@markusylisiurunen/tau 0.3.50 → 0.3.52

package/dist/core/static/tau_docs/remote-sessions.md

@@ -1,6 +1,6 @@
 # Remote sessions
 
-Remote sessions let the terminal stay close to the user while the session host and execution environment run elsewhere. Tau does not turn remote work into a second product mode: `tau attach` uses the same TUI over a WebSocket or stdio transport. The important choice is which process should stay alive, who owns credentials and persistence, and where agent-visible commands run.
+Remote sessions let the terminal stay close to the user while the session host and execution environment run elsewhere. Tau does not turn remote work into a second product mode: `tau attach` uses the same TUI over WebSocket. The important boundaries are who owns credentials and persistence and where agent-visible commands run.
 
 ## Choose the connection shape
 
@@ -9,12 +9,10 @@ Use the smallest shape that matches the lifecycle you need.
 | Shape | Best for | Lifetime and ownership |
 | --- | --- | --- |
 | `tau serve` plus WebSocket attach | Long-running hosts, reconnects, and multiple observers | The server owns the host independently of any one TUI. |
-| `tau attach -- ssh … tau rpc` | Ad hoc access through SSH without exposing a listener | The attachment owns one remote RPC process. Closing it shuts that host down. |
-| `tau rpc` directly | Editors, automation, and custom protocol clients over NDJSON | The parent process owns the RPC host and its stdin/stdout. |
 | Node SDK with its default client | Applications that want an in-process host | The SDK client owns the host and closes it with the client. |
 | Node SDK over WebSocket | Applications sharing a long-running `tau serve` host | The server owns sessions; the SDK observes them remotely. |
 
-Use `tau serve` when a turn should continue after a laptop disconnects. Use stdio/SSH when SSH is already the desired security and process boundary and it is acceptable for closing the TUI to stop remote work. The [session protocol](session-protocol.md) and [Node SDK](node-sdk.md) cover developer APIs and wire details; this page stays at the operational level.
+Use `tau serve` for remote TUI and SDK connections. Keep it bound to loopback behind an SSH tunnel when SSH is the desired security boundary. The [session protocol](session-protocol.md) and [Node SDK](node-sdk.md) cover developer APIs and wire details; this page stays at the operational level.
 
 ## Host sessions over WebSocket
 
@@ -58,24 +56,6 @@ Then attach locally:
 tau attach ws://127.0.0.1:8787
 ```
 
-## Attach through stdio and SSH
-
-Anything after `--` is launched as a local child process and must speak Tau’s session protocol over stdin and stdout. SSH makes that child a remote `tau rpc` process:
-
-```sh
-tau attach -- ssh dev@buildbox.example tau rpc
-```
-
-A login shell or project-specific host configuration can be selected in the remote command:
-
-```sh
-tau attach -- ssh dev@buildbox.example 'cd /srv/tau-host && tau rpc'
-```
-
-The remote process’s stdin and stdout are protocol traffic. Shell startup files and wrapper scripts must not print banners to stdout. Put diagnostics on stderr.
-
-This is a one-shot host. When the TUI exits or the transport fails, the local child is terminated, `tau rpc` shuts down its host, active work is interrupted, and durable state is recovered on the next process. Do not use this shape when work must continue through client disconnects; run `tau serve` instead.
-
 ## List, select, create, or attach
 
 Without `--session` or `--new`, `tau attach` asks the host for its session list and opens an interactive selector:
@@ -94,14 +74,6 @@ tau attach \
   ws://127.0.0.1:8787
 ```
 
-The equivalent SSH form is:
-
-```sh
-tau attach \
-  --session 0195d6e4-4cf9-7f44-a2d8-f8f7f49ee9d3 \
-  -- ssh dev@buildbox.example tau rpc
-```
-
 Create a new session with an absolute cwd in the selected execution environment:
 
 ```sh
@@ -111,15 +83,6 @@ tau attach \
   ws://127.0.0.1:8787
 ```
 
-For stdio/SSH:
-
-```sh
-tau attach \
-  --new \
-  --cwd /srv/workspaces/tau \
-  -- ssh dev@buildbox.example tau rpc
-```
-
 For the default `local` execution kind, this path is on the host machine, not the attaching machine. It must already be a usable directory with the desired repository or workspace. Tau creates the session, not the directory or repository.
 
