@markusylisiurunen/tau 0.3.91 → 0.3.93

package/dist/core/static/tau_docs/config-reference.md

@@ -30,7 +30,6 @@ Project and global content can change which persona ids exist. A configured defa
 | `subagents` | Object | Global, project | Most-specific `launchModels` list | Session runtime; `/reload` or new session |
 | `modelSystemNotices` | String map | Global, project | Merge by model target | Session runtime; `/reload`, affects later inputs |
 | `flySprites` | Object | Global, project | Merge connection fields | Host startup; host restart |
-| `nook` | Object | Global, project | Most-specific complete object | Host tool runtime; `/reload` or new session |
 | `history` | Object | Global only | One global object | Host startup; host restart |
 | `mcpServers` | Object keyed by server name | Global and project | Merge names; nearer entry replaces | Host startup; host restart |
 
@@ -180,29 +179,6 @@ Speech uses Eleven v4 Turbo, the delivery note `[Brisk but relaxed, speaking nat
 
 The TUI reads these speech settings from its own client configuration, including project configuration discovered from its startup directory, also when attached to a remote host. It does not load vocabulary from the remote session's repository. Telegram reads it from the runner's startup configuration, not from session workspaces. Restart the respective process after changes. This setting does not affect the explicit voices supplied to `tau tool speech-generate`.
 
-### `nook`
-
-Connection details for one existing Nook deployment:
-
-| Nested field | Type | Required | Contract |
-| --- | --- | --- | --- |
-| `domain` | Non-empty string | Yes | DNS hostname, optionally supplied as a plain `http://` or `https://` origin with no port, path, query, credentials, or fragment |
-| `accessClientId` | Non-empty string | No | Cloudflare Access service-token client id |
-| `accessClientSecret` | Non-empty string | No | Inline service-token secret |
-| `accessClientSecretEnv` | Non-empty string | No | Host environment variable containing the secret |
-
-```json
-{
-  "nook": {
-    "domain": "apps.example.com",
-    "accessClientId": "8f0c...access",
-    "accessClientSecretEnv": "NOOK_ACCESS_CLIENT_SECRET"
-  }
-}
-```
-
-Tau normalizes the domain to a lowercase hostname. A non-empty value from `accessClientSecretEnv` wins over `accessClientSecret`. The `nook` tool is available only when the active persona allows it and the effective configuration contains this object. See [Nook](nook.md).
-
 ### `history`
 
 A global-only remote history target:

package/dist/core/static/tau_docs/configuration.md

@@ -180,7 +180,7 @@ The Telegram runner loads its speech provider and its runner config at startup.
 
 **Editing the host's files for a hosted environment.** A hosted execution environment has its own project files and home. Put project `.tau` content on that environment, not at a similar path on the host.
 
-**Expecting nested objects to deep-merge.** A nearer `mcpServers` entry replaces the whole entry with the same name, including its credentials, and a nearer `nook` object replaces the broader one completely. Repeat every setting the entry needs.
+**Expecting nested objects to deep-merge.** A nearer `mcpServers` entry replaces the whole entry with the same name, including its credentials. Repeat every setting the entry needs.
 
 **Expecting `/reload` to restart the client or server.** Reload affects only the current session. Restart the process that reads the setting at startup.
 

package/dist/core/static/tau_docs/credentials.md

@@ -15,7 +15,6 @@ The host makes model calls and runs services such as web search and remote histo
 | OpenAI Codex OAuth accounts | Session host home |
 | Exa-backed `web.search` and `web.fetch` | Session host |
 | Remote history replication and queries | Session host |
-| Nook host tool | Session host |
 | Fly Sprite API | Session host startup |
 | `/listen` and `/speak` | TUI client |
 | Telegram transcription and voice responses | Telegram runner |
@@ -113,9 +112,9 @@ tau auth logout codex --account developer@example.com
 
 Every new request reads the current auth storage, in every session. Switching accounts takes effect without a host restart and does not affect a request already in progress.
 
