@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/tools/bash-allowed-prefixes.ts

@@ -1,3 +1,5 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
 import {
 	classifyStateArgv,
 	STATE_ACTION_NAMES,
@@ -13,8 +15,20 @@ export interface BashAllowedPrefixesCheck {
 
 export type BashRestrictionProfile = "workflow" | "read-only";
 
+/** Session identities and workspace the restricted `gjc` command may name. */
+export interface GjcSessionBinding {
+	sessionId?: string | null;
+	/** Owner identity already on the tool session. Role-agent ralplan writes use it. */
+	credentialSessionId?: string | null;
+	/** Session workspace. A `--worktree-root` must be this repo, not a foreign one. */
+	worktreeRoot: string;
+	/** Child cwd. Relative `--worktree-root` resolves against it, as ralplan does. */
+	invocationCwd: string;
+}
+
 export interface BashRestrictionOptions {
 	profile?: BashRestrictionProfile;
+	gjcSessionBinding?: GjcSessionBinding;
 }
 
 const SHELL_CONTROL_CHARS = new Set([";", "|", "&", "<", ">", "(", ")"]);
@@ -231,6 +245,33 @@ function isLongOption(word: string, option: string): boolean {
 	return word === option || word.startsWith(`${option}=`);
 }
 
+function fileCompilesMagic(words: readonly string[]): boolean {
+	const valueOptions = ["--exclude", "--exclude-quiet", "--files-from", "--separator", "--magic-file", "--parameter"];
+	for (let index = 1; index < words.length; index += 1) {
+		const word = words[index]!;
+		if (word === "--") break;
+		if (word.startsWith("--")) {
+			const equalsAt = word.indexOf("=");
+			const name = equalsAt === -1 ? word : word.slice(0, equalsAt);
+			if (name.length > 2 && "--compile".startsWith(name)) return true;
+			if (equalsAt === -1 && valueOptions.some(option => name.length > 2 && option.startsWith(name))) {
+				index += 1;
+			}
+		} else if (word.startsWith("-")) {
+			for (let offset = 1; offset < word.length; offset += 1) {
+				const flag = word[offset]!;
+				if (flag === "C") return true;
+				// Required arguments consume the rest of the cluster, or the next word (even `--`).
+				if ("eFfmMP".includes(flag)) {
+					if (offset === word.length - 1) index += 1;
+					break;
+				}
+			}
+		}
+	}
+	return false;
+}
+
 function hasShortOption(word: string, option: string): boolean {
 	return word.startsWith("-") && !word.startsWith("--") && word.slice(1).includes(option);
 }
@@ -239,7 +280,9 @@ function shellQuote(value: string): string {
 }
 
 function resolvedExternalCommand(command: string): string | undefined {
-	return Bun.which(command) ?? undefined;
+	// Bun.which caches a command name until PATH is passed explicitly, so a test
+	// or a later session that changes PATH must be visible here.
+	return Bun.which(command, { PATH: process.env.PATH ?? "" }) ?? undefined;
 }
 
 function validateReadOnlyCommand(words: readonly string[]): BashAllowedPrefixesCheck {
@@ -254,6 +297,9 @@ function validateReadOnlyCommand(words: readonly string[]): BashAllowedPrefixesC
 			if (isLongOption(option, "--pre") || isLongOption(option, "--pre-glob")) {
 				return { allowed: false, reason: "read-only bash does not allow ripgrep preprocessors" };
 			}
+			if (isLongOption(option, "--hostname-bin")) {
+				return { allowed: false, reason: "read-only bash does not allow ripgrep hostname commands" };
+			}
 			if (isLongOption(option, "--search-zip") || hasShortOption(option, "z")) {
 				return { allowed: false, reason: "read-only bash does not allow ripgrep compressed-file subprocesses" };
 			}
@@ -268,23 +314,161 @@ function validateReadOnlyCommand(words: readonly string[]): BashAllowedPrefixesC
 		}
 	}
 
