privateer-agent 0.12.34 → 0.12.36

package/README.md

@@ -171,6 +171,13 @@ for how you installed) or check your version with `privateer --version`.
 > `~/.privateer/agent/settings.json`. Linux arm64 and Windows arm64 bundles aren't built
 > yet — arm64 Windows runs the x64 bundle under emulation.
 
+Background-task storage is created only when a task starts, not when you open Privateer.
+Tasks normally write logs to `.pi/tasks` in your working directory. If that directory
+denies writes (for example, Git Bash opened in `C:\Program Files\Git`), Privateer
+uses `~/.privateer/agent/tasks/<project-id>/<run-id>` instead, respecting
+`PRIVATEER_HOME`. The task's output path shows the actual location. This does **not**
+change the working directory for commands or grant permission to edit protected files.
+
 ### Verifying what you're about to run
 
 Privateer is a coding agent — it runs shell commands and edits files, so "should I trust

package/bin/apply-patches.mjs

@@ -67,13 +67,16 @@ export function resolveDep(from, name, ...rest) {
 }
 
 function resolvePatchRoots(repo, patchFiles) {
-  const roots = new Set();
+  const roots = new Map();
   for (const file of patchFiles) {
     // "@earendil-works+pi-coding-agent+0.80.3.patch" -> "@earendil-works/pi-coding-agent"
     const parts = path.basename(file, ".patch").split("+");
     const name = parts[0].startsWith("@") ? `${parts[0]}/${parts[1]}` : parts[0];
     const root = findDepRoot(repo, name);
-    if (root) roots.add(root);
+    if (root) {
+      if (!roots.has(root)) roots.set(root, []);
+      roots.get(root).push(file);
+    }
   }
   return [...roots];
 }
@@ -112,23 +115,35 @@ export function applyPatchesIfNeeded(repo, nodeBin = process.execPath) {
     if (!pp || !fs.existsSync(pp)) return "skipped";
 
     let did = false;
-    for (const root of roots) {
+    for (const [root, files] of roots) {
       const stampFile = path.join(root, "node_modules", ".privateer-patches.json");
       try {
         if (JSON.parse(fs.readFileSync(stampFile, "utf8")).hash === want) continue; // current
       } catch { /* missing or unreadable stamp — (re)apply */ }
 
-      // --patch-dir points at OUR patches even though cwd is wherever the deps landed.
-      // It MUST be relative: patch-package resolves it against cwd, so an absolute path
-      // is silently mangled into a non-existent one and every patch "fails" to apply.
-      const relPatchDir = path.relative(root, patchDir);
-      const r = spawnSync(nodeBin, [pp, "--error-on-fail", "--patch-dir", relPatchDir], {
-        cwd: root,
-        stdio: ["ignore", "ignore", "pipe"],
-        timeout: 60_000,
-        windowsHide: true,
-      });
-      if (r.status !== 0) return "failed";
+      // Different targets can be hoisted to different roots. Apply only the patches
+      // belonging to this root, or patch-package fails on the absent/wrong copy of
+      // another target. Keep the staging dir on the SAME drive on Windows: --patch-dir
+      // must be relative (an absolute path is mangled by patch-package).
+      let stagedDir;
+      try {
+        let sourceDir = patchDir;
+        if (files.length !== patchFiles.length) {
+          stagedDir = fs.mkdtempSync(path.join(root, "node_modules", ".privateer-patches-"));
+          for (const file of files) fs.copyFileSync(path.join(patchDir, file), path.join(stagedDir, file));
+          sourceDir = stagedDir;
+        }
+        const relPatchDir = path.relative(root, sourceDir);
+        const r = spawnSync(nodeBin, [pp, "--error-on-fail", "--patch-dir", relPatchDir], {
+          cwd: root,
+          stdio: ["ignore", "ignore", "pipe"],
+          timeout: 60_000,
+          windowsHide: true,
+        });
+        if (r.status !== 0) return "failed";
+      } finally {
+        if (stagedDir) fs.rmSync(stagedDir, { recursive: true, force: true });
+      }
       did = true;
 
