privateer-agent 0.11.0 → 0.12.0

package/src/acp/run.ts

@@ -43,12 +43,17 @@
 
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
+import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
 
 // Read-only by default, exactly as the channels runtime and the routines harbor do:
 // a turn nobody is watching must not be able to mutate the filesystem or shell out
 // until a human widens it in config.
 const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
+// Media generation stays out of the default set (it spends the account's credit —
+// see the harbor's note); an ACP host that wants it names it in `acp.tools`. Listed
+// here so it can be stripped back out when generation is switched off.
+const MEDIA_GEN_TOOLS: string[] = [...MEDIA_TOOL_NAMES];
 
 type Posture = "readonly" | "approve" | "auto";
 const POSTURES: Posture[] = ["readonly", "approve", "auto"];
@@ -80,14 +85,12 @@ export async function runAcp(): Promise<void> {
     "@earendil-works/pi-coding-agent"
   );
   const { createEngineEventAdapter } = await import("../bridge/engineAdapter.ts");
-  const { makePermissionGate } = await import("../ext/permissionGate.ts");
   type GateController = import("../ext/permissionGate.ts").GateController;
-  const { makePiPrivacyExtension } = await import("pi-privacy");
-  const { makeAccountProvider, privateerChannel, rememberAccountCredential, dropPersistedAccountCredential } =
+  const { moatResourceOptions } = await import("../config/moat.ts");
+  const { privateerChannel, rememberAccountCredential, dropPersistedAccountCredential } =
     await import("../providers/account.ts");
   const { hasCredentials, acquireAccountCredential, revokeAccountSession } = await import("../auth/privateer.ts");
-  const { makeWebTools } = await import("../tools/web.ts");
-  const { webEnabled } = await import("../config/hosted.ts");
+  const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
   const { agentDir, configPath } = await import("../config/paths.ts");
   const { PrivateerAcpAgent, askOverAcp } = await import("./server.ts");
@@ -103,8 +106,9 @@ export async function runAcp(): Promise<void> {
   const block = cfg.acp ?? {};
   const defaultModel: string = resolveDefaultModel({ explicit: block.model ?? cfg.defaultModel });
   const web = webEnabled();
+  const media = mediaEnabled();
   const tools: string[] = Array.isArray(block.tools) && block.tools.length
-    ? (web ? block.tools : block.tools.filter((t: string) => !WEB_TOOLS.includes(t)))
+    ? block.tools.filter((t: string) => (web || !WEB_TOOLS.includes(t)) && (media || !MEDIA_GEN_TOOLS.includes(t)))
     : (web ? [...SAFE_TOOLS, ...WEB_TOOLS] : [...SAFE_TOOLS]);
   const posture: Posture = normalizePosture(block.posture) ?? "approve";
   const baseCwd: string = block.cwd ?? process.cwd();
@@ -146,20 +150,13 @@ export async function runAcp(): Promise<void> {
       //
       // Verified live: without this, `bash` was denied and remoteAsk never fired.
       //
-      // So: discover nothing, and load exactly the moat we want as in-code
-      // factories below. Same shape as bin/privateer-subagent.mjs's
-      // `--no-extensions -e …`, and for the same reason. This disables discovered
-      // MCP too; an ACP host supplies its own MCP servers in session/new, which is
-      // the more correct source anyway.
+      // The other entries now solve this with moatResourceOptions()'s extensionsOverride,
+      // which drops OUR shims and keeps the user's. ACP stays on the blunter setting on
+      // purpose: it also disables discovered MCP, and an ACP host supplies its own servers
+      // in session/new, which is the more correct source here. So this list is the only way
+      // a host (Zed, Buzz) gets the moat, the account provider, or media at all.
       noExtensions: true,
-      extensionFactories: [
-        makePermissionGate(gate),
-        makePiPrivacyExtension({
-          privateerVerifiedTee: (m: any) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
-        }),
-        makeAccountProvider(),
-        ...(webEnabled() ? [makeWebTools()] : []),
-      ] as any,
+      ...((await moatResourceOptions({ kind: "acp", gate })) as any),
     },
   });
 

package/src/channels/run.ts

@@ -49,6 +49,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 // Names only — the factory itself is imported lazily in main() like every other
 // module here. Safe statically: this evaluates after boot.ts and pulls in no Pi.
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
+import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
 
