privateer-agent 0.12.51 → 0.12.52

package/extensions/privateer-models.ts

@@ -21,7 +21,17 @@ import {
   Input,
   Spacer,
   Text,
+  type Component,
+  type TuiMouseEvent,
+  type TuiMouseEventResult,
 } from "@earendil-works/pi-tui";
+
+// TuiMouseDispatchResult isn't re-exported from the package index — same shape,
+// typed locally so the Container.handleMouse override matches its signature.
+interface MouseDispatchResult extends TuiMouseEventResult {
+  handled: true;
+  target: { component: Component; originX: number; originY: number; width: number; height: number };
+}
 import { TIERS, tierRank, type PrivacyTier } from "pi-privacy";
 import { verifyModelPosture } from "pi-privacy";
 import {
@@ -148,6 +158,10 @@ function sortRows(rows: Row[]): Row[] {
 
 const MAX_VISIBLE = 12;
 
+// Lines the picker renders above the first model row (title, legend, blank,
+// search input, blank). Used to translate a click's local y into a row index.
+const HEADER_LINES = 5;
+
 class ModelsPicker extends Container {
   private tui: TuiLike;
   private theme: ThemeLike;
@@ -202,7 +216,7 @@ class ModelsPicker extends Container {
     this.addChild(this.blurbText);
     this.addChild(
       new Text(
-        t.fg("muted", "↑↓ navigate   ⏎ select   type to search   esc cancel"),
+        t.fg("muted", "↑↓ navigate   PgUp/PgDn page   wheel scroll   click row   ⏎ select   esc cancel"),
         1,
         0,
       ),
@@ -317,6 +331,47 @@ class ModelsPicker extends Container {
     this.applyFilter(q);
   }
 
+  // Page the highlight by a whole viewport, clamped — PgUp/PgDn and shift-free
+  // long hops so a long ranked list is actually traversable.
+  private page(delta: number): void {
+    if (!this.filtered.length) return;
+    this.selectedIndex = Math.max(0, Math.min(this.selectedIndex + delta, this.filtered.length - 1));
+    this.updateList();
+  }
+
+  // Mouse support: wheel scrolls the highlight through the list, click jumps to a
+  // visible row. The terminal reports wheel as logical lines (negative = up).
+  handleMouse(event: TuiMouseEvent): MouseDispatchResult | undefined {
+    const handledHere = (): MouseDispatchResult => ({
+      handled: true,
+      target: { component: this, originX: 0, originY: 0, width: event.width, height: event.height },
+    });
+    if (event.type === "wheel" && event.wheelDelta) {
+      const delta = -event.wheelDelta;
+      if (!this.filtered.length || delta === 0) return handledHere();
+      this.selectedIndex = Math.max(0, Math.min(this.selectedIndex + delta, this.filtered.length - 1));
+      this.updateList();
+      this.tui.requestRender();
+      return handledHere();
+    }
+    if (event.type === "click" || event.type === "press") {
+      const row = event.y - HEADER_LINES;
+      if (row < 0 || row >= MAX_VISIBLE) return undefined;
+      const start = Math.max(
+        0,
+        Math.min(this.selectedIndex - Math.floor(MAX_VISIBLE / 2), this.filtered.length - MAX_VISIBLE),
+      );
+      const idx = start + row;
+      if (idx >= 0 && idx < this.filtered.length) {
+        this.selectedIndex = idx;
+        this.updateList();
+        this.tui.requestRender();
+        return handledHere();
+      }
+    }
+    return undefined;
+  }
+
   handleInput(keyData: string): void {
     const kb = getKeybindings();
     if (kb.matches(keyData, "tui.select.up")) {
@@ -329,6 +384,10 @@ class ModelsPicker extends Container {
       this.selectedIndex =
         this.selectedIndex === this.filtered.length - 1 ? 0 : this.selectedIndex + 1;
       this.updateList();
+    } else if (kb.matches(keyData, "tui.select.pageUp")) {
+      this.page(-MAX_VISIBLE);
+    } else if (kb.matches(keyData, "tui.select.pageDown")) {
+      this.page(MAX_VISIBLE);
     } else if (kb.matches(keyData, "tui.select.confirm")) {
       const row = this.filtered[this.selectedIndex];
       if (row) this.onSelect(row);

