privateer-agent 0.12.15 → 0.12.17

package/README.md

@@ -296,6 +296,20 @@ skipped entirely on an attested TEE or on-device channel, which provably can't r
 prompt anyway. It's best-effort structured-PII detection, labeled as such — a safety net, not
 a guarantee.
 
+Pattern detection fires on anything email-*shaped*, so some of what it finds isn't personal
+data at all. **`/privacy allow <value>`** is where you say so — an address
+(`me@acme.com`), a domain (`@acme.com`), an IPv4 block (`10.0.0.0/8`), or any exact or
+globbed value. Entries live in `privacy.piiAllow` in `~/.privateer/config.json`, apply from
+the next turn (no relaunch), and persist across sessions; `/privacy` on its own lists them
+and `/privacy unallow <value>` puts one back under the gate. Reserved shapes —
+`example.com`, loopback, `noreply@…`, `@users.noreply.github.com` — are allowed out of the
+box. `PI_PRIVACY_*` env vars and a `pi-privacy.config.json` are honoured too (a
+project-local file can only ever make the gate *stricter*).
+
+Under **no quarter** the gate doesn't ask — there's nobody to ask — so it redacts and sends,
+and prints what it masked. That's the one case where a false positive changes what the model
+sees without you seeing it first, which is why the notice tells you `/privacy allow` exists.
+
 ## Privateer account (billed inference)
 
 Instead of bringing your own key, run **`/signin`** to sign into a Privateer account. Your

package/extensions/privateer-gate.ts

@@ -21,6 +21,8 @@ import {
 } from "../src/remote/subagentRelay.ts";
 import { RelayClient } from "../src/remote/relayClient.ts";
 import { makeSendFileTool } from "../src/tools/sendFile.ts";
+import { makeSaveCargoTool } from "../src/tools/cargo.ts";
+import { makeChartTools } from "../src/tools/charts.ts";
 import { makeSaveAttachmentTool } from "../src/tools/saveAttachment.ts";
 import { AttachmentStore, type StoredAttachment } from "../src/util/attachmentStore.ts";
 import { makeExtensionsControl } from "../src/remote/extensionsControl.ts";
@@ -474,6 +476,17 @@ export default function privateerControl(pi: any): void {
   // driving. The daemon no longer loads this file, so there is nothing to shadow.
   pi.registerTool?.(makeSendFileTool(bridge));
   pi.registerTool?.(makeSaveAttachmentTool(attachments));
+  // save_cargo belongs with them: it is the same bridge, the same "needs a connected
+  // app" precondition, and the same failure mode if it were registered anywhere the
+  // relay isn't this file's. Unlike the pair it hands the app PLAINTEXT to encrypt —
+  // the terminal has no master key, so the round trip is the feature (cargoSave.ts).
+  pi.registerTool?.(makeSaveCargoTool(bridge));
+  // The chart tools, for the same reasons and one more. Same: this bridge, the same
+  // "needs a connected app" precondition, the same plaintext-out/app-encrypts round trip
+  // (chartOps.ts). More: they also READ the user's stored content back, so registering
+  // them anywhere the relay isn't this file's would mean a session asking for decrypted
+  // charts over a relay nobody is driving.
+  for (const tool of makeChartTools(bridge)) pi.registerTool?.(tool);
 
   // Subagents (and print/rpc) run as headless child `pi` processes with no UI. There
   // no one can approve, so a "default" gate would fail-closed on every tool and the

package/extensions/privateer-privacy.ts

@@ -23,9 +23,8 @@
 // win regardless of the order pi discovers extensions in. This is purely a
 // display/resolution + routing list — posture and attestation are dispatcher-bound and
 // unaffected by the model set.
-import { makePiPrivacyExtension } from "pi-privacy";
 import { registerAccountModels } from "../src/providers/account.ts";
-import { sharedPrivacyOptions } from "../src/config/privacyPolicy.ts";
+import { privacyExtension } from "../src/config/privacyPolicy.ts";
 