-## History and Nook indirection
+## History indirection
 
-History and Nook can name environment variables instead of embedding secrets in configuration.
+History can name environment variables instead of embedding secrets in configuration.
 
 Remote history is global-only configuration:
 
@@ -136,20 +135,6 @@ History resolves its API key in this order:
 
 If `history` is configured but no key is found, the host fails to start. Without `history`, history stays on the host machine. See [history](history.md) for service behavior.
 
-A Nook Access service token uses an ID plus a secret:
-
-```json
-{
-  "nook": {
-    "domain": "apps.example.net",
-    "accessClientId": "service-token-id.access",
-    "accessClientSecretEnv": "NOOK_ACCESS_CLIENT_SECRET"
-  }
-}
-```
-
-If the variable named by `accessClientSecretEnv` has a non-empty value, it wins over inline `accessClientSecret`. Otherwise Tau uses the inline value. The process that performs the Nook operation reads the secret: the host for the session tool, and the CLI process for `tau nook` commands. Nook setup and destroy also accept the command flags and environment variables listed in [Nook](nook.md). See [Nook](nook.md).
-
 ## Hosted execution credentials
 
 The Fly Sprite connection is host configuration. It must be in place when the host starts, before a client asks for a Sprite session. The connection needs a token:
@@ -174,7 +159,7 @@ Check a credential by using it, without printing its value:
 - Run `tau auth list` to check Codex identities, the active account, refresh status, and usage windows.
 - Restart the process that uses `apiKeys` after changing them.
 - Make a small request with the intended persona to verify model authentication and endpoint access.
-- After setting Exa, speech, history, Nook, or Fly credentials, use that feature. If a credential is missing, the error names where Tau looks for it.
+- After setting Exa, speech, history, or Fly credentials, use that feature. If a credential is missing, the error names where Tau looks for it.
 - For remote sessions, first confirm which machine is the host and which process runs the feature.
 
 Do not check by printing the environment, `config.json`, or `auth.json` into a transcript. If a secret ends up in shell history, logs, a session, or version control, rotate it at the provider and replace it. Broader handling guidance is in [security](security.md) and failure checks are in [troubleshooting](troubleshooting.md).

package/dist/core/static/tau_docs/index.md

@@ -35,7 +35,6 @@ These pages describe how to install, configure, operate, and integrate the versi
 - [Sessions](sessions.md): creating sessions, turns, queueing, compaction, rewind, recovery, and storage.
 - [Remote sessions](remote-sessions.md): `serve`, `attach`, remote paths, and authentication.
 - [History](history.md): searchable local history, optional remote replication, and the history tool.
-- [Nook](nook.md): setting up and running the optional static mini-app platform.
 - [Telegram](telegram.md): running the Telegram runner, bot access, chat commands, attachments, and recovery.
 - [Telegram projects and workspaces](telegram-projects.md): repository, persistent-directory, and composite projects, workspace lifecycle, and provision hooks.
 

package/dist/core/static/tau_docs/manifest.json

@@ -25,7 +25,6 @@
     "node-sdk.md",
     "sdk-diff-review.md",
     "history.md",
-    "nook.md",
     "telegram.md",
     "telegram-projects.md",
     "security.md",

package/dist/core/static/tau_docs/openrouter.md

@@ -30,6 +30,7 @@ Every request needs an exact `--model` ID from this table. There is no default,
 | `decisions` | `typesafe/jev-1.14` | Questions about text, structured state, or images; use for high-volume decisions when cost is the priority | Not supported |
 | `chat` | `google/gemini-3.8-flash` | Text, images, audio, video; first choice for audio/video and image-heavy analysis | `low`, `medium`, `high` |
 | `chat` | `openai/gpt-6-luna` | Text and images; cheap everyday extraction, summarization, and routine questions | `none`, `low`, `medium`, `high`, `xhigh`, `max` |
+| `chat` | `openai/gpt-6.1-terra` | Text and images; efficient visual reasoning, writing, and everyday coding | `low`, `medium`, `high`, `xhigh`, `max` |
 | `chat` | `openai/gpt-6.1-sol` | Text and images; coding, debugging, technical reasoning | `low`, `medium`, `high`, `xhigh`, `max` |
 | `chat` | `anthropic/claude-opus-5.5` | Text and images; premium generalist for writing, synthesis, difficult reasoning, and second opinions | `low`, `medium`, `high`, `xhigh`, `max` |
 

package/dist/core/static/tau_docs/personas.md

@@ -10,7 +10,7 @@ Built-in personas are generated from Tau's current model catalog. Most model fam
 
