privateer-agent 0.11.0 → 0.12.1

package/README.md

@@ -12,6 +12,9 @@
   <a href="https://www.npmjs.com/package/privateer-agent">
     <img src="https://img.shields.io/npm/v/privateer-agent" alt="npm" />
   </a>
+  <a href="https://www.npmjs.com/package/privateer-agent">
+    <img src="https://img.shields.io/npm/dm/privateer-agent" alt="npm downloads" />
+  </a>
   <a href="https://github.com/privateer-agent/privateer-agent/releases">
     <img src="https://img.shields.io/badge/changelog-what's%20new-5b8def" alt="Changelog" />
   </a>
@@ -116,6 +119,12 @@ silently. The moat is swappable; the floor under it holds.
   routing between them, and `human_gate` steps that pause for your approval and resume.
 - **Chat-app channels.** Bridge the agent into Telegram, Slack, Discord, or WhatsApp with
   role-based approval — admins can approve actions, members are read-only.
+- **Make images and video.** Signed in, the agent can generate images, video clips, narration
+  and music on your account — and stitch them together locally with ffmpeg. It plans the whole
+  piece: render the stills, animate them, carry the last frame of one clip into the next so the
+  shots stay continuous, cut them together, then score and narrate the result. Generated media
+  is handed straight back as files on your machine; none of it is stored in our cloud. See
+  [docs/media-generation.md](docs/media-generation.md).
 - **MCP servers, sub-agents & skills.** Connect Model Context Protocol servers (local stdio
   or remote HTTP with OAuth) with [`/connect`](#connectors--mcp), delegate work to bounded
   parallel sub-agents, and drop in skills — all gated like everything else.

package/bin/privateer-launch.mjs

@@ -3,12 +3,22 @@
 // platform (macOS, Linux, Windows). `bin/privateer-tui` (unix) and the Windows
 // `privateer.cmd` are thin shims that just pick a Node and run THIS file.
 //
-// It boots Pi's full interactive TUI with the Privateer moat + tool packs. The moat
-// is installed as re-export SHIMS in the agent dir's extensions/, so BOTH this TUI
-// and any subagents it spawns (child processes reading the same agent dir) load the
-// identical set — including our permission gate. One source of truth via discovery
-// (no `-e`, which would double-load vs discovery). Runs in the current directory;
-// model via PRIVATEER_MODEL=provider/id.
+// It boots Pi's full interactive TUI with the Privateer moat + tool packs, passed as
+// explicit `-e` extension args (the same way --skill passes our bundled skills).
+//
+// We USED to install the moat as re-export shims in the agent dir's extensions/ and let
+// Pi discover them. That directory is shared with every other Privateer process — the
+// harbor daemon, the channels runner, ACP, the REPL — and Pi discovers it into every
+// session built against that agent dir, so those processes each loaded a second copy of
+// the moat on top of the one they build in code: a gate wired to a RemoteBridge nothing
+// had attached a relay to, tool registrations that shadowed the session's own, and
+// module-level state shared across concurrent sessions. Each entry point defended itself
+// with a different env marker, and the ones nobody remembered to defend (media, MCP, web)
+// were never covered at all. Passing `-e` instead means the agent dir's extensions/ holds
+// ONLY the user's own extensions, so there is nothing of ours left to collide with, and
+// each process loads exactly the moat it asked for. See src/config/moat.ts.
+//
+// Runs in the current directory; model via PRIVATEER_MODEL=provider/id.
 //
 // Ported from the original bash launcher; behaviour is intended to match exactly.
 
@@ -16,7 +26,7 @@ import { spawn, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
@@ -25,6 +35,32 @@ const isWin = process.platform === "win32";
 
 const PRIVATEER_HOME = process.env.PRIVATEER_HOME || path.join(os.homedir(), ".privateer");
 const ENV_FILE = path.join(REPO, ".env"); // dev-only; a real install has none
+const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");
+const EXT_DIR = path.join(AGENT_DIR, "extensions");
+
+// WHAT to load comes from src/config/moatManifest.json — the same file the TS side derives
+// extensionsControl's RESERVED set and the per-profile factory lists from, so adding an
+// extension is one edit rather than four. JSON because this file runs before the patches,
+// with no tsx and no dependencies. See src/config/moatManifest.ts.
+const MANIFEST = JSON.parse(fs.readFileSync(path.join(REPO, "src", "config", "moatManifest.json"), "utf8"));
+
+// Releases up to 0.11 installed the moat as shim files here. They are no longer written
+// (we pass `-e` instead), so any that survive an upgrade are stale — and a stale shim is
+// worse than a missing one: Pi would discover it into every session sharing this agent
+// dir, loading a second moat next to the one that process builds in code. Sweep on EVERY
+// launch, not just the TUI's: a machine that only ever runs `privateer harbor` upgrades
+// too, and its sessions are exactly the ones the duplicate hurt most.
+function sweepLegacyShims() {
+  if (!fs.existsSync(EXT_DIR)) return;
+  for (const name of [...MANIFEST.shims.map((s) => s.name), ...MANIFEST.retired]) {
+    try {
+      fs.rmSync(path.join(EXT_DIR, `${name}.ts`), { force: true });
+    } catch {
+      /* a root-owned agent dir just means the stale shim stays; the in-process filter
+         (src/config/moat.ts) still keeps it out of any session we build. */
+    }
+  }
+}
 
