privateer-agent 0.12.28 → 0.12.30

package/bin/privateer-launch.mjs

@@ -35,6 +35,21 @@ const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
 const REPO = path.resolve(HERE, "..");
 const isWin = process.platform === "win32";
 
+// On Windows, ensure the console output code page is UTF-8 (65001).
+// Without this, raw UTF-8 writes to stdout/stderr (such as fs.writeSync(2, ...) in the
+// boot splash worker) are decoded through the OEM code page (CP437/850), turning
+// Unicode wave blocks and emojis into 3-byte mojibake that wraps and floods the console.
+if (isWin) {
+  try {
+    const chcp = process.env.SystemRoot
+      ? path.join(process.env.SystemRoot, "System32", "chcp.com")
+      : "chcp.com";
+    spawnSync(chcp, ["65001"], { stdio: "ignore", windowsHide: true });
+  } catch {
+    /* best effort */
+  }
+}
+
 const PRIVATEER_HOME = process.env.PRIVATEER_HOME || path.join(os.homedir(), ".privateer");
 const ENV_FILE = path.join(REPO, ".env"); // dev-only; a real install has none
 const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");

package/bin/privateer-splash.mjs

@@ -38,6 +38,8 @@
 //
 // The wave is drawn on STDERR; stdout belongs to the TUI's canvas.
 
+import { spawnSync } from "node:child_process";
+import path from "node:path";
 import { Worker } from "node:worker_threads";
 
 const enabled =
@@ -46,6 +48,20 @@ const enabled =
   !process.env.PRIVATEER_NO_SPLASH &&
   !process.env.CI;
 
+// On Windows, ensure the console output code page is UTF-8 (65001) before the worker
+// thread starts drawing. If privateer was launched via npm/npx or direct node rather
+// than privateer.cmd, the console might still be on OEM CP437.
+if (enabled && process.platform === "win32") {
+  try {
+    const chcp = process.env.SystemRoot
+      ? path.join(process.env.SystemRoot, "System32", "chcp.com")
+      : "chcp.com";
+    spawnSync(chcp, ["65001"], { stdio: "ignore", windowsHide: true });
+  } catch {
+    /* best effort */
+  }
+}
+
 // Bytes of stdout after TUI.start() that mean "this is the first frame, not a control
 // sequence". Everything Pi writes between raw mode and the frame is short (the paste
 // toggle, a Kitty protocol query, the cursor hide, an OSC window title — 42 bytes all
@@ -72,7 +88,8 @@ if (enabled) {
 
   // Room for "  ⚓ " + wave + message + elapsed, clamped so a narrow terminal doesn't
   // wrap (a wrapped line survives our `\r\x1b[K` erase only on its last row).
-  const width = Math.max(12, Math.min(28, (err.columns || 80) - 34));
+  const cols = err.columns && err.columns > 0 ? err.columns : 80;
+  const width = Math.max(6, Math.min(28, cols - 34));
 
   // The worker source is plain logic with no escape sequences of its own — every ANSI
   // string is handed over in workerData, so nothing here has to survive two rounds of

package/bin/privateer.cmd

@@ -1,4 +1,7 @@
 @echo off
+REM Ensure console output code page is UTF-8 so Unicode blocks and emojis render
+REM correctly without CP437 mojibake or line-wrapping cascades.
+chcp 65001 >nul 2>&1
 REM Windows entry point for a Privateer bundle. Mirrors the unix bin/privateer-tui
 REM shim: run the bundled Node against the shared cross-platform launcher. %~dp0 is
 REM this file's dir (<app>\bin\), so ..\node.exe is the bundled runtime.

package/extensions/privateer-context.ts

@@ -13,25 +13,49 @@
 // advertises /init. After /init we emit the shared context-changed signal so that line
 // refreshes at once. See src/context.ts for the discovery/formatting details.
 
-import { contextBlock, writeTemplate, emitContextChanged, CONTEXT_BLOCK_MARKER } from "../src/context.ts";
+import {
+  contextBlock,
+  writeTemplate,
+  emitContextChanged,
+  CONTEXT_BLOCK_MARKER,
+  RUNTIME_GUIDELINES_MARKER,
+  runtimeGuidelinesBlock,
+} from "../src/context.ts";
 
 // Honor Pi's own "disable context files" switch, so --no-context-files / -nc silences
-// PRIVATEER.md too (not just AGENTS.md/CLAUDE.md) — otherwise the flag would half-work.
+// everything this extension injects, not just PRIVATEER.md — otherwise the flag would
+// half-work. A user who asks for a bare prompt gets a bare prompt.
 const CONTEXT_FILES_DISABLED =
   process.argv.includes("--no-context-files") || process.argv.includes("-nc");
 
