privateer-agent 0.12.58 → 0.14.0

package/README.md

@@ -54,6 +54,10 @@ Privateer runs in three places, over one account and one config: the **terminal*
 - **Privacy you can verify, not just trust.** Confidential-enclave (TEE) inference is
   cryptographically **attested** — not a policy promise — and an **on-device PII gate**
   warns before structured personal data ever leaves your machine for an unverified model.
+- **A private subagent for your other agents.** Claude Code, Codex, or your own orchestrator
+  can hand Privateer the files it shouldn't read itself: `privateer -p --private "…"` reads
+  them on your machine, reasons over them in an attested enclave, and returns only the
+  answer. See [Hand off sensitive work](#hand-off-sensitive-work-to-privateer).
 - **It's Pi underneath.** Privateer is a distribution of the [Pi](https://pi.dev) coding agent —
   every Pi extension, skill, and command works, and Privateer's own features are just extensions
   you can read, swap, or build on. Nothing to compile. See [Built on Pi](#built-on-pi).
@@ -126,6 +130,9 @@ silently. The moat is swappable; the floor under it holds.
   and the mic closes when you stop talking. Your OS voice by default — nothing leaves the
   machine — or your account's confidential-compute TTS/STT once you sign in. `/talk loop on`
   makes it hands-free. See [Talk to it](#talk-to-it--voice-both-directions).
+- **Named terminals.** The agent can open windows you watch — a dev server, a REPL, a second
+  agent — give each a name, and bring any of them to the front; `/term api` switches you there
+  yourself. macOS Terminal, iTerm2, and tmux anywhere. See [Named terminals](#named-terminals).
 - **MCP servers, sub-agents & skills.** Connect Model Context Protocol servers (local stdio
   or remote HTTP with OAuth) with [`/connect`](#connectors--mcp), delegate work to bounded
   parallel sub-agents, and drop in skills — all gated like everything else.
@@ -359,8 +366,9 @@ One caveat while the account endpoints catch up: `/speak rate` and `/talk vocab`
 by the local and OpenAI-compatible engines, not yet by the account's TTS/STT.
 
 Voice is **off by default and interactive-only** — harbor, ACP and channel sessions never
-speak. The mic opens only on something you did (`/talk`, the push-to-talk key, or a
-conversation turn you switched on); there is no wake word, capture is hard-capped, audio is
+speak. The mic opens only on something you did (`/talk`, the push-to-talk key, a
+conversation turn you switched on, or switching to a window while dictation or conversation
+mode is on); there is no wake word, capture is hard-capped, audio is
 held in memory and never written to disk, and a mis-heard transcript is still just a prompt —
 every tool call it leads to hits the same permission gate as anything you type. Recording
 needs a capture tool on PATH: `sox` anywhere, or `arecord`/`parecord`/`ffmpeg` on Linux,
@@ -368,6 +376,37 @@ needs a capture tool on PATH: `sox` anywhere, or `arecord`/`parecord`/`ffmpeg` o
 standalone [`privateer-speak`](https://www.npmjs.com/package/privateer-speak) package, usable
 in any Pi agent.
 
+## Named terminals
+
+Ask for "a terminal running the dev server" and the agent opens a new window, names it, and
+puts it in front of you. Every Privateer window names itself too (after its folder, or the
+name the agent gave it), so you and the agent can hop between them by name:
+
+```
+/term                  pick a terminal to switch to
+/term api              switch to "api"
+/term open api npm run dev    open one yourself
+/term name backend     rename this window
+/term close api        close it, ending what runs there
+/term list             every named terminal (← marks this one)
+```
+
+The agent does the same through its `terminal` tool. Opening a window with a command goes
+through the permission gate exactly like running that command in bash; switching and listing
+don't ask. The agent can't read what a window prints: that's what bash and background tasks
+are for. These windows are for you.
+
+Voice follows you between windows. Every window shares one voice setup, so with
+dictation or conversation mode on, the window you switch to listens for your next prompt,
+including a new agent the moment its window opens in front. The window you left pauses
+its mic. (That's [privateer-speak](https://www.npmjs.com/package/privateer-speak)'s focus
+awareness; it needs a terminal that reports focus.)
+
+Works in **macOS Terminal**, **iTerm2**, and inside **tmux** on any platform; other terminals
+get told so. macOS may ask once for permission to let the terminal control itself. Names are
+shared across every Privateer on the machine (`~/.privateer/terminals.json`), and a window
+that's been closed drops off the list on its own.
+
 ## The Privateer app
 