       // Only stamp after a clean apply, so a partial/failed run retries next launch.

package/bin/privateer-launch.mjs

@@ -30,6 +30,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 import { routeUpdate } from "./update-route.mjs";
 import { runToCompletion } from "./run-to-completion.mjs";
+import { configureCompileCache } from "./startup-cache.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
 const REPO = path.resolve(HERE, "..");
@@ -41,15 +42,19 @@ const isWin = process.platform === "win32";
 // Unicode wave blocks and emojis into 3-byte mojibake that wraps and floods the console.
 if (isWin) {
   try {
-    const chcp = process.env.SystemRoot
-      ? path.join(process.env.SystemRoot, "System32", "chcp.com")
-      : "chcp.com";
-    spawnSync(chcp, ["65001"], { stdio: "ignore", windowsHide: true });
+    const comspec = process.env.ComSpec || "cmd.exe";
+    spawnSync(comspec, ["/d", "/s", "/c", "chcp 65001 >nul"], { stdio: "inherit", windowsHide: true });
   } catch {
     /* best effort */
   }
 }
 
+// Suppress upstream update checks: Pi's CLI update banner and pi-background-tasks'
+// update check / footer notice ("bg ⬆ v... /bg-update"). Privateer manages updates
+// at the distribution level via `privateer update` and its own banner.
+if (!process.env.PI_SKIP_VERSION_CHECK) process.env.PI_SKIP_VERSION_CHECK = "1";
+if (!process.env.PI_BG_DISABLE_UPDATE_CHECK) process.env.PI_BG_DISABLE_UPDATE_CHECK = "1";
+
 const PRIVATEER_HOME = process.env.PRIVATEER_HOME || path.join(os.homedir(), ".privateer");
 const ENV_FILE = path.join(REPO, ".env"); // dev-only; a real install has none
 const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");
@@ -165,6 +170,26 @@ if (NO_QUARTER) {
   );
 }
 
+// `--no-privacy` / `--privacy-off` — completely disable pi-privacy for this session.
+// Stripped before Pi's cli.js sees it. Exports PRIVATEER_PRIVACY_OFF=1 and PI_PRIVACY_OFF=1;
+// all PII scanning, prompts, and tool exfiltration/result checks are bypassed.
+const NO_PRIVACY = args.some((a) => a === "--no-privacy" || a === "--privacy-off");
+if (NO_PRIVACY) {
+  for (let i = args.length - 1; i >= 0; i--) if (args[i] === "--no-privacy" || args[i] === "--privacy-off") args.splice(i, 1);
+  process.env.PRIVATEER_PRIVACY_OFF = "1";
+  process.env.PI_PRIVACY_OFF = "1";
+  process.stderr.write(
+    [
+      "",
+      "  ⚓ \x1b[1;33mPrivacy off\x1b[0m — pi-privacy DISABLED for this session.",
+      "     PII scanning, tool exfiltration guards, and result credential redaction are OFF.",
+      "     Outbound requests and tool calls will NOT prompt or redact PII / IP addresses.",
+      "     Run /privacy on in-session to restore privacy protections.",
+      "",
+    ].join("\n") + "\n",
+  );
+}
+
 // `--allow-computer-control` — arm GUI control (screenshots, mouse, keyboard) for this
 // session. Stripped before Pi's cli.js sees it, exactly like --no-quarter above.
 //
@@ -348,6 +373,134 @@ if (sub === "update") {
   else updateSelf();
 }
 
