privateer-agent 0.12.6 → 0.12.7

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hayden Bulk Tech Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -570,8 +570,9 @@ posts a warning to the transcript, and while it's on the footer carries a perman
 Toggling takes effect from the next gated action — an approval already on screen still
 needs an answer. It's a physical-terminal switch: a phone driving this terminal over
 `/remote-access` can't reach it. The app has its own no-quarter toggle for driven turns,
-which is `bypass` exactly — never less — so dangerous shell and destructive actions
-still surface an Allow there, precisely as they do under `/mode bypass` locally.
+and it means the same thing this flag does: the moat down, dangerous shell and destructive
+actions included — stronger than `/mode bypass`, which keeps those two above it. A hard
+plan-mode deny is the one thing it doesn't talk around.
 
 > shift+tab is Pi's default "cycle thinking level" chord; Privateer takes it for this.
 > Thinking level is still under `/settings`, or bind `app.thinking.cycle` to another key

package/bin/privateer-acp.mjs

@@ -18,7 +18,7 @@
 // process.loadEnvFile and tsx's register() are both silent; keep it that way, and
 // send any diagnostic you add to stderr.
 import { register } from "tsx/esm/api";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -36,5 +36,5 @@ try {
 process.env.PI_SUBAGENT_PI_BINARY ??= resolve(repo, "bin/privateer-subagent.mjs");
 
 register();
-const { runAcp } = await import(resolve(repo, "src/acp/run.ts"));
+const { runAcp } = await import(pathToFileURL(resolve(repo, "src/acp/run.ts")).href);
 await runAcp();

package/bin/privateer-harbor.mjs

@@ -7,7 +7,7 @@
 // Invoked two ways: interactively via the bash launcher (`privateer harbor …`), and
 // by the installed launchd/systemd service (`node privateer-harbor.mjs run`).
 import { register } from "tsx/esm/api";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -26,5 +26,5 @@ try {
 process.env.PI_SUBAGENT_PI_BINARY ??= resolve(repo, "bin/privateer-subagent.mjs");
 
 register();
-const { runHarborCli } = await import(resolve(repo, "src/cli/harborCli.ts"));
+const { runHarborCli } = await import(pathToFileURL(resolve(repo, "src/cli/harborCli.ts")).href);
 await runHarborCli(process.argv.slice(2));

package/bin/privateer-launch.mjs

@@ -341,11 +341,11 @@ else {
   const signedIn = fs.existsSync(CRED);
   // Mirrors TINFOIL_MODEL_ID in src/providers/defaultModel.ts — keep them in step; that
   // file carries the measurements behind the choice.
-  const ACCOUNT_MODEL = "privateer/tinfoil/kimi-k2-6";
+  const ACCOUNT_MODEL = "privateer/tinfoil/gpt-oss-120b";
   const MODEL = process.env.PRIVATEER_MODEL
     ? process.env.PRIVATEER_MODEL
     : haveTinfoilKey()
-      ? "tinfoil/kimi-k2-6"
+      ? "tinfoil/gpt-oss-120b"
       : signedIn
         ? ACCOUNT_MODEL
         : haveKey("ANTHROPIC_API_KEY")

package/bin/privateer.mjs

@@ -4,7 +4,7 @@
 // code and dev keys from the repo. Prefer the `bin/pv` wrapper, which also picks a
 // Node >= 22 (the Pi stack's floor).
 import { register } from "tsx/esm/api";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname, resolve } from "node:path";
 
 const here = dirname(fileURLToPath(import.meta.url));
@@ -19,4 +19,11 @@ try {
 }
 
 register(); // resolves the repo's tsx regardless of the invocation cwd
-await import(resolve(repo, "src/cli/chat.ts"));
+// pathToFileURL, NOT the bare path: on Windows an absolute path starts with a
+// drive letter, and dynamic import() reads "D:\..." as the URL scheme "d:" —
+// ERR_UNSUPPORTED_ESM_URL_SCHEME, before a single line of ours runs. POSIX
+// absolute paths happen to work, which is exactly why this survived so long:
+// every launcher here had it, and `--version` is intercepted upstream in
+// privateer-launch.mjs, so the Windows smoke test booted fine while the actual
+// command was dead. Pinned by tests/launcherImports.test.ts.
+await import(pathToFileURL(resolve(repo, "src/cli/chat.ts")).href);

