wave-agent-sdk 0.19.8 → 1.0.0

package/src/managers/mcpManager.ts

@@ -9,6 +9,7 @@ import { ChatCompletionFunctionTool } from "openai/resources.js";
 import { createMcpToolPlugin, findToolServer } from "../utils/mcpUtils.js";
 import type { ToolPlugin, ToolResult, ToolContext } from "../tools/types.js";
 import { Container } from "../utils/container.js";
+import type { ConfigurationService } from "../services/configurationService.js";
 import type {
   Logger,
   McpServerConfig,
@@ -42,7 +43,21 @@ export interface McpManagerOptions {
  */
 const WAVE_TEMPLATE_VARS = ["WAVE_PLUGIN_ROOT", "CLAUDE_PLUGIN_ROOT"];
 
-export function expandEnvVars(value: string): string {
+/**
+ * Expand environment variables in a string value.
+ * Supports ${VAR} and ${VAR:-default} patterns.
+ *
+ * @param env - Merged env to resolve against (session snapshot over OS env).
+ *              Defaults to `process.env` for backward compatibility with tests
+ *              and standalone callers.
+ */
+export function expandEnvVars(
+  value: string,
+  env: Record<string, string | undefined> = process.env as Record<
+    string,
+    string | undefined
+  >,
+): string {
   return value.replace(/\$\{([^}]+)\}/g, (_match, expr: string) => {
     const [varName, ...rest] = expr.split(":-");
     const defaultValue = rest.join(":-");
@@ -50,45 +65,53 @@ export function expandEnvVars(value: string): string {
     if (WAVE_TEMPLATE_VARS.includes(varName)) {
       return _match; // return original ${...} string untouched
     }
-    return process.env[varName] ?? defaultValue;
+    return env[varName] ?? process.env[varName] ?? defaultValue;
   });
 }
 
 /**
  * Walk an MCP config and resolve environment variables in all string fields.
- * Only expands ${VAR} from process.env (skipping WAVE_PLUGIN_ROOT which is
- * handled at spawn time).
+ * Expands ${VAR} against the session env snapshot (over OS env); falls back to
+ * process.env. WAVE_PLUGIN_ROOT is skipped — handled at spawn time.
  */
-export function resolveMcpConfig(config: McpConfig): McpConfig {
+export function resolveMcpConfig(
+  config: McpConfig,
+  env: Record<string, string | undefined> = process.env as Record<
+    string,
+    string | undefined
+  >,
+): McpConfig {
   const resolved: McpConfig = { mcpServers: {} };
 
   for (const [name, serverConfig] of Object.entries(config.mcpServers)) {
     const resolvedServer: McpServerConfig = { ...serverConfig };
 
     if (resolvedServer.command) {
-      resolvedServer.command = expandEnvVars(resolvedServer.command);
+      resolvedServer.command = expandEnvVars(resolvedServer.command, env);
     }
 
     if (resolvedServer.args) {
-      resolvedServer.args = resolvedServer.args.map(expandEnvVars);
+      resolvedServer.args = resolvedServer.args.map((a) =>
+        expandEnvVars(a, env),
+      );
     }
 
     if (resolvedServer.env) {
       const resolvedEnv: Record<string, string> = {};
       for (const [key, val] of Object.entries(resolvedServer.env)) {
-        resolvedEnv[key] = expandEnvVars(val);
+        resolvedEnv[key] = expandEnvVars(val, env);
       }
       resolvedServer.env = resolvedEnv;
     }
 
     if (resolvedServer.url) {
-      resolvedServer.url = expandEnvVars(resolvedServer.url);
+      resolvedServer.url = expandEnvVars(resolvedServer.url, env);
     }
 
     if (resolvedServer.headers) {
       const resolvedHeaders: Record<string, string> = {};
       for (const [key, val] of Object.entries(resolvedServer.headers)) {
-        resolvedHeaders[key] = expandEnvVars(val);
+        resolvedHeaders[key] = expandEnvVars(val, env);
       }
       resolvedServer.headers = resolvedHeaders;
     }
@@ -119,6 +142,19 @@ export class McpManager {
     this.mcpServers = options.mcpServers;
   }
 