 The Opus 5.5 chat and coder personas are available only when `anthropic/claude-opus-5-5` is present in the effective model catalog. The Sonnet 5.5 variants (`sonnet-5.5-chat` and `sonnet-5.5-coder`) likewise require `anthropic/claude-sonnet-5-5`.
 
-GPT-6.1 Sol, GPT-6 Luna, and GPT-6 Astra have API and ChatGPT variants for chat and coding. Fast ChatGPT variants use priority service and are available only for coding. They are available only when the effective catalog contains the matching model ID (`gpt-6.1-sol`, `gpt-6-luna`, or `gpt-6-astra`) for the corresponding provider.
+GPT-6.1 Sol, GPT-6.1 Terra, GPT-6 Luna, and GPT-6 Astra have API and ChatGPT variants for chat and coding. Fast ChatGPT variants use priority service and are available only for coding. They are available only when the effective catalog contains the matching model ID (`gpt-6.1-sol`, `gpt-6.1-terra`, `gpt-6-luna`, or `gpt-6-astra`) for the corresponding provider.
 
 All built-in personas default to medium reasoning. The startup default is `sonnet-5.5-coder`.
 
@@ -97,12 +97,12 @@ Every persona can use all discovered skills. If a custom persona omits `tools`,
 
 The selectable tool names are:
 
-- `bash`, `write`, `edit`, `view_image`, `web`, `nook`, `history`, `mcp`, and `models`;
+- `bash`, `write`, `edit`, `view_image`, `web`, `history`, `mcp`, and `models`;
 - `spawn_agent`, `send_input_to_agent`, `wait_for_agents`, `list_agents`, and `interrupt_agent`.
 
-Names such as `web`, `nook`, `history`, `mcp`, and `models` enable capabilities inside the `code` tool, and `bash` also enables `tau.bash`. Tau builds the `code` tool from whichever of these capabilities are selected and usable.
+Names such as `web`, `history`, `mcp`, and `models` enable capabilities inside the `code` tool, and `bash` also enables `tau.bash`. Tau builds the `code` tool from whichever of these capabilities are selected and usable.
 
-A `tools` list replaces the defaults. Names are lowercased and duplicates removed. An unknown name makes the persona invalid. `tools: []` gives the persona none of these tools. The built-in `tau_docs` tool is always available, independent of this list. `nook` works only when Nook is configured, and `mcp` only when the host has enabled MCP servers. [Tools](tools.md) explains eligibility and ownership.
+A `tools` list replaces the defaults. Names are lowercased and duplicates removed. An unknown name makes the persona invalid. `tools: []` gives the persona none of these tools. The built-in `tau_docs` tool is always available, independent of this list. `mcp` works only when the host has enabled MCP servers. [Tools](tools.md) explains eligibility and ownership.
 
 ## Selecting a persona
 

package/dist/core/static/tau_docs/security.md

@@ -30,7 +30,7 @@ Trusting a repository therefore means trusting this content. Before using a repo
 
 - persona system prompts, tool lists, and model launch allowlists;
 - skill instructions and any scripts they direct the agent to run;
-- project configuration that sets Nook targets, model notices, or hosted-environment connections;
+- project configuration that sets model notices or hosted-environment connections;
 - `enabledClientTools`, which can turn on commands from your global configuration; and
 - provision scripts or other repository automation used by integrations such as Telegram.
 
