@markusylisiurunen/tau 0.3.77 → 0.3.79

package/dist/core/static/tau_docs/config-reference.md

@@ -8,15 +8,14 @@ Read [configuration](configuration.md) first for discovery and precedence. In th
 
 These are defaults built into this Tau version, not a dump of the effective configuration:
 
-| Behavior | Shipped default |
-| --- | --- |
-| Default persona | `sonnet-5.5-coder` |
-| Default TUI theme | `gold` |
-| Built-in personas | Enabled |
-| Automatic compaction | `{ "enabled": true, "reserveTokens": 16384, "keepRecentTokens": 20000 }` |
-| Speech-to-text provider when unset | `openai` |
-| Built-in diff tool code theme | `github-dark-dimmed` |
-| Command client tool timeout when unset | `60000` ms |
+| Behavior                               | Shipped default      |
+| -------------------------------------- | -------------------- |
+| Default persona                        | `sonnet-5.5-coder`   |
+| Default TUI theme                      | `gold`               |
+| Built-in personas                      | Enabled              |
+| Speech-to-text provider when unset     | `openai`             |
+| Built-in diff tool code theme          | `github-dark-dimmed` |
+| Command client tool timeout when unset | `60000` ms           |
 
 Project and global content can change which persona ids are available. A configured default must match an available persona or built-in theme; otherwise Tau reports a warning.
 
@@ -26,20 +25,17 @@ Project and global content can change which persona ids are available. A configu
 | --- | --- | --- | --- | --- |
 | `apiKeys` | Object of string values | Global, project | Merge by provider id | Host or feature consumer; `/reload` for session runtime keys, process restart for environment changes |
 | `defaultPersona` | Non-empty string | Global, project | Most-specific wins | Session host; new session |
-| `disableBuiltinPersonas` | Boolean | Global, project | Most-specific wins | Session runtime; `/reload` or new session |
-| `speech` | Object with optional `voiceId` | Global, project | Merge by field | TUI client or Telegram runner; process restart |
+| `speech` | Object with optional `voiceId` and `recordingShortcut` | Global, project | Merge by field | TUI client or Telegram runner; process restart |
 | `defaultTheme` | Non-empty string | Global, project | Most-specific wins | TUI client; client restart |
-| `diffTool` | Object | Global, project | Most-specific complete object | TUI client; client restart |
-| `builtInDiffTool` | Object | Global, project | Most-specific complete object | TUI client; client restart |
 | `clientTools` | Array of objects | Global only | One global definition list | Owning client; TUI restart or new Telegram session client |
 | `enabledClientTools` | String array | Project only | Most-specific project list | Owning client; TUI restart or new Telegram session client |
 | `agentContextFiles` | String array | Global, project | Additive, resolved and deduplicated | Execution environment and session host; `/reload` or new session |
 | `subagents` | Object | Global, project | Field-wise, currently one selectable list | Session runtime; `/reload` or new session |
-| `autoCompact` | Object | Global, project | Merge by field over shipped defaults | Session runtime; `/reload` or new session |
 | `modelSystemNotices` | String map | Global, project | Merge by model target | Session runtime; `/reload`, affects later inputs |
 | `flySprites` | Object | Global, project | Merge APIs by id | Host startup; host restart |
 | `nook` | Object | Global, project | Most-specific complete object | Host tool runtime; `/reload` or new session |
 | `history` | Object | Global only | One global object | Host startup; host restart |
+| `mcpServers` | Object keyed by server name | Global and project | Merge names; nearer entry replaces | Host startup; host restart |
 
 Unknown fields are stripped without warnings. Wrong types and invalid known values produce warnings, and Tau continues with valid fields. A field at a forbidden scope is rejected.
 
@@ -59,18 +55,6 @@ Allowed reasoning suffixes are `none`, `minimal`, `low`, `medium`, `high`, `xhig
 
 `defaultPersona` selects a new session when no CLI or session-creation override is supplied. Reloading an existing session retains its current persona id when possible. See [personas](personas.md).
 
-### `disableBuiltinPersonas`
-
-A boolean that removes shipped personas from the loaded persona catalog:
-
-```json
-{
-  "disableBuiltinPersonas": true
-}
-```
-
-The default is `false`. When enabled, at least one valid custom persona must be available or session startup fails. This field does not disable user or project personas.
-
 ### `agentContextFiles`
 
 An array of non-empty paths to additional text files included as project context:
@@ -89,16 +73,16 @@ The startup flag `--no-agent-context-files` disables context injection independe
 
 The top-level subagent configuration currently accepts one optional field:
 
-| Nested field | Type | Contract |
-| --- | --- | --- |
-| `defaultLaunchModels` | String array | Allowlist for launch overrides of the built-in `default` subagent |
+| Nested field   | Type         | Contract                                     |
+| -------------- | ------------ | -------------------------------------------- |
+| `launchModels` | String array | Allowlist for launch overrides for subagents |
 
 Each entry must use `<provider>/<model>:<effort>` and resolve against the merged model catalog:
 
 ```json
 {
   "subagents": {
-    "defaultLaunchModels": [
+    "launchModels": [
       "openai-codex/gpt-6.1-sol:high",
       "anthropic/claude-haiku-4-5:low"
     ]
@@ -106,29 +90,7 @@ Each entry must use `<provider>/<model>:<effort>` and resolve against the merged
 }
 ```
 
