wave-agent-sdk 1.1.5 → 1.3.0

package/dist/managers/messageManager.js

@@ -1,9 +1,12 @@
-import { addAssistantMessageToMessages, updateToolBlockInMessage, addErrorBlockToMessage, addUserMessageToMessages, updateUserMessageInMessages, addBangMessage, updateBangInMessage, completeBangInMessage, removeLastUserMessage, addToolBlockToMessageInMessages, addNotificationMessageToMessages, generateMessageId, sliceFromLastCompact, } from "../utils/messageOperations.js";
+import { addAssistantMessageToMessages, updateToolBlockInMessage, addErrorBlockToMessage, addUserMessageToMessages, updateUserMessageInMessages, removeLastUserMessage, addToolBlockToMessageInMessages, addNotificationMessageToMessages, generateMessageId, sliceFromLastCompact, } from "../utils/messageOperations.js";
 import { getLastApiRounds } from "../utils/groupMessagesByApiRound.js";
-import { join, isAbsolute, relative } from "path";
-import { appendMessages, createSession, generateSessionId, SESSION_DIR, } from "../services/session.js";
+import { join, isAbsolute, relative, resolve } from "path";
+import { appendMessages, createSession, generateSessionId, 
+// Aliased: this class exposes a `reAppendSessionMetadata` method of its own.
+reAppendSessionMetadata as reAppendSessionMetadataToFile, truncateSession, SESSION_DIR, } from "../services/session.js";
 import { pathEncoder } from "../utils/pathEncoder.js";
 import { estimateTokens } from "../utils/tokenEstimate.js";
+import { findNestedMemoryFiles, } from "../utils/nestedMemory.js";
 import { READ_TOOL_NAME } from "../constants/tools.js";
 // Cap for recentFileReads: content is only consumed by getRecentFileReads
 // (top 5 for post-compact restoration), so bound both the entry count and the
@@ -16,10 +19,19 @@ import { logger } from "../utils/globalLogger.js";
 export class MessageManager {
     constructor(container, options) {
         this.container = container;
+        /** Full display message stream for the UI. Mirrors `messages` (context) on
+         * every normal change; the two diverge only around compaction, where
+         * `messages` is replaced by [compact, ...last API rounds] for the API
+         * context while `displayMessages` keeps the full history and appends the
+         * compact block (aligned with Claude Code desktop/VS Code: compaction
+         * folds the API context but leaves the UI transcript intact). */
+        this.displayMessages = [];
         this.pendingFileReadTriggers = new Set(); // File paths read via Read tool, awaiting rule matching
         this.loadedRuleIds = new Set(); // IDs of conditional rules already injected as meta messages
+        this.pendingNestedMemoryTriggers = new Set(); // Absolute paths read since the last nested-memory scan
+        this.loadedNestedMemoryPaths = new Set(); // Nested memory files already injected (session-scoped, never evicted)
         this.recentFileReads = new Map(); // Track file read contents
-        this.invokedSkills = new Map(); // Track invoked skill names
+        this.invokedSkills = new Map(); // Track invoked skills
         this._usages = [];
         this.sessionId = generateSessionId();
         this.messages = [];
@@ -55,12 +67,30 @@ export class MessageManager {
     getMessages() {
         return [...this.messages];
     }
+    /** Full UI display message stream (includes pre-compaction history). */
+    getDisplayMessages() {
+        return [...this.displayMessages];
+    }
     getUsages() {
         return [...this._usages];
     }
     getLatestTotalTokens() {
         return this.latestTotalTokens;
     }
+    /**
+     * Re-point this manager at another working directory (in-session session
+     * switch). The encoded workdir and the transcript path are both derived from
+     * it, so they must move together with it: otherwise the next append would
+     * create a second copy of the same session file under the old project dir.
+     */
+    setWorkdir(workdir) {
+        if (this.workdir === workdir) {
+            return;
+        }
+        this.workdir = workdir;
+        this.encodedWorkdir = pathEncoder.encodeSync(workdir);
+        this.transcriptPath = this.computeTranscriptPath();
+    }
     getWorkdir() {
         return this.workdir;
     }
@@ -163,6 +193,31 @@ export class MessageManager {
             : filePath;
         this.pendingFileReadTriggers.add(normalizedPath);
     }
+    /**
+     * Record an absolute path whose read may pull in a nested memory file
+     * (`AGENTS.md` in one of its ancestor directories). Separate from
+     * `triggerFileRead`: rule matching needs workdir-relative paths, the nested
+     * walk needs absolute ones.
