wave-agent-sdk 1.2.0 → 1.3.0

package/dist/tools/workflowTool.js

@@ -1,5 +1,33 @@
+import * as path from "node:path";
 import { WORKFLOW_TOOL_NAME } from "../constants/tools.js";
+import { parseScript } from "../workflow/scriptRuntime.js";
 import { logger } from "../utils/globalLogger.js";
+/** Characters that would corrupt a single-line summary (ANSI-adjacent controls, separators, invisibles). */
+const SUMMARY_UNSAFE_CHARS = /[\p{Cc}\p{Cf}\p{Cs}\p{Default_Ignorable_Code_Point}\u2028\u2029]/gu;
+/** Max characters of the script head shown when `meta` cannot be parsed. */
+const FALLBACK_SUMMARY_MAX_CHARS = 80;
+function sanitizeForSummary(text) {
+    return text.replace(SUMMARY_UNSAFE_CHARS, "");
+}
+/**
+ * Summary for a script whose `meta` could not be parsed: its first non-empty
+ * line, truncated if needed, plus a hint that more lines follow.
+ */
+function summarizeUnparsedScript(script) {
+    const lines = script.split("\n");
+    const head = sanitizeForSummary(lines.find((line) => line.trim()) ?? "");
+    if (!head) {
+        return "";
+    }
+    const preview = head.length > FALLBACK_SUMMARY_MAX_CHARS
+        ? `${head.slice(0, FALLBACK_SUMMARY_MAX_CHARS - 1)}…`
+        : head;
+    const extraLines = lines.length - 1;
+    if (extraLines <= 0) {
+        return preview;
+    }
+    return `${preview} … +${extraLines} line${extraLines === 1 ? "" : "s"}`;
+}
 /**
  * Workflow tool plugin for executing deterministic multi-subagent orchestration scripts.
  *
@@ -176,15 +204,19 @@ Use this tool for multi-step orchestration where control flow should be determin
         }
     },
     formatCompactParams: (params) => {
-        if (params.scriptPath) {
-            return `scriptPath: ${params.scriptPath}`;
-        }
         const script = params.script;
-        if (script) {
-            // Extract meta.name from the script
-            const nameMatch = script.match(/name:\s*['"]([^'"]+)['"]/);
-            return nameMatch ? nameMatch[1] : script.slice(0, 50) + "...";
+        if (typeof script === "string" && script) {
+            try {
+                return sanitizeForSummary(parseScript(script).meta.description);
+            }
+            catch {
+                return summarizeUnparsedScript(script);
+            }
+        }
+        const scriptPath = params.scriptPath;
+        if (typeof scriptPath === "string" && scriptPath) {
+            return sanitizeForSummary(path.basename(scriptPath));
         }
-        return "workflow";
+        return "";
     },
 };

package/dist/tools/writeTool.js

@@ -1,7 +1,8 @@
-import { readFile, writeFile, mkdir, stat } from "fs/promises";
+import { readFile, mkdir, stat } from "fs/promises";
 import { createHash } from "crypto";
 import { dirname } from "path";
 import { logger } from "../utils/globalLogger.js";
+import { atomicWriteFile } from "../utils/atomicWrite.js";
 import { resolvePath, getDisplayPath } from "../utils/path.js";
 import { READ_TOOL_NAME } from "../constants/tools.js";
 /**
@@ -157,9 +158,10 @@ Usage:
             if (context.reversionManager && context.messageId) {
                 snapshotId = await context.reversionManager.recordSnapshot(context.messageId, resolvedPath, isExistingFile ? "modify" : "create");
             }
-            // Write file
+            // Write file (atomic: temp file + rename, so concurrent readers never
+            // observe a truncated file). Staleness/OCC was checked above.
             try {
-                await writeFile(resolvedPath, content, "utf-8");
+                await atomicWriteFile(resolvedPath, content);
                 // Commit snapshot on success
                 if (context.reversionManager && snapshotId) {
                     await context.reversionManager.commitSnapshot(snapshotId);
@@ -180,6 +182,7 @@ Usage:
                     mtime: newStats.mtime.getTime(),
                     hash,
                     source: "write",
+                    content,
                     offset: undefined,
                     limit: undefined,
                 });

