wave-agent-sdk 0.19.8 → 0.19.9

package/src/services/aiService.ts

@@ -24,7 +24,6 @@ import * as fs from "fs";
 import * as path from "path";
 
 import {
-  COMPACT_MESSAGES_SYSTEM_PROMPT,
   WEB_CONTENT_SYSTEM_PROMPT,
   BTW_SYSTEM_PROMPT,
   type SystemPromptBlock,
@@ -169,6 +168,12 @@ export interface CallAgentOptions {
     | "required"
     | { type: "function"; function: { name: string } }; // Force tool selection
 
+  // Force SSE streaming independent of callback presence. Long-running
+  // non-interactive calls (e.g. the compaction fork) need streaming so a
+  // slow reasoning model isn't killed by a gateway idle timeout before the
+  // first byte arrives.
+  stream?: boolean;
+
   // NEW: Streaming callbacks
   onContentUpdate?: (content: string) => void;
   onToolUpdate?: (toolCall: {
@@ -319,11 +324,9 @@ export async function callAgent(
     });
 
     // Determine if streaming is needed
-    const isStreaming = !!(
-      onContentUpdate ||
-      onToolUpdate ||
-      onReasoningUpdate
-    );
+    const isStreaming =
+      options.stream === true ||
+      !!(onContentUpdate || onToolUpdate || onReasoningUpdate);
 
     // Prepare API call parameters
     createParams = {
@@ -787,128 +790,6 @@ async function processStreamingResponse(
   return result;
 }
 
-export interface CompactMessagesOptions {
-  // Resolved configuration
-  gatewayConfig: GatewayConfig;
-  modelConfig: ModelConfig;
-
-  // Existing parameters
-  messages: ChatCompletionMessageParam[];
-  abortSignal?: AbortSignal;
-  model?: string;
-  customInstructions?: string;
-}
-
-export interface CompactMessagesResult {
-  content: string;
-  usage?: {
-    prompt_tokens: number;
-    completion_tokens: number;
-    total_tokens: number;
-  };
-}
-
-export async function compactMessages(
-  options: CompactMessagesOptions,
-): Promise<CompactMessagesResult> {
-  const { gatewayConfig, modelConfig, messages, abortSignal } = options;
-
-  // Validate model config at call time
-  validateModelConfig(modelConfig);
-
-  // Apply global 1 QPS rate limit
-  if (
-    process.env.NODE_ENV !== "test" ||
-    modelConfig.model === "rate-limit-test"
-  ) {
-    await acquireSlot(abortSignal);
-  }
-
-  // Strip images from messages before compact API call to reduce token usage
-  const cleanedMessages = messages.map((msg) => {
-    // Handle user/assistant messages with array content
-    if (Array.isArray(msg.content)) {
-      const textParts = msg.content.filter(
-        (part) => part.type === "text",
-      ) as import("openai/resources.js").ChatCompletionContentPartText[];
-      const text = textParts.map((p) => p.text).join("\n");
-      return { ...msg, content: text || "(empty message)" };
-    }
-    return msg;
-  });
-
-  // Create OpenAI client with injected configuration
-  const openai = new OpenAIClient({
-    apiKey: gatewayConfig.apiKey,
-    baseURL: gatewayConfig.baseURL,
-    defaultHeaders: gatewayConfig.defaultHeaders,
-    fetchOptions: gatewayConfig.fetchOptions,
-    fetch: gatewayConfig.fetch,
-  });
-
-  // When a fast model override is provided, use the fast model's options
-  // (if configured); otherwise fall back to the agent model's options.
-  const activeExtraParams = options.model
-    ? modelConfig.fastModelOptions || {}
-    : modelConfig.options || {};
-
-  const openaiModelConfig = getModelConfig(options.model || modelConfig.model, {
-    temperature: 0.1,
-    max_tokens: 8192,
-    ...activeExtraParams,
-  });
-
-  try {
-    const response = await openai.chat.completions.create(
-      {
-        ...openaiModelConfig,
-        messages: [
-          {
-            role: "system",
-            content: COMPACT_MESSAGES_SYSTEM_PROMPT,
-          },
-          ...cleanedMessages,
-          {
-            role: "user",
-            content: options.customInstructions
-              ? `Please create a detailed summary of the conversation so far. Pay special attention to these instructions: ${options.customInstructions}`
-              : `Please create a detailed summary of the conversation so far.`,
-          },
-        ],
-      },
-      {
-        signal: abortSignal,
-      },
-    );
-
-    const content = response.choices[0]?.message?.content?.trim();
-    if (!content) {
-      throw new Error(
-        "Failed to compact conversation history: Empty response from AI",
-      );
-    }
-    const usage = response.usage
-      ? {
-          prompt_tokens: response.usage.prompt_tokens,
-          completion_tokens: response.usage.completion_tokens,
-          total_tokens: response.usage.total_tokens,
-        }
-      : undefined;
-
-    return {
-      content,
-      usage,
-    };
-  } catch (error) {
-    if ((error as Error).name === "AbortError") {
-      logger.info("Compaction request was aborted");
-      throw new Error("Compaction request was aborted");
-    }
-    logger.error("Failed to compact messages:", error);
-    throw error;
-  }
-}
-
 export interface ProcessWebContentOptions {
   // Resolved configuration
   gatewayConfig: GatewayConfig;

