@lazyingart/agintiflow 0.20.117 → 0.20.118

package/README.md

@@ -170,7 +170,7 @@ aginti --resume <session-id> \
   "Take a fresh screenshot of the running app in the emulator, save it with a durable filename in this project, and keep git status clean."
 ```
 
-Permission behavior is intentionally consistent. Use `-s safe` for read-first sessions that ask before writes/setup, `-s normal` for current-project writes plus Docker setup, and `-s danger` for trusted host/full-access work. Inside chat, `/safe`, `/normal`, and `/danger` switch the current session. When a blocked action appears, CLI and web can offer `No`, `Yes this time`, or `Yes and always for this session` instead of making the agent retry command variants. Android/Gradle builds can use safe local env assignments such as `ANDROID_HOME=... JAVA_HOME=... ./gradlew assembleDebug` and relative workspace logs without requiring whole-host destructive mode. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
+Permission behavior is intentionally consistent. Use `-s safe` for read-first sessions that ask before writes/setup, `-s normal` for current-project writes plus Docker setup, and `-s danger` for trusted host/full-access work. In Docker workspace mode, common host data roots such as the user's home parent are mounted read-only at their original absolute paths so sibling projects and datasets can be inspected without granting host-write permission. Inside chat, `/safe`, `/normal`, and `/danger` switch the current session, and `/status` remains available while a run is active. When a blocked action appears, CLI and web can offer `No`, `Yes this time`, or `Yes and always for this session` instead of making the agent retry command variants. Android/Gradle builds can use safe local env assignments such as `ANDROID_HOME=... JAVA_HOME=... ./gradlew assembleDebug` and relative workspace logs without requiring whole-host destructive mode. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
 
 Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. In host mode, tmux startup/send command text follows the same host shell policy as `run_command`; broad host shell work needs explicit `--allow-destructive`. Use `--sandbox-mode host --allow-destructive` only when a tmux task really needs trusted whole-host execution.
 

package/docs/runtime-modes-and-autonomy.md

@@ -52,7 +52,7 @@ The runtime must be consistent when an action is not permitted. A blocked action
 Current contract:
 
 - `safe` asks before file-tool writes and package/setup actions. It is the right mode for inspection, review, and cautious first passes.
-- `normal` allows writes inside the current project folder and package/setup inside Docker workspace mode. It still blocks outside-project writes and host-system changes until approved.
+- `normal` allows writes inside the current project folder, read-only inspection of visible host data roots, and package/setup inside Docker workspace mode. It still blocks outside-project writes and host-system changes until approved.
 - `danger` is trusted host/full-access mode: host shell, destructive actions, host installs, password typing, and outside-workspace file paths are enabled. Use it only for tasks you trust; obvious secret/publish exfiltration guards remain hard stops.
 - Workspace file tools may read and write inside the configured project folder when file tools are enabled.
 - Narrow workspace-local shell actions such as safe probes, Gradle/TeX builds, and `chmod +x` on a project script may run when the command policy can classify them precisely.
@@ -111,6 +111,8 @@ aginti
 
 This starts interactive chat with Docker workspace mode, file tools, shell tools, web search, and package installs allowed inside Docker.
 
+Docker workspace mode also mounts common host data roots, such as the user's home parent, read-only at their original absolute paths. This lets a task in `/home/lachlan/ProjectsLFS/aginti-test` inspect a sibling dataset such as `/home/lachlan/ProjectsLFS/ProteinStructure` without switching to host-write mode. Outputs and edits still belong under `/workspace` unless the user explicitly approves stronger host permissions. Set `AGINTI_DOCKER_READONLY_HOST_MOUNTS=/path/a:/path/b` to override the read-only mounts, or set it to `off` to disable them.
