privateer-agent 0.12.13 → 0.12.15

package/README.md

@@ -396,6 +396,12 @@ Download for [macOS](https://privateer.pro/download/mac) (Apple silicon),
 [macOS Intel](https://privateer.pro/download/mac-intel), or
 [Windows](https://privateer.pro/download/windows).
 
+Once it's installed, **`/desktop`** in the terminal brings it up — no Spotlight detour. It
+opens the app, not a copy of this conversation: the desktop hosts its own session, so pick
+the folder you were working in from **File ▸ Spawn Privateer at…** and it starts on the same
+model and connectors this terminal uses (the per-folder defaults live in `~/.privateer`,
+which both read).
+
 It's an early release and **not yet code-signed or notarized** — macOS will warn on first
 open. Routines and channels deliberately aren't hosted here: those belong to the always-on
 harbor, so background work still wants `privateer harbor install`.
@@ -640,6 +646,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 | `/extensions` | list loaded Pi extensions |
 | `/web-tools` | point `web_search`/`web_fetch` at a search provider of your own (signed in, they already work on your account) |
 | `/init` | scaffold a starter `PRIVATEER.md` in this directory |
+| `/desktop` | open the [desktop app](#desktop-app) — same login, same per-folder defaults |
 | `/update` · `/privateer` | update to the latest release / Privateer status and posture |
 
 Shell subcommands: `privateer` (interactive), `privateer update`, `privateer harbor …`,

package/bin/privateer-subagent.mjs

@@ -35,8 +35,15 @@ const REPO = resolve(HERE, ".."); // repo root
 // which build their moat from factories and have no `-e` list to hand down. Those get the
 // floor and nothing else: gate = the permission moat (fail-closed, forwards the child's
 // approvals to the parent); privacy = ZDR/TEE posture + attestation dispatcher; account =
-// the privateer/* provider, so a child can run account models. Deliberately narrower than
-// a terminal's — an unattended run's children have no human to approve a tool that spends.
+// the privateer/* provider, so a child can run account models.
+//
+// media is here for the work an unattended run most wants to delegate — a film is a
+// per-shot job, and a shot per subagent is the shape that fits. It is SAFE to list
+// unconditionally because the extension shapes itself rather than trusting its position
+// on this list: video_compose (local ffmpeg, no spend) always registers, and the billing
+// generate_* tools register only when the parent handed this child an explicit spend
+// grant. See extensions/privateer-media.ts and src/permissions/childSpend.ts. Still
+// narrower than a terminal's list — no web, no MCP, no brand/hints/update surface.
 export function moatExtensionPaths(repoRoot = REPO, env = process.env) {
   const inherited = (env.PRIVATEER_CHILD_EXTENSIONS ?? "")
     .split(delimiter)
@@ -47,6 +54,7 @@ export function moatExtensionPaths(repoRoot = REPO, env = process.env) {
     join(repoRoot, "extensions", "privateer-gate.ts"),
     join(repoRoot, "extensions", "privateer-privacy.ts"),
     join(repoRoot, "extensions", "privateer-account.ts"),
+    join(repoRoot, "extensions", "privateer-media.ts"),
   ];
 }
 