+     */
+    triggerNestedMemory(filePath) {
+        this.pendingNestedMemoryTriggers.add(isAbsolute(filePath) ? filePath : resolve(this.workdir, filePath));
+    }
+    /**
+     * Resolve nested memory files for the paths read since the last call,
+     * outermost first. Clears the pending set; dedup is session-scoped via
+     * `loadedNestedMemoryPaths`.
+     */
+    async collectNestedMemoryFiles() {
+        if (this.pendingNestedMemoryTriggers.size === 0)
+            return [];
+        const filePaths = Array.from(this.pendingNestedMemoryTriggers);
+        this.pendingNestedMemoryTriggers.clear();
+        const memories = [];
+        for (const filePath of filePaths) {
+            memories.push(...(await findNestedMemoryFiles(filePath, this.workdir, this.loadedNestedMemoryPaths)));
+        }
+        return memories;
+    }
     /**
      * Check if a file has been read (for read-before-edit enforcement).
      * Uses recentFileReads Map populated from Read tool execution.
@@ -174,9 +229,35 @@ export class MessageManager {
         return (this.recentFileReads.has(normalizedPath) ||
             this.recentFileReads.has(filePath));
     }
-    setMessages(messages) {
+    setMessages(messages, opts) {
         const oldLength = this.messages.length;
         this.messages = [...messages];
+        // The UI display stream follows the context by default. Compaction /
+        // session restore / rewind pass keepDisplay and manage displayMessages
+        // explicitly (the display stream must keep the full pre-compaction
+        // history while the context folds at the last compact boundary).
+        if (!opts?.keepDisplay) {
+            if (messages.length === 0) {
+                // Clear path — nothing to merge.
+                this.displayMessages = [...messages];
+            }
+            else {
+                // Routine changes (new messages, tool block updates) still touch the
+                // display stream, but after compaction the display holds the full
+                // pre-compaction history while the context is folded. Merge by id so
+                // new messages append to the display stream and updated messages
+                // replace their display copy without dropping that history.
+                const byId = new Map(messages.map((m) => [m.id, m]));
+                const merged = this.displayMessages.map((m) => byId.get(m.id) ?? m);
+                const known = new Set(this.displayMessages.map((m) => m.id));
+                for (const m of messages) {
+                    if (!known.has(m.id)) {
+                        merged.push(m);
+                    }
+                }
+                this.displayMessages = merged;
+            }
+        }
         // Incrementally extract metadata from new messages
         const newMessages = messages.slice(oldLength);
         for (const message of newMessages) {
@@ -231,6 +312,27 @@ export class MessageManager {
             this.callbacks.onLatestTotalTokensChange?.(latestTotalTokens);
         }
     }
+    getCustomTitle() {
+        return this.customTitle;
+    }
+    setCustomTitle(customTitle) {
+        this.customTitle = customTitle;
+    }
+    /**
+     * Re-append the session's metadata entries at EOF, so they stay inside the
+     * tail window the session list reads. Called at the sparse points where the
+     * transcript is about to be read back by another process (exit, compaction,
+     * resume, rewind); doing it per save would cost a tail read plus a line on
+     * every message.
+     */
+    async reAppendSessionMetadata() {
+        try {
+            await reAppendSessionMetadataToFile(this.sessionId, this.workdir, this.customTitle, this.sessionType);
+        }
+        catch (error) {
+            logger?.error("Failed to re-append session metadata:", error);
+        }
+    }
     /**
      * Clear messages
      */
@@ -240,6 +342,9 @@ export class MessageManager {
         this.setSessionId(newSessionId);
         this.setlatestTotalTokens(0);
         this.savedMessageCount = 0; // Reset saved message count
+        // The title belongs to the session that was just abandoned: the new
+        // session id starts untitled until the user renames it.
+        this.customTitle = undefined;
     }
     /**
      * Trigger the rewind UI callback
@@ -250,13 +355,23 @@ export class MessageManager {
     // Initialize state from session data
     initializeFromSession(sessionData) {
         this.setSessionId(sessionData.id);
-        this.setMessages([...sessionData.messages]);
+        // The UI displays the full transcript (pre-compaction history included);
+        // the API context folds at the last compact boundary so the model only
+        // sees messages from the latest summary forward.
+        this.setMessages(sliceFromLastCompact(sessionData.messages), {
+            keepDisplay: true,
+        });
+        this.displayMessages = [...sessionData.messages];
         this.setlatestTotalTokens(sessionData.metadata.latestTotalTokens);
+        // Recovered by the whole-file scan on load: from here on it is the
+        // in-memory fallback that survives the title entry sliding out of the
+        // tail window.
