@shanepadgett/tau-agent 0.45.1 → 0.46.1

package/extensions/patch/README.md

@@ -1,6 +1,6 @@
 # patch
 
-Replaces the built-in `edit` and `write` tools with one multi-file patch tool. The agent applies structured patches to create, edit, move, and delete files while this extension is active. For xAI and Grok models, Tau disables `patch` and leaves `edit` and `write` active because those models are unreliable with the patch format.
+Replaces the built-in `edit` and `write` tools with one multi-file patch tool. The agent applies structured patches to create, edit, move, and delete files while this extension is active. Tau enables `patch` only for OpenAI and OpenAI Codex models; every other provider keeps `edit` and `write` and loses `patch` because those models apply the patch format less reliably.
 
 ## What it does
 

package/extensions/patch/index.ts

@@ -7,6 +7,7 @@ import { renderPatchCall, renderPatchResult } from "./render.ts";
 import { formatPatchSummary } from "./summary.ts";
 
 const SUPPRESSED_TOOLS = new Set(["edit", "write"]);
+const PATCH_PROVIDERS = new Set(["openai", "openai-codex"]);
 
 const patchParams = Type.Object({
 	input: Type.String({
@@ -135,15 +136,15 @@ export default function patchExtension(pi: ExtensionAPI): void {
 	const rowState = createToolRowStateStore(pi, "patch.tool-row-state");
 	pi.registerTool(createPatchTool(rowState));
 
-	function configureMutationTools(model: { provider: string; id: string } | undefined): void {
+	function configureMutationTools(model: { provider: string } | undefined): void {
 		const active = new Set(pi.getActiveTools());
-		const usesGrok = model?.provider.toLowerCase() === "xai" || model?.id.toLowerCase().includes("grok") === true;
-		if (usesGrok) {
-			active.delete("patch");
-			for (const tool of SUPPRESSED_TOOLS) active.add(tool);
-		} else {
+		const usesPatch = model !== undefined && PATCH_PROVIDERS.has(model.provider.toLowerCase());
+		if (usesPatch) {
 			active.add("patch");
 			for (const tool of SUPPRESSED_TOOLS) active.delete(tool);
+		} else {
+			active.delete("patch");
+			for (const tool of SUPPRESSED_TOOLS) active.add(tool);
 		}
 		pi.setActiveTools([...active]);
 	}

package/extensions/soul/README.md

@@ -1,6 +1,6 @@
 # Soul
 
-Soul supplies Tau's system prompt: communication, discussion, planning, execution, and coding guidance. It is always on.
+Soul supplies Tau's system prompt: communication, discussion, planning, execution, coding, and tool-use guidance. It is always on.
 
 Soul adds Pi documentation pointers, tool guidance, and the context that other Tau extensions supply, such as the local date, directory snapshot, and automatic-check instructions. The date and directory snapshot are captured on the first prompt and again after successful compaction, so they stay fixed across turns, reload, resume, and tree navigation.
 

package/extensions/soul/index.ts

@@ -40,7 +40,12 @@ export default function soulExtension(pi: ExtensionAPI): void {
 		const active = pi.getActiveTools();
 		const guidance = [
 			...new Set([
-				...(active.includes("bash") ? ["Use bash for file operations like ls, rg, find."] : []),
+				...(active.includes("bash")
+					? [
+							"Use bash for file operations like ls, rg, find.",
+							"Bash already runs in the working directory; do not cd into it.",
+						]
+					: []),
 				...active.flatMap((name) => options.toolGuidelines[name] ?? []),
 				...options.promptGuidelines,
 			]),

package/extensions/soul/prompt.ts

@@ -36,11 +36,17 @@ Stay within that scope. Ask before making a consequential choice the user has no
 Take the normal supported path. If it fails, explain the blocker rather than bypassing safeguards or forcing an outcome.
 Complete the authorized work and check the result. Report what changed, what was checked, and anything unresolved.
 Give brief progress updates when work takes time or the direction changes.
-When gathering independent information, request it together rather than one item per turn.
 For authorized work, make reasonable low-risk assumptions and proceed. Ask when a missing answer affects correctness, scope, or consequences.
 Keep the final answer proportional to the request. Avoid turning a simple answer into a report with repeated summaries.
 </execution>
 
