wave-agent-sdk 0.19.8 → 1.0.0

package/dist/managers/mcpManager.js

@@ -11,7 +11,15 @@ import { logger } from "../utils/globalLogger.js";
  * Supports ${VAR} and ${VAR:-default} patterns.
  */
 const WAVE_TEMPLATE_VARS = ["WAVE_PLUGIN_ROOT", "CLAUDE_PLUGIN_ROOT"];
-export function expandEnvVars(value) {
+/**
+ * Expand environment variables in a string value.
+ * Supports ${VAR} and ${VAR:-default} patterns.
+ *
+ * @param env - Merged env to resolve against (session snapshot over OS env).
+ *              Defaults to `process.env` for backward compatibility with tests
+ *              and standalone callers.
+ */
+export function expandEnvVars(value, env = process.env) {
     return value.replace(/\$\{([^}]+)\}/g, (_match, expr) => {
         const [varName, ...rest] = expr.split(":-");
         const defaultValue = rest.join(":-");
@@ -19,38 +27,38 @@ export function expandEnvVars(value) {
         if (WAVE_TEMPLATE_VARS.includes(varName)) {
             return _match; // return original ${...} string untouched
         }
-        return process.env[varName] ?? defaultValue;
+        return env[varName] ?? process.env[varName] ?? defaultValue;
     });
 }
 /**
  * Walk an MCP config and resolve environment variables in all string fields.
- * Only expands ${VAR} from process.env (skipping WAVE_PLUGIN_ROOT which is
- * handled at spawn time).
+ * Expands ${VAR} against the session env snapshot (over OS env); falls back to
+ * process.env. WAVE_PLUGIN_ROOT is skipped — handled at spawn time.
  */
-export function resolveMcpConfig(config) {
+export function resolveMcpConfig(config, env = process.env) {
     const resolved = { mcpServers: {} };
     for (const [name, serverConfig] of Object.entries(config.mcpServers)) {
         const resolvedServer = { ...serverConfig };
         if (resolvedServer.command) {
-            resolvedServer.command = expandEnvVars(resolvedServer.command);
+            resolvedServer.command = expandEnvVars(resolvedServer.command, env);
         }
         if (resolvedServer.args) {
-            resolvedServer.args = resolvedServer.args.map(expandEnvVars);
+            resolvedServer.args = resolvedServer.args.map((a) => expandEnvVars(a, env));
         }
         if (resolvedServer.env) {
             const resolvedEnv = {};
             for (const [key, val] of Object.entries(resolvedServer.env)) {
-                resolvedEnv[key] = expandEnvVars(val);
+                resolvedEnv[key] = expandEnvVars(val, env);
             }
             resolvedServer.env = resolvedEnv;
         }
         if (resolvedServer.url) {
-            resolvedServer.url = expandEnvVars(resolvedServer.url);
+            resolvedServer.url = expandEnvVars(resolvedServer.url, env);
         }
         if (resolvedServer.headers) {
             const resolvedHeaders = {};
             for (const [key, val] of Object.entries(resolvedServer.headers)) {
-                resolvedHeaders[key] = expandEnvVars(val);
+                resolvedHeaders[key] = expandEnvVars(val, env);
             }
             resolvedServer.headers = resolvedHeaders;
         }
@@ -71,6 +79,16 @@ export class McpManager {
         this.callbacks = options.callbacks || {};
         this.mcpServers = options.mcpServers;
     }
+    /**
+     * Merged env for this session: OS env overlaid with the per-session settings
+     * snapshot. MCP env-var expansion (${VAR}) resolves against this so multiple
+     * sessions in one `wave --stdio` process don't read each other's settings env.
+     */
+    get envSnapshot() {
+        return (this.container
+            .get("ConfigurationService")
+            ?.getMergedEnv?.() ?? process.env);
+    }
     /**
      * Initialize MCP manager with working directory and optionally auto-connect
      */
@@ -125,7 +143,7 @@ export class McpManager {
         try {
             const configContent = await fs.readFile(this.configPath, "utf-8");
             const rawConfig = JSON.parse(configContent);
-            const workspaceConfig = resolveMcpConfig(rawConfig);
+            const workspaceConfig = resolveMcpConfig(rawConfig, this.envSnapshot);
             // Extract original (pre-resolution) URLs for safe display
             const originalUrls = {};
             for (const [name, serverConfig] of Object.entries(rawConfig.mcpServers)) {
@@ -210,28 +228,29 @@ export class McpManager {
         }
         // Capture original URL before any resolution for safe display
         const originalUrl = config.url;
-        // Expand env vars from process.env (e.g. ${TAVILY_API_KEY})
+        // Expand env vars against the session snapshot (over OS env, e.g. ${TAVILY_API_KEY})
+        const env = this.envSnapshot;
         const resolvedConfig = { ...config };
         if (resolvedConfig.command) {
-            resolvedConfig.command = expandEnvVars(resolvedConfig.command);
+            resolvedConfig.command = expandEnvVars(resolvedConfig.command, env);
         }
         if (resolvedConfig.args) {
-            resolvedConfig.args = resolvedConfig.args.map(expandEnvVars);
+            resolvedConfig.args = resolvedConfig.args.map((a) => expandEnvVars(a, env));
         }
         if (resolvedConfig.env) {
             const resolvedEnv = {};
             for (const [key, val] of Object.entries(resolvedConfig.env)) {
-                resolvedEnv[key] = expandEnvVars(val);
+                resolvedEnv[key] = expandEnvVars(val, env);
             }
             resolvedConfig.env = resolvedEnv;
         }
         if (resolvedConfig.url) {
-            resolvedConfig.url = expandEnvVars(resolvedConfig.url);
+            resolvedConfig.url = expandEnvVars(resolvedConfig.url, env);
         }
         if (resolvedConfig.headers) {
             const resolvedHeaders = {};
             for (const [key, val] of Object.entries(resolvedConfig.headers)) {
-                resolvedHeaders[key] = expandEnvVars(val);
+                resolvedHeaders[key] = expandEnvVars(val, env);
             }
             resolvedConfig.headers = resolvedHeaders;
         }
@@ -332,8 +351,11 @@ export class McpManager {
                 if (!server.config.command) {
                     throw new Error(`MCP server ${name} with type "stdio" requires a 'command'`);
                 }
+                // Base env = OS env overlaid with this session's settings snapshot, so
+                // custom env vars from settings.json reach the MCP server subprocess
+                // without polluting other sessions sharing one `wave --stdio` process.
                 const env = {
-                    ...process.env,
+                    ...this.envSnapshot,
                     ...(server.config.env || {}),
                 };
                 // For plugin servers, substitute ${WAVE_PLUGIN_ROOT} and ${CLAUDE_PLUGIN_ROOT}