@@ -46,7 +46,7 @@ A Tau host that runs models refreshes compatible provider catalogs from `pi.dev`
 
 ## Keep secrets with the process that needs them
 
-Most model and service credentials belong on the host, because the host makes model calls, web searches, history replication, and Nook requests for the session tool. TUI speech credentials and command client tool credentials belong on the client. Telegram bot, transcription, and voice credentials belong to the Telegram runner. Credentials for hosted execution environments belong in the host's startup configuration.
+Most model and service credentials belong on the host, because the host makes model calls, performs web searches, and replicates history. TUI speech credentials and command client tool credentials belong on the client. Telegram bot, transcription, and voice credentials belong to the Telegram runner. Credentials for hosted execution environments belong in the host's startup configuration.
 
 When attached to a remote host, a credential exported on the laptop does not reach the host. Putting a host credential into the execution environment's shell would needlessly expose it to every process there. See [credentials](credentials.md) for which source wins.
 
@@ -57,12 +57,11 @@ Never put credentials in:
 - committed project files;
 - persona, prompt, skill, `AGENTS.md`, or model-notice text;
 - Bash command lines likely to enter shell history or process listings;
-- tool results, session messages, issue comments, or debug output; or
-- Nook static assets or browser KV.
+- tool results, session messages, issue comments, or debug output.
 
 Do not debug authentication by printing an environment, a configuration file, `auth.json`, or a service response that includes headers. Check that the expected source is set up for the right process, then run a small operation that uses it. `tau auth list` shows Codex account identities and status without showing tokens.
 
-If a credential appears in a session, log, shell history, repository, Nook deployment, Telegram message, or history, treat it as exposed. First revoke or rotate it at the provider. Then replace the stored value through configuration or the auth command, restart the process that uses it if needed, and delete the exposed copy where retention rules allow. Redacting the copy does not replace rotation.
+If a credential appears in a session, log, shell history, repository, Telegram message, or history, treat it as exposed. First revoke or rotate it at the provider. Then replace the stored value through configuration or the auth command, restart the process that uses it if needed, and delete the exposed copy where retention rules allow. Redacting the copy does not replace rotation.
 
 ## Understand environment sanitization
 
@@ -161,16 +160,6 @@ With global `history` configuration, entries are still written to local SQLite f
 
 Before turning on remote history, confirm who runs the service, its retention policy and region, who holds access keys, and which projects may be sent. One service key can search the whole shared collection. Rotate it if exposed. Removing the configuration does not delete data that was already copied. See [history](history.md) for storage and service behavior.
 
-## Treat Nook output as published content
-
-Nook deploys static files to HTTPS URLs. Deployments are private by default, and `--public` makes a site's files reachable by anyone. Review the built output, not just the source, before deploying. Static files must never contain provider keys, source maps with secrets, private configuration, or data that should stay on the execution environment.
-
-Each site has a JSON KV store for the browser that survives redeploys. On a public site, anyone can read and write it. On a private site, it requires a Cloudflare Access identity, but it is still application data that every allowed user and the site's code can read. It is not a place for credentials.
-
-Cloudflare Access should protect only the `/__nook/*` control plane at the root. Public site paths must stay reachable without Access, while private sites sign in through `/__nook/auth`. The Nook Worker validates Access JWTs; service-token headers only get a request past Access. Follow the exact Access application, audience, cookie, and service token setup in [Nook](nook.md).
-
-The Nook session tool and the `tau nook` CLI can deploy, delete, copy, and change KV without asking for confirmation. The model's JavaScript never receives Access credentials, but Tau uses them for the Nook API calls the program makes.
-
 ## Edit configuration without widening authority accidentally
 
 A configuration change can redirect network traffic, expose tools, or send credentials somewhere new. Follow these steps:
@@ -196,7 +185,6 @@ Tau's internal files hold the state it needs to recover. They are not configurat
 - `~/.config/tau/history.sqlite` and its SQLite side files;
 - Telegram runner session and project-preference state;
 - managed Telegram workspaces or repository caches as a first-line repair;
-- code-mode or compaction temporary files as if they were durable state; or
-- Nook R2 or Durable Object records outside supported Nook operations.
+- code-mode or compaction temporary files as if they were durable state.
 
