privateer-agent 0.11.0 → 0.12.0

package/src/providers/account.ts

@@ -37,7 +37,7 @@ import {
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
-// particular the default, tinfoil/glm-5-2, resolves at startup without a "model not
+// particular ACCOUNT_DEFAULT_MODEL_ID resolves at startup without a "model not
 // found" warning, which matters more than ever now that a signed-OUT terminal also
 // launches on it. The first two entries are the TEE tiers (Tinfoil, then NEAR); the
 // rest are the familiar names. Also the fallback list if the live listing is
@@ -46,6 +46,11 @@ import {
 const DEFAULT_MODELS = [
   ACCOUNT_DEFAULT_MODEL_ID,
   ACCOUNT_NEAR_MODEL_ID,
+  // The default until 2026-08-01 (see TINFOIL_MODEL_ID). It stays in the floor so a
+  // user who saved it as their own default still resolves it synchronously at launch,
+  // rather than falling through to "first model with configured auth" — the BYO dead
+  // end this seed list exists to prevent.
+  "tinfoil/glm-5-2",
   "anthropic/claude-opus-5",
   "anthropic/claude-sonnet-5",
   "openai/gpt-5.6-sol",
@@ -56,7 +61,9 @@ function seedModel(id: string) {
   return {
     id,
     name: id,
-    reasoning: false,
+    // reasoning + how to steer it, for the enclave models where we verified the
+    // control shape live; `reasoning: false` (Pi's "not a thinking model") for the rest.
+    ...(thinkingProfile(id) ?? { reasoning: false as const }),
     input: ["text"] as ("text" | "image")[],
     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
     contextWindow: 128000,
@@ -64,6 +71,83 @@ function seedModel(id: string) {
   };
 }
 