 // Tinfoil's live chat models (inference.tinfoil.sh/v1/models), kimi-k2-6 first — the
 // launcher's default. Non-chat endpoints (embeddings, tts, whisper, websearch,
@@ -55,9 +54,10 @@ function tinfoilModel(id: string) {
 
 // One configuration, shared with the factory-built copy in src/config/moat.ts — the tier
 // resolver for the private ACCOUNT channel, the unattended/no-quarter handling, the ingest
-// policy. Adding an option HERE rather than there is how this file and the moat drifted
-// twice; src/config/privacyPolicy.ts records what that cost.
-const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
+// policy, the operator's PII allowlist and the `/privacy` command that maintains it.
+// Adding an option HERE rather than there is how this file and the moat drifted twice;
+// src/config/privacyPolicy.ts records what that cost.
+const privacy = privacyExtension();
 
 export default function privateerPrivacy(pi: any): void {
   privacy(pi);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.15",
+  "version": "0.12.17",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -81,7 +81,7 @@
     "@zed-industries/agent-client-protocol": "0.4.5",
     "patch-package": "8.0.1",
     "pi-mcp-adapter": "2.11.0",
-    "pi-privacy": "0.11.0",
+    "pi-privacy": "0.13.0",
     "pi-subagents": "0.34.0",
     "picomatch": "4.0.5",
     "privateer-speak": "0.2.2",

package/src/cli/chat.ts

@@ -14,6 +14,7 @@ import { cliPalette } from "../ui/palette.ts"; // no Pi deps → safe pre-boot
 import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts"; // no Pi deps → safe pre-boot
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 import { createUIContext } from "../ext/headlessUi.ts"; // no Pi deps → safe pre-boot
+import { canOpenBrowser, openInBrowser } from "../util/openBrowser.ts"; // node:child_process only → safe pre-boot
 
 // This lean REPL has no Pi TUI (and so no Theme), so it detects the terminal background
 // itself (COLORFGBG) and picks a palette — on a light terminal the standard "\x1b[33m"
@@ -47,6 +48,7 @@ async function main() {
     persistAccountCredential,
     dropPersistedAccountCredential,
     ensureAccountArmed,
+    verificationLink,
   } = await import("../providers/account.ts");
   const { modelRegistryOf } = await import("../providers/piAuthStore.ts");
   const { agentVersion } = await import("../config/version.ts");
@@ -637,9 +639,24 @@ async function main() {
     try {
       const user = await priv.runDeviceLogin({
         onCode: (code: any) => {
-          console.log(`\n${CYAN}Approve this terminal in the Privateer app:${RESET}`);
-          console.log(`  code: ${YELLOW}${code.user_code}${RESET}`);
-          if (code.verification_uri_complete) console.log(`  or open: ${DIM}${code.verification_uri_complete}${RESET}`);
+          // Browser-first, the same deal the TUI's /login widget makes: the URL carries
+          // the code, so the page lands straight on Authorize and the user clicks
+          // rather than types. verificationLink makes the server's scheme-less value
+          // absolute; canOpenBrowser decides the wording SYNCHRONOUSLY (SSH or a
+          // headless box keeps the old app-approve copy, because a launcher there
+          // would open on the wrong machine); and the link is printed either way, so
+          // an open that silently fails costs nothing.
+          const uri = verificationLink(code.verification_uri_complete ?? code.verification_uri);
+          const opening = Boolean(uri) && canOpenBrowser();
+          if (opening) void openInBrowser(uri);
+          console.log(
+            opening
+              ? `\n${CYAN}Authorize this terminal in the browser window that just opened:${RESET}`
+              : `\n${CYAN}Approve this terminal in the Privateer app:${RESET}`,
+          );
+          const match = opening ? `${DIM} — check it matches the one in your browser${RESET}` : "";
+          console.log(`  code: ${YELLOW}${code.user_code}${RESET}${match}`);
+          if (uri) console.log(`  ${opening ? "no browser? open" : "or open"}: ${DIM}${uri}${RESET}`);
           console.log(`${DIM}  waiting for approval…${RESET}`);
         },
       });

