privateer-agent 0.12.13 → 0.12.14

package/bin/privateer-subagent.mjs

@@ -35,8 +35,15 @@ const REPO = resolve(HERE, ".."); // repo root
 // which build their moat from factories and have no `-e` list to hand down. Those get the
 // floor and nothing else: gate = the permission moat (fail-closed, forwards the child's
 // approvals to the parent); privacy = ZDR/TEE posture + attestation dispatcher; account =
-// the privateer/* provider, so a child can run account models. Deliberately narrower than
-// a terminal's — an unattended run's children have no human to approve a tool that spends.
+// the privateer/* provider, so a child can run account models.
+//
+// media is here for the work an unattended run most wants to delegate — a film is a
+// per-shot job, and a shot per subagent is the shape that fits. It is SAFE to list
+// unconditionally because the extension shapes itself rather than trusting its position
+// on this list: video_compose (local ffmpeg, no spend) always registers, and the billing
+// generate_* tools register only when the parent handed this child an explicit spend
+// grant. See extensions/privateer-media.ts and src/permissions/childSpend.ts. Still
+// narrower than a terminal's list — no web, no MCP, no brand/hints/update surface.
 export function moatExtensionPaths(repoRoot = REPO, env = process.env) {
   const inherited = (env.PRIVATEER_CHILD_EXTENSIONS ?? "")
     .split(delimiter)
@@ -47,6 +54,7 @@ export function moatExtensionPaths(repoRoot = REPO, env = process.env) {
     join(repoRoot, "extensions", "privateer-gate.ts"),
     join(repoRoot, "extensions", "privateer-privacy.ts"),
     join(repoRoot, "extensions", "privateer-account.ts"),
+    join(repoRoot, "extensions", "privateer-media.ts"),
   ];
 }
 

package/extensions/privateer-gate.ts

@@ -32,6 +32,7 @@ import { matchesKey } from "@earendil-works/pi-tui";
 import * as priv from "../src/auth/privateer.ts";
 import { paletteFor } from "../src/ui/palette.ts";
 import { noQuarterActive, setNoQuarter } from "../src/permissions/noQuarter.ts";
+import { childSpendAllows } from "../src/permissions/childSpend.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
 const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
@@ -429,6 +430,12 @@ const gate = makePermissionGate({
   // which subagent children inherit through the env. See src/permissions/noQuarter.ts.
   getSkipAllPermissions: noQuarterActive,
   remoteAsk: bridge.remoteAsk,
+  // Billing tools this process was authorized for BEFORE it started. Only ever non-empty
+  // inside a subagent child whose parent handed one down (childSpend.ts reads the env only
+  // when pi-subagents has marked us a child), so a terminal keeps asking its human. This
+  // is what lets an unattended run delegate a shot to a subagent: without it the child's
+  // gate denies every generate_* call, having no one to ask.
+  isSpendPreauthorized: (req) => childSpendAllows(req.tool),
 });
 
 export default function privateerControl(pi: any): void {

package/extensions/privateer-media.ts

@@ -1,5 +1,6 @@
-// Media tools for Pi's TUI: generate images, video, speech and music through the
-// signed-in Privateer account, and stitch the results together locally with ffmpeg.
+// Media tools for Pi's TUI: generate images, video, 3D meshes, speech, music and
+// sound effects through the signed-in Privateer account, and stitch the results
+// together locally with ffmpeg.
 //
 // Generation is registered only when the account channel can actually serve it
 // (mediaEnabled → signed in, and HARBOR_MEDIA not explicitly off). Omitting the
@@ -7,14 +8,26 @@
 // 401s on every call teaches the model to keep retrying, whereas a tool that isn't
 // there makes it say "you'd need to sign in" and move on.
 //
+// A SUBAGENT CHILD is held to the same rule for the same reason, one step further out.
+// A child is a headless process with nobody to approve a billing call, so unless its
+// parent handed down a spend grant (src/permissions/childSpend.ts — an unattended run
+// passing on the media tools its own allow-list names), every generate_* call it made
+// would be denied by the gate. Registering them anyway would spend the child's whole
+// context discovering that one refusal at a time. So an ungranted child gets no
+// generation tools and reports the truth: it can compose, not generate.
+//
 // video_compose is registered UNCONDITIONALLY. It is local ffmpeg work on files
 // already on disk — no account, no network, no spend — so it stays useful to a
-// signed-out terminal editing media that came from anywhere.
+// signed-out terminal, and to a child whose job is to cut together what its parent
+// generated.
 import { makeMediaTools } from "../src/tools/media.ts";
 import { makeComposeTools } from "../src/tools/videoCompose.ts";
 import { mediaEnabled } from "../src/config/hosted.ts";
+import { childHoldsSpendGrant } from "../src/permissions/childSpend.ts";
+import { isSubagentChild } from "../src/remote/subagentRelay.ts";
 
