@lazyingart/agintiflow 0.20.84 → 0.20.86

package/README.md

@@ -157,6 +157,8 @@ aginti --resume <session-id> \
 
 Permission behavior is intentionally consistent: writes inside the current project are allowed through file tools, network/setup runs are normal in approved Docker workspace mode, and outside-project or trusted-host actions stop with a clear blocker plus a suggested rerun command. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
 
+Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. In host mode, tmux startup/send command text follows the same host shell policy as `run_command`; broad host shell work needs explicit `--allow-destructive`. Use `--sandbox-mode host --allow-destructive` only when a tmux task really needs trusted whole-host execution.
+
 ## Permission Recipes
 
 Use these when you want explicit control instead of the default interactive policy:

package/docs/runtime-modes-and-autonomy.md

@@ -13,6 +13,8 @@ The failed task was expected under the current Docker design, but the agent shou
 
 The fix is guidance plus guardrails: raw `tmux` shell commands are blocked inside Docker `run_command`, and the model is told to use host tmux tools for durable sessions.
 
+Important boundary: host tmux tools are durable, but they are not a permission escape hatch. In `docker-readonly` and `docker-workspace` modes, `tmux_start_session` and `tmux_send_keys` are still workspace-bound. Startup commands and sent shell text must use relative paths under the project, not absolute host paths outside the project. In `host` mode, tmux startup/send command text follows the same host shell policy as `run_command`, so broad host shell work requires `--allow-destructive`. If a task really needs `/home/...`, `/etc/...`, an emulator outside the project, or whole-host maintenance, rerun explicitly with `--sandbox-mode host --allow-destructive`.
+
 ## Execution Modes
 
