@1agh/maude 0.58.1 → 0.58.2

package/apps/studio/.ai/cache/_stats.json

@@ -1,7 +1,7 @@
 {
   "hits": {},
   "misses": {
-    "security": 1
+    "security": 2
   },
   "since": 1783681711349
 }

package/apps/studio/acp/bridge.ts

@@ -147,6 +147,8 @@ export interface AcpBridgeOptions {
   onUsage?: (usage: BridgeUsage) => void;
   /** Override for `PERMISSION_TIMEOUT_MS` (tests only — production always gets the real default). */
   permissionTimeoutMs?: number;
+  /** Override for `CANCEL_ESCALATION_MS` (tests only — production always gets the real default). */
+  cancelEscalationMs?: number;
 }
 
 /**
@@ -561,6 +563,16 @@ export function newSessionParams(
 // the security control, so failing open would defeat the point.
 const PERMISSION_TIMEOUT_MS = 120_000;
 
+// SECURITY/RELIABILITY (issue-82) — how long cancel() waits for the
+// in-flight turn to actually END after asking the adapter cooperatively,
+// before forcing it to end itself. A wedged subprocess — or one that never
+// implemented `session/cancel` at all — must not be able to leave the Stop
+// button permanently inert (see `cancel()`'s doc comment). Bounded like
+// PERMISSION_TIMEOUT_MS/INITIALIZE_TIMEOUT_MS above: generous enough not to
+// misfire on a merely-slow cancel ack, short enough that Stop still feels
+// responsive.
+const CANCEL_ESCALATION_MS = 5_000;
+
 // SECURITY (ethical-hacker finding, retroactive review) — a single agent turn
 // can legitimately issue several tool calls back to back (a burst is normal
 // agent behavior, not a bug — e.g. prompt-injected content directing several
@@ -624,6 +636,32 @@ export class AcpBridge {
   // running establishSession() and stomping the single shared `replaying` flag.
   private sessionPromises = new Map<string, Promise<string>>();
   private currentSession: string | null = null; // the in-flight prompt's session
+  // issue-82 — every prompt() call currently racing a forced-cancellation
+  // (see `prompt()`), so cancel()/stop() can force ANY of them to settle
+  // when the adapter doesn't cooperate, instead of leaving one hanging
+  // forever. A Set, not a single field, on purpose (ethical-hacker finding):
+  // `handlePrompt` has no reentrancy guard, so a duplicate/replayed `prompt`
+  // frame for the same chat can start a SECOND overlapping turn on this
+  // bridge. A singleton field would be silently overwritten by the second
+  // turn's registration and then nulled by whichever turn settles first —
+  // even a normal, uncancelled completion — leaving an EARLIER, genuinely
+  // wedged turn permanently unescalatable and reopening this exact bug.
+  // Tracking every in-flight turn means cancel() always finds (and can
+  // force-end) whichever one is actually stuck, regardless of ordering.
+  private pendingTurns = new Set<{ reject: (err: Error) => void; settled: Promise<void> }>();
+  // issue-82 / ethical-hacker finding — set for good, synchronously, at the
+  // very top of `stop()`. `stop()` kills the subprocess but cannot make it
+  // die instantly (SIGTERM, not a synchronous severance of the ndjson
+  // stream), so a message the child had already started writing can still
+  // arrive and be dispatched afterward. Without this flag a
+  // `requestPermission`/`unstable_createElicitation` call landing in that
+  // window would register a fresh pending entry as if the session were
+  // still live — and a stale client `permission-response` could later
+  // resolve it as an "allow" against a session the user was told was
+  // closed. Checked at the top of both handlers below; never reset (a
+  // stopped bridge is torn out of the `bridges` map by `reap()` and never
+  // reused — see acp/index.ts).
+  private stopped = false;
   /** Sessions whose bootstrap brief already hit the transcript (audit record). */
   private briefLogged = new Set<string>();
   private starting: Promise<void> | null = null;
@@ -859,8 +897,31 @@ export class AcpBridge {
     }
   }
 