 Remote `--new` supplies the conventional creation attribute `source: "tui"`. It does not infer repository metadata by inspecting the remote cwd. Clients that need repository provenance should create through the SDK or protocol and provide complete immutable attributes. See [sessions](sessions.md).
@@ -215,7 +178,7 @@ Different changes have different owners:
 | Effective model `apiKeys` in execution-environment or session configuration | Wait for idle, then run `/reload`; new sessions also resolve the current values. |
 | Managed Codex auth changed with `tau auth` | No host restart; auth storage is read again on later credential resolutions. |
 | Attaching themes, diff launcher, speech config, or configured client tools | Restart `tau attach`. |
-| Host process environment variables, history target, WebSocket listener, Cloudflare bridge, Fly API target, or host startup flags | Restart `tau serve` or the `tau rpc` process. |
+| Host process environment variables, history target, WebSocket listener, Cloudflare bridge, Fly API target, or host startup flags | Restart `tau serve`. |
 | Host Tau package, built-in tools, protocol, session recovery code, or built-in documentation | Upgrade and restart the host. |
 | TUI package, keybindings, rendering, local speech, or client-tool implementation | Upgrade and restart the attaching client. |
 
@@ -227,8 +190,6 @@ A WebSocket connection observes a hosted session; it does not own or delete it.
 
 A clean `tau serve` shutdown interrupts active work, persists live sessions, and closes clients. On restart, the host lists sessions whose execution environments it can restore. Recovery returns sessions idle, drops pending queued and steering messages, discards live subagents, and changes an active persistent goal to blocked. Use `/goal resume` only after checking why the host stopped.
 
-A stdio/SSH connection is different because its RPC process is the host. Closing the connection ends that process. The session remains stored under the remote host user’s `~/.config/tau/sessions` and can be observed by a later `tau rpc` process using the same home and compatible resolver configuration.
-
 ## Use multiple observers carefully
 
 Multiple WebSocket clients can observe the same live session and receive the same committed updates and pending-message state. They can also submit, queue, steer, interrupt, or mutate that session, so coordinate human or automation ownership rather than treating observers as read-only.
@@ -265,10 +226,6 @@ Do not edit the session JSON to change environment identity. Restore the owning
 
 Verify that server and client use the same token and that a reverse proxy preserves the WebSocket request path and query string. `TAU_WS_AUTH_TOKEN` can silently supply either side, so inspect the environment as well as command-line flags. Do not print the token in shared logs.
 
-### SSH attachment fails before the TUI opens
-
-Run the remote command directly and confirm that `tau rpc` is installed and can start. Protocol stdout must contain only NDJSON. Login banners, shell startup output, or wrapper diagnostics on stdout corrupt the transport; redirect them to stderr or remove them.
-
 ### A reconnect shows an interrupted turn
 
-A client disconnect alone does not stop a WebSocket-hosted turn, but server shutdown does. Stdio/SSH attachment shutdown also ends its host. Review the last assistant and tool states, verify the execution environment with `!!pwd` and `!!git status --short`, then retry or resume a blocked goal intentionally. [Sessions](sessions.md) explains recovery and safe verification.
+A client disconnect alone does not stop a WebSocket-hosted turn, but server shutdown does. Review the last assistant and tool states, verify the execution environment with `!!pwd` and `!!git status --short`, then retry or resume a blocked goal intentionally. [Sessions](sessions.md) explains recovery and safe verification.

package/dist/core/static/tau_docs/security.md

@@ -41,7 +41,7 @@ Prompt templates are inserted into the editor for review rather than submitted a
 
 ## Keep secrets with the process that needs them
 
-Most model and service credentials belong to the host because the host performs model calls, web search, history replication, and host-tool Nook requests. TUI speech credentials and command client-tool credentials belong to the client. Telegram bot and transcription credentials belong to the Telegram runner. Hosted-environment bridge and API credentials belong to host startup.
+Most model and service credentials belong to the host because the host performs model calls, web search, history replication, and host-tool Nook requests. TUI speech credentials and command client-tool credentials belong to the client. Telegram bot, transcription, and voice-response credentials belong to the Telegram runner. Hosted-environment bridge and API credentials belong to host startup.
 
 In a remote attachment, a credential exported on the laptop does not authenticate the remote host. Conversely, putting a host credential into the execution target's shell environment unnecessarily exposes it to target processes. Follow [credentials](credentials.md) for exact resolution precedence.
 
@@ -77,12 +77,10 @@ Do not rely on sanitization as a secret store or authorization boundary. Avoid b
 
 Tau command execution uses a fresh non-interactive login Bash. The execution environment's `HOME` controls login startup discovery. Bash can read `/etc/profile`, the first available user login file, and `BASH_ENV`; a login file may also source `.bashrc`.
 
-These files execute with the same operating-system authority as every tool command. A compromised or overly broad startup file can change `PATH`, run commands, disclose data, terminate the shell, or corrupt protocol output. Review startup files in each execution environment, especially targets created from shared images or user homes.
+These files execute with the same operating-system authority as every tool command. A compromised or overly broad startup file can change `PATH`, run commands, disclose data, terminate the shell, or produce unexpected output. Review startup files in each execution environment, especially targets created from shared images or user homes.
 
