privateer-agent 0.12.57 → 0.12.58

package/extensions/privateer-gate.ts

@@ -491,11 +491,25 @@ const approveInAppMs = isSubagentChild() ? 0 : Number(process.env.PRIVATEER_APPR
 // anything, and media.ts has no business in the TUI's startup graph.
 async function quoteMediaCall(tool: string, input: unknown, signal?: AbortSignal): Promise<number | null> {
   const { readMediaCapabilities, quoteMediaCallUsd } = await import("../src/tools/media.ts");
+  const { effectiveMediaModel } = await import("../src/config/mediaModels.ts");
   const a = (input && typeof input === "object" ? input : {}) as Record<string, unknown>;
-  const model = typeof a.model === "string" && a.model ? a.model : undefined;
-  const query = tool === "generate_video" || tool === "generate_sprite" ? { videoModel: model } : tool === "generate_model" ? { model } : {};
+  // Price the model the tool will actually SEND — its own `model`, else this machine's
+  // /image-model or /video-model choice — not the account default it would fall past.
+  let priced = a;
+  let query: { imageModel?: string; videoModel?: string; model?: string } = {};
+  if (tool === "generate_image") {
+    const imageModel = effectiveMediaModel("image", a.model);
+    priced = { ...a, model: imageModel };
+    query = { imageModel };
+  } else if (tool === "generate_video" || tool === "generate_sprite") {
+    const imageModel = tool === "generate_sprite" ? effectiveMediaModel("image", a.image_model) : undefined;
+    priced = tool === "generate_sprite" ? { ...a, image_model: imageModel } : a;
+    query = { videoModel: effectiveMediaModel("video", a.model), imageModel };
+  } else if (tool === "generate_model") {
+    query = { model: typeof a.model === "string" && a.model ? a.model : undefined };
+  }
   const caps = await readMediaCapabilities(query, signal);
-  return caps.ok ? quoteMediaCallUsd(tool, input, caps.data) : null;
+  return caps.ok ? quoteMediaCallUsd(tool, priced, caps.data) : null;
 }
 
 const cliLedger = cliGrant ? new CliSpendLedger(cliGrant, quoteMediaCall) : null;

package/extensions/privateer-media.ts

@@ -20,14 +20,20 @@
 // already on disk — no account, no network, no spend — so it stays useful to a
 // signed-out terminal, and to a child whose job is to cut together what its parent
 // generated.
+//
+// /image-model and /video-model are registered unconditionally too: they only write a
+// local preference, and a signed-out terminal is told to /login when it opens the
+// picker rather than finding the command missing.
 import { makeMediaTools } from "../src/tools/media.ts";
 import { makeComposeTools } from "../src/tools/videoCompose.ts";
 import { mediaEnabled } from "../src/config/hosted.ts";
 import { childHoldsSpendGrant } from "../src/permissions/childSpend.ts";
 import { isSubagentChild } from "../src/remote/subagentRelay.ts";
+import { registerMediaModelCommands } from "../src/tools/mediaModelCommands.ts";
 
 export default function privateerMedia(pi: any): void {
   const canSpend = !isSubagentChild() || childHoldsSpendGrant();
   if (mediaEnabled() && canSpend) makeMediaTools()(pi);
   makeComposeTools()(pi);
+  registerMediaModelCommands(pi);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.57",
+  "version": "0.12.58",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/config/mediaModels.ts