package/extensions/privateer-web.ts

@@ -35,6 +35,7 @@
 // pulling that package's own .ts sources into our typecheck, the same trick config/moat.ts
 // uses for pi-mcp-adapter.
 import { guardedWebToolDefinitions } from "../src/tools/web.ts";
+import { guardedCryptoToolDefinitions } from "../src/tools/crypto.ts";
 import { readWebToolsConfig, resolveWebMode, type ProviderMetaLike } from "../src/tools/webMode.ts";
 
 const RPIV_WEB_TOOLS = "@juicesharp/rpiv-web-tools";
@@ -47,6 +48,9 @@ const SIGNED_OUT_HINT =
   "allowance, or /web-tools to use your own search provider (a Brave/Tavily key, or a " +
   "self-hosted SearXNG) instead.";
 
+const CRYPTO_SIGNED_OUT_HINT =
+  "Crypto lookups need a Privateer account: run /signin to use market data on your account.";
+
 interface RpivWebTools {
   registerWebSearchTool(pi: unknown): void;
   registerWebFetchTool(pi: unknown): void;
@@ -90,6 +94,10 @@ export default async function privateerWeb(pi: any): Promise<void> {
     for (const def of guardedWebToolDefinitions(SIGNED_OUT_HINT)) pi.registerTool?.(def);
   }
 
+  // Market data in BOTH branches: no user-configured provider serves it, so picking
+  // your own search engine must not cost you crypto_lookup. See tools/crypto.ts.
+  for (const def of guardedCryptoToolDefinitions(CRYPTO_SIGNED_OUT_HINT)) pi.registerTool?.(def);
+
   // Always available, whichever pack won: it is how a user on the account route configures
   // a provider of their own, and the only place to see which keys are resolving.
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.51",
+  "version": "0.12.52",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/acp/run.ts

@@ -43,13 +43,15 @@
 
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
+import { CRYPTO_TOOL_NAMES } from "../tools/crypto.ts";
 import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
 
 // Read-only by default, exactly as the channels runtime and the routines harbor do:
 // a turn nobody is watching must not be able to mutate the filesystem or shell out
 // until a human widens it in config.
 const SAFE_TOOLS = ["read", "grep", "find", "ls"];
-const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
+// crypto_lookup rides the web switch: its tickers/address leave the run as a query does.
+const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES, ...CRYPTO_TOOL_NAMES];
 // Media generation stays out of the default set (it spends the account's credit —
 // see the harbor's note); an ACP host that wants it names it in `acp.tools`. Listed
 // here so it can be stripped back out when generation is switched off.

package/src/channels/run.ts

@@ -51,6 +51,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 // Pi-free static graph by design — see the header of piAuthStore.ts.
 import { modelRegistryOf } from "../providers/piAuthStore.ts";
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
+import { CRYPTO_TOOL_NAMES } from "../tools/crypto.ts";
 import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
 
 // Read-only default toolset — same rationale as the routines harbor's SAFE_TOOLS:
@@ -63,7 +64,8 @@ const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 // Web tools join the default set when the agent has web access — see
 // config/hosted.ts. Kept out of SAFE_TOOLS proper because they're the one "read-only"
 // capability that still sends a query off the machine.
-const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
+// crypto_lookup rides the web switch: its tickers/address leave the run as a query does.
+const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES, ...CRYPTO_TOOL_NAMES];
 
 // Media GENERATION never joins the default set, even with the switch on: a chat
 // message is an untrusted prompt, and these spend the account's credit. A channel that

package/src/config/moat.ts

@@ -312,12 +312,17 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
   if (caps.web === "account" && webEnabled()) {
     const { makeWebTools } = await import("../tools/web.ts");
     factories.push(makeWebTools());
+    // Market data rides the web switch: the tickers leave exactly as a query does.
+    const { makeCryptoTools } = await import("../tools/crypto.ts");
+    factories.push(makeCryptoTools());
   } else if (caps.web === "guarded") {
     if (!opts.webHint) throw new Error(`buildMoat: kind "${opts.kind}" needs a webHint for guarded web tools`);
     const hint = opts.webHint;
     const { guardedWebToolDefinitions } = await import("../tools/web.ts");
+    const { guardedCryptoToolDefinitions } = await import("../tools/crypto.ts");
     factories.push((pi: any) => {
       for (const def of guardedWebToolDefinitions(hint)) pi.registerTool?.(def);
+      for (const def of guardedCryptoToolDefinitions(hint)) pi.registerTool?.(def);
     });
   }
 