 Startup files must not print banners, prompt for input, read stdin, require a TTY, launch an editor, or exit the shell unexpectedly. Tau does not suppress their output. There is no TTY, and ordinary agent Bash calls have no stdin, so interactive authentication and terminal prompts fail or wait until timeout. Configure Git, SSH, package managers, and cloud CLIs for deliberate noninteractive use.
 
-`tau rpc` has an additional constraint: stdout is the NDJSON protocol. Shell banners and wrapper diagnostics on stdout break the transport. Send diagnostics to stderr.
-
 ## Trust command client tools as local programs
 
 Command client tools are defined only in user-owned global configuration, then selected for a project. Tau starts the configured executable directly, without a shell, and validates model arguments against its configured object schema. The command still runs as trusted local code with the client's full inherited environment and filesystem permissions.
@@ -124,8 +122,6 @@ Tau's listener is plain WebSocket and has no certificate configuration. Across a
 
 A reverse proxy must preserve WebSocket upgrade behavior and the request query string while protecting both. Restrict who can reach the listener even when a token is configured. Multiple observers are active participants, not read-only viewers: they can submit, steer, interrupt, rewind, and advertise client tools. See [remote sessions](remote-sessions.md).
 
-Stdio attachment relies on the security of the launched command, commonly SSH. Closing that transport also closes its one-shot host. Use a long-running authenticated WebSocket host when work must survive client disconnects.
-
 ## Secure Telegram access and workspaces
 
 A Telegram runner is both a network-facing client and a local Tau host. Its bot configuration determines who can create turns that may execute tools in configured workspaces.

package/dist/core/static/tau_docs/session-protocol-methods.md

@@ -1,6 +1,6 @@
 # Session protocol method reference
 
-This page defines every request method in protocol version 12. It is the compact wire reference for clients that already understand connection, observation, and delta application from the [session protocol](session-protocol.md).
+This page defines every request method in protocol version 13. It is the compact wire reference for clients that already understand connection, observation, and delta application from the [session protocol](session-protocol.md).
 
 Every request uses `{ version, type: "request", id, method, params }`. Every successful response uses `{ version, type: "response", id, ok: true, result }`. `params` is required even when empty, and unknown object fields are stripped.
 
@@ -47,7 +47,7 @@ params: {
 }
 
 result: {
-  protocolVersion: 12;
+  protocolVersion: 13;
   methods: string[];
   alreadyInitialized: boolean;
 }
@@ -557,21 +557,62 @@ Acknowledges a `session.clientTool.call` before its deadline.
 params: {
   sessionId: string;
   callId: string;
+  presentation?: {
+    subject?: string;
+    subjectWrap?: "word" | "character";
+    details?: Array<{
+      text: string;
+      tone?: "added" | "removed";
+      wrap?: "word" | "character";
+    }>;
+    metadata?: string[];
+  };
 }
 result: {
   accepted: boolean;
 }
 ```
 
+The optional presentation is a partial running-state override. When present, `subject` must be non-empty and may contain line feeds but not carriage returns. Each detail text and metadata value is one line. Presentation objects are limited to 1 MiB; subjects and detail values to 256 KiB each; metadata values to 16 KiB each; and detail and metadata collections to 1,024 entries each.
+
+The host preserves explicit fields within those safety limits and supplies canonical display-truncated defaults for omitted fields. It owns the action and operation and records the resolved presentation. Empty detail or metadata arrays suppress those default fields. An accepted acknowledgement authorizes the client to begin execution.
+
 ### `session.clientTool.result`
 
-Completes an acknowledged call with model-visible content or an error.
+Completes a call with model-visible content or an error.
 