 // --- bundle detection ------------------------------------------------------
 // A self-contained bundle ships its own pinned Node at "$REPO/node[.exe]" plus a
@@ -43,6 +79,20 @@ process.env.PATH = path.dirname(NODE_BIN) + path.delimiter + (process.env.PATH |
 
 const args = process.argv.slice(2);
 
+// The command name to hand back to the user in copy-pasteable hints. Pi builds those
+// from its own APP_NAME ("pi"), which is installed nowhere on a Privateer machine — so
+// its "To resume this session: pi --session <id>" line pasted straight into
+// `bash: pi: command not found`. npm's bin symlink keeps its own name in argv[1], so
+// the invocation tells us the truth; internal entrypoints (privateer-launch.mjs, the
+// privateer-tui shim) are not on anyone's PATH, so those fall back to the published
+// bin name. Children inherit this via env; the patched formatResumeCommand reads it.
+process.env.PRIVATEER_CMD ??= invokedCommandName();
+
+function invokedCommandName() {
+  const name = path.basename(process.argv[1] || "").replace(/\.(mjs|cjs|js|cmd|bat|exe)$/i, "");
+  return !name || name.startsWith("privateer-") ? "privateer" : name;
+}
+
 // `--no-quarter` — total permission bypass ("take no prisoners"). Strip it from the
 // args BEFORE anything else so it never reaches Pi's cli.js (which doesn't know it)
 // and so `sub`/`args.slice(1)` see only real subcommands. When present we export
@@ -93,31 +143,92 @@ function runToCompletion(cmd, cmdArgs, opts = {}) {
   });
 }
 