 The same account drives Privateer from **iOS, Android, [the web app](https://privateer.pro),
@@ -510,6 +549,8 @@ setup, config, and limitations: [`docs/acp.md`](docs/acp.md).
 Driving Privateer from **your own program or agent**? ACP is how that program gets asked:
 every approval arrives as a `session/request_permission` call it answers. The wire format,
 option ids and a minimal client are in [`docs/acp.md`](docs/acp.md#driving-privateer-from-another-agent).
+Handing it data your program shouldn't see? Set `"private": true` in the `acp` block; see
+[Hand off sensitive work](#hand-off-sensitive-work-to-privateer).
 
 ### One-shot runs (`-p`) and spending
 
@@ -531,6 +572,36 @@ call. `media_capabilities` shows the same prices. A call that can't be priced is
 under a dollar cap rather than let through. `--approve-in-app` reaches the app while it's
 open or running in the background.
 
+## Hand off sensitive work to Privateer
+
+Your coding agent's context goes to its provider. When a task touches files that
+shouldn't (patient records, a customer export, payroll, a database dump), the agent can
+hand that part to Privateer instead of reading the files itself:
+
+```bash
+privateer -p --private --model privateer/tinfoil/gemma4-31b \
+  "Read customers/export.csv. Reply with the number of customers per country. No row-level data."
+```
+
+The calling agent passes file *names*. Privateer reads the files on this machine, reasons
+over them on a verified-private model, and prints only the answer. `--private` is what
+makes that a guarantee rather than a hope:
+
+- **No file reaches an unverified model.** Before every tool call the model must be
+  `tee-verified` (an enclave quote Privateer checked itself) or `local`. A ZDR route, a
+  standard provider, or a failed attestation refuses the tool.
+- **Nothing leaves through a tool.** Only on-machine tools run. Web, MCP, media, uploads
+  and network shell commands (`curl`, `ssh`, `git push`, …) are refused.
+- **Nothing lifts it.** It sits above permission modes and approvals, `--no-quarter`
+  included, and subagents inherit it.
+- **The caller sees only the answer.** `-p` prints the reply. `--private --mode json`,
+  which would stream the file contents, is refused.
+
+The reply itself is the one channel left, so ask for aggregates, yes/no answers, or a
+summary, and have Privateer write detail to a file. Setup for Claude Code and other agents,
+the ACP route for your own programs, prompt patterns, and the honest limits are in
+[`docs/private-handoff.md`](docs/private-handoff.md).
+
 ## Connectors — MCP
 
 Privateer is an **MCP client**. Point it at a [Model Context Protocol](https://modelcontextprotocol.io)
@@ -702,7 +773,10 @@ agent is stuck),
 `privateer acp` (serve the agent to an ACP host like Buzz or Zed — see
 [`docs/acp.md`](docs/acp.md)), `privateer auth status` (is this machine signed in?),
 `privateer -p … [--allow-spend …] [--approve-in-app]` (see
-[one-shot runs](#one-shot-runs--p-and-spending)), `privateer --no-quarter`, `privateer --version`.
+[one-shot runs](#one-shot-runs--p-and-spending)), `privateer --private` (tools run only on a
+verified-private model and never reach the network; see
+[Hand off sensitive work](#hand-off-sensitive-work-to-privateer)), `privateer --no-quarter`,
+`privateer --version`.
 An unknown subcommand of `auth` is an error. It is never sent to the model as a prompt.
 
