wave-agent-sdk 0.19.8 → 1.0.0

package/dist/services/interactionService.js

@@ -48,7 +48,7 @@ export class InteractionService {
                         transcriptPath: messageManager.getTranscriptPath(),
                         cwd: workdir,
                         userPrompt: content,
-                        env: Object.fromEntries(Object.entries(process.env).filter((e) => e[1] !== undefined)), // Include environment variables
+                        env: Object.fromEntries(Object.entries(context.configurationService.getMergedEnv()).filter((e) => e[1] !== undefined)), // Include environment variables
                     });
                     // Process hook results and determine if we should continue
                     const processResult = hookManager.processHookResults("UserPromptSubmit", hookResults, messageManager);
@@ -76,7 +76,7 @@ export class InteractionService {
         }
     }
     static async restoreSession(context, sessionId) {
-        const { messageManager, logger, subagentManager, taskManager, options, abortMessage, } = context;
+        const { messageManager, hookManager, logger, subagentManager, taskManager, options, abortMessage, } = context;
         // 1. Validation
         if (!sessionId || sessionId === messageManager.getSessionId()) {
             return; // No-op if session ID is invalid or already current
@@ -89,21 +89,49 @@ export class InteractionService {
             logger?.warn("Failed to save current session before restore:", error);
             // Continue with restoration even if save fails
         }
-        // 3. Load target session
+        // 3. Run SessionEnd hooks for the current session (cleanup before switching)
+        const currentSessionId = messageManager.getSessionId();
+        const currentTranscriptPath = messageManager.getTranscriptPath();
+        if (hookManager) {
+            try {
+                await hookManager.executeSessionEndHooks("resume", currentSessionId, currentTranscriptPath);
+            }
+            catch (error) {
+                logger?.warn(`SessionEnd hooks on restore failed: ${error.message}`);
+            }
+        }
+        // 4. Load target session
         const sessionData = await loadSessionFromJsonl(sessionId, messageManager.getWorkdir());
         if (!sessionData) {
             throw new Error(`Session not found: ${sessionId}`);
         }
-        // 4. Clean current state
+        // 5. Clean current state
         abortMessage(); // Abort any running operations
         subagentManager.cleanup(); // Clean up active subagents
-        // 5. Rebuild usage (in correct order)
+        // 6. Rebuild usage (in correct order)
         messageManager.rebuildUsageFromMessages(sessionData.messages);
-        // 6. Initialize session state last
+        // 7. Initialize session state last
         messageManager.initializeFromSession(sessionData);
+        // 8. Run SessionStart hooks for the restored session and inject additional
+        //    context as a meta user message (matches Claude Code's resume behavior:
+        //    SessionEnd then SessionStart, hook messages appended to the conversation)
+        if (hookManager) {
+            try {
+                const sessionStartResult = await hookManager.executeSessionStartHooks("resume", sessionData.id, messageManager.getTranscriptPath());
+                if (sessionStartResult.additionalContext) {
+                    messageManager.addUserMessage({
+                        content: `<system-reminder>\nSessionStart hook additional context: ${sessionStartResult.additionalContext}\n</system-reminder>`,
+                        isMeta: true,
+                    });
+                }
+            }
+            catch (error) {
+                logger?.warn(`SessionStart hooks on restore failed: ${error.message}`);
+            }
+        }
         // Update task manager with the root session ID to ensure continuity across compactions
         taskManager.setTaskListId(sessionData.id);
-        // 7. Load tasks for the restored session
+        // 9. Load tasks for the restored session
         const tasks = await taskManager.listTasks();
         options.callbacks?.onTasksChange?.(tasks);
     }

package/dist/services/remoteSettingsService.d.ts

@@ -6,6 +6,17 @@ import type { WaveConfiguration } from "../types/configuration.js";
  */
 export declare function onSettingsUpdate(callback: () => void | Promise<void>): () => void;
 export declare function initialize(): void;
+/**
+ * Start the fire-and-forget initial network fetch + background polling.
+ *
+ * Must be called AFTER loadMergedConfiguration() so disk-cached managed
+ * settings are merged before the fetch, and so settings `env` WAVE_SERVER_URL
+ * is mirrored to process.env (by setEnvironmentVars) before the fetch. The
+ * fetch uses authService.getServerUrl(), which reads process.env.WAVE_SERVER_URL
+ * — the settings value is visible there, so there is no init-ordering race
+ * that would fall back to DEFAULT_SERVER_URL (prod) and hit a test endpoint (401).
+ */
+export declare function startBackgroundFetch(): void;
 export declare function getRemoteSettingsSync(): WaveConfiguration | null;
 export declare function refresh(): Promise<RemoteSettingsFetchResult>;
 export declare function clear(): void;
@@ -17,6 +28,7 @@ export declare function mergeRemoteSettings(localMerged: WaveConfiguration, remo
  */
 export declare const remoteSettingsService: {
     readonly initialize: typeof initialize;
+    readonly startBackgroundFetch: typeof startBackgroundFetch;
     readonly getRemoteSettingsSync: typeof getRemoteSettingsSync;
     readonly refresh: typeof refresh;
     readonly clear: typeof clear;

