tau-coding-agent 0.1.5 → 0.1.6

package/extensions/sandbox/macos-sandbox-shell.mjs

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+
+/**
+ * Compatibility workaround for sandbox-runtime on macOS.
+ *
+ * The runtime routes Git-over-SSH through BSD nc, which cannot authenticate to
+ * its SOCKS5 proxy. This shell preserves normal bash execution while replacing
+ * that transport with an authenticated HTTP CONNECT tunnel.
+ *
+ * Remove once the upstream fix ships:
+ * https://github.com/anthropic-experimental/sandbox-runtime/pull/385
+ */
+
+import { spawn } from "node:child_process";
+import { connect } from "node:net";
+import { fileURLToPath } from "node:url";
+
+const PROXY_CONNECT_MODE = "--proxy-connect";
+const CONNECT_TIMEOUT_MS = 15_000;
+const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
+
+if (process.argv[2] === PROXY_CONNECT_MODE) {
+  connectThroughSandboxProxy(process.argv[3], process.argv[4]);
+} else {
+  runBash(process.argv.slice(2));
+}
+
+function runBash(args) {
+  if (hasAuthenticatedSandboxProxy()) {
+    const scriptPath = fileURLToPath(import.meta.url);
+    const proxyCommand = [
+      shellQuote(escapeSshPercent(process.execPath)),
+      shellQuote(escapeSshPercent(scriptPath)),
+      PROXY_CONNECT_MODE,
+      "%h",
+      "%p",
+    ].join(" ");
+    process.env.GIT_SSH_COMMAND = [
+      "ssh",
+      "-o ControlMaster=no",
+      "-o ControlPath=none",
+      `-o ProxyCommand=${shellQuote(proxyCommand)}`,
+    ].join(" ");
+  }
+
+  const child = spawn("bash", args, {
+    env: process.env,
+    stdio: "inherit",
+  });
+  child.once("error", (error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+  child.once("exit", (code, signal) => {
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exitCode = code ?? 1;
+  });
+}
+
+function hasAuthenticatedSandboxProxy() {
+  try {
+    const proxy = getSandboxProxyUrl();
+    return proxy.protocol === "http:" && Boolean(proxy.username || proxy.password);
+  } catch {
+    return false;
+  }
+}
+
+function connectThroughSandboxProxy(targetHost, targetPortText) {
+  const targetPort = Number(targetPortText);
+  if (
+    !targetHost ||
+    /[\r\n]/u.test(targetHost) ||
+    !Number.isInteger(targetPort) ||
+    targetPort < 1 ||
+    targetPort > 65_535
+  ) {
+    fail("Invalid SSH proxy target.");
+  }
+
+  let proxy;
+  try {
+    proxy = getSandboxProxyUrl();
+  } catch (error) {
+    fail(error);
+  }
+  if (proxy.protocol !== "http:") {
+    fail(`Unsupported sandbox proxy protocol: ${proxy.protocol}`);
+  }
+
+  const proxyPort = Number(proxy.port || 80);
+  const authority = targetHost.includes(":")
+    ? `[${targetHost}]:${targetPort}`
+    : `${targetHost}:${targetPort}`;
+  let username;
+  let password;
+  try {
+    username = decodeURIComponent(proxy.username);
+    password = decodeURIComponent(proxy.password);
+  } catch {
+    fail("Sandbox HTTP proxy credentials are invalid.");
+  }
+  const authorization =
+    username || password
+      ? `Proxy-Authorization: Basic ${Buffer.from(`${username}:${password}`).toString("base64")}\r\n`
+      : "";
+
+  const socket = connect({ host: proxy.hostname, port: proxyPort });
+  const connectTimeout = setTimeout(() => {
+    socket.destroy(new Error("Sandbox proxy connection timed out."));
+  }, CONNECT_TIMEOUT_MS);
+  let response = Buffer.alloc(0);
+  let tunnelEstablished = false;
+  let connectionFailed = false;
+
+  socket.once("connect", () => {
+    clearTimeout(connectTimeout);
+    socket.write(
+      `CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n${authorization}Proxy-Connection: Keep-Alive\r\n\r\n`,
+    );
+  });
+
+  const failConnection = (error) => {
+    if (connectionFailed) return;
+    connectionFailed = true;
+    clearTimeout(connectTimeout);
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+    socket.destroy();
+  };
+
+  const handleResponse = (chunk) => {
+    response = Buffer.concat([response, chunk]);
+    if (response.length > MAX_RESPONSE_HEADER_BYTES) {
+      failConnection(new Error("Sandbox proxy returned oversized headers."));
+      return;
+    }
+
+    const headerEnd = response.indexOf("\r\n\r\n");
+    if (headerEnd === -1) return;
+
+    const header = response.subarray(0, headerEnd).toString("latin1");
+    const status = header.match(/^HTTP\/\d(?:\.\d)?\s+(\d{3})/u)?.[1];
+    if (status !== "200") {
+      failConnection(new Error(`Sandbox proxy CONNECT failed${status ? ` (${status})` : ""}.`));
+      return;
+    }
+
+    tunnelEstablished = true;
+    socket.off("data", handleResponse);
+    const remainder = response.subarray(headerEnd + 4);
+    if (remainder.length > 0) process.stdout.write(remainder);
+    process.stdin.pipe(socket);
+    socket.pipe(process.stdout);
+  };
+
+  socket.on("data", handleResponse);
+  socket.once("error", failConnection);
+  socket.once("close", () => {
+    clearTimeout(connectTimeout);
+    process.stdin.unpipe(socket);
+    process.stdin.pause();
+    if (!tunnelEstablished && !connectionFailed) {
+      failConnection(new Error("Sandbox proxy closed before establishing the SSH tunnel."));
+    }
+  });
+  process.stdin.on("error", failConnection);
+  process.stdout.on("error", (error) => {
+    if (error?.code === "EPIPE") {
+      socket.destroy();
+      return;
+    }
+    failConnection(error);
+  });
+}
+
+function getSandboxProxyUrl() {
+  const value = process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY;
+  if (!value) throw new Error("Sandbox HTTP proxy is unavailable.");
+
+  try {
+    return new URL(value);
+  } catch {
+    throw new Error("Sandbox HTTP proxy URL is invalid.");
+  }
+}
+
+function escapeSshPercent(value) {
+  return value.replaceAll("%", "%%");
+}
+
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+
+function fail(error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}

