wave-agent-sdk 0.8.2 → 0.8.3

package/dist/managers/permissionManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissionManager.d.ts","sourceRoot":"","sources":["../../src/managers/permissionManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAgBhD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA8BlD,MAAM,WAAW,wBAAwB;IACvC,uDAAuD;IACvD,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACvC,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAiB;IAY1B,OAAO,CAAC,SAAS;IAXnB,OAAO,CAAC,qBAAqB,CAAC,CAAiB;IAC/C,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,qBAAqB,CAAgB;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,6BAA6B,CAAC,CAAiC;IACvE,OAAO,CAAC,OAAO,CAAC,CAAS;gBAGf,SAAS,EAAE,SAAS,EAC5B,OAAO,GAAE,wBAA6B;IAWxC;;OAEG;IACI,gCAAgC,CACrC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GACvC,IAAI;IAIP;;OAEG;IACH,2BAA2B,CAAC,WAAW,CAAC,EAAE,cAAc,GAAG,IAAI;IAc/D;;OAEG;IACI,wBAAwB,IAAI,cAAc,GAAG,SAAS;IAI7D;;OAEG;IACI,eAAe,IAAI,MAAM,EAAE;IAIlC;;OAEG;IACI,cAAc,IAAI,MAAM,EAAE;IAIjC;;OAEG;IACI,wBAAwB,IAAI,MAAM,EAAE;IAI3C;;OAEG;IACI,sBAAsB,IAAI,MAAM,EAAE;IAIzC;;OAEG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIzC;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIxC;;OAEG;IACI,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAI/C;;OAEG;IACI,mBAAmB,IAAI,IAAI;IAIlC;;OAEG;IACH,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI;IASxD;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpC;;OAEG;IACI,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAItD;;OAEG;IACI,eAAe,IAAI,MAAM,GAAG,SAAS;IAI5C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;OAEG;IACH,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,cAAc,GAAG,cAAc;IAI3E;;OAEG;IACH,8BAA8B,CAC5B,iBAAiB,CAAC,EAAE,cAAc,GACjC,cAAc;IAejB;;;OAGG;IACG,eAAe,CACnB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;IAyH9B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,cAAc,EAC9B,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,qBAAqB;IA6ExB;;OAEG;IACH,OAAO,CAAC,WAAW;IAmDnB;;OAEG;IACH,OAAO,CAAC,eAAe;IAyFvB;;;;;;;OAOG;IACI,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAkFjE;;;OAGG;IACU,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA4C5D"}
+{"version":3,"file":"permissionManager.d.ts","sourceRoot":"","sources":["../../src/managers/permissionManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAiBhD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA8BlD,MAAM,WAAW,wBAAwB;IACvC,uDAAuD;IACvD,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACvC,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,iBAAiB;IAY1B,OAAO,CAAC,SAAS;IAXnB,OAAO,CAAC,qBAAqB,CAAC,CAAiB;IAC/C,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,cAAc,CAAgB;IACtC,OAAO,CAAC,qBAAqB,CAAgB;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,6BAA6B,CAAC,CAAiC;IACvE,OAAO,CAAC,OAAO,CAAC,CAAS;gBAGf,SAAS,EAAE,SAAS,EAC5B,OAAO,GAAE,wBAA6B;IAWxC;;OAEG;IACI,gCAAgC,CACrC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GACvC,IAAI;IAIP;;OAEG;IACH,2BAA2B,CAAC,WAAW,CAAC,EAAE,cAAc,GAAG,IAAI;IAc/D;;OAEG;IACI,wBAAwB,IAAI,cAAc,GAAG,SAAS;IAI7D;;OAEG;IACI,eAAe,IAAI,MAAM,EAAE;IAIlC;;OAEG;IACI,cAAc,IAAI,MAAM,EAAE;IAIjC;;OAEG;IACI,wBAAwB,IAAI,MAAM,EAAE;IAI3C;;OAEG;IACI,sBAAsB,IAAI,MAAM,EAAE;IAIzC;;OAEG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIzC;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAIxC;;OAEG;IACI,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAI/C;;OAEG;IACI,mBAAmB,IAAI,IAAI;IAIlC;;OAEG;IACH,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI;IASxD;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIpC;;OAEG;IACI,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAItD;;OAEG;IACI,eAAe,IAAI,MAAM,GAAG,SAAS;IAI5C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IA2BxB;;OAEG;IACH,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,cAAc,GAAG,cAAc;IAI3E;;OAEG;IACH,8BAA8B,CAC5B,iBAAiB,CAAC,EAAE,cAAc,GACjC,cAAc;IAejB;;;OAGG;IACG,eAAe,CACnB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;IAyH9B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI3C;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,cAAc,EAC9B,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,qBAAqB;IAgFxB;;OAEG;IACH,OAAO,CAAC,WAAW;IA6DnB;;OAEG;IACH,OAAO,CAAC,eAAe;IAiGvB;;;;;;;OAOG;IACI,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;IAmFjE;;;OAGG;IACU,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA4C5D"}

