wave-agent-sdk 0.19.7 → 0.19.9

package/src/managers/permissionManager.ts

@@ -23,7 +23,11 @@ import {
   hasWriteRedirections,
   getSmartPrefix,
   isDangerousFind,
+  hasCommandSubstitution,
+  hasProcessSubstitution,
+  hasSedInPlace,
   DANGEROUS_COMMANDS,
+  READ_ONLY_COMMANDS,
 } from "../utils/bashParser.js";
 import { isPathInside } from "../utils/pathSafety.js";
 import {
@@ -37,23 +41,6 @@ import { Container } from "../utils/container.js";
 import { ConfigurationService } from "../services/configurationService.js";
 import type { WorktreeSession } from "../utils/worktreeSession.js";
 
-const SAFE_COMMANDS = [
-  "cd",
-  "ls",
-  "pwd",
-  "true",
-  "false",
-  "grep",
-  "rg",
-  "cat",
-  "head",
-  "tail",
-  "wc",
-  "sleep",
-  "find",
-  "sort",
-];
-
 const DEFAULT_ALLOWED_RULES = [
   "Bash(git status*)",
   "Bash(git diff*)",
@@ -747,6 +734,14 @@ export class PermissionManager {
         if (hasWriteRedirections(part)) {
           return true;
         }
+        // Command/process substitution and sed -i are dangerous (FR-019.5, FR-019.6)
+        if (
+          hasCommandSubstitution(part) ||
+          hasProcessSubstitution(part) ||
+          hasSedInPlace(part)
+        ) {
+          return true;
+        }
         const processedPart = stripRedirections(stripEnvVars(part));
         const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
         if (commandMatch) {
@@ -862,122 +857,115 @@ export class PermissionManager {
   }
 
   /**
-   * Check if a tool call is allowed by persistent or temporary rules
+   * Check if a single bash command part is auto-allowed (read-only and safe).
+   * Auto-allowed commands skip the confirmation dialog entirely.
+   * FR-019.2 through FR-019.7: read-only commands without write redirections,
+   * command substitution, process substitution, or sed -i are auto-allowed.
    */
-  private isAllowedByRule(context: ToolPermissionContext): boolean {
-    const isAllowedByRuleList = (
-      ctx: ToolPermissionContext,
-      rules: string[],
-      isDefaultRules: boolean = false,
-    ) => {
-      if (ctx.toolName === BASH_TOOL_NAME && ctx.toolInput?.command) {
-        const command = String(ctx.toolInput.command);
-        const parts = splitBashCommand(command);
-        if (parts.length === 0) return false;
-
-        const workdir = ctx.toolInput?.workdir as string | undefined;
-
-        return parts.every((part) => {
-          const hasWrite = hasWriteRedirections(part);
-          const processedPart = stripRedirections(stripEnvVars(part));
-
-          // Check for safe commands
-          if (!hasWrite) {
-            const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-            if (commandMatch) {
-              const cmd = commandMatch[1];
-              const args = commandMatch[2]?.trim() || "";
-
-              if (SAFE_COMMANDS.includes(cmd)) {
-                if (
-                  cmd === "pwd" ||
-                  cmd === "true" ||
-                  cmd === "false" ||
-                  cmd === "ls" ||
-                  cmd === "grep" ||
-                  cmd === "rg" ||
-                  cmd === "cat" ||
-                  cmd === "head" ||
-                  cmd === "tail" ||
-                  cmd === "wc" ||
-                  cmd === "sleep" ||
-                  cmd === "sort" ||
-                  (cmd === "find" && !isDangerousFind(part))
-                ) {
-                  return true;
-                }
+  private isAutoAllowedPart(part: string, workdir?: string): boolean {
+    // Write redirections disqualify (FR-019.4)
+    if (hasWriteRedirections(part)) return false;
+    // Command substitution $(...) or `...` disqualifies (FR-019.6)
+    if (hasCommandSubstitution(part)) return false;
+    // Process substitution <(...) or >(...) disqualifies (FR-019.6)
+    if (hasProcessSubstitution(part)) return false;
+
+    const processedPart = stripRedirections(stripEnvVars(part));
+    const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+    if (!commandMatch) return false;
+
+    const cmd = commandMatch[1];
+    const args = commandMatch[2]?.trim() || "";
+
+    // sed -i (in-place edit) disqualifies (FR-019.5)
+    if (hasSedInPlace(part)) return false;
+
+    // Read-only commands are auto-allowed (FR-019.2, FR-019.3)
+    if (READ_ONLY_COMMANDS.includes(cmd)) {
+      // find with dangerous flags (e.g. -exec, -delete) disqualifies
+      if (cmd === "find" && isDangerousFind(part)) return false;
+      return true;
+    }
 