 // Read-only default toolset — same rationale as the routines harbor's SAFE_TOOLS:
 // a turn nobody is watching can't mutate the filesystem or shell out. Now that the
@@ -62,6 +63,14 @@ const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 // capability that still sends a query off the machine.
 const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
 
+// Media GENERATION never joins the default set, even with the switch on: a chat
+// message is an untrusted prompt, and these spend the account's credit. A channel that
+// should be able to make pictures says so in `channels.tools`. Listed here only so
+// they can be stripped back out when generation is switched off, the same way web
+// tools are — a config naming a tool that no longer registers is a confusing failure.
+// (video_compose is local ffmpeg work and needs no such stripping.)
+const MEDIA_GEN_TOOLS: string[] = [...MEDIA_TOOL_NAMES];
+
 // A channel's posture governs how an ADMIN's risky actions are handled (members are
 // always capped to read-only — see effectivePosture). Config + restart only; there
 // is deliberately no in-chat toggle.
@@ -106,13 +115,6 @@ function normalizePosture(v: unknown): Posture | undefined {
 }
 
 async function main() {
-  // Mark the process before anything can create a session. This runner builds its
-  // session with its own makePermissionGate (the in-chat approver below), but the
-  // shipped TUI gate extension is still auto-discovered from the shared agent dir —
-  // and with no UI bound here its local asker fails CLOSED, denying every gated tool
-  // before our approver is ever consulted. See config/inlineMoat.ts.
-  const { markInlineMoat } = await import("../config/inlineMoat.ts");
-  markInlineMoat();
   const { readFileSync, appendFileSync } = await import("node:fs");
   const { join } = await import("node:path");
   const {
@@ -121,13 +123,9 @@ async function main() {
     SessionManager,
   } = await import("@earendil-works/pi-coding-agent");
   const { createEngineEventAdapter } = await import("../bridge/engineAdapter.ts");
-  const { makePermissionGate } = await import("../ext/permissionGate.ts");
   type GateController = import("../ext/permissionGate.ts").GateController;
-  const { makePiPrivacyExtension } = await import("pi-privacy");
-  const { makeAccountProvider, privateerChannel } = await import("../providers/account.ts");
-  const { hasCredentials } = await import("../auth/privateer.ts");
-  const { makeWebTools } = await import("../tools/web.ts");
-  const { webEnabled } = await import("../config/hosted.ts");
+  const { moatResourceOptions } = await import("../config/moat.ts");
+  const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
@@ -153,8 +151,9 @@ async function main() {
   const ch = cfg.channels ?? {};
   const defaultModel: string = resolveDefaultModel({ explicit: ch.model ?? cfg.defaultModel });
   const web = webEnabled();
+  const media = mediaEnabled();
   const defaultTools: string[] = Array.isArray(ch.tools) && ch.tools.length
-    ? (web ? ch.tools : ch.tools.filter((t: string) => !WEB_TOOLS.includes(t)))
+    ? ch.tools.filter((t: string) => (web || !WEB_TOOLS.includes(t)) && (media || !MEDIA_GEN_TOOLS.includes(t)))
     : (web ? [...SAFE_TOOLS, ...WEB_TOOLS] : [...SAFE_TOOLS]);
   const defaultPosture: Posture = normalizePosture(ch.posture) ?? "approve";
   const cwd: string = ch.cwd ?? process.cwd();
@@ -203,23 +202,15 @@ async function main() {
       return store.bridge.requestApproval(store.chatId, req, signal);
     },
   };
+  // Web and media are shaped by config/moat.ts: generation only when the agent is allowed
+  // it, composition always (local ffmpeg work). Neither joins the default tool list — a
+  // channel has to name them in its `tools`, because a message from a chat app is exactly
+  // the kind of untrusted prompt that shouldn't be able to bill for video.
   const services = await createAgentSessionServices({
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      extensionFactories: [
-        makePermissionGate(gate),
-        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
-        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
-        makePiPrivacyExtension({
-          privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
-        }),
-        makeAccountProvider(),
-        // Web access (src/tools/web.ts) — same wiring as the harbor: registered here
-        // because this path builds its session explicitly, and omitted entirely when
-        // the agent isn't allowed the web.
-        ...(webEnabled() ? [makeWebTools()] : []),
-      ] as any,
+      ...((await moatResourceOptions({ kind: "channels", gate })) as any),
     },
   });
 