 | Mode | Similar Codex idea | Best use | What persists | Risk |
@@ -137,7 +139,7 @@ Durable tmux task:
 aginti "start a tmux session named demo, run ls in it, keep it open, and tell me how to attach"
 ```
 
-The agent should use `tmux_start_session`, `tmux_send_keys`, and `tmux_capture_pane`, not Docker `run_command`.
+The agent should use `tmux_start_session`, `tmux_send_keys`, and `tmux_capture_pane`, not Docker `run_command`. In Docker sandbox mode, tmux commands must stay inside the project. In host mode, tmux command text is still governed by host shell policy; if a tmux command is blocked, present the suggested rerun path instead of trying tmux as a workaround. For trusted whole-host tmux work, use the host recipe above.
 
 ## Future Persistent Container Mode
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.84",
+  "version": "0.20.86",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-tmux-tools.js

@@ -20,7 +20,21 @@ const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-tmux-"));
 const session = `aginti-smoke-${process.pid}`;
 const config = {
   allowShellTool: true,
+  allowDestructive: true,
   commandCwd: workspace,
+  sandboxMode: "host",
+  useDockerSandbox: false,
+};
+const strictHostConfig = {
+  ...config,
+  allowDestructive: false,
+};
+const dockerConfig = {
+  ...config,
+  allowDestructive: false,
+  useDockerSandbox: true,
+  sandboxMode: "docker-workspace",
+  packageInstallPolicy: "allow",
 };
 
 function sleep(ms) {
@@ -41,7 +55,7 @@ try {
     target: start.target,
     text: "printf 'aginti tmux smoke\\n'; pwd",
     enter: true,
-  });
+  }, config);
   assert.equal(send.ok, true, send.error || send.reason);
   await sleep(500);
 
@@ -65,23 +79,101 @@ try {
   const destructive = checkTmuxToolUse("tmux_send_keys", { target: start.target, text: "rm -rf /" }, config);
   assert.equal(destructive.allowed, false, "tmux guardrail did not block destructive text");
 
+  const outsidePath = path.join(os.tmpdir(), "agintiflow-outside-workspace-canary.txt");
+  const workspacePath = path.join(workspace, "inside-workspace.txt");
+  const dockerTmuxOutsideStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-outside`, cwd: ".", command: `cat ${outsidePath}` },
+    config: dockerConfig,
+  });
+  assert.equal(dockerTmuxOutsideStart.allowed, false, "Docker-mode tmux_start_session should block outside host paths");
+  assert.equal(dockerTmuxOutsideStart.category, "tmux", "outside tmux path block should be categorized as tmux");
+
+  const dockerTmuxOutsideSend = checkTmuxToolUse(
+    "tmux_send_keys",
+    { target: start.target, text: `cat ${outsidePath}` },
+    dockerConfig
+  );
+  assert.equal(dockerTmuxOutsideSend.allowed, false, "Docker-mode tmux_send_keys should block outside host paths");
+
+  const directOutsideStart = await startTmuxSession(
+    { name: `${session}-direct-outside`, cwd: ".", command: `cat ${outsidePath}` },
+    dockerConfig
+  );
+  assert.equal(directOutsideStart.ok, false, "tmux_start_session should enforce outside host path guard at execution time");
+
+  const directOutsideSend = await sendTmuxKeys(
+    { target: start.target, text: `cat ${outsidePath}`, enter: false },
+    dockerConfig
+  );
+  assert.equal(directOutsideSend.ok, false, "tmux_send_keys should enforce outside host path guard at execution time");
+
+  const dockerTmuxWorkspaceStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-inside`, cwd: ".", command: `cat ${workspacePath}` },
+    config: dockerConfig,
+  });
+  assert.equal(dockerTmuxWorkspaceStart.allowed, true, "Docker-mode tmux_start_session should allow project absolute paths");
+
+  const dockerTmuxRelativeStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-relative`, cwd: ".", command: "cat inside-workspace.txt" },
+    config: dockerConfig,
+  });
+  assert.equal(dockerTmuxRelativeStart.allowed, true, "Docker-mode tmux_start_session should allow workspace-relative paths");
+
+  const hostBroadTmuxStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
+    config: strictHostConfig,
+  });
+  assert.equal(hostBroadTmuxStart.allowed, false, "Host-mode tmux_start_session should not bypass host shell approval");
+  assert.equal(hostBroadTmuxStart.category, "general-shell", "Host tmux broad command should keep shell policy category");
+
+  const hostBroadTmuxSend = checkTmuxToolUse(
+    "tmux_send_keys",
+    { target: start.target, text: 'echo "HOST_TMUX_SEND"; sleep 1' },
+    strictHostConfig
+  );
+  assert.equal(hostBroadTmuxSend.allowed, false, "Host-mode tmux_send_keys should not bypass host shell approval");
+  assert.equal(hostBroadTmuxSend.category, "general-shell", "Host tmux send should keep shell policy category");
+
+  const directHostBroadStart = await startTmuxSession(
+    { name: `${session}-direct-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
+    strictHostConfig
+  );
+  assert.equal(directHostBroadStart.ok, false, "tmux_start_session direct path should enforce host shell approval");
+
+  const directHostBroadSend = await sendTmuxKeys(
+    { target: start.target, text: 'echo "HOST_TMUX_SEND"; sleep 1', enter: false },
+    strictHostConfig
+  );
