wave-code 1.0.3 → 1.0.4

package/dist/cli.js

@@ -4,7 +4,7 @@ import { App } from "./components/App.js";
 import { cleanupLogs } from "./utils/logger.js";
 import { removeWorktree } from "./utils/worktree.js";
 export async function startCli(options) {
-    const { restoreSessionId, continueLastSession, bypassPermissions, permissionMode, pluginDirs, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, version, model, mcpServers, } = options;
+    const { restoreSessionId, continueLastSession, bypassPermissions, permissionMode, pluginDirs, additionalDirectories, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, version, model, mcpServers, } = options;
     // Continue with ink-based UI for normal mode
     let shouldRemoveWorktree = false;
     // Enable bracketed paste (DECSET 2004) so terminals wrap pasted text in
@@ -22,7 +22,7 @@ export async function startCli(options) {
         unmount();
     };
     // Render the application
-    const { unmount, waitUntilExit } = render(_jsx(App, { restoreSessionId: restoreSessionId, continueLastSession: continueLastSession, bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, worktreeSession: worktreeSession, workdir: workdir, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, onExit: handleExit }), { exitOnCtrlC: false });
+    const { unmount, waitUntilExit } = render(_jsx(App, { restoreSessionId: restoreSessionId, continueLastSession: continueLastSession, bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, additionalDirectories: additionalDirectories, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, worktreeSession: worktreeSession, workdir: workdir, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, onExit: handleExit }), { exitOnCtrlC: false });
     // Wait for the app to finish unmounting
     try {
         await waitUntilExit();

package/dist/components/App.js

@@ -54,7 +54,7 @@ const ChatWithExitPrompt = ({ worktreeSession, onExit }) => {
     }
     return _jsx(ChatInterface, {});
 };
-const AppWithProviders = ({ bypassPermissions, permissionMode, pluginDirs, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, version, model, mcpServers, onExit, }) => {
+const AppWithProviders = ({ bypassPermissions, permissionMode, pluginDirs, additionalDirectories, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, version, model, mcpServers, onExit, }) => {
     // Handle Ctrl-C for non-worktree sessions (immediate exit)
     // Ink runs terminal in raw mode, so Ctrl+C arrives as useInput event, not SIGINT
     useInput((input, key) => {
@@ -67,10 +67,10 @@ const AppWithProviders = ({ bypassPermissions, permissionMode, pluginDirs, tools
         }
     });
     if (worktreeSession) {
-        return (_jsx(ChatProvider, { bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, workdir: workdir, worktreeSession: worktreeSession, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, children: _jsx(ChatWithExitPrompt, { worktreeSession: worktreeSession, onExit: onExit }) }));
+        return (_jsx(ChatProvider, { bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, additionalDirectories: additionalDirectories, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, workdir: workdir, worktreeSession: worktreeSession, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, children: _jsx(ChatWithExitPrompt, { worktreeSession: worktreeSession, onExit: onExit }) }));
     }
-    return (_jsx(ChatProvider, { bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, workdir: workdir, worktreeSession: worktreeSession, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, children: _jsx(ChatInterface, {}) }));
+    return (_jsx(ChatProvider, { bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, additionalDirectories: additionalDirectories, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, workdir: workdir, worktreeSession: worktreeSession, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, children: _jsx(ChatInterface, {}) }));
 };
-export const App = ({ restoreSessionId, continueLastSession, bypassPermissions, permissionMode, pluginDirs, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, version, model, mcpServers, onExit, }) => {
-    return (_jsx(AppProvider, { restoreSessionId: restoreSessionId, continueLastSession: continueLastSession, children: _jsx(AppWithProviders, { bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, worktreeSession: worktreeSession, workdir: workdir, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, onExit: onExit }) }));
+export const App = ({ restoreSessionId, continueLastSession, bypassPermissions, permissionMode, pluginDirs, additionalDirectories, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, version, model, mcpServers, onExit, }) => {
+    return (_jsx(AppProvider, { restoreSessionId: restoreSessionId, continueLastSession: continueLastSession, children: _jsx(AppWithProviders, { bypassPermissions: bypassPermissions, permissionMode: permissionMode, pluginDirs: pluginDirs, additionalDirectories: additionalDirectories, tools: tools, allowedTools: allowedTools, disallowedTools: disallowedTools, worktreeSession: worktreeSession, workdir: workdir, originalCwd: originalCwd, version: version, model: model, mcpServers: mcpServers, onExit: onExit }) }));
 };

package/dist/components/ChatInterface.js

@@ -57,5 +57,5 @@ export const ChatInterface = () => {
     ]);
     if (!sessionId)
         return null;
-    return (_jsxs(Box, { ref: chatInterfaceRef, flexDirection: "column", children: [_jsx(MessageList, { messages: displayMessages, isExpanded: isExpanded, version: version, workdir: workdir, forceStatic: forceStatic }, remountKey), !isConfirmationVisible && !isExpanded && (_jsxs(_Fragment, { children: [(isLoading || isCommandRunning || isCompacting) && (_jsx(LoadingIndicator, { isLoading: isLoading, isCommandRunning: isCommandRunning, isCompacting: isCompacting, latestTotalTokens: latestTotalTokens })), _jsx(TaskList, {}), _jsx(QueuedMessageList, {}), _jsx(InputBox, { isLoading: isLoading, isCommandRunning: isCommandRunning, isCompacting: isCompacting, sendMessage: sendMessage, abortMessage: abortMessage, mcpServers: mcpServers, connectMcpServer: connectMcpServer, disconnectMcpServer: disconnectMcpServer, slashCommands: slashCommands, hasSlashCommand: hasSlashCommand, latestTotalTokens: latestTotalTokens, maxInputTokens: maxInputTokens, showLoginHint: showLoginHint })] })), isConfirmationVisible && (_jsxs(_Fragment, { children: [forceStatic ? (_jsx(Static, { items: [{ key: "confirmation-details" }], children: () => (_jsx(ConfirmationDetails, { toolName: confirmingTool.name, toolInput: confirmingTool.input, planContent: confirmingTool.planContent, isExpanded: isExpanded }, "confirmation-details")) })) : (_jsx(ConfirmationDetails, { toolName: confirmingTool.name, toolInput: confirmingTool.input, planContent: confirmingTool.planContent, isExpanded: isExpanded })), _jsx(ConfirmationSelector, { toolName: confirmingTool.name, toolInput: confirmingTool.input, suggestedPrefix: confirmingTool.suggestedPrefix, hidePersistentOption: confirmingTool.hidePersistentOption, isExpanded: isExpanded, onDecision: handleConfirmationDecision, onCancel: handleConfirmationCancel })] }))] }));
+    return (_jsxs(Box, { ref: chatInterfaceRef, flexDirection: "column", children: [_jsx(MessageList, { messages: displayMessages, isExpanded: isExpanded, version: version, workdir: workdir, forceStatic: forceStatic }, remountKey), !isConfirmationVisible && !isExpanded && (_jsxs(_Fragment, { children: [(isLoading || isCommandRunning || isCompacting) && (_jsx(LoadingIndicator, { isLoading: isLoading, isCommandRunning: isCommandRunning, isCompacting: isCompacting, latestTotalTokens: latestTotalTokens })), _jsx(TaskList, {}), _jsx(QueuedMessageList, {}), _jsx(InputBox, { isLoading: isLoading, isCommandRunning: isCommandRunning, isCompacting: isCompacting, sendMessage: sendMessage, abortMessage: abortMessage, mcpServers: mcpServers, connectMcpServer: connectMcpServer, disconnectMcpServer: disconnectMcpServer, slashCommands: slashCommands, hasSlashCommand: hasSlashCommand, latestTotalTokens: latestTotalTokens, maxInputTokens: maxInputTokens, showLoginHint: showLoginHint })] })), isConfirmationVisible && (_jsxs(_Fragment, { children: [forceStatic ? (_jsx(Static, { items: [{ key: "confirmation-details" }], children: () => (_jsx(ConfirmationDetails, { toolName: confirmingTool.name, toolInput: confirmingTool.input, planContent: confirmingTool.planContent, isExpanded: isExpanded }, "confirmation-details")) })) : (_jsx(ConfirmationDetails, { toolName: confirmingTool.name, toolInput: confirmingTool.input, planContent: confirmingTool.planContent, isExpanded: isExpanded })), _jsx(ConfirmationSelector, { toolName: confirmingTool.name, toolInput: confirmingTool.input, suggestedPrefix: confirmingTool.suggestedPrefix, hidePersistentOption: confirmingTool.hidePersistentOption, permissionMode: confirmingTool.permissionMode, isExpanded: isExpanded, onDecision: handleConfirmationDecision, onCancel: handleConfirmationCancel })] }))] }));
 };

