@junghanacs/entwurf 0.12.0

package/scripts/check-acp-config.ts

@@ -0,0 +1,322 @@
+// Deterministic gate for the S2g operator provider-config loader. Pure +
+// temp-dir settings I/O — IN pnpm check. No child, no spawn.
+//
+// Locks the GPT `…2f9325` config-passthrough invariants:
+//   1. global/project merge: scalar override (project-defined only) + mcpServers
+//      per-name shallow merge with project override.
+//   2. defaults: strictMcpConfig true, settingSources [], tools/permission/
+//      disallowed baseline, skillPlugins [].
+//   3. invalid mcpServers (root / entry / args / env / headers / type / url) →
+//      McpServerConfigError naming the offending server.
+//   4. invalid skillPlugins (relative / missing dir / missing manifest) → fail-loud.
+//   5. nonempty skillPlugins → Skill tool + Skill(*) permission auto-added.
+//   6. appendSystemPrompt: true → fail-loud (unsupported).
+//   7. strictMcpConfig: false → fail-loud (Hard Rule #4).
+//   8. normalized mcp hash: deterministic + sorted; a command/env/header/url
+//      change changes the hash (NOT just a name change). The envelope enrich
+//      injects PI_SESSION_ID/PI_AGENT_ID into entwurf-bridge only, filters stale
+//      values, leaves http/sse untouched, and runs AFTER the hash is taken.
+
+import { strict as assert } from "node:assert";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import type { AcpAdapterSettingsParams, AcpBackendAdapter } from "../pi-extensions/lib/acp/backend-adapter.ts";
+import {
+	type AcpMcpServer,
+	enrichMcpServersWithEnvelope,
+	McpServerConfigError,
+	mcpServerNames,
+	normalizeMcpServers,
+	resolveProviderConfig,
+} from "../pi-extensions/lib/acp/config.ts";
+import {
+	DEFAULT_CLAUDE_DISALLOWED_TOOLS,
+	DEFAULT_CLAUDE_PERMISSION_ALLOW,
+	DEFAULT_CLAUDE_TOOLS,
+} from "../pi-extensions/lib/acp/tool-surface.ts";
+
+// A minimal fake adapter — config.ts only ever calls `resolveAdapterSettings`, so the
+// other methods are never exercised here (cast through unknown). Keeps this gate from
+// loading the real backend-adapter.js (and its .js sibling value imports) at runtime;
+// the type import above is erased by strip-types.
+function fakeAdapter(resolveAdapterSettings: (p: AcpAdapterSettingsParams) => unknown): AcpBackendAdapter {
+	return { backend: "fake", resolveAdapterSettings } as unknown as AcpBackendAdapter;
+}
+const claudeLikeFake = fakeAdapter(() => undefined);
+
+const root = mkdtempSync(resolve(tmpdir(), "acp-config-gate-"));
+const NONE = join(root, "__absent__.json");
+
+/** Write a settings file with the given entwurfProvider block; return path. */
+function settings(name: string, block: unknown): string {
+	const p = join(root, name);
+	writeFileSync(p, JSON.stringify({ entwurfProvider: block }));
+	return p;
+}
+
+function resolveWith(globalPath: string, projectPath: string, adapter: AcpBackendAdapter = claudeLikeFake) {
+	return resolveProviderConfig({
+		cwd: root,
+		modelId: "claude-sonnet-4-6",
+		adapter,
+		globalSettingsPath: globalPath,
+		projectSettingsPath: projectPath,
+	});
+}
+
+const DEFAULT_TOOLS = ["Read", "Bash", "Edit", "Write"];
+
+try {
+	// ----------------------------------------------------------------------
+	// 1) defaults (no settings files at all)
+	// ----------------------------------------------------------------------
+	{
+		const c = resolveWith(NONE, NONE);
+		assert.deepEqual(c.settingSources, [], "settingSources defaults to []");
+		assert.equal(c.strictMcpConfig, true, "strictMcpConfig defaults to true");
+		assert.equal(c.showToolNotifications, true, "showToolNotifications defaults to true");
+		assert.deepEqual(c.mcpServers, [], "mcpServers defaults to []");
+		assert.deepEqual(c.tools, DEFAULT_TOOLS, "tools defaults to the pi baseline");
+		assert.ok(c.permissionAllow.includes("mcp__*"), "permissionAllow defaults include mcp__*");
+		assert.ok(c.disallowedTools.includes("WebSearch"), "disallowedTools defaults applied");
+		assert.deepEqual(c.skillPlugins, [], "skillPlugins defaults to []");
+		// Amber drift-lock (GPT `…2f9325`): config.ts mirrors the defaults as local
+		// constants (strip-types value-import ban). Assert they stay in lockstep with
+		// tool-surface.ts — the SSOT — so a one-sided edit fails this gate.
