@1agh/maude 1.0.11 → 1.2.0

package/apps/studio/test/figma-routes.test.ts

@@ -1,294 +0,0 @@
-// `/_api/figma/*` — the MAIN-origin half of DDR-216 D3.
-//
-// canvas-origin-gate.test.ts already asserts these routes are unreachable from
-// the segregated canvas origin. That proves the wrong property on its own: the
-// MAIN origin is reachable from any website the user visits while the dev
-// server is up. Round 1 of the DDR-216 security review found the first draft
-// named no CSRF / DNS-rebind guard at all, with a working PoC — a CORS-simple
-// POST that plants an attacker's PAT (`connect`) or spends the user's on an
-// attacker-chosen key (`probe`), opaque response, real side effect.
-//
-// So this file asserts the complementary half:
-//   • cross-site  → 403 (Sec-Fetch-Site, the `sameOriginWrite` guard)
-//   • foreign Host header → 403 (the DNS-rebinding `isTrustedRequestHost` guard)
-//   • the stored key is NEVER echoed on ANY response path
-//   • `probe` is gated as a WRITE even though it stores nothing — it spends the
-//     credential and reaches the network.
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import type { Subprocess } from 'bun';
-
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-const TOKEN = 'figd_ROUTECANARY_0123456789abcdef';
-
-let proc: Subprocess;
-let port: number;
-let base: string;
-let keysPath: string;
-let keysDir: string;
-
-beforeAll(async () => {
-  const { root } = makeSandbox();
-  keysDir = mkdtempSync(join(tmpdir(), 'maude-figma-routes-keys-'));
-  keysPath = join(keysDir, 'keys.json');
-  writeFileSync(keysPath, JSON.stringify({ keys: {} }), { mode: 0o600 });
-  port = nextPort();
-  base = `http://localhost:${port}`;
-  proc = await bootServer(root, port, { MAUDE_GEN_KEYS_PATH: keysPath });
-});
-
-afterAll(async () => {
-  await killProc(proc);
-  rmSync(keysDir, { recursive: true, force: true });
-});
-
-function storedToken(): string | undefined {
-  try {
-    return JSON.parse(readFileSync(keysPath, 'utf8')).keys?.figma;
-  } catch {
-    return undefined;
-  }
-}
-
-// The WRITE guard in this codebase is `sameOriginWrite`, which keys on `Origin`
-// — the header a browser stamps unspoofably on every cross-origin POST/DELETE.
-// (`Sec-Fetch-Site` is what `sameOriginRead` uses, for the GET case below where
-// browsers do NOT reliably send Origin.) These tests therefore send a real
-// cross-origin `Origin`, which is what an attacker page actually produces.
-describe('cross-origin writes are refused (the CSRF guard)', () => {
-  const EVIL = 'https://evil.example';
-  const PLANTED = 'figd_ATTACKER_PLANTED_0123456789';
-
-  test('POST /_api/figma/connect cross-origin is 403 and stores nothing', async () => {
-    const res = await fetch(`${base}/_api/figma/connect`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Origin: EVIL },
-      body: JSON.stringify({ token: PLANTED }),
-    });
-    expect(res.status).toBe(403);
-    expect(storedToken()).toBeUndefined();
-  });
-
-  test('POST /_api/figma/probe cross-origin is 403 — probe spends the credential', async () => {
-    const res = await fetch(`${base}/_api/figma/probe`, {
-      method: 'POST',
-      headers: { Origin: EVIL },
-    });
-    expect(res.status).toBe(403);
-  });
-
-  test('DELETE /_api/figma/connect cross-origin is 403', async () => {
-    const res = await fetch(`${base}/_api/figma/connect`, {
-      method: 'DELETE',
-      headers: { Origin: EVIL },
-    });
-    expect(res.status).toBe(403);
-  });
-
-  test('a CORS-simple POST (no preflight, text/plain) is still refused', async () => {
-    // The PoC shape from the DDR-216 review: a simple content type means no
-    // preflight and the page cannot read the response — but the side effect
-    // would land if the server allowed it. Origin is still stamped.