-Use `tau auth` for Codex accounts, TUI or session protocol operations for sessions, configuration for behavior, and the documented commands for history and Nook. If recovery reports corruption, keep the original data, stop any other process writing to it, write down the exact error and Tau version, and investigate through normal recovery before trying any repair that deletes data.
+Use `tau auth` for Codex accounts, TUI or session protocol operations for sessions, configuration for behavior, and the documented commands for history. If recovery reports corruption, keep the original data, stop any other process writing to it, write down the exact error and Tau version, and investigate through normal recovery before trying any repair that deletes data.

package/dist/core/static/tau_docs/subagents.md

@@ -26,7 +26,6 @@ A native Tau subagent can receive these tools. [Claude Code subagents](#claude-c
 - `view_image`
 - `web`
 - `history`
-- `nook`, when Nook is configured
 - `mcp`, when the host has enabled MCP servers
 - `models`
 

package/dist/core/static/tau_docs/tools.md

@@ -37,7 +37,6 @@ write
 edit
 view_image
 web
-nook
 history
 mcp
 models
@@ -48,9 +47,9 @@ list_agents
 interrupt_agent
 ```
 
-A custom persona that omits `tools` gets `bash`, `write`, `edit`, `view_image`, `web`, `nook`, `history`, `mcp`, and `models`, plus the five subagent tools. Built-in personas get the same set.
+A custom persona that omits `tools` gets `bash`, `write`, `edit`, `view_image`, `web`, `history`, `mcp`, and `models`, plus the five subagent tools. Built-in personas get the same set.
 
-`web`, `history`, `nook`, `mcp`, and `models` are not separate tools. Each enables a namespace inside the single `code` tool. `bash` enables both the Bash tools and `tau.bash` inside `code`. Tau adds `code` whenever at least one usable capability is selected; `code` itself cannot be listed. A namespace the persona does not select is missing from the `code` API and its documentation.
+`web`, `history`, `mcp`, and `models` are not separate tools. Each enables a namespace inside the single `code` tool. `bash` enables both the Bash tools and `tau.bash` inside `code`. Tau adds `code` whenever at least one usable capability is selected; `code` itself cannot be listed. A namespace the persona does not select is missing from the `code` API and its documentation.
 
 An empty list turns off every selectable tool:
 
@@ -60,7 +59,7 @@ tools: []
 
 `tau_docs` stays available. The list also has no effect on client tools, which attached clients offer on their own.
 
-`nook` has one more condition: the host configuration must include a Nook target. Without one, Tau leaves the capability out even if the persona lists it. For other tools, missing credentials or service configuration can make calls fail, but do not remove the tool. Persona configuration is covered in [personas](personas.md).
+Missing credentials can make calls fail, but do not remove the tool. Persona configuration is covered in [personas](personas.md).
 
 ## Tau documentation
 
@@ -143,7 +142,7 @@ Each guide covers setup, input, examples, outputs, and failures. Run `tau tool -
 
 ## Code-mode composition
 
-`code` runs a one-off JavaScript program that combines the enabled capabilities: `tau.web`, `tau.history`, `tau.nook`, `tau.mcp`, `tau.bash`, and `tau.models`. The Bash, write, edit, and image tools stay available as separate tools.
+`code` runs a one-off JavaScript program that combines the enabled capabilities: `tau.web`, `tau.history`, `tau.mcp`, `tau.bash`, and `tau.models`. The Bash, write, edit, and image tools stay available as separate tools.
 
 ### Documentation and output
 
@@ -159,7 +158,7 @@ The guide covers runtime rules, capabilities, and examples. The agent reads each
 printText(await tau.docs("web"));
 ```
 
-The agent does not re-read documentation it has already seen. MCP tool descriptions and Nook's authoring guide are read in their own separate steps. Programs do not need to print intermediate results.
+The agent does not re-read documentation it has already seen. MCP tool descriptions are read separately. Programs do not need to print intermediate results.
 
 `printText` accepts only strings; objects and arrays throw a `TypeError`. The agent selects relevant fields and explicitly formats concise plain text to save tokens. `JSON.stringify` is reserved for cases where the structure matters or machine-readable JSON is requested, with fields selected first instead of dumping whole responses.
 
