privateer-agent 0.12.5 → 0.12.7

package/src/config/spawns.ts

@@ -0,0 +1,187 @@
+// Spawn records — the per-folder defaults an agent starts with on this machine.
+//
+// A "spawn" is one agent pointed at one folder: the desktop's window sessions are
+// the visible case, but the record is deliberately machine-level rather than
+// desktop-level, because ~/.privateer is shared with the CLI and a `privateer` run
+// in the same folder should be able to honour the same defaults later.
+//
+// WHY NOT THE PROJECT FOLDER. Pi already has a project scope — `.privateer/` and
+// `.pi/` under cwd (see PROJECT_CONFIG_DIR_NAMES) — and this is NOT that. Project
+// config lives in the tree, travels with a clone, and lands in the user's commits.
+// These records are the opposite by choice: which model YOU run in a folder on THIS
+// computer is a local preference, not a property of the project, and writing it into
+// someone's repo would be a surprise the first time they `git status`. So they live
+// under the global dir, keyed by the folder's real path, and the folder itself is
+// left untouched. (PRIVATEER.md is the deliberate exception — that one IS about the
+// project and belongs in the tree.)
+//
+// Keying is by REAL path: a symlinked checkout (/var → /private/var on macOS) must
+// not read as a second folder, or a spawn would silently lose its defaults depending
+// on which route the user opened it by.
+
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { globalDir } from "./paths.ts";
+
+export interface SpawnRecord {
+  /** The folder, as resolved when the record was written. */
+  path: string;
+  /** Preferred model as "provider/id", or null to take the account default. */
+  model: string | null;
+  /** MCP connector names this folder's agent starts with. */
+  connectors: string[];
+  /** Epoch ms. */
+  createdAt: number;
+  /** Epoch ms of the last spawn opened on this folder, or null if never. */
+  lastOpenedAt: number | null;
+}
+
+/** All spawn records: <globalDir>/spawns/<key>/spawn.json (+ a per-spawn skills/ dir). */
+export function spawnsDir(): string {
+  return join(globalDir(), "spawns");
+}
+
+// The identity of a folder for record purposes. realpathSync resolves symlinks so
+// two routes to one checkout share a record; a path that doesn't exist yet (a folder
+// the user is about to create) falls back to the lexical resolution rather than
+// throwing. Case-folded on Windows, where the same folder is reachable as C:\Foo and
+// c:\foo and neither spelling is more correct than the other.
+function identity(path: string): string {
+  let real: string;
+  try {
+    real = realpathSync(resolve(path));
+  } catch {
+    real = resolve(path);
+  }
+  return process.platform === "win32" ? real.toLowerCase() : real;
+}
+
+/** Stable per-folder key. 64 bits of sha256 — collisions are checked, not assumed. */
+export function spawnKey(path: string): string {
+  return createHash("sha256").update(identity(path)).digest("hex").slice(0, 16);
+}
+
+/** This spawn's own directory (records + per-folder skills). */
+export function spawnDir(path: string): string {
+  return join(spawnsDir(), spawnKey(path));
+}
+
+/**
+ * Per-spawn skills, injected into the session as an extra skill path so a folder can
+ * carry its own without a `.privateer/skills` appearing in the user's tree.
+ */
+export function spawnSkillsDir(path: string): string {
+  return join(spawnDir(path), "skills");
+}
+
+function recordPath(path: string): string {
+  return join(spawnDir(path), "spawn.json");
+}
+
+// Tolerant on read: these files sit in a directory users are invited to inspect, and
+// a hand-edited or half-written one must degrade to "no record" rather than take the
+// app down on launch. Unknown keys are dropped, not preserved — the shape is ours.
+function parse(raw: string): SpawnRecord | null {