+  assert.equal(directHostBroadSend.ok, false, "tmux_send_keys direct path should enforce host shell approval");
+
+  const hostInterruptKey = checkTmuxToolUse(
+    "tmux_send_keys",
+    { target: start.target, text: "", keys: ["C-c"], enter: false },
+    strictHostConfig
+  );
+  assert.equal(hostInterruptKey.allowed, true, "Host-mode tmux_send_keys should still allow safe control keys");
+
   const dockerTmuxCommand = checkToolUse({
     toolName: "run_command",
     args: { command: "tmux new-session -d -s should-not-run" },
-    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+    config: dockerConfig,
   });
   assert.equal(dockerTmuxCommand.allowed, false, "Docker run_command tmux usage should be blocked in favor of host tmux tools");
   const dockerTmuxSearch = checkToolUse({
     toolName: "run_command",
     args: { command: "rg tmux README.md" },
-    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+    config: dockerConfig,
   });
   assert.equal(dockerTmuxSearch.allowed, true, "Docker run_command should still allow harmless tmux text searches");
 
   const dockerNpxAginti = checkToolUse({
     toolName: "run_command",
     args: { command: "npx aginti doctor --json" },
-    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+    config: dockerConfig,
   });
   assert.equal(dockerNpxAginti.allowed, false, "Docker run_command should block npx aginti self-invocation");
   assert.equal(dockerNpxAginti.category, "nested-aginti", "npx aginti block should be categorized");
@@ -89,7 +181,7 @@ try {
   const dockerNestedAginti = checkToolUse({
     toolName: "run_command",
     args: { command: "aginti storage status" },
-    config: { ...config, useDockerSandbox: true, sandboxMode: "docker-workspace", packageInstallPolicy: "allow" },
+    config: dockerConfig,
   });
   assert.equal(dockerNestedAginti.allowed, false, "Docker run_command should block nested aginti CLI calls");
   assert.equal(dockerNestedAginti.category, "nested-aginti", "nested aginti block should be categorized");
@@ -107,6 +199,13 @@ try {
           "list-sessions",
           "secret-guardrail",
           "destructive-guardrail",
+          "docker-tmux-start-outside-path-guardrail",
+          "docker-tmux-send-outside-path-guardrail",
+          "docker-tmux-start-project-path-allowed",
+          "docker-tmux-start-relative-path-allowed",
+          "host-tmux-start-shell-policy-guardrail",
+          "host-tmux-send-shell-policy-guardrail",
+          "host-tmux-control-key-allowed",
           "docker-run-command-tmux-guardrail",
           "docker-run-command-tmux-search-allowed",
           "docker-run-command-npx-aginti-guardrail",

package/src/agent-runner.js

@@ -428,7 +428,7 @@ async function createInitialState(config, sessionId) {
           "Permission contract: current-workspace file writes are allowed through workspace file tools when enabled. Outside-workspace paths, host sudo, host OS package installs, destructive git/shell actions, and blocked network/setup must not be bypassed by retrying variants. If a tool result includes permissionAdvice or suggestedCommand, stop, explain the blocker, copy the exact suggestedCommand when giving a rerun path, and ask the user to approve/rerun that mode or choose a safer workspace-relative path. Never invent legacy AgInTi syntax such as `aginti run --sandbox host`; use the exact flags from permissionAdvice.",
           "If an operation fails but a directory, artifact, or file already exists, treat it as pre-existing unless you have evidence this run created or updated it. Verify expected outputs before claiming success.",
           config.allowShellTool
-        ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived."
+        ? "Host tmux tools are available for long-running terminals: list sessions, capture panes, send safe keys/text, and start detached sessions. Prefer these tools for monitoring long installs/tests/dev servers without blocking; capture before sending input and never send secrets or sudo passwords. Do not start or install tmux inside Docker run_command containers because those containers are short-lived. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and must not reference absolute host paths outside the project; ask for --sandbox-mode host for trusted whole-host work."
         + " For one-shot tmux commands, redirect stdout/stderr and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
           config.allowFileTools
@@ -894,7 +894,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`
@@ -1224,7 +1224,7 @@ async function executeTool(browserState, toolCall, snapshot, config, store, obse
         return result;
       }
       case "tmux_send_keys": {
-        const result = await sendTmuxKeys(args);
+        const result = await sendTmuxKeys(args, config);
         const eventResult = sanitizeToolResult(result);
         await store.appendEvent(result.ok ? "tool.completed" : "tool.failed", eventResult);
         observers.event(result.ok ? "tool.completed" : "tool.failed", eventResult);

package/src/model-client.js

@@ -512,7 +512,7 @@ export async function createPlan(client, config, state) {
             ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
-            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers."
+            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound: use relative project paths, not absolute host paths outside the workspace. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. For large or unfamiliar repos, plan to call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests and exact files. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language instead of generic names like story.txt or output.txt; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`
@@ -786,7 +786,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "tmux_send_keys",
           description:
-            "Send literal text and/or safe control keys to a durable host tmux pane. Use for interacting with known shells or agent sessions after capturing context. Do not send secrets, passwords, sudo passwords, or destructive commands.",
+            "Send literal text and/or safe control keys to a durable host tmux pane. Use for interacting with known shells or agent sessions after capturing context. Do not send secrets, passwords, sudo passwords, destructive commands, or absolute host paths outside the workspace unless the run is explicitly in host sandbox mode.",
           parameters: {
             type: "object",
             properties: {
@@ -812,7 +812,7 @@ export async function requestNextStep(client, config, messages) {
         function: {
           name: "tmux_start_session",
           description:
-            "Start a detached durable host tmux session rooted inside the workspace, optionally with a startup command. Use for long-running local jobs that should be monitored with tmux_capture_pane instead of blocking the agent. For one-shot commands, redirect output and exit status to a durable workspace log or keep the shell open so capture can verify; do not claim results from an auto-terminated session. This is the correct tmux path in Docker mode because run_command containers are ephemeral.",
+            "Start a detached durable host tmux session rooted inside the workspace, optionally with a startup command. Use for long-running local jobs that should be monitored with tmux_capture_pane instead of blocking the agent. For one-shot commands, redirect output and exit status to a durable workspace log or keep the shell open so capture can verify; do not claim results from an auto-terminated session. In Docker sandbox mode, startup commands must stay workspace-bound and must not reference absolute host paths outside the project; ask for --sandbox-mode host for trusted whole-host work.",
           parameters: {
             type: "object",
             properties: {

package/src/permission-advice.js

@@ -67,12 +67,12 @@ function currentMode(config = {}) {
 }
 
 function adviceForCategory(category = "", { toolName = "", args = {}, config = {}, state = {}, reason = "" } = {}) {
-  const command = compactLine(args.command || "");
+  const command = compactLine(args.command || args.text || "");
   const base = {
     category: category || "permission",
     reason: compactLine(reason || "The runtime policy blocked this operation."),
     currentMode: currentMode(config),
-    blockedOperation: command ? `run_command: ${command}` : toolName,
+    blockedOperation: command ? `${toolName || "tool"}: ${command}` : toolName,
     instruction:
       "Stop and present this blocker to the user instead of repeatedly trying variants. Continue only after the user approves a safer mode, changes the workspace, or gives a replacement instruction.",
   };

package/src/tmux-tools.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import path from "node:path";
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
+import { evaluateCommandPolicy } from "./command-policy.js";
 import { redactSensitiveText } from "./redaction.js";
 
 const execFile = promisify(execFileCallback);
@@ -30,6 +31,8 @@ const ALLOWED_KEYS = new Set([
 const SECRET_PATTERN = /(api[_-]?key|auth[_-]?token|npm[_-]?token|_authToken|password|passwd|secret|bearer\s+[A-Za-z0-9._-]+)/i;
 const DESTRUCTIVE_PATTERN =
   /\b(rm\s+-[^\n;]*[rf][^\n;]*(\/|\*|~|\$HOME)|mkfs(?:\.[a-z0-9]+)?\b|dd\s+if=.*\s+of=\/dev\/|shutdown\b|reboot\b|poweroff\b)/i;
+const ABSOLUTE_PATH_PATTERN = /(^|[\s"'`=(:])((?:\/[A-Za-z0-9._@%+~:-]+)+\/?)/g;
+const ALWAYS_ALLOWED_ABSOLUTE_PATHS = new Set(["/dev/null"]);
 
 export const TMUX_TOOL_NAMES = ["tmux_list_sessions", "tmux_capture_pane", "tmux_send_keys", "tmux_start_session"];
 
@@ -103,6 +106,53 @@ function resolveCwd(config, cwd = ".") {
   return { ok: true, cwd: requested };
 }
 
+function isInsideDirectory(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function uniqueAbsolutePaths(text = "") {
+  const paths = new Set();
+  for (const match of String(text || "").matchAll(ABSOLUTE_PATH_PATTERN)) {
+    const candidate = match[2];
+    if (!candidate || candidate.startsWith("//")) continue;
+    paths.add(candidate.replace(/[),.;]+$/g, ""));
+  }
+  return [...paths].filter(Boolean);
+}
+
+function checkWorkspaceBoundTmuxText(text = "", config = {}, label = "tmux text") {