+// --- `privateer init [directory]` ------------------------------------------
+// Scaffold a starter PRIVATEER.md project-context file. Runs synchronously and exits
+// immediately — no Pi boot, no splash screen, no API keys needed.
+else if (sub === "init") {
+  const rest = args.slice(1);
+  const help = rest.includes("--help") || rest.includes("-h");
+  const cmd = process.env.PRIVATEER_CMD || "privateer";
+  if (help) {
+    console.log(
+      [
+        `${cmd} init — scaffold a starter PRIVATEER.md project-context file.`,
+        "",
+        `Usage: ${cmd} init [directory]`,
+        "",
+        "Options:",
+        "  -h, --help    Show this help message",
+        "",
+        "Creates a starter PRIVATEER.md in the current directory (or the specified directory).",
+        "Privateer loads this file automatically at startup to give the agent project context.",
+      ].join("\n"),
+    );
+    process.exit(0);
+  }
+
+  const unknownOpt = rest.find((a) => a.startsWith("-"));
+  if (unknownOpt) {
+    console.error(`privateer init: unknown option '${unknownOpt}'`);
+    console.error(`Run '${cmd} init --help' for usage.`);
+    process.exit(1);
+  }
+
+  const positionals = rest.filter((a) => !a.startsWith("-"));
+  if (positionals.length > 1) {
+    console.error(`privateer init: unexpected argument '${positionals[1]}'`);
+    console.error(`Run '${cmd} init --help' for usage.`);
+    process.exit(1);
+  }
+
+  const targetDir = positionals[0] ? path.resolve(positionals[0]) : process.cwd();
+  if (!fs.existsSync(targetDir) || !fs.statSync(targetDir).isDirectory()) {
+    console.error(`privateer init: directory not found '${targetDir}'`);
+    process.exit(1);
+  }
+
+  const targetFile = path.join(targetDir, "PRIVATEER.md");
+  if (fs.existsSync(targetFile)) {
+    console.log(`PRIVATEER.md already exists at ${targetFile} — left untouched.`);
+    process.exit(0);
+  }
+
+  const template = [
+    "# PRIVATEER.md",
+    "",
+    "Project context for the Privateer agent. Privateer loads this file automatically at",
+    "startup (the same way it loads AGENTS.md / CLAUDE.md) and prepends it to the model's",
+    "system prompt — so put anything the agent should always know about THIS project here.",
+    "",
+    "## Project",
+    "",
+    "<One or two lines: what this project is and what it does.>",
+    "",
+    "## Conventions",
+    "",
+    "- <Coding style, patterns, and idioms to follow.>",
+    "- <Things to avoid.>",
+    "",
+    "## Commands",
+    "",
+    "- build: <command>",
+    "- test: <command>",
+    "- run: <command>",
+    "",
+    "## Notes for the agent",
+    "",
+    "- <Domain context, gotchas, or constraints worth stating once.>",
+    "",
+  ].join("\n");
+
+  try {
+    fs.writeFileSync(targetFile, template, "utf8");
+    console.log(`\x1b[32m✓\x1b[0m Created ${targetFile}`);
+    console.log("  Edit it with your project's context — it loads automatically on every turn.");
+    process.exit(0);
+  } catch (err) {
+    console.error(`privateer init: failed to write ${targetFile} — ${err.message}`);
+    process.exit(1);
+  }
+}
+
+// --- `privateer help [command]` / `privateer --help` ------------------------
+else if (sub === "help" || (args.length === 1 && (args[0] === "--help" || args[0] === "-h"))) {
+  const target = sub === "help" ? args[1] : undefined;
+  const cmd = process.env.PRIVATEER_CMD || "privateer";
+  if (target === "init") {
+    console.log(
+      [
+        `${cmd} init — scaffold a starter PRIVATEER.md project-context file.`,
+        "",
+        `Usage: ${cmd} init [directory]`,
+        "",
+        "Options:",
+        "  -h, --help    Show this help message",
+        "",
+        "Creates a starter PRIVATEER.md in the current directory (or the specified directory).",
+        "Privateer loads this file automatically at startup to give the agent project context.",
+      ].join("\n"),
+    );
+    process.exit(0);
+  }
+  if (target === "update") {
+    console.log(
+      [
+        `${cmd} update — fetch the latest release, or newer tool packs.`,
+        "",
+        `  ${cmd} update                  update the Privateer CLI itself`,
+        `  ${cmd} update --extensions     update every installed tool pack`,
+        `  ${cmd} update <pack>           update one pack (npm name or git URL)`,
+        `  ${cmd} update --all            tool packs, then the CLI`,
+        "",
+        "Inside a running terminal, /update fetches tool packs in place — no restart.",
+      ].join("\n"),
+    );
+    process.exit(0);
+  }
+  printPrivateerHelp(cmd);
+  process.exit(0);
+}
+
 // --- `privateer harbor [run|install|uninstall|status]` ---------------------
 // The resident background harbor (routines + app-driven headless task spawns). Boots
 // straight into src/harbor via bin/privateer-harbor.mjs — the harbor loads the moat as
@@ -390,6 +543,10 @@ else if (sub === "acp") {
 