package/src/cli/chat.ts

@@ -29,8 +29,9 @@ async function main() {
     SessionManager,
   } = await import("@earendil-works/pi-coding-agent");
   const { createEngineEventAdapter } = await import("../bridge/engineAdapter.ts");
-  const { makePermissionGate, isRemoteUnsafeTool } = await import("../ext/permissionGate.ts");
-  const { makePiPrivacyExtension, verifyModelPosture, TIERS } = await import("pi-privacy");
+  const { isRemoteUnsafeTool } = await import("../ext/permissionGate.ts");
+  const { moatResourceOptions } = await import("../config/moat.ts");
+  const { verifyModelPosture, TIERS } = await import("pi-privacy");
   const { agentDir } = await import("../config/paths.ts");
   const { RemoteBridge } = await import("../remote/remoteBridge.ts");
   const { startParentApprovalRelay } = await import("../remote/subagentRelay.ts");
@@ -41,14 +42,14 @@ async function main() {
   const { resolveMentions, completeMention, searchFiles } = await import("../util/fileMentions.ts");
   const priv = await import("../auth/privateer.ts");
   const {
-    makeAccountProvider,
     accountPosture,
-    privateerChannel,
     rememberAccountCredential,
     dropPersistedAccountCredential,
   } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
-  const { resolveDefaultModel, resolveSignedInModel } = await import("../providers/defaultModel.ts");
+  const { resolveDefaultModel, resolveSignedInModel, savedPiDefaultSpec } = await import("../providers/defaultModel.ts");
+  const { postOutbox } = await import("../outbox/cloudOutbox.ts");
+  const { addPendingCloud } = await import("../routines/store.ts");
 
