@1agh/maude 0.56.0 → 0.57.0

package/apps/studio/test/acp-session-allowed-tools.test.ts

@@ -22,6 +22,11 @@
 //   (3) `WebSearch`/`WebFetch` (DDR-185) are present as bare native tool names
 //       — no prefix-matching involved, so no source-of-truth guard needed the
 //       way the Bash rules need one.
+//   (4) NO WRITE TOOL is on this list (feature-acp-write-path-scope). This
+//       file used to assert the exact opposite — that Edit/Write/NotebookEdit
+//       WERE present — so read the test's own comment before "restoring" it.
+//       Write auto-approval moved into the bridge's path gate, which is the
+//       only place a per-call target path exists; see acp-write-scope.test.ts.
 
 import { describe, expect, test } from 'bun:test';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
@@ -29,6 +34,7 @@ import { dirname, join } from 'node:path';
 
 import { MAUDE_DEFAULT_ALLOWED_TOOLS, newSessionParams } from '../acp/bridge.ts';
 import type { SdkPluginConfig } from '../acp/plugin-bootstrap.ts';
+import { WRITE_TOOL_NAMES } from '../acp/write-scope.ts';
 
 type Meta = {
   systemPrompt?: { append?: string };
@@ -73,12 +79,38 @@ describe('newSessionParams — allowedTools carrier shape (DDR-184)', () => {
 describe('MAUDE_DEFAULT_ALLOWED_TOOLS — source-of-truth guard (DDR-184 / DDR-062)', () => {
   const bashRules = MAUDE_DEFAULT_ALLOWED_TOOLS.filter((t) => t.startsWith('Bash'));
 
-  test('the canvas-editing file tools are all present', () => {
-    for (const t of ['Read', 'Edit', 'Write', 'Glob', 'Grep', 'NotebookEdit']) {
+  test('the READ-ONLY file tools are present', () => {
+    for (const t of ['Read', 'Glob', 'Grep']) {
       expect(MAUDE_DEFAULT_ALLOWED_TOOLS).toContain(t);
     }
   });
 
+  test('NO write tool is name-allowed — they are path-gated instead (feature-acp-write-path-scope)', () => {
+    // This assertion is the whole point of the change, so it is worth being
+    // explicit about WHY it inverts what this file used to assert.
+    //
+    // A bare tool name on this list means the CLI approves the call itself and
+    // `requestPermission` is NEVER invoked — so a path condition cannot be
+    // attached to an entry here, at all. Auto-approving a write therefore had
+    // to be moved into the bridge's own gate (`classifyWrite` →
+    // `writeTargetsInsideProject`), where a per-call path exists. DDR-184's
+    // no-prompt-per-edit outcome is fully preserved for in-project writes; what
+    // changed is that a write to `~/.zshenv` now prompts instead of landing
+    // silently with no rollback.
+    //
+    // If someone "fixes" a re-prompting regression by putting Write back on this
+    // list, this test is what tells them they just reopened the hole.
+    for (const t of [...WRITE_TOOL_NAMES]) {
+      expect(MAUDE_DEFAULT_ALLOWED_TOOLS).not.toContain(t);
+    }
+    // Guard the shape too — an `Edit(...)`-style scoped entry would also bypass
+    // the bridge gate, and `not.toContain` on the bare name would miss it.
+    for (const t of MAUDE_DEFAULT_ALLOWED_TOOLS) {
+      const bare = t.replace(/\(.*$/, '');
+      expect(WRITE_TOOL_NAMES.has(bare)).toBe(false);
+    }
+  });
+
   test('WebSearch and WebFetch are present (DDR-185)', () => {
     for (const t of ['WebSearch', 'WebFetch']) {
       expect(MAUDE_DEFAULT_ALLOWED_TOOLS).toContain(t);
@@ -98,18 +130,34 @@ describe('MAUDE_DEFAULT_ALLOWED_TOOLS — source-of-truth guard (DDR-184 / DDR-0
     //   - `Bash(find:*)` must NEVER appear — `find -exec` is unrestricted
     //     command execution, not "mutation"; there is no verb substitute, it
     //     is simply cut.
-    expect(bashRules).toEqual([
-      'Bash(maude:*)',
-      'Bash(ls:*)',
-      'Bash(cat:*)',
-      'Bash(pwd:*)',
-      'Bash(head:*)',
-      'Bash(tail:*)',
-      'Bash(wc:*)',
-      'Bash(tree:*)',
-      'Bash(file:*)',
-      'Bash(stat:*)',
-    ]);
+    //   - the read-only fs verb group must NEVER appear — every one of them
+    //     accepts `>`, making the rule an arbitrary-write grant. See the
+    //     dedicated test below.
+    expect(bashRules).toEqual(['Bash(maude:*)']);
+  });
+
+  test('NO redirect-capable bare-command Bash rule — `cat > file` is an arbitrary write (F1)', () => {
+    // SECURITY (security-auditor F1, PoC'd live against claude 2.1.220). The
+    // read-only fs group (ls/cat/pwd/head/tail/wc/tree/file/stat) USED to be on
+    // this list, justified as adding no incremental READ capability. True, and
+    // beside the point: Claude Code's `Bash(<cmd>:*)` prefix rule does not
+    // reject shell redirection, so `cat > ~/.zshenv <<'EOF' … EOF` matched
+    // `Bash(cat:*)`, was self-approved by the CLI, never reached
+    // `requestPermission`, and wrote model-authored arbitrary content to an
+    // arbitrary path — with no write tool involved at all. That is the A2
+    // primitive the write-path gate exists to close, reachable by a CHEAPER
+    // route than the write tools themselves.
+    //
+    // Cut rather than patched (same call DDR-185 made for `find` and
+    // `agent-browser`): a prefix rule cannot inspect what follows the command
+    // name, so there is nothing to patch. If they come back, they must come
+    // back as a hardened `maude design` wrapper verb, which CAN reject `>`.
+    //
+    // This test is what makes re-adding any of them a loud failure rather than
+    // a silent reopening of the hole.
+    for (const verb of ['ls', 'cat', 'pwd', 'head', 'tail', 'wc', 'tree', 'file', 'stat']) {
+      expect(MAUDE_DEFAULT_ALLOWED_TOOLS).not.toContain(`Bash(${verb}:*)`);
+    }
   });
 