+	if (command === "file" && fileCompilesMagic(words)) {
+		return { allowed: false, reason: "read-only bash does not allow file magic compilation" };
+	}
+
 	const gitWrite = rejectGitHostAccess(words);
 	if (gitWrite) return gitWrite;
 
 	return { allowed: true };
 }
 
+const GIT_DIFF_FAMILY_SUBCOMMANDS = new Set(["blame", "diff", "log", "show"]);
+
+function gitOptionName(word: string): string {
+	const equalsAt = word.indexOf("=");
+	return equalsAt === -1 ? word : word.slice(0, equalsAt);
+}
+
+/** Enabling forms only. `--no-ext-diff` and `--no-textconv` stay allowed. */
+function gitEnablesExternalHelper(word: string): boolean {
+	if (!word.startsWith("--")) return false;
+	const name = gitOptionName(word);
+	return name === "--ext-diff" || name === "--textconv";
+}
+
 function rejectGitHostAccess(words: readonly string[]): BashAllowedPrefixesCheck | undefined {
 	if (words[0] !== "git") return undefined;
 	for (const option of optionWords(words)) {
 		if (isLongOption(option, "--output") || isLongOption(option, "--no-index")) {
 			return { allowed: false, reason: "restricted bash does not allow git --output or --no-index" };
 		}
+		if (gitEnablesExternalHelper(option)) {
+			return {
+				allowed: false,
+				reason: "restricted bash does not allow git external diff or textconv helpers",
+			};
+		}
 	}
 	return undefined;
 }
 
