privateer-agent 0.12.12 → 0.12.14

package/README.md

@@ -72,7 +72,7 @@ What Privateer adds is a *moat* of Pi extensions layered on top:
 | `privateer-privacy` | `pi-privacy` — TEE attestation, ZDR routing, on-device PII gate — bound to the account tier resolver |
 | `privateer-account` | `/signin` billed inference against a Privateer account (device flow) |
 | `privateer-posture`, `privateer-tools` | live attestation shield + Privateer tool pack |
-| `rpiv-web-tools` | private-by-default web search (self-hosted SearXNG, no WebView) |
+| `privateer-web` | `web_search`/`web_fetch` — your account's search once signed in, or your own provider (`rpiv-web-tools`: self-hosted SearXNG, Brave, Tavily…) |
 | `rpiv-ask-user-question` | `ask_user_question` — a structured questionnaire the agent puts to you instead of guessing |
 | `pi-mcp-adapter`, `pi-subagents` | MCP servers · bounded parallel sub-agents |
 
@@ -612,8 +612,15 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
   approve it once.
 - **Workflows** — declarative multi-step pipelines the harbor executes; see
   [Workflows](#workflows).
-- **Web tools** (`rpiv-web-tools`) — private-by-default web search/fetch with pluggable backends
-  (self-hosted SearXNG for fully private search).
+- **Web tools** (`privateer-web`) — `web_search` and `web_fetch`, by one of two routes. Sign in
+  and they run on your Privateer account: no API key to obtain or keep on the machine, metered
+  against the account's daily web allowance, with the search itself made server-side (the derived
+  query is visible to Privateer — the page you fetch and the conversation around it are not).
+  Configure a provider of your own with `/web-tools` and that wins instead — `rpiv-web-tools` with
+  pluggable backends, including self-hosted SearXNG for fully private search, which is why a
+  provider you chose is never overridden. `PRIVATEER_WEB_SEARCH=privateer` picks the account route
+  even when you hold a key. Unattended runs (harbor, channels, ACP) always take the account route:
+  a routine must not hold a provider key it could be prompt-injected into leaking.
 - **Ask user question** (`rpiv-ask-user-question`) — when a request is underspecified the agent
   raises a structured questionnaire (typed options, multi-select, markdown previews, or type your
   own answer) instead of guessing. Ungated by design — it only asks you something.
@@ -631,6 +638,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 | `/connect` · `/mcp` | add, enable, or remove MCP connectors / see what actually connected |
 | `/speak` · `/talk` | read answers aloud / voice input (**alt+t** is push-to-talk) |
 | `/extensions` | list loaded Pi extensions |
+| `/web-tools` | point `web_search`/`web_fetch` at a search provider of your own (signed in, they already work on your account) |
 | `/init` | scaffold a starter `PRIVATEER.md` in this directory |
 | `/update` · `/privateer` | update to the latest release / Privateer status and posture |
 

package/bin/privateer-subagent.mjs

@@ -35,8 +35,15 @@ const REPO = resolve(HERE, ".."); // repo root
 // which build their moat from factories and have no `-e` list to hand down. Those get the
 // floor and nothing else: gate = the permission moat (fail-closed, forwards the child's
 // approvals to the parent); privacy = ZDR/TEE posture + attestation dispatcher; account =
-// the privateer/* provider, so a child can run account models. Deliberately narrower than
-// a terminal's — an unattended run's children have no human to approve a tool that spends.
+// the privateer/* provider, so a child can run account models.
+//
+// media is here for the work an unattended run most wants to delegate — a film is a
+// per-shot job, and a shot per subagent is the shape that fits. It is SAFE to list
+// unconditionally because the extension shapes itself rather than trusting its position
+// on this list: video_compose (local ffmpeg, no spend) always registers, and the billing
+// generate_* tools register only when the parent handed this child an explicit spend
+// grant. See extensions/privateer-media.ts and src/permissions/childSpend.ts. Still
+// narrower than a terminal's list — no web, no MCP, no brand/hints/update surface.
 export function moatExtensionPaths(repoRoot = REPO, env = process.env) {
   const inherited = (env.PRIVATEER_CHILD_EXTENSIONS ?? "")
     .split(delimiter)
@@ -47,6 +54,7 @@ export function moatExtensionPaths(repoRoot = REPO, env = process.env) {
     join(repoRoot, "extensions", "privateer-gate.ts"),
     join(repoRoot, "extensions", "privateer-privacy.ts"),
     join(repoRoot, "extensions", "privateer-account.ts"),
+    join(repoRoot, "extensions", "privateer-media.ts"),
   ];
 }
 