package/src/config/moatManifest.json

@@ -24,7 +24,7 @@
     { "entry": "extensions/privateer-update.ts", "name": "privateer-update", "note": "tool pack updates in place — banner flag + /update" },
     { "entry": "extensions/privateer-fresh.ts", "name": "privateer-fresh", "note": "/fresh — replace the agent with a new one and stop everything it started" },
     { "entry": "extensions/privateer-speak.ts", "name": "privateer-speak", "note": "spoken responses (/speak) + voice input (/talk) — pi-speak + confidential account TTS/STT" },
-    { "entry": "extensions/privateer-web.ts", "name": "privateer-web", "note": "web_search/web_fetch — account search when signed in, else the user's own provider (rpiv-web-tools)" },
+    { "entry": "extensions/privateer-web.ts", "name": "privateer-web", "note": "web_search/web_fetch — account search when signed in, else the user's own provider (rpiv-web-tools); crypto_lookup — account market data, in both cases" },
     { "dep": ["@juicesharp/rpiv-ask-user-question", "index.ts"], "name": "rpiv-ask-user-question", "note": "ask_user_question" },
     { "dep": ["pi-mcp-adapter", "index.ts"], "name": "pi-mcp-adapter", "note": "MCP servers as first-class tools" },
     { "dep": ["pi-subagents", "src", "extension", "index.ts"], "name": "pi-subagents", "note": "bounded parallel sub-agents" },

package/src/ext/permissionGate.ts

@@ -16,6 +16,7 @@ import type { PermissionRequest } from "../permissions/gate.ts";
 import { ModeGate, type AskOutcome } from "../permissions/modeGate.ts";
 import { classifyToolCall } from "../permissions/classify.ts";
 import { redactText } from "../util/redact.ts";
+import { coauthorGitCommits } from "../util/coauthor.ts";
 import { DEFAULT_DENYLIST } from "../permissions/danger.ts";
 
 // The per-tool_call hook context we read (structural subset of Pi's ctx — kept
@@ -271,7 +272,12 @@ export function makePermissionGate(ctrl: GateController) {
   }
 
   return function permissionGate(pi: PiExtensionApi): void {
-    pi.on("tool_call", (event, ctx) => decideToolCall(ctrl, event.toolName, event.input, ctx));
+    // Co-author the user's commits before the gate decides, so an approval prompt shows
+    // the command that will actually run (util/coauthor.ts).
+    pi.on("tool_call", (event, ctx) => {
+      coauthorGitCommits(event.toolName, event.input);
+      return decideToolCall(ctrl, event.toolName, event.input, ctx);
+    });
 
     // Redact secrets from tool output before it reaches the model / relay.
     // tool_result delivers content PARTS (per the Pi extension contract), not a

package/src/harbor/index.ts

@@ -36,7 +36,7 @@ import { terminalPublicKeyBase64 } from "../crypto/terminalKey.ts";
 import { openJsonFromApp } from "../crypto/terminalUnseal.ts";
 import { verifyChannelSave } from "../crypto/accountVerify.ts";
 import { loadAccountSignKey, loadLastControlTs, saveLastControlTs } from "../crypto/accountTrust.ts";
-import { authorizeControl } from "../remote/controlAuth.ts";
+import { authorizeControl, controlRequiresFreshTs } from "../remote/controlAuth.ts";
 import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke } from "../auth/privateer.ts";
 import {
   loadRoutines,
@@ -67,6 +67,7 @@ import { serializeBuild } from "./buildLock.ts";
 import { isHosted, publishRelayPub, webEnabled, mediaEnabled } from "../config/hosted.ts";
 import { relayExposureAllowed } from "../config/relayExposure.ts";
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
+import { CRYPTO_TOOL_NAMES } from "../tools/crypto.ts";
 import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
 import { COMPOSE_TOOL_NAMES } from "../tools/videoCompose.ts";
 import { BILLED_MEDIA_TOOLS } from "../permissions/classify.ts";
@@ -84,7 +85,8 @@ const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 // they join the DEFAULT allow-list: the overwhelmingly common unattended request
 // ("summarize today's news at 7pm") needs the live web and nothing else, and making
 // the user hand-write an allow-list for it was the whole friction.
-const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
+// crypto_lookup rides the web switch: its tickers/address leave the run as a query does.
+const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES, ...CRYPTO_TOOL_NAMES];
 
