privateer-agent 0.12.3 → 0.12.6

package/README.md

@@ -125,6 +125,10 @@ silently. The moat is swappable; the floor under it holds.
   shots stay continuous, cut them together, then score and narrate the result. Generated media
   is handed straight back as files on your machine; none of it is stored in our cloud. See
   [docs/media-generation.md](docs/media-generation.md).
+- **Talk to it.** `/speak on` reads answers aloud as they're written; **ctrl+x** is push-to-talk
+  and the mic closes when you stop talking. Your OS voice by default — nothing leaves the
+  machine — or your account's confidential-compute TTS/STT once you sign in. `/talk loop on`
+  makes it hands-free. See [Talk to it](#talk-to-it--voice-both-directions).
 - **MCP servers, sub-agents & skills.** Connect Model Context Protocol servers (local stdio
   or remote HTTP with OAuth) with [`/connect`](#connectors--mcp), delegate work to bounded
   parallel sub-agents, and drop in skills — all gated like everything else.
@@ -288,6 +292,42 @@ with `/signout`; manage linked terminals from the app.
 > to spend on your account. If someone sends you a code and asks you to approve it, don't —
 > that hands *them* a billed session on *your* account.
 
+## Talk to it — voice, both directions
+
+`/speak on` and answers are read aloud **as they are written**, sentence by sentence, with
+code blocks, tables and URLs stripped. Press **ctrl+x** and talk; the mic closes when you
+stop talking and the transcript lands in the composer for you to read before Enter sends it.
+
+```
+/speak on             read answers aloud    ctrl+x    push to talk (press again to send)
+/speak voice <name>   pick a speaker        /talk     the same thing, typed
+/speak rate <n>       0.5–3× pace           /talk loop on   conversation mode, hands-free
+/speak stream off     wait for the full answer instead of speaking as it arrives
+/speak provider       list engines (→ marks the active one); /talk provider does the same
+```
+
+Out of the box it uses your **OS voice** (`say`, `espeak-ng`, System.Speech) and nothing
+leaves the machine. Signed in, both directions quietly upgrade to your account's
+**confidential-compute TTS and STT** — attested-enclave models, the same ones the app's voice
+features use, inherited entitlement and billing. That is an upgrade, not a stomp: a provider
+you picked deliberately stays picked, and `/speak provider local` pins the offline voice for
+good. Be clear-eyed about the difference — the local voice never speaks to the network, while
+the account voice sends the utterance text to an enclave we can't read into but that is still
+off your machine.
+
+One caveat while the account endpoints catch up: `/speak rate` and `/talk vocab` are honored
+by the local and OpenAI-compatible engines, not yet by the account's TTS/STT.
+
+Voice is **off by default and interactive-only** — harbor, ACP and channel sessions never
+speak. The mic opens only on something you did (`/talk`, the push-to-talk key, or a
+conversation turn you switched on); there is no wake word, capture is hard-capped, audio is
+held in memory and never written to disk, and a mis-heard transcript is still just a prompt —
+every tool call it leads to hits the same permission gate as anything you type. Recording
+needs a capture tool on PATH: `sox` anywhere, or `arecord`/`parecord`/`ffmpeg` on Linux,
+`ffmpeg` on macOS. Everything is stored in `~/.privateer/speak.json`; the engine itself is the
+standalone [`privateer-speak`](https://www.npmjs.com/package/privateer-speak) package, usable
+in any Pi agent.
+
 ## The Privateer app
 
 The same account drives Privateer from **iOS, Android, [the web app](https://privateer.pro),
@@ -390,6 +430,37 @@ the app are write-only — the app can name them but never read them back. Note
 live in plaintext in `config.json` on your machine, and every channel action is appended to
 `~/.privateer/channels-audit.log`.
 