 // --- normal launch: resolve the moat, then exec Pi's TUI with it -----------
 else {
+  // Node 22 can reuse compiled code across launches instead of reparsing Pi and every
+  // provider SDK. Set the child env before any Node spawn; children inherit it too.
+  configureCompileCache(PRIVATEER_HOME);
+
   // Windows has no bash out of the box, but Privateer's command tool needs one. If a
   // real bash isn't reachable, stop here with a clear, actionable message — otherwise
   // the user boots fine and only hits a cryptic `'bash' is not recognized` the first
@@ -447,6 +604,7 @@ else {
   // Suppress Pi's upstream update banner (our banner is the startup surface). Disables
   // ONLY the version fetch — fd/rg can still download on first run.
   if (!process.env.PI_SKIP_VERSION_CHECK) process.env.PI_SKIP_VERSION_CHECK = "1";
+  if (!process.env.PI_BG_DISABLE_UPDATE_CHECK) process.env.PI_BG_DISABLE_UPDATE_CHECK = "1";
 
   // Quiet Pi's built-in startup chatter so our banner is the only greeting. Each key is
   // set only when unset, so a user's own settings.json toggle still wins.
@@ -551,8 +709,21 @@ else {
   // TUI branch only: harbor/acp/subagent children have no terminal to animate on (and
   // acp's stdout is a JSON-RPC stream). pathToFileURL, not the bare path — a Windows
   // absolute path reads as the URL scheme "d:"; see bin/privateer.mjs for the same trap.
+  const isNonInteractive = args.some(
+    (a) =>
+      a === "-p" ||
+      a === "--print" ||
+      a === "--mode" ||
+      a === "--export" ||
+      a === "--list-models" ||
+      a === "--help" ||
+      a === "-h" ||
+      a === "-v" ||
+      a === "-V" ||
+      a === "--version",
+  );
   const splash = path.join(HERE, "privateer-splash.mjs");
-  if (fs.existsSync(splash)) nodeArgs.push("--import", pathToFileURL(splash).href);
+  if (!isNonInteractive && fs.existsSync(splash)) nodeArgs.push("--import", pathToFileURL(splash).href);
 
   runToCompletion(NODE_BIN, [...nodeArgs, CLI, ...modelArgs, ...extArgs, ...skillArgs, ...args]);
 }
@@ -701,6 +872,74 @@ function warnKeylessLaunch() {
   process.stderr.write(lines.join("\n") + "\n");
 }
 
