Harden tmux MCP tool surface

[tony]

Summary

• block tmux format-job execution paths from readonly format inputs
• preserve structured tool responses above realistic terminal payload sizes
• fail closed on invalid safety tiers and pin startup to stdio transport
• add run_command for command completion with exit status, history suppression, and output filtering
• use libtmux's reset path for clear_pane
• expose active pane and snapshot liveness metadata, ship py.typed, and refresh stale docs

Issues

Closes #68
Closes #69
Closes #70
Closes #71
Closes #72
Closes #73
Closes #74
Closes #75

Verification

$ rm -rf docs/_build; uv run ruff check . --fix --show-fixes; uv run ruff format .; uv run mypy .; uv run py.test --reruns 0 -vvv; just build-docs;

Passed locally: ruff clean, format unchanged, mypy clean, 577 tests passed, docs build succeeded.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 86.77686% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.07%. Comparing base (b8e9297) to head (78f4f11).

Files with missing lines	Patch %	Lines
src/libtmux_mcp/tools/pane_tools/io.py	81.17%	13 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #76      +/-   ##
==========================================
+ Coverage   84.84%   85.07%   +0.22%     
==========================================
  Files          42       42              
  Lines        2772     2881     +109     
  Branches      372      385      +13     
==========================================
+ Hits         2352     2451      +99     
- Misses        314      322       +8     
- Partials      106      108       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[tony]

Code review

Found 1 issue:

1. The new run_command tool's command argument is not redacted in the MCP audit log, so a call like run_command(command="psql -U admin -W supersecret") leaks the credential to long-lived audit archives. AuditMiddleware._summarize_args only digests argument values whose name is in _SENSITIVE_ARG_NAMES; everything else is logged in cleartext (truncated to 200 chars). command is missing from that set even though it is the same risk class as the shell payloads already listed (keys, text, content, shell, ...). This repeats the exact gap fixed for respawn_pane's shell in commit 9e1997b ("redact respawn shell payloads": "An agent that passes shell='psql -U user -W secret' would otherwise leak the credential to long-lived audit archives"). Fix: add "command" to _SENSITIVE_ARG_NAMES and its docstring. (historical git context)

libtmux-mcp/src/libtmux_mcp/middleware.py

Lines 350 to 369 in 1c43cb9

	#: Argument names that carry user-supplied payloads we never want in logs.
	#: ``keys`` (send_keys), ``text`` (paste_text), ``value`` (set_environment),
	#: ``content`` (load_buffer), ``shell`` (respawn_pane), and ``environment``
	#: (respawn_pane) can contain commands, secrets, or arbitrary large strings.
	#: Matched by exact name, case-sensitive, to mirror the tool signatures.
	#:
	#: ``environment`` is dict-shaped (``dict[str, str]``); the redaction logic
	#: in :func:`_summarize_args` recognises this and digests each *value* while
	#: leaving the *keys* (env var names like ``DATABASE_URL``) visible — env
	#: var names are operator-debug-useful, but their values are the secret.
	#: All other entries are scalar strings; mixing the two is intentional.
	#:
	#: Note on ``shell`` and ``environment`` redaction: this redacts the MCP
	#: audit log only. ``respawn_pane(shell="env SECRET=... bash")`` and
	#: ``environment={"AWS_SECRET_KEY": "..."}`` may briefly expose the values
	#: via the OS process table and tmux's ``pane_current_command`` metadata
	#: until the spawned shell takes over — see ``docs/topics/safety.md``.
	_SENSITIVE_ARG_NAMES: frozenset[str] = frozenset(
	{"keys", "text", "value", "content", "shell", "environment"}
	)

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[tony]

Code review

Found 1 issue:

1. The new drop_hex_continuation heuristic in _filter_run_command_internal_lines (commit 1e512b8) silently drops legitimate command output. The flag is armed after dropping any matched line — including via internal_markers, which always matches the current call's joined sync line — and the next line is then dropped if it is 8–32 chars of pure hex. Because an interactive shell echoes the typed payload before executing it, the line after the sync line is the command's first real output. So run_command("git rev-parse --short=10 HEAD"), openssl rand -hex 8 (16 hex), a 12-char docker id, or any short hash/UUID slice is dropped, returning exit_status=0 with missing output and no truncation signal. The hex-drop branch also continues without resetting the flag, so consecutive hex output lines are all dropped. This re-opens the silent false-drop class that commit 76e57a5 deliberately fixed ("the over-broad substring markers ... only caused silent false drops of real output"). Arming the continuation only on the status_line_re/wait_line_re (previous-call wrap) matches, and resetting after a single dropped line, would scope it to wrapped fragments without eating real output. (bug due to the loop below)

libtmux-mcp/src/libtmux_mcp/tools/pane_tools/io.py

Lines 297 to 314 in 1e512b8

	for line in lines:
	stripped = line.strip()
	if (
	any(marker in line for marker in internal_markers)
	or status_line_re.search(line)
	or wait_line_re.search(line)
	):
	drop_hex_continuation = True
	continue
	if (
	drop_hex_continuation
	and 8 <= len(stripped) <= 32
	and all(char in hex_chars for char in stripped)
	):
	continue
	drop_hex_continuation = False
	kept.append(line)
	return kept

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}