privateer-agent 0.12.35 → 0.12.37

package/bin/privateer-launch.mjs

@@ -170,6 +170,26 @@ if (NO_QUARTER) {
   );
 }
 
+// `--no-privacy` / `--privacy-off` — completely disable pi-privacy for this session.
+// Stripped before Pi's cli.js sees it. Exports PRIVATEER_PRIVACY_OFF=1 and PI_PRIVACY_OFF=1;
+// all PII scanning, prompts, and tool exfiltration/result checks are bypassed.
+const NO_PRIVACY = args.some((a) => a === "--no-privacy" || a === "--privacy-off");
+if (NO_PRIVACY) {
+  for (let i = args.length - 1; i >= 0; i--) if (args[i] === "--no-privacy" || args[i] === "--privacy-off") args.splice(i, 1);
+  process.env.PRIVATEER_PRIVACY_OFF = "1";
+  process.env.PI_PRIVACY_OFF = "1";
+  process.stderr.write(
+    [
+      "",
+      "  ⚓ \x1b[1;33mPrivacy off\x1b[0m — pi-privacy DISABLED for this session.",
+      "     PII scanning, tool exfiltration guards, and result credential redaction are OFF.",
+      "     Outbound requests and tool calls will NOT prompt or redact PII / IP addresses.",
+      "     Run /privacy on in-session to restore privacy protections.",
+      "",
+    ].join("\n") + "\n",
+  );
+}
+
 // `--allow-computer-control` — arm GUI control (screenshots, mouse, keyboard) for this
 // session. Stripped before Pi's cli.js sees it, exactly like --no-quarter above.
 //

package/extensions/privateer-posture.ts

@@ -9,6 +9,7 @@
 import { verifyModelPosture, TIERS, type PrivacyTier } from "pi-privacy";
 import { accountPosture } from "../src/providers/account.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
+import { onPrivacyDisabledChange, privacyDisabled } from "../src/config/privacyDisabled.ts";
 
 const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
 
@@ -35,11 +36,39 @@ async function badgeFor(provider: string, modelId: string, p: Palette): Promise<
   return `${DOT[info.posture] ?? "⚪"} ${info.label}`;
 }
 
+export async function updatePostureBadge(ctx: any, provider?: string, modelId?: string): Promise<void> {
+  if (!ctx?.ui?.setStatus) return;
+  if (privacyDisabled()) {
+    ctx.ui.setStatus("privacy", "⚑ privacy off");
+    ctx.ui.setStatus("pi-privacy", undefined);
+    return;
+  }
+  const p = provider ?? ctx?.model?.provider;
+  const m = modelId ?? ctx?.model?.id;
+  if (!p || !m) {
+    ctx.ui.setStatus("privacy", undefined);
+    return;
+  }
+  try {
+    ctx.ui.setStatus("privacy", "⛉ …");
+    const badge = await badgeFor(p, m, paletteFor(ctx?.ui?.theme));
+    ctx.ui.setStatus("privacy", badge);
+  } catch {
+    ctx.ui.setStatus("privacy", undefined);
+  }
+}
+
 export default function privateerPosture(pi: any): void {
   // "latest wins" so rapid model cycling (Ctrl+P) doesn't leave a stale badge.
   let seq = 0;
   const update = async (provider?: string, modelId?: string, ctx?: any) => {
-    if (!provider || !modelId || !ctx?.ui?.setStatus) return;
+    if (!ctx?.ui?.setStatus) return;
+    if (privacyDisabled()) {
+      ctx.ui.setStatus("privacy", "⚑ privacy off");
+      ctx.ui.setStatus("pi-privacy", undefined);
+      return;
+    }
+    if (!provider || !modelId) return;
     const mine = ++seq;
     try {
       ctx.ui.setStatus("privacy", "⛉ …"); // immediate placeholder while attesting
@@ -50,6 +79,21 @@ export default function privateerPosture(pi: any): void {
     }
   };
 
-  pi.on("model_select", (event: any, ctx: any) => update(event?.model?.provider, event?.model?.id, ctx));
-  pi.on("session_start", (_event: any, ctx: any) => update(ctx?.model?.provider, ctx?.model?.id, ctx));
+  // Keep the last ctx a real event handed us: the badge has to be repainted when the
+  // privacy flag moves, and the flag can now move with no event behind it at all —
+  // the app's shield toggle writes it over the relay (RemoteBridge's onPrivacy), so
+  // `/privacy` is no longer the only driver and the CLI's own badge would otherwise
+  // sit on "⛉ Trusted Execution" over a session whose filter a phone just took down.
+  let lastCtx: any = null;
+  pi.on("model_select", (event: any, ctx: any) => {
+    lastCtx = ctx;
+    return update(event?.model?.provider, event?.model?.id, ctx);
+  });
+  pi.on("session_start", (_event: any, ctx: any) => {
+    lastCtx = ctx;
+    return update(ctx?.model?.provider, ctx?.model?.id, ctx);
+  });
+  onPrivacyDisabledChange(() => {
+    void update(lastCtx?.model?.provider, lastCtx?.model?.id, lastCtx);
+  });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.35",
+  "version": "0.12.37",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-ai+0.84.4.patch

@@ -0,0 +1,46 @@
+diff --git a/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js b/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
+index 216a45f..a1e3214 100644
+--- a/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
++++ b/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
+@@ -1,11 +1,38 @@
+ import { estimateContextTokens } from "../utils/estimate.js";
+ const CONTEXT_SAFETY_TOKENS = 4096;
+-const MIN_MAX_TOKENS = 1;
++// Privateer patch: floor the answer budget at a usable answer, not at one token.
++//
++// Stock pi floored this at 1, so the moment the (chars/4) context estimate reached
++// the declared window every turn asked the provider for ONE token: the whole prompt
++// still sent, still billed, one token back with finish_reason "length" — which the
++// TUI renders as "Response was truncated before completion." Compaction gets one
++// attempt, and when the estimate is still over afterwards the session stays there,
++// burning a full-price prompt per turn and producing nothing. Privateer reaches it
++// early because every account model is registered with a flat contextWindow of
++// 128000 (src/providers/account.ts seedModel) — /api/models publishes no per-model
++// window — so a larger-windowed model hits this ceiling with room to spare.
++//
++// The floor only raises `available`; the Math.min still honours a deliberately small
++// ask (a summariser, a title), and it is smaller than the CONTEXT_SAFETY_TOKENS
++// already subtracted above, so a floored request was inside that margin anyway. When
++// `available` is genuinely negative the context really does not fit and the provider
++// says so — a context-length error, which pi routes to compaction via
++// isContextOverflow. That is the designed recovery, and strictly better than a
++// silent one-token stub that costs the same.
++//
++// The floor is MIN_ANSWER_TOKENS, this module's OWN constant — declared below at its
++// original site, deliberately not redeclared here (a second top-level `const` of that
++// name is a SyntaxError that takes the whole app down). Reading it from below is safe:
++// clampMaxTokensToContext is only ever called at request time, long after module
++// evaluation, so the temporal dead zone has closed. Same value, same meaning, and it
++// stays in sync if upstream retunes it.
++//
++// Mirrors src/engine/contextBudget.ts, which is where this is specified and tested.
+ export function clampMaxTokensToContext(model, context, maxTokens) {
+     if (model.contextWindow <= 0)
+-        return Math.max(MIN_MAX_TOKENS, maxTokens);
++        return Math.max(1, maxTokens);
+     const available = model.contextWindow - estimateContextTokens(context).tokens - CONTEXT_SAFETY_TOKENS;
+-    return Math.min(maxTokens, Math.max(MIN_MAX_TOKENS, available));
++    return Math.min(maxTokens, Math.max(MIN_ANSWER_TOKENS, available));
+ }
+ export function buildBaseOptions(model, context, options, apiKey) {
+     const samplingParams = model.samplingParams || options?.samplingParams