package/src/config/moat.ts

@@ -34,6 +34,8 @@ import { basename } from "node:path";
 import { managedNames } from "./moatManifest.ts";
 import type { GateController } from "../ext/permissionGate.ts";
 import type { SendFileBridge } from "../tools/sendFile.ts";
+import type { CargoSaveBridge } from "../tools/cargo.ts";
+import type { ChartOpBridge } from "../tools/charts.ts";
 import type { AttachmentStore } from "../util/attachmentStore.ts";
 
 /** A Pi extension factory, as DefaultResourceLoader takes them. */
@@ -61,7 +63,7 @@ export interface MoatOptions {
    * its module-level bridge and stands them down inside the daemon, so a live spawn's own
    * pair is what the model gets (see tools/relayFileTools.ts).
    */
-  relayFiles?: { bridge: SendFileBridge; attachments: AttachmentStore };
+  relayFiles?: { bridge: SendFileBridge & CargoSaveBridge & ChartOpBridge; attachments: AttachmentStore };
   /**
    * THIS run's inbox-attachment staging area (routines/resultMedia.ts). Passed only by
    * a path whose result reaches the app's Inbox — a scheduled routine, a submitted
@@ -176,17 +178,16 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
   if (!caps) throw new Error(`buildMoat: unknown kind "${opts.kind}"`);
 
   const { makePermissionGate } = await import("../ext/permissionGate.ts");
-  const { makePiPrivacyExtension } = await import("pi-privacy");
   const { makeAccountProvider } = await import("../providers/account.ts");
   const { webEnabled, mediaEnabled } = await import("./hosted.ts");
-  const { sharedPrivacyOptions } = await import("./privacyPolicy.ts");
+  const { privacyExtension } = await import("./privacyPolicy.ts");
 
   const factories: ExtensionFactory[] = [makePermissionGate(opts.gate)];
 
   // pi-privacy is configured in exactly ONE place, shared with the DISCOVERED copy of this
   // extension (the TUI's, and every subagent child's) — see ./privacyPolicy.ts for the two
   // bugs that came of configuring it in two.
-  factories.push(makePiPrivacyExtension(sharedPrivacyOptions()));
+  factories.push(privacyExtension());
   factories.push(makeAccountProvider()); // must follow pi-privacy — see header
 