-function validateMatchedGjcCommand(words: readonly string[]): BashAllowedPrefixesCheck {
+/**
+ * Diff-family git commands run `diff.external`, `GIT_EXTERNAL_DIFF`, and textconv
+ * filters unless these flags are present. Place them immediately after the
+ * subcommand so a later value-taking option cannot consume them and they stay
+ * before a `--` pathspec. The gate rejects a later `--ext-diff` or `--textconv`,
+ * which would otherwise win.
+ */
+function disableGitExternalHelpers(commandName: string, argv: readonly string[]): string[] {
+	if (commandName !== "git" || !GIT_DIFF_FAMILY_SUBCOMMANDS.has(argv[1] ?? "")) return [...argv];
+	const next = [...argv];
+	next.splice(2, 0, "--no-ext-diff", "--no-textconv");
+	return next;
+}
+
+const GJC_SESSION_BIND_REASON = "restricted role-agent bash binds gjc to the current session";
+const GJC_WORKTREE_BIND_REASON = "restricted role-agent bash binds gjc --worktree-root to the current repository";
+
+function separateFlagValues(words: readonly string[], flag: string): string[] {
+	const values: string[] = [];
+	for (let index = 0; index < words.length; index += 1) {
+		if (words[index] !== flag) continue;
+		values.push(words[index + 1] ?? "");
+		index += 1;
+	}
+	return values;
+}
+
+function boundSessionIds(binding: GjcSessionBinding): ReadonlySet<string> {
+	const ids = new Set<string>();
+	for (const value of [binding.sessionId, binding.credentialSessionId]) {
+		if (typeof value !== "string") continue;
+		const trimmed = value.trim();
+		if (trimmed) ids.add(trimmed);
+	}
+	return ids;
+}
+
+function inlineStateSessionIds(words: readonly string[]): string[] {
+	if (words[1] !== "state") return [];
+	const ids: string[] = [];
+	for (const input of classifyStateArgv(words.slice(2)).inputs) {
+		if (input.kind !== "inline") continue;
+		let payload: unknown;
+		try {
+			payload = JSON.parse(input.raw);
+		} catch {
+			continue;
+		}
+		if (!payload || typeof payload !== "object" || Array.isArray(payload)) continue;
+		const sessionId = (payload as Record<string, unknown>).session_id;
+		if (typeof sessionId === "string") ids.push(sessionId);
+	}
+	return ids;
+}
+
+function gitCommonDir(directory: string): string | undefined {
+	const result = Bun.spawnSync(["git", "-C", directory, "rev-parse", "--git-common-dir"], {
+		stdout: "pipe",
+		stderr: "ignore",
+	});
+	if (result.exitCode !== 0) return undefined;
+	const text = result.stdout.toString().trim();
+	if (!text) return undefined;
+	const absolute = path.isAbsolute(text) ? text : path.resolve(directory, text);
+	try {
+		return fs.realpathSync(absolute);
+	} catch {
+		return undefined;
+	}
+}
+
+/** Same directory, or another worktree of the same git common dir (isolated tasks). */
+function sameRepository(workspace: string, target: string): boolean {
+	let workspaceReal: string;
+	let targetReal: string;
+	try {
+		workspaceReal = fs.realpathSync(workspace);
+		targetReal = fs.realpathSync(target);
+	} catch {
+		return false;
+	}
+	if (workspaceReal === targetReal) return true;
+	const workspaceCommon = gitCommonDir(workspaceReal);
+	const targetCommon = gitCommonDir(targetReal);
+	return workspaceCommon !== undefined && workspaceCommon === targetCommon;
+}
+
+function worktreeSelectorAllowed(binding: GjcSessionBinding, rawTarget: string): boolean {
+	const trimmed = rawTarget.trim();
+	if (!trimmed) return false;
+	const resolved = path.isAbsolute(trimmed) ? trimmed : path.resolve(binding.invocationCwd, trimmed);
+	return sameRepository(binding.worktreeRoot, resolved);
+}
+
+function rejectUnboundGjcCommand(
+	words: readonly string[],
+	options: BashRestrictionOptions,
+): BashAllowedPrefixesCheck | undefined {
+	const binding = options.gjcSessionBinding;
+	if (!binding) return undefined;
+	const allowed = boundSessionIds(binding);
+	const sessionSelectors = [...separateFlagValues(words, "--session-id"), ...inlineStateSessionIds(words)];
+	if (sessionSelectors.some(value => !allowed.has(value.trim()))) {
+		return { allowed: false, reason: GJC_SESSION_BIND_REASON };
+	}
+	if (separateFlagValues(words, "--worktree-root").some(value => !worktreeSelectorAllowed(binding, value))) {
+		return { allowed: false, reason: GJC_WORKTREE_BIND_REASON };
+	}
+	return undefined;
+}
+
+function validateMatchedGjcCommand(
+	words: readonly string[],
+	options: BashRestrictionOptions,
+): BashAllowedPrefixesCheck {
 	const gitWrite = rejectGitHostAccess(words);
 	if (gitWrite) return gitWrite;
 	if (words[0] !== "gjc") return { allowed: true };
@@ -293,7 +477,7 @@ function validateMatchedGjcCommand(words: readonly string[]): BashAllowedPrefixe
 		if (!words.includes("--write")) {
 			return { allowed: false, reason: "restricted role-agent bash only allows `gjc ralplan --write ...`" };
 		}
-		return { allowed: true };
+		return rejectUnboundGjcCommand(words, options) ?? { allowed: true };
 	}
 
 	if (words[1] === "state") {
@@ -311,10 +495,10 @@ function validateMatchedGjcCommand(words: readonly string[]): BashAllowedPrefixe
 				reason: `restricted role-agent bash does not allow \`gjc state ${classification.parsed.action}\``,
 			};
 		}
-		return { allowed: true };
+		return rejectUnboundGjcCommand(words, options) ?? { allowed: true };
 	}
 
-	return { allowed: true };
+	return rejectUnboundGjcCommand(words, options) ?? { allowed: true };
 }
 
 function commandAllowedPrefixesReason(normalizedPrefixes: readonly string[], options: BashRestrictionOptions): string {
@@ -324,6 +508,30 @@ function commandAllowedPrefixesReason(normalizedPrefixes: readonly string[], opt
 		: `restricted role-agent bash only allows commands starting with: ${prefixList}`;
 }
 