+// ── Thinking control ─────────────────────────────────────────────────────────
+//
+// Every account model used to register with `reasoning: false`, and that one field
+// silently pinned the whole catalog to maximum thinking. Pi gates EVERY
+// thinking-control branch on `model.reasoning` (pi-ai api/openai-completions.js
+// buildParams) and AgentSession.cycleThinkingLevel() returns undefined without it. So
+// Privateer sent no thinking parameter at all — a thinking model ran at whatever its
+// server-side default was, forever — and the user's thinking toggle was inert.
+//
+// What that cost, measured live against the account channel on 2026-08-01 with
+// "Write a haiku about the sea": the default model emitted 77 reasoning deltas and
+// ZERO content, spending all 300 tokens thinking. The same prompt with thinking off
+// answered in 18 tokens / 1.8s.
+//
+// Annotating a model is a promise that the dial actually moves, so ONLY shapes
+// verified against the live enclave appear below. Pi's default level is "medium", so
+// nothing here turns thinking off behind the user's back — it makes the toggle real.
+interface ThinkingProfile {
+  reasoning: true;
+  thinkingLevelMap?: Record<string, string | null>;
+  compat?: { thinkingFormat: string };
+}
+
+// The vLLM chat-template family (GLM, Qwen). Honours
+// `chat_template_kwargs.enable_thinking`, which is exactly what Pi's
+// "qwen-chat-template" format emits. Verified — enable_thinking=false → 0 reasoning
+// deltas and a direct answer, true → thinking restored, neither errors — on
+// tinfoil/glm-5-2, near/zai-org/GLM-5.1-FP8, near/Qwen/Qwen3.6-35B-A3B-FP8 and
+// phala/z-ai/glm-5.2.
+//
+// The switch is binary (there is no effort dial), so publish exactly two levels
+// instead of five that all mean "on": a null in thinkingLevelMap marks a level
+// unsupported and pi-ai's getSupportedThinkingLevels drops it.
+const CHAT_TEMPLATE_THINKING: ThinkingProfile = {
+  reasoning: true,
+  thinkingLevelMap: { minimal: null, low: null, high: null, xhigh: null },
+  compat: { thinkingFormat: "qwen-chat-template" },
+};
+
+// gpt-oss (harmony) is the other way round: it IGNORES chat_template_kwargs and
+// honours `reasoning_effort` — which is Pi's default format for our baseUrl, so this
+// profile deliberately carries no compat override. Verified on tinfoil/gpt-oss-120b:
+// low → 9 reasoning deltas, high → 61.
+//
+// Harmony has no "none", so "off" is pinned to the floor rather than left unset —
+// unset would send nothing and let the model fall back to its own default (medium),
+// i.e. an "off" that thinks harder than "low". This is the toggle's lowest setting,
+// not silence.
+const REASONING_EFFORT_THINKING: ThinkingProfile = {
+  reasoning: true,
+  thinkingLevelMap: { off: "low", minimal: "low", xhigh: null },
+};
+
+// Only the TEE prefixes are annotated. Those are enclaves we drive directly and can
+// probe. The rest of the catalog is proxied to a third-party gateway whose thinking
+// shape we have NOT verified from here, and an unsupported parameter fails the whole
+// turn — decisively worse than a turn that thinks too much. They keep the old
+// behaviour exactly.
+//
+// Two deliberate omissions inside the TEE set: `*-instruct` ids are the
+// non-thinking variants, and tinfoil/kimi-k2-6 reasons but ignored BOTH levers when
+// probed, so annotating it would hand the user a dial connected to nothing.
+const TEE_MODEL = /^(tinfoil|phala|near)\//;
+
+export function thinkingProfile(id: string): ThinkingProfile | null {
+  if (!TEE_MODEL.test(id)) return null;
+  if (/instruct/i.test(id)) return null;
+  const profile = /gpt-oss/i.test(id)
+    ? REASONING_EFFORT_THINKING
+    : /glm|qwen/i.test(id)
+      ? CHAT_TEMPLATE_THINKING
+      : null;
+  // Hand out a COPY. These entries end up on hundreds of registered models, and a
+  // shared nested object is one careless mutation away from retuning the whole catalog.
+  return profile && { ...profile, thinkingLevelMap: { ...profile.thinkingLevelMap }, ...(profile.compat ? { compat: { ...profile.compat } } : {}) };
+}
+
 // ── Catalog cache ────────────────────────────────────────────────────────────
 //
 // The live catalog (241 models and counting) can only be registered once the network
@@ -396,7 +480,7 @@ const TEE_PREFIXES = ["near/", "tinfoil/", "phala/"];
 // Which privacy channel an account model routes through: confidential compute (TEE)
 // for the prefixes above, else a server-side ZDR channel. Ported from tree-cli
 // resolve.ts, then widened — it used to say `near/` only, which quietly labelled the
-// default model (tinfoil/glm-5-2, a TEE model) as a mere ZDR policy claim.
+// then-default model (tinfoil/glm-5-2, a TEE model) as a mere ZDR policy claim.
 export function privateerChannel(modelId: string): "tee" | "zdr" {
   return TEE_PREFIXES.some((p) => modelId.startsWith(p)) ? "tee" : "zdr";
 }
@@ -498,7 +582,7 @@ export function accountProviderConfig(ids: string[]): Record<string, unknown> {
 // REPLACES a provider's model list and its request config, so whichever registration
 // lands last wins — and pi extensions are discovered with an unsorted readdirSync, which
 // on a typical box puts privateer-privacy after privateer-account. The account channel's
-// whole catalog was then replaced by that one model, so the default `tinfoil/glm-5-2` no
+// whole catalog was then replaced by that one model, so the account default no
 // longer resolved ("not found for provider privateer. Using custom model id") and the
 // synthesized model inherited the PUBLIC endpoint instead of `/api/agent/v1`.
 //

package/src/providers/defaultModel.ts

@@ -15,13 +15,29 @@ import { join } from "node:path";
 import { hasCredentials } from "../auth/privateer.ts";
 import { agentDir } from "../config/paths.ts";
 
