diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f986a67..769901b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,5 +19,8 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
+      - run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y tmux
       - run: npm ci
       - run: npm run check
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 914c8af..ed26347 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,6 +9,6 @@ npm install
 npm run check
 ```
 
-Keep the safety model intact: workspace paths must remain fixed at server startup, child working directories must remain inside that boundary, Git calls must not use a shell or user-provided argument arrays, and new persistence paths must pass through redaction and sensitive-path filtering.
+Keep the safety model intact: workspace paths must remain fixed at server startup, child working directories must remain inside that boundary, Git and tmux calls must not use a shell or user-provided argument arrays, and new persistence paths must pass through redaction and sensitive-path filtering.
 
-For behavior changes, add an integration test using a temporary Git repository. For new MCP tools, explain why the behavior cannot fit one of the existing ten tools; a small and predictable tool surface is a product constraint.
+For behavior changes, add an integration test using a temporary Git repository. Terminal changes also need an isolated tmux socket test; never attach tests to a user's default server. For new MCP tools, explain why the behavior cannot fit one of the existing tools; a small and predictable tool surface is a product constraint.
diff --git a/LICENSES/tmux-bridge-mcp-MIT.txt b/LICENSES/tmux-bridge-mcp-MIT.txt
new file mode 100644
index 0000000..26b3be4
--- /dev/null
+++ b/LICENSES/tmux-bridge-mcp-MIT.txt
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Howard Peng and tmux-bridge-mcp contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
index 79ed5f6..14689bb 100644
--- a/README.md
+++ b/README.md
@@ -4,15 +4,19 @@
 
 **Let AI continue where another AI stopped.**
 
-It tracks active sessions, task leases, advisory file ownership, decisions, failed attempts, Git state, and handoffs so Codex, Claude Code, and other agents can continue each other's work without rebuilding context from scratch.
+It tracks active sessions, task leases, advisory file ownership, decisions, failed attempts, Git state, and handoffs so Codex, Claude Code, and other agents can continue each other's work without rebuilding context from scratch. Its built-in tmux transport also lets those agents read and message trusted panes without installing a second MCP server.
 
 > Not another chat memory. A local coordination layer for coding agents.
 
-## What works in v0.3.1
+## What works in v0.4.0
 
 - Local-first SQLite storage inside a repository or workspace
 - Fixed non-Git workspace boundaries with child-repository Git context
-- MCP server with ten focused tools
+- MCP server with ten coordination tools and five live terminal tools
+- Built-in tmux transport with no `tmux-bridge-mcp` runtime dependency
+- One-session tmux boundary with pane labels and self-message prevention
+- Redacted, size-limited terminal reads and single-line message sends
+- Persistent read-before-send guards and content-free terminal audit events
 - Agent sessions and heartbeats
 - Expiring task leases
 - Advisory file and glob claims with overlap warnings
@@ -39,10 +43,19 @@ Agent B joins
   -> claims the continuation and starts from verified project state
 ```
 
-## Install from source
+## Install
 
 AgentRelay is not published to npm yet.
 
+Install the current GitHub repository as one self-contained CLI and MCP server:
+
+```bash
+npm install -g github:arumwu/agentrelay
+agentrelay --version
+```
+
+Or install from a source checkout:
+
 ```bash
 git clone https://github.com/arumwu/agentrelay.git
 cd agentrelay
@@ -51,7 +64,7 @@ npm run build
 npm link
 ```
 
-Node.js 22.13 or newer is required.
+Node.js 22.13 or newer is required. The coordination and memory features work without tmux; the live terminal tools additionally require tmux 3.2 or newer.
 
 ## Quick start
 
@@ -120,6 +133,31 @@ claude mcp add --scope local agentrelay -- \
 
 AgentRelay advertises its lifecycle instructions through MCP initialization. For clients that do not consume server instructions, place the fallback rules from [`examples/AGENTS.md`](examples/AGENTS.md) in the repository's `AGENTS.md` or `CLAUDE.md`.
 
+## Live tmux transport
+
+AgentRelay includes the terminal transport directly. Installing `@arumwu/agentrelay` or the GitHub package is enough; do not install or register a separate `tmux-bridge-mcp` server.
+
+Run the agents you want to coordinate in one tmux session. When AgentRelay starts inside tmux it automatically restricts terminal access to that current session:
+
+```bash
+agentrelay terminal list
+agentrelay terminal name %3 codex
+agentrelay terminal read codex --lines 40
+agentrelay terminal send codex "Review src/auth.ts and report any regressions"
+```
+
+`terminal read` opens a 90-second, one-use guard for that actor and pane. After one send, read the pane again before sending another message. AgentRelay stores audit metadata such as the pane, byte count, and correlation ID, but never persists captured terminal output or message content.
+
+If AgentRelay starts outside tmux, explicitly allow one session:
+
+```bash
+agentrelay terminal --tmux-session agent-work list
+```
+
+For MCP clients launched outside tmux, set `AGENTRELAY_TMUX_SESSION` in that server's environment. Set `AGENTRELAY_TMUX_SOCKET` only when using a non-default socket. Terminal targets outside the selected session are rejected.
+
+`terminal_send` types one literal, single-line message followed by Enter. A shell pane can interpret that text as a command, so only label and target panes you trust. AgentRelay intentionally exposes no arbitrary key or generic shell-execution tool.
+
 ## Workspace mode
 
 A workspace may contain many independent Git repositories and non-Git projects:
@@ -150,6 +188,11 @@ Task and scope claims remain workspace-wide. In the example above, claim `produc
 | `search_memory` | Search events, decisions, and handoffs with SQLite FTS5 |
 | `build_context` | Compile task-specific Git, coordination, and memory context |
 | `create_handoff` | Generate a Markdown handoff and optionally release leases |
+| `terminal_list` | List panes only in the allowed tmux session |
+| `terminal_read` | Read redacted, capped pane output and open a one-use send guard |
+| `terminal_send` | Send one literal single-line message and Enter after a recent read |
+| `terminal_name` | Assign an AgentRelay-specific pane label |
+| `terminal_doctor` | Diagnose tmux binary, socket, session, and safety limits |
 
 ## Local data
 
@@ -180,7 +223,11 @@ Decision conflicts are also advisory. AgentRelay flags related active decisions
 - The workspace root is resolved once when the server starts.
 - Agent working directories must exist inside that fixed workspace.
 - MCP tools cannot escape to another workspace path.
-- AgentRelay does not expose arbitrary shell or test-command execution.
+- AgentRelay does not expose a generic shell, arbitrary-key, or test-command tool.
+- Terminal access is limited to the current or explicitly configured tmux session.
+- Terminal sends require a recent read, reject self-targeting, and accept only one literal line.
+- Terminal output is redacted and size-limited; captured output and message text are not persisted.
+- Sending to a shell pane may still execute text, so terminal access is only for trusted panes.
 - Git inspection uses fixed argument arrays without a shell.
 - `.env`, private keys, and credential-like paths are filtered.
 - Common API keys, tokens, passwords, cookies, and bearer headers are redacted before storage.
@@ -195,7 +242,7 @@ npm install
 npm run check
 ```
 
-The integration tests create temporary Git repositories and exercise task conflict, scope overlap, memory search, decision conflict, handoff generation, and a real in-memory MCP client/server handshake.
+The integration tests create temporary Git repositories and exercise task conflict, scope overlap, memory search, decision conflict, handoff generation, and a real in-memory MCP client/server handshake. When tmux is installed, they also create an isolated socket and verify real pane listing, labeling, read-before-send enforcement, messaging, self-target rejection, and cross-session isolation. CI always installs tmux and runs this path.
 
 ## Roadmap
 
@@ -209,4 +256,4 @@ The integration tests create temporary Git repositories and exercise task confli
 
 ## License
 
-Apache License 2.0. See [LICENSE](LICENSE).
+AgentRelay is licensed under Apache License 2.0. See [LICENSE](LICENSE). The built-in terminal transport includes work adapted from MIT-declared `tmux-bridge-mcp`; see [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) and [LICENSES/tmux-bridge-mcp-MIT.txt](LICENSES/tmux-bridge-mcp-MIT.txt).
diff --git a/SECURITY.md b/SECURITY.md
index 8c59fc6..8911c95 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -14,23 +14,31 @@ Include the affected version, operating system, reproduction steps, security imp
 
 AgentRelay assumes coding agents and repository content may produce inaccurate or adversarial text. Stored memory is treated as context, not executable instructions.
