@1agh/maude 0.55.0 → 0.57.0

package/apps/studio/client/panels/PermissionPrompt.jsx

@@ -54,10 +54,102 @@ export function pickDefaultReject(options) {
   return list.find((o) => o?.kind === 'reject_once' || o?.kind === 'reject_always') ?? null;
 }
 
+// feature-acp-write-path-scope Task 4 — the out-of-project write case.
+//
+// `scope` is attached by the SERVER (bridge.ts `classifyWrite` → index.ts's
+// `permission-request` frame) and only ever for a write tool the path gate
+// refused to auto-approve. Everything this renders comes from that payload: the
+// paths are the bridge's REALPATH-RESOLVED absolutes, never `toolCall.rawInput`,
+// because the model's own string is what makes the write look harmless
+// (`docs/../../../.zshenv` reads as a docs edit). Same lesson as the deep-link
+// modal's truncated project name.
+//
+// Exported pure so the copy is unit-testable without rendering (mirrors
+// pickDefaultAllow's rationale — the affordance IS the security control here).
+// SECURITY (security-auditor F3) — the resolved path is REAL filesystem data,
+// but its non-existent tail is whatever the model asked to create, so it is
+// attacker-influenced text rendered in the one card whose entire job is to be
+// read accurately. React escapes markup; it does NOT neutralize bidi overrides
+// or C0 controls, so `~/safe/‮gnp.esriv/…` can be made to READ as a
+// harmless path while resolving somewhere else entirely.
+//
+// Stripped at RENDER time rather than in the frame: the frame should carry the
+// true path (it is also an audit record), and only the display needs to be
+// unspoofable. Replaced with U+FFFD rather than deleted so a tampered path is
+// visibly odd instead of silently shorter.
+// Written as \u escapes, never literal characters (security-auditor F3 nit) —
+// the same reasoning applied to the tests: a literal RLO in this source would
+// reorder THIS FILE in every editor and code-review diff that renders it.
+//   \p{Cc}          C0/C1 controls (newline, CR, NUL — hide a whole segment)
+//   202A-202E,2066-2069  bidi embeddings/overrides/isolates (visual reversal)
+//   200E,200F,061C  LRM/RLM/ALM — directional marks, same class of trick
+//   200B-200D,FEFF  zero-width space/non-joiner/joiner/BOM (invisible splits)
+//   00AD            soft hyphen (invisible, but may render as a break)
+const UNSAFE_DISPLAY =
+  /[\p{Cc}\u202A-\u202E\u2066-\u2069\u200E\u200F\u061C\u200B-\u200D\uFEFF\u00AD]/gu;
+export function sanitizePathForDisplay(p) {
+  return String(p).replace(UNSAFE_DISPLAY, '�');
+}
+
+export function describeOutOfProject(scope) {
+  if (!scope || scope.outOfProjectWrite !== true) return null;
+  const paths = Array.isArray(scope.resolvedPaths)
+    ? scope.resolvedPaths.filter(Boolean).map(sanitizePathForDisplay)
+    : [];
+  const lead =
+    scope.reason === 'no-target'
+      ? 'Claude asked to write a file but did not say which one.'
+      : scope.reason === 'disagreement'
+        ? 'Claude named two different files for one write.'
+        : // `in-project-denied` is INSIDE the project — saying "outside" would be
+          // a plain lie, and the reason it's being asked about is different in
+          // kind: not "where is this going" but "this file runs".
+          scope.reason === 'in-project-denied'
+          ? 'This file is part of how your project RUNS, not part of its design.'
+          : paths.length > 1
+            ? 'Claude wants to write files outside this project.'
+            : 'Claude wants to write a file outside this project.';
+  return {
+    lead,
+    paths,
+    scopeRoot: typeof scope.scopeRoot === 'string' ? sanitizePathForDisplay(scope.scopeRoot) : '',
+    // Decision D — the server already stripped every `allow_always` option, so
+    // there is no "always allow" to explain away. Say so, rather than leaving
+    // the user wondering where the usual option went.
+    note: 'This is allowed once, for this request only.',
+    /** Inside the project, but denied for an execution reason — the copy above
+     *  must not claim "outside". */
+    inProjectDenied: scope.reason === 'in-project-denied',
+  };
+}
+
+// Decision D is enforced SERVER-side (bridge.ts filters `allow_always` out of
+// the offered set, and validates a response against that same filtered set).
+// This is a second, client-side pass purely so a stale/racing frame can never
+// paint a button that the server would reject anyway — belt-and-braces, not the
+// control itself.
+function visibleOptions(options, outOfProject) {
+  const list = Array.isArray(options) ? options : [];
+  return outOfProject ? list.filter((o) => o?.kind !== 'allow_always') : list;
+}
+
 export default function PermissionPrompt({ request, onRespond, queueLength = 1 }) {
   const cardRef = useRef(null);
-  const { toolCall, options } = request;
+  const { toolCall } = request;
   const target = toolTarget(toolCall);
+  const outOfProject = describeOutOfProject(request.scope);
+  const options = visibleOptions(request.options, !!outOfProject);
+  // See the header comment in the JSX below for why an out-of-project write
+  // gets a substituted headline + target instead of the adapter's own.
+  const headline =
+    request.scope?.reason === 'in-project-denied'
+      ? 'Write to a file that runs'
+      : 'Write outside this project';
+  const headerTarget = outOfProject
+    ? outOfProject.paths.length === 1
+      ? String(outOfProject.paths[0]).split('/').pop()
+      : null
+    : target;
 
