wave-agent-sdk 1.0.3 → 1.0.4

package/dist/agent.d.ts

@@ -299,6 +299,25 @@ export declare class Agent {
         path: string;
         mimeType: string;
     }>): Promise<void>;
+    /**
+     * Add an additional directory to the Safe Zone for this session.
+     *
+     * The directory immediately becomes part of the Safe Zone (permission
+     * checks and the system prompt), and with `remember: true` it is also
+     * persisted to `.wave/settings.local.json` `permissions.additionalDirectories`
+     * so future sessions pick it up automatically.
+     *
+     * @param directory Path of the directory to add (relative paths resolve against the workdir).
+     * @param options.remember Whether to persist the directory across sessions.
+     */
+    addAdditionalDirectory(directory: string, options?: {
+        remember?: boolean;
+    }): Promise<void>;
+    /**
+     * Get the effective additional directories for this session (config +
+     * session-level union), matching what is listed in the system prompt.
+     */
+    getAdditionalDirectories(): string[];
     /** Get all MCP server status */
     getMcpServers(): McpServerStatus[];
     /** Connect MCP server */

package/dist/agent.js

@@ -1,5 +1,6 @@
 import { LspManager } from "./managers/lspManager.js";
 import { configValidator } from "./utils/configValidator.js";
+import path from "node:path";
 import { parseTaskNotificationXml } from "./utils/notificationXml.js";
 import { InitializationService } from "./services/initializationService.js";
 import { InteractionService } from "./services/interactionService.js";
@@ -790,6 +791,34 @@ export class Agent {
             abortMessage: () => this.abortMessage(),
         }, content, images);
     }
+    // ========== Additional Directories ==========
+    /**
+     * Add an additional directory to the Safe Zone for this session.
+     *
+     * The directory immediately becomes part of the Safe Zone (permission
+     * checks and the system prompt), and with `remember: true` it is also
+     * persisted to `.wave/settings.local.json` `permissions.additionalDirectories`
+     * so future sessions pick it up automatically.
+     *
+     * @param directory Path of the directory to add (relative paths resolve against the workdir).
+     * @param options.remember Whether to persist the directory across sessions.
+     */
+    async addAdditionalDirectory(directory, options) {
+        const resolvedPath = path.isAbsolute(directory)
+            ? directory
+            : path.resolve(this.workdir, directory);
+        this.permissionManager.addInstanceAdditionalDirectory(resolvedPath);
+        if (options?.remember) {
+            await this.configurationService.addAdditionalDirectory(this.workdir, resolvedPath);
+        }
+    }
+    /**
+     * Get the effective additional directories for this session (config +
+     * session-level union), matching what is listed in the system prompt.
+     */
+    getAdditionalDirectories() {
+        return this.permissionManager.getEffectiveAdditionalDirectories();
+    }
     // ========== MCP Management Methods ==========
     /** Get all MCP server status */
     getMcpServers() {

package/dist/managers/aiManager.js

@@ -482,6 +482,7 @@ export class AIManager {
             language: this.getLanguage(),
             isSubagent: !!this.subagentType,
             worktreeSession: this.getWorktreeSession(),
+            additionalWorkingDirectories: this.permissionManager?.getEffectiveAdditionalDirectories?.() ?? [],
             autoMemory: autoMemoryOptions,
         });
     }