-// Tinfoil's most capable chat model, and Privateer's default everywhere. Tinfoil runs
-// GLM 5.2 inside an attestable TEE (the serving enclave's quote is published and the
-// live TLS key is bound to it), which is the strongest privacy tier we offer — so the
-// most capable model on that tier is what a privacy-first agent should boot on.
+// A capable Tinfoil chat model, and Privateer's default everywhere. Tinfoil runs it
+// inside an attestable TEE (the serving enclave's quote is published and the live TLS
+// key is bound to it), which is the strongest privacy tier we offer — so a capable
+// model on that tier is what a privacy-first agent should boot on.
 // One definition, three consumers: this resolver, providers/account.ts's seed catalog,
 // and bin/privateer-launch.mjs (which mirrors the id — keep them in step).
-export const TINFOIL_MODEL_ID = "tinfoil/glm-5-2";
+//
+// It was `tinfoil/glm-5-2` until 2026-08-01, and the swap is a LATENCY decision, not a
+// capability one. Measured over 22 requests spaced 20s apart on the account channel,
+// glm-5-2 stalled before its first token on 9 of them — 33s to 98s each, with the
+// model demonstrably warm 20 seconds earlier, so it is contention in that deployment
+// rather than a cold start anything here can warm up. kimi-k2-6 and gpt-oss-120b, same
+// enclave provider, same tier, same transport, stalled 0 times in 20 (medians 1.2s and
+// 1.0s). The same run reproduced glm-5-2's stalls on BOTH the sealed and the cleartext
+// path, which is what rules out the shim, the relay and the proxy as the cause.
+//
+// Two consequences worth knowing when revisiting this: glm-5-2 remains in the live
+// catalog and is one pick away for anyone who wants it, and kimi-k2-6 reasons on every
+// turn with no working off switch (see thinkingProfile in providers/account.ts — its
+// levers were probed and none of them moved the reasoning volume). Its reasoning is
+// short and it always reaches an answer, which is why that is acceptable here and was
+// not for glm-5-2.
+export const TINFOIL_MODEL_ID = "tinfoil/kimi-k2-6";
 
 // Same model, reached two ways:
 //   - TINFOIL_DEFAULT_SPEC — direct to inference.tinfoil.sh with the user's own
@@ -63,6 +79,31 @@ export interface ResolveDefaultModelOptions {
   env?: NodeJS.ProcessEnv;
   // Override the signed-in check (testing). Defaults to hasCredentials().
   signedIn?: boolean;
+  // The user's saved Pi default ("provider/id"). undefined (the default) reads it
+  // from agentDir()/settings.json; null skips it entirely — resolveSignedInModel
+  // uses null because the sign-in TARGET must stay the confidential model (the
+  // decision to stay on a saved pick is made explicitly at its call sites, where
+  // the account channel still gets armed either way).
+  saved?: string | null;
+}
+
+// The user's own persisted model pick: Pi writes defaultProvider + defaultModel to
+// agentDir()/settings.json on EVERY interactive switch (AgentSession.setModel →
+// setDefaultModelAndProvider — both the built-in selector and pi-privacy's /models
+// picker land there). That makes it the strongest non-env signal of deliberate
+// intent we have, so resolveDefaultModel ranks it right after PRIVATEER_MODEL.
+// Returns "provider/id", or null when either half is missing.
+export function savedPiDefaultSpec(): string | null {
+  try {
+    const raw = readFileSync(join(agentDir(), "settings.json"), "utf8").trim();
+    if (!raw) return null;
+    const s = JSON.parse(raw) as Record<string, unknown>;
+    const provider = typeof s.defaultProvider === "string" ? s.defaultProvider.trim() : "";
+    const modelId = typeof s.defaultModel === "string" ? s.defaultModel.trim() : "";
+    return provider && modelId ? `${provider}/${modelId}` : null;
+  } catch {
+    return null;
+  }
 }
 
