@shanepadgett/tau-agent 0.43.0 → 0.44.1

package/extensions/script-runner/README.md

@@ -2,6 +2,8 @@
 
 Gives the agent a first-class `script_runner` tool for running Python 3, Node.js, and Deno scripts instead of falling back to bash. The agent picks whichever runtime is more efficient for the task.
 
-When a run fails, the tool keeps the script and returns a `scriptId`. The agent retries with targeted `{oldText, newText}` edits against what it just wrote instead of resending the whole script, saving output tokens and keeping duplicate scripts out of context. Only the source the agent already sent is referenced; no file path is exposed.
+When a run fails, the tool keeps the script and returns a `scriptId`. The agent retries with targeted `{oldText, newText}` edits against what it just wrote instead of resending the whole script, saving output tokens and keeping duplicate scripts out of context. Only the source the agent already sent is referenced; no script source file path is exposed.
+
+Long output shows the tail and a path to the complete output in a temporary file for the active session.
 
 Runtimes are detected from the environment: Python 3 via `python3`, Node via the current process when Node is 22.6 or newer (`node --experimental-strip-types`), Deno via `deno` (`deno run -A`). The `node` language is the local Node.js runtime with full Node APIs; scripts may be TypeScript with erasable syntax or plain JavaScript. The `deno` language is the local Deno runtime with full permissions and native TypeScript/JavaScript. The tool registers only the runtimes actually available and is hidden from the prompt entirely when none are present.

package/extensions/script-runner/index.ts

@@ -4,17 +4,13 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { StringEnum } from "@earendil-works/pi-ai";
-import {
-	DEFAULT_MAX_BYTES,
-	DEFAULT_MAX_LINES,
-	defineTool,
-	type ExecResult,
-	type ExtensionAPI,
-	type Theme,
-	truncateTail,
-} from "@earendil-works/pi-coding-agent";
+import { defineTool, type ExecResult, type ExtensionAPI, type Theme } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
+import { BoundedTextResultBuilder } from "../../shared/bounded-text-result.ts";
+import { onTauEventImmediately } from "../../shared/events.ts";
+import { createScriptSourceStore } from "../../shared/script-source.ts";
+import { createTemporaryOutputStore } from "../../shared/temporary-output-store.ts";
 import { renderToolOutputPreview } from "../../shared/text.ts";
 
 type Language = "python3" | "node" | "deno";
@@ -25,13 +21,7 @@ interface Runtimes {
 	deno: string | undefined;
 }
 
-interface StoredScript {
-	language: Language;
-	source: string;
-}
-
 const TIMEOUT_MS = 120_000;
-const MAX_STORED = 8;
 
 function detectRuntimes(): Runtimes {
 	let python3: string | undefined;
@@ -81,18 +71,6 @@ function scrubPath(text: string, file: string, dir: string): string {
 	return text.replaceAll(file, "<script>").replaceAll(dir, "<tmpdir>");
 }
 
-function applyEdits(source: string, edits: ReadonlyArray<{ oldText: string; newText: string }>): string {
-	let next = source;
-	for (const edit of edits) {
-		const idx = next.indexOf(edit.oldText);
-		if (idx === -1) {
-			throw new Error("edits oldText not found. Copy exact text from the script you wrote.");
-		}
-		next = next.slice(0, idx) + edit.newText + next.slice(idx + edit.oldText.length);
-	}
-	return next;
-}
-
 function renderEditsPreview(edits: ReadonlyArray<{ oldText: string; newText: string }>, theme: Theme): string {
 	return edits
 		.map((edit) => {
@@ -109,56 +87,6 @@ function renderEditsPreview(edits: ReadonlyArray<{ oldText: string; newText: str
 		.join("\n");
 }
 