@@ -0,0 +1,64 @@
+/**
+ * Which image and video models this machine's agent generates with, when the agent
+ * doesn't name one itself. Set by `/image-model` and `/video-model`
+ * (extensions/privateer-media.ts), stored as `media.imageModel` / `media.videoModel`
+ * in ~/.privateer/config.json.
+ *
+ * PER MACHINE, NOT PER ACCOUNT. The account already has a default for each (the app's
+ * own picker writes it, server-side), and that is what an unset value here falls through
+ * to. A terminal choice deliberately does not write back to it: picking a cheap video
+ * model for a batch of terminal drafts should not change what the phone renders with.
+ *
+ * PRECEDENCE, highest first: the tool call's own `model` → this file → the account
+ * default. The agent naming a model still wins, because it only does that when a job
+ * calls for a specific one (a 4K clip, a model that takes a last frame).
+ *
+ * Read at CALL time, like piiAllow.ts: a pick made in one terminal reaches a harbor or
+ * a second terminal on the same machine on its next generation, without a restart.
+ * Missing file, unreadable file and malformed JSON all mean "no choice" — the account
+ * default — never a crash in the middle of a tool call.
+ */
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { configPath } from "./paths.ts";
+
+export type MediaKind = "image" | "video";
+
+const KEY: Record<MediaKind, "imageModel" | "videoModel"> = { image: "imageModel", video: "videoModel" };
+
+function readConfig(): Record<string, unknown> {
+  try {
+    const cfg = JSON.parse(readFileSync(configPath(), "utf8"));
+    return cfg && typeof cfg === "object" && !Array.isArray(cfg) ? cfg : {};
+  } catch {
+    return {};
+  }
+}
+
+/** The chosen model id for `kind`, or undefined to use the account default. */
+export function mediaModelPref(kind: MediaKind): string | undefined {
+  const media = readConfig().media as Record<string, unknown> | undefined;
+  const v = media?.[KEY[kind]];
+  return typeof v === "string" && v.trim() ? v.trim() : undefined;
+}
+
+/**
+ * Set (or, with null, clear) the choice for `kind`. Every other key in config.json is
+ * preserved — it also holds webhooks, privacy and coauthor settings this must not drop.
+ */
+export function setMediaModelPref(kind: MediaKind, id: string | null): void {
+  const cfg = readConfig();
+  const media = { ...((cfg.media as Record<string, unknown>) ?? {}) };
+  const clean = id?.trim();
+  if (clean) media[KEY[kind]] = clean;
+  else delete media[KEY[kind]];
+  const next: Record<string, unknown> = { ...cfg, media };
+  if (Object.keys(media).length === 0) delete next.media;
+  mkdirSync(dirname(configPath()), { recursive: true });
+  writeFileSync(configPath(), JSON.stringify(next, null, 2) + "\n");
+}
+
+/** The model a call should send: its own `model`, else this machine's choice, else none. */
+export function effectiveMediaModel(kind: MediaKind, requested: unknown): string | undefined {
+  return typeof requested === "string" && requested.trim() ? requested.trim() : mediaModelPref(kind);
+}

package/src/tools/media.ts

@@ -42,6 +42,7 @@ import { mkdirSync, readFileSync, writeFileSync, unlinkSync, existsSync, statSyn
 import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import { apiRequest } from "../auth/privateer.ts";
+import { effectiveMediaModel } from "../config/mediaModels.ts";
 
 /** Tool names these definitions register, for allow-list construction. */
 export const MEDIA_TOOL_NAMES = [
@@ -280,7 +281,7 @@ export const generateImageToolDefinition = {
     count: Type.Optional(Type.Number({ description: "How many variations to produce, 1-4. Above 1, files are suffixed -1, -2, … Defaults to 1." })),
     aspectRatio: Type.Optional(Type.String({ description: "Aspect ratio, e.g. '16:9', '9:16', '1:1'. Defaults to the model's own." })),
     size: Type.Optional(Type.String({ description: "Explicit pixel size if the model supports one, e.g. '1024x1024'." })),
-    model: Type.Optional(Type.String({ description: "Override the account's image model (e.g. 'google/gemini-3.1-flash-image'). Leave unset to use the account default." })),
+    model: Type.Optional(Type.String({ description: "Override the image model (e.g. 'google/gemini-3.1-flash-image'). Leave unset to use the one the user chose with /image-model, or the account default." })),
   }),
   async execute(
     _toolCallId: string,
@@ -302,6 +303,7 @@ export const generateImageToolDefinition = {
     }
 