package/dist/managers/permissionManager.js

@@ -8,7 +8,7 @@
 import path from "node:path";
 import { minimatch } from "minimatch";
 import { RESTRICTED_TOOLS } from "../types/permissions.js";
-import { splitBashCommand, stripEnvVars, stripRedirections, getSmartPrefix, DANGEROUS_COMMANDS, } from "../utils/bashParser.js";
+import { splitBashCommand, stripEnvVars, stripRedirections, hasWriteRedirections, getSmartPrefix, DANGEROUS_COMMANDS, } from "../utils/bashParser.js";
 import { isPathInside } from "../utils/pathSafety.js";
 import { BASH_TOOL_NAME, EDIT_TOOL_NAME, WRITE_TOOL_NAME, READ_TOOL_NAME, LS_TOOL_NAME, } from "../constants/tools.js";
 const SAFE_COMMANDS = ["cd", "ls", "pwd", "true", "false"];
@@ -343,6 +343,9 @@ export class PermissionManager {
             const workdir = toolInput.workdir;
             const parts = splitBashCommand(command);
             const isDangerous = parts.some((part) => {
+                if (hasWriteRedirections(part)) {
+                    return true;
+                }
                 const processedPart = stripRedirections(stripEnvVars(part));
                 const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
                 if (commandMatch) {
@@ -390,7 +393,15 @@ export class PermissionManager {
         // Handle Bash command rules
         if (toolName === BASH_TOOL_NAME) {
             const command = String(context.toolInput?.command || "");
-            const processedPart = stripRedirections(stripEnvVars(command));
+            const hasWriteInPattern = hasWriteRedirections(pattern);
+            const hasWriteInCommand = hasWriteRedirections(command);
+            // If the command has write redirections, it must match a pattern that also has write redirections
+            if (hasWriteInCommand && !hasWriteInPattern) {
+                return false;
+            }
+            const processedPart = hasWriteInPattern
+                ? stripEnvVars(command)
+                : stripRedirections(stripEnvVars(command));
             // For Bash commands, we want '*' to match everything including slashes and spaces
             // minimatch's default behavior for '*' is to not match across directory separators
             // We use a regex to replace '*' with '.*' (match anything)
@@ -421,7 +432,7 @@ export class PermissionManager {
      * Check if a tool call is allowed by persistent or temporary rules
      */
     isAllowedByRule(context) {
-        const isAllowedByRuleList = (ctx, rules) => {
+        const isAllowedByRuleList = (ctx, rules, isDefaultRules = false) => {
             if (ctx.toolName === BASH_TOOL_NAME && ctx.toolInput?.command) {
                 const command = String(ctx.toolInput.command);
                 const parts = splitBashCommand(command);
@@ -429,40 +440,46 @@ export class PermissionManager {
                     return false;
                 const workdir = ctx.toolInput?.workdir;
                 return parts.every((part) => {
+                    const hasWrite = hasWriteRedirections(part);
                     const processedPart = stripRedirections(stripEnvVars(part));
                     // Check for safe commands
-                    const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-                    if (commandMatch) {
-                        const cmd = commandMatch[1];
-                        const args = commandMatch[2]?.trim() || "";
-                        if (SAFE_COMMANDS.includes(cmd)) {
-                            if (cmd === "pwd" || cmd === "true" || cmd === "false") {
-                                return true;
-                            }
-                            if (workdir) {
-                                // For cd and ls, check paths
-                                const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
-                                if (pathArgs.length === 0) {
-                                    // cd or ls without arguments operates on current dir (workdir)
+                    if (!hasWrite) {
+                        const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+                        if (commandMatch) {
+                            const cmd = commandMatch[1];
+                            const args = commandMatch[2]?.trim() || "";
