privateer-agent 0.12.36 → 0.12.38

package/extensions/privateer-posture.ts

@@ -9,7 +9,7 @@
 import { verifyModelPosture, TIERS, type PrivacyTier } from "pi-privacy";
 import { accountPosture } from "../src/providers/account.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
-import { privacyDisabled } from "../src/config/privacyDisabled.ts";
+import { onPrivacyDisabledChange, privacyDisabled } from "../src/config/privacyDisabled.ts";
 
 const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
 
@@ -79,6 +79,21 @@ export default function privateerPosture(pi: any): void {
     }
   };
 
-  pi.on("model_select", (event: any, ctx: any) => update(event?.model?.provider, event?.model?.id, ctx));
-  pi.on("session_start", (_event: any, ctx: any) => update(ctx?.model?.provider, ctx?.model?.id, ctx));
+  // Keep the last ctx a real event handed us: the badge has to be repainted when the
+  // privacy flag moves, and the flag can now move with no event behind it at all —
+  // the app's shield toggle writes it over the relay (RemoteBridge's onPrivacy), so
+  // `/privacy` is no longer the only driver and the CLI's own badge would otherwise
+  // sit on "⛉ Trusted Execution" over a session whose filter a phone just took down.
+  let lastCtx: any = null;
+  pi.on("model_select", (event: any, ctx: any) => {
+    lastCtx = ctx;
+    return update(event?.model?.provider, event?.model?.id, ctx);
+  });
+  pi.on("session_start", (_event: any, ctx: any) => {
+    lastCtx = ctx;
+    return update(ctx?.model?.provider, ctx?.model?.id, ctx);
+  });
+  onPrivacyDisabledChange(() => {
+    void update(lastCtx?.model?.provider, lastCtx?.model?.id, lastCtx);
+  });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.36",
+  "version": "0.12.38",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/config/privacyDisabled.ts

@@ -24,11 +24,27 @@ export function privacyDisabled(): boolean {
   return process.env[ENV] === "1" || process.env[ALT_ENV] === "1";
 }
 
+// WHO ELSE NEEDS TO KNOW. The env var is the store, but it is not observable — and the
+// switch now has two drivers on the same session: `/privacy off` typed into a composer,
+// and the app's own shield toggle (RemoteBridge's onPrivacy). Whichever one moves it, the
+// app's switch has to follow, or the desktop shows a shield over a session whose filter
+// its own composer just turned off. Listeners fire on a real CHANGE only, so a re-assert
+// is not an event; failures are swallowed, because a subscriber that throws must not
+// leave the flag half-applied.
+const listeners = new Set<(disabled: boolean) => void>();
+
+/** Watch the disabled state. Returns an unsubscribe. Fires only when the value changes. */
+export function onPrivacyDisabledChange(fn: (disabled: boolean) => void): () => void {
+  listeners.add(fn);
+  return () => listeners.delete(fn);
+}
+
 /**
  * Set the disabled state. Modifies process.env so every module copy and child process agrees.
  * Returns the new state.
  */
 export function setPrivacyDisabled(disabled: boolean): boolean {
+  const before = privacyDisabled();
   if (disabled) {
     process.env[ENV] = "1";
     process.env[ALT_ENV] = "1";
@@ -36,6 +52,11 @@ export function setPrivacyDisabled(disabled: boolean): boolean {
     delete process.env[ENV];
     delete process.env[ALT_ENV];
   }
+  if (before !== disabled) {
+    for (const fn of listeners) {
+      try { fn(disabled); } catch { /* a watcher must not break the toggle */ }
+    }
+  }
   return disabled;
 }
 

