@iinm/plain-agent 1.0.5 → 1.0.6

package/README.md

@@ -2,9 +2,9 @@
 
 A lightweight CLI-based coding agent.
 
-- **Safety controls** — Configure per-tool approval rules and run in a sandbox for stronger isolation
-- **Multi-provider** — Works with Anthropic, OpenAI, Gemini, AWS Bedrock, Azure, Vertex AI, and more
-- **Sequential subagent delegation** — Delegate subtasks to specialized subagents with full visibility into their actions
+- **Safety controls** — Configure approval rules and sandboxing for safe execution
+- **Multi-provider** — Supports Anthropic, OpenAI, Gemini, Bedrock, Azure, Vertex AI, and more
+- **Sequential subagent delegation** — Delegate subtasks to specialized subagents with full visibility
 - **MCP support** — Connect to external MCP servers to extend available tools
 - **Claude Code compatible** *(experimental)* — Reuse Claude Code plugins, agents, commands, and skills
 
@@ -13,8 +13,7 @@ A lightweight CLI-based coding agent.
 This CLI tool automatically allows the execution of certain tools but requires explicit approval for security-sensitive operations, such as accessing parent directories.
 The security rules are defined in [`config.predefined.json`](https://github.com/iinm/plain-agent/blob/main/.config/config.predefined.json) and [`toolInputValidator.mjs`](https://github.com/iinm/plain-agent/blob/main/src/toolInputValidator.mjs) within this repository.
 
-⚠️ The `write_file` and `patch_file` tools block direct access to git-ignored files. However, `exec_command` can access any files in your environment.
-Use a sandbox for stronger isolation.
+⚠️ `write_file` and `patch_file` block access to git-ignored files. `exec_command` blocks direct path arguments (e.g., `ls .env`), but cannot block access from executed programs (e.g., `node script.js`). Use a sandbox for stronger isolation.
 
 ## Requirements
 
@@ -34,8 +33,7 @@ npm install -g @iinm/plain-agent
 List available models.
 
 ```sh
-curl https://raw.githubusercontent.com/iinm/plain-agent/refs/heads/main/.config/config.predefined.json \
-  | jq -r '.models[] | "\(.name)+\(.variant)"'
+plain --list-models
 ```
 
 Create the configuration.
@@ -43,9 +41,10 @@ Create the configuration.
 ```js
 // ~/.config/plain-agent/config.local.json
 {
-  // Default model
   "model": "gpt-5.4+thinking-high",
+  // "model": "claude-sonnet-4-6+thinking-16k",
 
+  // Configure the providers you want to use
   "platforms": [
     {
       "name": "anthropic",
@@ -61,13 +60,35 @@ Create the configuration.
       "name": "openai",
       "variant": "default",
       "apiKey": "FIXME"
+    },
+    {
+      // Requires Azure CLI to get access token
+      "name": "azure",
+      "variant": "default",
+      "baseURL": "https://<resource>.openai.azure.com/openai",
+      // Optional
+      "azureConfigDir": "/home/xxx/.azure-for-agent"
+    },
+    {
+      "name": "bedrock",
+      "variant": "default",
+      "baseURL": "https://bedrock-runtime.<region>.amazonaws.com",
+      "awsProfile": "FIXME"
+    },
+    {
+      // Requires gcloud CLI to get authentication token
+      "name": "vertex-ai",
+      "variant": "default",
+      "baseURL": "https://aiplatform.googleapis.com/v1beta1/projects/<project>/locations/<location>",
+      // Optional
+      "account": "<service_account_email>"
     }
   ],
 
   // Optional
   "tools": {
     "askGoogle": {
-      "model": "gemini-3-flash-preview"
+      "model": "gemini-3-flash-preview",
 
       // Google AI Studio
       "apiKey": "FIXME"
@@ -76,42 +97,22 @@ Create the configuration.
       // "platform": "vertex-ai",
       // "baseURL": "https://aiplatform.googleapis.com/v1beta1/projects/<project_id>/locations/<location>",
     },
-    "tavily": {
-      "apiKey": "FIXME"
+
+    "searchWeb": {
+      "tavilyApiKey": "FIXME"
     }
-  }
+  },
+
 }
 
