wave-agent-sdk 0.19.8 → 1.0.0

package/src/services/interactionService.ts

@@ -93,7 +93,9 @@ export class InteractionService {
               cwd: workdir,
               userPrompt: content,
               env: Object.fromEntries(
-                Object.entries(process.env).filter((e) => e[1] !== undefined),
+                Object.entries(
+                  context.configurationService.getMergedEnv(),
+                ).filter((e) => e[1] !== undefined),
               ) as Record<string, string>, // Include environment variables
             },
           );
@@ -137,6 +139,7 @@ export class InteractionService {
   ): Promise<void> {
     const {
       messageManager,
+      hookManager,
       logger,
       subagentManager,
       taskManager,
@@ -157,7 +160,24 @@ export class InteractionService {
       // Continue with restoration even if save fails
     }
 
-    // 3. Load target session
+    // 3. Run SessionEnd hooks for the current session (cleanup before switching)
+    const currentSessionId = messageManager.getSessionId();
+    const currentTranscriptPath = messageManager.getTranscriptPath();
+    if (hookManager) {
+      try {
+        await hookManager.executeSessionEndHooks(
+          "resume",
+          currentSessionId,
+          currentTranscriptPath,
+        );
+      } catch (error) {
+        logger?.warn(
+          `SessionEnd hooks on restore failed: ${(error as Error).message}`,
+        );
+      }
+    }
+
+    // 4. Load target session
     const sessionData = await loadSessionFromJsonl(
       sessionId,
       messageManager.getWorkdir(),
@@ -166,20 +186,43 @@ export class InteractionService {
       throw new Error(`Session not found: ${sessionId}`);
     }
 
-    // 4. Clean current state
+    // 5. Clean current state
     abortMessage(); // Abort any running operations
     subagentManager.cleanup(); // Clean up active subagents
 
-    // 5. Rebuild usage (in correct order)
+    // 6. Rebuild usage (in correct order)
     messageManager.rebuildUsageFromMessages(sessionData.messages);
 
-    // 6. Initialize session state last
+    // 7. Initialize session state last
     messageManager.initializeFromSession(sessionData);
 
+    // 8. Run SessionStart hooks for the restored session and inject additional
+    //    context as a meta user message (matches Claude Code's resume behavior:
+    //    SessionEnd then SessionStart, hook messages appended to the conversation)
+    if (hookManager) {
+      try {
+        const sessionStartResult = await hookManager.executeSessionStartHooks(
+          "resume",
+          sessionData.id,
+          messageManager.getTranscriptPath(),
+        );
+        if (sessionStartResult.additionalContext) {
+          messageManager.addUserMessage({
+            content: `<system-reminder>\nSessionStart hook additional context: ${sessionStartResult.additionalContext}\n</system-reminder>`,
+            isMeta: true,
+          });
+        }
+      } catch (error) {
+        logger?.warn(
+          `SessionStart hooks on restore failed: ${(error as Error).message}`,
+        );
+      }
+    }
+
     // Update task manager with the root session ID to ensure continuity across compactions
     taskManager.setTaskListId(sessionData.id);
 
-    // 7. Load tasks for the restored session
+    // 9. Load tasks for the restored session
     const tasks = await taskManager.listTasks();
     options.callbacks?.onTasksChange?.(tasks);
   }

package/src/services/remoteSettingsService.ts

@@ -198,8 +198,22 @@ function startPolling(): void {
 }
 
 export function initialize(): void {
+  // Load disk cache synchronously so getRemoteSettingsSync() returns cached
+  // managed settings during loadMergedConfiguration() (must run BEFORE it).
   loadCacheFromDisk();
-  // Fire-and-forget the initial fetch, then start background polling
+}
+
+/**
+ * Start the fire-and-forget initial network fetch + background polling.
+ *
+ * Must be called AFTER loadMergedConfiguration() so disk-cached managed
+ * settings are merged before the fetch, and so settings `env` WAVE_SERVER_URL
+ * is mirrored to process.env (by setEnvironmentVars) before the fetch. The
+ * fetch uses authService.getServerUrl(), which reads process.env.WAVE_SERVER_URL
+ * — the settings value is visible there, so there is no init-ordering race
+ * that would fall back to DEFAULT_SERVER_URL (prod) and hit a test endpoint (401).
+ */
+export function startBackgroundFetch(): void {
   fetchRemoteSettings()
     .then(() => startPolling())
     .catch((err) => {
@@ -342,6 +356,7 @@ export function mergeRemoteSettings(
  */
 export const remoteSettingsService = {
   initialize,
+  startBackgroundFetch,
   getRemoteSettingsSync,
   refresh,
   clear,

