wave-agent-sdk 1.1.5 → 1.2.0

package/dist/services/jsonlHandler.js

@@ -4,7 +4,8 @@
  */
 import { appendFile, readFile, writeFile, stat, mkdir } from "fs/promises";
 import { dirname } from "path";
-import { getLastLine, readFirstNLines } from "../utils/fileUtils.js";
+import { getLastLine, readFirstNLines, readTailLines, } from "../utils/fileUtils.js";
+import { extractLatestTotalTokens } from "../utils/tokenCalculation.js";
 /**
  * JSONL handler class for message persistence operations
  */
@@ -88,6 +89,10 @@ export class JsonlHandler {
     async read(filePath) {
         try {
             const content = await readFile(filePath, "utf8");
+            // append() always terminates a written batch with "\n" (see append),
+            // so a file that does not end with a newline means the process was
+            // interrupted mid-write, leaving a partial trailing line behind.
+            const endsWithNewline = content.length === 0 || content.endsWith("\n");
             const lines = content
                 .split(/\r?\n/)
                 .map((line) => line.trim())
@@ -108,6 +113,14 @@ export class JsonlHandler {
                         allMessages.push(message);
                 }
                 catch (error) {
+                    // A parse failure on the final line of a file that lacks a trailing
+                    // newline is the residue of an interrupted append (complete batches
+                    // always end with "\n"): drop the partial line and keep every
+                    // message that was fully written. Corruption on any earlier line is
+                    // genuine corruption and still fails.
+                    if (!endsWithNewline && i === lines.length - 1) {
+                        continue;
+                    }
                     // Throw error for invalid JSON lines with line number
                     throw new Error(`Invalid JSON at line ${i + 1}: ${error}`);
                 }
@@ -157,6 +170,36 @@ export class JsonlHandler {
             throw new Error(`Failed to get last message from "${filePath}": ${error}`);
         }
     }
+    /**
+     * Latest context-usage total for a session file.
+     *
+     * Sessions accumulate usage-less messages at the end — SessionStart hook
+     * meta messages are appended (and persisted) on every resume — so the last
+     * line alone cannot answer "how much context did this conversation use".
+     * Scan backwards over the file's tail window and take the newest message
+     * that carries usage.
+     *
+     * @param filePath - Path to the session JSONL file
+     * @returns total_tokens of the newest usage-bearing message, or 0 when the
+     *          tail holds none (empty/unreadable file, no completed request yet)
+     */
+    async getLatestTotalTokens(filePath) {
+        const messages = [];
+        for (const line of await readTailLines(filePath)) {
+            try {
+                const parsed = JSON.parse(line);
+                // Metadata header line: not a message, skip
+                if (parsed.type === "metadata")
+                    continue;
+                messages.push(parsed);
+            }
+            catch {
+                // Partial line at the tail window's boundary — drop it.
+                continue;
+            }
+        }
+        return extractLatestTotalTokens(messages);
+    }
     /**
      * Read the creation-time metadata from the session file's header line.
      *

package/dist/services/memory.d.ts

@@ -26,4 +26,18 @@ export declare class MemoryService {
     getUserMemoryContent(): Promise<string>;
     readMemoryFile(workdir: string): Promise<string>;
     getCombinedMemoryContent(workdir: string): Promise<string>;
+    /**
+     * Persist the user-level memory file (~/.wave/AGENTS.md), creating it if
+     * missing. Clears the user-memory cache so subsequent reads see the new
+     * content (the default-template fallback to ~/.claude/AGENTS.md is also
+     * bypassed once the user writes real content).
+     */
+    writeUserMemoryContent(content: string): Promise<void>;
+    /**
+     * Persist the project-level memory file (<workdir>/AGENTS.md), creating it
+     * if missing. Reads fall back to CLAUDE.md but writes always target
+     * AGENTS.md (the canonical project memory file). Clears the project-memory
+     * cache so subsequent reads see the new content.
+     */
+    writeProjectMemoryContent(workdir: string, content: string): Promise<void>;
 }

