@1agh/maude 0.56.0 → 0.58.0

package/apps/studio/test/acp-permission-prompt.test.ts

@@ -6,8 +6,15 @@
 // visually-primary button resolves to — a seam no backend test could see.
 
 import { describe, expect, test } from 'bun:test';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
 
-import { pickDefaultAllow, pickDefaultReject } from '../client/panels/PermissionPrompt.jsx';
+import PermissionPrompt, {
+  describeOutOfProject,
+  pickDefaultAllow,
+  pickDefaultReject,
+  sanitizePathForDisplay,
+} from '../client/panels/PermissionPrompt.jsx';
 
 describe('pickDefaultAllow', () => {
   test('prefers allow_once over allow_always, regardless of array order', () => {
@@ -75,3 +82,170 @@ describe('pickDefaultReject', () => {
     expect(pickDefaultReject(null)).toBeNull();
   });
 });
+
+// feature-acp-write-path-scope Task 4 — the out-of-project WRITE card.
+//
+// Same reasoning as the pickDefaultAllow suite above: the affordance IS the
+// security control. A card that renders the model's own path string, or that
+// still offers an "always allow", is a speed bump rather than a gate — and
+// neither failure is visible to any bridge-side test.
+const OUT_OF_PROJECT = {
+  outOfProjectWrite: true,
+  resolvedPaths: ['/Users/x/.zshenv'],
+  scopeRoot: '/Users/x/git/project',
+  reason: 'outside',
+};
+
+describe('describeOutOfProject', () => {
+  test('absent scope → null (an ordinary permission card is unchanged)', () => {
+    expect(describeOutOfProject(undefined)).toBeNull();
+    expect(describeOutOfProject(null)).toBeNull();
+    // A scope object that isn't explicitly flagged must NOT trigger the copy —
+    // the discriminator is checked, not merely the object's presence.
+    expect(describeOutOfProject({ resolvedPaths: ['/etc/passwd'] })).toBeNull();
+  });
+
+  test('carries the resolved paths + root verbatim', () => {
+    const d = describeOutOfProject(OUT_OF_PROJECT);
+    expect(d?.paths).toEqual(['/Users/x/.zshenv']);
+    expect(d?.scopeRoot).toBe('/Users/x/git/project');
+    expect(d?.lead).toContain('outside this project');
+  });
+
+  test('plural lead for a multi-target write', () => {
+    const d = describeOutOfProject({ ...OUT_OF_PROJECT, resolvedPaths: ['/a', '/b'] });
+    expect(d?.lead).toContain('files outside this project');
+  });
+
+  test('the fail-closed reasons get their own honest copy, not "outside"', () => {
+    // `no-target` and `disagreement` are NOT "the file is outside the project" —
+    // saying so would be a claim the server never made. They are "we could not
+    // tell what will be written", which is a different thing to ask a human about.
+    expect(describeOutOfProject({ ...OUT_OF_PROJECT, reason: 'no-target' })?.lead).toContain(
+      'did not say which one'
+    );
+    expect(describeOutOfProject({ ...OUT_OF_PROJECT, reason: 'disagreement' })?.lead).toContain(
+      'two different files'
+    );
+  });
+
+  test('tolerates a malformed resolvedPaths — never throws', () => {
+    expect(describeOutOfProject({ outOfProjectWrite: true })?.paths).toEqual([]);
+    expect(
+      describeOutOfProject({ outOfProjectWrite: true, resolvedPaths: [null, '', '/ok'] })?.paths
+    ).toEqual(['/ok']);
+  });
+});
+
+describe('PermissionPrompt — render', () => {
+  const OPTIONS = [
+    { optionId: 'allow_always', kind: 'allow_always', name: 'Always Allow' },
+    { optionId: 'allow', kind: 'allow_once', name: 'Allow' },
+    { optionId: 'reject', kind: 'reject_once', name: 'Reject' },
+  ];
+  const render = (request) =>
+    renderToStaticMarkup(createElement(PermissionPrompt, { request, onRespond: () => {} }));
+
+  test('an ORDINARY request renders the generic copy and every offered option', () => {
+    const out = render({ id: '1', toolCall: { title: 'Run command' }, options: OPTIONS });
+    expect(out).toContain('Claude wants permission to continue');
+    expect(out).not.toContain('chat-perm-outside');
+    expect(out).toContain('Always Allow');
