@ouro.bot/cli 0.1.0-alpha.891 → 0.1.0-alpha.893

package/changelog.json

@@ -1,6 +1,18 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.893",
+      "changes": [
+        "New cmux sense: an agent with senses.cmux.enabled watches the coding agents running in cmux on this Mac. It follows cmux's event stream, keeps what each terminal's agent last did, and brings each permission request, question or plan approval that cmux is holding for the human to the agent once, the way the mail sense does: a pending message in the agent's private runtime plus a private-turn wake that the daemon's policy now allows for the cmux sense (never including the request's tool input; every Feed field is flattened to one line, capped and marked untrusted, and a burst of requests costs one wake). This works for an agent with no tool-profiles.json. Three family-only tools: cmux_overview (who needs the human and what each session did), cmux_read (a terminal's text, redacted and bounded) and cmux_signal (a one-line workspace status or a desktop notification). The socket credential is a cmux capability token stored per machine with 'ouro vault config set --scope machine --key cmux.socketCapability'. After a gap in cmux's event stream or a cmux restart it starts its picture of the terminals afresh; a request that cannot be queued is retried on the next check while the others carry on; a failed state write no longer stops the Feed checks; it records the cmux version it is attached to (a prerelease such as 0.65.0-beta counts as older than 0.65.0); and the cmux tools are denied whenever the caller's trust level is unknown. See docs/cmux-sense.md."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.892",
+      "changes": [
+        "Local audio joins play the agent's voice through ffmpeg instead of sox, because sox's CoreAudio output can deadlock and stay silent when the process runs at lowered priority. An outbound call is treated as the job's friend only when the dialed number is on that friend's record. Phone greetings now name the agent: they had introduced themselves as ChatGPT in half of the live test calls."
+      ]
+    },
     {
       "version": "0.1.0-alpha.891",
       "changes": [

package/deploy/unraid/sanctuary.ouro/bundle-meta.json

@@ -1,5 +1,5 @@
 {
-  "runtimeVersion": "0.1.0-alpha.891",
+  "runtimeVersion": "0.1.0-alpha.893",
   "bundleSchemaVersion": 3,
   "lastUpdated": "2026-09-03T00:00:00.000Z"
 }

package/deploy/unraid/sanctuary.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <Container version="2">
   <Name>ouro-butler</Name>
-  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.891</Repository>
+  <Repository>ghcr.io/ourostack/ouroboros-butler:0.1.0-alpha.893</Repository>
   <Registry>https://github.com/ourostack/ouroboros/pkgs/container/ouroboros-butler</Registry>
   <Network>host</Network>
   <Shell>sh</Shell>

package/dist/heart/cmux-config.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cmuxRepairHint = cmuxRepairHint;
+exports.cmuxConfigFacts = cmuxConfigFacts;
+exports.cmuxSenseStatus = cmuxSenseStatus;
+exports.defaultCmuxSocketPath = defaultCmuxSocketPath;
+exports.resolveCmuxConnection = resolveCmuxConnection;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../nerves/runtime");
+function cmuxRepairHint(agent) {
+    return `human-required: in a cmux terminal run 'ouro vault config set --agent ${agent} --scope machine --key cmux.socketCapability --value "$CMUX_SOCKET_CAPABILITY"' (or set cmux.socketPassword when cmux is in password mode), then 'ouro up'.`;
+}
+function text(record, key) {
+    const value = record?.[key];
+    return typeof value === "string" ? value.trim() : "";
+}
+function cmuxRecord(machinePayload) {
+    const value = machinePayload.cmux;
+    return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function authFrom(cmux) {
+    const token = text(cmux, "socketCapability");
+    if (token)
+        return { kind: "capability", token };
+    const password = text(cmux, "socketPassword");
+    if (password)
+        return { kind: "password", password };
+    if (text(cmux, "socketMode") === "automation")
+        return { kind: "none" };
+    return null;
+}
+function cmuxConfigFacts(machinePayload) {
+    const cmux = cmuxRecord(machinePayload);
+    const auth = authFrom(cmux);
+    if (!auth)
+        return cmux ? { configured: false, detail: "missing cmux.socketCapability" } : { configured: false, optional: true, detail: "not attached on this machine" };
+    return { configured: true, detail: `socket auth: ${auth.kind === "none" ? "automation mode" : auth.kind}` };
+}
+/** The one-word status the prompt and turn context show for the cmux sense, matching the daemon's sense rows. */
+function cmuxSenseStatus(enabled, machinePayload) {
+    if (!enabled)
+        return "disabled";
+    const facts = cmuxConfigFacts(machinePayload);
+    if (facts.configured)
+        return "ready";
+    return facts.optional ? "not_attached" : "needs_config";
+}
+/** cmux's own default: `~/.local/state/cmux/cmux-<uid>.sock`, then the older unscoped `cmux.sock`. */
+function defaultCmuxSocketPath(homeDir = os.homedir(), uid = process.getuid?.() ?? 0, exists = fs.existsSync) {
+    const dir = path.join(homeDir, ".local", "state", "cmux");
+    const scoped = path.join(dir, `cmux-${uid}.sock`);
+    const unscoped = path.join(dir, "cmux.sock");
+    return !exists(scoped) && exists(unscoped) ? unscoped : scoped;
+}
+function resolveCmuxConnection(agent, machinePayload, defaultSocketPath = defaultCmuxSocketPath) {
+    const cmux = cmuxRecord(machinePayload);
+    const auth = authFrom(cmux);
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.cmux_connection_resolved",
+        message: "resolved cmux socket connection settings",
+        meta: { agent, auth: auth?.kind ?? "missing" },
+    });
+    if (!auth)
+        return { ok: false, error: `cmux socket auth is not configured on this machine; ${cmuxRepairHint(agent)}` };
+    return { ok: true, connection: { socketPath: text(cmux, "socketPath") || defaultSocketPath(), auth } };
+}

