@1agh/maude 1.0.9 → 1.2.0

package/apps/studio/test/acp-permission-prompt.test.ts

@@ -1,251 +0,0 @@
-// SECURITY (ethical-hacker finding, retroactive review of Milestone B) —
-// pure unit tests for PermissionPrompt.jsx's default-option selection. The
-// bridge-side backend logic (resolvePermission's optionId validation) was
-// already correct and covered by test/acp-permission.test.ts; the bug this
-// covers lived entirely in the CLIENT affordance — which option Enter/the
-// visually-primary button resolves to — a seam no backend test could see.
-
-import { describe, expect, test } from 'bun:test';
-import { createElement } from 'react';
-import { renderToStaticMarkup } from 'react-dom/server';
-
-import PermissionPrompt, {
-  describeOutOfProject,
-  pickDefaultAllow,
-  pickDefaultReject,
-  sanitizePathForDisplay,
-} from '../client/panels/PermissionPrompt.jsx';
-
-describe('pickDefaultAllow', () => {
-  test('prefers allow_once over allow_always, regardless of array order', () => {
-    // Matches the REAL adapter's own ordering for a routine tool call —
-    // allow_always listed BEFORE allow_once — the exact shape that made the
-    // original `.find()` grab the wrong one.
-    const options = [
-      { optionId: 'allow-always', kind: 'allow_always', name: 'Allow always' },
-      { optionId: 'allow-once', kind: 'allow_once', name: 'Allow once' },
-      { optionId: 'reject-once', kind: 'reject_once', name: 'Reject' },
-    ];
-    expect(pickDefaultAllow(options)?.optionId).toBe('allow-once');
-  });
-
-  test('ExitPlanMode-shaped option set: prefers the once-only "manually approve edits" over auto/acceptEdits', () => {
-    // Mirrors the REAL adapter's ExitPlanMode option ordering exactly (see
-    // DDR-179 + the ethical-hacker finding): auto/acceptEdits (both
-    // allow_always) listed BEFORE the once-only "default" option.
-    const options = [
-      { optionId: 'auto', kind: 'allow_always', name: 'Yes, and use auto mode' },
-      { optionId: 'acceptEdits', kind: 'allow_always', name: 'Yes, and auto-accept edits' },
-      { optionId: 'default', kind: 'allow_once', name: 'Yes, manually approve edits' },
-      { optionId: 'plan', kind: 'reject_once', name: 'No, keep planning' },
-    ];
-    expect(pickDefaultAllow(options)?.optionId).toBe('default');
-  });
-
-  test('falls back to allow_always only when no once-only option exists', () => {
-    const options = [
-      { optionId: 'allow-always', kind: 'allow_always', name: 'Allow always' },
-      { optionId: 'reject-once', kind: 'reject_once', name: 'Reject' },
-    ];
-    expect(pickDefaultAllow(options)?.optionId).toBe('allow-always');
-  });
-
-  test('no allow-shaped option at all → null, not a reject option', () => {
-    const options = [{ optionId: 'reject-once', kind: 'reject_once', name: 'Reject' }];
-    expect(pickDefaultAllow(options)).toBeNull();
-  });
-
-  test('tolerates missing/malformed input — never throws', () => {
-    expect(pickDefaultAllow(undefined)).toBeNull();
-    expect(pickDefaultAllow(null)).toBeNull();
-    expect(
-      pickDefaultAllow([null, undefined, { kind: 'allow_once', optionId: 'x' }])?.optionId
-    ).toBe('x');
-  });
-});
-
-describe('pickDefaultReject', () => {
-  test('finds a reject_once/reject_always option regardless of position', () => {
-    const options = [
-      { optionId: 'allow-once', kind: 'allow_once', name: 'Allow once' },
-      { optionId: 'reject-once', kind: 'reject_once', name: 'Reject' },
-    ];
-    expect(pickDefaultReject(options)?.optionId).toBe('reject-once');
-  });
-
-  test('no reject-shaped option → null', () => {
-    expect(pickDefaultReject([{ optionId: 'allow-once', kind: 'allow_once' }])).toBeNull();
-  });
-
-  test('tolerates missing/malformed input — never throws', () => {
-    expect(pickDefaultReject(undefined)).toBeNull();
-    expect(pickDefaultReject(null)).toBeNull();
-  });
-});
-
-// feature-acp-write-path-scope Task 4 — the out-of-project WRITE card.
