@iinm/plain-agent 1.8.9 → 1.8.10

package/README.md

@@ -322,11 +322,17 @@ Files are loaded in the following order. Settings in later files override earlie
   └── .plain-agent/
         ├── (3) config.json        # Project-specific configuration
         ├── (4) config.local.json  # Project-specific local configuration (including secrets)
-        ├── memory/                  # Task-specific memory files
+        ├── memory/                  # Task-specific memory files (auto-approvable, writable in sandbox)
+        ├── tmp/                     # Agent scratch space (auto-approvable, writable in sandbox)
+        ├── claude-code-plugins/     # Cached Claude Code plugins (auto-approvable, writable in sandbox)
         ├── prompts/                 # Project-specific prompts
-        └── agents/                  # Project-specific agent roles
+        ├── agents/                  # Project-specific agent roles
+        ├── sandbox/                 # Sandbox runner scripts (run.sh, Dockerfile)
+        └── setup.sh                 # Initial setup script
 ```
 
+Within `.plain-agent/`, only `memory/`, `tmp/`, and `claude-code-plugins/` are auto-approvable as tool input; everything else is executed on the host or changes agent behavior, so writes/reads require explicit approval. The sandbox runner mounts `.plain-agent/` read-only and re-overlays those three scratch directories as writable.
+
 ### Example
 
 <details>

package/config/agents.predefined/sandbox-configurator.md

@@ -75,8 +75,23 @@ Generate `.plain-agent/sandbox/run.sh`. Use the following Node.js example as the
 
 set -eu -o pipefail
 
+# Mount .plain-agent/ as read-only over the writable project root, then
+# re-overlay the agent's scratch directories as writable. This prevents
+# in-sandbox modification of host-executed scripts (sandbox/run.sh,
+# setup.sh) and agent config (config.json, prompts/, agents/, ...).
+working_dir=$(pwd)
+metadata_dir="$working_dir/.plain-agent"
+mkdir -p \
+  "$metadata_dir/memory" \
+  "$metadata_dir/tmp" \
+  "$metadata_dir/claude-code-plugins"
+
 options=(
   --allow-write
+  --mount-readonly "$metadata_dir:$metadata_dir"
+  --mount-writable "$metadata_dir/memory:$metadata_dir/memory"
+  --mount-writable "$metadata_dir/tmp:$metadata_dir/tmp"
+  --mount-writable "$metadata_dir/claude-code-plugins:$metadata_dir/claude-code-plugins"
   --volume plain-sandbox--global--home-npm:/home/sandbox/.npm
   --volume node_modules
 )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iinm/plain-agent",
-  "version": "1.8.9",
+  "version": "1.8.10",
   "description": "A lightweight CLI-based coding agent",
   "license": "MIT",
   "type": "module",

package/src/toolInputValidator.mjs

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import {
   AGENT_MEMORY_DIR,
+  AGENT_PROJECT_METADATA_DIR,
   AGENT_TMP_DIR,
   CLAUDE_CODE_PLUGIN_DIR,
 } from "./env.mjs";
@@ -64,9 +65,15 @@ export function isSafeToolInputItem(arg) {
     return false;
   }
 
-  // Allow safe path even if git-ignored.
-  if (isSafePath(realPath)) {
-    return true;
+  // Inside the agent metadata directory, only the agent's known scratch
+  // directories (memory, tmp, claude-code-plugins) are auto-approvable
+  // (and that exception applies even when those subdirectories are
+  // git-ignored). Other entries (sandbox/, setup.sh, config.json,
+  // prompts/, agents/, ...) are executed on the host or change agent
+  // behavior across sessions, so tool uses targeting them must require
+  // explicit approval even if the file is git-managed.
+  if (isInsideAgentMetadataDir(realPath)) {
+    return isSafePath(realPath);
   }
 
   // Deny git ignored files (which may contain sensitive information or should not be accessed)
@@ -155,6 +162,18 @@ function isSafePath(targetPath) {
   return false;
 }
 
+/**
+ * @param {string} targetPath
+ * @returns {boolean}
+ */
+function isInsideAgentMetadataDir(targetPath) {
+  const metadataAbsPath = path.resolve(AGENT_PROJECT_METADATA_DIR);
+  return (
+    targetPath === metadataAbsPath ||
+    targetPath.startsWith(`${metadataAbsPath}${path.sep}`)
+  );
+}
+
 /**
  * @param {string} absPath
  * @returns {boolean}