@iinm/plain-agent 1.10.19 → 1.10.21

package/README.md

@@ -345,14 +345,13 @@ Files are loaded in the following order. Settings in later files override earlie
         └── agents/                # Project-specific agent roles
 ```
 
-### Example
-
 <details>
 <summary><b>YOLO mode example (requires a sandbox for safety)</b></summary>
 
 ```js
 {
   "autoApproval": {
+    // Deny all actions except explicitly allowed
     "defaultAction": "deny",
     "maxApprovals": 100,
     "patterns": [
@@ -378,17 +377,7 @@ Files are loaded in the following order. Settings in later files override earlie
   "sandbox": {
     "command": "plain-sandbox",
     "args": ["--allow-write", "--skip-build", "--keep-alive", "30"],
-    "separator": "--",
-    "rules": [
-      {
-        "pattern": {
-          "command": "npm",
-          "args": ["ci"]
-        },
-        "mode": "sandbox",
-        "additionalArgs": ["--allow-net", "0.0.0.0/0"]
-      }
-    ]
+    "separator": "--"
   }
 }
 ```
@@ -401,17 +390,16 @@ Files are loaded in the following order. Settings in later files override earlie
 {
   "autoApproval": {
     // Absolute paths outside the working directory that are allowed. Relative paths are ignored.
-    "allowedPaths": ["/tmp"],
+    "allowedPaths": ["/path/to/other/git-repo"],
+    // Allow access to git-unmanaged files (default: false).
+    // ⚠️ Changes to git-unmanaged files are hard to detect (e.g., node_modules). Sandbox is recommended.
+    "allowGitUnmanagedFiles": false,
+    // Default action when no patterns match. Can be "ask" (prompt user) or "deny" (block action).
     "defaultAction": "ask",
     // Maximum number of automatic approvals.
     "maxApprovals": 50,
     // Patterns are evaluated in order. First match wins.
     "patterns": [
-      {
-        "toolName": { "$regex": "^(write_file|patch_file)$" },
-        "input": { "filePath": { "$regex": "^\\.plain-agent/memory/.+\\.md$" } },
-        "action": "allow"
-      },
       {
         "toolName": { "$regex": "^(write_file|patch_file)$" },
         "input": { "filePath": { "$regex": "^src/" } },
@@ -440,6 +428,7 @@ Files are loaded in the following order. Settings in later files override earlie
 
   // Sandbox environment for the exec_command and tmux_command tools
   "sandbox": {
+    // Commands are wrapped and executed with this command
     "command": "plain-sandbox",
     "args": ["--allow-write", "--skip-build", "--keep-alive", "30"],
     // separator is inserted between sandbox flags and the user command to prevent bypasses
@@ -457,16 +446,15 @@ Files are loaded in the following order. Settings in later files override earlie
       {
         "pattern": {
           "command": "npm",
-          "args": ["install"]
+          "args": [{ "$regex": "^(install|ci)$" }]
         },
         "mode": "sandbox",
-        // Allow access to registry.npmjs.org
         "additionalArgs": ["--allow-net", "registry.npmjs.org"]
       }
     ]
   },
 
-  // Configure MCP servers
+  // MCP servers
   "mcpServers": {
     "chrome_devtools": {
       "command": "npx",
@@ -484,27 +472,11 @@ Files are loaded in the following order. Settings in later files override earlie
         // Enable only specific tools. If not specified, all tools are enabled.
         "enabledTools": ["notion-search", "notion-fetch"]
       }
-    },
-    "aws_knowledge": {
-      "command": "npx",
-      "args": ["-y", "mcp-remote", "https://knowledge-mcp.global.api.aws"]
-    },
-    // ⚠️ Add this to config.local.json to avoid committing secrets to Git
-    "google_developer-knowledge": {
-      "command": "npx",
-      "args": ["-y", "mcp-remote", "https://developerknowledge.googleapis.com/mcp", "--header", "X-Goog-Api-Key:<GOOGLE_API_KEY>"]
     }
   },
 
   // Override the default notification command
   "notifyCmd": { "command": "plain-notify-desktop", "args": [] }
-
-  // Voice input. See "Voice Input" below.
-  // ⚠️ Add this to config.local.json to avoid committing secrets to Git
-  "voiceInput": {
-    "provider": "openai",
-    "apiKey": "<OPENAI_API_KEY>"
-  }
 }
 ```
 </details>

