@lazyingart/agintiflow 0.20.85 → 0.20.87

package/README.md

@@ -157,7 +157,7 @@ aginti --resume <session-id> \
 
 Permission behavior is intentionally consistent: writes inside the current project are allowed through file tools, network/setup runs are normal in approved Docker workspace mode, and outside-project or trusted-host actions stop with a clear blocker plus a suggested rerun command. See [runtime modes and autonomy](docs/runtime-modes-and-autonomy.md) for the full contract.
 
-Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. Use `--sandbox-mode host` when a tmux task needs absolute host paths outside the project.
+Tmux follows the same rule. In Docker sandbox mode, `tmux_start_session` and `tmux_send_keys` are durable host tools, but their commands must stay workspace-bound. In host mode, tmux startup/send command text follows the same host shell policy as `run_command`; broad host shell work needs explicit `--allow-destructive`. Use `--sandbox-mode host --allow-destructive` only when a tmux task really needs trusted whole-host execution.
 
 ## Permission Recipes
 

package/docs/runtime-modes-and-autonomy.md

@@ -13,7 +13,7 @@ The failed task was expected under the current Docker design, but the agent shou
 
 The fix is guidance plus guardrails: raw `tmux` shell commands are blocked inside Docker `run_command`, and the model is told to use host tmux tools for durable sessions.
 
-Important boundary: host tmux tools are durable, but they are not a permission escape hatch. In `docker-readonly` and `docker-workspace` modes, `tmux_start_session` and `tmux_send_keys` are still workspace-bound. Startup commands and sent shell text must use relative paths under the project, not absolute host paths outside the project. If a task really needs `/home/...`, `/etc/...`, an emulator outside the project, or whole-host maintenance, rerun explicitly with `--sandbox-mode host`.
+Important boundary: host tmux tools are durable, but they are not a permission escape hatch. In `docker-readonly` and `docker-workspace` modes, `tmux_start_session` and `tmux_send_keys` are still workspace-bound. Startup commands and sent shell text must use relative paths under the project, not absolute host paths outside the project. In `host` mode, tmux startup/send command text follows the same host shell policy as `run_command`, so broad host shell work requires `--allow-destructive`. If a task really needs `/home/...`, `/etc/...`, an emulator outside the project, or whole-host maintenance, rerun explicitly with `--sandbox-mode host --allow-destructive`.
 