-    const res = await fetch(`${base}/_api/figma/connect`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'text/plain', Origin: EVIL },
-      body: JSON.stringify({ token: PLANTED }),
-    });
-    expect(res.status).toBe(403);
-    expect(storedToken()).toBeUndefined();
-  });
-});
-
-describe('cross-site reads are refused (Sec-Fetch-Site, the GET case)', () => {
-  test('GET /_api/figma/status with Sec-Fetch-Site: cross-site is 403', async () => {
-    // A no-cors GET from an attacker page passes the loopback guard and may omit
-    // Origin entirely, so `sameOriginWrite` cannot see it. Without the read
-    // guard this leaks whether the user has Figma connected.
-    const res = await fetch(`${base}/_api/figma/status`, {
-      headers: { 'Sec-Fetch-Site': 'cross-site' },
-    });
-    expect(res.status).toBe(403);
-  });
-});
-
-describe('a foreign Host header is refused (the DNS-rebinding guard)', () => {
-  for (const [label, host] of [
-    ['an attacker-controlled name', 'evil.example'],
-    ['a rebinding service name', 'figma.127.0.0.1.nip.io'],
-  ]) {
-    test(`GET /_api/figma/status with Host: ${label} is 403`, async () => {
-      const res = await fetch(`${base}/_api/figma/status`, { headers: { Host: host } });
-      expect(res.status).toBe(403);
-    });
-  }
-});
-
-describe('method gating', () => {
-  test('GET /_api/figma/connect is 405', async () => {
-    expect((await fetch(`${base}/_api/figma/connect`)).status).toBe(405);
-  });
-
-  test('GET /_api/figma/probe is 405 — probe is a write', async () => {
-    expect((await fetch(`${base}/_api/figma/probe`)).status).toBe(405);
-  });
-
-  test('POST /_api/figma/status is 405', async () => {
-    expect((await fetch(`${base}/_api/figma/status`, { method: 'POST' })).status).toBe(405);
-  });
-});
-
-describe('same-origin happy path — and the key never comes back out', () => {
-  test('status reports presence only, plus the granular scope to ask for', async () => {
-    const res = await fetch(`${base}/_api/figma/status`, {
-      headers: { 'Sec-Fetch-Site': 'same-origin' },
-    });
-    expect(res.status).toBe(200);
-    const body = (await res.json()) as Record<string, unknown>;
-    expect(body.configured).toBe(false);
-    // The blanket `files:read` scope is deprecated — the UI must never name it.
-    expect(body.requiredScope).toBe('file_content:read');
-    expect(JSON.stringify(body)).not.toContain('figd_');
-  });
-
-  test('connect stores the key and returns presence only — never the value', async () => {
-    const res = await fetch(`${base}/_api/figma/connect`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
-      body: JSON.stringify({ token: TOKEN }),
-    });
-    expect(res.status).toBe(200);
-    const raw = await res.text();
-    expect(JSON.parse(raw)).toEqual({ configured: true });
-    expect(raw).not.toContain(TOKEN);
-    expect(raw).not.toContain('ROUTECANARY');
-    // It really did store it — the assertion above is about the RESPONSE, not
-    // about the write silently failing.
-    expect(storedToken()).toBe(TOKEN);
-  });
-
-  test('status still never echoes the value once one is configured', async () => {
-    const res = await fetch(`${base}/_api/figma/status`, {
-      headers: { 'Sec-Fetch-Site': 'same-origin' },
-    });
-    const raw = await res.text();
-    expect(JSON.parse(raw).configured).toBe(true);
-    expect(raw).not.toContain('ROUTECANARY');
-  });
-
-  test('a malformed token is refused with a message that does not echo it', async () => {
-    const junk = 'not a token REFLECTION_CANARY';
-    const res = await fetch(`${base}/_api/figma/connect`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
-      body: JSON.stringify({ token: junk }),
-    });
-    expect(res.status).toBe(400);
-    const raw = await res.text();
-    expect(raw).not.toContain('REFLECTION_CANARY');