package/dist/heart/daemon/runtime-logging.js

@@ -58,7 +58,7 @@ function defaultLoggingForProcess(processName) {
             sinks: ["terminal", "ndjson"],
         };
     }
-    if (processName === "bluebubbles" || processName === "mail" || processName === "voice" || processName === "a2a") {
+    if (processName === "bluebubbles" || processName === "mail" || processName === "voice" || processName === "a2a" || processName === "cmux") {
         return {
             level: "warn",
             sinks: ["terminal", "ndjson"],

package/dist/heart/daemon/sense-manager.js

@@ -43,6 +43,7 @@ const runtime_credentials_1 = require("../runtime-credentials");
 const provider_credentials_1 = require("../provider-credentials");
 const sense_truth_1 = require("../sense-truth");
 const machine_identity_1 = require("../machine-identity");
+const cmux_config_1 = require("../cmux-config");
 const process_manager_1 = require("./process-manager");
 const config_1 = require("../../a2a/config");
 const DEFAULT_TEAMS_PORT = 3978;
@@ -62,6 +63,7 @@ function defaultSenses() {
         a2a: { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
         telegram: { ...identity_1.DEFAULT_AGENT_SENSES.telegram },
         workbench: { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
+        cmux: { ...identity_1.DEFAULT_AGENT_SENSES.cmux },
     };
 }
 function readAgentSenses(agentJsonPath) {
@@ -101,7 +103,7 @@ function readAgentSenses(agentJsonPath) {
         && !Array.isArray(rawMcpServers)
         && Object.prototype.hasOwnProperty.call(rawMcpServers, "ouro_workbench");
     const workbenchHasStaleBundleEntry = workbenchSensePresent || workbenchMcpPresent;
-    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench"]) {
+    for (const sense of ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench", "cmux"]) {
         const rawSense = rawSenses[sense];
         if (!rawSense || typeof rawSense !== "object" || Array.isArray(rawSense)) {
             continue;
@@ -162,7 +164,7 @@ function runtimeConfigUnavailableDetail(agent, runtimeConfig) {
     return `vault ${itemName} unavailable (${compactRuntimeConfigError(agent, runtimeConfig.error)})`;
 }
 function needsMachineRuntimeConfig(agent, sense) {
-    return sense === "bluebubbles" || sense === "voice" || sense === "a2a" || (agent === "sanctuary" && sense === "telegram");
+    return sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "cmux" || (agent === "sanctuary" && sense === "telegram");
 }
 function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntimeConfig = (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent), workbenchHasStaleBundleEntry = false) {
     const base = {
@@ -174,6 +176,7 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
         a2a: { configured: false, detail: "not enabled in agent.json" },
         telegram: { configured: false, detail: "not enabled in agent.json" },
         workbench: { configured: false, detail: "not enabled in agent.json" },
+        cmux: { configured: false, detail: "not enabled in agent.json" },
     };
     const payload = runtimeConfig.ok ? runtimeConfig.config : {};
     const unavailableDetail = runtimeConfigUnavailableDetail(agent, runtimeConfig);
@@ -342,6 +345,11 @@ function senseFactsFromRuntimeConfig(agent, senses, runtimeConfig, machineRuntim
             detail: publicUrl ? `${publicUrl}${endpointPath}` : `:${port} ${endpointPath}`,
         };
     }
+    if (senses.cmux.enabled) {
+        base.cmux = !machineRuntimeConfig.ok && machineRuntimeConfig.reason !== "missing"
+            ? { configured: false, detail: runtimeConfigUnavailableDetail(agent, machineRuntimeConfig) }
+            : (0, cmux_config_1.cmuxConfigFacts)(machinePayload);
+    }
     if (workbenchHasStaleBundleEntry || senses.workbench.enabled) {
         base.workbench = {
             configured: false,
@@ -369,6 +377,8 @@ function senseRepairHint(agent, sense) {