package/config/config.predefined.json

@@ -257,7 +257,7 @@
       }
     },
     {
-      "name": "claude-opus-4-7",
+      "name": "claude-opus-4-8",
       "variant": "thinking-high",
       "platform": {
         "name": "anthropic",
@@ -267,7 +267,7 @@
       "model": {
         "format": "anthropic",
         "config": {
-          "model": "claude-opus-4-7",
+          "model": "claude-opus-4-8",
           "max_tokens": 32768,
           "thinking": { "type": "adaptive" },
           "output_config": { "effort": "high" }
@@ -285,7 +285,7 @@
       }
     },
     {
-      "name": "claude-opus-4-7",
+      "name": "claude-opus-4-8",
       "variant": "thinking-max",
       "platform": {
         "name": "anthropic",
@@ -295,7 +295,7 @@
       "model": {
         "format": "anthropic",
         "config": {
-          "model": "claude-opus-4-7",
+          "model": "claude-opus-4-8",
           "max_tokens": 64000,
           "thinking": { "type": "adaptive" },
           "output_config": { "effort": "max" }
@@ -420,7 +420,7 @@
       }
     },
     {
-      "name": "claude-opus-4-7",
+      "name": "claude-opus-4-8",
       "variant": "thinking-high-bedrock",
       "platform": {
         "name": "bedrock",
@@ -429,7 +429,7 @@
       "model": {
         "format": "anthropic",
         "config": {
-          "model": "global.anthropic.claude-opus-4-7",
+          "model": "global.anthropic.claude-opus-4-8",
           "max_tokens": 32768,
           "thinking": { "type": "adaptive" },
           "output_config": { "effort": "high" }
@@ -447,7 +447,7 @@
       }
     },
     {
-      "name": "claude-opus-4-7",
+      "name": "claude-opus-4-8",
       "variant": "thinking-max-bedrock",
       "platform": {
         "name": "bedrock",
@@ -456,7 +456,7 @@
       "model": {
         "format": "anthropic",
         "config": {
-          "model": "global.anthropic.claude-opus-4-7",
+          "model": "global.anthropic.claude-opus-4-8",
           "max_tokens": 64000,
           "thinking": { "type": "adaptive" },
           "output_config": { "effort": "max" }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iinm/plain-agent",
-  "version": "1.10.19",
+  "version": "1.10.21",
   "description": "A lightweight coding agent for the terminal.",
   "license": "MIT",
   "type": "module",

package/sandbox/bin/plain-sandbox

@@ -890,8 +890,6 @@ test -L ~/.zsh_history || (touch /persistent/home/.zsh_history; ln -s /persisten
 test -L ~/.config || (mkdir -p /persistent/home/.config; ln -s /persistent/home/.config ~/ 2> /dev/null)
 test -L ~/.gitconfig || (touch /persistent/home/.gitconfig; ln -s /persistent/home/.gitconfig ~/ 2> /dev/null)
 test -L ~/.local || (mkdir -p /persistent/home/.local/share; ln -s /persistent/home/.local ~/ 2> /dev/null)
-test -L ~/.gemini || (mkdir -p /persistent/home/.gemini; ln -s /persistent/home/.gemini ~/ 2> /dev/null)
-test -L ~/.codex || (mkdir -p /persistent/home/.codex; ln -s /persistent/home/.codex ~/ 2> /dev/null)
 
 eval "$(mise activate bash)"
 exec "$@"

package/src/config.d.ts

@@ -76,6 +76,8 @@ export type AppConfig = {
     defaultAction?: "deny" | "ask";
     /** Additional absolute paths to allow for auto-approval (outside working directory) */
     allowedPaths?: string[];
+    /** Allow access to git-unmanaged files (default: false) */
+    allowGitUnmanagedFiles?: boolean;
   };
   sandbox?: ExecCommandSanboxConfig;
   tools?: {