-    // The previously-stored good token is untouched by a failed write.
-    expect(storedToken()).toBe(TOKEN);
-  });
-
-  test('probe surfaces a typed failure without leaking the token', async () => {
-    // No network stub here — the real api.figma.com will reject this canary
-    // token (or the call fails to connect in CI). Either way the response must
-    // be a typed reason with a code-owned message and no credential in it.
-    const res = await fetch(`${base}/_api/figma/probe`, {
-      method: 'POST',
-      headers: { 'Sec-Fetch-Site': 'same-origin' },
-    });
-    const raw = await res.text();
-    expect(raw).not.toContain('ROUTECANARY');
-    expect(raw).not.toContain('figd_');
-    const body = JSON.parse(raw) as { ok: boolean; reason?: string };
-    if (!body.ok) {
-      expect(['unauthorized', 'forbidden', 'network', 'bad_response', 'rate_limited']).toContain(
-        body.reason
-      );
-    }
-  });
-
-  test('disconnect clears the key', async () => {
-    const res = await fetch(`${base}/_api/figma/connect`, {
-      method: 'DELETE',
-      headers: { 'Sec-Fetch-Site': 'same-origin' },
-    });
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ configured: false });
-    expect(storedToken()).toBeUndefined();
-  });
-});
-
-describe('/_api/figma/import — same gate, and a validated body', () => {
-  test('cross-origin is 403 — it spends the PAT and writes to disk', async () => {
-    const res = await fetch(`${base}/_api/figma/import`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Origin: 'https://evil.example' },
-      body: JSON.stringify({ mode: 'board', url: 'https://www.figma.com/board/AAAAAAAAAA/x' }),
-    });
-    expect(res.status).toBe(403);
-  });
-
-  test('a foreign Host is 403', async () => {
-    const res = await fetch(`${base}/_api/figma/import`, {
-      method: 'POST',
-      headers: { Host: 'evil.example' },
-      body: '{}',
-    });
-    expect(res.status).toBe(403);
-  });
-
-  test('GET is 405', async () => {
-    expect((await fetch(`${base}/_api/figma/import`)).status).toBe(405);
-  });
-
-  test.each([
-    ['no body', {}],
-    ['unknown mode', { mode: 'everything', url: 'https://www.figma.com/board/AAAAAAAAAA/x' }],
-    ['missing url', { mode: 'board' }],
-    ['empty url', { mode: 'board', url: '' }],
-  ])('a malformed request is 400 (%s)', async (_label, body) => {
-    const res = await fetch(`${base}/_api/figma/import`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
-      body: JSON.stringify(body),
-    });
-    expect(res.status).toBe(400);
-  });
-
-  test('a caller cannot choose an output path', async () => {
-    // The body shape is fixed: {mode, url, dryRun}. A slug/path/into field is
-    // simply not read — the same "the producer never picks its own target"
-    // discipline DDR-174 applies to its authoring agent.
-    const res = await fetch(`${base}/_api/figma/import`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
-      body: JSON.stringify({
-        mode: 'board',
-        url: 'https://www.figma.com/board/AAAAAAAAAA/x',
-        slug: '../../etc/passwd',
-        into: '/etc/passwd',
-      }),
-    });
-    // It gets past validation (the url is well-formed) and fails on the
-    // credential instead — the point is that the path fields were ignored.
-    const raw = await res.text();
-    expect(raw).not.toContain('etc/passwd');
-    expect([400, 502]).toContain(res.status);
-  });
-
-  test('a failure never echoes an upstream string', async () => {
-    const res = await fetch(`${base}/_api/figma/import`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
-      body: JSON.stringify({ mode: 'board', url: 'https://www.figma.com/board/AAAAAAAAAA/x' }),
-    });
-    const raw = await res.text();
-    expect(raw).not.toContain('figd_');
-    expect(raw).not.toContain('ROUTECANARY');
-  });
-});