package/dist/types/agent.d.ts

@@ -29,15 +29,24 @@ export interface AgentOptions {
     visionModel?: string;
     maxInputTokens?: number;
     maxTokens?: number;
-    /** Preferred language for agent communication */
+    /**
+     * Preferred language for agent communication, injected verbatim into the
+     * system prompt (`# Language\nAlways respond in <value>`). When unset, the
+     * resolve chain falls back to `DEFAULT_LANGUAGE` (`zh-CN`).
+     */
     language?: string;
     /**
-     * Per-session override for auto-memory extraction (settings-page toggle
-     * value, carried by hosts over stdio). Takes precedence over settings.json
-     * merged config and WAVE_DISABLE_AUTO_MEMORY env; undefined defers to them.
+     * Per-session override for auto-memory extraction (程序化会话级覆盖).
+     * Takes precedence over settings.json merged config and
+     * WAVE_DISABLE_AUTO_MEMORY env; undefined defers to them. 三端设置页的开关
+     * **不**经这一层下发——它落用户级 `~/.wave/settings.json`，由实时重载在下一轮
+     * 生效（spec core/agent-config.md「设置实时重载」）。
      */
     autoMemoryEnabled?: boolean;
-    /** Per-session override for auto-memory extraction frequency (turns). */
+    /**
+     * Per-session override for auto-memory extraction frequency (turns). 同
+     * `autoMemoryEnabled`：设置页的值不在这一层。
+     */
     autoMemoryFrequency?: number;
     callbacks?: AgentCallbacks;
     restoreSessionId?: string;
@@ -119,4 +128,10 @@ export interface AgentCallbacks extends MessageManagerCallbacks, BackgroundTaskM
     onCompactionContentUpdate?: (content: string) => void;
     /** Streaming reasoning from the compaction fork (accumulated). */
     onCompactionReasoningUpdate?: (content: string) => void;
+    /**
+     * Full content of the plan file right after a successful `Write`/`Edit` of
+     * that file (spec: 计划文件更新后刷新计划面板). Hosts use it to refresh an
+     * already-open plan panel; it is not emitted for other files.
+     */
+    onPlanFileUpdated?: (content: string) => void;
 }

package/dist/types/configuration.d.ts

@@ -13,7 +13,6 @@ import type { TelemetryConfig } from "./telemetry.js";
 export type Scope = "user" | "project" | "local";
 export interface MarketplaceConfig {
     source: MarketplaceSource;
-    autoUpdate?: boolean;
 }
 /**
  * Root configuration structure for all Wave Agent settings including hooks and environment variables
@@ -62,6 +61,8 @@ export interface WaveConfiguration {
     };
     /** Whether the Artifact tool is enabled. Unset follows the code default constant (ARTIFACT_DEFAULT_ENABLED). */
     enableArtifact?: boolean;
+    /** Whether the Exec tool is enabled. Unset follows the code default constant (EXEC_DEFAULT_ENABLED). */
+    enableExec?: boolean;
     /**
      * Session transcript retention in days (aligned with Claude Code's
      * cleanupPeriodDays). Session jsonl files in ~/.wave/projects older than
@@ -70,6 +71,43 @@ export interface WaveConfiguration {
      */
     cleanupPeriodDays?: number;
 }
+/**
+ * 设置页读写的用户偏好子集（落点 = 用户级 `~/.wave/settings.json`；读写实现见
+ * `utils/userSettings.ts`）。三端（VSCE / JetBrains / desktop）设置页与 CLI 的
+ * `getUserSettings` / `updateUserSettings` RPC 共用这一形状；`contextLength` 单位
+ * 为 K（落盘换算为 `env.WAVE_MAX_INPUT_TOKENS`）。
+ */
+export interface UserPreferenceSettings {
+    /** AI 回复语言（settings.json 顶层 `language`，如 zh-CN / en-US）。 */
+    language?: string;
+    /** 上下文长度，单位 K（如 200 = 200K）。 */
+    contextLength?: number;
+    /** 是否开启自动记忆提取。 */
+    autoMemoryEnabled?: boolean;
+    /** 自动记忆提取的轮次频率（1–100）。 */
+    autoMemoryFrequency?: number;
+    /** Wave 服务端地址（settings.json 的 `env.WAVE_SERVER_URL`，如 https://…）。 */
+    serverUrl?: string;
+}
+/** 用户偏好键（设置页控件）。 */
+export type UserPreferenceKey = keyof UserPreferenceSettings;
+/**
+ * 生效值的来源层。只归因**进程级可达**的层（Remote 组织下发 / 用户级文件 /
+ * 机器环境变量 / SDK 默认）：`project` / `local` 需要 workdir，而
+ * `getUserSettings` 是刻意的无会话全局 RPC；`override` / `options` 是会话级
+ * 语义，不在这条链路上（见 spec core/agent-config.md 边界说明「用户偏好的层与来源」）。
+ */
+export type UserPreferenceSource = "remote" | "user" | "env" | "default";
+/**
+ * `getUserSettings` / `updateUserSettings` 的回包：**生效**用户偏好——键缺失
+ * 表示该偏好没有任何提供者（设置页据此显示「未设置」态）——外加每个键的来源层
+ * （`preferenceSources`，设置页对来源为 `remote` 的键显示生效值 + 置灰 +
+ * 「由组织配置管理」）。
+ */
+export interface UserPreferenceSettingsView extends UserPreferenceSettings {
+    /** 每个键恒有来源（缺省即 `default`）。 */
+    preferenceSources?: Partial<Record<UserPreferenceKey, UserPreferenceSource>>;
+}
 /**
  * Legacy alias for backward compatibility - will be deprecated
  */

