🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →
Sign In

@iinm/plain-agent

Package Overview
Dependencies
Maintainers
1
Versions
120
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@iinm/plain-agent - npm Package Compare versions

Comparing version
1.14.3
 to
1.14.4
+138
-0
config/config.predefined.json

@@ -611,2 +611,72 @@ {

{
"name": "claude-sonnet-5",
"variant": "thinking-high",
"platform": {
"name": "anthropic",
"variant": "default",
"baseURL": "https://api.anthropic.com"
},
"model": {
"format": "anthropic",
"config": {
"model": "claude-sonnet-5",
"max_tokens": 32768,
"thinking": { "type": "adaptive" },
"output_config": { "effort": "high" }
}
},
"cost": {
"currency": "USD",
"unit": "1M",
"prices": {
"input_tokens": 3,
"output_tokens": 15,
"cache_read_input_tokens": 0.3,
"cache_creation_input_tokens": 3.75
}
},
"autoCompact": {
"inputTokensKeys": [
"input_tokens",
"cache_read_input_tokens",
"cache_creation_input_tokens"
]
}
},
{
"name": "claude-sonnet-5",
"variant": "thinking-max",
"platform": {
"name": "anthropic",
"variant": "default",
"baseURL": "https://api.anthropic.com"
},
"model": {
"format": "anthropic",
"config": {
"model": "claude-sonnet-5",
"max_tokens": 64000,
"thinking": { "type": "adaptive" },
"output_config": { "effort": "max" }
}
},
"cost": {
"currency": "USD",
"unit": "1M",
"prices": {
"input_tokens": 3,
"output_tokens": 15,
"cache_read_input_tokens": 0.3,
"cache_creation_input_tokens": 3.75
}
},
"autoCompact": {
"inputTokensKeys": [
"input_tokens",
"cache_read_input_tokens",
"cache_creation_input_tokens"
]
}
},
{
"name": "claude-opus-4-8",

@@ -887,2 +957,70 @@ "variant": "thinking-high",

{
"name": "claude-sonnet-5",
"variant": "thinking-high-bedrock",
"platform": {
"name": "bedrock",
"variant": "default"
},
"model": {
"format": "anthropic",
"config": {
"model": "global.anthropic.claude-sonnet-5",
"max_tokens": 32768,
"thinking": { "type": "adaptive" },
"output_config": { "effort": "high" }
}
},
"cost": {
"currency": "USD",
"unit": "1M",
"prices": {
"input_tokens": 3,
"output_tokens": 15,
"cache_read_input_tokens": 0.3,
"cache_creation_input_tokens": 3.75
}
},
"autoCompact": {
"inputTokensKeys": [
"input_tokens",
"cache_read_input_tokens",
"cache_creation_input_tokens"
]
}
},
{
"name": "claude-sonnet-5",
"variant": "thinking-max-bedrock",
"platform": {
"name": "bedrock",
"variant": "default"
},
"model": {
"format": "anthropic",
"config": {
"model": "global.anthropic.claude-sonnet-5",
"max_tokens": 64000,
"thinking": { "type": "adaptive" },
"output_config": { "effort": "max" }
}
},
"cost": {
"currency": "USD",
"unit": "1M",
"prices": {
"input_tokens": 3,
"output_tokens": 15,
"cache_read_input_tokens": 0.3,
"cache_creation_input_tokens": 3.75
}
},
"autoCompact": {
"inputTokensKeys": [
"input_tokens",
"cache_read_input_tokens",
"cache_creation_input_tokens"
]
}
},
{
"name": "claude-opus-4-8",

@@ -889,0 +1027,0 @@ "variant": "thinking-high-bedrock",

+1
-1
package.json
{
"name": "@iinm/plain-agent",
"version": "1.14.3",
"version": "1.14.4",
"description": "A lightweight terminal-based coding agent focused on safety and low token cost",

@@ -5,0 +5,0 @@ "license": "MIT",

+30
-32
README.md
# Plain Agent
[![CodeQL](https://github.com/iinm/plain-agent/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/iinm/plain-agent/actions/workflows/github-code-scanning/codeql)
[![Socket Badge](https://badge.socket.dev/npm/package/@iinm/plain-agent/1.14.3)](https://socket.dev/npm/package/@iinm/plain-agent)
[![Socket Badge](https://badge.socket.dev/npm/package/@iinm/plain-agent/1.14.4)](https://socket.dev/npm/package/@iinm/plain-agent)
[![install size](https://packagephobia.com/badge?p=@iinm/plain-agent)](https://packagephobia.com/result?p=@iinm/plain-agent)