-                if (workdir) {
-                  // For cd, check paths
-                  const pathArgs =
-                    (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
-                      (arg) => !arg.startsWith("-"),
-                    ) || [];
-
-                  if (pathArgs.length === 0) {
-                    // cd without arguments operates on current dir (workdir)
-                    return true;
-                  }
-
-                  const allPathsSafe = pathArgs.every((pathArg) => {
-                    // Remove quotes if present
-                    const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                    const { isInside } = this.isInsideSafeZone(
-                      cleanPath,
-                      workdir,
-                    );
-                    return isInside;
-                  });
-
-                  if (allPathsSafe) {
-                    return true;
-                  }
-                }
-              }
-            }
-          }
+    // cd is not read-only but is safe if all paths are within the Safe Zone
+    if (cmd === "cd") {
+      if (!workdir) return false;
+      const pathArgs =
+        (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
+          (arg) => !arg.startsWith("-"),
+        ) || [];
+      if (pathArgs.length === 0) return true; // cd without args = current dir
+      return pathArgs.every((pathArg) => {
+        const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+        const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
+        return isInside;
+      });
+    }
 
-          // Check if this specific part is allowed by any rule
-          if (isDefaultRules && (hasWrite || isDangerousFind(part))) {
-            return false;
-          }
+    return false;
+  }
 
-          // We create a temporary context with just this part of the command
-          const partContext = {
-            ...ctx,
-            toolInput: { ...ctx.toolInput, command: part },
-          };
-          const allowedByRule = rules.some((rule) => {
-            return this.matchesRule(partContext, rule);
-          });
+  /**
+   * Check if a tool call is allowed by persistent or temporary rules
+   */
+  private isAllowedByRule(context: ToolPermissionContext): boolean {
+    // All allow-rule sources are matched as a union: each part of a chained
+    // command only needs to hit at least one rule across all sources, so
+    // different parts may be covered by different sources.
+    const explicitRules = [
+      ...this.instanceAllowedRules,
+      ...this.temporaryRules,
+      ...this.allowedRules,
+    ];
+
+    if (context.toolName === BASH_TOOL_NAME && context.toolInput?.command) {
+      const command = String(context.toolInput.command);
+      const parts = splitBashCommand(command);
+      if (parts.length === 0) return false;
 
-          if (allowedByRule) return true;
+      const workdir = context.toolInput?.workdir as string | undefined;
 
-          return !this.isRestrictedTool(ctx.toolName);
-        });
-      }
+      return parts.every((part) => {
+        // Check for auto-allowed read-only commands (FR-019.2 through FR-019.7)
+        if (this.isAutoAllowedPart(part, workdir)) {
+          return true;
+        }
 
-      // For other tools, check if any rule matches
-      return rules.some((rule) => this.matchesRule(ctx, rule));
-    };
+        // We create a temporary context with just this part of the command
+        const partContext = {
+          ...context,
+          toolInput: { ...context.toolInput, command: part },
+        };
 