+        this.customTitle = sessionData.metadata.customTitle;
         // Rebuild loadedRuleIds from persisted meta messages (session restore)
         this.rebuildLoadedRuleIds();
         // Set saved message count to the number of loaded messages since they're already saved
         // This must be done after setSessionId which resets it to 0
-        this.savedMessageCount = sessionData.messages.length;
+        this.savedMessageCount = this.messages.length;
     }
     // Encapsulated message operation functions
     addUserMessage(params) {
@@ -398,17 +513,32 @@ export class MessageManager {
         };
         // Build new message array: keep the compacted message and last messages
         const newMessages = [compactMessage, ...lastThreeMessages];
-        // APPEND to the same session file (append-only, like Claude Code)
+        // APPEND only the compact block to the session file (append-only, like
+        // Claude Code). The preserved last API rounds were already written before
+        // compaction (saveSession ran at the start), so re-appending them would
+        // duplicate those lines in the transcript — the loader relies on each
+        // message id appearing exactly once (dedup-skipped, aligned with CC).
         const { appendMessages } = await import("../services/session.js");
-        await appendMessages(this.sessionId, newMessages, this.workdir, this.sessionType);
-        // Update in-memory state
-        this.setMessages(newMessages);
+        await appendMessages(this.sessionId, [compactMessage], this.workdir, this.sessionType);
+        // Compaction leaves the transcript readable by the next process that
+        // lists sessions, so this is a flush point for the metadata entries.
+        await this.reAppendSessionMetadata();
+        // Update in-memory state: the API context folds to [compact, ...last
+        // rounds], while the UI display stream keeps the full history and appends
+        // the compact block at the end.
+        this.setMessages(newMessages, { keepDisplay: true });
+        this.displayMessages = [...this.displayMessages, compactMessage];
         this.savedMessageCount = newMessages.length;
         // Trim recent file read cache so contents compacted away are released
         this.trimRecentFileReads();
         // Clear and rebuild loaded rule IDs from remaining meta messages
         this.clearLoadedRuleIds();
         this.rebuildLoadedRuleIds();
+        // Nested memory has no marker to rebuild from, so the dedup set is dropped
+        // outright: compaction may have summarized the injected text away, and
+        // re-injecting it on the next read of that subtree beats never showing it
+        // again in this session.
+        this.loadedNestedMemoryPaths.clear();
         // Trigger compaction callback
         this.callbacks.onCompactBlockAdded?.(compactedContent);
     }
@@ -425,54 +555,6 @@ export class MessageManager {
             this.callbacks.onFileHistoryBlockAdded?.(snapshots);
         }
     }
-    // Bang related message operations
-    addBangMessage(command) {
-        const updatedMessages = addBangMessage({
-            messages: this.messages,
-            command,
-        });
-        this.setMessages(updatedMessages);
-        // The bang message is appended as the last message
-        const messageId = this.messages[this.messages.length - 1]?.id ?? "";
-        this.callbacks.onAddBangMessage?.(command, messageId);
-    }
-    updateBangMessage(command, output) {
-        const updatedMessages = updateBangInMessage({
-            messages: this.messages,
-            command,
-            output,
-        });
-        this.setMessages(updatedMessages);
-        const messageId = this.findBangMessageId(command) ?? "";
-        this.callbacks.onUpdateBangMessage?.(command, output, messageId);
-    }
-    completeBangMessage(command, exitCode, output) {
-        const updatedMessages = completeBangInMessage({
-            messages: this.messages,
-            command,
-            exitCode,
-            output,
-        });
-        this.setMessages(updatedMessages);
-        const messageId = this.findBangMessageId(command) ?? "";
-        this.callbacks.onCompleteBangMessage?.(command, exitCode, messageId, output?.trim());
-    }
-    /**
-     * Find the message ID of the most recent message containing a bang block
-     * for the given command. Bang callbacks do not carry a block ID, so the
-     * message is located by matching the command against bang blocks.
-     */
-    findBangMessageId(command) {
-        for (let i = this.messages.length - 1; i >= 0; i--) {
-            const message = this.messages[i];
-            if (message.role !== "user")
-                continue;
-            const hasBangBlock = message.blocks?.some((block) => block.type === "bang" && block.command === command);
-            if (hasBangBlock)
-                return message.id;
-        }
-        return undefined;
-    }
     addNotificationMessage(params) {
         const newMessages = addNotificationMessageToMessages({
             messages: this.messages,
@@ -735,12 +817,21 @@ export class MessageManager {
         if (reversionManager && messageIdsToRemove.length > 0) {
             await reversionManager.revertTo(messageIdsToRemove, messages);
         }
-        // Rewrite file with truncated messages (full history kept on disk)
-        await this.rewriteSessionFile(newMessages);
-        // Fold the in-memory messages at the last compact boundary so the agent
-        // only sees messages from the latest compact summary forward — matching
-        // the compact and resume behaviors (which also fold memory).