package/dist/types/marketplace.d.ts

@@ -3,18 +3,47 @@ export interface MarketplaceOwner {
     name: string;
     email?: string;
 }
+/**
+ * Object form of a plugin entry's `source` (spec plugin A-021): `url` is a whole
+ * repository, `git-subdir` is a subdirectory of one. Both are outside the
+ * marketplace checkout, so they carry no readable local copy for「最新版本」(A-010).
+ */
+export interface MarketplacePluginObjectSource {
+    source: "url" | "git-subdir";
+    url: string;
+    /** Only for `git-subdir`: path of the plugin inside the repository. */
+    path?: string;
+    /** Branch or tag. */
+    ref?: string;
+    /** Pinned commit; checked out after cloning. */
+    sha?: string;
+}
 export interface MarketplacePluginEntry {
     name: string;
-    source: string;
+    source: string | MarketplacePluginObjectSource;
     description: string;
 }
 export interface MarketplacePluginStatus extends MarketplacePluginEntry {
     marketplace: string;
     installed: boolean;
+    /** 已安装版本（未安装时 undefined） */
     version?: string;
+    /**
+     * 市场内该插件当前可安装的最新版本，取自市场检出目录内插件的
+     * `.wave-plugin/plugin.json`（兼容 `.claude-plugin/plugin.json`）。
+     * 插件来源是独立 Git 仓库等无法就地读取清单的情况为 undefined
+     * （spec plugin A-010：此时不展示最新版本）。
+     */
+    latestVersion?: string;
     cachePath?: string;
     projectPath?: string;
     scope?: Scope;
+    /**
+     * 该插件由组织的托管配置（远端托管设置）声明启用：成员不能卸载或禁用它，
+     * 界面据此把卸载入口判为不可用并给出由组织管理的说明（spec plugin A-024）。
+     * 判据只看下发值，本机不落任何标记。
+     */
+    managed?: boolean;
 }
 export interface MarketplaceManifest {
     name: string;
@@ -37,7 +66,6 @@ export interface KnownMarketplace {
     name: string;
     source: MarketplaceSource;
     isBuiltin?: boolean;
-    autoUpdate?: boolean;
     lastUpdated?: string;
     /** The scope where this marketplace was declared (user, project, local, or builtin) */
     declaredScope?: "user" | "project" | "local" | "builtin";
@@ -46,12 +74,22 @@ export interface KnownMarketplacesRegistry {
     builtinSeeded?: boolean;
     marketplaces: KnownMarketplace[];
 }
+/**
+ * 安装产物的记账位置（spec plugin A-015）：用户作用域是本机全局的，不带
+ * projectPath；项目作用域与本地作用域归属某个仓库，以该仓库路径为 projectPath。
+ */
+export interface PluginInstallLocation {
+    scope: Scope;
+    projectPath?: string;
+}
 export interface InstalledPlugin {
     name: string;
     marketplace: string;
     version: string;
     cachePath: string;
+    /** 该条安装记录所属的作用域；引入作用域维度之前写入的历史记录不带此字段（spec plugin A-015）。 */
     scope?: Scope;
+    /** 项目作用域与本地作用域所属仓库的路径；用户作用域不带。 */
     projectPath?: string;
 }
 export interface InstalledPluginsRegistry {