package/src/config.mjs

@@ -77,6 +77,9 @@ export async function loadAppConfig(options = {}) {
           ...(config.autoApproval?.allowedPaths ?? []),
           ...(merged.autoApproval?.allowedPaths ?? []),
         ],
+        allowGitUnmanagedFiles:
+          config.autoApproval?.allowGitUnmanagedFiles ??
+          merged.autoApproval?.allowGitUnmanagedFiles,
       },
       sandbox: config.sandbox ?? merged.sandbox,
       tools: {

package/src/main.mjs

@@ -369,6 +369,8 @@ export async function main(argv = process.argv) {
     defaultAction: appConfig.autoApproval?.defaultAction || "ask",
     patterns: appConfig.autoApproval?.patterns || [],
     allowedPaths: appConfig.autoApproval?.allowedPaths ?? [],
+    allowGitUnmanagedFiles:
+      appConfig.autoApproval?.allowGitUnmanagedFiles ?? false,
     maskApprovalInput: (toolName, input) => {
       for (const tool of builtinTools) {
         if (tool.def.name === toolName && tool.maskApprovalInput) {

package/src/prompt.mjs

@@ -73,7 +73,7 @@ Always read the target lines with \`read_file\` first to verify line numbers and
 
 ## exec_command
 
-- Use relative paths.
+- Use relative paths for files inside the working directory, absolute paths for files outside.
 - Use ${projectMetadataDir}/tmp/ for temporary files.
 - Use bash -c only when pipes (|) or redirection (>, <) are required.
 

package/src/tool.d.ts

@@ -39,6 +39,8 @@ export type ToolUseApproverConfig = {
   defaultAction: "deny" | "ask";
   /** Additional absolute paths to allow for auto-approval (outside working directory) */
   allowedPaths?: string[];
+  /** Allow access to git-unmanaged files (default: false) */
+  allowGitUnmanagedFiles?: boolean;
 
   /**
    * Mask the input before auto-approval checks and recording.

package/src/toolInputValidator.mjs

@@ -18,19 +18,26 @@ const BUILTIN_ALLOWED_PATHS = [
 /**
  * @param {unknown} input
  * @param {string[]} [allowedPaths=[]] - Additional allowed paths (outside working directory)
+ * @param {boolean} [allowGitUnmanagedFiles=false] - Allow access to git-unmanaged files
  * @returns {boolean}
  */
-export function isSafeToolInput(input, allowedPaths = []) {
+export function isSafeToolInput(
+  input,
+  allowedPaths = [],
+  allowGitUnmanagedFiles = false,
+) {
   if (["number", "boolean", "undefined"].includes(typeof input)) {
     return true;
   }
 
   if (typeof input === "string") {
-    return isSafeToolInputItem(input, allowedPaths);
+    return isSafeToolInputItem(input, allowedPaths, allowGitUnmanagedFiles);
   }
 
   if (Array.isArray(input)) {
-    return input.every((item) => isSafeToolInput(item, allowedPaths));
+    return input.every((item) =>
+      isSafeToolInput(item, allowedPaths, allowGitUnmanagedFiles),
+    );
   }
 
   if (typeof input === "object") {
@@ -38,7 +45,7 @@ export function isSafeToolInput(input, allowedPaths = []) {
       return true;
     }
     return Object.values(input).every((value) =>
-      isSafeToolInput(value, allowedPaths),
+      isSafeToolInput(value, allowedPaths, allowGitUnmanagedFiles),
     );
   }
 
@@ -48,9 +55,14 @@ export function isSafeToolInput(input, allowedPaths = []) {
 /**
  * @param {string} arg
  * @param {string[]} [allowedPaths=[]] - Additional allowed paths (outside working directory)
+ * @param {boolean} [allowGitUnmanagedFiles=false] - Allow access to git-unmanaged files
  * @returns {boolean}
  */
-export function isSafeToolInputItem(arg, allowedPaths = []) {
+export function isSafeToolInputItem(
+  arg,
+  allowedPaths = [],
+  allowGitUnmanagedFiles = false,
+) {
   const workingDir = process.cwd();
 