 ## Execution Modes
 
@@ -139,7 +139,7 @@ Durable tmux task:
 aginti "start a tmux session named demo, run ls in it, keep it open, and tell me how to attach"
 ```
 
-The agent should use `tmux_start_session`, `tmux_send_keys`, and `tmux_capture_pane`, not Docker `run_command`. In Docker sandbox mode, tmux commands must stay inside the project. For trusted whole-host tmux work, use the host recipe above.
+The agent should use `tmux_start_session`, `tmux_send_keys`, and `tmux_capture_pane`, not Docker `run_command`. In Docker sandbox mode, tmux commands must stay inside the project. In host mode, tmux command text is still governed by host shell policy; if a tmux command is blocked, present the suggested rerun path instead of trying tmux as a workaround. For trusted whole-host tmux work, use the host recipe above.
 
 ## Future Persistent Container Mode
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.85",
+  "version": "0.20.87",
   "type": "module",
   "description": "Low-cost, project-aware Web and CLI agents with DeepSeek/Venice/OpenAI routing, visible tool calls, durable sessions, scouts, AAPS, SCS, and guarded local execution.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -76,6 +76,7 @@ function runCli(args, inputText) {
         ...process.env,
         AGINTIFLOW_RUNTIME_DIR: "",
         AGINTIFLOW_HOME: agintiflowHome,
+        AGINTIFLOW_PREVIEW_TTL_MS: "1000",
         AGINTI_LANGUAGE: "en",
       },
     });

package/scripts/smoke-model-roles.js

@@ -10,7 +10,7 @@ import {
   selectModelRoute,
 } from "../src/model-routing.js";
 import { normalizeTextToolCallResponse, parseTextToolCalls, usesTextToolProtocol } from "../src/model-client.js";
-import { modelRoleChoices } from "../src/interactive-cli.js";
+import { modelRoleChoices, selectorVisibleWindow } from "../src/interactive-cli.js";
 import { buildScsEvidencePack, buildSupervisorInstruction } from "../src/scs-controller.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -151,6 +151,11 @@ assert(!routeChoices.includes("venice/e2ee-venice-uncensored-24b-p"), "shared mo
 assert(modelRoleChoices("route").some((item) => item.provider === "openai" && item.model === "gpt-5.5" && item.reasoningOptions.includes("xhigh")), "OpenAI selector missing reasoning levels");
 assert(modelRoleChoices("auxiliary").some((item) => item.provider === "grsai"), "auxiliary selector missing GRS AI");
 assert(modelRoleChoices("auxiliary").some((item) => item.provider === "venice" && item.model === "wan-2-7-pro-edit"), "auxiliary selector missing Venice Wan edit");
+const longAuxiliaryWindow = selectorVisibleWindow(32, 17, 24);
+assert(longAuxiliaryWindow.end - longAuxiliaryWindow.start <= 8, "selector should cap visible rows for long option lists");
+assert(longAuxiliaryWindow.topHidden > 0 && longAuxiliaryWindow.bottomHidden > 0, "selector should expose scroll indicators around middle selections");
+const topAuxiliaryWindow = selectorVisibleWindow(32, 0, 24);
+assert(topAuxiliaryWindow.start === 0 && topAuxiliaryWindow.bottomHidden > 0, "selector should keep first option visible at top of long lists");
 const parsedTextToolCalls = parseTextToolCalls('[TOOL_CALLS]list_files[ARGS]call_123[ARGS]{"path":".","maxDepth":1}');
 assert(parsedTextToolCalls.length === 1, "Venice text tool-call parser did not detect encoded tool call");
 assert(parsedTextToolCalls[0].function.name === "list_files", "Venice text tool-call parser returned wrong tool name");
@@ -253,6 +258,7 @@ console.log(
         "route-overrides",
         "provider-groups",
         "auxiliary-catalog",
+        "selector-windowing",
         "shared-model-selectors",
         "venice-text-tool-parser",
         "requested-tools-parser",

package/scripts/smoke-tmux-tools.js

@@ -20,10 +20,18 @@ const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-tmux-"));
 const session = `aginti-smoke-${process.pid}`;
 const config = {
   allowShellTool: true,
+  allowDestructive: true,
   commandCwd: workspace,
+  sandboxMode: "host",
+  useDockerSandbox: false,
+};
+const strictHostConfig = {
+  ...config,
+  allowDestructive: false,
 };
 const dockerConfig = {
   ...config,
+  allowDestructive: false,
   useDockerSandbox: true,
   sandboxMode: "docker-workspace",
   packageInstallPolicy: "allow",