-        this.setMessages(sliceFromLastCompact(newMessages));
+        // Keep the first `newMessages.length` messages on disk. Note the count is
+        // the message index, not a file operation: the rewrite walks the file's own
+        // lines and carries reserved entries (metadata header, custom-title) over.
+        await this.rewriteSessionFile(newMessages.length);
+        // The rewrite drops messages but keeps the reserved entries where they sit,
+        // which is not enough for the title: the session list reads only the file's
+        // tail window, and a title written early can end up outside it (the
+        // rewrite keeps the *first* messages, so the survivors after it are exactly
+        // what pushes it away). Re-append it at EOF like the other flush points do.
+        await this.reAppendSessionMetadata();
+        // The UI keeps the full truncated thread; the agent context folds at the
+        // last compact boundary so the agent only sees messages from the latest
+        // compact summary forward — matching the compact and resume behaviors.
+        this.setMessages(sliceFromLastCompact(newMessages), { keepDisplay: true });
+        this.displayMessages = newMessages;
         // savedMessageCount tracks in-memory progress, so it must be the folded
         // length. Using the full disk count here would make saveSession's
         // slice(savedMessageCount) empty after a rewind past a compact boundary
@@ -748,18 +839,13 @@ export class MessageManager {
         this.savedMessageCount = this.messages.length;
     }
     /**
-     * Rewrite the session file with the current messages.
+     * Drop everything past the first `keepMessageCount` messages from the
+     * session file. The rewrite is a filter over the file's own lines, so the
+     * metadata header, the user-set title and any other reserved entry survive.
      */
-    async rewriteSessionFile(messages) {
+    async rewriteSessionFile(keepMessageCount) {
         try {
-            const { writeFile } = await import("fs/promises");
-            const content = messages
-                .map((m) => {
-                const { timestamp, ...rest } = m;
-                return JSON.stringify({ timestamp, ...rest });
-            })
-                .join("\n") + (messages.length > 0 ? "\n" : "");
-            await writeFile(this.transcriptPath, content, "utf8");
+            await truncateSession(this.sessionId, keepMessageCount, this.workdir, this.sessionType);
         }
         catch (error) {
             logger?.error("Failed to rewrite session file:", error);
@@ -856,6 +942,10 @@ export class MessageManager {
                         this.invokedSkills.set(skillName, {
                             skillName,
                             timestamp: Date.now(),
+                            // 模型当时实际看到的那份正文（已替换 ${WAVE_SKILL_DIR} 等占位符、
+                            // 首行带 `Base directory for this skill:`）——压缩后回灌直接复用它，
+                            // 不能重新读文件原文（spec core/message-compact 场景 4）。
+                            content: block.result,
                         });
                     }
                 }
@@ -866,15 +956,14 @@ export class MessageManager {
         }
     }
     /**
-     * Get recently invoked skill names, sorted by timestamp (newest first).
+     * Get recently invoked skills, sorted by timestamp (newest first).
      * @param maxSkills - Maximum number of skills to return
-     * @returns Array of skill names sorted by recency
+     * @returns Invoked skill records sorted by recency
      */
-    getInvokedSkillNames(maxSkills = 10) {
-        const sorted = Array.from(this.invokedSkills.entries())
-            .sort(([, a], [, b]) => b.timestamp - a.timestamp)
+    getInvokedSkills(maxSkills = 10) {
+        return Array.from(this.invokedSkills.values())
+            .sort((a, b) => b.timestamp - a.timestamp)
             .slice(0, maxSkills);
-        return sorted.map(([, { skillName }]) => skillName);
     }
     /**
      * Clear all invoked skills (e.g., after compaction).

package/dist/managers/permissionManager.d.ts

@@ -8,9 +8,22 @@
 import type { PermissionDecision, ToolPermissionContext, PermissionCallback, PermissionMode } from "../types/permissions.js";
 import type { Logger } from "../types/index.js";
 import { Container } from "../utils/container.js";
+/**
+ * Resolve an additional-directory config entry to an absolute path.
+ * Supports `~` / `~/` prefixes (expanded against the user home directory,
+ * aligned with Claude Code's expandPath) alongside absolute paths and paths
+ * relative to the working directory.