package/src/services/session.ts

@@ -825,7 +825,9 @@ export async function handleSessionRestoration(
 /**
  * Load the full message thread for a session.
  * With append-only compaction, all messages are in a single file.
- * Returns the active messages (post-compact boundary).
+ * Unlike loadSessionFromJsonl, this returns every message in the file,
+ * including those before the last compact boundary — rewind needs the
+ * complete history to allow rewinding past compaction points.
  * @param currentSessionId - The ID of the current session
  * @param workdir - Working directory for the session
  * @returns Promise that resolves to an array of all messages in the thread
@@ -834,7 +836,19 @@ export async function loadFullMessageThread(
   currentSessionId: string,
   workdir: string,
 ): Promise<{ messages: Message[]; sessionIds: string[] }> {
-  const sessionData = await loadSessionFromJsonl(currentSessionId, workdir);
-  if (!sessionData) return { messages: [], sessionIds: [] };
-  return { messages: sessionData.messages, sessionIds: [currentSessionId] };
+  const jsonlHandler = new JsonlHandler();
+  const filePath = await generateSessionFilePath(
+    currentSessionId,
+    workdir,
+    "main",
+  );
+
+  try {
+    await fs.access(filePath);
+  } catch {
+    return { messages: [], sessionIds: [] };
+  }
+
+  const messages = await jsonlHandler.read(filePath);
+  return { messages, sessionIds: [currentSessionId] };
 }

package/src/services/taskManager.ts

@@ -71,6 +71,7 @@ export class TaskManager extends EventEmitter {
     let lockHandle;
     const maxRetries = 100;
     const retryDelay = process.env.NODE_ENV === "test" ? 1 : 100;
+    const staleThreshold = 10000;
 
     await this.ensureSessionDir();
 
@@ -79,16 +80,41 @@ export class TaskManager extends EventEmitter {
         lockHandle = await fs.open(lockPath, "wx");
         break;
       } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "EEXIST") {
-          if (i === maxRetries - 1) {
-            throw new Error(
-              `Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`,
-            );
+        const code = (error as NodeJS.ErrnoException).code;
+
+        // Only EEXIST (lock held) and EPERM (Windows pending-delete window)
+        // are transient lock-contention errors. EACCES/ENOENT are real failures
+        // and must not be retried as lock competition.
+        if (code !== "EEXIST" && code !== "EPERM") {
+          throw error;
+        }
+
+        if (i === maxRetries - 1) {
+          throw new Error(
+            `Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`,
+          );
+        }
+
+        // Stale recovery: if the lock holder crashed without releasing, the
+        // lock file remains forever. Check mtime — if older than the threshold,
+        // remove it. Aligns with proper-lockfile's default 10s stale detection.
+        // The lock file is empty (no PID content), so mtime is the only signal.
+        if (
+          code === "EEXIST" &&
+          (await this.isLockStale(lockPath, staleThreshold))
+        ) {
+          logger.warn(
+            `TaskManager: removing stale lock for task list ${this.taskListId}`,
+          );
+          try {
+            await fs.unlink(lockPath);
+          } catch {
+            // Another waiter may have already removed it — retry anyway
           }
-          await new Promise((resolve) => setTimeout(resolve, retryDelay));
           continue;
         }
-        throw error;
+
+        await new Promise((resolve) => setTimeout(resolve, retryDelay));
       }
     }
 
@@ -109,6 +135,19 @@ export class TaskManager extends EventEmitter {
     }
   }
 
+  private async isLockStale(
+    lockPath: string,
+    threshold: number,
+  ): Promise<boolean> {
+    try {
+      const stats = await fs.stat(lockPath);
+      return Date.now() - stats.mtimeMs > threshold;
+    } catch {
+      // Lock was removed between our EEXIST and stat — not stale, just retry
+      return false;
+    }
+  }
+
   private validateTask(task: Task): void {
     if (!task.id || typeof task.id !== "string")
       throw new Error("Invalid task ID");

package/src/tools/editTool.ts

@@ -114,9 +114,14 @@ Usage:
 