+/**
+ * Workflow restricted bash keeps the lexical prefix check, then runs the resolved
+ * executable. Callers also skip the shell snapshot and shell prefix, because a
+ * snapshot function can be named for that absolute path.
+ */
+export function normalizeWorkflowBashCommand(
+	command: string,
+	allowedPrefixes: readonly string[] | undefined,
+	options: BashRestrictionOptions = {},
+): string | undefined {
+	if (options.profile === "read-only") return undefined;
+	const gate = checkBashAllowedPrefixes(command, allowedPrefixes, { ...options, profile: "workflow" });
+	if (!gate.allowed) return undefined;
+	const parsed = parseShellWords(command.trim());
+	if (parsed.reason || parsed.words.length === 0) return undefined;
+	const [head, ...rest] = parsed.words;
+	if (!head) return undefined;
+	const resolvedHead = resolvedExternalCommand(head);
+	if (!resolvedHead) return undefined;
+	return disableGitExternalHelpers(head, [resolvedHead, ...rest])
+		.map(shellQuote)
+		.join(" ");
+}
+
 export function normalizeReadOnlyBashCommand(command: string): string | undefined {
 	const parsed = parseShellWords(command.trim());
 	if (parsed.reason || parsed.words.length === 0) return undefined;
@@ -360,5 +568,5 @@ export function checkBashAllowedPrefixes(
 	if (options.profile === "read-only") {
 		return validateReadOnlyCommand(parsed.words);
 	}
-	return validateMatchedGjcCommand(parsed.words);
+	return validateMatchedGjcCommand(parsed.words, options);
 }

package/src/tools/bash-interactive.ts

@@ -12,6 +12,7 @@ import {
 	visibleWidth,
 } from "@gajae-code/tui";
 import { logger, sanitizeText } from "@gajae-code/utils";
+import { projectDeclaredSpawnHookNames, projectSafeHomeOverride } from "@gajae-code/utils/shell-config";
 import type { Terminal as XtermTerminalType } from "@xterm/headless";
 import { Settings } from "../config/settings";
 import { NON_INTERACTIVE_ENV } from "../exec/non-interactive-env";
@@ -323,6 +324,14 @@ export interface InteractivePtyControls {
 	detachForegroundCancellation: () => void;
 }
 
+function ptyUnsetHookNames(explicit: Record<string, string> | undefined): string[] {
+	return projectDeclaredSpawnHookNames().filter(name => !Object.hasOwn(explicit ?? {}, name));
+}
+
+function ptyHomeOverride(explicit: Record<string, string> | undefined): Record<string, string> {
+	return projectSafeHomeOverride(explicit);
+}
+
 export async function runInteractiveBashPty(
 	ui: NonNullable<AgentToolContext["ui"]>,
 	options: {
@@ -422,8 +431,11 @@ export async function runInteractiveBashPty(
 				command: options.command,
 				cwd: options.cwd,
 				timeoutMs: options.timeoutMs,
-				env: { ...NON_INTERACTIVE_ENV, ...options.env },
-				unsetEnv: options.unsetEnv,
+				// The PTY child inherits the process env; drop project hook variables
+				// unless this call sets them explicitly. A dropped HOME is replaced by
+				// the trusted account home so the shell and git still have one.
+				env: { ...ptyHomeOverride(options.env), ...NON_INTERACTIVE_ENV, ...options.env },
+				unsetEnv: [...(options.unsetEnv ?? []), ...ptyUnsetHookNames(options.env)],
 				signal: processAbortController.signal,
 				cols: initialPtySize.cols,
 				rows: initialPtySize.rows,

