privateer-agent 0.12.53 → 0.12.55

package/extensions/privateer-brand.ts

@@ -285,9 +285,10 @@ function contextLine(p: Palette): string {
 // or three things a returning user should notice. `cmd`, when present, is rendered in the
 // accent color so the actionable bit stands out from the prose. Trim this as it ages.
 const WHATS_NEW: Array<{ text: string; cmd?: string }> = [
-  { text: "Privateer agent CLI is live —", cmd: "npm i -g privateer-agent" },
-  { text: "PRIVATEER.md project context —", cmd: "/init" },
-  { text: "Self-update built in —", cmd: "privateer update" },
+  { text: "Searchable model picker —", cmd: "/models" },
+  { text: "Start over with a new agent —", cmd: "/fresh" },
+  { text: "Text-only models can read images now" },
+  { text: "Live crypto prices and Solana wallets" },
 ];
 
 function whatsNewRows(p: Palette): string[] {

package/extensions/privateer-context.ts

@@ -25,6 +25,7 @@ import {
   RUNTIME_GUIDELINES_MARKER,
   runtimeGuidelinesBlock,
 } from "../src/context.ts";
+import privateerIdentity from "../src/identity.ts";
 
 // Honor Pi's own "disable context files" switch, so --no-context-files / -nc silences
 // everything this extension injects, not just PRIVATEER.md — otherwise the flag would
@@ -33,6 +34,10 @@ const CONTEXT_FILES_DISABLED =
   process.argv.includes("--no-context-files") || process.argv.includes("-nc");
 
 export default function privateerContext(pi: any): void {
+  // Privateer's name and CLI in place of Pi's (src/identity.ts). Its own handler, ahead
+  // of the -nc gate below: that flag silences context files, not which command is safe.
+  privateerIdentity(pi);
+
   // Inject the runtime guidelines + PRIVATEER.md into every turn's system prompt. The
   // prompt is rebuilt per turn and chained across before_agent_start handlers, so
   // appending here is idempotent for the turn; each marker guard makes its own block a

package/extensions/privateer-models.ts

@@ -41,7 +41,6 @@ import {
   fetchAccountCatalog,
 } from "../src/providers/account.ts";
 import { writePiDefaultModel } from "../src/providers/defaultModel.ts";
-import { acceptsImages } from "../src/providers/vision.ts";
 
 // A minimal view of Pi's theme (passed to the ui.custom factory) — enough to color
 // text without pulling Pi's internal theme types into an extension.
@@ -462,9 +461,6 @@ export default function privateerModels(pi: {
                 `Model: ${match.provider}/${match.id}  ·  ${TIERS[tier].label}`,
                 "info",
               );
-              if (!acceptsImages(`${match.provider}/${match.id}`)) {
-                ui?.notify?.(`${match.provider}/${match.id} can't see images — files will be dropped silently.`, "warning");
-              }
               return;
             } catch (e) {
               ui?.notify?.(`Couldn't switch model: ${(e as Error).message}`, "error");
@@ -511,9 +507,6 @@ export default function privateerModels(pi: {
           `Model: ${chosen.provider}/${chosen.id}  ·  ${TIERS[chosen.tier].label}`,
           "info",
         );
-        if (!acceptsImages(`${chosen.provider}/${chosen.id}`)) {
-          ui.notify?.(`${chosen.provider}/${chosen.id} can't see images — files will be dropped silently.`, "warning");
-        }
       } catch (e) {
         ui.notify?.(`Couldn't switch model: ${(e as Error).message}`, "error");
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.53",
+  "version": "0.12.55",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/cli/chat.ts

@@ -754,9 +754,6 @@ async function main() {
       writePiDefaultModel(sp);
       const m = `model → ${sp}`;
       console.log(`${DIM}${m}${RESET}`);
-      if (!acceptsImages(sp)) {
-        console.log(`${YELLOW}⚠ ${sp} can't see images — @file/read on a picture will be dropped silently.${RESET}`);
-      }
       relay?.sendContext({ model: currentSpec, cwd, version: agentVersion() }); // banner follows the switch
       if (remote) relay?.sendNotice(m);
     } catch (e) {