   // resolveDefaultModel() already honours PRIVATEER_MODEL first, then the account
   // default when signed in, then a BYO key — one source of truth (defaultModel.ts).
@@ -170,6 +171,12 @@ async function main() {
       relay?.sendCommands(availableCommands());
     },
     onStatus: (t) => console.log(`\n${DIM}⟿ ${t}${RESET}`),
+    // The driver asked for something, then closed the app (or lost the network) before
+    // the answer came back. The relay dropped every frame of it, so seal the reply to
+    // the account outbox instead: it lands in the app's Inbox on next open, sealed to
+    // a key this terminal can't read back. Same durability contract as a routine's
+    // `cloud` delivery — including the on-disk queue when the post can't go out now.
+    onUnwatchedResult: ({ prompt, content }) => void deliverUnwatchedTurn(prompt, content),
     // The app composer is autocompleting an `@file` mention — list the cwd entries
     // matching the query and reply. Read-only + cwd-constrained (searchFiles never
     // escapes the subtree); resolution of the picked path happens on the prompt turn.
@@ -275,6 +282,43 @@ async function main() {
   // Serialize turns so a remote prompt and a locally-typed one can't overlap.
   // `echo` prints the "⟿ [app] …" line; the caller suppresses it when it already
   // echoed (a fall-through command from onCommand).
+  // Deliver a finished but UNWATCHED driven turn to the account's Inbox.
+  //
+  // The app drove this turn and then went away — closed, killed, backgrounded past the
+  // relay's heartbeat. Everything the agent streamed up was dropped by the server (it
+  // forwards only to an attached controller), so without this the work is simply gone:
+  // the person comes back to a feed that ends at their own question. Sealing it to the
+  // outbox is the same store-and-forward path a routine's `cloud` delivery uses — the
+  // server holds ciphertext it cannot open, the app decrypts on next open, and the item
+  // is deleted server-side once acked.
+  //
+  // `task` rather than `routine`: this was a one-shot the user asked for, which is what
+  // that kind means in the app's Inbox filter.
+  //
+  // Never throws — a failed delivery falls back to the same on-disk queue the harbor
+  // flushes, and a failure to do even that must not take down the REPL.
+  async function deliverUnwatchedTurn(prompt: string, content: string): Promise<void> {
+    // Title the item by what was ASKED, not by what came back: it's what the person
+    // will recognise in a list, and the first line of an answer is often "Sure —".
+    const asked = prompt.replace(/\s+/g, " ").trim();
+    const title = asked ? (asked.length > 60 ? asked.slice(0, 57) + "…" : asked) : "Remote session";
+    const at = new Date().toISOString();
+    const body = `**${asked || "(no prompt)"}**\n\n${content}`;
+    try {
+      if (await postOutbox(title, at, "ok", body, "task")) {
+        console.log(`\n${DIM}⟿ app closed mid-turn — result sent to your Inbox.${RESET}`);
+        return;
+      }
+      // Couldn't seal/post right now (offline, no verified outbox key yet, server down).
+      // Queue it: the harbor flushes this file on its next connect, so the result is
+      // still headed for the Inbox rather than lost.
+      addPendingCloud({ routine: title, at, status: "ok", content: body, kind: "task" });
+      console.log(`\n${DIM}⟿ app closed mid-turn — result queued for your Inbox.${RESET}`);
+    } catch {
+      /* best effort: an undeliverable result must never break the session */
+    }
+  }
+
   async function runTurn(text: string, remote: boolean, echo = true): Promise<void> {
     if (turnActive) {
       console.log(`\n${DIM}(busy — a turn is already running)${RESET}`);
@@ -369,16 +413,11 @@ async function main() {
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      // Structural ext types are intentionally narrow; cast to Pi's ExtensionFactory.
-      extensionFactories: [
-        makePermissionGate(gate),
-        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
-        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
-        makePiPrivacyExtension({
-          privateerVerifiedTee: (m) => priv.hasCredentials() && privateerChannel(m.id ?? "") === "tee",
-        }),
-        makeAccountProvider(),
-      ] as any,
+      // The REPL builds its session from an explicit factory list rather than the
+      // launcher's shim directory, so config/moat.ts is the only way it gets the gate,
+      // the account provider, or media at all. Structural ext types are intentionally
+      // narrow; cast to Pi's ExtensionFactory.
+      ...((await moatResourceOptions({ kind: "repl", gate })) as any),
     },
   });
   for (const d of services.diagnostics) if (d.type === "error") console.log(`${RED}! ${d.message}${RESET}`);
@@ -557,11 +596,15 @@ async function main() {
       console.log(`${GREEN}Signed in as ${user.email ?? user.id}.${RESET}`);
       // Move the live session onto a confidential model right away, so the next prompt
       // doesn't dead-end on the launch model's missing key. resolveSignedInModel picks
-      // Tinfoil GLM 5.2 — direct with a Tinfoil key, over the subscription otherwise;
-      // PRIVATEER_MODEL (a deliberate override) is respected and left alone.
+      // the Tinfoil default — direct with a Tinfoil key, over the subscription
+      // otherwise. Two deliberate choices are respected and left alone: a
+      // PRIVATEER_MODEL override, and a saved default the user picked themselves
+      // (Pi persists every interactive switch) that points anywhere other than the
+      // target — sign-in arms the account channel, it doesn't move a chosen model.
       if (!process.env.PRIVATEER_MODEL?.trim()) {
         const target = resolveSignedInModel();
-        if (target !== currentSpec) await switchModel(target, false);
+        const saved = savedPiDefaultSpec();
+        if (target !== currentSpec && (!saved || saved === target)) await switchModel(target, false);
       }
     } catch (e) {
       console.log(`${RED}${(e as Error).message}${RESET}`);

package/src/config/hosted.ts

@@ -38,6 +38,40 @@ export function webEnabled(): boolean {
   return hasCredentials();
 }
 