 
-The v0.1 boundary is intentionally narrow:
+The boundary is intentionally narrow:
 
 - one fixed repository or workspace boundary per server process
 - local SQLite and Markdown storage
-- no arbitrary shell command tool
+- no generic shell, arbitrary-key, or test-command tool
 - fixed Git command argument arrays
 - workspace-relative scope paths only
 - path traversal and absolute-path rejection
 - sensitive filename filtering
 - best-effort secret redaction before persistence
+- one allowed tmux session per server process
+- one-use, actor-and-pane-specific read-before-send guards
+- single-line terminal messages with byte limits and self-target rejection
+- redacted and size-limited terminal reads
+- terminal audit metadata that excludes captured output and message text
 
 Secret redaction is defense in depth, not a substitute for avoiding secret input. Users should not intentionally send credentials to AgentRelay.
 
-## Out of scope for v0.1
+`terminal_send` types literal text followed by Enter. If the target is a shell pane, that text can execute as a command. Only expose AgentRelay to trusted MCP clients, use a dedicated tmux session, label intended agent panes, inspect the pane with `terminal_read`, and do not target unrelated shells or production consoles.
+
+## Out of scope
 
 - hostile local users with filesystem access to `.agentrelay/`
 - full-disk compromise
 - malicious changes to the AgentRelay executable or dependencies
+- malicious or compromised processes already running inside the allowed tmux session
 - perfect detection of every possible credential format
 - enforcing scope claims against tools that bypass AgentRelay
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
new file mode 100644
index 0000000..0d4971c
--- /dev/null
+++ b/THIRD_PARTY_NOTICES.md
@@ -0,0 +1,23 @@
+# Third-party notices
+
+AgentRelay is licensed under Apache-2.0. The built-in tmux transport also adapts
+the public behavior and selected implementation ideas of the following project.
+
+## tmux-bridge-mcp
+
+- Project: `tmux-bridge-mcp`
+- Author and current contributor: Howard Peng (`howardpen9`)
+- Upstream: https://github.com/howardpen9/tmux-bridge-mcp
+- Reviewed revision: `eccf41bc1ab89a12d9c7540fcbf6d00e7161ff5c`
+- Upstream package version: `0.3.0`
+- Declared license: MIT in the upstream `package.json`
+
+The upstream repository did not contain a root `LICENSE` file at the reviewed
+revision. AgentRelay therefore reproduces the standard MIT license text in
+[`LICENSES/tmux-bridge-mcp-MIT.txt`](LICENSES/tmux-bridge-mcp-MIT.txt) and keeps
+this provenance notice with source and package distributions. Copyright in the
+upstream work remains with its author and contributors.
+
+AgentRelay's integration uses its own `terminal_*` interface and adds a single
+tmux-session boundary, redaction and output limits, persistent read-before-send
+guards, audit metadata, self-message prevention, and no arbitrary key tool.
diff --git a/examples/AGENTS.md b/examples/AGENTS.md
index 51a2e80..962603e 100644
--- a/examples/AGENTS.md
+++ b/examples/AGENTS.md
@@ -21,6 +21,16 @@ AgentRelay normally advertises this lifecycle through MCP server instructions. U
 - Record durable architecture choices with `record_decision`.
 - Never store secrets, credentials, raw `.env` values, or private keys in AgentRelay.
 
+## Live terminal coordination
+
+1. Call `terminal_list` to inspect panes in the allowed tmux session.
+2. Optionally call `terminal_name` once to assign a stable AgentRelay label.
+3. Call `terminal_read` on the target before every `terminal_send`.
+4. Send only to trusted agent panes. Do not target shells, production consoles, or your own pane.
+5. Stop after sending; read again only when a new response is expected. Do not poll continuously.
+
+Terminal output is redacted and capped, but may still contain sensitive context that redaction does not recognize. Never ask another pane to print credentials or raw environment files.
+
 ## Before ending or handing off
 
 1. Record the latest test result and unresolved issues.
diff --git a/package-lock.json b/package-lock.json
index 7b4d7e4..d597d16 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@arumwu/agentrelay",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arumwu/agentrelay",
-      "version": "0.3.1",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
diff --git a/package.json b/package.json
index c8b322e..bac3409 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@arumwu/agentrelay",
-  "version": "0.3.1",
-  "description": "One project. Multiple AI agents. Zero repeated work.",
+  "version": "0.4.0",
+  "description": "Local-first coordination, shared project memory, and live tmux transport for coding agents.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -17,7 +17,10 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "SECURITY.md",
+    "LICENSE",
+    "LICENSES",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
@@ -25,6 +28,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "check": "npm run build && npm test",
+    "prepare": "npm run build",
     "prepack": "npm run check"
   },
   "engines": {
@@ -34,6 +38,8 @@
     "mcp",
     "coding-agents",
     "multi-agent",
+    "tmux",
+    "terminal",
     "handoff",
     "project-memory"
   ],
diff --git a/src/cli.ts b/src/cli.ts
index 6cb371c..4a9a37f 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -2,7 +2,9 @@
 import { Command, Option } from "commander";
 import { serveStdio } from "./mcp.js";
 import { ProjectStore } from "./store.js";
+import { TerminalService, TerminalTransport } from "./terminal.js";
 import type { AgentType, EventType, SearchResult } from "./types.js";
+import { AGENTRELAY_VERSION } from "./version.js";
 
 function print(value: unknown): void {
   process.stdout.write(`${typeof value === "string" ? value : JSON.stringify(value, null, 2)}\n`);
@@ -21,10 +23,37 @@ function withStore<T>(repo: string, callback: (store: ProjectStore) => T): T {
   }
 }
 
+async function withTerminal<T>(
+  repo: string,
+  options: { tmuxSession?: string; tmuxSocket?: string },
+  callback: (terminal: TerminalService) => Promise<T>,
+): Promise<T> {
+  const store = new ProjectStore(repo);
+  const transport = new TerminalTransport({
+    ...(options.tmuxSession ? { sessionName: options.tmuxSession } : {}),
+    ...(options.tmuxSocket ? { socketPath: options.tmuxSocket } : {}),
+  });
+  try {
+    return await callback(new TerminalService(store, transport));
+  } finally {
+    store.close();
+  }
+}
+
+function auditContext(options: { agentSession?: string; taskId?: string }): {
+  sessionId?: string;
+  taskId?: string;
+} {
+  return {
+    ...(options.agentSession ? { sessionId: options.agentSession } : {}),
+    ...(options.taskId ? { taskId: options.taskId } : {}),
+  };
+}
+
 const program = new Command()
   .name("agentrelay")
-  .description("Local-first coordination and shared project memory for coding agents.")
-  .version("0.3.1")
+  .description("Local-first coordination, shared project memory, and live tmux transport for coding agents.")