package/dist/services/remoteSettingsService.js

@@ -174,8 +174,21 @@ function startPolling() {
     _pollingTimer.unref();
 }
 export function initialize() {
+    // Load disk cache synchronously so getRemoteSettingsSync() returns cached
+    // managed settings during loadMergedConfiguration() (must run BEFORE it).
     loadCacheFromDisk();
-    // Fire-and-forget the initial fetch, then start background polling
+}
+/**
+ * Start the fire-and-forget initial network fetch + background polling.
+ *
+ * Must be called AFTER loadMergedConfiguration() so disk-cached managed
+ * settings are merged before the fetch, and so settings `env` WAVE_SERVER_URL
+ * is mirrored to process.env (by setEnvironmentVars) before the fetch. The
+ * fetch uses authService.getServerUrl(), which reads process.env.WAVE_SERVER_URL
+ * — the settings value is visible there, so there is no init-ordering race
+ * that would fall back to DEFAULT_SERVER_URL (prod) and hit a test endpoint (401).
+ */
+export function startBackgroundFetch() {
     fetchRemoteSettings()
         .then(() => startPolling())
         .catch((err) => {
@@ -302,6 +315,7 @@ export function mergeRemoteSettings(localMerged, remote) {
  */
 export const remoteSettingsService = {
     initialize,
+    startBackgroundFetch,
     getRemoteSettingsSync,
     refresh,
     clear,

package/dist/services/session.d.ts

@@ -184,7 +184,9 @@ export declare function handleSessionRestoration(restoreSessionId?: string, cont
 /**
  * Load the full message thread for a session.
  * With append-only compaction, all messages are in a single file.
- * Returns the active messages (post-compact boundary).
+ * Unlike loadSessionFromJsonl, this returns every message in the file,
+ * including those before the last compact boundary — rewind needs the
+ * complete history to allow rewinding past compaction points.
  * @param currentSessionId - The ID of the current session
  * @param workdir - Working directory for the session
  * @returns Promise that resolves to an array of all messages in the thread

package/dist/services/session.js

@@ -646,14 +646,22 @@ export async function handleSessionRestoration(restoreSessionId, continueLastSes
 /**
  * Load the full message thread for a session.
  * With append-only compaction, all messages are in a single file.
- * Returns the active messages (post-compact boundary).
+ * Unlike loadSessionFromJsonl, this returns every message in the file,
+ * including those before the last compact boundary — rewind needs the
+ * complete history to allow rewinding past compaction points.
  * @param currentSessionId - The ID of the current session
  * @param workdir - Working directory for the session
  * @returns Promise that resolves to an array of all messages in the thread
  */
 export async function loadFullMessageThread(currentSessionId, workdir) {
-    const sessionData = await loadSessionFromJsonl(currentSessionId, workdir);
-    if (!sessionData)
+    const jsonlHandler = new JsonlHandler();
+    const filePath = await generateSessionFilePath(currentSessionId, workdir, "main");
+    try {
+        await fs.access(filePath);
+    }
+    catch {
         return { messages: [], sessionIds: [] };
-    return { messages: sessionData.messages, sessionIds: [currentSessionId] };
+    }
+    const messages = await jsonlHandler.read(filePath);
+    return { messages, sessionIds: [currentSessionId] };
 }

package/dist/services/taskManager.d.ts

@@ -18,6 +18,7 @@ export declare class TaskManager extends EventEmitter {
     private getLockPath;
     ensureSessionDir(): Promise<void>;
     private withLock;
+    private isLockStale;
     private validateTask;
     createTask(task: Omit<Task, "id">): Promise<string>;
     getTask(taskId: string): Promise<Task | null>;