package/patches/@earendil-works+pi-coding-agent+0.84.4.patch

@@ -68,10 +68,10 @@ index f04269f..536e030 100644
  export const ENV_AGENT_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_DIR`;
  export const ENV_SESSION_DIR = `${APP_NAME.toUpperCase()}_CODING_AGENT_SESSION_DIR`;
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-index fd82b71..5e0821c 100644
+index fd82b71..7c10ba9 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-@@ -38,6 +38,111 @@ import { createLocalBashOperations } from "./tools/bash.js";
+@@ -38,6 +38,122 @@ import { createLocalBashOperations } from "./tools/bash.js";
  import { createAllToolDefinitions } from "./tools/index.js";
  import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
  import { addUsageToTotals, createUsageTotals } from "./usage-totals.js";
@@ -139,6 +139,17 @@ index fd82b71..5e0821c 100644
 +    const status = Number(m[1]);
 +    return status >= 400 && status < 500 && !PV_TRANSIENT_CLIENT_STATUS.has(status);
 +}
++// Privateer patch: undici's idle-timeout errors. Mirrors isIdleTimeoutError in
++// src/engine/errors.ts. The text is exact and stable — undici throws
++// BodyTimeoutError / HeadersTimeoutError with message "Body/Headers Timeout Error"
++// and code UND_ERR_BODY_TIMEOUT / UND_ERR_HEADERS_TIMEOUT — and it carries NO HTTP
++// status. pi's retry regex therefore reads the word "timeout" and silently re-sends
++// the whole turn across the full budget: three 5-minute stalls before the user sees
++// anything at all. A stalled transport is a fact; a body substring is a guess.
++export function isIdleTimeoutError(text) {
++    const s = typeof text === "string" ? text : "";
++    return /(?:^|\b)(?:Body|Headers) Timeout Error\b/i.test(s) || /^UND_ERR_(?:BODY|HEADERS)_TIMEOUT$/.test(s.trim());
++}
 +// Privateer patch: throttle handling. Mirrors isThrottleFailure / retryAfterMs /
 +// retryDelayMs in src/engine/errors.ts — see the incident note there.
 +export function isThrottleFailure(text) {
@@ -183,7 +194,7 @@ index fd82b71..5e0821c 100644
  /**
   * Parse a skill block from message text.
   * Returns null if the text doesn't contain a skill block.
-@@ -102,6 +207,8 @@ export class AgentSession {
+@@ -102,6 +218,8 @@ export class AgentSession {
      // Retry state
      _retryAbortController = undefined;
      _retryAttempt = 0;
@@ -192,7 +203,7 @@ index fd82b71..5e0821c 100644
      // Bash execution state
      _bashAbortControllers = new Set();
      _pendingBashMessages = [];
-@@ -186,6 +293,14 @@ export class AgentSession {
+@@ -186,6 +304,14 @@ export class AgentSession {
          }
          const isOAuth = this._modelRuntime.isUsingOAuth(model.provider);
          if (isOAuth) {
@@ -207,7 +218,7 @@ index fd82b71..5e0821c 100644
              throw new Error(`Authentication failed for "${model.provider}". ` +
                  `Credentials may have expired or network is unavailable. ` +
                  `Run '/login ${model.provider}' to re-authenticate.`);
-@@ -380,6 +495,16 @@ export class AgentSession {
+@@ -380,6 +506,16 @@ export class AgentSession {
                  }
              }
          }
@@ -224,7 +235,7 @@ index fd82b71..5e0821c 100644
          // Emit to extensions first
          await this._emitExtensionEvent(event);
          // Notify all listeners
-@@ -801,6 +926,33 @@ export class AgentSession {
+@@ -801,6 +937,33 @@ export class AgentSession {
                  finalError: msg.errorMessage,
              });
              this._retryAttempt = 0;
@@ -258,7 +269,7 @@ index fd82b71..5e0821c 100644
          }
          if (await this._checkCompaction(msg)) {
              return true;
-@@ -882,6 +1034,14 @@ export class AgentSession {
+@@ -882,6 +1045,14 @@ export class AgentSession {
              if (!hasConfiguredAuth) {
                  const isOAuth = this._modelRuntime.isUsingOAuth(this.model.provider);
                  if (isOAuth) {
@@ -273,7 +284,7 @@ index fd82b71..5e0821c 100644
                      throw new Error(`Authentication failed for "${this.model.provider}". ` +
                          `Credentials may have expired or network is unavailable. ` +
                          `Run '/login ${this.model.provider}' to re-authenticate.`);
-@@ -891,7 +1051,13 @@ export class AgentSession {
+@@ -891,7 +1062,13 @@ export class AgentSession {
              // Check if we need to compact before sending (catches aborted responses).
              // The user's new prompt is sent below, so do not call agent.continue() here.
              const lastAssistant = this._findLastAssistantMessage();
@@ -288,7 +299,7 @@ index fd82b71..5e0821c 100644
                  await this._checkCompaction(lastAssistant, false);
              }
              // Build messages array (custom message if any, then user message)
-@@ -2242,6 +2408,27 @@ export class AgentSession {
+@@ -2242,6 +2419,34 @@ export class AgentSession {
          // Context overflow is handled by compaction, not retry.
          if (isContextOverflow(message, this.model?.contextWindow ?? 0))
              return false;
@@ -312,11 +323,18 @@ index fd82b71..5e0821c 100644
 +        // rate limit is affected. Mirrors isAccountCapCode in src/engine/errors.ts.
 +        if (this.model?.provider === "privateer" &&
 +            /"code"\s*:\s*"[A-Z0-9_]*(?:CAP|QUOTA|LIMIT_REACHED|INSUFFICIENT|TOP_?UP)[A-Z0-9_]*"|limit of [^.]*reached|upgrade or top ?up|usage limit reached/i.test(message.errorMessage ?? ""))
++            return false;
++        // Privateer patch: a stalled stream is a transport fact, not a body substring.
++        // undici's "Body/Headers Timeout Error" contains "timeout", so pi spent the
++        // whole retry budget re-sending a turn the transport had already given up on —
++        // a 5-minute stall became three, and only then did the user see a message.
++        // Mirrors isIdleTimeoutError in src/engine/errors.ts.
++        if (isIdleTimeoutError(message.errorMessage))
 +            return false;
          return isRetryableAssistantError(message);
      }
      /**
-@@ -2287,7 +2474,11 @@ export class AgentSession {
+@@ -2287,7 +2492,11 @@ export class AgentSession {
              this._retryAttempt--;
              return false;
          }
@@ -375,7 +393,7 @@ index 197bccc..bc9ac3f 100644
  //# sourceMappingURL=auth-guidance.js.map
 