-    // Check instance-specific allowed rules first
-    if (isAllowedByRuleList(context, this.instanceAllowedRules)) {
-      return true;
-    }
+        if (explicitRules.some((rule) => this.matchesRule(partContext, rule))) {
+          return true;
+        }
 
-    // Check temporary rules
-    if (isAllowedByRuleList(context, this.temporaryRules)) {
-      return true;
-    }
+        // Default rules must not auto-allow dangerous variants (write
+        // redirections, substitutions, sed -i, dangerous find) through broad
+        // rules like Bash(echo*) or Bash(cat*)
+        const isDangerousVariant =
+          hasWriteRedirections(part) ||
+          isDangerousFind(part) ||
+          hasCommandSubstitution(part) ||
+          hasProcessSubstitution(part) ||
+          hasSedInPlace(part);
+        if (
+          !isDangerousVariant &&
+          DEFAULT_ALLOWED_RULES.some((rule) =>
+            this.matchesRule(partContext, rule),
+          )
+        ) {
+          return true;
+        }
 
-    // Check persistent allowed rules
-    if (isAllowedByRuleList(context, this.allowedRules)) {
-      return true;
+        return !this.isRestrictedTool(context.toolName);
+      });
     }
 
-    // Check default allowed rules
-    return isAllowedByRuleList(context, DEFAULT_ALLOWED_RULES, true);
+    // For other tools, check if any rule matches
+    const allRules = [...explicitRules, ...DEFAULT_ALLOWED_RULES];
+    return allRules.some((rule) => this.matchesRule(context, rule));
   }
 
   /**
@@ -996,52 +984,8 @@ export class PermissionManager {
       const hasWrite = hasWriteRedirections(part);
       const processedPart = stripRedirections(stripEnvVars(part));
 
-      // Check for safe commands
-      const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-      let isSafe = false;
-
-      if (commandMatch && !hasWrite) {
-        const cmd = commandMatch[1];
-        const args = commandMatch[2]?.trim() || "";
-
-        if (SAFE_COMMANDS.includes(cmd)) {
-          if (
-            cmd === "pwd" ||
-            cmd === "true" ||
-            cmd === "false" ||
-            cmd === "ls" ||
-            cmd === "grep" ||
-            cmd === "rg" ||
-            cmd === "cat" ||
-            cmd === "head" ||
-            cmd === "tail" ||
-            cmd === "wc" ||
-            cmd === "sleep" ||
-            (cmd === "find" && !isDangerousFind(part))
-          ) {
-            isSafe = true;
-          } else {
-            // For cd, check paths
-            const pathArgs =
-              (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
-                (arg) => !arg.startsWith("-"),
-              ) || [];
-
-            if (pathArgs.length === 0) {
-              isSafe = true;
-            } else {
-              const allPathsSafe = pathArgs.every((pathArg) => {
-                const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
-                return isInside;
-              });
-              if (allPathsSafe) {
-                isSafe = true;
-              }
-            }
-          }
-        }
-      }
+      // Check for auto-allowed read-only commands
+      const isSafe = this.isAutoAllowedPart(part, workdir);
 
       if (!isSafe) {
         // Check if command is dangerous or out-of-bounds
@@ -1050,7 +994,11 @@ export class PermissionManager {
           const cmd = commandMatch[1];
           const args = commandMatch[2]?.trim() || "";
 
-          if (DANGEROUS_COMMANDS.includes(cmd) || isDangerousFind(part)) {
+          if (
+            DANGEROUS_COMMANDS.includes(cmd) ||
+            isDangerousFind(part) ||
+            hasSedInPlace(part)
+          ) {
             continue;
           }
 

package/src/managers/pluginManager.ts

@@ -2,6 +2,8 @@ import { logger } from "../utils/globalLogger.js";
 import { Plugin, PluginConfig } from "../types/index.js";
 import { PluginLoader } from "../services/pluginLoader.js";
 import * as path from "path";
+import { existsSync, readdirSync } from "fs";
+import { getBuiltinPluginsDir } from "../utils/configPaths.js";
 import { SkillManager } from "./skillManager.js";
 import { HookManager } from "./hookManager.js";
 import { LspManager } from "./lspManager.js";
@@ -98,6 +100,8 @@ export class PluginManager {
 
