privateer-agent 0.1.1 → 0.2.1

package/src/components/App.tsx

@@ -7,6 +7,7 @@ import { Banner } from "./Banner.tsx";
 import { StatusBar, formatTokens, formatDuration } from "./StatusBar.tsx";
 import { RowView, groupRows, visualRows, clampStreamingText } from "./Transcript.tsx";
 import { ApprovalPrompt } from "./ApprovalPrompt.tsx";
+import { OptionPicker } from "./OptionPicker.tsx";
 import { ModelPicker } from "./ModelPicker.tsx";
 import { PromptInput } from "./PromptInput.tsx";
 import { PlanConfirm } from "./PlanConfirm.tsx";
@@ -35,13 +36,20 @@ import { createSession } from "../session.ts";
 import { QueryEngine } from "../engine/QueryEngine.ts";
 import { emptyUsage, type UsageTotals } from "../engine/events.ts";
 import { runCommand, commandList } from "../commands/registry.ts";
+import { sendToDaemon, DaemonNotRunningError } from "../daemon/ipc.ts";
+import { drainNotices } from "../routines/store.ts";
+import { describeTrigger } from "../routines/trigger.ts";
+import type { Routine } from "../routines/schema.ts";
 import { isSlashCommand } from "./promptModel.ts";
 import { loadCustomCommands } from "../commands/custom.ts";
+import { loadSkills } from "../skills/loader.ts";
+import { installSkills, removeSkill } from "../skills/installer.ts";
 import { saveGlobalConfig } from "../config/load.ts";
-import { logout as privateerLogout, hasCredentials } from "../auth/privateer.ts";
+import { logout as privateerLogout, hasCredentials, onSessionExpired, warmSession } from "../auth/privateer.ts";
 import { RelayClient } from "../remote/relayClient.ts";
 import { ModeGate, type AskOutcome } from "../permissions/uiGate.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
+import type { UserQuestion, UserAnswer, UserAsker } from "../tools/askUser.ts";
 import {
   saveSession,
   loadSession,
@@ -51,7 +59,7 @@ import {
   type SessionData,
   type SessionMeta,
 } from "../memory/store.ts";
-import { theme } from "./theme.ts";
+import { theme, toolDisplayName } from "./theme.ts";
 import { DOWN } from "./figures.ts";
 import { randomVerb } from "./spinnerVerbs.ts";
 
@@ -60,12 +68,33 @@ interface PendingApproval {
   resolve: (outcome: AskOutcome) => void;
 }
 
+// An `ask_user` question awaiting the user's choice in the TUI; mirrors how a
+// PendingApproval parks a tool blocked on the human.
+interface PendingQuestion {
+  q: UserQuestion;
+  resolve: (answer: UserAnswer) => void;
+}
+
 const BANNER = "__banner__";
 
 function asText(output: unknown): string {
   return typeof output === "string" ? output : JSON.stringify(output);
 }
 
+// Render the daemon's routine list for /routine.
+function formatRoutines(routines: Routine[]): string {
+  if (routines.length === 0) {
+    return "No routines. Ask the agent to create one (e.g. \"summarize world news every morning\").";
+  }
+  const lines = routines.map((r) => {
+    const state = r.enabled ? "▶" : "⏸";
+    const next = r.enabled && r.nextRun ? new Date(r.nextRun).toLocaleString() : "paused";
+    const last = r.lastRun ? ` · last ${r.lastStatus ?? "?"} ${new Date(r.lastRun).toLocaleString()}` : "";
+    return `  ${state} ${r.name} — ${describeTrigger(r)} → ${next} [${r.delivery.join(",")}]${last}`;
+  });
+  return `Routines:\n${lines.join("\n")}\n\n/routine pause|resume|rm|run <name>`;
+}
+
 // Rows of fixed chrome below the live transcript (spinner, todo, status bar, the
 // bordered input + mode hint) that the streaming text must leave room for, so the
 // dynamic region never outgrows the viewport and tips Ink into full-screen repaint.
@@ -95,13 +124,16 @@ function mergeAgentMetrics(
 