   test('the `maude` Bash rule is load-bearing on DDR-062: every design helper is a `maude design <verb>`', () => {

package/apps/studio/test/acp-usage-bridge.test.ts

@@ -130,6 +130,11 @@ describe('Acp manager — usage frame is cached + replayed on a fresh socket (Ta
       acp.onClose(b.ws);
     } finally {
       acp.onClose(a.ws);
+      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
+      // the point: a page reload must not kill a running turn). So a test that
+      // relied on socket-close for teardown leaks the adapter subprocess for the
+      // whole DETACHED_TTL_MS. Tear down explicitly.
+      acp.stopAll();
       await new Promise((r) => setTimeout(r, 50));
     }
   }, 20000);

package/apps/studio/test/acp-write-gate.test.ts

@@ -0,0 +1,323 @@
+// feature-acp-write-path-scope — the gate proven END TO END through a real ACP
+// round-trip (fixtures/mock-acp-agent-write.mjs replays the adapter's measured
+// wire shape; see that file's header for where each field came from).
+//
+// acp-write-scope.test.ts covers the pure path logic. THIS file covers the part
+// that logic cannot see:
+//   • the tool NAME arriving only on a prior `tool_call` notification, and the
+//     gate failing closed when it doesn't;
+//   • the in-project write producing NO client frame at all (the DDR-184
+//     regression guard — a prompt here is the user-visible bug this whole
+//     feature promised not to introduce);
+//   • Decision D — `allow_always` stripped from an out-of-project write, AND
+//     rejected if a crafted response names it anyway;
+//   • Task 11 — a session pinned to project A prompting for a write into
+//     project B while B is the "open" project.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { RequestPermissionRequest } from '@agentclientprotocol/sdk';
+
+import { AcpBridge, type PermissionScopeInfo } from '../acp/bridge.ts';
+
+const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent-write.mjs');
+const TEST_ENV_KEYS = [
+  'MAUDE_ACP_ADAPTER_ENTRY',
+  'MAUDE_ACP_RUNTIME',
+  'MAUDE_CLAUDE_BIN',
+  'MAUDE_TEST_WRITE_PATH',
+  'MAUDE_TEST_WRITE_TOOL',
+  'MAUDE_TEST_OMIT_TOOL_CALL',
+];
+
+let tmp: string;
+let projectA: string;
+let projectB: string;
+
+beforeAll(() => {
+  // realpath the base — on macOS `/var` symlinks to `/private/var`, which would
+  // otherwise make every in-project case look like an escape.
+  tmp = realpathSync(mkdtempSync(join(tmpdir(), 'maude-write-gate-')));
+  projectA = join(tmp, 'project-a');
+  projectB = join(tmp, 'project-b');
+  mkdirSync(join(projectA, '.design', 'ui'), { recursive: true });
+  mkdirSync(projectB, { recursive: true });
+  writeFileSync(join(projectA, '.design', 'ui', 'home.tsx'), '// canvas\n');
+});
+
+afterAll(() => rmSync(tmp, { recursive: true, force: true }));
+
+afterEach(() => {
+  for (const key of TEST_ENV_KEYS) delete process.env[key];
+});
+
+function useWriteAgent(opts: { path: string; tool?: string; omitToolCall?: boolean }) {
+  process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+  process.env.MAUDE_ACP_RUNTIME = process.execPath;
+  process.env.MAUDE_CLAUDE_BIN = process.execPath;
+  process.env.MAUDE_TEST_WRITE_PATH = opts.path;
+  process.env.MAUDE_TEST_WRITE_TOOL = opts.tool ?? 'Write';
+  if (opts.omitToolCall) process.env.MAUDE_TEST_OMIT_TOOL_CALL = '1';
+}
+
+interface Captured {
+  id: string;
+  req: RequestPermissionRequest;
+  scope?: PermissionScopeInfo;
+}
+
+/** Run one turn against the fixture and report what the client SAW. `text` is
+ *  the mock's echo of the outcome it received, which is the only proof of what
+ *  the bridge actually answered the adapter. */
+async function runTurn(repoRoot: string, autoRespond?: (c: Captured) => string) {
+  const prompts: Captured[] = [];
+  const transparency: RequestPermissionRequest[] = [];
+  const updates: Array<{ content?: { text?: string } }> = [];
+  const bridge = new AcpBridge({
+    repoRoot,
+    permissionTimeoutMs: 4000,
+    onUpdate: (u) => updates.push(u as { content?: { text?: string } }),
+    onPermission: (req) => transparency.push(req),