-A more-specific list replaces the broader list. Custom subagent definitions belong in persona frontmatter, not this object. See [subagents](subagents.md).
-
-### `autoCompact`
-
-Automatic compaction settings:
-
-| Nested field | Type | Default | Meaning |
-| --- | --- | --- | --- |
-| `enabled` | Boolean | `true` | Whether Tau checks and compacts before model subturns |
-| `reserveTokens` | Positive integer | `16384` | Context reserved below the model's context-window limit |
-| `keepRecentTokens` | Positive integer | `20000` | Target budget for the recent retained tail |
-
-Fields merge independently across levels:
-
-```json
-{
-  "autoCompact": {
-    "reserveTokens": 24000
-  }
-}
-```
-
-The omitted fields retain their broader or shipped values. This setting changes Tau's automatic policy; manual `/compact-all` and `/compact-keep-last` remain available. See [sessions](sessions.md).
+A more-specific list replaces the broader list. The worker’s instructions and tools are inherited from the main persona; custom worker definitions are not supported. See [subagents](subagents.md).
 
 ### `modelSystemNotices`
 
@@ -184,6 +146,18 @@ Controls `/speak` and Telegram `/tts_on` voice selection. Set `voiceId` to a non
 }
 ```
 
+For terminal recording, `recordingShortcut` replaces Ctrl+Y. Its required `key` is a single printable, non-whitespace character, `ctrl+y`, or `f1` through `f12`. Its required `gesture` is `press` or `double-tap`:
+
+```json
+{
+  "speech": {
+    "recordingShortcut": { "key": "§", "gesture": "double-tap" }
+  }
+}
+```
+
+A double tap must arrive within 300 ms. For printable double-tap bindings, an unmatched first tap inserts the character after that delay; another key inserts it immediately before processing the new input. Single-press bindings reserve the character. Bracketed paste never triggers recording. Keyboard auto-repeat can count as repeated taps. Recording shortcuts apply only to the TUI, not Telegram.
+
 Without an override, Tau looks up Maisie (`QtY3JBOUKEB5xzrRfOKc`) before synthesis and tries Caleb (`AaOhDHYJ1XLZk74lXhdE`) only if ElevenLabs reports that Maisie was not found. If neither is available, speech fails. A configured voice is used exclusively: an unavailable custom voice is an error, not a request to use a default.
 
 Voice lookup authentication, permission, rate-limit, and network errors do not trigger fallback. Successful metadata lookup fixes the voice for the entire reply; it does not guarantee synthesis permission. Synthesis failures never switch voices or automatically retry a potentially billable request.
@@ -236,61 +210,53 @@ A global-only remote history target:
 
 Credential precedence is `TAU_HISTORY_API_KEY`, then the variable named by `apiKeyEnv`, then `apiKey`. Configuring an endpoint without an available key prevents the host service from starting. Without `history`, transcript storage and queries remain machine-local. See [history](history.md).
 
-## TUI presentation and diff review
+### `mcpServers`
 
-### `defaultTheme`
-
-The exact, case-sensitive id of a built-in theme. The shipped default is `gold`:
+MCP servers are resolved at host startup from the global `~/.config/tau/config.json` and ancestor/project `.tau/config.json` layers for the host's launch directory. Server names accumulate across layers; a nearer definition replaces the entire same-named entry, including credentials. Use `enabled: false` to disable an inherited server. All sessions on that host share the resolved definitions, and subagents inherit their parent's access even in another working directory. Session execution-environment configuration does not contribute servers. Restart the host after changing definitions or credentials; `/reload` does not reload servers.
 
 ```json
 {
-  "defaultTheme": "azure"
+  "mcpServers": {
+    "issues": {
+      "type": "stdio",
+      "command": "uvx",
+      "args": ["example-mcp-server"],
+      "env": { "API_TOKEN": "${ISSUES_TOKEN}" }
+    },
+    "remote": {
+      "type": "http",
+      "url": "https://example.com/mcp",
+      "headers": { "Authorization": "Bearer ${REMOTE_MCP_TOKEN}" }
+    }
+  }
 }
 ```
 
-The attached TUI uses its client-local configuration. `/theme:<id>` changes the current client only and is not persisted into the session. See [TUI](tui.md).
+Server names use letters, digits, `_`, and `-`. Every entry requires an explicit `type`:
 
-### `diffTool`
+- `stdio`: requires a non-empty `command`; accepts optional literal `args`, `cwd`, and string-valued `env`.
+- `http`: requires an HTTP(S) `url` without embedded username/password; accepts optional string-valued `headers`. This is streamable HTTP, not the legacy SSE transport.
+- Both accept `enabled` (default `true`), `timeoutMs` for tool calls and resource reads (integer from 1 to 900,000, default 300,000), and `discoveryTimeoutMs` for connection startup and discovery requests (integer from 1 to 60,000, default 30,000). The outer MCP code-mode program has a 15-minute deadline. All calls remain interruptible.
 
-A custom client-local diff-review launcher:
+Stdio executables run directly without a shell. Bare commands resolve through the host's `PATH`. Commands containing `/` and relative `cwd` values resolve from the directory owning the defining config layer; `~/` resolves from host home. An omitted `cwd` defaults to the defining layer's directory. Arguments are literal: Tau does not interpolate them or expand shell syntax.
 
-| Nested field | Type | Required | Contract |
-| --- | --- | --- | --- |
-| `command` | Non-empty string | Yes | Executable name or path |
-| `args` | String array | No | Arguments passed to the executable |
-| `env` | Object of string values | No | Extra environment entries for the tool process |
+Values in `env` and `headers` can reference host environment variables with `${NAME}`. Missing variables fail connection setup. Command substitution is not supported. Stdio servers inherit the host environment, with `env` overriding matching names. Keep secrets in the host environment rather than committing them to JSON.
 
-```json
-{
-  "diffTool": {
-    "command": "./tools/review-ui",
-    "args": ["--browser", "firefox"],
-    "env": {
-      "REVIEW_LOG_LEVEL": "warn"
-    }
-  }
-}
-```
+Invalid entries are skipped with diagnostics while valid siblings remain configured. OAuth sign-in, MCP prompts, subscriptions, elicitation, sampling, execution-environment servers, and user approval dialogs are not supported. See [tools](tools.md#mcp) for discovery, calls, and result handling.
 
-The most-specific complete object wins. A relative command containing `/` resolves from the declaring level root; a bare command resolves through client `PATH`. The TUI launches this process on the client machine. If this field is absent, the TUI uses Tau's built-in diff tool. See [TUI](tui.md) and [client tools](client-tools.md) for the broader client-local distinction.
+## TUI presentation and diff review
 
-### `builtInDiffTool`
+### `defaultTheme`
 
-Settings for the built-in fallback diff tool:
+The exact, case-sensitive id of a built-in theme. The shipped default is `gold`:
 