+  /**
+   * Merged env for this session: OS env overlaid with the per-session settings
+   * snapshot. MCP env-var expansion (${VAR}) resolves against this so multiple
+   * sessions in one `wave --stdio` process don't read each other's settings env.
+   */
+  private get envSnapshot(): Record<string, string> {
+    return (
+      this.container
+        .get<ConfigurationService>("ConfigurationService")
+        ?.getMergedEnv?.() ?? (process.env as Record<string, string>)
+    );
+  }
+
   /**
    * Initialize MCP manager with working directory and optionally auto-connect
    */
@@ -189,7 +225,7 @@ export class McpManager {
     try {
       const configContent = await fs.readFile(this.configPath, "utf-8");
       const rawConfig: McpConfig = JSON.parse(configContent);
-      const workspaceConfig = resolveMcpConfig(rawConfig);
+      const workspaceConfig = resolveMcpConfig(rawConfig, this.envSnapshot);
 
       // Extract original (pre-resolution) URLs for safe display
       const originalUrls: Record<string, string | undefined> = {};
@@ -284,28 +320,31 @@ export class McpManager {
     // Capture original URL before any resolution for safe display
     const originalUrl = config.url;
 
-    // Expand env vars from process.env (e.g. ${TAVILY_API_KEY})
+    // Expand env vars against the session snapshot (over OS env, e.g. ${TAVILY_API_KEY})
+    const env = this.envSnapshot;
     const resolvedConfig: McpServerConfig = { ...config };
     if (resolvedConfig.command) {
-      resolvedConfig.command = expandEnvVars(resolvedConfig.command);
+      resolvedConfig.command = expandEnvVars(resolvedConfig.command, env);
     }
     if (resolvedConfig.args) {
-      resolvedConfig.args = resolvedConfig.args.map(expandEnvVars);
+      resolvedConfig.args = resolvedConfig.args.map((a) =>
+        expandEnvVars(a, env),
+      );
     }
     if (resolvedConfig.env) {
       const resolvedEnv: Record<string, string> = {};
       for (const [key, val] of Object.entries(resolvedConfig.env)) {
-        resolvedEnv[key] = expandEnvVars(val);
+        resolvedEnv[key] = expandEnvVars(val, env);
       }
       resolvedConfig.env = resolvedEnv;
     }
     if (resolvedConfig.url) {
-      resolvedConfig.url = expandEnvVars(resolvedConfig.url);
+      resolvedConfig.url = expandEnvVars(resolvedConfig.url, env);
     }
     if (resolvedConfig.headers) {
       const resolvedHeaders: Record<string, string> = {};
       for (const [key, val] of Object.entries(resolvedConfig.headers)) {
-        resolvedHeaders[key] = expandEnvVars(val);
+        resolvedHeaders[key] = expandEnvVars(val, env);
       }
       resolvedConfig.headers = resolvedHeaders;
     }
@@ -433,8 +472,11 @@ export class McpManager {
           );
         }
 
+        // Base env = OS env overlaid with this session's settings snapshot, so
+        // custom env vars from settings.json reach the MCP server subprocess
+        // without polluting other sessions sharing one `wave --stdio` process.
         const env: Record<string, string> = {
-          ...(process.env as Record<string, string>),
+          ...this.envSnapshot,
           ...(server.config.env || {}),
         };
 

package/src/managers/permissionManager.ts

@@ -23,7 +23,11 @@ import {
   hasWriteRedirections,
   getSmartPrefix,
   isDangerousFind,
+  hasCommandSubstitution,
+  hasProcessSubstitution,
+  hasSedInPlace,
   DANGEROUS_COMMANDS,
+  READ_ONLY_COMMANDS,
 } from "../utils/bashParser.js";
 import { isPathInside } from "../utils/pathSafety.js";
 import {
@@ -37,23 +41,6 @@ import { Container } from "../utils/container.js";
 import { ConfigurationService } from "../services/configurationService.js";
 import type { WorktreeSession } from "../utils/worktreeSession.js";
 