         const [name, marketplaceName] = pluginId.split("@");
         if (!name || !marketplaceName) continue;
+        // `@builtin` entries are loaded by loadBuiltinPlugins, not the marketplace.
+        if (marketplaceName === "builtin") continue;
 
         const isInstalled = installedRegistry.plugins.some(
           (p) => p.name === name && p.marketplace === marketplaceName,
@@ -283,6 +287,31 @@ export class PluginManager {
 
     // Load installed plugins from marketplace
     await this.loadInstalledPlugins();
+
+    // Load built-in plugins bundled with the SDK (lowest priority)
+    await this.loadBuiltinPlugins();
+  }
+
+  /**
+   * Load built-in plugins bundled with the SDK (e.g. sdd).
+   * Opt-in via `enabledPlugins`, keyed `<name>@builtin` (default off, consistent
+   * with marketplace plugins). Lowest priority: explicit config and marketplace
+   * plugins win on name conflicts (loadSinglePlugin skips duplicates).
+   */
+  private async loadBuiltinPlugins(): Promise<void> {
+    try {
+      const builtinDir = getBuiltinPluginsDir();
+      if (!existsSync(builtinDir)) return;
+
+      // The builtin plugin directory name is the plugin name by convention.
+      for (const entry of readdirSync(builtinDir, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        if (this.enabledPlugins[`${entry.name}@builtin`] !== true) continue;
+        await this.loadSinglePlugin(path.join(builtinDir, entry.name));
+      }
+    } catch (error) {
+      logger?.error("Failed to load built-in plugins:", error);
+    }
   }
 
   /**

package/src/managers/subagentManager.ts

@@ -290,6 +290,12 @@ export class SubagentManager {
     // Create a child container for the subagent to isolate its managers
     const subagentContainer = this.container.createChild();
 
+    // Register an independent MessageQueue so the subagent's AIManager drains its
+    // own (empty) queue instead of falling back to the parent container's queue.
+    // Without this, concurrent background subagents steal sibling completion
+    // notifications from the parent queue, causing the main agent to exit early.
+    subagentContainer.register("MessageQueue", new MessageQueue());
+
     // Register a modified AgentOptions without onLoadingChange to prevent subagent loading
     // from affecting the parent agent's loading state
     const parentOptions =

package/src/prompts/index.ts

@@ -190,53 +190,160 @@ export interface SystemPromptBlock {
   cacheable: boolean;
 }
 
-export const COMPACT_MESSAGES_SYSTEM_PROMPT = `You are continuing work on a software engineering task. Write a detailed continuation summary that will allow you (or another instance of yourself) to resume work efficiently in a future context window where the conversation history will be replaced with this summary.
+// Aggressive no-tools preamble, aligned with Claude Code's NO_TOOLS_PREAMBLE.
+// The fork path inherits the main conversation's full tool set (required for
+// cache-key match), so the instruction must be explicit about rejection
+// consequences to prevent wasted turns.
+const COMPACT_NO_TOOLS_PREAMBLE = `CRITICAL: Respond with TEXT ONLY. Do NOT call any tools.
 
-First, write your analysis in <analysis> tags as a thinking scratchpad:
-- Chronologically review the conversation
-- Identify user intents and goals
-- Note files read/modified, approaches tried, decisions made
-- Check for accuracy and completeness — ensure nothing critical is missing
+- Do NOT use Read, Bash, Grep, Glob, Edit, Write, or ANY other tool.
+- You already have all the context you need in the conversation above.
+- Tool calls will be REJECTED and will waste your only turn — you will fail the task.
+- Your entire response must be plain text: an <analysis> block followed by a <summary> block.
 