package/extensions/privateer-desktop.ts

@@ -0,0 +1,54 @@
+// /desktop — bring up the Privateer desktop app from the terminal.
+//
+// The two front ends already share everything that matters: one ~/.privateer home,
+// so one login, one model config, one MCP catalog, one set of per-folder spawn
+// defaults. What was missing was a way across. Getting from a terminal to the app
+// meant leaving the terminal — Spotlight, the Dock, a Start-menu hunt — which is
+// exactly the kind of small friction that leaves a shipped app unopened.
+//
+// What it does NOT do is carry the conversation over: the desktop hosts its own
+// in-process session and takes no folder argument (see src/config/desktopApp.ts),
+// so this opens the app and says how to point a window at the folder you were just
+// working in. When the app isn't installed we say so once, with the download page
+// for this platform, and never again unasked — the working-line tip in
+// privateer-hints.ts only fires on a machine that HAS it.
+
+import {
+  desktopAppPath,
+  desktopDownloadAltUrl,
+  desktopDownloadUrl,
+  openDesktopApp,
+} from "../src/config/desktopApp.ts";
+
+export default function privateerDesktop(pi: any): void {
+  pi.registerCommand?.("desktop", {
+    description: "Open the Privateer desktop app — same login, same per-folder defaults",
+    handler: (_args: string, ctx: any) => {
+      const app = desktopAppPath();
+
+      if (app) {
+        const cwd = process.cwd();
+        if (openDesktopApp(app)) {
+          ctx?.ui?.notify?.(
+            `Opening the Privateer desktop app — same login and per-folder defaults as this terminal. ` +
+              `File ▸ Spawn Privateer at… points a window at ${cwd}.`,
+            "info",
+          );
+        } else {
+          ctx?.ui?.notify?.(`Could not launch ${app} — open it yourself and this terminal keeps working.`, "error");
+        }
+        return;
+      }
+
+      const url = desktopDownloadUrl();
+      const alt = desktopDownloadAltUrl(); // the other Mac build — see desktopApp.ts
+      ctx?.ui?.notify?.(
+        url
+          ? `The Privateer desktop app isn't installed here. Download: ${url}${alt ? ` (other Macs: ${alt})` : ""} — ` +
+              `it reads the same ~/.privateer, so it starts already signed in with your models and connectors.`
+          : `The desktop app ships for macOS and Windows only — on this platform the terminal agent is the app.`,
+        "info",
+      );
+    },
+  });
+}

package/extensions/privateer-gate.ts

@@ -32,6 +32,7 @@ import { matchesKey } from "@earendil-works/pi-tui";
 import * as priv from "../src/auth/privateer.ts";
 import { paletteFor } from "../src/ui/palette.ts";
 import { noQuarterActive, setNoQuarter } from "../src/permissions/noQuarter.ts";
+import { childSpendAllows } from "../src/permissions/childSpend.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
 const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
@@ -429,6 +430,12 @@ const gate = makePermissionGate({
   // which subagent children inherit through the env. See src/permissions/noQuarter.ts.
   getSkipAllPermissions: noQuarterActive,
   remoteAsk: bridge.remoteAsk,
+  // Billing tools this process was authorized for BEFORE it started. Only ever non-empty
+  // inside a subagent child whose parent handed one down (childSpend.ts reads the env only
+  // when pi-subagents has marked us a child), so a terminal keeps asking its human. This
+  // is what lets an unattended run delegate a shot to a subagent: without it the child's
+  // gate denies every generate_* call, having no one to ask.
+  isSpendPreauthorized: (req) => childSpendAllows(req.tool),
 });
 
 export default function privateerControl(pi: any): void {

package/extensions/privateer-hints.ts

@@ -25,6 +25,7 @@ import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { keyText } from "@earendil-works/pi-coding-agent";
 import { configPath, globalDir } from "../src/config/paths.ts";
+import { desktopAppPath } from "../src/config/desktopApp.ts";
 
 const FIRST_MS = 6_000; // a turn shorter than this never shows a tip
 const EVERY_MS = 12_000;
@@ -76,9 +77,28 @@ const HINTS: Array<() => string> = [
       ? `${k} is push-to-talk — /speak on reads the answer back`
       : `/talk types what you say — /speak on reads the answer back`;
   },
+  () => (haveDesktopApp() ? `/desktop opens the Privateer desktop app — same login, same folder defaults` : ""),
   () => `these tips are /hints — /hints off silences them`,
 ];
 
+// A hint returns "" when it doesn't apply to THIS machine, and the rotation skips
+// it. The desktop tip is the case that needs it: naming a command for an app the
+// user has is discoverability, advertising one they haven't is an ad. Memoised
+// because the rotation asks every 12 s and the answer is a stat() on a path that
+// doesn't change under a running terminal (installing the app mid-session is worth
+// a restart, not a filesystem poll).
+let desktopSeen: boolean | undefined;
+function haveDesktopApp(): boolean {
+  if (desktopSeen === undefined) {
+    try {
+      desktopSeen = desktopAppPath() !== null;
+    } catch {
+      desktopSeen = false;
+    }
+  }
+  return desktopSeen;
+}
+
 // Default ON: absent file, absent block, or unreadable JSON all mean enabled.
 // Only an explicit { hints: { enabled: false } } turns the rotation off.
 function hintsEnabled(): boolean {
@@ -119,9 +139,20 @@ export default function privateerHints(pi: any): void {
     if (restoreDefault) uiRef?.setWorkingMessage?.();
   };
 