+		assert.deepEqual(
+			[...c.tools],
+			[...DEFAULT_CLAUDE_TOOLS],
+			"resolved default tools == tool-surface DEFAULT_CLAUDE_TOOLS",
+		);
+		assert.deepEqual(
+			[...c.permissionAllow],
+			[...DEFAULT_CLAUDE_PERMISSION_ALLOW],
+			"resolved default permissionAllow == tool-surface DEFAULT_CLAUDE_PERMISSION_ALLOW",
+		);
+		assert.deepEqual(
+			[...c.disallowedTools],
+			[...DEFAULT_CLAUDE_DISALLOWED_TOOLS],
+			"resolved default disallowedTools == tool-surface DEFAULT_CLAUDE_DISALLOWED_TOOLS",
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// 2) merge: project overrides global for defined keys; mcpServers merge per name
+	// ----------------------------------------------------------------------
+	{
+		const g = settings("g2.json", {
+			settingSources: ["user"],
+			mcpServers: { alpha: { command: "a" }, shared: { command: "global-shared" } },
+		});
+		const p = settings("p2.json", {
+			mcpServers: { beta: { type: "http", url: "https://b.test" }, shared: { command: "project-shared" } },
+		});
+		const c = resolveWith(g, p);
+		// project did NOT set settingSources → global value survives (not nuked by undefined).
+		assert.deepEqual(c.settingSources, ["user"], "absent project key keeps the global value");
+		// mcpServers: union of names, project wins on `shared`.
+		assert.deepEqual(mcpServerNames(c), ["alpha", "beta", "shared"], "mcpServers merge is the union, name-sorted");
+		const shared = c.mcpServers.find((s) => s.name === "shared") as Extract<AcpMcpServer, { command: string }>;
+		assert.equal(shared.command, "project-shared", "project overrides the global server of the same name");
+	}
+	assert.throws(
+		() => normalizeMcpServers([] as unknown as Record<string, unknown>),
+		McpServerConfigError,
+		"array root rejected",
+	);
+	assert.throws(
+		() => normalizeMcpServers({ x: { command: "" } }),
+		/x: stdio server requires/,
+		"empty command rejected",
+	);
+	assert.throws(() => normalizeMcpServers({ x: { command: "c", args: [1] } }), /x: "args/, "non-string arg rejected");
+	assert.throws(
+		() => normalizeMcpServers({ x: { command: "c", env: [{ name: "A" }] } }),
+		/x: "env/,
+		"env entry without value rejected",
+	);
+	assert.throws(
+		() => normalizeMcpServers({ x: { type: "http" } }),
+		/x: http server requires/,
+		"http without url rejected",
+	);
+	assert.throws(
+		() => normalizeMcpServers({ x: { type: "bogus" } }),
+		/x: unsupported "type"/,
+		"unsupported type rejected",
+	);
+	// the error carries structured issues naming each bad server.
