wave-agent-sdk 0.19.7 → 0.19.9

package/dist/services/aiService.js

@@ -7,7 +7,7 @@ import { supportsPromptCaching } from "../utils/modelCapabilities.js";
 import * as os from "os";
 import * as fs from "fs";
 import * as path from "path";
-import { COMPACT_MESSAGES_SYSTEM_PROMPT, WEB_CONTENT_SYSTEM_PROMPT, BTW_SYSTEM_PROMPT, } from "../prompts/index.js";
+import { WEB_CONTENT_SYSTEM_PROMPT, BTW_SYSTEM_PROMPT, } from "../prompts/index.js";
 import { GOAL_EVALUATION_SYSTEM_PROMPT } from "../constants/goalPrompts.js";
 // Global rate limiter state for 1 QPS
 let nextAllowedTime = 0;
@@ -149,9 +149,8 @@ export async function callAgent(options) {
             ...(modelConfig.options || {}),
         });
         // Determine if streaming is needed
-        const isStreaming = !!(onContentUpdate ||
-            onToolUpdate ||
-            onReasoningUpdate);
+        const isStreaming = options.stream === true ||
+            !!(onContentUpdate || onToolUpdate || onReasoningUpdate);
         // Prepare API call parameters
         createParams = {
             ...openaiModelConfig,
@@ -488,87 +487,6 @@ async function processStreamingResponse(stream, onContentUpdate, onToolUpdate, o
     }
     return result;
 }
-export async function compactMessages(options) {
-    const { gatewayConfig, modelConfig, messages, abortSignal } = options;
-    // Validate model config at call time
-    validateModelConfig(modelConfig);
-    // Apply global 1 QPS rate limit
-    if (process.env.NODE_ENV !== "test" ||
-        modelConfig.model === "rate-limit-test") {
-        await acquireSlot(abortSignal);
-    }
-    // Strip images from messages before compact API call to reduce token usage
-    const cleanedMessages = messages.map((msg) => {
-        // Handle user/assistant messages with array content
-        if (Array.isArray(msg.content)) {
-            const textParts = msg.content.filter((part) => part.type === "text");
-            const text = textParts.map((p) => p.text).join("\n");
-            return { ...msg, content: text || "(empty message)" };
-        }
-        return msg;
-    });
-    // Create OpenAI client with injected configuration
-    const openai = new OpenAIClient({
-        apiKey: gatewayConfig.apiKey,
-        baseURL: gatewayConfig.baseURL,
-        defaultHeaders: gatewayConfig.defaultHeaders,
-        fetchOptions: gatewayConfig.fetchOptions,
-        fetch: gatewayConfig.fetch,
-    });
-    // When a fast model override is provided, use the fast model's options
-    // (if configured); otherwise fall back to the agent model's options.
-    const activeExtraParams = options.model
-        ? modelConfig.fastModelOptions || {}
-        : modelConfig.options || {};
-    const openaiModelConfig = getModelConfig(options.model || modelConfig.model, {
-        temperature: 0.1,
-        max_tokens: 8192,
-        ...activeExtraParams,
-    });
-    try {
-        const response = await openai.chat.completions.create({
-            ...openaiModelConfig,
-            messages: [
-                {
-                    role: "system",
-                    content: COMPACT_MESSAGES_SYSTEM_PROMPT,
-                },
-                ...cleanedMessages,
-                {
-                    role: "user",
-                    content: options.customInstructions
-                        ? `Please create a detailed summary of the conversation so far. Pay special attention to these instructions: ${options.customInstructions}`
-                        : `Please create a detailed summary of the conversation so far.`,
-                },
-            ],
-        }, {
-            signal: abortSignal,
-        });
-        const content = response.choices[0]?.message?.content?.trim();
-        if (!content) {
-            throw new Error("Failed to compact conversation history: Empty response from AI");
-        }
-        const usage = response.usage
-            ? {
-                prompt_tokens: response.usage.prompt_tokens,
-                completion_tokens: response.usage.completion_tokens,
-                total_tokens: response.usage.total_tokens,
-            }
-            : undefined;
-        return {
-            content,
-            usage,
-        };
-    }
-    catch (error) {
-        if (error.name === "AbortError") {
-            logger.info("Compaction request was aborted");
-            throw new Error("Compaction request was aborted");
-        }
-        logger.error("Failed to compact messages:", error);
-        throw error;
-    }
-}
 export async function processWebContent(options) {
     const { gatewayConfig, modelConfig, content, prompt, abortSignal } = options;
     // Validate model config at call time