package/src/remote/relayClient.ts

@@ -126,6 +126,13 @@ export interface RelayCallbacks {
   // bypass mode instead of relaying every action, so the agent runs to completion.
   // Dangerous/destructive actions still relay — they sit above bypass locally too.
   onNoQuarter?: (on: boolean) => void;
+  // The app toggled the privacy filter. `off` true = pi-privacy is disabled for this
+  // session, exactly as `/privacy off` does it: no outbound PII scan or prompt, no
+  // tool-result credential redaction, no exfiltration or downgrade guard. The app is
+  // the only surface that can ask for this without a keyboard on this machine, so the
+  // frame carries the SAME state the command writes (process.env, shared with
+  // subagent children) rather than a second flag beside it.
+  onPrivacy?: (off: boolean) => void;
   // A controller attached — push a transcript snapshot so it can catch up.
   onControllerAttached: () => void;
   // The last controller went away (app closed / socket reaped). The terminal keeps
@@ -696,6 +703,7 @@ export class RelayClient {
       seq?: number;
       data?: string;
       on?: boolean;
+      off?: boolean;
       value?: string;
       source?: string;
       description?: string;
@@ -763,6 +771,9 @@ export class RelayClient {
       case "no_quarter":
         this.cb.onNoQuarter?.(frame.on === true);
         break;
+      case "privacy":
+        this.cb.onPrivacy?.(frame.off === true);
+        break;
       case "controller_attached":
         this.cb.onControllerAttached();
         break;
@@ -1158,6 +1169,15 @@ export class RelayClient {
     this.rawSend({ type: "no_quarter", on });
   }
 
+  // Echo the privacy-filter state up to the controller, same contract as
+  // sendNoQuarter: an ack of the app's toggle, and a resync on controller attach.
+  // Only ever sent while the filter is OFF — the app defaults its switch to "on"
+  // (the safe reading), so a terminal too old to know this frame, or one running
+  // with the filter intact, correctly shows protected.
+  sendPrivacy(off: boolean): void {
+    this.rawSend({ type: "privacy", off });
+  }
+
   // Push this terminal's live context (selected model, agent version) to a
   // controller so the app's session banner reflects reality instead of a stub.
   // Sent on controller attach — like the snapshot/no_quarter resync. NON-PII ONLY

package/src/remote/remoteBridge.ts

@@ -12,6 +12,9 @@
 
 import { randomUUID } from "node:crypto";
 import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts";
+// Pure env-var accessors (see config/privacyDisabled.ts) — no Pi, no node builtins,
+// so this stays safe to import from the bridge, which boot-ordered code reaches.
+import { onPrivacyDisabledChange, privacyDisabled, setPrivacyDisabled } from "../config/privacyDisabled.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
 import type { AskOutcome } from "../permissions/modeGate.ts";
@@ -56,6 +59,10 @@ export interface RelayLike {
   // turns into a duplicate of something the app already displayed.
   hasController?(): boolean;
   sendNoQuarter(on: boolean): void;
+  // Echo the privacy-filter state (off = pi-privacy disabled). Optional so a
+  // transport built against an older shape still satisfies the interface; the
+  // bridge's callers all treat a missing echo as "filter on", which is the safe read.
+  sendPrivacy?(off: boolean): void;
   sendFile(file: { name: string; mediaType: string; base64: string; size: number }): Promise<{ ok: boolean; reason?: string }>;
   sendNotice(text: string): void;
   sendCommands(commands: { name: string; description?: string }[]): void;
@@ -190,7 +197,25 @@ export class RemoteBridge {
   private turnPrompt = "";
   private turnText = "";
 
-  constructor(private readonly cfg: RemoteBridgeConfig) {}
+  // Unsubscribes the privacy watcher below. Held so a bridge that outlives its window
+  // (the desktop builds one per window, in one process) stops writing to a transport
+  // whose renderer is gone.
+  private readonly unwatchPrivacy: () => void;
+
+  constructor(private readonly cfg: RemoteBridgeConfig) {
+    // The privacy switch has a second driver: `/privacy off` typed into the composer
+    // (or into the CLI beside a driving app). Watch the flag itself rather than only
+    // the frame, so the app's shield follows the terminal however it was moved — and
+    // on the desktop, where the flag is process-wide, so does every OTHER window's,
+    // which is the truth: they share the env var this writes.
+    this.unwatchPrivacy = onPrivacyDisabledChange((off) => this.relay?.sendPrivacy?.(off));
+  }
+
+  /** Release what outlives a socket. Safe to call twice. */
+  dispose(): void {
+    this.unwatchPrivacy();
+    this.relay = undefined;
+  }
 