   const firstAllow = pickDefaultAllow(options);
   const firstReject = pickDefaultReject(options);
@@ -81,16 +173,33 @@ export default function PermissionPrompt({ request, onRespond, queueLength = 1 }
 
   return (
     <div
-      className="chat-perm"
+      className={'chat-perm' + (outOfProject ? ' chat-perm--outside' : '')}
       role="alertdialog"
-      aria-label="Permission request"
+      aria-label={
+        outOfProject
+          ? outOfProject.inProjectDenied
+            ? 'Permission request — file that runs code'
+            : 'Permission request — file outside this project'
+          : 'Permission request'
+      }
       tabIndex={-1}
       ref={cardRef}
       data-testid="chat-permission-prompt"
     >
       <div className="chat-perm-hd">
-        <b title={toolCall?.title || 'Tool call'}>{toolCall?.title || 'Tool call'}</b>
-        {target ? <span className="chat-tool-path">{target}</span> : null}
+        {/* SECURITY (feature-acp-write-path-scope Task 4) — for an out-of-project
+            write the header must NOT echo `toolCall.title`/`rawInput`. Both are
+            built from the model's own path string, and the adapter passes it
+            through verbatim (see acp/write-scope.ts's measured contract), so the
+            title of a write to `~/.zshenv` reads literally "Write
+            docs/../../../.zshenv" — a docs edit, to any human skimming the
+            header. The card's whole job is to be read; a truthful body under a
+            misleading headline is worse than no headline. Substitute a fixed
+            label + the RESOLVED basename, and let the body carry the full path. */}
+        <b title={outOfProject ? headline : toolCall?.title || 'Tool call'}>
+          {outOfProject ? headline : toolCall?.title || 'Tool call'}
+        </b>
+        {headerTarget ? <span className="chat-tool-path">{headerTarget}</span> : null}
         {/* SECURITY (ethical-hacker finding) — a growing backlog was
             invisible (always "1 of 1"), which is what manufactures the
             reflexive-Enter-mashing precondition the wrong-default bug
@@ -101,7 +210,38 @@ export default function PermissionPrompt({ request, onRespond, queueLength = 1 }
           </span>
         ) : null}
       </div>
-      <p className="chat-perm-body">Claude wants permission to continue. Choose an option:</p>
+      {outOfProject ? (
+        <div className="chat-perm-outside" data-testid="chat-perm-outside">
+          <p className="chat-perm-body">{outOfProject.lead}</p>
+          {outOfProject.paths.length > 0 ? (
+            <ul className="chat-perm-paths" data-testid="chat-perm-paths">
+              {outOfProject.paths.map((p) => (
+                <li key={p} className="chat-perm-path">
+                  {p}
+                </li>
+              ))}
+            </ul>
+          ) : null}
+          {outOfProject.scopeRoot ? (
+            <p className="chat-perm-scope">
+              {outOfProject.inProjectDenied ? (
+                <>
+                  Git hooks and Claude settings can execute code later, so Maude asks even
+                  though they live inside this project.
+                </>
+              ) : (
+                <>
+                  This project is <span className="chat-perm-root">{outOfProject.scopeRoot}</span>.
+                  Edits inside it never ask.
+                </>
+              )}
+            </p>
+          ) : null}
+          <p className="chat-perm-note">{outOfProject.note}</p>
+        </div>
+      ) : (
+        <p className="chat-perm-body">Claude wants permission to continue. Choose an option:</p>
+      )}
       <div className="chat-perm-actions">
         {options.map((o) => (
           <button

