@iinm/plain-agent 1.10.20 → 1.10.22

package/README.md

@@ -345,14 +345,13 @@ Files are loaded in the following order. Settings in later files override earlie
         └── agents/                # Project-specific agent roles
 ```
 
-### Example
-
 <details>
 <summary><b>YOLO mode example (requires a sandbox for safety)</b></summary>
 
 ```js
 {
   "autoApproval": {
+    // Deny all actions except explicitly allowed
     "defaultAction": "deny",
     "maxApprovals": 100,
     "patterns": [
@@ -361,7 +360,7 @@ Files are loaded in the following order. Settings in later files override earlie
         "action": "allow"
       },
       {
-        "toolName": { "$regex": "^(exec_command|tmux_command)$" },
+        "toolName": "exec_command",
         "action": "allow"
       },
       {
@@ -378,17 +377,7 @@ Files are loaded in the following order. Settings in later files override earlie
   "sandbox": {
     "command": "plain-sandbox",
     "args": ["--allow-write", "--skip-build", "--keep-alive", "30"],
-    "separator": "--",
-    "rules": [
-      {
-        "pattern": {
-          "command": "npm",
-          "args": ["ci"]
-        },
-        "mode": "sandbox",
-        "additionalArgs": ["--allow-net", "0.0.0.0/0"]
-      }
-    ]
+    "separator": "--"
   }
 }
 ```
@@ -401,17 +390,16 @@ Files are loaded in the following order. Settings in later files override earlie
 {
   "autoApproval": {
     // Absolute paths outside the working directory that are allowed. Relative paths are ignored.
-    "allowedPaths": ["/tmp"],
+    "allowedPaths": ["/path/to/other/git-repo"],
+    // Allow access to git-unmanaged files (default: false).
+    // ⚠️ Changes to git-unmanaged files are hard to detect (e.g., node_modules). Sandbox is recommended.
+    "allowGitUnmanagedFiles": false,
+    // Default action when no patterns match. Can be "ask" (prompt user) or "deny" (block action).
     "defaultAction": "ask",
     // Maximum number of automatic approvals.
     "maxApprovals": 50,
     // Patterns are evaluated in order. First match wins.
     "patterns": [
-      {
-        "toolName": { "$regex": "^(write_file|patch_file)$" },
-        "input": { "filePath": { "$regex": "^\\.plain-agent/memory/.+\\.md$" } },
-        "action": "allow"
-      },
       {
         "toolName": { "$regex": "^(write_file|patch_file)$" },
         "input": { "filePath": { "$regex": "^src/" } },
@@ -438,8 +426,17 @@ Files are loaded in the following order. Settings in later files override earlie
     ]
   },
 
+  "tools": {
+    // Enable web tools. See Quick Start section.
+    "webSearch": {},
+    "webFetch": {},
+    // Enable the tmux tool
+    "tmux": { "enabled": true }
+  },
+
   // Sandbox environment for the exec_command and tmux_command tools
   "sandbox": {
+    // Commands are wrapped and executed with this command
     "command": "plain-sandbox",
     "args": ["--allow-write", "--skip-build", "--keep-alive", "30"],
     // separator is inserted between sandbox flags and the user command to prevent bypasses
@@ -457,16 +454,15 @@ Files are loaded in the following order. Settings in later files override earlie
       {
         "pattern": {
           "command": "npm",
-          "args": ["install"]
+          "args": [{ "$regex": "^(install|ci)$" }]
         },
         "mode": "sandbox",
-        // Allow access to registry.npmjs.org
         "additionalArgs": ["--allow-net", "registry.npmjs.org"]
       }
     ]
   },
 
-  // Configure MCP servers
+  // MCP servers
   "mcpServers": {
     "chrome_devtools": {
       "command": "npx",
@@ -484,27 +480,11 @@ Files are loaded in the following order. Settings in later files override earlie
         // Enable only specific tools. If not specified, all tools are enabled.
         "enabledTools": ["notion-search", "notion-fetch"]
       }
-    },
-    "aws_knowledge": {
-      "command": "npx",
-      "args": ["-y", "mcp-remote", "https://knowledge-mcp.global.api.aws"]
-    },
-    // ⚠️ Add this to config.local.json to avoid committing secrets to Git
-    "google_developer-knowledge": {
-      "command": "npx",
-      "args": ["-y", "mcp-remote", "https://developerknowledge.googleapis.com/mcp", "--header", "X-Goog-Api-Key:<GOOGLE_API_KEY>"]
     }
   },
 
   // Override the default notification command
   "notifyCmd": { "command": "plain-notify-desktop", "args": [] }
-
-  // Voice input. See "Voice Input" below.
-  // ⚠️ Add this to config.local.json to avoid committing secrets to Git
-  "voiceInput": {
-    "provider": "openai",
-    "apiKey": "<OPENAI_API_KEY>"
-  }
 }
 ```
 </details>
@@ -517,7 +497,7 @@ The agent can use the following tools:
 - **write_file**: Write a file.
 - **patch_file**: Patch a file.
 - **exec_command**: Run a command without shell interpretation.
-- **tmux_command**: Run a tmux command.
+- **tmux_command**: Run a tmux command. It is disabled by default.
 - **web_search**: Search the web with one or more keyword sets and answer a question based on the combined results (requires Google API key, Vertex AI configuration, or the `command` provider with a local search command).
 - **web_fetch**: Fetch the contents of a single URL and answer a question based on it (requires Google API key, Vertex AI configuration, or the `command` provider with a local fetch command such as `w3m`, `curl`, or `lynx`).
 - **switch_to_subagent**: Switch to a subagent role within the same conversation, focusing on the specified goal.