+  .version(AGENTRELAY_VERSION)
   .option("-r, --repo <path>", "Workspace or Git repository to coordinate", process.cwd());
 
 program
@@ -208,6 +237,88 @@ program
     })));
   });
 
+const terminalCommand = program
+  .command("terminal")
+  .description("Coordinate trusted AI-agent panes through the built-in tmux transport")
+  .option("--tmux-session <name>", "Allow only this tmux session; defaults to the current session")
+  .option("--tmux-socket <path>", "Use an explicit tmux socket path");
+
+function terminalOptions(): { tmuxSession?: string; tmuxSocket?: string } {
+  const options = terminalCommand.opts<{ tmuxSession?: string; tmuxSocket?: string }>();
+  return {
+    ...(options.tmuxSession ? { tmuxSession: options.tmuxSession } : {}),
+    ...(options.tmuxSocket ? { tmuxSocket: options.tmuxSocket } : {}),
+  };
+}
+
+terminalCommand
+  .command("list")
+  .description("List panes in the allowed tmux session")
+  .action(async () => {
+    const repo = program.opts<{ repo: string }>().repo;
+    print(await withTerminal(repo, terminalOptions(), (terminal) => terminal.list()));
+  });
+
+terminalCommand
+  .command("read")
+  .description("Read redacted pane output and open a short-lived send guard")
+  .argument("<target>", "Pane id, tmux target, or AgentRelay pane label")
+  .option("--lines <count>", "Lines to read, from 1 to 200", "50")
+  .option("--agent-session <uuid>", "AgentRelay session for the audit event")
+  .option("--task-id <uuid>", "AgentRelay task for the audit event")
+  .action(async (target: string, options: { lines: string; agentSession?: string; taskId?: string }) => {
+    const repo = program.opts<{ repo: string }>().repo;
+    print(await withTerminal(
+      repo,
+      terminalOptions(),
+      (terminal) => terminal.read(target, Number(options.lines), auditContext(options)),
+    ));
+  });
+
+terminalCommand
+  .command("send")
+  .description("Send one literal message and Enter after a recent terminal read")
+  .argument("<target>", "Pane id, tmux target, or AgentRelay pane label")
+  .argument("<message>", "Single-line message, up to 8192 UTF-8 bytes")
+  .option("--agent-session <uuid>", "AgentRelay session for the audit event")
+  .option("--task-id <uuid>", "AgentRelay task for the audit event")
+  .action(async (target: string, message: string, options: { agentSession?: string; taskId?: string }) => {
+    const repo = program.opts<{ repo: string }>().repo;
+    print(await withTerminal(
+      repo,
+      terminalOptions(),
+      (terminal) => terminal.send(target, message, auditContext(options)),
+    ));
+  });
+
+terminalCommand
+  .command("name")
+  .description("Assign an AgentRelay-specific label to a pane")
+  .argument("<target>", "Pane id or tmux target")
+  .argument("<label>", "Letters, numbers, dots, underscores, or hyphens")
+  .option("--agent-session <uuid>", "AgentRelay session for the audit event")
+  .option("--task-id <uuid>", "AgentRelay task for the audit event")
+  .action(async (target: string, label: string, options: { agentSession?: string; taskId?: string }) => {
+    const repo = program.opts<{ repo: string }>().repo;
+    print(await withTerminal(
+      repo,
+      terminalOptions(),
+      (terminal) => terminal.name(target, label, auditContext(options)),
+    ));
+  });
+
+terminalCommand
+  .command("doctor")
+  .description("Diagnose tmux binary, socket, session, and safety limits")
+  .action(async () => {
+    const options = terminalOptions();
+    const transport = new TerminalTransport({
+      ...(options.tmuxSession ? { sessionName: options.tmuxSession } : {}),
+      ...(options.tmuxSocket ? { socketPath: options.tmuxSocket } : {}),
+    });
+    print(await transport.doctor());
+  });
+
 program.parseAsync().catch((error: unknown) => {
   process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
   process.exitCode = 1;
diff --git a/src/db.ts b/src/db.ts
index dcb751b..915c3de 100644
--- a/src/db.ts
+++ b/src/db.ts
@@ -96,6 +96,15 @@ CREATE TABLE IF NOT EXISTS handoffs (
   created_at TEXT NOT NULL
 );
 
+CREATE TABLE IF NOT EXISTS terminal_read_guards (
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  transport_id TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  pane_id TEXT NOT NULL,
+  read_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, transport_id, actor_id, pane_id)
+);
+
 CREATE TABLE IF NOT EXISTS search_documents (
   id TEXT PRIMARY KEY,
   project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
@@ -136,6 +145,7 @@ CREATE INDEX IF NOT EXISTS idx_scopes_project_expiry ON scope_claims(project_id,
 CREATE INDEX IF NOT EXISTS idx_events_project_created ON events(project_id, created_at);
 CREATE INDEX IF NOT EXISTS idx_decisions_project_status ON decisions(project_id, status, created_at);
 CREATE INDEX IF NOT EXISTS idx_handoffs_project_created ON handoffs(project_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_terminal_guards_read_at ON terminal_read_guards(project_id, read_at);
 `;
 
 export interface DatabaseHandle {
diff --git a/src/index.ts b/src/index.ts
index 58011ed..ed19193 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,5 +1,6 @@
 export { createMcpServer, serveStdio } from "./mcp.js";
 export { ProjectStore, scopePatternsMayOverlap } from "./store.js";
+export { TerminalService, TerminalTransport } from "./terminal.js";
 export {
   captureGitSnapshot,
   resolveRepositoryRoot,
@@ -8,4 +9,6 @@ export {
   tryResolveRepositoryRoot,
 } from "./git.js";
 export { filterSafePaths, isSensitivePath, redactSecrets, redactStructured } from "./security.js";
+export { AGENTRELAY_VERSION } from "./version.js";
+export type * from "./terminal.js";
 export type * from "./types.js";
diff --git a/src/mcp.ts b/src/mcp.ts
index 2a05c34..45f7d4b 100644
--- a/src/mcp.ts
+++ b/src/mcp.ts
@@ -1,8 +1,11 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import * as z from "zod/v4";
+import { redactSecrets } from "./security.js";
 import { ProjectStore } from "./store.js";
+import { TerminalService, TerminalTransport } from "./terminal.js";
 import type { AgentType, EventType, SearchResult } from "./types.js";
+import { AGENTRELAY_VERSION } from "./version.js";
 
 const agentTypes = ["codex", "claude-code", "gemini-cli", "cursor", "cline", "other"] as const;
 const eventTypes = [
@@ -23,6 +26,7 @@ export const AGENTRELAY_INSTRUCTIONS = [
   "Before editing, call claim_task and claim_scope and stop on relevant conflicts.",
   "Record durable decisions with record_decision and tests, results, failures, discoveries, and blockers with record_event.",
   "Before ending or handing off, call create_handoff.",
+  "For live tmux coordination, call terminal_list, then terminal_read on the target pane, then terminal_send. Only target trusted panes in the configured tmux session.",
   "Never store credentials, tokens, raw .env values, cookies, or private keys.",
 ].join(" ");
 
@@ -33,14 +37,14 @@ function response(value: unknown) {
 }
 
 function failure(error: unknown) {
-  const message = error instanceof Error ? error.message : String(error);
+  const message = redactSecrets(error instanceof Error ? error.message : String(error));
   return {
     isError: true,
     content: [{ type: "text" as const, text: message }],
   };
 }
 
-function registerTools(server: McpServer, store: ProjectStore): void {
+function registerTools(server: McpServer, store: ProjectStore, terminal: TerminalService): void {
   server.registerTool(
     "project_init",
     {
@@ -322,14 +326,121 @@ function registerTools(server: McpServer, store: ProjectStore): void {
       }
     },
   );
+
+  server.registerTool(
+    "terminal_list",
+    {
+      title: "List panes in the allowed tmux session",
+      description: "List only the panes in AgentRelay's current or explicitly configured tmux session.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    async () => {
+      try {
+        return response(await terminal.list());
+      } catch (error) {
+        return failure(error);
+      }
+    },
+  );
+
+  server.registerTool(
+    "terminal_read",
+    {
+      title: "Read a tmux pane",
+      description: "Read redacted, size-limited output from a pane and open a 90-second guard for one terminal_send.",
+      inputSchema: {
+        target: z.string().min(1).max(500),
+        lines: z.number().int().min(1).max(200).default(50),
+        session_id: z.string().uuid().optional(),