+function printPrivateerHelp(cmd = process.env.PRIVATEER_CMD || "privateer") {
+  console.log(
+    [
+      "privateer - Terminal & TUI coding agent with verified privacy and local control",
+      "",
+      "Usage:",
+      `  ${cmd} [options] [--] [@files...] [messages...]`,
+      "",
+      "Commands:",
+      `  ${cmd} init [directory]     Create a starter PRIVATEER.md project-context file`,
+      `  ${cmd} update [--all]       Fetch the latest release or newer tool packs`,
+      `  ${cmd} harbor <command>     Manage the resident background Harbor daemon (run/install/uninstall/status)`,
+      `  ${cmd} verify               Check local installation integrity and patch state`,
+      `  ${cmd} acp                  Run as an Agent Client Protocol server (JSON-RPC on stdio)`,
+      `  ${cmd} install <source>     Install extension source and add to settings`,
+      `  ${cmd} remove <source>      Remove extension source from settings`,
+      `  ${cmd} uninstall <source>   Alias for remove`,
+      `  ${cmd} list                 List installed extensions from settings`,
+      `  ${cmd} config               Open TUI to enable/disable package resources`,
+      `  ${cmd} auth <command>       Print credentials or check provider readiness`,
+      `  ${cmd} <command> --help     Show help for a specific command`,
+      "",
+      "Options:",
+      "  --provider <name>              Provider name",
+      '  --model <pattern>              Model pattern or ID (supports "provider/id" and optional ":<thinking>")',
+      "  --api-key <key>                API key (defaults to env vars)",
+      "  --system-prompt <text>         System prompt (default: coding assistant prompt)",
+      "  --append-system-prompt <text>  Append text or file contents to the system prompt",
+      "  --mode <mode>                  Output mode: text (default), json, or rpc",
+      "  --print, -p                    Non-interactive mode: process prompt and exit",
+      "  --continue, -c                 Continue previous session",
+      "  --resume, -r                   Select a session to resume",
+      "  --session <path|id>            Use specific session file or partial UUID",
+      "  --session-id <id>              Use exact project session ID, creating it if missing",
+      "  --fork <path|id>               Fork specific session file or partial UUID into a new session",
+      "  --session-dir <dir>            Directory for session storage and lookup",
+      "  --no-session                   Don't save session (ephemeral)",
+      "  --name, -n <name>              Set session display name",
+      "  --models <patterns>            Comma-separated model patterns for Ctrl+P cycling",
+      "  --no-tools, -nt                Disable all tools by default (built-in and extension)",
+      "  --no-builtin-tools, -nbt       Disable built-in tools by default",
+      "  --tools, -t <tools>            Comma-separated allowlist of tool names to enable",
+      "  --exclude-tools, -xt <tools>   Comma-separated denylist of tool names to disable",
+      "  --thinking <level>             Set thinking level: off, minimal, low, medium, high, xhigh, max",
+      "  --extension, -e <path>         Load an extension file (can be used multiple times)",
+      "  --no-extensions, -ne           Disable extension discovery (explicit -e paths still work)",
+      "  --skill <path>                 Load a skill file or directory (can be used multiple times)",
+      "  --no-skills, -ns               Disable skills discovery and loading",
+      "  --prompt-template <path>       Load a prompt template file or directory",
+      "  --no-prompt-templates, -np     Disable prompt template discovery and loading",
+      "  --theme <path>                 Load a theme file or directory",
+      "  --use-theme <name[/name]>      Set the initial interactive theme for this run",
+      "  --no-themes                    Disable theme discovery and loading",
+      "  --no-context-files, -nc        Disable PRIVATEER.md, AGENTS.md and CLAUDE.md discovery",
+      "  --export <file>                Export session file to HTML and exit",
+      "  --list-models [search]         List available models (with optional fuzzy search)",
+      "  --verbose                      Force verbose startup",
+      "  --tui-mode <mode>              TUI mode: regular (default) or fullscreen",
+      "  --approve, -a                  Trust project-local files for this run",
+      "  --no-approve, -na              Ignore project-local files for this run",
+      "  --offline                      Disable startup network operations",
+      "  --                             End option parsing; treat remaining arguments as messages/files",
+      "  --help, -h                     Show this help",
+      "  --version, -v, -V              Show version number",
+    ].join("\n"),
+  );
+}
+
 function refreshUpdateCache() {
   const cache = path.join(PRIVATEER_HOME, "update-check.json");
   try {