+  let obj: any;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!obj || typeof obj !== "object" || typeof obj.path !== "string" || !obj.path) return null;
+  return {
+    path: obj.path,
+    model: typeof obj.model === "string" && obj.model.includes("/") ? obj.model : null,
+    connectors: Array.isArray(obj.connectors) ? obj.connectors.filter((c: unknown) => typeof c === "string") : [],
+    createdAt: Number.isFinite(obj.createdAt) ? obj.createdAt : 0,
+    lastOpenedAt: Number.isFinite(obj.lastOpenedAt) ? obj.lastOpenedAt : null,
+  };
+}
+
+/**
+ * The record for `path`, or null if there is none.
+ *
+ * A record whose stored path disagrees with the folder we asked about is treated as a
+ * miss: that is the 64-bit collision case, and answering with another folder's model
+ * and connectors would be worse than answering with nothing.
+ */
+export function readSpawn(path: string): SpawnRecord | null {
+  const file = recordPath(path);
+  if (!existsSync(file)) return null;
+  let rec: SpawnRecord | null;
+  try {
+    rec = parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!rec) return null;
+  return identity(rec.path) === identity(path) ? rec : null;
+}
+
+/**
+ * Create or update the record for `path` and return the result. Absent fields keep
+ * their stored value, so a caller that only knows the model doesn't have to read
+ * first and risk clobbering connectors written by another window.
+ */
+export function writeSpawn(path: string, patch: Partial<Omit<SpawnRecord, "path" | "createdAt">>, now = Date.now()): SpawnRecord {
+  const existing = readSpawn(path);
+  const next: SpawnRecord = {
+    path: resolve(path),
+    model: patch.model !== undefined ? patch.model : existing?.model ?? null,
+    connectors: patch.connectors !== undefined ? patch.connectors : existing?.connectors ?? [],
+    createdAt: existing?.createdAt || now,
+    lastOpenedAt: patch.lastOpenedAt !== undefined ? patch.lastOpenedAt : existing?.lastOpenedAt ?? null,
+  };
+  const dir = spawnDir(path);
+  mkdirSync(dir, { recursive: true });
+  // 0600 like the rest of the global dir: a record names a folder on this machine
+  // and the connectors it runs, which is nobody else's business on a shared box.
+  writeFileSync(recordPath(path), JSON.stringify(next, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  return next;
+}
+
+/** Stamp a spawn as opened now — the roster's "most recent first" ordering. */
+export function touchSpawn(path: string, now = Date.now()): SpawnRecord {
+  return writeSpawn(path, { lastOpenedAt: now }, now);
+}
+
+/**
+ * Every record, most recently opened first (never-opened ones last, then by path so
+ * the order is stable). Unreadable entries are skipped rather than surfaced as blanks.
+ */
+export function listSpawns(): SpawnRecord[] {
+  const dir = spawnsDir();
+  if (!existsSync(dir)) return [];
+  let keys: string[];
+  try {
+    keys = readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+  const out: SpawnRecord[] = [];
+  for (const key of keys) {
+    try {
+      const rec = parse(readFileSync(join(dir, key, "spawn.json"), "utf8"));
+      if (rec) out.push(rec);
+    } catch {
+      // No record file, or an unreadable one — not a spawn we can offer.
+    }
+  }
+  return out.sort((a, b) => (b.lastOpenedAt ?? 0) - (a.lastOpenedAt ?? 0) || a.path.localeCompare(b.path));
+}
+
+/** Drop a folder's record (and its per-spawn skills). True if there was one. */
+export function forgetSpawn(path: string): boolean {
+  const dir = spawnDir(path);
+  if (!existsSync(dir)) return false;
+  // Only remove a directory that actually holds THIS folder's record, so a collision
+  // (or a stale key) can't delete another spawn's skills.
+  if (!readSpawn(path)) return false;
+  try {
+    rmSync(dir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/ext/permissionGate.ts