+
 Direct trusted host mode:
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.117",
+  "version": "0.20.118",
   "type": "module",
   "description": "AgInTiFlow is a project-aware agent workspace for hybrid wet-dry R&D, hardware-aware intelligence, software automation, and industrial workflows.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -10,6 +10,7 @@ import {
   buildPromptLayout,
   buildPromptRenderSequence,
   ComposerHistory,
+  activeRunSlashCommandAction,
   canonicalSlashPromptBuffer,
   classifyEscapeAction,
   formatElapsedDuration,
@@ -368,6 +369,15 @@ try {
   if (classifyEscapeAction({ active: true, pendingAsap: [] }) !== "abort") {
     throw new Error("active Esc should abort when no ASAP pipe messages are pending");
   }
+  if (activeRunSlashCommandAction("/status") !== "status" || activeRunSlashCommandAction("/status verbose") !== "status") {
+    throw new Error("active /status should be allowed during a run");
+  }
+  if (activeRunSlashCommandAction("/scs") !== "blocked") {
+    throw new Error("active mutating slash commands should remain blocked during a run");
+  }
+  if (activeRunSlashCommandAction("continue writing") !== "") {
+    throw new Error("active normal input should still pipe into the running task");
+  }
   const composerHistory = new ComposerHistory([
     "first prompt",
     "second prompt\nwith code",

package/scripts/smoke-toolchain-docker.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { readArtifactContent } from "../src/artifact-tunnel.js";
 import { evaluateCommandPolicy } from "../src/command-policy.js";
-import { runDockerPreflight, runDockerSandboxCommand } from "../src/docker-sandbox.js";
+import { dockerReadOnlyHostMounts, runDockerPreflight, runDockerSandboxCommand } from "../src/docker-sandbox.js";
 import { resolveRuntimeConfig } from "../src/config.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -13,7 +13,10 @@ const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-toolchain-"
 process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
 const runtimeDir = path.join(tempRoot, "runtime");
 const workspace = path.join(tempRoot, "workspace");
+const outsideData = path.join(tempRoot, "outside-data");
 await fs.mkdir(workspace, { recursive: true });
+await fs.mkdir(outsideData, { recursive: true });
+process.env.AGINTI_DOCKER_READONLY_HOST_MOUNTS = tempRoot;
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
@@ -53,6 +56,14 @@ try {
 
   const preflight = await runDockerPreflight(config, { buildImage: false });
   assert(preflight.ok, "Docker toolchain preflight failed. Run scripts/setup-agent-toolchain-docker.sh first.");
+  assert(
+    dockerReadOnlyHostMounts(config).includes(tempRoot),
+    "Docker read-only host mount configuration did not include the requested outside-data root"
+  );
+
+  await fs.writeFile(path.join(outsideData, "source-note.txt"), "READ_ONLY_HOST_MOUNT_OK\n", "utf8");
+  const outsideRead = await runToolchainCommand(`cat ${path.join(outsideData, "source-note.txt")}`, config);
+  assert(outsideRead.stdout.includes("READ_ONLY_HOST_MOUNT_OK"), "Docker normal mode could not read the configured outside data root");
 
   await fs.writeFile(
     path.join(workspace, "plot_fx.py"),
@@ -174,6 +185,7 @@ try {
         ok: true,
         image: config.dockerSandboxImage,
         workspace,
+        outsideReadRoot: outsideData,
         outputs: ["plot_fx.svg", "paper.pdf", "figure-note/fx_figure.pdf", "figure-note/figure_note.pdf"],
         artifactKinds: ["image/svg+xml", "application/pdf"],
       },

package/src/agent-runner.js

@@ -580,13 +580,13 @@ async function createInitialState(config, sessionId) {
           "Treat AGINTI.md as durable project memory and operating instructions for this project. The user can edit it manually or ask you in chat to update it; use workspace file tools for that and never store secrets there.",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace and the persistent agent toolchain is mounted at /aginti-env with caches under /aginti-cache. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this Docker shell; they may resolve stale project packages or create recursive agent sessions.`
+              ? `A shell command tool is available inside Docker sandbox mode ${config.sandboxMode}. Docker workspace mode with approved package installs supports broader setup and network commands. The project is mounted at /workspace, persistent agent toolchain state is mounted at /aginti-env with caches under /aginti-cache, and common host data roots such as the user's home parent are mounted read-only at their original absolute paths. Use /workspace for outputs and writes; use absolute host paths only for read-only inspection when visible. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this Docker shell; they may resolve stale project packages or create recursive agent sessions.`
               : `A host shell command tool is available under the configured trust policy on ${platformLabel(platform)}. On native Windows, prefer PowerShell/cmd-compatible commands or switch to WSL/Docker for bash-like toolchains.`
             : "No shell command tool is available.",
-          `Permission contract: permission mode is ${config.permissionMode || "normal"}. Safe mode asks before workspace writes/setup. Normal mode allows current-project writes and approved Docker setup, but outside-workspace paths and host-system changes require approval. Danger mode is trusted host/full-access mode. Do not bypass blockers by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as \`aginti run --sandbox host\`; use the exact flags from permissionAdvice.`,
+          `Permission contract: permission mode is ${config.permissionMode || "normal"}. Safe mode asks before workspace writes/setup. Normal mode allows current-project writes, read-only inspection of visible host paths, and approved Docker setup, but outside-workspace writes and host-system changes require approval. Danger mode is trusted host/full-access mode. Do not bypass blockers by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as \`aginti run --sandbox host\`; use the exact flags from permissionAdvice.`,
           "If an operation fails but a directory, artifact, or file already exists, treat it as pre-existing unless you have evidence this run created or updated it. Verify expected outputs before claiming success.",
           config.allowShellTool
-        ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and must not reference absolute host paths outside the project; ask for --sandbox-mode host for trusted whole-host work."