 ```json
 {
-  "builtInDiffTool": {
-    "codeTheme": "nord"
-  }
+  "defaultTheme": "azure"
 }
 ```
 
-`codeTheme` defaults to `github-dark-dimmed`. Supported values are:
-
-`andromeeda`, `aurora-x`, `ayu-dark`, `ayu-mirage`, `catppuccin-frappe`, `catppuccin-macchiato`, `catppuccin-mocha`, `dark-plus`, `dracula`, `dracula-soft`, `everforest-dark`, `github-dark`, `github-dark-default`, `github-dark-dimmed`, `github-dark-high-contrast`, `gruvbox-dark-hard`, `gruvbox-dark-medium`, `gruvbox-dark-soft`, `horizon`, `horizon-bright`, `houston`, `kanagawa-dragon`, `kanagawa-wave`, `laserwave`, `material-theme`, `material-theme-darker`, `material-theme-ocean`, `material-theme-palenight`, `min-dark`, `monokai`, `night-owl`, `nord`, `one-dark-pro`, `plastic`, `poimandres`, `red`, `rose-pine`, `rose-pine-moon`, `slack-dark`, `solarized-dark`, `synthwave-84`, `tokyo-night`, `vesper`, `vitesse-black`, and `vitesse-dark`.
-
-This object does not configure a custom `diffTool` process.
+The attached TUI uses its client-local configuration. `/theme:<id>` changes the current client only and is not persisted into the session. See [TUI](tui.md).
 
 ## Command client tools
 

package/dist/core/static/tau_docs/configuration.md

@@ -64,12 +64,10 @@ Within the project, the effective default persona is `gpt-6.1-sol-coder:high`.
 A few fields intentionally use other rules:
 
 - `apiKeys` merges by provider id. A more-specific key replaces only the same provider's value.
-- `autoCompact` merges by field on top of shipped defaults.
 - `modelSystemNotices` merges by normalized `<provider>/<model>` key.
 - `flySprites.apis` merges by API id. A more-specific API replaces the complete API entry with that id.
 - `agentContextFiles` is additive across levels, resolves each entry at its owning level, and removes duplicate resolved paths while preserving order.
-- `diffTool` and `builtInDiffTool` select the complete object from the most-specific level that defines them.
-- `subagents.defaultLaunchModels` selects the most-specific list.
+- `subagents.launchModels` selects the most-specific list.
 - `clientTools` is defined only at global scope. `enabledClientTools` at the most-specific project level is an exact selection from those definitions.
 - `history` is accepted only at global scope.
 
@@ -89,22 +87,18 @@ Relative path bases belong to the level that declares the value:
 
 - Global `agentContextFiles` entries resolve from home.
 - Project `agentContextFiles` entries resolve from the directory containing `.tau`.
-- A relative `diffTool.command` containing a slash resolves from the same level root.
 - A global `clientTools[].command` containing a slash resolves from home.
-- A bare command such as `review-ui` is left bare and resolves through the owning process's `PATH`.
+- A bare command such as `git` is left bare and resolves through the owning process's `PATH`.
 
 For example, in `/home/ada/work/ledger/.tau/config.json`:
 