-function resolveScriptSource(
-	scripts: Map<string, StoredScript>,
-	language: Language,
-	params: {
-		script?: string;
-		scriptId?: string;
-		edits?: ReadonlyArray<{ oldText: string; newText: string }>;
-	},
-): { scriptId: string; source: string } {
-	const edits = params.edits;
-	if (edits && edits.length > 0) {
-		const scriptId = params.scriptId;
-		if (!scriptId) throw new Error("edits require scriptId from the failed run.");
-		const stored = scripts.get(scriptId);
-		if (!stored) throw new Error(`No stored script for scriptId ${scriptId}. Evicted; resend full script.`);
-		if (stored.language !== language) {
-			throw new Error(`Language mismatch: scriptId ${scriptId} is ${stored.language}, not ${language}.`);
-		}
-		return { scriptId, source: applyEdits(stored.source, edits) };
-	}
-	if (typeof params.script !== "string" || params.script.length === 0) {
-		throw new Error("Provide script, or edits + scriptId.");
-	}
-	return { scriptId: params.scriptId ?? newScriptId(), source: params.script };
-}
-
-function formatTruncatedTail(text: string): { body: string; note: string } {
-	const trunc = truncateTail(text, { maxLines: DEFAULT_MAX_LINES, maxBytes: DEFAULT_MAX_BYTES });
-	const note = trunc.truncated
-		? `\n\n[output truncated: kept tail ${trunc.outputLines} / ${trunc.totalLines} lines]`
-		: "";
-	return { body: trunc.content, note };
-}
-
-function successScriptResult(stdout: string): { content: [{ type: "text"; text: string }]; details: undefined } {
-	const { body, note } = formatTruncatedTail(stdout.trim());
-	const out = body.trim();
-	return {
-		content: [{ type: "text", text: out ? `${out}${note}` : `(no output)${note}` }],
-		details: undefined,
-	};
-}
-
-function throwScriptFailure(scriptId: string, result: { stdout: string; stderr: string }): never {
-	const diag = result.stderr.trim() || result.stdout.trim();
-	const { body, note } = formatTruncatedTail(diag);
-	const detail = body ? `${body}${note}\n\n` : "";
-	throw new Error(`${detail}scriptId: ${scriptId}`);
-}
-
 export default function scriptRunnerExtension(pi: ExtensionAPI): void {
 	const runtimes = detectRuntimes();
 	const detected = (["python3", "node", "deno"] as const).filter(
@@ -168,17 +96,15 @@ export default function scriptRunnerExtension(pi: ExtensionAPI): void {
 
 	const langPhrase = formatLangList(detected);
 
-	const scripts = new Map<string, StoredScript>();
-	let tempDir: string | undefined;
-
-	function remember(scriptId: string, script: StoredScript): void {
-		scripts.set(scriptId, script);
-		while (scripts.size > MAX_STORED) {
-			const oldest = scripts.keys().next().value;
-			if (oldest === undefined) break;
-			scripts.delete(oldest);
-		}
-	}
+	const scriptStore = createScriptSourceStore();
+	const temporaryOutput = createTemporaryOutputStore();
+	onTauEventImmediately(pi, "script-runner.source-store", "tau:script-runner.source-store", ({ accept }) =>
+		accept(scriptStore),
+	);
+	pi.on("session_start", async () => {
+		await temporaryOutput.shutdown();
+		await temporaryOutput.start();
+	});
 
 	function resolveCommand(language: Language): string {
 		const cmd = runtimes[language];
@@ -190,12 +116,6 @@ export default function scriptRunnerExtension(pi: ExtensionAPI): void {
 		throw new Error("Deno is not available on this machine.");
 	}
 
-	async function ensureTempDir(): Promise<string> {
-		if (tempDir) return tempDir;
-		tempDir = await mkdtemp(join(tmpdir(), "tau-script-runner-"));
-		return tempDir;
-	}
-
 	async function runScript(
 		language: Language,
 		command: string,
@@ -203,21 +123,27 @@ export default function scriptRunnerExtension(pi: ExtensionAPI): void {
 		cwd: string,
 		signal: AbortSignal | undefined,
 	): Promise<ExecResult> {
-		const dir = await ensureTempDir();
-		const file = join(dir, language === "python3" ? "_run.py" : "_run.ts");
-		await writeFile(file, source, "utf8");
-		const args =
-			language === "python3"
-				? [file]
-				: language === "node"
-					? ["--experimental-strip-types", file]
-					: ["run", "-A", file];
-		const result = await pi.exec(command, args, { cwd, signal, timeout: TIMEOUT_MS });
-		return {
-			...result,
-			stdout: scrubPath(result.stdout, file, dir),
-			stderr: scrubPath(result.stderr, file, dir),
-		};
+		const dir = await mkdtemp(join(tmpdir(), "tau-script-runner-"));
+		try {
+			const file = join(dir, language === "python3" ? "_run.py" : "_run.ts");
+			await writeFile(file, source, "utf8");
+			const args =
+				language === "python3"
+					? [file]
+					: language === "node"
+						? ["--experimental-strip-types", file]
+						: ["run", "-A", file];
+			const result = await pi.exec(command, args, { cwd, signal, timeout: TIMEOUT_MS });
+			return {
+				...result,
+				stdout: scrubPath(result.stdout, file, dir),
+				stderr: scrubPath(result.stderr, file, dir),
+			};
+		} finally {
+			await rm(dir, { recursive: true, force: true }).catch(() => {
+				// best-effort cleanup
+			});
+		}
 	}
 