             ? "Agent-runnable: complete or recover the root authority migration; do not restore a resident Telegram token."
             : `Agent-runnable: store Telegram bot/user/chat coordinates with 'ouro connect telegram --agent ${agent}', then restart with 'ouro up'.`;
     }
+    if (sense === "cmux")
+        return (0, cmux_config_1.cmuxRepairHint)(agent);
     /* v8 ignore next -- Workbench is deliberately not daemon-managed, so getSenseInventory never asks the daemon manager for a repair hint @preserve */
     if (sense === "workbench") {
         return `Agent-runnable: install Ouro Workbench.app, then launch the boss through Workbench or run 'ouro acp-serve --agent ${agent} --workbench-mcp'; 'ouro connect workbench --agent ${agent}' only cleans stale bundle entries.`;
@@ -383,7 +393,7 @@ function parseSenseSnapshotName(name) {
     if (parts.length !== 2)
         return null;
     const [agent, sense] = parts;
-    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a" && sense !== "telegram")
+    if (sense !== "teams" && sense !== "bluebubbles" && sense !== "mail" && sense !== "voice" && sense !== "a2a" && sense !== "telegram" && sense !== "cmux")
         return null;
     return { agent, sense };
 }
@@ -403,11 +413,13 @@ function managedSenseEntry(sense) {
         return "senses/a2a-entry.js";
     if (sense === "telegram")
         return "senses/telegram-entry.js";
+    if (sense === "cmux")
+        return "senses/cmux-entry.js";
     return "senses/mail-entry.js";
 }
 function runtimeCredentialBootstrapFor(agent, sense) {
     const runtime = (0, runtime_credentials_1.readRuntimeCredentialConfig)(agent);
-    const usesMachineConfig = sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "telegram";
+    const usesMachineConfig = sense === "bluebubbles" || sense === "voice" || sense === "a2a" || sense === "telegram" || sense === "cmux";
     const machineId = usesMachineConfig ? currentMachineId() : undefined;
     const machine = usesMachineConfig ? (0, runtime_credentials_1.readMachineRuntimeCredentialConfig)(agent) : null;
     const providerPool = (0, provider_credentials_1.readProviderCredentialPool)(agent);
@@ -578,7 +590,7 @@ class DaemonSenseManager {
             return [agent, { senses, workbenchHasStaleBundleEntry, facts }];
         }));
         const managedSenseAgents = [...this.contexts.entries()].flatMap(([agent, context]) => {
-            return ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram"]
+            return ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "cmux"]
                 .filter((sense) => context.senses[sense].enabled)
                 .map((sense) => ({
                 name: `${agent}:${sense}`,
@@ -730,7 +742,7 @@ class DaemonSenseManager {
     }
     async refreshEnabledSenseConfigs() {
         const refreshes = [...this.contexts.entries()].map(async ([agent, context]) => {
-            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram"]
+            const enabledManagedSenses = ["teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "cmux"]
                 .filter((sense) => context.senses[sense].enabled);
             /* v8 ignore next -- periodic refresh work only exists when a managed background sense is enabled @preserve */
             if (enabledManagedSenses.length === 0)
@@ -904,6 +916,11 @@ class DaemonSenseManager {
                 workbench: {
                     configured: context.facts.workbench.configured,
                 },
+                cmux: {
+                    configured: context.facts.cmux.configured,
+                    optional: context.facts.cmux.optional,
+                    ...(runtime.get(agent)?.cmux ?? {}),
+                },
             };
             const inventory = (0, sense_truth_1.getSenseInventory)({ senses: context.senses }, runtimeInfo);
             return inventory.map((entry) => ({