 // Media generation (src/tools/media.ts) plus local composition (videoCompose.ts).
 //
@@ -579,11 +581,11 @@ export class Harbor {
     ts: number | undefined,
     run: () => string | undefined,
   ): string | undefined {
-    // task_submit/task_spawn are NON-idempotent (each runs a headless session), so they
-    // require a strictly-fresh ts — a replayed frame with an equal ts must NOT re-run.
-    // The idempotent config mutations (routines/channels save|delete) keep the default
-    // at-or-above acceptance. See authorizeControl's strict note.
-    const strict = action === "task_submit" || action === "task_spawn" || action === "workflows_run";
+    // Run-style actions (task_submit/task_spawn/routines_run/workflows_run) are
+    // NON-idempotent, so they require a strictly-fresh ts — a replayed frame with an
+    // equal ts must NOT run again. Only the listed idempotent config mutations keep
+    // at-or-above acceptance. See controlRequiresFreshTs / authorizeControl.
+    const strict = controlRequiresFreshTs(action);
     const auth = authorizeControl(routineRelayId(), action, args, sig, ts, { strict });
     if (!auth.ok) return auth.message;
     return run();

package/src/permissions/classify.ts

@@ -630,6 +630,24 @@ export function classifyToolCall(
     };
   }
 
+  // crypto_lookup (src/tools/crypto.ts) — a network read through the account API,
+  // like web_search. Named explicitly because nothing in its name matches the
+  // heuristic below, and the unknown-tool branch would make it bash-kind: a JSON
+  // prompt, and an outright DENY in plan/readonly, where "what's SOL at?" is as
+  // reasonable a question as any search.
+  if (name === "crypto_lookup") {
+    const mode = str(obj.mode) || "tokens";
+    const what = mode === "portfolio"
+      ? (str(obj.address) ? `wallet ${str(obj.address)}` : "the account's own Solana wallet")
+      : mode === "tokens" ? str(obj.query) : `${mode} tokens${obj.chain ? ` on ${str(obj.chain)}` : ""}`;
+    return {
+      tool: toolName,
+      kind: "fetch",
+      title: "Look up crypto market data",
+      detail: what,
+    };
+  }
+
   // Network reads (web fetch / search / http).
   if (name.includes("fetch") || name.includes("web") || name.includes("http") || name.includes("url")) {
     return {

package/src/remote/controlAuth.ts

@@ -17,6 +17,27 @@
 import { loadAccountSignKey, loadLastControlTs, saveLastControlTs } from "../crypto/accountTrust.ts";
 import { verifyControl } from "../crypto/accountVerify.ts";
 
+// Control actions that are safe to re-apply: replaying the latest signed frame (same ts)
+// just re-asserts the same config. Everything NOT listed here — routines_run,
+// workflows_run, task_submit/task_spawn, and any action added later — is treated as
+// effectful and verified in strict mode. Default-strict so a new "run" action can't
+// silently inherit replayability (routines_run once did).
+const IDEMPOTENT_CONTROL_ACTIONS: ReadonlySet<string> = new Set([
+  "routines_save",
+  "routines_delete",
+  "routines_set_enabled",
+  "channels_remove",
+  "mcp_set_enabled",
+  "mcp_remove",
+  "workflows_save",
+  "workflows_remove",
+]);
+
+/** True when `action` must carry a strictly-fresh ts (see authorizeControl's `strict`). */
+export function controlRequiresFreshTs(action: string): boolean {
+  return !IDEMPOTENT_CONTROL_ACTIONS.has(action);
+}
+
 export interface ControlAuthResult {
   ok: boolean;
   message?: string;
@@ -33,7 +54,7 @@ export interface ControlAuthResult {
  *     idempotent config mutations (routines/skills/extensions/channels save|delete),
  *     where replaying the latest signed frame just re-applies the same state — harmless.
  *   - strict: reject ts AT-or-below the watermark. Required for NON-idempotent, effectful
- *     actions (task_submit/task_spawn — each RUNS a headless session), where a malicious
+ *     actions (task_submit/task_spawn/routines_run/workflows_run — each RUNS something), where a malicious
  *     relay replaying the latest signed frame (same ts) would re-run the task / spawn
  *     another session (inference-cost + resource abuse). Strict forces every accepted
  *     effectful frame to carry a strictly-fresh ts, which the server cannot fabricate (it