   // Wire the outbound relay once it's constructed (RelayClient needs `callbacks`
   // at construction, so the relay is attached right after).
@@ -286,10 +311,29 @@ export class RemoteBridge {
       setNoQuarter(on);
       this.relay?.sendNoQuarter(on); // echo the ack back so the app's toggle syncs
     },
+    // The app's privacy switch. It writes the SAME state `/privacy off` writes — the
+    // env var every module copy and subagent child reads — so a session toggled from
+    // the app and one toggled from the keyboard are the same session, and the CLI's
+    // own `/privacy status` tells the truth about what the app did. Echoed back so
+    // the app's switch reflects what this terminal is actually doing rather than what
+    // it was asked to do.
+    onPrivacy: (off) => {
+      const changed = privacyDisabled() !== off;
+      setPrivacyDisabled(off);
+      // A real change is echoed by the watcher in the constructor (which also covers
+      // `/privacy` typed at a composer). Ack a no-op ask here so an app whose switch
+      // was already out of step still gets an answer rather than silence.
+      if (!changed) this.relay?.sendPrivacy?.(off);
+    },
     onControllerAttached: () => {
       if (this.noQuarter || noQuarterActive()) {
         this.relay?.sendNoQuarter(true);
       }
+      // Resync the privacy switch the same way, and for a sharper reason: the filter
+      // may have been turned off from the keyboard, or by a launch flag, or by an
+      // earlier session of this app — an attaching controller must not paint a shield
+      // over a terminal that has none. Sent only when OFF, so silence means protected.
+      if (privacyDisabled()) this.relay?.sendPrivacy?.(true);
       this.cfg.onControllerAttached?.();
     },
     // The app left while we're still running. Same posture as a dropped socket: stop
@@ -319,6 +363,9 @@ export class RemoteBridge {
   getRemote = (): boolean => this.remote;
   getNoQuarter = (): boolean => this.noQuarter || noQuarterActive();
 
+  /** True while the privacy filter is disabled for this session (`/privacy off`). */
+  getPrivacyDisabled = (): boolean => privacyDisabled();
+
   // The gate's remote approver: relay the request to the app and await its
   // allow/deny. Fail closed if no controller, on abort, or on disconnect. (The gate
   // also wraps this in its own timeout, so a silent app can't wedge the turn.)

package/src/tools/media.ts

@@ -1143,6 +1143,9 @@ export const generateSpriteToolDefinition = {
     "right-facing ones rather than rendered, which is why eight animations cost five clips and not " +
     "eight. Each clip is charged at the account's video rate, so an eight-way set is genuinely " +
     "expensive; say the total to the user before batching characters.\n" +
+    "TWO models are involved, which matters when one of them is down: an IMAGE model turns the " +
+    "picture to face each direction (only for `directions` 'four' and 'eight'), then a VIDEO model " +
+    "renders the motion per facing. `image_model` and `model` override them separately.\n" +
     "It takes several minutes (the clips render sequentially) and this tool waits. Frame count, cell " +
     "size and frame rate are chosen here and cost nothing extra. AVAILABILITY: this needs a video " +
     "decoder on the Privateer API and some deployments do not have one — call media_capabilities and " +
@@ -1218,13 +1221,25 @@ export const generateSpriteToolDefinition = {
     model: Type.Optional(
       Type.String({ description: "Video model id to render the motion with. Omit for the account default." }),
     ),
+    image_model: Type.Optional(
+      Type.String({
+        description:
+          "Image model id used to TURN the picture to face each direction, e.g. " +
+          "'google/gemini-3.1-flash-image'. Omit for the account default. Only used when " +
+          "`directions` is 'four' or 'eight' — 'one' renders no turns and never touches an image " +
+          "model. Worth setting when a run fails with SPRITE_IMAGE_MODEL_UNAVAILABLE: that is the " +
+          "image provider being down, not the request being wrong, and naming another model here " +
+          "retries the whole run for nothing (the turns are drawn before any clip is billed). " +
+          "media_capabilities lists the account's current image model.",
+      }),
+    ),
   }),
   async execute(
     _toolCallId: string,
     params: {
       image: string; prompt: string; dir: string; action?: string; directions?: string;
       frames?: number; frame_size?: number; fps?: number; loop?: boolean;
-      name?: string; res_path?: string; model?: string;
+      name?: string; res_path?: string; model?: string; image_model?: string;
     },
     signal?: AbortSignal,
     _onUpdate?: unknown,
@@ -1264,6 +1279,7 @@ export const generateSpriteToolDefinition = {
             return guessed ? { res_path: guessed } : {};
           })()),
         ...(params.model ? { model: params.model } : {}),
+        ...(params.image_model ? { image_model: params.image_model } : {}),
       },
     });
     if (!submitted.ok) return text(`Sprite generation failed: ${submitted.message}`);