package/dist/components/ConfirmationSelector.d.ts

@@ -1,10 +1,11 @@
 import React from "react";
-import type { PermissionDecision } from "wave-agent-sdk";
+import type { PermissionDecision, PermissionMode } from "wave-agent-sdk";
 export interface ConfirmationSelectorProps {
     toolName: string;
     toolInput?: Record<string, unknown>;
     suggestedPrefix?: string;
     hidePersistentOption?: boolean;
+    permissionMode?: PermissionMode;
     isExpanded?: boolean;
     onDecision: (decision: PermissionDecision) => void;
     onCancel: () => void;

package/dist/components/ConfirmationSelector.js

@@ -12,7 +12,7 @@ const getHeaderColor = (header) => {
     }
     return colors[Math.abs(hash) % colors.length];
 };
-export const ConfirmationSelector = ({ toolName, toolInput, suggestedPrefix, hidePersistentOption, isExpanded = false, onDecision, onCancel, }) => {
+export const ConfirmationSelector = ({ toolName, toolInput, suggestedPrefix, hidePersistentOption, permissionMode, isExpanded = false, onDecision, onCancel, }) => {
     const [state, dispatch] = useReducer(confirmationReducer, {
         selectedOption: "allow",
         alternativeText: "",
@@ -86,6 +86,7 @@ export const ConfirmationSelector = ({ toolName, toolInput, suggestedPrefix, hid
                 toolInput,
                 suggestedPrefix,
                 hidePersistentOption,
+                permissionMode,
             });
         }
     });
@@ -106,7 +107,7 @@ export const ConfirmationSelector = ({ toolName, toolInput, suggestedPrefix, hid
                                             : "", option.label, option.description ? ` - ${option.description}` : "", isOther && isSelected && (_jsxs(Text, { children: [":", " ", questionState.otherText ? (_jsxs(_Fragment, { children: [questionState.otherText.slice(0, questionState.otherCursorPosition), _jsx(Text, { backgroundColor: "white", color: "black", children: questionState.otherText[questionState.otherCursorPosition] || " " }), questionState.otherText.slice(questionState.otherCursorPosition + 1)] })) : (_jsx(Text, { color: "gray", dimColor: true, children: "[Type your answer...]" }))] }))] }) }, index));
                         }) }), _jsx(Box, { marginTop: 1, children: _jsxs(Text, { dimColor: true, children: ["Question ", questionState.currentQuestionIndex + 1, " of", " ", questions.length, " \u2022", currentQuestion.multiSelect ? " Space to toggle •" : "", " Use \u2191\u2193 or Tab to navigate \u2022 Enter to confirm"] }) })] })), toolName !== ASK_USER_QUESTION_TOOL_NAME && !isExpanded && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, children: _jsx(Text, { children: "Do you want to proceed?" }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Box, { children: _jsxs(Text, { color: state.selectedOption === "allow" ? "black" : "white", backgroundColor: state.selectedOption === "allow" ? "yellow" : undefined, bold: state.selectedOption === "allow", children: [state.selectedOption === "allow" ? "> " : "  ", toolName === EXIT_PLAN_MODE_TOOL_NAME
                                             ? "Yes, manually approve edits"
-                                            : "Yes, proceed"] }) }, "allow-option"), !hidePersistentOption && (_jsx(Box, { children: _jsxs(Text, { color: state.selectedOption === "auto" ? "black" : "white", backgroundColor: state.selectedOption === "auto" ? "yellow" : undefined, bold: state.selectedOption === "auto", children: [state.selectedOption === "auto" ? "> " : "  ", getAutoOptionText()] }) }, "auto-option")), (toolName === BASH_TOOL_NAME ||
-                                toolName === EXIT_PLAN_MODE_TOOL_NAME) && (_jsx(Box, { children: _jsxs(Text, { color: state.selectedOption === "bypass" ? "black" : "white", backgroundColor: state.selectedOption === "bypass" ? "yellow" : undefined, bold: state.selectedOption === "bypass", children: [state.selectedOption === "bypass" ? "> " : "  ", "Yes, and bypass permissions"] }) }, "bypass-option")), _jsx(Box, { children: _jsxs(Text, { color: state.selectedOption === "alternative" ? "black" : "white", backgroundColor: state.selectedOption === "alternative" ? "yellow" : undefined, bold: state.selectedOption === "alternative", children: [state.selectedOption === "alternative" ? "> " : "  ", toolName === ENTER_PLAN_MODE_TOOL_NAME && showPlaceholder ? (_jsx(Text, { color: "gray", dimColor: true, children: "No, start implementing now" })) : showPlaceholder ? (_jsx(Text, { color: "gray", dimColor: true, children: placeholderText })) : (_jsx(Text, { children: state.alternativeText ? (_jsxs(_Fragment, { children: [state.alternativeText.slice(0, state.alternativeCursorPosition), _jsx(Text, { backgroundColor: "white", color: "black", children: state.alternativeText[state.alternativeCursorPosition] || " " }), state.alternativeText.slice(state.alternativeCursorPosition + 1)] })) : ("Type here to tell Wave what to change") }))] }) }, "alternative-option")] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Use \u2191\u2193 or Tab to navigate \u2022 ESC to cancel" }) })] }))] }));
+                                            : "Yes, proceed"] }) }, "allow-option"), !hidePersistentOption && (_jsx(Box, { children: _jsxs(Text, { color: state.selectedOption === "auto" ? "black" : "white", backgroundColor: state.selectedOption === "auto" ? "yellow" : undefined, bold: state.selectedOption === "auto", children: [state.selectedOption === "auto" ? "> " : "  ", getAutoOptionText()] }) }, "auto-option")), (toolName === EXIT_PLAN_MODE_TOOL_NAME ||
+                                (toolName === BASH_TOOL_NAME && permissionMode !== "plan")) && (_jsx(Box, { children: _jsxs(Text, { color: state.selectedOption === "bypass" ? "black" : "white", backgroundColor: state.selectedOption === "bypass" ? "yellow" : undefined, bold: state.selectedOption === "bypass", children: [state.selectedOption === "bypass" ? "> " : "  ", "Yes, and bypass permissions"] }) }, "bypass-option")), _jsx(Box, { children: _jsxs(Text, { color: state.selectedOption === "alternative" ? "black" : "white", backgroundColor: state.selectedOption === "alternative" ? "yellow" : undefined, bold: state.selectedOption === "alternative", children: [state.selectedOption === "alternative" ? "> " : "  ", toolName === ENTER_PLAN_MODE_TOOL_NAME && showPlaceholder ? (_jsx(Text, { color: "gray", dimColor: true, children: "No, start implementing now" })) : showPlaceholder ? (_jsx(Text, { color: "gray", dimColor: true, children: placeholderText })) : (_jsx(Text, { children: state.alternativeText ? (_jsxs(_Fragment, { children: [state.alternativeText.slice(0, state.alternativeCursorPosition), _jsx(Text, { backgroundColor: "white", color: "black", children: state.alternativeText[state.alternativeCursorPosition] || " " }), state.alternativeText.slice(state.alternativeCursorPosition + 1)] })) : ("Type here to tell Wave what to change") }))] }) }, "alternative-option")] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Use \u2191\u2193 or Tab to navigate \u2022 ESC to cancel" }) })] }))] }));
 };
 ConfirmationSelector.displayName = "ConfirmationSelector";