package/extensions/usage/anthropic.ts

@@ -1,4 +1,4 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { readStoredCredential, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   clampPercent,
   formatCurrency,
@@ -111,7 +111,7 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   const token = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER_ID);
   if (!token) throw new LiveUsageUnavailableError("no auth configured");
 
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
+  const credential = readStoredCredential(PROVIDER_ID);
   if (credential?.type === "api_key") {
     throw new LiveUsageUnavailableError("API-key auth does not expose Claude subscription quota");
   }
@@ -170,12 +170,11 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   };
 }
 
-async function getLiveUsageAvailability(ctx: ExtensionContext) {
-  if (!ctx.modelRegistry.authStorage.hasAuth(PROVIDER_ID)) {
+async function getLiveUsageAvailability(_ctx: ExtensionContext) {
+  const credential = readStoredCredential(PROVIDER_ID);
+  if (!credential) {
     return { available: false as const, reason: "no auth configured" };
   }
-
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
   if (credential?.type === "oauth") {
     return { available: true as const };
   }

package/extensions/usage/github-copilot.ts

@@ -1,4 +1,5 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { OAuthCredential } from "@earendil-works/pi-ai";
+import { readStoredCredential, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   clampPercent,
   formatCount,
@@ -8,7 +9,12 @@ import {
   readNumber,
   readString,
 } from "./shared.js";
-import type { LiveUsageItem, LiveUsageSnapshot, UsageProviderDefinition } from "./types.js";
+import type {
+  LiveUsageAvailability,
+  LiveUsageItem,
+  LiveUsageSnapshot,
+  UsageProviderDefinition,
+} from "./types.js";
 
 const PROVIDER_ID = "github-copilot";
 