package/apps/studio/client/panels/RepoBranchSwitcher.jsx

@@ -97,6 +97,30 @@ async function postJson(url, body, opts = {}) {
   }
 }
 
+/**
+ * Copy for the "a chat is mid-turn" confirm (Addendum Task 9). Pure + exported
+ * so the WORDING is unit-testable without rendering the switcher (which needs a
+ * native shim and three fetches on mount) — same rationale as
+ * PermissionPrompt.jsx's `pickDefaultAllow`/`describeOutOfProject`: on a safety
+ * prompt the affordance IS the control, so the words are worth a test.
+ *
+ * The wording is deliberately "is editing files on this branch", NOT "this will
+ * stop it". Before Task 8 the reload genuinely killed the turn and "will stop
+ * it" was true; now the bridge outlives its socket, so the turn KEEPS GOING —
+ * into a worktree that has moved under it. Saying "will stop it" would now be
+ * false in the reassuring direction, which is the worst way for a safety prompt
+ * to be wrong.
+ */
+export function chatGuardCopy({ count, branch, verb }) {
+  return {
+    title: count > 1 ? `${count} chats are working right now` : 'A chat is working right now',
+    body: `Claude is editing files on ${branch}. If you ${verb} now, those edits can land on the wrong branch — and Maude's History can't undo a cross-branch mix-up.`,
+    meta: 'Safest is to wait for the chat to finish, or stop it yourself first.',
+    confirm: 'Do it anyway',
+    cancel: 'Wait',
+  };
+}
+
 export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, onGetLatest }) {
   const native = isNativeApp();
   const [status, setStatus] = useState(null); // { repo, branch }
@@ -115,6 +139,9 @@ export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, on
   const [pulling, setPulling] = useState(false);
   // "Continue on <draft>?" nudge — dismissed for this session once the user opts out.
   const [resumeDismissed, setResumeDismissed] = useState(false);
+  // Task 9 — a pending branch change held back because a chat is mid-turn:
+  // `{ count, verb, action }`. Null when nothing is being confirmed.
+  const [chatGuard, setChatGuard] = useState(null);
 
   // Open the PR in the OS browser. A WKWebView anchor can't reach the default browser,
   // so native goes through the Tauri opener (github.com host-locked in Rust); an older
@@ -241,9 +268,52 @@ export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, on
     catch { /* not a repo / offline — keep the prior list, never blank it */ }
   }
 
-  async function switchDraft(name, where) {
-    setOpen(false);
-    if (name === branch) return;
+  // ── Task 9: warn before a branch change moves the ground under a live turn ──
+  //
+  // THREE call sites reload, not one — `switchDraft`, `createDraft` and the
+  // local-merge fold in `foldDraft`. All three need the gate; missing one is the
+  // easy mistake here.
+  //
+  // Task 8 means the reload itself no longer KILLS the chat (the bridge outlives
+  // its socket now). That makes this warning MORE necessary, not less: the turn
+  // survives into a worktree that is no longer the one it was reasoning about.
+  // The agent read `foo.tsx` on this draft and will write it back after the
+  // checkout — a silent cross-branch clobber. And the "it's reversible" story
+  // this whole feature leans on degrades exactly here, because the `_history/`
+  // snapshot stack is per-canvas-slug with NO branch awareness.
+  //
+  // Asked of the SERVER, not of local chat state: a bridge can be running
+  // detached (post-reload, pre-re-attach) with no client that knows about it —
+  // precisely the case this warning is for.
+  async function chatsRunning() {
+    try {
+      const r = await fetch('/_api/acp/running');
+      if (!r.ok) return 0;
+      const j = await r.json();
+      return Number(j?.running) || 0;
+    } catch {
+      // Never block a branch switch because the probe failed — a switch the
+      // user asked for must not be hostage to an unrelated fetch error.
+      return 0;
+    }
+  }
+
+  /** Run `action` after an explicit confirm if a turn is in flight. Resolves
+   *  the pending action into state so the sheet below can render it; the sheet
+   *  calls back in on confirm. */
+  async function guardedByChat(action, verb) {
+    const n = await chatsRunning();
+    if (n === 0) {
+      action();
+      return;
+    }
+    setChatGuard({ count: n, verb, action });
+  }
+
+  // The raw action. Every caller goes through the guarded wrapper below — the
+  // warning has to happen BEFORE the checkout, since warning after the worktree
+  // already moved would be theatre.
+  async function doSwitchDraft(name, where) {
     setSwitching(name);
     setDownloading(where === 'remote'); // a remote-only branch is downloaded on switch
     setErr('');
@@ -252,6 +322,12 @@ export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, on
     else { setErr(r.json?.error || 'Could not switch.'); setSwitching(''); setDownloading(false); }
   }
 