package/bin/privateer-splash.mjs

@@ -64,10 +64,8 @@ const enabled =
 // than privateer.cmd, the console might still be on OEM CP437.
 if (enabled && process.platform === "win32") {
   try {
-    const chcp = process.env.SystemRoot
-      ? path.join(process.env.SystemRoot, "System32", "chcp.com")
-      : "chcp.com";
-    spawnSync(chcp, ["65001"], { stdio: "ignore", windowsHide: true });
+    const comspec = process.env.ComSpec || "cmd.exe";
+    spawnSync(comspec, ["/d", "/s", "/c", "chcp 65001 >nul"], { stdio: "inherit", windowsHide: true });
   } catch {
     /* best effort */
   }

package/bin/privateer-subagent.mjs

@@ -74,6 +74,8 @@ export function buildChildArgs(originalArgs, repoRoot = REPO, env = process.env)
 
 // Run only when invoked directly (not when imported by the test).
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  if (!process.env.PI_SKIP_VERSION_CHECK) process.env.PI_SKIP_VERSION_CHECK = "1";
+  if (!process.env.PI_BG_DISABLE_UPDATE_CHECK) process.env.PI_BG_DISABLE_UPDATE_CHECK = "1";
   const args = buildChildArgs(process.argv.slice(2));
   const child = spawn(process.execPath, [piCliPath(), ...args], { stdio: "inherit", env: process.env });
   // Propagate the child's exit faithfully so pi-subagents' parent reads the real

package/bin/startup-cache.d.mts

@@ -0,0 +1 @@
+export function configureCompileCache(privateerHome: string, env?: NodeJS.ProcessEnv): void;

package/bin/startup-cache.mjs

@@ -0,0 +1,19 @@
+import fs from "node:fs";
+import path from "node:path";
+
+// Set this BEFORE spawning Node: enabling it after importing Pi misses the expensive
+// module graph. Node keys bytecode by runtime version and source contents; /reload
+// still evaluates fresh modules. This is not Jiti's in-memory module cache.
+// Keep it outside the install/project (both may be read-only), under the same home
+// as the rest of this Privateer instance. Only code is cached, not session state.
+export function configureCompileCache(privateerHome, env = process.env) {
+  // Respect Node's own override/opt-out, including an explicitly empty cache path.
+  if (env.NODE_COMPILE_CACHE !== undefined || env.NODE_DISABLE_COMPILE_CACHE === "1") return;
+  try {
+    const dir = path.resolve(privateerHome, "cache", "node-compile");
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    env.NODE_COMPILE_CACHE = dir;
+  } catch {
+    // An unavailable cache must never prevent startup (or print on ACP stdout).
+  }
+}

package/extensions/privateer-models.ts

@@ -30,6 +30,7 @@ import {
   accountPosture,
   fetchAccountCatalog,
 } from "../src/providers/account.ts";
+import { writePiDefaultModel } from "../src/providers/defaultModel.ts";
 
 // A minimal view of Pi's theme (passed to the ui.custom factory) — enough to color
 // text without pulling Pi's internal theme types into an extension.
@@ -353,11 +354,7 @@ export default function privateerModels(pi: {
     argumentHint: "[search]",
     handler: async (args: string, ctx: any): Promise<void> => {
       const ui = ctx?.ui;
-      if (!ui?.custom) {
-        ctx?.ui?.notify?.("The model picker needs an interactive terminal.", "warning");
-        return;
-      }
-      const registry = ctx.modelRegistry;
+      const registry = ctx?.modelRegistry;
       // Refresh so a just-fetched account catalog / models.json edit is reflected.
       try {
         registry?.refresh?.();
@@ -376,13 +373,43 @@ export default function privateerModels(pi: {
 