+<tool-use>
+Use the tools available to you for the purpose each is designed for.
+Prefer the file tools for ordinary reads, edits, and writes. Use bash or scripts when they express the work more directly and in fewer tokens: generating files, bulk mechanical transforms, or computation whose intermediate output does not need to be shown.
+Batch independent calls into one response: independent reads, searches, and edits go together, and only calls that depend on earlier results are sequenced.
+Keep tool output small: request only the data you need and prefer compact, high-signal commands over ones that flood the context.
+</tool-use>
+
 <coding>
 For a prototype, make the requested idea work with minimal setup and polish.
 For product code, follow the project conventions and reuse existing code, standard libraries, and installed dependencies before adding something new.

package/extensions/tau-help/help.md

@@ -78,7 +78,7 @@ Adds `/manage-sessions` to browse saved sessions and `/sweep` to archive or dele
 
 ## patch
 
-Replaces separate edit/write operations with one multi-file `patch` tool. It can create, rewrite, edit, move, and delete files in one structured call. Fewer tool calls means fewer turns, and each avoided turn prevents the full chat context from being sent again. Tau keeps `patch` disabled and uses `edit` and `write` for xAI and Grok models.
+Replaces separate edit/write operations with one multi-file `patch` tool. It can create, rewrite, edit, move, and delete files in one structured call. Fewer tool calls means fewer turns, and each avoided turn prevents the full chat context from being sent again. Tau enables `patch` only for OpenAI and OpenAI Codex models and uses `edit` and `write` for every other provider.
 
 ## qna
 
@@ -114,7 +114,7 @@ Runs configured commands while keeping their output out of agent context when th
 
 ## soul
 
-Supplies Tau's communication, discussion, planning, execution, and coding instructions, plus tool guidance and context from other Tau extensions. The date and directory snapshot stay fixed until successful compaction. Other changes, such as an edited `AGENTS.md` after `/reload`, arrive as appended updates without rewriting earlier instructions.
+Supplies Tau's communication, discussion, planning, execution, and coding instructions, plus tool-use rules, tool guidance, and context from other Tau extensions. The date and directory snapshot stay fixed until successful compaction. Other changes, such as an edited `AGENTS.md` after `/reload`, arrive as appended updates without rewriting earlier instructions.
 
 ## stash
 
@@ -130,7 +130,9 @@ Adds `/tau`, `/tau init [--global|--project]`, and `/tau doctor` for Tau setup a
 
 ## tool-approval
 
-Reviews agent `bash` and `script_runner` requests before they run. Common read-only bash commands skip review. Set `extensions.toolApproval.autoApprove` to run every reviewer-approved request without another confirmation. Those auto-approvals show a user-only marker. The reviewer approves routine local development work. Concrete destructive, system, production, privileged, or security-sensitive effects require human approval with one explanatory paragraph. Reviewer failures fall back to human approval and send an attention notification. In the terminal approval panel, press `n` to add a note to Approve or Reject before choosing. Rejection notes tell the agent why the request was blocked; approval notes reach it with the tool result without changing the request. Reject with a note to ask for a revised request.
+Reviews agent `bash` and `script_runner` requests before they run. Common read-only bash commands skip review. Visible, understood requests need one review; hidden local execution targets get bounded inspection and one final review, without repository exploration. Unverified execution behavior requires human approval. Set `extensions.toolApproval.autoApprove` to run every reviewer-approved request without another confirmation. Those auto-approvals show a user-only marker. The reviewer approves routine local development work. Concrete destructive, system, production, privileged, or security-sensitive effects require human approval with a plain-language explanation of the effect, affected target, risk, and recovery difficulty. Changes to inspected files invalidate approval. Reviewer failures fall back to human approval and send an attention notification. In the terminal approval panel, press `n` to add a note to Approve or Reject before choosing. Rejection notes tell the agent why the request was blocked; approval notes reach it with the tool result without changing the request. Reject with a note to ask for a revised request.
+
+Approval decisions are saved privately in the session JSONL, including allowlist skips, review stages and models, inspected paths, evidence-gap categories, and user decisions. These records stay out of model context and do not copy scripts, arguments, file contents, or raw errors.
 
 ## tool-loader
 

package/extensions/tool-approval/README.md

@@ -2,11 +2,19 @@
 
 Reviews agent `bash` and `script_runner` requests before they run.
 
