privateer-agent 0.12.14 → 0.12.16

package/README.md

@@ -296,6 +296,20 @@ skipped entirely on an attested TEE or on-device channel, which provably can't r
 prompt anyway. It's best-effort structured-PII detection, labeled as such — a safety net, not
 a guarantee.
 
+Pattern detection fires on anything email-*shaped*, so some of what it finds isn't personal
+data at all. **`/privacy allow <value>`** is where you say so — an address
+(`me@acme.com`), a domain (`@acme.com`), an IPv4 block (`10.0.0.0/8`), or any exact or
+globbed value. Entries live in `privacy.piiAllow` in `~/.privateer/config.json`, apply from
+the next turn (no relaunch), and persist across sessions; `/privacy` on its own lists them
+and `/privacy unallow <value>` puts one back under the gate. Reserved shapes —
+`example.com`, loopback, `noreply@…`, `@users.noreply.github.com` — are allowed out of the
+box. `PI_PRIVACY_*` env vars and a `pi-privacy.config.json` are honoured too (a
+project-local file can only ever make the gate *stricter*).
+
+Under **no quarter** the gate doesn't ask — there's nobody to ask — so it redacts and sends,
+and prints what it masked. That's the one case where a false positive changes what the model
+sees without you seeing it first, which is why the notice tells you `/privacy allow` exists.
+
 ## Privateer account (billed inference)
 
 Instead of bringing your own key, run **`/signin`** to sign into a Privateer account. Your
@@ -396,6 +410,12 @@ Download for [macOS](https://privateer.pro/download/mac) (Apple silicon),
 [macOS Intel](https://privateer.pro/download/mac-intel), or
 [Windows](https://privateer.pro/download/windows).
 
+Once it's installed, **`/desktop`** in the terminal brings it up — no Spotlight detour. It
+opens the app, not a copy of this conversation: the desktop hosts its own session, so pick
+the folder you were working in from **File ▸ Spawn Privateer at…** and it starts on the same
+model and connectors this terminal uses (the per-folder defaults live in `~/.privateer`,
+which both read).
+
 It's an early release and **not yet code-signed or notarized** — macOS will warn on first
 open. Routines and channels deliberately aren't hosted here: those belong to the always-on
 harbor, so background work still wants `privateer harbor install`.
@@ -640,6 +660,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 | `/extensions` | list loaded Pi extensions |
 | `/web-tools` | point `web_search`/`web_fetch` at a search provider of your own (signed in, they already work on your account) |
 | `/init` | scaffold a starter `PRIVATEER.md` in this directory |
+| `/desktop` | open the [desktop app](#desktop-app) — same login, same per-folder defaults |
 | `/update` · `/privateer` | update to the latest release / Privateer status and posture |
 
 Shell subcommands: `privateer` (interactive), `privateer update`, `privateer harbor …`,

package/extensions/privateer-desktop.ts

@@ -0,0 +1,54 @@
+// /desktop — bring up the Privateer desktop app from the terminal.
+//
+// The two front ends already share everything that matters: one ~/.privateer home,
+// so one login, one model config, one MCP catalog, one set of per-folder spawn
+// defaults. What was missing was a way across. Getting from a terminal to the app
+// meant leaving the terminal — Spotlight, the Dock, a Start-menu hunt — which is
+// exactly the kind of small friction that leaves a shipped app unopened.
+//
+// What it does NOT do is carry the conversation over: the desktop hosts its own
+// in-process session and takes no folder argument (see src/config/desktopApp.ts),
+// so this opens the app and says how to point a window at the folder you were just
+// working in. When the app isn't installed we say so once, with the download page
+// for this platform, and never again unasked — the working-line tip in
+// privateer-hints.ts only fires on a machine that HAS it.
+
+import {
+  desktopAppPath,
+  desktopDownloadAltUrl,
+  desktopDownloadUrl,
+  openDesktopApp,
+} from "../src/config/desktopApp.ts";
+
+export default function privateerDesktop(pi: any): void {
+  pi.registerCommand?.("desktop", {
+    description: "Open the Privateer desktop app — same login, same per-folder defaults",
+    handler: (_args: string, ctx: any) => {
+      const app = desktopAppPath();
+
+      if (app) {
+        const cwd = process.cwd();
+        if (openDesktopApp(app)) {
+          ctx?.ui?.notify?.(
+            `Opening the Privateer desktop app — same login and per-folder defaults as this terminal. ` +
+              `File ▸ Spawn Privateer at… points a window at ${cwd}.`,
+            "info",
+          );
+        } else {
+          ctx?.ui?.notify?.(`Could not launch ${app} — open it yourself and this terminal keeps working.`, "error");
+        }
+        return;
+      }
+
+      const url = desktopDownloadUrl();
+      const alt = desktopDownloadAltUrl(); // the other Mac build — see desktopApp.ts
+      ctx?.ui?.notify?.(
+        url
+          ? `The Privateer desktop app isn't installed here. Download: ${url}${alt ? ` (other Macs: ${alt})` : ""} — ` +
+              `it reads the same ~/.privateer, so it starts already signed in with your models and connectors.`
+          : `The desktop app ships for macOS and Windows only — on this platform the terminal agent is the app.`,
+        "info",
+      );
+    },
+  });
+}