@@ -43,7 +43,12 @@ export interface GateController {
   cwd: string;
   confineToCwd?: boolean;
   getRemote?(): boolean;
+  // The controller raised the flag: total bypass for remote turns — see
+  // ModeGate.getNoQuarter.
   getNoQuarter?(): boolean;
+  // The weaker "auto" posture used by the non-interactive runtimes (ACP, channels):
+  // bypass-equivalent, dangerous/destructive still relayed. See ModeGate.getAutoApprove.
+  getAutoApprove?(): boolean;
   // Total bypass — see ModeGate.getSkipAllPermissions. Set by the `--no-quarter`
   // launch flag (env PRIVATEER_NO_QUARTER); when true the gate auto-allows every
   // action with no prompt.
@@ -129,13 +134,15 @@ export async function decideToolCall(
     setMode: ctrl.setMode,
     allowlist: ctrl.allowlist,
     allowedOutsideRoots: ctrl.allowedOutsideRoots,
-    // Default to the built-in dangerous-command patterns so bypass / no-quarter /
+    // Default to the built-in dangerous-command patterns so bypass / "auto"-posture /
     // headless-subagent runs still force dangerous shell + secret-exfil to "ask"
     // (→ headless deny). A controller can extend, but never silently disable, this.
+    // The two no-quarter switches sit above the denylist by design and clear it.
     denylist: ctrl.denylist ?? DEFAULT_DENYLIST,
     ask,
     getRemote: ctrl.getRemote,
     getNoQuarter: ctrl.getNoQuarter,
+    getAutoApprove: ctrl.getAutoApprove,
     getSkipAllPermissions: ctrl.getSkipAllPermissions,
   });
 