+  async function switchDraft(name, where) {
+    setOpen(false);
+    if (name === branch) return;
+    await guardedByChat(() => doSwitchDraft(name, where), `switch to “${name}”`);
+  }
+
   // "Fetch remote branches" — fetch all remote heads so a teammate's new branch
   // surfaces, then re-read the list. Explicit gesture (never auto-run); token is
   // server-held. A failure surfaces as an in-popup notice (DDR-133) — it NEVER
@@ -271,15 +347,21 @@ export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, on
     setRefreshing(false);
   }
 
-  async function createDraft() {
-    const name = slugify(draftName);
-    if (!name) return;
+  async function doCreateDraft(name) {
     setBusy(true); setErr('');
     const r = await postJson('/_api/git/branch', { name });
     if (r.ok && r.json?.ok) window.location.reload();
     else { setErr(r.json?.error || 'Could not create the draft.'); setBusy(false); }
   }
 
+  // Call site 2 of 3 — creating a branch checks it out, so it moves the
+  // worktree exactly like a switch does.
+  async function createDraft() {
+    const name = slugify(draftName);
+    if (!name) return;
+    await guardedByChat(() => doCreateDraft(name), `create “${name}”`);
+  }
+
   // "Get latest" from the dock nudge — pull the shared version's new commits. Reuses
   // the app's pull handler (onGetLatest = gitGetLatest): on success it re-probes so the
   // nudge clears; a content conflict opens the visual resolver (handled in app.jsx).
@@ -297,7 +379,15 @@ export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, on
   // opens a pull request (the merge happens on GitHub, post-review) — surface the PR
   // link and keep the sheet open. A local project merges directly (reload). A draft that
   // pushed but couldn't open a PR (no sign-in / non-github) shows a heads-up.
+  // Call site 3 of 3 — the LOCAL-merge path reloads (the GitHub-remote path
+  // opens a PR and stays put). Guarded as a whole rather than only around the
+  // reload: a merge landing under a running agent is the same hazard whether or
+  // not the page happens to reload afterward.
   async function foldDraft() {
+    await guardedByChat(doFoldDraft, `merge “${branch}” into ${sharedName}`);
+  }
+
+  async function doFoldDraft() {
     setFolding(branch);
     setErr('');
     const r = await postJson('/_api/git/fold', { name: branch }, { timeoutMs: 45000 });
@@ -339,6 +429,10 @@ export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, on
   }
 
   const slug = slugify(draftName);
+  // Task 9 — the confirm's words, from the pure helper above so they stay testable.
+  const guardCopy = chatGuard
+    ? chatGuardCopy({ count: chatGuard.count, branch, verb: chatGuard.verb })
+    : null;
   const currentDraft = onShared ? null : branches.find((b) => b.current);
   // On the Shared version with a draft around? Offer to jump back to the most
   // recently-worked local draft. Maude shows whatever branch HEAD is, so after a
@@ -544,6 +638,51 @@ export default function RepoBranchSwitcher({ project, liveBranch, remoteSync, on
         {err && !open && !newDraft && !switching && <div className="rb-switcher-err" role="alert">{err}</div>}
       </div>
 
+      {/* Task 9 — a chat is mid-turn and the user asked for something that moves
+          the worktree. Silently reloading is the ONE outcome the Addendum calls
+          unacceptable, so this is an explicit confirm, not a toast. */}
+      {chatGuard && guardCopy && (
+        <div className="rb-scrim" role="presentation" onClick={() => setChatGuard(null)}>
+          <div
+            className="rb-sheet"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="rb-chatguard-title"
+            aria-describedby="rb-chatguard-body"
+            data-testid="switcher-chat-guard"
+            onClick={(e) => e.stopPropagation()}
+            onKeyDown={(e) => { if (e.key === 'Escape') setChatGuard(null); }}
+          >
+            <span className="rb-sheet-icon"><Icon name="draft" size={20} /></span>
+            <h2 className="rb-sheet-title" id="rb-chatguard-title">{guardCopy.title}</h2>
+            <p className="rb-sheet-body" id="rb-chatguard-body">{guardCopy.body}</p>
+            <p className="rb-sheet-meta">{guardCopy.meta}</p>
+            <div className="rb-sheet-actions">
+              <button
+                type="button"
+                className="btn btn--ghost"
+                data-testid="switcher-chat-guard-cancel"
+                onClick={() => setChatGuard(null)}
+              >
+                {guardCopy.cancel}
+              </button>
+              <button
+                type="button"
+                className="btn btn--danger"
+                data-testid="switcher-chat-guard-confirm"
+                onClick={() => {
+                  const { action } = chatGuard;
+                  setChatGuard(null);
+                  action();
+                }}
+              >
+                {guardCopy.confirm}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
       {/* Add-to-default confirm — the one modal in this surface. No 3-way merge UI.
           After a GitHub-remote fold it flips to a pull-request result view (DDR-162). */}
       {foldConfirm && (