privateer-agent 0.12.53 → 0.12.54

package/extensions/privateer-context.ts

@@ -25,6 +25,7 @@ import {
   RUNTIME_GUIDELINES_MARKER,
   runtimeGuidelinesBlock,
 } from "../src/context.ts";
+import privateerIdentity from "../src/identity.ts";
 
 // Honor Pi's own "disable context files" switch, so --no-context-files / -nc silences
 // everything this extension injects, not just PRIVATEER.md — otherwise the flag would
@@ -33,6 +34,10 @@ const CONTEXT_FILES_DISABLED =
   process.argv.includes("--no-context-files") || process.argv.includes("-nc");
 
 export default function privateerContext(pi: any): void {
+  // Privateer's name and CLI in place of Pi's (src/identity.ts). Its own handler, ahead
+  // of the -nc gate below: that flag silences context files, not which command is safe.
+  privateerIdentity(pi);
+
   // Inject the runtime guidelines + PRIVATEER.md into every turn's system prompt. The
   // prompt is rebuilt per turn and chained across before_agent_start handlers, so
   // appending here is idempotent for the turn; each marker guard makes its own block a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.53",
+  "version": "0.12.54",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/config/moat.ts

@@ -291,7 +291,11 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
 
   if (caps.context) {
     const { default: privateerContext } = await import("../../extensions/privateer-context.ts");
-    factories.push(privateerContext);
+    factories.push(privateerContext); // carries privateerIdentity itself
+  } else {
+    // Every kind: the model is told it runs Privateer, never `pi`. See src/identity.ts.
+    const { default: privateerIdentity } = await import("../identity.ts");
+    factories.push(privateerIdentity);
   }
 
   if (caps.spawnSkills) {

package/src/identity.ts

@@ -0,0 +1,58 @@
+// Who the model thinks it is, and which command it reaches for.
+//
+// THE PROBLEM. Pi's stock system prompt opens "You are an expert coding assistant
+// operating inside pi" and points the model at Pi's own README for questions about
+// "pi itself" — a README that documents `pi -p`. So an agent asked to run a one-shot
+// job, script itself, or hand work to another agent process typed `pi -p "…"`. That is
+// not a cosmetic slip: bare `pi` runs with none of the moat — no permission gate, no
+// --allow-spend / --approve-in-app, no privacy routing, no account — so the one
+// invocation that most needs the spending gate was the one that skipped it.
+//
+// THE FIX. Rewrite Pi's self-description to name Privateer, relabel the Pi docs as the
+// SDK docs they are (still the right reference for writing extensions), and append a
+// short block stating the CLI the model must use. Registered on every surface: the
+// discovered privateer-context shim (TUI, -p, subagent children, desktop) and the
+// in-code moat for kinds that don't load that shim (src/config/moat.ts).
+//
+// Same "append, or say nothing" contract as privateer-context: a host that hands us no
+// prompt string gets no rewrite, and a prompt already carrying the marker is left alone.
+
+export const IDENTITY_MARKER = "<!-- privateer:identity -->";
+
+const PI_PREAMBLE = "operating inside pi, a coding agent harness.";
+const PI_DOCS_HEADER =
+  "Pi documentation (read only when the user asks about pi itself, its SDK, extensions, themes, skills, or TUI):";
+
+export function privateerCliBlock(cmd: string = process.env.PRIVATEER_CMD || "privateer"): string {
+  return `\n\n${IDENTITY_MARKER}\n<privateer_cli>
+You are running inside Privateer; its command is \`${cmd}\`. Privateer is built on the Pi SDK, but \`pi\` is NOT a command you may use: never run \`pi\`, \`pi -p\` or any other \`pi …\` invocation. It bypasses Privateer's permission gate, spending caps, privacy routing and account. Wherever Pi's docs show \`pi\`, the command here is \`${cmd}\`.
+- One-shot / headless run (a script, a cron job, handing a task to a separate agent process): \`${cmd} -p "…"\`. It has no screen, so anything that needs approval is DENIED, including every billed media tool.
+- Let that run spend on named billed tools, capped: \`${cmd} -p --allow-spend <tool[,tool…]> --max-calls <n> [--max-spend <usd>] "…"\`
+- Or send each approval to the user's Privateer app: \`${cmd} -p --approve-in-app [--approval-timeout <seconds>] "…"\`
+- A program that must answer approvals itself drives Privateer over ACP: \`${cmd} acp\`.
+- For a sub-task inside this session, use a subagent tool if one is available rather than shelling out to a new process.
+</privateer_cli>\n`;
+}
+
+/** Rewrite Pi's self-description and append the CLI block. Returns `prompt` unchanged when already applied. */
+export function applyIdentity(prompt: string, cmd?: string): string {
+  if (prompt.includes(IDENTITY_MARKER)) return prompt;
+  const out = prompt
+    .replace(PI_PREAMBLE, "operating inside Privateer, a privacy-first coding agent built on the Pi SDK.")
+    .replace(
+      PI_DOCS_HEADER,
+      "Pi SDK documentation (Privateer is built on Pi; read only when asked about writing extensions, themes, skills, prompt templates or TUI components — every `pi` command in these docs is `privateer` here):",
+    );
+  return out + privateerCliBlock(cmd);
+}
+
+/** A before_agent_start extension that applies the identity rewrite. */
+export default function privateerIdentity(pi: any): void {
+  pi.on("before_agent_start", (event: any) => {
+    const base = event?.systemPrompt;
+    if (typeof base !== "string") return;
+    const prompt = applyIdentity(base);
+    if (prompt === base) return;
+    return { systemPrompt: prompt };
+  });
+}