package/extensions/privateer-gate.ts

@@ -32,6 +32,7 @@ import { matchesKey } from "@earendil-works/pi-tui";
 import * as priv from "../src/auth/privateer.ts";
 import { paletteFor } from "../src/ui/palette.ts";
 import { noQuarterActive, setNoQuarter } from "../src/permissions/noQuarter.ts";
+import { childSpendAllows } from "../src/permissions/childSpend.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
 const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
@@ -429,6 +430,12 @@ const gate = makePermissionGate({
   // which subagent children inherit through the env. See src/permissions/noQuarter.ts.
   getSkipAllPermissions: noQuarterActive,
   remoteAsk: bridge.remoteAsk,
+  // Billing tools this process was authorized for BEFORE it started. Only ever non-empty
+  // inside a subagent child whose parent handed one down (childSpend.ts reads the env only
+  // when pi-subagents has marked us a child), so a terminal keeps asking its human. This
+  // is what lets an unattended run delegate a shot to a subagent: without it the child's
+  // gate denies every generate_* call, having no one to ask.
+  isSpendPreauthorized: (req) => childSpendAllows(req.tool),
 });
 
 export default function privateerControl(pi: any): void {

package/extensions/privateer-media.ts

@@ -1,5 +1,6 @@
-// Media tools for Pi's TUI: generate images, video, speech and music through the
-// signed-in Privateer account, and stitch the results together locally with ffmpeg.
+// Media tools for Pi's TUI: generate images, video, 3D meshes, speech, music and
+// sound effects through the signed-in Privateer account, and stitch the results
+// together locally with ffmpeg.
 //
 // Generation is registered only when the account channel can actually serve it
 // (mediaEnabled → signed in, and HARBOR_MEDIA not explicitly off). Omitting the
@@ -7,14 +8,26 @@
 // 401s on every call teaches the model to keep retrying, whereas a tool that isn't
 // there makes it say "you'd need to sign in" and move on.
 //
+// A SUBAGENT CHILD is held to the same rule for the same reason, one step further out.
+// A child is a headless process with nobody to approve a billing call, so unless its
+// parent handed down a spend grant (src/permissions/childSpend.ts — an unattended run
+// passing on the media tools its own allow-list names), every generate_* call it made
+// would be denied by the gate. Registering them anyway would spend the child's whole
+// context discovering that one refusal at a time. So an ungranted child gets no
+// generation tools and reports the truth: it can compose, not generate.
+//
 // video_compose is registered UNCONDITIONALLY. It is local ffmpeg work on files
 // already on disk — no account, no network, no spend — so it stays useful to a
-// signed-out terminal editing media that came from anywhere.
+// signed-out terminal, and to a child whose job is to cut together what its parent
+// generated.
 import { makeMediaTools } from "../src/tools/media.ts";
 import { makeComposeTools } from "../src/tools/videoCompose.ts";
 import { mediaEnabled } from "../src/config/hosted.ts";
+import { childHoldsSpendGrant } from "../src/permissions/childSpend.ts";
+import { isSubagentChild } from "../src/remote/subagentRelay.ts";
 
 export default function privateerMedia(pi: any): void {
-  if (mediaEnabled()) makeMediaTools()(pi);
+  const canSpend = !isSubagentChild() || childHoldsSpendGrant();
+  if (mediaEnabled() && canSpend) makeMediaTools()(pi);
   makeComposeTools()(pi);
 }