-  /** Spawn + handshake exactly once; concurrent callers share the same promise. */
+  /** Spawn + handshake exactly once; concurrent callers share the same promise.
+   *
+   * issue-82 follow-up (ethical-hacker finding on the fix itself) — once a
+   * bridge has been `stop()`'d, refuse to resurrect it rather than silently
+   * respawning. `stop()` is currently ONLY reached via `reap()` (which also
+   * deletes the bridge from `index.ts`'s map, so a fresh `AcpBridge` — with
+   * `stopped` correctly false — is created for the next turn) OR via THIS
+   * file's own cancel()-escalation path (`cancel()` calling `stop()` when a
+   * turn doesn't end in time), which does NOT go through `reap()` and leaves
+   * the SAME, now-permanently-`stopped` instance live in that map. Without
+   * this guard, a merely-slow (not malicious) turn that just misses
+   * `CANCEL_ESCALATION_MS` would respawn a working-looking subprocess whose
+   * `requestPermission`/`unstable_createElicitation` handlers silently
+   * auto-deny forever (the `stopped` check in both) — a hard-to-diagnose,
+   * silent regression of the permission gate with no visible error. Throwing
+   * here instead surfaces a clear, actionable error through the SAME
+   * try/catch every caller already has (`handlePrompt` etc.), so the failure
+   * is loud, not silent — the user is prompted to start a new chat, whose
+   * `getOrCreateEntry` makes a brand-new bridge with `stopped` unset. */
   async ensureStarted(): Promise<void> {
+    if (this.stopped) {
+      throw new Error(
+        'This AI editing session was stopped and cannot be reused — start a new chat.'
+      );
+    }
     if (this.conn) return;
     if (!this.starting) {
       this.starting = this.start().finally(() => {
@@ -1139,6 +1200,12 @@ export class AcpBridge {
         void this.appendTranscript({ role: 'agent', update: u }, seq);
       },
       requestPermission: (params: RequestPermissionRequest): Promise<RequestPermissionResponse> => {
+        // issue-82 / ethical-hacker finding — a message the child had already
+        // started writing before `stop()` killed it can still be dispatched
+        // in the brief window before the process actually dies. Fail closed
+        // immediately rather than register a pending entry a stale client
+        // response could later resolve as "allow" against a torn-down session.
+        if (this.stopped) return Promise.resolve({ outcome: { outcome: 'cancelled' } });
         // Milestone B (retires DDR-125 F2's blanket auto-approve) — the
         // permission POLICY is now the selected session mode (sourced from
         // Claude Code itself): `bypassPermissions`/`dontAsk` short-circuit
@@ -1195,6 +1262,11 @@ export class AcpBridge {
       unstable_createElicitation: (
         params: CreateElicitationRequest
       ): Promise<CreateElicitationResponse> => {
+        // issue-82 / ethical-hacker finding — same fail-closed guard as
+        // `requestPermission` above, and for the same reason: a message
+        // already in flight from the child when `stop()` fires must not
+        // register a pending entry a stale client response could resolve.
+        if (this.stopped) return Promise.resolve({ action: 'decline' });
         // feature-acp-ask-user-question — mirrors requestPermission's shape
         // exactly. Fires for BOTH `AskUserQuestion` and any MCP-server
         // elicitation (see the plan's Research section) — the toolCallId/
@@ -1316,10 +1388,40 @@ export class AcpBridge {
       }
     }
     await this.appendTranscript({ role: 'user', text });
-    const response = await conn.prompt({
-      sessionId,
-      prompt: [{ type: 'text', text }],
+
+    // issue-82 — race the real adapter response against a forced rejection
+    // `cancel()`/`stop()` can trigger. `turn.settled` resolves the moment the
+    // RACE ITSELF is decided (security-auditor finding: resolving it only
+    // after the transcript-append below would let a slow disk write
+    // masquerade as a still-hanging turn and trigger a needless escalation
+    // even though the real response already won) — the append is bookkeeping
+    // on an already-settled outcome, not part of what `cancel()` waits on.
+    let resolveSettled!: () => void;
+    const settled = new Promise<void>((resolve) => {
+      resolveSettled = resolve;
     });
+    const turn: { reject: (err: Error) => void; settled: Promise<void> } = {
+      reject: () => {}, // replaced synchronously below before this can matter
+      settled,
+    };
+    const forced = new Promise<never>((_, reject) => {
+      turn.reject = reject;
+    });
+    let response: PromptResponse;
+    // `add` happens INSIDE the try (not before it) so a synchronous throw
+    // from `conn.prompt()` still reaches the `finally` and removes `turn` —
+    // otherwise it would leak in the Set forever, and a later cancel()
+    // calling `turn.reject()` on it would reject a `forced` promise nothing
+    // is racing anymore (an unhandled rejection).
+    try {
+      this.pendingTurns.add(turn);
+      const promptCall = conn.prompt({ sessionId, prompt: [{ type: 'text', text }] });
+      promptCall.catch(() => {}); // a forced-reject race must not surface as an unhandled rejection
+      response = await Promise.race([promptCall, forced]);
+    } finally {
+      this.pendingTurns.delete(turn);
+      resolveSettled();
+    }
     await this.appendTranscript({ role: 'stop', stopReason: response.stopReason });
     return { stopReason: response.stopReason };
   }
@@ -1548,24 +1650,72 @@ export class AcpBridge {
     }
   }
 