package/src/harbor/ipc.ts

@@ -1,5 +1,6 @@
 import { createServer, createConnection, type Socket, type Server } from "node:net";
 import { existsSync, unlinkSync, chmodSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { globalDir } from "../config/paths.ts";
 import type { Routine } from "../routines/schema.ts";
@@ -8,7 +9,26 @@ import type { Routine } from "../routines/schema.ts";
 // is one JSON request per connection, answered with one JSON response, both
 // newline-terminated. Kept tiny and local — nothing crosses the machine boundary.
 
+const isWindows = process.platform === "win32";
+
+/**
+ * Where the harbor listens.
+ *
+ * POSIX: a unix socket inside PRIVATEER_HOME, so it inherits that directory's
+ * ownership and lives beside the log it writes.
+ *
+ * Windows has no unix sockets: `listen()` there accepts ONLY a name under
+ * \\.\pipe\, and handing it a file path fails — which is why `privateer harbor`
+ * could never start on Windows at all. The pipe name is derived from
+ * globalDir() so a non-default PRIVATEER_HOME still gets its own harbor (the
+ * pipe namespace is machine-global and has no directories to separate them),
+ * and hashed because that namespace takes no backslashes.
+ */
 export function harborSocketPath(): string {
+  if (isWindows) {
+    const id = createHash("sha256").update(globalDir().toLowerCase()).digest("hex").slice(0, 16);
+    return `\\\\.\\pipe\\privateer-harbor-${id}`;
+  }
   return join(globalDir(), "harbor.sock");
 }
 
@@ -115,6 +135,9 @@ export function startIpcServer(handler: IpcHandler): Promise<Server> {
       const server = build();
       server.once("error", (err: NodeJS.ErrnoException) => {
         if (err.code !== "EADDRINUSE") { reject(err); return; }
+        // Windows has nothing to reclaim: a named pipe exists only while a
+        // process holds it, so EADDRINUSE there always means a live harbor.
+        if (isWindows) { reject(new HarborAlreadyRunningError()); return; }
         void probeExistingListener(path).then((live) => {
           if (live) { reject(new HarborAlreadyRunningError()); return; }
           if (reclaimed) { reject(err); return; } // already reclaimed once — give up
@@ -140,7 +163,10 @@ export function startIpcServer(handler: IpcHandler): Promise<Server> {
 export function sendToHarbor(req: IpcRequest, timeoutMs = 5_000): Promise<IpcResponse> {
   const path = harborSocketPath();
   return new Promise<IpcResponse>((resolve, reject) => {
-    if (!existsSync(path)) {
+    // The fast "nothing is there" path. Skipped on Windows: a named pipe isn't a
+    // filesystem entry, so existsSync() is false even for a live harbor and this
+    // check would report every one of them as not running.
+    if (!isWindows && !existsSync(path)) {
       reject(new HarborNotRunningError());
       return;
     }

package/src/mcp/catalog.ts

@@ -8,6 +8,7 @@
  *   token — one prompt per env key (masked); `credUrl` is shown as "get one at …"
  *   path  — one prompt replacing the `fill` placeholder ARG (a folder, a DSN)
  *   oauth — nothing to type here; you authorize in a browser on THIS machine
+ *   url   — one prompt to confirm the endpoint of a server already running HERE
  *   none  — runs locally with no credentials, save it as-is
  *
  * Keep this list conservative and correct: a broken command in the catalog is worse
@@ -16,7 +17,7 @@
  */
 import type { McpDraft, McpTransport } from "../remote/mcpControl.ts";
 