 export default function privateerMedia(pi: any): void {
-  if (mediaEnabled()) makeMediaTools()(pi);
+  const canSpend = !isSubagentChild() || childHoldsSpendGrant();
+  if (mediaEnabled() && canSpend) makeMediaTools()(pi);
   makeComposeTools()(pi);
 }

package/extensions/privateer-privacy.ts

@@ -1,9 +1,10 @@
 // pi-privacy for privateer-agent: the standard pi-privacy extension (providers +
-// attestation + posture badge feed + PII gate) PLUS a tier resolver that teaches it
-// about the private ACCOUNT channel it doesn't ship — so a privateer/near… model
-// (actually confidential-compute TEE) is treated as verified-private (no PII
-// over-warning), and a zdr account model as zdr-policy. Replaces loading pi-privacy's
-// default entry directly.
+// attestation + posture badge feed + PII gate) configured the way every Privateer session
+// configures it — src/config/privacyPolicy.ts, which src/config/moat.ts hands to the
+// factory-built sessions verbatim. Chiefly that means a tier resolver teaching pi-privacy
+// about the private ACCOUNT channel it doesn't ship, so a privateer/near… model (actually
+// confidential-compute TEE) is treated as verified-private (no PII over-warning) and a zdr
+// account model as zdr-policy. Replaces loading pi-privacy's default entry directly.
 //
 // It also REPAIRS two provider registrations pi-privacy makes from its own catalog, each
 // of which replaces (not merges) whatever model list that provider already had:
@@ -23,7 +24,8 @@
 // display/resolution + routing list — posture and attestation are dispatcher-bound and
 // unaffected by the model set.
 import { makePiPrivacyExtension } from "pi-privacy";
-import { accountPosture, registerAccountModels } from "../src/providers/account.ts";
+import { registerAccountModels } from "../src/providers/account.ts";
+import { sharedPrivacyOptions } from "../src/config/privacyPolicy.ts";
 
 // Tinfoil's live chat models (inference.tinfoil.sh/v1/models), kimi-k2-6 first — the
 // launcher's default. Non-chat endpoints (embeddings, tts, whisper, websearch,
@@ -51,33 +53,11 @@ function tinfoilModel(id: string) {
   };
 }
 
-const privacy = makePiPrivacyExtension({
-  resolveTier: async (provider, modelId) => {
-    if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
-    return (await accountPosture(modelId)).tier;
-  },
-  // pi-privacy 0.8 added an INGEST gate: credentials arriving in a tool result are
-  // redacted before they enter context (they'd otherwise be re-sent every turn and
-  // written to the session file on disk). We already redact tool output in
-  // src/ext/permissionGate.ts, so its default "warn" would put an interactive prompt
-  // in front of something this app has always handled silently — "redact" keeps our
-  // UX and still takes the added coverage.
-  //
-  // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
-  // ours masks the configured provider keys by exact value (from env/config) plus the
-  // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
-  // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
-  // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which
-  // our patterns match.
-  //
-  // Order between the two is NOT guaranteed: pi discovers extensions with a bare
-  // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this
-  // box today, not by contract). "redact" makes that moot — both handlers run
-  // unconditionally and each masks its own patterns, so the surviving content is the
-  // same either way. Under "warn" the order WOULD matter, since it decides whether
-  // the prompt is raised on a raw key or one we already masked.
-  toolResultPolicy: "redact",
-});
+// One configuration, shared with the factory-built copy in src/config/moat.ts — the tier
+// resolver for the private ACCOUNT channel, the unattended/no-quarter handling, the ingest
+// policy. Adding an option HERE rather than there is how this file and the moat drifted
+// twice; src/config/privacyPolicy.ts records what that cost.
+const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
 
 export default function privateerPrivacy(pi: any): void {
   privacy(pi);