 ## Develop

package/bin/headless-flags.d.mts

@@ -6,6 +6,7 @@ export const BILLED_TOOLS: string[];
 export const CLI_SPEND_ENV: string;
 export const APPROVE_IN_APP_ENV: string;
 export const PI_SUBCOMMANDS: string[];
+export const PRIVATE_ENV: string;
 
 export interface CliSpendGrant {
   tools: string[];
@@ -22,4 +23,10 @@ export function extractHeadlessFlags(args: string[]): {
   error?: string;
 };
 
+/** Strips `--private` out of `args` in place; true when it was there. */
+export function extractPrivateFlag(args: string[]): boolean;
+
+/** Why these args can't run under --private, or null. */
+export function privateProblem(args: string[]): string | null;
+
 export function authProblem(args: string[], cmd?: string): string | null;

package/bin/headless-flags.mjs

@@ -137,6 +137,46 @@ export function extractHeadlessFlags(args) {
   };
 }
 
+/** The env var carrying `--private` (permissions/privateMode.ts) into every gate. */
+export const PRIVATE_ENV = "PRIVATEER_PRIVATE";
+
+/**
+ * Strip `--private` from `args` (in place). Returns true when it was there.
+ *
+ * Valid for any launch — the TUI, `-p`, `acp` — because it only ever makes a run
+ * stricter: tools run only while the model is verified-private, and only tools that
+ * stay on this machine. Unlike the spend env vars, an exported PRIVATEER_PRIVATE is
+ * honoured too, for the same reason.
+ */
+export function extractPrivateFlag(args) {
+  let found = false;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--") break;
+    if (args[i] === "--private") {
+      args.splice(i, 1);
+      i--;
+      found = true;
+    }
+  }
+  return found;
+}
+
+/**
+ * Why these args can't run in private mode, or null. `--mode json` streams every event
+ * to stdout, tool results included — the contents of every file the run read, handed to
+ * the very caller private mode exists to keep them from. `-p` prints only the answer.
+ */
+export function privateProblem(args) {
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") break;
+    if ((a === "--mode" && args[i + 1] === "json") || a === "--mode=json") {
+      return "--private can't be combined with --mode json: JSON mode streams every tool result (the files this run reads) to stdout. Use -p, which prints only the answer, or `privateer acp`.";
+    }
+  }
+  return null;
+}
+
 // Pi's own subcommands. Pi recognizes each only as args[0], so the launcher must hand
 // them over with NOTHING in front — the normal launch prepends --model, -e and --skill,
 // which is exactly how `privateer auth check` used to become a chat message.

package/bin/privateer-launch.mjs

@@ -29,7 +29,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 import { routeUpdate } from "./update-route.mjs";
-import { APPROVE_IN_APP_ENV, CLI_SPEND_ENV, PI_SUBCOMMANDS, authProblem, extractHeadlessFlags } from "./headless-flags.mjs";
+import { APPROVE_IN_APP_ENV, CLI_SPEND_ENV, PI_SUBCOMMANDS, PRIVATE_ENV, authProblem, extractHeadlessFlags, extractPrivateFlag, privateProblem } from "./headless-flags.mjs";
 import { runToCompletion } from "./run-to-completion.mjs";
 import { filterRespawnArgs, listTerminals, requestFresh, runSupervised } from "./fresh-supervisor.mjs";
 import { configureCompileCache } from "./startup-cache.mjs";
@@ -248,6 +248,16 @@ delete process.env[APPROVE_IN_APP_ENV];
   if (headless.spend) process.env[CLI_SPEND_ENV] = JSON.stringify(headless.spend);
   if (headless.approveInAppMs) process.env[APPROVE_IN_APP_ENV] = String(headless.approveInAppMs);
 }
+// --private: NOT cleared from the inherited env first, unlike the two above — it can only
+// tighten a run, so an orchestrator exporting it for every child is the point.
+if (extractPrivateFlag(args)) process.env[PRIVATE_ENV] = "1";
+if (/^(1|true|yes)$/i.test((process.env[PRIVATE_ENV] ?? "").trim())) {
+  const problem = privateProblem(args);
+  if (problem) {
+    process.stderr.write(`privateer: ${problem}\n`);
+    process.exit(2);
+  }
+}
 
 const sub = args[0];
 