@@ -47,7 +55,7 @@ try {
     target: start.target,
     text: "printf 'aginti tmux smoke\\n'; pwd",
     enter: true,
-  });
+  }, config);
   assert.equal(send.ok, true, send.error || send.reason);
   await sleep(500);
 
@@ -114,6 +122,41 @@ try {
   });
   assert.equal(dockerTmuxRelativeStart.allowed, true, "Docker-mode tmux_start_session should allow workspace-relative paths");
 
+  const hostBroadTmuxStart = checkToolUse({
+    toolName: "tmux_start_session",
+    args: { name: `${session}-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
+    config: strictHostConfig,
+  });
+  assert.equal(hostBroadTmuxStart.allowed, false, "Host-mode tmux_start_session should not bypass host shell approval");
+  assert.equal(hostBroadTmuxStart.category, "general-shell", "Host tmux broad command should keep shell policy category");
+
+  const hostBroadTmuxSend = checkTmuxToolUse(
+    "tmux_send_keys",
+    { target: start.target, text: 'echo "HOST_TMUX_SEND"; sleep 1' },
+    strictHostConfig
+  );
+  assert.equal(hostBroadTmuxSend.allowed, false, "Host-mode tmux_send_keys should not bypass host shell approval");
+  assert.equal(hostBroadTmuxSend.category, "general-shell", "Host tmux send should keep shell policy category");
+
+  const directHostBroadStart = await startTmuxSession(
+    { name: `${session}-direct-host-broad`, cwd: ".", command: 'echo "HOST_TMUX_STARTED"; sleep 1' },
+    strictHostConfig
+  );
+  assert.equal(directHostBroadStart.ok, false, "tmux_start_session direct path should enforce host shell approval");
+
+  const directHostBroadSend = await sendTmuxKeys(
+    { target: start.target, text: 'echo "HOST_TMUX_SEND"; sleep 1', enter: false },
+    strictHostConfig
+  );
+  assert.equal(directHostBroadSend.ok, false, "tmux_send_keys direct path should enforce host shell approval");
+
+  const hostInterruptKey = checkTmuxToolUse(
+    "tmux_send_keys",
+    { target: start.target, text: "", keys: ["C-c"], enter: false },
+    strictHostConfig
+  );
+  assert.equal(hostInterruptKey.allowed, true, "Host-mode tmux_send_keys should still allow safe control keys");
+
   const dockerTmuxCommand = checkToolUse({
     toolName: "run_command",
     args: { command: "tmux new-session -d -s should-not-run" },
@@ -160,6 +203,9 @@ try {
           "docker-tmux-send-outside-path-guardrail",
           "docker-tmux-start-project-path-allowed",
           "docker-tmux-start-relative-path-allowed",
+          "host-tmux-start-shell-policy-guardrail",
+          "host-tmux-send-shell-policy-guardrail",
+          "host-tmux-control-key-allowed",
           "docker-run-command-tmux-guardrail",
           "docker-run-command-tmux-search-allowed",
           "docker-run-command-npx-aginti-guardrail",

package/src/agent-runner.js

@@ -151,7 +151,7 @@ async function isPortAvailable(port) {
 async function findAvailablePort(preferredPort = 8765) {
   const preferred = Number(preferredPort);
   const start = Number.isFinite(preferred) && preferred > 0 ? preferred : 8765;
-  for (let port = start; port < start + 80; port += 1) {
+  for (let port = start; port < start + 1000 && port < 65535; port += 1) {
     if (await isPortAvailable(port)) return port;
   }
   throw new Error(`No available preview port found near ${start}.`);
@@ -894,7 +894,7 @@ async function captureSyntheticSnapshot(store, step, config) {
           : `Shell tool available in: ${config.commandCwd} on ${platformLabel(platform)}. Use OS-compatible commands; prefer WSL/Docker for bash-heavy workflows on Windows.`
         : "Shell tool disabled.",
       config.allowShellTool
-        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; use --sandbox-mode host for trusted whole-host work. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
+        ? "Host tmux tools available: tmux_list_sessions, tmux_capture_pane, tmux_send_keys, tmux_start_session. Use them for long-running jobs and agent terminals; capture before sending input. Docker run_command containers are ephemeral, so tmux there will not persist. In Docker sandbox mode, tmux start/send commands must stay workspace-bound and cannot reference absolute host paths outside the project; use --sandbox-mode host for trusted whole-host work. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if a broad host command is blocked, present the approval/rerun path instead of trying tmux as a workaround. For one-shot tmux commands, redirect output and exit status to a durable workspace log or keep the pane alive for capture; if capture fails because the session ended, do not infer output or exit status."