+// npm gives no usable progress, so on a TTY show a braille spinner while it runs
+// and keep its output buffered — shown only if the install fails. Non-TTY (CI,
+// piped) keeps the old passthrough behaviour. The global package is replaced in
+// place, so re-reading our own package.json afterwards yields the NEW version.
+function updateNpmPackage() {
+  const cmd = isWin ? "npm.cmd" : "npm";
+  const npmArgs = ["install", "-g", "privateer-agent@latest", "--no-fund", "--no-audit"];
+  if (!process.stdout.isTTY) {
+    console.log("Updating privateer-agent to the latest release…");
+    // npm is npm.cmd on Windows; Node >=18.20 needs a shell to spawn a .cmd (EINVAL otherwise).
+    runToCompletion(cmd, npmArgs, { shell: isWin });
+    return;
+  }
+  // Ask npm for the globally installed version — REPO/package.json would lie when
+  // this copy runs from somewhere other than the global root (e.g. an npx cache).
+  const globalVer = () => {
+    try {
+      const r = spawnSync(cmd, ["ls", "-g", "privateer-agent", "--depth=0", "--json"], { shell: isWin, encoding: "utf8" });
+      return JSON.parse(r.stdout).dependencies?.["privateer-agent"]?.version ?? null;
+    } catch { return null; }
+  };
+  const before = globalVer();
+  console.log(`\x1b[1m⚓ Updating Privateer\x1b[0m${before ? ` \x1b[2m(currently ${before})\x1b[0m` : ""}`);
+  const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+  let captured = "";
+  const child = spawn(cmd, [...npmArgs, "--loglevel=error"], { shell: isWin, env: process.env });
+  child.stdout.on("data", (d) => (captured += d));
+  child.stderr.on("data", (d) => (captured += d));
+  process.stdout.write("\x1b[?25l");
+  const t0 = Date.now();
+  let i = 0;
+  const timer = setInterval(() => {
+    const s = Math.round((Date.now() - t0) / 1000);
+    process.stdout.write(`\r  \x1b[36m${frames[i++ % frames.length]}\x1b[0m updating privateer-agent@latest \x1b[2m${s}s\x1b[0m\x1b[K`);
+  }, 80);
+  const restore = () => { clearInterval(timer); process.stdout.write("\r\x1b[K\x1b[?25h"); };
+  child.on("exit", (code, signal) => {
+    restore();
+    if (code === 0) {
+      const after = globalVer();
+      if (before && after && before === after) {
+        console.log(`\x1b[32m✓\x1b[0m Already ship-shape — privateer-agent ${after} is the latest release.`);
+      } else {
+        console.log(`\x1b[32m✓\x1b[0m Updated privateer-agent${before ? ` ${before} →` : ""}${after ? ` ${after}` : ""}`);
+        console.log(`\nRun \x1b[1mprivateer\x1b[0m to set sail on the new release.`);
+      }
+      process.exit(0);
+    }
+    if (captured.trim()) process.stderr.write(captured);
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 1);
+  });
+  child.on("error", (e) => {
+    restore();
+    console.error(`privateer: failed to launch npm — ${e.message}`);
+    process.exit(1);
+  });
+}
+
 // --- `privateer update` ----------------------------------------------------
 // Fetch the latest release and exit. Bundle installs re-run the download+extract
 // installer; npm installs update the global package.
 if (sub === "update") {
   if (BUNDLED) {
-    console.log("Updating Privateer to the latest release…");
+    // PRIVATEER_UPDATE=1 flips the installer into update mode: weigh-anchor banner,
+    // "X → Y" version reporting, and an early exit (no download) when already current.
+    // ?update=1 tells the server this fetch is an update, not a fresh install.
+    const env = { ...process.env, PRIVATEER_UPDATE: "1" };
     if (isWin) {
-      runToCompletion("powershell", ["-NoProfile", "-Command", "irm https://privateer.pro/install.ps1 | iex"]);
+      runToCompletion("powershell", ["-NoProfile", "-Command", "irm 'https://privateer.pro/install.ps1?update=1' | iex"], { env });
     } else {
-      runToCompletion("sh", ["-c", "curl -fsSL https://privateer.pro/install.sh | sh"]);
+      runToCompletion("sh", ["-c", "curl -fsSL 'https://privateer.pro/install.sh?update=1' | sh"], { env });
     }
   } else {
-    console.log("Updating privateer-agent to the latest release…");
-    // npm is npm.cmd on Windows; Node >=18.20 needs a shell to spawn a .cmd (EINVAL otherwise).
-    runToCompletion(isWin ? "npm.cmd" : "npm", ["install", "-g", "privateer-agent@latest"], { shell: isWin });
+    updateNpmPackage();
   }
-  // runToCompletion exits via the child's exit handler.
+  // both paths exit via their child's exit handler.
 }
 
 // --- `privateer harbor [run|install|uninstall|status]` ---------------------
 // The resident background harbor (routines + app-driven headless task spawns). Boots
-// straight into src/harbor via bin/privateer-harbor.mjs — no moat-shim install (the
-// harbor loads the moat as in-code factories, not interactive extensions).
+// straight into src/harbor via bin/privateer-harbor.mjs — the harbor loads the moat as
+// in-code factories, so it needs no `-e` args of its own.
 // `daemon` is a hidden back-compat alias for the pre-rename command name.
 else if (sub === "harbor" || sub === "daemon") {
+  sweepLegacyShims(); // a harbor-only machine upgrades too — see the function's note
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
   runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-harbor.mjs"), ...args.slice(1)]);
 }
@@ -126,16 +237,16 @@ else if (sub === "harbor" || sub === "daemon") {
 // Privateer as an Agent Client Protocol server, spawned by an ACP host (Buzz's
 // `buzz-acp`, Zed, …) and driven over newline-delimited JSON-RPC on stdio.
 //
-// ⚠️ STDOUT IS THE PROTOCOL here, so this branch must stay silent: no banner, no
-// patch chatter, no moat-shim install (like `harbor`, the ACP entry loads the moat
-// as in-code factories rather than discovered extensions). A single stray stdout
-// line breaks the JSON-RPC stream and the host disconnects.
+// ⚠️ STDOUT IS THE PROTOCOL here, so this branch must stay silent: no banner, no patch
+// chatter (like `harbor`, the ACP entry loads the moat as in-code factories). A single
+// stray stdout line breaks the JSON-RPC stream and the host disconnects.
 else if (sub === "acp") {
+  sweepLegacyShims(); // silent: only ever removes files
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
   runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-acp.mjs"), ...args.slice(1)]);
 }
 
-// --- normal launch: install the moat, then exec Pi's TUI -------------------
+// --- normal launch: resolve the moat, then exec Pi's TUI with it -----------
 else {
   // Windows has no bash out of the box, but Privateer's command tool needs one. If a
   // real bash isn't reachable, stop here with a clear, actionable message — otherwise
@@ -150,50 +261,22 @@ else {
   // stock Pi behaviour, not a broken boot. Bundles ship pre-patched and no-op here.
   ensurePatches();
 