 ```ts
+type PresentationOverride = {
+  subject?: string;
+  subjectWrap?: "word" | "character";
+  details?: Array<{
+    text: string;
+    tone?: "added" | "removed";
+    wrap?: "word" | "character";
+  }>;
+  metadata?: string[];
+};
+
 params:
-  | { sessionId: string; callId: string; ok: true; content: string }
-  | { sessionId: string; callId: string; ok: false; error: string }
-result: { accepted: boolean }
+  | {
+      sessionId: string;
+      callId: string;
+      ok: true;
+      content: string;
+      presentation?: PresentationOverride;
+    }
+  | {
+      sessionId: string;
+      callId: string;
+      ok: false;
+      error: string;
+      presentation?: PresentationOverride;
+    };
+result: { accepted: boolean };
 ```
 
-`accepted: false` means the call was cancelled, timed out, detached, unknown, or already completed. Do not retry or send additional results for that call.
+The optional result presentation applies only to the reported terminal state and is resolved independently from the running presentation. The host preserves explicit fields unchanged after safety validation and supplies canonical display-truncated defaults for omitted fields. If no client result arrives, the host uses a complete fallback for timeout, cancellation, detach, or another terminal outcome.
+
+A successful result is accepted only after the host has accepted the acknowledgement. An error sent before acknowledgement records a preparation failure, such as an error from `describe`, without authorizing execution. An error sent afterward records an execution failure.
+
+`accepted: false` means the successful call was not yet authorized, or the call was cancelled, timed out, detached, unknown, or already completed. Do not retry or send additional results for that call.

package/dist/core/static/tau_docs/session-protocol.md

@@ -1,16 +1,14 @@
 # Session protocol
 
-Tau's session protocol is the public wire contract for clients that create, observe, and control hosted sessions. Use it when an integration needs to speak directly to `tau rpc` or `tau serve`. Node applications can usually use the typed [Node SDK](node-sdk.md) instead.
+Tau's session protocol is the public wire contract for clients that create, observe, and control hosted sessions through `tau serve`. Node applications can usually use the typed [Node SDK](node-sdk.md) instead.
 
-The protocol carries the same semantics over stdio and WebSocket. It is request and response based, with separate server messages for observed state, pending input, subagent activity, ephemeral feedback, and delegated client tools. The complete method surface is in the [session protocol method reference](session-protocol-methods.md).
+The protocol is transport-neutral and request and response based, with separate server messages for observed state, pending input, subagent activity, ephemeral feedback, and delegated client tools. Tau currently exposes it over WebSocket. The complete method surface is in the [session protocol method reference](session-protocol-methods.md).
 
-## Choose a transport
+## Connect over WebSocket
 
-`tau rpc` uses UTF-8 NDJSON. The client writes one JSON request per stdin line and reads one JSON server message per stdout line. Stdout is protocol-only. Process diagnostics and login-shell output must go to stderr.
+`tau serve` uses one UTF-8 JSON object per text WebSocket message. Binary messages are not supported. Authentication, TLS, listener setup, SSH tunneling, and host lifetime belong to [remote sessions](remote-sessions.md).
 
-`tau serve` uses one UTF-8 JSON object per text WebSocket message. Binary messages are not supported. Authentication, TLS, listener setup, SSH attachment, and host lifetime belong to [remote sessions](remote-sessions.md).
-
-Both transports expose one host. Starting either server does not create or select a session. A client lists, creates, or observes sessions explicitly.
+The server exposes one host. Starting it does not create or select a session. A client lists, creates, or observes sessions explicitly.
 
 The client, host, and execution environment remain separate logical machines even when they share a process or filesystem. Session paths and commands belong to the execution environment. Persistence, credentials, model work, and protocol coordination belong to the host. Client tools and local UI belong to the connected client. See [ownership and scope](ownership-and-scope.md) before passing paths or credentials across this boundary.
 
@@ -20,7 +18,7 @@ The server sends `ready` as its first message:
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "ready",
   "methods": ["initialize", "session.create", "session.list"]
 }
@@ -32,7 +30,7 @@ After `ready`, send `initialize` with non-empty client metadata:
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "request",
   "id": "init-1",
   "method": "initialize",
@@ -52,7 +50,7 @@ Every request has the same envelope:
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "request",
   "id": "req-42",
   "method": "session.snapshot",
@@ -66,7 +64,7 @@ Successful responses echo the request id:
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "response",
   "id": "req-42",
   "ok": true,
@@ -126,7 +124,7 @@ Observed snapshot changes arrive as `session.delta`:
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "session.delta",
   "sessionId": "0195d6e4-4cf9-7f44-a2d8-f8f7f49ee9d3",
   "fromRevision": 8,
@@ -164,7 +162,7 @@ Not all observed state belongs in the recoverable snapshot. Each live channel ha
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "session.pendingUserMessages",
   "sessionId": "...",
   "state": {
@@ -201,7 +199,7 @@ An initialized client that advertised a tool can receive:
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "session.clientTool.call",
   "sessionId": "...",
   "agentId": "main",
@@ -213,9 +211,11 @@ An initialized client that advertised a tool can receive:
 }
 ```
 
-Acknowledge promptly with `session.clientTool.ack`, then send exactly one `session.clientTool.result` with either `{ ok: true, content }` or `{ ok: false, error }`. The result methods return `{ accepted: boolean }`; `false` means the call is no longer waiting for that message.
+Acknowledge promptly with `session.clientTool.ack`, optionally including a bounded partial running presentation. Begin execution only after the acknowledgement returns `{ accepted: true }`, then send exactly one `session.clientTool.result` with either `{ ok: true, content }` or `{ ok: false, error }` and an optional independent terminal presentation. Both presentation objects may contain `subject`, `subjectWrap`, `details`, and `metadata`; the host owns action and operation and supplies every omitted field. Explicit fields are preserved unchanged after protocol safety validation, while generated defaults use Tau's canonical display truncation. Empty detail or metadata arrays suppress those defaults.
+
+A successful result is rejected until acknowledgement has completed. If preparation itself fails, send an error result before acknowledgement; the host records it as a preparation failure without authorizing execution. If no result arrives because of timeout, cancellation, detach, or another failure, the host renders a complete fallback terminal presentation. The result method returns `{ accepted: boolean }`; `false` means the message is invalid for the call's current state or the call is no longer waiting for it.
 