package/extensions/privateer-privacy.ts

@@ -1,9 +1,10 @@
 // pi-privacy for privateer-agent: the standard pi-privacy extension (providers +
-// attestation + posture badge feed + PII gate) PLUS a tier resolver that teaches it
-// about the private ACCOUNT channel it doesn't ship — so a privateer/near… model
-// (actually confidential-compute TEE) is treated as verified-private (no PII
-// over-warning), and a zdr account model as zdr-policy. Replaces loading pi-privacy's
-// default entry directly.
+// attestation + posture badge feed + PII gate) configured the way every Privateer session
+// configures it — src/config/privacyPolicy.ts, which src/config/moat.ts hands to the
+// factory-built sessions verbatim. Chiefly that means a tier resolver teaching pi-privacy
+// about the private ACCOUNT channel it doesn't ship, so a privateer/near… model (actually
+// confidential-compute TEE) is treated as verified-private (no PII over-warning) and a zdr
+// account model as zdr-policy. Replaces loading pi-privacy's default entry directly.
 //
 // It also REPAIRS two provider registrations pi-privacy makes from its own catalog, each
 // of which replaces (not merges) whatever model list that provider already had:
@@ -23,7 +24,8 @@
 // display/resolution + routing list — posture and attestation are dispatcher-bound and
 // unaffected by the model set.
 import { makePiPrivacyExtension } from "pi-privacy";
-import { accountPosture, registerAccountModels } from "../src/providers/account.ts";
+import { registerAccountModels } from "../src/providers/account.ts";
+import { sharedPrivacyOptions } from "../src/config/privacyPolicy.ts";
 
 // Tinfoil's live chat models (inference.tinfoil.sh/v1/models), kimi-k2-6 first — the
 // launcher's default. Non-chat endpoints (embeddings, tts, whisper, websearch,
@@ -51,33 +53,11 @@ function tinfoilModel(id: string) {
   };
 }
 
-const privacy = makePiPrivacyExtension({
-  resolveTier: async (provider, modelId) => {
-    if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
-    return (await accountPosture(modelId)).tier;
-  },
-  // pi-privacy 0.8 added an INGEST gate: credentials arriving in a tool result are
-  // redacted before they enter context (they'd otherwise be re-sent every turn and
-  // written to the session file on disk). We already redact tool output in
-  // src/ext/permissionGate.ts, so its default "warn" would put an interactive prompt
-  // in front of something this app has always handled silently — "redact" keeps our
-  // UX and still takes the added coverage.
-  //
-  // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
-  // ours masks the configured provider keys by exact value (from env/config) plus the
-  // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
-  // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
-  // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which
-  // our patterns match.
-  //
-  // Order between the two is NOT guaranteed: pi discovers extensions with a bare
-  // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this
-  // box today, not by contract). "redact" makes that moot — both handlers run
-  // unconditionally and each masks its own patterns, so the surviving content is the
-  // same either way. Under "warn" the order WOULD matter, since it decides whether
-  // the prompt is raised on a raw key or one we already masked.
-  toolResultPolicy: "redact",
-});
+// One configuration, shared with the factory-built copy in src/config/moat.ts — the tier
+// resolver for the private ACCOUNT channel, the unattended/no-quarter handling, the ingest
+// policy. Adding an option HERE rather than there is how this file and the moat drifted
+// twice; src/config/privacyPolicy.ts records what that cost.
+const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
 
 export default function privateerPrivacy(pi: any): void {
   privacy(pi);

package/extensions/privateer-tools.ts

@@ -1,9 +1,14 @@
 // Privateer-specific custom tools for Pi's TUI (Phase 5). Today: create_routine
-// (schedule unattended tasks → the harbor runs them). The generic tools (read/edit/
-// bash/grep, web, subagents, todo) come from Pi builtins + adopted packages, so only
-// the privateer-only tools live here. Gated by our permission-gate extension.
+// (schedule unattended tasks → the harbor runs them) and read_routine_result (read
+// one back — its standing instruction plus its latest output — so a conversation can
+// ACT on what a routine found instead of only being told it ran). The generic tools
+// (read/edit/bash/grep, web, subagents, todo) come from Pi builtins + adopted
+// packages, so only the privateer-only tools live here. Gated by our permission-gate
+// extension.
 import { routineToolDefinition } from "../src/tools/routine.ts";
+import { routineResultToolDefinition } from "../src/tools/routineResult.ts";
 
 export default function privateerTools(pi: any): void {
   pi.registerTool?.(routineToolDefinition);
+  pi.registerTool?.(routineResultToolDefinition);
 }