+## Drive it from Buzz or Zed — ACP
+
+Privateer speaks the [Agent Client Protocol](https://agentclientprotocol.com) (ACP v1 over
+stdio). Any ACP host — [Buzz](https://buzz.xyz), Block's team messenger where agents are
+teammates, or the [Zed](https://zed.dev) editor — can spawn `privateer acp` and drive it:
+prompts stream back, tool activity shows live, and the host's model picker lists Privateer's
+catalog with TEE-backed models labelled **confidential (TEE)**.
+
+The part we care about: **the host renders the UI, but authority never leaves your machine.**
+
+- Every action is classified by Privateer's own permission gate — ACP's
+  `session/request_permission` only delivers the prompt.
+- The **tool ceiling** comes from your local config, not the host, and ships **read-only**
+  (`read`, `grep`, `find`, `ls`). The host cannot widen it.
+- Filesystem access is **confined to one directory root**; out-of-tree access is refused,
+  not prompted.
+- Every ambiguous outcome — unreachable host, cancelled dialog, unknown answer, aborted
+  turn — resolves to **deny**.
+- "Allow for this session" lives in memory and dies with the session; dangerous shell
+  (`curl … | sh` and friends) can never become standing permission.
+
+Zed setup (`settings.json`):
+
+```json
+{ "agent_servers": { "Privateer": { "command": "privateer", "args": ["acp"] } } }
+```
+
+Honest caveat for Buzz: **Buzz currently auto-approves permission prompts**, so under Buzz
+the tool ceiling *is* the control — which is exactly why the default is read-only. Full
+setup, config, and limitations: [`docs/acp.md`](docs/acp.md).
+
 ## Connectors — MCP
 
 Privateer is an **MCP client**. Point it at a [Model Context Protocol](https://modelcontextprotocol.io)
@@ -538,12 +609,14 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 | `/signin` · `/signout` | sign in to a Privateer account (device flow) / sign out |
 | `/remote-access` | link this terminal to the app and allow it to drive (off by default) |
 | `/connect` · `/mcp` | add, enable, or remove MCP connectors / see what actually connected |
+| `/speak` · `/talk` | read answers aloud / voice input (**ctrl+x** is push-to-talk) |
 | `/extensions` | list loaded Pi extensions |
 | `/init` | scaffold a starter `PRIVATEER.md` in this directory |
 | `/update` · `/privateer` | update to the latest release / Privateer status and posture |
 
 Shell subcommands: `privateer` (interactive), `privateer update`, `privateer harbor …`,
-`privateer --no-quarter`, `privateer --version`.
+`privateer acp` (serve the agent to an ACP host like Buzz or Zed — see
+[`docs/acp.md`](docs/acp.md)), `privateer --no-quarter`, `privateer --version`.
 
 ## Develop
 

package/extensions/privateer-brand.ts

@@ -107,10 +107,80 @@ function buildMark(p: Palette): string[] {
   return rows;
 }
 