   if (opts.relayFiles) {

package/src/config/piiAllow.ts

@@ -0,0 +1,117 @@
+// The PII allowlist the OPERATOR controls — "that string is not personal data, stop
+// masking it."
+//
+// WHY THIS EXISTS. pi-privacy's detection is pattern-based and honest about it: it fires
+// on anything email-SHAPED or address-SHAPED. It refuses the shapes that are impossible
+// for a type (see its precision guards), but plenty of real-world strings are genuinely
+// ambiguous — a bare `8.0.0.0` is a version quad AND a valid address, an internal
+// hostname list is a list of addresses, a fixture mailbox is an address nobody reads. For
+// those the only correct answer comes from the person, and until now Privateer gave them
+// nowhere to put it: sharedPrivacyOptions() hand-built pi-privacy's options and never
+// called its config loader, so `PI_PRIVACY_PII_ALLOW` and pi-privacy.config.json were
+// silently ignored in every Privateer session. The only lever was "Send + remember for
+// session", which is all-or-nothing and forgotten at exit.
+//
+// This matters more since the gate learned to answer itself: under no quarter the
+// question is swallowed and the payload is auto-redacted, so a false positive is no
+// longer a prompt you dismiss — it is a silent rewrite the model then reads.
+//
+// WHERE IT LIVES. `privacy.piiAllow` in ~/.privateer/config.json (the same file the
+// harbor, channels and webhooks read). Entry forms are pi-privacy's — `me@acme.com`
+// (exact, `*` globs), `@acme.com` (that domain and its subdomains), `10.0.0.0/8` (an
+// IPv4 block), or any exact/globbed value.
+//
+// LIVE, NOT LATCHED. entries() is handed to pi-privacy as a function, so `/privacy allow
+// …` applies on the next turn instead of the next launch. It is called once per matched
+// value during a scan, so it must stay cheap: the JSON is re-parsed only when the file
+// changes (stamp = mtime + size), which leaves a stat per call and nothing else. An edit
+// made in an editor is picked up on the next scan, exactly like one made through the
+// command — there is no "restart to apply" step to explain.
+
+import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { configPath } from "./paths.ts";
+
+let cached: string[] = [];
+let cachedStamp = "";
+
+function parse(raw: unknown): string[] {
+  const list = (raw as any)?.privacy?.piiAllow;
+  if (!Array.isArray(list)) return [];
+  return list.filter((e): e is string => typeof e === "string" && e.trim() !== "").map((e) => e.trim());
+}
+
+/**
+ * The operator's allowlist, live. Missing file, unreadable file and malformed JSON all
+ * mean "no entries" — a config typo must not take the PII gate down with it, and the
+ * gate erring toward MORE detection is the safe direction.
+ */
+export function piiAllowEntries(): readonly string[] {
+  try {
+    const st = statSync(configPath());
+    const stamp = `${st.mtimeMs}:${st.size}`;
+    if (stamp === cachedStamp) return cached;
+    cachedStamp = stamp;
+    cached = parse(JSON.parse(readFileSync(configPath(), "utf8")));
+  } catch {
+    cachedStamp = "";
+    cached = [];
+  }
+  return cached;
+}
+
+/** Drop the cache — after our own write, so the stamp is never mistaken for unchanged. */
+function invalidate(): void {
+  cachedStamp = "";
+}
+
+// A bare `*` allows every value of every type: that is `piiPolicy: off` wearing a
+// different hat, and pi-privacy refuses it at compile time anyway. Refusing it HERE means
+// the person who typed it is told, rather than watching an entry land in their config and
+// do nothing.
+function invalidReason(entry: string): string | undefined {
+  if (!entry) return "an empty entry matches nothing";
+  if (/^\*+$/.test(entry)) return "a bare `*` would allowlist everything — turn the gate off explicitly if that's what you mean";
+  return undefined;
+}
+
+export interface AllowEdit {
+  ok: boolean;
+  /** Why it was refused, or what already stood. Always safe to show the user. */
+  message: string;
+  entries: readonly string[];
+}
+
+function write(entries: string[]): void {
+  let cfg: Record<string, unknown> = {};
+  try {
+    cfg = JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    /* new or unreadable — a fresh object, so one bad file doesn't lose the edit */
+  }
+  const privacy = { ...((cfg.privacy as Record<string, unknown>) ?? {}), piiAllow: entries };
+  writeFileSync(configPath(), JSON.stringify({ ...cfg, privacy }, null, 2) + "\n");
+  invalidate();
+}
+
+/** Add one entry. Idempotent — adding what's already there is reported, not duplicated. */
+export function addPiiAllow(raw: string): AllowEdit {
+  const entry = raw.trim();
+  const bad = invalidReason(entry);
+  if (bad) return { ok: false, message: bad, entries: piiAllowEntries() };
+  const entries = [...piiAllowEntries()];
+  if (entries.includes(entry)) return { ok: true, message: `${entry} is already allowlisted`, entries };
+  entries.push(entry);
+  write(entries);
+  return { ok: true, message: `${entry} is no longer treated as PII in this and future sessions`, entries };
+}
+
+/** Remove one entry, exactly as written. */
+export function removePiiAllow(raw: string): AllowEdit {
+  const entry = raw.trim();
+  const entries = [...piiAllowEntries()];
+  const i = entries.indexOf(entry);
+  if (i < 0) return { ok: false, message: `${entry || "(empty)"} is not in the allowlist`, entries };
+  entries.splice(i, 1);
+  write(entries);
+  return { ok: true, message: `${entry} is gated again`, entries };
+}

package/src/config/privacyPolicy.ts

@@ -29,7 +29,9 @@
 // buildMoat(), exactly as it does every other Pi-touching import. Extensions load late
 // and import it statically.
 