+    onPermissionRequest: (id, req, scope) => {
+      const c = { id, req, scope };
+      prompts.push(c);
+      if (autoRespond) bridge.resolvePermission(id, autoRespond(c));
+    },
+  });
+  try {
+    await bridge.prompt('go', 'c1');
+    return {
+      prompts,
+      transparency,
+      outcome: updates.map((u) => u?.content?.text ?? '').join(''),
+      scopeRoot: bridge.writeScopeRoot,
+    };
+  } finally {
+    await bridge.stop();
+  }
+}
+
+describe('write gate — in-project writes never prompt (DDR-184 regression guard)', () => {
+  test('Write to an existing in-project file is auto-approved with NO client frame', async () => {
+    useWriteAgent({ path: join(projectA, '.design', 'ui', 'home.tsx') });
+    const r = await runTurn(projectA);
+    // The load-bearing assertion of this entire feature's "no friction" half:
+    // zero prompts forwarded to the UI.
+    expect(r.prompts).toHaveLength(0);
+    expect(r.outcome).toContain('"outcome":"selected"');
+    // Auto-approval uses the ONCE-only option, never `allow_always` — the
+    // latter makes the adapter install a session-wide standing rule for the
+    // tool NAME, which would silently restore the unscoped Write grant this
+    // change removes, from inside the code that removed it.
+    expect(r.outcome).toContain('"optionId":"allow"');
+    expect(r.outcome).not.toContain('allow_always');
+    // Transparency still fires for EVERY request regardless of how it resolves
+    // — auto-approving must not make a write invisible to an audit consumer.
+    expect(r.transparency).toHaveLength(1);
+  }, 20000);
+
+  test('Write to a NEW in-project file is auto-approved', async () => {
+    useWriteAgent({ path: join(projectA, '.design', 'ui', 'brand-new.tsx') });
+    const r = await runTurn(projectA);
+    expect(r.prompts).toHaveLength(0);
+    expect(r.outcome).toContain('"outcome":"selected"');
+  }, 20000);
+
+  test('Edit is gated the same way as Write', async () => {
+    useWriteAgent({ path: join(projectA, '.design', 'ui', 'home.tsx'), tool: 'Edit' });
+    const r = await runTurn(projectA);
+    expect(r.prompts).toHaveLength(0);
+  }, 20000);
+
+  test('NotebookEdit — no `locations` at all — is judged via rawInput.notebook_path', async () => {
+    useWriteAgent({ path: join(projectA, 'nb.ipynb'), tool: 'NotebookEdit' });
+    const r = await runTurn(projectA);
+    expect(r.prompts).toHaveLength(0);
+  }, 20000);
+});
+
+describe('write gate — out-of-project writes prompt', () => {
+  test('an absolute escape prompts and names the RESOLVED path', async () => {
+    useWriteAgent({ path: join(projectB, 'stolen.conf') });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    const { scope } = r.prompts[0];
+    expect(scope?.outOfProjectWrite).toBe(true);
+    expect(scope?.reason).toBe('outside');
+    expect(scope?.resolvedPaths).toEqual([join(projectB, 'stolen.conf')]);
+    expect(scope?.scopeRoot).toBe(projectA);
+  }, 20000);
+
+  test('a `../` escape prompts with the path RESOLVED, not as the model wrote it', async () => {
+    // `<projectA>/.design/../../project-b/stolen.conf` reads like a `.design`
+    // edit. Rendering the model's string is what makes the prompt useless.
+    const sneaky = join(projectA, '.design', '..', '..', 'project-b', 'stolen.conf');
+    useWriteAgent({ path: sneaky });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    expect(r.prompts[0].scope?.resolvedPaths).toEqual([join(projectB, 'stolen.conf')]);
+  }, 20000);
+
+  test('DECISION D — `allow_always` is stripped from the offered options', async () => {
+    useWriteAgent({ path: join(projectB, 'stolen.conf') });
+    const r = await runTurn(projectA, () => 'reject');
+    const kinds = r.prompts[0].req.options.map((o) => o.kind);
+    expect(kinds).not.toContain('allow_always');
+    // The reject path must survive the filter, or the card would have no way out.
+    expect(kinds).toContain('reject_once');
+    expect(kinds).toContain('allow_once');
+  }, 20000);
+
+  test('DECISION D — a crafted response naming `allow_always` FAILS CLOSED', async () => {