-  /** Cancel the in-flight turn (no-op if nothing is running). */
-  async cancel(): Promise<void> {
+  /** Deny pending permissions/elicitations, then fire the cooperative ACP
+   *  `session/cancel` request — WITHOUT waiting for it to settle. A wedged
+   *  or non-cooperating subprocess can leave this RPC unanswered forever (or
+   *  reject it immediately if `session/cancel` isn't even implemented);
+   *  either way this must never make a caller wait on it, so both
+   *  `cancel()`'s escalation and `stop()`'s teardown stay bounded no matter
+   *  what the adapter does with the request. */
+  private requestCancel(): void {
     this.denyAllPendingPermissions();
     this.declineAllPendingElicitations();
     if (this.conn && this.currentSession) {
-      try {
-        await this.conn.cancel({ sessionId: this.currentSession });
-      } catch {
-        /* turn may already have finished */
-      }
+      this.conn.cancel({ sessionId: this.currentSession }).catch(() => {
+        /* turn may already have finished, or the adapter doesn't implement cancel */
+      });
     }
   }
 
-  /** Tear down: cancel, kill the subprocess, drop all handles + sessions. */
+  /**
+   * Cancel the in-flight turn (no-op if nothing is running).
+   *
+   * Fires the cooperative ACP `session/cancel` request, but does not simply
+   * trust it: a wedged subprocess — or one that never implemented
+   * `session/cancel` at all — can leave the pending `prompt()` call
+   * unsettled forever, which used to mean Stop silently did nothing
+   * (issue-82): the client's turn loop never exits, `busy` stays true, and
+   * the Stop button stays visible but inert. Any turn that hasn't actually
+   * ended within `CANCEL_ESCALATION_MS` of asking is forced to end — reject
+   * its pending `prompt()` — so it always settles as an error the client
+   * surfaces, instead of hanging. If ANY turn needed forcing, the whole
+   * bridge (one subprocess serving every turn) is presumed wedged and torn
+   * down.
+   */
+  async cancel(): Promise<void> {
+    this.requestCancel();
+    const turns = [...this.pendingTurns];
+    if (turns.length === 0) return; // nothing in flight to escalate
+    const escalated = await Promise.all(
+      turns.map(async (turn) => {
+        const result = await withTimeout(
+          turn.settled,
+          this.opts.cancelEscalationMs ?? CANCEL_ESCALATION_MS
+        );
+        if (result !== TIMED_OUT) return false;
+        turn.reject(new Error('Cancelled — the agent did not respond in time and was stopped.'));
+        return true;
+      })
+    );
+    if (escalated.some(Boolean)) await this.stop();
+  }
+
+  /** Tear down: cancel, kill the subprocess, drop all handles + sessions.
+   *  Never blocks on the cooperative cancel ask (see `requestCancel`) — a
+   *  wedged subprocess must not be able to make `stop()` hang too. */
   async stop(): Promise<void> {
-    await this.cancel();
-    this.denyAllPendingPermissions(); // belt-and-suspenders — cancel() already does this
-    this.declineAllPendingElicitations(); // ditto
+    // Fail-closed from this instant on — see the `stopped` field comment.
+    this.stopped = true;
+    this.requestCancel();
+    // Any turn(s) still in flight — a direct stop() with no prior cancel(),
+    // or cancel()'s own escalation calling back in here. Force them to
+    // settle before the connection dies underneath them, so the client's
+    // turn loop always exits instead of awaiting a promise that can now
+    // never resolve.
+    for (const turn of this.pendingTurns) {
+      turn.reject(new Error('Stopped — the AI editing session was closed.'));
+    }
+    this.pendingTurns.clear();
     try {
       this.proc?.kill();
     } catch {

