wave-agent-sdk 0.19.7 → 0.19.9

package/src/utils/bashParser.ts

@@ -476,6 +476,77 @@ export const DANGEROUS_COMMANDS = [
   "netcat",
 ];
 
+/**
+ * Read-only command set: commands that only read/transform data and write to stdout.
+ * When a command in this set is used without write redirections, command substitution,
+ * or dangerous flags (e.g. sed -i), it is auto-allowed without a confirmation dialog.
+ * Aligned with Claude Code's SEMANTIC_READ_ONLY_COMMANDS, excluding interactive pagers
+ * (less, more, man, info), command executors (xargs), and infinite-output generators (yes).
+ * FR-019.2 through FR-019.7 in tool-permission-system.md.
+ */
+export const READ_ONLY_COMMANDS = [
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "sort",
+  "uniq",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "find",
+  "which",
+  "whereis",
+  "file",
+  "stat",
+  "du",
+  "df",
+  "free",
+  "uptime",
+  "uname",
+  "hostname",
+  "whoami",
+  "id",
+  "groups",
+  "env",
+  "printenv",
+  "echo",
+  "printf",
+  "date",
+  "true",
+  "false",
+  "pwd",
+  "tree",
+  "diff",
+  "cmp",
+  "md5sum",
+  "sha256sum",
+  "sha1sum",
+  "xxd",
+  "od",
+  "hexdump",
+  "strings",
+  "readlink",
+  "realpath",
+  "basename",
+  "dirname",
+  "seq",
+  "column",
+  "jq",
+  "yq",
+  "cut",
+  "paste",
+  "tr",
+  "awk",
+  "sed",
+  "test",
+  "expr",
+  "bc",
+  "sleep",
+];
+
 /**
  * Registry of commands and their expected subcommand depth for smart prefix extraction.
  * For example, 'git: 2' means 'git commit' is a valid prefix, but 'git' alone is not.
@@ -634,6 +705,41 @@ export function isDangerousFind(command: string): boolean {
   });
 }
 
+/**
+ * Detects command substitution $(...) or backticks `...` in a command string.
+ * Commands with substitution are never auto-allowed because the substituted
+ * command may be dangerous (e.g. cat $(rm x)). FR-019.6.
+ */
+export function hasCommandSubstitution(command: string): boolean {
+  // Remove quoted strings first so $() or backticks inside quotes don't trigger
+  const stripped = command
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+  return /\$\([^)]*\)/.test(stripped) || /`[^`]*`/.test(stripped);
+}
+
+/**
+ * Detects process substitution <(...) or >(...) in a command string.
+ * These can execute side effects and are never auto-allowed. FR-019.6.
+ */
+export function hasProcessSubstitution(command: string): boolean {
+  const stripped = command
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+  return /[<>]\([^)]*\)/.test(stripped);
+}
+
+/**
+ * Detects sed in-place edit flag (-i, with optional backup suffix like -i.bak).
+ * sed -i modifies files in place and must NOT be auto-allowed. FR-019.5.
+ */
+export function hasSedInPlace(command: string): boolean {
+  const stripped = stripRedirections(stripEnvVars(command));
+  const tokens = stripped.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
+  if (tokens.length === 0 || tokens[0] !== "sed") return false;
+  return tokens.some((token) => /^-i(\..*)?$/.test(token));
+}
+
 /**
  * Extracts a "smart prefix" from a bash command based on common developer tools.
  * Returns null if the command is blacklisted or cannot be safely prefix-matched.

package/src/utils/configPaths.ts

@@ -51,6 +51,13 @@ export function getBuiltinSubagentsDir(): string {
   return join(getPackageRoot(), "builtin", "subagents");
 }
 
+/**
+ * Get the builtin plugins directory path
+ */
+export function getBuiltinPluginsDir(): string {
+  return join(getPackageRoot(), "builtin", "plugins");
+}
+
 /**
  * Get the user-specific configuration file path (legacy function)
  * @deprecated Use getUserConfigPaths() for better priority support

package/src/utils/containerSetup.ts

@@ -256,8 +256,6 @@ export function setupAgentContainer(
 
         const decision = await options.canUseTool!(context);
 
