privateer-agent 0.12.17 → 0.12.18

package/bin/privateer-launch.mjs

@@ -29,6 +29,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 import { routeUpdate } from "./update-route.mjs";
+import { runToCompletion } from "./run-to-completion.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
 const REPO = path.resolve(HERE, "..");
@@ -132,18 +133,6 @@ if (sub === "--version" || sub === "-V") {
 }
 
 // Faithfully propagate a child's exit/signal, mirroring bash `exec`.
-function runToCompletion(cmd, cmdArgs, opts = {}) {
-  const child = spawn(cmd, cmdArgs, { stdio: "inherit", env: process.env, ...opts });
-  child.on("exit", (code, signal) => {
-    if (signal) process.kill(process.pid, signal);
-    else process.exit(code ?? 0);
-  });
-  child.on("error", (e) => {
-    console.error(`privateer: failed to launch — ${e.message}`);
-    process.exit(1);
-  });
-}
-
 // npm gives no usable progress, so on a TTY show a braille spinner while it runs
 // and keep its output buffered — shown only if the install fails. Non-TTY (CI,
 // piped) keeps the old passthrough behaviour. The global package is replaced in
@@ -291,7 +280,9 @@ if (sub === "update") {
 else if (sub === "harbor" || sub === "daemon") {
   sweepLegacyShims(); // a harbor-only machine upgrades too — see the function's note
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
-  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-harbor.mjs"), ...args.slice(1)]);
+  // A resident background process, stopped by launchd/systemd/scripts with a plain
+  // `kill` — which reaches only this launcher. See runToCompletion.
+  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-harbor.mjs"), ...args.slice(1)], { forwardSignals: true });
 }
 
 // --- `privateer verify` ----------------------------------------------------
@@ -314,7 +305,9 @@ else if (sub === "verify") {
 else if (sub === "acp") {
   sweepLegacyShims(); // silent: only ever removes files
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
-  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-acp.mjs"), ...args.slice(1)]);
+  // Long-lived and driven over stdio by an editor, which stops it by terminating
+  // the process rather than by a keystroke. Same leak, same fix.
+  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-acp.mjs"), ...args.slice(1)], { forwardSignals: true });
 }
 
 // --- normal launch: resolve the moat, then exec Pi's TUI with it -----------

package/bin/run-to-completion.d.mts

@@ -0,0 +1,18 @@
+// Types for the launcher's child-process handoff. Same reason as update-route.d.mts:
+// the implementation is plain .mjs because bin/ runs under a bare `node`, before any
+// transpiler exists — but the test that pins the signal behaviour is TypeScript.
+
+import type { SpawnOptions } from "node:child_process";
+
+export interface RunToCompletionOptions extends SpawnOptions {
+  /** Pass SIGTERM/SIGHUP on to the child and wait for it, instead of dying alone and
+   *  leaving it reparented to init. Off by default — only the long-lived headless
+   *  children (harbor, acp) need it; see the implementation's note on why SIGINT and
+   *  SIGQUIT are deliberately NOT forwarded. */
+  forwardSignals?: boolean;
+}
+
+/** Spawn a child and hand it this process's lifetime: its exit code, its signal
+ *  death, and — with `forwardSignals` — the termination signals sent to us. Never
+ *  returns normally; the process exits with the child. */
+export function runToCompletion(cmd: string, cmdArgs: string[], opts?: RunToCompletionOptions): void;