 // Resolve the model spec ("provider/id") to use when no model is named. Pure and
@@ -71,10 +112,13 @@ export interface ResolveDefaultModelOptions {
 // so the launcher, the REPL, and the next-launch seed all agree):
 //   1. explicit user choice (config/channel)      — deliberate, always wins
 //   2. PRIVATEER_MODEL env                         — dev/global override
-//   3. Tinfoil key present → Tinfoil GLM 5.2       — strongest (client-attested) privacy
-//   4. signed into Privateer → the same model over the subscription
-//   5. a BYO provider whose key is present         — anthropic, openai, openrouter
-//   6. nothing at all → the account default anyway — so the failure names Privateer
+//   3. the SAVED Pi default (settings.json)        — the model the user last picked
+//      interactively; Pi persists every switch, so honoring it here is what makes a
+//      /models pick actually stick across launches on every entry point
+//   4. Tinfoil key present → the Tinfoil default   — strongest (client-attested) privacy
+//   5. signed into Privateer → the same model over the subscription
+//   6. a BYO provider whose key is present         — anthropic, openai, openrouter
+//   7. nothing at all → the account default anyway — so the failure names Privateer
 //      and /login is the visible fix, instead of a keyless OpenRouter dead end
 export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): string {
   const env = opts.env ?? process.env;
@@ -85,6 +129,9 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
   const fromEnv = env.PRIVATEER_MODEL?.trim();
   if (fromEnv) return fromEnv;
 
+  const saved = opts.saved === undefined ? savedPiDefaultSpec() : opts.saved;
+  if (saved) return saved;
+
   // Privacy-first: a Tinfoil key means we can run verifiable TEE inference right now,
   // which we prefer even over the account's NEAR channel — same order the launcher uses.
   if (env.TINFOIL_API_KEY?.trim()) return TINFOIL_DEFAULT_SPEC;
@@ -110,8 +157,11 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
 // model sign-in should activate RIGHT AWAY: Tinfoil GLM 5.2, direct when a Tinfoil key
 // is present and over the subscription otherwise — no BYO key needed.
 // PRIVATEER_MODEL still wins — a deliberate override is never stomped.
+// `saved: null` on purpose: this is the sign-in TARGET, and the target is always the
+// confidential model. Whether to actually move a session that sits on a deliberate
+// saved pick is decided at the call sites (which arm the account channel either way).
 export function resolveSignedInModel(env: NodeJS.ProcessEnv = process.env): string {
-  return resolveDefaultModel({ env, signedIn: true });
+  return resolveDefaultModel({ env, signedIn: true, saved: null });
 }
 
 // Split a "provider/id" spec on its first slash (model ids themselves contain "/", so
@@ -135,7 +185,12 @@ function splitSpec(spec: string): { provider: string; modelId: string } | null {
 // `defaultModel` key), so a deliberate /model choice is never stomped. Best-effort —
 // any read/parse/write failure is swallowed; a missing seed just means the user picks
 // a model once via /model. Returns the spec written, or null if we left it alone.
-export function ensurePiDefaultModel(spec: string = ACCOUNT_DEFAULT_SPEC): string | null {
+//
+// The default seed is resolveSignedInModel(), not the static account spec: now that
+// the launcher HONORS a saved default (omits --model when one exists), seeding
+// `privateer/…` for a Tinfoil-keyed user would demote them from direct
+// client-attested inference to the subscription proxy on every later launch.
+export function ensurePiDefaultModel(spec: string = resolveSignedInModel()): string | null {
   const parts = splitSpec(spec);
   if (!parts) return null;
   const settingsPath = join(agentDir(), "settings.json");