+                            if (SAFE_COMMANDS.includes(cmd)) {
+                                if (cmd === "pwd" || cmd === "true" || cmd === "false") {
                                     return true;
                                 }
-                                const allPathsSafe = pathArgs.every((pathArg) => {
-                                    // Remove quotes if present
-                                    const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                                    const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
-                                    return isInside;
-                                });
-                                if (allPathsSafe) {
-                                    return true;
+                                if (workdir) {
+                                    // For cd and ls, check paths
+                                    const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
+                                    if (pathArgs.length === 0) {
+                                        // cd or ls without arguments operates on current dir (workdir)
+                                        return true;
+                                    }
+                                    const allPathsSafe = pathArgs.every((pathArg) => {
+                                        // Remove quotes if present
+                                        const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+                                        const { isInside } = this.isInsideSafeZone(cleanPath, workdir);
+                                        return isInside;
+                                    });
+                                    if (allPathsSafe) {
+                                        return true;
+                                    }
                                 }
                             }
                         }
                     }
                     // Check if this specific part is allowed by any rule
+                    if (hasWrite && isDefaultRules) {
+                        return false;
+                    }
                     // We create a temporary context with just this part of the command
                     const partContext = {
                         ...ctx,
-                        toolInput: { ...ctx.toolInput, command: processedPart },
+                        toolInput: { ...ctx.toolInput, command: part },
                     };
                     const allowedByRule = rules.some((rule) => {
                         return this.matchesRule(partContext, rule);
@@ -484,7 +501,7 @@ export class PermissionManager {
             return true;
         }
         // Check default allowed rules
-        return isAllowedByRuleList(context, DEFAULT_ALLOWED_RULES);
+        return isAllowedByRuleList(context, DEFAULT_ALLOWED_RULES, true);
     }
     /**
      * Expand a bash command into individual permission rules, filtering out safe commands.
@@ -498,11 +515,12 @@ export class PermissionManager {
         const parts = splitBashCommand(command);
         const rules = [];
         for (const part of parts) {
+            const hasWrite = hasWriteRedirections(part);
             const processedPart = stripRedirections(stripEnvVars(part));
             // Check for safe commands
             const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
             let isSafe = false;
-            if (commandMatch) {
+            if (commandMatch && !hasWrite) {
                 const cmd = commandMatch[1];
                 const args = commandMatch[2]?.trim() || "";
                 if (SAFE_COMMANDS.includes(cmd)) {
@@ -549,12 +567,12 @@ export class PermissionManager {
                         }
                     }
                 }
-                const smartPrefix = getSmartPrefix(processedPart);
+                const smartPrefix = hasWrite ? null : getSmartPrefix(processedPart);
                 if (smartPrefix) {
                     rules.push(`Bash(${smartPrefix}*)`);
                 }
                 else {
-                    rules.push(`Bash(${processedPart})`);
+                    rules.push(`Bash(${hasWrite ? stripEnvVars(part) : processedPart})`);
                 }
             }
         }