package/bin/run-to-completion.mjs

@@ -0,0 +1,73 @@
+/**
+ * Spawn a child and hand it this process's lifetime — including its termination
+ * signals.
+ *
+ * Extracted from the launcher for the same reason update-route.mjs was: the
+ * reasoning is subtle enough to want a test next to it, and the launcher itself
+ * runs on import so nothing inside it can be unit-tested in place.
+ */
+import { spawn } from "node:child_process";
+
+// How long a forwarded SIGTERM has to work before we stop being polite. A harbor
+// shuts down in milliseconds; this only matters for a child wedged mid-write.
+const SIGNAL_GRACE_MS = 5000;
+
+/**
+ * `forwardSignals` — pass a termination signal on to the child and wait for it.
+ *
+ * WHY THIS EXISTS. Every subcommand here re-execs a second Node process, and
+ * without this the launcher dies alone: the child is reparented to init and keeps
+ * running. For the TUI that is nearly invisible (Ctrl-C is delivered by the
+ * terminal to the whole foreground process group, so both die anyway), but for the
+ * long-lived headless children it is a real leak — `privateer harbor` is started by
+ * launchd/systemd and by scripts, both of which stop a process with a plain
+ * `kill`, and that signal reaches only the launcher.
+ *
+ * Measured 2026-08-23 while building the E2E CLI fixture: killing
+ * `privateer harbor run` left the harbor alive, reparented to init, and STILL
+ * CONNECTED TO THE RELAY — holding the account's live-agent slot (one, on the free
+ * plan) with no way to find it except by pid. The harbor already handles SIGTERM
+ * and shuts down cleanly; nothing was ever passing it on.
+ *
+ * **Only SIGTERM and SIGHUP are forwarded, deliberately.** SIGINT and SIGQUIT are
+ * generated by the terminal and delivered to the entire foreground process group,
+ * so the child has already had them — forwarding would deliver a SECOND one, and a
+ * TUI that treats the first Ctrl-C as "clear the line" and the second as "quit"
+ * would exit on a single keypress.
+ *
+ * The parent then waits for the child rather than exiting under it, so the exit
+ * code still belongs to the child, and escalates to SIGKILL after a grace period:
+ * a child that ignores SIGTERM must not be able to outlive the launcher, which is
+ * the whole failure being fixed.
+ */
+export function runToCompletion(cmd, cmdArgs, opts = {}) {
+  const { forwardSignals = false, ...spawnOpts } = opts;
+  const child = spawn(cmd, cmdArgs, { stdio: "inherit", env: process.env, ...spawnOpts });
+
+  let killTimer = null;
+  if (forwardSignals) {
+    for (const sig of ["SIGTERM", "SIGHUP"]) {
+      process.on(sig, () => {
+        try { child.kill(sig); } catch { /* already gone */ }
+        // Do NOT exit here: installing a listener suppresses Node's default
+        // terminate-now behaviour, so we stay up until the child's own exit fires
+        // below and can report its code.
+        if (killTimer) return;
+        killTimer = setTimeout(() => {
+          try { child.kill("SIGKILL"); } catch { /* already gone */ }
+        }, SIGNAL_GRACE_MS);
+        killTimer.unref?.();
+      });
+    }
+  }
+
+  child.on("exit", (code, signal) => {
+    if (killTimer) clearTimeout(killTimer);
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (e) => {
+    console.error(`privateer: failed to launch — ${e.message}`);
+    process.exit(1);
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.17",
+  "version": "0.12.18",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/crypto/terminalKey.ts

@@ -18,7 +18,7 @@
  * app's seal(): X25519 → HKDF-SHA256 → AES-256-GCM.
  */
 
-import { readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { readFileSync, writeFileSync, chmodSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { x25519 } from "@noble/curves/ed25519";
 import { globalDir } from "../config/paths.ts";
@@ -67,6 +67,14 @@ function loadOrCreate(): { publicKey: Uint8Array; secretKey: Uint8Array } {
   const secretKey = x25519.utils.randomPrivateKey();
   const publicKey = x25519.getPublicKey(secretKey);
   const file: TerminalKeyFile = { v: 1, publicKey: b64(publicKey), secretKey: b64(secretKey) };
+  // The home may not exist yet: the FIRST thing a fresh machine does is /login, and
+  // requestDeviceCode swallows a throw from here (a login must not fail over a key it
+  // can live without). Without the mkdir that swallow turned an absent directory into
+  // a login that silently carried no pubkey — so the app had nothing to pin and every
+  // app-sealed secret to this terminal stayed impossible until the next re-link.
+  // saveCredentials writes into the same directory and has always created it; this is
+  // the same rule, one step earlier in the flow.
+  mkdirSync(globalDir(), { recursive: true, mode: 0o700 });
   // Create 0600 from the start — passing `mode` to writeFileSync avoids the TOCTOU
   // window where a fresh file briefly carries umask perms (group/world-readable)
   // before a follow-up chmod. `mode` only applies on CREATE, so also chmod to fix an