diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Revision history for pms-domain-model
 
+## 0.1.6.0 -- 2026-05-02
+
+* Add agentAllowedCmds whitelist support for agent-proc-run.
+
 ## 0.1.5.0 -- 2026-04-30
 
 * Support timeout configuration.
diff --git a/pms-domain-model.cabal b/pms-domain-model.cabal
--- a/pms-domain-model.cabal
+++ b/pms-domain-model.cabal
@@ -20,7 +20,7 @@
 -- PVP summary:     +-+------- breaking API changes
 --                  | | +----- non-breaking API additions
 --                  | | | +--- code changes with no API change
-version:            0.1.5.0
+version:            0.1.6.0
 
 -- A short (one-line) description of the package.
 synopsis:           pms-domain-model
@@ -124,7 +124,6 @@
                       stm,
                       monad-logger,
                       async,
-                      unix,
                       lens,
                       aeson,
                       pms-domain-model
diff --git a/src/PMS/Domain/Model/DM/Type.hs b/src/PMS/Domain/Model/DM/Type.hs
--- a/src/PMS/Domain/Model/DM/Type.hs
+++ b/src/PMS/Domain/Model/DM/Type.hs
@@ -275,9 +275,6 @@
       }
 
 
-
-
-
 -- |
 --
 data McpResourcesTemplatesListRequestData =
@@ -342,8 +339,6 @@
       }
 
 
-
-
 -- |
 --
 data McpInitializedNotificationData =
@@ -393,7 +388,6 @@
       }
 
 
-
 -- |
 --
 data McpCompletionCompleteRequestDataParams =
@@ -658,8 +652,6 @@
       }
 
 
-
-
 -- |
 --
 data McpPromptsListResponseResult =
@@ -742,9 +734,6 @@
       }
 
 
-
-
-
 -- |
 --
 data McpResourcesTemplatesListResponseResult =
@@ -778,7 +767,6 @@
       }
 
 
-
 -- |
 --
 data McpResourcesListResponseResult =
@@ -812,9 +800,6 @@
       }
 
 
-
-
-
 -- |
 --
 data McpResourcesReadResponseResult =
@@ -848,8 +833,6 @@
       }
 
 
-
-
 -- |
 --
 data McpCompleteResponseResult =
@@ -984,13 +967,13 @@
         _methodMcpToolsListChangedNotificationData = "notifications/tools/list_changed"
       , _paramsMcpToolsListChangedNotificationData = def
       }
-      
 
+
 -- |
 --
 data McpPromptsListChangedNotificationDataParams =
   McpPromptsListChangedNotificationDataParams {
-    _promptsMcpPromptsListChangedNotificationDataParams :: RawJsonByteString   -- prompts-list
+    _promptsMcpPromptsListChangedNotificationDataParams :: RawJsonByteString
   } deriving (Show, Read, Eq)
 
 $(deriveJSON defaultOptions {fieldLabelModifier = dropDataName "McpPromptsListChangedNotificationDataParams", omitNothingFields = True} ''McpPromptsListChangedNotificationDataParams)
@@ -998,7 +981,7 @@
 
 instance Default McpPromptsListChangedNotificationDataParams where
   def = McpPromptsListChangedNotificationDataParams {
-        _promptsMcpPromptsListChangedNotificationDataParams = RawJsonByteString "[]"  -- prompts-list
+        _promptsMcpPromptsListChangedNotificationDataParams = RawJsonByteString "[]"
       }
 
 -- |
@@ -1019,13 +1002,11 @@
       }
 
 
-
-
 -- |
 --
 data McpResourcesListChangedNotificationDataParams =
   McpResourcesListChangedNotificationDataParams {
-    _resourcesMcpResourcesListChangedNotificationDataParams :: RawJsonByteString  -- resources-list
+    _resourcesMcpResourcesListChangedNotificationDataParams :: RawJsonByteString
   } deriving (Show, Read, Eq)
 
 $(deriveJSON defaultOptions {fieldLabelModifier = dropDataName "McpResourcesListChangedNotificationDataParams", omitNothingFields = True} ''McpResourcesListChangedNotificationDataParams)
@@ -1033,7 +1014,7 @@
 
 instance Default McpResourcesListChangedNotificationDataParams where
   def = McpResourcesListChangedNotificationDataParams {
-        _resourcesMcpResourcesListChangedNotificationDataParams = RawJsonByteString "[]"   -- resources-list
+        _resourcesMcpResourcesListChangedNotificationDataParams = RawJsonByteString "[]"
       }
 
 -- |
@@ -1277,7 +1258,6 @@
   deriving (Show, Read, Eq)
 
