@lazyingart/agintiflow 0.20.85 → 0.20.86

package/README.md

@@ -157,7 +157,7 @@ aginti --resume <session-id> \
 
 Permission behavior is intentionally consistent: writes inside the current project are allowed through file tools, network/setup runs are normal in approved Docker workspace mode, and outside-project or trusted-host actions stop with a clear blocker plus a suggested rerun command. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
 
-Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. Use `--sandbox-mode host` when a tmux task needs absolute host paths outside the project.
+Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. In host mode, tmux startup/send command text follows the same host shell policy as `run_command`; broad host shell work needs explicit `--allow-destructive`. Use `--sandbox-mode host --allow-destructive` only when a tmux task really needs trusted whole-host execution.
 
 ## Permission Recipes
 

package/docs/runtime-modes-and-autonomy.md

@@ -13,7 +13,7 @@ The failed task was expected under the current Docker design, but the agent shou
 
 The fix is guidance plus guardrails: raw `tmux` shell commands are blocked inside Docker `run_command`, and the model is told to use host tmux tools for durable sessions.
 
-Important boundary: host tmux tools are durable, but they are not a permission escape hatch. In `docker-readonly` and `docker-workspace` modes, `tmux_start_session` and `tmux_send_keys` are still workspace-bound. Startup commands and sent shell text must use relative paths under the project, not absolute host paths outside the project. If a task really needs `/home/...`, `/etc/...`, an emulator outside the project, or whole-host maintenance, rerun explicitly with `--sandbox-mode host`.
+Important boundary: host tmux tools are durable, but they are not a permission escape hatch. In `docker-readonly` and `docker-workspace` modes, `tmux_start_session` and `tmux_send_keys` are still workspace-bound. Startup commands and sent shell text must use relative paths under the project, not absolute host paths outside the project. In `host` mode, tmux startup/send command text follows the same host shell policy as `run_command`, so broad host shell work requires `--allow-destructive`. If a task really needs `/home/...`, `/etc/...`, an emulator outside the project, or whole-host maintenance, rerun explicitly with `--sandbox-mode host --allow-destructive`.
 