 ```json
 {
-  "agentContextFiles": ["docs/AI_GUIDE.md"],
-  "diffTool": {
-    "command": "./tools/review-ui"
-  }
+  "agentContextFiles": ["docs/AI_GUIDE.md"]
 }
 ```
 
-Tau resolves the paths as `/home/ada/work/ledger/docs/AI_GUIDE.md` and `/home/ada/work/ledger/tools/review-ui`. In an attached session, `diffTool` used by the TUI comes from the client-local load, so this resolved command is a client path.
+Tau resolves the path as `/home/ada/work/ledger/docs/AI_GUIDE.md`.
 
 Other strings that happen to contain paths are not automatically rebased unless their field contract says so. In particular, hosted execution-environment `home` values are passed as configured.
 
@@ -158,7 +152,6 @@ Never verify a secret by printing the full config or environment into a shared t
 Tau loads startup configuration and content before opening the TUI. Restart the local TUI or `tau attach` to apply client-owned changes such as:
 
 - `defaultTheme`
-- `diffTool` and `builtInDiffTool`
 - `clientTools` and `enabledClientTools`
 - client environment variables
 

package/dist/core/static/tau_docs/node-sdk.md

@@ -345,7 +345,7 @@ The handler receives `sessionId`, owning `agentId`, `callId`, an `AbortSignal`,
 
 `describe` is optional. When present, the SDK calls it with the arguments and a reduced context containing `sessionId`, `agentId`, `callId`, and `signal` before acknowledgement. This context deliberately has no execution-environment facade. It may return a partial running presentation containing `subject`, `subjectWrap`, `details`, or `metadata`. Tau owns action and operation, fills every omitted field, and acknowledges the resolved presentation before calling `execute`.
 
-The execution result may independently include the same partial shape for the terminal card. Return a string or `{ content, presentation? }` for success, or `{ ok: false, error, presentation? }` for a structured failure. Omitted presentation fields use Tau's terminal defaults; empty detail or metadata arrays suppress those defaults. If `describe` throws, the SDK reports a preparation error without calling `execute`. If the client never returns a result because of cancellation, timeout, detach, or another failure, the host produces a complete fallback presentation.
+The execution result may independently include the same partial shape for the terminal card. Return a string or `{ content, presentation? }` for success, or `{ ok: false, error, presentation? }` for a structured failure. Successful `content` may be a string or an ordered array of text/image blocks. Strings are delivered as one text block. Omitted presentation fields use Tau's terminal defaults; empty detail or metadata arrays suppress those defaults. If `describe` throws, the SDK reports a preparation error without calling `execute`. If the client never returns a result because of cancellation, timeout, detach, or another failure, the host produces a complete fallback presentation.
 
 Tau preserves every explicit presentation field up to the protocol safety limits; it does not apply display truncation or normalize client text. `truncateTauClientToolText` provides optional caller-controlled line, character, and head or middle truncation. Use its result directly for a subject. For a block of detail text, split the result on `\n` and map each line to one `details` entry; use `maxLines: 1` when assigning it directly to one detail or metadata entry. The helper shapes text but does not replace protocol validation. The SDK aborts handlers on host cancellation, client close, or terminal transport failure. `client.close()` waits for active handlers to settle.
 
@@ -375,7 +375,9 @@ const tickets = createTauCodeModeClientTool({
 });
 ```
 
-Pass `tickets` in `clientTools`. Generated code receives the declared API namespace, progressively disclosed `docs`, console output, live `Date` and `Math`, and agent-scoped scratch files when invoked as a client tool. API calls cross a bounded JSON bridge. The submitted code appears, concisely truncated and character-wrapped, as the running and terminal tool-card subject. The tool description remains explicit caller input; the builder is optional.
+Pass `tickets` in `clientTools`. Generated code receives the declared API namespace, progressively disclosed `docs`, console output, the asynchronous `image(block)` output helper, live `Date` and `Math`, and agent-scoped scratch files when invoked as a client tool. API calls cross a bounded JSON bridge. The submitted code appears, concisely truncated and character-wrapped, as the running and terminal tool-card subject. The tool description remains explicit caller input; the builder is optional.
+
+Use `await image({ type: "image", data, mimeType })` to forward a base64 image. Successful code-mode results contain an ordered `content` array of text/image blocks. SDK client tools preserve that order: adjacent console writes form one text block, and each awaited image separates the preceding and following text. The helper validates and prepares JPEG, PNG, or WebP images outside the sandbox, creates no files, and shares the limits described in [tools](tools.md).
 
 The SDK also exports `executeTauCodeMode` for standalone execution. The separate `@markusylisiurunen/tau/code-mode` entry point additionally exports file-capability types, `runTauClientToolCommand`, and `runTauCodeModeCommand` for command-backed tools. Use the helpers instead of implementing their framing manually.
 

package/dist/core/static/tau_docs/ownership-and-scope.md

@@ -16,6 +16,8 @@ The **host** creates, observes, persists, and recovers sessions. It owns model c
 
 The host's home owns data such as session snapshots, authentication storage, usage logs, and the local history database. Use Tau commands and session operations to manage these stores rather than editing their files directly.
 
+MCP connections are host-owned. Configure servers on the host; stdio servers run there, with host credentials and host resource access, not in the session execution environment.
+
 The intrinsic `tau_docs` tool is also host-owned. It reads documentation packaged with the installed host version.
 
 ### Execution environment
@@ -57,7 +59,7 @@ A Fly Sprite can place the execution environment on another target while the hos
 | Session snapshots | Host home | Local defaults live under the host's Tau config directory. Do not edit session files. |
 | Local transcript history and remote history outbox | Host home | History follows the host, not an attached TUI or execution target. |
 | Terminal theme and `/theme` | TUI client | An attached client selects from Tau’s built-in themes. Themes are not session state. |
-| `/diff` process | TUI client | `diffTool.command` must exist on the client machine. Repository capture still runs through the session execution environment. |
+| `/diff` process | TUI client | Tau’s built-in browser tool runs on the client machine. Repository capture still runs through the session execution environment. |
 | Configured command client tools | Owning client | Commands and their environment are client-local; their execution-environment facade reaches the session target explicitly. |
 | `/listen` and `/speak` capture or playback | TUI client | Required programs, devices, and media credentials belong on the client machine. |
 | Host execution-environment targets | Host startup | Fly Sprite API definitions must be available to the host before it accepts sessions using them. |
@@ -84,7 +86,7 @@ tau attach --new --cwd /srv/ledger ws://devbox.example:8787
 
 The path `/srv/ledger` is interpreted by the host and its local execution environment. Project personas and `.tau/config.json` are read from `/srv/ledger` and its ancestors on `devbox.example`. The laptop's current directory does not influence that session runtime.
 
