privateer-agent 0.12.5 → 0.12.7

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hayden Bulk Tech Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -125,6 +125,10 @@ silently. The moat is swappable; the floor under it holds.
   shots stay continuous, cut them together, then score and narrate the result. Generated media
   is handed straight back as files on your machine; none of it is stored in our cloud. See
   [docs/media-generation.md](docs/media-generation.md).
+- **Talk to it.** `/speak on` reads answers aloud as they're written; **ctrl+x** is push-to-talk
+  and the mic closes when you stop talking. Your OS voice by default — nothing leaves the
+  machine — or your account's confidential-compute TTS/STT once you sign in. `/talk loop on`
+  makes it hands-free. See [Talk to it](#talk-to-it--voice-both-directions).
 - **MCP servers, sub-agents & skills.** Connect Model Context Protocol servers (local stdio
   or remote HTTP with OAuth) with [`/connect`](#connectors--mcp), delegate work to bounded
   parallel sub-agents, and drop in skills — all gated like everything else.
@@ -288,6 +292,42 @@ with `/signout`; manage linked terminals from the app.
 > to spend on your account. If someone sends you a code and asks you to approve it, don't —
 > that hands *them* a billed session on *your* account.
 
+## Talk to it — voice, both directions
+
+`/speak on` and answers are read aloud **as they are written**, sentence by sentence, with
+code blocks, tables and URLs stripped. Press **ctrl+x** and talk; the mic closes when you
+stop talking and the transcript lands in the composer for you to read before Enter sends it.
+
+```
+/speak on             read answers aloud    ctrl+x    push to talk (press again to send)
+/speak voice <name>   pick a speaker        /talk     the same thing, typed
+/speak rate <n>       0.5–3× pace           /talk loop on   conversation mode, hands-free
+/speak stream off     wait for the full answer instead of speaking as it arrives
+/speak provider       list engines (→ marks the active one); /talk provider does the same
+```
+
+Out of the box it uses your **OS voice** (`say`, `espeak-ng`, System.Speech) and nothing
+leaves the machine. Signed in, both directions quietly upgrade to your account's
+**confidential-compute TTS and STT** — attested-enclave models, the same ones the app's voice
+features use, inherited entitlement and billing. That is an upgrade, not a stomp: a provider
+you picked deliberately stays picked, and `/speak provider local` pins the offline voice for
+good. Be clear-eyed about the difference — the local voice never speaks to the network, while
+the account voice sends the utterance text to an enclave we can't read into but that is still
+off your machine.
+
+One caveat while the account endpoints catch up: `/speak rate` and `/talk vocab` are honored
+by the local and OpenAI-compatible engines, not yet by the account's TTS/STT.
+
+Voice is **off by default and interactive-only** — harbor, ACP and channel sessions never
+speak. The mic opens only on something you did (`/talk`, the push-to-talk key, or a
+conversation turn you switched on); there is no wake word, capture is hard-capped, audio is
+held in memory and never written to disk, and a mis-heard transcript is still just a prompt —
+every tool call it leads to hits the same permission gate as anything you type. Recording
+needs a capture tool on PATH: `sox` anywhere, or `arecord`/`parecord`/`ffmpeg` on Linux,
+`ffmpeg` on macOS. Everything is stored in `~/.privateer/speak.json`; the engine itself is the
+standalone [`privateer-speak`](https://www.npmjs.com/package/privateer-speak) package, usable
+in any Pi agent.
+
 ## The Privateer app
 
 The same account drives Privateer from **iOS, Android, [the web app](https://privateer.pro),
@@ -530,8 +570,9 @@ posts a warning to the transcript, and while it's on the footer carries a perman
 Toggling takes effect from the next gated action — an approval already on screen still
 needs an answer. It's a physical-terminal switch: a phone driving this terminal over
 `/remote-access` can't reach it. The app has its own no-quarter toggle for driven turns,
-which is `bypass` exactly — never less — so dangerous shell and destructive actions
-still surface an Allow there, precisely as they do under `/mode bypass` locally.
+and it means the same thing this flag does: the moat down, dangerous shell and destructive
+actions included — stronger than `/mode bypass`, which keeps those two above it. A hard
+plan-mode deny is the one thing it doesn't talk around.
 