package/dist/components/InputBox.js

@@ -22,7 +22,7 @@ import { useChat } from "../contexts/useChat.js";
 export const INPUT_PLACEHOLDER_TEXT = "Type your message (use /help for more info)...";
 export const INPUT_PLACEHOLDER_TEXT_PREFIX = INPUT_PLACEHOLDER_TEXT.substring(0, 10);
 export const InputBox = ({ isLoading, isCommandRunning, isCompacting, sendMessage = () => { }, abortMessage = () => { }, mcpServers = [], connectMcpServer = async () => false, disconnectMcpServer = async () => false, slashCommands = [], hasSlashCommand = () => false, latestTotalTokens = 0, maxInputTokens = 200000, showLoginHint = false, }) => {
-    const { permissionMode: chatPermissionMode, setPermissionMode: setChatPermissionMode, handleRewindSelect, backgroundCurrentTask, messages, getFullMessageThread, sessionId, workingDirectory, askBtw, clearMessages, compact, currentModel, configuredModels, setModel, recreateAgent, recallQueuedMessage, queuedMessages, setIsBtwActive, } = useChat();
+    const { permissionMode: chatPermissionMode, setPermissionMode: setChatPermissionMode, handleRewindSelect, backgroundCurrentTask, messages, getFullMessageThread, sessionId, workingDirectory, askBtw, clearMessages, compact, addDir, currentModel, configuredModels, setModel, recreateAgent, recallQueuedMessage, queuedMessages, setIsBtwActive, } = useChat();
     // Ref to hold setInputText so queue callbacks can access it before useInputManager returns
     const setInputTextRef = useRef(() => { });
     const hasQueuedMessages = (queuedMessages?.length ?? 0) > 0;
@@ -62,6 +62,7 @@ export const InputBox = ({ isLoading, isCommandRunning, isCompacting, sendMessag
         onAskBtw: askBtw,
         onClearMessages: clearMessages,
         onCompact: compact,
+        onAddDir: addDir,
         onHasSlashCommand: hasSlashCommand,
         onAbortMessage: abortMessage,
         onBackgroundCurrentTask: backgroundCurrentTask,

package/dist/constants/commands.js

@@ -77,4 +77,10 @@ export const AVAILABLE_COMMANDS = [
         description: "Compact conversation history to reduce context usage",
         handler: () => { },
     },
+    {
+        id: "add-dir",
+        name: "add-dir",
+        description: "Add a directory to the session Safe Zone",
+        handler: () => { }, // Handler here won't be used, actual processing is in the hook
+    },
 ];

package/dist/contexts/useChat.d.ts

@@ -20,6 +20,7 @@ export interface ChatContextType {
     askBtw: (question: string, abortSignal?: AbortSignal, onContent?: (content: string) => void) => Promise<string>;
     clearMessages: () => Promise<void>;
     compact: (instructions?: string) => Promise<void>;
+    addDir: (args?: string) => Promise<void>;
     abortMessage: () => void;
     recallQueuedMessage: () => QueuedMessage | null;
     removeQueuedMessageById: (id: string) => boolean;
@@ -55,8 +56,9 @@ export interface ChatContextType {
         suggestedPrefix?: string;
         hidePersistentOption?: boolean;
         planContent?: string;
+        permissionMode?: PermissionMode;
     };
-    showConfirmation: (toolName: string, toolInput?: Record<string, unknown>, suggestedPrefix?: string, hidePersistentOption?: boolean, planContent?: string) => Promise<PermissionDecision>;
+    showConfirmation: (toolName: string, toolInput?: Record<string, unknown>, suggestedPrefix?: string, hidePersistentOption?: boolean, planContent?: string, permissionMode?: PermissionMode) => Promise<PermissionDecision>;
     hideConfirmation: () => void;
     handleConfirmationDecision: (decision: PermissionDecision) => void;
     handleConfirmationCancel: () => void;

package/dist/contexts/useChat.js

@@ -15,7 +15,7 @@ export const useChat = () => {
     }
     return context;
 };
-export const ChatProvider = ({ children, bypassPermissions, permissionMode: initialPermissionMode, pluginDirs, tools, allowedTools, disallowedTools, workdir, worktreeSession, originalCwd, version, model, mcpServers, }) => {
+export const ChatProvider = ({ children, bypassPermissions, permissionMode: initialPermissionMode, pluginDirs, additionalDirectories, tools, allowedTools, disallowedTools, workdir, worktreeSession, originalCwd, version, model, mcpServers, }) => {
     const { restoreSessionId, continueLastSession } = useAppConfig();
     const { stdout } = useStdout();
     // Message Display State
@@ -169,7 +169,7 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
         }
     }, []);
     // Permission confirmation methods with queue support
-    const showConfirmation = useCallback(async (toolName, toolInput, suggestedPrefix, hidePersistentOption, planContent) => {
+    const showConfirmation = useCallback(async (toolName, toolInput, suggestedPrefix, hidePersistentOption, planContent, permissionMode) => {
         return new Promise((resolve, reject) => {
             const queueItem = {
                 toolName,
@@ -177,6 +177,7 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
                 suggestedPrefix,
                 hidePersistentOption,
                 planContent,
+                permissionMode,
                 resolver: resolve,
                 reject,
             };
@@ -354,7 +355,7 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
             // Create the permission callback inside the try block to access showConfirmation
             const permissionCallback = async (context) => {
                 try {
-                    return await showConfirmation(context.toolName, context.toolInput, context.suggestedPrefix, context.hidePersistentOption, context.planContent);
+                    return await showConfirmation(context.toolName, context.toolInput, context.suggestedPrefix, context.hidePersistentOption, context.planContent, context.permissionMode);
                 }
                 catch {
                     // If confirmation was cancelled or failed, deny the operation
@@ -374,6 +375,7 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
                 canUseTool: permissionCallback,
                 stream: true,
                 plugins: pluginDirs?.map((path) => ({ type: "local", path })),
+                additionalDirectories,
                 tools,
                 allowedTools,
                 disallowedTools,
@@ -426,6 +428,7 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
         bypassPermissions,
         showConfirmation,
         pluginDirs,
+        additionalDirectories,
         tools,
         allowedTools,
         disallowedTools,
@@ -545,6 +548,43 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
         refreshMessages();
         forceRemount();
     }, [refreshMessages, forceRemount]);
+    // /add-dir: add a directory to the session Safe Zone (session-level, with
+    // optional --remember persistence). Bare command shows usage + current list.
+    const addDir = useCallback(async (args) => {
+        const agent = agentRef.current;
+        if (!agent)
+            return;
+        // Show the result as a UI-only assistant text message (same display path
+        // as error blocks; not persisted to session history).
+        const showResult = (content) => {
+            setMessages((prev) => [
+                ...prev,
+                {
+                    id: `msg-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`,
+                    role: "assistant",
+                    timestamp: new Date().toISOString(),
+                    blocks: [{ type: "text", content, stage: "end" }],
+                },
+            ]);
+        };
+        const rawArgs = (args ?? "").trim();
+        if (!rawArgs) {
+            const dirs = agent.getAdditionalDirectories();
+            const list = dirs.length > 0
+                ? dirs.map((dir) => `  - ${dir}`).join("\n")
+                : "  (none)";
+            showResult(`Usage: /add-dir <path> [--remember]\n\nAdditional working directories:\n${list}`);
+            return;
+        }
+        const remember = rawArgs.includes("--remember");
+        const dir = rawArgs.replace("--remember", "").trim();
+        if (!dir) {
+            showResult("Usage: /add-dir <path> [--remember]");
+            return;
+        }
+        await agent.addAdditionalDirectory(dir, { remember });
+        showResult(`Added ${dir} to the session Safe Zone${remember ? " (remembered)" : ""}.`);
+    }, []);
     // Unified interrupt method, interrupt both AI messages and command execution
     const abortMessage = useCallback(() => {
         agentRef.current?.abortMessage();
@@ -603,6 +643,7 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
                 suggestedPrefix: next.suggestedPrefix,
                 hidePersistentOption: next.hidePersistentOption,
                 planContent: next.planContent,
+                permissionMode: next.permissionMode,
             });
             setIsConfirmationVisible(true);
             setConfirmationQueue((prev) => prev.slice(1));
@@ -716,6 +757,7 @@ export const ChatProvider = ({ children, bypassPermissions, permissionMode: init
         askBtw,
         clearMessages,
         compact,
+        addDir,
         abortMessage,
         recallQueuedMessage,
         removeQueuedMessageById,