     const count = Math.min(Math.max(1, Math.round(params.count ?? 1)), 4);
+    const model = effectiveMediaModel("image", params.model);
     const r = await callAccount<ImageResponse>("/api/agent/media/images", {
       method: "POST",
       signal,
@@ -311,7 +313,7 @@ export const generateImageToolDefinition = {
         ...(inputs.length ? { images: inputs } : {}),
         ...(params.aspectRatio ? { aspectRatio: params.aspectRatio } : {}),
         ...(params.size ? { imageSize: params.size } : {}),
-        ...(params.model ? { model: params.model } : {}),
+        ...(model ? { model } : {}),
       },
     });
     if (!r.ok) return text(`Image generation failed: ${r.message}`);
@@ -381,7 +383,7 @@ export const generateVideoToolDefinition = {
     aspectRatio: Type.Optional(Type.String({ description: "Aspect ratio, e.g. '16:9', '9:16'. Model-specific." })),
     resolution: Type.Optional(Type.String({ description: "Resolution, e.g. '720p' or '1080p'." })),
     audio: Type.Optional(Type.Boolean({ description: "Ask the model to generate a soundtrack too, where it supports one. Costs more. Defaults to false." })),
-    model: Type.Optional(Type.String({ description: "Override the account's video model (e.g. 'google/veo-3.1-lite'). Leave unset to use the account default." })),
+    model: Type.Optional(Type.String({ description: "Override the video model (e.g. 'google/veo-3.1-lite'). Leave unset to use the one the user chose with /video-model, or the account default." })),
   }),
   async execute(
     _toolCallId: string,
@@ -417,6 +419,7 @@ export const generateVideoToolDefinition = {
       return text(`Error: ${e instanceof Error ? e.message : String(e)}`);
     }
 
+    const model = effectiveMediaModel("video", params.model);
     const submitted = await callAccount<VideoSubmitResponse>("/api/agent/media/videos", {
       method: "POST",
       signal,
@@ -426,7 +429,7 @@ export const generateVideoToolDefinition = {
         ...(params.aspectRatio ? { aspectRatio: params.aspectRatio } : {}),
         ...(params.resolution ? { resolution: params.resolution } : {}),
         ...(params.audio ? { generateAudio: true } : {}),
-        ...(params.model ? { model: params.model } : {}),
+        ...(model ? { model } : {}),
         ...(firstFrame ? { firstFrame } : {}),
         ...(lastFrame ? { lastFrame } : {}),
       },
@@ -1154,9 +1157,10 @@ export function quoteMediaCallUsd(tool: string, input: unknown, caps: Capabiliti
   };
   switch (tool) {
     case "generate_image": {
-      // The report prices the ACCOUNT's image model; a call naming another one would
-      // be quoted at the wrong model's rate, so it isn't quoted at all.
-      if (typeof args.model === "string" && args.model) return null;
+      // The report prices the image model it DESCRIBES; a call naming another one would
+      // be quoted at the wrong model's rate, so it isn't quoted at all. (A server that
+      // ignores `?imageModel=` describes the account default — a mismatch, so no quote.)
+      if (typeof args.model === "string" && args.model && args.model !== caps.image?.model) return null;
       const each = caps.image?.priceUsdEach;
       if (typeof each !== "number") return null;
       const n = Math.min(Math.max(Math.trunc(num(args.count) ?? 1), 1), caps.image?.maxPerCall ?? 4);
@@ -1176,7 +1180,7 @@ export function quoteMediaCallUsd(tool: string, input: unknown, caps: Capabiliti
       if (!row || clipUsd === null) return null;
       const stills = row.billedTurnStills ?? 0;
       const each = caps.image?.priceUsdEach;
-      if (stills > 0 && (typeof each !== "number" || (typeof args.image_model === "string" && args.image_model))) return null;
+      if (stills > 0 && (typeof each !== "number" || (typeof args.image_model === "string" && args.image_model && args.image_model !== caps.image?.model))) return null;
       return clipUsd * (row.billedClips ?? 1) + stills * (each ?? 0);
     }
     case "generate_sfx":
@@ -1189,12 +1193,13 @@ export function quoteMediaCallUsd(tool: string, input: unknown, caps: Capabiliti
   }
 }
 