+    // Filtering the option out of the UI is cosmetic on its own; the control is
+    // that `resolvePermission` validates against the same filtered set, so a
+    // hand-written WS frame can't pin the option that was never offered.
+    useWriteAgent({ path: join(projectB, 'stolen.conf') });
+    const r = await runTurn(projectA, () => 'allow_always');
+    expect(r.outcome).toContain('"outcome":"cancelled"');
+    expect(r.outcome).not.toContain('allow_always');
+  }, 20000);
+
+  test('an out-of-project write CAN still be approved per-call', async () => {
+    // The gate is a consent boundary, not a prohibition — proving the allow
+    // path works matters as much as proving the deny path does.
+    useWriteAgent({ path: join(projectB, 'stolen.conf') });
+    const r = await runTurn(projectA, () => 'allow');
+    expect(r.outcome).toContain('"optionId":"allow"');
+  }, 20000);
+});
+
+describe('write gate — fail-closed shapes', () => {
+  test('a MISSING `tool_call` notification (no tool name) prompts instead of auto-approving', async () => {
+    // The tool name has exactly one carrier. If a future adapter reorders or
+    // drops that notification, the gate must degrade to "the user is asked" —
+    // never to a silent allow. An in-project path is used deliberately: this
+    // proves the miss itself is what forces the prompt.
+    useWriteAgent({ path: join(projectA, '.design', 'ui', 'home.tsx'), omitToolCall: true });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    // No `scope` — the gate never judged it as a write, so the client must NOT
+    // claim "outside this project" (it isn't; the name was simply unknown).
+    expect(r.prompts[0].scope).toBeUndefined();
+  }, 20000);
+
+  test('a READ tool with an out-of-project path is NOT treated as a write', async () => {
+    // Reads are deliberately unscoped (this change closes write egress, not
+    // read). Read isn't on the allow-list in this test's bridge either, so it
+    // prompts — but as an ORDINARY prompt, with no out-of-project write copy
+    // and no option filtering.
+    useWriteAgent({ path: join(projectB, 'secret.txt'), tool: 'Read' });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    expect(r.prompts[0].scope).toBeUndefined();
+    expect(r.prompts[0].req.options.map((o) => o.kind)).toContain('allow_always');
+  }, 20000);
+});
+
+describe('write gate — Task 11: the scope is the session origin project', () => {
+  test('a session created under project A prompts for a write into project B', async () => {
+    // Today a bridge's lifetime IS one project's lifetime, so this reads as
+    // belt-and-braces. It is the Addendum's load-bearing invariant: once a
+    // session survives a project switch, a gate that re-reads "the open
+    // project" would hand A's session write access to B silently.
+    useWriteAgent({ path: join(projectB, 'canvas.tsx') });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    expect(r.prompts[0].scope?.scopeRoot).toBe(projectA);
+    expect(r.scopeRoot).toBe(projectA);
+  }, 20000);
+
+  test('the pinned root is resolved once and exposed read-only', async () => {
+    useWriteAgent({ path: join(projectA, 'x.tsx') });
+    const bridge = new AcpBridge({ repoRoot: projectA, onUpdate: () => {} });
+    try {
+      expect(bridge.writeScopeRoot).toBe(projectA);
+      // No setter exists — the pin cannot be re-pointed at runtime, which is
+      // the whole mechanism behind Solution E.
+      expect(Object.getOwnPropertyDescriptor(bridge, 'writeScopeRoot')?.set).toBeUndefined();
+    } finally {
+      await bridge.stop();
+    }
+  });
+});
+
+describe('write gate — F2: granting is strict, warning is generous', () => {
+  test('an UNKNOWN-name out-of-project write still strips allow_always and names the path', async () => {
+    // SECURITY (security-auditor F2). The first cut coupled BOTH the grant and
+    // the hardening to the strict `WRITE_TOOL_NAMES` check, so a missed/evicted/
+    // reordered `tool_call` notification failed closed for the grant but OPEN