-The laptop still loads its own theme, `diffTool`, and command client tools before attaching. If `/diff` launches `review-ui`, that executable must exist on the laptop. Git snapshot commands for the review run through the session and therefore see `/srv/ledger` on the execution environment.
+The laptop still loads its own theme and command client tools before attaching. `/diff` launches Tau’s built-in browser tool on the laptop. Git snapshot commands for the review run through the session and therefore see `/srv/ledger` on the execution environment.
 
 If the selected persona needs a provider credential, the host on `devbox.example` makes the model call. Export the provider environment variable for `tau serve` there, or make the appropriate runtime configuration available to that host. Setting it only in the laptop shell does not authenticate the remote host.
 

package/dist/core/static/tau_docs/personas.md

@@ -1,12 +1,12 @@
 # Personas
 
-A persona is Tau's complete model-facing working profile. It chooses a provider and model, supplies the base system prompt, sets reasoning and service behavior, and selects tools, skills, and subagents. Changing persona changes how future turns run without creating a new session.
+A persona is Tau's complete model-facing working profile. It chooses a provider and model, supplies the base system prompt, sets reasoning and service behavior, and selects tools and skills. Changing persona changes how future turns run without creating a new session.
 
 Tau ships generated built-in personas and discovers custom persona Markdown from the execution environment. The effective list is version-specific and scope-specific, so inspect the current catalog rather than relying on a memorized list of names.
 
 ## Built-in and effective personas
 
-Built-in personas are generated from Tau's current model catalog. Most model families have separate chat and coder variants; some families expose only the variants Tau supports. Built-ins carry Tau-maintained prompts, defaults, tool selections, skills, and the built-in `default` subagent.
+Built-in personas are generated from Tau's current model catalog. Most model families have separate chat and coder variants; some families expose only the variants Tau supports. Built-ins carry Tau-maintained prompts, defaults, tool selections, skills, and subagent supervision tools.
 
 The Opus 5.5 chat and coder personas are available only when `anthropic/claude-opus-5-5` is present in the effective model catalog. The Sonnet 5.5 variants (`sonnet-5.5-chat` and `sonnet-5.5-coder`) likewise require `anthropic/claude-sonnet-5-5`.
 
@@ -16,7 +16,7 @@ All built-in personas default to medium reasoning. The startup default is `sonne
 
 After a remote catalog refresh, `/reload` adopts the updated catalog for an existing session.
 
-Set `disableBuiltinPersonas: true` in `config.json` to omit built-ins from the effective catalog. Custom personas can also replace a built-in by using the same ID. A shipped built-in is therefore not necessarily available in a particular session.
+Built-in personas are always included in the catalog. Custom personas can replace a built-in by using the same ID.
 
 Use one of these to inspect the current effective list:
 
@@ -67,14 +67,6 @@ tools:
   - view_image
   - web
   - history
-subagents:
-  default: false
-  verifier:
-    description: Verify release state independently. Trigger: balanced.
-    systemPrompt: Verify the requested release state and report concrete blockers.
-    tools:
-      - bash
-      - history
 ---
 
 Work as a release engineer. Inspect repository policy before changing release state.
@@ -104,16 +96,15 @@ The frontmatter must be a YAML object between valid delimiters. Unknown fields a
 | `allowedReasoningLevels` | Array of reasoning efforts offered by the TUI selector. |
 | `skills` | `"*"`, a list of discovered skill names, or `[]`. |
 | `tools` | Explicit list of persona-controlled tools. |
-| `subagents` | Map of enabled subagent definitions. |
 
-If a standalone custom persona omits `skills`, Tau selects all discovered skills with `"*"`. If it omits `subagents`, Tau enables the built-in `default` subagent. Tool defaults then include the ordinary host tools plus subagent supervision tools. See [skills](skills.md) and [subagents](subagents.md) for those contracts.
+If a standalone custom persona omits `skills`, Tau selects all discovered skills with `"*"`. If it omits `tools`, Tau enables the ordinary host tools plus subagent supervision tools. An explicit `tools` list without `spawn_agent` prevents subagent launches. See [skills](skills.md) and [subagents](subagents.md) for those contracts.
 
 The persona-controlled tool names are:
 
-- `bash`, `write`, `edit`, `view_image`, `web`, `nook`, and `history`;
+- `bash`, `write`, `edit`, `view_image`, `web`, `nook`, `history`, and `mcp`;
 - `spawn_agent`, `send_input_to_agent`, `wait_for_agents`, `list_agents`, and `interrupt_agent`.
 