package/dist/heart/identity.js

@@ -145,6 +145,7 @@ exports.DEFAULT_AGENT_SENSES = {
     a2a: { enabled: false },
     telegram: { enabled: false },
     workbench: { enabled: false },
+    cmux: { enabled: false },
 };
 function normalizeSenses(value, configFile) {
     const defaults = {
@@ -156,6 +157,7 @@ function normalizeSenses(value, configFile) {
         a2a: { ...exports.DEFAULT_AGENT_SENSES.a2a },
         telegram: { ...exports.DEFAULT_AGENT_SENSES.telegram },
         workbench: { ...exports.DEFAULT_AGENT_SENSES.workbench },
+        cmux: { ...exports.DEFAULT_AGENT_SENSES.cmux },
     };
     if (value === undefined) {
         return defaults;
@@ -171,7 +173,7 @@ function normalizeSenses(value, configFile) {
         throw new Error(`agent.json at ${configFile} must include senses as an object when present.`);
     }
     const raw = value;
-    const senseNames = ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench"];
+    const senseNames = ["cli", "teams", "bluebubbles", "mail", "voice", "a2a", "telegram", "workbench", "cmux"];
     for (const senseName of senseNames) {
         const rawSense = raw[senseName];
         if (rawSense === undefined) {
@@ -219,6 +221,7 @@ function buildDefaultAgentTemplate(_agentName) {
             a2a: { ...exports.DEFAULT_AGENT_SENSES.a2a },
             telegram: { ...exports.DEFAULT_AGENT_SENSES.telegram },
             workbench: { ...exports.DEFAULT_AGENT_SENSES.workbench },
+            cmux: { ...exports.DEFAULT_AGENT_SENSES.cmux },
         },
         phrases: {
             thinking: [...exports.DEFAULT_AGENT_PHRASES.thinking],

package/dist/heart/private-runtime/policy.js

@@ -150,6 +150,14 @@ async function evaluatePolicy(request, context, deps) {
             reason: "verified daemon external event",
         };
     }
+    if (request.triggerSource === "cmux-feed"
+        && hasNonEmptyOriginRef(originRefs, "cmux-feed")
+        && hasOriginRef(originRefs, "sense", "cmux")) {
+        return {
+            result: "allow",
+            reason: "cmux sense escalation",
+        };
+    }
     if (request.triggerSource === "operator-cli"
         && hasOriginRef(originRefs, "cli-command", "ouro msg")
         && hasNonEmptyOriginRef(originRefs, "daemon-receipt")) {

package/dist/heart/sense-truth.js

@@ -12,6 +12,7 @@ const SENSES = [
     { sense: "a2a", label: "A2A", daemonManaged: true },
     { sense: "telegram", label: "Telegram", daemonManaged: true },
     { sense: "workbench", label: "Workbench", daemonManaged: false },
+    { sense: "cmux", label: "cmux", daemonManaged: true },
 ];
 function configuredSenses(senses) {
     const configured = senses ?? {};
@@ -25,6 +26,7 @@ function configuredSenses(senses) {
         a2a: configured.a2a ?? { ...identity_1.DEFAULT_AGENT_SENSES.a2a },
         telegram: configured.telegram ?? { ...identity_1.DEFAULT_AGENT_SENSES.telegram },
         workbench: configured.workbench ?? { ...identity_1.DEFAULT_AGENT_SENSES.workbench },
+        cmux: configured.cmux ?? { ...identity_1.DEFAULT_AGENT_SENSES.cmux },
     };
 }
 function resolveStatus(enabled, daemonManaged, runtimeInfo) {

package/dist/heart/turn-context.js

@@ -63,6 +63,7 @@ const provider_visibility_1 = require("./provider-visibility");
 const mail_import_discovery_1 = require("./mail-import-discovery");
 const flight_recorder_1 = require("../arc/flight-recorder");
 const context_loss_sentinel_1 = require("./context-loss-sentinel");
+const cmux_config_1 = require("./cmux-config");
 // ── Helpers ─────────────────────────────────────────────────────────
 const DAEMON_SOCKET_PATH = "/tmp/ouroboros-daemon.sock";
 function isLiveCodingSessionStatus(status) {
@@ -167,6 +168,7 @@ function readSenseStatusLines() {
         a2a: configuredSenses.a2a ?? { enabled: false },
         telegram: configuredSenses.telegram ?? { enabled: false },
         workbench: configuredSenses.workbench ?? { enabled: false },
+        cmux: configuredSenses.cmux ?? { enabled: false },
     };
     const payload = (0, config_1.loadConfig)();
     const agentName = (0, identity_1.getAgentName)();
@@ -221,6 +223,7 @@ function readSenseStatusLines() {
                 && hasTextField(runtimePayload, "telegramAuthorizedUserId")
                 && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
         workbench: false,
+        cmux: (0, cmux_config_1.cmuxSenseStatus)(true, machinePayload) === "ready",
     };
     const rows = [
         { label: "CLI", status: "interactive" },
@@ -248,6 +251,10 @@ function readSenseStatusLines() {
             label: "Telegram",
             status: !senses.telegram.enabled ? "disabled" : configured.telegram ? "ready" : "needs_config",
         },
+        {
+            label: "cmux",
+            status: (0, cmux_config_1.cmuxSenseStatus)(senses.cmux.enabled, machinePayload),
+        },
         {
             label: "Workbench",
             // Workbench can be injected at runtime (the Workbench app spawns