     // Enforce read-before-edit: the file must have been read or written first.
     // readFileState is populated by Read, Write, and Edit tools — single source
-    // of truth, aligned with Claude Code's readFileState approach.
+    // of truth, aligned with Claude Code's readFileState approach. Skipped in
+    // plan mode: permissionManager enforces a plan-file-only gate whose denial
+    // message must surface instead of being masked by a read-state rejection.
     const resolvedPath = resolvePath(filePath, context.workdir);
-    if (!context.readFileState?.has(resolvedPath)) {
+    if (
+      context.permissionMode !== "plan" &&
+      !context.readFileState?.has(resolvedPath)
+    ) {
       return {
         success: false,
         content: "",
@@ -137,18 +142,31 @@ Usage:
         };
       }
 
-      // Staleness check: file must not have been modified since last Read
-      if (context.readFileState) {
+      // Staleness check (aligned with Claude Code): only flag when the file got
+      // newer since last read. For full reads, a content-hash fallback avoids
+      // false positives when mtime changed but content didn't (git checkout,
+      // editor round-trip save, cloud sync, antivirus). Partial reads get no
+      // fallback since only a slice was cached. Skipped in plan mode (see
+      // read-before-edit note above) so the plan-file-only denial wins.
+      if (context.permissionMode !== "plan" && context.readFileState) {
         const state = context.readFileState.get(resolvedPath);
         if (state) {
           const currentStats = await stat(resolvedPath);
-          if (currentStats.mtime.getTime() !== state.mtime) {
-            return {
-              success: false,
-              content: "",
-              error:
-                "File has been unexpectedly modified since last read. Read it again before editing it.",
-            };
+          if (currentStats.mtime.getTime() > state.mtime) {
+            const isFullRead =
+              state.offset === undefined && state.limit === undefined;
+            const contentUnchanged =
+              isFullRead &&
+              createHash("sha256").update(originalContent).digest("hex") ===
+                state.hash;
+            if (!contentUnchanged) {
+              return {
+                success: false,
+                content: "",
+                error:
+                  "File has been unexpectedly modified since last read. Read it again before editing it.",
+              };
+            }
           }
         }
       }

package/src/tools/grepTool.ts

@@ -2,6 +2,7 @@ import type { ToolPlugin, ToolResult, ToolContext } from "./types.js";
 import { spawn } from "child_process";
 import { rgPath } from "../utils/ripgrep.js";
 import { getDisplayPath } from "../utils/path.js";
+import { logger } from "../utils/globalLogger.js";
 import {
   GREP_TOOL_NAME,
   BASH_TOOL_NAME,
@@ -235,8 +236,10 @@ export const grepTool: ToolPlugin = {
 
       const result = await executeCommand(rgPath, rgArgs, workdir);
 
-      if (result.error && result.exitCode !== 1) {
-        // rg returns 1 for no matches, not an error
+      // Only a process-level spawn failure (exitCode null) is a hard error.
+      // rg exit 2 means some files were unreadable (e.g. device-name files
+      // like "nul" on Windows); stdout still holds usable partial results.
+      if (result.exitCode === null) {
         return {
           success: false,
           content: "",
@@ -244,6 +247,12 @@ export const grepTool: ToolPlugin = {
         };
       }
 
+      if (result.exitCode !== 0 && result.exitCode !== 1) {
+        logger.debug(
+          `ripgrep exited with code ${result.exitCode}, keeping partial results: ${result.stderr.trim()}`,
+        );
+      }
+
       const output = result.stdout.trim();
       if (!output) {
         return {

package/src/tools/writeTool.ts

@@ -86,6 +86,49 @@ Usage:
         isExistingFile = false;
       }
 
+      // Read-before-write + staleness guards (aligned with Claude Code).
+      // Only enforced for existing files when readFileState is available
+      // (production always injects it; new-file creation always bypasses).
+      // Grep does not register a file as read, so Grep-then-Write on an
+      // existing file is still rejected. Staleness uses the same `>` + full-
+      // read content-hash fallback as editTool to avoid false positives from
+      // git checkout / editor round-trip save / cloud sync / antivirus.
+      // Plan mode is excluded: it has its own stricter write gate (plan-file-
+      // only, enforced in permissionManager) whose denial message must surface
+      // instead of being masked by a read-state rejection.
+      if (
+        isExistingFile &&
+        context.readFileState &&
+        context.permissionMode !== "plan"
+      ) {
+        const state = context.readFileState.get(resolvedPath);
+        if (!state) {
+          return {
+            success: false,
+            content: "",
+            error:
+              "File has not been read yet. Read it first before writing to it.",
+          };
+        }
+        const currentStats = await stat(resolvedPath);
+        if (currentStats.mtime.getTime() > state.mtime) {
+          const isFullRead =
+            state.offset === undefined && state.limit === undefined;
+          const contentUnchanged =
+            isFullRead &&
+            createHash("sha256").update(originalContent).digest("hex") ===
+              state.hash;
+          if (!contentUnchanged) {
+            return {
+              success: false,
+              content: "",
+              error:
+                "File has been unexpectedly modified since last read. Read it again before writing to it.",
+            };
+          }
+        }
+      }
+
       // Check if overwriting existing file but content is the same
       if (isExistingFile && originalContent === content) {
         return {

package/src/utils/bashParser.ts

@@ -476,6 +476,77 @@ export const DANGEROUS_COMMANDS = [
   "netcat",
 ];
 