+  // The next hint that applies here, advancing the cursor past any that opted out.
+  // Bounded by the list length, so an all-empty list ends the rotation instead of
+  // spinning through it forever.
+  const nextHint = (): string => {
+    for (let i = 0; i < HINTS.length; i++) {
+      const text = HINTS[cursor++ % HINTS.length]();
+      if (text) return text;
+    }
+    return "";
+  };
+
   const showNext = (): void => {
-    const hint = HINTS[cursor % HINTS.length]();
-    cursor++;
+    const hint = nextHint();
+    if (!hint) return; // nothing applies on this machine — leave "Working..." alone
     uiRef?.setWorkingMessage?.(`Working... · tip: ${hint}`);
     timer = setTimeout(showNext, EVERY_MS);
   };

package/extensions/privateer-media.ts

@@ -1,5 +1,6 @@
-// Media tools for Pi's TUI: generate images, video, speech and music through the
-// signed-in Privateer account, and stitch the results together locally with ffmpeg.
+// Media tools for Pi's TUI: generate images, video, 3D meshes, speech, music and
+// sound effects through the signed-in Privateer account, and stitch the results
+// together locally with ffmpeg.
 //
 // Generation is registered only when the account channel can actually serve it
 // (mediaEnabled → signed in, and HARBOR_MEDIA not explicitly off). Omitting the
@@ -7,14 +8,26 @@
 // 401s on every call teaches the model to keep retrying, whereas a tool that isn't
 // there makes it say "you'd need to sign in" and move on.
 //
+// A SUBAGENT CHILD is held to the same rule for the same reason, one step further out.
+// A child is a headless process with nobody to approve a billing call, so unless its
+// parent handed down a spend grant (src/permissions/childSpend.ts — an unattended run
+// passing on the media tools its own allow-list names), every generate_* call it made
+// would be denied by the gate. Registering them anyway would spend the child's whole
+// context discovering that one refusal at a time. So an ungranted child gets no
+// generation tools and reports the truth: it can compose, not generate.
+//
 // video_compose is registered UNCONDITIONALLY. It is local ffmpeg work on files
 // already on disk — no account, no network, no spend — so it stays useful to a
-// signed-out terminal editing media that came from anywhere.
+// signed-out terminal, and to a child whose job is to cut together what its parent
+// generated.
 import { makeMediaTools } from "../src/tools/media.ts";
 import { makeComposeTools } from "../src/tools/videoCompose.ts";
 import { mediaEnabled } from "../src/config/hosted.ts";
+import { childHoldsSpendGrant } from "../src/permissions/childSpend.ts";
+import { isSubagentChild } from "../src/remote/subagentRelay.ts";
 
 export default function privateerMedia(pi: any): void {
-  if (mediaEnabled()) makeMediaTools()(pi);
+  const canSpend = !isSubagentChild() || childHoldsSpendGrant();
+  if (mediaEnabled() && canSpend) makeMediaTools()(pi);
   makeComposeTools()(pi);
 }