package/dist/services/configurationService.d.ts

@@ -85,6 +85,12 @@ export declare class ConfigurationService {
      * @returns Resolved auto-memory enabled state
      */
     resolveAutoMemoryEnabled(): boolean;
+    /**
+     * Resolves worktree base ref with fallbacks
+     * Resolution priority: settings.json > default ("fresh")
+     * @returns Resolved worktree base ref
+     */
+    resolveWorktreeBaseRef(): "fresh" | "head";
     /**
      * Resolves auto-memory extraction frequency with fallbacks
      * Resolution priority: settings.json > WAVE_AUTO_MEMORY_FREQUENCY > default (1)

package/dist/services/configurationService.js

@@ -241,6 +241,19 @@ export class ConfigurationService {
                 }
             }
         }
+        // Validate worktree if present
+        if (config.worktree !== undefined) {
+            if (typeof config.worktree !== "object" || config.worktree === null) {
+                result.isValid = false;
+                result.errors.push("worktree configuration must be an object");
+            }
+            else if (config.worktree.baseRef !== undefined &&
+                config.worktree.baseRef !== "fresh" &&
+                config.worktree.baseRef !== "head") {
+                result.isValid = false;
+                result.errors.push(`Invalid worktree.baseRef: "${config.worktree.baseRef}". Must be "fresh" or "head".`);
+            }
+        }
         return result;
     }
     /**
@@ -506,6 +519,18 @@ export class ConfigurationService {
         // 3. Default (true)
         return true;
     }
+    /**
+     * Resolves worktree base ref with fallbacks
+     * Resolution priority: settings.json > default ("fresh")
+     * @returns Resolved worktree base ref
+     */
+    resolveWorktreeBaseRef() {
+        const baseRef = this.currentConfiguration?.worktree?.baseRef;
+        if (baseRef === "head") {
+            return "head";
+        }
+        return "fresh";
+    }
     /**
      * Resolves auto-memory extraction frequency with fallbacks
      * Resolution priority: settings.json > WAVE_AUTO_MEMORY_FREQUENCY > default (1)
@@ -944,6 +969,7 @@ export function loadWaveConfigFromFile(filePath) {
                 : undefined,
             models: config.models || undefined,
             marketplaces: config.marketplaces || undefined,
+            worktree: config.worktree || undefined,
         };
     }
     catch (error) {
@@ -1074,6 +1100,10 @@ export function loadMergedWaveConfig(workdir) {
                 mergedConfig.marketplaces = {};
             Object.assign(mergedConfig.marketplaces, config.marketplaces);
         }
+        // Merge worktree (last one wins)
+        if (config.worktree !== undefined) {
+            mergedConfig.worktree = config.worktree;
+        }
         // Merge models
         if (config.models) {
             if (!mergedConfig.models)
@@ -1111,5 +1141,6 @@ export function loadMergedWaveConfig(workdir) {
         models: mergedConfig.models && Object.keys(mergedConfig.models).length > 0
             ? mergedConfig.models
             : undefined,
+        worktree: mergedConfig.worktree,
     };
 }