-An explicit `tools` array replaces defaults. Names are normalized to lowercase, duplicates are removed, and unknown names reject the persona. `tools: []` leaves the persona without these persona-controlled tools. Some host capabilities, such as goal management, are supplied independently of this list. Listing `nook` does not make it usable without effective Nook configuration. [Tools](tools.md) explains eligibility and ownership.
+An explicit `tools` array replaces defaults. Names are normalized to lowercase, duplicates are removed, and unknown names reject the persona. `tools: []` leaves the persona without these persona-controlled tools. Some host capabilities, such as goal management, are supplied independently of this list. Listing `nook` does not make it usable without effective Nook configuration. Listing `mcp` requires enabled MCP servers configured on the host. [Tools](tools.md) explains eligibility and ownership.
 
 ## Extending a built-in
 
@@ -135,10 +126,8 @@ Important boundaries are:
 
 - `extends` resolves shipped built-ins, not another custom persona.
 - Lookup of the built-in ID is case-insensitive.
-- It remains available as an inheritance base even when `disableBuiltinPersonas` hides built-ins from the effective catalog.
 - A non-empty Markdown body replaces the inherited base prompt.
 - Explicit `skills` or `tools` replaces the inherited selection.
-- Explicit `subagents` builds a new subagent map rather than merging custom entries into the inherited map. Unless that map contains `default: false`, Tau adds the built-in `default` subagent.
 - `reasoning` and `serviceTier` override their individual inherited settings; omitted settings remain inherited.
 
 Extending a built-in is useful when Tau's maintained behavior is the desired base. A standalone body is more stable when the persona must not change as Tau updates its built-in prompts.
@@ -187,7 +176,7 @@ Run `/reload` while the TUI session is idle after editing personas, `models.json
 
 If the current persona ID still exists, Tau applies its newly loaded definition. This can reset runtime settings such as reasoning or service tier to the definition's values. If the ID disappeared, Tau selects the first effective persona. Existing session messages remain; changing a persona does not rewrite prior model-facing history.
 
-A reload does not alter a turn already in progress, and the TUI refuses the operation while one is running. Existing live subagent threads retain the runtime with which they were created; newly spawned subagents use the reloaded persona definition. See [subagents](subagents.md).
+A reload does not alter a turn already in progress, and the TUI refuses the operation while one is running. Existing live subagent threads retain the runtime with which they were created; newly spawned subagents inherit the reloaded persona. See [subagents](subagents.md).
 
 ## Validation and common mistakes
 
@@ -200,8 +189,6 @@ An invalid persona is skipped and reported as a configuration warning. Other val
 - an `extends` target that is not a shipped built-in;
 - an invalid reasoning effort or service tier;
 - `skills` that is neither `"*"` nor a string list, or contains a blank entry;
-- an unknown persona tool;
-- an invalid subagent name, missing custom `systemPrompt`, unsupported subagent tool, or invalid launch model; and
-- attempting to override the built-in `default` subagent instead of using `default: false`.
+- an unknown persona tool.
 
 `/reload` surfaces warning paths directly in the transcript. For a new local TUI session, `tau --debug --persona <id>` shows the selected model, settings, skills, subagents, tools, and complete effective prompt. If a remote edit appears to have no effect, confirm the session execution environment and `cwd` before changing another copy of the file. [Troubleshooting](troubleshooting.md) covers that check in more detail.

package/dist/core/static/tau_docs/prompts-and-project-context.md

@@ -149,7 +149,7 @@ The alternate directory controls:
 - target applicable `AGENTS.md` and `agentContextFiles`,
 - target-discovered skills filtered by the parent persona.
 
-The parent session remains the source of truth for the selected persona, subagent definition, model catalog, model settings, and tool policy. Tau filters skills discovered at the alternate directory through the parent persona's skill selection. It does not replace the source persona with a persona found in the target directory. See [subagents](subagents.md) for the full launch contract.
+The parent session remains the source of truth for the selected persona, model catalog, model settings, and tool policy. Tau filters skills discovered at the alternate directory through the parent persona's skill selection. It does not replace the source persona with a persona found in the target directory. See [subagents](subagents.md) for the full launch contract.
 
 ## Leading hidden system blocks
 

package/dist/core/static/tau_docs/remote-sessions.md

@@ -150,7 +150,7 @@ An attached session spans three logical machines even when two happen to share o
 - command execution, platform, PATH, and runtime dependencies
 - automatic-compaction archives and other target-side temporary files
 
-This is why changing a host’s theme selection does not affect a remote TUI, why `!git status` runs against the execution environment, and why a custom diff application opens on the attaching machine. [Ownership and scope](ownership-and-scope.md) applies the same model across Tau.
+This is why changing a host’s theme selection does not affect a remote TUI, why `!git status` runs against the execution environment, and why the built-in diff review tool opens on the attaching machine. [Ownership and scope](ownership-and-scope.md) applies the same model across Tau.
 