-/** Read the capability report (optionally describing a specific video / 3D model). */
+/** Read the capability report (optionally describing a specific image / video / 3D model). */
 export async function readMediaCapabilities(
-  query: { videoModel?: string; model?: string } = {},
+  query: { imageModel?: string; videoModel?: string; model?: string } = {},
   signal?: AbortSignal,
 ): Promise<{ ok: true; data: CapabilitiesResponse } | { ok: false; message: string }> {
   const q = new URLSearchParams();
+  if (query.imageModel) q.set("imageModel", query.imageModel);
   if (query.videoModel) q.set("videoModel", query.videoModel);
   if (query.model) q.set("model", query.model);
   const qs = q.toString();
@@ -1293,10 +1298,17 @@ export const mediaCapabilitiesToolDefinition = {
           "their legal values and the price — is per-model.",
       }),
     ),
+    imageModel: Type.Optional(
+      Type.String({
+        description:
+          "An image model id to describe instead of the default (e.g. 'google/gemini-3.1-flash-image'), " +
+          "so the price per image is the one generate_image will charge for it.",
+      }),
+    ),
     videoModel: Type.Optional(
       Type.String({
         description:
-          "A video model id to describe instead of the account default (e.g. 'bytedance/seedance-2.0'). " +
+          "A video model id to describe instead of the default (e.g. 'bytedance/seedance-2.0'). " +
           "Clip lengths, aspect ratios and the price per clip are all per-model — check the one you will " +
           "pass as generate_video's `model` before you spend on it.",
       }),
@@ -1310,10 +1322,20 @@ export const mediaCapabilitiesToolDefinition = {
       }),
     ),
   }),
-  async execute(_toolCallId: string, params: { model?: string; ttsModel?: string; videoModel?: string }, signal?: AbortSignal) {
+  async execute(
+    _toolCallId: string,
+    params: { model?: string; ttsModel?: string; imageModel?: string; videoModel?: string },
+    signal?: AbortSignal,
+  ) {
+    // Unset means "the model generate_* would use", which is this machine's
+    // /image-model or /video-model choice before the account default — describing the
+    // account default instead would quote one model's price and clip lengths for another.
+    const imageModel = effectiveMediaModel("image", params?.imageModel);
+    const videoModel = effectiveMediaModel("video", params?.videoModel);
     const query = new URLSearchParams();
     if (params?.model) query.set("model", params.model);
-    if (params?.videoModel) query.set("videoModel", params.videoModel);
+    if (imageModel) query.set("imageModel", imageModel);
+    if (videoModel) query.set("videoModel", videoModel);
     if (params?.ttsModel) query.set("ttsModel", params.ttsModel);
     const qs = query.toString();
     const r = await callAccount<CapabilitiesResponse>(
@@ -1324,6 +1346,11 @@ export const mediaCapabilitiesToolDefinition = {
 
     const { image, video, model3d, sfx, speech, privacy } = r.data;
     const lines = describeImageVideo(image, video);
+    // An older server ignores `?imageModel=` and reports the account default; say so
+    // rather than let the agent read that model's price as the chosen one's.
+    if (imageModel && image?.model && image.model !== imageModel) {
+      lines.push(`  (generate_image will use ${imageModel}; this server described the account default instead)`);
+    }
 
     lines.push(...describeModel3d(model3d));
     lines.push(...describeSfx(sfx));
@@ -1773,13 +1800,13 @@ export const generateSpriteToolDefinition = {
       }),
     ),
     model: Type.Optional(
-      Type.String({ description: "Video model id to render the motion with. Omit for the account default." }),
+      Type.String({ description: "Video model id to render the motion with. Omit for the one chosen with /video-model, or the account default." }),
     ),
     image_model: Type.Optional(
       Type.String({
         description:
           "Image model id used to TURN the picture to face each direction, e.g. " +
-          "'google/gemini-3.1-flash-image'. Omit for the account default. Only used when " +
+          "'google/gemini-3.1-flash-image'. Omit for the one chosen with /image-model, or the account default. Only used when " +
           "`directions` is 'four' or 'eight' — 'one' renders no turns and never touches an image " +
           "model. Worth setting when a run fails with SPRITE_IMAGE_MODEL_UNAVAILABLE: that is the " +
           "image provider being down, not the request being wrong, and naming another model here " +
@@ -1859,8 +1886,8 @@ export const generateSpriteToolDefinition = {
             const guessed = guessResPath(cwd, params.dir);
             return guessed ? { res_path: guessed } : {};
           })()),
-        ...(params.model ? { model: params.model } : {}),
-        ...(params.image_model ? { image_model: params.image_model } : {}),
+        ...((m) => (m ? { model: m } : {}))(effectiveMediaModel("video", params.model)),
+        ...((m) => (m ? { image_model: m } : {}))(effectiveMediaModel("image", params.image_model)),
       },
     });
     if (!submitted.ok) return text(`Sprite generation failed: ${submitted.message}`);