-// Visible width = characters after stripping SGR escapes. Everything we render inside
-// the box is ASCII or a BMP width-1 symbol, so a plain length is exact here.
+// Code points that terminals render two cells wide. Two groups matter to us: the CJK /
+// fullwidth ranges, and the symbols Unicode gives *emoji presentation by default* — the
+// second group is the trap, because they look like ordinary BMP dingbats. ⚓ (U+2693) is
+// one, and counting it as one cell pushed the banner's right border a column past the
+// frame on the PRIVATEER.md row. The list is the complete BMP Emoji_Presentation set plus
+// the astral emoji planes, so swapping in another glyph can't quietly reintroduce that.
+const WIDE_RANGES: Array<[number, number]> = [
+  [0x1100, 0x115f], [0x231a, 0x231b], [0x2329, 0x232a], [0x23e9, 0x23ec], [0x23f0, 0x23f0],
+  [0x23f3, 0x23f3], [0x25fd, 0x25fe], [0x2614, 0x2615], [0x2648, 0x2653], [0x267f, 0x267f],
+  [0x2693, 0x2693], [0x26a1, 0x26a1], [0x26aa, 0x26ab], [0x26bd, 0x26be], [0x26c4, 0x26c5],
+  [0x26ce, 0x26ce], [0x26d4, 0x26d4], [0x26ea, 0x26ea], [0x26f2, 0x26f3], [0x26f5, 0x26f5],
+  [0x26fa, 0x26fa], [0x26fd, 0x26fd], [0x2705, 0x2705], [0x270a, 0x270b], [0x2728, 0x2728],
+  [0x274c, 0x274c], [0x274e, 0x274e], [0x2753, 0x2755], [0x2757, 0x2757], [0x2795, 0x2797],
+  [0x27b0, 0x27b0], [0x27bf, 0x27bf], [0x2b1b, 0x2b1c], [0x2b50, 0x2b50], [0x2b55, 0x2b55],
+  [0x2e80, 0x303e], [0x3041, 0x33ff], [0x3400, 0x4dbf], [0x4e00, 0xa4cf], [0xa960, 0xa97f],
+  [0xac00, 0xd7a3], [0xf900, 0xfaff], [0xfe10, 0xfe19], [0xfe30, 0xfe6f], [0xff00, 0xff60],
+  [0xffe0, 0xffe6], [0x1f300, 0x1f64f], [0x1f680, 0x1f6ff], [0x1f900, 0x1f9ff],
+  [0x1fa70, 0x1faff],
+];
+
+function isWide(cp: number): boolean {
+  return WIDE_RANGES.some(([lo, hi]) => cp >= lo && cp <= hi);
+}
+
+// Visible width in terminal cells: SGR escapes are free, combining marks are free, and
+// wide glyphs cost two. A variation selector re-negotiates the *previous* glyph's
+// presentation (FE0F → emoji/wide, FE0E → text/narrow), so it adjusts the running total
+// rather than contributing width of its own.
 function vlen(s: string): number {
-  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+  const plain = s.replace(/\x1b\[[0-9;]*m/g, "");
+  let w = 0;
+  let prevWide = false;
+  for (const ch of plain) {
+    const cp = ch.codePointAt(0)!;
+    if (cp === 0xfe0f) {
+      if (!prevWide) { w += 1; prevWide = true; }
+      continue;
+    }
+    if (cp === 0xfe0e) {
+      if (prevWide) { w -= 1; prevWide = false; }
+      continue;
+    }
+    // Combining marks and zero-width joiners/spaces stack onto the previous cell.
+    if ((cp >= 0x0300 && cp <= 0x036f) || cp === 0x200b || cp === 0x200d || cp === 0xfeff) continue;
+    prevWide = isWide(cp);
+    w += prevWide ? 2 : 1;
+  }
+  return w;
+}
+
+// Clip a colored line to `max` cells. The banner caps its inner width to the terminal, so
+// on a narrow window a long row (a deep cwd, a long update notice) would otherwise run
+// past the right border and wrap — the same broken frame, from the other direction. SGR
+// escapes are copied through free of charge and a RESET is appended so the truncation
+// can't leak a color into the border. A wide glyph straddling the boundary is dropped and
+// replaced by a space, so the count still lands exactly on `max`.
+function vclip(s: string, max: number, reset: string): string {
+  if (vlen(s) <= max) return s;
+  const parts = s.split(/(\x1b\[[0-9;]*m)/);
+  let out = "";
+  let w = 0;
+  for (const part of parts) {
+    if (part.startsWith("\x1b[")) {
+      out += part;
+      continue;
+    }
+    for (const ch of part) {
+      const cw = vlen(ch);
+      if (w + cw > max) return `${out}${w < max ? " " : ""}${reset}`;
+      out += ch;
+      w += cw;
+    }
+  }
+  return `${out}${reset}`;
 }
 
 // Strip ESC/C0/C1 control bytes from any value we did NOT author before it lands in a
@@ -256,8 +326,9 @@ function renderBanner(width: number, p: Palette, mark: string[], modelProvider?:
   const bar = "─".repeat(inner + 2);
   const out = [`${p.BORDER}╭${bar}╮${p.RESET}`];
   for (const row of rows) {
-    const pad = Math.max(0, inner - vlen(row));
-    out.push(`${p.BORDER}│${p.RESET} ${row}${" ".repeat(pad)} ${p.BORDER}│${p.RESET}`);
+    const line = vclip(row, inner, p.RESET);
+    const pad = Math.max(0, inner - vlen(line));
+    out.push(`${p.BORDER}│${p.RESET} ${line}${" ".repeat(pad)} ${p.BORDER}│${p.RESET}`);
   }
   out.push(`${p.BORDER}╰${bar}╯${p.RESET}`);
   return out;
@@ -267,7 +338,9 @@ function renderBanner(width: number, p: Palette, mark: string[], modelProvider?:
 // provider so the account line reflects the picked model, and the live theme so every
 // colour tracks the terminal background (dark ink on light, light ink on dark). The
 // palette and mark are resolved once here (per theme), not per frame.
-function headerComponent(theme: any, modelProvider?: string) {
+// Exported for tests/banner.test.ts, which renders the real banner and checks the frame
+// is square — the failure mode is a one-cell drift no typecheck can catch.
+export function headerComponent(theme: any, modelProvider?: string) {
   const p = paletteFor(theme);
   const mark = buildMark(p);
   return {