package/src/tools/bash-skill-urls.ts

@@ -1,3 +1,4 @@
+import type * as fsTypes from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { isEnoent } from "@gajae-code/utils";
@@ -40,7 +41,7 @@ export interface InternalUrlExpansionOptions {
  * Resolve a single skill:// URL to its absolute filesystem path.
  * Does NOT read file content or verify existence.
  */
-export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): string {
+export function resolveSkillUrl(url: string, skills: readonly Skill[]): { skill: Skill; lexicalPath: string } {
 	const parsed = /^skill:\/\/([^/?#]+)(\/[^?#]*)?(?:[?#].*)?$/.exec(url);
 	if (!parsed) {
 		throw new ToolError(`Invalid skill:// URL: ${url}`);
@@ -72,7 +73,7 @@ export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): st
 	const hasRelativePath = rawPath !== "" && rawPath !== "/";
 
 	if (!hasRelativePath) {
-		return path.resolve(skill.filePath);
+		return { skill, lexicalPath: path.resolve(skill.filePath) };
 	}
 
 	let relativePath: string;
@@ -95,7 +96,11 @@ export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): st
 		throw new ToolError("Path traversal is not allowed in skill:// URLs");
 	}
 
-	return resolvedPath;
+	return { skill, lexicalPath: resolvedPath };
+}
+
+export function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): string {
+	return resolveSkillUrl(url, skills).lexicalPath;
 }
 
 /**
@@ -150,7 +155,7 @@ async function canonicalLocalPath(localRoot: string, lexicalPath: string): Promi
 	const missing: string[] = [];
 	let cursor = lexicalPath;
 	for (;;) {
-		let stat: Awaited<ReturnType<typeof fs.lstat>> | undefined;
+		let stat: fsTypes.Stats | undefined;
 		try {
 			stat = await fs.lstat(cursor);
 		} catch (error) {
@@ -177,6 +182,53 @@ async function canonicalLocalPath(localRoot: string, lexicalPath: string): Promi
 	}
 }
 
+const SKILL_ESCAPE = "Path traversal is not allowed in skill:// URLs";
+
+/** Real path of `target`, or the real ancestor plus the missing suffix. */
+async function canonicalPathOrAncestor(target: string, escapeMessage: string): Promise<string> {
+	try {
+		return await fs.realpath(target);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+
+	const missing: string[] = [];
+	let cursor = target;
+	for (;;) {
+		let stat: fsTypes.Stats | undefined;
+		try {
+			stat = await fs.lstat(cursor);
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+		}
+		if (stat) {
+			try {
+				return path.join(await fs.realpath(cursor), ...missing);
+			} catch (error) {
+				if (isEnoent(error)) throw new ToolError(escapeMessage);
+				throw error;
+			}
+		}
+		const parent = path.dirname(cursor);
+		if (parent === cursor) throw new ToolError(escapeMessage);
+		missing.unshift(path.basename(cursor));
+		cursor = parent;
+	}
+}
+
+/**
+ * Keep the lexical skill path, then bind the shell to the real path inside the skill directory.
+ * A missing file under a real in-skill ancestor still expands.
+ */
+async function canonicalSkillExpansionPath(baseDir: string, lexicalPath: string): Promise<string> {
+	const realBase = await canonicalPathOrAncestor(baseDir, SKILL_ESCAPE);
+	const realTarget = await canonicalPathOrAncestor(lexicalPath, SKILL_ESCAPE);
+	if (localPathEscapes(realBase, realTarget)) {
+		throw new ToolError(SKILL_ESCAPE);
+	}
+	return realTarget;
+}
+
 function extractScheme(url: string): SupportedInternalScheme | undefined {
 	const match = /^([a-z][a-z0-9+.-]*):\/\//i.exec(url);
 	if (!match) return undefined;
@@ -211,7 +263,8 @@ async function resolveInternalUrlToPath(
 	}
 
 	if (scheme === "skill") {
-		return resolveSkillUrlToPath(url, skills);
+		const { skill, lexicalPath } = resolveSkillUrl(url, skills);
+		return canonicalSkillExpansionPath(skill.baseDir, lexicalPath);
 	}
 