 export default function privateerContext(pi: any): void {
-  // Inject PRIVATEER.md into every turn's system prompt. The prompt is rebuilt per turn
-  // and chained across before_agent_start handlers, so appending here is idempotent for
-  // the turn; the marker guard makes it a no-op if an earlier handler already added it.
+  // Inject the runtime guidelines + PRIVATEER.md into every turn's system prompt. The
+  // prompt is rebuilt per turn and chained across before_agent_start handlers, so
+  // appending here is idempotent for the turn; each marker guard makes its own block a
+  // no-op if an earlier handler already added it.
+  //
+  // ONLY EVER APPEND, AND ONLY RETURN WHEN WE ADDED SOMETHING. Pi chains these handlers
+  // and a returned `systemPrompt` REPLACES what the chain has built so far, so both
+  // halves matter:
+  //
+  //   • A host that doesn't populate `event.systemPrompt` must not be handed a prompt
+  //     synthesised from "" — that gives back our two blocks as the ENTIRE system prompt
+  //     and silently drops the real one. `typeof base !== "string"` is what separates
+  //     "here is a prompt to chain onto" (possibly empty, legitimate) from "no field".
+  //   • When both markers are already present (a re-entrant chain) we have nothing to
+  //     contribute, and undefined leaves what is there alone.
   pi.on("before_agent_start", (event: any) => {
     if (CONTEXT_FILES_DISABLED) return;
-    const cwd = event?.systemPromptOptions?.cwd ?? process.cwd();
-    const base: string = event?.systemPrompt ?? "";
-    if (base.includes(CONTEXT_BLOCK_MARKER)) return; // already injected this chain
-    const block = contextBlock(cwd);
-    if (!block) return; // no PRIVATEER.md anywhere — leave the prompt untouched
-    return { systemPrompt: base + block };
+    const base = event?.systemPrompt;
+    if (typeof base !== "string") return;
+    let prompt = base;
+    if (!prompt.includes(RUNTIME_GUIDELINES_MARKER)) prompt += runtimeGuidelinesBlock();
+    if (!prompt.includes(CONTEXT_BLOCK_MARKER)) {
+      const cwd = event?.systemPromptOptions?.cwd ?? process.cwd();
+      prompt += contextBlock(cwd); // "" when there is no PRIVATEER.md anywhere
+    }
+    if (prompt === base) return; // nothing to add — leave the chain alone
+    return { systemPrompt: prompt };
   });
 
   // /init — scaffold a PRIVATEER.md in the working directory. Never clobbers an existing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.28",
+  "version": "0.12.30",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/context.ts

@@ -93,6 +93,15 @@ export function discoverContextFiles(cwd: string = process.cwd()): ContextFile[]
 // A unique sentinel opening the injected block, so before_agent_start can no-op if the
 // block is already present in the chained system prompt (defensive against re-entrancy).
 export const CONTEXT_BLOCK_MARKER = "<!-- privateer:PRIVATEER.md -->";
+export const RUNTIME_GUIDELINES_MARKER = "<!-- privateer:runtime-guidelines -->";
+
+export function runtimeGuidelinesBlock(): string {
+  return `\n\n${RUNTIME_GUIDELINES_MARKER}\n<environment_guidelines>
+- Node.js environment: Node.js (v22+) is guaranteed to be available in Privateer. Prefer \`node -e "..."\` or small Node.js scripts for quick scripting, calculations, or JSON processing instead of assuming \`python\` or \`python3\` is installed.
+- Search fallback: If \`rg\` (ripgrep) is missing or returns "command not found", fall back to standard POSIX \`grep -rn <pattern> <path>\` or \`find <path>\`.
+- Missing system dependencies: If an essential external tool (e.g. \`git\`, \`python\`, \`rg\`) is missing and needed, check its presence (\`command -v <tool>\`), explain clearly what is missing, and offer to install it using the host package manager (e.g. \`brew install\`, \`xcode-select --install\`, \`winget install\`, \`apt install\`) upon user approval.
+</environment_guidelines>\n`;
+}
 
 // Format the discovered files into a system-prompt fragment using the same framing Pi
 // applies to AGENTS.md (see core/system-prompt.js), so the model can't tell the two

package/src/remote/remoteBridge.ts

@@ -11,6 +11,7 @@
 // to "deny".
 
 import { randomUUID } from "node:crypto";
+import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
 import type { AskOutcome } from "../permissions/modeGate.ts";
@@ -169,7 +170,7 @@ export interface RemoteBridgeConfig {
 export class RemoteBridge {
   private relay?: RelayLike;
   private remote = false;
-  private noQuarter = false;
+  private noQuarter = noQuarterActive();
   private readonly pending = new Map<string, (d: AskOutcome) => void>();
   private readonly pendingSelects = new Map<string, (v: string | null) => void>();
   private readonly pendingInputs = new Map<string, (v: string | null) => void>();
@@ -282,9 +283,15 @@ export class RemoteBridge {
     onFilesSearch: (id, query) => this.cfg.onFilesSearch?.(id, query),
     onNoQuarter: (on) => {
       this.noQuarter = on;
+      setNoQuarter(on);
       this.relay?.sendNoQuarter(on); // echo the ack back so the app's toggle syncs
     },
-    onControllerAttached: () => this.cfg.onControllerAttached?.(),
+    onControllerAttached: () => {
+      if (this.noQuarter || noQuarterActive()) {
+        this.relay?.sendNoQuarter(true);
+      }
+      this.cfg.onControllerAttached?.();
+    },
     // The app left while we're still running. Same posture as a dropped socket: stop
     // treating the turn as remote (the gate must not wait on a controller that isn't
     // there) and fail every pending approval closed. The turn itself keeps going —
@@ -310,7 +317,7 @@ export class RemoteBridge {
   // ── gate hooks (passed into the GateController) ─────────────────────────────
 
   getRemote = (): boolean => this.remote;
-  getNoQuarter = (): boolean => this.noQuarter;
+  getNoQuarter = (): boolean => this.noQuarter || noQuarterActive();
 
   // The gate's remote approver: relay the request to the app and await its
   // allow/deny. Fail closed if no controller, on abort, or on disconnect. (The gate