package/dist/services/remoteSettingsService.js

@@ -286,6 +286,8 @@ export function mergeRemoteSettings(localMerged, remote) {
         result.autoMemoryEnabled = remote.autoMemoryEnabled;
     if (remote.autoMemoryFrequency !== undefined)
         result.autoMemoryFrequency = remote.autoMemoryFrequency;
+    if (remote.worktree !== undefined)
+        result.worktree = remote.worktree;
     if (remote.models !== undefined)
         result.models = remote.models;
     if (remote.marketplaces !== undefined)

package/dist/services/session.d.ts

@@ -184,7 +184,9 @@ export declare function handleSessionRestoration(restoreSessionId?: string, cont
 /**
  * Load the full message thread for a session.
  * With append-only compaction, all messages are in a single file.
- * Returns the active messages (post-compact boundary).
+ * Unlike loadSessionFromJsonl, this returns every message in the file,
+ * including those before the last compact boundary — rewind needs the
+ * complete history to allow rewinding past compaction points.
  * @param currentSessionId - The ID of the current session
  * @param workdir - Working directory for the session
  * @returns Promise that resolves to an array of all messages in the thread

package/dist/services/session.js

@@ -646,14 +646,22 @@ export async function handleSessionRestoration(restoreSessionId, continueLastSes
 /**
  * Load the full message thread for a session.
  * With append-only compaction, all messages are in a single file.
- * Returns the active messages (post-compact boundary).
+ * Unlike loadSessionFromJsonl, this returns every message in the file,
+ * including those before the last compact boundary — rewind needs the
+ * complete history to allow rewinding past compaction points.
  * @param currentSessionId - The ID of the current session
  * @param workdir - Working directory for the session
  * @returns Promise that resolves to an array of all messages in the thread
  */
 export async function loadFullMessageThread(currentSessionId, workdir) {
-    const sessionData = await loadSessionFromJsonl(currentSessionId, workdir);
-    if (!sessionData)
+    const jsonlHandler = new JsonlHandler();
+    const filePath = await generateSessionFilePath(currentSessionId, workdir, "main");
+    try {
+        await fs.access(filePath);
+    }
+    catch {
         return { messages: [], sessionIds: [] };
-    return { messages: sessionData.messages, sessionIds: [currentSessionId] };
+    }
+    const messages = await jsonlHandler.read(filePath);
+    return { messages, sessionIds: [currentSessionId] };
 }

package/dist/services/taskManager.d.ts

@@ -18,6 +18,7 @@ export declare class TaskManager extends EventEmitter {
     private getLockPath;
     ensureSessionDir(): Promise<void>;
     private withLock;
+    private isLockStale;
     private validateTask;
     createTask(task: Omit<Task, "id">): Promise<string>;
     getTask(taskId: string): Promise<Task | null>;

package/dist/services/taskManager.js

@@ -54,6 +54,7 @@ export class TaskManager extends EventEmitter {
         let lockHandle;
         const maxRetries = 100;
         const retryDelay = process.env.NODE_ENV === "test" ? 1 : 100;
+        const staleThreshold = 10000;
         await this.ensureSessionDir();
         for (let i = 0; i < maxRetries; i++) {
             try {
@@ -61,14 +62,32 @@ export class TaskManager extends EventEmitter {
                 break;
             }
             catch (error) {
-                if (error.code === "EEXIST") {
-                    if (i === maxRetries - 1) {
-                        throw new Error(`Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`);
+                const code = error.code;
+                // Only EEXIST (lock held) and EPERM (Windows pending-delete window)
+                // are transient lock-contention errors. EACCES/ENOENT are real failures
+                // and must not be retried as lock competition.
+                if (code !== "EEXIST" && code !== "EPERM") {
+                    throw error;
+                }
+                if (i === maxRetries - 1) {
+                    throw new Error(`Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`);
+                }
+                // Stale recovery: if the lock holder crashed without releasing, the
+                // lock file remains forever. Check mtime — if older than the threshold,
+                // remove it. Aligns with proper-lockfile's default 10s stale detection.
+                // The lock file is empty (no PID content), so mtime is the only signal.
+                if (code === "EEXIST" &&
+                    (await this.isLockStale(lockPath, staleThreshold))) {
+                    logger.warn(`TaskManager: removing stale lock for task list ${this.taskListId}`);
+                    try {
+                        await fs.unlink(lockPath);
+                    }
+                    catch {
+                        // Another waiter may have already removed it — retry anyway
                     }
-                    await new Promise((resolve) => setTimeout(resolve, retryDelay));
                     continue;
                 }
-                throw error;
+                await new Promise((resolve) => setTimeout(resolve, retryDelay));
             }
         }
         try {
@@ -86,6 +105,16 @@ export class TaskManager extends EventEmitter {
             }
         }
     }
+    async isLockStale(lockPath, threshold) {
+        try {
+            const stats = await fs.stat(lockPath);
+            return Date.now() - stats.mtimeMs > threshold;
+        }
+        catch {
+            // Lock was removed between our EEXIST and stat — not stale, just retry
+            return false;
+        }
+    }
     validateTask(task) {
         if (!task.id || typeof task.id !== "string")
             throw new Error("Invalid task ID");