       let available: ModelLike[] = [];
       try {
-        available = (await registry.getAvailable()) as ModelLike[];
+        available = (await registry?.getAvailable?.()) as ModelLike[] ?? [];
       } catch (e) {
-        ui.notify?.(`Couldn't list models: ${(e as Error).message}`, "error");
+        ui?.notify?.(`Couldn't list models: ${(e as Error).message}`, "error");
         return;
       }
       if (!available.length) {
-        ui.notify?.("No models available. Use /login to add a provider.", "warning");
+        ui?.notify?.("No models available. Use /login to add a provider.", "warning");
+        return;
+      }
+
+      const initialQuery = String(args ?? "").trim();
+      if (!ui?.custom) {
+        if (initialQuery) {
+          const match = available.find(
+            (m) => `${m.provider}/${m.id}` === initialQuery || m.id === initialQuery,
+          );
+          if (match) {
+            try {
+              const ok = await pi.setModel!(match);
+              if (ok === false) {
+                ui?.notify?.(`No API key for ${match.provider}/${match.id}.`, "warning");
+                return;
+              }
+              writePiDefaultModel(`${match.provider}/${match.id}`);
+              const tier = baselineTier(match.provider, match.id);
+              ui?.notify?.(
+                `Model: ${match.provider}/${match.id}  ·  ${TIERS[tier].label}`,
+                "info",
+              );
+              return;
+            } catch (e) {
+              ui?.notify?.(`Couldn't switch model: ${(e as Error).message}`, "error");
+              return;
+            }
+          }
+        }
+        ui?.notify?.("The model picker needs an interactive terminal.", "warning");
         return;
       }
 
@@ -394,7 +421,6 @@ export default function privateerModels(pi: {
         tier: baselineTier(m.provider, m.id),
       }));
 
-      const initialQuery = String(args ?? "").trim();
       const chosen: Row | undefined = await ui.custom(
         (tui: TuiLike, theme: ThemeLike, _kb: unknown, close: (result?: Row) => void) => {
           const picker = new ModelsPicker({
@@ -417,6 +443,7 @@ export default function privateerModels(pi: {
           ui.notify?.(`No API key for ${chosen.provider}/${chosen.id}.`, "warning");
           return;
         }
+        writePiDefaultModel(`${chosen.provider}/${chosen.id}`);
         ui.notify?.(
           `Model: ${chosen.provider}/${chosen.id}  ·  ${TIERS[chosen.tier].label}`,
           "info",

package/extensions/privateer-posture.ts

@@ -9,6 +9,7 @@
 import { verifyModelPosture, TIERS, type PrivacyTier } from "pi-privacy";
 import { accountPosture } from "../src/providers/account.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
+import { privacyDisabled } from "../src/config/privacyDisabled.ts";
 
 const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
 
@@ -35,11 +36,39 @@ async function badgeFor(provider: string, modelId: string, p: Palette): Promise<
   return `${DOT[info.posture] ?? "⚪"} ${info.label}`;
 }
 