package/dist/managers/permissionManager.d.ts

@@ -21,6 +21,8 @@ export interface PermissionManagerOptions {
     instanceDeniedRules?: string[];
     /** Additional directories considered part of the Safe Zone */
     additionalDirectories?: string[];
+    /** Instance-specific additional directories (from AgentOptions, session-level) */
+    instanceAdditionalDirectories?: string[];
     /** System additional directories (persistent across reloads) */
     systemAdditionalDirectories?: string[];
     /** Path to the current plan file */
@@ -37,6 +39,7 @@ export declare class PermissionManager {
     private instanceDeniedRules;
     private temporaryRules;
     private additionalDirectories;
+    private instanceAdditionalDirectories;
     private systemAdditionalDirectories;
     private planFilePath?;
     private hasExitedPlanMode;
@@ -83,6 +86,15 @@ export declare class PermissionManager {
      * Get all additional directories
      */
     getAdditionalDirectories(): string[];
+    /**
+     * Get all instance-specific additional directories (session-level, from AgentOptions or /add-dir)
+     */
+    getInstanceAdditionalDirectories(): string[];
+    /**
+     * Get the effective union of additional directories (config + instance, deduplicated).
+     * This is the data source for system prompt injection and Safe Zone checks.
+     */
+    getEffectiveAdditionalDirectories(): string[];
     /**
      * Get all system additional directories
      */
@@ -111,6 +123,10 @@ export declare class PermissionManager {
      * Update the additional directories (e.g., when configuration reloads)
      */
     updateAdditionalDirectories(directories: string[]): void;
+    /**
+     * Add an instance-level additional directory (session-level, e.g. /add-dir command)
+     */
+    addInstanceAdditionalDirectory(directory: string): void;
     /**
      * Add a system-level additional directory that is persistent across configuration reloads
      */

package/dist/managers/permissionManager.js

@@ -63,6 +63,7 @@ export class PermissionManager {
         this.instanceDeniedRules = [];
         this.temporaryRules = [];
         this.additionalDirectories = [];
+        this.instanceAdditionalDirectories = [];
         this.systemAdditionalDirectories = [];
         this.hasExitedPlanMode = false;
         this.needsPlanModeExitAttachment = false;
@@ -73,13 +74,17 @@ export class PermissionManager {
         this.instanceDeniedRules = options.instanceDeniedRules || [];
         this.planFilePath = options.planFilePath;
         this._logger = options.logger;
+        // Read workdir first so relative additional directories resolve against it.
+        this.workdir = this.container.get("Workdir");
+        this.worktreeName = this.container.get("WorktreeName");
+        this.mainRepoRoot = this.container.get("MainRepoRoot");
         this.updateAdditionalDirectories(options.additionalDirectories || []);
+        for (const dir of options.instanceAdditionalDirectories || []) {
+            this.addInstanceAdditionalDirectory(dir);
+        }
         for (const dir of options.systemAdditionalDirectories || []) {
             this.addSystemAdditionalDirectory(dir);
         }
-        this.workdir = this.container.get("Workdir");
-        this.worktreeName = this.container.get("WorktreeName");
-        this.mainRepoRoot = this.container.get("MainRepoRoot");
     }
     /**
      * Resolve the working directory from the DI container
@@ -141,6 +146,30 @@ export class PermissionManager {
     getAdditionalDirectories() {
         return [...this.additionalDirectories];
     }
+    /**
+     * Get all instance-specific additional directories (session-level, from AgentOptions or /add-dir)
+     */
+    getInstanceAdditionalDirectories() {
+        return [...this.instanceAdditionalDirectories];
+    }
+    /**
+     * Get the effective union of additional directories (config + instance, deduplicated).
+     * This is the data source for system prompt injection and Safe Zone checks.
+     */
+    getEffectiveAdditionalDirectories() {
+        const seen = new Set();
+        const result = [];
+        for (const dir of [
+            ...this.additionalDirectories,
+            ...this.instanceAdditionalDirectories,
+        ]) {
+            if (!seen.has(dir)) {
+                seen.add(dir);
+                result.push(dir);
+            }
+        }
+        return result;
+    }
     /**
      * Get all system additional directories
      */
@@ -189,6 +218,18 @@ export class PermissionManager {
             return path.resolve(dir);
         });
     }
+    /**
+     * Add an instance-level additional directory (session-level, e.g. /add-dir command)
+     */
+    addInstanceAdditionalDirectory(directory) {
+        const workdir = this.workdir;
+        const resolvedPath = workdir && !path.isAbsolute(directory)
+            ? path.resolve(workdir, directory)
+            : path.resolve(directory);
+        if (!this.instanceAdditionalDirectories.includes(resolvedPath)) {
+            this.instanceAdditionalDirectories.push(resolvedPath);
+        }
+    }
     /**
      * Add a system-level additional directory that is persistent across configuration reloads
      */
@@ -250,6 +291,12 @@ export class PermissionManager {
                 return { isInside: true, resolvedPath: absolutePath };
             }
         }
+        // Check instance additional directories
+        for (const dir of this.instanceAdditionalDirectories) {
+            if (isPathInside(absolutePath, dir)) {
+                return { isInside: true, resolvedPath: absolutePath };
+            }
+        }
         // Check system additional directories
         for (const dir of this.systemAdditionalDirectories) {
             if (isPathInside(absolutePath, dir)) {