+/**
+ * Is this agent allowed to GENERATE media (images, video, speech, music)?
+ *
+ * Every media call is served by the account API, so credentials are a hard prerequisite.
+ * `HARBOR_MEDIA` is authoritative when set. When it is UNSET the default splits by where
+ * we run: a hosted tenant fails CLOSED, a daemon on the user's own machine defaults on
+ * once signed in. Hosted has to be off-by-default because generation spends real credit
+ * and sends the prompt (plus any input image) out of the enclave to a model provider —
+ * that is a grant the user makes per agent (tenantEnv sets HARBOR_MEDIA=1), never one a
+ * missing env var hands out. (Contrast webEnabled, whose unset-default is on everywhere
+ * only because the orchestrator ALWAYS sets HARBOR_WEB in hosted mode; HARBOR_MEDIA is
+ * not guaranteed to be set, so the default here must be the safe one.)
+ *
+ * It is a separate switch from web access because it buys a different thing and costs a
+ * different thing. Generation spends real credit — cents for an image, up to a dollar
+ * for a video clip — where a search costs a fraction of one, and the prompt (plus any
+ * input image) leaves the enclave for a model provider rather than for a search index.
+ * A hosted agent that should read the news is not automatically one that should be able
+ * to bill the account for a minute of video.
+ *
+ * Note this gates GENERATION only. `video_compose` is local ffmpeg work on files
+ * already on disk — no account, no network, no spend — and stays available regardless,
+ * so an agent can still finish assembling media a previous run produced.
+ */
+export function mediaEnabled(): boolean {
+  const flag = process.env.HARBOR_MEDIA;
+  if (flag === "1") return hasCredentials();
+  if (flag === "0") return false;
+  // Unset: hosted tenants fail closed (explicit per-agent grant only); a daemon on
+  // the user's own machine defaults on once signed in.
+  if (isHosted()) return false;
+  return hasCredentials();
+}
+
 /**
  * Publish this harbor's relay identity key so the Harbor host can attest it.
  *