 ## Execution Modes
 
@@ -139,7 +139,7 @@ Durable tmux task:
 aginti "start a tmux session named demo, run ls in it, keep it open, and tell me how to attach"
 ```
 
-The agent should use `tmux_start_session`, `tmux_send_keys`, and `tmux_capture_pane`, not Docker `run_command`. In Docker sandbox mode, tmux commands must stay inside the project. For trusted whole-host tmux work, use the host recipe above.
+The agent should use `tmux_start_session`, `tmux_send_keys`, and `tmux_capture_pane`, not Docker `run_command`. In Docker sandbox mode, tmux commands must stay inside the project. In host mode, tmux command text is still governed by host shell policy; if a tmux command is blocked, present the suggested rerun path instead of trying tmux as a workaround. For trusted whole-host tmux work, use the host recipe above.
 
 ## Future Persistent Container Mode
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.85",
+  "version": "0.20.86",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-tmux-tools.js

@@ -20,10 +20,18 @@ const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-tmux-"));
 const session = `aginti-smoke-${process.pid}`;
 const config = {
   allowShellTool: true,
+  allowDestructive: true,
   commandCwd: workspace,
+  sandboxMode: "host",
+  useDockerSandbox: false,
+};
+const strictHostConfig = {
+  ...config,
+  allowDestructive: false,
 };
 const dockerConfig = {
   ...config,
+  allowDestructive: false,
   useDockerSandbox: true,
   sandboxMode: "docker-workspace",
   packageInstallPolicy: "allow",
@@ -47,7 +55,7 @@ try {
     target: start.target,
     text: "printf 'aginti tmux smoke\\n'; pwd",
     enter: true,
-  });
+  }, config);
   assert.equal(send.ok, true, send.error || send.reason);
   await sleep(500);
 
@@ -114,6 +122,41 @@ try {
   });
   assert.equal(dockerTmuxRelativeStart.allowed, true, "Docker-mode tmux_start_session should allow workspace-relative paths");
 
+  const hostBroadTmuxStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
+    config: strictHostConfig,
+  });
+  assert.equal(hostBroadTmuxStart.allowed, false, "Host-mode tmux_start_session should not bypass host shell approval");
+  assert.equal(hostBroadTmuxStart.category, "general-shell", "Host tmux broad command should keep shell policy category");
+
+  const hostBroadTmuxSend = checkTmuxToolUse(
+    "tmux_send_keys",
+    { target: start.target, text: 'echo "HOST_TMUX_SEND"; sleep 1' },
+    strictHostConfig
+  );
+  assert.equal(hostBroadTmuxSend.allowed, false, "Host-mode tmux_send_keys should not bypass host shell approval");
+  assert.equal(hostBroadTmuxSend.category, "general-shell", "Host tmux send should keep shell policy category");
+
+  const directHostBroadStart = await startTmuxSession(
+    { name: `${session}-direct-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
+    strictHostConfig
+  );
+  assert.equal(directHostBroadStart.ok, false, "tmux_start_session direct path should enforce host shell approval");
+
+  const directHostBroadSend = await sendTmuxKeys(
+    { target: start.target, text: 'echo "HOST_TMUX_SEND"; sleep 1', enter: false },
+    strictHostConfig
+  );
+  assert.equal(directHostBroadSend.ok, false, "tmux_send_keys direct path should enforce host shell approval");
+
+  const hostInterruptKey = checkTmuxToolUse(
+    "tmux_send_keys",
+    { target: start.target, text: "", keys: ["C-c"], enter: false },
+    strictHostConfig
+  );
+  assert.equal(hostInterruptKey.allowed, true, "Host-mode tmux_send_keys should still allow safe control keys");
+
   const dockerTmuxCommand = checkToolUse({
     toolName: "run_command",
     args: { command: "tmux new-session -d -s should-not-run" },
@@ -160,6 +203,9 @@ try {
           "docker-tmux-send-outside-path-guardrail",
           "docker-tmux-start-project-path-allowed",
           "docker-tmux-start-relative-path-allowed",
+          "host-tmux-start-shell-policy-guardrail",
+          "host-tmux-send-shell-policy-guardrail",
+          "host-tmux-control-key-allowed",
           "docker-run-command-tmux-guardrail",
           "docker-run-command-tmux-search-allowed",
           "docker-run-command-npx-aginti-guardrail",

package/src/agent-runner.js

@@ -894,7 +894,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; use --sandbox-mode host for trusted whole-host work. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`

package/src/model-client.js

@@ -512,7 +512,7 @@ export async function createPlan(client, config, state) {
             ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
-            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound: use relative project paths, not absolute host paths outside the workspace. Ask for --sandbox-mode host before whole-host tmux work."
+            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound: use relative project paths, not absolute host paths outside the workspace. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. For large or unfamiliar repos, plan to call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests and exact files. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language instead of generic names like story.txt or output.txt; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`

package/src/permission-advice.js

@@ -67,12 +67,12 @@ function currentMode(config = {}) {
 }
 
 function adviceForCategory(category = "", { toolName = "", args = {}, config = {}, state = {}, reason = "" } = {}) {
-  const command = compactLine(args.command || "");
+  const command = compactLine(args.command || args.text || "");
   const base = {
     category: category || "permission",
     reason: compactLine(reason || "The runtime policy blocked this operation."),
     currentMode: currentMode(config),
-    blockedOperation: command ? `run_command: ${command}` : toolName,
+    blockedOperation: command ? `${toolName || "tool"}: ${command}` : toolName,
     instruction:
       "Stop and present this blocker to the user instead of repeatedly trying variants. Continue only after the user approves a safer mode, changes the workspace, or gives a replacement instruction.",
   };

package/src/tmux-tools.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import path from "node:path";
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
+import { evaluateCommandPolicy } from "./command-policy.js";
 import { redactSensitiveText } from "./redaction.js";
 
 const execFile = promisify(execFileCallback);
@@ -136,6 +137,22 @@ function checkWorkspaceBoundTmuxText(text = "", config = {}, label = "tmux text"
   return { ok: true };
 }
 
+function checkHostShellPolicyForTmuxText(text = "", config = {}, label = "tmux text") {
+  const command = String(text || "").trim();
+  if (!command) return { ok: true };
+  if (config.useDockerSandbox || config.sandboxMode !== "host" || config.allowDestructive) {
+    return { ok: true };
+  }
+  const policy = evaluateCommandPolicy(command, config);
+  if (policy.allowed) return { ok: true };
+  return {
+    ok: false,
+    reason: `${label} is blocked by the same host shell policy as run_command: ${policy.reason}`,
+    category: policy.category || "tmux",
+    needsApproval: policy.needsApproval,
+  };
+}
+
 function parseSessions(stdout = "") {
   return String(stdout || "")
     .split(/\r?\n/)
@@ -238,6 +255,17 @@ export async function sendTmuxKeys(args = {}, config = {}) {
   if (!workspaceBound.ok) {
     return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: workspaceBound.reason };
   }
+  const hostPolicy = checkHostShellPolicyForTmuxText(text, config, "tmux text");
+  if (!hostPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_send_keys",
+      blocked: true,
+      reason: hostPolicy.reason,
+      category: hostPolicy.category,
+      needsApproval: hostPolicy.needsApproval,
+    };
+  }
   for (const key of keys) {
     if (!ALLOWED_KEYS.has(key)) {
       return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: `Unsupported tmux key: ${key}` };
@@ -293,6 +321,17 @@ export async function startTmuxSession(args = {}, config = {}) {
   if (!workspaceBound.ok) {
     return { ok: false, toolName: "tmux_start_session", blocked: true, reason: workspaceBound.reason };
   }
+  const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
+  if (!hostPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_start_session",
+      blocked: true,
+      reason: hostPolicy.reason,
+      category: hostPolicy.category,
+      needsApproval: hostPolicy.needsApproval,
+    };
+  }
 
   const tmuxArgs = ["new-session", "-d", "-s", name.name, "-c", cwd.cwd];
   if (command) tmuxArgs.push(command);
@@ -332,6 +371,15 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     }
     const workspaceBound = checkWorkspaceBoundTmuxText(text, config, "tmux text");
     if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const hostPolicy = checkHostShellPolicyForTmuxText(text, config, "tmux text");
+    if (!hostPolicy.ok) {
+      return {
+        allowed: false,
+        reason: hostPolicy.reason,
+        category: hostPolicy.category || "tmux",
+        needsApproval: hostPolicy.needsApproval,
+      };
+    }
     for (const key of Array.isArray(args.keys) ? args.keys : []) {
       if (!ALLOWED_KEYS.has(String(key))) return { allowed: false, reason: `Unsupported tmux key: ${key}`, category: "tmux" };
     }
@@ -354,6 +402,15 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     }
     const workspaceBound = checkWorkspaceBoundTmuxText(command, config, "tmux startup command");
     if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
+    if (!hostPolicy.ok) {
+      return {
+        allowed: false,
+        reason: hostPolicy.reason,
+        category: hostPolicy.category || "tmux",
+        needsApproval: hostPolicy.needsApproval,
+      };
+    }
     return { allowed: true, category: "tmux" };
   }
   return { allowed: true, category: "tmux" };