-const SAFE_COMMANDS = [
-  "cd",
-  "ls",
-  "pwd",
-  "true",
-  "false",
-  "grep",
-  "rg",
-  "cat",
-  "head",
-  "tail",
-  "wc",
-  "sleep",
-  "find",
-  "sort",
-];
-
 const DEFAULT_ALLOWED_RULES = [
   "Bash(git status*)",
   "Bash(git diff*)",
@@ -747,6 +734,14 @@ export class PermissionManager {
         if (hasWriteRedirections(part)) {
           return true;
         }
+        // Command/process substitution and sed -i are dangerous (FR-019.5, FR-019.6)
+        if (
+          hasCommandSubstitution(part) ||
+          hasProcessSubstitution(part) ||
+          hasSedInPlace(part)
+        ) {
+          return true;
+        }
         const processedPart = stripRedirections(stripEnvVars(part));
         const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
         if (commandMatch) {
@@ -862,122 +857,115 @@ export class PermissionManager {
   }
 
   /**
-   * Check if a tool call is allowed by persistent or temporary rules
+   * Check if a single bash command part is auto-allowed (read-only and safe).
+   * Auto-allowed commands skip the confirmation dialog entirely.
+   * FR-019.2 through FR-019.7: read-only commands without write redirections,
+   * command substitution, process substitution, or sed -i are auto-allowed.
    */
-  private isAllowedByRule(context: ToolPermissionContext): boolean {
-    const isAllowedByRuleList = (
-      ctx: ToolPermissionContext,
-      rules: string[],
-      isDefaultRules: boolean = false,
-    ) => {
-      if (ctx.toolName === BASH_TOOL_NAME && ctx.toolInput?.command) {
-        const command = String(ctx.toolInput.command);
-        const parts = splitBashCommand(command);
-        if (parts.length === 0) return false;
-
-        const workdir = ctx.toolInput?.workdir as string | undefined;
-
-        return parts.every((part) => {
-          const hasWrite = hasWriteRedirections(part);
-          const processedPart = stripRedirections(stripEnvVars(part));
-
-          // Check for safe commands
-          if (!hasWrite) {
-            const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-            if (commandMatch) {
-              const cmd = commandMatch[1];
-              const args = commandMatch[2]?.trim() || "";
-
-              if (SAFE_COMMANDS.includes(cmd)) {
-                if (
-                  cmd === "pwd" ||
-                  cmd === "true" ||
-                  cmd === "false" ||
-                  cmd === "ls" ||
-                  cmd === "grep" ||
-                  cmd === "rg" ||
-                  cmd === "cat" ||
-                  cmd === "head" ||
-                  cmd === "tail" ||
-                  cmd === "wc" ||
-                  cmd === "sleep" ||
-                  cmd === "sort" ||
-                  (cmd === "find" && !isDangerousFind(part))
-                ) {
-                  return true;
-                }
+  private isAutoAllowedPart(part: string, workdir?: string): boolean {
+    // Write redirections disqualify (FR-019.4)
+    if (hasWriteRedirections(part)) return false;
+    // Command substitution $(...) or `...` disqualifies (FR-019.6)
+    if (hasCommandSubstitution(part)) return false;
+    // Process substitution <(...) or >(...) disqualifies (FR-019.6)
+    if (hasProcessSubstitution(part)) return false;
+
+    const processedPart = stripRedirections(stripEnvVars(part));
+    const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+    if (!commandMatch) return false;
+
+    const cmd = commandMatch[1];
+    const args = commandMatch[2]?.trim() || "";
+
+    // sed -i (in-place edit) disqualifies (FR-019.5)
+    if (hasSedInPlace(part)) return false;
+
+    // Read-only commands are auto-allowed (FR-019.2, FR-019.3)
+    if (READ_ONLY_COMMANDS.includes(cmd)) {
+      // find with dangerous flags (e.g. -exec, -delete) disqualifies
+      if (cmd === "find" && isDangerousFind(part)) return false;
+      return true;
+    }
 
-                if (workdir) {
-                  // For cd, check paths
-                  const pathArgs =
-                    (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
-                      (arg) => !arg.startsWith("-"),
-                    ) || [];
-
-                  if (pathArgs.length === 0) {
-                    // cd without arguments operates on current dir (workdir)
-                    return true;
-                  }
-
-                  const allPathsSafe = pathArgs.every((pathArg) => {
-                    // Remove quotes if present
-                    const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                    const { isInside } = this.isInsideSafeZone(
-                      cleanPath,
-                      workdir,
-                    );
-                    return isInside;
-                  });
-
-                  if (allPathsSafe) {
-                    return true;
-                  }
-                }
-              }
-            }
-          }
+    // cd is not read-only but is safe if all paths are within the Safe Zone
+    if (cmd === "cd") {
+      if (!workdir) return false;
+      const pathArgs =
+        (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
+          (arg) => !arg.startsWith("-"),
+        ) || [];
+      if (pathArgs.length === 0) return true; // cd without args = current dir
+      return pathArgs.every((pathArg) => {
+        const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+        const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
+        return isInside;
+      });
+    }
 