package/src/config/moat.ts

@@ -0,0 +1,236 @@
+/**
+ * buildMoat() — the one place that decides which extensions a session gets, in what order.
+ *
+ * WHAT THIS REPLACES. Five entry points each hand-assembled their own `extensionFactories`
+ * array: the harbor's sessions (routines, workflows, tasks), its live task spawns, the
+ * channels runner, ACP, and the dev REPL. The five lists were the same list — same gate,
+ * same privacy extension, same account provider, the same `webEnabled()`/`mediaEnabled()`
+ * conditionals — copied with small deliberate differences and a large amount of duplicated
+ * comment explaining them. Nothing held them together, so an extension added to one path
+ * silently didn't exist on the other four (privateer-media had reached three of five), and
+ * the ordering rule below lived as prose repeated in each copy.
+ *
+ * ORDER MATTERS, ONCE. pi-privacy's own catalog registers a `privateer` provider (its
+ * PUBLIC developer-key channel, one seed model), and Pi's registerProvider REPLACES a
+ * provider's models and request config. So the privacy extension must be built ABOVE
+ * makeAccountProvider(), or the ACCOUNT channel doesn't land last, the default model stops
+ * resolving, and requests go to api.privateer.pro/v1 instead of /api/agent/v1. Expressing
+ * that as one ordered array is the point: it used to be a comment that each copy had to
+ * keep. (The interactive TUI still gets its extensions by discovery, where the order isn't
+ * ours to choose — which is why extensions/privateer-privacy.ts has to re-assert the
+ * account registration there. Folding the TUI into this function is the next step.)
+ *
+ * CAPABILITY SHAPING. web and media are omitted as FACTORIES, not merely dropped from the
+ * allow-list, when their switch is off: "web off" should mean the tool doesn't exist for
+ * that run, not that it exists and is denied. The per-kind table below records which paths
+ * get what — it is the behaviour the five copies already had, now readable in one place.
+ *
+ * IMPORT-SAFETY: every Pi-touching import is dynamic, inside the async function. So this
+ * module is safe to import statically from anywhere, including a pre-boot entry (the REPL
+ * loads everything Pi-touching after ../boot.ts, and this must not break that).
+ */
+
+import { basename } from "node:path";
+import { managedNames } from "./moatManifest.ts";
+import type { GateController } from "../ext/permissionGate.ts";
+import type { SendFileBridge } from "../tools/sendFile.ts";
+import type { AttachmentStore } from "../util/attachmentStore.ts";
+
+/** A Pi extension factory, as DefaultResourceLoader takes them. */
+export type ExtensionFactory = (pi: any) => void;
+
+/**
+ * Which session is being built. Not cosmetic: it selects the capability row below, so a
+ * new entry point has to say what it is rather than inherit whatever the copy it was
+ * pasted from happened to have.
+ */
+export type MoatKind =
+  | "harbor-session" // routines, workflows, submitted tasks (headless, unattended)
+  | "live-task" // a drivable session the harbor spawns for the app
+  | "channels" // Telegram / Slack / Discord / WhatsApp bridge sessions
+  | "acp" // `privateer acp` — an ACP host (Zed, Buzz) drives
+  | "repl"; // the lean dev REPL (npm run chat)
+
+export interface MoatOptions {
+  kind: MoatKind;
+  /** This session's gate — its cwd, its approver. Never shared between sessions. */
+  gate: GateController;
+  /**
+   * send_file_to_client / save_attachment bound to THIS session's bridge. Only a path that
+   * owns a relay passes these; the shipped gate extension registers its own pair against
+   * its module-level bridge and stands them down inside the daemon, so a live spawn's own
+   * pair is what the model gets (see tools/relayFileTools.ts).
+   */
+  relayFiles?: { bridge: SendFileBridge; attachments: AttachmentStore };
+}
+
+/**
+ * Per-kind capabilities. `web` and `media` are the CEILING — each is still ANDed with its
+ * runtime switch (webEnabled/mediaEnabled), so a false here means "never", not "by default".
+ *
+ * web is deliberately off for live-task and repl: makeWebTools() routes through the account
+ * API precisely because an unattended run must not hold a search provider key, and both of
+ * those paths have a human at the other end who can use their own provider (src/tools/web.ts).
+ * compose is unconditional everywhere: local ffmpeg work, no account, no network, no spend —
+ * so a run with generation off can still assemble media that already exists on disk.
+ */
+const CAPABILITIES: Record<MoatKind, { web: boolean; media: boolean; mcp: boolean }> = {
+  "harbor-session": { web: true, media: true, mcp: true },
+  "live-task": { web: false, media: true, mcp: false },
+  channels: { web: true, media: true, mcp: false },
+  acp: { web: true, media: true, mcp: false },
+  repl: { web: false, media: true, mcp: false },
+};
+
+/**
+ * Drop the launcher's shims from a session's DISCOVERED extension set, leaving everything
+ * else — the user's own `packages`, their own files in <agentDir>/extensions — untouched.
+ *
+ * THE PROBLEM. bin/privateer-launch.mjs installs the moat as shim files in the shared
+ * ~/.privateer/agent/extensions, and Pi discovers those into EVERY session built against
+ * that agent dir — including the ones the harbor daemon, the channels runner and the REPL
+ * stand up with their own in-code moat. So each of those processes got two copies of the
+ * moat: one wired to the session it belongs to, and one wired to module-level state from a
+ * process that isn't running (a RemoteBridge only `/remote-access` ever attaches a relay
+ * to, an allowlist shared across concurrent sessions, and process.cwd() rather than the
+ * session's). Pi runs every tool_call handler and resolves duplicate tool names
+ * first-registration-wins with discovered extensions loading BEFORE inline factories, so
+ * the stray copy either raised a second approval dialog for the same call (where a UI was
+ * bound) or fail-closed denied it before the session's real approver was consulted (where
+ * one wasn't) — and its tools shadowed the session's own.
+ *
+ * WHAT WE DID BEFORE. Each affected extension asked, from inside itself, whether its
+ * consumer wanted it: `discoveredGateApplies()`, `inHarborDaemon()`, `isSubagentChild()`,
+ * coordinated through process.env because jiti loads discovered extensions with the module
+ * cache off, so two copies of a module don't share memory. That inverted the dependency
+ * (the moat knew about the harbor), covered only the extensions someone had remembered to
+ * defend — the media, MCP, web and brand shims never stood down at all — and had to be
+ * repeated in each new entry point. The REPL was simply missed, and ran two gates.
+ *