package/extensions/privateer-tools.ts

@@ -1,9 +1,14 @@
 // Privateer-specific custom tools for Pi's TUI (Phase 5). Today: create_routine
-// (schedule unattended tasks → the harbor runs them). The generic tools (read/edit/
-// bash/grep, web, subagents, todo) come from Pi builtins + adopted packages, so only
-// the privateer-only tools live here. Gated by our permission-gate extension.
+// (schedule unattended tasks → the harbor runs them) and read_routine_result (read
+// one back — its standing instruction plus its latest output — so a conversation can
+// ACT on what a routine found instead of only being told it ran). The generic tools
+// (read/edit/bash/grep, web, subagents, todo) come from Pi builtins + adopted
+// packages, so only the privateer-only tools live here. Gated by our permission-gate
+// extension.
 import { routineToolDefinition } from "../src/tools/routine.ts";
+import { routineResultToolDefinition } from "../src/tools/routineResult.ts";
 
 export default function privateerTools(pi: any): void {
   pi.registerTool?.(routineToolDefinition);
+  pi.registerTool?.(routineResultToolDefinition);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.13",
+  "version": "0.12.14",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-coding-agent+0.84.1.patch

@@ -68,10 +68,81 @@ index 4600b23..075ecae 100644
  export const ENV_AGENT_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_DIR`;
  export const ENV_SESSION_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_SESSION_DIR`;
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-index ce8a9a2..1ae7b25 100644
+index ce8a9a2..c52ea80 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-@@ -186,6 +186,14 @@ export class AgentSession {
+@@ -38,6 +38,70 @@ import { createLocalBashOperations } from "./tools/bash.js";
+ import { createAllToolDefinitions } from "./tools/index.js";
+ import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
+ import { addUsageToTotals, createUsageTotals } from "./usage-totals.js";
++// ============================================================================
++// Privateer patch: provider errors that aren't API responses
++//
++// An inference endpoint does not always answer as an API. Put a WAF, a proxy or a
++// captive portal in front of one and a rejected request comes back as an HTML page,
++// which the provider SDK folds whole into `error.message` — status first, body after.
++//
++// Measured incident: the account channel's edge WAF answered a turn with a 403 block
++// page carrying three inline base64 web fonts, so `errorMessage` was 221 KB. Pi
++// printed it into the terminal in full, appended it to the session file on every
++// attempt (a 1.8 MB session), and ran isRetryableAssistantError over it — and a
++// megabyte of base64 reliably contains "429", "500" and "502", so a permanent 403
++// looked transient and burned the whole retry budget before the user saw anything.
++//
++// compactProviderError squeezes such a page down to the line a person can act on
++// (status, title, visible text — which is where a WAF puts its request id), and
++// isHardHttpFailure lets the STATUS decide retryability instead of a substring of the
++// body. Mirrors src/engine/errors.ts, which is where these are tested.
++const PV_MAX_ERROR_CHARS = 2000;
++const PV_MAX_PAGE_TEXT_CHARS = 600;
++const PV_HTML_DOC = /<!doctype html|<html[\s>]/i;
++const PV_NON_PROSE = /<(script|style|svg|head|noscript)\b[\s\S]*?<\/\1\s*>/gi;
++const PV_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", "#39": "'", "#x27": "'" };
++function pvPlainText(html) {
++    return html
++        .replace(/<[^>]*>/g, " ")
++        .replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (m, code) => {
++        const key = code.toLowerCase();
++        if (PV_ENTITIES[key] !== undefined)
++            return PV_ENTITIES[key];
++        if (key.startsWith("#x"))
++            return String.fromCodePoint(parseInt(key.slice(2), 16) || 0) || m;
++        if (key.startsWith("#"))
++            return String.fromCodePoint(parseInt(key.slice(1), 10) || 0) || m;
++        return m;
++    })
++        .replace(/\s+/g, " ")
++        .trim();
++}
++export function compactProviderError(raw) {
++    const text = typeof raw === "string" ? raw : String(raw ?? "");
++    if (!PV_HTML_DOC.test(text)) {
++        if (text.length <= PV_MAX_ERROR_CHARS)
++            return text;
++        return `${text.slice(0, PV_MAX_ERROR_CHARS)}… [dropped ${text.length - PV_MAX_ERROR_CHARS} chars]`;
++    }
++    const status = /^\s*(\d{3})\b/.exec(text)?.[1];
++    const title = pvPlainText(/<title[^>]*>([\s\S]*?)<\/title>/i.exec(text)?.[1] ?? "");