 // Project the committed transcript into structured feed items for a remote
 // controller's catch-up snapshot, mirroring the live event kinds the app renders.
+// Whitespace-only assistant/thinking entries (possible in transcripts persisted
+// before the empty-block guard in the turn loop) are dropped — the app would
+// render each one as a blank gap in its feed.
 function snapshotEntries(entries: Entry[]): { kind: string; text: string }[] {
   const out: { kind: string; text: string }[] = [];
   for (const e of entries) {
     if (e.kind === "user") out.push({ kind: "you", text: e.text });
-    else if (e.kind === "assistant") out.push({ kind: "assistant", text: e.text });
-    else if (e.kind === "thinking") out.push({ kind: "reasoning", text: e.text });
-    else if (e.kind === "tool") out.push({ kind: "tool", text: `▸ ${e.name} — ${e.status}` });
+    else if (e.kind === "assistant" && e.text.trim()) out.push({ kind: "assistant", text: e.text });
+    else if (e.kind === "thinking" && e.text.trim()) out.push({ kind: "reasoning", text: e.text });
+    else if (e.kind === "tool") out.push({ kind: "tool", text: `▸ ${toolDisplayName(e.name)} — ${e.status}` });
     else if (e.kind === "notice") out.push({ kind: "notice", text: e.text });
   }
   return out;
@@ -162,6 +194,7 @@ export function App({
   const [lastTurnUsage, setLastTurnUsage] = useState<UsageTotals>(emptyUsage());
   const [sessionError, setSessionError] = useState<string | null>(null);
   const [pending, setPending] = useState<PendingApproval | null>(null);
+  const [pendingQuestion, setPendingQuestion] = useState<PendingQuestion | null>(null);
   const [picking, setPicking] = useState(false);
   const [todos, setTodos] = useState<TodoItem[]>([]);
   const [verb, setVerb] = useState(randomVerb());
@@ -253,7 +286,12 @@ export function App({
 
   // Custom slash commands from .privateer/commands, plus the merged autocomplete list.
   const customCommands = useMemo(() => loadCustomCommands(cwd), [cwd]);
-  const commands = useMemo(() => commandList(customCommands), [customCommands]);
+  // Agent skills from .privateer/skills. The epoch bumps after /skills install|remove
+  // so this list — and the session, whose skill-tool catalog is baked in at build
+  // time — pick up the change.
+  const [skillsEpoch, setSkillsEpoch] = useState(0);
+  const skills = useMemo(() => loadSkills(cwd).skills, [cwd, skillsEpoch]);
+  const commands = useMemo(() => commandList(customCommands, skills), [customCommands, skills]);
   // Lifecycle hooks (UserPromptSubmit / Stop) configured in settings.
   const hooks = useMemo(() => new HookRunner(loadHooks((config as any).hooks), cwd), [cwd]);
 
@@ -301,6 +339,18 @@ export function App({
     [],
   );
 
+  // Bridge the `ask_user` tool to the TUI: park the question's resolver in state so
+  // the OptionPicker can render and resolve it, exactly like the approval prompt. A
+  // remote-driven turn has no local human to ask, so it resolves as dismissed and the
+  // model falls back to its own judgment.
+  const askUser = useMemo<UserAsker>(
+    () => (q) =>
+      currentTurnRemoteRef.current
+        ? Promise.resolve({ kind: "dismissed" as const })
+        : new Promise<UserAnswer>((resolve) => setPendingQuestion({ q, resolve })),
+    [],
+  );
+
   // Build (and rebuild on model / output-style change) the agent session, carrying
   // history forward.
   useEffect(() => {
@@ -312,6 +362,7 @@ export function App({
         modelSpec,
         cwd,
         gate,
+        askUser,
         confineToCwd: config.confineToCwd,
         allowedOutsideRoots: allowedOutsideRootsRef.current,
         outputStyle: outputStyle ?? undefined,
@@ -321,6 +372,16 @@ export function App({
         processes: processesRef.current,
         attachments: attachmentsRef.current,
         onSubAgentMetrics: (id, m) => subAgentMetricsRef.current.set(id, m),
+        // Read the ref at call time: the relay lives in its own effect (the
+        // /remote-access toggle), so this closure stays valid across session
+        // rebuilds and remote on/off flips.
+        sendFileToController: (file) => {
+          const client = relayRef.current;
+          if (!client) {
+            return Promise.resolve({ ok: false, reason: "remote access is off (/remote-access to enable)" });
+          }
+          return client.sendFile(file);
+        },
       });
       if (prev) {
         session.engine.messages.push(...prev.messages);
@@ -345,7 +406,7 @@ export function App({
     // Rebuild on model/style change, and when entering/leaving plan mode (so the
     // system prompt gains or loses the plan-mode mandate) — not on every mode change.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [modelSpec, outputStyle, mode === "plan", mcpTools, zdrEnforced]);
+  }, [modelSpec, outputStyle, mode === "plan", mcpTools, zdrEnforced, skillsEpoch]);
 