+        ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived. In Docker sandbox mode, tmux start/send commands must stay workspace-write-bound; prefer run_command for read-only host absolute path inspection through read-only mounts, and ask for --sandbox-mode host for trusted whole-host write/system work."
         + " For one-shot tmux commands, redirect stdout/stderr and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
           config.allowFileTools
@@ -640,7 +640,7 @@ async function createInitialState(config, sessionId) {
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
             ? config.useDockerSandbox
-              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths, not absolute host temp paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+              ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths for outputs/writes; common host data roots are read-only at original absolute paths for inspection. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
               : `Shell working directory: ${config.commandCwd}`
             : "",
           config.allowFileTools
@@ -1008,7 +1008,7 @@ async function applyContinuationPrompt(state, config, observers) {
       config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell working directory mounted into Docker as /workspace from ${config.commandCwd}. Use relative paths or /workspace paths for outputs/writes; common host data roots are read-only at original absolute paths for inspection. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell working directory: ${config.commandCwd}. Host platform: ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "",
       config.allowFileTools
@@ -1297,11 +1297,11 @@ async function captureSyntheticSnapshot(store, step, config) {
       config.startUrl ? `Suggested start URL: ${config.startUrl}` : "",
       config.allowShellTool
         ? config.useDockerSandbox
-          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
+          ? `Shell tool available in Docker with mounted workspace /workspace from ${config.commandCwd}. Use relative paths or /workspace paths for outputs/writes; common host data roots are read-only at original absolute paths for inspection. Persistent Docker env: /aginti-env, caches: /aginti-cache. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}.`
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; when sending text into a shell pane, tmux follows the same Docker workspace command policy as run_command and is not a bypass for package installs, destructive git history rewrites, or broad shell text. Use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-write-bound; when sending text into a shell pane, tmux follows the same Docker workspace command policy as run_command and is not a bypass for package installs, destructive git history rewrites, or broad shell text. Prefer run_command for read-only host absolute path inspection through read-only mounts. Use --sandbox-mode host for trusted whole-host write/system work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`

package/src/docker-sandbox.js

@@ -1,4 +1,4 @@
-import { constants as fsConstants } from "node:fs";
+import fsSync, { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -15,6 +15,7 @@ const DOCKER_ENV = "/aginti-env";
 const READY_IMAGES = new Set();
 const SANDBOX_LOG_LIMIT = 80;
 const sandboxLogs = [];
+const DISABLE_HOST_READ_MOUNTS = new Set(["0", "false", "no", "off", "none"]);
 
 function recordSandboxLog(type, data = {}) {
   sandboxLogs.push({
@@ -140,6 +141,30 @@ function persistentDockerDirs(config) {
   };
 }
 
+function uniqueHostMounts(mounts = []) {
+  const seen = new Set();
+  const result = [];
+  for (const mount of mounts) {
+    const normalized = path.resolve(String(mount || "").trim());
+    if (!normalized || normalized === "/" || seen.has(normalized)) continue;
+    if (!path.isAbsolute(normalized) || !fsSync.existsSync(normalized)) continue;
+    seen.add(normalized);
+    result.push(normalized);
+  }
+  return result;
+}
+
+export function dockerReadOnlyHostMounts(config = {}, sandboxMode = normalizeSandboxMode(config.sandboxMode)) {
+  if (sandboxMode !== "docker-workspace") return [];
+  const configured = process.env.AGINTI_DOCKER_READONLY_HOST_MOUNTS || process.env.AGINTI_DOCKER_HOST_READ_MOUNTS || "";
+  if (DISABLE_HOST_READ_MOUNTS.has(configured.trim().toLowerCase())) return [];
+  if (Array.isArray(config.readOnlyHostMounts)) return uniqueHostMounts(config.readOnlyHostMounts);
+  if (configured.trim()) return uniqueHostMounts(configured.split(path.delimiter));
+
+  const homeParent = path.dirname(os.homedir() || "");
+  return uniqueHostMounts([homeParent, "/mnt", "/media", "/Volumes"]);
+}
+
 async function ensurePersistentDockerDirs(config) {
   const dirs = persistentDockerDirs(config);
   await Promise.all([fs.mkdir(dirs.home, { recursive: true }), fs.mkdir(dirs.cache, { recursive: true }), fs.mkdir(dirs.env, { recursive: true })]);
@@ -265,6 +290,7 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
   const mountMode = sandboxMode === "docker-workspace" ? "rw" : "ro";