@@ -37,4 +37,4 @@

- **`platform`** — where to send the request and how to authenticate (Anthropic, Bedrock, Vertex AI, Azure, etc.)
- **`model.format`** — which API format to use (`anthropic`, `gemini`, `openai-responses`, `openai-messages`, `bedrock-converse`)
- **`platform`**: where to send the request and how to authenticate (Anthropic, Bedrock, Vertex AI, Azure, etc.)
- **`model.format`**: which API format to use (`anthropic`, `gemini`, `openai-responses`, `openai-messages`, `bedrock-converse`)

@@ -46,3 +46,3 @@ Because these are separate, the same API format works across different platforms. For example, Claude models use the `anthropic` format whether you call Anthropic directly or through Bedrock.

{
"name": "claude-sonnet-4-6",
"name": "claude-sonnet-5",
"variant": "thinking-high",

@@ -56,3 +56,3 @@ "platform": {

"config": {
"model": "claude-sonnet-4-6",
"model": "claude-sonnet-5",
"max_tokens": 32768,

@@ -65,5 +65,5 @@ "thinking": { "type": "adaptive" },

// Bedrock — same format, different platform
// Bedrock: same format, different platform
{
"name": "claude-sonnet-4-6",
"name": "claude-sonnet-5",
"variant": "thinking-high-bedrock-jp",

@@ -77,3 +77,3 @@ "platform": {

"config": {
"model": "jp.anthropic.claude-sonnet-4-6",
"model": "jp.anthropic.claude-sonnet-5",
"max_tokens": 32768,

@@ -87,3 +87,3 @@ "thinking": { "type": "adaptive" },

Models are identified by `name+variant` (e.g., `claude-sonnet-4-6+thinking-high`). You can define multiple variants of the same model with different settings — such as thinking budget or region — and switch between them as needed.
Models are identified by `name+variant` (e.g., `claude-sonnet-5+thinking-high`). You can define multiple variants of the same model with different settings, such as thinking budget or region.

@@ -96,3 +96,3 @@ You can also add entries to `platforms` and `models` to use any OpenAI-compatible endpoint, such as Ollama or Fireworks. See the Quick Start section for examples.

**Note**: Commands are executed without a shell — shell operators like `&&`, `|`, `;`, and redirects are not interpreted unless the agent explicitly uses `bash -c`. This makes each argument a discrete token that can be validated individually.
**Note**: Commands are executed without a shell. Shell operators like `|`, `>`, `;`, and `&&` are not interpreted unless the agent explicitly uses `bash -c`. This makes each argument a discrete token that can be validated individually.

@@ -108,3 +108,3 @@ ```js

// fd example:
// Ask for approval when risky flags like --exec or --no-ignore are present
// Ask for approval when risky flag like --exec is present
{

@@ -168,10 +168,10 @@ "toolName": "exec_command",

String values in tool inputs are treated as file paths and validated against these rules. This takes precedence over `autoApproval` — even if a pattern marks an action as `allow`, a validation failure falls back to `defaultAction`.
String values in tool inputs are treated as file paths and validated against these rules. This takes precedence over `autoApproval`: even if a pattern marks an action as `allow`, a validation failure falls back to `defaultAction`.
- The path must be under the working directory or a path listed in `autoApproval.allowedPaths`
- No directory traversal (`..` is not allowed)
- Symlinks are resolved to their real path before validation — a symlink inside the working directory that points outside is rejected. Broken and circular symlinks are also rejected.
- Symlinks are resolved to their real path before validation: a symlink inside the working directory that points outside is rejected. Broken and circular symlinks are also rejected.
- The file must be tracked by Git (not ignored)
Compound arguments are decomposed before validation — embedded paths are extracted and checked individually:
Compound arguments are decomposed before validation; embedded paths are extracted and checked individually:

@@ -186,6 +186,4 @@ | Pattern | Example | Extracted |

`--opt=<val>`, `-X<val>`, and `VAR=<val>` are checked recursively, so chained patterns like `-DINSTALL_DIR=/etc` decompose fully (`-D` → `INSTALL_DIR=/etc` → `/etc`).
**Note**: Validation only applies when the agent explicitly passes file paths to tools. It cannot catch file access inside scripts the agent writes: something like `bash -c "rm -rf /"` is beyond its reach. Always use a sandbox when auto-approving script execution.
**Note**: Validation only applies when the agent explicitly passes file paths to tools. It cannot catch file access inside scripts the agent writes — something like `bash -c "rm -rf /"` is beyond its reach. Always use a sandbox when auto-approving script execution.
### Sandbox

@@ -232,5 +230,5 @@

- Keep task state human-readable — you can open the file to see exactly where things stand.
- Resume cleanly — the agent can restart a task from the memory file with a clean context.
- Pass information between dependent tasks — subagents write their results to the memory file, which the main agent or a follow-up session reads to continue.
- Keep task state human-readable: you can open the file to see exactly where things stand.
- Resume cleanly: the agent can restart a task from the memory file with a clean context.
- Pass information between dependent tasks: subagents write their results to the memory file, which the main agent or a follow-up session reads to continue.

@@ -241,6 +239,6 @@ ### Token Efficiency

- Minimal system prompt — the [system prompt](https://github.com/iinm/plain-agent/blob/main/src/prompt.mjs) contains only what the agent needs to function.
- Output truncation — when a command or MCP tool produces large output, it is truncated and saved to a file. The agent can then read only the relevant parts.
- Context compaction — run `/compact` to discard old messages and reload task state from a memory file. This also happens automatically when input tokens exceed a configurable soft limit.
- MCP tool filtering — MCP servers often expose many tools. Use `enabledTools` in the server config to enable only the ones you need, which reduces the number of tool definitions sent to the model.
- Minimal system prompt: the [system prompt](https://github.com/iinm/plain-agent/blob/main/src/prompt.mjs) contains only what the agent needs to function.
- Output truncation: when a command or MCP tool produces large output, it is truncated and saved to a file. The agent can then read only the relevant parts.
- Context compaction: run `/compact` to discard old messages and reload task state from a memory file. This also happens automatically when input tokens exceed a configurable soft limit.
- MCP tool filtering: MCP servers often expose many tools. Use `enabledTools` in the server config to enable only the ones you need, which reduces the number of tool definitions sent to the model.

@@ -251,3 +249,3 @@ ### Claude Code Compatibility

**Limitation:** Subagents run sequentially, not in parallel. The upside is that their activity is fully observable and they don't spike token usage. They also inherit the main context rather than starting fresh — a simplification chosen for ease of implementation, which also avoids redundant file reads and reduces the chance of losing context between handoffs.
**Limitation:** Subagents run sequentially, not in parallel. The upside is that their activity is fully observable and they don't spike token usage. They also inherit the main context rather than starting fresh, a simplification chosen for ease of implementation, which also avoids redundant file reads and reduces the chance of losing context between handoffs.

@@ -279,3 +277,3 @@ ## Requirements

// Set default model
"model": "claude-sonnet-4-6+thinking-high",
"model": "claude-sonnet-5+thinking-high",

@@ -483,3 +481,3 @@ // Configure the providers you want to use

{
"name": "claude-sonnet-4-6",
"name": "claude-sonnet-5",
"variant": "thinking-high-bedrock-jp",

@@ -493,3 +491,3 @@ "platform": {

"config": {
"model": "jp.anthropic.claude-sonnet-4-6",
"model": "jp.anthropic.claude-sonnet-5",
"max_tokens": 32768,

@@ -581,6 +579,6 @@ "thinking": { "type": "adaptive" },

```sh
plain sandbox -- --tty zsh
plain sandbox -- --allow-net 0.0.0.0/0 --tty --verbose zsh
# Or specify a config file explicitly
plain sandbox -c .plain-agent/config.sandbox.json -- --tty zsh
plain sandbox -c .plain-agent/config.sandbox.json -- --allow-net 0.0.0.0/0 --tty --verbose zsh
```

@@ -609,3 +607,3 @@

<details>
<summary><b>Minimal example (file editing and web search only — no script execution, no sandbox required)</b></summary>
<summary><b>Minimal example (file editing and web search only, no script execution, no sandbox required)</b></summary>

@@ -789,3 +787,3 @@ ```js

"softLimitPerModelPrefix": {
"gemini-2.5-pro": 500000
"claude-sonnet-5": 120000
}

@@ -792,0 +790,0 @@ },