 	const paramsSchema = Type.Object(
@@ -266,24 +192,41 @@ export default function scriptRunnerExtension(pi: ExtensionAPI): void {
 			"script_runner never exposes the script path; you already have the source. Never try to read it back.",
 		],
 		parameters: paramsSchema,
-		async execute(_toolCallId, params, signal, onUpdate, ctx) {
+		async execute(toolCallId, params, signal, onUpdate, ctx) {
 			const language = params.language;
 			if (signal?.aborted) {
 				return { content: [{ type: "text", text: "Cancelled." }], details: undefined };
 			}
+			scriptStore.verifyAndConsume(toolCallId, params);
 			const command = resolveCommand(language);
-			const { scriptId, source } = resolveScriptSource(scripts, language, params);
-			remember(scriptId, { language, source });
+			const resolved = scriptStore.resolve(params);
+			const scriptId = resolved.scriptId ?? newScriptId();
+			const source = resolved.source;
+			scriptStore.remember(scriptId, language, source);
 			await onUpdate?.({
 				content: [{ type: "text", text: `Running ${languageLabel(language)}...` }],
 				details: undefined,
 			});
 			const result = await runScript(language, command, source, ctx.cwd, signal);
-			if (result.code === 0 && !result.killed) {
-				scripts.delete(scriptId);
-				return successScriptResult(result.stdout);
+			const succeeded = result.code === 0 && !result.killed;
+			const output = new BoundedTextResultBuilder(temporaryOutput, "tail");
+			let content: string;
+			try {
+				await output.append(succeeded ? result.stdout.trim() : result.stderr.trim() || result.stdout.trim());
+				if (signal?.aborted) {
+					await output.abort();
+					return { content: [{ type: "text", text: "Cancelled." }], details: undefined };
+				}
+				content = (await output.finish()).content;
+			} catch (error) {
+				await output.abort();
+				throw error;
+			}
+			if (succeeded) {
+				scriptStore.forget(scriptId);
+				return { content: [{ type: "text", text: content.trim() || "(no output)" }], details: undefined };
 			}
-			throwScriptFailure(scriptId, result);
+			throw new Error(`${content ? `${content}\n\n` : ""}scriptId: ${scriptId}`);
 		},
 		renderCall(args, theme, context) {
 			const text = (context.lastComponent as Text | undefined) ?? new Text("", 0, 0);
@@ -313,14 +256,8 @@ export default function scriptRunnerExtension(pi: ExtensionAPI): void {
 
 	pi.registerTool(tool);
 
-	pi.on("session_shutdown", () => {
-		scripts.clear();
-		const dir = tempDir;
-		tempDir = undefined;
-		if (dir) {
-			void rm(dir, { recursive: true, force: true }).catch(() => {
-				// best-effort cleanup
-			});
-		}
+	pi.on("session_shutdown", async () => {
+		scriptStore.clear();
+		await temporaryOutput.shutdown();
 	});
 }

package/extensions/tool-approval/README.md

@@ -2,13 +2,13 @@
 
 Reviews agent `bash` and `script_runner` requests before they run.
 
-Common read-only bash commands skip review and run immediately. Other bash and every `script_runner` request go to a separate reviewer. Tau uses the reviewer model for the current provider, then the current chat model if that reviewer is unavailable or fails. If a reviewer model is unavailable or fails, Tau notifies and tries the next one. The reviewer returns a validated decision and one concise paragraph that explains the request.
+Common read-only bash commands skip review and run immediately. Other bash and every `script_runner` request go to a separate reviewer. For a `script_runner` retry with `scriptId` and edits, Tau reconstructs the full resulting script before review and runs that exact source after approval. A retry with missing or invalid stored source is blocked. When the agent requests several tools at once, Tau reviews up to three requests concurrently, with one model review focused on each request. Tau uses the reviewer model for the current provider, then the current chat model if that reviewer is unavailable or fails. If a reviewer model is unavailable or fails, Tau notifies and tries the next one. The reviewer returns a validated decision and one concise paragraph that explains the request.
 
 With `autoApprove` enabled, reviewer-approved requests run without another confirmation. Tau shows a user-only marker with the reviewer model after those auto-approvals. Common read-only bash that skips review does not get a marker. Routine local development work should be approved, including requests that modify project files or run scripts. The reviewer asks for human approval only when it finds a concrete destructive, system, production, privileged, or security-sensitive effect.
 