 	// Managed artifact and agent resources carry session authority. Expanding

package/src/tools/bash.ts

@@ -64,7 +64,12 @@ import { CachedOutputBlock, getOutputBlockContentWidth } from "../tui/output-blo
 import { truncateToWidth } from "../tui/utils";
 import { getSixelLineMask } from "../utils/sixel";
 import type { ToolSession } from ".";
-import { checkBashAllowedPrefixes, normalizeReadOnlyBashCommand } from "./bash-allowed-prefixes";
+import { AwaitingInputDetector, type AwaitingInputSignal } from "./awaiting-input";
+import {
+	checkBashAllowedPrefixes,
+	normalizeReadOnlyBashCommand,
+	normalizeWorkflowBashCommand,
+} from "./bash-allowed-prefixes";
 import { applyBashFixups } from "./bash-command-fixup";
 import { type BashInteractiveResult, runInteractiveBashPty } from "./bash-interactive";
 import { checkBashInterception } from "./bash-interceptor";
@@ -578,6 +583,12 @@ export interface BashToolDetails {
 	foldReason?: FoldReason;
 	/** The accepted model-declared activity declaration, when the call carried one. */
 	activity?: BashActivityDeclaration;
+	/**
+	 * Set on a running (partial) update when the foreground command printed an
+	 * interactive auth prompt and then went quiet. Carries only the prompt kind,
+	 * never the URL or code.
+	 */
+	awaitingInput?: AwaitingInputSignal;
 	async?: {
 		state: "running" | "completed" | "failed";
 		jobId: string;
@@ -1125,6 +1136,17 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 				const spillThreshold = resolveBashOutputSinkTailBytes(this.session.settings);
 				const headBytes = resolveBashOutputSinkHeadBytes(this.session.settings);
 				const tailBuffer = new TailBuffer(spillThreshold);
+				// Only a foreground wait blocks the turn; once folded or started in the
+				// background the agent is free and this tool call has already settled.
+				const awaitingInput = new AwaitingInputDetector({
+					onDetect: signal => {
+						if (backgrounded) return;
+						void options.onUpdate?.({
+							content: [{ type: "text", text: latestText }],
+							details: { ...activityDetails, awaitingInput: signal },
+						});
+					},
+				});
 