++    const body = pvPlainText(text.replace(PV_NON_PROSE, " "));
++    const visible = [title, body].filter(Boolean).join(" — ").slice(0, PV_MAX_PAGE_TEXT_CHARS);
++    return (`${status ?? "HTTP error"} — an HTML page, not an API response (something in front of ` +
++        `the provider answered: a WAF, a proxy, or a captive portal): ` +
++        `${visible || "(no readable text)"} [dropped ${text.length} chars of HTML]`);
++}
++// Client-error statuses that CAN clear on their own: a timeout, a lock conflict, an
++// early-data replay, a throttle. Every other 4xx is the request itself being wrong.
++const PV_TRANSIENT_CLIENT_STATUS = new Set([408, 409, 425, 429]);
++export function isHardHttpFailure(text) {
++    const m = /^\s*(\d{3})\b/.exec(typeof text === "string" ? text : "");
++    if (!m)
++        return false;
++    const status = Number(m[1]);
++    return status >= 400 && status < 500 && !PV_TRANSIENT_CLIENT_STATUS.has(status);
++}
+ /**
+  * Parse a skill block from message text.
+  * Returns null if the text doesn't contain a skill block.
+@@ -186,6 +250,14 @@ export class AgentSession {
          }
          const isOAuth = this._modelRuntime.isUsingOAuth(model.provider);
          if (isOAuth) {
@@ -86,7 +157,24 @@ index ce8a9a2..1ae7b25 100644
              throw new Error(`Authentication failed for "${model.provider}". ` +
                  `Credentials may have expired or network is unavailable. ` +
                  `Run '/login ${model.provider}' to re-authenticate.`);
-@@ -772,6 +780,15 @@ export class AgentSession {
+@@ -360,6 +432,16 @@ export class AgentSession {
+                 }
+             }
+         }
++        // Privateer patch: squeeze a non-API error body BEFORE anything reads it. This is
++        // the one point upstream of all four consumers — extension handlers, UI listeners,
++        // session persistence, and the _lastAssistantMessage the retry classifier reads —
++        // so an HTML block page is shortened once, in place, rather than printed, stored
++        // and pattern-matched at full size. See compactProviderError above.
++        if (event.type === "message_end" &&
++            event.message?.role === "assistant" &&
++            typeof event.message.errorMessage === "string") {
++            event.message.errorMessage = compactProviderError(event.message.errorMessage);
++        }
+         // Emit to extensions first
+         await this._emitExtensionEvent(event);
+         // Notify all listeners
+@@ -772,6 +854,15 @@ export class AgentSession {
                  finalError: msg.errorMessage,
              });
              this._retryAttempt = 0;
@@ -102,7 +190,7 @@ index ce8a9a2..1ae7b25 100644
          }
          if (await this._checkCompaction(msg)) {
              return true;
-@@ -852,6 +869,14 @@ export class AgentSession {
+@@ -852,6 +943,14 @@ export class AgentSession {
              if (!hasConfiguredAuth) {
                  const isOAuth = this._modelRuntime.isUsingOAuth(this.model.provider);
                  if (isOAuth) {
@@ -117,10 +205,19 @@ index ce8a9a2..1ae7b25 100644
                      throw new Error(`Authentication failed for "${this.model.provider}". ` +
                          `Credentials may have expired or network is unavailable. ` +
                          `Run '/login ${this.model.provider}' to re-authenticate.`);
-@@ -2084,6 +2109,18 @@ export class AgentSession {
+@@ -2084,6 +2183,27 @@ export class AgentSession {
          // Context overflow is handled by compaction, not retry.
          if (isContextOverflow(message, this.model?.contextWindow ?? 0))
              return false;
++        // Privateer patch: an HTTP status is a fact; a substring of the body is a guess.
++        // pi classifies by regex over the whole error text, so a 403 whose body merely
++        // CONTAINS "500" — a WAF block page, any proxy interstitial, anything with base64
++        // in it — spent the full retry budget on a failure retrying could never clear.
++        // A 4xx other than 408/409/425/429 is the request being wrong, whatever its body
++        // says. Provider-agnostic on purpose: an intercepting proxy is not ours to detect.
++        // Mirrors isHardHttpFailure in src/engine/errors.ts.
++        if (isHardHttpFailure(message.errorMessage))
++            return false;
 +        // Privateer patch: a Privateer ACCOUNT CAP is not a throttle. Daily/monthly
 +        // message or token limits (and an exhausted balance) come back from the account
 +        // channel as a 429 carrying the backend's machine `code` and a ready-to-show