   // One-time notice when resuming a prior conversation.
   useEffect(() => {
@@ -357,6 +418,22 @@ export function App({
     }
   }, []);
 
+  // Surface any scheduled-routine results that finished while no terminal was
+  // attached ("notice" delivery). Drained once on startup.
+  useEffect(() => {
+    const pending = drainNotices();
+    if (pending.length === 0) return;
+    const lines = pending.map((n) => {
+      const mark = n.status === "ok" ? "⏺" : "✗";
+      const where = n.path ? ` (${n.path})` : "";
+      return `  ${mark} ${n.routine}: ${n.preview}${where}`;
+    });
+    setCommitted((c) => [
+      { kind: "notice", text: `Scheduled routine results:\n${lines.join("\n")}` },
+      ...c,
+    ]);
+  }, []);
+
   // Keep a live mirror of the committed transcript so checkpoints can record its
   // length synchronously (the useInput/runTurn closures can lag a render).
   useEffect(() => {
@@ -508,6 +585,13 @@ export function App({
         append({ kind: "notice", text: `📎 received ${file.name} from app` });
       },
       onInterrupt: () => abortRef.current?.abort(),
+      // The app's "End remote access" — same as typing /remote-access off. Flipping
+      // remoteEnabled runs this effect's cleanup: the client stops (no reconnect)
+      // and any parked approvals resolve to deny.
+      onTerminate: () => {
+        append({ kind: "notice", text: "Remote access turned off from the Privateer app. Use /remote-access on to re-enable." });
+        setRemoteEnabled(false);
+      },
       onApprovalResponse: (id, decision) => {
         const entry = pendingApprovalsRef.current.get(id);
         if (entry) {
@@ -563,8 +647,9 @@ export function App({
 
   useInput((input, key) => {
     if (key.ctrl && input === "c") exit();
-    // Esc interrupts an in-flight turn (the run loop persists partial output).
-    if (key.escape && busy && abortRef.current) abortRef.current.abort();
+    // Esc interrupts an in-flight turn (the run loop persists partial output) — but
+    // not while a question picker owns input, where Esc means "dismiss the question".
+    if (key.escape && busy && !pendingQuestion && abortRef.current) abortRef.current.abort();
     // Ctrl+O toggles detail level for the whole transcript: it expands/collapses
     // both the model's reasoning blocks and full tool output together. (Reasoning
     // only exists when extended thinking is enabled, so without also flipping tool
@@ -579,7 +664,16 @@ export function App({
     }
     // Shift+Tab rotates the permission mode — but not while a modal overlay owns
     // input (it has its own keybindings).
-    if (key.tab && key.shift && !pending && !picking && !rewinding && !planReady && !sessionsPicking)
+    if (
+      key.tab &&
+      key.shift &&
+      !pending &&
+      !pendingQuestion &&
+      !picking &&
+      !rewinding &&
+      !planReady &&
+      !sessionsPicking
+    )
       cycleMode();
   });
 
@@ -596,8 +690,34 @@ export function App({
 
   const append = (...entries: Entry[]) => setCommitted((c) => [...c, ...entries]);
 