package/dist/managers/pluginManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pluginManager.d.ts","sourceRoot":"","sources":["../../src/managers/pluginManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAUzD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qBAAa,aAAa;IAMtB,OAAO,CAAC,SAAS;IALnB,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAA0B;gBAGtC,SAAS,EAAE,SAAS,EAC5B,OAAO,EAAE,oBAAoB;IAM/B,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAEtB;IAED,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,mBAAmB,GAE9B;IAED,OAAO,KAAK,oBAAoB,GAE/B;IAED;;OAEG;IACH,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAInE;;OAEG;YACW,oBAAoB;IAyBlC;;OAEG;YACW,gBAAgB;IAyD9B;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBzD;;OAEG;IACH,UAAU,IAAI,MAAM,EAAE;IAItB;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG5C"}
+{"version":3,"file":"pluginManager.d.ts","sourceRoot":"","sources":["../../src/managers/pluginManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAUzD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,qBAAa,aAAa;IAMtB,OAAO,CAAC,SAAS;IALnB,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAA0B;gBAGtC,SAAS,EAAE,SAAS,EAC5B,OAAO,EAAE,oBAAoB;IAM/B,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAEtB;IAED,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,mBAAmB,GAE9B;IAED,OAAO,KAAK,oBAAoB,GAE/B;IAED;;OAEG;IACH,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAInE;;OAEG;YACW,oBAAoB;IA+DlC;;OAEG;YACW,gBAAgB;IAyD9B;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBzD;;OAEG;IACH,UAAU,IAAI,MAAM,EAAE;IAItB;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG5C"}

package/dist/managers/pluginManager.js

@@ -43,7 +43,34 @@ export class PluginManager {
                 this.enabledPlugins = this.configurationService.getMergedEnabledPlugins(this.workdir);
             }
             const marketplaceService = new MarketplaceService();
-            const installedRegistry = await marketplaceService.getInstalledPlugins();
+            let installedRegistry = await marketplaceService.getInstalledPlugins();
+            const knownMarketplaces = await marketplaceService.listMarketplaces();
+            // Identify missing enabled plugins and auto-install them if marketplace is known
+            for (const pluginId of Object.keys(this.enabledPlugins)) {
+                if (this.enabledPlugins[pluginId] !== true)
+                    continue;
+                const [name, marketplaceName] = pluginId.split("@");
+                if (!name || !marketplaceName)
+                    continue;
+                const isInstalled = installedRegistry.plugins.some((p) => p.name === name && p.marketplace === marketplaceName);
+                if (!isInstalled) {
+                    const isMarketplaceKnown = knownMarketplaces.some((m) => m.name === marketplaceName);
+                    if (isMarketplaceKnown) {
+                        logger?.info(`Auto-installing missing plugin: ${pluginId}`);
+                        try {
+                            await marketplaceService.installPlugin(pluginId);
+                        }
+                        catch (installError) {
+                            logger?.error(`Failed to auto-install plugin ${pluginId}:`, installError);
+                        }
+                    }
+                    else {
+                        logger?.warn(`Plugin ${pluginId} is enabled but marketplace ${marketplaceName} is unknown. Skipping auto-install.`);
+                    }
+                }
+            }
+            // Refresh registry after potential auto-installs
+            installedRegistry = await marketplaceService.getInstalledPlugins();
             for (const p of installedRegistry.plugins) {
                 const pluginId = `${p.name}@${p.marketplace}`;
                 if (this.enabledPlugins[pluginId] !== true) {

package/dist/utils/bashParser.d.ts

@@ -11,6 +11,10 @@ export declare function stripEnvVars(command: string): string;
  * Removes redirections (e.g., echo "data" > output.txt -> echo "data").
  */
 export declare function stripRedirections(command: string): string;
+/**
+ * Checks if a bash command contains any write redirections (>, >>, &>, 2>, >|).
+ */
+export declare function hasWriteRedirections(command: string): boolean;
 /**
  * Blacklist of dangerous commands that should not be safely prefix-matched
  * and should not have persistent permissions.