@@ -136,13 +142,18 @@ function buildUsageUrl(enterpriseUrl?: string): string {
   return `https://${host}/copilot_internal/user`;
 }
 
-async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<LiveUsageSnapshot> {
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
-  if (
-    credential?.type !== "oauth" ||
-    typeof credential.refresh !== "string" ||
-    !credential.refresh.trim()
-  ) {
+async function getLiveUsageAvailability(_ctx: ExtensionContext): Promise<LiveUsageAvailability> {
+  return getStoredCopilotCredential()
+    ? { available: true }
+    : { available: false, reason: "not logged in" };
+}
+
+async function fetchUsage(
+  _ctx: ExtensionContext,
+  signal?: AbortSignal,
+): Promise<LiveUsageSnapshot> {
+  const credential = getStoredCopilotCredential();
+  if (!credential) {
     throw new Error("Not logged in to GitHub Copilot.");
   }
 
@@ -193,11 +204,21 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   };
 }
 
+function getStoredCopilotCredential(): OAuthCredential | undefined {
+  const credential = readStoredCredential(PROVIDER_ID);
+  return credential?.type === "oauth" &&
+    typeof credential.refresh === "string" &&
+    credential.refresh.trim()
+    ? credential
+    : undefined;
+}
+
 const githubCopilotProvider: UsageProviderDefinition = {
   id: PROVIDER_ID,
   label: "GitHub Copilot",
   shortLabel: "copilot",
   color: { r: 168, g: 85, b: 247 },
+  getLiveUsageAvailability,
   fetchLiveUsage: fetchUsage,
 };
 

package/extensions/usage/index.ts

@@ -1433,7 +1433,7 @@ async function getLiveUsageAvailability(
     return provider.getLiveUsageAvailability(ctx);
   }
 
-  return ctx.modelRegistry.authStorage.hasAuth(provider.id)
+  return ctx.modelRegistry.getProviderAuthStatus(provider.id).configured
     ? { available: true }
     : { available: false, reason: "no auth configured" };
 }

package/extensions/usage/openai-codex.ts

@@ -1,4 +1,4 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { readStoredCredential, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   clampPercent,
   formatCurrency,
@@ -112,7 +112,7 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   const apiKey = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER_ID);
   if (!apiKey) throw new Error("Not logged in to OpenAI Codex.");
 
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
+  const credential = readStoredCredential(PROVIDER_ID);
   const accountId =
     credential?.type === "oauth" && typeof credential.accountId === "string"
       ? credential.accountId

package/extensions/websearch/providers/pi-model.shared.ts

@@ -5,6 +5,7 @@ export interface PiModelSelection {
   model: Model<Api>;
   apiKey?: string;
   headers?: Record<string, string>;
+  env?: Record<string, string>;
 }
 
 export async function selectCurrentPiModel(
@@ -42,7 +43,24 @@ async function resolvePiModelSelection(
   ctx: Pick<ExtensionContext, "modelRegistry">,
 ): Promise<PiModelSelection | null> {
   const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
-  return auth.ok ? { model, apiKey: auth.apiKey, headers: auth.headers } : null;
+  return auth.ok
+    ? {
+        model: resolveModelEnv(model, auth.env),
+        apiKey: auth.apiKey,
+        headers: auth.headers,
+        env: auth.env,
+      }
+    : null;
+}
+
+function resolveModelEnv(model: Model<Api>, env?: Record<string, string>): Model<Api> {
+  if (!model.baseUrl || !env) return model;
+
+  let baseUrl = model.baseUrl;
+  for (const [name, value] of Object.entries(env)) {
+    baseUrl = baseUrl.replaceAll(`{${name}}`, value);
+  }
+  return baseUrl === model.baseUrl ? model : { ...model, baseUrl };
 }
 
 function rankPiModels(models: Model<Api>[]): Model<Api>[] {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tau-coding-agent",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Opinionated Pi package with web search, review workflows, sandboxing, memory, usage reporting, skills, and a theme",
   "keywords": [
     "agent-tools",
@@ -27,7 +27,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@anthropic-ai/sandbox-runtime": "^0.0.49",
+    "@anthropic-ai/sandbox-runtime": "^0.0.67",
     "@mozilla/readability": "^0.6.0",
     "jsdom": "^29.0.2",
     "puppeteer-core": "^24.40.0",

package/skills/oracle/SKILL.md

@@ -43,14 +43,14 @@ Run commands from this skill directory:
 ./scripts/oracle-bundle -p "<task>" --file "src/**" --file "!**/*.test.*"
 