package/extensions/privateer-web.ts

@@ -0,0 +1,100 @@
+// `web_search` / `web_fetch` for the terminal — one route, chosen at load.
+//
+// WHAT CHANGED. The TUI used to load @juicesharp/rpiv-web-tools and nothing else, so web
+// access at a prompt meant going and getting a provider key first. Being signed in to a
+// Privateer account bought you nothing here, even though the same account's unattended
+// runs (harbor, channels, ACP) have searched through /api/rag/* all along. Now signing in
+// is enough: with no provider of your own configured, the account's search is what the
+// tools call — Brave server-side, no key on the machine, the account's daily allowance
+// and metering, and the query visible to Privateer's servers (never say a session that
+// searches this way is fully private).
+//
+// PRECEDENCE, AND WHY THIS FILE EXISTS. Both packs register the SAME two tool names, and
+// Pi resolves duplicates first-registration-wins — a session holding both would silently
+// get whichever loaded first. So exactly one of them may register, and something has to
+// decide which: this extension, once per process, via tools/webMode.ts. A configured
+// provider always wins. Someone who set up a self-hosted SearXNG picked the more private
+// route deliberately, and re-pointing their searches at our servers (billing their account
+// for them) would quietly undo that. `PRIVATEER_WEB_SEARCH=privateer` or `"provider":
+// "privateer"` in the rpiv config is the way back for someone who holds a key and wants
+// the account path anyway.
+//
+// WHAT IS STILL LIVE, AND WHAT NEEDS A RELAUNCH. `/signin` mid-session works: the account
+// tools are registered up front and check for credentials per call, so a signed-out
+// terminal says how to fix it rather than silently lacking a web tool. Configuring a
+// provider mid-session does NOT switch routes — the registration already happened — so it
+// takes effect at the next launch. `/web-tools` is registered either way, so that
+// configuration is always reachable.
+//
+// THE PACK IS OPTIONAL. rpiv-web-tools is a dependency the launcher drops if it didn't
+// resolve (a partial or hoisted install). Every import of it here is dynamic and
+// failure-tolerant: without it there is no user provider to choose, so the account route
+// is the only one left — which is the honest answer, not a fallback.
+//
+// The specifiers are built rather than written as literals on purpose: it keeps tsc from
+// pulling that package's own .ts sources into our typecheck, the same trick config/moat.ts
+// uses for pi-mcp-adapter.
+import { guardedWebToolDefinitions } from "../src/tools/web.ts";
+import { readWebToolsConfig, resolveWebMode, type ProviderMetaLike } from "../src/tools/webMode.ts";
+
+const RPIV_WEB_TOOLS = "@juicesharp/rpiv-web-tools";
+
+// What a signed-out terminal hears when the model reaches for the web. Both exits are
+// named because both are real: sign in and it works on the account's allowance, or bring
+// a provider of your own and the query never touches our servers.
+const SIGNED_OUT_HINT =
+  "Web access needs a Privateer account: run /signin to search on your account's " +
+  "allowance, or /web-tools to use your own search provider (a Brave/Tavily key, or a " +
+  "self-hosted SearXNG) instead.";
+
+interface RpivWebTools {
+  registerWebSearchTool(pi: unknown): void;
+  registerWebFetchTool(pi: unknown): void;
+  registerWebSearchConfigCommand(pi: unknown): void;
+  providers: readonly ProviderMetaLike[];
+}
+
+async function loadRpivWebTools(): Promise<RpivWebTools | null> {
+  try {
+    // Two entry points: the package root registers the tools and the `/web-tools`
+    // command, and providers/ carries the metadata (which env var holds which provider's
+    // key, which providers are self-hosted) that the precedence rules read. Taking that
+    // metadata from the package rather than restating it here is what keeps our notion of
+    // "configured" from drifting from theirs when it gains a provider.
+    const [tools, providers] = await Promise.all([
+      import(`${RPIV_WEB_TOOLS}/index.ts`),
+      import(`${RPIV_WEB_TOOLS}/providers/index.ts`),
+    ]);
+    if (typeof tools?.registerWebSearchTool !== "function") return null;
+    return {
+      registerWebSearchTool: tools.registerWebSearchTool,
+      registerWebFetchTool: tools.registerWebFetchTool,
+      registerWebSearchConfigCommand: tools.registerWebSearchConfigCommand,
+      providers: Array.isArray(providers?.PROVIDERS) ? providers.PROVIDERS : [],
+    };
+  } catch {
+    return null;
+  }
+}
+
+export default async function privateerWeb(pi: any): Promise<void> {
+  const rpiv = await loadRpivWebTools();
+  const decision = resolveWebMode({ providers: rpiv?.providers ?? [], config: readWebToolsConfig() });
+
+  if (rpiv && decision.mode === "own") {
+    // The user's own provider, run by the package that owns it — its interceptors, its
+    // guidance overrides, its truncation. We are choosing between packs, not wrapping one.
+    rpiv.registerWebSearchTool(pi);
+    rpiv.registerWebFetchTool(pi);
+  } else {
+    for (const def of guardedWebToolDefinitions(SIGNED_OUT_HINT)) pi.registerTool?.(def);
+  }
+
+  // Always available, whichever pack won: it is how a user on the account route configures
+  // a provider of their own, and the only place to see which keys are resolving.
+  try {
+    rpiv?.registerWebSearchConfigCommand(pi);
+  } catch {
+    /* the command is a convenience — never let it cost the session its web tools */
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.12",
+  "version": "0.12.14",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-coding-agent+0.84.1.patch