package/dist/mind/prompt.js

@@ -86,6 +86,7 @@ const daemon_health_1 = require("../heart/daemon/daemon-health");
 const scrutiny_1 = require("./scrutiny");
 const pulse_1 = require("../heart/daemon/pulse");
 const provider_visibility_1 = require("../heart/provider-visibility");
+const cmux_config_1 = require("../heart/cmux-config");
 const store_1 = require("../trips/store");
 const orientation_frame_1 = require("../heart/orientation-frame");
 const flight_recorder_1 = require("../arc/flight-recorder");
@@ -478,6 +479,7 @@ function localSenseStatusLines() {
         a2a: configuredSenses.a2a ?? { enabled: false },
         telegram: configuredSenses.telegram ?? { enabled: false },
         workbench: configuredSenses.workbench ?? { enabled: false },
+        cmux: configuredSenses.cmux ?? { enabled: false },
     };
     const payload = (0, config_1.loadConfig)();
     const runtimeConfig = (0, runtime_credentials_1.readRuntimeCredentialConfig)((0, identity_1.getAgentName)());
@@ -506,6 +508,7 @@ function localSenseStatusLines() {
             && hasTextField(runtimePayload, "telegramAuthorizedUserId")
             && hasTextField(runtimePayload, "telegramAuthorizedChatId"),
         workbench: false,
+        cmux: (0, cmux_config_1.cmuxSenseStatus)(true, machinePayload) === "ready",
     };
     const rows = [
         { label: "CLI", status: "interactive" },
@@ -533,6 +536,10 @@ function localSenseStatusLines() {
             label: "Telegram",
             status: !senses.telegram.enabled ? "disabled" : configured.telegram ? "ready" : "needs_config",
         },
+        {
+            label: "cmux",
+            status: (0, cmux_config_1.cmuxSenseStatus)(senses.cmux.enabled, machinePayload),
+        },
         {
             label: "Workbench",
             // Workbench can be injected at runtime (the Workbench app spawns

package/dist/repertoire/guardrails.js

@@ -441,6 +441,9 @@ const TRAVEL_TRUSTED_TOOLS = new Set(["weather_lookup", "travel_advisory", "geoc
 const A2A_TRUSTED_TOOLS = new Set(["a2a_list_peers", "a2a_send_message", "a2a_get_task"]);
 const COMMERCE_FAMILY_TOOLS = new Set(["commerce_checkout_preview", "commerce_checkout_commit", "commerce_receipt_get", "commerce_access_log"]);
 const COMMERCE_AUTHORITY_TOOLS = new Set(["stripe_create_card", "flight_hold", "flight_book"]);
+// The cmux tools read the owner's terminals and speak to them through their desktop, so only family may use them.
+// A call with no known trust level fails closed.
+const CMUX_FAMILY_TOOLS = new Set(["cmux_overview", "cmux_read", "cmux_signal"]);
 const MAIL_FAMILY_TOOLS = new Set(["mail_screener", "mail_decide", "mail_access_log", "mail_send", "mail_index_refresh"]);
 const MAIL_DELEGATED_READ_TOOLS = new Set(["mail_recent", "mail_search"]);
 function opaqueAnsiShellAtoms(command) {
@@ -1181,6 +1184,9 @@ function checkTrustLevelGuardrails(toolName, args, context) {
     const mailResult = mailTrustGuardrail(toolName, args, context);
     if (!mailResult.allowed)
         return mailResult;
+    if (CMUX_FAMILY_TOOLS.has(toolName) && context.trustLevel !== "family") {
+        return deny("the owner's cmux terminals require family trust.");
+    }
     // Credential tools have their own trust rules that apply at all levels
     const credentialResult = checkCredentialTrustGuardrails(toolName, context);
     if (!credentialResult.allowed)