package/dist/managers/subagentManager.js

@@ -178,6 +178,7 @@ export class SubagentManager {
                 TASK_LIST_TOOL_NAME,
             ],
             additionalDirectories: parentPermissionManager?.getAdditionalDirectories(),
+            instanceAdditionalDirectories: parentPermissionManager?.getInstanceAdditionalDirectories?.(),
             systemAdditionalDirectories: parentPermissionManager?.getSystemAdditionalDirectories(),
             planFilePath: parentPermissionManager?.getPlanFilePath(),
         });

package/dist/prompts/index.d.ts

@@ -40,6 +40,7 @@ export declare function buildSystemPrompt(basePrompt: string | undefined, tools:
     language?: string;
     isSubagent?: boolean;
     worktreeSession?: WorktreeSession | null;
+    additionalWorkingDirectories?: string[];
     autoMemory?: {
         directory: string;
         content: string;

package/dist/prompts/index.js

@@ -346,10 +346,14 @@ export function buildSystemPrompt(basePrompt, tools, options = {}) {
         const osVersion = getUnameSR();
         const primaryWorkdir = options.originalWorkdir ?? options.workdir;
         const worktreeSession = options.worktreeSession;
+        const additionalWorkingDirectories = options.additionalWorkingDirectories || [];
         if (options.isSubagent) {
             // Subagent env section, aligned with Claude Code's computeEnvInfo() +
             // enhanceSystemPromptWithEnvDetails() (without the model description and
             // knowledge cutoff lines, which Wave does not use).
+            const additionalDirsInfo = additionalWorkingDirectories.length > 0
+                ? `Additional working directories: ${additionalWorkingDirectories.join(", ")}\n`
+                : "";
             dynamicText += `
 
 ${SUBAGENT_ENV_NOTES}
@@ -358,7 +362,7 @@ Here is useful information about the environment you are running in:
 <env>
 Working directory: ${primaryWorkdir}
 Is directory a git repo: ${isGitRepo}
-Platform: ${platform}
+${additionalDirsInfo}Platform: ${platform}
 ${shellInfo}
 OS Version: ${osVersion}
 </env>
@@ -374,6 +378,12 @@ OS Version: ${osVersion}
                     ? `This is a git worktree — an isolated copy of the repository. Run all commands from this directory. Do NOT \`cd\` to the original repository root.`
                     : null,
                 `Is a git repository: ${isGitRepo}`,
+                additionalWorkingDirectories.length > 0
+                    ? `Additional working directories:`
+                    : null,
+                additionalWorkingDirectories.length > 0
+                    ? additionalWorkingDirectories
+                    : null,
                 `Platform: ${platform}`,
                 shellInfo,
                 `OS Version: ${osVersion}`,
@@ -381,7 +391,9 @@ OS Version: ${osVersion}
             const envBlock = [
                 `# Environment`,
                 `You have been invoked in the following environment: `,
-                ...envItems.map((item) => ` - ${item}`),
+                ...envItems.flatMap((item) => Array.isArray(item)
+                    ? item.map((subItem) => `  - ${subItem}`)
+                    : [` - ${item}`]),
             ].join("\n");
             dynamicText += `\n\n${envBlock}`;
         }