-  const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");
-  const EXT_DIR = path.join(AGENT_DIR, "extensions");
+  // The agent dir's extensions/ is now the USER's alone — we create it so there's a place
+  // to drop one, and clear out any shim an older release left behind.
   fs.mkdirSync(EXT_DIR, { recursive: true });
-
-  // Install/refresh the moat + tool-pack shims. Each shim re-exports its target by
-  // ABSOLUTE path (as a file:// URL, portable across OSes) so the target's own
-  // relative imports resolve from the repo. We remove any shim we previously managed
-  // first, so a dropped package can't linger and reload.
-  const MANAGED = [
-    "privateer-brand", "privateer-context", "privateer-gate", "privateer-account",
-    "privateer-models", "privateer-posture", "privateer-tools", "privateer-privacy",
-    "privateer-connect",
-    "pi-privacy", "pi-web-access", "rpiv-web-tools", "rpiv-ask-user-question",
-    "pi-mcp-adapter", "pi-hypa", "pi-subagents",
-  ];
-  for (const name of MANAGED) fs.rmSync(path.join(EXT_DIR, `${name}.ts`), { force: true });
-
-  const ext = (...p) => path.join(REPO, "extensions", ...p);
-  // Resolve dependencies by walking the node_modules chain, NOT as REPO/node_modules.
-  // npm only nests deps under us for a global install; `npx privateer-agent` and
-  // `npm i privateer-agent` HOIST them to a sibling/parent node_modules, where the
-  // hardcoded path resolves to nothing and every shim below points at a missing file.
+  sweepLegacyShims();
+
+  // Resolve every moat entry point to an absolute path, to be passed to Pi as `-e`.
+  // Dependencies resolve by walking the node_modules chain, NOT as REPO/node_modules: npm
+  // only nests deps under us for a global install; `npx privateer-agent` and `npm i
+  // privateer-agent` HOIST them to a sibling/parent node_modules, where a hardcoded path
+  // resolves to nothing. A target that doesn't exist means that optional tool pack isn't
+  // installed — drop it rather than passing a path Pi will fail to load.
   const dep = (name, ...rest) => resolveDep(REPO, name, ...rest);
-  // A missing target means that optional tool pack isn't installed — skip its shim
-  // rather than writing one that points at nothing (which fails at extension load).
-  const shim = (name, target) => {
-    if (!target || !fs.existsSync(target)) return;
-    fs.writeFileSync(path.join(EXT_DIR, `${name}.ts`), `export { default } from ${JSON.stringify(pathToFileURL(target).href)};\n`);
-  };
-
-  shim("privateer-brand", ext("privateer-brand.ts"));       // banner, ⚓ badge, /signin /signout
-  shim("privateer-context", ext("privateer-context.ts"));   // PRIVATEER.md context + /init
-  shim("privateer-gate", ext("privateer-gate.ts"));         // the permission gate (moat)
-  shim("privateer-account", ext("privateer-account.ts"));
-  shim("privateer-models", ext("privateer-models.ts"));     // /models picker w/ privacy shields
-  shim("privateer-posture", ext("privateer-posture.ts"));
-  shim("privateer-tools", ext("privateer-tools.ts"));
-  shim("privateer-privacy", ext("privateer-privacy.ts"));   // pi-privacy + account tier resolver
-  shim("privateer-connect", ext("privateer-connect.ts"));   // /connect — MCP connector manager
-  shim("rpiv-web-tools", dep("@juicesharp/rpiv-web-tools", "index.ts")); // private web tools
-  shim("rpiv-ask-user-question", dep("@juicesharp/rpiv-ask-user-question", "index.ts")); // ask_user_question
-  shim("pi-mcp-adapter", dep("pi-mcp-adapter", "index.ts"));
-  shim("pi-hypa", dep("@hypabolic/pi-hypa", "extensions", "index.ts"));
-  shim("pi-subagents", dep("pi-subagents", "src", "extension", "index.ts"));
+  const MOAT_PATHS = MANIFEST.shims
+    .map((s) => (s.entry ? path.join(REPO, s.entry) : dep(...s.dep)))
+    .filter((p) => p && fs.existsSync(p));
+  const extArgs = MOAT_PATHS.flatMap((p) => ["-e", p]);
 