package/extensions/privateer-brand.ts

@@ -281,17 +281,21 @@ function contextLine(p: Palette): string {
 }
 
 // ── "What's New" — a tiny in-banner changelog ────────────────────────────────
-// A hand-curated highlights list (newest first). Not the full changelog — just the two
-// or three things a returning user should notice. `cmd`, when present, is rendered in the
-// accent color so the actionable bit stands out from the prose. Trim this as it ages.
-const WHATS_NEW: Array<{ text: string; cmd?: string }> = [
-  { text: "Searchable model picker —", cmd: "/models" },
-  { text: "Start over with a new agent —", cmd: "/fresh" },
-  { text: "Text-only models can read images now" },
-  { text: "Live crypto prices and Solana wallets" },
-];
+// A hand-curated highlights list (newest first), kept in src/config/whatsNew.json so the
+// release guard (scripts/check-whats-new.mjs) can read it without loading the TUI. Not the
+// full changelog — just the two to four things a returning user should notice. `cmd`, when
+// present, is rendered in the accent color so the actionable bit stands out from the prose.
+const WHATS_NEW: Array<{ text: string; cmd?: string }> = (() => {
+  try {
+    const list = JSON.parse(readFileSync(new URL("../src/config/whatsNew.json", import.meta.url), "utf8"));
+    return Array.isArray(list?.items) ? list.items : [];
+  } catch {
+    return []; // a banner without the list beats no banner
+  }
+})();
 
 function whatsNewRows(p: Palette): string[] {
+  if (!WHATS_NEW.length) return [];
   const head = `${p.BOLD}${p.INK}✦ What's new${p.RESET}`;
   const items = WHATS_NEW.map(
     ({ text, cmd }) =>
@@ -322,7 +326,8 @@ function renderBanner(width: number, p: Palette, mark: string[], modelProvider?:
   const packs = packNotice(p);
   if (packs) text.push(packs);
   // A blank spacer, then the What's New block — set off below the identity lines.
-  text.push("", ...whatsNewRows(p));
+  const news = whatsNewRows(p);
+  if (news.length) text.push("", ...news);
 
   // Zip the mark and the text column by row. Rows past the mark's height get a blank
   // gutter of the mark's width, so the text stays in one column throughout.

package/extensions/privateer-gate.ts

@@ -40,6 +40,7 @@ import { updatePostureBadge } from "./privateer-posture.ts";
 import { childSpendAllows } from "../src/permissions/childSpend.ts";
 import { CliSpendLedger, headlessSpendGuidance, isSpendRequest, readCliSpendGrant } from "../src/permissions/cliSpend.ts";
 import { BILLED_MEDIA_TOOLS } from "../src/permissions/classify.ts";
+import { privateModeFromEnv } from "../src/permissions/privateMode.ts";
 import type { PermissionRequest } from "../src/permissions/gate.ts";
 import { HeadlessAppApprover } from "../src/remote/headlessApproval.ts";
 import { describeErrorText } from "../src/engine/errors.ts";
@@ -694,7 +695,9 @@ export default function privateerControl(pi: any): void {
   // prompt, before it plans). Quiet when nothing billable is enabled, or when no quarter
   // lifts the gate anyway.
   function uncoveredBilledTools(): string[] {
-    if (noQuarterActive()) return [];
+    // Private mode refuses every billed tool outright (they send text off the machine),
+    // so "add --allow-spend" would be advice that cannot work.
+    if (noQuarterActive() || privateModeFromEnv()) return [];
     const active: string[] = (() => {
       try {
         return pi.getActiveTools?.() ?? [];
@@ -750,6 +753,25 @@ export default function privateerControl(pi: any): void {
   });
   pi.on("session_shutdown", () => appApprover?.close());
 
+  // Private mode (src/permissions/privateMode.ts), told to the model before it plans:
+  // otherwise it reaches for web_search, gets refused, and narrates the refusal instead
+  // of doing the local work. And the reply is the one channel the gate can't close, so
+  // the model is asked to keep raw records out of it — a request, not a control.
+  pi.on("before_agent_start", (event: any) => {
+    if (!privateModeFromEnv()) return;
+    return {
+      systemPrompt:
+        `${event.systemPrompt}\n\n# Private mode\n` +
+        "This run handles data that must not leave this machine except through a verified-private model. " +
+        "Only local tools work: read, grep, find, ls, write, edit, and shell commands that don't use the network. " +
+        "Web, MCP, media and upload tools, and network commands, are refused. Every tool is refused if the model " +
+        "can't be verified as private; if that happens, stop and say so.\n" +
+        "Your reply leaves private mode: whoever asked will see it. Answer exactly what was asked. Don't quote raw " +
+        "records, names, emails, identifiers or other personal data from the files unless the task explicitly asks " +
+        "for them. When asked for detail, write it to a file and reply with the path.",
+    };
+  });
+
   // Print mode prints a failed turn's raw SDK text — "401 status code (no body)",
   // "Connection error." — and exits. Follow it with what that means and what to do,
   // on stderr so stdout stays the answer (or the JSON stream).