package/dist/services/taskManager.js

@@ -32,7 +32,13 @@ export class TaskManager extends EventEmitter {
         if (!messageManager)
             return;
         const rootSessionId = messageManager.getRootSessionId();
-        if (this.taskListId !== rootSessionId && !process.env.WAVE_TASK_LIST_ID) {
+        // Read the per-session snapshot (not process.env) so multiple sessions in
+        // one `wave --stdio` process don't cross-pollute this flag.
+        const envSnap = this.container
+            .get("ConfigurationService")
+            ?.getEnvSnapshot() ?? {};
+        const pinnedTaskListId = envSnap.WAVE_TASK_LIST_ID ?? process.env.WAVE_TASK_LIST_ID;
+        if (this.taskListId !== rootSessionId && !pinnedTaskListId) {
             this.setTaskListId(rootSessionId);
             await this.refreshTasks();
         }
@@ -54,6 +60,7 @@ export class TaskManager extends EventEmitter {
         let lockHandle;
         const maxRetries = 100;
         const retryDelay = process.env.NODE_ENV === "test" ? 1 : 100;
+        const staleThreshold = 10000;
         await this.ensureSessionDir();
         for (let i = 0; i < maxRetries; i++) {
             try {
@@ -61,14 +68,32 @@ export class TaskManager extends EventEmitter {
                 break;
             }
             catch (error) {
-                if (error.code === "EEXIST") {
-                    if (i === maxRetries - 1) {
-                        throw new Error(`Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`);
+                const code = error.code;
+                // Only EEXIST (lock held) and EPERM (Windows pending-delete window)
+                // are transient lock-contention errors. EACCES/ENOENT are real failures
+                // and must not be retried as lock competition.
+                if (code !== "EEXIST" && code !== "EPERM") {
+                    throw error;
+                }
+                if (i === maxRetries - 1) {
+                    throw new Error(`Could not acquire lock for task list ${this.taskListId} after ${maxRetries} retries`);
+                }
+                // Stale recovery: if the lock holder crashed without releasing, the
+                // lock file remains forever. Check mtime — if older than the threshold,
+                // remove it. Aligns with proper-lockfile's default 10s stale detection.
+                // The lock file is empty (no PID content), so mtime is the only signal.
+                if (code === "EEXIST" &&
+                    (await this.isLockStale(lockPath, staleThreshold))) {
+                    logger.warn(`TaskManager: removing stale lock for task list ${this.taskListId}`);
+                    try {
+                        await fs.unlink(lockPath);
+                    }
+                    catch {
+                        // Another waiter may have already removed it — retry anyway
                     }
-                    await new Promise((resolve) => setTimeout(resolve, retryDelay));
                     continue;
                 }
-                throw error;
+                await new Promise((resolve) => setTimeout(resolve, retryDelay));
             }
         }
         try {
@@ -86,6 +111,16 @@ export class TaskManager extends EventEmitter {
             }
         }
     }
+    async isLockStale(lockPath, threshold) {
+        try {
+            const stats = await fs.stat(lockPath);
+            return Date.now() - stats.mtimeMs > threshold;
+        }
+        catch {
+            // Lock was removed between our EEXIST and stat — not stale, just retry
+            return false;
+        }
+    }
     validateTask(task) {
         if (!task.id || typeof task.id !== "string")
             throw new Error("Invalid task ID");

package/dist/tools/bashTool.js

@@ -238,6 +238,7 @@ The working directory persists between commands. Try to maintain your current wo
                 cwd: context.workdir,
                 env: {
                     ...process.env,
+                    ...context.sessionEnv,
                 },
             });
             let outputBuffer = "";