+  if (!config.useDockerSandbox) return { ok: true };
+  const root = path.resolve(config.commandCwd || process.cwd());
+  for (const candidate of uniqueAbsolutePaths(text)) {
+    if (ALWAYS_ALLOWED_ABSOLUTE_PATHS.has(candidate)) continue;
+    const resolved = path.resolve(candidate);
+    if (!isInsideDirectory(root, resolved)) {
+      return {
+        ok: false,
+        reason: `${label} references an absolute host path outside the configured workspace while Docker sandbox mode is active: ${candidate}. Use a workspace-relative path or rerun with --sandbox-mode host for trusted whole-host access.`,
+      };
+    }
+  }
+  return { ok: true };
+}
+
+function checkHostShellPolicyForTmuxText(text = "", config = {}, label = "tmux text") {
+  const command = String(text || "").trim();
+  if (!command) return { ok: true };
+  if (config.useDockerSandbox || config.sandboxMode !== "host" || config.allowDestructive) {
+    return { ok: true };
+  }
+  const policy = evaluateCommandPolicy(command, config);
+  if (policy.allowed) return { ok: true };
+  return {
+    ok: false,
+    reason: `${label} is blocked by the same host shell policy as run_command: ${policy.reason}`,
+    category: policy.category || "tmux",
+    needsApproval: policy.needsApproval,
+  };
+}
+
 function parseSessions(stdout = "") {
   return String(stdout || "")
     .split(/\r?\n/)
@@ -186,7 +236,7 @@ export async function captureTmuxPane(args = {}) {
   };
 }
 
-export async function sendTmuxKeys(args = {}) {
+export async function sendTmuxKeys(args = {}, config = {}) {
   const target = validateTarget(args.target);
   if (!target.ok) return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: target.reason };
   const text = String(args.text || "");
@@ -201,6 +251,21 @@ export async function sendTmuxKeys(args = {}) {
   if (DESTRUCTIVE_PATTERN.test(text)) {
     return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: "tmux text appears destructive; ask the user before sending it." };
   }
+  const workspaceBound = checkWorkspaceBoundTmuxText(text, config, "tmux text");
+  if (!workspaceBound.ok) {
+    return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: workspaceBound.reason };
+  }
+  const hostPolicy = checkHostShellPolicyForTmuxText(text, config, "tmux text");
+  if (!hostPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_send_keys",
+      blocked: true,
+      reason: hostPolicy.reason,
+      category: hostPolicy.category,
+      needsApproval: hostPolicy.needsApproval,
+    };
+  }
   for (const key of keys) {
     if (!ALLOWED_KEYS.has(key)) {
       return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: `Unsupported tmux key: ${key}` };
@@ -252,6 +317,21 @@ export async function startTmuxSession(args = {}, config = {}) {
       reason: "tmux startup command appears destructive; ask the user before starting it.",
     };
   }
+  const workspaceBound = checkWorkspaceBoundTmuxText(command, config, "tmux startup command");
+  if (!workspaceBound.ok) {
+    return { ok: false, toolName: "tmux_start_session", blocked: true, reason: workspaceBound.reason };
+  }
+  const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
+  if (!hostPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_start_session",
+      blocked: true,
+      reason: hostPolicy.reason,
+      category: hostPolicy.category,
+      needsApproval: hostPolicy.needsApproval,
+    };
+  }
 
   const tmuxArgs = ["new-session", "-d", "-s", name.name, "-c", cwd.cwd];
   if (command) tmuxArgs.push(command);
@@ -289,6 +369,17 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     if (DESTRUCTIVE_PATTERN.test(text)) {
       return { allowed: false, reason: "tmux text appears destructive; ask the user before sending it.", category: "tmux" };
     }
+    const workspaceBound = checkWorkspaceBoundTmuxText(text, config, "tmux text");
+    if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const hostPolicy = checkHostShellPolicyForTmuxText(text, config, "tmux text");
+    if (!hostPolicy.ok) {
+      return {
+        allowed: false,
+        reason: hostPolicy.reason,
+        category: hostPolicy.category || "tmux",
+        needsApproval: hostPolicy.needsApproval,
+      };
+    }
     for (const key of Array.isArray(args.keys) ? args.keys : []) {
       if (!ALLOWED_KEYS.has(String(key))) return { allowed: false, reason: `Unsupported tmux key: ${key}`, category: "tmux" };
     }
@@ -309,6 +400,17 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     if (DESTRUCTIVE_PATTERN.test(command)) {
       return { allowed: false, reason: "tmux startup command appears destructive; ask the user before starting it.", category: "tmux" };
     }
+    const workspaceBound = checkWorkspaceBoundTmuxText(command, config, "tmux startup command");
+    if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
+    if (!hostPolicy.ok) {
+      return {
+        allowed: false,
+        reason: hostPolicy.reason,
+        category: hostPolicy.category || "tmux",
+        needsApproval: hostPolicy.needsApproval,
+      };
+    }
     return { allowed: true, category: "tmux" };
   }
   return { allowed: true, category: "tmux" };