package/dist/services/memory.js

@@ -215,4 +215,37 @@ export class MemoryService {
         this._cachedCombinedMemory = combined;
         return combined;
     }
+    /**
+     * Persist the user-level memory file (~/.wave/AGENTS.md), creating it if
+     * missing. Clears the user-memory cache so subsequent reads see the new
+     * content (the default-template fallback to ~/.claude/AGENTS.md is also
+     * bypassed once the user writes real content).
+     */
+    async writeUserMemoryContent(content) {
+        await this.ensureUserMemoryFile();
+        await fs.writeFile(USER_MEMORY_FILE, content, "utf-8");
+        this._cachedUserMemory = null;
+        this._cachedCombinedMemory = null;
+        logger.debug("User memory content written", {
+            userMemoryFile: USER_MEMORY_FILE,
+            contentLength: content.length,
+        });
+    }
+    /**
+     * Persist the project-level memory file (<workdir>/AGENTS.md), creating it
+     * if missing. Reads fall back to CLAUDE.md but writes always target
+     * AGENTS.md (the canonical project memory file). Clears the project-memory
+     * cache so subsequent reads see the new content.
+     */
+    async writeProjectMemoryContent(workdir, content) {
+        const memoryFilePath = path.join(workdir, "AGENTS.md");
+        await fs.mkdir(workdir, { recursive: true });
+        await fs.writeFile(memoryFilePath, content, "utf-8");
+        this._cachedProjectMemory = null;
+        this._cachedCombinedMemory = null;
+        logger.debug("Project memory content written", {
+            memoryFilePath,
+            contentLength: content.length,
+        });
+    }
 }

package/dist/services/officialMarketplaceMirror.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Builtin official marketplace zip-snapshot mirror fetch.
+ *
+ * The official marketplace (wave-plugins-official, BUILTIN in MarketplaceService)
+ * is hosted on GitHub, which is poorly reachable from CN networks. Instead of a
+ * dumb-HTTP git endpoint we mirror the "content-addressed zip + latest pointer +
+ * local sentinel" model Claude Code uses for its official marketplace
+ * (officialMarketplaceGcs.ts, inc-5046):
+ *
+ *   1. GET `{base}/latest` (10s timeout) → content-addressed sha
+ *   2. Compare against the local sentinel `.wave-market-sha` at the market root
+ *      — equal ⇒ no-op (idempotent, one ~40B request per run)
+ *   3. GET `{base}/{sha}.zip` (60s timeout) → extract into a `.staging` dir
+ *      (path-traversal/absolute-path rejection, size limits, exec-bit restore
+ *      from zip external attrs)
+ *   4. Atomic swap: rm old market dir + rename staging → market dir, write the
+ *      sentinel back
+ *
+ * Any failure returns null; the caller decides whether to fall through to the
+ * existing git path (guarded by a kill switch, mirroring Claude's
+ * tengu_plugin_official_mkt_git_fallback flag).
+ */
+/** Sentinel file name stored at the market root holding the last fetched sha. */
+export declare const OFFICIAL_MARKET_SENTINEL_FILE = ".wave-market-sha";
+/** Env var override for the mirror base URL (highest precedence). */
+export declare const OFFICIAL_MARKET_MIRROR_BASE_URL_ENV = "WAVE_OFFICIAL_MARKET_MIRROR_BASE_URL";
+/**
+ * Kill switch for the git fallback after a mirror failure (default: allowed).
+ * Mirrors Claude Code's `tengu_plugin_official_mkt_git_fallback` flag. When
+ * false and the mirror fails, the builtin marketplace update is skipped
+ * (retried on next run) instead of hitting GitHub.
+ */
+export declare const ALLOW_OFFICIAL_MARKET_GIT_FALLBACK = true;
+/**
+ * Resolves the mirror base URL: env var wins, otherwise the built-in constant.
+ * Returns null when neither is configured (mirror channel disabled).
+ */
+export declare function resolveOfficialMarketplaceMirrorBaseUrl(): string | null;
+/**
+ * Rejects zip entry paths that would escape the extraction root: absolute
+ * paths (POSIX or Windows drive/UNC), `..` segments, and null bytes. Paths
+ * use either `/` or `\` as separator. Returns the normalized relative path on
+ * success or null for entries that must be skipped (empty/directory-only is
+ * handled by the caller via the trailing `/`).
+ */
+export declare function sanitizeZipEntryPath(entryPath: string): string | null;
+/**
+ * Fetches the official marketplace from the zip-snapshot mirror and extracts
+ * it to installLocation. Idempotent — compares the local `.wave-market-sha`
+ * sentinel before downloading.
+ *
+ * @param installLocation where to extract (must be inside marketplacesCacheDir)
+ * @param marketplacesCacheDir the marketplace cache root (defense-in-depth:
+ *   this function `rm`s installLocation during the atomic swap)
+ * @param baseUrl optional explicit base URL (tests); defaults to env/constant
+ * @returns the fetched sha on success (including no-op), null on any failure
+ *   (unconfigured mirror, network, 404, corrupt zip, unsafe entries). Caller
+ *   decides whether to fall through to git.
+ */
+export declare function fetchOfficialMarketplaceFromMirror(installLocation: string, marketplacesCacheDir: string, baseUrl?: string): Promise<string | null>;
+interface ZipValidationState {
+    fileCount: number;
+    totalUncompressed: number;
+    compressedSize: number;
+}
+/**
+ * Validates one zip entry (called from the fflate filter). Throws to abort the
+ * whole extraction when an entry is unsafe or the archive exceeds limits.
+ */
+export declare function validateZipEntry(name: string, originalSize: number, state: ZipValidationState): void;
+/**
+ * Parse Unix file modes from a zip's central directory.
+ *
+ * fflate's `unzipSync` returns only `Record<string, Uint8Array>` — it does not
+ * surface the external file attributes stored in the central directory, so
+ * executable bits would be lost (everything extracts as 0644). Returns
+ * `name → mode` for entries created on a Unix host (`versionMadeBy` high byte
+ * === 3); other entries are omitted and extract with default mode.
+ *
+ * Format per PKZIP APPNOTE.TXT §4.3.12 (central directory) and §4.3.16 (EOCD).
+ * ZIP64 is not handled — returns `{}` on archives >4GB or >65535 entries,
+ * which is fine for marketplace zips.
+ */
+export declare function parseZipModes(data: Uint8Array): Record<string, number>;
+export {};