@@ -184,7 +183,6 @@ Programs have no direct access to files, processes, environment variables, crede
 
 - `tau.web`: metadata discovery, Exa search, and fetching page content. Search uses Auto with Dynamic Highlights to select evidence across results. An optional `objective` (1–4,096 nonblank characters) describes the broader task and facts to extract. Results include a `notices` array with retrieval qualifications such as relaxed query restrictions; each notice retains its `code`, `path`, `message`, and optional `details`. The agent prints notices alongside selected search results. The agent prefers local data, dedicated CLIs, first-party APIs, and structured sources over scraping web pages. For GitHub it uses `gh` or a Git checkout where suitable. Metadata discovery works without an Exa key; search and content fetching need one.
 - `tau.history`: read-only search and paginated transcripts. The agent uses it only when explicitly told to look at past sessions. It treats past content as data and never follows instructions in it. See [history](history.md).
-- `tau.nook`: deploying sites, templates, and each site's JSON KV store. The agent uses it when the user asks to publish or manage Nook. Before writing an app, the agent reads `tau.nook.skill()` in a separate call that only prints documentation. See [Nook](nook.md).
 - `tau.mcp`: finding and calling tools and resources on configured MCP servers. When the persona allows MCP, enabled server names and optional configured descriptions are visible in the initial tool definition, before any tool call. Disabled servers and connection settings are omitted. These summaries guide discovery and do not grant permission to act. The agent reads each tool's description and schema before calling it. Connections are shared and opened on first use, and calls that change data are never retried. An `isError` result is returned as data, while protocol failures throw. MCP server configuration and trust rules apply. See [configuration reference](config-reference.md#mcpservers) and [security](security.md#trust-mcp-servers).
 - `tau.bash`: `run`, `start`, `list`, `read`, `wait`, and `stop`. `run` returns stdout, stderr, and exit and termination fields, capturing up to 24 MiB. Beyond that it keeps the end, so check `truncated` before parsing. Optional UTF-8 `stdin` is limited to 16 MiB and closed after writing. Without `stdin` the command has no stdin at all, while `""` gives it an empty one. `start` takes no stdin. Background jobs are the same jobs as the Bash tools', with the same output limits. Jobs survive the program ending and interruption, while foreground commands are cancelled. The shell rules above apply.
 - `tau.models`: lists a fixed set of OpenRouter models and runs standalone chats or typed decisions with them. These calls do not see the session's conversation or tools. Chat media can be paths on the agent's machine or inline padded base64 with a matching MIME type. Credentials stay on the host. Provider usage data is returned, but these charges are not included in the session's cost or usage logs. Requests can be cancelled and are never retried automatically. Limits on input, models, media, responses, and requests are the same as in [OpenRouter](openrouter.md). Check whether a response completed or was refused instead of assuming it is a full answer.
@@ -193,7 +191,7 @@ SDK and command client tools built on code mode use the same sandbox functions a
 
 ## Subagent tools
 
-A subagent gets each of `bash`, `write`, `edit`, `view_image`, `web`, `history`, `nook`, `mcp`, and `models` that the main persona also has, plus `tau_docs`. It never gets the subagent tools or client tools. Its Bash and file tools start in the subagent's working directory. [Subagents](subagents.md#tools) has the details.
+A subagent gets each of `bash`, `write`, `edit`, `view_image`, `web`, `history`, `mcp`, and `models` that the main persona also has, plus `tau_docs`. It never gets the subagent tools or client tools. Its Bash and file tools start in the subagent's working directory. [Subagents](subagents.md#tools) has the details.
 