package/extensions/privateer-privacy.ts

@@ -1,9 +1,10 @@
 // pi-privacy for privateer-agent: the standard pi-privacy extension (providers +
-// attestation + posture badge feed + PII gate) PLUS a tier resolver that teaches it
-// about the private ACCOUNT channel it doesn't ship — so a privateer/near… model
-// (actually confidential-compute TEE) is treated as verified-private (no PII
-// over-warning), and a zdr account model as zdr-policy. Replaces loading pi-privacy's
-// default entry directly.
+// attestation + posture badge feed + PII gate) configured the way every Privateer session
+// configures it — src/config/privacyPolicy.ts, which src/config/moat.ts hands to the
+// factory-built sessions verbatim. Chiefly that means a tier resolver teaching pi-privacy
+// about the private ACCOUNT channel it doesn't ship, so a privateer/near… model (actually
+// confidential-compute TEE) is treated as verified-private (no PII over-warning) and a zdr
+// account model as zdr-policy. Replaces loading pi-privacy's default entry directly.
 //
 // It also REPAIRS two provider registrations pi-privacy makes from its own catalog, each
 // of which replaces (not merges) whatever model list that provider already had:
@@ -23,7 +24,8 @@
 // display/resolution + routing list — posture and attestation are dispatcher-bound and
 // unaffected by the model set.
 import { makePiPrivacyExtension } from "pi-privacy";
-import { accountPosture, registerAccountModels } from "../src/providers/account.ts";
+import { registerAccountModels } from "../src/providers/account.ts";
+import { sharedPrivacyOptions } from "../src/config/privacyPolicy.ts";
 
 // Tinfoil's live chat models (inference.tinfoil.sh/v1/models), kimi-k2-6 first — the
 // launcher's default. Non-chat endpoints (embeddings, tts, whisper, websearch,
@@ -51,33 +53,11 @@ function tinfoilModel(id: string) {
   };
 }
 
-const privacy = makePiPrivacyExtension({
-  resolveTier: async (provider, modelId) => {
-    if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
-    return (await accountPosture(modelId)).tier;
-  },
-  // pi-privacy 0.8 added an INGEST gate: credentials arriving in a tool result are
-  // redacted before they enter context (they'd otherwise be re-sent every turn and
-  // written to the session file on disk). We already redact tool output in
-  // src/ext/permissionGate.ts, so its default "warn" would put an interactive prompt
-  // in front of something this app has always handled silently — "redact" keeps our
-  // UX and still takes the added coverage.
-  //
-  // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
-  // ours masks the configured provider keys by exact value (from env/config) plus the
-  // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
-  // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
-  // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which
-  // our patterns match.
-  //
-  // Order between the two is NOT guaranteed: pi discovers extensions with a bare
-  // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this
-  // box today, not by contract). "redact" makes that moot — both handlers run
-  // unconditionally and each masks its own patterns, so the surviving content is the
-  // same either way. Under "warn" the order WOULD matter, since it decides whether
-  // the prompt is raised on a raw key or one we already masked.
-  toolResultPolicy: "redact",
-});
+// One configuration, shared with the factory-built copy in src/config/moat.ts — the tier
+// resolver for the private ACCOUNT channel, the unattended/no-quarter handling, the ingest
+// policy. Adding an option HERE rather than there is how this file and the moat drifted
+// twice; src/config/privacyPolicy.ts records what that cost.
+const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
 
 export default function privateerPrivacy(pi: any): void {
   privacy(pi);

package/extensions/privateer-tools.ts

@@ -1,9 +1,14 @@
 // Privateer-specific custom tools for Pi's TUI (Phase 5). Today: create_routine
-// (schedule unattended tasks → the harbor runs them). The generic tools (read/edit/
-// bash/grep, web, subagents, todo) come from Pi builtins + adopted packages, so only
-// the privateer-only tools live here. Gated by our permission-gate extension.
+// (schedule unattended tasks → the harbor runs them) and read_routine_result (read
+// one back — its standing instruction plus its latest output — so a conversation can
+// ACT on what a routine found instead of only being told it ran). The generic tools
+// (read/edit/bash/grep, web, subagents, todo) come from Pi builtins + adopted
+// packages, so only the privateer-only tools live here. Gated by our permission-gate
+// extension.
 import { routineToolDefinition } from "../src/tools/routine.ts";
+import { routineResultToolDefinition } from "../src/tools/routineResult.ts";
 
 export default function privateerTools(pi: any): void {
   pi.registerTool?.(routineToolDefinition);
+  pi.registerTool?.(routineResultToolDefinition);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.13",
+  "version": "0.12.15",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-coding-agent+0.84.1.patch