 				let executionResult: BashResult | BashInteractiveResult | undefined;
 				try {
@@ -1148,18 +1170,24 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 								spillThreshold,
 								headBytes,
 								oneShot: true,
-								ignoreShellPrefix: this.session.bashRestrictionProfile === "read-only",
-								disableShellSnapshot: this.session.bashRestrictionProfile === "read-only",
+								ignoreShellPrefix: this.#isolateRestrictedShell(),
+								disableShellSnapshot: this.#isolateRestrictedShell(),
 								onChunk: chunk => {
 									tailBuffer.append(chunk);
 									latestText = tailBuffer.text();
 									void reportProgress(latestText, runningDetails(jobId));
 								},
-								onRawChunk: chunk => manager.appendOutput(jobId, chunk),
+								// onChunk is throttled and drops chunks inside the window; the
+								// detector must see every chunk, so it reads the raw stream.
+								onRawChunk: chunk => {
+									manager.appendOutput(jobId, chunk);
+									awaitingInput.push(chunk);
+								},
 								onMinimizedSave: async originalText =>
 									saveBashOriginalArtifact(options.artifactPublication, originalText),
 							});
 					executionResult = result;
+					awaitingInput.dispose();
 					const finalResult = this.#buildCompletedResult(result, options.timeoutSec, {
 						requestedTimeoutSec: options.requestedTimeoutSec,
 						notices: options.notices,
@@ -1173,6 +1201,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 					await reportProgress(finalText, completedDetails(jobId));
 					return finalText;
 				} catch (error) {
+					awaitingInput.dispose();
 					const message = error instanceof Error ? error.message : String(error);
 					latestText = message;
 					options.onCompletion?.();
@@ -1323,6 +1352,11 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 	 * helper after `AgentSession` has applied the public-tool permission gate, so
 	 * Monitor inherits Bash's cwd / env / artifact / interceptor pipeline 1:1.
 	 */
+	/** Read-only and workflow allowlists must not source a snapshot or a shell prefix. */
+	#isolateRestrictedShell(): boolean {
+		return this.session.bashRestrictionProfile === "read-only" || (this.session.bashAllowedPrefixes?.length ?? 0) > 0;
+	}
+
 	async #prepareBashExecution(
 		input: { command: string; env?: Record<string, string>; timeout?: number; cwd?: string },
 		ctx?: AgentToolContext,
@@ -1379,9 +1413,23 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		}
 		if (allowedPrefixes && allowedPrefixes.length > 0) {
 			const commandsToCheck = rawCommand === command ? [command] : [rawCommand, command];
+			const invocationCwd =
+				cwd && !cwd.includes("://") && !cwd.includes("local:/")
+					? resolveToCwd(cwd, this.session.cwd)
+					: this.session.cwd;
 			for (const commandToCheck of commandsToCheck) {
 				const allowlist = checkBashAllowedPrefixes(commandToCheck, allowedPrefixes, {
 					profile: this.session.bashRestrictionProfile,
+					...(this.session.bashRestrictionProfile === "read-only"
+						? {}
+						: {
+								gjcSessionBinding: {
+									sessionId: this.session.getSessionId?.() ?? null,
+									credentialSessionId: this.session.getCredentialSessionId?.() ?? null,
+									worktreeRoot: this.session.cwd,
+									invocationCwd,
+								},
+							}),
 				});
 				if (!allowlist.allowed) {
 					throw new ToolError(allowlist.reason ?? "Command blocked by restricted role-agent bash allowlist.");
@@ -1433,19 +1481,6 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			...internalUrlOptions,
 			ensureLocalParentDirs: this.session.bashRestrictionProfile !== "read-only",
 		});
-		// Issue #5039: refuse tmux write verbs whose target resolves to this
-		// agent's own tmux pane — such bytes forge a human `user` turn in the
-		// transcript. This is after command expansion but before any spawn, so
-		// blocked attempts inject no bytes and create no transcript turn.
-		if (this.session.bashRestrictionProfile !== "read-only") {
-			const injection = await checkTmuxSelfInjection(command, {
-				env: process.env,
-				cwd: this.session.cwd,
-			});
-			if (injection.block) {
-				throw new ToolError(injection.reason ?? "Blocked: tmux self-pane injection.");
-			}
-		}
 		const expandedEnv = env
 			? Object.fromEntries(
 					await Promise.all(
@@ -1527,6 +1562,45 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		if (this.session.bashRestrictionProfile === "read-only" || (allowedPrefixes?.length ?? 0) > 0) {
 			await assertCwdInsideWorkspace(this.session.cwd, commandCwd);
 		}
+		// Issue #5039: refuse tmux write verbs whose target resolves to this
+		// agent's own tmux pane — such bytes forge a human `user` turn in the
+		// transcript. This is after command/env/cwd preparation but before any
+		// spawn, so guard discovery matches execution without trusting caller env
+		// for the agent's tmux identity.
+		if (this.session.bashRestrictionProfile !== "read-only") {
+			const shellConfigEnv = this.session.settings.getShellConfig().env;
+			const injection = await checkTmuxSelfInjection(command, {
+				env: process.env,
+				cwd: commandCwd,
+				executionEnv: { ...process.env, ...shellConfigEnv, ...resolvedEnv },
+			});
+			if (injection.block) {
+				throw new ToolError(injection.reason ?? "Blocked: tmux self-pane injection.");
+			}
+		}
+		// Direct master spawn parses the original command itself and does not source
+		// a shell snapshot. Every other restricted workflow command is rebound here,
+		// after the allowlist and interceptor have seen the caller's text.
+		if (
+			!directMasterSpawn &&
+			this.session.bashRestrictionProfile !== "read-only" &&
+			allowedPrefixes &&
+			allowedPrefixes.length > 0
+		) {
+			const normalizedWorkflowCommand = normalizeWorkflowBashCommand(command, allowedPrefixes, {
+				profile: "workflow",
+				gjcSessionBinding: {
+					sessionId: this.session.getSessionId?.() ?? null,
+					credentialSessionId: this.session.getCredentialSessionId?.() ?? null,
+					worktreeRoot: this.session.cwd,
+					invocationCwd: commandCwd,
+				},
+			});
+			if (!normalizedWorkflowCommand) {
+				throw new ToolError("Restricted role-agent bash command could not be normalized safely.");
+			}
+			command = normalizedWorkflowCommand;
+		}
 