package/extensions/privateer-speak.ts

@@ -61,6 +61,7 @@ import {
 } from "privateer-speak";
 import { apiRequest, hasCredentials } from "../src/auth/privateer.ts";
 import { globalDir } from "../src/config/paths.ts";
+import { thisTerminalIsFront } from "../src/terminals/index.ts";
 import { VOICE_DESCRIPTIONS } from "./speak-voices.data.ts";
 
 const QWEN3_TTS_VOICES = ["serena", "aiden", "dylan", "eric", "ono_anna", "ryan", "sohee", "uncle_fu", "vivian"];
@@ -358,7 +359,14 @@ export default function privateerSpeak(pi: any): void {
   // voiceCommands: saying one of these AS THE WHOLE UTTERANCE runs /fresh (see
   // extensions/privateer-fresh.ts) instead of sending the words to the model. Whole
   // utterance only, so "why did the fresh start fail" is still a question.
-  makePiSpeakExtension({ configFile: join(globalDir(), "speak.json"), voiceCommands: VOICE_COMMANDS })(pi);
+  // isFocused: a window that has just started (say, one the agent opened with the
+  // terminal tool) asks Terminal/iTerm2 whether it's in front, so a hands-free mode
+  // carries on in the new agent without a keypress — see src/terminals/.
+  makePiSpeakExtension({
+    configFile: join(globalDir(), "speak.json"),
+    voiceCommands: VOICE_COMMANDS,
+    isFocused: thisTerminalIsFront,
+  })(pi);
 }
 
 const VOICE_COMMANDS: Record<string, string> = {

package/extensions/privateer-terminals.ts

@@ -0,0 +1,73 @@
+// Named terminals — the `terminal` tool and /term, so the agent can open windows the
+// user watches (a dev server, a REPL, a second agent) and either of them can switch
+// between those windows by name. See src/terminals/ for how windows are found and why
+// only tmux, macOS Terminal and iTerm2 are driven.
+//
+// Interactive only: the window registers itself at session start, which a harbor or ACP
+// host has no window to do, and the tool refuses without a UI.
+
+import { closeTerminal, describeListing, focusTerminal, openTerminal, renameSelf, terminalListing, backend, claimSelf } from "../src/terminals/index.ts";
+import { terminalToolDefinition } from "../src/tools/terminal.ts";
+
+const USAGE =
+  "/term — pick a terminal to switch to · /term <name> — switch · /term open <name> [command] · " +
+  "/term name <name> — rename this one · /term close <name> · /term list";
+
+export default function privateerTerminals(pi: any): void {
+  pi.registerTool?.(terminalToolDefinition);
+
+  // Name this window as soon as the session starts, so it can be switched back to from
+  // any other — not only after its first /term.
+  pi.on?.("session_start", (_e: any, ctx: any) => {
+    if (!ctx?.hasUI) return;
+    const b = backend();
+    if ("unsupported" in b) return;
+    void claimSelf(b, ctx.cwd ?? process.cwd()).catch(() => undefined);
+  });
+
+  pi.registerCommand?.("term", {
+    description: "Switch between named terminals, or open one",
+    handler: async (args: string, ctx: any) => {
+      const notify = (m: string, kind: "info" | "warning" | "error" = "info") => ctx?.ui?.notify?.(m, kind);
+      const cwd = ctx?.cwd ?? process.cwd();
+      const [sub = "", ...rest] = String(args ?? "").trim().split(/\s+/).filter(Boolean);
+      const report = (o: { ok: boolean; message: string }) => notify(o.message, o.ok ? "info" : "warning");
+
+      switch (sub.toLowerCase()) {
+        case "": {
+          const l = await terminalListing(cwd);
+          if ("unsupported" in l) return notify(l.unsupported, "warning");
+          const others = l.records.filter((r) => r.id !== l.selfId);
+          if (!others.length) return notify(`No other named terminals. ${USAGE}`);
+          if (typeof ctx?.ui?.select !== "function") return notify(describeListing(l));
+          const labels = others.map((r) => `${r.name}  ${r.command ?? r.cwd}`);
+          const picked = await ctx.ui.select("Switch to terminal", labels);
+          const rec = picked ? others[labels.indexOf(picked)] : undefined;
+          if (rec) report(await focusTerminal(rec.name, cwd));
+          return;
+        }
+        case "list": {
+          const l = await terminalListing(cwd);
+          return notify("unsupported" in l ? l.unsupported : describeListing(l), "unsupported" in l ? "warning" : "info");
+        }
+        case "open": {
+          const [name, ...cmd] = rest;
+          if (!name) return notify("Usage: /term open <name> [command]", "warning");
+          return report(await openTerminal({ name, cwd, ...(cmd.length ? { command: cmd.join(" ") } : {}) }));
+        }
+        case "name":
+        case "rename":
+          if (!rest.length) return notify("Usage: /term name <name>", "warning");
+          return report(await renameSelf(rest.join(" "), cwd));
+        case "close":
+          if (!rest.length) return notify("Usage: /term close <name>", "warning");
+          return report(await closeTerminal(rest.join(" "), cwd));
+        case "help":
+          return notify(USAGE);
+        default:
+          // Anything else is a name: /term api, /term "dev server".
+          return report(await focusTerminal([sub, ...rest].join(" "), cwd));
+      }
+    },
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.58",
+  "version": "0.14.0",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -64,6 +64,7 @@
     "dev": "node bin/privateer-launch.mjs",
     "dev:fresh": "PRIVATEER_HOME=\"$PWD/.dev-home\" node bin/privateer-launch.mjs",
     "typecheck": "tsc --noEmit",
+    "check:whats-new": "node scripts/check-whats-new.mjs",
     "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
   },
   "engines": {
@@ -86,7 +87,7 @@
     "pi-privacy": "0.14.1",
     "pi-subagents": "0.70.0",
     "picomatch": "4.0.5",
-    "privateer-speak": "0.6.0",
+    "privateer-speak": "0.7.0",
     "privateer-workflow": "0.1.0",
     "tinfoil": "1.1.11",
     "tsx": "4.23.0",