package/dist/hooks/useInputManager.js

@@ -14,7 +14,7 @@ export const useInputManager = (callbacks = {}) => {
     // dismissed ref suppresses the late SET_BTW_STATE dispatch / error logging.
     const btwAbortRef = useRef(null);
     const btwDismissedRef = useRef(false);
-    const { onInputTextChange, onCursorPositionChange, onFileSelectorStateChange, onCommandSelectorStateChange, onHistorySearchStateChange, onBackgroundTaskManagerStateChange, onMcpManagerStateChange, onRewindManagerStateChange, onHelpStateChange, onStatusCommandStateChange, onPluginManagerStateChange, onModelSelectorStateChange, onWorkflowManagerStateChange, onImagesStateChange, onSendMessage, onHasSlashCommand, onAbortMessage, onBackgroundCurrentTask, onPermissionModeChange, onAskBtw, sessionId, workdir, getFullMessageThread, logger, hasQueuedMessages: hasQueuedMessagesProp, onRecallQueuedMessage, onClearMessages, onCompact, isIdle: isIdleProp, } = callbacks;
+    const { onInputTextChange, onCursorPositionChange, onFileSelectorStateChange, onCommandSelectorStateChange, onHistorySearchStateChange, onBackgroundTaskManagerStateChange, onMcpManagerStateChange, onRewindManagerStateChange, onHelpStateChange, onStatusCommandStateChange, onPluginManagerStateChange, onModelSelectorStateChange, onWorkflowManagerStateChange, onImagesStateChange, onSendMessage, onHasSlashCommand, onAbortMessage, onBackgroundCurrentTask, onPermissionModeChange, onAskBtw, sessionId, workdir, getFullMessageThread, logger, hasQueuedMessages: hasQueuedMessagesProp, onRecallQueuedMessage, onClearMessages, onCompact, onAddDir, isIdle: isIdleProp, } = callbacks;
     // Handle debounced file search
     useEffect(() => {
         if (state.showFileSelector) {
@@ -216,6 +216,9 @@ export const useInputManager = (callbacks = {}) => {
                             else if (command === "compact") {
                                 await onCompact?.(effect.args);
                             }
+                            else if (command === "add-dir") {
+                                await onAddDir?.(effect.args);
+                            }
                         }
                         break;
                     case "RECALL_QUEUED_MESSAGE":
@@ -243,6 +246,7 @@ export const useInputManager = (callbacks = {}) => {
         onRecallQueuedMessage,
         onClearMessages,
         onCompact,
+        onAddDir,
     ]);
     useEffect(() => {
         onFileSelectorStateChange?.(state.showFileSelector, state.filteredFiles, state.fileSearchQuery, state.atPosition);

package/dist/index.js

@@ -78,6 +78,12 @@ export async function main() {
             type: "array",
             string: true,
             global: false,
+        })
+            .option("add-dir", {
+            description: "Add a directory to the session Safe Zone (repeatable)",
+            type: "array",
+            string: true,
+            global: false,
         })
             .option("tools", {
             description: 'Specify a comma-separated list of tools to enable (e.g., \'Bash,Read,Write\'). Use "" to disable all, "default" for all.',
@@ -233,6 +239,9 @@ export async function main() {
         }
         // Resolve plugin directories to absolute paths before any worktree logic
         const pluginDirs = argv.pluginDir?.map((dir) => path.resolve(originalCwd, dir));
+        // Resolve additional directories to absolute paths (relative to the
+        // original working directory, before any worktree change)
+        const additionalDirectories = argv.addDir?.map((dir) => path.resolve(originalCwd, dir));
         let worktreeSession;
         if (argv.worktree !== undefined ||
             process.argv.includes("-w") ||
@@ -267,6 +276,7 @@ export async function main() {
                 bypassPermissions: argv.dangerouslySkipPermissions,
                 permissionMode: argv.permissionMode,
                 pluginDirs,
+                additionalDirectories,
                 tools,
                 allowedTools,
                 disallowedTools,
@@ -289,6 +299,7 @@ export async function main() {
                 bypassPermissions: argv.dangerouslySkipPermissions,
                 permissionMode: argv.permissionMode,
                 pluginDirs,
+                additionalDirectories,
                 tools,
                 allowedTools,
                 disallowedTools,
@@ -316,6 +327,7 @@ export async function main() {
             bypassPermissions: argv.dangerouslySkipPermissions,
             permissionMode: argv.permissionMode,
             pluginDirs,
+            additionalDirectories,
             tools,
             allowedTools,
             disallowedTools,

package/dist/managers/inputHandlers.js

@@ -300,6 +300,9 @@ export const handleCommandSelect = (state, dispatch, callbacks, command) => {
                 else if (command === "compact") {
                     await callbacks.onCompact?.();
                 }
+                else if (command === "add-dir") {
+                    await callbacks.onAddDir?.();
+                }
             }
         })();
         dispatch({ type: "CANCEL_COMMAND_SELECTOR" });

package/dist/managers/inputReducer.d.ts

@@ -81,6 +81,7 @@ export interface InputManagerCallbacks {
     onAskBtw?: (question: string, abortSignal?: AbortSignal, onContent?: (content: string) => void) => Promise<string>;
     onClearMessages?: () => Promise<void>;
     onCompact?: (instructions?: string) => Promise<void>;
+    onAddDir?: (args?: string) => Promise<void>;
     sessionId?: string;
     workdir?: string;
     getFullMessageThread?: () => Promise<{

package/dist/print-cli.js

@@ -14,7 +14,7 @@ function displayTimingInfo(startTime, showStats) {
 }
 export async function startPrintCli(options) {
     const startTime = new Date();
-    const { restoreSessionId, continueLastSession, message, showStats = false, bypassPermissions, permissionMode, pluginDirs, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, model, mcpServers, } = options;
+    const { restoreSessionId, continueLastSession, message, showStats = false, bypassPermissions, permissionMode, pluginDirs, additionalDirectories, tools, allowedTools, disallowedTools, worktreeSession, workdir, originalCwd, model, mcpServers, } = options;
     if ((typeof message !== "string" || message.trim() === "") &&
         !continueLastSession &&
         !restoreSessionId) {
@@ -77,6 +77,7 @@ export async function startPrintCli(options) {
             continueLastSession,
             permissionMode: permissionMode || (bypassPermissions ? "bypassPermissions" : undefined),
             plugins: pluginDirs?.map((path) => ({ type: "local", path })),
+            additionalDirectories,
             tools,
             allowedTools,
             disallowedTools,