package/src/services/session.ts

@@ -825,7 +825,9 @@ export async function handleSessionRestoration(
 /**
  * Load the full message thread for a session.
  * With append-only compaction, all messages are in a single file.
- * Returns the active messages (post-compact boundary).
+ * Unlike loadSessionFromJsonl, this returns every message in the file,
+ * including those before the last compact boundary — rewind needs the
+ * complete history to allow rewinding past compaction points.
  * @param currentSessionId - The ID of the current session
  * @param workdir - Working directory for the session
  * @returns Promise that resolves to an array of all messages in the thread
@@ -834,7 +836,19 @@ export async function loadFullMessageThread(
   currentSessionId: string,
   workdir: string,
 ): Promise<{ messages: Message[]; sessionIds: string[] }> {
-  const sessionData = await loadSessionFromJsonl(currentSessionId, workdir);
-  if (!sessionData) return { messages: [], sessionIds: [] };
-  return { messages: sessionData.messages, sessionIds: [currentSessionId] };
+  const jsonlHandler = new JsonlHandler();
+  const filePath = await generateSessionFilePath(
+    currentSessionId,
+    workdir,
+    "main",
+  );
+
+  try {
+    await fs.access(filePath);
+  } catch {
+    return { messages: [], sessionIds: [] };
+  }
+
+  const messages = await jsonlHandler.read(filePath);
+  return { messages, sessionIds: [currentSessionId] };
 }

package/src/services/taskManager.ts

@@ -6,6 +6,7 @@ import { Task } from "../types/tasks.js";
 import { logger } from "../utils/globalLogger.js";
 import { Container } from "../utils/container.js";
 import type { MessageManager } from "../managers/messageManager.js";
+import type { ConfigurationService } from "./configurationService.js";
 
 function byIdAsc(a: Task, b: Task) {
   const aNum = parseInt(a.id, 10);
@@ -44,7 +45,15 @@ export class TaskManager extends EventEmitter {
     if (!messageManager) return;
 
     const rootSessionId = messageManager.getRootSessionId();
-    if (this.taskListId !== rootSessionId && !process.env.WAVE_TASK_LIST_ID) {
+    // Read the per-session snapshot (not process.env) so multiple sessions in
+    // one `wave --stdio` process don't cross-pollute this flag.
+    const envSnap =
+      this.container
+        .get<ConfigurationService>("ConfigurationService")
+        ?.getEnvSnapshot() ?? {};
+    const pinnedTaskListId =
+      envSnap.WAVE_TASK_LIST_ID ?? process.env.WAVE_TASK_LIST_ID;
+    if (this.taskListId !== rootSessionId && !pinnedTaskListId) {
       this.setTaskListId(rootSessionId);
       await this.refreshTasks();
     }
@@ -71,6 +80,7 @@ export class TaskManager extends EventEmitter {
     let lockHandle;
     const maxRetries = 100;
     const retryDelay = process.env.NODE_ENV === "test" ? 1 : 100;
+    const staleThreshold = 10000;
 
     await this.ensureSessionDir();
 