-//
-// Same reasoning as the pickDefaultAllow suite above: the affordance IS the
-// security control. A card that renders the model's own path string, or that
-// still offers an "always allow", is a speed bump rather than a gate — and
-// neither failure is visible to any bridge-side test.
-const OUT_OF_PROJECT = {
-  outOfProjectWrite: true,
-  resolvedPaths: ['/Users/x/.zshenv'],
-  scopeRoot: '/Users/x/git/project',
-  reason: 'outside',
-};
-
-describe('describeOutOfProject', () => {
-  test('absent scope → null (an ordinary permission card is unchanged)', () => {
-    expect(describeOutOfProject(undefined)).toBeNull();
-    expect(describeOutOfProject(null)).toBeNull();
-    // A scope object that isn't explicitly flagged must NOT trigger the copy —
-    // the discriminator is checked, not merely the object's presence.
-    expect(describeOutOfProject({ resolvedPaths: ['/etc/passwd'] })).toBeNull();
-  });
-
-  test('carries the resolved paths + root verbatim', () => {
-    const d = describeOutOfProject(OUT_OF_PROJECT);
-    expect(d?.paths).toEqual(['/Users/x/.zshenv']);
-    expect(d?.scopeRoot).toBe('/Users/x/git/project');
-    expect(d?.lead).toContain('outside this project');
-  });
-
-  test('plural lead for a multi-target write', () => {
-    const d = describeOutOfProject({ ...OUT_OF_PROJECT, resolvedPaths: ['/a', '/b'] });
-    expect(d?.lead).toContain('files outside this project');
-  });
-
-  test('the fail-closed reasons get their own honest copy, not "outside"', () => {
-    // `no-target` and `disagreement` are NOT "the file is outside the project" —
-    // saying so would be a claim the server never made. They are "we could not
-    // tell what will be written", which is a different thing to ask a human about.
-    expect(describeOutOfProject({ ...OUT_OF_PROJECT, reason: 'no-target' })?.lead).toContain(
-      'did not say which one'
-    );
-    expect(describeOutOfProject({ ...OUT_OF_PROJECT, reason: 'disagreement' })?.lead).toContain(
-      'two different files'
-    );
-  });
-
-  test('tolerates a malformed resolvedPaths — never throws', () => {
-    expect(describeOutOfProject({ outOfProjectWrite: true })?.paths).toEqual([]);
-    expect(
-      describeOutOfProject({ outOfProjectWrite: true, resolvedPaths: [null, '', '/ok'] })?.paths
-    ).toEqual(['/ok']);
-  });
-});
-
-describe('PermissionPrompt — render', () => {
-  const OPTIONS = [
-    { optionId: 'allow_always', kind: 'allow_always', name: 'Always Allow' },
-    { optionId: 'allow', kind: 'allow_once', name: 'Allow' },
-    { optionId: 'reject', kind: 'reject_once', name: 'Reject' },
-  ];
-  const render = (request) =>
-    renderToStaticMarkup(createElement(PermissionPrompt, { request, onRespond: () => {} }));
-
-  test('an ORDINARY request renders the generic copy and every offered option', () => {
-    const out = render({ id: '1', toolCall: { title: 'Run command' }, options: OPTIONS });
-    expect(out).toContain('Claude wants permission to continue');
-    expect(out).not.toContain('chat-perm-outside');
-    expect(out).toContain('Always Allow');
-  });
-
-  test('an OUT-OF-PROJECT write renders the RESOLVED path, never the model string', () => {
-    const out = render({
-      id: '1',
-      // `rawInput.file_path` is the model-authored string. It reads like a docs
-      // edit; only the resolution tells the truth, so the card must show the
-      // latter. Same lesson as the deep-link modal's truncated project name.