 > shift+tab is Pi's default "cycle thinking level" chord; Privateer takes it for this.
 > Thinking level is still under `/settings`, or bind `app.thinking.cycle` to another key
@@ -569,6 +610,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 | `/signin` · `/signout` | sign in to a Privateer account (device flow) / sign out |
 | `/remote-access` | link this terminal to the app and allow it to drive (off by default) |
 | `/connect` · `/mcp` | add, enable, or remove MCP connectors / see what actually connected |
+| `/speak` · `/talk` | read answers aloud / voice input (**ctrl+x** is push-to-talk) |
 | `/extensions` | list loaded Pi extensions |
 | `/init` | scaffold a starter `PRIVATEER.md` in this directory |
 | `/update` · `/privateer` | update to the latest release / Privateer status and posture |

package/bin/privateer-acp.mjs

@@ -18,7 +18,7 @@
 // process.loadEnvFile and tsx's register() are both silent; keep it that way, and
 // send any diagnostic you add to stderr.
 import { register } from "tsx/esm/api";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -36,5 +36,5 @@ try {
 process.env.PI_SUBAGENT_PI_BINARY ??= resolve(repo, "bin/privateer-subagent.mjs");
 
 register();
-const { runAcp } = await import(resolve(repo, "src/acp/run.ts"));
+const { runAcp } = await import(pathToFileURL(resolve(repo, "src/acp/run.ts")).href);
 await runAcp();

package/bin/privateer-harbor.mjs

@@ -7,7 +7,7 @@
 // Invoked two ways: interactively via the bash launcher (`privateer harbor …`), and
 // by the installed launchd/systemd service (`node privateer-harbor.mjs run`).
 import { register } from "tsx/esm/api";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -26,5 +26,5 @@ try {
 process.env.PI_SUBAGENT_PI_BINARY ??= resolve(repo, "bin/privateer-subagent.mjs");
 
 register();
-const { runHarborCli } = await import(resolve(repo, "src/cli/harborCli.ts"));
+const { runHarborCli } = await import(pathToFileURL(resolve(repo, "src/cli/harborCli.ts")).href);
 await runHarborCli(process.argv.slice(2));

package/bin/privateer-launch.mjs

@@ -341,11 +341,11 @@ else {
   const signedIn = fs.existsSync(CRED);
   // Mirrors TINFOIL_MODEL_ID in src/providers/defaultModel.ts — keep them in step; that
   // file carries the measurements behind the choice.
-  const ACCOUNT_MODEL = "privateer/tinfoil/kimi-k2-6";
+  const ACCOUNT_MODEL = "privateer/tinfoil/gpt-oss-120b";
   const MODEL = process.env.PRIVATEER_MODEL
     ? process.env.PRIVATEER_MODEL
     : haveTinfoilKey()
-      ? "tinfoil/kimi-k2-6"
+      ? "tinfoil/gpt-oss-120b"
       : signedIn
         ? ACCOUNT_MODEL
         : haveKey("ANTHROPIC_API_KEY")

package/bin/privateer.mjs

@@ -4,7 +4,7 @@
 // code and dev keys from the repo. Prefer the `bin/pv` wrapper, which also picks a
 // Node >= 22 (the Pi stack's floor).
 import { register } from "tsx/esm/api";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -19,4 +19,11 @@ try {
 }
 
 register(); // resolves the repo's tsx regardless of the invocation cwd
-await import(resolve(repo, "src/cli/chat.ts"));
+// pathToFileURL, NOT the bare path: on Windows an absolute path starts with a
+// drive letter, and dynamic import() reads "D:\..." as the URL scheme "d:" —
+// ERR_UNSUPPORTED_ESM_URL_SCHEME, before a single line of ours runs. POSIX
+// absolute paths happen to work, which is exactly why this survived so long:
+// every launcher here had it, and `--version` is intercepted upstream in
+// privateer-launch.mjs, so the Windows smoke test booted fine while the actual
+// command was dead. Pinned by tests/launcherImports.test.ts.
+await import(pathToFileURL(resolve(repo, "src/cli/chat.ts")).href);

package/extensions/privateer-brand.ts

@@ -107,10 +107,80 @@ function buildMark(p: Palette): string[] {
   return rows;
 }
 