package/config/config.predefined.json

@@ -9,6 +9,15 @@
         "action": "deny",
         "reason": "Use rg or fd instead"
       },
+      {
+        "toolName": "exec_command",
+        "input": {
+          "command": "bash",
+          "args": ["-c", { "$not": { "$regex": "[|><&;$`]" } }]
+        },
+        "action": "deny",
+        "reason": "Use bash -c only when shell features (|, >, <, &, ;, $, `) are required"
+      },
       {
         "toolName": "exec_command",
         "input": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iinm/plain-agent",
-  "version": "1.10.20",
+  "version": "1.10.22",
   "description": "A lightweight coding agent for the terminal.",
   "license": "MIT",
   "type": "module",

package/src/config.d.ts

@@ -76,11 +76,14 @@ export type AppConfig = {
     defaultAction?: "deny" | "ask";
     /** Additional absolute paths to allow for auto-approval (outside working directory) */
     allowedPaths?: string[];
+    /** Allow access to git-unmanaged files (default: false) */
+    allowGitUnmanagedFiles?: boolean;
   };
   sandbox?: ExecCommandSanboxConfig;
   tools?: {
     webSearch?: WebSearchToolConfig;
     webFetch?: WebFetchToolConfig;
+    tmux?: { enabled: boolean };
   };
   mcpServers?: Record<string, MCPServerConfig>;
   notifyCmd?: { command: string; args?: string[] };

package/src/config.mjs

@@ -77,6 +77,9 @@ export async function loadAppConfig(options = {}) {
           ...(config.autoApproval?.allowedPaths ?? []),
           ...(merged.autoApproval?.allowedPaths ?? []),
         ],
+        allowGitUnmanagedFiles:
+          config.autoApproval?.allowGitUnmanagedFiles ??
+          merged.autoApproval?.allowGitUnmanagedFiles,
       },
       sandbox: config.sandbox ?? merged.sandbox,
       tools: {
@@ -92,6 +95,12 @@ export async function loadAppConfig(options = {}) {
               ...config.tools.webFetch,
             }
           : merged.tools?.webFetch,
+        tmux: config.tools?.tmux
+          ? {
+              ...(merged.tools?.tmux ?? {}),
+              ...config.tools.tmux,
+            }
+          : merged.tools?.tmux,
       },
       mcpServers: {
         ...(merged.mcpServers ?? {}),