-          // Check if this specific part is allowed by any rule
-          if (isDefaultRules && (hasWrite || isDangerousFind(part))) {
-            return false;
-          }
+    return false;
+  }
 
-          // We create a temporary context with just this part of the command
-          const partContext = {
-            ...ctx,
-            toolInput: { ...ctx.toolInput, command: part },
-          };
-          const allowedByRule = rules.some((rule) => {
-            return this.matchesRule(partContext, rule);
-          });
+  /**
+   * Check if a tool call is allowed by persistent or temporary rules
+   */
+  private isAllowedByRule(context: ToolPermissionContext): boolean {
+    // All allow-rule sources are matched as a union: each part of a chained
+    // command only needs to hit at least one rule across all sources, so
+    // different parts may be covered by different sources.
+    const explicitRules = [
+      ...this.instanceAllowedRules,
+      ...this.temporaryRules,
+      ...this.allowedRules,
+    ];
+
+    if (context.toolName === BASH_TOOL_NAME && context.toolInput?.command) {
+      const command = String(context.toolInput.command);
+      const parts = splitBashCommand(command);
+      if (parts.length === 0) return false;
 
-          if (allowedByRule) return true;
+      const workdir = context.toolInput?.workdir as string | undefined;
 
-          return !this.isRestrictedTool(ctx.toolName);
-        });
-      }
+      return parts.every((part) => {
+        // Check for auto-allowed read-only commands (FR-019.2 through FR-019.7)
+        if (this.isAutoAllowedPart(part, workdir)) {
+          return true;
+        }
 
-      // For other tools, check if any rule matches
-      return rules.some((rule) => this.matchesRule(ctx, rule));
-    };
+        // We create a temporary context with just this part of the command
+        const partContext = {
+          ...context,
+          toolInput: { ...context.toolInput, command: part },
+        };
 
-    // Check instance-specific allowed rules first
-    if (isAllowedByRuleList(context, this.instanceAllowedRules)) {
-      return true;
-    }
+        if (explicitRules.some((rule) => this.matchesRule(partContext, rule))) {
+          return true;
+        }
 
-    // Check temporary rules
-    if (isAllowedByRuleList(context, this.temporaryRules)) {
-      return true;
-    }
+        // Default rules must not auto-allow dangerous variants (write
+        // redirections, substitutions, sed -i, dangerous find) through broad
+        // rules like Bash(echo*) or Bash(cat*)
+        const isDangerousVariant =
+          hasWriteRedirections(part) ||
+          isDangerousFind(part) ||
+          hasCommandSubstitution(part) ||
+          hasProcessSubstitution(part) ||
+          hasSedInPlace(part);
+        if (
+          !isDangerousVariant &&
+          DEFAULT_ALLOWED_RULES.some((rule) =>
+            this.matchesRule(partContext, rule),
+          )
+        ) {
+          return true;
+        }
 
-    // Check persistent allowed rules
-    if (isAllowedByRuleList(context, this.allowedRules)) {
-      return true;
+        return !this.isRestrictedTool(context.toolName);
+      });
     }
 
-    // Check default allowed rules
-    return isAllowedByRuleList(context, DEFAULT_ALLOWED_RULES, true);
+    // For other tools, check if any rule matches
+    const allRules = [...explicitRules, ...DEFAULT_ALLOWED_RULES];
+    return allRules.some((rule) => this.matchesRule(context, rule));
   }
 
   /**
@@ -996,52 +984,8 @@ export class PermissionManager {
       const hasWrite = hasWriteRedirections(part);
       const processedPart = stripRedirections(stripEnvVars(part));
 