package/extensions/privateer-hints.ts

@@ -0,0 +1,152 @@
+// Rotating tips in the working line. While the agent streams, the "Working..."
+// loader is dead air for seconds at a time — the one spot a discoverability hint
+// costs no vertical space and interrupts nothing. So while a turn is active we
+// rotate short tips through it for the keys and commands nobody finds on their
+// own: ctrl+t to hide thinking text (the ask that prompted this), shift+tab for
+// the thinking level, @file mentions, /models, and so on.
+//
+// Mechanics: ctx.ui.setWorkingMessage(msg) both stores the message for the next
+// working indicator AND live-updates the one currently on screen (and ONLY the
+// "working" kind — Pi's guard means retry/compaction spinners are never touched),
+// so a timer can rotate the text mid-stream. Calling it with no argument restores
+// Pi's default "Working...", which is what agent_end does. Timers run strictly
+// inside agent_start → agent_end, so an idle terminal owns no message at all.
+//
+// Keys render through pi-coding-agent's keyText, which reads the LIVE keybindings
+// singleton the running app configured — a user remap shows the remapped key, and
+// each hint carries a fallback for an unbound action. The first tip waits a beat
+// (FIRST_MS) so short turns never see one; the cursor is module-lifetime so
+// back-to-back turns continue the rotation instead of repeating tip #1.
+//
+// /hints on|off persists { hints: { enabled } } in ~/.privateer/config.json (ours;
+// Pi never reads that file) — read-modify-write, preserving unrelated keys.
+
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { keyText } from "@earendil-works/pi-coding-agent";
+import { configPath, globalDir } from "../src/config/paths.ts";
+
+const FIRST_MS = 6_000; // a turn shorter than this never shows a tip
+const EVERY_MS = 12_000;
+
+// keyText returns "" for an unbound action and could throw if the keybindings
+// singleton isn't initialized yet (headless surfaces) — fall back either way.
+function key(binding: Parameters<typeof keyText>[0], fallback: string): string {
+  try {
+    return keyText(binding) || fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+// Push-to-talk is pi-speak's own binding, not a Pi keybinding action, so keyText
+// can't see it — it lives in speak.json beside config.json and /talk key rebinds
+// it. Read it the same defensive way (any failure = the default).
+function talkKey(): string {
+  try {
+    const shortcut = JSON.parse(readFileSync(join(globalDir(), "speak.json"), "utf8"))?.input?.shortcut;
+    // An explicit "" is "unbound", not "missing" — only an absent field defaults.
+    return typeof shortcut === "string" ? shortcut : "ctrl+x";
+  } catch {
+    return "ctrl+x";
+  }
+}
+
+// Lazy thunks, not strings: keys resolve at display time, after the app has
+// loaded (and possibly remapped) its keybindings.
+const HINTS: Array<() => string> = [
+  () => `${key("app.thinking.toggle", "ctrl+t")} hides thinking text — make it stick in /settings`,
+  () => `${key("app.thinking.cycle", "shift+tab")} cycles the thinking level`,
+  () => `${key("app.message.followUp", "alt+enter")} queues a follow-up without interrupting`,
+  () => `${key("app.tools.expand", "ctrl+o")} expands collapsed tool output`,
+  () => `type @ to reference a file in your prompt — Tab completes the path`,
+  () => `/models picks a model, with TEE/ZDR privacy shields`,
+  () => `/init writes a PRIVATEER.md so the agent knows this project`,
+  () => `/connect adds MCP connectors to this terminal`,
+  () => `${key("app.editor.external", "ctrl+g")} drafts long prompts in your $EDITOR`,
+  () => {
+    const k = talkKey();
+    return k
+      ? `${k} is push-to-talk — /speak on reads the answer back`
+      : `/talk types what you say — /speak on reads the answer back`;
+  },
+  () => `these tips are /hints — /hints off silences them`,
+];
+
+// Default ON: absent file, absent block, or unreadable JSON all mean enabled.
+// Only an explicit { hints: { enabled: false } } turns the rotation off.
+function hintsEnabled(): boolean {
+  try {
+    return JSON.parse(readFileSync(configPath(), "utf8"))?.hints?.enabled !== false;
+  } catch {
+    return true;
+  }
+}
+
+function persistEnabled(enabled: boolean): void {
+  let cfg: any = {};
+  try {
+    cfg = JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    /* no config yet */
+  }
+  if (typeof cfg !== "object" || cfg === null || Array.isArray(cfg)) cfg = {};
+  cfg.hints = { ...(cfg.hints ?? {}), enabled };
+  try {
+    mkdirSync(globalDir(), { recursive: true });
+    writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + "\n");
+  } catch {
+    /* best effort — the toggle still holds for this session */
+  }
+}
+
+export default function privateerHints(pi: any): void {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let uiRef: any;
+  let cursor = 0;
+
+  const stop = (restoreDefault: boolean): void => {
+    if (timer !== undefined) {
+      clearTimeout(timer);
+      timer = undefined;
+    }
+    if (restoreDefault) uiRef?.setWorkingMessage?.();
+  };
+
+  const showNext = (): void => {
+    const hint = HINTS[cursor % HINTS.length]();
+    cursor++;
+    uiRef?.setWorkingMessage?.(`Working... · tip: ${hint}`);
+    timer = setTimeout(showNext, EVERY_MS);
+  };
+
+  pi.on("agent_start", (_e: any, ctx: any) => {
+    if (!ctx?.hasUI) return; // headless (print/rpc/harbor): no loader to write to
+    uiRef = ctx.ui;
+    stop(false); // an interrupted turn can restart without an agent_end between
+    if (!hintsEnabled()) return;
+    timer = setTimeout(showNext, FIRST_MS);
+  });
+
+  pi.on("agent_end", () => stop(true));
+  pi.on("session_shutdown", () => stop(false));
+
+  pi.registerCommand?.("hints", {
+    description: "Rotating tips in the working line: /hints [on | off]",
+    handler: (args: string, ctx: any) => {
+      uiRef = ctx?.ui ?? uiRef;
+      const sub = String(args ?? "").trim().toLowerCase().split(/\s+/)[0];
+      if (sub === "on" || sub === "off") {
+        const enabled = sub === "on";
+        persistEnabled(enabled);
+        if (!enabled) stop(true); // takes effect mid-turn; "on" starts next turn
+        ctx?.ui?.notify?.(`Working-line tips ${enabled ? "on" : "off"}.`, "info");
+        return;
+      }
+      ctx?.ui?.notify?.(
+        `Working-line tips are ${hintsEnabled() ? "on" : "off"} — /hints on|off to change.`,
+        "info",
+      );
+    },
+  });
+}

