ms-tau-sdk 1.2.14.dev25__tar.gz → 1.3.0.dev26__tar.gz

{ms_tau_sdk-1.2.14.dev25 → ms_tau_sdk-1.3.0.dev26}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## Unreleased
+
+- Project skills stay available with `TAU_EXCLUDE_BASE_TOOLS=true`. Tau lists skills in the system
+  prompt only when a tool named `read` exists, so excluding the four coding tools also removed
+  every skill in `.tau/skills/`. The SDK now registers a `read` tool in their place that opens only
+  the files of the skills Tau discovered for the session: a skill's `SKILL.md` and the files in its
+  directory, such as `references/*.md`. It rejects every other path, including other workspace
+  files, system paths, `..` escapes, and symlinks that resolve outside the skill, so the process
+  environment and its credentials stay out of reach. It keeps Tau's `offset`, `limit`, and output
+  limits. With both exclusions set, the catalog is project tools, this `read`, and the two Task
+  controls. In this mode a project extension that registers `read` fails on session load and on
+  reload. With base tools included nothing changes. See the 2026-10-05 amendment of ADR 0011
+  ([#54](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/54)).
+
 ## 1.2.14 — 2026-10-01
 
 - The repository structure reference now shows Tau Board: the tree lists `packages/tau-board/` and

{ms_tau_sdk-1.2.14.dev25 → ms_tau_sdk-1.3.0.dev26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 1.2.14.dev25
+Version: 1.3.0.dev26
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs

{ms_tau_sdk-1.2.14.dev25 → ms_tau_sdk-1.3.0.dev26}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "1.2.14.dev25"
+version = "1.3.0.dev26"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-1.2.14.dev25 → ms_tau_sdk-1.3.0.dev26}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -52,7 +52,7 @@ Two independent process settings select the host-provided tools. Both default to
 
 | Setting | Effect when `true` |
 | --- | --- |
-| `TAU_EXCLUDE_BASE_TOOLS` | Omit Tau's `read`, `write`, `edit`, and `bash`. |
+| `TAU_EXCLUDE_BASE_TOOLS` | Replace Tau's `read`, `write`, `edit`, and `bash` with a skill-scoped `read`. |
 | `TAU_EXCLUDE_MAINSEQUENCE_MCP` | Skip Main Sequence MCP connection, tools, resources, and resource prompt. |
 
 Set them in `harness_agent.spec.env_vars` in a managed repository workflow, in the process
@@ -67,15 +67,18 @@ Task controls requires an actual Task context and is specified by ADR 0015.
 | Exclude base tools | Exclude Main Sequence MCP | Model-facing sources |
 | --- | --- | --- |
 | `false` | `false` | Coding tools, Main Sequence MCP, project extension tools, A2A Task controls. |
-| `true` | `false` | Main Sequence MCP, project extension tools, A2A Task controls. |
+| `true` | `false` | Skill-scoped `read`, Main Sequence MCP, project extension tools, A2A Task controls. |
 | `false` | `true` | Coding tools, project extension tools, A2A Task controls. |
-| `true` | `true` | Project extension tools and A2A Task controls. |
+| `true` | `true` | Skill-scoped `read`, project extension tools, and A2A Task controls. |
 
 The A2A Task controls are `task_request_input` and `task_request_authorization`. They remain
 available in every mode for the agent's own Task; extensions must not register those names.
 Register project tools under `.tau/extensions/` and verify the effective catalog after loading.
-With `read` excluded, Tau 0.4.2 does not insert discovered skills into the system prompt. Put
-needed guidance in the effective `.tau/SYSTEM.md` or expose it through a declared retrieval tool.
+With base tools excluded, the skill-scoped `read` keeps `.tau/skills/` available: it opens a
+discovered skill's `SKILL.md` and the files in its directory, such as `references/*.md`, and
+rejects every other path, including symlinks that resolve outside the skill. Tau lists the skills
+in the system prompt because a tool named `read` exists. Extensions must not register `read` in
+this mode.
 Excluding coding tools does not sandbox extension Python code.
 