package/dist/services/configurationService.d.ts

@@ -144,6 +144,11 @@ export declare class ConfigurationService {
      * Add a permission rule to the local settings.local.json
      */
     addAllowedRule(workdir: string, rule: string): Promise<void>;
+    /**
+     * Add an additional directory to the local settings.local.json
+     * `permissions.additionalDirectories`, so it persists across sessions.
+     */
+    addAdditionalDirectory(workdir: string, directory: string): Promise<void>;
     /**
      * Update the enabled state of a plugin in the specified scope
      */

package/dist/services/configurationService.js

@@ -741,6 +741,39 @@ export class ConfigurationService {
             await atomicWriteFile(localConfigPath, JSON.stringify(config, null, 2));
         }
     }
+    /**
+     * Add an additional directory to the local settings.local.json
+     * `permissions.additionalDirectories`, so it persists across sessions.
+     */
+    async addAdditionalDirectory(workdir, directory) {
+        const localConfigPath = path.join(workdir, ".wave", "settings.local.json");
+        // Ensure .wave directory exists
+        const waveDir = path.join(workdir, ".wave");
+        ensureWaveRuntimeFilesExcluded(workdir);
+        if (!existsSync(waveDir)) {
+            await fs.mkdir(waveDir, { recursive: true });
+        }
+        let config = {};
+        if (existsSync(localConfigPath)) {
+            try {
+                const content = await fs.readFile(localConfigPath, "utf-8");
+                config = JSON.parse(content);
+            }
+            catch {
+                // If file is corrupted, start with empty config
+            }
+        }
+        if (!config.permissions) {
+            config.permissions = {};
+        }
+        if (!config.permissions.additionalDirectories) {
+            config.permissions.additionalDirectories = [];
+        }
+        if (!config.permissions.additionalDirectories.includes(directory)) {
+            config.permissions.additionalDirectories.push(directory);
+            await atomicWriteFile(localConfigPath, JSON.stringify(config, null, 2));
+        }
+    }
     /**
      * Update the enabled state of a plugin in the specified scope
      */

package/dist/types/agent.d.ts

@@ -72,6 +72,12 @@ export interface AgentOptions {
      * These rules follow the standard permission rule syntax: `ToolName` or `ToolName(pattern)`.
      */
     disallowedTools?: string[];
+    /**
+     * Optional list of additional directories to include in the Safe Zone
+     * for this agent session. These directories are listed in the system
+     * prompt and treated as safe for file operations (e.g. in acceptEdits mode).
+     */
+    additionalDirectories?: string[];
     /**
      * Optional MCP server configs to connect at startup.
      * Overrides .mcp.json for specified server names.

package/dist/utils/containerSetup.js

@@ -115,6 +115,7 @@ export function setupAgentContainer(setupOptions) {
     const permissionManager = new PermissionManager(container, {
         instanceAllowedRules: options.allowedTools,
         instanceDeniedRules: options.disallowedTools,
+        instanceAdditionalDirectories: options.additionalDirectories,
     });
     if (configurationService.resolveAutoMemoryEnabled()) {
         const autoMemoryDir = memoryService.getAutoMemoryDirectory(workdir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wave-agent-sdk",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "SDK for building AI-powered development tools and agents",
   "keywords": [
     "ai",

package/src/agent.ts

@@ -38,6 +38,7 @@ import { configValidator } from "./utils/configValidator.js";
 import { SkillManager } from "./managers/skillManager.js";
 import { TaskManager } from "./services/taskManager.js";
 import type { WorktreeSession } from "./utils/worktreeSession.js";
+import path from "node:path";
 import { parseTaskNotificationXml } from "./utils/notificationXml.js";
 import { InitializationService } from "./services/initializationService.js";
 import { InteractionService } from "./services/interactionService.js";
@@ -1045,6 +1046,43 @@ export class Agent {
     );
   }
 