-      toolCall: {
-        title: 'Write docs/../../../.zshenv',
-        rawInput: { file_path: 'docs/../../../.zshenv' },
-      },
-      options: OPTIONS,
-      scope: OUT_OF_PROJECT,
-    });
-    expect(out).toContain('/Users/x/.zshenv');
-    expect(out).not.toContain('docs/../../../.zshenv');
-    expect(out).toContain('outside this project');
-    expect(out).toContain('/Users/x/git/project');
-  });
-
-  test('DECISION D — the out-of-project card offers NO "always" option', () => {
-    const out = render({
-      id: '1',
-      toolCall: { title: 'Write' },
-      options: OPTIONS,
-      scope: OUT_OF_PROJECT,
-    });
-    expect(out).not.toContain('Always Allow');
-    expect(out).toContain('Allow');
-    expect(out).toContain('Reject');
-    expect(out).toContain('for this request only');
-  });
-
-  test('the out-of-project card is distinguishable, not just differently worded', () => {
-    // A card that LOOKS identical to the routine one gets clicked through at the
-    // same rate, which is the whole prompt-fatigue failure mode.
-    const out = render({
-      id: '1',
-      toolCall: { title: 'Write' },
-      options: OPTIONS,
-      scope: OUT_OF_PROJECT,
-    });
-    expect(out).toContain('chat-perm--outside');
-    expect(out).toContain('file outside this project'); // aria-label
-  });
-});
-
-// SECURITY (security-auditor F3) — the resolved path's non-existent tail is
-// whatever the model asked to create, so it is attacker-influenced text in the
-// one card whose entire job is to be read accurately. React escapes markup; it
-// does NOT neutralize bidi overrides, so a path can be made to READ as harmless
-// while resolving somewhere else. Written as \u escapes on purpose: a literal
-// override in this source would reorder the test file itself in every editor.
-const RLO = '\u202E';
-const PDF = '\u202C';
-
-describe('sanitizePathForDisplay (F3)', () => {
-  test('neutralizes bidi overrides — the visual-spoofing primitive', () => {
-    const out = sanitizePathForDisplay(`/Users/x/safe/${RLO}gnp.esriv${PDF}`);
-    expect(out).not.toContain(RLO);
-    expect(out).not.toContain(PDF);
-    // Replaced, not deleted — a tampered path should look ODD, not just shorter.
-    expect(out).toContain('\uFFFD');
-  });
-
-  test('neutralizes C0 controls (newline/CR can hide a whole path segment)', () => {
-    const out = sanitizePathForDisplay('/Users/x/a\nb\rc');
-    expect(out).not.toMatch(/[\n\r]/);
-  });
-
-  test('also covers zero-width, directional marks and soft hyphen (F3 nit)', () => {
-    // Zero-width joiners and directional marks are invisible, so they can split
-    // or re-order a path name without leaving any visible trace at all — the
-    // same class of trick as the overrides, just quieter.
-    const sneaky = '/Users/x/\u200Bzsh\u200Cenv\u061C\u00AD';
-    const out = sanitizePathForDisplay(sneaky);
-    for (const ch of ['\u200B', '\u200C', '\u061C', '\u00AD']) {
-      expect(out).not.toContain(ch);
-    }
-  });
-
-  test('leaves an ordinary path completely untouched', () => {
-    const p = '/Users/x/git/project/.design/ui/home.tsx';
-    expect(sanitizePathForDisplay(p)).toBe(p);
-  });
-
-  test('describeOutOfProject sanitizes BOTH the paths and the scope root', () => {
-    const d = describeOutOfProject({
-      outOfProjectWrite: true,
-      reason: 'outside',
-      resolvedPaths: [`/Users/x/${RLO}evil`],
-      scopeRoot: `/Users/x/${RLO}root`,
-    });
-    expect(d.paths[0]).not.toContain(RLO);
-    expect(d.scopeRoot).not.toContain(RLO);
-  });
-});

package/apps/studio/test/acp-permission.test.ts

@@ -1,278 +0,0 @@
-// Proves the permission approve/deny gate end-to-end (Milestone B, retires
-// DDR-125 F2's blanket auto-approve) against a mock ACP agent that calls back
-// into the client via a REAL `session/request_permission` request (fixtures/
-// mock-acp-agent-permission.mjs) — no real `claude` needed. Covers:
-//   • requestPermission is forwarded via onPermissionRequest (+ onPermission
-//     transparency) and stays pending until resolvePermission is called.