-export type CatalogNeeds = "token" | "path" | "oauth" | "none";
+export type CatalogNeeds = "token" | "path" | "oauth" | "url" | "none";
 
 export interface CatalogEntry {
   // Stable key for the picker; also the default server name written to config.
@@ -36,6 +37,25 @@ export interface CatalogEntry {
   fill?: string;
   // Where to get the credential, shown as a hint in the form.
   credUrl?: string;
+  /**
+   * An HTTP server running on THIS MACHINE that needs no credential at all.
+   *
+   * A third shape alongside `oauth` and a stored bearer token, and it needs its own
+   * flag rather than falling out of the URL: every other http entry here is a remote
+   * service the user authorizes, so "must authenticate" is derived from
+   * `transport === "http"` alone. That is false here — there is nothing to authorize
+   * — so the flag is what makes draftFromCatalog emit `auth: "none"`. Without it the
+   * adapter goes hunting for an authorization server that does not exist.
+   *
+   * Always pair with `hosted: false`: a hosted enclave has no route to the user's
+   * loopback, and hostedCapable()'s derived rule keys on `oauth`, not on this.
+   */
+  localHttp?: boolean;
+  /**
+   * Where to learn how to TURN THE SERVER ON — deliberately not `credUrl`, which
+   * means "get a credential here" and would be a lie for an entry that has none.
+   */
+  docsUrl?: string;
   // Can this connector run on a HOSTED (Harbor) agent? Leave unset to take the derived
   // answer from hostedCapable() below; set it explicitly only to say "no" to something
   // that would otherwise qualify.
@@ -110,7 +130,10 @@ export const MCP_CATALOG: CatalogEntry[] = [
     label: "Linear",
     blurb: "Issues and projects. Sign in via browser.",
     transport: "http",
-    url: "https://mcp.linear.app/sse",
+    // /sse is GONE — it 404s on both GET and POST (checked 2026-07-31). Linear moved
+    // to the Streamable HTTP endpoint; the old URL silently failed for anyone who
+    // added Linear from this picker. Mirrored from the client copy on 2026-08-06.
+    url: "https://mcp.linear.app/mcp",
     oauth: true,
     needs: "oauth",
   },
@@ -320,6 +343,38 @@ export const MCP_CATALOG: CatalogEntry[] = [
     args: ["-y", "@modelcontextprotocol/server-sequential-thinking"],
     needs: "none",
   },
+
+  // ── Local apps that host their own MCP server ───────────────────────────────
+  // http, but on 127.0.0.1: nothing to install, nothing to authorize, nothing
+  // leaving the machine. See `localHttp` on CatalogEntry for why that needs a flag.
+  {
+    // Unreal Engine 5.8 embeds an MCP server in the EDITOR PROCESS (plugin
+    // `ModelContextProtocol`, surfaced as "Unreal MCP"; the tools come from the
+    // "All Toolsets" plugin, which has to be enabled too). Three facts shape this:
+    //
+    //  1. NO AUTHENTICATION, of any kind. Hence localHttp + auth:"none".
+    //  2. LOOPBACK ONLY. It binds per [HTTPServer.Listeners] DefaultBindAddress
+    //     (default `localhost`) AND rejects non-loopback `Origin` headers — so the
+    //     agent has to be on the same machine as the editor. True for this CLI and
+    //     for the desktop app; not true for a hosted agent, hence hosted: false.
+    //  3. IT IS ONLY UP WHILE THE EDITOR IS. A connector that fails here usually
+    //     means "Unreal isn't running", not "this is misconfigured".
+    //
+    // The port and path are editable in Editor Preferences → Model Context
+    // Protocol, so `needs: "url"`: the one setup step is confirming the endpoint
+    // rather than pasting a secret. `ModelContextProtocol.GenerateClientConfig` in
+    // the UE console prints the URL the editor is actually serving.
+    id: "unreal",
+    name: "unreal",
+    label: "Unreal Engine",
+    blurb: "Drive the Unreal Editor — actors, lighting, materials, tests.",
+    transport: "http",
+    url: "http://127.0.0.1:8000/mcp",
+    localHttp: true,
+    needs: "url",
+    hosted: false,
+    docsUrl: "https://dev.epicgames.com/documentation/unreal-engine/unreal-mcp-in-unreal-editor",
+  },
 ];
 
