privateer-agent 0.12.34 → 0.12.36

package/src/config/privacyPolicy.ts

@@ -36,6 +36,8 @@ import { cliPalette, detectScheme } from "../ui/palette.ts";
 import { accountPosture, privateerChannel } from "../providers/account.ts";
 import { hasCredentials } from "../auth/privateer.ts";
 import { writePiDefaultModel } from "../providers/defaultModel.ts";
+import { privacyDisabled, setPrivacyDisabled } from "./privacyDisabled.ts";
+import { updatePostureBadge } from "../../extensions/privateer-posture.ts";
 
 // Color-coat pi-privacy's auto-redact notice as the moat acting on your behalf: the red
 // no-quarter flag (same glyph and color as the no-quarter banner in chat.ts and the gate
@@ -67,6 +69,7 @@ export function sharedPrivacyOptions() {
   const ambient = loadConfig();
   return {
     ...ambient,
+    disabled: privacyDisabled,
     // The account channel's real posture. pi-privacy ships a `privateer` provider, but it
     // is the PUBLIC developer-key channel (sk-priv-…, server-proxied and unverifiable
     // end-to-end), so from the package alone every privateer/* model floors to
@@ -131,69 +134,161 @@ export function sharedPrivacyOptions() {
 // Registered from HERE rather than from the extension file, for the reason this module
 // exists at all: the factory-built sessions and the discovered extension must not drift.
 function registerPrivacyCommand(pi: any): void {
-  pi.registerCommand?.("privacy", {
-    description: "Values the PII gate must not treat as personal data: /privacy [allow <value> | unallow <value>]",
-    handler: (args: string, ctx: any) => {
-      const raw = String(args ?? "").trim();
-      const [verb, ...rest] = raw.split(/\s+/);
-      const value = rest.join(" ").trim();
-      const notify = (msg: string, level: "info" | "warning" = "info") => ctx?.ui?.notify?.(msg, level);
-
-      if (verb === "allow" || verb === "unallow") {
-        if (!value) return notify(`usage: /privacy ${verb} <value>`, "warning");
-        const r = verb === "allow" ? addPiiAllow(value) : removePiiAllow(value);
-        return notify(r.message, r.ok ? "info" : "warning");
-      }
-      if (verb) return notify(`unknown option "${verb}" — usage: /privacy [allow <value> | unallow <value>]`, "warning");
+  const handler = async (args: string, ctx: any) => {
+    const raw = String(args ?? "").trim();
+    const [verb, ...rest] = raw.split(/\s+/);
+    const value = rest.join(" ").trim();
+    const notify = (msg: string, level: "info" | "warning" = "info") => ctx?.ui?.notify?.(msg, level);
 