package/dist/tools/editTool.js

@@ -97,9 +97,12 @@ Usage:
         context.messageManager?.triggerFileRead(filePath);
         // Enforce read-before-edit: the file must have been read or written first.
         // readFileState is populated by Read, Write, and Edit tools — single source
-        // of truth, aligned with Claude Code's readFileState approach.
+        // of truth, aligned with Claude Code's readFileState approach. Skipped in
+        // plan mode: permissionManager enforces a plan-file-only gate whose denial
+        // message must surface instead of being masked by a read-state rejection.
         const resolvedPath = resolvePath(filePath, context.workdir);
-        if (!context.readFileState?.has(resolvedPath)) {
+        if (context.permissionMode !== "plan" &&
+            !context.readFileState?.has(resolvedPath)) {
             return {
                 success: false,
                 content: "",
@@ -119,17 +122,28 @@ Usage:
                     error: `Failed to read file: ${readError instanceof Error ? readError.message : String(readError)}`,
                 };
             }
-            // Staleness check: file must not have been modified since last Read
-            if (context.readFileState) {
+            // Staleness check (aligned with Claude Code): only flag when the file got
+            // newer since last read. For full reads, a content-hash fallback avoids
+            // false positives when mtime changed but content didn't (git checkout,
+            // editor round-trip save, cloud sync, antivirus). Partial reads get no
+            // fallback since only a slice was cached. Skipped in plan mode (see
+            // read-before-edit note above) so the plan-file-only denial wins.
+            if (context.permissionMode !== "plan" && context.readFileState) {
                 const state = context.readFileState.get(resolvedPath);
                 if (state) {
                     const currentStats = await stat(resolvedPath);
-                    if (currentStats.mtime.getTime() !== state.mtime) {
-                        return {
-                            success: false,
-                            content: "",
-                            error: "File has been unexpectedly modified since last read. Read it again before editing it.",
-                        };
+                    if (currentStats.mtime.getTime() > state.mtime) {
+                        const isFullRead = state.offset === undefined && state.limit === undefined;
+                        const contentUnchanged = isFullRead &&
+                            createHash("sha256").update(originalContent).digest("hex") ===
+                                state.hash;
+                        if (!contentUnchanged) {
+                            return {
+                                success: false,
+                                content: "",
+                                error: "File has been unexpectedly modified since last read. Read it again before editing it.",
+                            };
+                        }
                     }
                 }
             }

package/dist/tools/enterWorktreeTool.js

@@ -83,7 +83,8 @@ export const enterWorktreeTool = {
             };
         }
         // Create the worktree (captures originalHeadCommit internally)
-        const worktreeInfo = createWorktree(name, mainRepoRoot);
+        const baseRef = context.aiManager?.getWorktreeBaseRef?.();
+        const worktreeInfo = createWorktree(name, mainRepoRoot, { baseRef });
         // Build session state
         const session = {
             originalCwd: context.workdir,

