privateer-agent 0.12.23 → 0.12.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.23",
+  "version": "0.12.25",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/bridge/engineAdapter.ts

@@ -20,6 +20,8 @@ import {
   type EngineEvent,
   type UsageTotals,
 } from "../engine/events.ts";
+import { describeErrorText } from "../engine/errors.ts";
+import { redactText } from "../util/redact.ts";
 
 // Minimal structural view of the Pi session events we read. Kept loose (not the
 // full Pi union) so this module type-checks without pinning to Pi's internals;
@@ -108,16 +110,41 @@ export function createEngineEventAdapter() {
             ];
 
       case "turn_end": {
-        const turn = normUsage((ev.message as any)?.usage);
+        const msg = ev.message as any;
+        const turn = normUsage(msg?.usage);
         sessionTotal = addUsage(sessionTotal, turn);
         const finishReason =
-          (ev.finishReason as string) ??
-          ((ev.message as any)?.stopReason as string) ??
-          "stop";
-        return [
-          { type: "usage", usage: sessionTotal, turn },
-          { type: "finish", usage: sessionTotal, finishReason },
-        ];
+          (ev.finishReason as string) ?? (msg?.stopReason as string) ?? "stop";
+        const out: EngineEvent[] = [{ type: "usage", usage: sessionTotal, turn }];
+        // A FAILED turn ends here, not by throwing — and this is the only place the
+        // app can learn it failed.
+        //
+        // Pi reports a dead model call as an assistant message with
+        // `stopReason: "error"` and an `errorMessage`; `prompt()` then resolves
+        // NORMALLY, so the desktop's runTurn catch never fires. Our own pi patch
+        // widened that path deliberately (a hard 4xx, and a 429 that outlived the
+        // retry budget, both end the turn instead of re-entering the agent loop),
+        // which is right for the CLI — its TUI reads the assistant message and
+        // prints describeErrorText. The app reads EngineEvents, and this adapter
+        // used to drop `errorMessage` on the floor: the turn arrived as a bare
+        // `finish`, which RemoteDriveContext closes as a green ✓ "done". A signed-in
+        // user whose first turn 401'd or hit their cap saw a tick and no words.
+        //
+        // So say it. Same wording the terminal gets, ahead of the finish so the feed
+        // reads in order, and redacted either way because an unrecognised body goes
+        // out verbatim.
+        if (msg?.stopReason === "error") {
+          const raw = typeof msg.errorMessage === "string" ? msg.errorMessage : "";
+          const described = describeErrorText(raw);
+          out.push({
+            type: "error",
+            error: described?.message ?? redactText(raw || "The model call failed."),
+            ...(described?.hint ? { hint: described.hint } : {}),
+            ...(described?.retryable != null ? { retryable: described.retryable } : {}),
+          });
+        }
+        out.push({ type: "finish", usage: sessionTotal, finishReason });
+        return out;
       }
 
       // Compaction: Pi collapses history to free context. TODO(verify) field
@@ -146,8 +173,14 @@ export function createEngineEventAdapter() {
           },
         ];
 
-      // Terminal error surfaced at the end of an agent run. TODO(verify) shape;
-      // Phase 1 re-points errors/errors.ts (describeError) here.
+      // Terminal error surfaced at the end of an agent run.
+      //
+      // ⚠️ Pi 0.84's `agent_end` is `{ messages, willRetry }` — there is NO `error`
+      // field, so this branch has been returning [] for every run since the 0.84
+      // refactor. It is kept (harmless, and other Pi versions have carried one)
+      // but it is NOT the error path: a failed model call arrives on `turn_end`
+      // above, which is where the real mapping lives. Do not "restore" error
+      // reporting here and delete it there.
       case "agent_end": {
         const err = (ev as any).error;
         if (!err) return [];

package/src/remote/relayClient.ts

@@ -254,8 +254,9 @@ export interface RelayCallbacks {
   // STRICT mode (it executes a graph — non-idempotent, like task_spawn).
   onWorkflowsRun?: (idOrName: string, sig?: string, ts?: number) => void;
   // A file finished transferring from the app (reassembled from chunks). Held to
-  // ride along with the next remote prompt.
-  onAttachment: (file: { name: string; mediaType: string; base64: string }) => void;
+  // ride along with the next remote prompt. `path` instead of `base64` is the desktop
+  // loopback's shape only — see RemoteAttachment; nothing on this WebSocket sets it.
+  onAttachment: (file: { name: string; mediaType: string; base64?: string; path?: string }) => void;
   // Surface a one-line status/notice in the TUI.
   onStatus?: (text: string) => void;
   // The relay socket closed (controller no longer reachable until reconnect).