 ## Client-owned tools
 

package/dist/core/static/tau_docs/troubleshooting.md

@@ -13,11 +13,10 @@ tau --help
 tau attach --help
 tau auth --help
 tau history --help
-tau nook --help
 tau telegram --help
 ```
 
-Help describes that installed binary, and `tau_docs` describes the host's installed version. An attached TUI, a remote host, and deployed history or Nook services can each run a different version, so the host's documentation may not match an older client's flags or a separately deployed service.
+Help describes that installed binary, and `tau_docs` describes the host's installed version. An attached TUI, a remote host, and deployed history services can each run a different version, so the host's documentation may not match an older client's flags or a separately deployed service.
 
 For a local startup, `tau --debug` loads configuration and content from the current directory, prints warnings and catalog information, and exits without opening the TUI:
 
@@ -114,7 +113,7 @@ Check the exact built-in theme ID and the client's `defaultTheme`. Use `/theme:<
 
 Work out which kind of tool is missing before changing configuration.
 
-For a host tool, check the active persona's `tools` list. A list replaces the defaults. Run `tau --debug --persona <id>` for a new local session, or reload the current session while idle. Missing credentials make a tool fail but usually do not remove it. Nook is the exception: it also needs `nook` configuration.
+For a host tool, check the active persona's `tools` list. A list replaces the defaults. Run `tau --debug --persona <id>` for a new local session, or reload the current session while idle. Missing credentials make a tool fail but usually do not remove it.
 
 For subagents, check three things:
 
@@ -147,13 +146,13 @@ When the client detaches, its tools disappear and running calls are cancelled. R
 
 Find the process that makes the request:
 
-| Operation | Where the credential belongs |
-| --- | --- |
-| Model calls, host `web`, `history`, or `nook` | Host |
-| `/listen`, `/speak`, or TUI client tools | Client |
-| Telegram bot or transcription | Runner |
-| `tau nook`, `tau history`, or `tau tool` commands | The machine running the command |
-| Fly Sprite connection | Host startup configuration |
+| Operation                                | Where the credential belongs    |
+| ---------------------------------------- | ------------------------------- |
+| Model calls, host `web`, or `history`    | Host                            |
+| `/listen`, `/speak`, or TUI client tools | Client                          |
+| Telegram bot or transcription            | Runner                          |
+| `tau history` or `tau tool` commands     | The machine running the command |
+| Fly Sprite connection                    | Host startup configuration      |
 
 A variable set on the laptop does not reach a remote host. After changing environment variables or `apiKeys`, restart the process that uses them. `apiKeys` in a project file are rejected; check the process's environment and its global configuration.
 
@@ -223,11 +222,10 @@ A WebSocket client disconnecting does not interrupt a long-running host, but a s
 
 A session saved in a newer storage format needs that Tau version or later. Newer Tau versions upgrade supported older sessions automatically. For invalid JSON, snapshot, or ID errors, keep the file and the exact error, stop other hosts using the same store, and investigate through normal recovery. Do not edit or delete the file first.
 
-## History, Nook, or Telegram
+## History or Telegram
 
 These features have their own troubleshooting sections:
 
 - [History](history.md#troubleshooting): missing API key, service errors, sessions missing from remote search, and local history failures.
-- [Nook](nook.md#common-errors): configuration, Access and authorization errors, wrong visibility, and deploy rejections.
 - [Telegram](telegram.md#troubleshooting): ignored messages, project selection, audio, voice replies, and late or missing replies.
 - [Telegram projects and workspaces](telegram-projects.md#troubleshooting): repository preparation, provisioning, and workspace recovery.

package/dist/core/static/tau_docs/tui.md

@@ -262,6 +262,7 @@ Transcription uses Gemini and needs `GEMINI_API_KEY` or `apiKeys.google`. The TU
 - Longer responses are split into balanced parts, each aiming for at most two minutes of speech.
 - The source and rewritten text are limited to 10,000 Unicode characters, and generation stops after 32 MiB of raw audio.
 - Voice lookups and synthesis requests have a two-minute deadline.
+- The rewrite turns paths, commands, and formatting into spoken prose. It reads a link's label instead of its address, and refers to a bare address as a link. When the address points to an issue or pull request, the rewrite names it by number, such as "issue 620". The rewrite is model-generated, so an address may occasionally still be read aloud.
 
 See [`speech` configuration](config-reference.md#speech) for the default Maisie and Caleb voices and for choosing your own.