package/src/acp/run.ts

@@ -21,7 +21,8 @@
 //       "model":   "openrouter/openai/gpt-4o-mini",   // optional
 //       "tools":   ["read","grep","find","ls"],        // optional ceiling
 //       "posture": "approve",                          // readonly | approve | auto
-//       "cwd":     "/path/to/project"        // optional; else this process's cwd
+//       "cwd":     "/path/to/project",       // optional; else this process's cwd
+//       "private": true                         // optional; see permissions/privateMode.ts
 //     }
 //   }
 //
@@ -115,6 +116,10 @@ export async function runAcp(): Promise<void> {
     : (web ? [...SAFE_TOOLS, ...WEB_TOOLS] : [...SAFE_TOOLS]);
   const posture: Posture = normalizePosture(block.posture) ?? "approve";
   const baseCwd: string = block.cwd ?? process.cwd();
+  // Private mode: `acp.private`, or `privateer acp --private` / PRIVATEER_PRIVATE (read by
+  // the gate itself). The handoff surface for an agent that must not see the data.
+  const { privateModeFromEnv, modelTier, PRIVATE_TIERS } = await import("../permissions/privateMode.ts");
+  const privateMode: boolean = block.private === true || privateModeFromEnv();
 
   // The gate. Identical posture semantics to the channels runtime: "readonly" maps to
   // plan mode (hard-deny writes), "auto" relaxes non-dangerous actions, and every ask
@@ -129,6 +134,7 @@ export async function runAcp(): Promise<void> {
     confineToCwd: true,
     getRemote: () => true,
     getAutoApprove: () => posture === "auto",
+    getPrivate: () => privateMode,
     async localAsk() {
       return "deny";
     },
@@ -272,8 +278,22 @@ export async function runAcp(): Promise<void> {
   const modelCount = listModels()?.available.length ?? 0;
   log(
     `ready — model ${defaultModel}, ${modelCount} selectable, ` +
-      `ceiling [${tools.join(", ")}], posture ${posture}`,
+      `ceiling [${tools.join(", ")}], posture ${posture}${privateMode ? ", PRIVATE" : ""}`,
   );
+  // Say up front when private mode will refuse every tool, rather than letting the
+  // caller find out from its first denial. The gate re-checks per call regardless.
+  if (privateMode) {
+    try {
+      const tier = await modelTier({ provider: model.provider, id: model.id, baseUrl: model.baseUrl });
+      log(
+        PRIVATE_TIERS.has(tier)
+          ? `private mode: ${defaultModel} is ${tier}`
+          : `private mode: ${defaultModel} is ${tier}, NOT verified-private — every tool will be refused. Pick a TEE or local model.`,
+      );
+    } catch (e) {
+      log(`private mode: could not verify ${defaultModel} (${e instanceof Error ? e.message : String(e)}) — tools will be refused until it verifies`);
+    }
+  }
 