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/extensions/loader.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/extensions/loader.js
-index bb022d4..382ff2b 100644
+index bb022d4..207f3ba 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/extensions/loader.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/extensions/loader.js
 @@ -18,7 +18,7 @@ import { createJiti } from "jiti/static";
@@ -1657,7 +1675,7 @@ index c33fc39..060a38f 100644
          if (content) {
              text += `\n\n${content}`;
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
-index a27754f..61a1fff 100644
+index a27754f..3403ca8 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 @@ -10,7 +10,7 @@ import * as TuiLayouts from "@earendil-works/pi-tui";
@@ -1683,7 +1701,7 @@ index a27754f..61a1fff 100644
      if (!sessionManager.usesDefaultSessionDir()) {
          args.push("--session-dir", quoteIfNeeded(sessionManager.getSessionDir()));
      }
-@@ -232,6 +237,54 @@ export function createInteractiveTuiReference(getTui) {
+@@ -232,6 +237,64 @@ export function createInteractiveTuiReference(getTui) {
          getPrototypeOf: () => Reflect.getPrototypeOf(getTui()),
      });
  }
@@ -1716,8 +1734,18 @@ index a27754f..61a1fff 100644
 +function pvDescribeErrorText(text) {
 +    const s = typeof text === "string" ? text : "";
 +    const status = Number(/^\s*(\d{3})\b/.exec(s)?.[1] ?? NaN);
-+    if (!Number.isFinite(status))
++    if (!Number.isFinite(status)) {
++        // Privateer patch: no HTTP status, but undici's idle-timeout message is exact
++        // and is the one error a stalled turn produces — printing it raw leaves the
++        // user with two words and no next step. Mirrors isIdleTimeoutError /
++        // describeErrorText in src/engine/errors.ts.
++        if (/(?:^|\b)(?:Body|Headers) Timeout Error\b/i.test(s))
++            return {
++                message: "The provider stopped responding — the connection went idle.",
++                hint: "No data arrived for the whole idle-timeout window, so the turn was cut off. Send it again, or run /model to switch providers (a slow model can be given longer in /settings → HTTP idle timeout).",
++            };
 +        return null;
++    }
 +    if (status === 429) {
 +        const stated = pvRetryAfterMs(s);
 +        return {
@@ -1738,7 +1766,7 @@ index a27754f..61a1fff 100644
  export class InteractiveMode {
      runtimeHost;
      renderer;
-@@ -439,9 +492,15 @@ export class InteractiveMode {
+@@ -439,9 +502,15 @@ export class InteractiveMode {
      }
      getBuiltInCommandConflictDiagnostics(extensionRunner) {
          const builtinNames = new Set(BUILTIN_SLASH_COMMANDS.map((command) => command.name));
@@ -1755,7 +1783,7 @@ index a27754f..61a1fff 100644
              .map((command) => ({
              type: "warning",
              message: command.invocationName === command.name
-@@ -815,20 +874,18 @@ export class InteractiveMode {
+@@ -815,20 +884,18 @@ export class InteractiveMode {
                  this.showNewVersionNotification(newRelease);
              }
          });
@@ -1788,7 +1816,7 @@ index a27754f..61a1fff 100644
          // Check tmux keyboard setup asynchronously
          this.checkTmuxKeyboardSetup().then((warning) => {
              if (warning) {
-@@ -2393,7 +2450,17 @@ export class InteractiveMode {
+@@ -2393,7 +2460,17 @@ export class InteractiveMode {
              if (text === "/model" || text.startsWith("/model ")) {
                  const searchTerm = text.startsWith("/model ") ? text.slice(7).trim() : undefined;
                  this.editor.setText("");
@@ -1807,7 +1835,7 @@ index a27754f..61a1fff 100644
                  return;
              }
              if (text === "/thinking" || text.startsWith("/thinking ")) {
-@@ -2465,12 +2532,42 @@ export class InteractiveMode {
+@@ -2465,12 +2542,42 @@ export class InteractiveMode {
              if (text === "/login" || text.startsWith("/login ")) {
                  const providerRef = text.startsWith("/login ") ? text.slice(7).trim() : undefined;
                  this.editor.setText("");
@@ -1852,7 +1880,30 @@ index a27754f..61a1fff 100644
                  return;
              }
              if (text === "/new") {
-@@ -3164,7 +3261,7 @@ export class InteractiveMode {
+@@ -2788,9 +2895,19 @@ export class InteractiveMode {
+                     if (entries[0]?.type !== "compaction") {
+                         throw new Error("Completed compaction is missing from the session context");
+                     }
+-                    this.chatContainer.clear();
+-                    // The latest compaction is prepended for model context; append it below at its chronological position.
+-                    this.renderSessionEntries(entries.slice(1));
++                    // Privateer patch: a compaction must never erase what the user can see.
++                    // Stock Pi cleared the whole chat container here and re-rendered only
++                    // buildContextEntries().slice(1) — the MODEL's new context, a summary plus
++                    // the firstKeptEntryId tail. That is the right set of messages to send to
++                    // the model and the wrong set to leave on screen: every prompt, answer and
++                    // tool result above the keep boundary vanished from the transcript the
++                    // instant the summary appeared, so the user watched the thing they typed get
++                    // swallowed and replaced by a summary — worst of all when the compaction was
++                    // triggered by that very prompt. The model context is allowed to shrink; the
++                    // transcript is the record of what actually happened and does not. The kept
++                    // tail is already on screen (it was rendered as it happened), so re-rendering
++                    // it would duplicate it — keep every child and append the summary at its
++                    // chronological position, which is the boundary ("now").
+                     this.addMessageToChat(createCompactionSummaryMessage(event.result.summary, event.result.tokensBefore, new Date().toISOString()));
+                     if (event.result.usage) {
+                         this.addCompactionCostNotice({
+@@ -3164,7 +3281,7 @@ export class InteractiveMode {
          if (this.chatContainer.children.length > 0) {
              this.chatContainer.addChild(new Spacer(1));
          }
@@ -1861,7 +1912,7 @@ index a27754f..61a1fff 100644
      }
      async getUserInput() {
          const queuedInput = this.pendingUserInputs.shift();
-@@ -3504,7 +3601,17 @@ export class InteractiveMode {
+@@ -3504,7 +3621,17 @@ export class InteractiveMode {
      }
      showError(errorMessage) {
          this.chatContainer.addChild(new Spacer(1));

package/src/config/privacyDisabled.ts

@@ -0,0 +1,66 @@
+// Privacy toggle: completely disable pi-privacy across agent sessions.
+//
+// When active, all pi-privacy hooks are completely bypassed:
+//   - Outbound PII scanning and prompts are disabled (IP addresses, emails, and
+//     other non-sensitive data that trigger detection can be sent as-is with NO interference).
+//   - Unattended mode does NOT auto-redact PII.
+//   - Tool exfiltration guards and warnings are disabled.
+//   - Tool result credential scanning / redaction is disabled.
+//   - Model downgrade guards are disabled.
+//
+// THE ENV VAR IS THE STORE:
+// Exactly like `src/permissions/noQuarter.ts`, state is stored in `process.env.PRIVATEER_PRIVACY_OFF`
+// and `process.env.PI_PRIVACY_OFF`:
+//   1. ACROSS PROCESSES: subagent children inherit the env var and run without privacy gates.
+//   2. ACROSS EXTENSIONS: different jiti instances and late-loaded extensions all share process.env.
+//   3. LAUNCH CONFIG: users can launch with `PRIVATEER_PRIVACY_OFF=1` or `PI_PRIVACY_OFF=1`
+//      or `--privacy-off` / `--no-privacy` CLI flags.
+
+const ENV = "PRIVATEER_PRIVACY_OFF";
+const ALT_ENV = "PI_PRIVACY_OFF";
+
+/** True while pi-privacy is completely disabled for this session. Read live, never cached. */
+export function privacyDisabled(): boolean {
+  return process.env[ENV] === "1" || process.env[ALT_ENV] === "1";
+}
+
+// WHO ELSE NEEDS TO KNOW. The env var is the store, but it is not observable — and the
+// switch now has two drivers on the same session: `/privacy off` typed into a composer,
+// and the app's own shield toggle (RemoteBridge's onPrivacy). Whichever one moves it, the
+// app's switch has to follow, or the desktop shows a shield over a session whose filter
+// its own composer just turned off. Listeners fire on a real CHANGE only, so a re-assert
+// is not an event; failures are swallowed, because a subscriber that throws must not
+// leave the flag half-applied.
+const listeners = new Set<(disabled: boolean) => void>();
+
+/** Watch the disabled state. Returns an unsubscribe. Fires only when the value changes. */
+export function onPrivacyDisabledChange(fn: (disabled: boolean) => void): () => void {
+  listeners.add(fn);
+  return () => listeners.delete(fn);
+}
+
+/**
+ * Set the disabled state. Modifies process.env so every module copy and child process agrees.
+ * Returns the new state.
+ */
+export function setPrivacyDisabled(disabled: boolean): boolean {
+  const before = privacyDisabled();
+  if (disabled) {
+    process.env[ENV] = "1";
+    process.env[ALT_ENV] = "1";
+  } else {
+    delete process.env[ENV];
+    delete process.env[ALT_ENV];
+  }
+  if (before !== disabled) {
+    for (const fn of listeners) {
+      try { fn(disabled); } catch { /* a watcher must not break the toggle */ }
+    }
+  }
+  return disabled;
+}
+
+/** Flip the disabled state. Returns the new state. */
+export function togglePrivacyDisabled(): boolean {
+  return setPrivacyDisabled(!privacyDisabled());
+}

package/src/config/privacyPolicy.ts

@@ -36,6 +36,8 @@ import { cliPalette, detectScheme } from "../ui/palette.ts";
 import { accountPosture, privateerChannel } from "../providers/account.ts";
 import { hasCredentials } from "../auth/privateer.ts";
 import { writePiDefaultModel } from "../providers/defaultModel.ts";
+import { privacyDisabled, setPrivacyDisabled } from "./privacyDisabled.ts";
+import { updatePostureBadge } from "../../extensions/privateer-posture.ts";
 