package/extensions/privateer-gate.ts

@@ -21,6 +21,7 @@ import {
 } from "../src/remote/subagentRelay.ts";
 import { RelayClient } from "../src/remote/relayClient.ts";
 import { makeSendFileTool } from "../src/tools/sendFile.ts";
+import { makeSaveCargoTool } from "../src/tools/cargo.ts";
 import { makeSaveAttachmentTool } from "../src/tools/saveAttachment.ts";
 import { AttachmentStore, type StoredAttachment } from "../src/util/attachmentStore.ts";
 import { makeExtensionsControl } from "../src/remote/extensionsControl.ts";
@@ -474,6 +475,11 @@ export default function privateerControl(pi: any): void {
   // driving. The daemon no longer loads this file, so there is nothing to shadow.
   pi.registerTool?.(makeSendFileTool(bridge));
   pi.registerTool?.(makeSaveAttachmentTool(attachments));
+  // save_cargo belongs with them: it is the same bridge, the same "needs a connected
+  // app" precondition, and the same failure mode if it were registered anywhere the
+  // relay isn't this file's. Unlike the pair it hands the app PLAINTEXT to encrypt —
+  // the terminal has no master key, so the round trip is the feature (cargoSave.ts).
+  pi.registerTool?.(makeSaveCargoTool(bridge));
 
   // Subagents (and print/rpc) run as headless child `pi` processes with no UI. There
   // no one can approve, so a "default" gate would fail-closed on every tool and the

package/extensions/privateer-hints.ts

@@ -25,6 +25,7 @@ import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { keyText } from "@earendil-works/pi-coding-agent";
 import { configPath, globalDir } from "../src/config/paths.ts";
+import { desktopAppPath } from "../src/config/desktopApp.ts";
 
 const FIRST_MS = 6_000; // a turn shorter than this never shows a tip
 const EVERY_MS = 12_000;
@@ -76,9 +77,28 @@ const HINTS: Array<() => string> = [
       ? `${k} is push-to-talk — /speak on reads the answer back`
       : `/talk types what you say — /speak on reads the answer back`;
   },
+  () => (haveDesktopApp() ? `/desktop opens the Privateer desktop app — same login, same folder defaults` : ""),
   () => `these tips are /hints — /hints off silences them`,
 ];
 
+// A hint returns "" when it doesn't apply to THIS machine, and the rotation skips
+// it. The desktop tip is the case that needs it: naming a command for an app the
+// user has is discoverability, advertising one they haven't is an ad. Memoised
+// because the rotation asks every 12 s and the answer is a stat() on a path that
+// doesn't change under a running terminal (installing the app mid-session is worth
+// a restart, not a filesystem poll).
+let desktopSeen: boolean | undefined;
+function haveDesktopApp(): boolean {
+  if (desktopSeen === undefined) {
+    try {
+      desktopSeen = desktopAppPath() !== null;
+    } catch {
+      desktopSeen = false;
+    }
+  }
+  return desktopSeen;
+}
+
 // Default ON: absent file, absent block, or unreadable JSON all mean enabled.
 // Only an explicit { hints: { enabled: false } } turns the rotation off.
 function hintsEnabled(): boolean {
@@ -119,9 +139,20 @@ export default function privateerHints(pi: any): void {
     if (restoreDefault) uiRef?.setWorkingMessage?.();
   };
 