 ## Reload or restart the correct process
 
@@ -161,7 +161,7 @@ Different changes have different owners:
 | Project config, model overlays, personas, prompts, skills, or AGENTS.md in the execution environment | Wait for idle, then run `/reload`. |
 | Effective model `apiKeys` in execution-environment or session configuration | Wait for idle, then run `/reload`; new sessions also resolve the current values. |
 | Managed Codex auth changed with `tau auth` | No host restart; auth storage is read again on later credential resolutions. |
-| Attaching themes, diff launcher, speech config, or configured client tools | Restart `tau attach`. |
+| Attaching themes, speech config, or configured client tools | Restart `tau attach`. |
 | Host process environment variables, history target, WebSocket listener, Fly API target, or host startup flags | Restart `tau serve`. |
 | Host Tau package, built-in tools, protocol, session recovery code, or built-in documentation | Upgrade and restart the host. |
 | TUI package, keybindings, rendering, local speech, or client-tool implementation | Upgrade and restart the attaching client. |

package/dist/core/static/tau_docs/security.md

@@ -26,7 +26,7 @@ The execution environment supplies more than source files. Tau can load project
 
 A repository checkout is therefore part of Tau's trust boundary. Before using it with meaningful credentials or write access, inspect relevant `.tau/`, `.agents/`, and `AGENTS.md` content, including nearer nested levels. Pay particular attention to:
 
-- persona system prompts, tool lists, subagent definitions, and model launch allowlists;
+- persona system prompts, tool lists, and model launch allowlists;
 - skill instructions and any scripts they direct the agent to run;
 - model overlays that replace endpoints, headers, capabilities, or token limits;
 - project configuration that supplies API keys, Nook targets, model notices, or hosted-environment definitions;
@@ -100,11 +100,11 @@ Before enabling one:
 
 A project `enabledClientTools` list is permission to select an already trusted global definition. Unknown selected names are ignored, so verify effective advertisement after changes. Start an untrusted project with `--no-client-tools` until its selection has been reviewed.
 
-The TUI's diff launcher is also a client-local process. A custom `diffTool.command` and its configured environment should be treated as trusted code.
+The TUI's built-in diff review tool is also a client-local process.
 
 ## Use code mode as a capability boundary
 
-The generated JavaScript used by `web`, `history`, `nook`, and code-mode client tools runs in Tau's bounded worker runtime. It receives only a declared API, `docs`, console output, live `Date`, `Math.random()`, and, when configured, agent-scoped UTF-8 scratch files. Generated code has no direct imports, process, environment, credentials, timers, `fetch`, or arbitrary network access.
+The generated JavaScript used by `web`, `history`, `nook`, `mcp`, and code-mode client tools runs in Tau's bounded worker runtime. It receives only a declared API, `docs`, console output, the asynchronous `image(block)` output helper, live `Date`, `Math.random()`, and, when configured, agent-scoped UTF-8 scratch files. Generated code has no direct imports, process, environment, credentials, timers, `fetch`, or arbitrary network access.
 
 API handlers run outside that worker and retain the authority deliberately exposed by the tool. The boundary therefore limits generated code to declared capabilities, but it does not make an overpowered API safe. Tool authors should validate every argument, expose narrow operations, keep credentials in the parent, enforce cancellation, and avoid returning secrets.
 
@@ -112,6 +112,18 @@ Scratch files live in a private execution-environment temporary directory derive
 
 The `history` code-mode API is read-only, but it can see transcripts across repositories and execution environments in the configured collection. Its agent policy requires a direct user or active-instruction request before use. That policy does not replace access control on the history service.
 
+## Trust MCP servers
+
+MCP server definitions come from the host launch directory's global and ancestor/project configuration layers. Launching a host inside a repository trusts those layers to introduce host commands and use host credentials; there is no approval dialog. MCP capabilities apply to all sessions on that host whose persona allows `mcp`, and their supervised subagents; they are not isolated per repository or client. Session execution-environment configuration cannot introduce servers.
+
+A stdio MCP server is trusted host code. It runs outside the code-mode sandbox with the host account's filesystem and process permissions and full inherited environment, including credentials. Review executables and arguments before configuring them. HTTP servers receive configured headers and the arguments sent to their tools. Use HTTPS for remote services and grant only the access needed.
+
+MCP does not add a confirmation layer. Tools can mutate external systems or host resources immediately. Interrupting a call cannot undo a completed effect, and an unknown outcome does not make retrying a mutation safe. Server descriptions, instructions, annotations, and results are untrusted data. Annotations such as `readOnlyHint` are not enforced permissions.
+
+Stdio shutdown depends on the MCP transport. Descendants that ignore `SIGTERM` can survive when the server process exits first; do not rely on shutdown to contain untrusted server processes.
+
+The execution environment does not sandbox a host-run MCP server. A server that exposes host files or commands gives the agent that host authority even when Bash runs in a remote sandbox. Disable `mcp` in the persona or disable the server if that authority is inappropriate. Connections and credentials stay outside the generated JavaScript, but the configured server remains responsible for what its tools return.
+
 ## Protect remote session transports
 
 `tau serve` binds to loopback by default. Keep that default unless remote network access is required. A WebSocket server without `--auth-token` or `TAU_WS_AUTH_TOKEN` is unauthenticated, and any connected client can observe and mutate hosted sessions.

package/dist/core/static/tau_docs/session-protocol-methods.md

@@ -1,6 +1,6 @@
 # Session protocol method reference
 
-This page defines every request method in protocol version 14. It is the compact wire reference for clients that already understand connection, observation, and delta application from the [session protocol](session-protocol.md).
+This page defines every request method in protocol version 15. It is the compact wire reference for clients that already understand connection, observation, and delta application from the [session protocol](session-protocol.md).
 
 Every request uses `{ version, type: "request", id, method, params }`. Every successful response uses `{ version, type: "response", id, ok: true, result }`. `params` is required even when empty, and unknown object fields are stripped.
 