package/dist/tools/editTool.js

@@ -97,9 +97,12 @@ Usage:
         context.messageManager?.triggerFileRead(filePath);
         // Enforce read-before-edit: the file must have been read or written first.
         // readFileState is populated by Read, Write, and Edit tools — single source
-        // of truth, aligned with Claude Code's readFileState approach.
+        // of truth, aligned with Claude Code's readFileState approach. Skipped in
+        // plan mode: permissionManager enforces a plan-file-only gate whose denial
+        // message must surface instead of being masked by a read-state rejection.
         const resolvedPath = resolvePath(filePath, context.workdir);
-        if (!context.readFileState?.has(resolvedPath)) {
+        if (context.permissionMode !== "plan" &&
+            !context.readFileState?.has(resolvedPath)) {
             return {
                 success: false,
                 content: "",
@@ -119,17 +122,28 @@ Usage:
                     error: `Failed to read file: ${readError instanceof Error ? readError.message : String(readError)}`,
                 };
             }
-            // Staleness check: file must not have been modified since last Read
-            if (context.readFileState) {
+            // Staleness check (aligned with Claude Code): only flag when the file got
+            // newer since last read. For full reads, a content-hash fallback avoids
+            // false positives when mtime changed but content didn't (git checkout,
+            // editor round-trip save, cloud sync, antivirus). Partial reads get no
+            // fallback since only a slice was cached. Skipped in plan mode (see
+            // read-before-edit note above) so the plan-file-only denial wins.
+            if (context.permissionMode !== "plan" && context.readFileState) {
                 const state = context.readFileState.get(resolvedPath);
                 if (state) {
                     const currentStats = await stat(resolvedPath);
-                    if (currentStats.mtime.getTime() !== state.mtime) {
-                        return {
-                            success: false,
-                            content: "",
-                            error: "File has been unexpectedly modified since last read. Read it again before editing it.",
-                        };
+                    if (currentStats.mtime.getTime() > state.mtime) {
+                        const isFullRead = state.offset === undefined && state.limit === undefined;
+                        const contentUnchanged = isFullRead &&
+                            createHash("sha256").update(originalContent).digest("hex") ===
+                                state.hash;
+                        if (!contentUnchanged) {
+                            return {
+                                success: false,
+                                content: "",
+                                error: "File has been unexpectedly modified since last read. Read it again before editing it.",
+                            };
+                        }
                     }
                 }
             }

package/dist/tools/enterWorktreeTool.js

@@ -2,7 +2,7 @@
  * EnterWorktree tool - creates an isolated git worktree and switches the session into it.
  * Mirrors Claude Code's EnterWorktree tool behavior and prompt.
  */
-import { createWorktree, validateWorktreeName, generateWorktreeName, } from "../utils/worktreeUtils.js";
+import { createWorktree, validateWorktreeName, generateWorktreeName, performPostCreationSetup, } from "../utils/worktreeUtils.js";
 import { getGitMainRepoRoot } from "../utils/gitUtils.js";
 import { ENTER_WORKTREE_TOOL_NAME } from "../constants/tools.js";
 import { logger } from "../utils/globalLogger.js";
@@ -85,6 +85,17 @@ export const enterWorktreeTool = {
         // Create the worktree (captures originalHeadCommit internally)
         const baseRef = context.aiManager?.getWorktreeBaseRef?.();
         const worktreeInfo = createWorktree(name, mainRepoRoot, { baseRef });
+        // Copy local settings (.wave/settings.local.json) and gitignored project
+        // files (.worktreeinclude, e.g. .env/.mcp.json) into a new worktree —
+        // mirrors the CLI createWorktree path. Best-effort, never fails the tool.
+        if (worktreeInfo.isNew) {
+            try {
+                await performPostCreationSetup(worktreeInfo.path, worktreeInfo.repoRoot);
+            }
+            catch (error) {
+                logger?.warn("Worktree post-creation setup failed:", error);
+            }
+        }
         // Build session state
         const session = {
             originalCwd: context.workdir,
@@ -110,10 +121,10 @@ export const enterWorktreeTool = {
                     projectDir: worktreeInfo.path,
                     timestamp: new Date(),
                     sessionId: context.sessionId ?? "",
-                    transcriptPath: context.messageManager?.getTranscriptPath() ?? "",
+                    transcriptPath: context.messageManager?.getTranscriptPath?.() ?? "",
                     cwd: worktreeInfo.path,
                     worktreeName: worktreeInfo.name,
-                    env: Object.fromEntries(Object.entries(process.env).filter((e) => e[1] !== undefined)),
+                    env: Object.fromEntries(Object.entries(context.sessionEnv ?? process.env).filter((e) => e[1] !== undefined)),
                 });
                 if (context.messageManager) {
                     context.hookManager.processHookResults("WorktreeCreate", hookResults, context.messageManager);