+  // The next hint that applies here, advancing the cursor past any that opted out.
+  // Bounded by the list length, so an all-empty list ends the rotation instead of
+  // spinning through it forever.
+  const nextHint = (): string => {
+    for (let i = 0; i < HINTS.length; i++) {
+      const text = HINTS[cursor++ % HINTS.length]();
+      if (text) return text;
+    }
+    return "";
+  };
+
   const showNext = (): void => {
-    const hint = HINTS[cursor % HINTS.length]();
-    cursor++;
+    const hint = nextHint();
+    if (!hint) return; // nothing applies on this machine — leave "Working..." alone
     uiRef?.setWorkingMessage?.(`Working... · tip: ${hint}`);
     timer = setTimeout(showNext, EVERY_MS);
   };

package/extensions/privateer-privacy.ts

@@ -23,9 +23,8 @@
 // win regardless of the order pi discovers extensions in. This is purely a
 // display/resolution + routing list — posture and attestation are dispatcher-bound and
 // unaffected by the model set.
-import { makePiPrivacyExtension } from "pi-privacy";
 import { registerAccountModels } from "../src/providers/account.ts";
-import { sharedPrivacyOptions } from "../src/config/privacyPolicy.ts";
+import { privacyExtension } from "../src/config/privacyPolicy.ts";
 
 // Tinfoil's live chat models (inference.tinfoil.sh/v1/models), kimi-k2-6 first — the
 // launcher's default. Non-chat endpoints (embeddings, tts, whisper, websearch,
@@ -55,9 +54,10 @@ function tinfoilModel(id: string) {
 
 // One configuration, shared with the factory-built copy in src/config/moat.ts — the tier
 // resolver for the private ACCOUNT channel, the unattended/no-quarter handling, the ingest
-// policy. Adding an option HERE rather than there is how this file and the moat drifted
-// twice; src/config/privacyPolicy.ts records what that cost.
-const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
+// policy, the operator's PII allowlist and the `/privacy` command that maintains it.
+// Adding an option HERE rather than there is how this file and the moat drifted twice;
+// src/config/privacyPolicy.ts records what that cost.
+const privacy = privacyExtension();
 
 export default function privateerPrivacy(pi: any): void {
   privacy(pi);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.14",
+  "version": "0.12.16",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -81,7 +81,7 @@
     "@zed-industries/agent-client-protocol": "0.4.5",
     "patch-package": "8.0.1",
     "pi-mcp-adapter": "2.11.0",
-    "pi-privacy": "0.11.0",
+    "pi-privacy": "0.13.0",
     "pi-subagents": "0.34.0",
     "picomatch": "4.0.5",
     "privateer-speak": "0.2.2",

package/src/cli/chat.ts

@@ -14,6 +14,7 @@ import { cliPalette } from "../ui/palette.ts"; // no Pi deps → safe pre-boot
 import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts"; // no Pi deps → safe pre-boot
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 import { createUIContext } from "../ext/headlessUi.ts"; // no Pi deps → safe pre-boot
+import { canOpenBrowser, openInBrowser } from "../util/openBrowser.ts"; // node:child_process only → safe pre-boot
 