package/src/main.mjs

@@ -139,8 +139,6 @@ export async function main(argv = process.argv) {
     ? new Date(resumedState.startTime)
     : new Date();
   const sessionId = resumedState ? resumedState.sessionId : generateSessionId();
-  const tmuxSessionId = `agent-${sessionId}`;
-
   const isBatchMode = cliArgs.subcommand.type === "batch";
   /** @type {string[]} */
   const configFiles =
@@ -294,7 +292,6 @@ export async function main(argv = process.argv) {
     workingDir: process.cwd(),
     today: new Date().toISOString().split("T")[0],
     sessionId,
-    tmuxSessionId,
     projectMetadataDir: AGENT_PROJECT_METADATA_DIR,
     agentRoles,
     skills: Array.from(prompts.values()).filter((p) => p.isSkill),
@@ -305,12 +302,15 @@ export async function main(argv = process.argv) {
     readFileTool,
     writeFileTool,
     createPatchFileTool(),
-    createTmuxCommandTool({ sandbox: appConfig.sandbox }),
     createCompactContextTool(),
     createSwitchToSubagentTool(),
     createSwitchToMainAgentTool(),
   ];
 
+  if (appConfig.tools?.tmux?.enabled) {
+    builtinTools.push(createTmuxCommandTool({ sandbox: appConfig.sandbox }));
+  }
+
   if (appConfig.tools?.webSearch) {
     const webSearchConfig = appConfig.tools.webSearch;
     if (webSearchConfig.provider === "command") {
@@ -369,6 +369,8 @@ export async function main(argv = process.argv) {
     defaultAction: appConfig.autoApproval?.defaultAction || "ask",
     patterns: appConfig.autoApproval?.patterns || [],
     allowedPaths: appConfig.autoApproval?.allowedPaths ?? [],
+    allowGitUnmanagedFiles:
+      appConfig.autoApproval?.allowGitUnmanagedFiles ?? false,
     maskApprovalInput: (toolName, input) => {
       for (const tool of builtinTools) {
         if (tool.def.name === toolName && tool.maskApprovalInput) {

package/src/prompt.mjs

@@ -7,7 +7,6 @@ import { toOneLine } from "./utils/toOneLine.mjs";
  * @property {string} workingDir - The current working directory.
  * @property {string} today - Today's date in YYYY-MM-DD format.
  * @property {string} sessionId
- * @property {string} tmuxSessionId
  * @property {string} projectMetadataDir - The directory where memory files are stored.
  * @property {Map<string, import('./context/loadAgentRoles.mjs').AgentRole>} agentRoles - Available agent roles.
  * @property {{filePath: string, description: string}[]} skills
@@ -22,7 +21,6 @@ export function createPrompt({
   modelName,
   sessionId,
   today,
-  tmuxSessionId,
   workingDir,
   projectMetadataDir,
   agentRoles,
@@ -73,9 +71,8 @@ Always read the target lines with \`read_file\` first to verify line numbers and
 
 ## exec_command
 
-- Use relative paths.
+- Use relative paths for files inside the working directory, absolute paths for files outside.
 - Use ${projectMetadataDir}/tmp/ for temporary files.
-- Use bash -c only when pipes (|) or redirection (>, <) are required.
 
 Examples:
 - List directories or find files: fd [".", "./", "--max-depth", "3", "--type", "d", "--hidden"]
@@ -84,18 +81,6 @@ Examples:
   Get PR details: gh ["pr", "view", "123", "--json", "title,body,url"]
   Get PR comment: gh ["api", "--method", "GET", "repos/<owner>/<repo>/pulls/comments/<id>", "--jq", "{user: .user.login, path: .path, line: .line, body: .body}"]
 
-## tmux_command
-
-- Use only when the user explicitly requests it.
-- Create a new session with the given tmux session id.
-
-Examples:
-- Start session: new-session ["-d", "-s", "<tmux-session-id>"]
-- Detect window number to send keys: list-windows ["-t", "<tmux-session-id>"]
-- Get output of window before sending keys: capture-pane ["-p", "-t", "<tmux-session-id>:<window>"]
-- Send key to session: send-keys ["-t", "<tmux-session-id>:<window>", "echo hello", "Enter"]
-- Delete line: send-keys ["-t", "<tmux-session-id>:<window>", "C-a", "C-k"]
-
 # Project Rules and Skills
  
 Discover and apply project-specific rules and reusable skills.
@@ -119,7 +104,6 @@ ${skillDescriptions}
 - Current working directory: ${workingDir}
 - Today's date: ${today}
 - Session id: ${sessionId}
-- Tmux session id: ${tmuxSessionId}
 - Memory file path: ${projectMetadataDir}/memory/${sessionId}--<kebab-case-title>.md
 