+  // Announce a Privateer sign-out the moment it happens. The machine login
+  // dies server-side when its refresh-token TTL lapses (only after weeks of
+  // no use — spawns slide it forward) or it's revoked, and — because the child
+  // session only spawns on demand — the CLI used to discover that on the first
+  // request after a boot, where the credentials were wiped silently. The
+  // listener covers every spawn path (startup, first prompt, relay tickets);
+  // warming the session up front when the active model bills to the account
+  // moves the announcement to launch instead of mid-turn.
+  useEffect(() => {
+    const unsub = onSessionExpired(() =>
+      append({
+        kind: "notice",
+        tone: "error",
+        text: "Signed out of your Privateer account — this machine's login expired.",
+        hint: "Run /login to sign back in. Account models stay listed under /model.",
+      }),
+    );
+    try {
+      if (parseModelSpec(modelSpec).provider === "privateer") void warmSession();
+    } catch {
+      /* malformed model spec — nothing to warm */
+    }
+    return unsub;
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
   function handleCommand(raw: string): boolean {
-    const res = runCommand(raw, { config, modelSpec, mode, usage, context, cwd, todos, customCommands });
+    const res = runCommand(raw, { config, modelSpec, mode, usage, context, cwd, todos, customCommands, skills });
     if (!res) return false;
     append({ kind: "user", text: raw });
     switch (res.type) {
@@ -629,6 +749,32 @@ export function App({
       case "runPrompt":
         void runTurn(res.text, { hideInput: true });
         break;
+      case "skillOp": {
+        const scope = res.project ? ("project" as const) : ("user" as const);
+        if (res.op === "install") {
+          append({ kind: "notice", text: `Installing skill(s) from ${res.arg}…` });
+          void installSkills(res.arg, { scope, all: res.all, force: res.force, cwd })
+            .then((installed) => {
+              append({
+                kind: "notice",
+                text: `Installed (${scope}): ${installed.map((s) => s.name).join(", ")}`,
+              });
+              setSkillsEpoch((e) => e + 1);
+            })
+            .catch((err) => {
+              append({ kind: "notice", tone: "error", text: err instanceof Error ? err.message : String(err) });
+            });
+        } else {
+          try {
+            const { dir } = removeSkill(res.arg, { scope: res.project ? "project" : undefined, cwd });
+            append({ kind: "notice", text: `Removed skill "${res.arg}" (${dir}).` });
+            setSkillsEpoch((e) => e + 1);
+          } catch (err) {
+            append({ kind: "notice", tone: "error", text: err instanceof Error ? err.message : String(err) });
+          }
+        }
+        break;
+      }
       case "compact":
         void doCompact();
         break;
@@ -753,6 +899,47 @@ export function App({
         });
         break;
       }
+      case "routine": {
+        const targeted = res.action !== "list";
+        if (targeted && !res.arg) {
+          append({ kind: "notice", tone: "error", text: `Usage: /routine ${res.action} <name>` });
+          break;
+        }
+        const req =
+          res.action === "list"
+            ? ({ cmd: "list" } as const)
+            : res.action === "pause"
+              ? ({ cmd: "pause", idOrName: res.arg! } as const)
+              : res.action === "resume"
+                ? ({ cmd: "resume", idOrName: res.arg! } as const)
+                : res.action === "remove"
+                  ? ({ cmd: "remove", idOrName: res.arg! } as const)
+                  : ({ cmd: "run-now", idOrName: res.arg! } as const);
+        void sendToDaemon(req)
+          .then((r) => {
+            if (!r.ok) {
+              append({ kind: "notice", tone: "error", text: r.message ?? "Command failed." });
+              return;
+            }
+            if (res.action === "list") {
+              append({ kind: "notice", text: formatRoutines(r.routines ?? []) });
+            } else {
+              append({ kind: "notice", text: r.message ?? "Done." });
+            }
+          })
+          .catch((err) => {
+            if (err instanceof DaemonNotRunningError) {
+              append({
+                kind: "notice",
+                tone: "error",
+                text: "Routine daemon isn't running. Start it with `privateer daemon` (or `privateer daemon --detach`).",
+              });
+            } else {
+              append({ kind: "notice", tone: "error", text: `Routine error: ${String(err)}` });
+            }
+          });
+        break;
+      }
       case "rewind":
         if (checkpointsRef.current.list().length === 0) {
           append({ kind: "notice", text: "No checkpoints yet — they're taken before each turn." });
@@ -1012,10 +1199,16 @@ export function App({
       }
       for await (const ev of engine.send(sendText, controller.signal, attachments)) {
         switch (ev.type) {
-          case "text":
+          case "text": {
             thinkingIdx = -1;
             if (assistantIdx === -1) {
-              pushLive({ kind: "assistant", text: ev.text });
+              // Models often emit a whitespace-only text block between tool
+              // calls; opening an entry for it paints an empty ⏺ bullet. Hold
+              // off until real text arrives, and drop the leading whitespace
+              // when it does (it was only ever a separator).
+              const opening = ev.text.replace(/^\s+/, "");
+              if (!opening) break;
+              pushLive({ kind: "assistant", text: opening });
               assistantIdx = liveEntries.length - 1;
             } else {
               const idx = assistantIdx;
@@ -1025,9 +1218,13 @@ export function App({
               sync();
             }
             break;
-          case "reasoning":
+          }
+          case "reasoning": {
             if (thinkingIdx === -1) {
-              pushLive({ kind: "thinking", text: ev.text });
+              // Same whitespace-only guard as assistant text above.
+              const opening = ev.text.replace(/^\s+/, "");
+              if (!opening) break;
+              pushLive({ kind: "thinking", text: opening });
               thinkingIdx = liveEntries.length - 1;
             } else {
               const idx = thinkingIdx;
@@ -1037,6 +1234,7 @@ export function App({
               sync();
             }
             break;
+          }
           case "tool-call": {
             // `task` calls carry the sub-agent's description/type so the grouped
             // agents view can label each row before its metrics land.
@@ -1331,7 +1529,7 @@ export function App({
             no work to animate. Crucially, ink-spinner re-renders the whole dynamic
             region every frame; left running it would erase+redraw the bordered
             ApprovalPrompt below it ~10×/s, which reads as the box flickering. */}
-        {busy && !pending && (
+        {busy && !pending && !pendingQuestion && (
           <Box marginTop={1} gap={1}>
             <Text color={theme.accent}>
               <Spinner type="dots" />
@@ -1376,6 +1574,14 @@ export function App({
               setPending(null);
             }}
           />
+        ) : pendingQuestion ? (
+          <OptionPicker
+            question={pendingQuestion.q}
+            onRespond={(answer) => {
+              pendingQuestion.resolve(answer);
+              setPendingQuestion(null);
+            }}
+          />
         ) : rewinding ? (
           <RewindPicker
             checkpoints={checkpointsRef.current.list()}