   // One Pi session per ACP session. A single subscription routes streamed text into a
   // mutable holder, which the running turn owns — safe because a session runs at most
@@ -353,7 +373,12 @@ export async function runAcp(): Promise<void> {
           // its own `hasConfiguredAuth` precheck before it emits `before_agent_start`,
           // where providers/account.ts installs the equivalent net.
           await ensureAccountArmed(currentProvider);
-          await session.prompt(text);
+          // Prompt text is the HOST's, so it is never a command: with expansion on, Pi
+          // runs a leading `/name` as an extension command, and anyone who can post to
+          // the host (a Buzz channel, a calling agent) could send `/privacy off` or
+          // `/privacy allow *` — the second persisted to config.json. Text goes to the
+          // model as text.
+          await session.prompt(text, { expandPromptTemplates: false });
         } catch (e) {
           return { ok: false, error: e instanceof Error ? e.message : String(e) };
         } finally {
@@ -371,7 +396,7 @@ export async function runAcp(): Promise<void> {
 
   let agent: InstanceType<typeof PrivateerAcpAgent> | undefined;
   new AgentSideConnection((conn) => {
-    agent = new PrivateerAcpAgent(conn, { createSession, models: listModels, onLog: log });
+    agent = new PrivateerAcpAgent(conn, { createSession, models: listModels, onLog: log, private: privateMode });
     return agent;
   }, stream);
 

package/src/channels/run.ts

@@ -332,7 +332,12 @@ async function main() {
         // in providers/account.ts hangs off `before_agent_start`, which pi's prompt()
         // never reaches — it throws on its own `hasConfiguredAuth` precheck first.
         if (model?.provider === "privateer") await ensureAccountArmed(undefined);
-        await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () => session.prompt(text));
+        // A chat message is never a command: with expansion on, Pi runs a leading
+        // `/name` as an extension command, so any chat member could send `/privacy off`
+        // or `/privacy allow *` (persisted to config.json). Same rule as ACP.
+        await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () =>
+          session.prompt(text, { expandPromptTemplates: false }),
+        );
       } catch (e) {
         return { ok: false, error: e instanceof Error ? e.message : String(e) };
       } finally {

package/src/config/moatManifest.json

@@ -20,6 +20,7 @@
     { "entry": "extensions/privateer-media.ts", "name": "privateer-media", "note": "image/video/speech/music + ffmpeg compose" },
     { "entry": "extensions/privateer-computer.ts", "name": "privateer-computer", "note": "screen control — screenshots, mouse and keyboard (off unless armed with --allow-computer-control)" },
     { "entry": "extensions/privateer-desktop.ts", "name": "privateer-desktop", "note": "/desktop — open the Privateer desktop app" },
+    { "entry": "extensions/privateer-terminals.ts", "name": "privateer-terminals", "note": "named terminal windows — the terminal tool + /term to switch between them" },
     { "entry": "extensions/privateer-hints.ts", "name": "privateer-hints", "note": "rotating tips in the working line + /hints" },
     { "entry": "extensions/privateer-update.ts", "name": "privateer-update", "note": "tool pack updates in place — banner flag + /update" },
     { "entry": "extensions/privateer-fresh.ts", "name": "privateer-fresh", "note": "/fresh — replace the agent with a new one and stop everything it started" },