-        const planFilePath = permissionManager.getPlanFilePath();
-
         if (decision.newPermissionMode) {
           setPermissionMode(decision.newPermissionMode);
         }
@@ -266,15 +264,6 @@ export function setupAgentContainer(
           await addPermissionRule(decision.newPermissionRule);
         }
 
-        if (decision.clearContext) {
-          messageManager.clearMessages();
-          if (planFilePath) {
-            messageManager.addUserMessage({
-              content: `Implement the plan at ${planFilePath}`,
-            });
-          }
-        }
-
         return decision;
       }
     : undefined;

package/src/utils/fileSearch.ts

@@ -34,9 +34,13 @@ async function getAllFiles(workingDirectory: string): Promise<string[]> {
     });
 
     child.on("close", (code) => {
+      // Exit 2 = some files were unreadable (e.g. device-name files like
+      // "nul" on Windows); stdout still holds usable partial results.
+      // Spawn failures surface via the 'error' listener instead.
       if (code !== 0 && code !== 1) {
-        reject(new Error(`ripgrep failed: ${stderr}`));
-        return;
+        logger.warn(
+          `ripgrep exited with code ${code}, keeping partial results: ${stderr.trim()}`,
+        );
       }
       const files = stdout
         .trim()

package/src/utils/worktreeSession.ts

@@ -5,7 +5,7 @@
  * "WorktreeSession" container slot registered in containerSetup.ts and accessed via
  * AIManager.getWorktreeSession()/setWorktreeSession()). This keeps worktree state
  * isolated per session in stdio multi-agent mode — a process-level singleton would
- * leak state across concurrent sessions (see specs/047-worktree.md FR-042).
+ * leak state across concurrent sessions (see docs/specs/multi-agent/worktree.md FR-042).
  */
 
 export interface WorktreeSession {

package/src/utils/worktreeUtils.ts

@@ -93,8 +93,16 @@ export function getHeadCommit(cwd: string): string {
 
 /**
  * Create a git worktree for use during a session.
+ * @param name Worktree name
+ * @param cwd Current working directory (will be resolved to main repo root)
+ * @param options Optional creation options
+ * @param options.baseRef "fresh" (default, origin/<default-branch>) | "head" (local HEAD)
  */
-export function createWorktree(name: string, cwd: string): WorktreeInfo {
+export function createWorktree(
+  name: string,
+  cwd: string,
+  options?: { baseRef?: "fresh" | "head" },
+): WorktreeInfo {
   const repoRoot = getGitMainRepoRoot(cwd);
   if (!repoRoot) {
     throw new Error(
@@ -107,7 +115,8 @@ export function createWorktree(name: string, cwd: string): WorktreeInfo {
 
   const worktreePath = path.join(repoRoot, ".wave", "worktrees", name);
   const branchName = `worktree-${name}`;
-  const baseBranch = getDefaultRemoteBranch(cwd);
+  const useHead = options?.baseRef === "head";
+  const baseBranch = useHead ? "HEAD" : getDefaultRemoteBranch(cwd);
 
   // Ensure Wave runtime files are git-excluded in this repo
   ensureWaveRuntimeFilesExcluded(cwd);
@@ -183,8 +192,9 @@ export function createWorktree(name: string, cwd: string): WorktreeInfo {
       }
     }
     if (
-      stderr.includes("not a valid object name") ||
-      stderr.includes("unknown revision")
+      !useHead &&
+      (stderr.includes("not a valid object name") ||
+        stderr.includes("unknown revision"))
     ) {
       // Base branch not fetched yet — try fetching then retrying
       const branchNameOnly = baseBranch.split("/").pop()!;

package/src/workflow/types.ts

@@ -42,6 +42,12 @@ export interface WorkflowRun {
   failedAgentError?: string;
 }
 
+/**
+ * Serializable workflow run for stdio transport, with the non-serializable
+ * `completionPromise` stripped. Returned by the `getWorkflowRuns` RPC.
+ */
+export type SerializableWorkflowRun = Omit<WorkflowRun, "completionPromise">;
+
 export interface JournalEntry {
   agentIndex: number;
   prompt: string;