   // Note: An argument can be a command option (e.g., '-l').
@@ -84,18 +96,20 @@ export function isSafeToolInputItem(arg, allowedPaths = []) {
     return false;
   }
 
-  // User-configured allowed paths (outside working directory)
-  if (isInUserAllowedPath(realPath, allowedPaths)) {
-    return true;
+  // Path must be inside the working directory or in user-configured allowed paths
+  if (
+    !isInsideWorkingDirectory(realPath, workingDir) &&
+    !isInUserAllowedPath(realPath, allowedPaths)
+  ) {
+    return false;
   }
 
-  // Disallow paths outside the working directory (not in allowedPaths)
-  if (!isInsideWorkingDirectory(realPath, workingDir)) {
+  // Deny git-unmanaged files (outside git repo or git-ignored)
+  if (!allowGitUnmanagedFiles && !isGitManaged(realPath)) {
     return false;
   }
 
-  // Deny git ignored files (which may contain sensitive information or should not be accessed)
-  return !isGitIgnored(realPath);
+  return true;
 }
 
 /**
@@ -216,16 +230,33 @@ function isInsideProjectMetadataDir(targetPath) {
 }
 
 /**
+ * Check if the path is managed by git (inside a git repo and not ignored).
  * @param {string} absPath
  * @returns {boolean}
  */
-function isGitIgnored(absPath) {
+function isGitManaged(absPath) {
+  const dir = findExistingDirectory(absPath);
+
+  /** @type {string} */
+  let gitRoot;
   try {
-    execFileSync("git", ["check-ignore", "--no-index", "-q", absPath], {
-      stdio: ["ignore", "ignore", "ignore"],
-    });
-    // The path is ignored (exit code 0)
-    return true;
+    gitRoot = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8",
+    }).trim();
+  } catch {
+    // Not inside a git repository
+    return false;
+  }
+
+  try {
+    execFileSync(
+      "git",
+      ["-C", gitRoot, "check-ignore", "--no-index", "-q", absPath],
+      { stdio: ["ignore", "ignore", "ignore"] },
+    );
+    // File is git-ignored: not managed
+    return false;
   } catch (error) {
     if (
       error instanceof Error &&
@@ -233,11 +264,28 @@ function isGitIgnored(absPath) {
       typeof error.status === "number" &&
       error.status === 1
     ) {
-      // Path is not ignored
-      return false;
+      // Not ignored: managed
+      return true;
     }
-    // Other errors (e.g., status 128 if not a git repo or other git error)
-    // We treat this as "effectively ignored" to be safe.
-    return true;
+    // Other error: treat as not managed for safety
+    return false;
+  }
+}
+
+/**
+ * @param {string} absPath
+ * @returns {string}
+ */
+function findExistingDirectory(absPath) {
+  const stats = noThrowSync(() => fs.statSync(absPath));
+  if (!(stats instanceof Error)) {
+    return stats.isDirectory() ? absPath : path.dirname(absPath);
+  }
+  let dir = absPath;
+  while (!fs.existsSync(dir)) {
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
+  return dir;
 }

package/src/toolUseApprover.mjs

@@ -16,6 +16,7 @@ export function createToolUseApprover({
   defaultAction,
   maskApprovalInput,
   allowedPaths = [],
+  allowGitUnmanagedFiles = false,
 }) {
   const state = {
     approvalCount: 0,
@@ -65,7 +66,9 @@ export function createToolUseApprover({
 
       if (action === "allow") {
         const maskedInput = maskApprovalInput(toolUse.toolName, toolUse.input);
-        if (isSafeToolInput(maskedInput, allowedPaths)) {
+        if (
+          isSafeToolInput(maskedInput, allowedPaths, allowGitUnmanagedFiles)
+        ) {
           state.approvalCount += 1;
           return state.approvalCount <= max
             ? { action: "allow" }