package/src/tools/mediaModelCommands.ts

@@ -0,0 +1,175 @@
+// `/image-model` and `/video-model` — choose which model the media tools generate with
+// on this machine when the agent doesn't name one (see config/mediaModels.ts for where
+// the choice lives and why it is per machine rather than written to the account).
+//
+//   /image-model            open a picker over the account's live image catalog
+//   /image-model <id>       set it directly (checked against that catalog)
+//   /image-model default    clear it — back to the account default
+//
+// The catalog is the same list the app's own picker reads
+// (GET /api/models/openrouter?action=imageGen|videoGen), so the terminal can never
+// offer a model the account can't reach. Each row carries its privacy posture, because
+// a ZDR account choosing a non-ZDR model will have every generation refused — better
+// to see that in the picker than as a failed call later.
+import { apiRequest } from "../auth/privateer.ts";
+import { mediaModelPref, setMediaModelPref, type MediaKind } from "../config/mediaModels.ts";
+
+export interface CatalogModel {
+  id: string;
+  name?: string;
+  isZdr?: boolean;
+  isTee?: boolean;
+  supportedDurations?: number[] | null;
+  generateAudio?: boolean | null;
+  supportsImageToVideo?: boolean;
+}
+
+const ACTION: Record<MediaKind, string> = { image: "imageGen", video: "videoGen" };
+const RESET = new Set(["default", "reset", "clear", "none", "account"]);
+
+export async function fetchMediaCatalog(
+  kind: MediaKind,
+): Promise<{ ok: true; models: CatalogModel[] } | { ok: false; message: string }> {
+  let res: Response;
+  try {
+    res = await apiRequest(`/api/models/openrouter?action=${ACTION[kind]}`, { method: "GET" });
+  } catch (e) {
+    return { ok: false, message: `could not reach Privateer: ${e instanceof Error ? e.message : String(e)}` };
+  }
+  if (!res.ok) {
+    if (res.status === 401) return { ok: false, message: "not signed in — run /login first" };
+    return { ok: false, message: `Privateer returned ${res.status}` };
+  }
+  try {
+    const body = (await res.json()) as { models?: CatalogModel[] };
+    // OpenRouter's auto routers ride along in the image-output list but pick a CHAT
+    // model per request — not something a generation can be pinned to.
+    const models = (body.models ?? []).filter(
+      (m) => m && typeof m.id === "string" && m.id && !m.id.startsWith("openrouter/"),
+    );
+    return { ok: true, models };
+  } catch {
+    return { ok: false, message: "Privateer returned a malformed model list" };
+  }
+}
+
+/** "3-15s" for a contiguous run of whole seconds, "5/10s" otherwise. Pure. */
+export function formatDurations(d: number[]): string {
+  const s = [...new Set(d)].sort((a, b) => a - b);
+  const contiguous = s.length > 2 && s.every((v, i) => i === 0 || v === s[i - 1] + 1);
+  return contiguous ? `${s[0]}-${s[s.length - 1]}s` : `${s.join("/")}s`;
+}
+
+/** One picker row: name, id, posture, and for video what the model can do. Pure. */
+export function describeCatalogRow(m: CatalogModel, kind: MediaKind, current?: string): string {
+  const posture = m.isTee ? "confidential" : m.isZdr ? "ZDR" : "non-ZDR";
+  const tags = [posture];
+  if (kind === "video") {
+    if (m.supportedDurations?.length) tags.push(formatDurations(m.supportedDurations));
+    if (m.supportsImageToVideo) tags.push("first frame");
+    if (m.generateAudio) tags.push("audio");
+  }
+  const name = m.name && m.name !== m.id ? `${m.name}  ` : "";
+  return `${m.id === current ? "● " : "  "}${name}${m.id}  (${tags.join(", ")})`;
+}
+
+const LABEL: Record<MediaKind, string> = { image: "Image", video: "Video" };
+