package/apps/studio/client/app.jsx

@@ -11794,13 +11794,23 @@ function App() {
 
   // ----- Inbound messages from iframes -----
   useEffect(() => {
+    // Does this comment id belong to the canvas the user is actually looking
+    // at? Scopes the patch/delete relays below — see the SECURITY note there.
+    //
+    // The leading `!!activePath` is load-bearing, not defensive noise: with no
+    // active canvas the branches' `activeWin` is `null`, and `e.source` is also
+    // `null` for a message whose source context was discarded before dispatch —
+    // so `e.source === activeWin` can pass as `null === null`. This is the
+    // second conjunct that closes that path. Don't "simplify" it away.
+    const ownsActiveComment = (id) =>
+      !!activePath && (commentsByFile[activePath] || []).some((c) => c && c.id === id);
     function onMessage(e) {
       // Cross-origin hardening (DDR-054): only accept dgn control messages from
       // the canvas-content origin — the split origin when on, else our own origin
       // for the same-origin iframe. Drops spoofed messages from any other window.
-      // The handlers below relay to inert stores (comments / selection — the
-      // "safe to sync" set), so the blast radius was small, but unchecked inbound
-      // postMessage is a confused-deputy seam the F1 hardening should close.
+      // Every canvas iframe shares that origin, so the check below proves only
+      // "a canvas said this", NOT "the canvas the user is looking at said it" —
+      // each mutating branch additionally gates on `e.source === activeWin`.
       const expectedOrigin = cfg?.canvasOrigin || window.location.origin;
       if (e.origin !== expectedOrigin) return;
       const m = e.data;
@@ -12408,13 +12418,26 @@ function App() {
         // Phase 6 — iframe overlay finished composing. Relay through the
         // existing WS `comments-add` channel; server-side persistence +
         // broadcast back are identical to the legacy shell-composer flow.
+        //
+        // SECURITY — gated on `activeWin` and PINNED to `activePath`, the same
+        // shape as every other mutating branch in this handler. The origin
+        // check at the top passes for EVERY canvas iframe (they all share
+        // `canvasOrigin`), so without this a canvas sitting in a BACKGROUND
+        // tab could post comments onto any file it cared to name, with no user
+        // gesture. This handler's preamble waived that on the grounds that
+        // comments are an "inert store" — the ACP panel's one-click
+        // "Implement N comments" action retires that premise, because open
+        // comments are now a feed the agent acts on. `p.file` is ignored
+        // rather than validated: the active canvas is the only file the user
+        // can actually see themselves commenting on.
         const p = m.payload;
         const txt = String(p.text).trim();
-        if (txt) {
+        const activeWin = activePath ? iframesRef.current.get(activePath)?.contentWindow : null;
+        if (e.source === activeWin && txt && activePath && activePath !== SYSTEM_TAB) {
           wsSend({
             type: 'comments-add',
             payload: {
-              file: p.file,
+              file: activePath,
               selector: p.selector,
               index: p.index,
               dom_path: p.dom_path,
@@ -12428,10 +12451,21 @@ function App() {
         }
       } else if (m.dgn === 'comment-patch' && m.id && m.patch && typeof m.patch === 'object') {
         // Phase 6 — thread popover routes resolve / reopen through here.
-        wsSend({ type: 'comments-patch', id: m.id, patch: m.patch });
+        // SECURITY — same gate as comment-submit, plus an ownership check: a
+        // bare id would otherwise reach ANY comment in the project. Patch and
+        // delete change or remove somebody else's note, which is exactly why
+        // ws.ts refuses both for a viewer session; the iframe lane needs the
+        // matching restriction.
+        const activeWin = activePath ? iframesRef.current.get(activePath)?.contentWindow : null;
+        if (e.source === activeWin && ownsActiveComment(m.id)) {
+          wsSend({ type: 'comments-patch', id: m.id, patch: m.patch });
+        }
       } else if (m.dgn === 'comment-delete' && m.id) {
-        wsSend({ type: 'comments-delete', id: m.id });
-        setFocusedCommentId((prev) => (prev === m.id ? null : prev));
+        const activeWin = activePath ? iframesRef.current.get(activePath)?.contentWindow : null;
+        if (e.source === activeWin && ownsActiveComment(m.id)) {
+          wsSend({ type: 'comments-delete', id: m.id });
+          setFocusedCommentId((prev) => (prev === m.id ? null : prev));