@@ -79,16 +89,41 @@ export class TaskManager extends EventEmitter {
         lockHandle = await fs.open(lockPath, "wx");
         break;
       } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "EEXIST") {
-          if (i === maxRetries - 1) {
-            throw new Error(
-              `Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`,
-            );
+        const code = (error as NodeJS.ErrnoException).code;
+
+        // Only EEXIST (lock held) and EPERM (Windows pending-delete window)
+        // are transient lock-contention errors. EACCES/ENOENT are real failures
+        // and must not be retried as lock competition.
+        if (code !== "EEXIST" && code !== "EPERM") {
+          throw error;
+        }
+
+        if (i === maxRetries - 1) {
+          throw new Error(
+            `Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`,
+          );
+        }
+
+        // Stale recovery: if the lock holder crashed without releasing, the
+        // lock file remains forever. Check mtime — if older than the threshold,
+        // remove it. Aligns with proper-lockfile's default 10s stale detection.
+        // The lock file is empty (no PID content), so mtime is the only signal.
+        if (
+          code === "EEXIST" &&
+          (await this.isLockStale(lockPath, staleThreshold))
+        ) {
+          logger.warn(
+            `TaskManager: removing stale lock for task list ${this.taskListId}`,
+          );
+          try {
+            await fs.unlink(lockPath);
+          } catch {
+            // Another waiter may have already removed it — retry anyway
           }
-          await new Promise((resolve) => setTimeout(resolve, retryDelay));
           continue;
         }
-        throw error;
+
+        await new Promise((resolve) => setTimeout(resolve, retryDelay));
       }
     }
 
@@ -109,6 +144,19 @@ export class TaskManager extends EventEmitter {
     }
   }
 
+  private async isLockStale(
+    lockPath: string,
+    threshold: number,
+  ): Promise<boolean> {
+    try {
+      const stats = await fs.stat(lockPath);
+      return Date.now() - stats.mtimeMs > threshold;
+    } catch {
+      // Lock was removed between our EEXIST and stat — not stale, just retry
+      return false;
+    }
+  }
+
   private validateTask(task: Task): void {
     if (!task.id || typeof task.id !== "string")
       throw new Error("Invalid task ID");

package/src/tools/bashTool.ts

@@ -285,6 +285,7 @@ The working directory persists between commands. Try to maintain your current wo
         cwd: context.workdir,
         env: {
           ...process.env,
+          ...context.sessionEnv,
         },
       });
 

package/src/tools/editTool.ts

@@ -114,9 +114,14 @@ Usage:
 
     // Enforce read-before-edit: the file must have been read or written first.
     // readFileState is populated by Read, Write, and Edit tools — single source
-    // of truth, aligned with Claude Code's readFileState approach.
+    // of truth, aligned with Claude Code's readFileState approach. Skipped in
+    // plan mode: permissionManager enforces a plan-file-only gate whose denial
+    // message must surface instead of being masked by a read-state rejection.
     const resolvedPath = resolvePath(filePath, context.workdir);
-    if (!context.readFileState?.has(resolvedPath)) {
+    if (
+      context.permissionMode !== "plan" &&
+      !context.readFileState?.has(resolvedPath)
+    ) {
       return {
         success: false,
         content: "",
@@ -137,18 +142,31 @@ Usage:
         };
       }
 
-      // Staleness check: file must not have been modified since last Read
-      if (context.readFileState) {
+      // Staleness check (aligned with Claude Code): only flag when the file got
+      // newer since last read. For full reads, a content-hash fallback avoids
+      // false positives when mtime changed but content didn't (git checkout,
+      // editor round-trip save, cloud sync, antivirus). Partial reads get no
+      // fallback since only a slice was cached. Skipped in plan mode (see
+      // read-before-edit note above) so the plan-file-only denial wins.
+      if (context.permissionMode !== "plan" && context.readFileState) {
         const state = context.readFileState.get(resolvedPath);
         if (state) {
           const currentStats = await stat(resolvedPath);
-          if (currentStats.mtime.getTime() !== state.mtime) {
-            return {
-              success: false,
-              content: "",
-              error:
-                "File has been unexpectedly modified since last read. Read it again before editing it.",
-            };
+          if (currentStats.mtime.getTime() > state.mtime) {
+            const isFullRead =
+              state.offset === undefined && state.limit === undefined;
+            const contentUnchanged =
+              isFullRead &&
+              createHash("sha256").update(originalContent).digest("hex") ===
+                state.hash;
+            if (!contentUnchanged) {
+              return {
+                success: false,
+                content: "",
+                error:
+                  "File has been unexpectedly modified since last read. Read it again before editing it.",
+              };
+            }
           }
         }
       }