+import { loadConfig, makePiPrivacyExtension } from "pi-privacy";
 import { noQuarterActive } from "../permissions/noQuarter.ts";
+import { addPiiAllow, piiAllowEntries, removePiiAllow } from "./piiAllow.ts";
 import { cliPalette, detectScheme } from "../ui/palette.ts";
 import { accountPosture, privateerChannel } from "../providers/account.ts";
 import { hasCredentials } from "../auth/privateer.ts";
@@ -38,15 +40,32 @@ import { hasCredentials } from "../auth/privateer.ts";
 // no-quarter flag (same glyph and color as the no-quarter banner in chat.ts and the gate
 // extension's status line), body in the accent color — distinct from a yellow warning and
 // from a red error, because this is neither: it's the answer we gave for you.
+// The tail is the point as much as the color is: unattended, nobody was asked, so the
+// only way to disagree with the answer is to know where to say so. `/privacy allow …`
+// is that place, and a notice about a masked filename is exactly when you want to know
+// it exists.
 function renderPiiAutoRedact(notice: string): string {
   const p = cliPalette(detectScheme());
   const body = notice.startsWith("⚑ ") ? notice.slice(2) : notice;
-  return `${p.RED}⚑${p.RESET} ${p.CYAN}${body}${p.RESET}`;
+  return `${p.RED}⚑${p.RESET} ${p.CYAN}${body}${p.RESET} ${p.DIM}· /privacy allow <value> if it shouldn't be masked${p.RESET}`;
 }
 