 # Show which oracle model would be selected
-./scripts/oracle --list-models --current openai-codex/gpt-5.5
+./scripts/oracle --list-models --current openai-codex/gpt-5.6-sol
 
 # Ask the automatically selected oracle model
-./scripts/oracle --current openai-codex/gpt-5.5 \
+./scripts/oracle --current openai-codex/gpt-5.6-sol \
   -p "<task>" --file "src/**" --file "!**/*.test.*"
 
 # Override the oracle model when the automatic choice is wrong
-./scripts/oracle --model github-copilot/claude-opus-4.7 \
+./scripts/oracle --model anthropic/claude-fable-5 \
   -p "<task>" --file "src/**" --file "!**/*.test.*"
 ```
 

package/skills/oracle/scripts/oracle

@@ -144,82 +144,86 @@ function selectOracleModel(models, enabledModels, currentFamily) {
 
 function bestModelForFamily(models, enabledModels, family) {
   return models
-    .map((model) => ({ model, score: scoreModel(model, enabledModels, family) }))
-    .filter((entry) => entry.score >= 0)
-    .sort((a, b) => b.score - a.score || a.model.spec.localeCompare(b.model.spec))[0]?.model;
+    .filter((model) => modelFamily(model.spec) === family)
+    .sort((left, right) => compareModels(left, right, enabledModels, family))[0];
 }
 
-function scoreModel(entry, enabledModels, targetFamily) {
-  if (modelFamily(entry.spec) !== targetFamily) return -1;
-
-  let score = enabledModels.has(normalizeModelSpec(entry.spec)) ? 10_000 : 0;
-  score += providerScore(entry.provider, targetFamily);
-  score += nameScore(entry.model, targetFamily);
-  return score;
+function compareModels(left, right, enabledModels, family) {
+  return (
+    Number(enabledModels.has(normalizeModelSpec(right.spec))) -
+      Number(enabledModels.has(normalizeModelSpec(left.spec))) ||
+    modelRank(right.model, family) - modelRank(left.model, family) ||
+    providerRank(right.provider, family) - providerRank(left.provider, family) ||
+    left.spec.localeCompare(right.spec)
+  );
 }
 
-function providerScore(provider, family) {
+function providerRank(provider, family) {
   const normalized = provider.toLowerCase();
   if (family === "openai") {
-    if (normalized === "openai-codex") return 700;
-    if (normalized === "openai") return 600;
-    if (normalized === "github-copilot") return 500;
-    if (normalized.includes("azure")) return 450;
-    if (normalized === "openrouter") return 300;
-    return 100;
+    if (normalized === "openai-codex") return 5;
+    if (normalized === "openai") return 4;
+    if (normalized === "github-copilot") return 3;
+    if (normalized.includes("azure")) return 2;
+    if (normalized === "openrouter") return 1;
+    return 0;
   }
 
   if (family === "anthropic") {
-    if (normalized === "github-copilot") return 700;
-    if (normalized === "anthropic") return 600;
-    if (normalized === "amazon-bedrock") return 450;
-    if (normalized === "openrouter") return 300;
-    return 100;
+    if (normalized === "github-copilot") return 4;
+    if (normalized === "anthropic") return 3;
+    if (normalized === "amazon-bedrock") return 2;
+    if (normalized === "openrouter") return 1;
+    return 0;
   }
 
   if (family === "google") {
-    if (normalized === "google") return 600;