   // Unlike the tool packs above, Pi's CLI is not optional — it IS the agent. If it
   // didn't resolve, the install is broken; say so instead of spawning `undefined`.
@@ -206,10 +289,18 @@ else {
     process.exit(1);
   }
   process.env.PI_CODING_AGENT_DIR = AGENT_DIR;
-  // The binary pi-subagents spawns for each child. Point it at OUR cli.js so the child
-  // reads this same PI_CODING_AGENT_DIR and DISCOVERS the moat shims (gated + private,
-  // no -e injection). Set only when unset so a power user can override.
-  if (!process.env.PI_SUBAGENT_PI_BINARY) process.env.PI_SUBAGENT_PI_BINARY = CLI;
+  // The binary pi-subagents spawns for each child, and the moat that child must load.
+  //
+  // ⚠️ SECURITY-LOAD-BEARING. A child used to inherit the moat by DISCOVERING the shims
+  // from the shared agent dir — so pointing PI_SUBAGENT_PI_BINARY straight at cli.js was
+  // enough. With the shims gone there is nothing to discover, and a child spawned that way
+  // would run COMPLETELY UNGATED. So route children through our wrapper, which injects the
+  // moat explicitly, and hand it the exact set this TUI is loading: a child gets its
+  // parent's moat, not a hardcoded subset that drifts from it.
+  if (!process.env.PI_SUBAGENT_PI_BINARY) {
+    process.env.PI_SUBAGENT_PI_BINARY = path.join(REPO, "bin", "privateer-subagent.mjs");
+  }
+  process.env.PRIVATEER_CHILD_EXTENSIONS = MOAT_PATHS.join(path.delimiter);
   // Suppress Pi's upstream update banner (our banner is the startup surface). Disables
   // ONLY the version fetch — fd/rg can still download on first run.
   if (!process.env.PI_SKIP_VERSION_CHECK) process.env.PI_SKIP_VERSION_CHECK = "1";
@@ -233,10 +324,11 @@ else {
   // auto-install. Fire-and-forget: the event loop stays alive while the TUI child runs.
   refreshUpdateCache();
 
-  // Default model. Mirrors src/providers/defaultModel.ts resolveDefaultModel() — keep
-  // the two in step. Tinfoil's GLM 5.2 is the default either way: direct when the user
-  // has a Tinfoil key (pi-privacy can client-attest the enclave), over the Privateer
-  // subscription otherwise.
+  // Computed default model — used ONLY when the user has no saved pick and no
+  // override (see modelArgs below). Mirrors src/providers/defaultModel.ts
+  // resolveDefaultModel() — keep the two in step. Tinfoil's default is the same
+  // either way: direct when the user has a Tinfoil key (pi-privacy can client-attest
+  // the enclave), over the Privateer subscription otherwise.
   //
   // The last branch is the important one. A signed-out, keyless terminal used to launch
   // on `openrouter/openai/gpt-4o-mini`, which it had no key for — so the first prompt
@@ -247,11 +339,13 @@ else {
   // Privateer and points at /login.
   const CRED = path.join(PRIVATEER_HOME, "credentials.json");
   const signedIn = fs.existsSync(CRED);
-  const ACCOUNT_MODEL = "privateer/tinfoil/glm-5-2";
+  // Mirrors TINFOIL_MODEL_ID in src/providers/defaultModel.ts — keep them in step; that
+  // file carries the measurements behind the choice.
+  const ACCOUNT_MODEL = "privateer/tinfoil/kimi-k2-6";
   const MODEL = process.env.PRIVATEER_MODEL
     ? process.env.PRIVATEER_MODEL
     : haveTinfoilKey()
-      ? "tinfoil/glm-5-2"
+      ? "tinfoil/kimi-k2-6"
       : signedIn
         ? ACCOUNT_MODEL
         : haveKey("ANTHROPIC_API_KEY")
@@ -280,9 +374,35 @@ else {
     .filter((dir) => fs.existsSync(dir));
   const skillArgs = SKILL_DIRS.flatMap((dir) => ["--skill", dir]);
 