+        task_id: z.string().uuid().optional(),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+    },
+    async ({ target, lines, session_id, task_id }) => {
+      try {
+        return response(await terminal.read(target, lines, {
+          ...(session_id ? { sessionId: session_id } : {}),
+          ...(task_id ? { taskId: task_id } : {}),
+        }));
+      } catch (error) {
+        return failure(error);
+      }
+    },
+  );
+
+  server.registerTool(
+    "terminal_send",
+    {
+      title: "Send a message to a tmux pane",
+      description: "Send one literal single-line message and Enter to a trusted pane after terminal_read. No arbitrary key tool is exposed.",
+      inputSchema: {
+        target: z.string().min(1).max(500),
+        message: z.string().min(1).max(8_192),
+        session_id: z.string().uuid().optional(),
+        task_id: z.string().uuid().optional(),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false },
+    },
+    async ({ target, message, session_id, task_id }) => {
+      try {
+        return response(await terminal.send(target, message, {
+          ...(session_id ? { sessionId: session_id } : {}),
+          ...(task_id ? { taskId: task_id } : {}),
+        }));
+      } catch (error) {
+        return failure(error);
+      }
+    },
+  );
+
+  server.registerTool(
+    "terminal_name",
+    {
+      title: "Name a tmux pane",
+      description: "Assign an AgentRelay-specific label to a pane in the allowed tmux session.",
+      inputSchema: {
+        target: z.string().min(1).max(500),
+        label: z.string().min(1).max(64),
+        session_id: z.string().uuid().optional(),
+        task_id: z.string().uuid().optional(),
+      },
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true },
+    },
+    async ({ target, label, session_id, task_id }) => {
+      try {
+        return response(await terminal.name(target, label, {
+          ...(session_id ? { sessionId: session_id } : {}),
+          ...(task_id ? { taskId: task_id } : {}),
+        }));
+      } catch (error) {
+        return failure(error);
+      }
+    },
+  );
+
+  server.registerTool(
+    "terminal_doctor",
+    {
+      title: "Diagnose AgentRelay tmux access",
+      description: "Check the tmux binary, socket inheritance, session boundary, pane identity, and safety limits.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true },
+    },
+    async () => response(await terminal.doctor()),
+  );
+}
+
+export interface McpServerOptions {
+  terminalTransport?: TerminalTransport;
 }
 
-export function createMcpServer(store: ProjectStore): McpServer {
+export function createMcpServer(store: ProjectStore, options: McpServerOptions = {}): McpServer {
   const server = new McpServer(
-    { name: "agentrelay", version: "0.3.1" },
+    { name: "agentrelay", version: AGENTRELAY_VERSION },
     { instructions: AGENTRELAY_INSTRUCTIONS },
   );
-  registerTools(server, store);
+  registerTools(server, store, new TerminalService(store, options.terminalTransport));
   return server;
 }
 
diff --git a/src/security.ts b/src/security.ts
index 3370f9d..63f3b22 100644
--- a/src/security.ts
+++ b/src/security.ts
@@ -8,6 +8,8 @@ const SENSITIVE_PATH_PATTERNS = [
 ];
 
 const SECRET_PATTERNS: Array<[RegExp, string]> = [
+  [/(-----BEGIN [^-\r\n]*PRIVATE KEY-----)[\s\S]*?(-----END [^-\r\n]*PRIVATE KEY-----)/g, "$1\n[REDACTED_PRIVATE_KEY]\n$2"],
+  [/(\b[a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)[^@\s/]+(@)/gi, "$1[REDACTED]$2"],
   [/(\b(?:(?:[a-z0-9]+[_-])?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|client[_-]?secret)|password|passwd|cookie)\b\s*[:=]\s*)[^\s,;]+/gi, "$1[REDACTED]"],
   [/(\bAuthorization\s*:\s*Bearer\s+)[A-Za-z0-9._~+\/-]+=*/gi, "$1[REDACTED]"],
   [/\b(?:sk|pk|ghp|github_pat)_[A-Za-z0-9_\-]{16,}\b/g, "[REDACTED_TOKEN]"],
diff --git a/src/store.ts b/src/store.ts
index b3c009f..f182d48 100644
--- a/src/store.ts
+++ b/src/store.ts
@@ -119,6 +119,9 @@ const VALID_EVENT_TYPES = new Set<EventType>([
   "task_claimed",
   "scope_claimed",
   "handoff_created",
+  "terminal_read",
+  "terminal_send",
+  "terminal_named",
   "attempt",
   "result",
   "issue",
@@ -220,6 +223,14 @@ function truncate(value: string, maxChars: number): string {
   return `${value.slice(0, Math.max(0, maxChars - 24))}\n…[context truncated]`;
 }
 
+function terminalAuditValue(value: string, label: string): string {
+  const normalized = redactSecrets(value.trim());
+  if (!normalized || normalized.length > 500 || /[\u0000-\u001f\u007f]/u.test(normalized)) {
+    throw new Error(`${label} must be non-empty text without control characters.`);
+  }
+  return normalized;
+}
+
 function workspaceChangedFiles(workspaceRoot: string, snapshot: GitSnapshot): string[] {
   if (!snapshot.repositoryRoot) return [];
   const prefix = path.relative(workspaceRoot, snapshot.repositoryRoot).replaceAll(path.sep, "/");
@@ -321,6 +332,9 @@ export class ProjectStore {
       security: {
         workspaceBoundary: this.rootPath,
         arbitraryShellCommands: false,
+        terminalSendCanTriggerTargetProcess: true,
+        terminalAccessRequiresTrustedTmuxSession: true,
+        terminalMessageContentPersisted: false,
         secretRedaction: true,
       },
     };
@@ -627,6 +641,182 @@ export class ProjectStore {
     return { id, eventType: input.eventType, summary, content, files, evidence, createdAt: timestamp };
   }
 
+  recordTerminalRead(input: {
+    transportId: string;
+    actorId: string;
+    paneId: string;
+    paneTarget: string;
+    tmuxSession: string;
+    requestedLines: number;
+    outputBytes: number;
+    truncated: boolean;
+    sessionId?: string;
+    taskId?: string;
+    guardSeconds: number;
+  }): { eventId: string; expiresAt: string } {
+    if (!Number.isInteger(input.guardSeconds) || input.guardSeconds < 1 || input.guardSeconds > 600) {
+      throw new Error("Terminal read guard must be between 1 and 600 seconds.");
+    }
+    if (input.sessionId) this.requireSession(input.sessionId);
+    if (input.taskId) this.requireTask(input.taskId);
+    if (!Number.isInteger(input.requestedLines) || input.requestedLines < 1 || input.requestedLines > 200) {
+      throw new Error("Terminal requested lines must be an integer from 1 to 200.");
+    }
+    if (!Number.isInteger(input.outputBytes) || input.outputBytes < 0 || input.outputBytes > 64 * 1024) {
+      throw new Error("Terminal output byte count is outside the supported range.");
+    }
+    const transportId = terminalAuditValue(input.transportId, "Terminal transport id");
+    const actorId = terminalAuditValue(input.actorId, "Terminal actor id");
+    const paneId = terminalAuditValue(input.paneId, "Terminal pane id");
+    const paneTarget = terminalAuditValue(input.paneTarget, "Terminal pane target");
+    const tmuxSession = terminalAuditValue(input.tmuxSession, "tmux session");
+    const timestamp = now();
+    this.db
+      .prepare(
+        `INSERT INTO terminal_read_guards
+         (project_id, transport_id, actor_id, pane_id, read_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(project_id, transport_id, actor_id, pane_id)
+         DO UPDATE SET read_at = excluded.read_at`,
+      )
+      .run(
+        this.project.id,
+        transportId,
+        actorId,
+        paneId,
+        timestamp,
+      );
+    const event = this.recordEvent({
+      ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+      ...(input.taskId ? { taskId: input.taskId } : {}),
+      eventType: "terminal_read",
+      summary: `Terminal read: ${paneId}`,
+      content: `Read ${input.requestedLines} line(s) from ${paneTarget} in tmux session ${tmuxSession}. Captured terminal content was not persisted.`,
+      metadata: {
+        transportId,
+        actorId,
+        paneId,
+        requestedLines: input.requestedLines,
+        outputBytes: input.outputBytes,
+        truncated: input.truncated,
+      },
+    }) as { id: string };
+    return {
+      eventId: event.id,
+      expiresAt: new Date(Date.parse(timestamp) + input.guardSeconds * 1_000).toISOString(),
+    };
+  }
+
+  validateTerminalAuditContext(input: { sessionId?: string; taskId?: string }): void {
+    if (input.sessionId) this.requireSession(input.sessionId);
+    if (input.taskId) this.requireTask(input.taskId);
+  }
+
+  consumeTerminalReadGuard(input: {
+    transportId: string;
+    actorId: string;
+    paneId: string;
+    guardSeconds: number;
+  }): void {