package/src/config/moat.ts

@@ -291,7 +291,11 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
 
   if (caps.context) {
     const { default: privateerContext } = await import("../../extensions/privateer-context.ts");
-    factories.push(privateerContext);
+    factories.push(privateerContext); // carries privateerIdentity itself
+  } else {
+    // Every kind: the model is told it runs Privateer, never `pi`. See src/identity.ts.
+    const { default: privateerIdentity } = await import("../identity.ts");
+    factories.push(privateerIdentity);
   }
 
   if (caps.spawnSkills) {

package/src/identity.ts

@@ -0,0 +1,58 @@
+// Who the model thinks it is, and which command it reaches for.
+//
+// THE PROBLEM. Pi's stock system prompt opens "You are an expert coding assistant
+// operating inside pi" and points the model at Pi's own README for questions about
+// "pi itself" — a README that documents `pi -p`. So an agent asked to run a one-shot
+// job, script itself, or hand work to another agent process typed `pi -p "…"`. That is
+// not a cosmetic slip: bare `pi` runs with none of the moat — no permission gate, no
+// --allow-spend / --approve-in-app, no privacy routing, no account — so the one
+// invocation that most needs the spending gate was the one that skipped it.
+//
+// THE FIX. Rewrite Pi's self-description to name Privateer, relabel the Pi docs as the
+// SDK docs they are (still the right reference for writing extensions), and append a
+// short block stating the CLI the model must use. Registered on every surface: the
+// discovered privateer-context shim (TUI, -p, subagent children, desktop) and the
+// in-code moat for kinds that don't load that shim (src/config/moat.ts).
+//
+// Same "append, or say nothing" contract as privateer-context: a host that hands us no
+// prompt string gets no rewrite, and a prompt already carrying the marker is left alone.
+
+export const IDENTITY_MARKER = "<!-- privateer:identity -->";
+
+const PI_PREAMBLE = "operating inside pi, a coding agent harness.";
+const PI_DOCS_HEADER =
+  "Pi documentation (read only when the user asks about pi itself, its SDK, extensions, themes, skills, or TUI):";
+
+export function privateerCliBlock(cmd: string = process.env.PRIVATEER_CMD || "privateer"): string {
+  return `\n\n${IDENTITY_MARKER}\n<privateer_cli>
+You are running inside Privateer; its command is \`${cmd}\`. Privateer is built on the Pi SDK, but \`pi\` is NOT a command you may use: never run \`pi\`, \`pi -p\` or any other \`pi …\` invocation. It bypasses Privateer's permission gate, spending caps, privacy routing and account. Wherever Pi's docs show \`pi\`, the command here is \`${cmd}\`.
+- One-shot / headless run (a script, a cron job, handing a task to a separate agent process): \`${cmd} -p "…"\`. It has no screen, so anything that needs approval is DENIED, including every billed media tool.
+- Let that run spend on named billed tools, capped: \`${cmd} -p --allow-spend <tool[,tool…]> --max-calls <n> [--max-spend <usd>] "…"\`
+- Or send each approval to the user's Privateer app: \`${cmd} -p --approve-in-app [--approval-timeout <seconds>] "…"\`
+- A program that must answer approvals itself drives Privateer over ACP: \`${cmd} acp\`.
+- For a sub-task inside this session, use a subagent tool if one is available rather than shelling out to a new process.
+</privateer_cli>\n`;
+}
+
+/** Rewrite Pi's self-description and append the CLI block. Returns `prompt` unchanged when already applied. */
+export function applyIdentity(prompt: string, cmd?: string): string {
+  if (prompt.includes(IDENTITY_MARKER)) return prompt;
+  const out = prompt
+    .replace(PI_PREAMBLE, "operating inside Privateer, a privacy-first coding agent built on the Pi SDK.")
+    .replace(
+      PI_DOCS_HEADER,
+      "Pi SDK documentation (Privateer is built on Pi; read only when asked about writing extensions, themes, skills, prompt templates or TUI components — every `pi` command in these docs is `privateer` here):",
+    );
+  return out + privateerCliBlock(cmd);
+}
+
+/** A before_agent_start extension that applies the identity rewrite. */
+export default function privateerIdentity(pi: any): void {
+  pi.on("before_agent_start", (event: any) => {
+    const base = event?.systemPrompt;
+    if (typeof base !== "string") return;
+    const prompt = applyIdentity(base);
+    if (prompt === base) return;
+    return { systemPrompt: prompt };
+  });
+}