@@ -68,10 +68,81 @@ index 4600b23..075ecae 100644
  export const ENV_AGENT_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_DIR`;
  export const ENV_SESSION_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_SESSION_DIR`;
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-index ce8a9a2..1ae7b25 100644
+index ce8a9a2..c52ea80 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-@@ -186,6 +186,14 @@ export class AgentSession {
+@@ -38,6 +38,70 @@ import { createLocalBashOperations } from "./tools/bash.js";
+ import { createAllToolDefinitions } from "./tools/index.js";
+ import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
+ import { addUsageToTotals, createUsageTotals } from "./usage-totals.js";
++// ============================================================================
++// Privateer patch: provider errors that aren't API responses
++//
++// An inference endpoint does not always answer as an API. Put a WAF, a proxy or a
++// captive portal in front of one and a rejected request comes back as an HTML page,
++// which the provider SDK folds whole into `error.message` — status first, body after.
++//
++// Measured incident: the account channel's edge WAF answered a turn with a 403 block
++// page carrying three inline base64 web fonts, so `errorMessage` was 221 KB. Pi
++// printed it into the terminal in full, appended it to the session file on every
++// attempt (a 1.8 MB session), and ran isRetryableAssistantError over it — and a
++// megabyte of base64 reliably contains "429", "500" and "502", so a permanent 403
++// looked transient and burned the whole retry budget before the user saw anything.
++//
++// compactProviderError squeezes such a page down to the line a person can act on
++// (status, title, visible text — which is where a WAF puts its request id), and
++// isHardHttpFailure lets the STATUS decide retryability instead of a substring of the
++// body. Mirrors src/engine/errors.ts, which is where these are tested.
++const PV_MAX_ERROR_CHARS = 2000;
++const PV_MAX_PAGE_TEXT_CHARS = 600;
++const PV_HTML_DOC = /<!doctype html|<html[\s>]/i;
++const PV_NON_PROSE = /<(script|style|svg|head|noscript)\b[\s\S]*?<\/\1\s*>/gi;
++const PV_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", "#39": "'", "#x27": "'" };
++function pvPlainText(html) {
++    return html
++        .replace(/<[^>]*>/g, " ")
++        .replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (m, code) => {
++        const key = code.toLowerCase();
++        if (PV_ENTITIES[key] !== undefined)
++            return PV_ENTITIES[key];
++        if (key.startsWith("#x"))
++            return String.fromCodePoint(parseInt(key.slice(2), 16) || 0) || m;
++        if (key.startsWith("#"))
++            return String.fromCodePoint(parseInt(key.slice(1), 10) || 0) || m;
++        return m;
++    })
++        .replace(/\s+/g, " ")
++        .trim();
++}
++export function compactProviderError(raw) {
++    const text = typeof raw === "string" ? raw : String(raw ?? "");
++    if (!PV_HTML_DOC.test(text)) {
++        if (text.length <= PV_MAX_ERROR_CHARS)
++            return text;
++        return `${text.slice(0, PV_MAX_ERROR_CHARS)}… [dropped ${text.length - PV_MAX_ERROR_CHARS} chars]`;
++    }
++    const status = /^\s*(\d{3})\b/.exec(text)?.[1];
++    const title = pvPlainText(/<title[^>]*>([\s\S]*?)<\/title>/i.exec(text)?.[1] ?? "");
++    const body = pvPlainText(text.replace(PV_NON_PROSE, " "));
++    const visible = [title, body].filter(Boolean).join(" — ").slice(0, PV_MAX_PAGE_TEXT_CHARS);
++    return (`${status ?? "HTTP error"} — an HTML page, not an API response (something in front of ` +
++        `the provider answered: a WAF, a proxy, or a captive portal): ` +
++        `${visible || "(no readable text)"} [dropped ${text.length} chars of HTML]`);
++}
++// Client-error statuses that CAN clear on their own: a timeout, a lock conflict, an
++// early-data replay, a throttle. Every other 4xx is the request itself being wrong.