-//   • A valid decision (an offered optionId, or 'cancelled') resolves it.
-//   • An UNOFFERED decision fails closed to 'cancelled' (DDR-125 F1 posture).
-//   • Timeout defaults to 'cancelled' (deny), never allow.
-//   • A turn-cancel denies every pending request instead of leaving it hung.
-//   • The Acp manager relays permission-request/-response frames end to end.
-
-import { afterEach, describe, expect, test } from 'bun:test';
-import { join } from 'node:path';
-
-import type { ServerWebSocket } from 'bun';
-
-import { AcpBridge, MAX_PENDING_PERMISSIONS } from '../acp/bridge.ts';
-import { createAcp } from '../acp/index.ts';
-import type { Context } from '../context.ts';
-import type { WsData } from '../ws.ts';
-
-const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent-permission.mjs');
-const FIXTURE_FLOOD = join(import.meta.dir, 'fixtures', 'mock-acp-agent-permission-flood.mjs');
-const TEST_ENV_KEYS = ['MAUDE_ACP_ADAPTER_ENTRY', 'MAUDE_ACP_RUNTIME', 'MAUDE_CLAUDE_BIN'];
-
-function useMockAgent(fixture = FIXTURE) {
-  process.env.MAUDE_ACP_ADAPTER_ENTRY = fixture;
-  process.env.MAUDE_ACP_RUNTIME = process.execPath;
-  process.env.MAUDE_CLAUDE_BIN = process.execPath;
-}
-
-afterEach(() => {
-  for (const key of TEST_ENV_KEYS) delete process.env[key];
-});
-
-async function until<T>(fn: () => T | undefined, timeoutMs = 12000): Promise<T> {
-  const start = performance.now();
-  for (;;) {
-    const v = fn();
-    if (v !== undefined) return v;
-    if (performance.now() - start > timeoutMs) throw new Error('timeout waiting for condition');
-    await new Promise((r) => setTimeout(r, 25));
-  }
-}
-
-function fakeWs(id: string) {
-  const frames: Array<Record<string, unknown>> = [];
-  const ws = {
-    data: { id } as WsData,
-    send: (raw: string) => {
-      frames.push(JSON.parse(raw));
-    },
-  } as unknown as ServerWebSocket<WsData>;
-  return { ws, frames };
-}
-
-describe('AcpBridge — permission approve/deny (Task B1)', () => {
-  test('a request is forwarded via onPermissionRequest + onPermission, stays pending, and a valid decision resolves the turn', async () => {
-    useMockAgent();
-    const requests: Array<{ id: string; toolCallTitle?: string; optionIds: string[] }> = [];
-    const transparency: unknown[] = [];
-    const bridge = new AcpBridge({
-      repoRoot: process.cwd(),
-      onUpdate: () => {},
-      onPermission: (req) => transparency.push(req),
-      onPermissionRequest: (id, req) =>
-        requests.push({
-          id,
-          toolCallTitle: req.toolCall?.title,
-          optionIds: req.options.map((o) => o.optionId),
-        }),
-    });
-    try {
-      const promptPromise = bridge.prompt('hi', 'c1');
-      const req = await until(() => (requests.length ? requests[0] : undefined));
-      expect(req.toolCallTitle).toBe('Write file');
-      // `allow-always` is ABSENT, and that is the point (feature-acp-write-path-
-      // scope Decision D + security-auditor F2). This fixture's tool call is
-      // `kind:'edit'` targeting `/tmp/x` — a write-shaped call landing OUTSIDE
-      // the bridge's project root — so the bridge strips every `allow_always`
-      // option before offering it, and validates any response against that same
-      // filtered set. Consent for an out-of-project write is per-call; one click
-      // must not be able to install a session-wide standing rule.