         : "",
       config.allowFileTools
         ? `Workspace file tools available in: ${config.commandCwd}. Use inspect_project first for large or unfamiliar codebases, then search/read exact files before editing. Use workspace-relative paths. Use apply_patch for code edits; it supports exact single-file replacement and multi-file Codex-style/unified patches. For new standalone generated content, pick a descriptive non-conflicting filename and avoid overwriting unless explicitly requested.`

package/src/interactive-cli.js

@@ -2220,21 +2220,49 @@ function clearSelectorSequence(lineCount) {
   return Array.from({ length: Math.max(lineCount, 0) }, () => "\x1b[1A\r\x1b[2K").join("");
 }
 
+export function selectorVisibleWindow(optionCount = 0, selectedIndex = 0, height = terminalHeight()) {
+  const count = Math.max(Number(optionCount) || 0, 0);
+  const maxRows = Math.max(4, Math.min(8, Math.floor(Math.max(Number(height) || 24, 10) * 0.36)));
+  if (count <= maxRows) {
+    return { start: 0, end: count, topHidden: 0, bottomHidden: 0 };
+  }
+  const selected = clamp(selectedIndex, 0, count - 1);
+  const half = Math.floor(maxRows / 2);
+  const start = clamp(selected - half, 0, count - maxRows);
+  const end = Math.min(start + maxRows, count);
+  return {
+    start,
+    end,
+    topHidden: start,
+    bottomHidden: count - end,
+  };
+}
+
 function renderSelector({ title, subtitle, options, selectedIndex, lineCount = 0 }) {
   const width = Math.min(Math.max(terminalWidth() - 2, 60), 110);
   const bodyWidth = width - 4;
   const safeTitle = compactLine(title, bodyWidth);
   const safeSubtitle = compactLine(subtitle, bodyWidth);
+  const visible = selectorVisibleWindow(options.length, selectedIndex, terminalHeight());
+  const optionRows = [];
+  if (visible.topHidden > 0) {
+    optionRows.push(`│ ${padVisible(color(`  ... ${visible.topHidden} earlier option${visible.topHidden === 1 ? "" : "s"}`, ansi.dim), bodyWidth)} │`);
+  }
+  for (let index = visible.start; index < visible.end; index += 1) {
+    const option = options[index];
+    const marker = index === selectedIndex ? ">" : " ";
+    const rendered = `${marker} ${compactLine(modelChoiceLine(option), bodyWidth - 2)}`;
+    optionRows.push(`│ ${padVisible(index === selectedIndex ? color(rendered, ansi.userBg, ansi.bold) : rendered, bodyWidth)} │`);
+  }
+  if (visible.bottomHidden > 0) {
+    optionRows.push(`│ ${padVisible(color(`  ... ${visible.bottomHidden} later option${visible.bottomHidden === 1 ? "" : "s"}`, ansi.dim), bodyWidth)} │`);
+  }
   const rows = [
     `╭${"─".repeat(width - 2)}╮`,
     `│ ${padVisible(safeTitle, bodyWidth)} │`,
     `│ ${padVisible(safeSubtitle, bodyWidth)} │`,
     `├${"─".repeat(width - 2)}┤`,
-    ...options.map((option, index) => {
-      const marker = index === selectedIndex ? ">" : " ";
-      const rendered = `${marker} ${compactLine(modelChoiceLine(option), bodyWidth - 2)}`;
-      return `│ ${padVisible(index === selectedIndex ? color(rendered, ansi.userBg, ansi.bold) : rendered, bodyWidth)} │`;
-    }),
+    ...optionRows,
     `╰${"─".repeat(width - 2)}╯`,
   ];
   output.write(`${lineCount > 0 ? clearSelectorSequence(lineCount) : ""}${rows.join("\n")}\n`);

package/src/model-client.js

@@ -512,7 +512,7 @@ export async function createPlan(client, config, state) {
             ? `Shell tool is enabled in ${config.commandCwd}. Host platform: ${platformLabel(platform)}. In Docker, this path is mounted as /workspace with persistent /aginti-env and /aginti-cache mounts. Use relative paths or /workspace paths, not absolute host temp paths. Sandbox mode: ${config.sandboxMode}. Package install policy: ${config.packageInstallPolicy}. For npm/pip/conda/venv setup, explain the need and wait for approval unless policy is allow. Do not run npx aginti, npm exec aginti, or nested aginti diagnostics from this shell; they may resolve stale project packages or create recursive agent sessions. On native Windows host mode, prefer PowerShell/cmd-compatible commands or WSL/Docker for bash-like toolchains.`