package/apps/studio/test/file-lock.test.ts

@@ -1,84 +0,0 @@
-// file-lock.test.ts — DDR-150 P2. The cross-process advisory lock that closes
-// the race the in-process mutex couldn't see: the HTTP server, the /design:edit
-// CLI, and the HMR watcher all editing the same comp file. Verifies mutual
-// exclusion across "processes" (concurrent acquirers), stale-lock stealing (a
-// crashed holder), and that an edit through the integrated withLock cleans up.
-
-import { describe, expect, test } from 'bun:test';
-import { utimes } from 'node:fs/promises';
-
-import { acquireFileLock, editAttribute, lockPathFor } from '../canvas-edit.ts';
-import { transpileCanvasSource } from '../canvas-pipeline.ts';
-
-const tmp = (tag: string) => `/tmp/maude-lock-${tag}-${Math.random().toString(36).slice(2)}.tsx`;
-
-describe('acquireFileLock', () => {
-  test('acquires + releases; release is idempotent', async () => {
-    const f = tmp('basic');
-    const rel = await acquireFileLock(f);
-    expect(await Bun.file(lockPathFor(f)).exists()).toBe(true);
-    await rel();
-    expect(await Bun.file(lockPathFor(f)).exists()).toBe(false);
-    await rel(); // second release is a no-op, never throws
-  });
-
-  test('serialises a second (cross-process) contender until the first releases', async () => {
-    const f = tmp('contend');
-    const relA = await acquireFileLock(f);
-    let bAcquired = false;
-    const bPromise = acquireFileLock(f).then((rel) => {
-      bAcquired = true;
-      return rel;
-    });
-    // While A holds the lock, B must be blocked (it's polling the lockfile).
-    await new Promise((r) => setTimeout(r, 80));
-    expect(bAcquired).toBe(false);
-    await relA();
-    const relB = await bPromise; // B now wins the lock
-    expect(bAcquired).toBe(true);
-    await relB();
-    expect(await Bun.file(lockPathFor(f)).exists()).toBe(false);
-  });
-
-  test('steals a STALE lock (holder crashed) instead of waiting forever', async () => {
-    const f = tmp('stale');
-    const lp = lockPathFor(f);
-    await Bun.write(lp, '99999 0'); // a "held" lock from a dead pid
-    const old = new Date(Date.now() - 60_000); // mtime 60s ago (> LOCK_STALE_MS)
-    await utimes(lp, old, old);
-    const start = Date.now();
-    const rel = await acquireFileLock(f); // must steal it, not block
-    expect(Date.now() - start).toBeLessThan(2000);
-    await rel();
-  });
-});
-
-describe('withLock integration', () => {
-  test('an edit acquires + cleans up the cross-process lock', async () => {
-    const f = tmp('edit');
-    const src = 'function Demo() { return <div className="x">y</div>; }';
-    await Bun.write(f, src);
-    const { withIds } = transpileCanvasSource(f, src);
-    const id = withIds.match(/data-cd-id="([0-9a-f]{8})"/)?.[1] as string;
-    const r = await editAttribute(f, id, 'className', 'edited');
-    expect(r.changed).toBe(true);
-    expect(await Bun.file(f).text()).toContain('className="edited"');
-    // The lockfile must be released after the edit — not left dangling.
-    expect(await Bun.file(lockPathFor(f)).exists()).toBe(false);
-  });
-
-  test('concurrent edits to the same file both land (serialised, no lost write)', async () => {
-    const f = tmp('concurrent');
-    const src = 'function Demo() { return <div className="x" title="t">y</div>; }';
-    await Bun.write(f, src);
-    const { withIds } = transpileCanvasSource(f, src);
-    const id = withIds.match(/data-cd-id="([0-9a-f]{8})"/)?.[1] as string;
-    await Promise.all([
-      editAttribute(f, id, 'className', 'cls-A'),
-      editAttribute(f, id, 'title', 'title-B'),
-    ]);
-    const out = await Bun.file(f).text();
-    expect(out).toContain('cls-A');
-    expect(out).toContain('title-B'); // neither edit clobbered the other
-  });
-});

package/apps/studio/test/fixtures/backgrounding-claude-auth.sh

@@ -1,12 +0,0 @@
-#!/bin/sh
-# Test fixture for issue #107 round-2 defender L6 — a `claude` stand-in that
-# prints a perfectly good status document and THEN leaves a descendant holding
-# fd 1 (a daemon, an update check, a corporate agent). The pipe never reaches
-# EOF, so the read hits its deadline — but the answer is already in the buffer
-# and must not be thrown away.
-if [ "$1" = "auth" ] && [ "$2" = "status" ]; then
-  echo '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}'
-  sleep 120 &
-  exit 0
-fi
-exit 1

