@iinm/plain-agent 1.10.24 → 1.10.25

package/README.md

@@ -72,7 +72,7 @@ String values in tool inputs are treated as file paths and validated against the
 - No directory traversal (`..` is not allowed)
 - The file must be tracked by Git (not ignored)
 
-**Note**: validation only applies when the agent explicitly passes file paths to tools. It cannot catch file access inside scripts the agent writes — something like `bash -c "rm -rf /"` is beyond its reach. Always use a sandbox when allowing arbitrary script execution.
+**Note**: validation only applies when the agent explicitly passes file paths to tools. It cannot catch file access inside scripts the agent writes — something like `bash -c "rm -rf /"` is beyond its reach. Always use a sandbox when auto-approving script execution.
 
 ### Sandbox
 
@@ -81,11 +81,12 @@ A Docker-based wrapper called `plain-sandbox` is included, but the interface is
 
 ```js
 {
-  // Sandbox environment for the exec_command and tmux_command tools
   "sandbox": {
     // Commands are wrapped and executed with this command
+    // Build the image before first use: plain-sandbox --verbose echo done
     "command": "plain-sandbox",
-    "args": ["--allow-write", "--skip-build", "--keep-alive", "30"],
+    "args": ["--allow-write", "--mount-readonly", ".plain-agent/config.json", "--skip-build", "--keep-alive", "30"],
+    // ↑ --mount-readonly: prevents the agent from overwriting its own config
     // separator is inserted between sandbox flags and the user command to prevent bypasses
     "separator": "--",
 
@@ -117,7 +118,6 @@ A few design choices keep token usage low:
 
 - Minimal system prompt — the [system prompt](https://github.com/iinm/plain-agent/blob/main/src/prompt.mjs) contains only what the agent needs to function. 
 - Output truncation — when a command or MCP tool produces large output, it is truncated and saved to a file. The agent can then read only the relevant parts.
-- (Experimental) [Hashline-based](https://blog.can.ac/2026/02/12/the-harness-problem/) patch_file tool.
 
 ### Claude Code Compatibility
 
@@ -457,6 +457,31 @@ Files are loaded in the following order. Settings in later files override earlie
         └── agents/                # Project-specific agent roles
 ```
 
+
+<details>
+<summary><b>Minimal example (file editing and web search only — no script execution, no sandbox required)</b></summary>
+
+```js
+{
+  "autoApproval": {
+    "defaultAction": "ask",
+    "maxApprovals": 100,
+    "patterns": [
+      {
+        "toolName": { "$regex": "^(write_file|patch_file)$" },
+        "action": "allow"
+      },
+      {
+        "toolName": { "$regex": "^(web_search|web_fetch)$" },
+        "action": "allow"
+      }
+    ]
+  }
+}
+```
+
+</details>
+
 <details>
 <summary><b>YOLO mode example (requires a sandbox for safety)</b></summary>
 
@@ -472,11 +497,11 @@ Files are loaded in the following order. Settings in later files override earlie
         "action": "allow"
       },
       {
-        "toolName": "exec_command",
+        "toolName": { "$regex": "^(web_search|web_fetch)$" },
         "action": "allow"
       },
       {
-        "toolName": { "$regex": "^(web_search|web_fetch)$" },
+        "toolName": "exec_command",
         "action": "allow"
       }
       // ⚠️ Never do this. MCP runs outside the sandbox, so it can send anything externally.
@@ -487,8 +512,10 @@ Files are loaded in the following order. Settings in later files override earlie
     ]
   },
   "sandbox": {
+    // ⚠️ Build the image before first use: plain-sandbox --verbose echo done
     "command": "plain-sandbox",
-    "args": ["--allow-write", "--skip-build", "--keep-alive", "30"],
+    "args": ["--allow-write", "--mount-readonly", ".plain-agent/config.json", "--skip-build", "--keep-alive", "30"],
+    // ↑ --mount-readonly: prevents the agent from overwriting its own config
     "separator": "--"
   }
 }
@@ -518,7 +545,7 @@ Files are loaded in the following order. Settings in later files override earlie
         "action": "allow"
       },
 