-    if (normalized === "github-copilot") return 500;
-    if (normalized.includes("vertex")) return 450;
-    if (normalized === "openrouter") return 300;
-    return 100;
+    if (normalized === "google") return 4;
+    if (normalized === "github-copilot") return 3;
+    if (normalized.includes("vertex")) return 2;
+    if (normalized === "openrouter") return 1;
+    return 0;
   }
 
   return 0;
 }
 
-function nameScore(model, family) {
+function modelRank(model, family) {
   const normalized = model.toLowerCase();
 
   if (family === "openai") {
-    if (/gpt-5\.5/.test(normalized)) return 1_000;
-    if (/gpt-5\.4/.test(normalized)) return 950;
-    if (/gpt-5\.3.*codex/.test(normalized)) return 925;
-    if (/gpt-5\.3/.test(normalized)) return 900;
-    if (/gpt-5\.2/.test(normalized)) return 850;
-    if (/gpt-5\.1/.test(normalized)) return 800;
-    if (/gpt-5/.test(normalized)) return 750;
-    if (/gpt-4\.1/.test(normalized)) return 500;
-    return 100;
+    if (/gpt-5\.6[-_.]sol/.test(normalized)) return 10;
+    if (/gpt-5\.6/.test(normalized)) return 9;
+    if (/gpt-5\.5/.test(normalized)) return 8;
+    if (/gpt-5\.4/.test(normalized)) return 7;
+    if (/gpt-5\.3.*codex/.test(normalized)) return 6;
+    if (/gpt-5\.3/.test(normalized)) return 5;
+    if (/gpt-5\.2/.test(normalized)) return 4;
+    if (/gpt-5\.1/.test(normalized)) return 3;
+    if (/gpt-5/.test(normalized)) return 2;
+    if (/gpt-4\.1/.test(normalized)) return 1;
+    return 0;
   }
 
   if (family === "anthropic") {
-    if (/claude[-_.]opus[-_.]4[-_.]7/.test(normalized)) return 1_000;
-    if (/claude[-_.]opus[-_.]4[-_.]6/.test(normalized)) return 950;
-    if (/claude[-_.]opus[-_.]4[-_.]5/.test(normalized)) return 900;
-    if (/claude[-_.]opus[-_.]4[-_.]1/.test(normalized)) return 850;
-    if (/claude[-_.]opus[-_.]4/.test(normalized)) return 800;
-    if (/claude[-_.]sonnet[-_.]4[-_.]6/.test(normalized)) return 700;
-    if (/claude[-_.]sonnet[-_.]4[-_.]5/.test(normalized)) return 650;
-    if (/claude[-_.]sonnet[-_.]4/.test(normalized)) return 600;
-    return 100;
+    if (/claude[-_.]fable[-_.]5/.test(normalized)) return 10;
+    if (/claude[-_.]opus[-_.]4[-_.]8/.test(normalized)) return 9;
+    if (/claude[-_.]opus[-_.]4[-_.]7/.test(normalized)) return 8;
+    if (/claude[-_.]opus[-_.]4[-_.]6/.test(normalized)) return 7;
+    if (/claude[-_.]opus[-_.]4[-_.]5/.test(normalized)) return 6;
+    if (/claude[-_.]opus[-_.]4[-_.]1/.test(normalized)) return 5;
+    if (/claude[-_.]opus[-_.]4/.test(normalized)) return 4;
+    if (/claude[-_.]sonnet[-_.]4[-_.]6/.test(normalized)) return 3;
+    if (/claude[-_.]sonnet[-_.]4[-_.]5/.test(normalized)) return 2;
+    if (/claude[-_.]sonnet[-_.]4/.test(normalized)) return 1;
+    return 0;
   }
 
   if (family === "google") {
-    if (/gemini[-_.]3\.1[-_.]pro/.test(normalized)) return 1_000;
-    if (/gemini[-_.]3[-_.]pro/.test(normalized)) return 950;
-    if (/gemini[-_.]2\.5[-_.]pro/.test(normalized)) return 800;
-    return 100;
+    if (/gemini[-_.]3\.1[-_.]pro/.test(normalized)) return 3;
+    if (/gemini[-_.]3[-_.]pro/.test(normalized)) return 2;
+    if (/gemini[-_.]2\.5[-_.]pro/.test(normalized)) return 1;
+    return 0;
   }
 
   return 0;