-Then produce a structured summary in <summary> tags with these sections:
-
-## Primary Request and Intent
-- The user's core request and success criteria
-- Clarifications, constraints, or scope changes
-
-## Key Technical Concepts
-- Frameworks, libraries, patterns, architectural decisions
+`;
 
-## Files and Code Sections
-- Files read, modified, created (with full paths)
-- Critical code snippets (function signatures, bug fixes, key logic)
-- Focus on recent messages — include full code for important sections
+// Aligned with Claude Code's DETAILED_ANALYSIS_INSTRUCTION_BASE. The
+// <analysis> block is a drafting scratchpad that formatCompactSummary()
+// strips before the summary reaches context.
+const COMPACT_DETAILED_ANALYSIS_INSTRUCTION = `Before providing your final summary, wrap your analysis in <analysis> tags to organize your thoughts and ensure you've covered all necessary points. In your analysis process:
+
+1. Chronologically analyze each message and section of the conversation. For each section thoroughly identify:
+   - The user's explicit requests and intents
+   - Your approach to addressing the user's requests
+   - Key decisions, technical concepts and code patterns
+   - Specific details like:
+     - file names
+     - full code snippets
+     - function signatures
+     - file edits
+   - Errors that you ran into and how you fixed them
+   - Pay special attention to specific user feedback that you received, especially if the user told you to do something differently.
+2. Double-check for technical accuracy and completeness, addressing each required element thoroughly.`;
+
+// Aligned with Claude Code's BASE_COMPACT_PROMPT (9 sections + example).
+const BASE_COMPACT_PROMPT = `Your task is to create a detailed summary of the conversation so far, paying close attention to the user's explicit requests and your previous actions.
+This summary should be thorough in capturing technical details, code patterns, and architectural decisions that would be essential for continuing development work without losing context.
+
+${COMPACT_DETAILED_ANALYSIS_INSTRUCTION}
+
+Your summary should include the following sections:
+
+1. Primary Request and Intent: Capture all of the user's explicit requests and intents in detail
+2. Key Technical Concepts: List all important technical concepts, technologies, and frameworks discussed.
+3. Files and Code Sections: Enumerate specific files and code sections examined, modified, or created. Pay special attention to the most recent messages and include full code snippets where applicable and include a summary of why this file read or edit is important.
+4. Errors and fixes: List all errors that you ran into, and how you fixed them. Pay special attention to specific user feedback that you received, especially if the user told you to do something differently.
+5. Problem Solving: Document problems solved and any ongoing troubleshooting efforts.
+6. All user messages: List ALL user messages that are not tool results. These are critical for understanding the users' feedback and changing intent.
+7. Pending Tasks: Outline any pending tasks that you have explicitly been asked to work on.
+8. Current Work: Describe in detail precisely what was being worked on immediately before this summary request, paying special attention to the most recent messages from both user and assistant. Include file names and code snippets where applicable.
+9. Optional Next Step: List the next step that you will take that is related to the most recent work you were doing. IMPORTANT: ensure that this step is DIRECTLY in line with the user's most recent explicit requests, and the task you were working on immediately before this summary request. If your last task was concluded, then only list next steps if they are explicitly in line with the users request. Do not start on tangential requests or really old requests that were already completed without confirming with the user first.
+                       If there is a next step, include direct quotes from the most recent conversation showing exactly what task you were working on and where you left off. This should be verbatim to ensure there's no drift in task interpretation.
+
+Here's an example of how your output should be structured:
+
+<example>
+<analysis>
+[Your thought process, ensuring all points are covered thoroughly and accurately]
+</analysis>
+
+<summary>
+1. Primary Request and Intent:
+   [Detailed description]
+
+2. Key Technical Concepts:
+   - [Concept 1]
+   - [Concept 2]
+   - [...]
+
+3. Files and Code Sections:
+   - [File Name 1]
+      - [Summary of why this file is important]
+      - [Summary of the changes made to this file, if any]
+      - [Important Code Snippet]
+   - [File Name 2]
+      - [Important Code Snippet]
+   - [...]
+
+4. Errors and fixes:
+    - [Detailed description of error 1]:
+      - [How you fixed the error]
+      - [User feedback on the error if any]
+    - [...]
+
+5. Problem Solving:
+   [Description of solved problems and ongoing troubleshooting]
+
+6. All user messages:
+    - [Detailed non tool use user message]
+    - [...]
+
+7. Pending Tasks:
+   - [Task 1]
+   - [Task 2]
+   - [...]
+
+8. Current Work:
+   [Precise description of current work]
+
+9. Optional Next Step:
+   [Optional Next step to take]
+
+</summary>
+</example>
+
+Please provide your summary based on the conversation so far, following this structure and ensuring precision and thoroughness in your response.
+
+There may be additional summarization instructions provided in the included context. If so, remember to follow these instructions when creating the above summary.`;
+
+const COMPACT_NO_TOOLS_TRAILER =
+  "\n\nREMINDER: Do NOT call any tools. Respond with plain text only — " +
+  "an <analysis> block followed by a <summary> block. " +
+  "Tool calls will be rejected and you will fail the task.";
 