-// Visible width = characters after stripping SGR escapes. Everything we render inside
-// the box is ASCII or a BMP width-1 symbol, so a plain length is exact here.
+// Code points that terminals render two cells wide. Two groups matter to us: the CJK /
+// fullwidth ranges, and the symbols Unicode gives *emoji presentation by default* — the
+// second group is the trap, because they look like ordinary BMP dingbats. ⚓ (U+2693) is
+// one, and counting it as one cell pushed the banner's right border a column past the
+// frame on the PRIVATEER.md row. The list is the complete BMP Emoji_Presentation set plus
+// the astral emoji planes, so swapping in another glyph can't quietly reintroduce that.
+const WIDE_RANGES: Array<[number, number]> = [
+  [0x1100, 0x115f], [0x231a, 0x231b], [0x2329, 0x232a], [0x23e9, 0x23ec], [0x23f0, 0x23f0],
+  [0x23f3, 0x23f3], [0x25fd, 0x25fe], [0x2614, 0x2615], [0x2648, 0x2653], [0x267f, 0x267f],
+  [0x2693, 0x2693], [0x26a1, 0x26a1], [0x26aa, 0x26ab], [0x26bd, 0x26be], [0x26c4, 0x26c5],
+  [0x26ce, 0x26ce], [0x26d4, 0x26d4], [0x26ea, 0x26ea], [0x26f2, 0x26f3], [0x26f5, 0x26f5],
+  [0x26fa, 0x26fa], [0x26fd, 0x26fd], [0x2705, 0x2705], [0x270a, 0x270b], [0x2728, 0x2728],
+  [0x274c, 0x274c], [0x274e, 0x274e], [0x2753, 0x2755], [0x2757, 0x2757], [0x2795, 0x2797],
+  [0x27b0, 0x27b0], [0x27bf, 0x27bf], [0x2b1b, 0x2b1c], [0x2b50, 0x2b50], [0x2b55, 0x2b55],
+  [0x2e80, 0x303e], [0x3041, 0x33ff], [0x3400, 0x4dbf], [0x4e00, 0xa4cf], [0xa960, 0xa97f],
+  [0xac00, 0xd7a3], [0xf900, 0xfaff], [0xfe10, 0xfe19], [0xfe30, 0xfe6f], [0xff00, 0xff60],
+  [0xffe0, 0xffe6], [0x1f300, 0x1f64f], [0x1f680, 0x1f6ff], [0x1f900, 0x1f9ff],
+  [0x1fa70, 0x1faff],
+];
+
+function isWide(cp: number): boolean {
+  return WIDE_RANGES.some(([lo, hi]) => cp >= lo && cp <= hi);
+}
+
+// Visible width in terminal cells: SGR escapes are free, combining marks are free, and
+// wide glyphs cost two. A variation selector re-negotiates the *previous* glyph's
+// presentation (FE0F → emoji/wide, FE0E → text/narrow), so it adjusts the running total
+// rather than contributing width of its own.
 function vlen(s: string): number {
-  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+  const plain = s.replace(/\x1b\[[0-9;]*m/g, "");
+  let w = 0;
+  let prevWide = false;
+  for (const ch of plain) {
+    const cp = ch.codePointAt(0)!;
+    if (cp === 0xfe0f) {
+      if (!prevWide) { w += 1; prevWide = true; }
+      continue;
+    }
+    if (cp === 0xfe0e) {
+      if (prevWide) { w -= 1; prevWide = false; }
+      continue;
+    }
+    // Combining marks and zero-width joiners/spaces stack onto the previous cell.
+    if ((cp >= 0x0300 && cp <= 0x036f) || cp === 0x200b || cp === 0x200d || cp === 0xfeff) continue;
+    prevWide = isWide(cp);
+    w += prevWide ? 2 : 1;
+  }
+  return w;
+}
+
+// Clip a colored line to `max` cells. The banner caps its inner width to the terminal, so
+// on a narrow window a long row (a deep cwd, a long update notice) would otherwise run
+// past the right border and wrap — the same broken frame, from the other direction. SGR
+// escapes are copied through free of charge and a RESET is appended so the truncation
+// can't leak a color into the border. A wide glyph straddling the boundary is dropped and
+// replaced by a space, so the count still lands exactly on `max`.
+function vclip(s: string, max: number, reset: string): string {
+  if (vlen(s) <= max) return s;
+  const parts = s.split(/(\x1b\[[0-9;]*m)/);
+  let out = "";
+  let w = 0;
+  for (const part of parts) {
+    if (part.startsWith("\x1b[")) {
+      out += part;
+      continue;
+    }
+    for (const ch of part) {
+      const cw = vlen(ch);
+      if (w + cw > max) return `${out}${w < max ? " " : ""}${reset}`;
+      out += ch;
+      w += cw;
+    }
+  }
+  return `${out}${reset}`;
 }
 