 // Color-coat pi-privacy's auto-redact notice as the moat acting on your behalf: the red
 // no-quarter flag (same glyph and color as the no-quarter banner in chat.ts and the gate
@@ -67,6 +69,7 @@ export function sharedPrivacyOptions() {
   const ambient = loadConfig();
   return {
     ...ambient,
+    disabled: privacyDisabled,
     // The account channel's real posture. pi-privacy ships a `privateer` provider, but it
     // is the PUBLIC developer-key channel (sk-priv-…, server-proxied and unverifiable
     // end-to-end), so from the package alone every privateer/* model floors to
@@ -131,69 +134,161 @@ export function sharedPrivacyOptions() {
 // Registered from HERE rather than from the extension file, for the reason this module
 // exists at all: the factory-built sessions and the discovered extension must not drift.
 function registerPrivacyCommand(pi: any): void {
-  pi.registerCommand?.("privacy", {
-    description: "Values the PII gate must not treat as personal data: /privacy [allow <value> | unallow <value>]",
-    handler: (args: string, ctx: any) => {
-      const raw = String(args ?? "").trim();
-      const [verb, ...rest] = raw.split(/\s+/);
-      const value = rest.join(" ").trim();
-      const notify = (msg: string, level: "info" | "warning" = "info") => ctx?.ui?.notify?.(msg, level);
-
-      if (verb === "allow" || verb === "unallow") {
-        if (!value) return notify(`usage: /privacy ${verb} <value>`, "warning");
-        const r = verb === "allow" ? addPiiAllow(value) : removePiiAllow(value);
-        return notify(r.message, r.ok ? "info" : "warning");
-      }
-      if (verb) return notify(`unknown option "${verb}" — usage: /privacy [allow <value> | unallow <value>]`, "warning");
+  const handler = async (args: string, ctx: any) => {
+    const raw = String(args ?? "").trim();
+    const [verb, ...rest] = raw.split(/\s+/);
+    const value = rest.join(" ").trim();
+    const notify = (msg: string, level: "info" | "warning" = "info") => ctx?.ui?.notify?.(msg, level);
 
+    if (verb === "off" || verb === "disable") {
+      setPrivacyDisabled(true);
+      await updatePostureBadge(ctx);
+      return notify(
+        "⚑ pi-privacy is completely OFF for this session. Outbound requests will not be scanned or gated for PII, " +
+          "and tool exfiltration, result, and downgrade guards are disabled. Run /privacy on to restore.",
+        "warning",
+      );
+    }
+
+    if (verb === "on" || verb === "enable" || verb === "restore") {
+      setPrivacyDisabled(false);
+      await updatePostureBadge(ctx);
+      return notify(
+        "pi-privacy is ON for this session. PII scanning, tool exfiltration guards, and privacy checks restored.",
+        "info",
+      );
+    }
+
+    if (verb === "status") {
+      const state = privacyDisabled() ? "OFF (disabled for this session)" : "ON (active)";
       const mine = piiAllowEntries();
-      notify(
+      return notify(
         [
+          `pi-privacy status: ${state}`,
           mine.length ? `PII allowlist (~/.privateer/config.json):\n  ${mine.join("\n  ")}` : "PII allowlist: empty",
-          "Reserved shapes (example.com, loopback, noreply@…) are allowed by default and not listed here.",
-          "Add one with /privacy allow <value> — an address (me@acme.com), a domain (@acme.com),",
-          "an IPv4 block (10.0.0.0/8), or any exact/globbed value.",
+          "Reserved shapes (example.com, loopback, noreply@…) are allowed by default.",
+          "Commands: /privacy off | /privacy on | /privacy status | /privacy allow <value> | /privacy unallow <value>",
         ].join("\n"),
         "info",
       );
+    }
+
+    if (verb === "allow" || verb === "unallow") {
+      if (!value) return notify(`usage: /privacy ${verb} <value>`, "warning");
+      const r = verb === "allow" ? addPiiAllow(value) : removePiiAllow(value);
+      return notify(r.message, r.ok ? "info" : "warning");
+    }
+
+    if (verb && verb !== "help") {
+      return notify(`unknown option "${verb}" — usage: /privacy [off | on | status | allow <value> | unallow <value>]`, "warning");
+    }
+
+    const state = privacyDisabled() ? "OFF (disabled for this session)" : "ON (active)";
+    const mine = piiAllowEntries();
+    notify(
+      [
+        `pi-privacy status: ${state}`,
+        mine.length ? `PII allowlist (~/.privateer/config.json):\n  ${mine.join("\n  ")}` : "PII allowlist: empty",
+        "Reserved shapes (example.com, loopback, noreply@…) are allowed by default and not listed here.",
+        "Commands:",
+        "  /privacy off              — turn off pi-privacy completely for this session",
+        "  /privacy on               — restore pi-privacy protections",
+        "  /privacy status           — show current status and allowlist",
+        "  /privacy allow <value>    — add value to PII allowlist",
+        "  /privacy unallow <value>  — remove value from PII allowlist",
+      ].join("\n"),
+      "info",
+    );
+  };
+
+  const spec = {
+    description: "Manage privacy protections: /privacy [off | on | status | allow <value> | unallow <value>]",
+    handler,
+    getArgumentCompletions: (prefix: string) => {
+      const p = prefix.trim().toLowerCase();
+      const verbs = ["off", "on", "status", "allow", "unallow"];
+      return verbs.filter((v) => v.startsWith(p)).map((v) => ({ value: v, label: v }));
+    },
+  };
+
+  pi.registerCommand?.("privacy", spec);
+  pi.registerCommand?.("pi-privacy", {
+    ...spec,
+    description: "Alias for /privacy: /pi-privacy [off | on | status | allow <value> | unallow <value>]",
+  });
+}
+
+/**
+ * Intercept pi-privacy's event registrations and commands so that when pi-privacy is completely
+ * disabled via `/privacy off` (or `PRIVATEER_PRIVACY_OFF=1` / `PI_PRIVACY_OFF=1`),
+ * all gating, prompt, and redaction hooks are cleanly bypassed.
+ */
+function gatingPrivacyPi(pi: any): any {
+  const on = (event: string, handler: any) => {
+    if (typeof pi?.on !== "function") return;
+    if (typeof handler !== "function") return pi.on(event, handler);
+
+    if (
+      event === "before_provider_request" ||
+      event === "tool_call" ||
+      event === "user_bash" ||
+      event === "tool_result" ||
+      event === "model_select"
+    ) {
+      return pi.on(event, async (ev: any, ctx: any) => {
+        if (privacyDisabled()) return undefined;
+        return handler(ev, ctx);
+      });
+    }
+
+    return pi.on(event, handler);
+  };
+
+  const registerCommand = (name: string, spec: any) => {
+    if (typeof pi?.registerCommand !== "function") return;
+    if (name === "pii" && spec && typeof spec.handler === "function") {
+      const orig = spec.handler;
+      const wrappedHandler = async (args: string, ctx: any) => {
+        const raw = String(args ?? "").trim().toLowerCase();
+        const [verb] = raw.split(/\s+/);
+        if (verb === "off" || verb === "disable") {
+          setPrivacyDisabled(true);
+          await updatePostureBadge(ctx);
+        } else if (verb === "on" || verb === "enable" || verb === "restore") {
+          setPrivacyDisabled(false);
+          await updatePostureBadge(ctx);
+        }
+        return orig(args, ctx);
+      };
+      return pi.registerCommand(name, { ...spec, handler: wrappedHandler });
+    }
+    return pi.registerCommand(name, spec);
+  };
+
+  return new Proxy(pi, {
+    get(target, prop, receiver) {
+      if (prop === "on") return on;
+      if (prop === "registerCommand") return registerCommand;
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
     },
   });
 }
 
 /**
  * The privacy half of the moat as ONE factory: pi-privacy configured the Privateer way,
- * plus the `/privacy` command that maintains its allowlist. Both routes into pi-privacy
+ * plus the `/privacy` command that maintains its allowlist and toggles. Both routes into pi-privacy
  * (src/config/moat.ts and extensions/privateer-privacy.ts) use this, so neither can end
  * up with the gate but not its escape hatch.
  */
 export function privacyExtension() {
   const privacy = makePiPrivacyExtension(sharedPrivacyOptions());
   return function privateerPrivacyCore(pi: any): void {
-    privacy(persistingModelPicks(pi));
+    privacy(gatingPrivacyPi(persistingModelPicks(pi)));
     registerPrivacyCommand(pi);
   };
 }
 