package/src/components/ApprovalPrompt.tsx

@@ -20,18 +20,29 @@ export function ApprovalPrompt({
     else if (c === "n" || key.escape) onRespond("deny");
   });
 
+  // Quiet cue for elevated-stakes requests — stays in the blue theme, just flags
+  // that this one is weightier than a routine approval. Order = most severe first.
+  const badge = req.alwaysAsk
+    ? "destructive"
+    : req.protected
+      ? "guarded file"
+      : req.outside
+        ? "outside cwd"
+        : undefined;
+
   return (
-    <Box flexDirection="column" marginTop={1} borderStyle="round" borderColor={theme.warning} paddingX={1}>
+    <Box flexDirection="column" marginTop={1} borderStyle="round" borderColor={theme.accent} paddingX={1}>
       <Text>
-        <Text bold color={theme.warning}>
+        <Text bold color={theme.accent}>
           {req.title}
         </Text>
         <Text dimColor> ({req.tool})</Text>
+        {badge && <Text dimColor>  ⚠ {badge}</Text>}
       </Text>
       <Text>{req.detail}</Text>
       <Text dimColor>
-        <Text color={theme.success}>y</Text> allow · <Text color={theme.success}>a</Text> always ·{" "}
-        <Text color={theme.error}>n</Text> deny
+        <Text color={theme.accent}>y</Text> allow · <Text color={theme.accent}>a</Text> always ·{" "}
+        <Text color={theme.accentDim}>n</Text> deny
       </Text>
     </Box>
   );

package/src/components/Banner.tsx

@@ -57,7 +57,9 @@ export function Banner({ model }: { model: string }) {
           <Text bold color={theme.accent}>
             {WELCOME} PRIVATEER
           </Text>
-          <Text color={theme.dim}>bring your own model · v{VERSION}</Text>
+          <Text color={theme.dim}>
+            bring your own model or connect to Privateer · v{VERSION}
+          </Text>
           {account && (
             <Text color={theme.dim}>
               connected as <Text color={theme.accent}>{account}</Text>

package/src/components/ModelPicker.tsx

@@ -4,6 +4,7 @@ import Spinner from "ink-spinner";
 import TextInput from "ink-text-input";
 import type { Config, ProviderName } from "../config/schema.ts";
 import { configuredProviders, privateerChannel } from "../providers/resolve.ts";
+import { hasCredentials } from "../auth/privateer.ts";
 import { PROVIDER_META } from "../providers/catalog.ts";
 import { listModels, zdrPosture, type ModelInfo } from "../providers/models.ts";
 import { theme, POSTURE_COLOR } from "./theme.ts";
@@ -27,14 +28,18 @@ export function ModelPicker({
   onSelect: (spec: string) => void;
   onCancel?: () => void;
 }) {
-  const ready = useMemo(() => {
-    const offered = providers ?? configuredProviders(config).filter((p) => p.ready).map((p) => p.name);
-    return offered as ProviderName[];
+  const entries = useMemo<{ name: ProviderName; ready: boolean }[]>(() => {
+    if (providers) return providers.map((name) => ({ name, ready: true }));
+    // Ready providers, plus the Privateer account provider even when signed
+    // out: an expired machine login wipes the stored credentials, and the
+    // account silently vanishing from this list reads as a bug. It stays
+    // listed, annotated, and selecting it points at /login.
+    return configuredProviders(config).filter((p) => p.ready || p.name === "privateer");
   }, [config, providers]);
 