@@ -47,7 +47,7 @@ params: {
 }
 
 result: {
-  protocolVersion: 14;
+  protocolVersion: 15;
   methods: string[];
   alreadyInitialized: boolean;
 }
@@ -594,7 +594,10 @@ params:
       sessionId: string;
       callId: string;
       ok: true;
-      content: string;
+      content: Array<
+        | { type: "text"; text: string; textSignature?: string }
+        | { type: "image"; data: string; mimeType: "image/jpeg" | "image/png" | "image/webp" }
+      >;
       presentation?: PresentationOverride;
     }
   | {
@@ -607,6 +610,8 @@ params:
 result: { accepted: boolean };
 ```
 
+`content` preserves text/image block order in the model-facing result, snapshots, and deltas. It may be empty and allows at most 1,024 blocks, including at most 16 images with valid padded base64 representing at most 3.5 MiB each. Image bytes are not presentation content.
+
 The optional result presentation applies only to the reported terminal state and is resolved independently from the running presentation. The host preserves explicit fields unchanged after safety validation and supplies canonical display-truncated defaults for omitted fields. If no client result arrives, the host uses a complete fallback for timeout, cancellation, detach, or another terminal outcome.
 
 A successful result is accepted only after the host has accepted the acknowledgement. An error sent before acknowledgement records a preparation failure, such as an error from `describe`, without authorizing execution. An error sent afterward records an execution failure.

package/dist/core/static/tau_docs/session-protocol.md

@@ -18,7 +18,7 @@ The server sends `ready` as its first message:
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "ready",
   "methods": ["initialize", "session.create", "session.list"]
 }
@@ -30,7 +30,7 @@ After `ready`, send `initialize` with non-empty client metadata:
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "request",
   "id": "init-1",
   "method": "initialize",
@@ -50,7 +50,7 @@ Every request has the same envelope:
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "request",
   "id": "req-42",
   "method": "session.snapshot",
@@ -64,7 +64,7 @@ Successful responses echo the request id:
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "response",
   "id": "req-42",
   "ok": true,
@@ -108,6 +108,8 @@ Observation controls delivery, not session ownership. `session.unobserve` stops
 | `tools`, `operations`, `agents` | Mutable semantic state referenced by timeline items or client views. |
 | `facets` | Versioned client-facing metadata. Unknown facet kinds and versions should be ignored. |
 
+`bootstrap.prompt.subagentSystemPrompt` is present when subagent launches are enabled. Each catalog persona has a `subagentLaunchModels` allowlist. Subagent records have task titles and IDs, not worker-type names.
+
 Render active transcript order from `timeline.items`, not by sorting or filtering `messages`. A timeline item either contains a notice or references a message, tool, or operation in the corresponding snapshot collection. Some model-visible messages intentionally have no timeline item.
 
 The timeline has an `epoch`, a per-epoch sequence high-water mark, and ordered items. Successful compaction replaces the active recoverable timeline and advances the epoch. Rewind stays in the same epoch, removes later items, and preserves the sequence high-water mark so sequence numbers are not reused.
@@ -128,7 +130,7 @@ Observed snapshot changes arrive as `session.delta`:
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "session.delta",
   "sessionId": "0195d6e4-4cf9-7f44-a2d8-f8f7f49ee9d3",
   "fromRevision": 8,
@@ -166,7 +168,7 @@ Not all observed state belongs in the recoverable snapshot. Each live channel ha
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "session.pendingUserMessages",
   "sessionId": "...",
   "state": {
@@ -203,7 +205,7 @@ An initialized client that advertised a tool can receive:
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "session.clientTool.call",
   "sessionId": "...",
   "agentId": "main",
@@ -215,7 +217,7 @@ An initialized client that advertised a tool can receive:
 }
 ```
 
-Acknowledge promptly with `session.clientTool.ack`, optionally including a bounded partial running presentation. Begin execution only after the acknowledgement returns `{ accepted: true }`, then send exactly one `session.clientTool.result` with either `{ ok: true, content }` or `{ ok: false, error }` and an optional independent terminal presentation. Both presentation objects may contain `subject`, `subjectWrap`, `details`, and `metadata`; the host owns action and operation and supplies every omitted field. Explicit fields are preserved unchanged after protocol safety validation, while generated defaults use Tau's canonical display truncation. Empty detail or metadata arrays suppress those defaults.
+Acknowledge promptly with `session.clientTool.ack`, optionally including a bounded partial running presentation. Begin execution only after the acknowledgement returns `{ accepted: true }`, then send exactly one `session.clientTool.result` with either `{ ok: true, content }` or `{ ok: false, error }` and an optional independent terminal presentation. Successful `content` is an ordered array of text/image blocks. Both presentation objects may contain `subject`, `subjectWrap`, `details`, and `metadata`; the host owns action and operation and supplies every omitted field. Explicit fields are preserved unchanged after protocol safety validation, while generated defaults use Tau's canonical display truncation. Empty detail or metadata arrays suppress those defaults.
 
 A successful result is rejected until acknowledgement has completed. If preparation itself fails, send an error result before acknowledgement; the host records it as a preparation failure without authorizing execution. If no result arrives because of timeout, cancellation, detach, or another failure, the host renders a complete fallback terminal presentation. The result method returns `{ accepted: boolean }`; `false` means the message is invalid for the call's current state or the call is no longer waiting for it.
 
@@ -227,7 +229,7 @@ Error responses use `ok: false`:
 
 ```json
 {
-  "version": 14,
+  "version": 15,
   "type": "response",
   "id": "req-42",
   "ok": false,