-/**
- * pi-privacy's `/models` picker switched the live session and stopped there, so the
- * pick lasted exactly as long as the terminal and the next one launched on whatever
- * settings.json still said. Pi persists a switch only for a caller that passes
- * `{ persist: true }`, and the extension api it reaches setModel through forwards no
- * options at all (see savedPiDefaultSpec in providers/defaultModel.ts).
- *
- * Pi's own selector splits the two — Enter switches for the session, ctrl+s makes it
- * the default. OUR picker has no second key to press and never advertised a
- * distinction, so a pick made in it means "this is my model": we persist it.
- *
- * Wrapped here rather than fixed inside pi-privacy so the rule sits with the rest of
- * what Privateer configures on that extension, and so it stays scoped to the picker.
- * The brand extension's sign-in switch shares the same api and deliberately does NOT
- * get this — writePiDefaultModel says why an automatic switch must not persist.
- *
- * A Proxy, not a spread: the api object is a plain literal today, but a spread of a
- * class instance would silently drop every method and take pi-privacy down with it.
- * Forwarding leaves that failure mode impossible.
- */
 function persistingModelPicks(pi: any): any {
   if (typeof pi?.setModel !== "function") return pi;
   const setModel = async (model: any) => {

package/src/engine/contextBudget.ts

@@ -0,0 +1,74 @@
+// How many output tokens a turn may ask for, once the prompt has taken its share.
+//
+// Mirrors the patched clampMaxTokensToContext in pi-ai (api/simple-options.js) —
+// that copy is what actually runs; this one is where the behaviour is specified and
+// tested. See patches/@earendil-works+pi-ai+0.84.4.patch.
+//
+// ── The bug this exists to fix ───────────────────────────────────────────────
+//
+// Stock pi computes the answer budget as
+//
+//     available = contextWindow − estimateContextTokens(context) − 4096
+//     maxTokens = min(asked, max(1, available))
+//
+// and that floor is literally `1`. So the moment the estimate reaches the declared
+// window, every turn asks the provider for ONE token. The request still goes out,
+// still sends the whole prompt, and is still billed in full — and comes back with a
+// single token and `finish_reason: "length"`, which the TUI renders as "Response was
+// truncated before completion." Compaction runs once, and if the estimate is still
+// over (it usually is — see below) the session is stuck there: every turn burns a
+// full-price prompt to produce nothing. That is the "it won't resume" failure, and
+// it is reachable on any long session.
+//
+// Two things conspire to reach it early. `estimateContextTokens` is a chars/4
+// approximation over the whole context — system prompt and tool schemas included —
+// so it runs ahead of what the provider actually counts; and Privateer registers
+// every account model with a flat `contextWindow: 128000` (providers/account.ts
+// seedModel) because /api/models does not publish per-model windows. A model with a
+// larger real window therefore hits this ceiling while it still has room.
+//
+// ── The fix ──────────────────────────────────────────────────────────────────
+//
+// Floor the budget at a usable answer instead of at 1. The floor only ever raises
+// `available`; it never raises what the caller asked for, so a deliberately small
+// request (a summariser, a title) keeps its own number — the `min` still wins.
+//
+// It is safe against the window because the floor is smaller than the 4096-token
+// safety margin already subtracted above: when `available` lands between 0 and the
+// floor, the tokens we hand back were inside that margin all along.
+//
+// When `available` is genuinely negative the context really does not fit, and the
+// honest outcome is the provider saying so — a context-length error, which pi
+// classifies via isContextOverflow and answers with compaction, the path designed
+// for exactly this. That is strictly better than the silent one-token stub it
+// replaces: same cost, but the agent recovers instead of looking hung.
+export const CONTEXT_SAFETY_TOKENS = 4096;
+
+// pi-ai's own MIN_ANSWER_TOKENS — the floor it already reserves when a thinking
+// budget shares the response ceiling (clampThinkingBudgetToAnswerRoom). Below this a
+// turn cannot produce a usable answer or even a complete tool call, so asking for
+// less is never worth a request.
+//
+// The patch REFERENCES that constant rather than declaring its own: simple-options.js
+// exports it from the same module scope, so a second top-level `const` of that name
+// is a SyntaxError — and since every provider imports this module, that one would not
+// fail quietly, it would stop the CLI from starting. This copy exists so the value is
+// stated and tested here; tests/contextBudget.test.ts pins both halves together.
+export const MIN_ANSWER_TOKENS = 1024;
+
+export interface ContextBudgetModel {
+  contextWindow: number;
+}
+
+export function clampMaxTokensToContext(
+  model: ContextBudgetModel,
+  estimatedContextTokens: number,
+  maxTokens: number,
+): number {
+  // An unknown window (0 or absent) means "we cannot reason about room" — pass the
+  // ask through rather than inventing a ceiling. Stock behaviour, kept verbatim:
+  // the 1 here guards a zero/negative ask, it is not the floor this patch changes.
+  if (!(model.contextWindow > 0)) return Math.max(1, maxTokens);
+  const available = model.contextWindow - estimatedContextTokens - CONTEXT_SAFETY_TOKENS;
+  return Math.min(maxTokens, Math.max(MIN_ANSWER_TOKENS, available));
+}

package/src/engine/errors.ts

@@ -37,7 +37,7 @@ const HOST_LABELS: Record<string, string> = {
 // provider's machine code (which comes out of the response body) — these mean the
 // request never got a response at all.
 const NETWORK_ERRNO =
-  /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|EPIPE|ENETUNREACH|EHOSTUNREACH|UND_ERR_CONNECT_TIMEOUT|UND_ERR_SOCKET)$/;
+  /^(ECONNREFUSED|ECONNRESET|ENOTFOUND|ETIMEDOUT|EAI_AGAIN|EPIPE|ENETUNREACH|EHOSTUNREACH|UND_ERR_CONNECT_TIMEOUT|UND_ERR_SOCKET|UND_ERR_BODY_TIMEOUT|UND_ERR_HEADERS_TIMEOUT)$/;
 
 // Pull structured fields off an unknown error without trusting any one shape.
 //
@@ -241,6 +241,35 @@ export function isHardHttpFailure(text: string | null | undefined): boolean {
   return status >= 400 && status < 500 && !TRANSIENT_CLIENT_STATUS.has(status);
 }
 