@@ -68,10 +68,81 @@ index 4600b23..075ecae 100644
  export const ENV_AGENT_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_DIR`;
  export const ENV_SESSION_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_SESSION_DIR`;
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-index ce8a9a2..1ae7b25 100644
+index ce8a9a2..c52ea80 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-@@ -186,6 +186,14 @@ export class AgentSession {
+@@ -38,6 +38,70 @@ import { createLocalBashOperations } from "./tools/bash.js";
+ import { createAllToolDefinitions } from "./tools/index.js";
+ import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
+ import { addUsageToTotals, createUsageTotals } from "./usage-totals.js";
++// ============================================================================
++// Privateer patch: provider errors that aren't API responses
++//
++// An inference endpoint does not always answer as an API. Put a WAF, a proxy or a
++// captive portal in front of one and a rejected request comes back as an HTML page,
++// which the provider SDK folds whole into `error.message` — status first, body after.
++//
++// Measured incident: the account channel's edge WAF answered a turn with a 403 block
++// page carrying three inline base64 web fonts, so `errorMessage` was 221 KB. Pi
++// printed it into the terminal in full, appended it to the session file on every
++// attempt (a 1.8 MB session), and ran isRetryableAssistantError over it — and a
++// megabyte of base64 reliably contains "429", "500" and "502", so a permanent 403
++// looked transient and burned the whole retry budget before the user saw anything.
++//
++// compactProviderError squeezes such a page down to the line a person can act on
++// (status, title, visible text — which is where a WAF puts its request id), and
++// isHardHttpFailure lets the STATUS decide retryability instead of a substring of the
++// body. Mirrors src/engine/errors.ts, which is where these are tested.
++const PV_MAX_ERROR_CHARS = 2000;
++const PV_MAX_PAGE_TEXT_CHARS = 600;
++const PV_HTML_DOC = /<!doctype html|<html[\s>]/i;
++const PV_NON_PROSE = /<(script|style|svg|head|noscript)\b[\s\S]*?<\/\1\s*>/gi;
++const PV_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " ", "#39": "'", "#x27": "'" };
++function pvPlainText(html) {
++    return html
++        .replace(/<[^>]*>/g, " ")
++        .replace(/&(#x?[0-9a-f]+|[a-z]+);/gi, (m, code) => {
++        const key = code.toLowerCase();
++        if (PV_ENTITIES[key] !== undefined)
++            return PV_ENTITIES[key];
++        if (key.startsWith("#x"))
++            return String.fromCodePoint(parseInt(key.slice(2), 16) || 0) || m;
++        if (key.startsWith("#"))
++            return String.fromCodePoint(parseInt(key.slice(1), 10) || 0) || m;
++        return m;
++    })
++        .replace(/\s+/g, " ")
++        .trim();
++}
++export function compactProviderError(raw) {
++    const text = typeof raw === "string" ? raw : String(raw ?? "");
++    if (!PV_HTML_DOC.test(text)) {
++        if (text.length <= PV_MAX_ERROR_CHARS)
++            return text;
++        return `${text.slice(0, PV_MAX_ERROR_CHARS)}… [dropped ${text.length - PV_MAX_ERROR_CHARS} chars]`;
++    }
++    const status = /^\s*(\d{3})\b/.exec(text)?.[1];
++    const title = pvPlainText(/<title[^>]*>([\s\S]*?)<\/title>/i.exec(text)?.[1] ?? "");
++    const body = pvPlainText(text.replace(PV_NON_PROSE, " "));
++    const visible = [title, body].filter(Boolean).join(" — ").slice(0, PV_MAX_PAGE_TEXT_CHARS);
++    return (`${status ?? "HTTP error"} — an HTML page, not an API response (something in front of ` +
++        `the provider answered: a WAF, a proxy, or a captive portal): ` +
++        `${visible || "(no readable text)"} [dropped ${text.length} chars of HTML]`);
++}
++// Client-error statuses that CAN clear on their own: a timeout, a lock conflict, an
++// early-data replay, a throttle. Every other 4xx is the request itself being wrong.