package/dist/utils/bashParser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bashParser.d.ts","sourceRoot":"","sources":["../../src/utils/bashParser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA8G1D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA2CpD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAuHzD;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAa9B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuL7D"}
+{"version":3,"file":"bashParser.d.ts","sourceRoot":"","sources":["../../src/utils/bashParser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAmH1D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA2CpD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAuHzD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsC7D;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAa9B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuL7D"}

package/dist/utils/bashParser.js

@@ -98,8 +98,11 @@ export function splitBashCommand(command) {
         parts.push(lastPart);
     const finalResult = [];
     for (const part of parts) {
-        const stripped = stripRedirections(stripEnvVars(part));
-        if (stripped.startsWith("(") && stripped.endsWith(")")) {
+        const envStripped = stripEnvVars(part);
+        const stripped = stripRedirections(envStripped);
+        if (stripped.startsWith("(") &&
+            stripped.endsWith(")") &&
+            stripped === envStripped) {
             const inner = stripped.substring(1, stripped.length - 1).trim();
             if (inner) {
                 finalResult.push(...splitBashCommand(inner));
@@ -268,6 +271,40 @@ export function stripRedirections(command) {
     }
     return result.trim();
 }
+/**
+ * Checks if a bash command contains any write redirections (>, >>, &>, 2>, >|).
+ */
+export function hasWriteRedirections(command) {
+    let inSingleQuote = false;
+    let inDoubleQuote = false;
+    let escaped = false;
+    for (let i = 0; i < command.length; i++) {
+        const char = command[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (char === "'" && !inDoubleQuote) {
+            inSingleQuote = !inSingleQuote;
+            continue;
+        }
+        if (char === '"' && !inSingleQuote) {
+            inDoubleQuote = !inDoubleQuote;
+            continue;
+        }
+        if (inSingleQuote || inDoubleQuote) {
+            continue;
+        }
+        if (char === ">") {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * Blacklist of dangerous commands that should not be safely prefix-matched
  * and should not have persistent permissions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wave-agent-sdk",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "SDK for building AI-powered development tools and agents",
   "keywords": [
     "ai",
@@ -49,9 +49,6 @@
     "test": "vitest run --reporter=dot",
     "test:coverage": "vitest run --coverage --reporter=dot",
     "lint": "eslint --cache",
-    "format": "prettier --write .",
-    "version:patch": "node ../../scripts/version.js patch",
-    "version:minor": "node ../../scripts/version.js minor",
-    "version:major": "node ../../scripts/version.js major"
+    "format": "prettier --write ."
   }
 }

package/src/managers/permissionManager.ts

@@ -20,6 +20,7 @@ import {
   splitBashCommand,
   stripEnvVars,
   stripRedirections,
+  hasWriteRedirections,
   getSmartPrefix,
   DANGEROUS_COMMANDS,
 } from "../utils/bashParser.js";
@@ -464,6 +465,9 @@ export class PermissionManager {
       const parts = splitBashCommand(command);
 
       const isDangerous = parts.some((part) => {
+        if (hasWriteRedirections(part)) {
+          return true;
+        }
         const processedPart = stripRedirections(stripEnvVars(part));
         const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
         if (commandMatch) {
@@ -523,7 +527,17 @@ export class PermissionManager {
     // Handle Bash command rules
     if (toolName === BASH_TOOL_NAME) {
       const command = String(context.toolInput?.command || "");
-      const processedPart = stripRedirections(stripEnvVars(command));
+      const hasWriteInPattern = hasWriteRedirections(pattern);
+      const hasWriteInCommand = hasWriteRedirections(command);
+
+      // If the command has write redirections, it must match a pattern that also has write redirections
+      if (hasWriteInCommand && !hasWriteInPattern) {
+        return false;
+      }
+
+      const processedPart = hasWriteInPattern
+        ? stripEnvVars(command)
+        : stripRedirections(stripEnvVars(command));
       // For Bash commands, we want '*' to match everything including slashes and spaces
       // minimatch's default behavior for '*' is to not match across directory separators
       // We use a regex to replace '*' with '.*' (match anything)
@@ -561,6 +575,7 @@ export class PermissionManager {
     const isAllowedByRuleList = (
       ctx: ToolPermissionContext,
       rules: string[],
+      isDefaultRules: boolean = false,
     ) => {
       if (ctx.toolName === BASH_TOOL_NAME && ctx.toolInput?.command) {
         const command = String(ctx.toolInput.command);
@@ -570,53 +585,60 @@ export class PermissionManager {
         const workdir = ctx.toolInput?.workdir as string | undefined;
 