+    if (verb === "off" || verb === "disable") {
+      setPrivacyDisabled(true);
+      await updatePostureBadge(ctx);
+      return notify(
+        "⚑ pi-privacy is completely OFF for this session. Outbound requests will not be scanned or gated for PII, " +
+          "and tool exfiltration, result, and downgrade guards are disabled. Run /privacy on to restore.",
+        "warning",
+      );
+    }
+
+    if (verb === "on" || verb === "enable" || verb === "restore") {
+      setPrivacyDisabled(false);
+      await updatePostureBadge(ctx);
+      return notify(
+        "pi-privacy is ON for this session. PII scanning, tool exfiltration guards, and privacy checks restored.",
+        "info",
+      );
+    }
+
+    if (verb === "status") {
+      const state = privacyDisabled() ? "OFF (disabled for this session)" : "ON (active)";
       const mine = piiAllowEntries();
-      notify(
+      return notify(
         [
+          `pi-privacy status: ${state}`,
           mine.length ? `PII allowlist (~/.privateer/config.json):\n  ${mine.join("\n  ")}` : "PII allowlist: empty",
-          "Reserved shapes (example.com, loopback, noreply@…) are allowed by default and not listed here.",
-          "Add one with /privacy allow <value> — an address (me@acme.com), a domain (@acme.com),",
-          "an IPv4 block (10.0.0.0/8), or any exact/globbed value.",
+          "Reserved shapes (example.com, loopback, noreply@…) are allowed by default.",
+          "Commands: /privacy off | /privacy on | /privacy status | /privacy allow <value> | /privacy unallow <value>",
         ].join("\n"),
         "info",
       );
+    }
+
+    if (verb === "allow" || verb === "unallow") {
+      if (!value) return notify(`usage: /privacy ${verb} <value>`, "warning");
+      const r = verb === "allow" ? addPiiAllow(value) : removePiiAllow(value);
+      return notify(r.message, r.ok ? "info" : "warning");
+    }
+
+    if (verb && verb !== "help") {
+      return notify(`unknown option "${verb}" — usage: /privacy [off | on | status | allow <value> | unallow <value>]`, "warning");
+    }
+
+    const state = privacyDisabled() ? "OFF (disabled for this session)" : "ON (active)";
+    const mine = piiAllowEntries();
+    notify(
+      [
+        `pi-privacy status: ${state}`,
+        mine.length ? `PII allowlist (~/.privateer/config.json):\n  ${mine.join("\n  ")}` : "PII allowlist: empty",
+        "Reserved shapes (example.com, loopback, noreply@…) are allowed by default and not listed here.",
+        "Commands:",
+        "  /privacy off              — turn off pi-privacy completely for this session",
+        "  /privacy on               — restore pi-privacy protections",
+        "  /privacy status           — show current status and allowlist",
+        "  /privacy allow <value>    — add value to PII allowlist",
+        "  /privacy unallow <value>  — remove value from PII allowlist",
+      ].join("\n"),
+      "info",
+    );
+  };
+
+  const spec = {
+    description: "Manage privacy protections: /privacy [off | on | status | allow <value> | unallow <value>]",
+    handler,
+    getArgumentCompletions: (prefix: string) => {
+      const p = prefix.trim().toLowerCase();
+      const verbs = ["off", "on", "status", "allow", "unallow"];
+      return verbs.filter((v) => v.startsWith(p)).map((v) => ({ value: v, label: v }));
+    },
+  };
+
+  pi.registerCommand?.("privacy", spec);
+  pi.registerCommand?.("pi-privacy", {
+    ...spec,
+    description: "Alias for /privacy: /pi-privacy [off | on | status | allow <value> | unallow <value>]",
+  });
+}
+
+/**
+ * Intercept pi-privacy's event registrations and commands so that when pi-privacy is completely
+ * disabled via `/privacy off` (or `PRIVATEER_PRIVACY_OFF=1` / `PI_PRIVACY_OFF=1`),
+ * all gating, prompt, and redaction hooks are cleanly bypassed.
+ */
+function gatingPrivacyPi(pi: any): any {
+  const on = (event: string, handler: any) => {
+    if (typeof pi?.on !== "function") return;
+    if (typeof handler !== "function") return pi.on(event, handler);
+
+    if (
+      event === "before_provider_request" ||
+      event === "tool_call" ||
+      event === "user_bash" ||
+      event === "tool_result" ||
+      event === "model_select"
+    ) {
+      return pi.on(event, async (ev: any, ctx: any) => {
+        if (privacyDisabled()) return undefined;
+        return handler(ev, ctx);
+      });
+    }
+
+    return pi.on(event, handler);
+  };
+
+  const registerCommand = (name: string, spec: any) => {
+    if (typeof pi?.registerCommand !== "function") return;
+    if (name === "pii" && spec && typeof spec.handler === "function") {
+      const orig = spec.handler;
+      const wrappedHandler = async (args: string, ctx: any) => {
+        const raw = String(args ?? "").trim().toLowerCase();
+        const [verb] = raw.split(/\s+/);
+        if (verb === "off" || verb === "disable") {
+          setPrivacyDisabled(true);
+          await updatePostureBadge(ctx);
+        } else if (verb === "on" || verb === "enable" || verb === "restore") {
+          setPrivacyDisabled(false);
+          await updatePostureBadge(ctx);
+        }
+        return orig(args, ctx);
+      };
+      return pi.registerCommand(name, { ...spec, handler: wrappedHandler });
+    }
+    return pi.registerCommand(name, spec);
+  };
+
+  return new Proxy(pi, {
+    get(target, prop, receiver) {
+      if (prop === "on") return on;
+      if (prop === "registerCommand") return registerCommand;
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
     },
   });
 }
 
 /**
  * The privacy half of the moat as ONE factory: pi-privacy configured the Privateer way,
- * plus the `/privacy` command that maintains its allowlist. Both routes into pi-privacy
+ * plus the `/privacy` command that maintains its allowlist and toggles. Both routes into pi-privacy
  * (src/config/moat.ts and extensions/privateer-privacy.ts) use this, so neither can end
  * up with the gate but not its escape hatch.
  */
 export function privacyExtension() {
   const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
   return function privateerPrivacyCore(pi: any): void {
-    privacy(persistingModelPicks(pi));
+    privacy(gatingPrivacyPi(persistingModelPicks(pi)));
     registerPrivacyCommand(pi);
   };
 }
 