++const PV_TRANSIENT_CLIENT_STATUS = new Set([408, 409, 425, 429]);
++export function isHardHttpFailure(text) {
++    const m = /^\s*(\d{3})\b/.exec(typeof text === "string" ? text : "");
++    if (!m)
++        return false;
++    const status = Number(m[1]);
++    return status >= 400 && status < 500 && !PV_TRANSIENT_CLIENT_STATUS.has(status);
++}
+ /**
+  * Parse a skill block from message text.
+  * Returns null if the text doesn't contain a skill block.
+@@ -186,6 +250,14 @@ export class AgentSession {
          }
          const isOAuth = this._modelRuntime.isUsingOAuth(model.provider);
          if (isOAuth) {
@@ -86,7 +157,24 @@ index ce8a9a2..1ae7b25 100644
              throw new Error(`Authentication failed for "${model.provider}". ` +
                  `Credentials may have expired or network is unavailable. ` +
                  `Run '/login ${model.provider}' to re-authenticate.`);
-@@ -772,6 +780,15 @@ export class AgentSession {
+@@ -360,6 +432,16 @@ export class AgentSession {
+                 }
+             }
+         }
++        // Privateer patch: squeeze a non-API error body BEFORE anything reads it. This is
++        // the one point upstream of all four consumers — extension handlers, UI listeners,
++        // session persistence, and the _lastAssistantMessage the retry classifier reads —
++        // so an HTML block page is shortened once, in place, rather than printed, stored
++        // and pattern-matched at full size. See compactProviderError above.
++        if (event.type === "message_end" &&
++            event.message?.role === "assistant" &&
++            typeof event.message.errorMessage === "string") {
++            event.message.errorMessage = compactProviderError(event.message.errorMessage);
++        }
+         // Emit to extensions first
+         await this._emitExtensionEvent(event);
+         // Notify all listeners
+@@ -772,6 +854,15 @@ export class AgentSession {
                  finalError: msg.errorMessage,
              });
              this._retryAttempt = 0;
@@ -102,7 +190,7 @@ index ce8a9a2..1ae7b25 100644
          }
          if (await this._checkCompaction(msg)) {
              return true;
-@@ -852,6 +869,14 @@ export class AgentSession {
+@@ -852,6 +943,14 @@ export class AgentSession {
              if (!hasConfiguredAuth) {
                  const isOAuth = this._modelRuntime.isUsingOAuth(this.model.provider);
                  if (isOAuth) {
@@ -117,10 +205,19 @@ index ce8a9a2..1ae7b25 100644
                      throw new Error(`Authentication failed for "${this.model.provider}". ` +
                          `Credentials may have expired or network is unavailable. ` +
                          `Run '/login ${this.model.provider}' to re-authenticate.`);
-@@ -2084,6 +2109,18 @@ export class AgentSession {
+@@ -2084,6 +2183,27 @@ export class AgentSession {
          // Context overflow is handled by compaction, not retry.
          if (isContextOverflow(message, this.model?.contextWindow ?? 0))
              return false;
++        // Privateer patch: an HTTP status is a fact; a substring of the body is a guess.
++        // pi classifies by regex over the whole error text, so a 403 whose body merely
++        // CONTAINS "500" — a WAF block page, any proxy interstitial, anything with base64
++        // in it — spent the full retry budget on a failure retrying could never clear.
++        // A 4xx other than 408/409/425/429 is the request being wrong, whatever its body
++        // says. Provider-agnostic on purpose: an intercepting proxy is not ours to detect.
++        // Mirrors isHardHttpFailure in src/engine/errors.ts.
++        if (isHardHttpFailure(message.errorMessage))
++            return false;
 +        // Privateer patch: a Privateer ACCOUNT CAP is not a throttle. Daily/monthly
 +        // message or token limits (and an exhausted balance) come back from the account
 +        // channel as a 429 carrying the backend's machine `code` and a ready-to-show