+        }
       } else if (m.dgn === 'comment-click' && m.id) {
         setFocusedCommentId(m.id);
       } else if (m.dgn === 'artboards' && typeof m.count === 'number') {
@@ -12518,27 +12552,48 @@ function App() {
       } else if (m.dgn === 'shell-shortcut') {
         // Same forwarding lane for the other shell chords (inspect.ts) — so
         // ⌘R / ⌘⇧I / ⌘⇧M / ⌘⇧E / ⌘⇧H behave identically wherever focus is.
-        if (m.id === 'reload') reloadActive();
-        else if (m.id === 'inspector') toggleRightPanel('inspector');
-        else if (m.id === 'assistant' && isNativeApp()) toggleRightPanel('assistant');
-        else if (m.id === 'comments') toggleRightPanel('comments');
-        else if (m.id === 'changes') toggleRightPanel('changes');
-        else if (m.id === 'timeline') toggleTimeline();
-        else if (m.id === 'export') setExportDialog({ mode: 'export' });
-        else if (m.id === 'handoff') setExportDialog({ mode: 'handoff' });
+        //
+        // SECURITY — every one of these is a chord the user pressed INSIDE the
+        // canvas they are looking at, so it gets the same `activeWin` gate as
+        // its siblings. Ungated, a background canvas could reload the active
+        // file out from under an edit or pop the Export/Handoff dialog on
+        // demand — a modal-timing primitive, and the mirror image of the
+        // present-enter branch that was already hardened against modal HIDING.
+        const activeWin = activePath ? iframesRef.current.get(activePath)?.contentWindow : null;
+        if (e.source === activeWin) {
+          if (m.id === 'reload') reloadActive();
+          else if (m.id === 'inspector') toggleRightPanel('inspector');
+          else if (m.id === 'assistant' && isNativeApp()) toggleRightPanel('assistant');
+          else if (m.id === 'comments') toggleRightPanel('comments');
+          else if (m.id === 'changes') toggleRightPanel('changes');
+          else if (m.id === 'timeline') toggleTimeline();
+          else if (m.id === 'export') setExportDialog({ mode: 'export' });
+          else if (m.id === 'handoff') setExportDialog({ mode: 'handoff' });
+        }
       } else if (m.dgn === 'open-export') {
         // Plan C — the in-canvas toolbar / context menu route here so they open
         // the SAME shell Export dialog as the menubar (one look, all settings).
         // Carry the context-menu's scope hint (e.g. "Export selection").
-        setExportDialog({
-          mode: 'export',
-          scope: m.detail && typeof m.detail.scope === 'string' ? m.detail.scope : undefined,
-        });
+        //
+        // SECURITY — gated with `shell-shortcut` above rather than separately:
+        // both reach the same `setExportDialog`, so leaving this one open would
+        // hand back the capability the other now refuses.
+        const activeWin = activePath ? iframesRef.current.get(activePath)?.contentWindow : null;
+        if (e.source === activeWin) {
+          setExportDialog({
+            mode: 'export',
+            scope: m.detail && typeof m.detail.scope === 'string' ? m.detail.scope : undefined,
+          });
+        }
       } else if (m.dgn === 'open-timeline-request') {
         // Artboard-chrome context menu's "Open Timeline" (video-comp artboards
         // only). Scope the Timeline to the right-clicked artboard, then open it.
-        if (typeof m.artboardId === 'string') setCanvasActiveArtboard(m.artboardId.slice(0, 120));
-        setTimelineOpen(true);
+        // SECURITY — same class: a context-menu action from the canvas in view.
+        const activeWin = activePath ? iframesRef.current.get(activePath)?.contentWindow : null;
+        if (e.source === activeWin) {
+          if (typeof m.artboardId === 'string') setCanvasActiveArtboard(m.artboardId.slice(0, 120));
+          setTimelineOpen(true);
+        }
       } else if (m.dgn === 'loaded' && m.file) {
         // iframe finished loading — drop the compile skeleton, push current
         // comments + carry over focused pin if any
@@ -14190,6 +14245,12 @@ function App() {
     (panelSide[id] || PANEL_SIDES_DEFAULTS[id]) === 'left' ? dragSide === 'sb' : dragSide === 'rp';
   const activeCanvasFile =
     activePath && activePath !== SYSTEM_TAB && /\.(tsx|html)$/i.test(activePath) ? activePath : null;
+  // Issue #74 — drives the chat panel's "Implement N comments" quick action.
+  // Canvas-wide on purpose: the verb operates on every open comment of the
+  // active canvas, so it is deliberately NOT scoped to the current selection.
+  const activeOpenComments = activeCanvasFile
+    ? openCount(commentsByFile[activeCanvasFile])
+    : 0;
 