 // Strip ESC/C0/C1 control bytes from any value we did NOT author before it lands in a
@@ -256,8 +326,9 @@ function renderBanner(width: number, p: Palette, mark: string[], modelProvider?:
   const bar = "─".repeat(inner + 2);
   const out = [`${p.BORDER}╭${bar}╮${p.RESET}`];
   for (const row of rows) {
-    const pad = Math.max(0, inner - vlen(row));
-    out.push(`${p.BORDER}│${p.RESET} ${row}${" ".repeat(pad)} ${p.BORDER}│${p.RESET}`);
+    const line = vclip(row, inner, p.RESET);
+    const pad = Math.max(0, inner - vlen(line));
+    out.push(`${p.BORDER}│${p.RESET} ${line}${" ".repeat(pad)} ${p.BORDER}│${p.RESET}`);
   }
   out.push(`${p.BORDER}╰${bar}╯${p.RESET}`);
   return out;
@@ -267,7 +338,9 @@ function renderBanner(width: number, p: Palette, mark: string[], modelProvider?:
 // provider so the account line reflects the picked model, and the live theme so every
 // colour tracks the terminal background (dark ink on light, light ink on dark). The
 // palette and mark are resolved once here (per theme), not per frame.
-function headerComponent(theme: any, modelProvider?: string) {
+// Exported for tests/banner.test.ts, which renders the real banner and checks the frame
+// is square — the failure mode is a one-cell drift no typecheck can catch.
+export function headerComponent(theme: any, modelProvider?: string) {
   const p = paletteFor(theme);
   const mark = buildMark(p);
   return {

package/extensions/privateer-connect.ts

@@ -297,6 +297,20 @@ function pendingFromCatalog(e: CatalogEntry): Pending {
       hint: `Replaces the placeholder ${e.fill}`,
       initial: e.fill,
     });
+  } else if (e.needs === "url") {
+    // A server hosted by an app already running HERE. Nothing to paste, but the
+    // endpoint is the one thing that can differ per machine (Unreal's port and path
+    // are editable in Editor Preferences), and a wrong port is a connector that
+    // saves cleanly and never answers — the failure this catalog exists to avoid.
+    // Pre-filled with the documented default, so <enter> is the common case.
+    steps.push({
+      key: "url",
+      prompt: "Server URL",
+      hint: `Default is ${e.url} — change it only if you moved it.`,
+      initial: e.url,
+      validate: (v) =>
+        /^https?:\/\//i.test(v.trim()) ? undefined : "That needs to be an http:// or https:// URL.",
+    });
   }
   return {
     title: e.label,
@@ -307,12 +321,17 @@ function pendingFromCatalog(e: CatalogEntry): Pending {
       for (const [k, v] of Object.entries(answers)) {
         if (k.startsWith("env:")) env[k.slice(4)] = v;
       }
-      return draftFromCatalog(e, { env, fill: answers.fill });
+      return draftFromCatalog(e, { env, fill: answers.fill, url: answers.url });
     },
     note:
       e.needs === "oauth"
         ? `Authorize it in a browser on THIS machine: /mcp-auth ${e.name}`
-        : undefined,
+        : e.localHttp
+          // Not a warning — a localHttp connector is correct the moment it saves. But
+          // it answers only while its host app is up, so a later failure means "the
+          // app is closed", and saying that now beats debugging it then.
+          ? `Works whenever ${e.label} is running on this machine. Nothing to authorize.`
+          : undefined,
   };
 }
 
@@ -329,6 +348,7 @@ const NEEDS_LABEL: Record<string, string> = {
   token: "needs a token",
   path: "needs a path",
   oauth: "browser sign-in",
+  url: "confirm the URL",
   none: "no setup",
 };
 

package/extensions/privateer-hints.ts

@@ -22,6 +22,7 @@
 // Pi never reads that file) — read-modify-write, preserving unrelated keys.
 