         return parts.every((part) => {
+          const hasWrite = hasWriteRedirections(part);
           const processedPart = stripRedirections(stripEnvVars(part));
 
           // Check for safe commands
-          const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
-          if (commandMatch) {
-            const cmd = commandMatch[1];
-            const args = commandMatch[2]?.trim() || "";
-
-            if (SAFE_COMMANDS.includes(cmd)) {
-              if (cmd === "pwd" || cmd === "true" || cmd === "false") {
-                return true;
-              }
-
-              if (workdir) {
-                // For cd and ls, check paths
-                const pathArgs =
-                  (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
-                    (arg) => !arg.startsWith("-"),
-                  ) || [];
-
-                if (pathArgs.length === 0) {
-                  // cd or ls without arguments operates on current dir (workdir)
+          if (!hasWrite) {
+            const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+            if (commandMatch) {
+              const cmd = commandMatch[1];
+              const args = commandMatch[2]?.trim() || "";
+
+              if (SAFE_COMMANDS.includes(cmd)) {
+                if (cmd === "pwd" || cmd === "true" || cmd === "false") {
                   return true;
                 }
 
-                const allPathsSafe = pathArgs.every((pathArg) => {
-                  // Remove quotes if present
-                  const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
-                  const { isInside } = this.isInsideSafeZone(
-                    cleanPath,
-                    workdir,
-                  );
-                  return isInside;
-                });
-
-                if (allPathsSafe) {
-                  return true;
+                if (workdir) {
+                  // For cd and ls, check paths
+                  const pathArgs =
+                    (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter(
+                      (arg) => !arg.startsWith("-"),
+                    ) || [];
+
+                  if (pathArgs.length === 0) {
+                    // cd or ls without arguments operates on current dir (workdir)
+                    return true;
+                  }
+
+                  const allPathsSafe = pathArgs.every((pathArg) => {
+                    // Remove quotes if present
+                    const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+                    const { isInside } = this.isInsideSafeZone(
+                      cleanPath,
+                      workdir,
+                    );
+                    return isInside;
+                  });
+
+                  if (allPathsSafe) {
+                    return true;
+                  }
                 }
               }
             }
           }
 
           // Check if this specific part is allowed by any rule
+          if (hasWrite && isDefaultRules) {
+            return false;
+          }
+
           // We create a temporary context with just this part of the command
           const partContext = {
             ...ctx,
-            toolInput: { ...ctx.toolInput, command: processedPart },
+            toolInput: { ...ctx.toolInput, command: part },
           };
           const allowedByRule = rules.some((rule) => {
             return this.matchesRule(partContext, rule);
@@ -643,7 +665,7 @@ export class PermissionManager {
     }
 
     // Check default allowed rules
-    return isAllowedByRuleList(context, DEFAULT_ALLOWED_RULES);
+    return isAllowedByRuleList(context, DEFAULT_ALLOWED_RULES, true);
   }
 
   /**
@@ -659,13 +681,14 @@ export class PermissionManager {
     const rules: string[] = [];
 
     for (const part of parts) {
+      const hasWrite = hasWriteRedirections(part);
       const processedPart = stripRedirections(stripEnvVars(part));
 
       // Check for safe commands
       const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
       let isSafe = false;
 
-      if (commandMatch) {
+      if (commandMatch && !hasWrite) {
         const cmd = commandMatch[1];
         const args = commandMatch[2]?.trim() || "";
 