package/apps/studio/test/fixtures/fake-claude-auth.mjs

@@ -1,23 +0,0 @@
-#!/usr/bin/env node
-// Test fixture standing in for the `claude` CLI — implements only the one
-// subcommand probeAcpAvailabilityAuthed()/getClaudeAuthStatus() shell out to.
-// FAKE_CLAUDE_LOGGED_IN=1 controls the reported sign-in state.
-//
-// FAKE_CLAUDE_STDOUT_NOISE=1 reproduces issue #107: a version-manager shim
-// (mise/asdf/volta) or corporate wrapper fronting the real binary and printing
-// a banner to STDOUT ahead of the JSON. The second noise line deliberately
-// carries braces of its own, pinning that a brace-bearing banner can't outrank
-// the real payload.
-const [, , cmd, sub] = process.argv;
-if (cmd === 'auth' && sub === 'status') {
-  const loggedIn = process.env.FAKE_CLAUDE_LOGGED_IN === '1';
-  if (process.env.FAKE_CLAUDE_STDOUT_NOISE === '1') {
-    process.stdout.write('mise ~/.config/mise/config.toml tools: claude@2.1.246\n');
-    process.stdout.write('resolving {claude} from {global} config\n');
-  }
-  process.stdout.write(
-    JSON.stringify({ loggedIn, apiProvider: loggedIn ? 'firstParty' : undefined })
-  );
-  process.exit(0);
-}
-process.exit(1);

package/apps/studio/test/fixtures/figjam-v3-groups-bindings.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_aaa1" data-tool="rect" stroke="#3b82f6" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="#e0ebfd" x="100" y="100" width="160" height="100" data-group-ids="g_team1"/><g data-id="s_aaa2" data-tool="sticky" data-r="8" data-fs="14" fill="#fce8a6" data-group-ids="g_inner g_team1"><rect x="320" y="100" width="200" height="200" rx="8" ry="8"/><text data-sticky-body="1" x="332" y="112" font-size="14" fill="#1a1a1a" dominant-baseline="hanging">flow start</text></g><g data-id="s_aaa3" data-tool="arrow" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" data-start-bind="s_aaa1 1 0.5" data-end-bind="s_aaa2 0 0.5 p"><line x1="260" y1="150" x2="320" y2="200"/><polyline points="307.1972004393032,196.78622909829892 320,200 314.5302123070536,187.9866148569984" fill="#1f1f1f"/></g><text data-id="s_aaa4" data-tool="text" x="100" y="260" data-font-size="14" fill="#1f1f1f" text-anchor="start" dominant-baseline="hanging" data-author="ai">AI note</text><ellipse data-id="s_aaa5" data-tool="ellipse" stroke="#30a46c" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" cx="700" cy="150" rx="60" ry="40" data-rot="15" transform="rotate(15 700 150)"/></svg>