-/**
- * pi-privacy's `/models` picker switched the live session and stopped there, so the
- * pick lasted exactly as long as the terminal and the next one launched on whatever
- * settings.json still said. Pi persists a switch only for a caller that passes
- * `{ persist: true }`, and the extension api it reaches setModel through forwards no
- * options at all (see savedPiDefaultSpec in providers/defaultModel.ts).
- *
- * Pi's own selector splits the two — Enter switches for the session, ctrl+s makes it
- * the default. OUR picker has no second key to press and never advertised a
- * distinction, so a pick made in it means "this is my model": we persist it.
- *
- * Wrapped here rather than fixed inside pi-privacy so the rule sits with the rest of
- * what Privateer configures on that extension, and so it stays scoped to the picker.
- * The brand extension's sign-in switch shares the same api and deliberately does NOT
- * get this — writePiDefaultModel says why an automatic switch must not persist.
- *
- * A Proxy, not a spread: the api object is a plain literal today, but a spread of a
- * class instance would silently drop every method and take pi-privacy down with it.
- * Forwarding leaves that failure mode impossible.
- */
 function persistingModelPicks(pi: any): any {
   if (typeof pi?.setModel !== "function") return pi;
   const setModel = async (model: any) => {

package/src/engine/contextBudget.ts

@@ -0,0 +1,74 @@
+// How many output tokens a turn may ask for, once the prompt has taken its share.
+//
+// Mirrors the patched clampMaxTokensToContext in pi-ai (api/simple-options.js) —
+// that copy is what actually runs; this one is where the behaviour is specified and
+// tested. See patches/@earendil-works+pi-ai+0.84.4.patch.
+//
+// ── The bug this exists to fix ───────────────────────────────────────────────
+//
+// Stock pi computes the answer budget as
+//
+//     available = contextWindow − estimateContextTokens(context) − 4096
+//     maxTokens = min(asked, max(1, available))
+//
+// and that floor is literally `1`. So the moment the estimate reaches the declared
+// window, every turn asks the provider for ONE token. The request still goes out,
+// still sends the whole prompt, and is still billed in full — and comes back with a
+// single token and `finish_reason: "length"`, which the TUI renders as "Response was
+// truncated before completion." Compaction runs once, and if the estimate is still
+// over (it usually is — see below) the session is stuck there: every turn burns a
+// full-price prompt to produce nothing. That is the "it won't resume" failure, and
+// it is reachable on any long session.
+//
+// Two things conspire to reach it early. `estimateContextTokens` is a chars/4
+// approximation over the whole context — system prompt and tool schemas included —
+// so it runs ahead of what the provider actually counts; and Privateer registers
+// every account model with a flat `contextWindow: 128000` (providers/account.ts
+// seedModel) because /api/models does not publish per-model windows. A model with a
+// larger real window therefore hits this ceiling while it still has room.
+//
+// ── The fix ──────────────────────────────────────────────────────────────────
+//
+// Floor the budget at a usable answer instead of at 1. The floor only ever raises
+// `available`; it never raises what the caller asked for, so a deliberately small
+// request (a summariser, a title) keeps its own number — the `min` still wins.
+//
+// It is safe against the window because the floor is smaller than the 4096-token
+// safety margin already subtracted above: when `available` lands between 0 and the
+// floor, the tokens we hand back were inside that margin all along.
+//
+// When `available` is genuinely negative the context really does not fit, and the
+// honest outcome is the provider saying so — a context-length error, which pi
+// classifies via isContextOverflow and answers with compaction, the path designed
+// for exactly this. That is strictly better than the silent one-token stub it
+// replaces: same cost, but the agent recovers instead of looking hung.
+export const CONTEXT_SAFETY_TOKENS = 4096;
+
+// pi-ai's own MIN_ANSWER_TOKENS — the floor it already reserves when a thinking
+// budget shares the response ceiling (clampThinkingBudgetToAnswerRoom). Below this a
+// turn cannot produce a usable answer or even a complete tool call, so asking for
+// less is never worth a request.
+//
+// The patch REFERENCES that constant rather than declaring its own: simple-options.js
+// exports it from the same module scope, so a second top-level `const` of that name
+// is a SyntaxError — and since every provider imports this module, that one would not
+// fail quietly, it would stop the CLI from starting. This copy exists so the value is
+// stated and tested here; tests/contextBudget.test.ts pins both halves together.
+export const MIN_ANSWER_TOKENS = 1024;
+
+export interface ContextBudgetModel {
+  contextWindow: number;
+}
+
+export function clampMaxTokensToContext(
+  model: ContextBudgetModel,
+  estimatedContextTokens: number,
+  maxTokens: number,
+): number {
+  // An unknown window (0 or absent) means "we cannot reason about room" — pass the
+  // ask through rather than inventing a ceiling. Stock behaviour, kept verbatim:
+  // the 1 here guards a zero/negative ask, it is not the floor this patch changes.
+  if (!(model.contextWindow > 0)) return Math.max(1, maxTokens);
+  const available = model.contextWindow - estimatedContextTokens - CONTEXT_SAFETY_TOKENS;
+  return Math.min(maxTokens, Math.max(MIN_ANSWER_TOKENS, available));
+}