package/dist/types/mcp.d.ts

@@ -19,6 +19,34 @@ export interface McpTool {
     name: string;
     description?: string;
     inputSchema: Record<string, unknown>;
+    /**
+     * The schema the server declared for its *output*, raw as listed. Not passed
+     * through `cleanSchema` like `inputSchema`: that cleaning exists because the
+     * input schema travels inside a request, and this one is only ever rendered as
+     * a return type. Absent for most servers today, and degenerate
+     * (`{ type: "object" }`) when present.
+     */
+    outputSchema?: Record<string, unknown>;
+}
+/**
+ * What one MCP tool call produced. Two audiences, two fields:
+ *
+ * - `content` is the display text the flat path hands the model — a placeholder
+ *   when the tool said nothing (`No content`) or returned only images.
+ * - `output` is what a sandbox `await` resolves to: the server's
+ *   `structuredContent` when it returned one, otherwise its text, otherwise
+ *   `null`. The catalog renders its return types from this same rule, so a
+ *   signature can never promise a shape the sandbox does not deliver.
+ */
+export interface McpToolCallResult {
+    success: boolean;
+    content: string;
+    output: unknown;
+    serverName?: string;
+    images?: Array<{
+        data: string;
+        mediaType?: string;
+    }>;
 }
 export interface McpServerStatus {
     name: string;
@@ -32,6 +60,17 @@ export interface McpServerStatus {
     tools?: McpTool[];
     toolCount?: number;
     capabilities?: string[];
+    /**
+     * Usage notes the server described about itself during `initialize`
+     * (`instructions`): rate limits, preconditions, how the server is meant to be
+     * used. Server-level prose, announced once in the conversation instead of the
+     * system prompt — see `utils/mcpInstructions.ts` for why, and for the per-server
+     * cap — and already truncated by the time it lands here, unlike a tool
+     * description, which the catalog compresses.
+     * Retained across a reconnecting server (like `tools`) and cleared once the
+     * server is gone, so a dropped server cannot keep talking to the model.
+     */
+    instructions?: string;
     lastConnected?: number;
     error?: string;
 }

package/dist/types/permissions.d.ts

@@ -15,6 +15,8 @@ export interface PermissionDecision {
     newPermissionMode?: PermissionMode;
     /** Signal to persist a new allowed rule */
     newPermissionRule?: string;
+    /** Signal to add a directory to this session's Safe Zone (not persisted) */
+    newAdditionalDirectory?: string;
 }
 /** Callback function for custom permission logic */
 export type PermissionCallback = (context: ToolPermissionContext) => Promise<PermissionDecision>;
@@ -32,6 +34,12 @@ export interface ToolPermissionContext {
     suggestedPrefix?: string;
     /** Whether to hide the persistent permission option (e.g., "Don't ask again") in the UI */
     hidePersistentOption?: boolean;
+    /**
+     * Absolute path of the directory holding an out-of-Safe-Zone target, set for
+     * Edit/Write when the target lies outside the Safe Zone. Lets the confirmation
+     * UI offer adding that directory to the session Safe Zone.
+     */
+    outsideSafeZoneDirectory?: string;
     /** The ID of the tool call that triggered this permission request */
     toolCallId?: string;
     /** The content of the plan being exited from */
@@ -41,6 +49,20 @@ export interface ToolPermissionContext {
 }
 /** List of tools that require permission checks in default mode */
 export declare const RESTRICTED_TOOLS: readonly ["Edit", "Bash", "Write", "EnterPlanMode", "ExitPlanMode", "AskUserQuestion", "Artifact"];
+/**
+ * Tools that must still reach the user when permission checks are bypassed
+ * (`bypassPermissions` mode, or `plan` mode in a session holding the bypass
+ * authorization) — aligned with Claude Code's `requiresUserInteraction`:
+ * its permission pipeline returns the tool's own ask result before the
+ * bypass step can allow it.
+ *
+ * - `AskUserQuestion`: the tool *is* the question; bypassing it would strand
+ *   the agent without an answer.
+ * - `ExitPlanMode`: leaving plan mode is the user's approval of the plan, so
+ *   it stays a user decision even in a "don't ask me" session. This is the
+ *   one remaining gate on plan mode for such sessions (see plan-mode.md).
+ */
+export declare const USER_INTERACTION_REQUIRED_TOOLS: readonly ["AskUserQuestion", "ExitPlanMode"];
 /** Type for restricted tool names */
 export type RestrictedTool = (typeof RESTRICTED_TOOLS)[number];
 export declare const OPERATION_CANCELLED_BY_USER = "Operation cancelled by user";