++const PV_TRANSIENT_CLIENT_STATUS = new Set([408, 409, 425, 429]);
++export function isHardHttpFailure(text) {
++    const m = /^\s*(\d{3})\b/.exec(typeof text === "string" ? text : "");
++    if (!m)
++        return false;
++    const status = Number(m[1]);
++    return status >= 400 && status < 500 && !PV_TRANSIENT_CLIENT_STATUS.has(status);
++}
+ /**
+  * Parse a skill block from message text.
+  * Returns null if the text doesn't contain a skill block.
+@@ -186,6 +250,14 @@ export class AgentSession {
          }
          const isOAuth = this._modelRuntime.isUsingOAuth(model.provider);
          if (isOAuth) {
@@ -86,7 +157,24 @@ index ce8a9a2..1ae7b25 100644
              throw new Error(`Authentication failed for "${model.provider}". ` +
                  `Credentials may have expired or network is unavailable. ` +
                  `Run '/login ${model.provider}' to re-authenticate.`);
-@@ -772,6 +780,15 @@ export class AgentSession {
+@@ -360,6 +432,16 @@ export class AgentSession {
+                 }
+             }
+         }
++        // Privateer patch: squeeze a non-API error body BEFORE anything reads it. This is
++        // the one point upstream of all four consumers — extension handlers, UI listeners,
++        // session persistence, and the _lastAssistantMessage the retry classifier reads —
++        // so an HTML block page is shortened once, in place, rather than printed, stored
++        // and pattern-matched at full size. See compactProviderError above.
++        if (event.type === "message_end" &&
++            event.message?.role === "assistant" &&
++            typeof event.message.errorMessage === "string") {
++            event.message.errorMessage = compactProviderError(event.message.errorMessage);
++        }
+         // Emit to extensions first
+         await this._emitExtensionEvent(event);
+         // Notify all listeners
+@@ -772,6 +854,15 @@ export class AgentSession {
                  finalError: msg.errorMessage,
              });
              this._retryAttempt = 0;
@@ -102,7 +190,7 @@ index ce8a9a2..1ae7b25 100644
          }
          if (await this._checkCompaction(msg)) {
              return true;
-@@ -852,6 +869,14 @@ export class AgentSession {
+@@ -852,6 +943,14 @@ export class AgentSession {
              if (!hasConfiguredAuth) {
                  const isOAuth = this._modelRuntime.isUsingOAuth(this.model.provider);
                  if (isOAuth) {
@@ -117,10 +205,19 @@ index ce8a9a2..1ae7b25 100644
                      throw new Error(`Authentication failed for "${this.model.provider}". ` +
                          `Credentials may have expired or network is unavailable. ` +
                          `Run '/login ${this.model.provider}' to re-authenticate.`);
-@@ -2084,6 +2109,18 @@ export class AgentSession {
+@@ -2084,6 +2183,27 @@ export class AgentSession {
          // Context overflow is handled by compaction, not retry.
          if (isContextOverflow(message, this.model?.contextWindow ?? 0))
              return false;
++        // Privateer patch: an HTTP status is a fact; a substring of the body is a guess.
++        // pi classifies by regex over the whole error text, so a 403 whose body merely
++        // CONTAINS "500" — a WAF block page, any proxy interstitial, anything with base64
++        // in it — spent the full retry budget on a failure retrying could never clear.
++        // A 4xx other than 408/409/425/429 is the request being wrong, whatever its body
++        // says. Provider-agnostic on purpose: an intercepting proxy is not ours to detect.
++        // Mirrors isHardHttpFailure in src/engine/errors.ts.
++        if (isHardHttpFailure(message.errorMessage))
++            return false;
 +        // Privateer patch: a Privateer ACCOUNT CAP is not a throttle. Daily/monthly
 +        // message or token limits (and an exhausted balance) come back from the account
 +        // channel as a 429 carrying the backend's machine `code` and a ready-to-show