package/src/acp/run.ts

@@ -89,7 +89,7 @@ export async function runAcp(): Promise<void> {
   const { moatResourceOptions } = await import("../config/moat.ts");
   const { privateerChannel, rememberAccountCredential, persistAccountCredential, dropPersistedAccountCredential } =
     await import("../providers/account.ts");
-  const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
+  const { modelRegistryOf, piAuthStore } = await import("../providers/piAuthStore.ts");
   const { hasCredentials, acquireAccountCredential, revokeAccountSession } = await import("../auth/privateer.ts");
   const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
@@ -230,7 +230,23 @@ export async function runAcp(): Promise<void> {
   // there. The moment anything revoked it, every ACP turn started failing.
   let armedAccount = false;
   async function ensureAccountArmed(providerName: string): Promise<void> {
-    if (armedAccount || providerName !== "privateer") return;
+    if (providerName !== "privateer") return;
+    // Re-read the PERSISTED entry instead of latching on `armedAccount`. auth.json holds
+    // one machine-global `privateer` entry, so whichever terminal armed LAST removes it
+    // on exit — including one that armed over ours — and a latch would never notice. The
+    // session we hold stays perfectly valid while Pi sees no entry at all, so every turn
+    // from then on fails with the misleading "This terminal isn't signed in to
+    // Privateer". Re-arming reuses our own session (accountCredential's memo) rather
+    // than minting a second one, so the recovery costs a store write, not a Linked
+    // Devices row.
+    if (armedAccount) {
+      try {
+        if (await (await piAuthStore()).read("privateer")) return;
+      } catch {
+        return; // can't read the store — leave it to the turn's own error path
+      }
+      log("account entry was removed by another terminal — re-arming");
+    }
     if (!hasCredentials()) {
       log("not signed in to Privateer — run `privateer` and /login, or pick a BYO-key model");
       return;
@@ -246,6 +262,10 @@ export async function runAcp(): Promise<void> {
     }
   }
   await ensureAccountArmed(model.provider);
+  // The provider actually selected right now — `model` is the launch model and never
+  // moves, but session/set_model can switch channels mid-run, and the per-turn re-arm
+  // below has to follow that rather than the model this process booted on.
+  let currentProvider = model.provider;
 
   const modelCount = listModels()?.available.length ?? 0;
   log(
@@ -312,11 +332,18 @@ export async function runAcp(): Promise<void> {
         // with the same misleading "not signed in".
         await ensureAccountArmed(next.provider);
         await session.setModel(next);
+        currentProvider = next.provider;
       },
       async prompt(text, events, signal) {
         holder.events = events;
         holder.error = undefined;
         try {
+          // Ahead of every turn, not just at startup: the entry we armed can be removed
+          // by another terminal's exit at any point in a long-lived host session (see
+          // ensureAccountArmed). It has to happen HERE because pi's prompt() throws on
+          // its own `hasConfiguredAuth` precheck before it emits `before_agent_start`,
+          // where providers/account.ts installs the equivalent net.
+          await ensureAccountArmed(currentProvider);
           await session.prompt(text);
         } catch (e) {
           return { ok: false, error: e instanceof Error ? e.message : String(e) };

package/src/channels/run.ts

@@ -129,6 +129,7 @@ async function main() {
   const { moatResourceOptions } = await import("../config/moat.ts");
   const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
+  const { ensureAccountArmed } = await import("../providers/account.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
   const { MessagingBridge } = await import("./bridge.ts");
@@ -321,6 +322,14 @@ async function main() {
       // A member's turn is always read-only, whatever the channel posture.
       const effectivePosture: Posture = meta.isAdmin ? chPosture : "readonly";
       try {
+        // Re-arm the account channel ahead of the turn. This daemon runs for weeks, and
+        // Pi's auth.json holds ONE machine-global `privateer` entry: any other terminal
+        // on the box that arms over ours and then exits takes the entry with it, and
+        // from that moment every channel message answers "This terminal isn't signed in
+        // to Privateer" on a session that is still perfectly valid. The equivalent net
+        // in providers/account.ts hangs off `before_agent_start`, which pi's prompt()
+        // never reaches — it throws on its own `hasConfiguredAuth` precheck first.
+        if (model?.provider === "privateer") await ensureAccountArmed(undefined);
         await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () => session.prompt(text));
       } catch (e) {
         return { ok: false, error: e instanceof Error ? e.message : String(e) };