package/extensions/privateer-speak.ts

@@ -0,0 +1,124 @@
+// Spoken responses AND voice input for the TUI: the generic privateer-speak (pi-speak)
+// extension, plus Privateer's own providers hooked into both its registries — the
+// account's confidential-compute TTS (/api/audio/speech, same path as the app's Audio
+// studio and generate_speech; today Tinfoil qwen3-tts in an attested enclave) and its
+// confidential STT (/api/audio/transcribe, same tinfoil/near routing the app's voice
+// features use). Both inherit the account's entitlement, caps and billing.
+//
+// STREAMING, AND WHAT IT COSTS. Since pi-speak 0.2.0 a turn is spoken while it is still
+// being written: the stream is cut at sentence boundaries and each piece is synthesized
+// a clip or two ahead of playback. For this provider that means SEVERAL /api/audio/speech
+// calls per answer instead of one — same characters, same billing basis, more round
+// trips — which is the trade that makes the reply start in about the time one sentence
+// takes to speak. /speak stream off puts it back to one call at the end of the turn.
+//
+// NOT WIRED, DELIBERATELY. pi-speak passes two hints this account path has nowhere to
+// put: `rate` (0.5–3× pace) and the transcriber's vocabulary `prompt`. /api/audio/speech
+// takes { text, voice, format, ttsModelId } and /api/audio/transcribe takes
+// { audioBase64, format, language, sttModelId } — neither has a speed or bias field — so
+// sending them would be dead weight on the wire (and, for the vocabulary hint, project
+// nouns leaving the machine to be ignored). They stay unsent until the endpoints grow
+// them; both work today on the local and openai-compatible providers.
+//
+// PROVIDER ATTUNEMENT, NOT STOMPING. The provider registers with preferWhen: signed-in,
+// which the registry ranks ABOVE the built-in local voice but BELOW a deliberate /speak
+// provider pick — sign in and speech quietly upgrades from the OS voice to confidential
+// TTS, exactly the resolveSignedInModel pattern, with the model-persistence lesson
+// applied (a user who picked "local" stays on "local").
+//
+// HONEST FRAMING. "Confidential", never "private end-to-end": the utterance text leaves
+// the machine for the attested TTS enclave. That is the claim the label makes and the
+// only one it may make. And this only ever speaks in interactive UI sessions — pi-speak
+// gates on hasUI, so harbor/daemon/ACP surfaces stay silent by design (this extension is
+// manifest-only, like privateer-hints: buildMoat never includes it).
+//
+// VOICES. qwen3-tts speakers, mirrored from the server's TINFOIL_VOICES (the list is
+// static there too; first entry is the server-side default). Tinfoil requires the voice
+// param server-side, so the server applies "serena" when none is sent — leaving voice
+// unset here is always safe. If the account's default TTS model ever changes, update
+// this list with it.
+import { join } from "node:path";
+import { makePiSpeakExtension, registerSpeechProvider, registerTranscriptionProvider } from "privateer-speak";
+import { apiRequest, hasCredentials } from "../src/auth/privateer.ts";
+import { globalDir } from "../src/config/paths.ts";
+
+const QWEN3_TTS_VOICES = ["serena", "aiden", "dylan", "eric", "ono_anna", "ryan", "sohee", "uncle_fu", "vivian"];
+
+// Call an account audio endpoint and hand back the parsed JSON, throwing the server's
+// own (person-readable, localized) message on failure — same policy as media.ts's
+// callAccount: surface, never swallow.
+async function accountJson<T>(path: string, body: unknown, signal?: AbortSignal): Promise<T> {