+    if (!Number.isInteger(input.guardSeconds) || input.guardSeconds < 1 || input.guardSeconds > 600) {
+      throw new Error("Terminal read guard must be between 1 and 600 seconds.");
+    }
+    const transportId = terminalAuditValue(input.transportId, "Terminal transport id");
+    const actorId = terminalAuditValue(input.actorId, "Terminal actor id");
+    const paneId = terminalAuditValue(input.paneId, "Terminal pane id");
+    const cutoff = new Date(Date.now() - input.guardSeconds * 1_000).toISOString();
+    const transaction = this.db.transaction(() => {
+      const row = this.db
+        .prepare(
+          `SELECT read_at FROM terminal_read_guards
+           WHERE project_id = ? AND transport_id = ? AND actor_id = ? AND pane_id = ?`,
+        )
+        .get(
+          this.project.id,
+          transportId,
+          actorId,
+          paneId,
+        ) as { read_at: string } | undefined;
+      this.db
+        .prepare(
+          `DELETE FROM terminal_read_guards
+           WHERE project_id = ? AND transport_id = ? AND actor_id = ? AND pane_id = ?`,
+        )
+        .run(
+          this.project.id,
+          transportId,
+          actorId,
+          paneId,
+        );
+      if (!row || row.read_at < cutoff) {
+        throw new Error(
+          `Read pane ${paneId} before sending; the terminal read guard is missing or expired.`,
+        );
+      }
+    });
+    transaction();
+  }
+
+  recordTerminalSend(input: {
+    transportId: string;
+    actorId: string;
+    paneId: string;
+    paneTarget: string;
+    tmuxSession: string;
+    correlationId: string;
+    messageBytes: number;
+    sessionId?: string;
+    taskId?: string;
+  }): { eventId: string } {
+    if (!Number.isInteger(input.messageBytes) || input.messageBytes < 1 || input.messageBytes > 8 * 1024) {
+      throw new Error("Terminal message byte count is outside the supported range.");
+    }
+    const transportId = terminalAuditValue(input.transportId, "Terminal transport id");
+    const actorId = terminalAuditValue(input.actorId, "Terminal actor id");
+    const paneId = terminalAuditValue(input.paneId, "Terminal pane id");
+    const paneTarget = terminalAuditValue(input.paneTarget, "Terminal pane target");
+    const tmuxSession = terminalAuditValue(input.tmuxSession, "tmux session");
+    const correlationId = terminalAuditValue(input.correlationId, "Terminal correlation id");
+    const event = this.recordEvent({
+      ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+      ...(input.taskId ? { taskId: input.taskId } : {}),
+      eventType: "terminal_send",
+      summary: `Terminal message sent: ${paneId}`,
+      content: `Sent a ${input.messageBytes}-byte message to ${paneTarget} in tmux session ${tmuxSession}. Message content was not persisted.`,
+      metadata: {
+        transportId,
+        actorId,
+        paneId,
+        correlationId,
+        messageBytes: input.messageBytes,
+      },
+    }) as { id: string };
+    return { eventId: event.id };
+  }
+
+  recordTerminalName(input: {
+    paneId: string;
+    paneTarget: string;
+    tmuxSession: string;
+    label: string;
+    sessionId?: string;
+    taskId?: string;
+  }): { eventId: string } {
+    const paneId = terminalAuditValue(input.paneId, "Terminal pane id");
+    const paneTarget = terminalAuditValue(input.paneTarget, "Terminal pane target");
+    const tmuxSession = terminalAuditValue(input.tmuxSession, "tmux session");
+    const label = terminalAuditValue(input.label, "Terminal pane label");
+    const event = this.recordEvent({
+      ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+      ...(input.taskId ? { taskId: input.taskId } : {}),
+      eventType: "terminal_named",
+      summary: `Terminal pane named: ${label}`,
+      content: `Named ${paneTarget} (${paneId}) in tmux session ${tmuxSession}.`,
+      metadata: { paneId, label },
+    }) as { id: string };
+    return { eventId: event.id };
+  }
+
   recordDecision(input: {
     sessionId?: string;
     taskId?: string;
diff --git a/src/terminal.ts b/src/terminal.ts
new file mode 100644
index 0000000..95c72cd
--- /dev/null
+++ b/src/terminal.ts
@@ -0,0 +1,537 @@
+/**
+ * Built-in tmux transport for AgentRelay.
+ *
+ * This module adapts the public behavior and selected implementation ideas of
+ * tmux-bridge-mcp by Howard Peng. See THIRD_PARTY_NOTICES.md and
+ * LICENSES/tmux-bridge-mcp-MIT.txt for attribution and license terms.
+ */
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import os from "node:os";
+import { promisify } from "node:util";
+import { redactSecrets } from "./security.js";
+import { ProjectStore } from "./store.js";
+
+const execFileAsync = promisify(execFile);
+const FIELD_SEPARATOR = "::AGENTRELAY_FIELD::";
+const DEFAULT_READ_LINES = 50;
+const MAX_READ_LINES = 200;
+const MAX_OUTPUT_BYTES = 64 * 1024;
+const MAX_TMUX_BUFFER_BYTES = 512 * 1024;
+const MAX_MESSAGE_BYTES = 8 * 1024;
+const READ_GUARD_SECONDS = 90;
+const TMUX_TIMEOUT_MS = 10_000;
+
+export interface TerminalPane {
+  id: string;
+  target: string;
+  session: string;
+  windowIndex: number;
+  paneIndex: number;
+  process: string;
+  label: string | null;
+  workingDirectory: string;
+  active: boolean;
+}
+
+export interface TerminalScope {
+  id: string;
+  session: string;
+  actorId: string;
+}
+
+export interface TerminalReadResult {
+  scope: TerminalScope;
+  pane: TerminalPane;
+  requestedLines: number;
+  output: string;
+  outputBytes: number;
+  truncated: boolean;
+}
+
+export interface TerminalSendResult {
+  scope: TerminalScope;
+  pane: TerminalPane;
+  correlationId: string;
+  messageBytes: number;
+  submitted: true;
+}
+
+export interface TerminalDoctorResult {
+  available: boolean;
+  version: string | null;
+  currentPane: string | null;
+  session: string | null;
+  sessionSource: "configured" | "current-pane" | "unavailable";
+  socketSource: "configured" | "inherited" | "default";
+  limits: {
+    maxReadLines: number;
+    maxOutputBytes: number;
+    maxMessageBytes: number;
+    readGuardSeconds: number;
+  };
+  problems: string[];
+}
+
+export interface TerminalTransportOptions {
+  tmuxPath?: string;
+  socketPath?: string;
+  sessionName?: string;
+  currentPane?: string;
+  environment?: NodeJS.ProcessEnv;
+}
+
+export interface TerminalAuditContext {
+  sessionId?: string;
+  taskId?: string;
+}
+
+function ensureSafeArgument(value: string, label: string): string {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 500 || /[\u0000-\u001f\u007f]/u.test(trimmed)) {
+    throw new Error(`${label} must be non-empty text without control characters.`);
+  }
+  return trimmed;
+}
+
+function ensureLabel(value: string): string {
+  const label = ensureSafeArgument(value, "Pane label");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(label)) {
+    throw new Error("Pane labels must use 1-64 letters, numbers, dots, underscores, or hyphens.");
+  }
+  return label;
+}
+
+function ensureMessage(value: string): string {
+  const message = value.trim();
+  if (!message) throw new Error("Terminal messages cannot be empty.");
+  if (/[\u0000-\u001f\u007f]/u.test(message)) {
+    throw new Error("Terminal messages must be a single line without control characters.");
+  }
+  if (Buffer.byteLength(message, "utf8") > MAX_MESSAGE_BYTES) {
+    throw new Error(`Terminal messages cannot exceed ${MAX_MESSAGE_BYTES} UTF-8 bytes.`);
+  }
+  return message;
+}
+
+function compactError(error: unknown): string {
+  if (!(error instanceof Error)) return redactSecrets(String(error));
+  const withStderr = error as Error & { stderr?: string | Buffer };
+  const stderr = typeof withStderr.stderr === "string"
+    ? withStderr.stderr
+    : Buffer.isBuffer(withStderr.stderr)
+      ? withStderr.stderr.toString("utf8")
+      : "";
+  return redactSecrets((stderr.trim() || error.message).slice(0, 2_000));
+}
+
+function truncateUtf8(value: string, maxBytes: number): { value: string; bytes: number; truncated: boolean } {
+  const buffer = Buffer.from(value, "utf8");
+  if (buffer.byteLength <= maxBytes) {
+    return { value, bytes: buffer.byteLength, truncated: false };
+  }
+  const marker = "[older terminal output truncated]\n";
+  const suffixBytes = Math.max(0, maxBytes - Buffer.byteLength(marker, "utf8"));
+  const suffix = buffer.subarray(buffer.byteLength - suffixBytes).toString("utf8").replace(/^\uFFFD/u, "");
+  const truncatedValue = `${marker}${suffix}`;