package/dist/tools/grepTool.js

@@ -1,6 +1,7 @@
 import { spawn } from "child_process";
 import { rgPath } from "../utils/ripgrep.js";
 import { getDisplayPath } from "../utils/path.js";
+import { logger } from "../utils/globalLogger.js";
 import { GREP_TOOL_NAME, BASH_TOOL_NAME, AGENT_TOOL_NAME, } from "../constants/tools.js";
 // Version control system directories to exclude from searches.
 // These are excluded automatically because they create noise in search results.
@@ -199,14 +200,19 @@ export const grepTool = {
                 rgArgs.push(".");
             }
             const result = await executeCommand(rgPath, rgArgs, workdir);
-            if (result.error && result.exitCode !== 1) {
-                // rg returns 1 for no matches, not an error
+            // Only a process-level spawn failure (exitCode null) is a hard error.
+            // rg exit 2 means some files were unreadable (e.g. device-name files
+            // like "nul" on Windows); stdout still holds usable partial results.
+            if (result.exitCode === null) {
                 return {
                     success: false,
                     content: "",
                     error: `ripgrep failed: ${result.stderr}`,
                 };
             }
+            if (result.exitCode !== 0 && result.exitCode !== 1) {
+                logger.debug(`ripgrep exited with code ${result.exitCode}, keeping partial results: ${result.stderr.trim()}`);
+            }
             const output = result.stdout.trim();
             if (!output) {
                 return {

package/dist/tools/writeTool.js

@@ -74,6 +74,42 @@ Usage:
                 // File doesn't exist, this is normal for new file creation
                 isExistingFile = false;
             }
+            // Read-before-write + staleness guards (aligned with Claude Code).
+            // Only enforced for existing files when readFileState is available
+            // (production always injects it; new-file creation always bypasses).
+            // Grep does not register a file as read, so Grep-then-Write on an
+            // existing file is still rejected. Staleness uses the same `>` + full-
+            // read content-hash fallback as editTool to avoid false positives from
+            // git checkout / editor round-trip save / cloud sync / antivirus.
+            // Plan mode is excluded: it has its own stricter write gate (plan-file-
+            // only, enforced in permissionManager) whose denial message must surface
+            // instead of being masked by a read-state rejection.
+            if (isExistingFile &&
+                context.readFileState &&
+                context.permissionMode !== "plan") {
+                const state = context.readFileState.get(resolvedPath);
+                if (!state) {
+                    return {
+                        success: false,
+                        content: "",
+                        error: "File has not been read yet. Read it first before writing to it.",
+                    };
+                }
+                const currentStats = await stat(resolvedPath);
+                if (currentStats.mtime.getTime() > state.mtime) {
+                    const isFullRead = state.offset === undefined && state.limit === undefined;
+                    const contentUnchanged = isFullRead &&
+                        createHash("sha256").update(originalContent).digest("hex") ===
+                            state.hash;
+                    if (!contentUnchanged) {
+                        return {
+                            success: false,
+                            content: "",
+                            error: "File has been unexpectedly modified since last read. Read it again before writing to it.",
+                        };
+                    }
+                }
+            }
             // Check if overwriting existing file but content is the same
             if (isExistingFile && originalContent === content) {
                 return {

package/dist/types/configuration.d.ts

@@ -50,6 +50,11 @@ export interface WaveConfiguration {
     monitoring?: {
         telemetry?: Partial<TelemetryConfig>;
     };
+    /** Worktree configuration */
+    worktree?: {
+        /** Base ref for new worktrees: "fresh" (origin/<default-branch>, default) | "head" (local HEAD) */
+        baseRef?: "fresh" | "head";
+    };
 }
 /**
  * Legacy alias for backward compatibility - will be deprecated