   const networkMode = policy.needsNetwork ? "bridge" : "none";
   const toolchain = policy.category === "toolchain";
+  const readOnlyHostMountArgs = dockerReadOnlyHostMounts(config, sandboxMode).flatMap((mount) => ["-v", `${mount}:${mount}:ro`]);
   const readOnlyArgs =
     mountMode === "ro"
       ? ["--read-only", "--tmpfs", "/tmp:rw,nosuid,nodev,size=128m"]
@@ -291,6 +317,7 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
     "NPM_CONFIG_USERCONFIG=/tmp/.npmrc",
     "-e",
     "PIP_DISABLE_PIP_VERSION_CHECK=1",
+    ...readOnlyHostMountArgs,
     "-v",
     `${config.commandCwd}:${DOCKER_WORKSPACE}:${mountMode}`,
     "-v",

package/src/interactive-cli.js

@@ -1182,6 +1182,13 @@ export function classifyEscapeAction({ active = false, pendingAsap = [] } = {})
   return Array.isArray(pendingAsap) && pendingAsap.length > 0 ? "wait-for-asap" : "abort";
 }
 
+export function activeRunSlashCommandAction(value = "") {
+  const content = canonicalSlashPromptBuffer(value).trim();
+  if (!content.startsWith("/")) return "";
+  if (/^\/status(?:\s|$)/.test(content)) return "status";
+  return "blocked";
+}
+
 function readTtyPrompt(options = {}) {
   return new Promise((resolve, reject) => {
     emitKeypressEvents(input);
@@ -1581,8 +1588,18 @@ class LiveRunInput {
   async submitAsap() {
     const content = this.buffer.trim();
     if (!content) return;
-    if (content.startsWith("/")) {
-      this.printLine(`${label("warn", ansi.red)} Slash commands are disabled while a run is active. Press Esc/Ctrl+C to stop, or wait until idle.`);
+    const slashAction = activeRunSlashCommandAction(content);
+    if (slashAction === "status") {
+      this.setBuffer("");
+      printStatus(this.state);
+      if (this.pendingAsap.length || this.pendingQueued.length) {
+        printSystemLine(`pending asap=${this.pendingAsap.length} queued=${this.pendingQueued.length}`);
+      }
+      this.redraw();
+      return;
+    }
+    if (slashAction === "blocked") {
+      this.printLine(`${label("warn", ansi.red)} Slash commands are disabled while a run is active except /status. Press Esc/Ctrl+C to stop, or wait until idle.`);
       this.setStatus(`running · command ${compactLine(content, 24)} not accepted during active run`);
       return;
     }
@@ -1610,7 +1627,14 @@ class LiveRunInput {
   queueAfterFinish() {
     const content = this.buffer.trim();
     if (!content) return;
-    if (content.startsWith("/")) {
+    const slashAction = activeRunSlashCommandAction(content);
+    if (slashAction === "status") {
+      this.setBuffer("");
+      printStatus(this.state);
+      this.redraw();
+      return;
+    }
+    if (slashAction === "blocked") {
       this.printLine(`${label("warn", ansi.red)} Slash commands cannot be queued during a run. Wait until idle, then run ${content}.`);
       this.setStatus(`running · command ${compactLine(content, 24)} not queued`);
       return;

package/src/model-client.js

@@ -603,10 +603,10 @@ export async function createPlan(client, config, state) {
           state.startUrl ? `Suggested start URL: ${state.startUrl}` : "",
           config.allowedDomains.length > 0 ? `Allowed domains: ${config.allowedDomains.join(", ")}` : "",
           config.allowShellTool
-            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Permission mode: ${config.permissionMode || "normal"}. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
+            ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts, and common host data roots such as the user's home parent are mounted read-only at their original absolute paths for inspection. Use relative paths or /workspace for outputs and writes. Absolute host paths are acceptable for read-only inspection when visible, but do not write outside /workspace unless the user approves host mode. Permission mode: ${config.permissionMode || "normal"}. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
-            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound and shell-pane text follows the same Docker workspace command policy as run_command: use relative project paths, not absolute host paths outside the workspace, and do not use tmux as a workaround for package installs, destructive git rewrites, or broad shell commands. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
+            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-write-bound and shell-pane text follows the same Docker workspace command policy as run_command: use relative project paths for writes and outputs. Read-only inspection of visible host absolute paths is allowed through run_command's read-only mounts; do not use tmux as a workaround for package installs, destructive git rewrites, or broad shell commands. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host write/system work."
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. For large or unfamiliar repos, plan to call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests and exact files. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language instead of generic names like story.txt or output.txt; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`