privateer-agent 0.12.36 → 0.12.37

package/extensions/privateer-posture.ts

@@ -9,7 +9,7 @@
 import { verifyModelPosture, TIERS, type PrivacyTier } from "pi-privacy";
 import { accountPosture } from "../src/providers/account.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
-import { privacyDisabled } from "../src/config/privacyDisabled.ts";
+import { onPrivacyDisabledChange, privacyDisabled } from "../src/config/privacyDisabled.ts";
 
 const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
 
@@ -79,6 +79,21 @@ export default function privateerPosture(pi: any): void {
     }
   };
 
-  pi.on("model_select", (event: any, ctx: any) => update(event?.model?.provider, event?.model?.id, ctx));
-  pi.on("session_start", (_event: any, ctx: any) => update(ctx?.model?.provider, ctx?.model?.id, ctx));
+  // Keep the last ctx a real event handed us: the badge has to be repainted when the
+  // privacy flag moves, and the flag can now move with no event behind it at all —
+  // the app's shield toggle writes it over the relay (RemoteBridge's onPrivacy), so
+  // `/privacy` is no longer the only driver and the CLI's own badge would otherwise
+  // sit on "⛉ Trusted Execution" over a session whose filter a phone just took down.
+  let lastCtx: any = null;
+  pi.on("model_select", (event: any, ctx: any) => {
+    lastCtx = ctx;
+    return update(event?.model?.provider, event?.model?.id, ctx);
+  });
+  pi.on("session_start", (_event: any, ctx: any) => {
+    lastCtx = ctx;
+    return update(ctx?.model?.provider, ctx?.model?.id, ctx);
+  });
+  onPrivacyDisabledChange(() => {
+    void update(lastCtx?.model?.provider, lastCtx?.model?.id, lastCtx);
+  });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.36",
+  "version": "0.12.37",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/config/privacyDisabled.ts

@@ -24,11 +24,27 @@ export function privacyDisabled(): boolean {
   return process.env[ENV] === "1" || process.env[ALT_ENV] === "1";
 }
 
+// WHO ELSE NEEDS TO KNOW. The env var is the store, but it is not observable — and the
+// switch now has two drivers on the same session: `/privacy off` typed into a composer,
+// and the app's own shield toggle (RemoteBridge's onPrivacy). Whichever one moves it, the
+// app's switch has to follow, or the desktop shows a shield over a session whose filter
+// its own composer just turned off. Listeners fire on a real CHANGE only, so a re-assert
+// is not an event; failures are swallowed, because a subscriber that throws must not
+// leave the flag half-applied.
+const listeners = new Set<(disabled: boolean) => void>();
+
+/** Watch the disabled state. Returns an unsubscribe. Fires only when the value changes. */
+export function onPrivacyDisabledChange(fn: (disabled: boolean) => void): () => void {
+  listeners.add(fn);
+  return () => listeners.delete(fn);
+}
+
 /**
  * Set the disabled state. Modifies process.env so every module copy and child process agrees.
  * Returns the new state.
  */
 export function setPrivacyDisabled(disabled: boolean): boolean {
+  const before = privacyDisabled();
   if (disabled) {
     process.env[ENV] = "1";
     process.env[ALT_ENV] = "1";
@@ -36,6 +52,11 @@ export function setPrivacyDisabled(disabled: boolean): boolean {
     delete process.env[ENV];
     delete process.env[ALT_ENV];
   }
+  if (before !== disabled) {
+    for (const fn of listeners) {
+      try { fn(disabled); } catch { /* a watcher must not break the toggle */ }
+    }
+  }
   return disabled;
 }
 

package/src/remote/relayClient.ts

@@ -126,6 +126,13 @@ export interface RelayCallbacks {
   // bypass mode instead of relaying every action, so the agent runs to completion.
   // Dangerous/destructive actions still relay — they sit above bypass locally too.
   onNoQuarter?: (on: boolean) => void;
+  // The app toggled the privacy filter. `off` true = pi-privacy is disabled for this
+  // session, exactly as `/privacy off` does it: no outbound PII scan or prompt, no
+  // tool-result credential redaction, no exfiltration or downgrade guard. The app is
+  // the only surface that can ask for this without a keyboard on this machine, so the
+  // frame carries the SAME state the command writes (process.env, shared with
+  // subagent children) rather than a second flag beside it.
+  onPrivacy?: (off: boolean) => void;
   // A controller attached — push a transcript snapshot so it can catch up.
   onControllerAttached: () => void;
   // The last controller went away (app closed / socket reaped). The terminal keeps
@@ -696,6 +703,7 @@ export class RelayClient {
       seq?: number;
       data?: string;
       on?: boolean;
+      off?: boolean;
       value?: string;
       source?: string;
       description?: string;
@@ -763,6 +771,9 @@ export class RelayClient {
       case "no_quarter":
         this.cb.onNoQuarter?.(frame.on === true);
         break;
+      case "privacy":
+        this.cb.onPrivacy?.(frame.off === true);
+        break;
       case "controller_attached":
         this.cb.onControllerAttached();
         break;
@@ -1158,6 +1169,15 @@ export class RelayClient {
     this.rawSend({ type: "no_quarter", on });
   }
 