 Available subagents:

package/src/tool.d.ts

@@ -39,6 +39,8 @@ export type ToolUseApproverConfig = {
   defaultAction: "deny" | "ask";
   /** Additional absolute paths to allow for auto-approval (outside working directory) */
   allowedPaths?: string[];
+  /** Allow access to git-unmanaged files (default: false) */
+  allowGitUnmanagedFiles?: boolean;
 
   /**
    * Mask the input before auto-approval checks and recording.

package/src/toolInputValidator.mjs

@@ -18,19 +18,26 @@ const BUILTIN_ALLOWED_PATHS = [
 /**
  * @param {unknown} input
  * @param {string[]} [allowedPaths=[]] - Additional allowed paths (outside working directory)
+ * @param {boolean} [allowGitUnmanagedFiles=false] - Allow access to git-unmanaged files
  * @returns {boolean}
  */
-export function isSafeToolInput(input, allowedPaths = []) {
+export function isSafeToolInput(
+  input,
+  allowedPaths = [],
+  allowGitUnmanagedFiles = false,
+) {
   if (["number", "boolean", "undefined"].includes(typeof input)) {
     return true;
   }
 
   if (typeof input === "string") {
-    return isSafeToolInputItem(input, allowedPaths);
+    return isSafeToolInputItem(input, allowedPaths, allowGitUnmanagedFiles);
   }
 
   if (Array.isArray(input)) {
-    return input.every((item) => isSafeToolInput(item, allowedPaths));
+    return input.every((item) =>
+      isSafeToolInput(item, allowedPaths, allowGitUnmanagedFiles),
+    );
   }
 
   if (typeof input === "object") {
@@ -38,7 +45,7 @@ export function isSafeToolInput(input, allowedPaths = []) {
       return true;
     }
     return Object.values(input).every((value) =>
-      isSafeToolInput(value, allowedPaths),
+      isSafeToolInput(value, allowedPaths, allowGitUnmanagedFiles),
     );
   }
 
@@ -48,9 +55,14 @@ export function isSafeToolInput(input, allowedPaths = []) {
 /**
  * @param {string} arg
  * @param {string[]} [allowedPaths=[]] - Additional allowed paths (outside working directory)
+ * @param {boolean} [allowGitUnmanagedFiles=false] - Allow access to git-unmanaged files
  * @returns {boolean}
  */
-export function isSafeToolInputItem(arg, allowedPaths = []) {
+export function isSafeToolInputItem(
+  arg,
+  allowedPaths = [],
+  allowGitUnmanagedFiles = false,
+) {
   const workingDir = process.cwd();
 
   // Note: An argument can be a command option (e.g., '-l').
@@ -84,18 +96,20 @@ export function isSafeToolInputItem(arg, allowedPaths = []) {
     return false;
   }
 
-  // User-configured allowed paths (outside working directory)
-  if (isInUserAllowedPath(realPath, allowedPaths)) {
-    return true;
+  // Path must be inside the working directory or in user-configured allowed paths
+  if (
+    !isInsideWorkingDirectory(realPath, workingDir) &&
+    !isInUserAllowedPath(realPath, allowedPaths)
+  ) {
+    return false;
   }
 
-  // Disallow paths outside the working directory (not in allowedPaths)
-  if (!isInsideWorkingDirectory(realPath, workingDir)) {
+  // Deny git-unmanaged files (outside git repo or git-ignored)
+  if (!allowGitUnmanagedFiles && !isGitManaged(realPath)) {
     return false;
   }
 
-  // Deny git ignored files (which may contain sensitive information or should not be accessed)
-  return !isGitIgnored(realPath);
+  return true;
 }
 