 export function catalogEntry(id: string): CatalogEntry | undefined {
@@ -341,9 +396,11 @@ export function promptOrder(e: CatalogEntry): string[] {
 //                and mcpControl treats that as "clear this key" — so a skipped
 //                optional credential is simply absent, never a bogus empty one.
 //   input.fill — the real path/DSN replacing the placeholder ARG (needs:"path").
+//   input.url  — the endpoint the user confirmed (needs:"url"); blank keeps the
+//                catalog default, so a straight <enter> is the documented port.
 export function draftFromCatalog(
   e: CatalogEntry,
-  input: { env?: Record<string, string>; fill?: string } = {},
+  input: { env?: Record<string, string>; fill?: string; url?: string } = {},
 ): McpDraft {
   const draft: McpDraft = { name: e.name, transport: e.transport };
 
@@ -354,11 +411,13 @@ export function draftFromCatalog(
     const filled = input.fill?.trim();
     draft.args = (e.args ?? []).map((a) => (e.fill && a === e.fill && filled ? filled : a));
   } else {
-    draft.url = e.url;
-    // Every http entry in this catalog is an OAuth connector. Emit the adapter's own
-    // vocabulary (`auth`) rather than the legacy boolean, so the projection carries
-    // `auth: "oauth"` and not a bogus boolean in the adapter's OAuthConfig slot.
-    draft.auth = (e.oauth ?? true) ? "oauth" : "none";
+    draft.url = input.url?.trim() || e.url;
+    // Emit the adapter's own vocabulary (`auth`) rather than the legacy boolean, so
+    // the projection carries a string and not a bogus boolean in the adapter's
+    // OAuthConfig slot. A localHttp entry authenticates to nothing — saying "oauth"
+    // there would send the adapter looking for an authorization server that does not
+    // exist, which fails at connect time rather than at save time.
+    draft.auth = e.localHttp ? "none" : (e.oauth ?? true) ? "oauth" : "none";
   }
 
   const keys = Object.keys(e.env ?? {});

package/src/permissions/modeGate.ts

@@ -30,10 +30,23 @@ export interface ModeGateDeps {
   // Hard denies (e.g. plan mode) are still honored without bothering the phone.
   getRemote?: () => boolean;
   // True while the controller has toggled no-quarter (unattended) mode: remote
-  // turns auto-approve like bypass mode so the agent runs to completion without
-  // pinging the phone. Dangerous shell and alwaysAsk-destructive actions rank
-  // above bypass in decideAuto, so those still relay for an explicit Allow/Deny.
+  // turns auto-approve so the agent runs to completion without pinging the phone.
+  // This is the SAME total bypass as the `--no-quarter` launch flag below, only
+  // scoped to remote turns — dangerous shell, secret-exfil shapes and alwaysAsk-
+  // destructive tools included. It has to be: "no quarter" is a step-away-from-
+  // the-keyboard switch, and a mode that still stops on the one command the user
+  // walked away from isn't unattended, it's a turn that wedges until it times out
+  // (a relayed prompt with nobody to answer it fails closed). A hard "deny" — plan
+  // mode — is still honored, so a read-only stance can't be talked around remotely.
   getNoQuarter?: () => boolean;
+  // True while a non-interactive runtime is running under its "auto" posture (the
+  // ACP host's `posture: "auto"`, a channel whose role resolves to it). Weaker than
+  // no-quarter on purpose: re-decide as if in bypass mode, so ordinary writes and
+  // bash run unattended but dangerous shell / alwaysAsk-destructive actions still
+  // relay for an explicit Allow/Deny. The party choosing it there is a host config
+  // or a chat-app role, not someone who tapped through a confirm on their own
+  // terminal, so it does not get to clear the denylist.
+  getAutoApprove?: () => boolean;
   // True when the operator launched with `--no-quarter` (env PRIVATEER_NO_QUARTER):
   // a session-wide TOTAL bypass of the gate. Every request auto-approves — including
   // dangerous shell, destructive tools, out-of-cwd and protected-file access — with
@@ -66,10 +79,16 @@ export class ModeGate implements PermissionGate {
     // remembered — we don't let a remote operator mutate local allowlist/mode.
     if (this.deps.getRemote?.()) {
       if (auto === "deny") return "deny";
-      // No-quarter: re-evaluate as if in bypass mode. Dangerous/destructive
-      // actions still come back "ask" (they sit above bypass) and fall through
-      // to the relayed prompt; everything else runs unattended.
-      if (this.deps.getNoQuarter?.() && decideAuto(req, "bypass", this.deps.allowlist, denylist) === "allow") {
+      // No-quarter: the controller has lowered the moat for this session, so
+      // auto-allow everything the plan-mode deny above didn't already stop —
+      // dangerous shell and alwaysAsk-destructive tools included. Stronger than
+      // `/mode bypass` (which keeps those two above it) and deliberately so: it
+      // is the remote-scoped twin of the `--no-quarter` flag, and the app's
+      // confirm says as much before the flag goes up.
+      if (this.deps.getNoQuarter?.()) return "allow";
+      // "auto" posture: the weaker cousin — bypass-equivalent, with dangerous and
+      // alwaysAsk-destructive actions still falling through to the relayed prompt.
+      if (this.deps.getAutoApprove?.() && decideAuto(req, "bypass", this.deps.allowlist, denylist) === "allow") {
         return "allow";
       }
       return (await this.deps.ask(req)) === "deny" ? "deny" : "allow";