package/dist/managers/permissionManager.d.ts

@@ -164,6 +164,13 @@ export declare class PermissionManager {
      * Check if a tool call matches a specific permission rule
      */
     private matchesRule;
+    /**
+     * Check if a single bash command part is auto-allowed (read-only and safe).
+     * Auto-allowed commands skip the confirmation dialog entirely.
+     * FR-019.2 through FR-019.7: read-only commands without write redirections,
+     * command substitution, process substitution, or sed -i are auto-allowed.
+     */
+    private isAutoAllowedPart;
     /**
      * Check if a tool call is allowed by persistent or temporary rules
      */

package/dist/managers/permissionManager.js

@@ -8,25 +8,9 @@
 import path from "node:path";
 import { minimatch } from "minimatch";
 import { RESTRICTED_TOOLS } from "../types/permissions.js";
-import { splitBashCommand, stripEnvVars, stripRedirections, hasWriteRedirections, getSmartPrefix, isDangerousFind, DANGEROUS_COMMANDS, } from "../utils/bashParser.js";
+import { splitBashCommand, stripEnvVars, stripRedirections, hasWriteRedirections, getSmartPrefix, isDangerousFind, hasCommandSubstitution, hasProcessSubstitution, hasSedInPlace, DANGEROUS_COMMANDS, READ_ONLY_COMMANDS, } from "../utils/bashParser.js";
 import { isPathInside } from "../utils/pathSafety.js";
 import { BASH_TOOL_NAME, EDIT_TOOL_NAME, WRITE_TOOL_NAME, READ_TOOL_NAME, ASK_USER_QUESTION_TOOL_NAME, } from "../constants/tools.js";
-const SAFE_COMMANDS = [
-    "cd",
-    "ls",
-    "pwd",
-    "true",
-    "false",
-    "grep",
-    "rg",
-    "cat",
-    "head",
-    "tail",
-    "wc",
-    "sleep",
-    "find",
-    "sort",
-];
 const DEFAULT_ALLOWED_RULES = [
     "Bash(git status*)",
     "Bash(git diff*)",
@@ -573,6 +557,12 @@ export class PermissionManager {
                 if (hasWriteRedirections(part)) {
                     return true;
                 }
+                // Command/process substitution and sed -i are dangerous (FR-019.5, FR-019.6)
+                if (hasCommandSubstitution(part) ||
+                    hasProcessSubstitution(part) ||
+                    hasSedInPlace(part)) {
+                    return true;
+                }
                 const processedPart = stripRedirections(stripEnvVars(part));
                 const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
                 if (commandMatch) {
@@ -665,95 +655,101 @@ export class PermissionManager {
         return false;
     }
     /**
-     * Check if a tool call is allowed by persistent or temporary rules
+     * Check if a single bash command part is auto-allowed (read-only and safe).
+     * Auto-allowed commands skip the confirmation dialog entirely.
+     * FR-019.2 through FR-019.7: read-only commands without write redirections,
+     * command substitution, process substitution, or sed -i are auto-allowed.
      */
-    isAllowedByRule(context) {
-        const isAllowedByRuleList = (ctx, rules, isDefaultRules = false) => {
-            if (ctx.toolName === BASH_TOOL_NAME && ctx.toolInput?.command) {
-                const command = String(ctx.toolInput.command);
-                const parts = splitBashCommand(command);
-                if (parts.length === 0)
-                    return false;
-                const workdir = ctx.toolInput?.workdir;
-                return parts.every((part) => {
-                    const hasWrite = hasWriteRedirections(part);
-                    const processedPart = stripRedirections(stripEnvVars(part));
-                    // Check for safe commands
-                    if (!hasWrite) {
-                        const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-                        if (commandMatch) {
-                            const cmd = commandMatch[1];
-                            const args = commandMatch[2]?.trim() || "";
-                            if (SAFE_COMMANDS.includes(cmd)) {
-                                if (cmd === "pwd" ||
-                                    cmd === "true" ||
-                                    cmd === "false" ||
-                                    cmd === "ls" ||
-                                    cmd === "grep" ||
-                                    cmd === "rg" ||
-                                    cmd === "cat" ||
-                                    cmd === "head" ||
-                                    cmd === "tail" ||
-                                    cmd === "wc" ||
-                                    cmd === "sleep" ||
-                                    cmd === "sort" ||
-                                    (cmd === "find" && !isDangerousFind(part))) {
-                                    return true;
-                                }
-                                if (workdir) {
-                                    // For cd, check paths