 // This lean REPL has no Pi TUI (and so no Theme), so it detects the terminal background
 // itself (COLORFGBG) and picks a palette — on a light terminal the standard "\x1b[33m"
@@ -47,6 +48,7 @@ async function main() {
     persistAccountCredential,
     dropPersistedAccountCredential,
     ensureAccountArmed,
+    verificationLink,
   } = await import("../providers/account.ts");
   const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
   const { agentVersion } = await import("../config/version.ts");
@@ -637,9 +639,24 @@ async function main() {
     try {
       const user = await priv.runDeviceLogin({
         onCode: (code: any) => {
-          console.log(`\n${CYAN}Approve this terminal in the Privateer app:${RESET}`);
-          console.log(`  code: ${YELLOW}${code.user_code}${RESET}`);
-          if (code.verification_uri_complete) console.log(`  or open: ${DIM}${code.verification_uri_complete}${RESET}`);
+          // Browser-first, the same deal the TUI's /login widget makes: the URL carries
+          // the code, so the page lands straight on Authorize and the user clicks
+          // rather than types. verificationLink makes the server's scheme-less value
+          // absolute; canOpenBrowser decides the wording SYNCHRONOUSLY (SSH or a
+          // headless box keeps the old app-approve copy, because a launcher there
+          // would open on the wrong machine); and the link is printed either way, so
+          // an open that silently fails costs nothing.
+          const uri = verificationLink(code.verification_uri_complete ?? code.verification_uri);
+          const opening = Boolean(uri) && canOpenBrowser();
+          if (opening) void openInBrowser(uri);
+          console.log(
+            opening
+              ? `\n${CYAN}Authorize this terminal in the browser window that just opened:${RESET}`
+              : `\n${CYAN}Approve this terminal in the Privateer app:${RESET}`,
+          );
+          const match = opening ? `${DIM} — check it matches the one in your browser${RESET}` : "";
+          console.log(`  code: ${YELLOW}${code.user_code}${RESET}${match}`);
+          if (uri) console.log(`  ${opening ? "no browser? open" : "or open"}: ${DIM}${uri}${RESET}`);
           console.log(`${DIM}  waiting for approval…${RESET}`);
         },
       });