+function nonZdrWarning(m: CatalogModel | undefined): string {
+  return m && !m.isZdr && !m.isTee
+    ? " — non-ZDR: refused if this account requires Zero Data Retention for media (Settings → Privacy)"
+    : "";
+}
+
+interface Ui {
+  notify?: (msg: string, level?: string) => void;
+  select?: (title: string, options: string[]) => Promise<string | undefined>;
+}
+
+/**
+ * The whole command, minus registration — exported so tests can drive it with a fake
+ * ui and a stubbed catalog.
+ */
+export async function runMediaModelCommand(
+  kind: MediaKind,
+  args: string,
+  ui: Ui | undefined,
+  catalog: (kind: MediaKind) => ReturnType<typeof fetchMediaCatalog> = fetchMediaCatalog,
+): Promise<void> {
+  const say = (msg: string, level = "info") => ui?.notify?.(msg, level);
+  const label = LABEL[kind];
+  const current = mediaModelPref(kind);
+  const arg = String(args ?? "").trim();
+
+  if (RESET.has(arg.toLowerCase())) {
+    setMediaModelPref(kind, null);
+    say(`${label} model: account default${current ? ` (was ${current})` : ""}`);
+    return;
+  }
+
+  const list = await catalog(kind);
+
+  if (arg) {
+    // A typed id is checked against the live catalog when we can read it — a typo
+    // saved here would fail every later generation. When the catalog is unreachable
+    // it is saved anyway, with that said: the server still refuses an id it can't serve.
+    if (list.ok) {
+      const hit = list.models.find((m) => m.id === arg) ?? list.models.find((m) => m.id.toLowerCase() === arg.toLowerCase());
+      if (!hit) {
+        const near = list.models.filter((m) => m.id.toLowerCase().includes(arg.toLowerCase())).slice(0, 5);
+        say(
+          `No ${kind} model "${arg}" on this account.` +
+            (near.length ? ` Did you mean: ${near.map((m) => m.id).join(", ")}?` : ` Run /${kind}-model to browse.`),
+          "warning",
+        );
+        return;
+      }
+      setMediaModelPref(kind, hit.id);
+      say(`${label} model: ${hit.id}${nonZdrWarning(hit)}`);
+      return;
+    }
+    setMediaModelPref(kind, arg);
+    say(`${label} model: ${arg} (couldn't check it against the catalog: ${list.message})`, "warning");
+    return;
+  }
+
+  if (!list.ok) {
+    say(`Couldn't list ${kind} models: ${list.message}`, "error");
+    return;
+  }
+  if (!list.models.length) {
+    say(`This account has no ${kind} models available.`, "warning");
+    return;
+  }
+  if (!ui?.select) {
+    say(`${label} model: ${current ?? "account default"}. Set one with /${kind}-model <id>.`);
+    return;
+  }
+
+  const DEFAULT_ROW = `${current ? "  " : "● "}Account default`;
+  const rows = list.models.map((m) => describeCatalogRow(m, kind, current));
+  const picked = await ui.select(`${label} model for generate_${kind} — current: ${current ?? "account default"}`, [
+    DEFAULT_ROW,
+    ...rows,
+  ]);
+  if (picked === undefined) return;
+  if (picked === DEFAULT_ROW) {
+    setMediaModelPref(kind, null);
+    say(`${label} model: account default`);
+    return;
+  }
+  const chosen = list.models[rows.indexOf(picked)];
+  if (!chosen) return;
+  setMediaModelPref(kind, chosen.id);
+  say(`${label} model: ${chosen.id}${nonZdrWarning(chosen)}`);
+}
+
+export function registerMediaModelCommands(pi: { registerCommand?: (name: string, opts: unknown) => void }): void {
+  for (const kind of ["image", "video"] as const) {
+    pi.registerCommand?.(`${kind}-model`, {
+      description: `Choose the model generate_${kind} uses on this machine (default = the account's)`,
+      argumentHint: "[model id | default]",
+      handler: (args: string, ctx: any) => runMediaModelCommand(kind, args, ctx?.ui),
+    });
+  }
+}