+  // Honor the user's own persisted pick. Pi writes defaultProvider + defaultModel to
+  // AGENT_DIR/settings.json on EVERY interactive switch (AgentSession.setModel — the
+  // built-in selector and pi-privacy's /models picker both land there), but consults
+  // it ONLY when no --model flag is passed (sdk.js: `let model = options.model` short-
+  // circuits the settings default). Passing --model unconditionally was therefore the
+  // "model switch doesn't persist" bug: every pick saved faithfully, then stomped at
+  // the next launch. Precedence (mirrors resolveDefaultModel — keep in step):
+  //   1. a --model the user typed on the privateer command line (already in `args`)
+  //   2. PRIVATEER_MODEL — deliberate override, folded into MODEL above
+  //   3. a saved pick in settings.json → pass NO flag; Pi resolves it itself (and
+  //      falls back sanely if that model has vanished from the registry)
+  //   4. nothing saved (first run / fresh home) → the computed MODEL above
+  const userPassedModel = args.includes("--model");
+  let savedDefault = null;
+  try {
+    const s = JSON.parse(fs.readFileSync(path.join(AGENT_DIR, "settings.json"), "utf8"));
+    if (
+      typeof s.defaultProvider === "string" && s.defaultProvider.trim() &&
+      typeof s.defaultModel === "string" && s.defaultModel.trim()
+    ) {
+      savedDefault = `${s.defaultProvider}/${s.defaultModel}`;
+    }
+  } catch { /* absent/unreadable → no saved pick */ }
+  const modelArgs =
+    userPassedModel || (savedDefault && !process.env.PRIVATEER_MODEL) ? [] : ["--model", MODEL];
+
   // Dev convenience: load provider keys from the repo's .env if present.
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
-  runToCompletion(NODE_BIN, [...nodeArgs, CLI, "--model", MODEL, ...skillArgs, ...args]);
+  runToCompletion(NODE_BIN, [...nodeArgs, CLI, ...modelArgs, ...extArgs, ...skillArgs, ...args]);
 }
 
 // --- helpers ---------------------------------------------------------------
@@ -346,11 +466,27 @@ function findWindowsBash() {
 // tell the user why in a way they can act on. "current"/"applied"/"skipped" are silent.
 function ensurePatches() {
   if (applyPatchesIfNeeded(REPO, NODE_BIN) !== "failed") return;
+
+  // Most of the patch set is UX polish that degrades to stock Pi. The project config
+  // dir is NOT: without the patch, `<cwd>/.privateer/` is a directory Pi has never
+  // heard of, so a project's settings, packages, skills and extensions are ignored
+  // outright. Say so — and say it louder when the current project actually has one,
+  // because that user is about to run with a config they believe is loaded.
+  const projectDirIgnored = fs.existsSync(path.join(process.cwd(), ".privateer"));
   process.stderr.write(
     [
       "",
       "  ⚓ Couldn't apply Privateer's bundled patches to node_modules — continuing without them.",
-      "     Two upstream fixes (retry-loop guard, /model → /models redirect) stay off.",
+      "     Upstream fixes (retry-loop guard, /model → /models redirect) stay off, and this",
+      "     project's `.privateer/` config directory is NOT read — only `.pi/` is.",
+      ...(projectDirIgnored
+        ? [
+            "",
+            `     THIS PROJECT HAS ONE: ${path.join(process.cwd(), ".privateer")}`,
+            "     Its settings, packages, skills and extensions are being ignored right now.",
+          ]
+        : []),
+      "",
       `     Usually a permissions issue: ${path.join(REPO, "node_modules")} isn't writable`,
       "     by this user (a `sudo npm install -g` install). Re-run once with sudo, or",
       "     install without sudo (nvm, or an npm prefix you own) to fix it for good.",

package/bin/privateer-subagent.mjs

@@ -1,35 +1,48 @@
 #!/usr/bin/env node
-// The binary pi-subagents spawns for each subagent child (via PI_SUBAGENT_PI_BINARY)
-// when the PARENT loaded privateer's moat as IN-CODE extension factories (the lean
-// REPL, the harbor, live task sessions) rather than agent-dir discovery.
+// The binary pi-subagents spawns for EVERY subagent child (via PI_SUBAGENT_PI_BINARY).
 //
-// Why a wrapper here (vs the plain cli.js the TUI uses): a subagent child is a fresh
-// `pi` subprocess that can't inherit the parent's in-code factories. It CAN auto-
-// discover agent-dir extensions — but if the parent ALSO loaded those same shims as
-// factories, Pi loads both (resource-loader merges discovered + inline) and the moat
-// double-loads (two gates, two provider registrations). So instead of relying on
-// discovery, this wrapper injects the moat EXPLICITLY as `-e` extensions and passes
-// `--no-extensions` to turn agent-dir discovery OFF. The child then loads exactly:
-//   • pi-subagents' own runtime extensions (already present in the argv it built), and
-//   • privateer's gate + privacy + account (the three `-e` below),
-// with no discovery, hence no double-load — while pi-subagents' explicit `--extension`
-// args still load (‑‑no‑extensions only disables DISCOVERY, not explicit `-e`).
+// ⚠️ THIS IS WHAT KEEPS A SUBAGENT GATED. A child is a fresh `pi` subprocess that cannot
+// inherit its parent's in-code extension factories, and — since the moat stopped being
+// installed as discovery shims in the shared agent dir — there is nothing for it to
+// discover either. So the moat reaches a child through exactly one route: the `-e` args
+// injected here. A child spawned around this wrapper runs UNGATED.
+//
+// It also passes `--no-extensions` to turn agent-dir discovery off. That is now about the
+// child's blast radius rather than double-loading: an unattended, headless worker should
+// load the set its parent chose and nothing else — not whatever extensions the user
+// happens to have configured for their own interactive sessions. (`--no-extensions`
+// disables DISCOVERY only, so pi-subagents' own `--extension` args still load, as do the
+// `-e` paths below.)
 //
 // Exported helpers are pure and unit-tested (tests/subagentWrapper.test.ts); the
 // spawn only runs when this file is invoked as a binary.
 