 ## Invariants extensions must not replace

{ms_tau_sdk-1.2.14.dev25 → ms_tau_sdk-1.3.0.dev26}/src/ms_tau_sdk/runtime/extensions.py

@@ -18,6 +18,7 @@ def validate_tool_catalog(
     *,
     sdk_tool_names: frozenset[str],
     require_complete_project_catalog: bool,
+    reserved_sdk_tool_names: frozenset[str] = frozenset(),
 ) -> None:
     """Reject extension overrides and catalog drift before a model can use tools."""
     sources = session.extension_tool_sources
@@ -26,6 +27,11 @@ def validate_tool_catalog(
         raise ConfigurationError(
             "Project extensions cannot replace A2A Task controls: " + ", ".join(sorted(reserved))
         )
+    replaced = reserved_sdk_tool_names & sources.keys()
+    if replaced:
+        raise ConfigurationError(
+            "Project extensions cannot replace reserved SDK tools: " + ", ".join(sorted(replaced))
+        )
     names = [tool.name for tool in session.tools]
     expected = sdk_tool_names | sources.keys()
     if len(names) != len(set(names)) or set(names) != expected:

{ms_tau_sdk-1.2.14.dev25 → ms_tau_sdk-1.3.0.dev26}/src/ms_tau_sdk/runtime/manager.py

@@ -77,6 +77,7 @@ from ms_tau_sdk.tools.mainsequence_mcp import (
     create_mainsequence_mcp_tools,
     mainsequence_mcp_resource_prompt,
 )
+from ms_tau_sdk.tools.skill_read import create_skill_read_tool
 from ms_tau_sdk.tools.task_control import create_task_control_tools
 
 from .session import ActiveSessionRuntime, PlatformEvent
@@ -1123,7 +1124,11 @@ class SessionRuntimeManager:
                     "lease_token": lease.lease_token,
                 }
             tools = []
-            if not self.settings.exclude_base_tools:
+            if self.settings.exclude_base_tools:
+                # Tau lists skills only when a tool named `read` exists. The tool runs only in
+                # this session's turns, after `coding_session` is bound below.
+                tools.append(create_skill_read_tool(cwd=cwd, skills=lambda: coding_session.skills))
+            else:
                 tools.extend(create_coding_tools(cwd=cwd))
             if mcp_client is not None:
                 tools.extend(
@@ -1140,12 +1145,16 @@ class SessionRuntimeManager:
             require_complete_project_catalog = (
                 self.settings.exclude_base_tools and self.settings.exclude_mainsequence_mcp
             )
+            reserved_sdk_tool_names = (
+                frozenset({"read"}) if self.settings.exclude_base_tools else frozenset()
+            )
 
             def check_catalog(session: CodingSession) -> None:
                 validate_tool_catalog(
                     session,
                     sdk_tool_names=sdk_tool_names,
                     require_complete_project_catalog=require_complete_project_catalog,
+                    reserved_sdk_tool_names=reserved_sdk_tool_names,
                 )
 
             coding_session = await CodingSession.load(

ms_tau_sdk-1.3.0.dev26/src/ms_tau_sdk/tools/skill_read.py

@@ -0,0 +1,52 @@
+"""Tau's `read` tool limited to the files of discovered skills."""
+
+from __future__ import annotations
+
+import dataclasses
+from collections.abc import Callable, Iterable
+from pathlib import Path
+
+from tau_agent.tools import AgentTool
+from tau_coding.skills import Skill
+from tau_coding.tools import (
+    DEFAULT_MAX_OUTPUT_BYTES,
+    DEFAULT_MAX_OUTPUT_LINES,
+    DEFAULT_READ_OPERATIONS,
+    ToolInputError,
+    create_read_tool_definition,
+)
+
+
+def create_skill_read_tool(*, cwd: Path, skills: Callable[[], Iterable[Skill]]) -> AgentTool:
+    """Create a `read` tool that serves only the files of the session's discovered skills.
+
+    Tau lists skills in the system prompt only when a tool named `read` exists. With the coding
+    tools excluded, this tool keeps project skills available without exposing any other file.
+    `skills` is called on every read, so a Tau reload changes what the tool serves.
+    """
+
+    def validate_path(path: Path) -> None:
+        resolved = path.resolve()
+        if not any(
+            resolved == skill.path.resolve() or resolved.is_relative_to(skill.path.parent.resolve())
+            for skill in skills()
+        ):
+            raise ToolInputError(f"Path is outside the available skills: {path}")
+        DEFAULT_READ_OPERATIONS.validate_path(path)
+
+    definition = create_read_tool_definition(
+        cwd=cwd,
+        operations=dataclasses.replace(DEFAULT_READ_OPERATIONS, validate_path=validate_path),
+    )
+    return dataclasses.replace(
+        definition,
+        description=(
+            "Read a file of one of the available skills: its SKILL.md or another file in its "
+            "skill directory, such as a referenced document. Every other path is rejected. "
+            f"Output is truncated to {DEFAULT_MAX_OUTPUT_LINES} lines or "
+            f"{DEFAULT_MAX_OUTPUT_BYTES // 1024}KB (whichever is hit first). Use offset/limit "
+            "for large files. When you need the full file, continue with offset until complete."
+        ),
+        prompt_snippet="Read the files of the available skills",
+        prompt_guidelines=(),
+    ).to_agent_tool()