+  });
+
+  test('an OUT-OF-PROJECT write renders the RESOLVED path, never the model string', () => {
+    const out = render({
+      id: '1',
+      // `rawInput.file_path` is the model-authored string. It reads like a docs
+      // edit; only the resolution tells the truth, so the card must show the
+      // latter. Same lesson as the deep-link modal's truncated project name.
+      toolCall: {
+        title: 'Write docs/../../../.zshenv',
+        rawInput: { file_path: 'docs/../../../.zshenv' },
+      },
+      options: OPTIONS,
+      scope: OUT_OF_PROJECT,
+    });
+    expect(out).toContain('/Users/x/.zshenv');
+    expect(out).not.toContain('docs/../../../.zshenv');
+    expect(out).toContain('outside this project');
+    expect(out).toContain('/Users/x/git/project');
+  });
+
+  test('DECISION D — the out-of-project card offers NO "always" option', () => {
+    const out = render({
+      id: '1',
+      toolCall: { title: 'Write' },
+      options: OPTIONS,
+      scope: OUT_OF_PROJECT,
+    });
+    expect(out).not.toContain('Always Allow');
+    expect(out).toContain('Allow');
+    expect(out).toContain('Reject');
+    expect(out).toContain('for this request only');
+  });
+
+  test('the out-of-project card is distinguishable, not just differently worded', () => {
+    // A card that LOOKS identical to the routine one gets clicked through at the
+    // same rate, which is the whole prompt-fatigue failure mode.
+    const out = render({
+      id: '1',
+      toolCall: { title: 'Write' },
+      options: OPTIONS,
+      scope: OUT_OF_PROJECT,
+    });
+    expect(out).toContain('chat-perm--outside');
+    expect(out).toContain('file outside this project'); // aria-label
+  });
+});
+
+// SECURITY (security-auditor F3) — the resolved path's non-existent tail is
+// whatever the model asked to create, so it is attacker-influenced text in the
+// one card whose entire job is to be read accurately. React escapes markup; it
+// does NOT neutralize bidi overrides, so a path can be made to READ as harmless
+// while resolving somewhere else. Written as \u escapes on purpose: a literal
+// override in this source would reorder the test file itself in every editor.
+const RLO = '\u202E';
+const PDF = '\u202C';
+
+describe('sanitizePathForDisplay (F3)', () => {
+  test('neutralizes bidi overrides — the visual-spoofing primitive', () => {
+    const out = sanitizePathForDisplay(`/Users/x/safe/${RLO}gnp.esriv${PDF}`);
+    expect(out).not.toContain(RLO);
+    expect(out).not.toContain(PDF);
+    // Replaced, not deleted — a tampered path should look ODD, not just shorter.
+    expect(out).toContain('\uFFFD');
+  });
+
+  test('neutralizes C0 controls (newline/CR can hide a whole path segment)', () => {
+    const out = sanitizePathForDisplay('/Users/x/a\nb\rc');
+    expect(out).not.toMatch(/[\n\r]/);
+  });
+
+  test('also covers zero-width, directional marks and soft hyphen (F3 nit)', () => {
+    // Zero-width joiners and directional marks are invisible, so they can split
+    // or re-order a path name without leaving any visible trace at all — the
+    // same class of trick as the overrides, just quieter.
+    const sneaky = '/Users/x/\u200Bzsh\u200Cenv\u061C\u00AD';
+    const out = sanitizePathForDisplay(sneaky);
+    for (const ch of ['\u200B', '\u200C', '\u061C', '\u00AD']) {
+      expect(out).not.toContain(ch);
+    }
+  });
+
+  test('leaves an ordinary path completely untouched', () => {
+    const p = '/Users/x/git/project/.design/ui/home.tsx';
+    expect(sanitizePathForDisplay(p)).toBe(p);
+  });
+
+  test('describeOutOfProject sanitizes BOTH the paths and the scope root', () => {
+    const d = describeOutOfProject({
+      outOfProjectWrite: true,
+      reason: 'outside',
+      resolvedPaths: [`/Users/x/${RLO}evil`],
+      scopeRoot: `/Users/x/${RLO}root`,
+    });
+    expect(d.paths[0]).not.toContain(RLO);
+    expect(d.scopeRoot).not.toContain(RLO);
+  });
+});