package/src/remote/remoteBridge.ts

@@ -112,7 +112,12 @@ export interface InputRequest {
 export interface RemoteAttachment {
   name: string;
   mediaType: string;
-  base64: string;
+  // Exactly one of these. `base64` is the cloud relay's shape: the app is on another
+  // machine, so the bytes are chunked across. `path` is the desktop's: app and agent
+  // share a disk (IpcRelay), so the file is named rather than moved — which is why a
+  // desktop attachment has no size cap. Both are consumed by AttachmentStore.register.
+  base64?: string;
+  path?: string;
 }
 
 export interface RemoteBridgeConfig {

package/src/tools/saveAttachment.ts

@@ -4,7 +4,7 @@
 // extension gates the tool_call, classified as a write against the destination path).
 
 import { Type } from "typebox";
-import { writeFileSync, mkdirSync, readFileSync } from "node:fs";
+import { mkdirSync, copyFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 import type { AttachmentStore } from "../util/attachmentStore.ts";
 
@@ -42,9 +42,13 @@ export function makeSaveAttachmentTool(store: AttachmentStore) {
       const cwd = ctx?.cwd ?? process.cwd();
       const abs = isAbsolute(params.path) ? params.path : resolve(cwd, params.path);
       mkdirSync(dirname(abs), { recursive: true });
-      const bytes = readFileSync(entry.path);
-      writeFileSync(abs, bytes);
-      return text(`Saved attachment #${params.ref} (${entry.name}, ${entry.mediaType}) to ${params.path} (${bytes.length} bytes).`);
+      // copy rather than read-then-write: a desktop attachment is the user's own file
+      // at its own path (AttachmentStore adopts it instead of staging a copy), and
+      // those have no size cap — reading a 4 GB video into the heap to write it back
+      // out would be the one place the uncapped path could still fall over.
+      copyFileSync(entry.path, abs);
+      const size = statSync(abs).size;
+      return text(`Saved attachment #${params.ref} (${entry.name}, ${entry.mediaType}) to ${params.path} (${size} bytes).`);
     },
   };
 }

package/src/util/attachmentStore.ts

@@ -6,12 +6,19 @@ import { join, extname } from "node:path";
 // scratch dir keyed by the "#n" reference the model sees, so the save_attachment tool
 // can write one back out to a real path on demand. Ported/adapted from tree-cli
 // (which persisted paste/drop bytes); here the source is inbound relay attachments.
+//
+// A DESKTOP attachment arrives as a path instead of bytes — the app and this agent
+// share a disk, so there is nothing to transfer and nothing to stage. Such an entry
+// simply points at the file where it already lives; `owned` is what tells the two
+// apart, so cleanup() removes only what we wrote. That is also why the desktop
+// composer has no attachment size cap: a 4 GB video costs one string here.
 
 export interface StoredAttachment {
   n: number;
-  path: string; // absolute scratch-file path holding the decoded bytes
+  path: string; // absolute path holding the bytes — our scratch file, or the user's own file
   mediaType: string;
   name: string; // original filename from the app
+  owned: boolean; // did WE write this file? false for a desktop path hand-off
 }
 
 export class AttachmentStore {
@@ -26,13 +33,24 @@ export class AttachmentStore {
     return this.dir;
   }
 
-  // Persist an inbound attachment's bytes, assign it the next ref number, and return
-  // the stored record (its ref + scratch path).
-  register(file: { name: string; mediaType: string; base64: string }): StoredAttachment {
+  // Register an inbound attachment under the next ref number and return the stored
+  // record. Bytes are staged into the scratch dir; a `path` (desktop) is adopted
+  // as-is — copying a file the agent can already open would be pure waste, and for
+  // the large files this path exists to carry, waste measured in gigabytes.
+  register(file: { name: string; mediaType: string; base64?: string; path?: string }): StoredAttachment {
     const n = this.nextN++;
+    if (file.path) {
+      const stored: StoredAttachment = {
+        n, path: file.path, mediaType: file.mediaType, name: file.name, owned: false,
+      };
+      this.byN.set(n, stored);
+      return stored;
+    }
     const path = join(this.ensureDir(), `att-${n}${extname(file.name) || ""}`);
-    writeFileSync(path, Buffer.from(file.base64, "base64"));
-    const stored: StoredAttachment = { n, path, mediaType: file.mediaType, name: file.name };
+    writeFileSync(path, Buffer.from(file.base64 ?? "", "base64"));
+    const stored: StoredAttachment = {
+      n, path, mediaType: file.mediaType, name: file.name, owned: true,
+    };
     this.byN.set(n, stored);
     return stored;
   }