+	try {
+		normalizeMcpServers({ bad1: { command: "" }, bad2: { type: "sse" } });
+		assert.fail("expected McpServerConfigError");
+	} catch (e) {
+		assert.ok(e instanceof McpServerConfigError, "is a McpServerConfigError");
+		assert.deepEqual(e.issues.map((i) => i.server).sort(), ["bad1", "bad2"], "issues name every offending server");
+	}
+
+	// ----------------------------------------------------------------------
+	// 4) invalid skillPlugins → fail-loud
+	// ----------------------------------------------------------------------
+	{
+		assert.throws(
+			() => resolveWith(NONE, settings("p4a.json", { skillPlugins: ["relative/path"] })),
+			/must be an absolute path/,
+			"relative skillPlugin path rejected",
+		);
+		assert.throws(
+			() => resolveWith(NONE, settings("p4b.json", { skillPlugins: [join(root, "nope")] })),
+			/does not exist/,
+			"missing skillPlugin dir rejected",
+		);
+		const noManifest = join(root, "nomanifest");
+		mkdirSync(noManifest, { recursive: true });
+		assert.throws(
+			() => resolveWith(NONE, settings("p4c.json", { skillPlugins: [noManifest] })),
+			/missing \.claude-plugin\/plugin\.json/,
+			"skillPlugin without manifest rejected",
+		);
+	}
+
+	// ----------------------------------------------------------------------
+	// 5) nonempty skillPlugins → Skill + Skill(*) auto-added
+	// ----------------------------------------------------------------------
+	{
+		const skill = join(root, "okskill");
+		mkdirSync(join(skill, ".claude-plugin"), { recursive: true });
+		writeFileSync(join(skill, ".claude-plugin", "plugin.json"), JSON.stringify({ name: "okskill" }));
+		const c = resolveWith(NONE, settings("p5.json", { skillPlugins: [skill] }));
+		assert.ok(c.tools.includes("Skill"), "Skill tool auto-added");
+		assert.ok(c.permissionAllow.includes("Skill(*)"), "Skill(*) permission auto-added");
+		assert.deepEqual(c.skillPlugins, [skill], "the plugin path is carried through");
+		// idempotent: an operator who already listed Skill is not duplicated.
+		const c2 = resolveWith(NONE, settings("p5b.json", { skillPlugins: [skill], tools: ["Read", "Skill"] }));
+		assert.equal(c2.tools.filter((t) => t === "Skill").length, 1, "Skill is not duplicated");
+	}
+	assert.throws(
+		() => resolveWith(NONE, settings("p6.json", { appendSystemPrompt: true })),
+		/appendSystemPrompt: true is unsupported/,
+		"appendSystemPrompt:true rejected (rich context = first-user augment)",
+	);
+	// false / absent is fine.
+	assert.doesNotThrow(() => resolveWith(NONE, settings("p6b.json", { appendSystemPrompt: false })), "false is allowed");
+	assert.throws(
+		() => resolveWith(NONE, settings("p7.json", { strictMcpConfig: false })),
+		/strictMcpConfig: false is unsupported/,
+		"strictMcpConfig:false rejected (Hard Rule #4: no ambient MCP)",
+	);
+	assert.doesNotThrow(() => resolveWith(NONE, settings("p7b.json", { strictMcpConfig: true })), "true is allowed");
+
+	// backend is a DIAGNOSTIC field, parsed SYNTACTICALLY only — config does NOT
+	// whitelist values (the adapter registry owns valid backends; the model-id
+	// prefix is the routing authority). The declared-vs-routed mismatch guard lives
+	// in backend.ts, NOT here. So config accepts ANY backend string and surfaces it.
+	{
+		const claudeBackend = resolveWith(NONE, settings("p7c.json", { backend: "claude" }));
+		assert.equal(claudeBackend.backend, "claude", "backend string is parsed and surfaced");
+		// A fictional, unregistered backend name — config must accept ANY string (the
+		// registry, not config, owns the valid set). NOT a real backend: this gate never
+		// implements one; a real backend brings its own adapter PR + gates.
+		const future = resolveWith(NONE, settings("p7d.json", { backend: "demobackend" }));
+		assert.equal(future.backend, "demobackend", "config does NOT whitelist backend values (no claude-only gate)");
+		const absent = resolveWith(NONE, settings("p7e.json", {}));
+		assert.equal(absent.backend, undefined, "absent backend → undefined");
+		assert.throws(
+			() => resolveWith(NONE, settings("p7f.json", { backend: 123 })),
+			/backend must be a string/,
+			"non-string backend rejected (syntactic guard)",
+		);
+	}
+
+	// adapterSettings seam (generic plumbing — uses a FICTIONAL backend key, implements
+	// NO real backend): the routed adapter's resolveAdapterSettings receives the RAW
+	// blocks, and its opaque return lands on config.adapterSettings. A backend-specific
+	// key (`demoSetting` here) rides the raw block to the hook but NEVER appears on the
+	// common ResolvedAcpConfig. Real backends bring their own adapter PR + gates; this
+	// gate only proves the rail carries arbitrary backend settings without polluting common.