package/src/providers/account.ts

@@ -47,10 +47,11 @@ import {
 const DEFAULT_MODELS = [
   ACCOUNT_DEFAULT_MODEL_ID,
   ACCOUNT_NEAR_MODEL_ID,
-  // The default until 2026-08-01 (see TINFOIL_MODEL_ID). It stays in the floor so a
-  // user who saved it as their own default still resolves it synchronously at launch,
-  // rather than falling through to "first model with configured auth" — the BYO dead
-  // end this seed list exists to prevent.
+  // Both former defaults (see TINFOIL_MODEL_ID for the dates). They stay in the floor
+  // so a user who saved either as their own default still resolves it synchronously at
+  // launch, rather than falling through to "first model with configured auth" — the BYO
+  // dead end this seed list exists to prevent.
+  "tinfoil/kimi-k2-6",
   "tinfoil/glm-5-2",
   "anthropic/claude-opus-5",
   "anthropic/claude-sonnet-5",

package/src/providers/defaultModel.ts

@@ -22,22 +22,43 @@ import { agentDir } from "../config/paths.ts";
 // One definition, three consumers: this resolver, providers/account.ts's seed catalog,
 // and bin/privateer-launch.mjs (which mirrors the id — keep them in step).
 //
-// It was `tinfoil/glm-5-2` until 2026-08-01, and the swap is a LATENCY decision, not a
-// capability one. Measured over 22 requests spaced 20s apart on the account channel,
-// glm-5-2 stalled before its first token on 9 of them — 33s to 98s each, with the
-// model demonstrably warm 20 seconds earlier, so it is contention in that deployment
-// rather than a cold start anything here can warm up. kimi-k2-6 and gpt-oss-120b, same
-// enclave provider, same tier, same transport, stalled 0 times in 20 (medians 1.2s and
-// 1.0s). The same run reproduced glm-5-2's stalls on BOTH the sealed and the cleartext
-// path, which is what rules out the shim, the relay and the proxy as the cause.
+// This has moved twice. The history matters, because both moves were about the same
+// two axes — first-token latency and reasoning control — pulling in opposite directions:
 //
-// Two consequences worth knowing when revisiting this: glm-5-2 remains in the live
-// catalog and is one pick away for anyone who wants it, and kimi-k2-6 reasons on every
-// turn with no working off switch (see thinkingProfile in providers/account.ts — its
-// levers were probed and none of them moved the reasoning volume). Its reasoning is
-// short and it always reaches an answer, which is why that is acceptable here and was
-// not for glm-5-2.
-export const TINFOIL_MODEL_ID = "tinfoil/kimi-k2-6";
+//   • until 2026-08-01 — glm-5-2.
+//   • 2026-08-01 → 2026-08-06 — kimi-k2-6, a LATENCY swap, not a capability one. Over
+//     22 requests spaced 20s apart on the account channel, glm-5-2 stalled before its
+//     first token on 9 of them — 33s to 98s each, with the model demonstrably warm 20
+//     seconds earlier, so it was contention in that deployment rather than a cold start
+//     anything here can warm up. kimi-k2-6 and gpt-oss-120b, same enclave provider,
+//     same tier, same transport, stalled 0 times in 20 (medians 1.2s and 1.0s). That
+//     run reproduced the stalls on BOTH the sealed and the cleartext path, which is
+//     what ruled out the shim, the relay and the proxy as the cause.
+//   • 2026-08-06 — gpt-oss-120b, on REASONING CONTROL, having ruled out a return to
+//     glm-5-2 by re-measuring. kimi-k2-6 reasons on every turn with no working off
+//     switch: thinkingProfile (providers/account.ts) omits it deliberately because both
+//     levers were probed and neither moved the reasoning volume. On an agent that makes
+//     many small tool calls, a toggle that works is worth real latency — but not glm's
+//     latency. Re-run of the probe above (14 rounds, 20s apart, TTFT to the first token
+//     of any kind, all three models per round):
+//
+//         glm-5-2        median 4.6s  max 55.0s  stalls(>10s) 5/14
+//         kimi-k2-6      median 0.9s  max  1.1s  stalls        0/14
+//         gpt-oss-120b   median 0.4s  max  0.4s  stalls        0/14
+//
+//     glm-5-2's stalls (55.0 / 46.3 / 46.3 / 55.0 / 29.9s) interleave with 1.0s
+//     responses on the same key in the same minute while the other two never waver —
+//     the 2026-08-01 signature, unchanged. At ~36% per request a ten-tool-call task
+//     stalls with ~99% probability, so it is not defaultable however good the model is.
+//     gpt-oss-120b takes the latency crown outright AND honours reasoning_effort
+//     (verified: low → 9 reasoning deltas, high → 61), so it is the only one of the
+//     three that gives the user a working dial. It is a smaller model than GLM 5.2 and
+//     Kimi K2.6; that capability trade was made knowingly. It also serves from NEAR as
+//     well as Tinfoil — the only capable model here with two attested homes.
+//
+// Re-measure before moving this again. The stall behaviour is a property of a
+// provider's deployment, not of a model, and it has already changed under us twice.
+export const TINFOIL_MODEL_ID = "tinfoil/gpt-oss-120b";
 
 // Same model, reached two ways:
 //   - TINFOIL_DEFAULT_SPEC — direct to inference.tinfoil.sh with the user's own