package/dist/services/officialMarketplaceMirror.js

@@ -0,0 +1,289 @@
+/**
+ * Builtin official marketplace zip-snapshot mirror fetch.
+ *
+ * The official marketplace (wave-plugins-official, BUILTIN in MarketplaceService)
+ * is hosted on GitHub, which is poorly reachable from CN networks. Instead of a
+ * dumb-HTTP git endpoint we mirror the "content-addressed zip + latest pointer +
+ * local sentinel" model Claude Code uses for its official marketplace
+ * (officialMarketplaceGcs.ts, inc-5046):
+ *
+ *   1. GET `{base}/latest` (10s timeout) → content-addressed sha
+ *   2. Compare against the local sentinel `.wave-market-sha` at the market root
+ *      — equal ⇒ no-op (idempotent, one ~40B request per run)
+ *   3. GET `{base}/{sha}.zip` (60s timeout) → extract into a `.staging` dir
+ *      (path-traversal/absolute-path rejection, size limits, exec-bit restore
+ *      from zip external attrs)
+ *   4. Atomic swap: rm old market dir + rename staging → market dir, write the
+ *      sentinel back
+ *
+ * Any failure returns null; the caller decides whether to fall through to the
+ * existing git path (guarded by a kill switch, mirroring Claude's
+ * tengu_plugin_official_mkt_git_fallback flag).
+ */
+import { chmod, mkdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+import { unzipSync } from "fflate";
+import { logWarn } from "../utils/globalLogger.js";
+/** Sentinel file name stored at the market root holding the last fetched sha. */
+export const OFFICIAL_MARKET_SENTINEL_FILE = ".wave-market-sha";
+/** Suffix of the staging dir used for atomic swap into the market root. */
+const STAGING_SUFFIX = ".staging";
+/**
+ * Default mirror base URL (prod contract) — files hang directly off this base:
+ * `{base}/latest` (pure-text sha) and `{base}/{sha}.zip` (whole-tree snapshot).
+ * Trailing slash is normalized away when composing URLs.
+ *
+ * - PROD: `https://codechat.codewave.163.com/wave-plugins-official/`
+ * - TEST（验证用）: `https://codechat.codewave-test.163yun.com/wave-plugins-official/`
+ *
+ * Override with env var `WAVE_OFFICIAL_MARKET_MIRROR_BASE_URL` (highest
+ * precedence). 注意：prod 该 URL 的 ingress/内容尚未上线，镜像请求会 404 → 按既有
+ * 设计回退 git 兜底（ALLOW_OFFICIAL_MARKET_GIT_FALLBACK），行为安全。
+ */
+const DEFAULT_OFFICIAL_MARKET_MIRROR_BASE_URL = "https://codechat.codewave.163.com/wave-plugins-official/";
+/** Env var override for the mirror base URL (highest precedence). */
+export const OFFICIAL_MARKET_MIRROR_BASE_URL_ENV = "WAVE_OFFICIAL_MARKET_MIRROR_BASE_URL";
+/**
+ * Kill switch for the git fallback after a mirror failure (default: allowed).
+ * Mirrors Claude Code's `tengu_plugin_official_mkt_git_fallback` flag. When
+ * false and the mirror fails, the builtin marketplace update is skipped
+ * (retried on next run) instead of hitting GitHub.
+ */
+export const ALLOW_OFFICIAL_MARKET_GIT_FALLBACK = true;
+const LATEST_TIMEOUT_MS = 10000;
+const ZIP_TIMEOUT_MS = 60000;
+// Sanity limits against corrupt/malicious archives (zip bombs). The publisher
+// is first-party, so these are corruption guards rather than a trust boundary;
+// values follow the Claude Code reference (utils/dxt/zip.ts).
+const ZIP_LIMITS = {
+    MAX_SINGLE_FILE_SIZE: 512 * 1024 * 1024, // per-file uncompressed
+    MAX_TOTAL_SIZE: 1024 * 1024 * 1024, // total uncompressed
+    MAX_FILE_COUNT: 100000,
+    MAX_COMPRESSION_RATIO: 50, // uncompressed : compressed
+};
+/**
+ * Resolves the mirror base URL: env var wins, otherwise the built-in constant.
+ * Returns null when neither is configured (mirror channel disabled).
+ */
+export function resolveOfficialMarketplaceMirrorBaseUrl() {