package/dist/tools/exitWorktreeTool.js

@@ -128,14 +128,8 @@ export const exitWorktreeTool = {
         };
         // Count changes BEFORE removing the worktree (directory will be gone after)
         const summary = countWorktreeChanges(worktreePath, session.originalHeadCommit) ?? { changedFiles: 0, commits: 0 };
-        removeWorktree(worktreeInfo);
-        // Clear session state and restore CWD
-        const aiManager = context.aiManager;
-        if (aiManager) {
-            aiManager.setWorktreeSession(null);
-            aiManager.setWorkdir(originalCwd);
-        }
-        // Trigger WorktreeRemove hook (non-blocking)
+        // Trigger WorktreeRemove hook (non-blocking) BEFORE git removal so hooks
+        // can still read files inside the worktree to clean up external resources.
         let hookTriggered = false;
         if (context.hookManager) {
             try {
@@ -144,10 +138,10 @@ export const exitWorktreeTool = {
                     projectDir: originalCwd,
                     timestamp: new Date(),
                     sessionId: context.sessionId ?? "",
-                    transcriptPath: context.messageManager?.getTranscriptPath() ?? "",
+                    transcriptPath: context.messageManager?.getTranscriptPath?.() ?? "",
                     cwd: originalCwd,
                     worktreePath,
-                    env: Object.fromEntries(Object.entries(process.env).filter((e) => e[1] !== undefined)),
+                    env: Object.fromEntries(Object.entries(context.sessionEnv ?? process.env).filter((e) => e[1] !== undefined)),
                 });
                 if (context.messageManager) {
                     context.hookManager.processHookResults("WorktreeRemove", hookResults, context.messageManager);
@@ -159,6 +153,13 @@ export const exitWorktreeTool = {
                 logger?.warn("WorktreeRemove hooks execution failed:", error);
             }
         }
+        removeWorktree(worktreeInfo);
+        // Clear session state and restore CWD
+        const aiManager = context.aiManager;
+        if (aiManager) {
+            aiManager.setWorktreeSession(null);
+            aiManager.setWorkdir(originalCwd);
+        }
         const discardParts = [];
         if (summary.commits > 0) {
             discardParts.push(`${summary.commits} ${summary.commits === 1 ? "commit" : "commits"}`);

package/dist/tools/grepTool.js

@@ -1,6 +1,7 @@
 import { spawn } from "child_process";
 import { rgPath } from "../utils/ripgrep.js";
 import { getDisplayPath } from "../utils/path.js";
+import { logger } from "../utils/globalLogger.js";
 import { GREP_TOOL_NAME, BASH_TOOL_NAME, AGENT_TOOL_NAME, } from "../constants/tools.js";
 // Version control system directories to exclude from searches.
 // These are excluded automatically because they create noise in search results.
@@ -199,14 +200,19 @@ export const grepTool = {
                 rgArgs.push(".");
             }
             const result = await executeCommand(rgPath, rgArgs, workdir);
-            if (result.error && result.exitCode !== 1) {
-                // rg returns 1 for no matches, not an error
+            // Only a process-level spawn failure (exitCode null) is a hard error.
+            // rg exit 2 means some files were unreadable (e.g. device-name files
+            // like "nul" on Windows); stdout still holds usable partial results.
+            if (result.exitCode === null) {
                 return {
                     success: false,
                     content: "",
                     error: `ripgrep failed: ${result.stderr}`,
                 };
             }
+            if (result.exitCode !== 0 && result.exitCode !== 1) {
+                logger.debug(`ripgrep exited with code ${result.exitCode}, keeping partial results: ${result.stderr.trim()}`);
+            }
             const output = result.stdout.trim();
             if (!output) {
                 return {

package/dist/tools/types.d.ts

@@ -104,4 +104,11 @@ export interface ToolContext {
     originalWorkdir?: string;
     /** Workflow manager instance for workflow orchestration */
     workflowManager?: import("../managers/workflowManager.js").WorkflowManager;
+    /**
+     * Per-session merged environment (OS env overlaid with the settings env
+     * snapshot) for this session. Tools that spawn subprocesses (Bash, hooks)
+     * should merge this on top of `process.env` so settings `env` vars reach
+     * the subprocess without polluting other sessions in one stdio process.
+     */
+    sessionEnv?: Record<string, string>;
 }