-## Errors and Fixes
-- Errors encountered, root causes, how they were resolved
-- Approaches tried that didn't work and why
+/**
+ * Builds the compact instruction sent as the trailing user message on the
+ * fork path. Aligned with Claude Code's getCompactPrompt().
+ */
+export function getCompactPrompt(customInstructions?: string): string {
+  let prompt = COMPACT_NO_TOOLS_PREAMBLE + BASE_COMPACT_PROMPT;
 
-## Problem Solving
-- Approach evolution, trade-offs considered, decisions made
+  if (customInstructions && customInstructions.trim() !== "") {
+    prompt += `\n\nAdditional Instructions:\n${customInstructions}`;
+  }
 
-## All User Messages
-- Complete list of all user messages (non-tool content)
-- Preserve exact wording where load-bearing
+  prompt += COMPACT_NO_TOOLS_TRAILER;
 
-## Pending Tasks
-- Outstanding work, TODOs, unresolved questions
+  return prompt;
+}
 
-## Current Work
-- What was being worked on at the time of summarization
-- Exact state of in-progress changes
+/**
+ * Formats the compact summary by stripping the <analysis> drafting scratchpad
+ * and extracting the <summary> section. Raw text passes through unchanged
+ * when no <summary> tag is present. Aligned with Claude Code's
+ * formatCompactSummary().
+ */
+export function formatCompactSummary(summary: string): string {
+  let formattedSummary = summary;
+
+  formattedSummary = formattedSummary.replace(
+    /<analysis>[\s\S]*?<\/analysis>/,
+    "",
+  );
+
+  const summaryMatch = formattedSummary.match(/<summary>([\s\S]*?)<\/summary>/);
+  if (summaryMatch) {
+    const content = summaryMatch[1] || "";
+    formattedSummary = formattedSummary.replace(
+      /<summary>[\s\S]*?<\/summary>/,
+      `Summary:\n${content.trim()}`,
+    );
+  }
 
-## Optional Next Step
-- Immediate next action needed
-- Include verbatim quotes from recent conversation if relevant
+  formattedSummary = formattedSummary.replace(/\n\n+/g, "\n\n");
 
-Be concise but complete — include information that prevents duplicate work or repeated mistakes.
-Respond with text only. Do NOT call any tools.
-Wrap your summary in <summary></summary> tags.`;
+  return formattedSummary.trim();
+}
 
 export const WEB_CONTENT_SYSTEM_PROMPT = `You are a helpful assistant that extracts information from web content. The content is provided in Markdown format.`;
 export const BTW_SYSTEM_PROMPT = `You are a helpful assistant. Answer the user's side question based on the conversation history.