package/dist/reducers/confirmationReducer.d.ts

@@ -1,5 +1,5 @@
 import { Key } from "ink";
-import type { PermissionDecision } from "wave-agent-sdk";
+import type { PermissionDecision, PermissionMode } from "wave-agent-sdk";
 export interface ConfirmationState {
     selectedOption: "auto" | "bypass" | "allow" | "alternative";
     alternativeText: string;
@@ -32,5 +32,6 @@ export type ConfirmationAction = {
     toolInput?: Record<string, unknown>;
     suggestedPrefix?: string;
     hidePersistentOption?: boolean;
+    permissionMode?: PermissionMode;
 };
 export declare function confirmationReducer(state: ConfirmationState, action: ConfirmationAction): ConfirmationState;

package/dist/reducers/confirmationReducer.js

@@ -44,7 +44,7 @@ export function confirmationReducer(state, action) {
         case "CLEAR_DECISION":
             return { ...state, decision: null };
         case "HANDLE_KEY": {
-            const { input, key, toolName, toolInput, suggestedPrefix, hidePersistentOption, } = action;
+            const { input, key, toolName, toolInput, suggestedPrefix, hidePersistentOption, permissionMode, } = action;
             if (key.return) {
                 let decision = null;
                 if (state.selectedOption === "allow") {
@@ -125,7 +125,8 @@ export function confirmationReducer(state, action) {
             availableOptions.push("allow");
             if (!hidePersistentOption)
                 availableOptions.push("auto");
-            if (toolName === BASH_TOOL_NAME || toolName === EXIT_PLAN_MODE_TOOL_NAME)
+            if (toolName === EXIT_PLAN_MODE_TOOL_NAME ||
+                (toolName === BASH_TOOL_NAME && permissionMode !== "plan"))
                 availableOptions.push("bypass");
             availableOptions.push("alternative");
             if (key.upArrow) {

package/dist/stdio/agentBridge.d.ts

@@ -80,6 +80,14 @@ export declare class AgentBridge {
     private disconnectMcpServer;
     private getSlashCommands;
     private searchFiles;
+    /**
+     * Writes an uploaded file (from the desktop/webview "+上传文件" flow) into the
+     * artifacts dir on THIS machine — i.e. where the agent runs. Remote sessions
+     * call this over the ssh tunnel so the returned path is reachable by the
+     * remote agent's tools; local sessions never hit this (desktop writes locally
+     * itself).
+     */
+    private writeArtifactFile;
     private getPromptHistory;
     private searchPromptHistory;
     private canUseTool;

package/dist/stdio/agentBridge.js

@@ -15,8 +15,11 @@
  * - Handle config updates by destroying and recreating the Agent
  */
 import { Agent, listSessions, searchFiles, generateRandomName, getDefaultRemoteBranch, getMessageContent, PromptHistoryManager, AuthService, PluginCore, validateWorktreeRemovalPath, } from "wave-agent-sdk";
-import { INTERNAL_ERROR as PROTOCOL_INTERNAL_ERROR, METHOD_NOT_FOUND as PROTOCOL_METHOD_NOT_FOUND, } from "./protocol.js";
+import { INVALID_PARAMS as PROTOCOL_INVALID_PARAMS, INTERNAL_ERROR as PROTOCOL_INTERNAL_ERROR, METHOD_NOT_FOUND as PROTOCOL_METHOD_NOT_FOUND, } from "./protocol.js";
 import { execFileSync } from "node:child_process";
+import { mkdirSync, existsSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, extname, join } from "node:path";
 import { createWorktree, removeWorktree } from "../utils/worktree.js";
 import { logger } from "../utils/logger.js";
 import { isUserCheckpointMessage } from "../utils/rewindCheckpoints.js";
@@ -92,6 +95,8 @@ export class AgentBridge {
             // ── File / History (global — no session required) ──
             case "searchFiles":
                 return this.searchFiles(p, sessionId);
+            case "writeArtifactFile":
+                return this.writeArtifactFile(p);
             case "getPromptHistory":
                 return this.getPromptHistory(p.workdir, sessionId);
             case "searchPromptHistory":
@@ -588,6 +593,33 @@ export class AgentBridge {
         });
         return { files };
     }
+    /**
+     * Writes an uploaded file (from the desktop/webview "+上传文件" flow) into the
+     * artifacts dir on THIS machine — i.e. where the agent runs. Remote sessions
+     * call this over the ssh tunnel so the returned path is reachable by the
+     * remote agent's tools; local sessions never hit this (desktop writes locally
+     * itself).
+     */
+    async writeArtifactFile(params) {
+        // Artifacts are keyed by basename only — reject anything that could escape
+        // the artifacts dir via path traversal.
+        const safeName = basename(params.name || "");
+        if (!safeName || safeName === "." || safeName === "..") {
+            throw new RpcError(PROTOCOL_INVALID_PARAMS, `Invalid artifact file name: ${params.name}`);
+        }
+        const artifactsDir = join(tmpdir(), "wave-artifacts");
+        mkdirSync(artifactsDir, { recursive: true });
+        let finalPath = join(artifactsDir, safeName);
+        let counter = 1;
+        while (existsSync(finalPath)) {
+            const ext = extname(safeName);
+            const baseName = basename(safeName, ext);
+            finalPath = join(artifactsDir, `${baseName}_${counter}${ext}`);
+            counter++;
+        }
+        writeFileSync(finalPath, Buffer.from(params.contentBase64 || "", "base64"));
+        return { path: finalPath };
+    }
     async getPromptHistory(workdir, sessionId) {
         const history = await PromptHistoryManager.getHistory({
             workdir: workdir || this.getSessionWorkdir(sessionId),