 		const requestedTimeoutSec = input.timeout ?? 300;
 		const timeoutSec = clampTimeout("bash", requestedTimeoutSec);
@@ -1710,9 +1784,8 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 						spillThreshold,
 						headBytes,
 						oneShot: true,
-						ignoreShellPrefix: this.session.bashRestrictionProfile === "read-only" || prepared.directMasterSpawn,
-						disableShellSnapshot:
-							this.session.bashRestrictionProfile === "read-only" || prepared.directMasterSpawn,
+						ignoreShellPrefix: this.#isolateRestrictedShell() || prepared.directMasterSpawn,
+						disableShellSnapshot: this.#isolateRestrictedShell() || prepared.directMasterSpawn,
 						onChunk: chunk => {
 							tailBuffer.append(chunk);
 							void reportProgress(tailBuffer.text(), {
@@ -2637,6 +2710,14 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 
 		// Track output for streaming updates (tail only)
 		const tailBuffer = new TailBuffer(spillThreshold);
+		const awaitingInput = new AwaitingInputDetector({
+			onDetect: signal => {
+				void onUpdate?.({
+					content: [{ type: "text", text: tailBuffer.text() }],
+					details: { ...(activity === undefined ? {} : { activity }), awaitingInput: signal },
+				});
+			},
+		});
 
 		const artifactPublisher = createBashArtifactPublisher(artifactPublication);
 
@@ -2819,11 +2900,15 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 					onOutput: chunk => {
 						ptyOutputSeen = true;
 						if (ptyJobId) ownedManager?.appendOutput(ptyJobId, chunk);
+						awaitingInput.push(chunk);
 					},
-				}).catch(error => {
-					if (ptyAdmission) ownedManager?.releaseCapacity(ptyAdmission);
-					throw error;
 				})
+					.catch(error => {
+						if (ptyAdmission) ownedManager?.releaseCapacity(ptyAdmission);
+						throw error;
+					})
+					// Completion, error, and a fold all settle this foreground wait.
+					.finally(() => awaitingInput.dispose())
 			: await executeBash(command, {
 					cwd: commandCwd,
 					settings: this.session.settings,
@@ -2837,10 +2922,12 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 					spillThreshold,
 					headBytes,
 					onChunk: streamTailUpdates(tailBuffer, onUpdate),
+					// onChunk is throttled and drops chunks; the detector needs all of them.
+					onRawChunk: chunk => awaitingInput.push(chunk),
 					onMinimizedSave: async originalText => saveBashOriginalArtifact(artifactPublication, originalText),
-					ignoreShellPrefix: this.session.bashRestrictionProfile === "read-only" || directMasterSpawn,
-					disableShellSnapshot: this.session.bashRestrictionProfile === "read-only" || directMasterSpawn,
-				});
+					ignoreShellPrefix: this.#isolateRestrictedShell() || directMasterSpawn,
+					disableShellSnapshot: this.#isolateRestrictedShell() || directMasterSpawn,
+				}).finally(() => awaitingInput.dispose());
 		ptyFoldUnregister?.();
 		// Folded: the foreground was settled by the fold, so return the background
 		// -start result verbatim instead of presenting a half-finished command.