package/src/config/desktopApp.ts

@@ -0,0 +1,138 @@
+// Where the Privateer DESKTOP app lives on this machine, and how to bring it up.
+//
+// The desktop app and this terminal are two front ends over one home: both read
+// ~/.privateer, so they share the account login, the model config, the MCP catalog
+// and the per-folder spawn defaults (config/spawns.ts). That makes "open the app"
+// a genuinely useful thing for a terminal to offer — nothing is handed over, the
+// state is already common — which is what /desktop (extensions/privateer-desktop.ts)
+// does, and what the working-line tip in privateer-hints.ts points at.
+//
+// WHY DETECTION AND NOT JUST A DOWNLOAD LINK. A tip that advertises software the
+// user hasn't got is an ad; one that names a command for software they HAVE is
+// discoverability. So both consumers ask this module first, and the hint stays
+// silent on a machine with no app installed.
+//
+// NO FOLDER HANDOFF. The app takes no path argument today — its second-instance
+// handler just focuses the running window (desktop/src/main/main.mjs) — so /desktop
+// opens the app, and the user picks this folder from File ▸ Spawn Privateer at…,
+// where the spawn record this terminal already shares makes it start on the same
+// model and connectors. If the app ever learns a folder argv, this is the one place
+// that has to change.
+//
+// IMPORT-SAFETY: node builtins only, no Pi imports, no side effects — safe from an
+// extension under jiti and from a pre-boot entry alike.
+
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+
+/** Per-platform download pages (README ▸ Desktop app). No Linux build exists. */
+const DOWNLOAD_MAC = "https://privateer.pro/download/mac";
+const DOWNLOAD_MAC_INTEL = "https://privateer.pro/download/mac-intel";
+const DOWNLOAD_WINDOWS = "https://privateer.pro/download/windows";
+
+/**
+ * The download page to lead with on THIS machine, or null where we ship no desktop
+ * build. macOS is split by CPU family — the arm64 dmg won't run on an Intel Mac —
+ * and process.arch is the interpreter's answer, not the machine's: an Apple-silicon
+ * Mac running a Rosetta node reports x64 and would be led to the Intel build. That
+ * is survivable rather than solved (detecting the translation means shelling out to
+ * `sysctl sysctl.proc_translated` for one link) because the OTHER build is offered
+ * alongside it — see desktopDownloadAltUrl.
+ */
+export function desktopDownloadUrl(
+  platform: NodeJS.Platform = process.platform,
+  arch: string = process.arch,
+): string | null {
+  if (platform === "darwin") return arch === "x64" ? DOWNLOAD_MAC_INTEL : DOWNLOAD_MAC;
+  if (platform === "win32") return DOWNLOAD_WINDOWS;
+  return null; // electron-builder.yml targets mac + win only
+}
+
+/**
+ * The macOS build for the OTHER CPU family, so a Mac user is never one wrong arch
+ * away from a download that won't launch. Null everywhere else: Windows ships one
+ * x64 installer and there is no Linux build at all.
+ */
+export function desktopDownloadAltUrl(
+  platform: NodeJS.Platform = process.platform,
+  arch: string = process.arch,
+): string | null {
+  if (platform !== "darwin") return null;
+  return arch === "x64" ? DOWNLOAD_MAC : DOWNLOAD_MAC_INTEL;
+}
+
+/**
+ * The installed app, or null. Ordered by confidence:
+ *
+ *  1. OUR OWN interpreter, when the terminal is running on the app's bundled Node.
+ *     The desktop's CLI shim runs `privateer` through the app binary itself with
+ *     ELECTRON_RUN_AS_NODE=1 (desktop/src/main/cliShim.mjs), so process.execPath IS
+ *     the app — and it's the copy the user actually installed, wherever they put it.
+ *  2. The standard install locations. macOS drag-install goes to /Applications or
+ *     ~/Applications; the Windows installer is per-user NSIS (perMachine: false) so
+ *     %LOCALAPPDATA%\Programs\Privateer is the default, with Program Files covered
+ *     for an install that chose it (allowToChangeInstallationDirectory: true).
+ *
+ * A user who installed somewhere else entirely reads as "not installed" — which
+ * costs them a download link they don't need, and never a wrong app launched.
+ */
+export function desktopAppPath(
+  platform: NodeJS.Platform = process.platform,
+  env: Record<string, string | undefined> = process.env,
+  execPath: string = process.execPath,
+): string | null {
+  const hit = (p: string): string | null => (p && existsSync(p) ? p : null);
+
+  if (platform === "darwin") {
+    // …/Privateer.app/Contents/MacOS/Privateer → …/Privateer.app
+    const marker = "/Privateer.app/";
+    const at = execPath.indexOf(marker);
+    if (at >= 0) {
+      const bundle = hit(execPath.slice(0, at + marker.length - 1));
+      if (bundle) return bundle;
+    }
+    return hit("/Applications/Privateer.app") ?? hit(join(homedir(), "Applications", "Privateer.app"));
+  }
+
+  if (platform === "win32") {
+    if (/^privateer\.exe$/i.test(basename(execPath))) {
+      const self = hit(execPath);
+      if (self) return self;
+    }
+    const local = env.LOCALAPPDATA;
+    const files = env.ProgramFiles;
+    return (
+      (local ? hit(join(local, "Programs", "Privateer", "Privateer.exe")) : null) ??
+      (files ? hit(join(files, "Privateer", "Privateer.exe")) : null)
+    );
+  }
+
+  return null;
+}
+
+/**
+ * Launch (or focus) the desktop app. Best-effort and never throws — the caller
+ * reports the failure as text, the way openBrowser.ts does.
+ *
+ * ELECTRON_RUN_AS_NODE IS STRIPPED, and that is load-bearing rather than tidy: when
+ * this terminal was itself started by the desktop's CLI shim, that variable is set
+ * in our environment, and a child inheriting it starts the app binary as a bare Node
+ * that exits without ever drawing a window. `open` goes through LaunchServices and
+ * wouldn't pass it on anyway; the Windows path spawns the exe directly and would.
+ */
+export function openDesktopApp(appPath: string, platform: NodeJS.Platform = process.platform): boolean {
+  const { ELECTRON_RUN_AS_NODE: _drop, ...env } = process.env;
+  try {
+    const child =
+      platform === "darwin"
+        ? spawn("open", ["-a", appPath], { detached: true, stdio: "ignore", env })
+        : spawn(appPath, [], { detached: true, stdio: "ignore", env });
+    child.on("error", () => {}); // a spawn failure must not raise on the event loop
+    child.unref(); // never hold the CLI's exit open
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/config/moat.ts

@@ -34,6 +34,7 @@ import { basename } from "node:path";
 import { managedNames } from "./moatManifest.ts";
 import type { GateController } from "../ext/permissionGate.ts";
 import type { SendFileBridge } from "../tools/sendFile.ts";
+import type { CargoSaveBridge } from "../tools/cargo.ts";
 import type { AttachmentStore } from "../util/attachmentStore.ts";
 