package/src/engine/errors.ts

@@ -37,7 +37,7 @@ const HOST_LABELS: Record<string, string> = {
 // provider's machine code (which comes out of the response body) — these mean the
 // request never got a response at all.
 const NETWORK_ERRNO =
-  /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|EPIPE|ENETUNREACH|EHOSTUNREACH|UND_ERR_CONNECT_TIMEOUT|UND_ERR_SOCKET)$/;
+  /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|EPIPE|ENETUNREACH|EHOSTUNREACH|UND_ERR_CONNECT_TIMEOUT|UND_ERR_SOCKET|UND_ERR_BODY_TIMEOUT|UND_ERR_HEADERS_TIMEOUT)$/;
 
 // Pull structured fields off an unknown error without trusting any one shape.
 //
@@ -117,6 +117,30 @@ export function isAccountCapCode(code: string | null | undefined): boolean {
   return typeof code === "string" && CAP_CODE.test(code);
 }
 
+/**
+ * Balance guidance for the signed-in Privateer account channel ONLY. A bare 429
+ * is not evidence of an empty balance; neither is a daily cap or provider quota.
+ * The SDK may retain the JSON body (flat or OpenAI-shaped), or just its message.
+ */
+export function describeAccountBalanceError(text: string): DescribedError | null {
+  if (!/^\s*(?:402|429)\b/.test(text) || /<!doctype html|<html[\s>]/i.test(text)) return null;
+  const bodyStart = text.indexOf("{");
+  const facts = bodyStart < 0 ? {} : extract({ responseBody: text.slice(bodyStart) });
+  const code = facts.code;
+  const message = facts.providerMessage ?? text;
+  const balanceCode = /^(?:INSUFFICIENT_(?:BALANCE|FUNDS|CREDITS?)|(?:BALANCE|CREDITS?)_EXHAUSTED)$/i;
+  const balanceText = /\b(?:insufficient (?:credit(?:s| balance)?|balance|funds)|out of credits?|(?:credit balance|balance|credits?) (?:is |are )?exhausted)\b/i;
+  // If a machine code exists, it decides — don't turn a rate limit whose help
+  // text mentions credits into a billing failure.
+  if (code ? !balanceCode.test(code) : !balanceText.test(message)) return null;
+  return {
+    message: "Your Privateer account has insufficient balance.",
+    // Use our known destination, never a URL copied from an untrusted error body.
+    hint: "Top up at https://privateer.pro/top-up, then try again.",
+    retryable: false,
+  };
+}
+
 // ── Oversized / non-API error bodies ─────────────────────────────────────────
 //
 // An inference endpoint does not always answer as an API. Put a WAF, a proxy or a
@@ -217,6 +241,35 @@ export function isHardHttpFailure(text: string | null | undefined): boolean {
   return status >= 400 && status < 500 && !TRANSIENT_CLIENT_STATUS.has(status);
 }
 