+// ── Idle timeouts: a stalled stream, said plainly ────────────────────────────
+//
+// undici guards a connection that has gone quiet with `bodyTimeout` (the gap
+// between response chunks) and `headersTimeout` (the wait for the first byte). Pi
+// wires both from `httpIdleTimeoutMs` (default 5 min, see http-dispatcher.js). When
+// either fires, undici throws BodyTimeoutError / HeadersTimeoutError with an exact,
+// stable message and code — and NO HTTP status.
+//
+// That absence is the whole problem. `describeErrorText` only describes text that
+// opens with a 3-digit status, so the bare string "Body Timeout Error" printed
+// through untouched; and pi's retry regex matches the word "timeout", so the agent
+// silently re-sent the entire turn across its whole retry budget — a single stalled
+// stream became three 5-minute waits before the user saw any message at all. The
+// transport timing out is a fact, not a guess from a body substring, so recognise
+// it exactly (message OR code) and treat it as terminal: retrying re-bills the same
+// request and, on a genuinely stalled provider, will stall again.
+const IDLE_TIMEOUT_CODE = /^UND_ERR_(?:BODY|HEADERS)_TIMEOUT$/;
+const IDLE_TIMEOUT_TEXT = /(?:^|\b)(?:Body|Headers) Timeout Error\b/i;
+
+export function isIdleTimeoutError(text: string | null | undefined): boolean {
+  const s = typeof text === "string" ? text : "";
+  return IDLE_TIMEOUT_TEXT.test(s) || IDLE_TIMEOUT_CODE.test(s.trim());
+}
+
+const IDLE_TIMEOUT_DESCRIPTION: DescribedError = {
+  message: "The provider stopped responding — the connection went idle.",
+  hint: "No data arrived for the whole idle-timeout window, so the turn was cut off. Send it again, or run /model to switch providers — a slow model can be given longer under /settings → HTTP idle timeout.",
+};
+
 function rawMessage(err: unknown): string {
   if (err instanceof Error) return err.message;
   if (typeof err === "string") return err;
@@ -318,6 +347,17 @@ export function describeError(err: unknown): DescribedError {
       hint: "Check the model id — run /model to switch.",
     });
   }
+  if (
+    status === 413 ||
+    facts.code === "PAYLOAD_TOO_LARGE" ||
+    facts.code === "REQUEST_TOO_LARGE" ||
+    /payload too large|request_too_large|request entity too large/i.test(text)
+  ) {
+    return out({
+      message: `Request payload too large${forProvider} (413).`,
+      hint: "The conversation history or attached files exceed the server limit. Start a new session (/new) or remove large attachments.",
+    });
+  }
   if (status === 429) {
     return out({
       message: `Rate limited${forProvider} (429).`,
@@ -332,6 +372,12 @@ export function describeError(err: unknown): DescribedError {
       retryable: true,
     });
   }
+  // A stream that stopped producing data. This carries no status, so without this
+  // branch it fell through to the generic "Network error" below, and pi re-sent the
+  // whole turn on the substring "timeout". Say what actually happened, and stop.
+  if (isIdleTimeoutError(text) || isIdleTimeoutError(facts.errno)) {
+    return out(IDLE_TIMEOUT_DESCRIPTION);
+  }
   if (
     facts.errno != null ||
     /fetch failed|cannot connect|ENOTFOUND|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|network/i.test(text)
@@ -469,7 +515,18 @@ export function retryDelayMs(
 export function describeErrorText(text: string | null | undefined): DescribedError | null {
   const s = typeof text === "string" ? text : "";
   const status = Number(/^\s*(\d{3})\b/.exec(s)?.[1] ?? NaN);
-  if (!Number.isFinite(status)) return null;
+  if (!Number.isFinite(status)) {
+    // No leading status: the one message we can still describe with certainty is a
+    // transport idle timeout, which undici names exactly. Everything else is printed
+    // unchanged, as before.
+    if (isIdleTimeoutError(s)) {
+      return {
+        message: redactText(IDLE_TIMEOUT_DESCRIPTION.message),
+        hint: IDLE_TIMEOUT_DESCRIPTION.hint,
+      };
+    }
+    return null;
+  }
 
   if (status === 429) {
     const stated = retryAfterMs(s);
@@ -493,6 +550,12 @@ export function describeErrorText(text: string | null | undefined): DescribedErr
       hint: "Check the model id — run /model to switch.",
     };
   }
+  if (status === 413 || /413\b|payload too large|request_too_large|request entity too large/i.test(s)) {
+    return {
+      message: redactText(`Request payload too large (413).`),
+      hint: "The conversation history or attached files exceed the server limit. Start a new session (/new) or remove large attachments.",
+    };
+  }
   if (status >= 500) {
     return {
       message: redactText(compactProviderError(s)),

package/src/providers/account.ts

@@ -76,6 +76,29 @@ const DEFAULT_MODELS = [
   "openai/gpt-5.6-luna",
 ];
 
+// What to assume when the server publishes no window for a model — an older server,
+// a model the upstream catalog has no `context_length` for, or an admin-added row.
+// 128000 was the flat value the whole catalog used to be registered with, so keeping
+// it here means "no published window" behaves exactly as it always has, and only a
+// model we have a real number for changes.
+const DEFAULT_CONTEXT_WINDOW = 128000;
+
+// A sane band for a published window. The catalog is remote input and the cache is a
+// file on disk, so a garbled or hostile number must not reach pi's budget arithmetic:
+// too small silently strangles every turn, too large defeats compaction by promising
+// room that isn't there. Anything outside the band is treated as unpublished.
+const MIN_PUBLISHED_CONTEXT_WINDOW = 8_192;
+const MAX_PUBLISHED_CONTEXT_WINDOW = 10_000_000;
+
+function validContextWindow(value: unknown): number | undefined {
+  return typeof value === "number" &&
+    Number.isFinite(value) &&
+    value >= MIN_PUBLISHED_CONTEXT_WINDOW &&
+    value <= MAX_PUBLISHED_CONTEXT_WINDOW
+    ? Math.floor(value)
+    : undefined;
+}
+
 function seedModel(id: string) {
   return {
     id,
@@ -88,7 +111,13 @@ function seedModel(id: string) {
     // attaches when the user points at a screenshot. See providers/vision.ts.
     input: visionInput(id),
     cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-    contextWindow: 128000,
+    // The model's real window when the server published one, else the fallback.
+    // This is not cosmetic: pi sizes each turn's answer budget as
+    // (contextWindow − estimated prompt − 4096) and clamps max_tokens to it
+    // (pi-ai clampMaxTokensToContext, and see src/engine/contextBudget.ts). A window
+    // that under-states the model's real one therefore throttles the answer — and
+    // used to collapse it to a single token — while the model still has room.
+    contextWindow: accountContextWindow(id) ?? DEFAULT_CONTEXT_WINDOW,
     maxTokens: 16384,
   };
 }
@@ -146,25 +175,79 @@ const REASONING_EFFORT_THINKING: ThinkingProfile = {
   thinkingLevelMap: { off: "low", minimal: "low", xhigh: null },
 };
 
-// Only the TEE prefixes are annotated. Those are enclaves we drive directly and can
-// probe. The rest of the catalog is proxied to a third-party gateway whose thinking
-// shape we have NOT verified from here, and an unsupported parameter fails the whole
-// turn — decisively worse than a turn that thinks too much. They keep the old
-// behaviour exactly.
+// The proxied catalog: everything that is NOT a TEE prefix reaches OpenRouter
+// through the account relay, which forwards our body unchanged (treeview
+// services/inferenceService.js proxyChatCompletion — "pass the client body through
+// unchanged except for the fields we own"). OpenRouter normalises reasoning across
+// vendors with a nested `reasoning` object, which is exactly Pi's "openrouter"
+// thinkingFormat, and it derives a token budget from the effort — so the effort dial
+// is also the budget cap.
+//
+// That cap is the point. `reasoning: false` does not mean "does not think": it means
+// Pi sends NO thinking parameter at all, because every thinking branch in pi-ai
+// buildParams is gated on model.reasoning. The model then reasons at the gateway's
+// default — and reasoning shares `maxTokens` with the answer, so an unbounded
+// thinking phase eats the response. Measured across 6,200 real turns: 58–76% of ALL
+// output tokens on these models were reasoning, 158 turns spent ≥90% of the 16,384
+// budget thinking, and 12 produced thousands of reasoning tokens with no answer and
+// no tool call — a five-to-nine-minute spinner ending in "Response was truncated
+// before completion." The annotated TEE models, on the same measurement, sat at 0%.
+//
+// "off" pins to the floor instead of sending `effort: "none"`, for the same reason
+// harmony does above: an unsupported enum fails the whole turn, and this is the one
+// path with no safety net — the app's generateTextStream retries without the hint on
+// a 400 (inferenceService.js), proxyChatCompletion does not. "minimal" is only
+// universal on the GPT-5 family, so it shares the floor. low/medium/high pass
+// through verbatim; xhigh/max stay unmapped so getSupportedThinkingLevels drops them.
+const OPENROUTER_THINKING: ThinkingProfile = {
+  reasoning: true,
+  thinkingLevelMap: { off: "low", minimal: "low" },
+  compat: { thinkingFormat: "openrouter" },
+};
+
+// Only the TEE prefixes are driven directly and can be probed from here. The rest is
+// proxied to a third-party gateway, so an id is annotated only when it is
+// unambiguously a thinking model — an allowlist, never a denylist. The live catalog
+// carries 284 ids including roleplay finetunes (sao10k, thedrummer, gryphe) and
+// code-apply models (morph, relace) that do not reason at all, and being wrong here
+// costs the whole turn rather than just a slow one.
 //
+// Every family below was measured burning its budget in the session logs. Families
+// that reason but were NOT observed here — anthropic/*, qwen/*, moonshotai/*,
+// minimax/* — are deliberately left alone until probed live: Anthropic in particular
+// takes a thinking BUDGET through OpenRouter and constrains temperature alongside it,
+// which is a second parameter we would be guessing at.
+const PROXIED_THINKING_MODEL: RegExp[] = [
+  /^google\/gemini-/i, //           gemini-2.5+ all take an effort; gemma-* deliberately excluded
+  /^z-ai\/glm-/i, //                the whole GLM line reasons, vision variants included
+  /^deepseek\/deepseek-(r1|v3\.[12]|v4)/i, // NOT deepseek-chat*, which is the non-thinking split
+  /^x-ai\/grok-4/i, //              grok-4.x; grok-build-0.1 is unprobed
+  /^openai\/gpt-(5|6|oss)/i, //     gpt-4*/gpt-3.5* do not reason
+];
+
+// Non-thinking variants inside an otherwise-thinking family. `-chat` is OpenAI's
+// non-reasoning split (gpt-5.2-chat); `instruct` is the same idea everywhere.
+const NON_THINKING_VARIANT = /(?:^|[-/])(?:chat|instruct)(?:[-.]|$)/i;
+
+const TEE_MODEL = /^(tinfoil|phala|near)\//;
+
 // Two deliberate omissions inside the TEE set: `*-instruct` ids are the
 // non-thinking variants, and tinfoil/kimi-k2-6 reasons but ignored BOTH levers when
 // probed, so annotating it would hand the user a dial connected to nothing.
-const TEE_MODEL = /^(tinfoil|phala|near)\//;
+function teeThinkingProfile(id: string): ThinkingProfile | null {
+  if (/instruct/i.test(id)) return null;
+  if (/gpt-oss/i.test(id)) return REASONING_EFFORT_THINKING;
+  if (/glm|qwen/i.test(id)) return CHAT_TEMPLATE_THINKING;
+  return null;
+}
+
+function proxiedThinkingProfile(id: string): ThinkingProfile | null {
+  if (NON_THINKING_VARIANT.test(id)) return null;
+  return PROXIED_THINKING_MODEL.some((re) => re.test(id)) ? OPENROUTER_THINKING : null;
+}
 