+ */
+export declare function resolveAdditionalDirectory(dir: string, workdir: string | undefined): string;
 export interface PermissionManagerOptions {
     /** Configured permission mode from settings */
     configuredPermissionMode?: PermissionMode;
+    /**
+     * Session-level bypass authorization (see `captureBypassAuthorization`).
+     * Passed explicitly by subagents so they inherit the parent session's value
+     * instead of re-deriving it from their own (mid-session) mode.
+     */
+    bypassAuthorization?: boolean;
     /** Allowed rules from settings */
     allowedRules?: string[];
     /** Denied rules from settings */
@@ -33,6 +46,15 @@ export interface PermissionManagerOptions {
 export declare class PermissionManager {
     private container;
     private configuredPermissionMode?;
+    /**
+     * Session-level bypass authorization: the permission mode in effect when the
+     * session was created was `bypassPermissions`. Frozen at session start, so a
+     * later mode switch (or config reload) can never grant it. Its only effect is
+     * that plan mode skips permission checks instead of re-asking — mirroring
+     * Claude Code's `isBypassPermissionsModeAvailable`. `undefined` = not
+     * captured yet (subagents get an explicit value instead).
+     */
+    private bypassAuthorization?;
     private allowedRules;
     private deniedRules;
     private instanceAllowedRules;
@@ -66,6 +88,17 @@ export declare class PermissionManager {
      * Get the configured default mode
      */
     getConfiguredPermissionMode(): PermissionMode | undefined;
+    /**
+     * Freeze the session-level bypass authorization from the permission mode in
+     * effect when the session was created (CLI mode > configured default mode >
+     * `default`). No-op once captured, so switching to `bypassPermissions`
+     * mid-session does not grant it.
+     */
+    captureBypassAuthorization(): void;
+    /**
+     * Whether this session keeps bypass semantics while in plan mode
+     */
+    getBypassAuthorization(): boolean;
     /**
      * Get all currently allowed rules (user-defined)
      */
@@ -87,6 +120,13 @@ export declare class PermissionManager {
      * Unlike addPermissionRule, this does NOT persist to settings.local.json.
      */
     addInstanceAllowedRule(rule: string): void;
+    /**
+     * Remove an instance-level allowed rule added via addInstanceAllowedRule.
+     * Used when a builtin plugin that contributed a helper-script grant is
+     * unloaded, so the grant does not outlive the plugin.
+     * @returns true if the rule was present
+     */
+    removeInstanceAllowedRule(rule: string): boolean;
     /**
      * Get all additional directories
      */
@@ -136,6 +176,13 @@ export declare class PermissionManager {
      * Add a system-level additional directory that is persistent across configuration reloads
      */
     addSystemAdditionalDirectory(directory: string): void;
+    /**
+     * Remove a system-level additional directory (idempotent). Used when a
+     * settings.json change revokes a privilege that was granted at construction
+     * time — e.g. turning auto-memory off removes its directory from the safe
+     * zone (core/agent-config.md scenario 6).
+     */
+    removeSystemAdditionalDirectory(directory: string): void;
     /**
      * Set the current plan file path
      */
@@ -192,10 +239,32 @@ export declare class PermissionManager {
      * command substitution, process substitution, or sed -i are auto-allowed.
      */
     private isAutoAllowedPart;
+    /**
+     * Check whether a bash command part takes path arguments (cd or a
+     * path-taking read-only command) that escape the Safe Zone. Used to
+     * disqualify auto-allow via DEFAULT_ALLOWED_RULES and to hide the
+     * "don't ask again" persistence option for out-of-bounds access.
+     */
+    private isOutOfSafeZonePart;
     /**
      * Check if a tool call is allowed by persistent or temporary rules
      */
     private isAllowedByRule;
+    /**
+     * Classify one expanded leaf command. Every leaf of a compound command or
+     * command substitution is judged with the exact rules used for a plain
+     * command, with two structure-aware additions:
+     *
+     *  - a leaf the parser flagged `unsafe` (a bare reference to a variable whose
+     *    value is not statically known, or a command substitution inside the
+     *    leaf's own argument words) is never auto-allowed and never matches the
+     *    built-in default rules — only an explicit allow rule may cover it;
+     *  - `read` (e.g. the condition of `while read …`) only reads stdin, so it
+     *    is treated as safe when it carries no redirection of its own.
+     */
+    private isBashLeafAllowed;
+    /** A context whose Bash command is a single part/leaf text. */
+    private ruleContext;
     /**
      * Expand a bash command into individual permission rules, filtering out safe commands.
      * Used when saving permissions to the allow list.