+    // for the hardening: no `scope` ⇒ `allow_always` was NOT stripped (one click
+    // installs a session-wide standing rule for Write — Decision D defeated) and
+    // the card fell back to the model's own `Write docs/../../../.zshenv`
+    // headline. The fixture omits the notification, so the name is genuinely
+    // unknown — exactly that state.
+    useWriteAgent({ path: join(projectB, 'stolen.conf'), omitToolCall: true });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    const { scope, req } = r.prompts[0];
+    // Warned about, despite the unknown name …
+    expect(scope?.outOfProjectWrite).toBe(true);
+    expect(scope?.resolvedPaths).toEqual([join(projectB, 'stolen.conf')]);
+    // … and Decision D still enforced.
+    expect(req.options.map((o) => o.kind)).not.toContain('allow_always');
+  }, 20000);
+
+  test('an unknown name is still NEVER granted, even in-project', async () => {
+    // The other half of the asymmetry: generosity applies only to warning.
+    // Auto-approval still requires a confirmed write tool.
+    useWriteAgent({ path: join(projectA, '.design', 'ui', 'home.tsx'), omitToolCall: true });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    // …and it must NOT claim "outside this project" — the file is inside; the
+    // NAME was the unknown. A false scope claim would be its own bug.
+    expect(r.prompts[0].scope).toBeUndefined();
+  }, 20000);
+
+  test('a READ of an out-of-project file is still NOT treated as a write', async () => {
+    // The heuristic is `kind:'edit'` / `notebook_path`, deliberately NOT "has a
+    // file_path" — Read carries one too, and would otherwise get the write copy
+    // plus a pointlessly stripped allow_always.
+    useWriteAgent({ path: join(projectB, 'secret.txt'), tool: 'Read', omitToolCall: true });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts[0].scope).toBeUndefined();
+    expect(r.prompts[0].req.options.map((o) => o.kind)).toContain('allow_always');
+  }, 20000);
+});
+
+describe('write gate — F6: `allow_always` is stripped from EVERY write-shaped card', () => {
+  test('an IN-PROJECT write-shaped card still offers no `allow_always`', async () => {
+    // SECURITY (security-auditor F6). The first cut tied the option filter to
+    // `info`, which is only set when the target is OUTSIDE the project. So an
+    // in-project write-shaped card that reached the prompt still offered
+    // `allow_always` — and selecting it makes the adapter install a
+    // `{type:'addRules', rules:[{toolName}]}` standing rule keyed by the tool
+    // NAME, carrying no path scope whatsoever. One click on an inside-the-
+    // project card therefore permanently permits every subsequent write by that
+    // tool, INCLUDING out-of-project ones: the whole gate, undone from the safe-
+    // looking side of it.
+    //
+    // `info` (copy — only truthful when outside) and `stripAlways` (control —
+    // needed whenever the call is write-shaped) are now separate.
+    //
+    // Reached via an unknown tool name so the call is write-SHAPED but not
+    // grantable, which is what puts an in-project write on a card at all.
+    useWriteAgent({ path: join(projectA, '.design', 'ui', 'home.tsx'), omitToolCall: true });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts).toHaveLength(1);
+    // No false "outside this project" claim — the file IS inside …
+    expect(r.prompts[0].scope).toBeUndefined();
+    // … and yet no standing-exemption option either.
+    expect(r.prompts[0].req.options.map((o) => o.kind)).not.toContain('allow_always');
+  }, 20000);
+
+  test('a NON-write tool keeps its `allow_always` — the strip is scoped to writes', async () => {
+    // Guard against over-correcting: stripping everywhere would quietly remove a
+    // legitimate affordance from every ordinary tool card.
+    useWriteAgent({ path: join(projectA, 'x.txt'), tool: 'Read', omitToolCall: true });
+    const r = await runTurn(projectA, () => 'reject');
+    expect(r.prompts[0].req.options.map((o) => o.kind)).toContain('allow_always');
+  }, 20000);
+});