+ * WHAT WE DO NOW. The host decides. Pi's own `extensionsOverride` hook runs over the
+ * discovered set before inline factories are applied, so a process that builds its own moat
+ * filters ours out by name and keeps the user's. Positive, one place, and it cannot be
+ * forgotten by a new entry point because it ships with the factories it complements.
+ *
+ * Matching is by file basename against the shipping manifest: the launcher owns those
+ * names (extensionsControl refuses to install a user package under any of them), and the
+ * basename is stable where an absolute path is not — Pi reports the shim's own path, but
+ * tmpdir symlinks and Windows separators make full-path equality a trap.
+ *
+ * WHAT THIS DOES NOT DO. Pi runs the override AFTER loading, so a dropped shim's module
+ * has still been evaluated and its factory still ran — we stop it being dispatched to and
+ * owning tool names, not being executed. Two consequences. Its tool registrations collide
+ * with ours during load, producing conflict diagnostics that name an extension the session
+ * is about to discard; those are noise, so we drop them alongside it (an entry point that
+ * printed them would tell the user a tool conflicts with something not in the session).
+ * And any side effect in the extension body still happens, which is why the shipped gate
+ * keeps its own stand-down checks for now. Stopping the load itself means not putting the
+ * shims in the discovered directory at all — passing them to the TUI as explicit `-e` args
+ * the way bin/privateer-subagent.mjs already does for children — which also has to move
+ * TUI-spawned subagents onto that wrapper. Separate change.
+ */
+export function excludeDiscoveredMoat(): (base: any) => any {
+  const managed = new Set(managedNames());
+  const name = (p: unknown): string => basename(String(p ?? "")).replace(/\.(ts|js|mjs|cjs)$/, "");
+  return (base: any) => {
+    const dropped: string[] = [];
+    const extensions = (base?.extensions ?? []).filter((e: any) => {
+      if (!managed.has(name(e?.path))) return true;
+      dropped.push(String(e?.path ?? ""));
+      return false;
+    });
+    // A diagnostic is ours to drop when it belongs to a shim we removed, or when it points
+    // at one — "Tool X conflicts with <shim path>" is reported against the OTHER extension.
+    const errors = (base?.errors ?? []).filter(
+      (e: any) =>
+        !managed.has(name(e?.path)) &&
+        !dropped.some((p) => p && String(e?.error ?? "").includes(p)),
+    );
+    return { ...base, extensions, errors };
+  };
+}
+
+/**
+ * Everything a session's resourceLoaderOptions needs: our factories, plus the filter that
+ * stops the discovered copies of those same extensions loading alongside them. Callers
+ * should prefer this over buildMoat() — passing the factories without the filter is the
+ * bug described above.
+ */
+export async function moatResourceOptions(
+  opts: MoatOptions,
+): Promise<{ extensionFactories: ExtensionFactory[]; extensionsOverride: (base: any) => any }> {
+  return { extensionFactories: await buildMoat(opts), extensionsOverride: excludeDiscoveredMoat() };
+}
+
+/** Build the ordered extension factory list for one session. */
+export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]> {
+  const caps = CAPABILITIES[opts.kind];
+  if (!caps) throw new Error(`buildMoat: unknown kind "${opts.kind}"`);
+
+  const { makePermissionGate } = await import("../ext/permissionGate.ts");
+  const { makePiPrivacyExtension } = await import("pi-privacy");
+  const { makeAccountProvider, privateerChannel } = await import("../providers/account.ts");
+  const { hasCredentials } = await import("../auth/privateer.ts");
+  const { webEnabled, mediaEnabled } = await import("./hosted.ts");
+  const { noQuarterActive } = await import("../permissions/noQuarter.ts");
+  const { cliPalette, detectScheme } = await import("../ui/palette.ts");
+
+  const factories: ExtensionFactory[] = [makePermissionGate(opts.gate)];
+
+  // Per-model verified-TEE capability for pi-privacy's /models picker: show Privateer's
+  // TEE-channel models (near/tinfoil/phala) as "◆ Verifiable TEE" when logged in, while
+  // ZDR-channel models stay at their honest floor. The live verdict still comes from
+  // accountPosture on select — this only lifts the label.
+  factories.push(
+    makePiPrivacyExtension({
+      privateerVerifiedTee: (m: any) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+      // No quarter = unattended: the PII send-or-redact question would block a session
+      // the operator explicitly stepped away from, so it's swallowed the safe way —
+      // auto-redact + send — and what was masked surfaces as output instead. A live
+      // function, not a boolean: shift+tab / /no-quarter flips this mid-session.
+      piiUnattended: noQuarterActive,
+      // Color-coat that notice as the moat acting on your behalf: the red no-quarter
+      // flag (same glyph/color as the no-quarter banner in chat.ts), body in the
+      // accent color — distinct from yellow warnings and red errors.
+      renderPiiAutoRedact: (notice: string) => {
+        const p = cliPalette(detectScheme());
+        const body = notice.startsWith("⚑ ") ? notice.slice(2) : notice;
+        return `${p.RED}⚑${p.RESET} ${p.CYAN}${body}${p.RESET}`;
+      },
+    }),
+  );
+  factories.push(makeAccountProvider()); // must follow pi-privacy — see header
+
+  if (opts.relayFiles) {
+    const { makeRelayFileTools } = await import("../tools/relayFileTools.ts");
+    factories.push(makeRelayFileTools(opts.relayFiles.bridge, opts.relayFiles.attachments));
+  }
+
+  if (caps.web && webEnabled()) {
+    const { makeWebTools } = await import("../tools/web.ts");
+    factories.push(makeWebTools());
+  }
+
+  if (caps.media && mediaEnabled()) {
+    const { makeMediaTools } = await import("../tools/media.ts");
+    factories.push(makeMediaTools());
+  }
+  const { makeComposeTools } = await import("../tools/videoCompose.ts");
+  factories.push(makeComposeTools());
+
+  if (caps.mcp) {
+    // Registers the tools from the shared agent/mcp.json — the same projection the app's
+    // MCP manager writes over the relay. No servers configured → a no-op. The specifier is
+    // a variable so tsc treats it as Promise<any> and doesn't pull the third-party
+    // adapter's own .ts into our typecheck.
+    //
+    // The caller still owns MCP_DIRECT_TOOLS: the adapter reads it when the factory RUNS
+    // (inside createAgentSessionServices), not when it is imported here, so the env has to
+    // be set around session creation rather than around this call.
+    const mcpAdapterSpec = "pi-mcp-adapter";
+    const { default: mcpAdapter } = await import(mcpAdapterSpec);
+    factories.push(mcpAdapter);
+  }
+
+  return factories;
+}