-`session.clientTool.cancel` names the session and call with reason `aborted`, `timeout`, or `client-detached`. Abort local work and do not send a late result. The SDK implements this lifecycle automatically. Tool execution authority and the execution-environment facade are covered in [client tools](client-tools.md).
+`session.clientTool.cancel` names the session and call with reason `aborted`, `timeout`, `client-detached`, or `host-failed`. Abort local work and do not send a late result. The SDK implements this lifecycle automatically. Tool execution authority and the execution-environment facade are covered in [client tools](client-tools.md).
 
 ## Handle errors and terminal transport failure
 
@@ -223,7 +223,7 @@ Error responses use `ok: false`:
 
 ```json
 {
-  "version": 12,
+  "version": 13,
   "type": "response",
   "id": "req-42",
   "ok": false,
@@ -249,7 +249,7 @@ The supported codes are:
 
 When no valid request id can be recovered, an error response uses `id: null`. Error `message` and optional `data` are diagnostic. Branch on `code`, not message text.
 
-A closed stdio stream, process exit, WebSocket close, malformed server payload, unsupported version, or other terminal transport failure rejects all outstanding requests. Stop sending, cancel client-local delegated tools, and reconnect or create a new transport deliberately. A WebSocket disconnect detaches from a long-running host; closing a stdio RPC process shuts down the host it owns.
+A WebSocket close, malformed server payload, unsupported version, or other terminal transport failure rejects all outstanding requests. Stop sending, cancel client-local delegated tools, and reconnect or create a new transport deliberately. A WebSocket disconnect detaches from the long-running host.
 
 ## Coordinate concurrent work
 

package/dist/core/static/tau_docs/sessions.md

@@ -48,7 +48,7 @@ Retry runs another assistant turn from the current session history. It does not
 
 Retry is unavailable when there is no prior user turn. It is also unavailable for goal-controlled turns because a blocked goal has an explicit resume operation.
 
-Detaching is not the same as interrupting. Closing one observer of a long-running host leaves the hosted turn running. By contrast, a local TUI owns its in-process host, and a stdio attachment owns its `tau rpc` process; closing either causes that host to shut down and interrupt active work. See [remote sessions](remote-sessions.md).
+Detaching is not the same as interrupting. Closing one observer of a long-running host leaves the hosted turn running. By contrast, a local TUI owns its in-process host, so closing it causes that host to shut down and interrupt active work. See [remote sessions](remote-sessions.md).
 
 ## Change persona and reasoning safely
 
@@ -189,14 +189,14 @@ Filters can be combined:
 tau usage --since 2026-08-01 --provider openai-codex --group-by model
 ```
 
-There is no `--until`, `--session`, or `--agent` filter. For a remote session, run `tau usage` on the host under the same user as `tau serve` or `tau rpc`; running it on an attaching client reads that client user’s logs instead. The command is read-only, but the raw files still reveal timestamps, session identifiers, model choices, token volume, and cost activity. Prefer the filtered aggregate output over copying raw JSONL into a shared transcript, and treat Tau-recorded costs as operational estimates rather than a provider invoice.
+There is no `--until`, `--session`, or `--agent` filter. For a remote session, run `tau usage` on the host under the same user as `tau serve`; running it on an attaching client reads that client user’s logs instead. The command is read-only, but the raw files still reveal timestamps, session identifiers, model choices, token volume, and cost activity. Prefer the filtered aggregate output over copying raw JSONL into a shared transcript, and treat Tau-recorded costs as operational estimates rather than a provider invoice.
 
 ## What survives each boundary
 
 | Event | Durable session state | Pending input | Active turns and subagents | Client-local state |
 | --- | --- | --- | --- | --- |
 | Another client detaches from a live WebSocket host | Preserved | Preserved in host memory | Continue | Detached client tools, themes, drafts, and local tasks are lost |
-| Local TUI or stdio/RPC attachment exits | Persisted by owned-host shutdown | Cancelled | Interrupted and settled where possible | Lost |
+| Local TUI exits | Persisted by owned-host shutdown | Cancelled | Interrupted and settled where possible | Lost |
 | WebSocket host restarts | Recovered from storage | Lost | Returns idle; subagents are not restored | Each client reconnects separately |
 | TUI restarts while host stays live | Preserved | Preserved in host memory | Continue | Reloaded from the new client process |
 | `/new` | Old session remains stored | Not copied | New idle session | Same TUI process continues |
@@ -214,10 +214,11 @@ Use normal Tau operations rather than opening or editing session files.
 5. Run non-contextual environment checks with `!!`, for example `!!pwd` and `!!git status --short`.
 6. Submit a small read-only request before resuming destructive work.
 