package/src/providers/modelCatalog.ts

@@ -0,0 +1,115 @@
+// What the `/model` picker is allowed to offer, and why it might be short.
+//
+// Three surfaces build that list — the REPL (`cli/chat.ts`), the desktop session
+// (`desktop/src/main/agentSession.ts`) and, through the relay, the app's picker
+// sheet — and all three used the same two lines: `modelRegistry.getAvailable()`,
+// mapped to `provider/id` and sorted. Two things about that list are surprising
+// enough that they belong here rather than being rediscovered at each call site:
+//
+//  1. **Sealed-only models are registered late.** `phala/*` is registered only once
+//     the sealed loopback shim is bound (isServableAccountModel — the cleartext
+//     `/api/agent/v1` has no Phala route and rejects those ids outright), and the
+//     shim binds a beat AFTER the session's first synchronous registration. The
+//     account provider re-registers when it comes up, so the catalog heals itself
+//     within ~half a second — but a picker opened inside that window listed a
+//     catalog quietly missing the whole Phala tier. Waiting for the shim first
+//     costs milliseconds (`startShim` is a loopback `listen(0)` — no network and no
+//     attestation) and removes the race.
+//
+//  2. **The account catalog can be registered and yet entirely unavailable.** Pi's
+//     `getAvailable()` is `models.filter(hasConfiguredAuth)`, and hasConfiguredAuth
+//     is "the provider has an auth entry, or its config's apiKey resolves". The
+//     account provider has no apiKey — it authenticates with an OAuth child token —
+//     so every `privateer/*` model (the NEAR and Tinfoil confidential tiers, and the
+//     bulk of the 240-odd catalog) is filtered out until the credential is armed
+//     into Pi's auth store, which needs a machine login. On a signed-out box the
+//     picker therefore drops the entire account catalog and says nothing: it looks
+//     like we don't carry those models, rather than like you're signed out.
+//
+// So: one place computes the list, and the same place reports what it had to hide.
+
+import { hasCredentials } from "../auth/privateer.ts";
+import { ensureSealedShim, sealedEnabled, sealedShimBase } from "./sealedShim.ts";
+
+/** The routing provider for the account channel — `privateer/<catalog id>`. */
+export const ACCOUNT_PROVIDER = "privateer";
+
+/** The shape we need from Pi's model registry (kept structural — it's untyped here). */
+export interface CatalogRegistry {
+  getAll?: () => unknown[];
+  getAvailable?: () => unknown[] | Promise<unknown[]>;
+}
+
+interface RegistryModel {
+  provider?: string;
+  id?: string;
+}
+
+const specOf = (m: RegistryModel): string => `${m.provider}/${m.id}`;
+
+/**
+ * Wait for the sealed shim if it's coming, so a catalog read can't miss the
+ * sealed-only models purely because it happened early (see note 1 above).
+ *
+ * The account provider attached its own post-shim re-registration at extension
+ * init, i.e. BEFORE this one — promise callbacks run in attachment order, so by the
+ * time this resolves, `phala/*` is already in the registry. Failure is not fatal:
+ * the catalog is then honestly the one we can serve.
+ */
+export async function readySealedCatalog(): Promise<void> {
+  if (!sealedEnabled() || sealedShimBase()) return;
+  try {
+    await ensureSealedShim();
+  } catch {
+    /* no shim → no sealed models, which is exactly what the list should show */
+  }
+}
+
+export interface PickerCatalog {
+  /** Sorted `provider/id` specs the session can actually reach — what to offer. */
+  specs: string[];
+  /** Account models registered but unreachable right now (0 when all is well). */
+  hiddenAccountModels: number;
+  /** Whether this machine holds a Privateer login at all. */
+  signedIn: boolean;
+}
+
+/** The picker's list, plus what it had to leave out. */
+export async function pickerCatalog(registry: CatalogRegistry | null | undefined): Promise<PickerCatalog> {
+  await readySealedCatalog();
+  const available = ((await registry?.getAvailable?.()) ?? []) as RegistryModel[];
+  const all = (registry?.getAll?.() ?? []) as RegistryModel[];
+  const offeredAccount = available.filter((m) => m.provider === ACCOUNT_PROVIDER).length;
+  const registeredAccount = all.filter((m) => m.provider === ACCOUNT_PROVIDER).length;
+  return {
+    specs: available.map(specOf).sort(),
+    hiddenAccountModels: Math.max(0, registeredAccount - offeredAccount),
+    signedIn: hasCredentials(),
+  };
+}
+
+/**
+ * One line explaining an account catalog we registered but can't offer, or null
+ * when there's nothing to explain.
+ *
+ * `signInHint` is the caller's own instruction for getting signed in — the REPL
+ * says `/login`, the desktop points at its Account menu — because "sign in" without
+ * saying where is the half of this message that was already implicit.
+ */
+export function hiddenAccountNotice(cat: PickerCatalog, signInHint: string): string | null {
+  if (cat.hiddenAccountModels === 0) return null;
+  const n = cat.hiddenAccountModels;
+  const models = `${n} Privateer account model${n === 1 ? "" : "s"} (including the confidential TEE ones)`;
+  return cat.signedIn
+    // Signed in but still unavailable: the credential never reached Pi's auth store
+    // — a revoked machine login, the terminal cap, or a network blip while arming.
+    ? `${models} are hidden — the account channel isn't armed. ${signInHint}`
+    : `Not signed in — ${models} are hidden. ${signInHint}`;
+}
+
+/** A short suffix for the picker's own title, so the shortfall shows where you're looking. */
+export function hiddenAccountTitleSuffix(cat: PickerCatalog): string {
+  return cat.hiddenAccountModels === 0
+    ? ""
+    : ` · sign in for ${cat.hiddenAccountModels} more`;
+}