package/dist/stdio/protocol.d.ts

@@ -34,7 +34,7 @@ export declare const INVALID_REQUEST = -32600;
 export declare const METHOD_NOT_FOUND = -32601;
 export declare const INVALID_PARAMS = -32602;
 export declare const INTERNAL_ERROR = -32603;
-export type RequestMethod = "initialize" | "destroy" | "restoreSession" | "listSessions" | "getSessionInfo" | "sendMessage" | "bang" | "askBtw" | "abortMessage" | "clearMessages" | "rewindToMessage" | "listRewindCheckpoints" | "deleteQueuedMessage" | "updateQueuedMessage" | "deleteQueuedMessageById" | "getMessages" | "getFullMessageThread" | "setPermissionMode" | "getPermissionMode" | "getMcpServers" | "connectMcpServer" | "disconnectMcpServer" | "getSlashCommands" | "searchFiles" | "getPromptHistory" | "searchPromptHistory" | "updateConfig" | "listPendingPermissions" | "getAuthStatus" | "login" | "logout" | "listPlugins" | "installPlugin" | "uninstallPlugin" | "enablePlugin" | "disablePlugin" | "updatePlugin" | "listMarketplaces" | "addMarketplace" | "removeMarketplace" | "updateMarketplace" | "compact" | "getBackgroundTaskOutput" | "stopBackgroundTask" | "getWorkflowRuns" | "stopWorkflowRun" | "listGitBranches" | "createWorktree" | "removeWorktree";
+export type RequestMethod = "initialize" | "destroy" | "restoreSession" | "listSessions" | "getSessionInfo" | "sendMessage" | "bang" | "askBtw" | "abortMessage" | "clearMessages" | "rewindToMessage" | "listRewindCheckpoints" | "deleteQueuedMessage" | "updateQueuedMessage" | "deleteQueuedMessageById" | "getMessages" | "getFullMessageThread" | "setPermissionMode" | "getPermissionMode" | "getMcpServers" | "connectMcpServer" | "disconnectMcpServer" | "getSlashCommands" | "searchFiles" | "writeArtifactFile" | "getPromptHistory" | "searchPromptHistory" | "updateConfig" | "listPendingPermissions" | "getAuthStatus" | "login" | "logout" | "listPlugins" | "installPlugin" | "uninstallPlugin" | "enablePlugin" | "disablePlugin" | "updatePlugin" | "listMarketplaces" | "addMarketplace" | "removeMarketplace" | "updateMarketplace" | "compact" | "getBackgroundTaskOutput" | "stopBackgroundTask" | "getWorkflowRuns" | "stopWorkflowRun" | "listGitBranches" | "createWorktree" | "removeWorktree";
 export type ClientNotificationMethod = "permissionResponse";
 export type ServerNotificationMethod = "userMessageAdded" | "assistantMessageAdded" | "assistantContentUpdated" | "assistantReasoningUpdated" | "toolBlockUpdated" | "errorBlockAdded" | "loadingChange" | "commandRunningChange" | "queuedMessagesChange" | "tasksChange" | "sessionIdChange" | "permissionModeChange" | "mcpServersChange" | "workdirChange" | "bangMessageAdded" | "bangMessageUpdated" | "bangMessageCompleted" | "notificationMessageAdded" | "permissionRequest" | "authUrl" | "compactBlockAdded" | "compactionStateChange" | "backgroundTasksChange" | "btwContent";
 export declare function isRequest(msg: unknown): msg is JsonRpcRequest;

package/dist/types.d.ts

@@ -4,6 +4,8 @@ export interface BaseAppProps {
     bypassPermissions?: boolean;
     permissionMode?: PermissionMode;
     pluginDirs?: string[];
+    /** Additional directories to add to the session Safe Zone (from --add-dir). */
+    additionalDirectories?: string[];
     tools?: string[];
     allowedTools?: string[];
     disallowedTools?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wave-code",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "CLI-based code assistant powered by AI, built with React and Ink",
   "repository": {
     "type": "git",
@@ -43,7 +43,7 @@
     "wrap-ansi": "^10.0.0",
     "yargs": "^17.7.2",
     "zod": "^3.23.8",
-    "wave-agent-sdk": "1.0.3"
+    "wave-agent-sdk": "1.0.4"
   },
   "devDependencies": {
     "@types/react": "^19.1.8",

package/src/cli.tsx

@@ -17,6 +17,7 @@ export async function startCli(options: CliOptions): Promise<void> {
     bypassPermissions,
     permissionMode,
     pluginDirs,
+    additionalDirectories,
     tools,
     allowedTools,
     disallowedTools,
@@ -55,6 +56,7 @@ export async function startCli(options: CliOptions): Promise<void> {
       bypassPermissions={bypassPermissions}
       permissionMode={permissionMode}
       pluginDirs={pluginDirs}
+      additionalDirectories={additionalDirectories}
       tools={tools}
       allowedTools={allowedTools}
       disallowedTools={disallowedTools}

package/src/components/App.tsx

@@ -96,6 +96,7 @@ const AppWithProviders: React.FC<AppWithProvidersProps> = ({
   bypassPermissions,
   permissionMode,
   pluginDirs,
+  additionalDirectories,
   tools,
   allowedTools,
   disallowedTools,
@@ -124,6 +125,7 @@ const AppWithProviders: React.FC<AppWithProvidersProps> = ({
         bypassPermissions={bypassPermissions}
         permissionMode={permissionMode}
         pluginDirs={pluginDirs}
+        additionalDirectories={additionalDirectories}
         tools={tools}
         allowedTools={allowedTools}
         disallowedTools={disallowedTools}
@@ -144,6 +146,7 @@ const AppWithProviders: React.FC<AppWithProvidersProps> = ({
       bypassPermissions={bypassPermissions}
       permissionMode={permissionMode}
       pluginDirs={pluginDirs}
+      additionalDirectories={additionalDirectories}
       tools={tools}
       allowedTools={allowedTools}
       disallowedTools={disallowedTools}
@@ -165,6 +168,7 @@ export const App: React.FC<AppProps> = ({
   bypassPermissions,
   permissionMode,
   pluginDirs,
+  additionalDirectories,
   tools,
   allowedTools,
   disallowedTools,
@@ -185,6 +189,7 @@ export const App: React.FC<AppProps> = ({
         bypassPermissions={bypassPermissions}
         permissionMode={permissionMode}
         pluginDirs={pluginDirs}
+        additionalDirectories={additionalDirectories}
         tools={tools}
         allowedTools={allowedTools}
         disallowedTools={disallowedTools}

package/src/components/ChatInterface.tsx

@@ -159,6 +159,7 @@ export const ChatInterface: React.FC = () => {
             toolInput={confirmingTool!.input}
             suggestedPrefix={confirmingTool!.suggestedPrefix}
             hidePersistentOption={confirmingTool!.hidePersistentOption}
+            permissionMode={confirmingTool!.permissionMode}
             isExpanded={isExpanded}
             onDecision={handleConfirmationDecision}
             onCancel={handleConfirmationCancel}

package/src/components/ConfirmationSelector.tsx

@@ -1,6 +1,10 @@
 import React, { useEffect, useReducer } from "react";
 import { Box, Text, useInput } from "ink";
-import type { PermissionDecision, AskUserQuestionInput } from "wave-agent-sdk";
+import type {
+  PermissionDecision,
+  PermissionMode,
+  AskUserQuestionInput,
+} from "wave-agent-sdk";
 import {
   BASH_TOOL_NAME,
   EXIT_PLAN_MODE_TOOL_NAME,
@@ -24,6 +28,7 @@ export interface ConfirmationSelectorProps {
   toolInput?: Record<string, unknown>;
   suggestedPrefix?: string;
   hidePersistentOption?: boolean;
+  permissionMode?: PermissionMode;
   isExpanded?: boolean;
   onDecision: (decision: PermissionDecision) => void;
   onCancel: () => void;
@@ -34,6 +39,7 @@ export const ConfirmationSelector: React.FC<ConfirmationSelectorProps> = ({
   toolInput,
   suggestedPrefix,
   hidePersistentOption,
+  permissionMode,
   isExpanded = false,
   onDecision,
   onCancel,
@@ -119,6 +125,7 @@ export const ConfirmationSelector: React.FC<ConfirmationSelectorProps> = ({
         toolInput,
         suggestedPrefix,
         hidePersistentOption,
+        permissionMode,
       });
     }
   });
@@ -240,8 +247,8 @@ export const ConfirmationSelector: React.FC<ConfirmationSelectorProps> = ({
                 </Text>
               </Box>
             )}
-            {(toolName === BASH_TOOL_NAME ||
-              toolName === EXIT_PLAN_MODE_TOOL_NAME) && (
+            {(toolName === EXIT_PLAN_MODE_TOOL_NAME ||
+              (toolName === BASH_TOOL_NAME && permissionMode !== "plan")) && (
               <Box key="bypass-option">
                 <Text
                   color={state.selectedOption === "bypass" ? "black" : "white"}