package/src/tools/enterWorktreeTool.ts

@@ -9,6 +9,7 @@ import {
   createWorktree,
   validateWorktreeName,
   generateWorktreeName,
+  performPostCreationSetup,
 } from "../utils/worktreeUtils.js";
 import { getGitMainRepoRoot } from "../utils/gitUtils.js";
 import { ENTER_WORKTREE_TOOL_NAME } from "../constants/tools.js";
@@ -105,6 +106,20 @@ export const enterWorktreeTool: ToolPlugin = {
     const baseRef = context.aiManager?.getWorktreeBaseRef?.();
     const worktreeInfo = createWorktree(name, mainRepoRoot, { baseRef });
 
+    // Copy local settings (.wave/settings.local.json) and gitignored project
+    // files (.worktreeinclude, e.g. .env/.mcp.json) into a new worktree —
+    // mirrors the CLI createWorktree path. Best-effort, never fails the tool.
+    if (worktreeInfo.isNew) {
+      try {
+        await performPostCreationSetup(
+          worktreeInfo.path,
+          worktreeInfo.repoRoot,
+        );
+      } catch (error) {
+        logger?.warn("Worktree post-creation setup failed:", error);
+      }
+    }
+
     // Build session state
     const session: WorktreeSession = {
       originalCwd: context.workdir,
@@ -134,11 +149,13 @@ export const enterWorktreeTool: ToolPlugin = {
             projectDir: worktreeInfo.path,
             timestamp: new Date(),
             sessionId: context.sessionId ?? "",
-            transcriptPath: context.messageManager?.getTranscriptPath() ?? "",
+            transcriptPath: context.messageManager?.getTranscriptPath?.() ?? "",
             cwd: worktreeInfo.path,
             worktreeName: worktreeInfo.name,
             env: Object.fromEntries(
-              Object.entries(process.env).filter((e) => e[1] !== undefined),
+              Object.entries(context.sessionEnv ?? process.env).filter(
+                (e) => e[1] !== undefined,
+              ),
             ) as Record<string, string>,
           },
         );

package/src/tools/exitWorktreeTool.ts

@@ -162,16 +162,8 @@ export const exitWorktreeTool: ToolPlugin = {
       session.originalHeadCommit,
     ) ?? { changedFiles: 0, commits: 0 };
 
-    removeWorktree(worktreeInfo);
-
-    // Clear session state and restore CWD
-    const aiManager = context.aiManager;
-    if (aiManager) {
-      aiManager.setWorktreeSession(null);
-      aiManager.setWorkdir(originalCwd);
-    }
-
-    // Trigger WorktreeRemove hook (non-blocking)
+    // Trigger WorktreeRemove hook (non-blocking) BEFORE git removal so hooks
+    // can still read files inside the worktree to clean up external resources.
     let hookTriggered = false;
     if (context.hookManager) {
       try {
@@ -182,11 +174,13 @@ export const exitWorktreeTool: ToolPlugin = {
             projectDir: originalCwd,
             timestamp: new Date(),
             sessionId: context.sessionId ?? "",
-            transcriptPath: context.messageManager?.getTranscriptPath() ?? "",
+            transcriptPath: context.messageManager?.getTranscriptPath?.() ?? "",
             cwd: originalCwd,
             worktreePath,
             env: Object.fromEntries(
-              Object.entries(process.env).filter((e) => e[1] !== undefined),
+              Object.entries(context.sessionEnv ?? process.env).filter(
+                (e) => e[1] !== undefined,
+              ),
             ) as Record<string, string>,
           },
         );
@@ -206,6 +200,15 @@ export const exitWorktreeTool: ToolPlugin = {
       }
     }
 