package/dist/tools/writeTool.js

@@ -74,6 +74,42 @@ Usage:
                 // File doesn't exist, this is normal for new file creation
                 isExistingFile = false;
             }
+            // Read-before-write + staleness guards (aligned with Claude Code).
+            // Only enforced for existing files when readFileState is available
+            // (production always injects it; new-file creation always bypasses).
+            // Grep does not register a file as read, so Grep-then-Write on an
+            // existing file is still rejected. Staleness uses the same `>` + full-
+            // read content-hash fallback as editTool to avoid false positives from
+            // git checkout / editor round-trip save / cloud sync / antivirus.
+            // Plan mode is excluded: it has its own stricter write gate (plan-file-
+            // only, enforced in permissionManager) whose denial message must surface
+            // instead of being masked by a read-state rejection.
+            if (isExistingFile &&
+                context.readFileState &&
+                context.permissionMode !== "plan") {
+                const state = context.readFileState.get(resolvedPath);
+                if (!state) {
+                    return {
+                        success: false,
+                        content: "",
+                        error: "File has not been read yet. Read it first before writing to it.",
+                    };
+                }
+                const currentStats = await stat(resolvedPath);
+                if (currentStats.mtime.getTime() > state.mtime) {
+                    const isFullRead = state.offset === undefined && state.limit === undefined;
+                    const contentUnchanged = isFullRead &&
+                        createHash("sha256").update(originalContent).digest("hex") ===
+                            state.hash;
+                    if (!contentUnchanged) {
+                        return {
+                            success: false,
+                            content: "",
+                            error: "File has been unexpectedly modified since last read. Read it again before writing to it.",
+                        };
+                    }
+                }
+            }
             // Check if overwriting existing file but content is the same
             if (isExistingFile && originalContent === content) {
                 return {

package/dist/types/config.d.ts

@@ -10,6 +10,8 @@ export interface GatewayConfig {
     defaultHeaders?: Record<string, string>;
     fetchOptions?: OpenAI["fetchOptions"];
     fetch?: OpenAI["fetch"];
+    /** Session identifier, sent as the `x-session-id` request header for backend correlation. */
+    sessionId?: string;
 }
 export interface ModelCapabilities {
     /** Whether the model supports image/vision input. Default: true. */

package/dist/types/hooks.d.ts

@@ -54,8 +54,8 @@ export declare class HookConfigurationError extends Error {
     readonly validationErrors: string[];
     constructor(configPath: string, validationErrors: string[]);
 }
-export type SessionStartSource = "startup" | "compact" | "clear";
-export type SessionEndSource = "exit" | "stop" | "compact" | "clear";
+export type SessionStartSource = "startup" | "resume" | "compact" | "clear";
+export type SessionEndSource = "exit" | "resume" | "stop" | "compact" | "clear";
 export declare function isValidHookEvent(event: string): event is HookEvent;
 export declare function isValidHookCommand(cmd: unknown): cmd is HookCommand;
 export declare function isValidHookEventConfig(config: unknown): config is HookEventConfig;

package/dist/utils/bashParser.d.ts

@@ -28,6 +28,15 @@ export declare function isBashHeredocWrite(command: string): boolean;
  * and should not have persistent permissions.
  */
 export declare const DANGEROUS_COMMANDS: string[];
+/**
+ * Read-only command set: commands that only read/transform data and write to stdout.
+ * When a command in this set is used without write redirections, command substitution,
+ * or dangerous flags (e.g. sed -i), it is auto-allowed without a confirmation dialog.
+ * Aligned with Claude Code's SEMANTIC_READ_ONLY_COMMANDS, excluding interactive pagers
+ * (less, more, man, info), command executors (xargs), and infinite-output generators (yes).
+ * FR-019.2 through FR-019.7 in tool-permission-system.md.
+ */
+export declare const READ_ONLY_COMMANDS: string[];
 /**
  * Registry of commands and their expected subcommand depth for smart prefix extraction.
  * For example, 'git: 2' means 'git commit' is a valid prefix, but 'git' alone is not.
@@ -46,6 +55,22 @@ export declare const DANGEROUS_SUBCOMMANDS: Record<string, string[]>;
  * Checks if a find command is dangerous (e.g., contains -exec, -delete, etc.).
  */
 export declare function isDangerousFind(command: string): boolean;
+/**
+ * Detects command substitution $(...) or backticks `...` in a command string.
+ * Commands with substitution are never auto-allowed because the substituted
+ * command may be dangerous (e.g. cat $(rm x)). FR-019.6.
+ */
+export declare function hasCommandSubstitution(command: string): boolean;
+/**
+ * Detects process substitution <(...) or >(...) in a command string.
+ * These can execute side effects and are never auto-allowed. FR-019.6.
+ */
+export declare function hasProcessSubstitution(command: string): boolean;
+/**
+ * Detects sed in-place edit flag (-i, with optional backup suffix like -i.bak).
+ * sed -i modifies files in place and must NOT be auto-allowed. FR-019.5.
+ */
+export declare function hasSedInPlace(command: string): boolean;
 /**
  * Extracts a "smart prefix" from a bash command based on common developer tools.
  * Returns null if the command is blacklisted or cannot be safely prefix-matched.