 /** The pi-privacy options every Privateer session gets, whichever route built it. */
 export function sharedPrivacyOptions() {
+  // pi-privacy's OWN configuration — PI_PRIVACY_* env vars and a pi-privacy.config.json.
+  // We used to build the options object by hand and never call this, so every one of
+  // those settings was silently ignored in Privateer and nowhere else: a user who set
+  // PI_PRIVACY_PII_ALLOW watched it do nothing. Ambient settings go UNDER ours, so the
+  // knobs Privateer has a product reason to hold (the tier resolver, the unattended
+  // signal, the account badge) are still ours, while the ones that are a matter of taste
+  // (piiPolicy, badge sinks, the exfil/downgrade policies) become settable.
+  //
+  // Safe against a repo you just opened: a project-local pi-privacy.config.json is
+  // clamped by pi-privacy itself — it may not weaken a policy below the built-in floor,
+  // and may not add allowlist entries at all.
+  const ambient = loadConfig();
   return {
+    ...ambient,
     // The account channel's real posture. pi-privacy ships a `privateer` provider, but it
     // is the PUBLIC developer-key channel (sk-priv-…, server-proxied and unverifiable
     // end-to-end), so from the package alone every privateer/* model floors to
@@ -92,6 +111,64 @@ export function sharedPrivacyOptions() {
     // unconditionally and each masks its own patterns, so the surviving content is the
     // same either way. Under "warn" the order WOULD matter, since it decides whether the
     // prompt is raised on a raw key or one we already masked.
-    toolResultPolicy: "redact" as const,
+    toolResultPolicy: ambient.toolResultPolicy ?? ("redact" as const),
+    // The operator's own "that is not personal data" list, read LIVE (see
+    // ./piiAllow.ts): `/privacy allow @acme.com` applies on the next turn, not the next
+    // launch. Ambient config entries come first — both lists are additive, since an
+    // allowlist can only ever remove detection and there is no sense in which one of
+    // them should silence the other.
+    piiAllow: () => [...(ambient.piiAllow ?? []), ...piiAllowEntries()],
+  };
+}
+
+// ── /privacy ─────────────────────────────────────────────────────────────────────────
+// The gate's escape hatch, at the point of complaint. Everything else about pi-privacy is
+// glanceable (the badge) or answerable in the moment (the prompt); the allowlist is the
+// only part that needs a place to live, and "edit ~/.privateer/config.json and relaunch"
+// is not a thing anyone does mid-task while the gate masks a filename in front of them.
+//
+// Registered from HERE rather than from the extension file, for the reason this module
+// exists at all: the factory-built sessions and the discovered extension must not drift.
+function registerPrivacyCommand(pi: any): void {
+  pi.registerCommand?.("privacy", {
+    description: "Values the PII gate must not treat as personal data: /privacy [allow <value> | unallow <value>]",
+    handler: (args: string, ctx: any) => {
+      const raw = String(args ?? "").trim();
+      const [verb, ...rest] = raw.split(/\s+/);
+      const value = rest.join(" ").trim();
+      const notify = (msg: string, level: "info" | "warning" = "info") => ctx?.ui?.notify?.(msg, level);
+
+      if (verb === "allow" || verb === "unallow") {
+        if (!value) return notify(`usage: /privacy ${verb} <value>`, "warning");
+        const r = verb === "allow" ? addPiiAllow(value) : removePiiAllow(value);
+        return notify(r.message, r.ok ? "info" : "warning");
+      }
+      if (verb) return notify(`unknown option "${verb}" — usage: /privacy [allow <value> | unallow <value>]`, "warning");
+
+      const mine = piiAllowEntries();
+      notify(
+        [
+          mine.length ? `PII allowlist (~/.privateer/config.json):\n  ${mine.join("\n  ")}` : "PII allowlist: empty",
+          "Reserved shapes (example.com, loopback, noreply@…) are allowed by default and not listed here.",
+          "Add one with /privacy allow <value> — an address (me@acme.com), a domain (@acme.com),",
+          "an IPv4 block (10.0.0.0/8), or any exact/globbed value.",
+        ].join("\n"),
+        "info",
+      );
+    },
+  });
+}
+
+/**
+ * The privacy half of the moat as ONE factory: pi-privacy configured the Privateer way,
+ * plus the `/privacy` command that maintains its allowlist. Both routes into pi-privacy
+ * (src/config/moat.ts and extensions/privateer-privacy.ts) use this, so neither can end
+ * up with the gate but not its escape hatch.
+ */
+export function privacyExtension() {
+  const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
+  return function privateerPrivacyCore(pi: any): void {
+    privacy(pi);
+    registerPrivacyCommand(pi);
   };
 }