-For a local stored session, a one-shot local RPC attachment exercises the same recovery path:
+For a local stored session, start a WebSocket host under the same user and attach from another terminal:
 
 ```sh
-tau attach --session 0195d6e4-4cf9-7f44-a2d8-f8f7f49ee9d3 -- tau rpc
+tau serve
+tau attach --session 0195d6e4-4cf9-7f44-a2d8-f8f7f49ee9d3 ws://127.0.0.1:8787
 ```
 
 If recovery fails, verify the host version, execution-environment resolver configuration, target availability, and credentials before assuming the stored session is damaged. [Remote sessions](remote-sessions.md) covers those checks.

package/dist/core/static/tau_docs/telegram.md

@@ -58,7 +58,7 @@ Unknown object fields are stripped, so a misspelled field can have no effect wit
 | `maxSessions` | No | Positive integer cap on active sessions across the whole runner. |
 | `systemMessage` | No | Non-empty model-facing instruction prepended to every Telegram turn. |
 
-A relative top-level `workspaceRoot` resolves from the Telegram config file's directory. Tau persists runner session records at `<workspaceRoot>-sessions.json` and per-chat project preferences at `<workspaceRoot>-project-preferences.json`. These are runner-owned state files, not operator editing surfaces. Session snapshots remain in the normal host store under the runner user's Tau home.
+A relative top-level `workspaceRoot` resolves from the Telegram config file's directory. Tau persists runner session records at `<workspaceRoot>-sessions.json` and per-chat preferences at `<workspaceRoot>-project-preferences.json`. These are runner-owned state files, not operator editing surfaces. Session snapshots remain in the normal host store under the runner user's Tau home.
 
 `maxSessions` counts queued, preparing, running, and waiting sessions across all configured bots. Failed records do not consume the active cap, but they remain visible to their owning chat until replaced or closed.
 
@@ -83,7 +83,7 @@ Use both lists for a private bot. `allowedUserIds` controls who can trigger work
 
 A bot sees only `allowedProjectIds`. If that field is omitted, it sees every configured project. A sole allowed project is selected automatically; otherwise a chat needs `defaultProjectId` or an explicit `/use_<project>` preference before `/new`.
 
-Tau registers eight built-in commands plus one `/use_<projectId>` command per visible project. A bot may expose at most 92 projects under Telegram's 100-command limit.
+Tau registers ten built-in commands plus one `/use_<projectId>` command per visible project. A bot may expose at most 90 projects under Telegram's 100-command limit.
 
 ## Project IDs and common fields
 
@@ -236,8 +236,10 @@ The runner's speech-to-text provider is loaded from normal Tau config at runner
 | `/effort_xhigh` | Selects xhigh reasoning for later independent turns. |
 | `/compact` | Runs summary-only manual compaction while the session is idle. |
 | `/interrupt` | Interrupts the active Tau turn. |
+| `/tts_on` | Enables a Gemini-generated voice note after each final assistant response. |
+| `/tts_off` | Disables voice responses. |
 
-Project preferences are scoped to one bot and chat and survive restarts. A changed preference does not switch the active session; `/status` reports the difference.
+Preferences are scoped to one bot and chat and survive restarts, projects, and sessions. A new project choice does not switch the active session; `/status` reports the difference.
 
 In groups, commands must explicitly mention the bot. Accepted forms include:
 
@@ -284,6 +286,8 @@ Mistral is the default provider. Configure credentials in the runner's normal Ta
 
 The environment variable wins for each speech provider. Audio without a usable key produces a user-facing error instead of entering a turn. See [credentials](credentials.md).
 
+`/tts_on` uses `gemini-3.7-flash`, `gemini-3.1-flash-tts-preview`, Despina, the Google key, and runner `ffmpeg` with Opus. Source and rewritten text each allow 10,000 Unicode characters; audio allows 32 MiB. Rewrite and job timeouts are one and five minutes. Jobs are ephemeral. Failure sends `voice response failed. please try again.` without affecting text; details stay in logs.
+
 ## Command client tools
 
 Each Telegram session advertises the configured command client tools selected by normal Tau configuration for its prepared workspace. Global `clientTools` definitions provide executable behavior, while the workspace's most-specific `enabledClientTools` value selects an exact subset. An empty list disables all configured client tools for that workspace.
@@ -300,7 +304,7 @@ If a referenced repository workspace is missing, Tau reconstructs it from the ca
 
 If the connection is lost after Telegram submits a message, startup checks whether Tau accepted and completed it. Running work remains interruptible until it settles. A confirmed unaccepted message prompts the user to resend it; failed or blocked outcomes remain queued until delivery succeeds.
 