package/src/remote/relayClient.ts

@@ -22,6 +22,8 @@ import { apiRequest, serverBaseUrl } from "../auth/privateer.ts";
 import { MOAT_SHIMS, reservedNames } from "../config/moatManifest.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
+import { noQuarterActive } from "../permissions/noQuarter.ts";
+import { authorizeControl } from "./controlAuth.ts";
 import { CARGO_CHUNK_CHARS, type CargoSaveRequest, type CargoSaveResult } from "./cargoSave.ts";
 import {
   LIBRARY_CHUNK_CHARS,
@@ -120,11 +122,13 @@ export interface RelayCallbacks {
   // relay. Optional so callbacks that predate the frame keep compiling; an older
   // CLI that ignores it still gets signed out by the ≤25s heartbeat kill.
   onRevoked?: () => void;
-  // The app answered a relayed approval request.
+  // The app answered a relayed approval request. An "allow" reaches here only once
+  // handle() has verified the account's signature over it; a deny needs none.
   onApprovalResponse: (id: string, decision: "allow" | "deny") => void;
   // The app toggled no-quarter (unattended) mode: remote turns auto-approve like
   // bypass mode instead of relaying every action, so the agent runs to completion.
   // Dangerous/destructive actions still relay — they sit above bypass locally too.
+  // `on: true` reaches here only once handle() has verified the account's signature.
   onNoQuarter?: (on: boolean) => void;
   // The app toggled the privacy filter. `off` true = pi-privacy is disabled for this
   // session, exactly as `/privacy off` does it: no outbound PII scan or prompt, no
@@ -765,12 +769,59 @@ export class RelayClient {
       case "session_revoked":
         this.cb.onRevoked?.();
         break;
-      case "approval_response":
-        if (frame.id) this.cb.onApprovalResponse(frame.id, frame.decision === "deny" ? "deny" : "allow");
+      // The two frames that LOWER the permission gate. The relay is untrusted (docs/
+      // harbor-channels-and-app.md §6), and before this an unsigned `approval_response`
+      // or `no_quarter` from it was taken as the human's word — a hostile relay could
+      // allow any pending action, or lift the gate for the whole session. So each is
+      // account-signed now, like every other mutating control frame (H2), and verified
+      // against THIS terminal's id. Only the direction that widens what the agent may do
+      // needs proof: a deny, or no-quarter off, is safe from anyone and stays unsigned.
+      case "approval_response": {
+        if (typeof frame.id !== "string" || !frame.id) break;
+        // Exactly "allow" — anything else, including a missing or unknown decision,
+        // is a deny. This used to be the other way round.
+        if (frame.decision !== "allow") {
+          this.cb.onApprovalResponse(frame.id, "deny");
+          break;
+        }
+        // Not strict: the id binds the signature to one request, and the bridge
+        // settles each id once, so a replay has nothing left to answer. Strict would
+        // refuse the burst the app sends when it allows a queue in the same ms.
+        const auth = authorizeControl(
+          this.termId,
+          "approval_response",
+          { id: frame.id, decision: "allow" },
+          sig(frame),
+          tsOf(frame),
+        );
+        if (!auth.ok) {
+          this.refuseControl(auth.message);
+          // Settle it now rather than leave the gate waiting out its timeout.
+          this.cb.onApprovalResponse(frame.id, "deny");
+          break;
+        }
+        this.cb.onApprovalResponse(frame.id, "allow");
         break;
-      case "no_quarter":
-        this.cb.onNoQuarter?.(frame.on === true);
+      }
+      case "no_quarter": {
+        if (frame.on !== true) {
+          this.cb.onNoQuarter?.(false);
+          break;
+        }
+        // Strict: `on` is not bound to anything that expires, so a relay that kept the
+        // last signed `on` could otherwise replay it after the user turned the flag off.
+        const auth = authorizeControl(this.termId, "no_quarter", { on: true }, sig(frame), tsOf(frame), {
+          strict: true,
+        });
+        if (!auth.ok) {
+          this.refuseControl(auth.message);
+          // The app flips its toggle optimistically; tell it what actually holds.
+          this.sendNoQuarter(noQuarterActive());
+          break;
+        }
+        this.cb.onNoQuarter?.(true);
         break;
+      }
       case "privacy":
         this.cb.onPrivacy?.(frame.off === true);
         break;
@@ -1206,6 +1257,15 @@ export class RelayClient {
     this.rawSend(frame);
   }
 