-When approval is required, Tau shows one paragraph that explains the effect and risk without repeating the request. If the reviewer fails or returns a malformed decision, Tau asks for direct human approval instead of running it automatically. Tau also sends an attention notification when the approval window opens.
+When approval is required, Tau shows one paragraph that explains the effect and risk without repeating the request. For `script_runner`, human confirmation also shows the complete script that will run. If several requests need approval, their confirmation windows open one at a time. If the reviewer fails or returns a malformed decision, Tau asks for direct human approval instead of running it automatically. Tau also sends an attention notification when the approval window opens.
 
-In the terminal approval panel, move between Approve and Reject, press `n` to add a note to the highlighted choice, then press Enter to choose. Enter saves an edited note before choosing; Escape cancels note editing or blocks the request from the choice list. A rejection note tells the agent why the request was blocked. An approval note reaches the agent with the tool result; it does not change the request being approved. To ask for a different request, reject it with a note. Long notes are truncated. RPC clients use the standard confirmation dialog without notes.
+In the terminal approval panel, move between Approve and Reject, press `j` or `k` to scroll a script, press `n` to add a note to the highlighted choice, then press Enter to choose. Enter saves an edited note before choosing; Escape cancels note editing or blocks the request from the choice list. A rejection note tells the agent why the request was blocked. An approval note reaches the agent with the tool result; it does not change the request being approved. To ask for a different request, reject it with a note. Long notes are truncated. RPC clients use the standard confirmation dialog without notes.
 
 Configure under `extensions.toolApproval`:
 

package/extensions/tool-approval/index.ts

@@ -8,7 +8,9 @@ import {
 import { Marker } from "@shanepadgett/tau-tui";
 import { Type } from "typebox";
 import { emitAgentBlocked } from "../../shared/agent-blocked.ts";
+import { emitTauEvent } from "../../shared/events.ts";
 import { generateToolValidated, resolveCandidates } from "../../shared/model-fallback/index.ts";
+import type { ScriptSourceStore } from "../../shared/script-source.ts";
 import { errorText, truncAt } from "../../shared/text.ts";
 import { loadTauExtensionSettings } from "../../shared/settings/load.ts";
 import { isAllowlistedBash } from "./allowlist.ts";
@@ -17,6 +19,7 @@ import toolApprovalSettings from "./settings.ts";
 
 const STATUS_KEY = "tool-approval";
 const AUTO_APPROVED_TYPE = "tau.tool-approval.auto-approved";
+const MAX_CONCURRENT_REVIEWS = 3;
 
 const REVIEW_SCHEMA = Type.Object(
 	{
@@ -75,6 +78,13 @@ interface ToolApprovalRequest {
 	input: Record<string, unknown>;
 }
 
+type ToolReviewResult = { review: ToolReview; provider: string; model: string };
+
+interface CachedReview {
+	requestJson: string;
+	outcome: PromiseSettledResult<ToolReviewResult>;
+}
+
 interface AutoApprovedMarker {
 	toolName: ApprovalToolName;
 	provider: string;
@@ -83,6 +93,7 @@ interface AutoApprovedMarker {
 
 export default function toolApprovalExtension(pi: ExtensionAPI): void {
 	let settings = toolApprovalSettings.defaults;
+	let batchReviews: Map<string, CachedReview> | undefined;
 	const pendingNotes = new Map<string, string>();
 
 	pi.registerEntryRenderer<AutoApprovedMarker>(AUTO_APPROVED_TYPE, (entry, _options, theme) => {
@@ -103,10 +114,16 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 	async function requestToolApproval(
 		ctx: ExtensionContext,
 		toolCallId: string,
-		toolName: ApprovalToolName,
+		request: ToolApprovalRequest,
 		title: string,
 		body: string,
 	): Promise<{ block: true; reason: string } | undefined> {
+		const toolName = request.toolName;
+		const source =
+			toolName === "script_runner" && typeof request.input.script === "string" ? request.input.script : undefined;
+		if (toolName === "script_runner" && source === undefined) {
+			return block("script_runner source is unavailable for manual approval");
+		}
 		if (!ctx.hasUI) return block(`${toolLabel(toolName)} needs confirmation, but interactive UI is unavailable`);
 		try {
 			emitAgentBlocked(pi, {
@@ -115,11 +132,14 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 				source: "tool-approval.review",
 			});
 			if (ctx.mode !== "tui") {
-				const confirmed = await ctx.ui.confirm(title, body);
+				const confirmed = await ctx.ui.confirm(
+					title,
+					source === undefined ? body : `${body}\n\nFull script:\n${source}`,
+				);
 				return confirmed ? undefined : block(`${toolLabel(toolName)} rejected by user`);
 			}
 			const answer = await ctx.ui.custom<ApprovalAnswer | undefined>(
-				(tui, theme, keys, done) => new ToolApprovalPanel(tui, theme, keys, title, body, done),
+				(tui, theme, keys, done) => new ToolApprovalPanel(tui, theme, keys, title, body, source, done),
 			);
 			if (!answer) return block(`${toolLabel(toolName)} approval cancelled by user`);
 			const note = truncAt(answer.note, 800);
@@ -136,7 +156,9 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 	}
 
 	pi.on("session_start", async (_event, ctx) => {
+		batchReviews = undefined;
 		pendingNotes.clear();
+		scriptSourceStoreFrom(pi)?.clearApprovals();
 		await refreshSettings(ctx);
 	});
 