package/src/cli/chat.ts

@@ -46,6 +46,7 @@ async function main() {
     rememberAccountCredential,
     persistAccountCredential,
     dropPersistedAccountCredential,
+    ensureAccountArmed,
   } = await import("../providers/account.ts");
   const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
   const { agentVersion } = await import("../config/version.ts");
@@ -330,6 +331,17 @@ async function main() {
     turnActive = true;
     if (remote && echo) console.log(`\n${DIM}⟿ [app] ${text.slice(0, 80)}${RESET}`);
     try {
+      // Re-arm the account channel BEFORE the prompt, because nothing downstream can.
+      // auth.json holds ONE machine-global `privateer` entry, so the terminal that
+      // armed LAST deletes it on exit and strands every other terminal still running —
+      // this one keeps a good credential in memory while Pi sees no entry, and every
+      // prompt dies on "This terminal isn't signed in to Privateer".
+      //
+      // The `before_agent_start` net in providers/account.ts cannot cover this: pi's
+      // prompt() throws on its own `hasConfiguredAuth` precheck before that event is
+      // ever emitted. Here is the last point ahead of it. One store read on the healthy
+      // path, and a no-op when the machine isn't signed in.
+      if (currentSpec.startsWith("privateer/")) await ensureAccountArmed(undefined);
       // Expand any `@path` mentions into appended <file> blocks + image attachments,
       // resolved against this terminal's cwd (constrained to the cwd subtree). Both a
       // locally-typed prompt and an app-driven one land here, so both get it. A prompt
@@ -568,6 +580,41 @@ async function main() {
     const t = TIERS[res.tier];
     const color = t.posture === "green" ? GREEN : t.posture === "yellow" ? YELLOW : DIM;
     console.log(`\n${color}⛉ ${t.label}${RESET} ${DIM}(${res.tier}${res.teePosture ? "/" + res.teePosture : ""}) — ${t.blurb}${RESET}${res.error ? `\n${RED}  ${res.error}${RESET}` : ""}`);
+    // What the verified quote says about the enclave that answered (Phala today). The
+    // ordering here is the point: the self-consistency checks PASSED to get this far,
+    // so they are stated as fact; the image identity is only ever "same as last time",
+    // so it is stated as memory. Never let the second read like the first.
+    const enclave = "enclaveIdentity" in res ? res.enclaveIdentity : undefined;
+    if (enclave) {
+      const { measurements, identity, pin } = enclave;
+      console.log(`${DIM}  event log replays to the signed registers; app_compose matches the attested compose-hash${RESET}`);
+      if (enclave.skippedChecks.length) {
+        console.log(`${YELLOW}  not checked (no material in the report): ${enclave.skippedChecks.join(", ")}${RESET}`);
+      }
+
+      if (pin.state === "changed") {
+        // The one line here that should stop a reader. Not a failure — Phala upgrades
+        // the gateway legitimately — but it is the only moment we can ever detect a
+        // swapped image, so it must not read like routine output.
+        console.log(`${YELLOW}  ⚠ enclave image CHANGED since ${pin.firstSeenAt ?? "first use"}:${RESET}`);
+        for (const line of pin.changed) console.log(`${YELLOW}      ${line}${RESET}`);
+      } else if (pin.state === "first-seen") {
+        console.log(`${DIM}  image recorded on first use — no prior value to compare against${RESET}`);
+      } else {
+        console.log(`${DIM}  image unchanged since ${pin.firstSeenAt ?? "first use"}${RESET}`);
+      }
+
+      for (const [name, value] of Object.entries({ ...measurements, ...identity })) {
+        if (value) console.log(`${DIM}    ${name.padEnd(12)} ${value}${RESET}`);
+      }
+      if (enclave.repoCommit) {
+        console.log(`${DIM}  declares source ${enclave.repoUrl ?? "?"} @ ${enclave.repoCommit}${RESET}`);
+        console.log(`${DIM}    (self-declared — the quote does not prove this binary came from that commit)${RESET}`);
+      }
+      if (enclave.downstreamDomain) {
+        console.log(`${DIM}  forwards to ${enclave.downstreamDomain} — a separate trust domain we do not attest${RESET}`);
+      }
+    }
   }
 