+  return {
+    value: truncatedValue,
+    bytes: Buffer.byteLength(truncatedValue, "utf8"),
+    truncated: true,
+  };
+}
+
+function hideHome(value: string, environment: NodeJS.ProcessEnv): string {
+  const home = environment.HOME || os.homedir();
+  if (!home) return value;
+  return value === home ? "~" : value.startsWith(`${home}/`) ? `~${value.slice(home.length)}` : value;
+}
+
+export class TerminalTransport {
+  private readonly tmuxPath: string;
+  private readonly socketPath: string | null;
+  private readonly configuredSession: string | null;
+  private readonly currentPane: string | null;
+  private readonly environment: NodeJS.ProcessEnv;
+  private readonly socketSource: "configured" | "inherited" | "default";
+  private resolvedSession: string | null = null;
+  private resolvedSessionTarget: string | null = null;
+
+  constructor(options: TerminalTransportOptions = {}) {
+    this.environment = options.environment ?? process.env;
+    this.tmuxPath = options.tmuxPath ?? "tmux";
+    const inheritedSocket = this.environment.TMUX?.split(",", 1)[0]?.trim() || null;
+    const configuredSocket = options.socketPath?.trim()
+      || this.environment.AGENTRELAY_TMUX_SOCKET?.trim()
+      || null;
+    this.socketPath = configuredSocket || inheritedSocket;
+    this.socketSource = configuredSocket ? "configured" : inheritedSocket ? "inherited" : "default";
+    this.configuredSession = options.sessionName?.trim()
+      || this.environment.AGENTRELAY_TMUX_SESSION?.trim()
+      || null;
+    this.currentPane = options.currentPane?.trim()
+      || this.environment.TMUX_PANE?.trim()
+      || null;
+  }
+
+  private socketArgs(): string[] {
+    return this.socketPath ? ["-S", this.socketPath] : [];
+  }
+
+  private async run(args: string[], includeSocket = true): Promise<string> {
+    try {
+      const result = await execFileAsync(
+        this.tmuxPath,
+        [...(includeSocket ? this.socketArgs() : []), ...args],
+        {
+          encoding: "utf8",
+          timeout: TMUX_TIMEOUT_MS,
+          maxBuffer: MAX_TMUX_BUFFER_BYTES,
+          env: this.environment,
+        },
+      );
+      return result.stdout;
+    } catch (error) {
+      throw new Error(`tmux failed: ${compactError(error)}`);
+    }
+  }
+
+  private async allowedSession(): Promise<string> {
+    if (this.resolvedSession) return this.resolvedSession;
+    if (this.configuredSession) {
+      this.resolvedSession = ensureSafeArgument(this.configuredSession, "tmux session");
+      return this.resolvedSession;
+    }
+    if (!this.currentPane) {
+      throw new Error(
+        "No tmux session is configured. Run AgentRelay inside tmux or set AGENTRELAY_TMUX_SESSION.",
+      );
+    }
+    const session = (await this.run([
+      "display-message",
+      "-t",
+      ensureSafeArgument(this.currentPane, "Current tmux pane"),
+      "-p",
+      "#{session_name}",
+    ])).trim();
+    this.resolvedSession = ensureSafeArgument(session, "tmux session");
+    return this.resolvedSession;
+  }
+
+  private parsePane(line: string): TerminalPane {
+    const [id, session, windowIndex, paneIndex, processName, label, workingDirectory, active] =
+      line.split(FIELD_SEPARATOR);
+    if (!id || !session || windowIndex === undefined || paneIndex === undefined) {
+      throw new Error("tmux returned an incomplete pane record.");
+    }
+    return {
+      id,
+      target: `${session}:${windowIndex}.${paneIndex}`,
+      session,
+      windowIndex: Number(windowIndex),
+      paneIndex: Number(paneIndex),
+      process: redactSecrets(processName || "unknown"),
+      label: label ? redactSecrets(label) : null,
+      workingDirectory: redactSecrets(hideHome(workingDirectory || "", this.environment)),
+      active: active === "1",
+    };
+  }
+
+  private paneFormat(): string {
+    return [
+      "#{pane_id}",
+      "#{session_name}",
+      "#{window_index}",
+      "#{pane_index}",
+      "#{pane_current_command}",
+      "#{@agentrelay_name}",
+      "#{pane_current_path}",
+      "#{pane_active}",
+    ].join(FIELD_SEPARATOR);
+  }
+
+  private async allowedSessionTarget(): Promise<string> {
+    if (this.resolvedSessionTarget) return this.resolvedSessionTarget;
+    const session = await this.allowedSession();
+    const output = await this.run([
+      "list-sessions",
+      "-F",
+      ["#{session_id}", "#{session_name}"].join(FIELD_SEPARATOR),
+    ]);
+    const matches = output
+      .trim()
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => line.split(FIELD_SEPARATOR))
+      .filter(([, name]) => name === session);
+    if (matches.length === 0 || !matches[0]?.[0]) {
+      throw new Error(`The allowed tmux session '${session}' does not exist.`);
+    }
+    if (matches.length > 1) {
+      throw new Error(`More than one tmux session resolved to '${session}'.`);
+    }
+    this.resolvedSessionTarget = `${matches[0][0]}:`;
+    return this.resolvedSessionTarget;
+  }
+
+  private async directPane(target: string): Promise<TerminalPane> {
+    const output = await this.run([
+      "display-message",
+      "-t",
+      ensureSafeArgument(target, "Pane target"),
+      "-p",
+      this.paneFormat(),
+    ]);
+    const pane = this.parsePane(output.trim());
+    const session = await this.allowedSession();
+    if (pane.session !== session) {
+      throw new Error(`Pane ${pane.id} is outside the allowed tmux session '${session}'.`);
+    }
+    return pane;
+  }
+
+  async scope(): Promise<TerminalScope> {
+    const session = await this.allowedSession();
+    const socketIdentity = this.socketPath || "default";
+    const id = createHash("sha256")
+      .update(`${socketIdentity}\u0000${session}`)
+      .digest("hex")
+      .slice(0, 24);
+    return {
+      id,
+      session,
+      actorId: this.currentPane || "external",
+    };
+  }
+
+  async list(): Promise<TerminalPane[]> {
+    const output = await this.run([
+      "list-panes",
+      "-t",
+      await this.allowedSessionTarget(),
+      "-F",
+      this.paneFormat(),
+    ]);
+    return output
+      .trim()
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => this.parsePane(line));
+  }
+
+  async resolvePane(target: string): Promise<TerminalPane> {
+    const safeTarget = ensureSafeArgument(target, "Pane target");
+    if (
+      /^%\d+$/u.test(safeTarget)
+      || /^\d+(?:\.\d+)?$/u.test(safeTarget)
+      || safeTarget.includes(":")
+    ) {
+      return this.directPane(safeTarget);
+    }
+    const label = ensureLabel(safeTarget);
+    const matches = (await this.list()).filter((pane) => pane.label === label);
+    if (matches.length === 0) throw new Error(`No pane has the AgentRelay label '${label}'.`);
+    if (matches.length > 1) throw new Error(`More than one pane has the AgentRelay label '${label}'.`);
+    return matches[0]!;
+  }
+
+  async read(target: string, lines = DEFAULT_READ_LINES): Promise<TerminalReadResult> {
+    if (!Number.isInteger(lines) || lines < 1 || lines > MAX_READ_LINES) {
+      throw new Error(`Terminal read lines must be an integer from 1 to ${MAX_READ_LINES}.`);
+    }
+    const pane = await this.resolvePane(target);
+    const raw = await this.run([
+      "capture-pane",
+      "-t",
+      pane.id,
+      "-p",
+      "-J",
+      "-S",
+      `-${lines}`,
+    ]);
+    const redacted = redactSecrets(raw.replace(/\s+$/u, ""));
+    const bounded = truncateUtf8(redacted, MAX_OUTPUT_BYTES);
+    return {
+      scope: await this.scope(),
+      pane,
+      requestedLines: lines,
+      output: bounded.value,
+      outputBytes: bounded.bytes,
+      truncated: bounded.truncated,
+    };
+  }
+
+  async sendResolved(pane: TerminalPane, messageInput: string): Promise<TerminalSendResult> {
+    const paneNow = await this.directPane(pane.id);
+    const scope = await this.scope();
+    if (this.currentPane && paneNow.id === this.currentPane) {
+      throw new Error("AgentRelay will not send a terminal message to its own pane.");
+    }
+    const message = ensureMessage(messageInput);
+    let sender = scope.actorId;
+    if (this.currentPane) {
+      try {
+        const label = (await this.run([
+          "display-message",
+          "-t",
+          this.currentPane,
+          "-p",
+          "#{@agentrelay_name}",
+        ])).trim();
+        if (label) sender = label;
+      } catch {
+        // Sender labeling is optional; the pane id remains a stable fallback.