+export async function updatePostureBadge(ctx: any, provider?: string, modelId?: string): Promise<void> {
+  if (!ctx?.ui?.setStatus) return;
+  if (privacyDisabled()) {
+    ctx.ui.setStatus("privacy", "⚑ privacy off");
+    ctx.ui.setStatus("pi-privacy", undefined);
+    return;
+  }
+  const p = provider ?? ctx?.model?.provider;
+  const m = modelId ?? ctx?.model?.id;
+  if (!p || !m) {
+    ctx.ui.setStatus("privacy", undefined);
+    return;
+  }
+  try {
+    ctx.ui.setStatus("privacy", "⛉ …");
+    const badge = await badgeFor(p, m, paletteFor(ctx?.ui?.theme));
+    ctx.ui.setStatus("privacy", badge);
+  } catch {
+    ctx.ui.setStatus("privacy", undefined);
+  }
+}
+
 export default function privateerPosture(pi: any): void {
   // "latest wins" so rapid model cycling (Ctrl+P) doesn't leave a stale badge.
   let seq = 0;
   const update = async (provider?: string, modelId?: string, ctx?: any) => {
-    if (!provider || !modelId || !ctx?.ui?.setStatus) return;
+    if (!ctx?.ui?.setStatus) return;
+    if (privacyDisabled()) {
+      ctx.ui.setStatus("privacy", "⚑ privacy off");
+      ctx.ui.setStatus("pi-privacy", undefined);
+      return;
+    }
+    if (!provider || !modelId) return;
     const mine = ++seq;
     try {
       ctx.ui.setStatus("privacy", "⛉ …"); // immediate placeholder while attesting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.34",
+  "version": "0.12.36",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -90,7 +90,7 @@
     "privateer-workflow": "0.1.0",
     "tinfoil": "1.1.11",
     "tsx": "4.23.0",
-    "typebox": "1.3.4",
+    "typebox": "1.3.7",
     "undici": "7.29.0",
     "ws": "8.21.0",
     "yaml": "2.9.0",

package/patches/@earendil-works+pi-ai+0.84.4.patch

@@ -0,0 +1,46 @@
+diff --git a/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js b/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
+index 216a45f..a1e3214 100644
+--- a/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
++++ b/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
+@@ -1,11 +1,38 @@
+ import { estimateContextTokens } from "../utils/estimate.js";
+ const CONTEXT_SAFETY_TOKENS = 4096;
+-const MIN_MAX_TOKENS = 1;
++// Privateer patch: floor the answer budget at a usable answer, not at one token.
++//
++// Stock pi floored this at 1, so the moment the (chars/4) context estimate reached
++// the declared window every turn asked the provider for ONE token: the whole prompt
++// still sent, still billed, one token back with finish_reason "length" — which the
++// TUI renders as "Response was truncated before completion." Compaction gets one
++// attempt, and when the estimate is still over afterwards the session stays there,
++// burning a full-price prompt per turn and producing nothing. Privateer reaches it
++// early because every account model is registered with a flat contextWindow of
++// 128000 (src/providers/account.ts seedModel) — /api/models publishes no per-model
++// window — so a larger-windowed model hits this ceiling with room to spare.
++//
++// The floor only raises `available`; the Math.min still honours a deliberately small
++// ask (a summariser, a title), and it is smaller than the CONTEXT_SAFETY_TOKENS
++// already subtracted above, so a floored request was inside that margin anyway. When
++// `available` is genuinely negative the context really does not fit and the provider
++// says so — a context-length error, which pi routes to compaction via
++// isContextOverflow. That is the designed recovery, and strictly better than a
++// silent one-token stub that costs the same.
++//
++// The floor is MIN_ANSWER_TOKENS, this module's OWN constant — declared below at its
++// original site, deliberately not redeclared here (a second top-level `const` of that
++// name is a SyntaxError that takes the whole app down). Reading it from below is safe:
++// clampMaxTokensToContext is only ever called at request time, long after module
++// evaluation, so the temporal dead zone has closed. Same value, same meaning, and it
++// stays in sync if upstream retunes it.
++//
++// Mirrors src/engine/contextBudget.ts, which is where this is specified and tested.
+ export function clampMaxTokensToContext(model, context, maxTokens) {
+     if (model.contextWindow <= 0)
+-        return Math.max(MIN_MAX_TOKENS, maxTokens);
++        return Math.max(1, maxTokens);
+     const available = model.contextWindow - estimateContextTokens(context).tokens - CONTEXT_SAFETY_TOKENS;
+-    return Math.min(maxTokens, Math.max(MIN_MAX_TOKENS, available));
++    return Math.min(maxTokens, Math.max(MIN_ANSWER_TOKENS, available));
+ }
+ export function buildBaseOptions(model, context, options, apiKey) {
+     const samplingParams = model.samplingParams || options?.samplingParams