package/apps/studio/test/acp-permission.test.ts

@@ -75,7 +75,14 @@ describe('AcpBridge — permission approve/deny (Task B1)', () => {
       const promptPromise = bridge.prompt('hi', 'c1');
       const req = await until(() => (requests.length ? requests[0] : undefined));
       expect(req.toolCallTitle).toBe('Write file');
-      expect(req.optionIds).toEqual(['allow-once', 'allow-always', 'reject-once']);
+      // `allow-always` is ABSENT, and that is the point (feature-acp-write-path-
+      // scope Decision D + security-auditor F2). This fixture's tool call is
+      // `kind:'edit'` targeting `/tmp/x` — a write-shaped call landing OUTSIDE
+      // the bridge's project root — so the bridge strips every `allow_always`
+      // option before offering it, and validates any response against that same
+      // filtered set. Consent for an out-of-project write is per-call; one click
+      // must not be able to install a session-wide standing rule.
+      expect(req.optionIds).toEqual(['allow-once', 'reject-once']);
       expect(transparency.length).toBe(1); // transparency fires unconditionally too
 
       bridge.resolvePermission(req.id, 'allow-once');
@@ -191,7 +198,11 @@ describe('Acp manager — permission-request/-response frames (Task B2)', () =>
       const reqFrame = await until(() => a.frames.find((f) => f.t === 'permission-request'));
       expect(reqFrame.toolCall).toMatchObject({ title: 'Write file' });
       const options = reqFrame.options as Array<{ optionId: string }>;
-      expect(options.map((o) => o.optionId)).toEqual(['allow-once', 'allow-always', 'reject-once']);
+      // See the Task B1 test above — `allow-always` is stripped for this
+      // out-of-project write-shaped call, and the FRAME carries the filtered
+      // set, so the client is shown the real options rather than a cosmetic
+      // subset the server would then reject.
+      expect(options.map((o) => o.optionId)).toEqual(['allow-once', 'reject-once']);
 
       acp.onMessage(
         a.ws,
@@ -200,6 +211,11 @@ describe('Acp manager — permission-request/-response frames (Task B2)', () =>
       await until(() => a.frames.find((f) => f.t === 'turn-end'));
     } finally {
       acp.onClose(a.ws);
+      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
+      // the point: a page reload must not kill a running turn). So a test that
+      // relied on socket-close for teardown leaks the adapter subprocess for the
+      // whole DETACHED_TTL_MS. Tear down explicitly.
+      acp.stopAll();
       await new Promise((r) => setTimeout(r, 50));
     }
   }, 20000);

package/apps/studio/test/acp-session-allowed-tools.test.ts

@@ -22,6 +22,11 @@
 //   (3) `WebSearch`/`WebFetch` (DDR-185) are present as bare native tool names
 //       — no prefix-matching involved, so no source-of-truth guard needed the
 //       way the Bash rules need one.
+//   (4) NO WRITE TOOL is on this list (feature-acp-write-path-scope). This
+//       file used to assert the exact opposite — that Edit/Write/NotebookEdit
+//       WERE present — so read the test's own comment before "restoring" it.
+//       Write auto-approval moved into the bridge's path gate, which is the
+//       only place a per-call target path exists; see acp-write-scope.test.ts.
 
 import { describe, expect, test } from 'bun:test';
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
@@ -29,6 +34,7 @@ import { dirname, join } from 'node:path';
 
 import { MAUDE_DEFAULT_ALLOWED_TOOLS, newSessionParams } from '../acp/bridge.ts';
 import type { SdkPluginConfig } from '../acp/plugin-bootstrap.ts';
+import { WRITE_TOOL_NAMES } from '../acp/write-scope.ts';
 
 type Meta = {
   systemPrompt?: { append?: string };
@@ -73,12 +79,38 @@ describe('newSessionParams — allowedTools carrier shape (DDR-184)', () => {
 describe('MAUDE_DEFAULT_ALLOWED_TOOLS — source-of-truth guard (DDR-184 / DDR-062)', () => {
   const bashRules = MAUDE_DEFAULT_ALLOWED_TOOLS.filter((t) => t.startsWith('Bash'));
 
-  test('the canvas-editing file tools are all present', () => {
-    for (const t of ['Read', 'Edit', 'Write', 'Glob', 'Grep', 'NotebookEdit']) {
+  test('the READ-ONLY file tools are present', () => {
+    for (const t of ['Read', 'Glob', 'Grep']) {
       expect(MAUDE_DEFAULT_ALLOWED_TOOLS).toContain(t);
     }
   });
 