-                                    const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
-                                    if (pathArgs.length === 0) {
-                                        // cd without arguments operates on current dir (workdir)
-                                        return true;
-                                    }
-                                    const allPathsSafe = pathArgs.every((pathArg) => {
-                                        // Remove quotes if present
-                                        const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                                        const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
-                                        return isInside;
-                                    });
-                                    if (allPathsSafe) {
-                                        return true;
-                                    }
-                                }
-                            }
-                        }
-                    }
-                    // Check if this specific part is allowed by any rule
-                    if (isDefaultRules && (hasWrite || isDangerousFind(part))) {
-                        return false;
-                    }
-                    // We create a temporary context with just this part of the command
-                    const partContext = {
-                        ...ctx,
-                        toolInput: { ...ctx.toolInput, command: part },
-                    };
-                    const allowedByRule = rules.some((rule) => {
-                        return this.matchesRule(partContext, rule);
-                    });
-                    if (allowedByRule)
-                        return true;
-                    return !this.isRestrictedTool(ctx.toolName);
-                });
-            }
-            // For other tools, check if any rule matches
-            return rules.some((rule) => this.matchesRule(ctx, rule));
-        };
-        // Check instance-specific allowed rules first
-        if (isAllowedByRuleList(context, this.instanceAllowedRules)) {
+    isAutoAllowedPart(part, workdir) {
+        // Write redirections disqualify (FR-019.4)
+        if (hasWriteRedirections(part))
+            return false;
+        // Command substitution $(...) or `...` disqualifies (FR-019.6)
+        if (hasCommandSubstitution(part))
+            return false;
+        // Process substitution <(...) or >(...) disqualifies (FR-019.6)
+        if (hasProcessSubstitution(part))
+            return false;
+        const processedPart = stripRedirections(stripEnvVars(part));
+        const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+        if (!commandMatch)
+            return false;
+        const cmd = commandMatch[1];
+        const args = commandMatch[2]?.trim() || "";
+        // sed -i (in-place edit) disqualifies (FR-019.5)
+        if (hasSedInPlace(part))
+            return false;
+        // Read-only commands are auto-allowed (FR-019.2, FR-019.3)
+        if (READ_ONLY_COMMANDS.includes(cmd)) {
+            // find with dangerous flags (e.g. -exec, -delete) disqualifies
+            if (cmd === "find" && isDangerousFind(part))
+                return false;
             return true;
         }
-        // Check temporary rules
-        if (isAllowedByRuleList(context, this.temporaryRules)) {
-            return true;
+        // cd is not read-only but is safe if all paths are within the Safe Zone
+        if (cmd === "cd") {
+            if (!workdir)
+                return false;
+            const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
+            if (pathArgs.length === 0)
+                return true; // cd without args = current dir
+            return pathArgs.every((pathArg) => {
+                const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+                const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
+                return isInside;
+            });
         }
-        // Check persistent allowed rules
-        if (isAllowedByRuleList(context, this.allowedRules)) {
-            return true;
+        return false;
+    }
+    /**
+     * Check if a tool call is allowed by persistent or temporary rules
+     */
+    isAllowedByRule(context) {
+        // All allow-rule sources are matched as a union: each part of a chained
+        // command only needs to hit at least one rule across all sources, so
+        // different parts may be covered by different sources.
+        const explicitRules = [
+            ...this.instanceAllowedRules,
+            ...this.temporaryRules,
+            ...this.allowedRules,
+        ];
+        if (context.toolName === BASH_TOOL_NAME && context.toolInput?.command) {
+            const command = String(context.toolInput.command);