+  // Echo the privacy-filter state up to the controller, same contract as
+  // sendNoQuarter: an ack of the app's toggle, and a resync on controller attach.
+  // Only ever sent while the filter is OFF — the app defaults its switch to "on"
+  // (the safe reading), so a terminal too old to know this frame, or one running
+  // with the filter intact, correctly shows protected.
+  sendPrivacy(off: boolean): void {
+    this.rawSend({ type: "privacy", off });
+  }
+
   // Push this terminal's live context (selected model, agent version) to a
   // controller so the app's session banner reflects reality instead of a stub.
   // Sent on controller attach — like the snapshot/no_quarter resync. NON-PII ONLY

package/src/remote/remoteBridge.ts

@@ -12,6 +12,9 @@
 
 import { randomUUID } from "node:crypto";
 import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts";
+// Pure env-var accessors (see config/privacyDisabled.ts) — no Pi, no node builtins,
+// so this stays safe to import from the bridge, which boot-ordered code reaches.
+import { onPrivacyDisabledChange, privacyDisabled, setPrivacyDisabled } from "../config/privacyDisabled.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
 import type { AskOutcome } from "../permissions/modeGate.ts";
@@ -56,6 +59,10 @@ export interface RelayLike {
   // turns into a duplicate of something the app already displayed.
   hasController?(): boolean;
   sendNoQuarter(on: boolean): void;
+  // Echo the privacy-filter state (off = pi-privacy disabled). Optional so a
+  // transport built against an older shape still satisfies the interface; the
+  // bridge's callers all treat a missing echo as "filter on", which is the safe read.
+  sendPrivacy?(off: boolean): void;
   sendFile(file: { name: string; mediaType: string; base64: string; size: number }): Promise<{ ok: boolean; reason?: string }>;
   sendNotice(text: string): void;
   sendCommands(commands: { name: string; description?: string }[]): void;
@@ -190,7 +197,25 @@ export class RemoteBridge {
   private turnPrompt = "";
   private turnText = "";
 
-  constructor(private readonly cfg: RemoteBridgeConfig) {}
+  // Unsubscribes the privacy watcher below. Held so a bridge that outlives its window
+  // (the desktop builds one per window, in one process) stops writing to a transport
+  // whose renderer is gone.
+  private readonly unwatchPrivacy: () => void;
+
+  constructor(private readonly cfg: RemoteBridgeConfig) {
+    // The privacy switch has a second driver: `/privacy off` typed into the composer
+    // (or into the CLI beside a driving app). Watch the flag itself rather than only
+    // the frame, so the app's shield follows the terminal however it was moved — and
+    // on the desktop, where the flag is process-wide, so does every OTHER window's,
+    // which is the truth: they share the env var this writes.
+    this.unwatchPrivacy = onPrivacyDisabledChange((off) => this.relay?.sendPrivacy?.(off));
+  }
+
+  /** Release what outlives a socket. Safe to call twice. */
+  dispose(): void {
+    this.unwatchPrivacy();
+    this.relay = undefined;
+  }
 
   // Wire the outbound relay once it's constructed (RelayClient needs `callbacks`
   // at construction, so the relay is attached right after).
@@ -286,10 +311,29 @@ export class RemoteBridge {
       setNoQuarter(on);
       this.relay?.sendNoQuarter(on); // echo the ack back so the app's toggle syncs
     },
+    // The app's privacy switch. It writes the SAME state `/privacy off` writes — the
+    // env var every module copy and subagent child reads — so a session toggled from
+    // the app and one toggled from the keyboard are the same session, and the CLI's
+    // own `/privacy status` tells the truth about what the app did. Echoed back so
+    // the app's switch reflects what this terminal is actually doing rather than what
+    // it was asked to do.
+    onPrivacy: (off) => {
+      const changed = privacyDisabled() !== off;
+      setPrivacyDisabled(off);
+      // A real change is echoed by the watcher in the constructor (which also covers
+      // `/privacy` typed at a composer). Ack a no-op ask here so an app whose switch
+      // was already out of step still gets an answer rather than silence.
+      if (!changed) this.relay?.sendPrivacy?.(off);
+    },
     onControllerAttached: () => {
       if (this.noQuarter || noQuarterActive()) {
         this.relay?.sendNoQuarter(true);
       }
+      // Resync the privacy switch the same way, and for a sharper reason: the filter
+      // may have been turned off from the keyboard, or by a launch flag, or by an
+      // earlier session of this app — an attaching controller must not paint a shield
+      // over a terminal that has none. Sent only when OFF, so silence means protected.
+      if (privacyDisabled()) this.relay?.sendPrivacy?.(true);
       this.cfg.onControllerAttached?.();
     },
     // The app left while we're still running. Same posture as a dropped socket: stop
@@ -319,6 +363,9 @@ export class RemoteBridge {
   getRemote = (): boolean => this.remote;
   getNoQuarter = (): boolean => this.noQuarter || noQuarterActive();
 
+  /** True while the privacy filter is disabled for this session (`/privacy off`). */
+  getPrivacyDisabled = (): boolean => privacyDisabled();
+
   // The gate's remote approver: relay the request to the app and await its
   // allow/deny. Fail closed if no controller, on abort, or on disconnect. (The gate
   // also wraps this in its own timeout, so a silent app can't wedge the turn.)