package/src/acp/run.ts

@@ -89,7 +89,7 @@ export async function runAcp(): Promise<void> {
   const { moatResourceOptions } = await import("../config/moat.ts");
   const { privateerChannel, rememberAccountCredential, persistAccountCredential, dropPersistedAccountCredential } =
     await import("../providers/account.ts");
-  const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
+  const { modelRegistryOf, piAuthStore } = await import("../providers/piAuthStore.ts");
   const { hasCredentials, acquireAccountCredential, revokeAccountSession } = await import("../auth/privateer.ts");
   const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
@@ -230,7 +230,23 @@ export async function runAcp(): Promise<void> {
   // there. The moment anything revoked it, every ACP turn started failing.
   let armedAccount = false;
   async function ensureAccountArmed(providerName: string): Promise<void> {
-    if (armedAccount || providerName !== "privateer") return;
+    if (providerName !== "privateer") return;
+    // Re-read the PERSISTED entry instead of latching on `armedAccount`. auth.json holds
+    // one machine-global `privateer` entry, so whichever terminal armed LAST removes it
+    // on exit — including one that armed over ours — and a latch would never notice. The
+    // session we hold stays perfectly valid while Pi sees no entry at all, so every turn
+    // from then on fails with the misleading "This terminal isn't signed in to
+    // Privateer". Re-arming reuses our own session (accountCredential's memo) rather
+    // than minting a second one, so the recovery costs a store write, not a Linked
+    // Devices row.
+    if (armedAccount) {
+      try {
+        if (await (await piAuthStore()).read("privateer")) return;
+      } catch {
+        return; // can't read the store — leave it to the turn's own error path
+      }
+      log("account entry was removed by another terminal — re-arming");
+    }
     if (!hasCredentials()) {
       log("not signed in to Privateer — run `privateer` and /login, or pick a BYO-key model");
       return;
@@ -246,6 +262,10 @@ export async function runAcp(): Promise<void> {
     }
   }
   await ensureAccountArmed(model.provider);
+  // The provider actually selected right now — `model` is the launch model and never
+  // moves, but session/set_model can switch channels mid-run, and the per-turn re-arm
+  // below has to follow that rather than the model this process booted on.
+  let currentProvider = model.provider;
 
   const modelCount = listModels()?.available.length ?? 0;
   log(
@@ -312,11 +332,18 @@ export async function runAcp(): Promise<void> {
         // with the same misleading "not signed in".
         await ensureAccountArmed(next.provider);
         await session.setModel(next);
+        currentProvider = next.provider;
       },
       async prompt(text, events, signal) {
         holder.events = events;
         holder.error = undefined;
         try {
+          // Ahead of every turn, not just at startup: the entry we armed can be removed
+          // by another terminal's exit at any point in a long-lived host session (see
+          // ensureAccountArmed). It has to happen HERE because pi's prompt() throws on
+          // its own `hasConfiguredAuth` precheck before it emits `before_agent_start`,
+          // where providers/account.ts installs the equivalent net.
+          await ensureAccountArmed(currentProvider);
           await session.prompt(text);
         } catch (e) {
           return { ok: false, error: e instanceof Error ? e.message : String(e) };

package/src/channels/run.ts

@@ -129,6 +129,7 @@ async function main() {
   const { moatResourceOptions } = await import("../config/moat.ts");
   const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
+  const { ensureAccountArmed } = await import("../providers/account.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
   const { MessagingBridge } = await import("./bridge.ts");
@@ -321,6 +322,14 @@ async function main() {
       // A member's turn is always read-only, whatever the channel posture.
       const effectivePosture: Posture = meta.isAdmin ? chPosture : "readonly";
       try {
+        // Re-arm the account channel ahead of the turn. This daemon runs for weeks, and
+        // Pi's auth.json holds ONE machine-global `privateer` entry: any other terminal
+        // on the box that arms over ours and then exits takes the entry with it, and
+        // from that moment every channel message answers "This terminal isn't signed in
+        // to Privateer" on a session that is still perfectly valid. The equivalent net
+        // in providers/account.ts hangs off `before_agent_start`, which pi's prompt()
+        // never reaches — it throws on its own `hasConfiguredAuth` precheck first.
+        if (model?.provider === "privateer") await ensureAccountArmed(undefined);
         await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () => session.prompt(text));
       } catch (e) {
         return { ok: false, error: e instanceof Error ? e.message : String(e) };