@@ -151,61 +173,98 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 			return block(`tool approval settings failed to load: ${truncAt(message, 600)}`);
 		}
 		if (!settings.enabled) return undefined;
+		const scriptStore = scriptSourceStoreFrom(pi);
+		if (request.toolName === "script_runner") {
+			try {
+				if (!scriptStore) return block("script_runner source store is unavailable for review");
+				const { source } = scriptStore.resolve(request.input);
+				request.input.script = source;
+				delete request.input.edits;
+			} catch (error) {
+				return block(`script_runner source could not be reviewed: ${errorText(error)}`);
+			}
+		}
 
-		let command: string | undefined;
 		if (request.toolName === "bash") {
-			const value = request.input.command;
-			if (typeof value !== "string") return block("bash command was malformed");
-			if (!value.trim()) {
+			const command = request.input.command;
+			if (typeof command !== "string") return block("bash command was malformed");
+			if (!command.trim()) {
 				ctx.ui.notify("Bash command blocked: command is empty", "warning");
 				return block("bash command is empty");
 			}
-			command = value;
 			if (isAllowlistedBash(command)) return undefined;
 		}
 
 		ctx.ui.setStatus(STATUS_KEY, `reviewing ${toolLabel(request.toolName)}`);
 		try {
-			const { review, provider, model } = await reviewToolRequest(ctx, request);
+			batchReviews ??= await reviewAssistantRequests(ctx, event, request, scriptStore);
+			if (ctx.signal?.aborted) return block("Tool review cancelled");
+			const cached = batchReviews.get(event.toolCallId);
+			batchReviews.delete(event.toolCallId);
+			let result: ToolReviewResult;
+			if (cached && cached.requestJson === JSON.stringify(request)) {
+				if (cached.outcome.status === "rejected") throw cached.outcome.reason;
+				result = cached.outcome.value;
+			} else {
+				// A sibling's validated input may differ from its arguments in the assistant message.
+				result = await reviewToolRequest(ctx, request);
+			}
+			if (ctx.signal?.aborted) return block("Tool review cancelled");
+			const { review, provider, model } = result;
+			let rejected: { block: true; reason: string } | undefined;
 			if (review.decision === "requires_user_approval") {
-				return requestToolApproval(
+				rejected = await requestToolApproval(
 					ctx,
 					event.toolCallId,
-					request.toolName,
+					request,
 					`Approve high-impact ${toolLabel(request.toolName)}?`,
 					formatApproval(review.summary, review.reason),
 				);
-			}
-			if (settings.autoApprove) {
+			} else if (settings.autoApprove) {
 				pi.appendEntry<AutoApprovedMarker>(AUTO_APPROVED_TYPE, {
 					toolName: request.toolName,
 					provider,
 					model,
 				});
-				return undefined;
+			} else {
+				rejected = await requestToolApproval(
+					ctx,
+					event.toolCallId,
+					request,
+					`Run reviewed ${toolLabel(request.toolName)}?`,
+					formatApproval(review.summary, "Automatic approval is disabled."),
+				);
 			}
-			return requestToolApproval(
-				ctx,
-				event.toolCallId,
-				request.toolName,
-				`Run reviewed ${toolLabel(request.toolName)}?`,
-				formatApproval(review.summary, "Automatic approval is disabled."),
-			);
+			if (!rejected && request.toolName === "script_runner") {
+				if (!scriptStore) return block("script_runner source store is unavailable for approval");
+				scriptStore.approve(event.toolCallId, request.input);
+			}
+			return rejected;
 		} catch (error) {
+			if (ctx.signal?.aborted) return block("Tool review cancelled");
 			const message = singleLine(errorText(error));
 			ctx.ui.notify(`Tool review failed; manual approval required: ${truncAt(message, 600)}`, "warning");
-			return requestToolApproval(
+			const rejected = await requestToolApproval(
 				ctx,
 				event.toolCallId,
-				request.toolName,
+				request,
 				`Automatic ${toolLabel(request.toolName)} review failed. Continue?`,
-				`The automatic review failed, so Tau could not summarize this ${toolLabel(request.toolName)}. Approve it only if you understand the request shown above.`,
+				`The automatic review failed, so Tau could not summarize this ${toolLabel(request.toolName)}. Approve it only if you understand ${request.toolName === "script_runner" ? "the full script below" : "the request shown above"}.`,
 			);
+			if (!rejected && request.toolName === "script_runner") {
+				if (!scriptStore) return block("script_runner source store is unavailable for approval");
+				scriptStore.approve(event.toolCallId, request.input);
+			}
+			return rejected;
 		} finally {
 			ctx.ui.setStatus(STATUS_KEY, undefined);
 		}
 	});
 