package/src/permissions/classify.ts

@@ -270,6 +270,101 @@ export function classifyToolCall(
     };
   }
 
+  // save_cargo (src/tools/cargo.ts) — hand an artifact to the connected app, which
+  // encrypts it and stores it in the user's Cargo.
+  //
+  // Left to the unknown-tool branch this is bash-kind: a "Run save_cargo" prompt over a
+  // JSON blob, and an outright DENY in plan/readonly. Denying it there is the wrong call
+  // twice over — it writes nothing on this machine, and "show me this on my phone" is a
+  // reasonable thing to ask for while planning.
+  //
+  // Classified as a WRITE even though no local file changes, because that is what it is
+  // from the user's side: a new, persistent thing in their account, against their storage
+  // quota. Not alwaysAsk — unlike the generate_* tools it spends no credit, and unlike an
+  // ordinary egress the destination is the user's OWN device, encrypted there before it
+  // is stored, so there is no third party to leak to and nothing irreversible to stop.
+  //
+  // `outside` is about the SOURCE. The content is read off disk and shipped off-machine,
+  // so `path: "~/Documents/notes.md"` discloses a file from outside the working directory
+  // — the same disclosure the media tools flag on their inputs, and the reason `outside`
+  // has to be set here: it forces a prompt even under acceptEdits, which would otherwise
+  // swallow the call as an ordinary in-scope write.
+  // The chart tools (src/tools/charts.ts) — read and write the boards in the user's app.
+  //
+  // Split by direction, because they are not the same act. list_charts and read_chart are
+  // READS, and left to the unknown-tool branch they'd be bash-kind prompts denied outright
+  // in plan/readonly — wrong twice over: they touch nothing on this machine, and "look at
+  // what's already on my board" is exactly the kind of thing a plan-mode turn wants.
+  //
+  // read_chart is still worth naming precisely in the prompt rather than folding in with
+  // the listing. It returns DECRYPTED content out of the user's account — the only tool
+  // here that does — and the detail line says which chart, so an approval is a decision
+  // about a specific board rather than a blanket yes to reading their charts.
+  //
+  // create_chart and edit_chart are WRITES for the same reason save_cargo is: a new,
+  // persistent thing in the user's account against their quota. Not alwaysAsk — no credit
+  // is spent and the destination is the user's own device, encrypted there before storage,
+  // so there is no third party and nothing irreversible. `outside` is deliberately NOT set:
+  // unlike save_cargo there is no source file, so there is no out-of-scope disclosure to
+  // flag. A delete_node step is the one thing here that destroys something the user made,
+  // so it is surfaced in the title rather than buried in the op list.
+  if (name === "list_charts") {
+    return { tool: toolName, kind: "read", title: "List charts in the Privateer app", detail: "titles and card counts" };
+  }
+  if (name === "read_chart") {
+    const chartId = str(obj.chartId);
+    return {
+      tool: toolName,
+      kind: "read",
+      title: "Read a chart from the Privateer app",
+      detail: chartId ? `chart ${chartId} — the app decrypts its cards on the device` : "a chart's cards",
+    };
+  }
+  if (name === "create_chart") {
+    const nodes = Array.isArray(obj.nodes) ? obj.nodes.length : 0;
+    const titleNote = str(obj.title) ? ` "${str(obj.title)}"` : "";
+    return {
+      tool: toolName,
+      kind: "write",
+      title: "Create a chart in the Privateer app",
+      detail: `${nodes} card${nodes === 1 ? "" : "s"}${titleNote} → the app encrypts them and stores them in Charts`,
+    };
+  }
+  if (name === "edit_chart") {
+    const ops = Array.isArray(obj.ops) ? (obj.ops as Array<Record<string, unknown>>) : [];
+    const deletes = ops.filter((o) => o?.edit === "delete_node").length;
+    const chartId = str(obj.chartId);
+    const kinds = [...new Set(ops.map((o) => str(o?.edit)).filter(Boolean))].join(", ");
+    return {
+      tool: toolName,
+      kind: "write",
+      title: deletes ? "Edit a chart in the Privateer app (deletes cards)" : "Edit a chart in the Privateer app",
+      detail:
+        `${ops.length} step${ops.length === 1 ? "" : "s"}${kinds ? ` (${kinds})` : ""}` +
+        `${chartId ? ` on chart ${chartId}` : ""}` +
+        `${deletes ? ` — ${deletes} card${deletes === 1 ? "" : "s"} deleted` : ""}`,
+    };
+  }
+
+  if (name === "save_cargo") {
+    const src = str(obj.path);
+    if (!src) return unknownTarget(toolName, "write");
+    const abs = resolveInCwd(scope.cwd, src);
+    const outside = isOutsideScope(scope, abs);
+    const protectedSrc = isProtectedPath(abs);
+    const kindNote = str(obj.kind) ? ` as ${str(obj.kind)}` : "";
+    const titleNote = str(obj.title) ? ` "${str(obj.title)}"` : "";
+    return {
+      tool: toolName,
+      kind: "write",
+      title: protectedSrc ? "Save a protected file to Cargo in the app" : "Save to Cargo in the Privateer app",
+      detail: `${outside || protectedSrc ? abs : src}${kindNote}${titleNote} → the app encrypts it and stores it in Cargo`,
+      protected: protectedSrc,
+      outside,
+      path: abs,
+    };
+  }
+
   // Media generation (src/tools/media.ts) and local composition (videoCompose.ts).
   //
   // Left to the unknown-tool branch at the bottom these classify as bash-kind, which