 
-
 --------------------------------------------------------------------------------
 -- |
 --
@@ -1366,6 +1346,112 @@
 --------------------------------------------------------------------------------
 -- |
 --
+data AgentProcessEchoCommandData =
+  AgentProcessEchoCommandData {
+    _jsonrpcAgentProcessEchoCommandData :: JsonRpcRequest
+  , _valueAgentProcessEchoCommandData   :: String
+  } deriving (Show, Read, Eq)
+
+$(deriveJSON defaultOptions {fieldLabelModifier = dropDataName "AgentProcessEchoCommandData", omitNothingFields = True} ''AgentProcessEchoCommandData)
+makeLenses ''AgentProcessEchoCommandData
+
+instance Default AgentProcessEchoCommandData where
+  def = AgentProcessEchoCommandData {
+        _jsonrpcAgentProcessEchoCommandData = def
+      , _valueAgentProcessEchoCommandData   = def
+      }
+
+-- |
+--
+data AgentProcessRunCommandData =
+  AgentProcessRunCommandData {
+    _jsonrpcAgentProcessRunCommandData   :: JsonRpcRequest
+  , _nameAgentProcessRunCommandData      :: String
+  , _argumentsAgentProcessRunCommandData :: RawJsonByteString
+  } deriving (Show, Read, Eq)
+
+$(deriveJSON defaultOptions {fieldLabelModifier = dropDataName "AgentProcessRunCommandData", omitNothingFields = True} ''AgentProcessRunCommandData)
+makeLenses ''AgentProcessRunCommandData
+
+instance Default AgentProcessRunCommandData where
+  def = AgentProcessRunCommandData {
+        _jsonrpcAgentProcessRunCommandData   = def
+      , _nameAgentProcessRunCommandData      = def
+      , _argumentsAgentProcessRunCommandData = def
+      }
+
+-- |
+--
+data AgentProcessTerminateCommandData =
+  AgentProcessTerminateCommandData {
+    _jsonrpcAgentProcessTerminateCommandData :: JsonRpcRequest
+  } deriving (Show, Read, Eq)
+
+$(deriveJSON defaultOptions {fieldLabelModifier = dropDataName "AgentProcessTerminateCommandData", omitNothingFields = True} ''AgentProcessTerminateCommandData)
+makeLenses ''AgentProcessTerminateCommandData
+
+instance Default AgentProcessTerminateCommandData where
+  def = AgentProcessTerminateCommandData {
+        _jsonrpcAgentProcessTerminateCommandData = def
+      }
+
+-- |
+--
+data AgentProcessReadCommandData =
+  AgentProcessReadCommandData {
+    _jsonrpcAgentProcessReadCommandData   :: JsonRpcRequest
+  , _argumentsAgentProcessReadCommandData :: RawJsonByteString
+  } deriving (Show, Read, Eq)
+
+$(deriveJSON defaultOptions {fieldLabelModifier = dropDataName "AgentProcessReadCommandData", omitNothingFields = True} ''AgentProcessReadCommandData)
+makeLenses ''AgentProcessReadCommandData
+
+instance Default AgentProcessReadCommandData where
+  def = AgentProcessReadCommandData {
+        _jsonrpcAgentProcessReadCommandData   = def
+      , _argumentsAgentProcessReadCommandData = def
+      }
+
+-- |
+--
+data AgentProcessWriteCommandData =
+  AgentProcessWriteCommandData {
+    _jsonrpcAgentProcessWriteCommandData   :: JsonRpcRequest
+  , _argumentsAgentProcessWriteCommandData :: RawJsonByteString
+  } deriving (Show, Read, Eq)
+
+$(deriveJSON defaultOptions {fieldLabelModifier = dropDataName "AgentProcessWriteCommandData", omitNothingFields = True} ''AgentProcessWriteCommandData)
+makeLenses ''AgentProcessWriteCommandData
+
+instance Default AgentProcessWriteCommandData where
+  def = AgentProcessWriteCommandData {
+        _jsonrpcAgentProcessWriteCommandData   = def
+      , _argumentsAgentProcessWriteCommandData = def
+      }
+
+-- |
+--
+data AgentProcessCommand =
+    AgentProcessEchoCommand      AgentProcessEchoCommandData
+  | AgentProcessRunCommand       AgentProcessRunCommandData
+  | AgentProcessTerminateCommand AgentProcessTerminateCommandData
+  | AgentProcessReadCommand      AgentProcessReadCommandData
+  | AgentProcessWriteCommand     AgentProcessWriteCommandData
+  deriving (Show, Read, Eq)
+
+-- |
+--
+getJsonRpcAgentProcessCommand :: AgentProcessCommand -> JsonRpcRequest
+getJsonRpcAgentProcessCommand (AgentProcessEchoCommand      d) = d^.jsonrpcAgentProcessEchoCommandData
+getJsonRpcAgentProcessCommand (AgentProcessRunCommand       d) = d^.jsonrpcAgentProcessRunCommandData
+getJsonRpcAgentProcessCommand (AgentProcessTerminateCommand d) = d^.jsonrpcAgentProcessTerminateCommandData
+getJsonRpcAgentProcessCommand (AgentProcessReadCommand      d) = d^.jsonrpcAgentProcessReadCommandData
+getJsonRpcAgentProcessCommand (AgentProcessWriteCommand     d) = d^.jsonrpcAgentProcessWriteCommandData
+
+
+--------------------------------------------------------------------------------
+-- |
+--
 data SocketEchoCommandData =
   SocketEchoCommandData {
     _jsonrpcSocketEchoCommandData :: JsonRpcRequest
@@ -1550,26 +1636,28 @@
 -- |
 --
 data DomainData = DomainData {
-    _logDirDomainData            :: Maybe String
-  , _logLevelDomainData          :: LogLevel
-  , _toolsDirDomainData          :: String
-  , _promptsDirDomainData        :: String
-  , _resourcesDirDomainData      :: String
-  , _sandboxDirDomainData       :: Maybe String
-  , _requestQueueDomainData      :: TQueue McpRequest
-  , _responseQueueDomainData     :: TQueue McpResponse
-  , _notificationQueueDomainData :: TQueue McpNotification
-  , _commandQueueDomainData      :: TQueue Command
-  , _cmdRunQueueDomainData       :: TQueue CmdRunCommand
-  , _fileSystemQueueDomainData   :: TQueue FileSystemCommand
-  , _watchQueueDomainData        :: TQueue WatchCommand
-  , _procspawnQueueDomainData    :: TQueue ProcSpawnCommand
-  , _socketQueueDomainData       :: TQueue SocketCommand
-  , _serialQueueDomainData       :: TQueue SerialCommand
-  , _promptsDomainData           :: [String]
-  , _invalidCharsDomainData      :: [String]
-  , _invalidCmdsDomainData       :: [String]
-  , _timeoutMicrosecDomainData   :: Int
+    _logDirDomainData              :: Maybe String
+  , _logLevelDomainData            :: LogLevel
+  , _toolsDirDomainData            :: String
+  , _promptsDirDomainData          :: String
+  , _resourcesDirDomainData        :: String
+  , _sandboxDirDomainData          :: Maybe String
+  , _requestQueueDomainData        :: TQueue McpRequest
+  , _responseQueueDomainData       :: TQueue McpResponse
+  , _notificationQueueDomainData   :: TQueue McpNotification
+  , _commandQueueDomainData        :: TQueue Command
+  , _cmdRunQueueDomainData         :: TQueue CmdRunCommand
+  , _fileSystemQueueDomainData     :: TQueue FileSystemCommand
+  , _watchQueueDomainData          :: TQueue WatchCommand
+  , _procspawnQueueDomainData      :: TQueue ProcSpawnCommand
+  , _agentProcessQueueDomainData   :: TQueue AgentProcessCommand
+  , _socketQueueDomainData         :: TQueue SocketCommand
+  , _serialQueueDomainData         :: TQueue SerialCommand
+  , _promptsDomainData             :: [String]
+  , _invalidCharsDomainData        :: [String]
+  , _invalidCmdsDomainData         :: [String]
+  , _allowedAgentCmdsDomainData    :: [String]   -- ^ whitelist for agent-proc-run; empty means deny all
+  , _timeoutMicrosecDomainData     :: Int
   }
 