package/src/remote/extensionsControl.ts

@@ -8,11 +8,11 @@
  * of these and route the extensions_* relay frames through it.
  *
  * Only the user's OWN packages surface here. The Privateer moat (privateer-*,
- * pi-privacy, rpiv-web-tools, …) is installed by bin/privateer-tui as shim .ts
- * files in the agent dir's extensions/ folder — auto-discovered, NOT recorded in
- * settings.json "packages". listConfiguredPackages() reads only "packages", so the
- * moat is naturally excluded. We keep a RESERVED name guard as defence in depth in
- * case a user ever hand-adds one of our package names.
+ * rpiv-web-tools, …) never appears in settings.json "packages": the launcher passes it to
+ * Pi as `-e` arguments, and the in-process entries build it from factories. So
+ * listConfiguredPackages(), which reads only "packages", excludes it naturally. The
+ * RESERVED guard is defence in depth for a user who hand-adds one of our names — which
+ * would load a second copy of an extension the moat already supplies.
  *
  * Framework-agnostic: nothing here imports React or the relay. The caller owns the
  * frame plumbing and hands us a SettingsManager (the REPL reuses the session's;
@@ -20,6 +20,7 @@
  */
 import { DefaultPackageManager } from "@earendil-works/pi-coding-agent";
 import type { ProgressEvent, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { reservedNames } from "../config/moatManifest.ts";
 
 // One installed extension as surfaced to the app. NON-PII: a package source
 // (npm:/git: spec) plus its scope — no cwd, no absolute paths beyond what Pi
@@ -49,25 +50,12 @@ export interface ExtensionsControl {
 // Package names we never manage from the app: the Privateer moat + adopted packs
 // installed as shims by the launcher. A guard only — listConfiguredPackages()
 // already omits them since they aren't settings "packages".
-const RESERVED = new Set([
-  "privateer-brand",
-  "privateer-context",
-  "privateer-gate",
-  "privateer-account",
-  "privateer-posture",
-  "privateer-tools",
-  "privateer-privacy",
-  "pi-privacy",
-  "pi-web-access",
-  "rpiv-web-tools",
-  "@juicesharp/rpiv-web-tools",
-  "rpiv-ask-user-question",
-  "@juicesharp/rpiv-ask-user-question",
-  "pi-mcp-adapter",
-  "pi-hypa",
-  "@hypabolic/pi-hypa",
-  "pi-subagents",
-]);
+//
+// Derived from the shipping manifest rather than hand-listed. The hand-written version
+// had drifted: privateer-models and privateer-connect were shimmed by the launcher but
+// missing here, so the app would have offered to install a user package under a name the
+// launcher overwrites on every launch. See src/config/moatManifest.ts.
+const RESERVED = new Set(reservedNames());
 
 // The bare package name inside a source spec, for the RESERVED check. Strips the
 // npm:/git: scheme and any @version / #ref suffix; leaves scoped names intact.

package/src/remote/liveTaskSession.ts

@@ -18,19 +18,13 @@ import {
 import { agentDir } from "../config/paths.ts";
 import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
-import { makePermissionGate, isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
-import { makePiPrivacyExtension } from "pi-privacy";
-import {
-  makeAccountProvider,
-  privateerChannel,
-  rememberAccountCredential,
-  dropPersistedAccountCredential,
-} from "../providers/account.ts";
+import { isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
+import { moatResourceOptions } from "../config/moat.ts";
+import { rememberAccountCredential, dropPersistedAccountCredential } from "../providers/account.ts";
 import { RelayClient, type TaskSpec } from "./relayClient.ts";
 import { RemoteBridge } from "./remoteBridge.ts";
-import { makeRelayFileTools } from "../tools/relayFileTools.ts";
 import { AttachmentStore, type StoredAttachment } from "../util/attachmentStore.ts";
-import { spawnAccountCredentials, revokeAccountSession, hasCredentials } from "../auth/privateer.ts";
+import { spawnAccountCredentials, revokeAccountSession } from "../auth/privateer.ts";
 import { createUIContext } from "../ext/headlessUi.ts";
 import { noQuarterActive } from "../permissions/noQuarter.ts";
 