+	{
+		const sentinel = { ok: true };
+		let captured: AcpAdapterSettingsParams | undefined;
+		const recording = fakeAdapter((p) => {
+			captured = p;
+			return sentinel;
+		});
+		const block = { backend: "demobackend", demoSetting: "demo-val", tools: ["Read"] };
+		const cfg = resolveWith(NONE, settings("p7g.json", block), recording);
+		assert.equal(cfg.adapterSettings, sentinel, "adapterSettings = the opaque value the adapter returned");
+		assert.ok(captured, "resolveAdapterSettings was called");
+		assert.equal(captured?.mergedBlock.demoSetting, "demo-val", "raw mergedBlock carries backend keys to the hook");
+		assert.equal(captured?.projectBlock.demoSetting, "demo-val", "raw projectBlock passed for error attribution");
+		assert.ok(
+			!Object.hasOwn(cfg as object, "demoSetting"),
+			"backend-specific key NEVER lands on the common ResolvedAcpConfig (no fat-bridge regression)",
+		);
+		const claudeLike = resolveWith(NONE, settings("p7h.json", {}));
+		assert.equal(claudeLike.adapterSettings, undefined, "a backend with no own settings → adapterSettings undefined");
+	}
+
+	// ----------------------------------------------------------------------
+	// 8) hash determinism + sensitivity; envelope enrich semantics
+	// ----------------------------------------------------------------------
+	{
+		const a = normalizeMcpServers({ z: { command: "c", args: ["1"] }, a: { command: "c" } });
+		const b = normalizeMcpServers({ a: { command: "c" }, z: { command: "c", args: ["1"] } });
+		assert.equal(a.hash, b.hash, "hash is order-independent (servers sorted before hashing)");
+		assert.deepEqual(
+			a.servers.map((s) => s.name),
+			["a", "z"],
+			"servers are name-sorted",
+		);
+		// a command / arg / env change changes the hash (not just a name change).
+		assert.notEqual(
+			normalizeMcpServers({ a: { command: "c" } }).hash,
+			normalizeMcpServers({ a: { command: "DIFFERENT" } }).hash,
+			"command change changes the hash",
+		);
+		assert.notEqual(
+			normalizeMcpServers({ a: { command: "c" } }).hash,
+			normalizeMcpServers({ a: { command: "c", env: { K: "V" } } }).hash,
+			"env change changes the hash",
+		);
+		assert.notEqual(
+			normalizeMcpServers({ a: { type: "http", url: "https://x.test" } }).hash,
+			normalizeMcpServers({ a: { type: "http", url: "https://y.test", headers: { H: "V" } } }).hash,
+			"url/header change changes the hash",
+		);
+
+		// enrich: PI_SESSION_ID/PI_AGENT_ID into entwurf-bridge only; stale filtered;
+		// http untouched; other stdio untouched.
+		const servers = normalizeMcpServers({
+			"entwurf-bridge": { command: "node", env: { PI_SESSION_ID: "STALE", FOO: "bar" } },
+			weather: { type: "http", url: "https://w.test" },
+			other: { command: "x" },
+		}).servers;
+		const enriched = enrichMcpServersWithEnvelope(servers, { modelId: "claude-sonnet-4-6", piSessionId: "LIVE-1" });
+		const bridge = enriched.find((s) => s.name === "entwurf-bridge") as Extract<AcpMcpServer, { command: string }>;
+		const env = Object.fromEntries(bridge.env.map((e) => [e.name, e.value]));
+		assert.equal(env.PI_SESSION_ID, "LIVE-1", "live PI_SESSION_ID wins over the stale operator value");
+		assert.equal(env.PI_AGENT_ID, "entwurf/claude-sonnet-4-6", "PI_AGENT_ID injected from the model id");
+		assert.equal(env.FOO, "bar", "operator env preserved");
+		const weather = enriched.find((s) => s.name === "weather");
+		assert.ok(!("env" in (weather ?? {})), "http server not enriched (no env carrier)");
+		const other = enriched.find((s) => s.name === "other") as Extract<AcpMcpServer, { command: string }>;
+		assert.deepEqual(other.env, [], "a non-bridge stdio server keeps its (empty) env untouched");
+		// enrich does NOT mutate the normalized list (hash taken earlier stays valid).