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
 import { keyText } from "@earendil-works/pi-coding-agent";
 import { configPath, globalDir } from "../src/config/paths.ts";
 
@@ -38,6 +39,19 @@ function key(binding: Parameters<typeof keyText>[0], fallback: string): string {
   }
 }
 
+// Push-to-talk is pi-speak's own binding, not a Pi keybinding action, so keyText
+// can't see it — it lives in speak.json beside config.json and /talk key rebinds
+// it. Read it the same defensive way (any failure = the default).
+function talkKey(): string {
+  try {
+    const shortcut = JSON.parse(readFileSync(join(globalDir(), "speak.json"), "utf8"))?.input?.shortcut;
+    // An explicit "" is "unbound", not "missing" — only an absent field defaults.
+    return typeof shortcut === "string" ? shortcut : "ctrl+x";
+  } catch {
+    return "ctrl+x";
+  }
+}
+
 // Lazy thunks, not strings: keys resolve at display time, after the app has
 // loaded (and possibly remapped) its keybindings.
 const HINTS: Array<() => string> = [
@@ -50,6 +64,12 @@ const HINTS: Array<() => string> = [
   () => `/init writes a PRIVATEER.md so the agent knows this project`,
   () => `/connect adds MCP connectors to this terminal`,
   () => `${key("app.editor.external", "ctrl+g")} drafts long prompts in your $EDITOR`,
+  () => {
+    const k = talkKey();
+    return k
+      ? `${k} is push-to-talk — /speak on reads the answer back`
+      : `/talk types what you say — /speak on reads the answer back`;
+  },
   () => `these tips are /hints — /hints off silences them`,
 ];
 

package/extensions/privateer-spawn-skills.ts

@@ -0,0 +1,39 @@
+// Per-spawn skills — the skills a folder carries, without touching the folder.
+//
+// Pi discovers project skills at `<cwd>/.privateer/skills` (and `<cwd>/.pi/skills`),
+// resolved lexically from cwd with no override — see projectConfigDirCandidates. That
+// is the right home for skills a TEAM shares through the repo, and the wrong one for
+// "the skills I use in this folder on this machine": giving a folder its own skills
+// would mean writing into the user's tree, where it lands in their next `git status`.
+//
+// So per-spawn skills live under the global dir with that folder's other defaults
+// (src/config/spawns.ts), and this extension hands the directory to Pi through the
+// `resources_discover` hook — the supported way to contribute skill paths. Nothing is
+// patched, and the skills are loaded by the session itself, so the model can actually
+// invoke them rather than merely having them listed in the app's Skills manager.
+//
+// Note this contributes PATHS, not skills: Pi still owns discovery, precedence and
+// the disable-model-invocation flag inside them.
+
+import { existsSync } from "node:fs";
+import { spawnSkillsDir } from "../src/config/spawns.ts";
+
+export default function privateerSpawnSkills(pi: any): void {
+  pi.on("resources_discover", (event: any) => {
+    // `cwd` comes from the event rather than a captured value: the desktop rebuilds
+    // its session on a folder switch, and a stale closure would keep feeding the old
+    // folder's skills to the new one.
+    const cwd = event?.cwd ?? process.cwd();
+    let dir: string;
+    try {
+      dir = spawnSkillsDir(cwd);
+    } catch {
+      return; // no global dir (PRIVATEER_HOME unset in a stripped environment)
+    }
+    // Only offer a directory that exists. Pi tolerates a missing path, but an empty
+    // contribution is also how `emitResourcesDiscover` decides there is nothing to
+    // reload — so staying silent keeps a spawn with no skills of its own free.
+    if (!existsSync(dir)) return;
+    return { skillPaths: [dir] };
+  });
+}