+	pi.on("turn_end", () => {
+		batchReviews = undefined;
+	});
+
 	pi.on("tool_result", (event) => {
 		const note = pendingNotes.get(event.toolCallId);
 		if (!note) return;
@@ -222,15 +281,31 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 	});
 
 	pi.on("agent_end", () => {
+		batchReviews = undefined;
 		pendingNotes.clear();
+		scriptSourceStoreFrom(pi)?.clearApprovals();
 	});
 
 	pi.on("session_shutdown", (_event, ctx) => {
+		batchReviews = undefined;
 		pendingNotes.clear();
+		scriptSourceStoreFrom(pi)?.clearApprovals();
 		ctx.ui.setStatus(STATUS_KEY, undefined);
 	});
 }
 
+function scriptSourceStoreFrom(pi: ExtensionAPI): ScriptSourceStore | undefined {
+	let store: ScriptSourceStore | undefined;
+	let count = 0;
+	emitTauEvent(pi, "tau:script-runner.source-store", {
+		accept(candidate) {
+			store = candidate;
+			count++;
+		},
+	});
+	return count === 1 ? store : undefined;
+}
+
 function approvalRequest(event: ToolCallEvent): ToolApprovalRequest | undefined {
 	if (isToolCallEventType("bash", event)) return { toolName: "bash", input: event.input };
 	if (isToolCallEventType<"script_runner", Record<string, unknown>>("script_runner", event)) {
@@ -252,10 +327,61 @@ function autoApprovedMarker(value: unknown): AutoApprovedMarker | undefined {
 	return { toolName: record.toolName, provider: record.provider, model: record.model };
 }
 
-async function reviewToolRequest(
+async function reviewAssistantRequests(
 	ctx: ExtensionContext,
-	request: ToolApprovalRequest,
-): Promise<{ review: ToolReview; provider: string; model: string }> {
+	event: ToolCallEvent,
+	currentRequest: ToolApprovalRequest,
+	scriptStore: ScriptSourceStore | undefined,
+): Promise<Map<string, CachedReview>> {
+	const reviews = new Map<string, CachedReview>();
+	const assistant = ctx.sessionManager
+		.getBranch()
+		.reverse()
+		.find((entry) => entry.type === "message" && entry.message.role === "assistant");
+	if (!assistant || assistant.type !== "message" || assistant.message.role !== "assistant") return reviews;
+	if (
+		!assistant.message.content.some(
+			(part) => part.type === "toolCall" && part.id === event.toolCallId && part.name === currentRequest.toolName,
+		)
+	)
+		return reviews;
+
+	const requests = assistant.message.content.flatMap((part) => {
+		if (part.type !== "toolCall" || (part.name !== "bash" && part.name !== "script_runner")) return [];
+		const request: ToolApprovalRequest = {
+			toolName: part.name,
+			input: part.id === event.toolCallId ? currentRequest.input : part.arguments,
+		};
+		if (request.toolName === "bash") {
+			const command = request.input.command;
+			if (typeof command !== "string" || !command.trim() || isAllowlistedBash(command)) return [];
+		}
+		if (request.toolName === "script_runner" && part.id !== event.toolCallId) {
+			if (!scriptStore) return [];
+			try {
+				const { source } = scriptStore.resolve(request.input);
+				request.input = { ...request.input, script: source };
+				delete request.input.edits;
+			} catch {
+				// The sibling's own validated tool call will reject invalid or missing source.
+				return [];
+			}
+		}
+		return [{ toolCallId: part.id, request, requestJson: JSON.stringify(request) }];
+	});
+
+	for (let index = 0; index < requests.length && !ctx.signal?.aborted; index += MAX_CONCURRENT_REVIEWS) {
+		const group = requests.slice(index, index + MAX_CONCURRENT_REVIEWS);
+		const outcomes = await Promise.allSettled(group.map((item) => reviewToolRequest(ctx, item.request)));
+		for (const [offset, item] of group.entries()) {
+			const outcome = outcomes[offset];
+			if (outcome) reviews.set(item.toolCallId, { requestJson: item.requestJson, outcome });
+		}
+	}
+	return reviews;
+}
+
+async function reviewToolRequest(ctx: ExtensionContext, request: ToolApprovalRequest): Promise<ToolReviewResult> {
 	const requestJson = JSON.stringify(request);
 	const reviewer = REVIEW_MODELS.find((item) => item.provider === ctx.model?.provider);
 	const preferred = reviewer ? [reviewer] : [];