+    const envUrl = process.env[OFFICIAL_MARKET_MIRROR_BASE_URL_ENV];
+    const candidate = (envUrl && envUrl.trim()) || DEFAULT_OFFICIAL_MARKET_MIRROR_BASE_URL;
+    if (!candidate)
+        return null;
+    return candidate.replace(/\/+$/, ""); // normalize trailing slashes
+}
+/**
+ * Rejects zip entry paths that would escape the extraction root: absolute
+ * paths (POSIX or Windows drive/UNC), `..` segments, and null bytes. Paths
+ * use either `/` or `\` as separator. Returns the normalized relative path on
+ * success or null for entries that must be skipped (empty/directory-only is
+ * handled by the caller via the trailing `/`).
+ */
+export function sanitizeZipEntryPath(entryPath) {
+    if (!entryPath || entryPath.includes("\0"))
+        return null;
+    if (entryPath.startsWith("/") || entryPath.startsWith("\\"))
+        return null;
+    const segments = entryPath.split(/[\\/]/);
+    // A drive-letter prefix (Windows "C:/…") must not slip through as relative.
+    if (segments[0] && /^[A-Za-z]:$/.test(segments[0]))
+        return null;
+    for (const seg of segments) {
+        if (seg === "..")
+            return null;
+    }
+    return entryPath;
+}
+/**
+ * Fetches the official marketplace from the zip-snapshot mirror and extracts
+ * it to installLocation. Idempotent — compares the local `.wave-market-sha`
+ * sentinel before downloading.
+ *
+ * @param installLocation where to extract (must be inside marketplacesCacheDir)
+ * @param marketplacesCacheDir the marketplace cache root (defense-in-depth:
+ *   this function `rm`s installLocation during the atomic swap)
+ * @param baseUrl optional explicit base URL (tests); defaults to env/constant
+ * @returns the fetched sha on success (including no-op), null on any failure
+ *   (unconfigured mirror, network, 404, corrupt zip, unsafe entries). Caller
+ *   decides whether to fall through to git.
+ */
+export async function fetchOfficialMarketplaceFromMirror(installLocation, marketplacesCacheDir, baseUrl) {
+    // Defense in depth: this function does `rm(installLocation, {recursive})`
+    // during the atomic swap. A corrupted known_marketplaces.json could point
+    // at the user's project. Refuse any path outside the marketplace cache dir.
+    // Same guard as Claude's officialMarketplaceGcs.ts:57-65.
+    const cacheDir = resolve(marketplacesCacheDir);
+    const resolvedLoc = resolve(installLocation);
+    if (resolvedLoc !== cacheDir && !resolvedLoc.startsWith(cacheDir + sep)) {
+        logWarn(`Official marketplace mirror: refusing install location outside marketplaces cache dir: ${installLocation}`);
+        return null;
+    }
+    const effectiveBase = baseUrl ?? resolveOfficialMarketplaceMirrorBaseUrl();
+    if (!effectiveBase)
+        return null; // mirror not configured
+    try {
+        // 1. Latest pointer — tiny request, hit on every startup.
+        const latestText = await httpGetText(`${effectiveBase}/latest`, LATEST_TIMEOUT_MS);
+        const sha = latestText.trim();
+        if (!sha) {
+            // Empty /latest body — mirror misconfigured. Bail (null), don't lock
+            // into a permanently-broken empty-sentinel state.
+            throw new Error("Official marketplace mirror: latest pointer returned empty body");
+        }
+        // sha is interpolated into a URL — keep it a sane opaque token.
+        if (!/^[^\s/\\]+$/.test(sha)) {
+            throw new Error(`Official marketplace mirror: invalid sha from latest pointer`);
+        }
+        // 2. Sentinel check.
+        const currentSha = await readFile(join(installLocation, OFFICIAL_MARKET_SENTINEL_FILE), "utf8")