+  // ========== Additional Directories ==========
+
+  /**
+   * Add an additional directory to the Safe Zone for this session.
+   *
+   * The directory immediately becomes part of the Safe Zone (permission
+   * checks and the system prompt), and with `remember: true` it is also
+   * persisted to `.wave/settings.local.json` `permissions.additionalDirectories`
+   * so future sessions pick it up automatically.
+   *
+   * @param directory Path of the directory to add (relative paths resolve against the workdir).
+   * @param options.remember Whether to persist the directory across sessions.
+   */
+  public async addAdditionalDirectory(
+    directory: string,
+    options?: { remember?: boolean },
+  ): Promise<void> {
+    const resolvedPath = path.isAbsolute(directory)
+      ? directory
+      : path.resolve(this.workdir, directory);
+    this.permissionManager.addInstanceAdditionalDirectory(resolvedPath);
+    if (options?.remember) {
+      await this.configurationService.addAdditionalDirectory(
+        this.workdir,
+        resolvedPath,
+      );
+    }
+  }
+
+  /**
+   * Get the effective additional directories for this session (config +
+   * session-level union), matching what is listed in the system prompt.
+   */
+  public getAdditionalDirectories(): string[] {
+    return this.permissionManager.getEffectiveAdditionalDirectories();
+  }
+
   // ========== MCP Management Methods ==========
 
   /** Get all MCP server status */

package/src/managers/aiManager.ts

@@ -746,6 +746,8 @@ export class AIManager {
       language: this.getLanguage(),
       isSubagent: !!this.subagentType,
       worktreeSession: this.getWorktreeSession(),
+      additionalWorkingDirectories:
+        this.permissionManager?.getEffectiveAdditionalDirectories?.() ?? [],
       autoMemory: autoMemoryOptions,
     });
   }

package/src/managers/permissionManager.ts

@@ -99,6 +99,8 @@ export interface PermissionManagerOptions {
   instanceDeniedRules?: string[];
   /** Additional directories considered part of the Safe Zone */
   additionalDirectories?: string[];
+  /** Instance-specific additional directories (from AgentOptions, session-level) */
+  instanceAdditionalDirectories?: string[];
   /** System additional directories (persistent across reloads) */
   systemAdditionalDirectories?: string[];
   /** Path to the current plan file */
@@ -115,6 +117,7 @@ export class PermissionManager {
   private instanceDeniedRules: string[] = [];
   private temporaryRules: string[] = [];
   private additionalDirectories: string[] = [];
+  private instanceAdditionalDirectories: string[] = [];
   private systemAdditionalDirectories: string[] = [];
   private planFilePath?: string;
   private hasExitedPlanMode: boolean = false;
@@ -136,14 +139,17 @@ export class PermissionManager {
     this.instanceDeniedRules = options.instanceDeniedRules || [];
     this.planFilePath = options.planFilePath;
     this._logger = options.logger;
+    // Read workdir first so relative additional directories resolve against it.
+    this.workdir = this.container.get<string>("Workdir");
+    this.worktreeName = this.container.get<string | undefined>("WorktreeName");
+    this.mainRepoRoot = this.container.get<string | undefined>("MainRepoRoot");
     this.updateAdditionalDirectories(options.additionalDirectories || []);
+    for (const dir of options.instanceAdditionalDirectories || []) {
+      this.addInstanceAdditionalDirectory(dir);
+    }
     for (const dir of options.systemAdditionalDirectories || []) {
       this.addSystemAdditionalDirectory(dir);
     }
-
-    this.workdir = this.container.get<string>("Workdir");
-    this.worktreeName = this.container.get<string | undefined>("WorktreeName");
-    this.mainRepoRoot = this.container.get<string | undefined>("MainRepoRoot");
   }
 
   /**
@@ -221,6 +227,32 @@ export class PermissionManager {
     return [...this.additionalDirectories];
   }
 