-      expect(req.optionIds).toEqual(['allow-once', 'reject-once']);
-      expect(transparency.length).toBe(1); // transparency fires unconditionally too
-
-      bridge.resolvePermission(req.id, 'allow-once');
-      await promptPromise;
-    } finally {
-      await bridge.stop();
-    }
-  }, 15000);
-
-  test('an unoffered decision fails closed to cancelled — never forwards an arbitrary optionId', async () => {
-    useMockAgent();
-    const updates: unknown[] = [];
-    const requests: Array<{ id: string }> = [];
-    const bridge = new AcpBridge({
-      repoRoot: process.cwd(),
-      onUpdate: (u) => updates.push(u),
-      onPermissionRequest: (id) => requests.push({ id }),
-    });
-    try {
-      const promptPromise = bridge.prompt('hi', 'c1');
-      const req = await until(() => (requests.length ? requests[0] : undefined));
-      // Not one of ['allow-once','allow-always','reject-once'] — must deny, not select.
-      bridge.resolvePermission(req.id, 'some-optionId-never-offered');
-      await promptPromise;
-      const text = updates.map((u) => u?.content?.text ?? '').join('');
-      expect(text).toContain('"outcome":"cancelled"');
-      expect(text).not.toContain('some-optionId-never-offered');
-    } finally {
-      await bridge.stop();
-    }
-  }, 15000);
-
-  test('resolvePermission("cancelled") denies explicitly', async () => {
-    useMockAgent();
-    const updates: unknown[] = [];
-    const requests: Array<{ id: string }> = [];
-    const bridge = new AcpBridge({
-      repoRoot: process.cwd(),
-      onUpdate: (u) => updates.push(u),
-      onPermissionRequest: (id) => requests.push({ id }),
-    });
-    try {
-      const promptPromise = bridge.prompt('hi', 'c1');
-      const req = await until(() => (requests.length ? requests[0] : undefined));
-      bridge.resolvePermission(req.id, 'cancelled');
-      await promptPromise;
-      const text = updates.map((u) => u?.content?.text ?? '').join('');
-      expect(text).toContain('"outcome":"cancelled"');
-    } finally {
-      await bridge.stop();
-    }
-  }, 15000);
-
-  test('a stale/unknown id is a silent no-op — never throws', async () => {
-    useMockAgent();
-    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
-    try {
-      expect(() => bridge.resolvePermission('does-not-exist', 'allow-once')).not.toThrow();
-    } finally {
-      await bridge.stop();
-    }
-  }, 15000);
-
-  test('timeout defaults to cancelled (deny), never allow', async () => {
-    useMockAgent();
-    const updates: unknown[] = [];
-    const bridge = new AcpBridge({
-      repoRoot: process.cwd(),
-      onUpdate: (u) => updates.push(u),
-      permissionTimeoutMs: 150, // short override — see AcpBridgeOptions.permissionTimeoutMs (tests only)
-    });
-    try {
-      await bridge.prompt('hi', 'c1'); // never calls resolvePermission — must resolve itself
-      const text = updates.map((u) => u?.content?.text ?? '').join('');
-      expect(text).toContain('"outcome":"cancelled"');
-    } finally {
-      await bridge.stop();
-    }
-  }, 15000);
-
-  test('a turn-cancel denies every pending permission request instead of hanging it forever', async () => {
-    useMockAgent();
-    const requests: Array<{ id: string }> = [];
-    const bridge = new AcpBridge({
-      repoRoot: process.cwd(),
-      onUpdate: () => {},
-      onPermissionRequest: (id) => requests.push({ id }),
-      permissionTimeoutMs: 60000, // long — proves cancel() settles it, not the timeout racing in
-    });
-    try {
-      const promptPromise = bridge.prompt('hi', 'c1');
-      await until(() => (requests.length ? true : undefined));
-      await bridge.cancel(); // must deny the pending request, not leave it hanging
-      await promptPromise; // resolves because the mock's requestPermission() call unblocked
-    } finally {
-      await bridge.stop();
-    }
-  }, 15000);
-});
-
-describe('Acp manager — permission-request/-response frames (Task B2)', () => {
-  test('a permission-request frame is relayed to the client and a valid permission-response resolves it', async () => {
-    useMockAgent();
-    const ctx = {
-      paths: { repoRoot: process.cwd(), designRoot: '/tmp/does-not-matter' },
-    } as unknown as Context;
-    const acp = createAcp(ctx);
-
-    const a = fakeWs('perm-ws-a');
-    try {
-      acp.onOpen(a.ws);
-      acp.onMessage(a.ws, JSON.stringify({ t: 'prompt', text: 'hi', chat: 'c1' }));
-      const reqFrame = await until(() => a.frames.find((f) => f.t === 'permission-request'));
-      expect(reqFrame.toolCall).toMatchObject({ title: 'Write file' });
-      const options = reqFrame.options as Array<{ optionId: string }>;
-      // See the Task B1 test above — `allow-always` is stripped for this
-      // out-of-project write-shaped call, and the FRAME carries the filtered
-      // set, so the client is shown the real options rather than a cosmetic
-      // subset the server would then reject.