+		assert.equal(
+			normalizeMcpServers({ "entwurf-bridge": { command: "node", env: { PI_SESSION_ID: "STALE", FOO: "bar" } } })
+				.servers[0].name,
+			"entwurf-bridge",
+			"enrich is a pure map — the source normalized list is unchanged",
+		);
+	}
+
+	console.log(
+		"[check-acp-config] ok — defaults (strict-mcp on, [] sources, baseline tools); project overrides global only for " +
+			"defined keys; mcpServers merge per-name with project win; invalid mcpServers/skillPlugins fail loud naming the " +
+			"offender; nonempty skillPlugins auto-add Skill+Skill(*); appendSystemPrompt:true and strictMcpConfig:false are " +
+			"rejected; mcp hash is sorted+deterministic and sensitive to command/args/env/url/headers; envelope enrich injects " +
+			"PI_SESSION_ID/PI_AGENT_ID into entwurf-bridge only (stale filtered), leaves http/other stdio untouched, post-hash",
+	);
+} finally {
+	rmSync(root, { recursive: true, force: true });
+}

package/scripts/check-acp-event-mapper.ts

@@ -0,0 +1,253 @@
+// Deterministic gate for the S2c ACP→pi event mapper + context conversion.
+//
+// Feeds synthetic ACP session_notification updates through the mapper and
+// asserts the emitted pi AssistantMessageEvent sequence, including the critical
+// boundary: ACP tool_call / tool_call_update render as TEXT NOTICES, never as
+// structured toolcall_* events (the ACP child already executed the tool — a
+// structured pi ToolCall would trigger re-execution). Also locks the S2c
+// context→ACP-prompt conversion: transcript passthrough that excludes
+// systemPrompt and never replays structured tools.
+//
+// Pure/deterministic — IN pnpm check.
+
+import { strict as assert } from "node:assert";
+import type { AssistantMessageEvent, Context } from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
+import { contextToAcpPrompt, contextTranscript } from "../pi-extensions/lib/acp/context.ts";
+import {
+	type AcpPiStreamState,
+	applyAcpSessionUpdate,
+	createAcpStreamState,
+	finalizeAcpStreamState,
+} from "../pi-extensions/lib/acp/event-mapper.ts";
+
+const IDENTITY = { api: "entwurf", provider: "entwurf", model: "claude-sonnet-4-6" };
+
+// Drive a set of synthetic updates through a fresh mapper and collect every
+// emitted event (push is synchronous; the terminal done drains the queue).
+async function drive(
+	updates: Array<Record<string, unknown>>,
+): Promise<{ events: AssistantMessageEvent[]; state: AcpPiStreamState }> {
+	const stream = createAssistantMessageEventStream();
+	const state = createAcpStreamState(stream, IDENTITY, { timestamp: 0 });
+	stream.push({ type: "start", partial: state.output });
+	for (const u of updates) applyAcpSessionUpdate(state, u);
+	finalizeAcpStreamState(state);
+	stream.push({ type: "done", reason: "stop", message: state.output });
+	const events: AssistantMessageEvent[] = [];
+	for await (const ev of stream) events.push(ev);
+	return { events, state };
+}
+
+const types = (events: AssistantMessageEvent[]): string[] => events.map((e) => e.type);
+const deltas = (events: AssistantMessageEvent[]): string[] =>
+	events
+		.filter((e): e is Extract<AssistantMessageEvent, { type: "text_delta" }> => e.type === "text_delta")
+		.map((e) => e.delta);
+
+// ---------------------------------------------------------------------------
+// 1) agent_message_chunk → text_start / text_delta(s) / text_end
+// ---------------------------------------------------------------------------
+{
+	const { events } = await drive([
+		{ sessionUpdate: "agent_message_chunk", content: { type: "text", text: "Hello" } },
+		{ sessionUpdate: "agent_message_chunk", content: { type: "text", text: " world" } },
+	]);
+	assert.deepEqual(
+		types(events),
+		["start", "text_start", "text_delta", "text_delta", "text_end", "done"],
+		"text chunk event sequence",
+	);
+	assert.deepEqual(deltas(events), ["Hello", " world"], "text deltas accumulate in order");
+	const end = events.find((e) => e.type === "text_end") as Extract<AssistantMessageEvent, { type: "text_end" }>;