package/extensions/privateer-speak.ts

@@ -5,6 +5,21 @@
 // confidential STT (/api/audio/transcribe, same tinfoil/near routing the app's voice
 // features use). Both inherit the account's entitlement, caps and billing.
 //
+// STREAMING, AND WHAT IT COSTS. Since pi-speak 0.2.0 a turn is spoken while it is still
+// being written: the stream is cut at sentence boundaries and each piece is synthesized
+// a clip or two ahead of playback. For this provider that means SEVERAL /api/audio/speech
+// calls per answer instead of one — same characters, same billing basis, more round
+// trips — which is the trade that makes the reply start in about the time one sentence
+// takes to speak. /speak stream off puts it back to one call at the end of the turn.
+//
+// NOT WIRED, DELIBERATELY. pi-speak passes two hints this account path has nowhere to
+// put: `rate` (0.5–3× pace) and the transcriber's vocabulary `prompt`. /api/audio/speech
+// takes { text, voice, format, ttsModelId } and /api/audio/transcribe takes
+// { audioBase64, format, language, sttModelId } — neither has a speed or bias field — so
+// sending them would be dead weight on the wire (and, for the vocabulary hint, project
+// nouns leaving the machine to be ignored). They stay unsent until the endpoints grow
+// them; both work today on the local and openai-compatible providers.
+//
 // PROVIDER ATTUNEMENT, NOT STOMPING. The provider registers with preferWhen: signed-in,
 // which the registry ranks ABOVE the built-in local voice but BELOW a deliberate /speak
 // provider pick — sign in and speech quietly upgrades from the OS voice to confidential

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.5",
+  "version": "0.12.7",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -84,7 +84,7 @@
     "pi-privacy": "^0.11.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
-    "privateer-speak": "0.1.0",
+    "privateer-speak": "0.2.0",
     "privateer-workflow": "^0.1.0",
     "tinfoil": "^1.1.11",
     "tsx": "^4.16.0",

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -1055,3 +1055,71 @@ index f81b4b4..9712a37 100644
    -a, --approve     Trust project-local files for this command
    -na, --no-approve Ignore project-local files for this command
  
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
+index 68d0308..f7208f1 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
+@@ -1,5 +1,5 @@
+ import { isAbsolute, relative, resolve, sep } from "node:path";
+-import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
++import { truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+ import { areExperimentalFeaturesEnabled } from "../../../core/experimental.js";
+ import { theme } from "../theme/theme.js";
+ /**
+@@ -13,6 +13,43 @@ function sanitizeStatusText(text) {
+         .replace(/ +/g, " ")
+         .trim();
+ }
++/**
++ * Lay extension statuses out over as many lines as the terminal needs, keeping
++ * each status whole. Upstream joined them into ONE line and truncated it to the
++ * width, which silently hid whatever didn't fit — and what didn't fit was often
++ * the loudest indicator on screen (Privateer's "permission gate OFF" flag). A
++ * status too wide to fit on a line of its own is wrapped, never clipped.
++ */
++function packStatusLines(statuses, width) {
++    if (width <= 0)
++        return [];
++    const lines = [];
++    let current = "";
++    let currentWidth = 0;
++    const flush = () => {
++        if (current)
++            lines.push(current);
++        current = "";
++        currentWidth = 0;
++    };
++    for (const status of statuses) {
++        if (!status)
++            continue;
++        const statusWidth = visibleWidth(status);
++        if (statusWidth > width) {
++            flush();
++            lines.push(...wrapTextWithAnsi(status, width));
++            continue;
++        }
++        const separator = current ? 1 : 0;
++        if (currentWidth + separator + statusWidth > width)
++            flush();
++        current = current ? `${current} ${status}` : status;
++        currentWidth += separator + statusWidth;
++    }
++    flush();
++    return lines;
++}
+ /**
+  * Format token counts for compact footer display.
+  */
+@@ -211,9 +248,9 @@ export class FooterComponent {
+             const sortedStatuses = Array.from(extensionStatuses.entries())
+                 .sort(([a], [b]) => a.localeCompare(b))
+                 .map(([, text]) => sanitizeStatusText(text));
+-            const statusLine = sortedStatuses.join(" ");
+-            // Truncate to terminal width with dim ellipsis for consistency with footer style
+-            lines.push(truncateToWidth(statusLine, width, theme.fg("dim", "...")));
++            // Wrap onto extra lines instead of truncating: a status is there because
++            // something wants to be seen, so none of them may be cut off.
++            lines.push(...packStatusLines(sortedStatuses, width));
+         }
+         return lines;
+     }