-Common read-only bash commands skip review and run immediately. Other bash and every `script_runner` request go to a separate reviewer. For a `script_runner` retry with `scriptId` and edits, Tau reconstructs the full resulting script before review and runs that exact source after approval. A retry with missing or invalid stored source is blocked. When the agent requests several tools at once, Tau reviews up to three requests concurrently, with one model review focused on each request. Tau uses the reviewer model for the current provider, then the current chat model if that reviewer is unavailable or fails. If a reviewer model is unavailable or fails, Tau notifies and tries the next one. The reviewer returns a validated decision and one concise paragraph that explains the request.
+Common read-only bash commands skip review and run immediately. Other bash and every `script_runner` request go to a separate reviewer. The first review can approve, ask you, or request inspection of directly referenced code. Visible, understood requests need only one review. When inspection is needed, Tau reads exact execution targets and supported direct local dependencies, then makes one final review with the same reviewer model policy. Obvious local script execution cannot be automatically approved without inspection, even if the first reviewer misses it.
 
-With `autoApprove` enabled, reviewer-approved requests run without another confirmation. Tau shows a user-only marker with the reviewer model after those auto-approvals. Common read-only bash that skips review does not get a marker. Routine local development work should be approved, including requests that modify project files or run scripts. The reviewer asks for human approval only when it finds a concrete destructive, system, production, privileged, or security-sensitive effect.
+Inspection is limited to four files, 48 KiB of source, and a two-second file-work budget. Tau does not browse directories, search the repository, run code, or fetch remote code during review. It can inspect common literal Python, Node, Deno, and shell script invocations, local imports, subprocess targets, and package task definitions. Project npm execution settings are included without sending registry credentials. Unsupported Yarn executable configuration requires confirmation. Dynamic paths, unsupported execution forms, missing source, and exhausted limits require human approval with an explanation of what could not be verified. Installed tools and libraries retain their normal trust assumption; approval is a risk filter, not a sandbox or a proof that arbitrary code is safe.
 
-When approval is required, Tau shows one paragraph that explains the effect and risk without repeating the request. For `script_runner`, human confirmation also shows the complete script that will run. If several requests need approval, their confirmation windows open one at a time. If the reviewer fails or returns a malformed decision, Tau asks for direct human approval instead of running it automatically. Tau also sends an attention notification when the approval window opens.
+For a `script_runner` retry with `scriptId` and edits, Tau reconstructs the full resulting script before review and runs that exact source after approval. A retry with missing or invalid stored source is blocked. When the agent requests several tools at once, Tau reviews up to three requests concurrently, with each review focused on one request. Tau rechecks inspected file contents before using a decision and after human confirmation. Changed files invalidate approval; repeated changes or changes during confirmation block the request until the agent submits it again. These checks do not make shell execution atomic with file inspection.
+
+Tau uses the reviewer model for the current provider, then the current chat model if that reviewer is unavailable or fails. If a reviewer model is unavailable or fails, Tau notifies and tries the next one. Both review stages use this existing model policy.
+
+Each handled request saves a private decision record in the session JSONL under `tau.tool-approval.decision`. Records include the tool-call ID, tool name, approval or block decision, decision source and reason, review stages and reviewer models, inspected paths, evidence-gap categories, and elapsed time. They also cover allowlist skips, disabled approval, failed reviews, cancellations, and user rejection. These records are excluded from model context and follow the session's storage and deletion lifecycle. They do not copy command arguments, scripts, file contents, reviewer explanations, approval notes, or raw errors. Inspected paths are retained, so file names remain visible in the session.
+
+With `autoApprove` enabled, reviewer-approved requests run without another confirmation. Tau shows a user-only marker with the reviewer model after those auto-approvals. Common read-only bash that skips review does not get a marker. Routine local development work should be approved, including requests that modify project files or run inspected scripts. The reviewer asks for human approval when it finds a concrete destructive, system, production, privileged, or security-sensitive effect, or cannot verify important execution behavior.
+
+When approval is required, Tau shows one plain-language paragraph explaining what you are allowing, who or what is affected, why approval is needed, and what recovery might involve. It summarizes consequences rather than listing script steps or specialized APIs. If the issue is missing evidence rather than a known danger, it says what could not be checked. For `script_runner`, human confirmation also shows the complete script that will run. If several requests need approval, their confirmation windows open one at a time. If the reviewer fails or returns a malformed decision, Tau asks for direct human approval instead of running it automatically. Tau also sends an attention notification when the approval window opens.
 
 In the terminal approval panel, move between Approve and Reject, press `j` or `k` to scroll a script, press `n` to add a note to the highlighted choice, then press Enter to choose. Enter saves an edited note before choosing; Escape cancels note editing or blocks the request from the choice list. A rejection note tells the agent why the request was blocked. An approval note reaches the agent with the tool result; it does not change the request being approved. To ask for a different request, reject it with a note. Long notes are truncated. RPC clients use the standard confirmation dialog without notes.