+  // A signed control frame failed verification here. Say so on both ends: the app,
+  // whose user pressed the button, and this terminal, whose user owns the machine.
+  private refuseControl(message?: string): void {
+    const text = message ?? "Refused an unverified change from the app.";
+    this.debug(`refused control: ${text}`);
+    this.sendNotice(text);
+    this.cb.onStatus?.(text);
+  }
+
   // A one-line notice for the app's feed (e.g. "model → …", "unknown command").
   // The generic command-feedback channel back to the driver.
   sendNotice(text: string): void {

package/src/tools/crypto.ts

@@ -0,0 +1,101 @@
+// `crypto_lookup` — live crypto market and Solana wallet data, served by Privateer.
+//
+// Same posture as web_search (see web.ts's header, which applies here word for word):
+// the call goes to the account API (`/api/rag/crypto`) with the session credential
+// this agent already holds, so no data-provider key ever sits in a harbor's
+// environment. The server resolves the lookup — Solana tickers through Jupiter's
+// verified token registry, market data from DexScreener, wallet holdings from the
+// Solana RPC — and hands back a formatted block.
+//
+// WHAT LEAVES. The tickers, or the wallet address, reach Privateer's servers and the
+// public data providers in plaintext; the run's prompt and result do not. That is the
+// web_search trade exactly, which is why this tool rides the same "web access" switch
+// on unattended paths (harbor/channels/ACP add it to their WEB_TOOLS allow-lists).
+//
+// "MY WALLET" IS THE ACCOUNT'S, NEVER A CLAIM. `portfolio` without an address reads the
+// Solana wallet the account signed in with, and the server takes it from the account
+// record, not from this request. A pasted address is public chain state.
+//
+// READ-ONLY. Nothing here signs, swaps or moves funds, and the result tells the model
+// it is information, not financial advice.
+
+import { Type } from "typebox";
+import { hasCredentials } from "../auth/privateer.ts";
+import { callRag, text } from "./web.ts";
+
+/** Tool names this module registers, for allow-list construction. */
+export const CRYPTO_TOOL_NAMES = ["crypto_lookup"] as const;
+
+const MODES = ["tokens", "portfolio", "new", "boosted"] as const;
+type Mode = (typeof MODES)[number];
+
+const SOLANA_ADDRESS = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+
+export const cryptoLookupToolDefinition = {
+  name: "crypto_lookup",
+  label: "Crypto Lookup",
+  description:
+    "Live crypto market and Solana wallet data. Modes: " +
+    "`tokens` — price, 1h/24h change, volume, liquidity, market cap, holders and pair age for up to four " +
+    "tickers, names or contract addresses (Solana tickers are matched against the verified token registry; " +
+    "BTC/ETH/BNB are priced from their wrapped forms); " +
+    "`portfolio` — a Solana wallet's holdings priced and totalled (omit `address` for the signed-in account's " +
+    "own wallet); `new` — the newest token listings; `boosted` — tokens paying for promotion on DexScreener " +
+    "(paid placement, not organic popularity). Use this rather than web_search for prices and holdings; use " +
+    "web_search for crypto NEWS. Read-only. Runs through the user's Privateer account — the tickers or " +
+    "address are visible to Privateer's servers.",
+  parameters: Type.Object({
+    mode: Type.Optional(Type.Union(MODES.map((m) => Type.Literal(m)), { description: "What to look up. Defaults to tokens." })),
+    query: Type.Optional(Type.String({ description: "tokens mode: comma-separated tickers, names or contract addresses, e.g. \"SOL, BONK\"." })),
+    address: Type.Optional(Type.String({ description: "portfolio mode: a Solana wallet address. Omit for the account's own wallet." })),
+    chain: Type.Optional(Type.String({ description: "new/boosted: narrow to one chain, e.g. \"solana\", \"ethereum\", \"base\", \"bsc\"." })),
+  }),
+  async execute(_toolCallId: string, params: { mode?: Mode; query?: string; address?: string; chain?: string }) {
+    const mode: Mode = MODES.includes(params.mode as Mode) ? (params.mode as Mode) : "tokens";
+    const query = String(params.query ?? "").trim();
+    const address = String(params.address ?? "").trim();
+    if (mode === "tokens" && !query) return text("Error: query is required in tokens mode (e.g. \"SOL, BONK\").");
+    if (address && !SOLANA_ADDRESS.test(address)) return text("Error: address must be a Solana wallet address.");
+
+    const body: Record<string, unknown> = { mode, raw: true };
+    if (mode === "tokens") body.query = query;
+    if (mode === "portfolio" && address) body.address = address;
+    const chain = String(params.chain ?? "").trim().toLowerCase();
+    if ((mode === "new" || mode === "boosted") && chain) body.chain = chain;
+
+    const r = await callRag<{ found?: boolean; text?: string }>("/api/rag/crypto", body);
+    if (!r.ok) return text(`Crypto lookup failed: ${r.message}`);
+    if (!r.data.found || !r.data.text) {
+      return text(
+        mode === "tokens"
+          ? `No DEX market found for ${query}. It may not trade on-chain, or the ticker may be spelled differently — try a contract address, or web_search.`
+          : "No market data came back for that lookup.",
+      );
+    }
+    return text(r.data.text);
+  },
+};
+
+/** Extension factory for the unattended paths (see config/moat.ts), beside makeWebTools. */
+export function makeCryptoTools() {
+  return (pi: { registerTool?: (def: unknown) => void }): void => {
+    pi.registerTool?.(cryptoLookupToolDefinition);
+  };
+}
+
+/**
+ * The interactive form: a sign-in check per call, for the same reason
+ * guardedWebToolDefinitions has one (a terminal signs in mid-session). Registered in
+ * BOTH of privateer-web.ts's branches — unlike web_search there is no user-configured
+ * provider for this to compete with, so choosing your own search engine must not cost
+ * you market data.
+ */
+export function guardedCryptoToolDefinitions(hint: string): unknown[] {
+  return [{
+    ...cryptoLookupToolDefinition,
+    async execute(toolCallId: string, params: any) {
+      if (!hasCredentials()) return text(hint);
+      return cryptoLookupToolDefinition.execute(toolCallId, params);
+    },
+  }];
+}