+      }
+    }
+    sender = sender.replace(/[^A-Za-z0-9%._-]/gu, "_").slice(0, 64) || "external";
+    const correlationId = randomUUID().slice(0, 12);
+    const payload = `[AgentRelay from:${sender} id:${correlationId}] ${message}`;
+    await this.run(["send-keys", "-t", paneNow.id, "-l", "--", payload]);
+    await this.run(["send-keys", "-t", paneNow.id, "Enter"]);
+    return {
+      scope,
+      pane: paneNow,
+      correlationId,
+      messageBytes: Buffer.byteLength(message, "utf8"),
+      submitted: true,
+    };
+  }
+
+  async name(target: string, labelInput: string): Promise<{ scope: TerminalScope; pane: TerminalPane; label: string }> {
+    const pane = await this.resolvePane(target);
+    const label = ensureLabel(labelInput);
+    await this.run(["set-option", "-p", "-t", pane.id, "@agentrelay_name", label]);
+    return { scope: await this.scope(), pane: { ...pane, label }, label };
+  }
+
+  async doctor(): Promise<TerminalDoctorResult> {
+    const problems: string[] = [];
+    let version: string | null = null;
+    let session: string | null = null;
+    try {
+      version = (await this.run(["-V"], false)).trim() || null;
+    } catch (error) {
+      problems.push(compactError(error));
+    }
+    if (version) {
+      try {
+        session = await this.allowedSession();
+        await this.allowedSessionTarget();
+      } catch (error) {
+        problems.push(compactError(error));
+      }
+    }
+    return {
+      available: Boolean(version && session && problems.length === 0),
+      version,
+      currentPane: this.currentPane,
+      session,
+      sessionSource: this.configuredSession
+        ? "configured"
+        : this.currentPane
+          ? "current-pane"
+          : "unavailable",
+      socketSource: this.socketSource,
+      limits: {
+        maxReadLines: MAX_READ_LINES,
+        maxOutputBytes: MAX_OUTPUT_BYTES,
+        maxMessageBytes: MAX_MESSAGE_BYTES,
+        readGuardSeconds: READ_GUARD_SECONDS,
+      },
+      problems,
+    };
+  }
+}
+
+export class TerminalService {
+  constructor(
+    private readonly store: ProjectStore,
+    private readonly transport = new TerminalTransport(),
+  ) {}
+
+  async list(): Promise<{ scope: TerminalScope; panes: TerminalPane[] }> {
+    return { scope: await this.transport.scope(), panes: await this.transport.list() };
+  }
+
+  async read(
+    target: string,
+    lines = DEFAULT_READ_LINES,
+    context: TerminalAuditContext = {},
+  ): Promise<TerminalReadResult & { auditEventId: string; readGuardExpiresAt: string }> {
+    this.store.validateTerminalAuditContext(context);
+    const result = await this.transport.read(target, lines);
+    const audit = this.store.recordTerminalRead({
+      transportId: result.scope.id,
+      actorId: result.scope.actorId,
+      paneId: result.pane.id,
+      paneTarget: result.pane.target,
+      tmuxSession: result.scope.session,
+      requestedLines: result.requestedLines,
+      outputBytes: result.outputBytes,
+      truncated: result.truncated,
+      ...(context.sessionId ? { sessionId: context.sessionId } : {}),
+      ...(context.taskId ? { taskId: context.taskId } : {}),
+      guardSeconds: READ_GUARD_SECONDS,
+    });
+    return {
+      ...result,
+      auditEventId: audit.eventId,
+      readGuardExpiresAt: audit.expiresAt,
+    };
+  }
+
+  async send(
+    target: string,
+    message: string,
+    context: TerminalAuditContext = {},
+  ): Promise<TerminalSendResult & { auditEventId: string }> {
+    this.store.validateTerminalAuditContext(context);
+    const messageInput = ensureMessage(message);
+    const pane = await this.transport.resolvePane(target);
+    const scope = await this.transport.scope();
+    if (scope.actorId === pane.id) {
+      throw new Error("AgentRelay will not send a terminal message to its own pane.");
+    }
+    this.store.consumeTerminalReadGuard({
+      transportId: scope.id,
+      actorId: scope.actorId,
+      paneId: pane.id,
+      guardSeconds: READ_GUARD_SECONDS,
+    });
+    const result = await this.transport.sendResolved(pane, messageInput);
+    const audit = this.store.recordTerminalSend({
+      transportId: result.scope.id,
+      actorId: result.scope.actorId,
+      paneId: result.pane.id,
+      paneTarget: result.pane.target,
+      tmuxSession: result.scope.session,
+      correlationId: result.correlationId,
+      messageBytes: result.messageBytes,
+      ...(context.sessionId ? { sessionId: context.sessionId } : {}),
+      ...(context.taskId ? { taskId: context.taskId } : {}),
+    });
+    return { ...result, auditEventId: audit.eventId };
+  }
+
+  async name(
+    target: string,
+    label: string,
+    context: TerminalAuditContext = {},
+  ): Promise<{ scope: TerminalScope; pane: TerminalPane; label: string; auditEventId: string }> {
+    this.store.validateTerminalAuditContext(context);
+    const result = await this.transport.name(target, label);
+    const audit = this.store.recordTerminalName({
+      paneId: result.pane.id,
+      paneTarget: result.pane.target,
+      tmuxSession: result.scope.session,
+      label: result.label,
+      ...(context.sessionId ? { sessionId: context.sessionId } : {}),
+      ...(context.taskId ? { taskId: context.taskId } : {}),
+    });
+    return { ...result, auditEventId: audit.eventId };
+  }
+
+  doctor(): Promise<TerminalDoctorResult> {
+    return this.transport.doctor();
+  }
+}
diff --git a/src/types.ts b/src/types.ts
index 1700242..24d385b 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -12,6 +12,9 @@ export type EventType =
   | "task_claimed"
   | "scope_claimed"
   | "handoff_created"
+  | "terminal_read"
+  | "terminal_send"
+  | "terminal_named"
   | "attempt"
   | "result"
   | "issue"
diff --git a/src/version.ts b/src/version.ts
new file mode 100644
index 0000000..b9eb84b
--- /dev/null
+++ b/src/version.ts
@@ -0,0 +1 @@
+export const AGENTRELAY_VERSION = "0.4.0";
diff --git a/tests/mcp.test.ts b/tests/mcp.test.ts
index 5b7275f..e6c58f8 100644
--- a/tests/mcp.test.ts
+++ b/tests/mcp.test.ts
@@ -19,7 +19,7 @@ describe("MCP surface", () => {
     removeTestRepository(root);
   });
 
-  it("advertises the ten coordination tools and accepts a join call", async () => {
+  it("advertises coordination and terminal tools and accepts a join call", async () => {
     const server = createMcpServer(store);
     const client = new Client({ name: "agentrelay-test-client", version: "1.0.0" });
     const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
@@ -41,6 +41,11 @@ describe("MCP surface", () => {
       "record_decision",
       "record_event",
       "search_memory",
+      "terminal_doctor",
+      "terminal_list",
+      "terminal_name",
+      "terminal_read",
+      "terminal_send",
     ]);
 
     const result = await client.callTool({
@@ -54,6 +59,10 @@ describe("MCP surface", () => {
     expect(result.isError).not.toBe(true);
     expect(JSON.stringify(result.content)).toContain("codex-test");
 
+    const doctor = await client.callTool({ name: "terminal_doctor", arguments: {} });
+    expect(doctor.isError).not.toBe(true);
+    expect(JSON.stringify(doctor.content)).toContain("readGuardSeconds");
+
     await client.close();