             : "",
           config.allowShellTool
-            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound: use relative project paths, not absolute host paths outside the workspace. Ask for --sandbox-mode host before whole-host tmux work."
+            ? "Host tmux tools are enabled for long-running sessions. Plan to use tmux_start_session for durable jobs, tmux_capture_pane to monitor, tmux_send_keys to interact after capture, and tmux_list_sessions to discover existing sessions. Do not install or run tmux inside Docker run_command containers; those containers are short-lived and cannot preserve tmux servers. In Docker sandbox mode, tmux startup/send commands are still workspace-bound: use relative project paths, not absolute host paths outside the workspace. In host mode, tmux startup/send command text follows the same host shell policy as run_command; if blocked, present the suggested approval/rerun path instead of trying tmux as a workaround. Ask for --sandbox-mode host --allow-destructive before trusted whole-host tmux work."
             : "",
           config.allowFileTools
             ? `Workspace file tools are enabled in ${config.commandCwd}: inspect_project, list_files, read_file, search_files, write_file, apply_patch, open_workspace_file, preview_workspace. For large or unfamiliar repos, plan to call inspect_project first, then search/read AGINTI.md/AGENTS.md/README/manifests and exact files. apply_patch supports exact single-file replacements and Codex-style/unified multi-file patches; prefer it for edits after reading relevant context. Keep all paths workspace-relative, for example plot_fx.svg or docs/report.tex, and avoid secrets. For newly generated standalone prose/docs/stories/assets, choose a descriptive non-conflicting filename from the topic/language instead of generic names like story.txt or output.txt; do not overwrite existing files unless the user explicitly asked to update/replace/overwrite that file. For generated local HTML/SVG/PDF/static sites, plan to use open_workspace_file or preview_workspace rather than starting a localhost server inside Docker.`

package/src/permission-advice.js

@@ -67,12 +67,12 @@ function currentMode(config = {}) {
 }
 
 function adviceForCategory(category = "", { toolName = "", args = {}, config = {}, state = {}, reason = "" } = {}) {
-  const command = compactLine(args.command || "");
+  const command = compactLine(args.command || args.text || "");
   const base = {
     category: category || "permission",
     reason: compactLine(reason || "The runtime policy blocked this operation."),
     currentMode: currentMode(config),
-    blockedOperation: command ? `run_command: ${command}` : toolName,
+    blockedOperation: command ? `${toolName || "tool"}: ${command}` : toolName,
     instruction:
       "Stop and present this blocker to the user instead of repeatedly trying variants. Continue only after the user approves a safer mode, changes the workspace, or gives a replacement instruction.",
   };

package/src/static-preview-server.js

@@ -5,6 +5,8 @@ import path from "node:path";
 const root = path.resolve(process.argv[2] || process.cwd());
 const port = Number(process.argv[3] || 0);
 const host = "127.0.0.1";
+const idleTtlMs = Math.max(Number(process.env.AGINTIFLOW_PREVIEW_TTL_MS) || 6 * 60 * 60 * 1000, 1000);
+let lastRequestAt = Date.now();
 
 const MIME_TYPES = new Map([
   [".html", "text/html; charset=utf-8"],
@@ -62,6 +64,7 @@ function isBlockedPath(relativePath) {
 }
 
 const server = http.createServer(async (req, res) => {
+  lastRequestAt = Date.now();
   if (!["GET", "HEAD"].includes(req.method || "")) {
     send(res, 405, "Method Not Allowed");
     return;
@@ -110,3 +113,14 @@ server.listen(port, host, () => {
   const actualPort = typeof address === "object" && address ? address.port : port;
   console.log(`AgInTiFlow static preview http://${host}:${actualPort}/ root=${root}`);
 });
+
+const ttlTimer = setInterval(async () => {
+  const rootExists = await fs
+    .stat(root)
+    .then((stat) => stat.isDirectory())
+    .catch(() => false);