   // Render a panel body by id (width undefined ⇒ fills the .st-dockslot wrapper,
   // which owns the resizable width). Assistant is handled separately below as an
@@ -14512,6 +14573,7 @@ function App() {
                   hidden={leftActive !== 'assistant'}
                   activeCanvas={activeCanvasFile}
                   selected={selected}
+                  openComments={activeOpenComments}
                   designRel={(cfg?.designRel || cfg?.designRoot || '.design').replace(/^\/+|\/+$/g, '')}
                   resizing={resizingFor('assistant')}
                   onClose={() => setAssistantOpen(false)}
@@ -14586,6 +14648,7 @@ function App() {
                   hidden={rightActive !== 'assistant'}
                   activeCanvas={activeCanvasFile}
                   selected={selected}
+                  openComments={activeOpenComments}
                   designRel={(cfg?.designRel || cfg?.designRoot || '.design').replace(/^\/+|\/+$/g, '')}
                   resizing={resizingFor('assistant')}
                   onClose={() => setAssistantOpen(false)}

package/apps/studio/client/panels/ChatPanel.jsx

@@ -1058,9 +1058,29 @@ function ChatEmpty() {
   );
 }
 
-function QuickActions() {
+function QuickActions({ openComments = 0 }) {
   return (
     <div className="chat-quick">
+      {/* Issue #74 — the reporter asked for a button that IMPLEMENTS the
+          comments they already dropped on the canvas, not one that adds a new
+          one. `/design:edit` already owns the whole behaviour (edit.md §3: a
+          generic feedback string + open comments → iterate each as a scoped
+          edit, resolve each after it lands), so this is purely a shortcut to
+          the phrasing that triggers it. Shown only when there IS something to
+          implement — a permanently-disabled verb would just be noise.
+          Prefill, never fire blind: same rule as QUICK_ACTIONS above, so the
+          user can narrow the ask ("…but skip the one about the colour")
+          before sending. */}
+      {openComments > 0 ? (
+        <ThreadPrimitive.Suggestion
+          prompt="/design:edit fix open comments"
+          send={false}
+          className="btn btn--ghost btn--sm chat-qa chat-qa--comments"
+          data-testid="chat-qa-implement-comments"
+        >
+          {`✓ Implement ${openComments} comment${openComments === 1 ? '' : 's'}`}
+        </ThreadPrimitive.Suggestion>
+      ) : null}
       {QUICK_ACTIONS.map((a) => (
         <ThreadPrimitive.Suggestion
           key={a.label}
@@ -1495,6 +1515,7 @@ function ChatThread({
   activeCanvas,
   selected,
   designRel,
+  openComments,
   transcriptView,
   onSetTranscriptView,
   onPermissionRequest,
@@ -1735,7 +1756,7 @@ function ChatThread({
           ) : (
             <ErrorCard error={turnError} onRetry={retryLastTurn} />
           )}
-          <QuickActions />
+          <QuickActions openComments={openComments} />
           <Composer
             activeCanvas={activeCanvas}
             chatCtx={ctxDismissed ? null : chatCtx}
@@ -1766,6 +1787,7 @@ export default function ChatPanel({
   activeCanvas,
   selected,
   designRel,
+  openComments = 0,
   width,
   resizing,
   onClose,
@@ -2288,6 +2310,7 @@ export default function ChatPanel({
                 activeCanvas={activeCanvas}
                 selected={selected}
                 designRel={designRel}
+                openComments={openComments}
                 transcriptView={transcriptView}
                 onSetTranscriptView={setTranscriptView}
                 onPermissionRequest={onPermissionRequest}

package/apps/studio/client/styles/6-acp-chat.css

@@ -1235,6 +1235,18 @@
   .chat-qa {
     font-family: var(--font-mono);
   }
+  /* Issue #74 — the "Implement N comments" action. Its siblings are literal
+     slash commands (hence mono); this one is prose ABOUT the canvas's current
+     state and only appears when there is something to act on, so it reads as
+     the row's contextual action: proportional type + a light accent tint. */
+  .chat-qa--comments {
+    font-family: inherit;
+    border-color: var(--accent-muted);
+    color: var(--accent);
+  }
+  .chat-qa--comments:hover {
+    background: var(--accent-tint);
+  }
 
   /* Composer */
   .chat-composer {