-Tau does not resend earlier assistant messages, notices, or unrelated old outcomes just because the runner restarted. New warning and error notices are delivered after recovery. A restart clears short-lived network retries, but notifications waiting to be delivered remain pending.
+Restart does not replay responses. It clears voice jobs and short-lived retries, but pending notifications remain.
 
 If a failed session still has unresolved submitted work, Tau can reconnect to determine the outcome. Other failed sessions remain visible with their original diagnostic until the owning chat replaces or closes them. Do not edit runner state files to force recovery.
 

package/dist/core/static/tau_docs/tools.md

@@ -91,7 +91,7 @@ Tau starts Bash with `-lc` and the execution environment's `HOME`. A login shell
 
 There is no TTY and assistant `bash` calls have no stdin. Commands that prompt, open an interactive editor, or require terminal control will hang until timeout or fail. Use non-interactive flags and pass a `workingDirectory` rather than relying on a previous `cd`.
 
-Tau forces Git into non-interactive mode: terminal prompts and askpass interaction are disabled, editors are replaced, pagers are disabled, and SSH uses batch mode. Authentication therefore needs to be available non-interactively.
+Tau sets `NO_COLOR=1`, `FORCE_COLOR=0`, `TERM=dumb`, and `PAGER=cat` for predictable non-interactive command output. It also forces Git into non-interactive mode: terminal prompts and askpass interaction are disabled, editors are replaced, pagers are disabled, and SSH uses batch mode. These fixed values override inherited and execution-environment values after login startup. A command can still assign its own environment explicitly. Authentication therefore needs to be available non-interactively.
 
 The default timeout is 60 seconds. Tau captures at most 1 MiB of merged stdout and stderr, preserving the tail when raw capture overflows. The default model-facing result limit is roughly 8,192 estimated tokens. When output exceeds it, Tau returns a roughly 2,048-token middle preview and a gating notice. The command has already run and its side effects have already happened.
 

package/dist/core/static/tau_docs/troubleshooting.md

@@ -189,8 +189,6 @@ Every Tau command uses a fresh non-interactive login Bash in the execution envir
 
 Use automation-safe command flags. Configure credentials before invocation, set Git and SSH up for noninteractive access, and avoid editors or tools that require terminal control. Shell aliases, variables, `cd`, and functions do not persist between calls, so pass `workingDirectory` or use a complete command each time.
 
-For stdio or SSH attachment, stdout from `tau rpc` is protocol-only. A login banner or wrapper message on stdout can look like malformed JSON, an unsupported message, or a timeout waiting for the ready message. Remove it or send diagnostics to stderr. Running the remote command directly can reveal startup diagnostics, but do not copy protocol output or secrets into reports.
-
 Local command sanitization removes inherited credential-shaped variable names. If a target command needs authentication, use the tool's own secure noninteractive credential mechanism rather than broad environment forwarding. Hosted targets use their own environment.
 
 ## WebSocket attachment is unauthorized or unsafe
@@ -219,15 +217,13 @@ Changing a resolver definition or credential requires a host restart. `/reload`
 
 Without `--session` or `--new`, attach needs a TTY for its selector. In automation, pass one explicitly. Normal local startup `--persona` flags are not attach options; choose the host default for new sessions or switch the attached session with `/persona:<id>` while idle.
 
-If an SSH attach closes when the TUI exits, that is expected: the attachment owns its one-shot `tau rpc` host. Use `tau serve` when work must continue after disconnect. See [remote sessions](remote-sessions.md).
-
 ## A session is missing, interrupted, or will not recover
 
 A selector shows only sessions this host can load and restore. Confirm its machine, OS user, home, Tau version, resolver configuration, and target still match the creator. Another user's `~/.config/tau/sessions` is a different store. Restore missing bridge/API definitions, credentials, local directory, sandbox, or Sprite. Never edit session JSON to substitute a target or `cwd`.
 
 Recovery returns idle, aborts unfinished turns, cancels running maintenance, removes live subagents, and blocks an active goal. Review the last assistant and tools, then safely check `!!pwd` and `!!git status --short`. Resume a goal only after understanding the stop. Retry continues current history without rerunning completed tools automatically.
 