+  if (rootExists && Date.now() - lastRequestAt < idleTtlMs) return;
+  server.close(() => process.exit(0));
+  setTimeout(() => process.exit(0), 1000).unref();
+}, Math.min(Math.max(Math.floor(idleTtlMs / 2), 1000), 60_000));
+ttlTimer.unref();

package/src/tmux-tools.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import path from "node:path";
 import { execFile as execFileCallback } from "node:child_process";
 import { promisify } from "node:util";
+import { evaluateCommandPolicy } from "./command-policy.js";
 import { redactSensitiveText } from "./redaction.js";
 
 const execFile = promisify(execFileCallback);
@@ -136,6 +137,22 @@ function checkWorkspaceBoundTmuxText(text = "", config = {}, label = "tmux text"
   return { ok: true };
 }
 
+function checkHostShellPolicyForTmuxText(text = "", config = {}, label = "tmux text") {
+  const command = String(text || "").trim();
+  if (!command) return { ok: true };
+  if (config.useDockerSandbox || config.sandboxMode !== "host" || config.allowDestructive) {
+    return { ok: true };
+  }
+  const policy = evaluateCommandPolicy(command, config);
+  if (policy.allowed) return { ok: true };
+  return {
+    ok: false,
+    reason: `${label} is blocked by the same host shell policy as run_command: ${policy.reason}`,
+    category: policy.category || "tmux",
+    needsApproval: policy.needsApproval,
+  };
+}
+
 function parseSessions(stdout = "") {
   return String(stdout || "")
     .split(/\r?\n/)
@@ -238,6 +255,17 @@ export async function sendTmuxKeys(args = {}, config = {}) {
   if (!workspaceBound.ok) {
     return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: workspaceBound.reason };
   }
+  const hostPolicy = checkHostShellPolicyForTmuxText(text, config, "tmux text");
+  if (!hostPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_send_keys",
+      blocked: true,
+      reason: hostPolicy.reason,
+      category: hostPolicy.category,
+      needsApproval: hostPolicy.needsApproval,
+    };
+  }
   for (const key of keys) {
     if (!ALLOWED_KEYS.has(key)) {
       return { ok: false, toolName: "tmux_send_keys", blocked: true, reason: `Unsupported tmux key: ${key}` };
@@ -293,6 +321,17 @@ export async function startTmuxSession(args = {}, config = {}) {
   if (!workspaceBound.ok) {
     return { ok: false, toolName: "tmux_start_session", blocked: true, reason: workspaceBound.reason };
   }
+  const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
+  if (!hostPolicy.ok) {
+    return {
+      ok: false,
+      toolName: "tmux_start_session",
+      blocked: true,
+      reason: hostPolicy.reason,
+      category: hostPolicy.category,
+      needsApproval: hostPolicy.needsApproval,
+    };
+  }
 
   const tmuxArgs = ["new-session", "-d", "-s", name.name, "-c", cwd.cwd];
   if (command) tmuxArgs.push(command);
@@ -332,6 +371,15 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     }
     const workspaceBound = checkWorkspaceBoundTmuxText(text, config, "tmux text");
     if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const hostPolicy = checkHostShellPolicyForTmuxText(text, config, "tmux text");
+    if (!hostPolicy.ok) {
+      return {
+        allowed: false,
+        reason: hostPolicy.reason,
+        category: hostPolicy.category || "tmux",
+        needsApproval: hostPolicy.needsApproval,
+      };
+    }
     for (const key of Array.isArray(args.keys) ? args.keys : []) {
       if (!ALLOWED_KEYS.has(String(key))) return { allowed: false, reason: `Unsupported tmux key: ${key}`, category: "tmux" };
     }
@@ -354,6 +402,15 @@ export function checkTmuxToolUse(toolName, args = {}, config = {}) {
     }
     const workspaceBound = checkWorkspaceBoundTmuxText(command, config, "tmux startup command");
     if (!workspaceBound.ok) return { allowed: false, reason: workspaceBound.reason, category: "tmux" };
+    const hostPolicy = checkHostShellPolicyForTmuxText(command, config, "tmux startup command");
+    if (!hostPolicy.ok) {
+      return {
+        allowed: false,
+        reason: hostPolicy.reason,
+        category: hostPolicy.category || "tmux",
+        needsApproval: hostPolicy.needsApproval,
+      };
+    }
     return { allowed: true, category: "tmux" };
   }
   return { allowed: true, category: "tmux" };