package/src/acp/run.ts

@@ -125,7 +125,7 @@ export async function runAcp(): Promise<void> {
     cwd: baseCwd,
     confineToCwd: true,
     getRemote: () => true,
-    getNoQuarter: () => posture === "auto",
+    getAutoApprove: () => posture === "auto",
     async localAsk() {
       return "deny";
     },

package/src/channels/run.ts

@@ -191,7 +191,7 @@ async function main() {
     cwd,
     confineToCwd: true,
     getRemote: () => true,
-    getNoQuarter: () => posture() === "auto",
+    getAutoApprove: () => posture() === "auto",
     async localAsk() {
       return "deny";
     },

package/src/cli/chat.ts

@@ -47,6 +47,7 @@ async function main() {
     dropPersistedAccountCredential,
   } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
+  const { pickerCatalog, hiddenAccountNotice, hiddenAccountTitleSuffix } = await import("../providers/modelCatalog.ts");
   const { resolveDefaultModel, resolveSignedInModel, savedPiDefaultSpec } = await import("../providers/defaultModel.ts");
   const { postOutbox } = await import("../outbox/cloudOutbox.ts");
   const { addPendingCloud } = await import("../routines/store.ts");
@@ -625,11 +626,14 @@ async function main() {
   console.log(`${DIM}shift+tab toggles no quarter — unattended mode, no approval prompts.${RESET}`);
   await showPosture();
 
-  // The available model catalog as sorted "provider/id" specs. Same source the
-  // /models list and the app's picker draw from.
-  async function availableModelSpecs(): Promise<string[]> {
-    const all: any[] = (services.modelRegistry as any).getAvailable ? await (services.modelRegistry as any).getAvailable() : [];
-    return all.map((m) => `${m.provider}/${m.id}`).sort();
+  // The available model catalog as sorted "provider/id" specs, plus what the
+  // registry had to leave out. Same source the /models list and the app's picker
+  // draw from — see providers/modelCatalog.ts for the two things that make this
+  // more than a map+sort (sealed models register late; the whole account catalog
+  // is filtered out until the credential is armed).
+  const SIGN_IN_HINT = "Run /login.";
+  async function modelCatalog() {
+    return pickerCatalog(services.modelRegistry as any);
   }
 
   // Switch the live session's model in place (history preserved — see
@@ -660,9 +664,17 @@ async function main() {
   // as a selection prompt and switch to whatever the driver picks. This is the
   // remote /model flow — the terminal owns the options, the app just renders them.
   async function pickModelRemote(filter: string): Promise<void> {
-    const specs = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+    const cat = await modelCatalog();
+    const specs = cat.specs.filter((sp) => !filter || sp.toLowerCase().includes(filter));
+    // Say why the list is short BEFORE opening it — a driver looking at a catalog
+    // with no confidential models has no way to tell "we don't carry them" from
+    // "this terminal is signed out", and only one of those has a fix.
+    const notice = hiddenAccountNotice(cat, SIGN_IN_HINT);
+    if (notice) relay?.sendNotice(notice);
     const choice = await bridge.selectRemote({
-      title: "Choose a model",
+      // The suffix puts the same fact in the sheet itself, where the driver is
+      // actually looking. Terminal chrome, so English like the rest of the title.
+      title: `Choose a model${hiddenAccountTitleSuffix(cat)}`,
       options: specs.map((sp) => ({ value: sp, label: sp })),
       current: currentSpec,
     });
@@ -689,8 +701,11 @@ async function main() {
     if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
       const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
       if (remote) { await pickModelRemote(filter); return true; }
-      const rows = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+      const cat = await modelCatalog();
+      const rows = cat.specs.filter((sp) => !filter || sp.toLowerCase().includes(filter));
       console.log(rows.slice(0, 40).join("\n") + (rows.length > 40 ? `\n${DIM}… ${rows.length - 40} more (try /models <filter>)${RESET}` : ""));
+      const hidden = hiddenAccountNotice(cat, SIGN_IN_HINT);
+      if (hidden) console.log(`${DIM}${hidden}${RESET}`);
       return true;
     }
     // Extensions: remote drives the app's manager (list frame); local prints the list.