+            .then((s) => s.trim())
+            .catch(() => null); // ENOENT — first fetch, proceed to download
+        if (currentSha === sha)
+            return sha;
+        // 3. Download zip and extract to a staging dir, then atomic-swap into
+        //    place. A crash mid-extract leaves a .staging dir (rm'd on the next
+        //    run) rather than a half-written installLocation.
+        const zipBuf = await httpGetBuffer(`${effectiveBase}/${sha}.zip`, ZIP_TIMEOUT_MS);
+        const zipState = {
+            fileCount: 0,
+            totalUncompressed: 0,
+            compressedSize: zipBuf.length,
+        };
+        const files = unzipSync(new Uint8Array(zipBuf), {
+            filter: (file) => {
+                validateZipEntry(file.name, file.originalSize, zipState);
+                return true;
+            },
+        });
+        // fflate doesn't surface external_attr, so parse the central directory
+        // ourselves to recover exec bits. Without this, hooks/scripts extract as
+        // 0644 and fail to execute — git clone preserves +x natively, so the zip
+        // path must too.
+        const modes = parseZipModes(zipBuf);
+        const staging = `${installLocation}${STAGING_SUFFIX}`;
+        await rm(staging, { recursive: true, force: true });
+        await mkdir(staging, { recursive: true });
+        for (const [entryName, data] of Object.entries(files)) {
+            if (!entryName || entryName.endsWith("/"))
+                continue; // dir entries
+            const rel = sanitizeZipEntryPath(entryName);
+            if (!rel)
+                continue; // validated in filter; skip defensively
+            const dest = join(staging, rel);
+            await mkdir(dirname(dest), { recursive: true });
+            await writeFile(dest, data);
+            const mode = modes[entryName];
+            if (mode && mode & 0o111) {
+                // Only chmod when an exec bit is set — skip plain files to save
+                // syscalls. Swallow EPERM/ENOTSUP (read-only mounts) — losing +x is
+                // better than aborting mid-extraction.
+                await chmod(dest, mode & 0o777).catch(() => { });
+            }
+        }
+        await writeFile(join(staging, OFFICIAL_MARKET_SENTINEL_FILE), sha);
+        // 4. Atomic swap: rm old, rename staging. Brief window where
+        //    installLocation doesn't exist — acceptable for a background refresh
+        //    (next run re-downloads if it crashes here).
+        await rm(installLocation, { recursive: true, force: true });
+        await rename(staging, installLocation);
+        return sha;
+    }
+    catch (error) {
+        logWarn(`Official marketplace mirror fetch failed (falling back per caller policy): ${error instanceof Error ? error.message : String(error)}`);
+        return null;
+    }
+}
+/**
+ * Validates one zip entry (called from the fflate filter). Throws to abort the
+ * whole extraction when an entry is unsafe or the archive exceeds limits.
+ */
+export function validateZipEntry(name, originalSize, state) {
+    state.fileCount++;
+    if (state.fileCount > ZIP_LIMITS.MAX_FILE_COUNT) {
+        throw new Error(`Official marketplace zip contains too many files (${state.fileCount}, max ${ZIP_LIMITS.MAX_FILE_COUNT})`);
+    }
+    const clean = sanitizeZipEntryPath(name);
+    if (!clean) {
+        // Reject unsafe entries (path traversal, absolute paths, null bytes).
+        // Directory entries are validated too — a `../` dir entry aborts.
+        throw new Error(`Official marketplace zip contains unsafe path: "${name}"`);
+    }