package/extensions/tool-approval/panel.ts

@@ -15,6 +15,7 @@ import {
 	pushSavedNote,
 	rawHint,
 	renderNoteEditor,
+	ScrollableMarkdown,
 	ToolPanel,
 	type ToolPanelConfig,
 	wrapWithPrefix,
@@ -34,6 +35,7 @@ export class ToolApprovalPanel implements Component, Focusable {
 	private readonly noteEditor: Editor;
 	private readonly panelConfig: ToolPanelConfig;
 	private readonly panel: ToolPanel;
+	private readonly sourceView: ScrollableMarkdown | undefined;
 	private readonly notes: Record<ApprovalChoice, string> = { approve: "", reject: "" };
 	private choice: ApprovalChoice = "approve";
 	private editing = false;
@@ -45,6 +47,7 @@ export class ToolApprovalPanel implements Component, Focusable {
 		keys: KeybindingsManager,
 		title: string,
 		body: string,
+		scriptSource: string | undefined,
 		done: (answer: ApprovalAnswer | undefined) => void,
 	) {
 		this.tui = tui;
@@ -56,11 +59,16 @@ export class ToolApprovalPanel implements Component, Focusable {
 			this.notes[this.choice] = value.trim();
 			this.closeNote();
 		};
+		if (scriptSource !== undefined) {
+			const fenceLength = (scriptSource.match(/`+/g) ?? []).reduce((max, run) => Math.max(max, run.length + 1), 3);
+			const fence = "`".repeat(fenceLength);
+			this.sourceView = new ScrollableMarkdown(tui, `${fence}\n${scriptSource}\n${fence}`, 14);
+		}
 		this.panelConfig = {
 			title,
 			secondary: "Approve runs this request as shown. To change it, reject with a note.",
 			header: [body],
-			body: { render: (width) => this.renderChoices(width), invalidate: () => {} },
+			body: { render: (width) => this.renderChoices(width), invalidate: () => this.sourceView?.invalidate() },
 			footer: { kind: "hints", hints: this.hints() },
 		};
 		this.panel = new ToolPanel(theme, this.panelConfig);
@@ -90,7 +98,9 @@ export class ToolApprovalPanel implements Component, Focusable {
 			this.done(undefined);
 			return;
 		}
-		if (this.keys.matches(data, "tui.select.up") || this.keys.matches(data, "tui.select.down")) {
+		if (this.sourceView && (data === "j" || data === "k")) {
+			this.sourceView.scroll(data === "j" ? 1 : -1);
+		} else if (this.keys.matches(data, "tui.select.up") || this.keys.matches(data, "tui.select.down")) {
 			this.choice = this.choice === "approve" ? "reject" : "approve";
 		} else if (data === "n") {
 			this.editing = true;
@@ -113,6 +123,9 @@ export class ToolApprovalPanel implements Component, Focusable {
 
 	private renderChoices(width: number): string[] {
 		const lines: string[] = [];
+		if (this.sourceView) {
+			lines.push(this.theme.fg("muted", "Complete script:"), ...this.sourceView.render(width), "");
+		}
 		for (const choice of ["approve", "reject"] as const) {
 			const selected = choice === this.choice;
 			const prefix = selected ? this.theme.fg("accent", "→ ") : "  ";
@@ -140,6 +153,7 @@ export class ToolApprovalPanel implements Component, Focusable {
 			? [bindingHint("tui.input.submit", "save"), bindingHint("tui.select.cancel", "cancel note")]
 			: [
 					bindingsHint(["tui.select.up", "tui.select.down"], "move"),
+					...(this.sourceView ? [rawHint("j/k", "scroll script")] : []),
 					bindingHint("tui.select.confirm", "choose"),
 					rawHint("n", "note"),
 					bindingHint("tui.select.cancel", "block"),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@shanepadgett/tau-agent",
-	"version": "0.43.0",
+	"version": "0.44.1",
 	"description": "Tau is a custom agentic harness built with pi extensions",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -35,7 +35,7 @@
 	],
 	"dependencies": {
 		"@ast-grep/wasm": "0.45.3",
-		"@shanepadgett/tau-tui": "0.43.0",
+		"@shanepadgett/tau-tui": "0.44.1",
 		"@vscode/tree-sitter-wasm": "0.3.1",
 		"image-size": "2.0.4",
 		"smol-toml": "1.8.0",