package/src/tools/web.ts

@@ -50,7 +50,7 @@ export const WEB_TOOL_NAMES = ["web_search", "web_fetch"] as const;
 // tighter bound because a routine has no human to notice it went sideways.
 const MAX_FETCH_CHARS = 12_000;
 
-function text(t: string) {
+export function text(t: string) {
   return { content: [{ type: "text", text: t }], details: {} };
 }
 
@@ -76,7 +76,7 @@ function plain(s: string | undefined): string {
     .trim();
 }
 
-interface RagFailure {
+export interface RagFailure {
   ok: false;
   message: string;
 }
@@ -87,7 +87,7 @@ interface RagFailure {
  * swallowed: a routine that answers from memory because search quietly failed is
  * worse than one that says the search failed.
  */
-async function callRag<T>(path: string, body: unknown): Promise<({ ok: true } & { data: T }) | RagFailure> {
+export async function callRag<T>(path: string, body: unknown): Promise<({ ok: true } & { data: T }) | RagFailure> {
   let res: Response;
   try {
     res = await apiRequest(path, {

package/src/util/coauthor.ts

@@ -0,0 +1,119 @@
+// Privateer co-authors the commits it makes. When the agent runs `git commit` through
+// its shell tool, the command is rewritten to carry
+//
+//   --trailer 'Co-authored-by: Privateer <291203302+privateer-first-mate@users.noreply.github.com>'
+//
+// so a pushed commit shows Privateer beside the user on GitHub. The account is
+// github.com/privateer-first-mate — a real USER account. The `privateer-agent` GitHub
+// account is an organization, and an org has no commit email, so a trailer naming it
+// would never link or show an avatar.
+//
+// Why the flag and not a prompt instruction: a model told to add a trailer forgets, or
+// adds it to one commit of three. A rewrite in the tool_call hook (makePermissionGate —
+// the one hook every surface runs bash through) cannot be skipped, and because it runs
+// BEFORE the gate decides, the approval prompt shows the command that will really run.
+//
+// What is and isn't rewritten:
+//   - only `git [global opts] commit` at the START of a shell command (start of string,
+//     or after ; & | ( or a newline). `git commit-tree`/`commit-graph` are not commits.
+//   - never inside quotes: `-m "fix the git commit hook"` is message text, not a command.
+//   - never twice: a command already naming privateer-first-mate is left alone, and on
+//     `--amend` git's default trailer.ifExists (addIfDifferentNeighbor) won't duplicate
+//     a trailer that is already the last one.
+//   - never on git older than 2.32, which has no --trailer and would fail the commit.
+//
+// Off switch: PRIVATEER_COAUTHOR=0 (or off/false), or `"coauthor": false` in
+// ~/.privateer/config.json.
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { configPath } from "../config/paths.ts";
+
+export const COAUTHOR_TRAILER =
+  "Co-authored-by: Privateer <291203302+privateer-first-mate@users.noreply.github.com>";
+
+const SHELL_TOOLS = new Set(["bash", "shell", "run", "exec", "sh"]);
+
+// `git`, then any global options (`-C dir`, `-c k=v`, `--no-pager`, `--git-dir=x`),
+// then `commit` as a whole word — not `commit-tree`, not `commitish`.
+const GIT_COMMIT =