+    if (originalSize > ZIP_LIMITS.MAX_SINGLE_FILE_SIZE) {
+        throw new Error(`Official marketplace zip entry "${name}" too large (${originalSize} bytes, max ${ZIP_LIMITS.MAX_SINGLE_FILE_SIZE})`);
+    }
+    state.totalUncompressed += originalSize;
+    if (state.totalUncompressed > ZIP_LIMITS.MAX_TOTAL_SIZE) {
+        throw new Error(`Official marketplace zip total size exceeds ${ZIP_LIMITS.MAX_TOTAL_SIZE} bytes`);
+    }
+    if (state.compressedSize > 0 &&
+        state.totalUncompressed / state.compressedSize >
+            ZIP_LIMITS.MAX_COMPRESSION_RATIO) {
+        throw new Error(`Official marketplace zip suspicious compression ratio (>${ZIP_LIMITS.MAX_COMPRESSION_RATIO}:1) — possible zip bomb`);
+    }
+}
+async function httpGetText(url, timeoutMs) {
+    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!response.ok) {
+        throw new Error(`HTTP ${response.status} fetching ${url}`);
+    }
+    return response.text();
+}
+async function httpGetBuffer(url, timeoutMs) {
+    const response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    if (!response.ok) {
+        throw new Error(`HTTP ${response.status} fetching ${url}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+/**
+ * Parse Unix file modes from a zip's central directory.
+ *
+ * fflate's `unzipSync` returns only `Record<string, Uint8Array>` — it does not
+ * surface the external file attributes stored in the central directory, so
+ * executable bits would be lost (everything extracts as 0644). Returns
+ * `name → mode` for entries created on a Unix host (`versionMadeBy` high byte
+ * === 3); other entries are omitted and extract with default mode.
+ *
+ * Format per PKZIP APPNOTE.TXT §4.3.12 (central directory) and §4.3.16 (EOCD).
+ * ZIP64 is not handled — returns `{}` on archives >4GB or >65535 entries,
+ * which is fine for marketplace zips.
+ */
+export function parseZipModes(data) {
+    const buf = Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+    const modes = {};
+    // 1. Find the End of Central Directory record (sig 0x06054b50). Scan
+    //    backwards from the trailing 22 + max-comment bytes.
+    const minEocd = Math.max(0, buf.length - 22 - 0xffff);
+    let eocd = -1;
+    for (let i = buf.length - 22; i >= minEocd; i--) {
+        if (buf.readUInt32LE(i) === 0x06054b50) {
+            eocd = i;
+            break;
+        }
+    }
+    if (eocd < 0)
+        return modes; // malformed — the unzip error surfaces separately
+    const entryCount = buf.readUInt16LE(eocd + 10);
+    let off = buf.readUInt32LE(eocd + 16);
+    // 2. Walk central directory entries (sig 0x02014b50). Each entry has a
+    //    46-byte fixed header followed by variable-length name/extra/comment.
+    for (let i = 0; i < entryCount; i++) {
+        if (off + 46 > buf.length || buf.readUInt32LE(off) !== 0x02014b50)
+            break;
+        const versionMadeBy = buf.readUInt16LE(off + 4);
+        const nameLen = buf.readUInt16LE(off + 28);
+        const extraLen = buf.readUInt16LE(off + 30);
+        const commentLen = buf.readUInt16LE(off + 32);
+        const externalAttr = buf.readUInt32LE(off + 38);
+        const name = buf.toString("utf8", off + 46, off + 46 + nameLen);
+        // versionMadeBy high byte = host OS. 3 = Unix. For Unix zips the high 16
+        // bits of externalAttr hold st_mode (file type + permission bits).
+        if (versionMadeBy >> 8 === 3) {
+            const mode = (externalAttr >>> 16) & 0xffff;
+            if (mode)
+                modes[name] = mode;
+        }
+        off += 46 + nameLen + extraLen + commentLen;
+    }
+    return modes;
+}