   async function remoteAccess(on: boolean) {

package/src/config/moat.ts

@@ -177,36 +177,16 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
 
   const { makePermissionGate } = await import("../ext/permissionGate.ts");
   const { makePiPrivacyExtension } = await import("pi-privacy");
-  const { makeAccountProvider, privateerChannel } = await import("../providers/account.ts");
-  const { hasCredentials } = await import("../auth/privateer.ts");
+  const { makeAccountProvider } = await import("../providers/account.ts");
   const { webEnabled, mediaEnabled } = await import("./hosted.ts");
-  const { noQuarterActive } = await import("../permissions/noQuarter.ts");
-  const { cliPalette, detectScheme } = await import("../ui/palette.ts");
+  const { sharedPrivacyOptions } = await import("./privacyPolicy.ts");
 
   const factories: ExtensionFactory[] = [makePermissionGate(opts.gate)];
 
-  // Per-model verified-TEE capability for pi-privacy's /models picker: show Privateer's
-  // TEE-channel models (near/tinfoil/phala) as "◆ Verifiable TEE" when logged in, while
-  // ZDR-channel models stay at their honest floor. The live verdict still comes from
-  // accountPosture on select — this only lifts the label.
-  factories.push(
-    makePiPrivacyExtension({
-      privateerVerifiedTee: (m: any) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
-      // No quarter = unattended: the PII send-or-redact question would block a session
-      // the operator explicitly stepped away from, so it's swallowed the safe way —
-      // auto-redact + send — and what was masked surfaces as output instead. A live
-      // function, not a boolean: shift+tab / /no-quarter flips this mid-session.
-      piiUnattended: noQuarterActive,
-      // Color-coat that notice as the moat acting on your behalf: the red no-quarter
-      // flag (same glyph/color as the no-quarter banner in chat.ts), body in the
-      // accent color — distinct from yellow warnings and red errors.
-      renderPiiAutoRedact: (notice: string) => {
-        const p = cliPalette(detectScheme());
-        const body = notice.startsWith("⚑ ") ? notice.slice(2) : notice;
-        return `${p.RED}⚑${p.RESET} ${p.CYAN}${body}${p.RESET}`;
-      },
-    }),
-  );
+  // pi-privacy is configured in exactly ONE place, shared with the DISCOVERED copy of this
+  // extension (the TUI's, and every subagent child's) — see ./privacyPolicy.ts for the two
+  // bugs that came of configuring it in two.
+  factories.push(makePiPrivacyExtension(sharedPrivacyOptions()));
   factories.push(makeAccountProvider()); // must follow pi-privacy — see header
 
   if (opts.relayFiles) {

package/src/config/moatManifest.ts

@@ -27,6 +27,11 @@ import { readFileSync } from "node:fs";
  * `dep` is a node_modules specifier as [packageName, ...pathSegments], resolved through
  * the node_modules chain at launch (npm hoists, so a fixed path would miss). Exactly one
  * of the two is set.
+ *
+ * `note` is USER-VISIBLE: relayClient.sendExtensions ships it to the app, which lists it
+ * under each built-in in the Extensions manager. Write it as a one-line description of
+ * what the extension gives the user (English only — the app renders it verbatim, as it
+ * already does for the agent's status messages), not as a code comment.
  */
 export interface MoatShim {
   name: string;