@@ -207,24 +201,21 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     onRemoteBlocked: (toolName) => bridge.sendNotice(`${toolName} is disabled while driving remotely — its prompts can't reach the app.`),
   };
 
+  // relayFiles binds send_file_to_client / save_attachment to THIS session's bridge — the
+  // one whose relay the app is attached to. The shipped gate extension is discovered into
+  // this session too but stands its own pair down inside the daemon, so these are the ones
+  // the model gets (see tools/relayFileTools.ts). Media generation is on for a live spawn:
+  // it is driven from the app, so "make me a video of X" is one of the things it is FOR —
+  // and the gate still routes each call to the phone for approval like any other write.
   const services = await createAgentSessionServices({
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      extensionFactories: [
-        makePermissionGate(gate),
-        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
-        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
-        makePiPrivacyExtension({
-          privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
-        }),
-        makeAccountProvider(),
-        // send_file_to_client / save_attachment bound to THIS session's bridge — the one
-        // whose relay the app is attached to. The shipped gate extension is discovered
-        // into this session too but stands its own pair down inside the daemon, so these
-        // are the ones the model gets (see tools/relayFileTools.ts).
-        makeRelayFileTools(bridge, attachments),
-      ] as any,
+      ...((await moatResourceOptions({
+        kind: "live-task",
+        gate,
+        relayFiles: { bridge, attachments },
+      })) as any),
     },
   });
   servicesRef = services as any;

package/src/remote/relayClient.ts

@@ -118,6 +118,11 @@ export interface RelayCallbacks {
   onNoQuarter?: (on: boolean) => void;
   // A controller attached — push a transcript snapshot so it can catch up.
   onControllerAttached: () => void;
+  // The last controller went away (app closed / socket reaped). The terminal keeps
+  // running; the owner should stop assuming anything it sends up is being read, and
+  // deliver finished work durably instead (the cloud outbox → the app's Inbox).
+  // Optional so callbacks that predate the frame keep compiling.
+  onControllerDetached?: () => void;
   // The app ran a slash command from its composer (e.g. "/model provider/id").
   // Routed to the same command dispatcher the local REPL uses. Optional so
   // callbacks that predate the app command UI keep compiling.
@@ -353,6 +358,11 @@ export class RelayClient {
   private heartbeatTimer: ReturnType<typeof setInterval> | undefined;
   private lastInboundAt = 0;
   private connectedAt = 0;
+  // Is somebody actually on the other end? An open socket is NOT the same thing —
+  // the server holds our frames' route open and simply drops what it forwards when
+  // no controller is attached, so without this an unwatched turn writes its answer
+  // into a socket nobody is reading. See hasController() and the `handle` note.
+  private controllerHere = false;
   // Current backoff delay for the next unqualified scheduleReconnect(); reset on 'open'.
   private reconnectDelay = RECONNECT_MS;
   // Last refusal reason reported, so a 4xx is logged once instead of on every retry.
@@ -507,6 +517,9 @@ export class RelayClient {
         this.stopHeartbeat();
         if (this.ws === ws) this.ws = null;
         this.connectedAt = 0;
+        // A dead socket means no controller is reachable, whatever the last
+        // attach/detach frame said. Re-learned on the next attach or inbound frame.
+        this.controllerHere = false;
         this.cb.onDisconnected?.();
         if (!this.closed) {
           this.cb.onStatus?.(
@@ -660,6 +673,12 @@ export class RelayClient {
       return;
     }
     this.debug(`recv ${frame.type}`);
+    // Presence, learned from the traffic itself. The server forwards a frame to us
+    // only when a controller sent it (or when it announces one attaching), so ANY
+    // inbound frame is proof somebody is on the other end — which matters because
+    // `controller_attached` is missed by a terminal whose own socket reconnected
+    // mid-session. Cleared by `controller_detached` and by a dead socket.
+    if (frame.type !== "controller_detached") this.controllerHere = true;
     switch (frame.type) {
       case "prompt":
         // Forward even an empty/whitespace prompt: a file-only send carries no text,
@@ -685,6 +704,16 @@ export class RelayClient {
       case "controller_attached":
         this.cb.onControllerAttached();
         break;
+      // The app's socket went away (closed the app, lost the network, backgrounded
+      // long enough for the server's heartbeat to reap it). The relay stays up — the
+      // terminal is still reachable — but anything we send now lands nowhere, so the
+      // owner delivers finished work through the outbox instead. Published only when
+      // the LAST controller left (CAS-guarded server-side), so a take-over doesn't
+      // masquerade as "nobody is watching".
+      case "controller_detached":
+        this.controllerHere = false;
+        this.cb.onControllerDetached?.();
+        break;
       case "command":
         if (typeof frame.text === "string") this.cb.onCommand?.(frame.text);
         break;
@@ -876,6 +905,16 @@ export class RelayClient {
     return this.ws?.readyState === WebSocket.OPEN;
   }
 