package/apps/studio/test/fixtures/mock-acp-agent-caps.mjs

@@ -1,158 +0,0 @@
-#!/usr/bin/env bun
-// Mock ACP agent exercising the session-capabilities channel (feature-acp-
-// panel-dynamic-claude-code-capabilities) — modes + configOptions returned
-// from session/new, live session/set_mode + session/set_config_option, and
-// the config_option_update / session_info_update notifications a real
-// claude-agent-acp session emits. No real `claude` needed.
-//
-// Mirrors the REAL adapter's observed behavior (read from the installed
-// @agentclientprotocol/claude-agent-acp source, not guessed):
-//   - session/set_mode updates the mode AND mirrors it into configOptions'
-//     "mode" entry, emitting ONLY a config_option_update notification (no
-//     current_mode_update) — bridge.ts cross-derives lastModes from that.
-//   - session/set_config_option('model', …) can change which OTHER options
-//     are offered (here: picking "opus" adds a "fast" option) and returns
-//     the FULL refreshed configOptions in its RPC response (no notification).
-
-import { Readable, Writable } from 'node:stream';
-
-import * as acp from '@agentclientprotocol/sdk';
-
-const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
-
-const MODEL_OPTIONS = [
-  { value: 'sonnet', name: 'Sonnet' },
-  { value: 'opus', name: 'Opus' },
-];
-const EFFORT_OPTIONS = [
-  { value: 'default', name: 'Default' },
-  { value: 'high', name: 'High' },
-];
-const MODE_OPTIONS = [
-  { value: 'default', name: 'Manual' },
-  { value: 'plan', name: 'Plan Mode' },
-];
-const AVAILABLE_MODES = [
-  {
-    id: 'default',
-    name: 'Manual',
-    description: 'Standard behavior, prompts for dangerous operations',
-  },
-  { id: 'plan', name: 'Plan Mode', description: 'Planning mode, no actual tool execution' },
-];
-
-// `session` carries every tracked field (model/effort/mode/fast) so a call
-// that rebuilds the FULL option set (e.g. session/set_mode, which is scoped
-// to just the mode) never regresses a field a PRIOR call already changed —
-// mirrors the real adapter's `session.configOptions` being one persistent
-// object, not independently recomputed per field.
-function baseConfigOptions(session) {
-  const opts = [
-    {
-      id: 'model',
-      name: 'Model',
-      category: 'model',
-      type: 'select',
-      currentValue: session.model,
-      options: MODEL_OPTIONS,
-    },
-    {
-      id: 'effort',
-      name: 'Effort',
-      category: 'thought_level',
-      type: 'select',
-      currentValue: session.effort,
-      options: EFFORT_OPTIONS,
-    },
-    {
-      id: 'mode',
-      name: 'Mode',
-      category: 'mode',
-      type: 'select',
-      currentValue: session.mode,
-      options: MODE_OPTIONS,
-    },
-  ];
-  if (session.model === 'opus') {
-    opts.push({
-      id: 'fast',
-      name: 'Fast mode',
-      category: 'model_config',
-      type: 'select',
-      currentValue: session.fast,
-      options: [
-        { value: 'on', name: 'On' },
-        { value: 'off', name: 'Off' },
-      ],
-    });
-  }
-  return opts;
-}
-
-let n = 0;
-const sessions = new Map(); // sessionId -> { model, effort, mode, fast }
-
-acp
-  .agent({ name: 'mock-acp-agent-caps' })
-  .onRequest('initialize', () => ({
-    protocolVersion: acp.PROTOCOL_VERSION,
-    agentCapabilities: { loadSession: false },
-  }))
-  .onRequest('session/new', async (ctx) => {
-    const sessionId = `mock-caps-session-${++n}`;
-    const session = { model: 'sonnet', effort: 'default', mode: 'default', fast: 'off' };
-    sessions.set(sessionId, session);
-    await ctx.client.notify('session/update', {
-      sessionId,
-      update: { sessionUpdate: 'session_info_update', title: 'New chat' },
-    });
-    return {
-      sessionId,
-      modes: { currentModeId: 'default', availableModes: AVAILABLE_MODES },
-      configOptions: baseConfigOptions(session),
-    };
-  })
-  .onRequest('session/prompt', async (ctx) => {
-    await ctx.client.notify('session/update', {
-      sessionId: ctx.params.sessionId,
-      update: { sessionUpdate: 'agent_message_chunk', content: { type: 'text', text: 'ok' } },
-    });
-    return { stopReason: 'end_turn' };
-  })
-  .onRequest('session/set_mode', async (ctx) => {
-    const session = sessions.get(ctx.params.sessionId);
-    if (!session) throw new Error('session not found');
-    if (!AVAILABLE_MODES.some((m) => m.id === ctx.params.modeId)) {
-      throw new Error(`unknown mode: ${ctx.params.modeId}`);
-    }
-    session.mode = ctx.params.modeId;
-    // Real adapter: setSessionMode emits ONLY config_option_update, never
-    // current_mode_update — bridge.ts must cross-derive lastModes from it.
-    await ctx.client.notify('session/update', {
-      sessionId: ctx.params.sessionId,
-      update: { sessionUpdate: 'config_option_update', configOptions: baseConfigOptions(session) },
-    });
-    return {};
-  })
-  .onRequest('session/set_config_option', async (ctx) => {
-    const session = sessions.get(ctx.params.sessionId);
-    if (!session) throw new Error('session not found');
-    const { configId, value } = ctx.params;
-    if (configId === 'model') {
-      if (!MODEL_OPTIONS.some((o) => o.value === value)) throw new Error(`unknown model: ${value}`);
-      session.model = value;
-    } else if (configId === 'effort') {
-      if (!EFFORT_OPTIONS.some((o) => o.value === value))
-        throw new Error(`unknown effort: ${value}`);
-      session.effort = value;
-    } else if (configId === 'mode') {
-      if (!AVAILABLE_MODES.some((m) => m.id === value)) throw new Error(`unknown mode: ${value}`);
-      session.mode = value;
-    } else if (configId === 'fast') {
-      session.fast = value;
-    } else {
-      throw new Error(`unknown config option: ${configId}`);
-    }
-    return { configOptions: baseConfigOptions(session) };
-  })
-  .connect(stream);