+            const parts = splitBashCommand(command);
+            if (parts.length === 0)
+                return false;
+            const workdir = context.toolInput?.workdir;
+            return parts.every((part) => {
+                // Check for auto-allowed read-only commands (FR-019.2 through FR-019.7)
+                if (this.isAutoAllowedPart(part, workdir)) {
+                    return true;
+                }
+                // We create a temporary context with just this part of the command
+                const partContext = {
+                    ...context,
+                    toolInput: { ...context.toolInput, command: part },
+                };
+                if (explicitRules.some((rule) => this.matchesRule(partContext, rule))) {
+                    return true;
+                }
+                // Default rules must not auto-allow dangerous variants (write
+                // redirections, substitutions, sed -i, dangerous find) through broad
+                // rules like Bash(echo*) or Bash(cat*)
+                const isDangerousVariant = hasWriteRedirections(part) ||
+                    isDangerousFind(part) ||
+                    hasCommandSubstitution(part) ||
+                    hasProcessSubstitution(part) ||
+                    hasSedInPlace(part);
+                if (!isDangerousVariant &&
+                    DEFAULT_ALLOWED_RULES.some((rule) => this.matchesRule(partContext, rule))) {
+                    return true;
+                }
+                return !this.isRestrictedTool(context.toolName);
+            });
         }
-        // Check default allowed rules
-        return isAllowedByRuleList(context, DEFAULT_ALLOWED_RULES, true);
+        // For other tools, check if any rule matches
+        const allRules = [...explicitRules, ...DEFAULT_ALLOWED_RULES];
+        return allRules.some((rule) => this.matchesRule(context, rule));
     }
     /**
      * Expand a bash command into individual permission rules, filtering out safe commands.
@@ -769,53 +765,17 @@ export class PermissionManager {
         for (const part of parts) {
             const hasWrite = hasWriteRedirections(part);
             const processedPart = stripRedirections(stripEnvVars(part));
-            // Check for safe commands
-            const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-            let isSafe = false;
-            if (commandMatch && !hasWrite) {
-                const cmd = commandMatch[1];
-                const args = commandMatch[2]?.trim() || "";
-                if (SAFE_COMMANDS.includes(cmd)) {
-                    if (cmd === "pwd" ||
-                        cmd === "true" ||
-                        cmd === "false" ||
-                        cmd === "ls" ||
-                        cmd === "grep" ||
-                        cmd === "rg" ||
-                        cmd === "cat" ||
-                        cmd === "head" ||
-                        cmd === "tail" ||
-                        cmd === "wc" ||
-                        cmd === "sleep" ||
-                        (cmd === "find" && !isDangerousFind(part))) {
-                        isSafe = true;
-                    }
-                    else {
-                        // For cd, check paths
-                        const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
-                        if (pathArgs.length === 0) {
-                            isSafe = true;
-                        }
-                        else {
-                            const allPathsSafe = pathArgs.every((pathArg) => {
-                                const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                                const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
-                                return isInside;
-                            });
-                            if (allPathsSafe) {
-                                isSafe = true;
-                            }
-                        }
-                    }
-                }
-            }
+            // Check for auto-allowed read-only commands
+            const isSafe = this.isAutoAllowedPart(part, workdir);
             if (!isSafe) {
                 // Check if command is dangerous or out-of-bounds
                 const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
                 if (commandMatch) {
                     const cmd = commandMatch[1];
                     const args = commandMatch[2]?.trim() || "";
-                    if (DANGEROUS_COMMANDS.includes(cmd) || isDangerousFind(part)) {
+                    if (DANGEROUS_COMMANDS.includes(cmd) ||
+                        isDangerousFind(part) ||
+                        hasSedInPlace(part)) {
                         continue;
                     }
                     if (cmd === "cd") {