+    removeWorktree(worktreeInfo);
+
+    // Clear session state and restore CWD
+    const aiManager = context.aiManager;
+    if (aiManager) {
+      aiManager.setWorktreeSession(null);
+      aiManager.setWorkdir(originalCwd);
+    }
+
     const discardParts: string[] = [];
     if (summary.commits > 0) {
       discardParts.push(

package/src/tools/grepTool.ts

@@ -2,6 +2,7 @@ import type { ToolPlugin, ToolResult, ToolContext } from "./types.js";
 import { spawn } from "child_process";
 import { rgPath } from "../utils/ripgrep.js";
 import { getDisplayPath } from "../utils/path.js";
+import { logger } from "../utils/globalLogger.js";
 import {
   GREP_TOOL_NAME,
   BASH_TOOL_NAME,
@@ -235,8 +236,10 @@ export const grepTool: ToolPlugin = {
 
       const result = await executeCommand(rgPath, rgArgs, workdir);
 
-      if (result.error && result.exitCode !== 1) {
-        // rg returns 1 for no matches, not an error
+      // Only a process-level spawn failure (exitCode null) is a hard error.
+      // rg exit 2 means some files were unreadable (e.g. device-name files
+      // like "nul" on Windows); stdout still holds usable partial results.
+      if (result.exitCode === null) {
         return {
           success: false,
           content: "",
@@ -244,6 +247,12 @@ export const grepTool: ToolPlugin = {
         };
       }
 
+      if (result.exitCode !== 0 && result.exitCode !== 1) {
+        logger.debug(
+          `ripgrep exited with code ${result.exitCode}, keeping partial results: ${result.stderr.trim()}`,
+        );
+      }
+
       const output = result.stdout.trim();
       if (!output) {
         return {

package/src/tools/types.ts

@@ -127,4 +127,11 @@ export interface ToolContext {
   originalWorkdir?: string;
   /** Workflow manager instance for workflow orchestration */
   workflowManager?: import("../managers/workflowManager.js").WorkflowManager;
+  /**
+   * Per-session merged environment (OS env overlaid with the settings env
+   * snapshot) for this session. Tools that spawn subprocesses (Bash, hooks)
+   * should merge this on top of `process.env` so settings `env` vars reach
+   * the subprocess without polluting other sessions in one stdio process.
+   */
+  sessionEnv?: Record<string, string>;
 }

package/src/tools/writeTool.ts

@@ -86,6 +86,49 @@ Usage:
         isExistingFile = false;
       }
 
+      // Read-before-write + staleness guards (aligned with Claude Code).
+      // Only enforced for existing files when readFileState is available
+      // (production always injects it; new-file creation always bypasses).
+      // Grep does not register a file as read, so Grep-then-Write on an
+      // existing file is still rejected. Staleness uses the same `>` + full-
+      // read content-hash fallback as editTool to avoid false positives from
+      // git checkout / editor round-trip save / cloud sync / antivirus.
+      // Plan mode is excluded: it has its own stricter write gate (plan-file-
+      // only, enforced in permissionManager) whose denial message must surface
+      // instead of being masked by a read-state rejection.
+      if (
+        isExistingFile &&
+        context.readFileState &&
+        context.permissionMode !== "plan"
+      ) {
+        const state = context.readFileState.get(resolvedPath);
+        if (!state) {
+          return {
+            success: false,
+            content: "",
+            error:
+              "File has not been read yet. Read it first before writing to it.",
+          };
+        }
+        const currentStats = await stat(resolvedPath);
+        if (currentStats.mtime.getTime() > state.mtime) {
+          const isFullRead =
+            state.offset === undefined && state.limit === undefined;
+          const contentUnchanged =
+            isFullRead &&
+            createHash("sha256").update(originalContent).digest("hex") ===
+              state.hash;
+          if (!contentUnchanged) {
+            return {
+              success: false,
+              content: "",
+              error:
+                "File has been unexpectedly modified since last read. Read it again before writing to it.",
+            };
+          }
+        }
+      }
+
       // Check if overwriting existing file but content is the same
       if (isExistingFile && originalContent === content) {
         return {

package/src/types/config.ts

@@ -12,6 +12,8 @@ export interface GatewayConfig {
   defaultHeaders?: Record<string, string>;
   fetchOptions?: OpenAI["fetchOptions"];
   fetch?: OpenAI["fetch"];
+  /** Session identifier, sent as the `x-session-id` request header for backend correlation. */
+  sessionId?: string;
 }
 
 export interface ModelCapabilities {

package/src/types/hooks.ts

@@ -102,9 +102,9 @@ export class HookConfigurationError extends Error {
   }
 }
 
-export type SessionStartSource = "startup" | "compact" | "clear";
+export type SessionStartSource = "startup" | "resume" | "compact" | "clear";
 