+  // Is the app actually on the other end right now? Requires an open socket AND a
+  // controller known to be attached — learned from `controller_attached`, from any
+  // frame a controller sent us, and un-learned by `controller_detached` or a dropped
+  // socket. Conservative in the useful direction: it only reads true when we have
+  // positive evidence someone is there, so "deliver it durably instead" is the
+  // default for a turn whose audience we can't account for.
+  hasController(): boolean {
+    return this.isConnected() && this.controllerHere;
+  }
+
   // Connection health, for `privateer harbor status` / the IPC status reply. `quietSec`
   // is how long since the server last said anything: a connected socket that has been
   // quiet for longer than the server's 25s ping cadence is the shape of the half-open

package/src/remote/remoteBridge.ts

@@ -16,11 +16,20 @@ import type { PermissionRequest } from "../permissions/gate.ts";
 import type { AskOutcome } from "../permissions/modeGate.ts";
 import type { RelayCallbacks } from "./relayClient.ts";
 
+// How much of a driven turn's reply we hold for possible outbox delivery. The
+// sealed item is capped at 45k plaintext anyway; this just stops a pathological
+// turn from growing the buffer without bound.
+const MAX_TURN_CAPTURE = 60_000;
+
 // The outbound surface the bridge needs; RelayClient implements all of it.
 export interface RelayLike {
   requestApproval(id: string, req: PermissionRequest): void;
   sendEvent(ev: EngineEvent): void;
   isConnected(): boolean;
+  // Is a controller actually attached (not merely "our socket is up")? Optional:
+  // a relay that can't tell is treated as attached, so an unknown audience never
+  // turns into a duplicate of something the app already displayed.
+  hasController?(): boolean;
   sendNoQuarter(on: boolean): void;
   sendFile(file: { name: string; mediaType: string; base64: string; size: number }): Promise<{ ok: boolean; reason?: string }>;
   sendNotice(text: string): void;
@@ -99,6 +108,15 @@ export interface RemoteBridgeConfig {
   onFilesSearch?: (id: string, query: string) => void;
   // A controller (re)attached — the owner should push a transcript snapshot.
   onControllerAttached?: () => void;
+  // The last controller went away. Informational for the owner (the bridge already
+  // fails pending approvals closed); a driven turn in flight keeps running.
+  onControllerDetached?: () => void;
+  // A driven turn finished with NOBODY on the other end — the app was closed, killed,
+  // or its socket was reaped while the agent worked. Everything the turn streamed up
+  // was dropped by the relay, so the owner should deliver this durably instead (seal
+  // it to the account outbox → the app's Inbox). Called once per unwatched turn, after
+  // the turn settles; `prompt` is what was asked, `content` the reply as streamed.
+  onUnwatchedResult?: (result: { prompt: string; content: string }) => void;
   onStatus?: (text: string) => void;
   // A file finished transferring down from the app. The owner registers it (e.g. into
   // an AttachmentStore) so the save_attachment tool can persist it.
@@ -113,6 +131,17 @@ export class RemoteBridge {
   private readonly pendingSelects = new Map<string, (v: string | null) => void>();
   private readonly pendingInputs = new Map<string, (v: string | null) => void>();
   private pendingAttachments: RemoteAttachment[] = [];
+  // The driven turn in flight, kept only so it can be delivered to the outbox if it
+  // turns out nobody was watching (see settleTurn). Bounded: the outbox truncates at
+  // 45k anyway, and this must not grow with a runaway turn.
+  //
+  // `turnDriven` is deliberately NOT `remote`: a mid-turn disconnect clears `remote`
+  // (so the gate stops waiting on a controller that's gone) and that is exactly the
+  // case this feature exists for — the turn was still driven by the app, and its
+  // answer still has to reach the account. Only settleTurn clears it.
+  private turnDriven = false;
+  private turnPrompt = "";
+  private turnText = "";
 