package/dist/managers/pluginManager.d.ts

@@ -34,6 +34,13 @@ export declare class PluginManager {
      * @param configs Array of plugin configurations
      */
     loadPlugins(configs: PluginConfig[]): Promise<void>;
+    /**
+     * Load built-in plugins bundled with the SDK (e.g. sdd).
+     * Opt-in via `enabledPlugins`, keyed `<name>@builtin` (default off, consistent
+     * with marketplace plugins). Lowest priority: explicit config and marketplace
+     * plugins win on name conflicts (loadSinglePlugin skips duplicates).
+     */
+    private loadBuiltinPlugins;
     /**
      * Get all loaded plugins
      */

package/dist/managers/pluginManager.js

@@ -1,6 +1,8 @@
 import { logger } from "../utils/globalLogger.js";
 import { PluginLoader } from "../services/pluginLoader.js";
 import * as path from "path";
+import { existsSync, readdirSync } from "fs";
+import { getBuiltinPluginsDir } from "../utils/configPaths.js";
 import { MarketplaceService } from "../services/MarketplaceService.js";
 export class PluginManager {
     constructor(container, options) {
@@ -61,6 +63,9 @@ export class PluginManager {
                 const [name, marketplaceName] = pluginId.split("@");
                 if (!name || !marketplaceName)
                     continue;
+                // `@builtin` entries are loaded by loadBuiltinPlugins, not the marketplace.
+                if (marketplaceName === "builtin")
+                    continue;
                 const isInstalled = installedRegistry.plugins.some((p) => p.name === name && p.marketplace === marketplaceName);
                 if (!isInstalled) {
                     const isMarketplaceKnown = knownMarketplaces.some((m) => m.name === marketplaceName);
@@ -195,6 +200,32 @@ export class PluginManager {
         }
         // Load installed plugins from marketplace
         await this.loadInstalledPlugins();
+        // Load built-in plugins bundled with the SDK (lowest priority)
+        await this.loadBuiltinPlugins();
+    }
+    /**
+     * Load built-in plugins bundled with the SDK (e.g. sdd).
+     * Opt-in via `enabledPlugins`, keyed `<name>@builtin` (default off, consistent
+     * with marketplace plugins). Lowest priority: explicit config and marketplace
+     * plugins win on name conflicts (loadSinglePlugin skips duplicates).
+     */
+    async loadBuiltinPlugins() {
+        try {
+            const builtinDir = getBuiltinPluginsDir();
+            if (!existsSync(builtinDir))
+                return;
+            // The builtin plugin directory name is the plugin name by convention.
+            for (const entry of readdirSync(builtinDir, { withFileTypes: true })) {
+                if (!entry.isDirectory())
+                    continue;
+                if (this.enabledPlugins[`${entry.name}@builtin`] !== true)
+                    continue;
+                await this.loadSinglePlugin(path.join(builtinDir, entry.name));
+            }
+        }
+        catch (error) {
+            logger?.error("Failed to load built-in plugins:", error);
+        }
     }
     /**
      * Get all loaded plugins