 export function thinkingProfile(id: string): ThinkingProfile | null {
-  if (!TEE_MODEL.test(id)) return null;
-  if (/instruct/i.test(id)) return null;
-  const profile = /gpt-oss/i.test(id)
-    ? REASONING_EFFORT_THINKING
-    : /glm|qwen/i.test(id)
-      ? CHAT_TEMPLATE_THINKING
-      : null;
+  const profile = TEE_MODEL.test(id) ? teeThinkingProfile(id) : proxiedThinkingProfile(id);
   // Hand out a COPY. These entries end up on hundreds of registered models, and a
   // shared nested object is one careless mutation away from retuning the whole catalog.
   return profile && { ...profile, thinkingLevelMap: { ...profile.thinkingLevelMap }, ...(profile.compat ? { compat: { ...profile.compat } } : {}) };
@@ -198,16 +281,69 @@ function catalogCachePath(): string {
 
 // Best effort in both directions: this cache is an optimization, and a launch must never
 // fail because it couldn't be read or written.
-function saveCachedCatalogIds(ids: string[]): void {
+//
+// `windows` joined `ids` here because the synchronous launch seed needs it. Registration
+// builds every model entry before the live fetch can resolve, so a context window known
+// only to the live catalog would always arrive one launch too late — the entries pi
+// actually binds would already carry the fallback. A window is a capability, not a
+// privacy claim, so unlike the tier it is safe to read back from disk: the worst a stale
+// one does is size a budget against last week's number, and the live fetch corrects it
+// moments later. (The v1 `ids` key is still written, so an older build reading this file
+// sees exactly what it expects.)
+function saveCachedCatalog(infos: AccountModelInfo[]): void {
   try {
     mkdirSync(globalDir(), { recursive: true });
-    const payload = { v: 1, fetchedAt: new Date().toISOString(), ids: ids.slice(0, CATALOG_CACHE_MAX) };
+    const kept = infos.slice(0, CATALOG_CACHE_MAX);
+    const windows: Record<string, number> = {};
+    for (const info of kept) {
+      if (info.contextWindow !== undefined) windows[info.id] = info.contextWindow;
+    }
+    const payload = {
+      v: 2,
+      fetchedAt: new Date().toISOString(),
+      ids: kept.map((info) => info.id),
+      windows,
+    };
     writeFileSync(catalogCachePath(), JSON.stringify(payload) + "\n", "utf8");
+    forgetCachedContextWindows();
   } catch {
     /* unwritable home — we just seed from DEFAULT_MODELS next launch */
   }
 }
 
+// Read the cache once per process. seedModel calls accountContextWindow for every id in
+// the catalog on every registration, and the catalog re-registers whenever the shim
+// state changes — re-reading and re-parsing a 284-entry file each time would turn a
+// cheap lookup into hundreds of syscalls on the launch path.
+let cachedWindows: Map<string, number> | null = null;
+
+function cachedContextWindows(): Map<string, number> {
+  if (cachedWindows) return cachedWindows;
+  cachedWindows = new Map();
+  try {
+    const path = catalogCachePath();
+    if (existsSync(path)) {
+      const parsed = JSON.parse(readFileSync(path, "utf8")) as { windows?: unknown };
+      // A v1 file has no `windows` at all; every id then falls back, exactly as before.
+      if (parsed.windows && typeof parsed.windows === "object") {
+        for (const [id, value] of Object.entries(parsed.windows as Record<string, unknown>)) {
+          const window = validContextWindow(value);
+          if (window !== undefined && cachedWindows.size < CATALOG_CACHE_MAX) cachedWindows.set(id, window);
+        }
+      }
+    }
+  } catch {
+    /* absent, unreadable, or garbage — every model just uses the fallback window */
+  }
+  return cachedWindows;
+}
+
+// Drop the memo so the next read sees what was just written (and so a test can rewrite
+// the cache between assertions).
+function forgetCachedContextWindows(): void {
+  cachedWindows = null;
+}
+
 export function loadCachedCatalogIds(): string[] {
   try {
     const path = catalogCachePath();
@@ -267,6 +403,10 @@ export function seedCatalogIds(): string[] {
 export interface AccountModelInfo {
   id: string;
   tier: PrivacyTier;
+  // The server's published context window, when it published one and it is credible.
+  // Absent means "unknown" — seedModel falls back to DEFAULT_CONTEXT_WINDOW rather
+  // than to a guess, so an older server behaves exactly as before.
+  contextWindow?: number;
 }
 
 // The set of tier strings pi-privacy defines (posture/tiers.ts). We only trust a
@@ -300,6 +440,19 @@ function normalizeTier(tier: string | undefined, modelId: string): PrivacyTier {
 // A live NEAR attestation (accountPosture) can still upgrade a row to tee-verified.
 const accountTierMap = new Map<string, PrivacyTier>();
 
+// Published context windows, keyed by modelId. Unlike the tier map this one IS
+// persisted (see the cache below): a window is a capability, not a privacy claim, and
+// it is needed at LAUNCH — registration happens synchronously, long before the live
+// fetch resolves, so a window learned only at fetch time would arrive after the model
+// entries pi actually uses were built.
+const accountWindowMap = new Map<string, number>();
+
+// The server's published context window for a model, or undefined if we have not been
+// told one. Live catalog first, then the on-disk cache from the last launch.
+export function accountContextWindow(id: string): number | undefined {
+  return accountWindowMap.get(id) ?? cachedContextWindows().get(id);
+}
+
 // The server-asserted baseline tier for an account model, or undefined if we haven't
 // seen it in a catalog fetch. Used by the /models picker (privateer-models.ts).
 export function accountBaselineTier(modelId: string): PrivacyTier | undefined {
@@ -329,23 +482,38 @@ export async function fetchAccountCatalog(): Promise<AccountModelInfo[]> {
       infos = fallback();
     } else {
       const data = (await res.json()) as {
-        models?: { modelId?: string; privacy?: { tier?: string } }[];
+        models?: { modelId?: string; privacy?: { tier?: string }; contextLength?: unknown }[];
       };
       const parsed = (data.models ?? [])
-        .map((m) => (m.modelId ? { id: m.modelId, tier: normalizeTier(m.privacy?.tier, m.modelId) } : null))
+        .map((m): AccountModelInfo | null =>
+          m.modelId
+            ? {
+                id: m.modelId,
+                tier: normalizeTier(m.privacy?.tier, m.modelId),
+                // `contextLength` is null for a model upstream has no window for, and
+                // absent entirely on a server older than the field — both mean
+                // "unknown", and validContextWindow collapses them to undefined.
+                contextWindow: validContextWindow(m.contextLength),
+              }
+            : null,
+        )
         .filter((x): x is AccountModelInfo => !!x);
       // Cache only a real LIVE listing — never the fallback, which would freeze the six
       // seed ids on disk and read back as though it were the catalog. Both the cache and
       // the returned list are the server's UNFILTERED offer; servability is decided at
       // registration (accountProviderConfig), which re-evaluates it every time.
-      if (parsed.length) saveCachedCatalogIds(parsed.map((p) => p.id));
+      if (parsed.length) saveCachedCatalog(parsed);
       infos = parsed.length ? parsed : fallback();
     }
   } catch {
     infos = fallback();
   }
   accountTierMap.clear();
-  for (const info of infos) accountTierMap.set(info.id, info.tier);
+  accountWindowMap.clear();
+  for (const info of infos) {
+    accountTierMap.set(info.id, info.tier);
+    if (info.contextWindow !== undefined) accountWindowMap.set(info.id, info.contextWindow);
+  }
   return infos;
 }
 