package/dist/types/permissions.js

@@ -13,4 +13,21 @@ export const RESTRICTED_TOOLS = [
     ASK_USER_QUESTION_TOOL_NAME,
     ARTIFACT_TOOL_NAME,
 ];
+/**
+ * Tools that must still reach the user when permission checks are bypassed
+ * (`bypassPermissions` mode, or `plan` mode in a session holding the bypass
+ * authorization) — aligned with Claude Code's `requiresUserInteraction`:
+ * its permission pipeline returns the tool's own ask result before the
+ * bypass step can allow it.
+ *
+ * - `AskUserQuestion`: the tool *is* the question; bypassing it would strand
+ *   the agent without an answer.
+ * - `ExitPlanMode`: leaving plan mode is the user's approval of the plan, so
+ *   it stays a user decision even in a "don't ask me" session. This is the
+ *   one remaining gate on plan mode for such sessions (see plan-mode.md).
+ */
+export const USER_INTERACTION_REQUIRED_TOOLS = [
+    ASK_USER_QUESTION_TOOL_NAME,
+    EXIT_PLAN_MODE_TOOL_NAME,
+];
 export const OPERATION_CANCELLED_BY_USER = "Operation cancelled by user";

package/dist/types/plugins.d.ts

@@ -1,7 +1,7 @@
 import { CustomSlashCommand } from "./commands.js";
 import { Skill } from "./skills.js";
 import { LspConfig } from "./lsp.js";
-import { McpConfig } from "./mcp.js";
+import { McpConfig, McpServerConfig } from "./mcp.js";
 import { PartialHookConfiguration } from "./configuration.js";
 import { SubagentConfiguration } from "../utils/subagentParser.js";
 /**
@@ -10,10 +10,20 @@ import { SubagentConfiguration } from "../utils/subagentParser.js";
 export interface PluginManifest {
     name: string;
     description: string;
-    version: string;
+    /**
+     * Optional: plugins in the Claude Code ecosystem often omit it (spec plugin
+     * A-022). Install and load both fall back to `1.0.0`.
+     */
+    version?: string;
     author?: {
         name: string;
     };
+    /**
+     * Inline MCP server declarations, equivalent to a sibling `.mcp.json`
+     * (spec plugin A-023). Claude Code also allows a path string or array of
+     * paths here; only the object form is supported.
+     */
+    mcpServers?: Record<string, McpServerConfig>;
 }
 /**
  * Plugin configuration in AgentOptions or wave.settings.json
@@ -22,10 +32,24 @@ export interface PluginConfig {
     type: "local";
     path: string;
 }
+/** A plugin root that failed to load during the most recent load/reload. */
+export interface PluginLoadFailure {
+    path: string;
+    error: string;
+}
+/** Result of `Agent.reloadPlugins()` / `PluginManager.reloadAllPlugins()`. */
+export interface PluginReloadResult {
+    /** Plugin names loaded after the reload. */
+    plugins: string[];
+    /** Plugins that could not be loaded; the reload does not roll back. */
+    failures: PluginLoadFailure[];
+}
 /**
  * Represents a loaded plugin in the system
  */
 export interface Plugin extends PluginManifest {
+    /** Always resolved on load: a missing manifest version becomes `1.0.0` (A-022). */
+    version: string;
     path: string;
     commands: CustomSlashCommand[];
     skills: Skill[];