package/apps/studio/test/fixtures/mock-acp-agent-commands.mjs

@@ -1,44 +0,0 @@
-#!/usr/bin/env bun
-// Mock ACP agent variant that publishes an `available_commands_update` the moment
-// a session is created (before the prompt) — stands in for Claude Code's command
-// catalogue so acp-commands.test.ts can exercise the warm-up + broadcast path
-// WITHOUT a real `claude`. Also answers a prompt so prompt-based paths still work.
-
-import { Readable, Writable } from 'node:stream';
-
-import * as acp from '@agentclientprotocol/sdk';
-
-const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
-
-let n = 0;
-
-acp
-  .agent({ name: 'mock-acp-agent-commands' })
-  .onRequest('initialize', () => ({
-    protocolVersion: acp.PROTOCOL_VERSION,
-    agentCapabilities: { loadSession: false },
-  }))
-  .onRequest('session/new', async (ctx) => {
-    const sessionId = `mock-session-${++n}`;
-    // Publish the command catalogue on session creation — the warm-up path relies
-    // on this arriving without a prompt.
-    await ctx.client.notify('session/update', {
-      sessionId,
-      update: {
-        sessionUpdate: 'available_commands_update',
-        availableCommands: [
-          { name: 'design:edit', description: 'Iterate on the active canvas' },
-          { name: 'flow:plan', description: 'Create a plan' },
-        ],
-      },
-    });
-    return { sessionId };
-  })
-  .onRequest('session/prompt', async (ctx) => {
-    await ctx.client.notify('session/update', {
-      sessionId: ctx.params.sessionId,
-      update: { sessionUpdate: 'agent_message_chunk', content: { type: 'text', text: 'ok' } },
-    });
-    return { stopReason: 'end_turn' };
-  })
-  .connect(stream);

package/apps/studio/test/fixtures/mock-acp-agent-elicit-flood.mjs

@@ -1,46 +0,0 @@
-#!/usr/bin/env bun
-// Mock ACP agent proving the MAX_PENDING_ELICITATIONS cap (feature-acp-ask-
-// user-question, SECURITY / ethical-hacker finding — an unbounded queue lets
-// any connected MCP server flood the client with elicitation requests). Fires
-// MORE than the cap concurrently, without waiting for each one — mirroring a
-// hostile/compromised MCP server that never waits for an answer before
-// issuing the next request — and reports which ones actually round-tripped to
-// the client vs. were declined immediately by the bridge's own cap.
-
-import { Readable, Writable } from 'node:stream';
-
-import * as acp from '@agentclientprotocol/sdk';
-
-const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
-
-const FLOOD_COUNT = 8; // > MAX_PENDING_ELICITATIONS (5) in acp/bridge.ts
-
-let n = 0;
-
-acp
-  .agent({ name: 'mock-acp-agent-elicit-flood' })
-  .onRequest('initialize', () => ({
-    protocolVersion: acp.PROTOCOL_VERSION,
-    agentCapabilities: { loadSession: false },
-  }))
-  .onRequest('session/new', () => ({ sessionId: `mock-elicit-flood-session-${++n}` }))
-  .onRequest('session/prompt', async (ctx) => {
-    const requests = Array.from({ length: FLOOD_COUNT }, (_, i) =>
-      ctx.client.request(acp.methods.client.elicitation.create, {
-        mode: 'form',
-        sessionId: ctx.params.sessionId,
-        message: `Flood question ${i}`,
-        requestedSchema: { type: 'object', properties: { [`q${i}`]: { type: 'string' } } },
-      })
-    );
-    const responses = await Promise.all(requests);
-    await ctx.client.notify('session/update', {
-      sessionId: ctx.params.sessionId,
-      update: {
-        sessionUpdate: 'agent_message_chunk',
-        content: { type: 'text', text: `responses=${JSON.stringify(responses)}` },
-      },
-    });
-    return { stopReason: 'end_turn' };
-  })
-  .connect(stream);