package/dist/managers/toolManager.js

@@ -179,6 +179,11 @@ class ToolManager {
             workflowManager: this.container.has("WorkflowManager")
                 ? this.container.get("WorkflowManager")
                 : undefined,
+            sessionEnv: this.container.has("ConfigurationService")
+                ? this.container
+                    .get("ConfigurationService")
+                    ?.getMergedEnv?.()
+                : undefined,
             sessionId: context.sessionId,
             toolCallId: context.toolCallId,
         };

package/dist/prompts/index.d.ts

@@ -21,7 +21,18 @@ export interface SystemPromptBlock {
     text: string;
     cacheable: boolean;
 }
-export declare const COMPACT_MESSAGES_SYSTEM_PROMPT = "You are continuing work on a software engineering task. Write a detailed continuation summary that will allow you (or another instance of yourself) to resume work efficiently in a future context window where the conversation history will be replaced with this summary.\n\nFirst, write your analysis in <analysis> tags as a thinking scratchpad:\n- Chronologically review the conversation\n- Identify user intents and goals\n- Note files read/modified, approaches tried, decisions made\n- Check for accuracy and completeness \u2014 ensure nothing critical is missing\n\nThen produce a structured summary in <summary> tags with these sections:\n\n## Primary Request and Intent\n- The user's core request and success criteria\n- Clarifications, constraints, or scope changes\n\n## Key Technical Concepts\n- Frameworks, libraries, patterns, architectural decisions\n\n## Files and Code Sections\n- Files read, modified, created (with full paths)\n- Critical code snippets (function signatures, bug fixes, key logic)\n- Focus on recent messages \u2014 include full code for important sections\n\n## Errors and Fixes\n- Errors encountered, root causes, how they were resolved\n- Approaches tried that didn't work and why\n\n## Problem Solving\n- Approach evolution, trade-offs considered, decisions made\n\n## All User Messages\n- Complete list of all user messages (non-tool content)\n- Preserve exact wording where load-bearing\n\n## Pending Tasks\n- Outstanding work, TODOs, unresolved questions\n\n## Current Work\n- What was being worked on at the time of summarization\n- Exact state of in-progress changes\n\n## Optional Next Step\n- Immediate next action needed\n- Include verbatim quotes from recent conversation if relevant\n\nBe concise but complete \u2014 include information that prevents duplicate work or repeated mistakes.\nRespond with text only. Do NOT call any tools.\nWrap your summary in <summary></summary> tags.";
+/**
+ * Builds the compact instruction sent as the trailing user message on the
+ * fork path. Aligned with Claude Code's getCompactPrompt().
+ */
+export declare function getCompactPrompt(customInstructions?: string): string;
+/**
+ * Formats the compact summary by stripping the <analysis> drafting scratchpad
+ * and extracting the <summary> section. Raw text passes through unchanged
+ * when no <summary> tag is present. Aligned with Claude Code's
+ * formatCompactSummary().
+ */
+export declare function formatCompactSummary(summary: string): string;
 export declare const WEB_CONTENT_SYSTEM_PROMPT = "You are a helpful assistant that extracts information from web content. The content is provided in Markdown format.";
 export declare const BTW_SYSTEM_PROMPT = "You are a helpful assistant. Answer the user's side question based on the conversation history. \nDo NOT say things like \"Let me try...\", \"I'll now...\", \"Let me check...\", or promise to take any action. \nIf you don't know the answer, say so - do not offer to look it up or investigate. \nSimply answer the question with the information you have.";
 export declare function buildSystemPrompt(basePrompt: string | undefined, tools: ToolPlugin[], options?: {