package/src/config/whatsNew.json

@@ -0,0 +1,10 @@
+{
+  "$comment": "The banner's What's New list, newest first: the two to four things a returning user should notice, not a changelog. `reviewedFor` is the release this list was last looked at for. A release can't ship until it equals package.json's version (scripts/check-whats-new.mjs, run by `npm test` and by release.yml before anything builds), so every release, patches included, is a deliberate look at this list. If nothing new is worth a line, bumping `reviewedFor` alone is the answer. `since` is the release an entry arrived in. `cmd` is shown in the accent colour.",
+  "reviewedFor": "0.14.0",
+  "items": [
+    { "text": "Hand off sensitive files: privateer --private", "since": "0.14.0" },
+    { "text": "Open and switch named terminals —", "cmd": "/term", "since": "0.13.0" },
+    { "text": "Voice follows the window you're in", "since": "0.13.0" },
+    { "text": "Searchable model picker —", "cmd": "/models", "since": "0.12.53" }
+  ]
+}

package/src/ext/permissionGate.ts

@@ -18,6 +18,7 @@ import { classifyToolCall } from "../permissions/classify.ts";
 import { redactText } from "../util/redact.ts";
 import { coauthorGitCommits } from "../util/coauthor.ts";
 import { DEFAULT_DENYLIST } from "../permissions/danger.ts";
+import { privateModeFromEnv, privateRefusal, type ModelRef } from "../permissions/privateMode.ts";
 
 // The per-tool_call hook context we read (structural subset of Pi's ctx — kept
 // local so the gate stays import-order-safe and unit-testable).
@@ -25,6 +26,8 @@ export interface ToolCallCtx {
   signal?: AbortSignal;
   hasUI?: boolean;
   mode?: "tui" | "rpc" | "json" | "print" | string;
+  // The session's current model — what private mode checks before any tool runs.
+  model?: ModelRef;
   // Pi's ExtensionUIContext shape (verified against pi-coding-agent 0.80):
   // select(title, options: string[]) → chosen string | undefined; confirm(title, message).
   ui?: {
@@ -43,6 +46,10 @@ export interface GateController {
   denylist?: string[];
   cwd: string;
   confineToCwd?: boolean;
+  // Unattended confinement: deny outside-cwd and protected access in every mode, and
+  // treat a read of a credential store as protected even inside cwd. See
+  // ModeGate.hardConfine and ScopeOptions.guardSecretReads.
+  hardConfine?: boolean;
   getRemote?(): boolean;
   // The controller raised the flag: total bypass for remote turns — see
   // ModeGate.getNoQuarter.
@@ -54,6 +61,11 @@ export interface GateController {
   // launch flag (env PRIVATEER_NO_QUARTER); when true the gate auto-allows every
   // action with no prompt.
   getSkipAllPermissions?(): boolean;
+  // Private mode (permissions/privateMode.ts): no tool runs unless the session's model is
+  // verified-private, and only tools that stay on this machine run at all. ORed with
+  // PRIVATEER_PRIVATE, which any controller honours, so a controller can switch it on but
+  // never off.
+  getPrivate?(): boolean;
   // Billing tools the operator authorized before this run started, so an unattended
   // session can spend what it was told it may spend instead of denying every media
   // call for want of a human. Lifts `alwaysAsk` and nothing else — see
@@ -138,10 +150,18 @@ export async function decideToolCall(
     };
   }
 
+  // Private mode sits above every mode, allowlist and approval: nothing a person or a
+  // host answers can show a file to an unverified model or send it off the machine.
+  if (ctrl.getPrivate?.() || privateModeFromEnv()) {
+    const refusal = await privateRefusal(toolName, input, ctx.model);
+    if (refusal) return { block: true, reason: refusal };
+  }
+
   const req = classifyToolCall(toolName, input, {
     cwd: ctrl.cwd,
     confineToCwd: ctrl.confineToCwd,
     allowedOutsideRoots: ctrl.allowedOutsideRoots,
+    guardSecretReads: ctrl.hardConfine,
   });
   if (!req) return undefined; // no gate needed — read-only/in-scope/meta
 
@@ -181,6 +201,7 @@ export async function decideToolCall(
     getNoQuarter: ctrl.getNoQuarter,
     getAutoApprove: ctrl.getAutoApprove,
     getSkipAllPermissions: ctrl.getSkipAllPermissions,
+    hardConfine: ctrl.hardConfine,
     isSpendPreauthorized: ctrl.isSpendPreauthorized
       ? (r: PermissionRequest) => ctrl.isSpendPreauthorized!(r, input, ctx.signal)
       : undefined,