 ```
 
 <details>
-<summary>Extra provider examples</summary>
+<summary>Other provider examples</summary>
 
 ```js
 {
   "platforms": [
-    {
-      // Requires Azure CLI to get access token
-      "name": "azure",
-      "variant": "default",
-      "baseURL": "https://<resource>.openai.azure.com/openai",
-      // Optional
-      "azureConfigDir": "/home/xxx/.azure-for-agent"
-    },
-    {
-      "name": "bedrock",
-      "variant": "default",
-      "baseURL": "https://bedrock-runtime.<region>.amazonaws.com",
-      "awsProfile": "FIXME"
-    },
-    {
-      // Requires gcloud CLI to get authentication token
-      "name": "vertex-ai",
-      "variant": "default",
-      "baseURL": "https://aiplatform.googleapis.com/v1beta1/projects/<project>/locations/<location>",
-      // Optional
-      "account": "<service_account_email>"
-    },
     {
       "name": "openai",
       "variant": "ollama",
@@ -164,8 +165,8 @@ The agent can use the following tools to assist with tasks:
 - **patch_file**: Patch a file.
 - **tmux_command**: Run a tmux command.
 - **fetch_web_page**: Fetch and extract web page content from a given URL, returning it as Markdown.
-- **search_web**: Search the web for information (requires Tavily API key).
 - **ask_google**: Ask Google a question using natural language (requires Gemini API key).
+- **search_web**: Search the web for information (requires Tavily API key).
 - **delegate_to_subagent**: Delegate a subtask to a subagent. The agent switches to a subagent role within the same conversation, focusing on the specified goal.
 - **report_as_subagent**: Report completion and return to the main agent. Used by subagents to communicate results and restore the main agent role. After reporting, the subagent's conversation history is removed from the context.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iinm/plain-agent",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "A lightweight CLI-based coding agent",
   "license": "MIT",
   "type": "module",

package/src/cliArgs.mjs

@@ -2,6 +2,7 @@
  * @typedef {Object} CliArgs
  * @property {string|null} model - Model name with variant
  * @property {boolean} showHelp - Whether to show help message
+ * @property {boolean} listModels - Whether to list available models
  */
 
 /**
@@ -12,13 +13,15 @@
 export function parseCliArgs(argv) {
   const args = argv.slice(2);
   /** @type {CliArgs} */
-  const result = { model: null, showHelp: false };
+  const result = { model: null, showHelp: false, listModels: false };
 
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "-m" && args[i + 1]) {
       result.model = args[++i];
     } else if (args[i] === "-h" || args[i] === "--help") {
       result.showHelp = true;
+    } else if (args[i] === "-l" || args[i] === "--list-models") {
+      result.listModels = true;
     }
   }
 
@@ -35,6 +38,7 @@ Usage: agent [options]
 
 Options:
   -m <model+variant>  Model to use
+  -l, --list-models   List available models
   -h, --help          Show this help message
 
 Examples:

package/src/config.d.ts

@@ -18,9 +18,6 @@ export type AppConfig = {
   };
   sandbox?: ExecCommandSanboxConfig;
   tools?: {
-    tavily?: {
-      apiKey?: string;
-    };
     /**
      * - Vertex AI: requires baseURL and account
      * - AI Studio: requires apiKey
@@ -32,6 +29,9 @@ export type AppConfig = {
       apiKey?: string;
       model?: string;
     };
+    searchWeb?: {
+      tavilyApiKey?: string;
+    };
   };
   mcpServers?: Record<string, MCPServerConfig>;
   notifyCmd?: string;

package/src/config.mjs

@@ -16,9 +16,12 @@ import {
 import { evalJSONConfig } from "./utils/evalJSONConfig.mjs";
 