-export type SessionEndSource = "exit" | "stop" | "compact" | "clear";
+export type SessionEndSource = "exit" | "resume" | "stop" | "compact" | "clear";
 
 // Type guards for runtime validation
 export function isValidHookEvent(event: string): event is HookEvent {

package/src/utils/bashParser.ts

@@ -476,6 +476,77 @@ export const DANGEROUS_COMMANDS = [
   "netcat",
 ];
 
+/**
+ * Read-only command set: commands that only read/transform data and write to stdout.
+ * When a command in this set is used without write redirections, command substitution,
+ * or dangerous flags (e.g. sed -i), it is auto-allowed without a confirmation dialog.
+ * Aligned with Claude Code's SEMANTIC_READ_ONLY_COMMANDS, excluding interactive pagers
+ * (less, more, man, info), command executors (xargs), and infinite-output generators (yes).
+ * FR-019.2 through FR-019.7 in tool-permission-system.md.
+ */
+export const READ_ONLY_COMMANDS = [
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "sort",
+  "uniq",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "find",
+  "which",
+  "whereis",
+  "file",
+  "stat",
+  "du",
+  "df",
+  "free",
+  "uptime",
+  "uname",
+  "hostname",
+  "whoami",
+  "id",
+  "groups",
+  "env",
+  "printenv",
+  "echo",
+  "printf",
+  "date",
+  "true",
+  "false",
+  "pwd",
+  "tree",
+  "diff",
+  "cmp",
+  "md5sum",
+  "sha256sum",
+  "sha1sum",
+  "xxd",
+  "od",
+  "hexdump",
+  "strings",
+  "readlink",
+  "realpath",
+  "basename",
+  "dirname",
+  "seq",
+  "column",
+  "jq",
+  "yq",
+  "cut",
+  "paste",
+  "tr",
+  "awk",
+  "sed",
+  "test",
+  "expr",
+  "bc",
+  "sleep",
+];
+
 /**
  * Registry of commands and their expected subcommand depth for smart prefix extraction.
  * For example, 'git: 2' means 'git commit' is a valid prefix, but 'git' alone is not.
@@ -634,6 +705,41 @@ export function isDangerousFind(command: string): boolean {
   });
 }
 
+/**
+ * Detects command substitution $(...) or backticks `...` in a command string.
+ * Commands with substitution are never auto-allowed because the substituted
+ * command may be dangerous (e.g. cat $(rm x)). FR-019.6.
+ */
+export function hasCommandSubstitution(command: string): boolean {
+  // Remove quoted strings first so $() or backticks inside quotes don't trigger
+  const stripped = command
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+  return /\$\([^)]*\)/.test(stripped) || /`[^`]*`/.test(stripped);
+}
+
+/**
+ * Detects process substitution <(...) or >(...) in a command string.
+ * These can execute side effects and are never auto-allowed. FR-019.6.
+ */
+export function hasProcessSubstitution(command: string): boolean {
+  const stripped = command
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''");
+  return /[<>]\([^)]*\)/.test(stripped);
+}
+
+/**
+ * Detects sed in-place edit flag (-i, with optional backup suffix like -i.bak).
+ * sed -i modifies files in place and must NOT be auto-allowed. FR-019.5.
+ */
+export function hasSedInPlace(command: string): boolean {
+  const stripped = stripRedirections(stripEnvVars(command));
+  const tokens = stripped.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
+  if (tokens.length === 0 || tokens[0] !== "sed") return false;
+  return tokens.some((token) => /^-i(\..*)?$/.test(token));
+}
+
 /**
  * Extracts a "smart prefix" from a bash command based on common developer tools.
  * Returns null if the command is blacklisted or cannot be safely prefix-matched.