-      // Check for safe commands
-      const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-      let isSafe = false;
-
-      if (commandMatch && !hasWrite) {
-        const cmd = commandMatch[1];
-        const args = commandMatch[2]?.trim() || "";
-
-        if (SAFE_COMMANDS.includes(cmd)) {
-          if (
-            cmd === "pwd" ||
-            cmd === "true" ||
-            cmd === "false" ||
-            cmd === "ls" ||
-            cmd === "grep" ||
-            cmd === "rg" ||
-            cmd === "cat" ||
-            cmd === "head" ||
-            cmd === "tail" ||
-            cmd === "wc" ||
-            cmd === "sleep" ||
-            (cmd === "find" && !isDangerousFind(part))
-          ) {
-            isSafe = true;
-          } else {
-            // For cd, check paths
-            const pathArgs =
-              (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
-                (arg) => !arg.startsWith("-"),
-              ) || [];
-
-            if (pathArgs.length === 0) {
-              isSafe = true;
-            } else {
-              const allPathsSafe = pathArgs.every((pathArg) => {
-                const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
-                return isInside;
-              });
-              if (allPathsSafe) {
-                isSafe = true;
-              }
-            }
-          }
-        }
-      }
+      // Check for auto-allowed read-only commands
+      const isSafe = this.isAutoAllowedPart(part, workdir);
 
       if (!isSafe) {
         // Check if command is dangerous or out-of-bounds
@@ -1050,7 +994,11 @@ export class PermissionManager {
           const cmd = commandMatch[1];
           const args = commandMatch[2]?.trim() || "";
 
-          if (DANGEROUS_COMMANDS.includes(cmd) || isDangerousFind(part)) {
+          if (
+            DANGEROUS_COMMANDS.includes(cmd) ||
+            isDangerousFind(part) ||
+            hasSedInPlace(part)
+          ) {
             continue;
           }
 

package/src/managers/pluginManager.ts

@@ -2,6 +2,8 @@ import { logger } from "../utils/globalLogger.js";
 import { Plugin, PluginConfig } from "../types/index.js";
 import { PluginLoader } from "../services/pluginLoader.js";
 import * as path from "path";
+import { existsSync, readdirSync } from "fs";
+import { getBuiltinPluginsDir } from "../utils/configPaths.js";
 import { SkillManager } from "./skillManager.js";
 import { HookManager } from "./hookManager.js";
 import { LspManager } from "./lspManager.js";
@@ -98,6 +100,8 @@ export class PluginManager {
 
         const [name, marketplaceName] = pluginId.split("@");
         if (!name || !marketplaceName) continue;
+        // `@builtin` entries are loaded by loadBuiltinPlugins, not the marketplace.
+        if (marketplaceName === "builtin") continue;
 
         const isInstalled = installedRegistry.plugins.some(
           (p) => p.name === name && p.marketplace === marketplaceName,
@@ -283,6 +287,31 @@ export class PluginManager {
 
     // Load installed plugins from marketplace
     await this.loadInstalledPlugins();
+
+    // Load built-in plugins bundled with the SDK (lowest priority)
+    await this.loadBuiltinPlugins();
+  }
+
+  /**
+   * Load built-in plugins bundled with the SDK (e.g. sdd).
+   * Opt-in via `enabledPlugins`, keyed `<name>@builtin` (default off, consistent
+   * with marketplace plugins). Lowest priority: explicit config and marketplace
+   * plugins win on name conflicts (loadSinglePlugin skips duplicates).
+   */
+  private async loadBuiltinPlugins(): Promise<void> {
+    try {
+      const builtinDir = getBuiltinPluginsDir();
+      if (!existsSync(builtinDir)) return;
+
+      // The builtin plugin directory name is the plugin name by convention.
+      for (const entry of readdirSync(builtinDir, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        if (this.enabledPlugins[`${entry.name}@builtin`] !== true) continue;
+        await this.loadSinglePlugin(path.join(builtinDir, entry.name));
+      }
+    } catch (error) {
+      logger?.error("Failed to load built-in plugins:", error);
+    }
   }
 
   /**

package/src/managers/toolManager.ts

@@ -253,6 +253,13 @@ class ToolManager {
             "WorkflowManager",
           )
         : undefined,
+      sessionEnv: this.container.has("ConfigurationService")
+        ? this.container
+            .get<
+              import("../services/configurationService.js").ConfigurationService
+            >("ConfigurationService")
+            ?.getMergedEnv?.()
+        : undefined,
       sessionId: context.sessionId,
       toolCallId: context.toolCallId,
     };