package/src/config/privacyPolicy.ts

@@ -0,0 +1,97 @@
+// The pi-privacy options that must be the SAME however a session reaches pi-privacy.
+//
+// There are two call sites, and they are genuinely separate routes — not one path with a
+// fallback:
+//
+//   - src/config/moat.ts builds the extension from FACTORIES: the harbor's sessions,
+//     live tasks, the channels runner, ACP, the lean REPL.
+//   - extensions/privateer-privacy.ts is what Pi DISCOVERS for the interactive TUI, and
+//     what bin/privateer-subagent.mjs injects (`-e`) into every subagent child.
+//
+// They drifted, and the drift was the bug this module exists to make impossible: the
+// factory side wired the unattended signal and the discovered side didn't, so in the
+// terminal `--no-quarter` (and shift+tab) lowered the permission moat while pi-privacy
+// still stopped the turn with "PII detected — send as-is or redact?". No quarter means no
+// prompts, from every gate in the session, not just ours.
+//
+// EVERYTHING pi-privacy is configured with lives here — there is no "and each side adds
+// its own bit" left, because that arrangement is what produced both bugs. The other one:
+// c2ee0fa added `resolveTier` to the discovered extension to stop the PII gate
+// over-warning on the account channel (pi-privacy's own catalog only knows Privateer's
+// PUBLIC developer key, which floors to zdr-policy, so a session on an ATTESTED account
+// TEE model was judged unverified and asked about PII on every turn). The factory-built
+// sessions never got it, and they never got the badge right either. Symmetrically, they
+// had `privateerVerifiedTee` and the discovered copy didn't.
+//
+// IMPORT-SAFETY: this module reaches the account channel, so it pulls Pi-touching code
+// and node builtins — it is NOT safe to import from a boot-ordered entrypoint (see
+// boot.ts's ORDERING CONTRACT). moat.ts therefore imports it DYNAMICALLY, inside
+// buildMoat(), exactly as it does every other Pi-touching import. Extensions load late
+// and import it statically.
+
+import { noQuarterActive } from "../permissions/noQuarter.ts";
+import { cliPalette, detectScheme } from "../ui/palette.ts";
+import { accountPosture, privateerChannel } from "../providers/account.ts";
+import { hasCredentials } from "../auth/privateer.ts";
+
+// Color-coat pi-privacy's auto-redact notice as the moat acting on your behalf: the red
+// no-quarter flag (same glyph and color as the no-quarter banner in chat.ts and the gate
+// extension's status line), body in the accent color — distinct from a yellow warning and
+// from a red error, because this is neither: it's the answer we gave for you.
+function renderPiiAutoRedact(notice: string): string {
+  const p = cliPalette(detectScheme());
+  const body = notice.startsWith("⚑ ") ? notice.slice(2) : notice;
+  return `${p.RED}⚑${p.RESET} ${p.CYAN}${body}${p.RESET}`;
+}
+
+/** The pi-privacy options every Privateer session gets, whichever route built it. */
+export function sharedPrivacyOptions() {
+  return {
+    // The account channel's real posture. pi-privacy ships a `privateer` provider, but it
+    // is the PUBLIC developer-key channel (sk-priv-…, server-proxied and unverifiable
+    // end-to-end), so from the package alone every privateer/* model floors to
+    // zdr-policy. The in-app ACCOUNT channel is a different thing — its own OAuth
+    // session, account server and sealed relay — and only the host can say what it
+    // resolves to: tee-verified for a quote WE checked over the sealed path,
+    // tee-unverified for a proxied enclave we can't bind to this connection, zdr-policy
+    // for the ZDR-channel models. Without this hook a session running an ATTESTED TEE
+    // model is judged unverified, so the badge lies and the PII gate asks about every
+    // turn — the over-warning c2ee0fa fixed for the terminal and nowhere else.
+    resolveTier: async (provider: string, modelId: string) => {
+      if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
+      return (await accountPosture(modelId)).tier;
+    },
+    // Per-model verified-TEE capability for pi-privacy's /models picker: show Privateer's
+    // TEE-channel models (near/tinfoil/phala) as "◆ Verifiable TEE" when logged in, while
+    // ZDR-channel models stay at their honest floor. The live verdict still comes from
+    // resolveTier above on select — this only lifts the label.
+    privateerVerifiedTee: (m: any) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+    // No quarter = unattended. The PII send-or-redact question would stall a session the
+    // operator explicitly stepped away from, so pi-privacy swallows it the SAFE way —
+    // redact, then send — and reports what it masked as output instead of asking. A live
+    // function, not a boolean: shift+tab / `/no-quarter` flips this mid-session and the
+    // gate re-reads it on every request.
+    piiUnattended: noQuarterActive,
+    renderPiiAutoRedact,
+    // pi-privacy's INGEST gate: credentials arriving in a tool result are masked before
+    // they enter context (otherwise they're re-sent every turn and written to the session
+    // file on disk). We already redact tool output in src/ext/permissionGate.ts, so its
+    // default "warn" would put an interactive prompt in front of something this app has
+    // always handled silently — "redact" keeps our UX and still takes the added coverage.
+    //
+    // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
+    // ours masks the configured provider keys by exact value (from env/config) plus the
+    // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
+    // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
+    // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which our
+    // patterns match.
+    //
+    // Order between the two is NOT guaranteed: pi discovers extensions with a bare
+    // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this box
+    // today, not by contract). "redact" makes that moot — both handlers run
+    // unconditionally and each masks its own patterns, so the surviving content is the
+    // same either way. Under "warn" the order WOULD matter, since it decides whether the
+    // prompt is raised on a raw key or one we already masked.
+    toolResultPolicy: "redact" as const,
+  };
+}