-  const [provider, setProvider] = useState<ProviderName | null>(ready.length === 1 ? ready[0] : null);
+  const [provider, setProvider] = useState<ProviderName | null>(entries.length === 1 ? entries[0].name : null);
 
-  if (ready.length === 0) {
+  if (entries.length === 0) {
     return (
       <Box flexDirection="column" paddingX={1}>
         <Text color={theme.error}>No providers configured. Run /login to add an API key.</Text>
@@ -43,7 +48,16 @@ export function ModelPicker({
   }
 
   if (provider === null) {
-    return <ProviderStage providers={ready} onPick={setProvider} onCancel={onCancel} />;
+    return <ProviderStage providers={entries} onPick={setProvider} onCancel={onCancel} />;
+  }
+
+  if (provider === "privateer" && !hasCredentials()) {
+    return (
+      <SignedOutStage
+        onBack={entries.length > 1 ? () => setProvider(null) : undefined}
+        onCancel={onCancel}
+      />
+    );
   }
 
   return (
@@ -51,7 +65,7 @@ export function ModelPicker({
       provider={provider}
       config={config}
       onSelect={(id) => onSelect(`${provider}:${id}`)}
-      onBack={ready.length > 1 ? () => setProvider(null) : undefined}
+      onBack={entries.length > 1 ? () => setProvider(null) : undefined}
       onCancel={onCancel}
     />
   );
@@ -62,7 +76,7 @@ function ProviderStage({
   onPick,
   onCancel,
 }: {
-  providers: ProviderName[];
+  providers: { name: ProviderName; ready: boolean }[];
   onPick: (name: ProviderName) => void;
   onCancel?: () => void;
 }) {
@@ -70,7 +84,7 @@ function ProviderStage({
   useInput((input, key) => {
     if (key.upArrow || input === "k") setCursor((c) => (c - 1 + providers.length) % providers.length);
     else if (key.downArrow || input === "j") setCursor((c) => (c + 1) % providers.length);
-    else if (key.return) onPick(providers[cursor]);
+    else if (key.return) onPick(providers[cursor].name);
     else if (key.escape) onCancel?.();
   });
 
@@ -81,10 +95,11 @@ function ProviderStage({
         <Text color={theme.accent}>enter</Text> select{onCancel ? ", esc cancel" : ""}.
       </Text>
       <Box flexDirection="column" marginTop={1}>
-        {providers.map((name, i) => (
-          <Text key={name} color={i === cursor ? theme.accent : undefined}>
+        {providers.map((p, i) => (
+          <Text key={p.name} color={i === cursor ? theme.accent : undefined}>
             {i === cursor ? "❯ " : "  "}
-            {PROVIDER_META[name].label}
+            {PROVIDER_META[p.name].label}
+            {!p.ready ? <Text color={theme.warning}> — signed out, run /login</Text> : null}
           </Text>
         ))}
       </Box>
@@ -92,6 +107,24 @@ function ProviderStage({
   );
 }
 
+// The Privateer account provider is listed but signed out (fresh install, or
+// the machine login's TTL lapsed and the credentials were wiped): explain how
+// to get it back instead of failing the model fetch with a raw auth error.
+function SignedOutStage({ onBack, onCancel }: { onBack?: () => void; onCancel?: () => void }) {
+  useInput((_input, key) => {
+    if (key.escape) (onBack ?? onCancel)?.();
+  });
+  return (
+    <Box flexDirection="column" paddingX={1}>
+      <Text color={theme.warning}>Not signed in to your Privateer account.</Text>
+      <Text color={theme.dim}>
+        Run /login to link this terminal, then pick an account model here.
+        {onBack ? " Esc to go back." : onCancel ? " Esc to cancel." : ""}
+      </Text>
+    </Box>
+  );
+}
+
 function ModelStage({
   provider,
   config,