 /** A Pi extension factory, as DefaultResourceLoader takes them. */
@@ -61,7 +62,7 @@ export interface MoatOptions {
    * its module-level bridge and stands them down inside the daemon, so a live spawn's own
    * pair is what the model gets (see tools/relayFileTools.ts).
    */
-  relayFiles?: { bridge: SendFileBridge; attachments: AttachmentStore };
+  relayFiles?: { bridge: SendFileBridge & CargoSaveBridge; attachments: AttachmentStore };
   /**
    * THIS run's inbox-attachment staging area (routines/resultMedia.ts). Passed only by
    * a path whose result reaches the app's Inbox — a scheduled routine, a submitted
@@ -176,17 +177,16 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
   if (!caps) throw new Error(`buildMoat: unknown kind "${opts.kind}"`);
 
   const { makePermissionGate } = await import("../ext/permissionGate.ts");
-  const { makePiPrivacyExtension } = await import("pi-privacy");
   const { makeAccountProvider } = await import("../providers/account.ts");
   const { webEnabled, mediaEnabled } = await import("./hosted.ts");
-  const { sharedPrivacyOptions } = await import("./privacyPolicy.ts");
+  const { privacyExtension } = await import("./privacyPolicy.ts");
 
   const factories: ExtensionFactory[] = [makePermissionGate(opts.gate)];
 
   // pi-privacy is configured in exactly ONE place, shared with the DISCOVERED copy of this
   // extension (the TUI's, and every subagent child's) — see ./privacyPolicy.ts for the two
   // bugs that came of configuring it in two.
-  factories.push(makePiPrivacyExtension(sharedPrivacyOptions()));
+  factories.push(privacyExtension());
   factories.push(makeAccountProvider()); // must follow pi-privacy — see header
 
   if (opts.relayFiles) {

package/src/config/moatManifest.json

@@ -11,6 +11,7 @@
     { "name": "privateer-privacy", "entry": "extensions/privateer-privacy.ts", "note": "pi-privacy + account tier resolver" },
     { "name": "privateer-connect", "entry": "extensions/privateer-connect.ts", "note": "/connect — MCP connector manager" },
     { "name": "privateer-media", "entry": "extensions/privateer-media.ts", "note": "image/video/speech/music + ffmpeg compose" },
+    { "name": "privateer-desktop", "entry": "extensions/privateer-desktop.ts", "note": "/desktop — open the Privateer desktop app" },
     { "name": "privateer-hints", "entry": "extensions/privateer-hints.ts", "note": "rotating tips in the working line + /hints" },
     { "name": "privateer-update", "entry": "extensions/privateer-update.ts", "note": "tool pack updates in place — banner flag + /update" },
     { "name": "privateer-speak", "entry": "extensions/privateer-speak.ts", "note": "spoken responses (/speak) + voice input (/talk) — pi-speak + confidential account TTS/STT" },