     await server.close();
   });
diff --git a/tests/security.test.ts b/tests/security.test.ts
index 1008524..2d0dcd3 100644
--- a/tests/security.test.ts
+++ b/tests/security.test.ts
@@ -20,6 +20,18 @@ describe("security boundaries", () => {
     expect(value).toContain("[REDACTED]");
   });
 
+  it("redacts private keys and credentials embedded in URLs", () => {
+    const value = redactSecrets([
+      "postgres://agent:database-password@example.invalid/app",
+      "-----BEGIN PRIVATE KEY-----",
+      "private-key-material",
+      "-----END PRIVATE KEY-----",
+    ].join("\n"));
+    expect(value).not.toContain("database-password");
+    expect(value).not.toContain("private-key-material");
+    expect(value).toContain("[REDACTED_PRIVATE_KEY]");
+  });
+
   it("blocks traversal, absolute paths, and credential files", () => {
     expect(() => assertSafeRelativePattern("../outside.ts")).toThrow(/escape/);
     expect(() => assertSafeRelativePattern("/tmp/file")).toThrow(/repository-relative/);
diff --git a/tests/terminal-store.test.ts b/tests/terminal-store.test.ts
new file mode 100644
index 0000000..c249131
--- /dev/null
+++ b/tests/terminal-store.test.ts
@@ -0,0 +1,83 @@
+import fs from "node:fs";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { ProjectStore } from "../src/store.js";
+import { createTestRepository, removeTestRepository } from "./helpers.js";
+
+describe("terminal audit and read guards", () => {
+  let root: string;
+  let store: ProjectStore;
+
+  beforeEach(() => {
+    root = createTestRepository();
+    store = new ProjectStore(root);
+  });
+
+  afterEach(() => {
+    store.close();
+    removeTestRepository(root);
+  });
+
+  it("allows one send after a recent read and records metadata without message content", () => {
+    const read = store.recordTerminalRead({
+      transportId: "transport-a",
+      actorId: "%1",
+      paneId: "%2",
+      paneTarget: "agents:0.1",
+      tmuxSession: "agents",
+      requestedLines: 40,
+      outputBytes: 120,
+      truncated: false,
+      guardSeconds: 90,
+    });
+    expect(read.eventId).toMatch(/[0-9a-f-]{36}/u);
+
+    store.consumeTerminalReadGuard({
+      transportId: "transport-a",
+      actorId: "%1",
+      paneId: "%2",
+      guardSeconds: 90,
+    });
+    expect(() => store.consumeTerminalReadGuard({
+      transportId: "transport-a",
+      actorId: "%1",
+      paneId: "%2",
+      guardSeconds: 90,
+    })).toThrow(/missing or expired/u);
+
+    store.recordTerminalSend({
+      transportId: "transport-a",
+      actorId: "%1",
+      paneId: "%2",
+      paneTarget: "agents:0.1",
+      tmuxSession: "agents",
+      correlationId: "abc123",
+      messageBytes: 42,
+    });
+
+    const log = fs.readFileSync(`${root}/.agentrelay/events.jsonl`, "utf8");
+    expect(log).toContain("terminal_read");
+    expect(log).toContain("terminal_send");
+    expect(log).toContain("Message content was not persisted");
+    expect(log).not.toContain("private message payload");
+  });
+
+  it("does not share a read guard between actors", () => {
+    store.recordTerminalRead({
+      transportId: "transport-a",
+      actorId: "%1",
+      paneId: "%2",
+      paneTarget: "agents:0.1",
+      tmuxSession: "agents",
+      requestedLines: 10,
+      outputBytes: 10,
+      truncated: false,
+      guardSeconds: 90,
+    });
+    expect(() => store.consumeTerminalReadGuard({
+      transportId: "transport-a",
+      actorId: "%3",
+      paneId: "%2",
+      guardSeconds: 90,
+    })).toThrow(/missing or expired/u);
+  });
+});
diff --git a/tests/terminal.test.ts b/tests/terminal.test.ts
new file mode 100644
index 0000000..ae7dea8
--- /dev/null
+++ b/tests/terminal.test.ts
@@ -0,0 +1,91 @@
+import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { ProjectStore } from "../src/store.js";
+import { TerminalService, TerminalTransport } from "../src/terminal.js";
+import { createTestRepository, removeTestRepository } from "./helpers.js";
+
+const hasTmux = spawnSync("tmux", ["-V"], { encoding: "utf8" }).status === 0;
+
+describe.skipIf(!hasTmux)("isolated tmux transport", () => {
+  let root: string;
+  let store: ProjectStore;
+  let socketPath: string;
+  let sessionName: string;
+  let service: TerminalService;
+  let currentPane: string;
+  let workerPane: string;
+
+  const runTmux = (args: string[]): string => {
+    const result = spawnSync("tmux", ["-S", socketPath, ...args], { encoding: "utf8" });
+    if (result.status !== 0) throw new Error(result.stderr || `tmux exited with ${result.status}`);
+    return result.stdout.trim();
+  };
+
+  beforeEach(() => {
+    root = createTestRepository();
+    store = new ProjectStore(root);
+    socketPath = path.join(os.tmpdir(), `agentrelay-tmux-${randomUUID()}.sock`);
+    sessionName = `agentrelay-${randomUUID().slice(0, 8)}`;
+    runTmux(["new-session", "-d", "-s", sessionName, "-n", "agents", "cat"]);
+    runTmux(["split-window", "-d", "-t", `${sessionName}:`, "cat"]);
+    [currentPane, workerPane] = runTmux([
+      "list-panes",
+      "-t",
+      `${sessionName}:`,
+      "-F",
+      "#{pane_id}",
+    ]).split("\n") as [string, string];
+    runTmux(["send-keys", "-t", workerPane, "-l", "--", "READY api_key=super-secret"]);
+    runTmux(["send-keys", "-t", workerPane, "Enter"]);
+    const transport = new TerminalTransport({
+      socketPath,
+      sessionName,
+      currentPane,
+    });
+    service = new TerminalService(store, transport);
+  });
+
+  afterEach(() => {
+    try {
+      runTmux(["kill-server"]);
+    } catch {
+      // A failed test may already have stopped the isolated server.
+    }
+    store.close();
+    removeTestRepository(root);
+  });
+
+  it("lists, labels, reads, sends, redacts, and consumes the read guard", async () => {
+    expect((await service.list()).panes).toHaveLength(2);
+    await service.name(workerPane, "worker.review");
+
+    await expect(service.send("worker.review", "hello before read")).rejects.toThrow(/read guard/u);
+    const firstRead = await service.read("worker.review", 20);
+    expect(firstRead.output).toContain("READY");
+    expect(firstRead.output).not.toContain("super-secret");
+    const sent = await service.send("worker.review", "hello from test");
+    expect(sent.submitted).toBe(true);
+    await expect(service.send("worker.review", "second send")).rejects.toThrow(/read guard/u);
+
+    let output = "";
+    for (let attempt = 0; attempt < 20; attempt += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      output = (await service.read("worker.review", 30)).output;
+      if (output.includes("[AgentRelay")) break;
+    }
+    expect(output).toContain("hello from test");
+  });
+
+  it("rejects self-messages and panes outside the configured session", async () => {
+    await service.read(currentPane, 10);
+    await expect(service.send(currentPane, "do not loop")).rejects.toThrow(/own pane/u);
+
+    const otherSession = `other-${randomUUID().slice(0, 8)}`;
+    runTmux(["new-session", "-d", "-s", otherSession, "cat"]);
+    const otherPane = runTmux(["list-panes", "-t", `${otherSession}:`, "-F", "#{pane_id}"]);
+    await expect(service.read(otherPane, 10)).rejects.toThrow(/outside the allowed/u);
+  });
+});