package/shared/events.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { Tool } from "@earendil-works/pi-ai";
 import type { ToolRowVisualState } from "./tool-row-state.js";
+import type { ScriptSourceStore } from "./script-source.ts";
 import type { FileInjectionRequest, PreparedFileInjection } from "../src/file-injection/index.ts";
 
 export type TauAgentEvents = {
@@ -57,6 +58,10 @@ export type TauAgentEvents = {
 		request: FileInjectionRequest;
 		accept(preparation: Promise<PreparedFileInjection[]>): void;
 	};
+	/** @internal Script runner's live source store, used to review the code it will execute. */
+	"tau:script-runner.source-store": {
+		accept(store: ScriptSourceStore): void;
+	};
 	"tau:footer-item": {
 		id: string;
 		text?: string;

package/shared/script-source.ts

@@ -0,0 +1,94 @@
+type Language = "python3" | "node" | "deno";
+
+interface StoredScript {
+	language: Language;
+	source: string;
+}
+
+export interface ScriptSourceStore {
+	resolve(input: Record<string, unknown>): { scriptId: string | undefined; source: string };
+	remember(scriptId: string, language: Language, source: string): void;
+	forget(scriptId: string): void;
+	approve(toolCallId: string, input: Record<string, unknown>): void;
+	verifyAndConsume(toolCallId: string, input: Record<string, unknown>): void;
+	clearApprovals(): void;
+	clear(): void;
+}
+
+const MAX_STORED = 8;
+
+export function createScriptSourceStore(): ScriptSourceStore {
+	const scripts = new Map<string, StoredScript>();
+	const approvals = new Map<string, string>();
+	const store: ScriptSourceStore = {
+		resolve(input) {
+			const language = input.language;
+			if (language !== "python3" && language !== "node" && language !== "deno") {
+				throw new Error("Invalid script_runner language.");
+			}
+			const scriptId = input.scriptId;
+			if (scriptId !== undefined && typeof scriptId !== "string") {
+				throw new Error("Invalid scriptId.");
+			}
+			const edits = input.edits;
+			if (edits !== undefined && !Array.isArray(edits)) throw new Error("Invalid script edits.");
+			if (Array.isArray(edits) && edits.length > 0) {
+				if (!scriptId) throw new Error("edits require scriptId from the failed run.");
+				const stored = scripts.get(scriptId);
+				if (!stored) throw new Error(`No stored script for scriptId ${scriptId}. Evicted; resend full script.`);
+				if (stored.language !== language) {
+					throw new Error(`Language mismatch: scriptId ${scriptId} is ${stored.language}, not ${language}.`);
+				}
+				let source = stored.source;
+				for (const edit of edits) {
+					if (
+						!edit ||
+						typeof edit !== "object" ||
+						typeof edit.oldText !== "string" ||
+						typeof edit.newText !== "string"
+					) {
+						throw new Error("Invalid script edit.");
+					}
+					const idx = source.indexOf(edit.oldText);
+					if (idx === -1) throw new Error("edits oldText not found. Copy exact text from the script you wrote.");
+					source = source.slice(0, idx) + edit.newText + source.slice(idx + edit.oldText.length);
+				}
+				return { scriptId, source };
+			}
+			if (typeof input.script !== "string" || (input.script.length === 0 && !scriptId)) {
+				throw new Error("Provide script, or edits + scriptId.");
+			}
+			return { scriptId, source: input.script };
+		},
+		remember(scriptId, language, source) {
+			scripts.set(scriptId, { language, source });
+			while (scripts.size > MAX_STORED) {
+				const oldest = scripts.keys().next().value;
+				if (oldest === undefined) break;
+				scripts.delete(oldest);
+			}
+		},
+		forget(scriptId) {
+			scripts.delete(scriptId);
+		},
+		approve(toolCallId, input) {
+			approvals.set(toolCallId, JSON.stringify(input));
+		},
+		verifyAndConsume(toolCallId, input) {
+			const approved = approvals.get(toolCallId);
+			if (approved === undefined) return;
+			approvals.delete(toolCallId);
+			if (approved !== JSON.stringify(input)) {
+				throw new Error("script_runner request changed after approval; blocked.");
+			}
+		},
+		clearApprovals() {
+			approvals.clear();
+		},
+		clear() {
+			scripts.clear();
+			approvals.clear();
+		},
+	};
+	return store;
+}