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { dirname, resolve, join } from "node:path";
+import { dirname, resolve, join, delimiter } from "node:path";
+import { existsSync } from "node:fs";
 
 const HERE = dirname(fileURLToPath(import.meta.url)); // bin/
 const REPO = resolve(HERE, ".."); // repo root
 
-// Absolute paths to privateer's moat extension entry files (the same modules the TUI
-// installs as discovery shims). gate = the permission moat (fail-closed / forwards
-// child approvals to the parent); privacy = ZDR/TEE posture + attestation dispatcher;
-// account = the privateer/* provider so a child can run account models.
-export function moatExtensionPaths(repoRoot = REPO) {
+// The moat a child loads: whatever its PARENT loaded, handed down through the environment.
+//
+// bin/privateer-launch.mjs sets PRIVATEER_CHILD_EXTENSIONS to the same list it passes the
+// TUI, so a child of a terminal gets the terminal's moat — including the tool packs —
+// rather than a hardcoded subset that silently drifts from it as the manifest changes.
+//
+// The fallback covers the in-code parents (the lean REPL, the harbor, live task sessions),
+// which build their moat from factories and have no `-e` list to hand down. Those get the
+// floor and nothing else: gate = the permission moat (fail-closed, forwards the child's
+// approvals to the parent); privacy = ZDR/TEE posture + attestation dispatcher; account =
+// the privateer/* provider, so a child can run account models. Deliberately narrower than
+// a terminal's — an unattended run's children have no human to approve a tool that spends.
+export function moatExtensionPaths(repoRoot = REPO, env = process.env) {
+  const inherited = (env.PRIVATEER_CHILD_EXTENSIONS ?? "")
+    .split(delimiter)
+    .map((p) => p.trim())
+    .filter((p) => p && existsSync(p));
+  if (inherited.length > 0) return inherited;
   return [
     join(repoRoot, "extensions", "privateer-gate.ts"),
     join(repoRoot, "extensions", "privateer-privacy.ts"),
@@ -45,9 +58,9 @@ export function piCliPath(repoRoot = REPO) {
 // Given the args pi-subagents built for the child, return the args to run the bundled
 // cli.js with: `--no-extensions` + one `-e <path>` per moat extension, THEN the
 // original args (so the injected flags precede the positional `Task:` prompt).
-export function buildChildArgs(originalArgs, repoRoot = REPO) {
+export function buildChildArgs(originalArgs, repoRoot = REPO, env = process.env) {
   const inject = ["--no-extensions"];
-  for (const p of moatExtensionPaths(repoRoot)) inject.push("-e", p);
+  for (const p of moatExtensionPaths(repoRoot, env)) inject.push("-e", p);
   return [...inject, ...originalArgs];
 }
 

package/extensions/privateer-brand.ts

@@ -34,7 +34,7 @@ import {
   makeAccountProvider,
   verificationLink,
 } from "../src/providers/account.ts";
-import { resolveSignedInModel } from "../src/providers/defaultModel.ts";
+import { resolveSignedInModel, savedPiDefaultSpec } from "../src/providers/defaultModel.ts";
 import { discoverContextFiles, onContextChanged } from "../src/context.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
 
@@ -501,6 +501,19 @@ export default function privateerBrand(pi: any): void {
         return;
       }
 
+      // A saved default the user picked themselves (Pi persists every interactive
+      // switch, and the launcher now boots on it) is a standing instruction. When it
+      // points anywhere other than the sign-in target, arming the channel — done
+      // above — is all sign-in may do: auto-switching would stomp the pick the
+      // launcher just honored, one login at a time.
+      const saved = savedPiDefaultSpec();
+      if (saved && saved !== spec) {
+        dbg(`activateSignedInModel: saved default ${saved} is a deliberate pick — not switching`);
+        refresh(ctx);
+        ctx?.ui?.notify?.("Signed in — account channel armed. Staying on your saved model.", "info");
+        return;
+      }
+
       const reg = ctx?.modelRegistry;
       if (!reg?.find || typeof pi.setModel !== "function") return;
       const model = reg.find(provider, id);