+  let res: Response;
+  try {
+    res = await apiRequest(path, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+      ...(signal ? { signal } : {}),
+    });
+  } catch (e) {
+    throw new Error(`could not reach Privateer: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (!res.ok) {
+    let message = `Privateer returned ${res.status}`;
+    try {
+      const err = (await res.json()) as { message?: string; error?: { message?: string } };
+      message = err?.message ?? err?.error?.message ?? message;
+    } catch {
+      /* non-JSON body — the status message stands */
+    }
+    throw new Error(message);
+  }
+  return (await res.json()) as T;
+}
+
+registerSpeechProvider(
+  {
+    id: "privateer",
+    label: "Privateer account TTS (attested enclave)",
+    privacy: "confidential",
+    defaultVoice: QWEN3_TTS_VOICES[0],
+    voices: () => QWEN3_TTS_VOICES,
+    available: () => hasCredentials(),
+    fetchSpeech: async (text, { voice, signal }) => {
+      const { audioBase64 } = await accountJson<{ audioBase64?: string }>(
+        "/api/audio/speech",
+        { text, ...(voice ? { voice } : {}) },
+        signal,
+      );
+      if (!audioBase64) throw new Error("Privateer returned no audio");
+      return { data: Buffer.from(audioBase64, "base64"), format: "mp3" };
+    },
+  },
+  { preferWhen: () => hasCredentials() },
+);
+
+registerTranscriptionProvider(
+  {
+    id: "privateer",
+    label: "Privateer account STT (attested enclave)",
+    privacy: "confidential",
+    available: () => hasCredentials(),
+    transcribe: async (audio, { language, signal }) => {
+      const { text } = await accountJson<{ text?: string }>(
+        "/api/audio/transcribe",
+        {
+          audioBase64: Buffer.from(audio.data).toString("base64"),
+          format: audio.format,
+          ...(language ? { language } : {}),
+        },
+        signal,
+      );
+      return typeof text === "string" ? text : "";
+    },
+  },
+  { preferWhen: () => hasCredentials() },
+);
+
+export default function privateerSpeak(pi: any): void {
+  // Ours, beside config.json — NOT ~/.pi/speak.json, so a user who also runs plain Pi
+  // with the generic package keeps two independent setups instead of a fought-over
+  // file. globalDir() is read here, not at module load, so PRIVATEER_HOME set around
+  // session creation (tests, the daemon) is honoured.
+  makePiSpeakExtension({ configFile: join(globalDir(), "speak.json") })(pi);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.3",
+  "version": "0.12.6",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -60,7 +60,8 @@
     "start": "tsx src/main.ts",
     "chat": "node --env-file=.env --import tsx src/cli/chat.ts",
     "channels": "node --env-file=.env --import tsx src/channels/run.ts",
-    "dev": "tsx watch src/main.ts",
+    "dev": "node bin/privateer-launch.mjs",
+    "dev:fresh": "PRIVATEER_HOME=\"$PWD/.dev-home\" node bin/privateer-launch.mjs",
     "typecheck": "tsc --noEmit",
     "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
   },
@@ -71,7 +72,6 @@
     "@earendil-works/pi-ai": "^0.80.3",
     "@earendil-works/pi-coding-agent": "0.80.3",
     "@earendil-works/pi-tui": "^0.80.3",
-    "@hypabolic/pi-hypa": "^0.1.6",
     "@juicesharp/rpiv-ask-user-question": "^2.2.0",
     "@juicesharp/rpiv-web-tools": "^1.20.0",
     "@noble/ciphers": "^2.1.1",
@@ -84,6 +84,7 @@
     "pi-privacy": "^0.11.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
+    "privateer-speak": "0.2.0",
     "privateer-workflow": "^0.1.0",
     "tinfoil": "^1.1.11",
     "tsx": "^4.16.0",