package/src/components/InputBox.tsx

@@ -81,6 +81,7 @@ export const InputBox: React.FC<InputBoxProps> = ({
     askBtw,
     clearMessages,
     compact,
+    addDir,
     currentModel,
     configuredModels,
     setModel,
@@ -166,6 +167,7 @@ export const InputBox: React.FC<InputBoxProps> = ({
     onAskBtw: askBtw,
     onClearMessages: clearMessages,
     onCompact: compact,
+    onAddDir: addDir,
     onHasSlashCommand: hasSlashCommand,
     onAbortMessage: abortMessage,
     onBackgroundCurrentTask: backgroundCurrentTask,

package/src/constants/commands.ts

@@ -80,4 +80,10 @@ export const AVAILABLE_COMMANDS: SlashCommand[] = [
     description: "Compact conversation history to reduce context usage",
     handler: () => {},
   },
+  {
+    id: "add-dir",
+    name: "add-dir",
+    description: "Add a directory to the session Safe Zone",
+    handler: () => {}, // Handler here won't be used, actual processing is in the hook
+  },
 ];

package/src/contexts/useChat.tsx

@@ -64,6 +64,7 @@ export interface ChatContextType {
   ) => Promise<string>;
   clearMessages: () => Promise<void>;
   compact: (instructions?: string) => Promise<void>;
+  addDir: (args?: string) => Promise<void>;
   abortMessage: () => void;
   recallQueuedMessage: () => QueuedMessage | null;
   removeQueuedMessageById: (id: string) => boolean;
@@ -107,6 +108,7 @@ export interface ChatContextType {
     suggestedPrefix?: string;
     hidePersistentOption?: boolean;
     planContent?: string;
+    permissionMode?: PermissionMode;
   };
   showConfirmation: (
     toolName: string,
@@ -114,6 +116,7 @@ export interface ChatContextType {
     suggestedPrefix?: string,
     hidePersistentOption?: boolean,
     planContent?: string,
+    permissionMode?: PermissionMode,
   ) => Promise<PermissionDecision>;
   hideConfirmation: () => void;
   handleConfirmationDecision: (decision: PermissionDecision) => void;
@@ -160,6 +163,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
   bypassPermissions,
   permissionMode: initialPermissionMode,
   pluginDirs,
+  additionalDirectories,
   tools,
   allowedTools,
   disallowedTools,
@@ -361,6 +365,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
         suggestedPrefix?: string;
         hidePersistentOption?: boolean;
         planContent?: string;
+        permissionMode?: PermissionMode;
       }
     | undefined
   >();
@@ -371,6 +376,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
       suggestedPrefix?: string;
       hidePersistentOption?: boolean;
       planContent?: string;
+      permissionMode?: PermissionMode;
       resolver: (decision: PermissionDecision) => void;
       reject: () => void;
     }>
@@ -381,6 +387,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
     suggestedPrefix?: string;
     hidePersistentOption?: boolean;
     planContent?: string;
+    permissionMode?: PermissionMode;
     resolver: (decision: PermissionDecision) => void;
     reject: () => void;
   } | null>(null);
@@ -421,6 +428,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
       suggestedPrefix?: string,
       hidePersistentOption?: boolean,
       planContent?: string,
+      permissionMode?: PermissionMode,
     ): Promise<PermissionDecision> => {
       return new Promise<PermissionDecision>((resolve, reject) => {
         const queueItem = {
@@ -429,6 +437,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
           suggestedPrefix,
           hidePersistentOption,
           planContent,
+          permissionMode,
           resolver: resolve,
           reject,
         };
@@ -632,6 +641,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
               context.suggestedPrefix,
               context.hidePersistentOption,
               context.planContent,
+              context.permissionMode,
             );
           } catch {
             // If confirmation was cancelled or failed, deny the operation
@@ -653,6 +663,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
           canUseTool: permissionCallback,
           stream: true,
           plugins: pluginDirs?.map((path) => ({ type: "local", path })),
+          additionalDirectories,
           tools,
           allowedTools,
           disallowedTools,
@@ -710,6 +721,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
       bypassPermissions,
       showConfirmation,
       pluginDirs,
+      additionalDirectories,
       tools,
       allowedTools,
       disallowedTools,
@@ -861,6 +873,52 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
     [refreshMessages, forceRemount],
   );
 
+  // /add-dir: add a directory to the session Safe Zone (session-level, with
+  // optional --remember persistence). Bare command shows usage + current list.
+  const addDir = useCallback(async (args?: string) => {
+    const agent = agentRef.current;
+    if (!agent) return;
+
+    // Show the result as a UI-only assistant text message (same display path
+    // as error blocks; not persisted to session history).
+    const showResult = (content: string) => {
+      setMessages((prev) => [
+        ...prev,
+        {
+          id: `msg-${Date.now()}-${Math.random().toString(36).slice(2, 11)}`,
+          role: "assistant",
+          timestamp: new Date().toISOString(),
+          blocks: [{ type: "text", content, stage: "end" }],
+        },
+      ]);
+    };
+
+    const rawArgs = (args ?? "").trim();
+    if (!rawArgs) {
+      const dirs = agent.getAdditionalDirectories();
+      const list =
+        dirs.length > 0
+          ? dirs.map((dir) => `  - ${dir}`).join("\n")
+          : "  (none)";
+      showResult(
+        `Usage: /add-dir <path> [--remember]\n\nAdditional working directories:\n${list}`,
+      );
+      return;
+    }
+
+    const remember = rawArgs.includes("--remember");
+    const dir = rawArgs.replace("--remember", "").trim();
+    if (!dir) {
+      showResult("Usage: /add-dir <path> [--remember]");
+      return;
+    }
+
+    await agent.addAdditionalDirectory(dir, { remember });
+    showResult(
+      `Added ${dir} to the session Safe Zone${remember ? " (remembered)" : ""}.`,
+    );
+  }, []);
+
   // Unified interrupt method, interrupt both AI messages and command execution
   const abortMessage = useCallback(() => {
     agentRef.current?.abortMessage();
@@ -925,6 +983,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
         suggestedPrefix: next.suggestedPrefix,
         hidePersistentOption: next.hidePersistentOption,
         planContent: next.planContent,
+        permissionMode: next.permissionMode,
       });
       setIsConfirmationVisible(true);
       setConfirmationQueue((prev) => prev.slice(1));
@@ -1058,6 +1117,7 @@ export const ChatProvider: React.FC<ChatProviderProps> = ({
     askBtw,
     clearMessages,
     compact,
+    addDir,
     abortMessage,
     recallQueuedMessage,
     removeQueuedMessageById,

package/src/hooks/useInputManager.ts

@@ -61,6 +61,7 @@ export const useInputManager = (
     onRecallQueuedMessage,
     onClearMessages,
     onCompact,
+    onAddDir,
     isIdle: isIdleProp,
   } = callbacks;
 
@@ -272,6 +273,8 @@ export const useInputManager = (
                 await onClearMessages?.();
               } else if (command === "compact") {
                 await onCompact?.(effect.args);
+              } else if (command === "add-dir") {
+                await onAddDir?.(effect.args);
               }
             }
             break;
@@ -300,6 +303,7 @@ export const useInputManager = (
     onRecallQueuedMessage,
     onClearMessages,
     onCompact,
+    onAddDir,
   ]);
 
   useEffect(() => {

package/src/index.ts

@@ -88,6 +88,12 @@ export async function main() {
         string: true,
         global: false,
       })
+      .option("add-dir", {
+        description: "Add a directory to the session Safe Zone (repeatable)",
+        type: "array",
+        string: true,
+        global: false,
+      })
       .option("tools", {
         description:
           'Specify a comma-separated list of tools to enable (e.g., \'Bash,Read,Write\'). Use "" to disable all, "default" for all.',
@@ -321,6 +327,12 @@ export async function main() {
       path.resolve(originalCwd, dir),
     );
 