package/src/config/moatManifest.json

@@ -0,0 +1,26 @@
+{
+  "$comment": "The one list of extensions Privateer ships. Read by bin/privateer-launch.mjs (shim install, dependency-free, pre-patch) and src/config/moatManifest.ts (RESERVED + profile composition). JSON so both a plain .mjs and the TS side can read it without a build step. See moatManifest.ts for the field contract.",
+  "shims": [
+    { "name": "privateer-brand", "entry": "extensions/privateer-brand.ts", "note": "banner, ⚓ badge, /signin /signout" },
+    { "name": "privateer-context", "entry": "extensions/privateer-context.ts", "note": "PRIVATEER.md context + /init" },
+    { "name": "privateer-gate", "entry": "extensions/privateer-gate.ts", "note": "the permission gate (moat)" },
+    { "name": "privateer-account", "entry": "extensions/privateer-account.ts", "note": "account inference provider" },
+    { "name": "privateer-models", "entry": "extensions/privateer-models.ts", "note": "/models picker w/ privacy shields" },
+    { "name": "privateer-posture", "entry": "extensions/privateer-posture.ts", "note": "live attestation shield" },
+    { "name": "privateer-tools", "entry": "extensions/privateer-tools.ts", "note": "Privateer tool pack" },
+    { "name": "privateer-privacy", "entry": "extensions/privateer-privacy.ts", "note": "pi-privacy + account tier resolver" },
+    { "name": "privateer-connect", "entry": "extensions/privateer-connect.ts", "note": "/connect — MCP connector manager" },
+    { "name": "privateer-media", "entry": "extensions/privateer-media.ts", "note": "image/video/speech/music + ffmpeg compose" },
+    { "name": "rpiv-web-tools", "dep": ["@juicesharp/rpiv-web-tools", "index.ts"], "note": "private web tools (user's own provider key)" },
+    { "name": "rpiv-ask-user-question", "dep": ["@juicesharp/rpiv-ask-user-question", "index.ts"], "note": "ask_user_question" },
+    { "name": "pi-mcp-adapter", "dep": ["pi-mcp-adapter", "index.ts"], "note": "MCP servers as first-class tools" },
+    { "name": "pi-hypa", "dep": ["@hypabolic/pi-hypa", "extensions", "index.ts"], "note": "hypa pack" },
+    { "name": "pi-subagents", "dep": ["pi-subagents", "src", "extension", "index.ts"], "note": "bounded parallel sub-agents" }
+  ],
+  "retired": ["pi-privacy", "pi-web-access"],
+  "reservedAliases": [
+    "@juicesharp/rpiv-web-tools",
+    "@juicesharp/rpiv-ask-user-question",
+    "@hypabolic/pi-hypa"
+  ]
+}