@@ -724,11 +747,11 @@ export class PermissionManager {
           }
         }
 
-        const smartPrefix = getSmartPrefix(processedPart);
+        const smartPrefix = hasWrite ? null : getSmartPrefix(processedPart);
         if (smartPrefix) {
           rules.push(`Bash(${smartPrefix}*)`);
         } else {
-          rules.push(`Bash(${processedPart})`);
+          rules.push(`Bash(${hasWrite ? stripEnvVars(part) : processedPart})`);
         }
       }
     }

package/src/managers/pluginManager.ts

@@ -73,7 +73,45 @@ export class PluginManager {
       }
 
       const marketplaceService = new MarketplaceService();
-      const installedRegistry = await marketplaceService.getInstalledPlugins();
+      let installedRegistry = await marketplaceService.getInstalledPlugins();
+      const knownMarketplaces = await marketplaceService.listMarketplaces();
+
+      // Identify missing enabled plugins and auto-install them if marketplace is known
+      for (const pluginId of Object.keys(this.enabledPlugins)) {
+        if (this.enabledPlugins[pluginId] !== true) continue;
+
+        const [name, marketplaceName] = pluginId.split("@");
+        if (!name || !marketplaceName) continue;
+
+        const isInstalled = installedRegistry.plugins.some(
+          (p) => p.name === name && p.marketplace === marketplaceName,
+        );
+
+        if (!isInstalled) {
+          const isMarketplaceKnown = knownMarketplaces.some(
+            (m) => m.name === marketplaceName,
+          );
+
+          if (isMarketplaceKnown) {
+            logger?.info(`Auto-installing missing plugin: ${pluginId}`);
+            try {
+              await marketplaceService.installPlugin(pluginId);
+            } catch (installError) {
+              logger?.error(
+                `Failed to auto-install plugin ${pluginId}:`,
+                installError,
+              );
+            }
+          } else {
+            logger?.warn(
+              `Plugin ${pluginId} is enabled but marketplace ${marketplaceName} is unknown. Skipping auto-install.`,
+            );
+          }
+        }
+      }
+
+      // Refresh registry after potential auto-installs
+      installedRegistry = await marketplaceService.getInstalledPlugins();
 
       for (const p of installedRegistry.plugins) {
         const pluginId = `${p.name}@${p.marketplace}`;

package/src/utils/bashParser.ts

@@ -100,8 +100,13 @@ export function splitBashCommand(command: string): string[] {
 
   const finalResult: string[] = [];
   for (const part of parts) {
-    const stripped = stripRedirections(stripEnvVars(part));
-    if (stripped.startsWith("(") && stripped.endsWith(")")) {
+    const envStripped = stripEnvVars(part);
+    const stripped = stripRedirections(envStripped);
+    if (
+      stripped.startsWith("(") &&
+      stripped.endsWith(")") &&
+      stripped === envStripped
+    ) {
       const inner = stripped.substring(1, stripped.length - 1).trim();
       if (inner) {
         finalResult.push(...splitBashCommand(inner));
@@ -286,6 +291,49 @@ export function stripRedirections(command: string): string {
   return result.trim();
 }
 
+/**
+ * Checks if a bash command contains any write redirections (>, >>, &>, 2>, >|).
+ */
+export function hasWriteRedirections(command: string): boolean {
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let escaped = false;
+
+  for (let i = 0; i < command.length; i++) {
+    const char = command[i];
+
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+
+    if (char === "'" && !inDoubleQuote) {
+      inSingleQuote = !inSingleQuote;
+      continue;
+    }
+
+    if (char === '"' && !inSingleQuote) {
+      inDoubleQuote = !inDoubleQuote;
+      continue;
+    }
+
+    if (inSingleQuote || inDoubleQuote) {
+      continue;
+    }
+
+    if (char === ">") {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 /**
  * Blacklist of dangerous commands that should not be safely prefix-matched
  * and should not have persistent permissions.