package/src/remote/relayClient.ts

@@ -126,6 +126,13 @@ export interface RelayCallbacks {
   // bypass mode instead of relaying every action, so the agent runs to completion.
   // Dangerous/destructive actions still relay — they sit above bypass locally too.
   onNoQuarter?: (on: boolean) => void;
+  // The app toggled the privacy filter. `off` true = pi-privacy is disabled for this
+  // session, exactly as `/privacy off` does it: no outbound PII scan or prompt, no
+  // tool-result credential redaction, no exfiltration or downgrade guard. The app is
+  // the only surface that can ask for this without a keyboard on this machine, so the
+  // frame carries the SAME state the command writes (process.env, shared with
+  // subagent children) rather than a second flag beside it.
+  onPrivacy?: (off: boolean) => void;
   // A controller attached — push a transcript snapshot so it can catch up.
   onControllerAttached: () => void;
   // The last controller went away (app closed / socket reaped). The terminal keeps
@@ -696,6 +703,7 @@ export class RelayClient {
       seq?: number;
       data?: string;
       on?: boolean;
+      off?: boolean;
       value?: string;
       source?: string;
       description?: string;
@@ -763,6 +771,9 @@ export class RelayClient {
       case "no_quarter":
         this.cb.onNoQuarter?.(frame.on === true);
         break;
+      case "privacy":
+        this.cb.onPrivacy?.(frame.off === true);
+        break;
       case "controller_attached":
         this.cb.onControllerAttached();
         break;
@@ -1158,6 +1169,15 @@ export class RelayClient {
     this.rawSend({ type: "no_quarter", on });
   }
 
+  // Echo the privacy-filter state up to the controller, same contract as
+  // sendNoQuarter: an ack of the app's toggle, and a resync on controller attach.
+  // Only ever sent while the filter is OFF — the app defaults its switch to "on"
+  // (the safe reading), so a terminal too old to know this frame, or one running
+  // with the filter intact, correctly shows protected.
+  sendPrivacy(off: boolean): void {
+    this.rawSend({ type: "privacy", off });
+  }
+
   // Push this terminal's live context (selected model, agent version) to a
   // controller so the app's session banner reflects reality instead of a stub.
   // Sent on controller attach — like the snapshot/no_quarter resync. NON-PII ONLY

package/src/remote/remoteBridge.ts

@@ -12,6 +12,9 @@
 
 import { randomUUID } from "node:crypto";
 import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts";
+// Pure env-var accessors (see config/privacyDisabled.ts) — no Pi, no node builtins,
+// so this stays safe to import from the bridge, which boot-ordered code reaches.
+import { onPrivacyDisabledChange, privacyDisabled, setPrivacyDisabled } from "../config/privacyDisabled.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
 import type { AskOutcome } from "../permissions/modeGate.ts";
@@ -56,6 +59,10 @@ export interface RelayLike {
   // turns into a duplicate of something the app already displayed.
   hasController?(): boolean;
   sendNoQuarter(on: boolean): void;
+  // Echo the privacy-filter state (off = pi-privacy disabled). Optional so a
+  // transport built against an older shape still satisfies the interface; the
+  // bridge's callers all treat a missing echo as "filter on", which is the safe read.
+  sendPrivacy?(off: boolean): void;
   sendFile(file: { name: string; mediaType: string; base64: string; size: number }): Promise<{ ok: boolean; reason?: string }>;
   sendNotice(text: string): void;
   sendCommands(commands: { name: string; description?: string }[]): void;
@@ -190,7 +197,25 @@ export class RemoteBridge {
   private turnPrompt = "";
   private turnText = "";
 
-  constructor(private readonly cfg: RemoteBridgeConfig) {}
+  // Unsubscribes the privacy watcher below. Held so a bridge that outlives its window
+  // (the desktop builds one per window, in one process) stops writing to a transport
+  // whose renderer is gone.
+  private readonly unwatchPrivacy: () => void;
+
+  constructor(private readonly cfg: RemoteBridgeConfig) {
+    // The privacy switch has a second driver: `/privacy off` typed into the composer
+    // (or into the CLI beside a driving app). Watch the flag itself rather than only
+    // the frame, so the app's shield follows the terminal however it was moved — and
+    // on the desktop, where the flag is process-wide, so does every OTHER window's,
+    // which is the truth: they share the env var this writes.
+    this.unwatchPrivacy = onPrivacyDisabledChange((off) => this.relay?.sendPrivacy?.(off));
+  }
+
+  /** Release what outlives a socket. Safe to call twice. */
+  dispose(): void {
+    this.unwatchPrivacy();
+    this.relay = undefined;
+  }
 
   // Wire the outbound relay once it's constructed (RelayClient needs `callbacks`
   // at construction, so the relay is attached right after).
@@ -286,10 +311,29 @@ export class RemoteBridge {
       setNoQuarter(on);
       this.relay?.sendNoQuarter(on); // echo the ack back so the app's toggle syncs
     },
+    // The app's privacy switch. It writes the SAME state `/privacy off` writes — the
+    // env var every module copy and subagent child reads — so a session toggled from
+    // the app and one toggled from the keyboard are the same session, and the CLI's
+    // own `/privacy status` tells the truth about what the app did. Echoed back so
+    // the app's switch reflects what this terminal is actually doing rather than what
+    // it was asked to do.
+    onPrivacy: (off) => {
+      const changed = privacyDisabled() !== off;
+      setPrivacyDisabled(off);
+      // A real change is echoed by the watcher in the constructor (which also covers
+      // `/privacy` typed at a composer). Ack a no-op ask here so an app whose switch
+      // was already out of step still gets an answer rather than silence.
+      if (!changed) this.relay?.sendPrivacy?.(off);
+    },
     onControllerAttached: () => {
       if (this.noQuarter || noQuarterActive()) {
         this.relay?.sendNoQuarter(true);
       }
+      // Resync the privacy switch the same way, and for a sharper reason: the filter
+      // may have been turned off from the keyboard, or by a launch flag, or by an
+      // earlier session of this app — an attaching controller must not paint a shield
+      // over a terminal that has none. Sent only when OFF, so silence means protected.
+      if (privacyDisabled()) this.relay?.sendPrivacy?.(true);
       this.cfg.onControllerAttached?.();
     },
     // The app left while we're still running. Same posture as a dropped socket: stop
@@ -319,6 +363,9 @@ export class RemoteBridge {
   getRemote = (): boolean => this.remote;
   getNoQuarter = (): boolean => this.noQuarter || noQuarterActive();
 
+  /** True while the privacy filter is disabled for this session (`/privacy off`). */
+  getPrivacyDisabled = (): boolean => privacyDisabled();
+
   // The gate's remote approver: relay the request to the app and await its
   // allow/deny. Fail closed if no controller, on abort, or on disconnect. (The gate
   // also wraps this in its own timeout, so a silent app can't wedge the turn.)