+	assert.equal(end.content, "Hello world", "text_end carries the full accumulated text");
+}
+
+// ---------------------------------------------------------------------------
+// 2) agent_thought_chunk → thinking_*; switching text↔thinking closes the prior
+// ---------------------------------------------------------------------------
+{
+	const { events } = await drive([
+		{ sessionUpdate: "agent_message_chunk", content: { type: "text", text: "pre" } },
+		{ sessionUpdate: "agent_thought_chunk", content: { type: "text", text: "hmm" } },
+		{ sessionUpdate: "agent_message_chunk", content: { type: "text", text: "post" } },
+	]);
+	assert.deepEqual(
+		types(events),
+		[
+			"start",
+			"text_start",
+			"text_delta",
+			"text_end",
+			"thinking_start",
+			"thinking_delta",
+			"thinking_end",
+			"text_start",
+			"text_delta",
+			"text_end",
+			"done",
+		],
+		"text→thinking→text closes each block before opening the next",
+	);
+	const tDelta = events.find((e) => e.type === "thinking_delta") as Extract<
+		AssistantMessageEvent,
+		{ type: "thinking_delta" }
+	>;
+	assert.equal(tDelta.delta, "hmm", "thinking delta carried through");
+}
+
+// ---------------------------------------------------------------------------
+// 3) tool_call / tool_call_update → TEXT NOTICE, never structured toolcall_*
+// ---------------------------------------------------------------------------
+{
+	const { events, state } = await drive([
+		{ sessionUpdate: "tool_call", toolCallId: "t1", title: "Bash" },
+		{
+			sessionUpdate: "tool_call_update",
+			toolCallId: "t1",
+			status: "completed",
+			rawOutput: [{ type: "text", text: "result body" }],
+		},
+	]);
+	// The hard invariant: zero structured tool-call events.
+	for (const t of types(events)) {
+		assert.ok(!t.startsWith("toolcall"), `tool events must NOT surface as structured toolcall_* (saw ${t})`);
+	}
+	const noticeText = deltas(events).join("");
+	assert.match(noticeText, /\[tool:start\] Bash/, "tool_call renders a [tool:start] notice");
+	assert.match(
+		noticeText,
+		/\[tool:done\] Bash — result body/,
+		"completed tool_call_update renders a [tool:done] notice with summary",
+	);
+	// The running message must contain only text content blocks (no ToolCall).
+	for (const c of state.output.content) {
+		assert.equal((c as { type: string }).type, "text", "notices land as text content, never a ToolCall");
+	}
+}
+
+// ---------------------------------------------------------------------------
+// 3b) MCP-level error (isError) on a completed call → [tool:failed]
+// ---------------------------------------------------------------------------
+{
+	const { events } = await drive([
+		{ sessionUpdate: "tool_call", toolCallId: "t2", title: "Write" },
+		{
+			sessionUpdate: "tool_call_update",
+			toolCallId: "t2",
+			status: "completed",
+			rawOutput: { isError: true, content: [{ type: "text", text: "nope" }] },
+		},
+	]);
+	const noticeText = deltas(events).join("");
+	assert.match(noticeText, /\[tool:failed\] Write — nope/, "isError completed call renders [tool:failed]");
+}
+
+// ---------------------------------------------------------------------------
+// 3c) cancelled status → [tool:cancelled]
+// ---------------------------------------------------------------------------
+{
+	const { events } = await drive([
+		{ sessionUpdate: "tool_call", toolCallId: "t3", title: "Bash" },
+		{ sessionUpdate: "tool_call_update", toolCallId: "t3", status: "cancelled" },
+	]);
+	const noticeText = deltas(events).join("");
+	assert.match(noticeText, /\[tool:cancelled\] Bash/, "cancelled tool_call_update renders [tool:cancelled]");
+}
+
+// ---------------------------------------------------------------------------
+// 4) usage_update → mutates the running message usage
+// ---------------------------------------------------------------------------
+{
+	const { state } = await drive([{ sessionUpdate: "usage_update", used: 1234, cost: { amount: 0.05 } }]);