package/dist/types/skills.d.ts

@@ -91,6 +91,21 @@ export interface SkillParseOptions {
     validateMetadata?: boolean;
     basePath?: string;
 }
+/**
+ * A skill invocation recorded for context restoration (post-compaction
+ * re-injection, spec core/message-compact 场景 4).
+ */
+export interface InvokedSkillRecord {
+    skillName: string;
+    timestamp: number;
+    /**
+     * The content the model actually saw when the skill was invoked — directory
+     * placeholders already substituted, prefixed with
+     * `Base directory for this skill: <path>`. Re-injecting the raw SKILL.md
+     * instead would hand the model a literal `${WAVE_SKILL_DIR}`.
+     */
+    content?: string;
+}
 export declare const SKILL_DEFAULTS: {
     readonly PERSONAL_SKILLS_DIR: ".wave/skills";
     readonly PROJECT_SKILLS_DIR: ".wave/skills";

package/dist/utils/constants.d.ts

@@ -23,6 +23,16 @@ export declare const USER_MEMORY_FILE: string;
  */
 export declare const DEFAULT_WAVE_MAX_INPUT_TOKENS = 200000;
 export declare const DEFAULT_WAVE_MAX_OUTPUT_TOKENS = 32000;
+/**
+ * AI 回复语言的默认值（未设置 `language` 时生效）。
+ *
+ * 取值必须与设置页「AI 回复语言」下拉的默认项是同一个串（webview
+ * `SettingsPage.tsx` 的 `zh-CN` / `en-US`），否则未设置时会出现「设置页显示中文、
+ * 实际生效却不是中文」的分叉（spec core/agent-config.md 边界说明「语言默认值」：
+ * 未设置时 **显示 ≡ 生效**）。该值原样注入系统提示的
+ * `# Language\nAlways respond in <值>` 指令。
+ */
+export declare const DEFAULT_LANGUAGE = "zh-CN";
 /**
  * Default server URL for SSO authentication.
  * Overridden by WAVE_SERVER_URL env var or programmatic AgentOptions.serverUrl.

package/dist/utils/constants.js

@@ -25,6 +25,16 @@ export const USER_MEMORY_FILE = path.join(DATA_DIRECTORY, "AGENTS.md");
  */
 export const DEFAULT_WAVE_MAX_INPUT_TOKENS = 200000; // Default token limit
 export const DEFAULT_WAVE_MAX_OUTPUT_TOKENS = 32000; // Default output token limit (aligned with Claude Code)
+/**
+ * AI 回复语言的默认值（未设置 `language` 时生效）。
+ *
+ * 取值必须与设置页「AI 回复语言」下拉的默认项是同一个串（webview
+ * `SettingsPage.tsx` 的 `zh-CN` / `en-US`），否则未设置时会出现「设置页显示中文、
+ * 实际生效却不是中文」的分叉（spec core/agent-config.md 边界说明「语言默认值」：
+ * 未设置时 **显示 ≡ 生效**）。该值原样注入系统提示的
+ * `# Language\nAlways respond in <值>` 指令。
+ */
+export const DEFAULT_LANGUAGE = "zh-CN";
 /**
  * Default server URL for SSO authentication.
  * Overridden by WAVE_SERVER_URL env var or programmatic AgentOptions.serverUrl.