package/extensions/privateer-gate.ts

@@ -26,8 +26,6 @@ import { AttachmentStore, type StoredAttachment } from "../src/util/attachmentSt
 import { makeExtensionsControl } from "../src/remote/extensionsControl.ts";
 import { makeSkillsControl } from "../src/remote/skillsControl.ts";
 import { agentDir } from "../src/config/paths.ts";
-import { inHarborDaemon } from "../src/config/harborDaemon.ts";
-import { discoveredGateApplies } from "../src/config/inlineMoat.ts";
 import { agentVersion } from "../src/config/version.ts";
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
 import { matchesKey } from "@earendil-works/pi-tui";
@@ -435,22 +433,18 @@ const gate = makePermissionGate({
 
 export default function privateerControl(pi: any): void {
   piRef = pi;
-  // The moat — tool_call (block/allow) + tool_result (redact) — but ONLY when this
-  // session doesn't already carry one. A process that builds its sessions with
-  // makePermissionGate() as an inline factory (the harbor and its live task spawns,
-  // the channels runner) still auto-discovers this shim from the shared agent dir,
-  // and Pi runs EVERY tool_call handler — stopping early only on a block. Installing
-  // here too would mean two gates on one call: a second, redundant approval dialog
-  // where a UI is bound (a live task spawn), and a fail-closed local deny where one
-  // isn't (this file's bridge has no relay outside `/remote-access`). The session's
-  // own gate is the right one — it knows that session's cwd and its approver. See
-  // config/inlineMoat.ts for the full failure shape.
+  // The moat — tool_call (block/allow) + tool_result (redact).
   //
-  // A subagent child is the exception: it loads this file EXPLICITLY (`-e`, see
-  // bin/privateer-subagent.mjs) as its only gate, and inherits the parent's env — so
-  // it must keep installing regardless of the inherited marker, or children of a
-  // harbor task would run entirely ungated.
-  if (discoveredGateApplies(isSubagentChild())) gate(pi);
+  // Unconditional, because this file now only loads where it is wanted: the interactive
+  // TUI and subagent children get it as an explicit `-e` argument (bin/privateer-launch.mjs,
+  // bin/privateer-subagent.mjs), and the processes that build their own gate from
+  // makePermissionGate() never load it at all. It used to be conditional — this extension
+  // was installed as a shim in the shared agent dir, so Pi discovered it into the harbor,
+  // the channels runner and the REPL as well, and a second gate there meant either a
+  // duplicate approval dialog or a fail-closed deny before the session's real approver was
+  // consulted. The fix moved to the host: nothing of ours is discoverable any more, so the
+  // gate no longer has to ask whose process it woke up in. See src/config/moat.ts.
+  gate(pi);
 
   // Top-level session: watch the subagent approval channel and relay each child's
   // gated action to the app over this session's bridge. The bridge fails closed while
@@ -464,17 +458,15 @@ export default function privateerControl(pi: any): void {
   // save_attachment (app→CLI, from the AttachmentStore inbound files land in). Both
   // live here because they share the RemoteBridge / its attachment stream.
   //
-  // NOT inside the harbor daemon. This extension is auto-discovered from the shared
-  // ~/.privateer/agent/extensions into every session the daemon runs, but `bridge` only
-  // ever gets a relay from THIS file's /remote-access command — which the daemon never
-  // runs. Registering there would shadow (Pi: first registration per name wins, and
-  // discovered extensions load before inline factories) the session-scoped pair a live
-  // task spawn registers against its own connected relay, so send_file_to_client would
-  // always answer "remote access is off" while the app was attached and driving.
-  if (!inHarborDaemon()) {
-    pi.registerTool?.(makeSendFileTool(bridge));
-    pi.registerTool?.(makeSaveAttachmentTool(attachments));
-  }
+  // Also unconditional now, and for the same reason. These used to stand down inside the
+  // harbor daemon: this extension was discovered into every session the daemon ran, where
+  // `bridge` never gets a relay (only THIS file's /remote-access attaches one), so the pair
+  // registered here would shadow — Pi resolves duplicate tool names first-registration-wins
+  // — the session-scoped pair a live task spawn binds to its own connected relay, and
+  // send_file_to_client would answer "remote access is off" while the app sat attached and
+  // driving. The daemon no longer loads this file, so there is nothing to shadow.
+  pi.registerTool?.(makeSendFileTool(bridge));
+  pi.registerTool?.(makeSaveAttachmentTool(attachments));
 
   // Subagents (and print/rpc) run as headless child `pi` processes with no UI. There
   // no one can approve, so a "default" gate would fail-closed on every tool and the