package/dist/services/remoteSettingsService.js

@@ -268,8 +268,8 @@ export function mergeRemoteSettings(localMerged, remote) {
             deny: lp.deny || rp.deny
                 ? dedupe([...(lp.deny ?? []), ...(rp.deny ?? [])])
                 : undefined,
-            // permissionMode: remote wins (scalar)
-            permissionMode: rp.permissionMode ?? lp.permissionMode,
+            // defaultMode: remote wins (scalar)
+            defaultMode: rp.defaultMode ?? lp.defaultMode,
             // additionalDirectories: concatenate + dedupe
             additionalDirectories: lp.additionalDirectories || rp.additionalDirectories
                 ? dedupe([
@@ -283,8 +283,8 @@ export function mergeRemoteSettings(localMerged, remote) {
             delete result.permissions.allow;
         if (!result.permissions.deny)
             delete result.permissions.deny;
-        if (!result.permissions.permissionMode)
-            delete result.permissions.permissionMode;
+        if (!result.permissions.defaultMode)
+            delete result.permissions.defaultMode;
         if (!result.permissions.additionalDirectories)
             delete result.permissions.additionalDirectories;
     }

package/dist/services/session.js

@@ -24,7 +24,7 @@ import { PathEncoder } from "../utils/pathEncoder.js";
 import { JsonlHandler } from "../services/jsonlHandler.js";
 import { extractLatestTotalTokens } from "../utils/tokenCalculation.js";
 import { logger } from "../utils/globalLogger.js";
-import { getMessageContent, sliceFromLastCompact, } from "../utils/messageOperations.js";
+import { getMessageContent } from "../utils/messageOperations.js";
 const execFileAsync = promisify(execFile);
 /**
  * Generate a new session ID using Node.js native crypto.randomUUID()
@@ -215,8 +215,20 @@ export async function loadSessionFromJsonl(sessionId, workdir, sessionType = "ma
             }
         }
         const allMessages = await jsonlHandler.read(resolvedPath);
-        // Find the last compact boundary — only return messages from there forward
-        const messages = sliceFromLastCompact(allMessages);
+        // Transcripts written by older CLI versions re-appended the preserved
+        // rounds at each compaction point, so a message id can appear twice.
+        // Keep the first occurrence — duplicates would render twice once the
+        // full-history restore below feeds them to displayMessages. Append-only
+        // transcripts (current write side) have unique ids, making this a no-op.
+        const seenIds = new Set();
+        const messages = [];
+        for (const message of allMessages) {
+            if (message.id && seenIds.has(message.id))
+                continue;
+            if (message.id)
+                seenIds.add(message.id);
+            messages.push(message);
+        }
         // Extract metadata from messages
         const lastMessage = messages.length > 0 ? messages[messages.length - 1] : null;
         const sessionData = {
@@ -227,9 +239,11 @@ export async function loadSessionFromJsonl(sessionId, workdir, sessionType = "ma
                 lastActiveAt: lastMessage
                     ? lastMessage.timestamp
                     : new Date().toISOString(),
-                latestTotalTokens: lastMessage?.usage
-                    ? extractLatestTotalTokens([lastMessage])
-                    : 0,
+                // Scan backwards for the last usage-bearing message instead of only
+                // testing the tail: a resumed conversation gets usage-less meta
+                // messages appended (SessionStart hooks), which would otherwise report
+                // 0 and blank the context-usage indicator for that conversation.
+                latestTotalTokens: extractLatestTotalTokens(messages),
             },
         };
         return sessionData;
@@ -348,9 +362,9 @@ export async function listSessionsFromJsonl(workdir) {
                         ? new Date(header.createdAt)