 makeLenses ''DomainData
@@ -1585,23 +1673,24 @@
   hSetEncoding stderr utf8
   hSetBuffering stderr LineBuffering
 
-  reqQ <- newTQueueIO
-  resQ <- newTQueueIO
-  notQ <- newTQueueIO
-  cmdQ <- newTQueueIO
-  cmdRunQ <- newTQueueIO
-  fileSystemQ <- newTQueueIO
-  watchQ  <- newTQueueIO
-  procQ   <- newTQueueIO
-  socketQ   <- newTQueueIO
-  serialQ   <- newTQueueIO
+  reqQ         <- newTQueueIO
+  resQ         <- newTQueueIO
+  notQ         <- newTQueueIO
+  cmdQ         <- newTQueueIO
+  cmdRunQ      <- newTQueueIO
+  fileSystemQ  <- newTQueueIO
+  watchQ       <- newTQueueIO
+  procQ        <- newTQueueIO
+  agentProcQ   <- newTQueueIO
+  socketQ      <- newTQueueIO
+  serialQ      <- newTQueueIO
   return DomainData {
            _logDirDomainData            = Nothing
          , _logLevelDomainData          = LevelDebug
          , _toolsDirDomainData          = "pty-mcp-server/tools"
          , _promptsDirDomainData        = "pty-mcp-server/prompts"
          , _resourcesDirDomainData      = "pty-mcp-server/resources"
-         , _sandboxDirDomainData       = Nothing
+         , _sandboxDirDomainData        = Nothing
          , _requestQueueDomainData      = reqQ
          , _responseQueueDomainData     = resQ
          , _notificationQueueDomainData = notQ
@@ -1610,11 +1699,13 @@
          , _fileSystemQueueDomainData   = fileSystemQ
          , _watchQueueDomainData        = watchQ
          , _procspawnQueueDomainData    = procQ
+         , _agentProcessQueueDomainData = agentProcQ
          , _socketQueueDomainData       = socketQ
          , _serialQueueDomainData       = serialQ
          , _promptsDomainData           = def
          , _invalidCharsDomainData      = def
          , _invalidCmdsDomainData       = def
+         , _allowedAgentCmdsDomainData  = def     -- deny all by default
          , _timeoutMicrosecDomainData   = 30 * 1000 * 1000
          }
 
@@ -1622,6 +1713,3 @@
 --
 type ErrorData = String
 type DomainContext a = DomainData -> IO a
-
-
-