-      expect(options.map((o) => o.optionId)).toEqual(['allow-once', 'reject-once']);
-
-      acp.onMessage(
-        a.ws,
-        JSON.stringify({ t: 'permission-response', id: reqFrame.id, decision: 'allow-once' })
-      );
-      await until(() => a.frames.find((f) => f.t === 'turn-end'));
-    } finally {
-      acp.onClose(a.ws);
-      // Task 8 — `onClose` DETACHES now; it no longer stops the bridge (that is
-      // the point: a page reload must not kill a running turn). So a test that
-      // relied on socket-close for teardown leaks the adapter subprocess for the
-      // whole DETACHED_TTL_MS. Tear down explicitly.
-      acp.stopAll();
-      await new Promise((r) => setTimeout(r, 50));
-    }
-  }, 20000);
-
-  test('a permission-response with an unknown id is a harmless no-op — the turn still settles via timeout', async () => {
-    useMockAgent();
-    const ctx = {
-      paths: { repoRoot: process.cwd(), designRoot: '/tmp/does-not-matter-2' },
-    } as unknown as Context;
-    const acp = createAcp(ctx);
-
-    const a = fakeWs('perm-ws-b');
-    try {
-      acp.onOpen(a.ws);
-      acp.onMessage(a.ws, JSON.stringify({ t: 'prompt', text: 'hi', chat: 'c1' }));
-      await until(() => a.frames.find((f) => f.t === 'permission-request'));
-
-      // Bogus id — must not throw / crash the manager.
-      expect(() =>
-        acp.onMessage(
-          a.ws,
-          JSON.stringify({ t: 'permission-response', id: 'not-a-real-id', decision: 'allow-once' })
-        )
-      ).not.toThrow();
-    } finally {
-      acp.onClose(a.ws);
-      await new Promise((r) => setTimeout(r, 50));
-    }
-  }, 20000);
-});
-
-// SECURITY (ethical-hacker finding, retroactive review) — a single agent turn
-// can legitimately issue several tool calls back to back, so "one per tool
-// call" was never a real ceiling on `pendingPermissions`. Prove the cap: a
-// flood of concurrent requests only ever keeps MAX_PENDING_PERMISSIONS of
-// them live at once — the rest are denied immediately rather than queued.
-describe('AcpBridge — permission flood cap', () => {
-  test(`a burst of concurrent permission requests only forwards ${MAX_PENDING_PERMISSIONS} to the client — the rest deny immediately`, async () => {
-    useMockAgent(FIXTURE_FLOOD);
-    const requests: Array<{ id: string }> = [];
-    const bridge = new AcpBridge({
-      repoRoot: process.cwd(),
-      onUpdate: () => {},
-      onPermissionRequest: (id) => requests.push({ id }),
-    });
-    try {
-      const promptPromise = bridge.prompt('hi', 'c1');
-      // Denying is synchronous inside requestPermission once the cap trips,
-      // so there's nothing further to await once every request has had a
-      // chance to arrive.
-      await new Promise((r) => setTimeout(r, 300));
-      expect(requests.length).toBeLessThanOrEqual(MAX_PENDING_PERMISSIONS);
-      expect(requests.length).toBeGreaterThan(0);
-      for (const req of requests) bridge.resolvePermission(req.id, 'cancelled');
-      await promptPromise;
-    } finally {
-      await bridge.stop();
-    }
-  }, 15000);
-});

package/apps/studio/test/acp-plugin-bootstrap.test.ts

@@ -1,89 +0,0 @@
-// ACP session-scoped plugin auto-bootstrap resolver (DDR-143; unconditional
-// injection DDR-168).