package/src/config/moatManifest.json

@@ -11,16 +11,16 @@
     { "name": "privateer-privacy", "entry": "extensions/privateer-privacy.ts", "note": "pi-privacy + account tier resolver" },
     { "name": "privateer-connect", "entry": "extensions/privateer-connect.ts", "note": "/connect — MCP connector manager" },
     { "name": "privateer-media", "entry": "extensions/privateer-media.ts", "note": "image/video/speech/music + ffmpeg compose" },
+    { "name": "privateer-hints", "entry": "extensions/privateer-hints.ts", "note": "rotating tips in the working line + /hints" },
+    { "name": "privateer-speak", "entry": "extensions/privateer-speak.ts", "note": "spoken responses (/speak) + voice input (/talk) — pi-speak + confidential account TTS/STT" },
     { "name": "rpiv-web-tools", "dep": ["@juicesharp/rpiv-web-tools", "index.ts"], "note": "private web tools (user's own provider key)" },
     { "name": "rpiv-ask-user-question", "dep": ["@juicesharp/rpiv-ask-user-question", "index.ts"], "note": "ask_user_question" },
     { "name": "pi-mcp-adapter", "dep": ["pi-mcp-adapter", "index.ts"], "note": "MCP servers as first-class tools" },
-    { "name": "pi-hypa", "dep": ["@hypabolic/pi-hypa", "extensions", "index.ts"], "note": "hypa pack" },
     { "name": "pi-subagents", "dep": ["pi-subagents", "src", "extension", "index.ts"], "note": "bounded parallel sub-agents" }
   ],
-  "retired": ["pi-privacy", "pi-web-access"],
+  "retired": ["pi-privacy", "pi-web-access", "pi-hypa"],
   "reservedAliases": [
     "@juicesharp/rpiv-web-tools",
-    "@juicesharp/rpiv-ask-user-question",
-    "@hypabolic/pi-hypa"
+    "@juicesharp/rpiv-ask-user-question"
   ]
 }