package/src/cli/chat.ts

@@ -46,6 +46,7 @@ async function main() {
     rememberAccountCredential,
     persistAccountCredential,
     dropPersistedAccountCredential,
+    ensureAccountArmed,
   } = await import("../providers/account.ts");
   const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
   const { agentVersion } = await import("../config/version.ts");
@@ -330,6 +331,17 @@ async function main() {
     turnActive = true;
     if (remote && echo) console.log(`\n${DIM}⟿ [app] ${text.slice(0, 80)}${RESET}`);
     try {
+      // Re-arm the account channel BEFORE the prompt, because nothing downstream can.
+      // auth.json holds ONE machine-global `privateer` entry, so the terminal that
+      // armed LAST deletes it on exit and strands every other terminal still running —
+      // this one keeps a good credential in memory while Pi sees no entry, and every
+      // prompt dies on "This terminal isn't signed in to Privateer".
+      //
+      // The `before_agent_start` net in providers/account.ts cannot cover this: pi's
+      // prompt() throws on its own `hasConfiguredAuth` precheck before that event is
+      // ever emitted. Here is the last point ahead of it. One store read on the healthy
+      // path, and a no-op when the machine isn't signed in.
+      if (currentSpec.startsWith("privateer/")) await ensureAccountArmed(undefined);
       // Expand any `@path` mentions into appended <file> blocks + image attachments,
       // resolved against this terminal's cwd (constrained to the cwd subtree). Both a
       // locally-typed prompt and an app-driven one land here, so both get it. A prompt
@@ -568,6 +580,41 @@ async function main() {
     const t = TIERS[res.tier];
     const color = t.posture === "green" ? GREEN : t.posture === "yellow" ? YELLOW : DIM;
     console.log(`\n${color}⛉ ${t.label}${RESET} ${DIM}(${res.tier}${res.teePosture ? "/" + res.teePosture : ""}) — ${t.blurb}${RESET}${res.error ? `\n${RED}  ${res.error}${RESET}` : ""}`);
+    // What the verified quote says about the enclave that answered (Phala today). The
+    // ordering here is the point: the self-consistency checks PASSED to get this far,
+    // so they are stated as fact; the image identity is only ever "same as last time",
+    // so it is stated as memory. Never let the second read like the first.
+    const enclave = "enclaveIdentity" in res ? res.enclaveIdentity : undefined;
+    if (enclave) {
+      const { measurements, identity, pin } = enclave;
+      console.log(`${DIM}  event log replays to the signed registers; app_compose matches the attested compose-hash${RESET}`);
+      if (enclave.skippedChecks.length) {
+        console.log(`${YELLOW}  not checked (no material in the report): ${enclave.skippedChecks.join(", ")}${RESET}`);
+      }
+
+      if (pin.state === "changed") {
+        // The one line here that should stop a reader. Not a failure — Phala upgrades
+        // the gateway legitimately — but it is the only moment we can ever detect a
+        // swapped image, so it must not read like routine output.
+        console.log(`${YELLOW}  ⚠ enclave image CHANGED since ${pin.firstSeenAt ?? "first use"}:${RESET}`);
+        for (const line of pin.changed) console.log(`${YELLOW}      ${line}${RESET}`);
+      } else if (pin.state === "first-seen") {
+        console.log(`${DIM}  image recorded on first use — no prior value to compare against${RESET}`);
+      } else {
+        console.log(`${DIM}  image unchanged since ${pin.firstSeenAt ?? "first use"}${RESET}`);
+      }
+
+      for (const [name, value] of Object.entries({ ...measurements, ...identity })) {
+        if (value) console.log(`${DIM}    ${name.padEnd(12)} ${value}${RESET}`);
+      }
+      if (enclave.repoCommit) {
+        console.log(`${DIM}  declares source ${enclave.repoUrl ?? "?"} @ ${enclave.repoCommit}${RESET}`);
+        console.log(`${DIM}    (self-declared — the quote does not prove this binary came from that commit)${RESET}`);
+      }
+      if (enclave.downstreamDomain) {
+        console.log(`${DIM}  forwards to ${enclave.downstreamDomain} — a separate trust domain we do not attest${RESET}`);
+      }
+    }
   }
 
   async function remoteAccess(on: boolean) {