package/dist/types/permissions.d.ts

@@ -15,8 +15,6 @@ export interface PermissionDecision {
     newPermissionMode?: PermissionMode;
     /** Signal to persist a new allowed rule */
     newPermissionRule?: string;
-    /** Signal to clear the conversation context and proceed with the plan */
-    clearContext?: boolean;
 }
 /** Callback function for custom permission logic */
 export type PermissionCallback = (context: ToolPermissionContext) => Promise<PermissionDecision>;

package/dist/types/processes.d.ts

@@ -44,6 +44,33 @@ export interface BackgroundWorkflow extends BackgroundTaskBase {
     runId: string;
 }
 export type BackgroundTask = BackgroundShell | BackgroundSubagent | BackgroundWorkflow;
+/**
+ * Serializable summary of a BackgroundTask, used for notifications where the
+ * full stdout/stderr and non-serializable process/onStop fields must be
+ * stripped to control payload size. Output is fetched on demand via
+ * getBackgroundTaskOutput.
+ */
+export interface BackgroundTaskSummary {
+    id: string;
+    type: BackgroundTaskType;
+    status: BackgroundTaskStatus;
+    startTime: number;
+    endTime?: number;
+    command?: string;
+    description?: string;
+    exitCode?: number;
+    runtime?: number;
+    outputPath?: string;
+}
+/** Output snapshot returned by getBackgroundTaskOutput. */
+export interface BackgroundTaskOutput {
+    stdout: string;
+    stderr: string;
+    status: BackgroundTaskStatus;
+    outputPath?: string;
+    type: BackgroundTaskType;
+    exitCode?: number;
+}
 export interface ForegroundTask {
     id: string;
     backgroundHandler: () => Promise<void>;

package/dist/types/workflow.d.ts

@@ -1 +1 @@
-export type { WorkflowRun, WorkflowMeta, WorkflowPhaseState, } from "../workflow/types.js";
+export type { WorkflowRun, WorkflowMeta, WorkflowPhaseState, SerializableWorkflowRun, } from "../workflow/types.js";

package/dist/utils/bashParser.d.ts

@@ -28,6 +28,15 @@ export declare function isBashHeredocWrite(command: string): boolean;
  * and should not have persistent permissions.
  */
 export declare const DANGEROUS_COMMANDS: string[];
+/**
+ * Read-only command set: commands that only read/transform data and write to stdout.
+ * When a command in this set is used without write redirections, command substitution,
+ * or dangerous flags (e.g. sed -i), it is auto-allowed without a confirmation dialog.
+ * Aligned with Claude Code's SEMANTIC_READ_ONLY_COMMANDS, excluding interactive pagers
+ * (less, more, man, info), command executors (xargs), and infinite-output generators (yes).
+ * FR-019.2 through FR-019.7 in tool-permission-system.md.
+ */
+export declare const READ_ONLY_COMMANDS: string[];
 /**
  * Registry of commands and their expected subcommand depth for smart prefix extraction.
  * For example, 'git: 2' means 'git commit' is a valid prefix, but 'git' alone is not.
@@ -46,6 +55,22 @@ export declare const DANGEROUS_SUBCOMMANDS: Record<string, string[]>;
  * Checks if a find command is dangerous (e.g., contains -exec, -delete, etc.).
  */
 export declare function isDangerousFind(command: string): boolean;
+/**
+ * Detects command substitution $(...) or backticks `...` in a command string.
+ * Commands with substitution are never auto-allowed because the substituted
+ * command may be dangerous (e.g. cat $(rm x)). FR-019.6.
+ */
+export declare function hasCommandSubstitution(command: string): boolean;
+/**
+ * Detects process substitution <(...) or >(...) in a command string.
+ * These can execute side effects and are never auto-allowed. FR-019.6.
+ */
+export declare function hasProcessSubstitution(command: string): boolean;
+/**
+ * Detects sed in-place edit flag (-i, with optional backup suffix like -i.bak).
+ * sed -i modifies files in place and must NOT be auto-allowed. FR-019.5.
+ */
+export declare function hasSedInPlace(command: string): boolean;
 /**
  * Extracts a "smart prefix" from a bash command based on common developer tools.
  * Returns null if the command is blacklisted or cannot be safely prefix-matched.