+  /**
+   * Get all instance-specific additional directories (session-level, from AgentOptions or /add-dir)
+   */
+  public getInstanceAdditionalDirectories(): string[] {
+    return [...this.instanceAdditionalDirectories];
+  }
+
+  /**
+   * Get the effective union of additional directories (config + instance, deduplicated).
+   * This is the data source for system prompt injection and Safe Zone checks.
+   */
+  public getEffectiveAdditionalDirectories(): string[] {
+    const seen = new Set<string>();
+    const result: string[] = [];
+    for (const dir of [
+      ...this.additionalDirectories,
+      ...this.instanceAdditionalDirectories,
+    ]) {
+      if (!seen.has(dir)) {
+        seen.add(dir);
+        result.push(dir);
+      }
+    }
+    return result;
+  }
+
   /**
    * Get all system additional directories
    */
@@ -276,6 +308,21 @@ export class PermissionManager {
     });
   }
 
+  /**
+   * Add an instance-level additional directory (session-level, e.g. /add-dir command)
+   */
+  public addInstanceAdditionalDirectory(directory: string): void {
+    const workdir = this.workdir;
+    const resolvedPath =
+      workdir && !path.isAbsolute(directory)
+        ? path.resolve(workdir, directory)
+        : path.resolve(directory);
+
+    if (!this.instanceAdditionalDirectories.includes(resolvedPath)) {
+      this.instanceAdditionalDirectories.push(resolvedPath);
+    }
+  }
+
   /**
    * Add a system-level additional directory that is persistent across configuration reloads
    */
@@ -355,6 +402,13 @@ export class PermissionManager {
       }
     }
 
+    // Check instance additional directories
+    for (const dir of this.instanceAdditionalDirectories) {
+      if (isPathInside(absolutePath, dir)) {
+        return { isInside: true, resolvedPath: absolutePath };
+      }
+    }
+
     // Check system additional directories
     for (const dir of this.systemAdditionalDirectories) {
       if (isPathInside(absolutePath, dir)) {

package/src/managers/subagentManager.ts

@@ -341,6 +341,8 @@ export class SubagentManager {
       ],
       additionalDirectories:
         parentPermissionManager?.getAdditionalDirectories(),
+      instanceAdditionalDirectories:
+        parentPermissionManager?.getInstanceAdditionalDirectories?.(),
       systemAdditionalDirectories:
         parentPermissionManager?.getSystemAdditionalDirectories(),
       planFilePath: parentPermissionManager?.getPlanFilePath(),

package/src/prompts/index.ts

@@ -396,6 +396,7 @@ export function buildSystemPrompt(
     language?: string;
     isSubagent?: boolean;
     worktreeSession?: WorktreeSession | null;
+    additionalWorkingDirectories?: string[];
     autoMemory?: {
       directory: string;
       content: string;
@@ -431,11 +432,17 @@ export function buildSystemPrompt(
     const osVersion = getUnameSR();
     const primaryWorkdir = options.originalWorkdir ?? options.workdir;
     const worktreeSession = options.worktreeSession;
+    const additionalWorkingDirectories =
+      options.additionalWorkingDirectories || [];
 
     if (options.isSubagent) {
       // Subagent env section, aligned with Claude Code's computeEnvInfo() +
       // enhanceSystemPromptWithEnvDetails() (without the model description and
       // knowledge cutoff lines, which Wave does not use).
+      const additionalDirsInfo =
+        additionalWorkingDirectories.length > 0
+          ? `Additional working directories: ${additionalWorkingDirectories.join(", ")}\n`
+          : "";
       dynamicText += `
 
