@iinm/plain-agent 1.11.1 → 1.11.2

package/README.md

@@ -3,7 +3,7 @@
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/iinm/plain-agent)
 [![npm version](https://img.shields.io/npm/v/@iinm/plain-agent)](https://www.npmjs.com/package/@iinm/plain-agent)
 [![install size](https://packagephobia.com/badge?p=@iinm/plain-agent)](https://packagephobia.com/result?p=@iinm/plain-agent)
-[![Socket Badge](https://badge.socket.dev/npm/package/@iinm/plain-agent/1.11.1)](https://socket.dev/npm/package/@iinm/plain-agent)
+[![Socket Badge](https://badge.socket.dev/npm/package/@iinm/plain-agent/1.11.2)](https://socket.dev/npm/package/@iinm/plain-agent)
 [![CodeQL](https://github.com/iinm/plain-agent/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/iinm/plain-agent/actions/workflows/github-code-scanning/codeql)
 
 A lightweight terminal-based coding agent focused on safety and low token cost
@@ -175,7 +175,7 @@ Compound arguments are decomposed before validation — embedded paths are extra
 | `--opt=<val>` | `--prefix=/tmp/foo` | `/tmp/foo` |
 | `-X<val>` | `-I/usr/include` | `/usr/include` |
 | `VAR=<val>` | `OUTPUT=/etc/passwd` | `/etc/passwd` |
-| `proto://…` | `file:///etc/passwd` | `/etc/passwd` |
+| `proto://…` | `file:///etc/passwd` | `/etc/passwd` (only `file:` is treated as a local path; `http(s)://` URLs are always allowed) |
 
 `--opt=<val>`, `-X<val>`, and `VAR=<val>` are checked recursively, so chained patterns like `-DINSTALL_DIR=/etc` decompose fully (`-D` → `INSTALL_DIR=/etc` → `/etc`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iinm/plain-agent",
-  "version": "1.11.1",
+  "version": "1.11.2",
   "description": "A lightweight terminal-based coding agent focused on safety and low token cost",
   "license": "MIT",
   "type": "module",

package/src/toolInputValidator.mjs

@@ -108,19 +108,18 @@ export function isSafeToolInputItem(
     );
   }
 
-  // proto://path pattern (e.g., file:///etc/passwd)
-  const protoMatch = arg.match(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(.+)$/);
-  if (protoMatch) {
+  // file:// pattern — references the local filesystem
+  const fileMatch = arg.match(/^file:\/\/(.+)$/i);
+  if (fileMatch) {
     return (
       isSafeToolInputItemRaw(arg, allowedPaths, allowGitUnmanagedFiles) &&
       isSafeToolInputItemRaw(
-        `/${protoMatch[1]}`,
+        `/${fileMatch[1]}`,
         allowedPaths,
         allowGitUnmanagedFiles,
       )
     );
   }
-
   return isSafeToolInputItemRaw(arg, allowedPaths, allowGitUnmanagedFiles);
 }