+  /(^|[;&|(\n])(\s*)(git(?:\s+(?:-[Cc]\s+(?:"[^"]*"|'[^']*'|\S+)|--?[\w-]+(?:=(?:"[^"]*"|'[^']*'|\S+))?))*\s+commit)(?=\s|$|[;&|)])/g;
+
+/** Positions in `s` that are inside a single- or double-quoted string. */
+function quotedMask(s: string): boolean[] {
+  const mask = new Array<boolean>(s.length).fill(false);
+  let quote: "'" | '"' | null = null;
+  for (let i = 0; i < s.length; i++) {
+    const c = s[i];
+    if (quote) {
+      mask[i] = true;
+      if (c === "\\" && quote === '"') {
+        if (i + 1 < s.length) mask[++i] = true;
+      } else if (c === quote) {
+        quote = null;
+      }
+    } else if (c === "\\") {
+      i++; // an escaped character outside quotes starts nothing
+    } else if (c === "'" || c === '"') {
+      quote = c;
+      mask[i] = true;
+    }
+  }
+  return mask;
+}
+
+/** `command` with the co-author trailer added to every `git commit` in it. */
+export function withCoauthorTrailer(command: string): string {
+  if (!command.includes("commit") || command.includes("privateer-first-mate")) return command;
+  const mask = quotedMask(command);
+  const flag = ` --trailer '${COAUTHOR_TRAILER}'`;
+  return command.replace(GIT_COMMIT, (match, lead: string, space: string, git: string, offset: number) => {
+    const start = offset + lead.length + space.length;
+    if (mask[start] || mask[start + git.length - 1]) return match;
+    return `${lead}${space}${git}${flag}`;
+  });
+}
+
+let gitSupportsTrailer: boolean | undefined;
+
+/** git >= 2.32 (the release that added `commit --trailer`). Probed once per process. */
+function trailerSupported(): boolean {
+  if (gitSupportsTrailer !== undefined) return gitSupportsTrailer;
+  try {
+    const out = execFileSync("git", ["--version"], { encoding: "utf8", timeout: 5_000 });
+    const m = /(\d+)\.(\d+)/.exec(out);
+    gitSupportsTrailer = !!m && (Number(m[1]) > 2 || (Number(m[1]) === 2 && Number(m[2]) >= 32));
+  } catch {
+    gitSupportsTrailer = false;
+  }
+  return gitSupportsTrailer;
+}
+
+function coauthorEnabled(env: NodeJS.ProcessEnv): boolean {
+  const flag = env.PRIVATEER_COAUTHOR?.trim().toLowerCase();
+  if (flag === "0" || flag === "off" || flag === "false") return false;
+  try {
+    return JSON.parse(readFileSync(configPath(), "utf8"))?.coauthor !== false;
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * The tool_call side: rewrite a shell tool's command in place (Pi executes the
+ * mutated `event.input`). Never throws — a failure here must not block a tool call.
+ */
+export function coauthorGitCommits(toolName: string, input: unknown, env: NodeJS.ProcessEnv = process.env): void {
+  try {
+    if (!SHELL_TOOLS.has(toolName.toLowerCase()) || !input || typeof input !== "object") return;
+    const obj = input as Record<string, unknown>;
+    const key = (["command", "cmd", "script"] as const).find((k) => typeof obj[k] === "string");
+    if (!key) return;
+    const command = obj[key] as string;
+    const next = withCoauthorTrailer(command);
+    if (next === command || !coauthorEnabled(env) || !trailerSupported()) return;
+    obj[key] = next;
+  } catch {
+    // leave the command as the model wrote it
+  }
+}