package/src/config/piiAllow.ts

@@ -0,0 +1,117 @@
+// The PII allowlist the OPERATOR controls — "that string is not personal data, stop
+// masking it."
+//
+// WHY THIS EXISTS. pi-privacy's detection is pattern-based and honest about it: it fires
+// on anything email-SHAPED or address-SHAPED. It refuses the shapes that are impossible
+// for a type (see its precision guards), but plenty of real-world strings are genuinely
+// ambiguous — a bare `8.0.0.0` is a version quad AND a valid address, an internal
+// hostname list is a list of addresses, a fixture mailbox is an address nobody reads. For
+// those the only correct answer comes from the person, and until now Privateer gave them
+// nowhere to put it: sharedPrivacyOptions() hand-built pi-privacy's options and never
+// called its config loader, so `PI_PRIVACY_PII_ALLOW` and pi-privacy.config.json were
+// silently ignored in every Privateer session. The only lever was "Send + remember for
+// session", which is all-or-nothing and forgotten at exit.
+//
+// This matters more since the gate learned to answer itself: under no quarter the
+// question is swallowed and the payload is auto-redacted, so a false positive is no
+// longer a prompt you dismiss — it is a silent rewrite the model then reads.
+//
+// WHERE IT LIVES. `privacy.piiAllow` in ~/.privateer/config.json (the same file the
+// harbor, channels and webhooks read). Entry forms are pi-privacy's — `me@acme.com`
+// (exact, `*` globs), `@acme.com` (that domain and its subdomains), `10.0.0.0/8` (an
+// IPv4 block), or any exact/globbed value.
+//
+// LIVE, NOT LATCHED. entries() is handed to pi-privacy as a function, so `/privacy allow
+// …` applies on the next turn instead of the next launch. It is called once per matched
+// value during a scan, so it must stay cheap: the JSON is re-parsed only when the file
+// changes (stamp = mtime + size), which leaves a stat per call and nothing else. An edit
+// made in an editor is picked up on the next scan, exactly like one made through the
+// command — there is no "restart to apply" step to explain.
+
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { configPath } from "./paths.ts";
+
+let cached: string[] = [];
+let cachedStamp = "";
+
+function parse(raw: unknown): string[] {
+  const list = (raw as any)?.privacy?.piiAllow;
+  if (!Array.isArray(list)) return [];
+  return list.filter((e): e is string => typeof e === "string" && e.trim() !== "").map((e) => e.trim());
+}
+
+/**
+ * The operator's allowlist, live. Missing file, unreadable file and malformed JSON all
+ * mean "no entries" — a config typo must not take the PII gate down with it, and the
+ * gate erring toward MORE detection is the safe direction.
+ */
+export function piiAllowEntries(): readonly string[] {
+  try {
+    const st = statSync(configPath());
+    const stamp = `${st.mtimeMs}:${st.size}`;
+    if (stamp === cachedStamp) return cached;
+    cachedStamp = stamp;
+    cached = parse(JSON.parse(readFileSync(configPath(), "utf8")));
+  } catch {
+    cachedStamp = "";
+    cached = [];
+  }
+  return cached;
+}
+
+/** Drop the cache — after our own write, so the stamp is never mistaken for unchanged. */
+function invalidate(): void {
+  cachedStamp = "";
+}
+
+// A bare `*` allows every value of every type: that is `piiPolicy: off` wearing a
+// different hat, and pi-privacy refuses it at compile time anyway. Refusing it HERE means
+// the person who typed it is told, rather than watching an entry land in their config and
+// do nothing.
+function invalidReason(entry: string): string | undefined {
+  if (!entry) return "an empty entry matches nothing";
+  if (/^\*+$/.test(entry)) return "a bare `*` would allowlist everything — turn the gate off explicitly if that's what you mean";
+  return undefined;
+}
+
+export interface AllowEdit {
+  ok: boolean;
+  /** Why it was refused, or what already stood. Always safe to show the user. */
+  message: string;
+  entries: readonly string[];
+}
+
+function write(entries: string[]): void {
+  let cfg: Record<string, unknown> = {};
+  try {
+    cfg = JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    /* new or unreadable — a fresh object, so one bad file doesn't lose the edit */
+  }
+  const privacy = { ...((cfg.privacy as Record<string, unknown>) ?? {}), piiAllow: entries };
+  writeFileSync(configPath(), JSON.stringify({ ...cfg, privacy }, null, 2) + "\n");
+  invalidate();
+}
+
+/** Add one entry. Idempotent — adding what's already there is reported, not duplicated. */
+export function addPiiAllow(raw: string): AllowEdit {
+  const entry = raw.trim();
+  const bad = invalidReason(entry);
+  if (bad) return { ok: false, message: bad, entries: piiAllowEntries() };
+  const entries = [...piiAllowEntries()];
+  if (entries.includes(entry)) return { ok: true, message: `${entry} is already allowlisted`, entries };
+  entries.push(entry);
+  write(entries);
+  return { ok: true, message: `${entry} is no longer treated as PII in this and future sessions`, entries };
+}
+
+/** Remove one entry, exactly as written. */
+export function removePiiAllow(raw: string): AllowEdit {
+  const entry = raw.trim();
+  const entries = [...piiAllowEntries()];
+  const i = entries.indexOf(entry);
+  if (i < 0) return { ok: false, message: `${entry || "(empty)"} is not in the allowlist`, entries };
+  entries.splice(i, 1);
+  write(entries);
+  return { ok: true, message: `${entry} is gated again`, entries };
+}