 ${SUBAGENT_ENV_NOTES}
@@ -444,7 +451,7 @@ Here is useful information about the environment you are running in:
 <env>
 Working directory: ${primaryWorkdir}
 Is directory a git repo: ${isGitRepo}
-Platform: ${platform}
+${additionalDirsInfo}Platform: ${platform}
 ${shellInfo}
 OS Version: ${osVersion}
 </env>
@@ -453,21 +460,31 @@ OS Version: ${osVersion}
       // Main agent env section, aligned with Claude Code's
       // computeSimpleEnvInfo() (without the model description, knowledge
       // cutoff, and marketing lines, which Wave does not use).
-      const envItems = [
+      const envItems: Array<string | string[]> = [
         `Primary working directory: ${primaryWorkdir}`,
         worktreeSession
           ? `This is a git worktree — an isolated copy of the repository. Run all commands from this directory. Do NOT \`cd\` to the original repository root.`
           : null,
         `Is a git repository: ${isGitRepo}`,
+        additionalWorkingDirectories.length > 0
+          ? `Additional working directories:`
+          : null,
+        additionalWorkingDirectories.length > 0
+          ? additionalWorkingDirectories
+          : null,
         `Platform: ${platform}`,
         shellInfo,
         `OS Version: ${osVersion}`,
-      ].filter((item): item is string => item !== null);
+      ].filter((item): item is string | string[] => item !== null);
 
       const envBlock = [
         `# Environment`,
         `You have been invoked in the following environment: `,
-        ...envItems.map((item) => ` - ${item}`),
+        ...envItems.flatMap((item) =>
+          Array.isArray(item)
+            ? item.map((subItem) => `  - ${subItem}`)
+            : [` - ${item}`],
+        ),
       ].join("\n");
 
       dynamicText += `\n\n${envBlock}`;

package/src/services/configurationService.ts

@@ -919,6 +919,46 @@ export class ConfigurationService {
     }
   }
 
+  /**
+   * Add an additional directory to the local settings.local.json
+   * `permissions.additionalDirectories`, so it persists across sessions.
+   */
+  async addAdditionalDirectory(
+    workdir: string,
+    directory: string,
+  ): Promise<void> {
+    const localConfigPath = path.join(workdir, ".wave", "settings.local.json");
+
+    // Ensure .wave directory exists
+    const waveDir = path.join(workdir, ".wave");
+    ensureWaveRuntimeFilesExcluded(workdir);
+    if (!existsSync(waveDir)) {
+      await fs.mkdir(waveDir, { recursive: true });
+    }
+
+    let config: WaveConfiguration = {};
+    if (existsSync(localConfigPath)) {
+      try {
+        const content = await fs.readFile(localConfigPath, "utf-8");
+        config = JSON.parse(content);
+      } catch {
+        // If file is corrupted, start with empty config
+      }
+    }
+
+    if (!config.permissions) {
+      config.permissions = {};
+    }
+    if (!config.permissions.additionalDirectories) {
+      config.permissions.additionalDirectories = [];
+    }
+
+    if (!config.permissions.additionalDirectories.includes(directory)) {
+      config.permissions.additionalDirectories.push(directory);
+      await atomicWriteFile(localConfigPath, JSON.stringify(config, null, 2));
+    }
+  }
+
   /**
    * Update the enabled state of a plugin in the specified scope
    */

package/src/types/agent.ts

@@ -85,6 +85,12 @@ export interface AgentOptions {
    * These rules follow the standard permission rule syntax: `ToolName` or `ToolName(pattern)`.
    */
   disallowedTools?: string[];
+  /**
+   * Optional list of additional directories to include in the Safe Zone
+   * for this agent session. These directories are listed in the system
+   * prompt and treated as safe for file operations (e.g. in acceptEdits mode).
+   */
+  additionalDirectories?: string[];
   /**
    * Optional MCP server configs to connect at startup.
    * Overrides .mcp.json for specified server names.

package/src/utils/containerSetup.ts

@@ -176,6 +176,7 @@ export function setupAgentContainer(
   const permissionManager = new PermissionManager(container, {
     instanceAllowedRules: options.allowedTools,
     instanceDeniedRules: options.disallowedTools,
+    instanceAdditionalDirectories: options.additionalDirectories,
   });
   if (configurationService.resolveAutoMemoryEnabled()) {
     const autoMemoryDir = memoryService.getAutoMemoryDirectory(workdir);