package/src/acp/run.ts

@@ -89,7 +89,7 @@ export async function runAcp(): Promise<void> {
   const { moatResourceOptions } = await import("../config/moat.ts");
   const { privateerChannel, rememberAccountCredential, persistAccountCredential, dropPersistedAccountCredential } =
     await import("../providers/account.ts");
-  const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
+  const { modelRegistryOf, piAuthStore } = await import("../providers/piAuthStore.ts");
   const { hasCredentials, acquireAccountCredential, revokeAccountSession } = await import("../auth/privateer.ts");
   const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
@@ -230,7 +230,23 @@ export async function runAcp(): Promise<void> {
   // there. The moment anything revoked it, every ACP turn started failing.
   let armedAccount = false;
   async function ensureAccountArmed(providerName: string): Promise<void> {
-    if (armedAccount || providerName !== "privateer") return;
+    if (providerName !== "privateer") return;
+    // Re-read the PERSISTED entry instead of latching on `armedAccount`. auth.json holds
+    // one machine-global `privateer` entry, so whichever terminal armed LAST removes it
+    // on exit — including one that armed over ours — and a latch would never notice. The
+    // session we hold stays perfectly valid while Pi sees no entry at all, so every turn
+    // from then on fails with the misleading "This terminal isn't signed in to
+    // Privateer". Re-arming reuses our own session (accountCredential's memo) rather
+    // than minting a second one, so the recovery costs a store write, not a Linked
+    // Devices row.
+    if (armedAccount) {
+      try {
+        if (await (await piAuthStore()).read("privateer")) return;
+      } catch {
+        return; // can't read the store — leave it to the turn's own error path
+      }
+      log("account entry was removed by another terminal — re-arming");
+    }
     if (!hasCredentials()) {
       log("not signed in to Privateer — run `privateer` and /login, or pick a BYO-key model");
       return;
@@ -246,6 +262,10 @@ export async function runAcp(): Promise<void> {
     }
   }
   await ensureAccountArmed(model.provider);
+  // The provider actually selected right now — `model` is the launch model and never
+  // moves, but session/set_model can switch channels mid-run, and the per-turn re-arm
+  // below has to follow that rather than the model this process booted on.
+  let currentProvider = model.provider;
 
   const modelCount = listModels()?.available.length ?? 0;
   log(
@@ -312,11 +332,18 @@ export async function runAcp(): Promise<void> {
         // with the same misleading "not signed in".
         await ensureAccountArmed(next.provider);
         await session.setModel(next);
+        currentProvider = next.provider;
       },
       async prompt(text, events, signal) {
         holder.events = events;
         holder.error = undefined;
         try {
+          // Ahead of every turn, not just at startup: the entry we armed can be removed
+          // by another terminal's exit at any point in a long-lived host session (see
+          // ensureAccountArmed). It has to happen HERE because pi's prompt() throws on
+          // its own `hasConfiguredAuth` precheck before it emits `before_agent_start`,
+          // where providers/account.ts installs the equivalent net.
+          await ensureAccountArmed(currentProvider);
           await session.prompt(text);
         } catch (e) {
           return { ok: false, error: e instanceof Error ? e.message : String(e) };

package/src/channels/run.ts

@@ -129,6 +129,7 @@ async function main() {
   const { moatResourceOptions } = await import("../config/moat.ts");
   const { webEnabled, mediaEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
+  const { ensureAccountArmed } = await import("../providers/account.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
   const { MessagingBridge } = await import("./bridge.ts");
@@ -321,6 +322,14 @@ async function main() {
       // A member's turn is always read-only, whatever the channel posture.
       const effectivePosture: Posture = meta.isAdmin ? chPosture : "readonly";
       try {
+        // Re-arm the account channel ahead of the turn. This daemon runs for weeks, and
+        // Pi's auth.json holds ONE machine-global `privateer` entry: any other terminal
+        // on the box that arms over ours and then exits takes the entry with it, and
+        // from that moment every channel message answers "This terminal isn't signed in
+        // to Privateer" on a session that is still perfectly valid. The equivalent net
+        // in providers/account.ts hangs off `before_agent_start`, which pi's prompt()
+        // never reaches — it throws on its own `hasConfiguredAuth` precheck first.
+        if (model?.provider === "privateer") await ensureAccountArmed(undefined);
         await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () => session.prompt(text));
       } catch (e) {
         return { ok: false, error: e instanceof Error ? e.message : String(e) };