+	assert.equal(state.output.usage.totalTokens, 1234, "usage_update.used → totalTokens");
+	assert.equal(state.output.usage.cost.total, 0.05, "usage_update.cost.amount → cost.total");
+}
+
+// ---------------------------------------------------------------------------
+// 5) notice suppression — showToolNotifications:false drops tool notices
+// ---------------------------------------------------------------------------
+{
+	const stream = createAssistantMessageEventStream();
+	const state = createAcpStreamState(stream, IDENTITY, { timestamp: 0, showToolNotifications: false });
+	stream.push({ type: "start", partial: state.output });
+	applyAcpSessionUpdate(state, { sessionUpdate: "tool_call", toolCallId: "t1", title: "Bash" });
+	finalizeAcpStreamState(state);
+	stream.push({ type: "done", reason: "stop", message: state.output });
+	const events: AssistantMessageEvent[] = [];
+	for await (const ev of stream) events.push(ev);
+	assert.deepEqual(types(events), ["start", "done"], "suppressed notices emit no text events");
+}
+
+// ---------------------------------------------------------------------------
+// 6) context conversion — transcript passthrough, no systemPrompt, single block
+// ---------------------------------------------------------------------------
+{
+	const context: Context = {
+		systemPrompt: "SECRET-SYSTEM-PROMPT-DO-NOT-LEAK",
+		tools: [{ name: "x", description: "d", parameters: {} as never }],
+		messages: [
+			{ role: "user", content: "first question", timestamp: 0 },
+			{
+				role: "assistant",
+				content: [
+					{ type: "thinking", thinking: "private reasoning" },
+					{ type: "text", text: "an answer" },
+					{ type: "toolCall", id: "c1", name: "Bash", arguments: {} },
+				],
+				api: "x",
+				provider: "x",
+				model: "x",
+				usage: {
+					input: 0,
+					output: 0,
+					cacheRead: 0,
+					cacheWrite: 0,
+					totalTokens: 0,
+					cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+				},
+				stopReason: "stop",
+				timestamp: 0,
+			},
+			{
+				role: "toolResult",
+				toolCallId: "c1",
+				toolName: "Bash",
+				content: [{ type: "text", text: "tool body" }],
+				isError: false,
+				timestamp: 0,
+			},
+			{
+				role: "user",
+				content: [
+					{ type: "image", data: "BASE64IMAGEDATA", mimeType: "image/png" },
+					{ type: "text", text: "follow up" },
+				],
+				timestamp: 0,
+			},
+		],
+	};
+	const transcript = contextTranscript(context);
+	assert.ok(!transcript.includes("SECRET-SYSTEM-PROMPT"), "transcript must NOT leak context.systemPrompt");
+	assert.ok(!transcript.includes("private reasoning"), "transcript must NOT include assistant thinking");
+	assert.match(transcript, /User: first question/, "includes prior user turn");
+	assert.match(transcript, /Assistant: an answer/, "includes assistant text");
+	assert.match(transcript, /Tool result \(Bash\): tool body/, "includes tool result as plain text");
+	assert.match(transcript, /follow up/, "includes the last user turn");
+	// image content is NOT silently dropped — it leaves a marker, never raw data.
+	assert.match(transcript, /\[image omitted: image\/png\]/, "image content leaves a text marker");
+	assert.ok(!transcript.includes("BASE64IMAGEDATA"), "raw image data must never enter the transcript");
+
+	const prompt = contextToAcpPrompt(context);
+	assert.equal(prompt.length, 1, "prompt is a single text block");
+	assert.equal(prompt[0].type, "text", "prompt block is text");
+	assert.equal(prompt[0].text, transcript, "prompt text equals the transcript");
+
+	assert.deepEqual(contextToAcpPrompt({ messages: [] }), [], "empty history → empty prompt array");
+}
+
+console.log(
+	"[check-acp-event-mapper] ok — text/thinking block lifecycle, tool_call→text-notice (no structured toolcall_*), " +
+		"isError→[tool:failed], cancelled→[tool:cancelled], usage mutation, notice suppression, and context transcript " +
+		"passthrough (no systemPrompt/thinking, image marker not silent-drop, single block)",
+);