   constructor(private readonly cfg: RemoteBridgeConfig) {}
 
@@ -128,6 +157,9 @@ export class RemoteBridge {
   readonly callbacks: Required<RelayCallbacks> = {
     onPrompt: (text) => {
       this.remote = true; // a remote turn is now in flight → gate relays each action
+      this.turnDriven = true;
+      this.turnPrompt = text;
+      this.turnText = "";
       const attachments = this.pendingAttachments;
       this.pendingAttachments = [];
       this.cfg.onPrompt(text, attachments);
@@ -195,6 +227,16 @@ export class RemoteBridge {
       this.relay?.sendNoQuarter(on); // echo the ack back so the app's toggle syncs
     },
     onControllerAttached: () => this.cfg.onControllerAttached?.(),
+    // The app left while we're still running. Same posture as a dropped socket: stop
+    // treating the turn as remote (the gate must not wait on a controller that isn't
+    // there) and fail every pending approval closed. The turn itself keeps going —
+    // and settleTurn will deliver its answer to the outbox, since `turnDriven` (unlike
+    // `remote`) survives the departure.
+    onControllerDetached: () => {
+      this.remote = false;
+      this.rejectAllPending();
+      this.cfg.onControllerDetached?.();
+    },
     onAttachment: (file) => {
       this.pendingAttachments.push(file);
       this.cfg.onAttachment?.(file);
@@ -307,13 +349,36 @@ export class RemoteBridge {
 
   // Mark the end of a turn so the next (possibly local) turn isn't treated as
   // remote. Call after each driven turn completes.
+  //
+  // Also the one moment we can tell whether the turn had an audience. If the app
+  // drove it and is now gone, everything the turn streamed up was dropped by the
+  // relay — so hand the answer to the owner for durable delivery rather than letting
+  // a completed piece of work evaporate because someone closed their phone.
   settleTurn(): void {
+    const driven = this.turnDriven;
+    const prompt = this.turnPrompt;
+    const content = this.turnText.trim();
     this.remote = false;
+    this.turnDriven = false;
+    this.turnPrompt = "";
+    this.turnText = "";
+    if (!driven || !content) return;
+    // Unknown (a relay that can't report presence) counts as watched: better to skip
+    // delivery than to duplicate something the app already showed in its feed.
+    const watched = this.relay?.hasController ? this.relay.hasController() : !!this.relay?.isConnected();
+    if (watched) return;
+    this.cfg.onUnwatchedResult?.({ prompt, content });
   }
 
   // Forward an EngineEvent up to the app. Safe to call for every event of every
   // turn (local included) — the relay only sends when a socket is open.
   forwardEvent(ev: EngineEvent): void {
+    // Keep the driven turn's reply as it streams, in case settleTurn finds nobody
+    // was there to read it. Text only: the outbox item is the answer, not a
+    // transcript of every tool call.
+    if (this.turnDriven && ev.type === "text" && this.turnText.length < MAX_TURN_CAPTURE) {
+      this.turnText += String(ev.text ?? "");
+    }
     this.relay?.sendEvent(ev);
   }