package/dist/utils/containerSetup.js

@@ -28,6 +28,8 @@ import { MemoryService } from "../services/memory.js";
 import { AutoMemoryService } from "../services/autoMemoryService.js";
 import { USER_MEMORY_FILE } from "./constants.js";
 import { getGitMainRepoRoot } from "./gitUtils.js";
+import { toPosixPath } from "./path.js";
+import { EDIT_TOOL_NAME, WRITE_TOOL_NAME } from "../constants/tools.js";
 import { AsyncWorkRegistry } from "./asyncWorkRegistry.js";
 import { logger } from "./globalLogger.js";
 import { authService } from "../services/authService.js";
@@ -211,6 +213,19 @@ export function setupAgentContainer(setupOptions) {
             if (decision.newPermissionRule) {
                 await addPermissionRule(decision.newPermissionRule);
             }
+            if (decision.newAdditionalDirectory) {
+                // Session-level only: the user approved this directory from the
+                // confirmation dialog (never persisted to settings).
+                permissionManager.addInstanceAdditionalDirectory(decision.newAdditionalDirectory);
+                // The dialog option is "允许本会话编辑 <目录名>/" — it has to cover
+                // later edits too, otherwise `default` mode would keep prompting for
+                // every Write/Edit in that directory. Forward slashes: minimatch
+                // treats the pattern `\` as an escape, while it normalises the input
+                // path's separators on Windows.
+                const pattern = `${toPosixPath(decision.newAdditionalDirectory)}/**`;
+                permissionManager.addInstanceAllowedRule(`${EDIT_TOOL_NAME}(${pattern})`);
+                permissionManager.addInstanceAllowedRule(`${WRITE_TOOL_NAME}(${pattern})`);
+            }
             return decision;
         }
         : undefined;
@@ -248,13 +263,41 @@ export function setupAgentContainer(setupOptions) {
         },
     });
     container.register("LiveConfigManager", liveConfigManager);
+    // The turn-scoped configuration snapshot is held by LiveConfigManager (it owns
+    // the turn boundaries and the live reload) and read by ConfigurationService's
+    // resolve chain, so a mid-turn settings.json change applies from the next turn
+    // instead of shifting values under the running one.
+    configurationService.setTurnSnapshotSource(() => liveConfigManager.getTurnSnapshot());
     // Wire up remote settings hot-update: when polling detects changed settings,
     // reload configuration so admin changes propagate to the running agent.
     // The callback strongly captures the per-agent LiveConfigManager, so it MUST
     // be unsubscribed in destroy() via teardown — otherwise the module-level
     // callback array pins the whole agent object graph.
+    // Managed plugin config (enabledPlugins / marketplaces) last applied to the
+    // plugin subsystem, keyed by a JSON signature: a synced change that touches
+    // neither field must not bounce every plugin's MCP servers.
+    const remoteAtSetup = remoteSettingsService.getRemoteSettingsSync();
+    let managedPluginSignature = JSON.stringify([
+        remoteAtSetup?.enabledPlugins ?? null,
+        remoteAtSetup?.marketplaces ?? null,
+    ]);
     teardowns.push(remoteSettingsService.onSettingsUpdate(async () => {
         await liveConfigManager.reload();
+        // Managed settings also drive plugin installation and loading: a synced
+        // change to `enabledPlugins` / `marketplaces` must re-read the plugins in
+        // place, otherwise an admin push would only take effect after a restart
+        // (spec enterprise server-managed-config「托管配置下发插件市场与启用列表」
+        // 场景 1 与 3).
+        const remote = remoteSettingsService.getRemoteSettingsSync();
+        const signature = JSON.stringify([
+            remote?.enabledPlugins ?? null,
+            remote?.marketplaces ?? null,
+        ]);
+        if (signature === managedPluginSignature) {
+            return;
+        }
+        managedPluginSignature = signature;
+        await container.get("PluginManager")?.reloadAllPlugins();
     }));
     const subagentManager = new SubagentManager(container, {
         workdir,

package/dist/utils/convertMessagesForAPI.d.ts

@@ -10,8 +10,14 @@ export interface ConvertMessagesOptions {
 /**
  * Convert message format to API call format, stopping when a compacted message is encountered.
  * Messages with no meaningful content or tool calls are filtered out.
+ *
+ * Async because every outbound image is routed through `planOutboundImage`,
+ * which may have to re-encode an oversized image with the optional `sharp`
+ * codec (`utils/imageRewrite.ts`). Images that are already inside the budget —
+ * the common case — take a synchronous fast path and come out byte-identical.
+ *
  * @param messages Message list
  * @param options Optional conversion options (e.g. supportsVision)
  * @returns Converted API message format list
  */
-export declare function convertMessagesForAPI(messages: Message[], options?: ConvertMessagesOptions): ChatCompletionMessageParam[];
+export declare function convertMessagesForAPI(messages: Message[], options?: ConvertMessagesOptions): Promise<ChatCompletionMessageParam[]>;