+/**
+ * Read-only command set: commands that only read/transform data and write to stdout.
+ * When a command in this set is used without write redirections, command substitution,
+ * or dangerous flags (e.g. sed -i), it is auto-allowed without a confirmation dialog.
+ * Aligned with Claude Code's SEMANTIC_READ_ONLY_COMMANDS, excluding interactive pagers
+ * (less, more, man, info), command executors (xargs), and infinite-output generators (yes).
+ * FR-019.2 through FR-019.7 in tool-permission-system.md.
+ */
+export const READ_ONLY_COMMANDS = [
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "sort",
+  "uniq",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "find",
+  "which",
+  "whereis",
+  "file",
+  "stat",
+  "du",
+  "df",
+  "free",
+  "uptime",
+  "uname",
+  "hostname",
+  "whoami",
+  "id",
+  "groups",
+  "env",
+  "printenv",
+  "echo",
+  "printf",
+  "date",
+  "true",
+  "false",
+  "pwd",
+  "tree",
+  "diff",
+  "cmp",
+  "md5sum",
+  "sha256sum",
+  "sha1sum",
+  "xxd",
+  "od",
+  "hexdump",
+  "strings",
+  "readlink",
+  "realpath",
+  "basename",
+  "dirname",
+  "seq",
+  "column",
+  "jq",
+  "yq",
+  "cut",
+  "paste",
+  "tr",
+  "awk",
+  "sed",
+  "test",
+  "expr",
+  "bc",
+  "sleep",
+];
+
 /**
  * Registry of commands and their expected subcommand depth for smart prefix extraction.
  * For example, 'git: 2' means 'git commit' is a valid prefix, but 'git' alone is not.
@@ -634,6 +705,41 @@ export function isDangerousFind(command: string): boolean {
   });
 }
 
+/**
+ * Detects command substitution $(...) or backticks `...` in a command string.
+ * Commands with substitution are never auto-allowed because the substituted
+ * command may be dangerous (e.g. cat $(rm x)). FR-019.6.
+ */
+export function hasCommandSubstitution(command: string): boolean {
+  // Remove quoted strings first so $() or backticks inside quotes don't trigger
+  const stripped = command
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+  return /\$\([^)]*\)/.test(stripped) || /`[^`]*`/.test(stripped);
+}
+
+/**
+ * Detects process substitution <(...) or >(...) in a command string.
+ * These can execute side effects and are never auto-allowed. FR-019.6.
+ */
+export function hasProcessSubstitution(command: string): boolean {
+  const stripped = command
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+  return /[<>]\([^)]*\)/.test(stripped);
+}
+
+/**
+ * Detects sed in-place edit flag (-i, with optional backup suffix like -i.bak).
+ * sed -i modifies files in place and must NOT be auto-allowed. FR-019.5.
+ */
+export function hasSedInPlace(command: string): boolean {
+  const stripped = stripRedirections(stripEnvVars(command));
+  const tokens = stripped.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
+  if (tokens.length === 0 || tokens[0] !== "sed") return false;
+  return tokens.some((token) => /^-i(\..*)?$/.test(token));
+}
+
 /**
  * Extracts a "smart prefix" from a bash command based on common developer tools.
  * Returns null if the command is blacklisted or cannot be safely prefix-matched.

package/src/utils/configPaths.ts

@@ -51,6 +51,13 @@ export function getBuiltinSubagentsDir(): string {
   return join(getPackageRoot(), "builtin", "subagents");
 }
 
+/**
+ * Get the builtin plugins directory path
+ */
+export function getBuiltinPluginsDir(): string {
+  return join(getPackageRoot(), "builtin", "plugins");
+}
+
 /**
  * Get the user-specific configuration file path (legacy function)
  * @deprecated Use getUserConfigPaths() for better priority support

package/src/utils/fileSearch.ts

@@ -34,9 +34,13 @@ async function getAllFiles(workingDirectory: string): Promise<string[]> {
     });
 
     child.on("close", (code) => {
+      // Exit 2 = some files were unreadable (e.g. device-name files like
+      // "nul" on Windows); stdout still holds usable partial results.
+      // Spawn failures surface via the 'error' listener instead.
       if (code !== 0 && code !== 1) {
-        reject(new Error(`ripgrep failed: ${stderr}`));
-        return;
+        logger.warn(
+          `ripgrep exited with code ${code}, keeping partial results: ${stderr.trim()}`,
+        );
       }
       const files = stdout
         .trim()