+// ── Idle timeouts: a stalled stream, said plainly ────────────────────────────
+//
+// undici guards a connection that has gone quiet with `bodyTimeout` (the gap
+// between response chunks) and `headersTimeout` (the wait for the first byte). Pi
+// wires both from `httpIdleTimeoutMs` (default 5 min, see http-dispatcher.js). When
+// either fires, undici throws BodyTimeoutError / HeadersTimeoutError with an exact,
+// stable message and code — and NO HTTP status.
+//
+// That absence is the whole problem. `describeErrorText` only describes text that
+// opens with a 3-digit status, so the bare string "Body Timeout Error" printed
+// through untouched; and pi's retry regex matches the word "timeout", so the agent
+// silently re-sent the entire turn across its whole retry budget — a single stalled
+// stream became three 5-minute waits before the user saw any message at all. The
+// transport timing out is a fact, not a guess from a body substring, so recognise
+// it exactly (message OR code) and treat it as terminal: retrying re-bills the same
+// request and, on a genuinely stalled provider, will stall again.
+const IDLE_TIMEOUT_CODE = /^UND_ERR_(?:BODY|HEADERS)_TIMEOUT$/;
+const IDLE_TIMEOUT_TEXT = /(?:^|\b)(?:Body|Headers) Timeout Error\b/i;
+
+export function isIdleTimeoutError(text: string | null | undefined): boolean {
+  const s = typeof text === "string" ? text : "";
+  return IDLE_TIMEOUT_TEXT.test(s) || IDLE_TIMEOUT_CODE.test(s.trim());
+}
+
+const IDLE_TIMEOUT_DESCRIPTION: DescribedError = {
+  message: "The provider stopped responding — the connection went idle.",
+  hint: "No data arrived for the whole idle-timeout window, so the turn was cut off. Send it again, or run /model to switch providers — a slow model can be given longer under /settings → HTTP idle timeout.",
+};
+
 function rawMessage(err: unknown): string {
   if (err instanceof Error) return err.message;
   if (typeof err === "string") return err;
@@ -294,6 +347,17 @@ export function describeError(err: unknown): DescribedError {
       hint: "Check the model id — run /model to switch.",
     });
   }
+  if (
+    status === 413 ||
+    facts.code === "PAYLOAD_TOO_LARGE" ||
+    facts.code === "REQUEST_TOO_LARGE" ||
+    /payload too large|request_too_large|request entity too large/i.test(text)
+  ) {
+    return out({
+      message: `Request payload too large${forProvider} (413).`,
+      hint: "The conversation history or attached files exceed the server limit. Start a new session (/new) or remove large attachments.",
+    });
+  }
   if (status === 429) {
     return out({
       message: `Rate limited${forProvider} (429).`,
@@ -308,6 +372,12 @@ export function describeError(err: unknown): DescribedError {
       retryable: true,
     });
   }
+  // A stream that stopped producing data. This carries no status, so without this
+  // branch it fell through to the generic "Network error" below, and pi re-sent the
+  // whole turn on the substring "timeout". Say what actually happened, and stop.
+  if (isIdleTimeoutError(text) || isIdleTimeoutError(facts.errno)) {
+    return out(IDLE_TIMEOUT_DESCRIPTION);
+  }
   if (
     facts.errno != null ||
     /fetch failed|cannot connect|ENOTFOUND|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|network/i.test(text)
@@ -445,7 +515,18 @@ export function retryDelayMs(
 export function describeErrorText(text: string | null | undefined): DescribedError | null {
   const s = typeof text === "string" ? text : "";
   const status = Number(/^\s*(\d{3})\b/.exec(s)?.[1] ?? NaN);
-  if (!Number.isFinite(status)) return null;
+  if (!Number.isFinite(status)) {
+    // No leading status: the one message we can still describe with certainty is a
+    // transport idle timeout, which undici names exactly. Everything else is printed
+    // unchanged, as before.
+    if (isIdleTimeoutError(s)) {
+      return {
+        message: redactText(IDLE_TIMEOUT_DESCRIPTION.message),
+        hint: IDLE_TIMEOUT_DESCRIPTION.hint,
+      };
+    }
+    return null;
+  }
 
   if (status === 429) {
     const stated = retryAfterMs(s);
@@ -469,6 +550,12 @@ export function describeErrorText(text: string | null | undefined): DescribedErr
       hint: "Check the model id — run /model to switch.",
     };
   }
+  if (status === 413 || /413\b|payload too large|request_too_large|request entity too large/i.test(s)) {
+    return {
+      message: redactText(`Request payload too large (413).`),
+      hint: "The conversation history or attached files exceed the server limit. Start a new session (/new) or remove large attachments.",
+    };
+  }
   if (status >= 500) {
     return {
       message: redactText(compactProviderError(s)),

package/src/engine/events.ts

@@ -18,6 +18,8 @@ export type EngineEvent =
   | { type: "text"; text: string }
   | { type: "reasoning"; text: string }
   | { type: "tool-call"; id: string; name: string; input: unknown }
+  // Latest output snapshot; transports bound it, without settling the running card.
+  | { type: "tool-progress"; id: string; name: string; output: string }
   | { type: "tool-result"; id: string; name: string; output: unknown }
   | { type: "tool-error"; id: string; name: string; error: string }
   | { type: "step-finish" }
@@ -42,7 +44,7 @@ export type EngineEvent =
   // engine — the engine has no clock and no view of the turn as a whole.
   //
   // It exists because silence is ambiguous and the app cannot resolve it: a tool
-  // call emits at its start and its end and nothing in between, so a fifteen-minute
+  // call may emit at its start and its end with nothing in between, so a fifteen-minute
   // build, a stalled model socket and a dead agent all look identical from the far
   // side of the relay. This is the frame that says which. `tool`/`toolMs` name what
   // is being waited on when something is.