package/src/permissions/noQuarter.ts

@@ -5,38 +5,46 @@
 //
 // Two ways in, one state:
 //   1. `privateer --no-quarter` at launch → PRIVATEER_NO_QUARTER=1 (see
-//      bin/privateer-launch.mjs), which seeds `active` below.
+//      bin/privateer-launch.mjs), which is what the reader below sees.
 //   2. shift+tab in a live session → toggleNoQuarter(). This is the "step away from
 //      the keyboard" switch: flip it on and the agent runs to completion instead of
 //      stopping on the next approval prompt.
 //
-// Toggling MIRRORS the env var, because that's how the state reaches subagents: a
-// pi-subagents child is a `pi` subprocess that inherits this process's env and reads
-// PRIVATEER_NO_QUARTER in its own gate. Children spawned after a toggle therefore
-// match the parent; ones already running keep the posture they started with.
+// THE ENV VAR IS THE STORE, not a mirror of a module-level flag — and that is
+// load-bearing for two separate reasons:
+//
+//   • ACROSS PROCESSES: a pi-subagents child is a `pi` subprocess that inherits this
+//     process's env and reads PRIVATEER_NO_QUARTER in its own gate. Children spawned
+//     after a toggle therefore match the parent; ones already running keep the posture
+//     they started with.
+//   • ACROSS EXTENSIONS IN THIS PROCESS: Pi loads each extension with its OWN jiti
+//     instance and `moduleCache: false` (pi-coding-agent dist/core/extensions/loader.ts,
+//     loadExtensionModule), so every extension that imports this file gets a SEPARATE
+//     copy of it. A module-level `let` would be per-extension state: shift+tab in
+//     extensions/privateer-gate.ts flipped the gate's copy while the copy inside
+//     extensions/privateer-privacy.ts stayed false, so a no-quarter session still
+//     stopped the turn with pi-privacy's "PII detected — send as-is or redact?" prompt.
+//     process.env is the one thing all those copies share, so the state lives there and
+//     nowhere else: every reader, in every extension, sees every toggle.
 //
 // IMPORT-SAFETY: no Pi imports, no node builtins — safe to load from anywhere,
 // including boot-ordered entrypoints (see boot.ts's ORDERING CONTRACT).
 
 const ENV = "PRIVATEER_NO_QUARTER";
 
-// Seeded from the launch flag so `--no-quarter` and the toggle share one state.
-let active = process.env[ENV] === "1";
-
-/** True while the gate is fully lowered for this session. */
+/** True while the gate is fully lowered for this session. Read live, never cached. */
 export function noQuarterActive(): boolean {
-  return active;
+  return process.env[ENV] === "1";
 }
 
-/** Set the state (and mirror it to the env for future subagent children). Returns the new state. */
+/** Set the state — in the env, so every copy of this module and every child agrees. Returns the new state. */
 export function setNoQuarter(on: boolean): boolean {
-  active = on;
   if (on) process.env[ENV] = "1";
   else delete process.env[ENV];
-  return active;
+  return on;
 }
 
 /** Flip the state. Returns the new state. */
 export function toggleNoQuarter(): boolean {
-  return setNoQuarter(!active);
+  return setNoQuarter(!noQuarterActive());
 }

package/src/providers/account.ts

@@ -63,6 +63,12 @@ const DEFAULT_MODELS = [
   // account catalog automatically; these seeds just make them resolve at launch).
   "moonshotai/kimi-k3",
   "z-ai/glm-5.2",
+  // Both verified 2026-08-19 against /endpoints/zdr and GET /api/models: ZDR-covered
+  // and servable. Same reason as the line above — the live catalog already carries
+  // them, this only closes the first-launch window where a saved default that isn't
+  // yet in the cache would fall through to a BYO provider.
+  "x-ai/grok-4.6",
+  "openai/gpt-5.6-luna",
 ];
 
 function seedModel(id: string) {