-A WebSocket client disconnect does not interrupt the long-running host; server shutdown does. Closing a local TUI or stdio attachment shuts down its owned host, so interrupted recovery is expected.
+A WebSocket client disconnect does not interrupt the long-running host; server shutdown does. Closing a local TUI shuts down its owned host, so interrupted recovery is expected.
 
 A newer storage version requires that Tau version or later. For invalid JSON, snapshot, or ID errors, preserve the file and exact error, stop competing hosts, and investigate normal recovery. Do not edit or delete it first. Newer Tau migrates supported older documents automatically.
 
@@ -283,6 +279,8 @@ Distinguish download, materialization, format, and transcription errors. The rep
 
 Successful audio turns echo `transcribed: …` before submission. In groups, non-triggering audio can be buffered for later mentioned context. If that is inappropriate for the chat, narrow `allowedChatIds` or avoid enabling the group.
 
+Outgoing `/tts_on` voice responses always need `GEMINI_API_KEY` or `apiKeys.google`, even when incoming audio uses Mistral. They also require runner-side `ffmpeg` with Opus support. A generation or delivery failure sends `voice response failed. please try again.` while detailed diagnostics remain in runner logs. The original text response remains delivered.
+
 ## Telegram replies or notifications are delayed or missing
 
 Each outbound chunk has a deadline and retries retryable failures twice. Telegram `retry_after` is honored, and per-chat ordering holds later notifications. Large replies are split, so only a later chunk may have failed.

package/dist/core/static/tau_docs/tui.md

@@ -17,7 +17,7 @@ Tau creates a local execution environment rooted at that directory. A startup pe
 tau --persona gpt-5.6-sol-coder:high
 ```
 
-`-p` is the short form. `--no-agent-context-files` omits `AGENTS.md` and explicitly configured context files, and `--no-client-tools` prevents the TUI from advertising its built-in and configured [client tools](client-tools.md). On macOS, `--caffeinated` runs `caffeinate -i` while assistant turns are active. It is a no-op on Linux and is not an option for `tau attach`.
+`-p` is the short form. `--no-agent-context-files` omits `AGENTS.md` and explicitly configured context files, and `--no-client-tools` prevents the TUI from advertising its built-in and configured [client tools](client-tools.md).
 
 Piped stdin becomes the first message in a local TUI session:
 
@@ -191,7 +191,7 @@ The session host supplies ephemeral review agents, while the local tool owns its
 
 The TUI also advertises diff review as a client tool unless `--no-client-tools` is set. Manual `/diff` remains a TUI command even when model-facing client tools are disabled. See [client tools](client-tools.md) for attachment and multiple-client implications.
 
-## Use speech and keep-awake support
+## Use speech
 
 `/listen` and Ctrl+Y are currently macOS-only. Recording uses local `ffmpeg` with the AVFoundation audio input and stops when Ctrl+Y is pressed again, when Escape is pressed, or after five minutes. The transcript is inserted at the cursor for review and is not submitted automatically.
 
@@ -203,9 +203,7 @@ brew install ffmpeg
 
 Mistral is the default and needs `MISTRAL_API_KEY` or `apiKeys.mistral`. Set `speechToText.provider` to `gemini` to use `GEMINI_API_KEY` or `apiKeys.google` instead. These settings and credentials are read by the TUI process, including during remote attachment.
 
-`/speak` is also macOS-only. It rewrites the last assistant response for speech, generates audio with Gemini, and plays it through the local `afplay` command. It requires `GEMINI_API_KEY` or `apiKeys.google`, runs only while the session is idle, and can be stopped with Escape.
-
-`tau --caffeinated` keeps macOS awake only during active assistant turns in that local TUI. It does not keep a remote host awake, and it is not accepted by `tau attach`.
+`/speak` is also macOS-only. It rewrites the last assistant response for speech, generates audio with Gemini, and plays it through the local `afplay` command. It requires `GEMINI_API_KEY` or `apiKeys.google`, runs only while the session is idle, and can be stopped with Escape. Speech source and rewritten text are limited to 10,000 Unicode characters, and generation stops after 32 MiB of raw audio.
 
 ## Reload the right component
 
@@ -221,4 +219,4 @@ Restart the TUI instead after changing client-owned themes, the diff launcher, s
 - `/prompt:<id>` fills the editor but does not submit it.
 - `/diff` records returned feedback but does not automatically ask the assistant to act on it.
 - `/reload` does not reload client themes or client tools.
-- Exiting a WebSocket attachment does not delete or necessarily stop the hosted session. Exiting a local TUI or one-shot stdio attachment also shuts down its owned host, so active work is interrupted and persisted before recovery where possible.
+- Exiting a WebSocket attachment does not delete or necessarily stop the hosted session. Exiting a local TUI shuts down its owned host, so active work is interrupted and persisted before recovery where possible.