package/src/cli/chat.ts

@@ -46,6 +46,7 @@ async function main() {
     rememberAccountCredential,
     persistAccountCredential,
     dropPersistedAccountCredential,
+    ensureAccountArmed,
   } = await import("../providers/account.ts");
   const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
   const { agentVersion } = await import("../config/version.ts");
@@ -330,6 +331,17 @@ async function main() {
     turnActive = true;
     if (remote && echo) console.log(`\n${DIM}⟿ [app] ${text.slice(0, 80)}${RESET}`);
     try {
+      // Re-arm the account channel BEFORE the prompt, because nothing downstream can.
+      // auth.json holds ONE machine-global `privateer` entry, so the terminal that
+      // armed LAST deletes it on exit and strands every other terminal still running —
+      // this one keeps a good credential in memory while Pi sees no entry, and every
+      // prompt dies on "This terminal isn't signed in to Privateer".
+      //
+      // The `before_agent_start` net in providers/account.ts cannot cover this: pi's
+      // prompt() throws on its own `hasConfiguredAuth` precheck before that event is
+      // ever emitted. Here is the last point ahead of it. One store read on the healthy
+      // path, and a no-op when the machine isn't signed in.
+      if (currentSpec.startsWith("privateer/")) await ensureAccountArmed(undefined);
       // Expand any `@path` mentions into appended <file> blocks + image attachments,
       // resolved against this terminal's cwd (constrained to the cwd subtree). Both a
       // locally-typed prompt and an app-driven one land here, so both get it. A prompt
@@ -568,6 +580,41 @@ async function main() {
     const t = TIERS[res.tier];
     const color = t.posture === "green" ? GREEN : t.posture === "yellow" ? YELLOW : DIM;
     console.log(`\n${color}⛉ ${t.label}${RESET} ${DIM}(${res.tier}${res.teePosture ? "/" + res.teePosture : ""}) — ${t.blurb}${RESET}${res.error ? `\n${RED}  ${res.error}${RESET}` : ""}`);
+    // What the verified quote says about the enclave that answered (Phala today). The
+    // ordering here is the point: the self-consistency checks PASSED to get this far,
+    // so they are stated as fact; the image identity is only ever "same as last time",
+    // so it is stated as memory. Never let the second read like the first.
+    const enclave = "enclaveIdentity" in res ? res.enclaveIdentity : undefined;
+    if (enclave) {
+      const { measurements, identity, pin } = enclave;
+      console.log(`${DIM}  event log replays to the signed registers; app_compose matches the attested compose-hash${RESET}`);
+      if (enclave.skippedChecks.length) {
+        console.log(`${YELLOW}  not checked (no material in the report): ${enclave.skippedChecks.join(", ")}${RESET}`);
+      }
+
+      if (pin.state === "changed") {
+        // The one line here that should stop a reader. Not a failure — Phala upgrades
+        // the gateway legitimately — but it is the only moment we can ever detect a
+        // swapped image, so it must not read like routine output.
+        console.log(`${YELLOW}  ⚠ enclave image CHANGED since ${pin.firstSeenAt ?? "first use"}:${RESET}`);
+        for (const line of pin.changed) console.log(`${YELLOW}      ${line}${RESET}`);
+      } else if (pin.state === "first-seen") {
+        console.log(`${DIM}  image recorded on first use — no prior value to compare against${RESET}`);
+      } else {
+        console.log(`${DIM}  image unchanged since ${pin.firstSeenAt ?? "first use"}${RESET}`);
+      }
+
+      for (const [name, value] of Object.entries({ ...measurements, ...identity })) {
+        if (value) console.log(`${DIM}    ${name.padEnd(12)} ${value}${RESET}`);
+      }
+      if (enclave.repoCommit) {
+        console.log(`${DIM}  declares source ${enclave.repoUrl ?? "?"} @ ${enclave.repoCommit}${RESET}`);
+        console.log(`${DIM}    (self-declared — the quote does not prove this binary came from that commit)${RESET}`);
+      }
+      if (enclave.downstreamDomain) {
+        console.log(`${DIM}  forwards to ${enclave.downstreamDomain} — a separate trust domain we do not attest${RESET}`);
+      }
+    }
   }
 
   async function remoteAccess(on: boolean) {