-//
-// The pure gate logic — native/bundle context and per-plugin bundled-dir
-// presence — all exercised without touching disk or ~/.claude. Since DDR-168,
-// there is no longer a `scan`-gated no-op: a bundled plugin injects regardless
-// of whether it's ALSO installed on disk (the double-registration risk that
-// used to gate this is now closed structurally in bridge.ts instead — see
-// acp-session-plugins.test.ts). The wire-level presence test (that the
-// resolved configs actually land on `_meta.claudeCode.options.plugins`) lives
-// in acp-session-plugins.test.ts.
-
-import { describe, expect, test } from 'bun:test';
-
-import { computeSessionPlugins } from '../acp/plugin-bootstrap.ts';
-
-const DESIGN = '/bundle/plugins/design';
-const FLOW = '/bundle/plugins/flow';
-const KGAI = '/bundle/plugins/kgai';
-
-describe('computeSessionPlugins — gates', () => {
-  // `/flow` auto-load is intentionally OFF for now (2026-07-03) — only `design`
-  // is ever injected, even when the flow dir resolves.
-  test('native, both bundled ⇒ inject design only (flow disabled)', () => {
-    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
-    expect(out).toEqual([{ type: 'local', path: DESIGN, skipMcpDiscovery: true }]);
-  });
-
-  // DDR-168 — no more no-op gate: injection no longer depends on disk state.
-  // The double-registration risk this used to guard against is now closed
-  // structurally via bridge.ts's `options.settings.enabledPlugins` override.
-  test('design already installed on disk ⇒ STILL injects (no more scan-gated no-op)', () => {
-    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
-    expect(out).toEqual([{ type: 'local', path: DESIGN, skipMcpDiscovery: true }]);
-  });
-
-  test('native-only gate: not native (web serve) ⇒ inject nothing even if dirs resolve', () => {
-    const out = computeSessionPlugins({ native: false, designDir: DESIGN, flowDir: FLOW });
-    expect(out).toEqual([]);
-  });
-
-  test('path-missing gate: design dir null ⇒ inject nothing (flow disabled, so no fallback)', () => {
-    const out = computeSessionPlugins({ native: true, designDir: null, flowDir: FLOW });
-    expect(out).toEqual([]);
-  });
-
-  test('web/npm layout: native false AND both dirs null ⇒ empty', () => {
-    const out = computeSessionPlugins({ native: false, designDir: null, flowDir: null });
-    expect(out).toEqual([]);
-  });
-
-  test('every injected config sets skipMcpDiscovery (SDK host owns MCP)', () => {
-    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
-    expect(out.every((c) => c.skipMcpDiscovery === true && c.type === 'local')).toBe(true);
-  });
-
-  // feature-kgai-ecosystem-integration Phase 8 — the third-party kgai plugin
-  // carries the `Stop` hook that IS autonomous decision capture. Without
-  // injection the packaged app records nothing (settingSources:['user'], and a
-  // terminal-less DDR-177 user never marketplace-installs it).
-  test('kgai bundled ⇒ injected alongside design (autonomous capture in the .app)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      kgaiDir: KGAI,
-    });
-    expect(out).toEqual([
-      { type: 'local', path: DESIGN, skipMcpDiscovery: true },
-      { type: 'local', path: KGAI, skipMcpDiscovery: true },
-    ]);
-  });
-
-  test('kgai absent (dev tree / npm layout) ⇒ design only, no crash', () => {
-    expect(
-      computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW, kgaiDir: null })
-    ).toEqual([{ type: 'local', path: DESIGN, skipMcpDiscovery: true }]);
-    // omitted entirely (optional field) behaves the same
-    expect(computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW })).toEqual([
-      { type: 'local', path: DESIGN, skipMcpDiscovery: true },
-    ]);
-  });
-
-  test('not native ⇒ kgai is NOT injected either (web-serve gate holds)', () => {
-    expect(
-      computeSessionPlugins({ native: false, designDir: DESIGN, flowDir: FLOW, kgaiDir: KGAI })
-    ).toEqual([]);
-  });
-});