                         : new Date(),
                     lastActiveAt,
-                    latestTotalTokens: lastMessage?.usage
-                        ? extractLatestTotalTokens([lastMessage])
-                        : 0,
+                    // Scans the file tail: a resumed session's last line is a usage-less
+                    // hook message, so the line alone would report 0 tokens here.
+                    latestTotalTokens: await jsonlHandler.getLatestTotalTokens(filePath),
                     branch: header?.gitBranch,
                 };
                 // Try to get first message content for display
@@ -535,9 +549,9 @@ export async function listAllSessions(options) {
                                 ? new Date(header.createdAt)
                                 : new Date(),
                             lastActiveAt,
-                            latestTotalTokens: lastMessage?.usage
-                                ? extractLatestTotalTokens([lastMessage])
-                                : 0,
+                            // Scans the file tail: a resumed session's last line is a
+                            // usage-less hook message, so the line alone would report 0.
+                            latestTotalTokens: await jsonlHandler.getLatestTotalTokens(filePath),
                             firstMessage,
                             branch: header?.gitBranch,
                         });
@@ -828,7 +842,10 @@ export async function handleSessionRestoration(restoreSessionId, continueLastSes
             }
         }
         if (sessionToRestore) {
-            console.log(`Restoring session: ${sessionToRestore.id}`);
+            // Diagnostics only — never stdout: `wave --stdio`'s stdout carries the
+            // JSON-RPC channel, and a stray line there makes the host log a parse
+            // failure for every restore (the logger writes to the log file).
+            logger.info(`Restoring session: ${sessionToRestore.id}`);
             // // Initialize from session data
             // this.initializeFromSession();
             return sessionToRestore;

package/dist/services/worktreeHooks.js

@@ -58,7 +58,12 @@ export async function executeWorktreeRemoveHook(worktreePath, configuration, con
     const results = await runWorktreeHooks("WorktreeRemove", hookConfigs, context, { worktreePath });
     for (const result of results) {
         if (!result.success) {
-            logger?.error(`WorktreeRemove hook failed [${result.command}]: ${result.stderr || "no output"}`);
+            // The path identifies which worktree survived; exit/timeout/duration tell
+            // apart "the hook failed on its own" from "the hook was killed by the
+            // hook timeout" when failures are aggregated later.
+            logger?.error(`WorktreeRemove hook failed [${result.command}] worktree=${worktreePath} ` +
+                `exit=${result.exitCode ?? "n/a"} timedOut=${result.timedOut} ` +
+                `durationMs=${result.duration}: ${result.stderr || "no output"}`);
         }
     }
     return true;

package/dist/stdio/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Host-side stdio RPC layer shared by the VS Code extension and the desktop
+ * app: a typed StdioAgent wrapper (mirrors the CLI Agent API over JSON-RPC)
+ * plus the sessionId-demultiplexing NotificationRouter.
+ *
+ * Import via the `wave-agent-sdk/stdio` subpath.
+ */
+export * from "./rpcClient.js";
+export * from "./notificationRouter.js";
+export * from "./stdioAgent.js";

package/dist/stdio/index.js

@@ -0,0 +1,10 @@
+/**
+ * Host-side stdio RPC layer shared by the VS Code extension and the desktop
+ * app: a typed StdioAgent wrapper (mirrors the CLI Agent API over JSON-RPC)
+ * plus the sessionId-demultiplexing NotificationRouter.
+ *
+ * Import via the `wave-agent-sdk/stdio` subpath.
+ */
+export * from "./rpcClient.js";
+export * from "./notificationRouter.js";
+export * from "./stdioAgent.js";