package/dist/utils/bashParser.js

@@ -430,6 +430,76 @@ export const DANGEROUS_COMMANDS = [
     "nc",
     "netcat",
 ];
+/**
+ * Read-only command set: commands that only read/transform data and write to stdout.
+ * When a command in this set is used without write redirections, command substitution,
+ * or dangerous flags (e.g. sed -i), it is auto-allowed without a confirmation dialog.
+ * Aligned with Claude Code's SEMANTIC_READ_ONLY_COMMANDS, excluding interactive pagers
+ * (less, more, man, info), command executors (xargs), and infinite-output generators (yes).
+ * FR-019.2 through FR-019.7 in tool-permission-system.md.
+ */
+export const READ_ONLY_COMMANDS = [
+    "ls",
+    "cat",
+    "head",
+    "tail",
+    "wc",
+    "sort",
+    "uniq",
+    "grep",
+    "egrep",
+    "fgrep",
+    "rg",
+    "find",
+    "which",
+    "whereis",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "free",
+    "uptime",
+    "uname",
+    "hostname",
+    "whoami",
+    "id",
+    "groups",
+    "env",
+    "printenv",
+    "echo",
+    "printf",
+    "date",
+    "true",
+    "false",
+    "pwd",
+    "tree",
+    "diff",
+    "cmp",
+    "md5sum",
+    "sha256sum",
+    "sha1sum",
+    "xxd",
+    "od",
+    "hexdump",
+    "strings",
+    "readlink",
+    "realpath",
+    "basename",
+    "dirname",
+    "seq",
+    "column",
+    "jq",
+    "yq",
+    "cut",
+    "paste",
+    "tr",
+    "awk",
+    "sed",
+    "test",
+    "expr",
+    "bc",
+    "sleep",
+];
 export const TOOL_RULES = {
     // Node/JS
     npm: { depth: 2, scopeFlags: ["--prefix", "-C", "--registry"] },
@@ -567,6 +637,39 @@ export function isDangerousFind(command) {
         return dangerousFlags.includes(unquoted);
     });
 }
+/**
+ * Detects command substitution $(...) or backticks `...` in a command string.
+ * Commands with substitution are never auto-allowed because the substituted
+ * command may be dangerous (e.g. cat $(rm x)). FR-019.6.
+ */
+export function hasCommandSubstitution(command) {
+    // Remove quoted strings first so $() or backticks inside quotes don't trigger
+    const stripped = command
+        .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+        .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+    return /\$\([^)]*\)/.test(stripped) || /`[^`]*`/.test(stripped);
+}
+/**
+ * Detects process substitution <(...) or >(...) in a command string.
+ * These can execute side effects and are never auto-allowed. FR-019.6.
+ */
+export function hasProcessSubstitution(command) {
+    const stripped = command
+        .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+        .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+    return /[<>]\([^)]*\)/.test(stripped);
+}
+/**
+ * Detects sed in-place edit flag (-i, with optional backup suffix like -i.bak).
+ * sed -i modifies files in place and must NOT be auto-allowed. FR-019.5.
+ */
+export function hasSedInPlace(command) {
+    const stripped = stripRedirections(stripEnvVars(command));
+    const tokens = stripped.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
+    if (tokens.length === 0 || tokens[0] !== "sed")
+        return false;
+    return tokens.some((token) => /^-i(\..*)?$/.test(token));
+}
 /**
  * Extracts a "smart prefix" from a bash command based on common developer tools.
  * Returns null if the command is blacklisted or cannot be safely prefix-matched.