-      // ⚠️ Arbitrary code execution can access unauthorized files and networks. Always use a sandbox.
+      // ⚠️ When auto-approving execution, scripts can access unauthorized files and networks. Always use a sandbox.
       {
         "toolName": "exec_command",
         "input": { "command": "npm", "args": ["run", { "$regex": "^(lint|test)$" }] },
@@ -549,8 +576,10 @@ Files are loaded in the following order. Settings in later files override earlie
   // Sandbox environment for the exec_command and tmux_command tools
   "sandbox": {
     // Commands are wrapped and executed with this command
+    // Build the image before first use: plain-sandbox --verbose echo done
     "command": "plain-sandbox",
-    "args": ["--allow-write", "--skip-build", "--keep-alive", "30"],
+    "args": ["--allow-write", "--mount-readonly", ".plain-agent/config.json", "--skip-build", "--keep-alive", "30"],
+    // ↑ --mount-readonly: prevents the agent from overwriting its own config
     // separator is inserted between sandbox flags and the user command to prevent bypasses
     "separator": "--",
 
@@ -749,33 +778,6 @@ Press **Ctrl-O** to start recording, then press it again to stop. Partial transc
   is a letter (a-z) or one of `[ \ ] ^ _`. Defaults to `"ctrl-o"`.
 - `recorder` — Override automatic recorder detection, e.g. `{ "command": "sox", "args": ["-q", "-d", "-b", "16", "-c", "1", "-r", "24000", "-e", "signed-integer", "-t", "raw", "-"] }`. It must write raw 16-bit little-endian mono PCM to stdout at 24 kHz (OpenAI) or 16 kHz (Gemini).
 
-## Development
-
-```sh
-# Run lint, typecheck, and tests
-npm run check
-
-# Fix lint issues
-npm run fix
-# or
-npm run fix -- --unsafe
-
-# Update dependencies
-npx npm-check-updates -t minor -c 3
-npx npm-check-updates -t minor -c 3 -u
-```
-
-## Release
-
-```sh
-npm version <major|minor|patch>
-
-git push --follow-tags
-gh release create $(git describe --tags) --generate-notes
-
-npm publish --access public
-```
-
 ## Appendix: Creating Least-Privilege Users for Cloud Providers
 
 <details>
@@ -921,3 +923,19 @@ gcloud iam service-accounts add-iam-policy-binding "$service_account_email" \
 gcloud auth print-access-token --impersonate-service-account "$service_account_email"
 ```
 </details>
+
+## Developer Notes
+
+<details>
+<summary>Release</summary>
+
+```sh
+npm version <major|minor|patch>
+
+git push --follow-tags
+gh release create $(git describe --tags) --generate-notes
+
+npm publish --access public
+```
+</details>
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iinm/plain-agent",
-  "version": "1.10.24",
+  "version": "1.10.25",
   "description": "A lightweight terminal-based coding agent focused on safety and low token cost",
   "license": "MIT",
   "type": "module",

package/src/cli/interactive.mjs

@@ -391,6 +391,8 @@ export function startInteractiveSession({
 
   // Handle readline close (e.g., stdin closed externally)
   cli.on("close", handleExit);
+  process.on("SIGTERM", handleExit);
+  process.on("SIGHUP", handleExit);
 
   const handleCommand = createCommandHandler({
     agentCommands,

package/src/main.mjs

@@ -165,6 +165,7 @@ export async function main(argv = process.argv) {
       const sandboxStr = [
         appConfig.sandbox.command,
         ...(appConfig.sandbox.args || []),
+        ...(appConfig.sandbox.separator ? [appConfig.sandbox.separator] : []),
       ].join(" ");
       console.log(styleText("green", "\n📦 Sandbox: on"));
       console.log(`  ⤷ ${sandboxStr}`);