+  test('NO write tool is name-allowed — they are path-gated instead (feature-acp-write-path-scope)', () => {
+    // This assertion is the whole point of the change, so it is worth being
+    // explicit about WHY it inverts what this file used to assert.
+    //
+    // A bare tool name on this list means the CLI approves the call itself and
+    // `requestPermission` is NEVER invoked — so a path condition cannot be
+    // attached to an entry here, at all. Auto-approving a write therefore had
+    // to be moved into the bridge's own gate (`classifyWrite` →
+    // `writeTargetsInsideProject`), where a per-call path exists. DDR-184's
+    // no-prompt-per-edit outcome is fully preserved for in-project writes; what
+    // changed is that a write to `~/.zshenv` now prompts instead of landing
+    // silently with no rollback.
+    //
+    // If someone "fixes" a re-prompting regression by putting Write back on this
+    // list, this test is what tells them they just reopened the hole.
+    for (const t of [...WRITE_TOOL_NAMES]) {
+      expect(MAUDE_DEFAULT_ALLOWED_TOOLS).not.toContain(t);
+    }
+    // Guard the shape too — an `Edit(...)`-style scoped entry would also bypass
+    // the bridge gate, and `not.toContain` on the bare name would miss it.
+    for (const t of MAUDE_DEFAULT_ALLOWED_TOOLS) {
+      const bare = t.replace(/\(.*$/, '');
+      expect(WRITE_TOOL_NAMES.has(bare)).toBe(false);
+    }
+  });
+
   test('WebSearch and WebFetch are present (DDR-185)', () => {
     for (const t of ['WebSearch', 'WebFetch']) {
       expect(MAUDE_DEFAULT_ALLOWED_TOOLS).toContain(t);
@@ -98,18 +130,34 @@ describe('MAUDE_DEFAULT_ALLOWED_TOOLS — source-of-truth guard (DDR-184 / DDR-0
     //   - `Bash(find:*)` must NEVER appear — `find -exec` is unrestricted
     //     command execution, not "mutation"; there is no verb substitute, it
     //     is simply cut.
-    expect(bashRules).toEqual([
-      'Bash(maude:*)',
-      'Bash(ls:*)',
-      'Bash(cat:*)',
-      'Bash(pwd:*)',
-      'Bash(head:*)',
-      'Bash(tail:*)',
-      'Bash(wc:*)',
-      'Bash(tree:*)',
-      'Bash(file:*)',
-      'Bash(stat:*)',
-    ]);
+    //   - the read-only fs verb group must NEVER appear — every one of them
+    //     accepts `>`, making the rule an arbitrary-write grant. See the
+    //     dedicated test below.
+    expect(bashRules).toEqual(['Bash(maude:*)']);
+  });
+
+  test('NO redirect-capable bare-command Bash rule — `cat > file` is an arbitrary write (F1)', () => {
+    // SECURITY (security-auditor F1, PoC'd live against claude 2.1.220). The
+    // read-only fs group (ls/cat/pwd/head/tail/wc/tree/file/stat) USED to be on
+    // this list, justified as adding no incremental READ capability. True, and
+    // beside the point: Claude Code's `Bash(<cmd>:*)` prefix rule does not
+    // reject shell redirection, so `cat > ~/.zshenv <<'EOF' … EOF` matched
+    // `Bash(cat:*)`, was self-approved by the CLI, never reached
+    // `requestPermission`, and wrote model-authored arbitrary content to an
+    // arbitrary path — with no write tool involved at all. That is the A2
+    // primitive the write-path gate exists to close, reachable by a CHEAPER
+    // route than the write tools themselves.
+    //
+    // Cut rather than patched (same call DDR-185 made for `find` and
+    // `agent-browser`): a prefix rule cannot inspect what follows the command
+    // name, so there is nothing to patch. If they come back, they must come
+    // back as a hardened `maude design` wrapper verb, which CAN reject `>`.
+    //
+    // This test is what makes re-adding any of them a loud failure rather than
+    // a silent reopening of the hole.
+    for (const verb of ['ls', 'cat', 'pwd', 'head', 'tail', 'wc', 'tree', 'file', 'stat']) {
+      expect(MAUDE_DEFAULT_ALLOWED_TOOLS).not.toContain(`Bash(${verb}:*)`);
+    }
   });
 
   test('the `maude` Bash rule is load-bearing on DDR-062: every design helper is a `maude design <verb>`', () => {

package/apps/studio/test/acp-usage-bridge.test.ts

@@ -130,6 +130,11 @@ describe('Acp manager — usage frame is cached + replayed on a fresh socket (Ta
       acp.onClose(b.ws);
     } finally {
       acp.onClose(a.ws);
+      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
+      // the point: a page reload must not kill a running turn). So a test that
+      // relied on socket-close for teardown leaks the adapter subprocess for the
+      // whole DETACHED_TTL_MS. Tear down explicitly.
+      acp.stopAll();
       await new Promise((r) => setTimeout(r, 50));
     }
   }, 20000);