 /**
@@ -216,16 +230,33 @@ function isInsideProjectMetadataDir(targetPath) {
 }
 
 /**
+ * Check if the path is managed by git (inside a git repo and not ignored).
  * @param {string} absPath
  * @returns {boolean}
  */
-function isGitIgnored(absPath) {
+function isGitManaged(absPath) {
+  const dir = findExistingDirectory(absPath);
+
+  /** @type {string} */
+  let gitRoot;
   try {
-    execFileSync("git", ["check-ignore", "--no-index", "-q", absPath], {
-      stdio: ["ignore", "ignore", "ignore"],
-    });
-    // The path is ignored (exit code 0)
-    return true;
+    gitRoot = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8",
+    }).trim();
+  } catch {
+    // Not inside a git repository
+    return false;
+  }
+
+  try {
+    execFileSync(
+      "git",
+      ["-C", gitRoot, "check-ignore", "--no-index", "-q", absPath],
+      { stdio: ["ignore", "ignore", "ignore"] },
+    );
+    // File is git-ignored: not managed
+    return false;
   } catch (error) {
     if (
       error instanceof Error &&
@@ -233,11 +264,28 @@ function isGitIgnored(absPath) {
       typeof error.status === "number" &&
       error.status === 1
     ) {
-      // Path is not ignored
-      return false;
+      // Not ignored: managed
+      return true;
     }
-    // Other errors (e.g., status 128 if not a git repo or other git error)
-    // We treat this as "effectively ignored" to be safe.
-    return true;
+    // Other error: treat as not managed for safety
+    return false;
+  }
+}
+
+/**
+ * @param {string} absPath
+ * @returns {string}
+ */
+function findExistingDirectory(absPath) {
+  const stats = noThrowSync(() => fs.statSync(absPath));
+  if (!(stats instanceof Error)) {
+    return stats.isDirectory() ? absPath : path.dirname(absPath);
+  }
+  let dir = absPath;
+  while (!fs.existsSync(dir)) {
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
   }
+  return dir;
 }

package/src/toolUseApprover.mjs

@@ -16,6 +16,7 @@ export function createToolUseApprover({
   defaultAction,
   maskApprovalInput,
   allowedPaths = [],
+  allowGitUnmanagedFiles = false,
 }) {
   const state = {
     approvalCount: 0,
@@ -65,7 +66,9 @@ export function createToolUseApprover({
 
       if (action === "allow") {
         const maskedInput = maskApprovalInput(toolUse.toolName, toolUse.input);
-        if (isSafeToolInput(maskedInput, allowedPaths)) {
+        if (
+          isSafeToolInput(maskedInput, allowedPaths, allowGitUnmanagedFiles)
+        ) {
           state.approvalCount += 1;
           return state.approvalCount <= max
             ? { action: "allow" }

package/src/tools/tmuxCommand.mjs

@@ -18,7 +18,17 @@ export function createTmuxCommandTool(config) {
   return {
     def: {
       name: "tmux_command",
-      description: "Run a tmux command",
+      description: [
+        "Run a tmux command.",
+        "The tmux session id is plain-agent-<session-id>.",
+        "",
+        "Examples:",
+        '- Start session: new-session ["-d", "-s", "<tmux-session-id>"]',
+        '- Detect window number to send keys: list-windows ["-t", "<tmux-session-id>"]',
+        '- Get output of window before sending keys: capture-pane ["-p", "-t", "<tmux-session-id>:<window>"]',
+        '- Send key to session: send-keys ["-t", "<tmux-session-id>:<window>", "echo hello", "Enter"]',
+        '- Delete line: send-keys ["-t", "<tmux-session-id>:<window>", "C-a", "C-k"]',
+      ].join("\n"),
       inputSchema: {
         type: "object",
         properties: {

package/src/utils/evalJSONConfig.mjs

@@ -40,6 +40,23 @@ export function evalJSONConfig(configItem) {
       );
     }
 
+    if (Object.keys(configItem).length === 1 && "$not" in configItem) {
+      const pattern = evalJSONConfig(configItem.$not);
+      /** @param {unknown} value */
+      return (value) => {
+        if (typeof pattern === "string") {
+          return value !== pattern;
+        }
+        if (pattern instanceof RegExp) {
+          return typeof value !== "string" || !pattern.test(value);
+        }
+        if (typeof pattern === "function") {
+          return !pattern(value);
+        }
+        return true;
+      };
+    }
+
     if (Object.keys(configItem).length === 1 && "$has" in configItem) {
       const pattern = evalJSONConfig(configItem.$has);
       /** @param {unknown} value */