+    // Resolve additional directories to absolute paths (relative to the
+    // original working directory, before any worktree change)
+    const additionalDirectories = (argv.addDir as string[] | undefined)?.map(
+      (dir) => path.resolve(originalCwd, dir),
+    );
+
     let worktreeSession: WorktreeSession | undefined;
     if (
       argv.worktree !== undefined ||
@@ -365,6 +377,7 @@ export async function main() {
         bypassPermissions: argv.dangerouslySkipPermissions as boolean,
         permissionMode: argv.permissionMode as PermissionMode | undefined,
         pluginDirs,
+        additionalDirectories,
         tools,
         allowedTools,
         disallowedTools,
@@ -390,6 +403,7 @@ export async function main() {
           | undefined,
         permissionMode: argv.permissionMode as PermissionMode | undefined,
         pluginDirs,
+        additionalDirectories,
         tools,
         allowedTools,
         disallowedTools,
@@ -420,6 +434,7 @@ export async function main() {
       bypassPermissions: argv.dangerouslySkipPermissions as boolean | undefined,
       permissionMode: argv.permissionMode as PermissionMode | undefined,
       pluginDirs,
+      additionalDirectories,
       tools,
       allowedTools,
       disallowedTools,

package/src/managers/inputHandlers.ts

@@ -394,6 +394,8 @@ export const handleCommandSelect = (
           await callbacks.onClearMessages?.();
         } else if (command === "compact") {
           await callbacks.onCompact?.();
+        } else if (command === "add-dir") {
+          await callbacks.onAddDir?.();
         }
       }
     })();

package/src/managers/inputReducer.ts

@@ -99,6 +99,7 @@ export interface InputManagerCallbacks {
   ) => Promise<string>;
   onClearMessages?: () => Promise<void>;
   onCompact?: (instructions?: string) => Promise<void>;
+  onAddDir?: (args?: string) => Promise<void>;
   sessionId?: string;
   workdir?: string;
   getFullMessageThread?: () => Promise<{

package/src/print-cli.ts

@@ -44,6 +44,7 @@ export async function startPrintCli(options: PrintCliOptions): Promise<void> {
     bypassPermissions,
     permissionMode,
     pluginDirs,
+    additionalDirectories,
     tools,
     allowedTools,
     disallowedTools,
@@ -125,6 +126,7 @@ export async function startPrintCli(options: PrintCliOptions): Promise<void> {
       permissionMode:
         permissionMode || (bypassPermissions ? "bypassPermissions" : undefined),
       plugins: pluginDirs?.map((path) => ({ type: "local", path })),
+      additionalDirectories,
       tools,
       allowedTools,
       disallowedTools,

package/src/reducers/confirmationReducer.ts

@@ -1,5 +1,5 @@
 import { Key } from "ink";
-import type { PermissionDecision } from "wave-agent-sdk";
+import type { PermissionDecision, PermissionMode } from "wave-agent-sdk";
 import {
   BASH_TOOL_NAME,
   EXIT_PLAN_MODE_TOOL_NAME,
@@ -30,6 +30,7 @@ export type ConfirmationAction =
       toolInput?: Record<string, unknown>;
       suggestedPrefix?: string;
       hidePersistentOption?: boolean;
+      permissionMode?: PermissionMode;
     };
 
 export function confirmationReducer(
@@ -95,6 +96,7 @@ export function confirmationReducer(
         toolInput,
         suggestedPrefix,
         hidePersistentOption,
+        permissionMode,
       } = action;
 
       if (key.return) {
@@ -175,7 +177,10 @@ export function confirmationReducer(
       const availableOptions: ConfirmationState["selectedOption"][] = [];
       availableOptions.push("allow");
       if (!hidePersistentOption) availableOptions.push("auto");
-      if (toolName === BASH_TOOL_NAME || toolName === EXIT_PLAN_MODE_TOOL_NAME)
+      if (
+        toolName === EXIT_PLAN_MODE_TOOL_NAME ||
+        (toolName === BASH_TOOL_NAME && permissionMode !== "plan")
+      )
         availableOptions.push("bypass");
       availableOptions.push("alternative");
 

package/src/stdio/agentBridge.ts

@@ -45,10 +45,14 @@ import {
 } from "wave-agent-sdk";
 import {
   type JsonRpcError,
+  INVALID_PARAMS as PROTOCOL_INVALID_PARAMS,
   INTERNAL_ERROR as PROTOCOL_INTERNAL_ERROR,
   METHOD_NOT_FOUND as PROTOCOL_METHOD_NOT_FOUND,
 } from "./protocol.js";
 import { execFileSync } from "node:child_process";
+import { mkdirSync, existsSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, extname, join } from "node:path";
 import { createWorktree, removeWorktree } from "../utils/worktree.js";
 import { logger } from "../utils/logger.js";
 import { isUserCheckpointMessage } from "../utils/rewindCheckpoints.js";
@@ -222,6 +226,10 @@ export class AgentBridge {
       // ── File / History (global — no session required) ──
       case "searchFiles":
         return this.searchFiles(p as unknown as SearchFilesParams, sessionId);
+      case "writeArtifactFile":
+        return this.writeArtifactFile(
+          p as unknown as { name: string; contentBase64: string },
+        );
       case "getPromptHistory":
         return this.getPromptHistory(
           p.workdir as string | undefined,
@@ -982,6 +990,40 @@ export class AgentBridge {
     return { files };
   }
 
+  /**
+   * Writes an uploaded file (from the desktop/webview "+上传文件" flow) into the
+   * artifacts dir on THIS machine — i.e. where the agent runs. Remote sessions
+   * call this over the ssh tunnel so the returned path is reachable by the
+   * remote agent's tools; local sessions never hit this (desktop writes locally
+   * itself).
+   */
+  private async writeArtifactFile(params: {
+    name: string;
+    contentBase64: string;
+  }): Promise<{ path: string }> {
+    // Artifacts are keyed by basename only — reject anything that could escape
+    // the artifacts dir via path traversal.
+    const safeName = basename(params.name || "");
+    if (!safeName || safeName === "." || safeName === "..") {
+      throw new RpcError(
+        PROTOCOL_INVALID_PARAMS,
+        `Invalid artifact file name: ${params.name}`,
+      );
+    }
+    const artifactsDir = join(tmpdir(), "wave-artifacts");
+    mkdirSync(artifactsDir, { recursive: true });
+    let finalPath = join(artifactsDir, safeName);
+    let counter = 1;
+    while (existsSync(finalPath)) {
+      const ext = extname(safeName);
+      const baseName = basename(safeName, ext);
+      finalPath = join(artifactsDir, `${baseName}_${counter}${ext}`);
+      counter++;
+    }
+    writeFileSync(finalPath, Buffer.from(params.contentBase64 || "", "base64"));
+    return { path: finalPath };
+  }
+
   private async getPromptHistory(
     workdir?: string,
     sessionId?: string,

package/src/stdio/protocol.ts

@@ -71,6 +71,7 @@ export type RequestMethod =
   | "disconnectMcpServer"
   | "getSlashCommands"
   | "searchFiles"
+  | "writeArtifactFile"
   | "getPromptHistory"
   | "searchPromptHistory"
   | "updateConfig"

package/src/types.ts

@@ -5,6 +5,8 @@ export interface BaseAppProps {
   bypassPermissions?: boolean;
   permissionMode?: PermissionMode;
   pluginDirs?: string[];
+  /** Additional directories to add to the session Safe Zone (from --add-dir). */
+  additionalDirectories?: string[];
   tools?: string[];
   allowedTools?: string[];
   disallowedTools?: string[];