 /**
+ * @param {Object} [options]
+ * @param {boolean} [options.skipTrustCheck] - Skip trust check for config files
  * @returns {Promise<{appConfig: AppConfig, loadedConfigPath: string[]}>}
  */
-export async function loadAppConfig() {
+export async function loadAppConfig(options = {}) {
+  const { skipTrustCheck = false } = options;
   const paths = [
     `${AGENT_ROOT}/.config/config.predefined.json`,
     `${AGENT_USER_CONFIG_DIR}/config.json`,
@@ -33,7 +36,7 @@ export async function loadAppConfig() {
   let merged = {};
 
   for (const filePath of paths) {
-    const config = await loadConfigFile(path.resolve(filePath));
+    const config = await loadConfigFile(path.resolve(filePath), skipTrustCheck);
     if (Object.keys(config).length) {
       loadedConfigPath.push(filePath);
     }
@@ -55,9 +58,9 @@ export async function loadAppConfig() {
       },
       sandbox: config.sandbox ?? merged.sandbox,
       tools: {
-        tavily: {
-          ...(merged.tools?.tavily ?? {}),
-          ...(config.tools?.tavily ?? {}),
+        searchWeb: {
+          ...(merged.tools?.searchWeb ?? {}),
+          ...(config.tools?.searchWeb ?? {}),
         },
         askGoogle: {
           ...(merged.tools?.askGoogle ?? {}),
@@ -81,9 +84,10 @@ export async function loadAppConfig() {
 
 /**
  * @param {string} filePath
+ * @param {boolean} [skipTrustCheck=false]
  * @returns {Promise<AppConfig>}
  */
-export async function loadConfigFile(filePath) {
+export async function loadConfigFile(filePath, skipTrustCheck = false) {
   let content;
   try {
     content = await fs.readFile(filePath, "utf-8");
@@ -95,7 +99,7 @@ export async function loadConfigFile(filePath) {
   }
 
   const hash = crypto.createHash("sha256").update(content).digest("hex");
-  const isTrusted = await isConfigHashTrusted(hash);
+  const isTrusted = skipTrustCheck || (await isConfigHashTrusted(hash));
 
   if (!isTrusted) {
     if (!process.stdout.isTTY) {

package/src/main.mjs

@@ -33,6 +33,21 @@ if (cliArgs.showHelp) {
   printHelp();
 }
 
+if (cliArgs.listModels) {
+  const { appConfig } = await loadAppConfig({ skipTrustCheck: true });
+  if (!appConfig.models || appConfig.models.length === 0) {
+    console.error("No models found in configuration.");
+    process.exit(1);
+  }
+  for (const model of appConfig.models) {
+    const platform = model.platform;
+    console.log(
+      `${model.name}+${model.variant} (platform: ${platform.name}+${platform.variant})`,
+    );
+  }
+  process.exit(0);
+}
+
 (async () => {
   const startTime = new Date();
   const sessionId = [
@@ -118,8 +133,8 @@ if (cliArgs.showHelp) {
     createReportAsSubagentTool(),
   ];
 
-  if (appConfig.tools?.tavily?.apiKey) {
-    builtinTools.push(createTavilySearchTool(appConfig.tools.tavily));
+  if (appConfig.tools?.searchWeb?.tavilyApiKey) {
+    builtinTools.push(createTavilySearchTool(appConfig.tools.searchWeb));
   }
 
   if (appConfig.tools?.askGoogle) {

package/src/tools/tavilySearch.mjs

@@ -6,7 +6,7 @@
 import { noThrow } from "../utils/noThrow.mjs";
 
 /**
- * @param {{apiKey?: string}} config
+ * @param {{tavilyApiKey?: string}} config
  * @returns {Tool}
  */
 export function createTavilySearchTool(config) {
@@ -34,7 +34,7 @@ export function createTavilySearchTool(config) {
         const response = await fetch("https://api.tavily.com/search", {
           method: "POST",
           headers: {
-            Authorization: `Bearer ${config.apiKey}`,
+            Authorization: `Bearer ${config.tavilyApiKey}`,
             "Content-Type": "application/json",
           },
           body: JSON.stringify({