package/extensions/privateer-connect.ts

@@ -297,6 +297,20 @@ function pendingFromCatalog(e: CatalogEntry): Pending {
       hint: `Replaces the placeholder ${e.fill}`,
       initial: e.fill,
     });
+  } else if (e.needs === "url") {
+    // A server hosted by an app already running HERE. Nothing to paste, but the
+    // endpoint is the one thing that can differ per machine (Unreal's port and path
+    // are editable in Editor Preferences), and a wrong port is a connector that
+    // saves cleanly and never answers — the failure this catalog exists to avoid.
+    // Pre-filled with the documented default, so <enter> is the common case.
+    steps.push({
+      key: "url",
+      prompt: "Server URL",
+      hint: `Default is ${e.url} — change it only if you moved it.`,
+      initial: e.url,
+      validate: (v) =>
+        /^https?:\/\//i.test(v.trim()) ? undefined : "That needs to be an http:// or https:// URL.",
+    });
   }
   return {
     title: e.label,
@@ -307,12 +321,17 @@ function pendingFromCatalog(e: CatalogEntry): Pending {
       for (const [k, v] of Object.entries(answers)) {
         if (k.startsWith("env:")) env[k.slice(4)] = v;
       }
-      return draftFromCatalog(e, { env, fill: answers.fill });
+      return draftFromCatalog(e, { env, fill: answers.fill, url: answers.url });
     },
     note:
       e.needs === "oauth"
         ? `Authorize it in a browser on THIS machine: /mcp-auth ${e.name}`
-        : undefined,
+        : e.localHttp
+          // Not a warning — a localHttp connector is correct the moment it saves. But
+          // it answers only while its host app is up, so a later failure means "the
+          // app is closed", and saying that now beats debugging it then.
+          ? `Works whenever ${e.label} is running on this machine. Nothing to authorize.`
+          : undefined,
   };
 }
 
@@ -329,6 +348,7 @@ const NEEDS_LABEL: Record<string, string> = {
   token: "needs a token",
   path: "needs a path",
   oauth: "browser sign-in",
+  url: "confirm the URL",
   none: "no setup",
 };
 

package/extensions/privateer-spawn-skills.ts

@@ -0,0 +1,39 @@
+// Per-spawn skills — the skills a folder carries, without touching the folder.
+//
+// Pi discovers project skills at `<cwd>/.privateer/skills` (and `<cwd>/.pi/skills`),
+// resolved lexically from cwd with no override — see projectConfigDirCandidates. That
+// is the right home for skills a TEAM shares through the repo, and the wrong one for
+// "the skills I use in this folder on this machine": giving a folder its own skills
+// would mean writing into the user's tree, where it lands in their next `git status`.
+//
+// So per-spawn skills live under the global dir with that folder's other defaults
+// (src/config/spawns.ts), and this extension hands the directory to Pi through the
+// `resources_discover` hook — the supported way to contribute skill paths. Nothing is
+// patched, and the skills are loaded by the session itself, so the model can actually
+// invoke them rather than merely having them listed in the app's Skills manager.
+//
+// Note this contributes PATHS, not skills: Pi still owns discovery, precedence and
+// the disable-model-invocation flag inside them.
+
+import { existsSync } from "node:fs";
+import { spawnSkillsDir } from "../src/config/spawns.ts";
+
+export default function privateerSpawnSkills(pi: any): void {
+  pi.on("resources_discover", (event: any) => {
+    // `cwd` comes from the event rather than a captured value: the desktop rebuilds
+    // its session on a folder switch, and a stale closure would keep feeding the old
+    // folder's skills to the new one.
+    const cwd = event?.cwd ?? process.cwd();
+    let dir: string;
+    try {
+      dir = spawnSkillsDir(cwd);
+    } catch {
+      return; // no global dir (PRIVATEER_HOME unset in a stripped environment)
+    }
+    // Only offer a directory that exists. Pi tolerates a missing path, but an empty
+    // contribution is also how `emitResourcesDiscover` decides there is nothing to
+    // reload — so staying silent keeps a spawn with no skills of its own free.
+    if (!existsSync(dir)) return;
+    return { skillPaths: [dir] };
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.6",
+  "version": "0.12.7",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -1055,3 +1055,71 @@ index f81b4b4..9712a37 100644
    -a, --approve     Trust project-local files for this command
    -na, --no-approve Ignore project-local files for this command
  
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
+index 68d0308..f7208f1 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
+@@ -1,5 +1,5 @@
+ import { isAbsolute, relative, resolve, sep } from "node:path";
+-import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
++import { truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+ import { areExperimentalFeaturesEnabled } from "../../../core/experimental.js";
+ import { theme } from "../theme/theme.js";
+ /**
+@@ -13,6 +13,43 @@ function sanitizeStatusText(text) {
+         .replace(/ +/g, " ")
+         .trim();
+ }
++/**
++ * Lay extension statuses out over as many lines as the terminal needs, keeping
++ * each status whole. Upstream joined them into ONE line and truncated it to the
++ * width, which silently hid whatever didn't fit — and what didn't fit was often
++ * the loudest indicator on screen (Privateer's "permission gate OFF" flag). A
++ * status too wide to fit on a line of its own is wrapped, never clipped.
++ */
++function packStatusLines(statuses, width) {
++    if (width <= 0)
++        return [];
++    const lines = [];
++    let current = "";
++    let currentWidth = 0;
++    const flush = () => {
++        if (current)
++            lines.push(current);
++        current = "";
++        currentWidth = 0;
++    };
++    for (const status of statuses) {
++        if (!status)
++            continue;
++        const statusWidth = visibleWidth(status);
++        if (statusWidth > width) {
++            flush();
++            lines.push(...wrapTextWithAnsi(status, width));
++            continue;
++        }
++        const separator = current ? 1 : 0;
++        if (currentWidth + separator + statusWidth > width)
++            flush();
++        current = current ? `${current} ${status}` : status;
++        currentWidth += separator + statusWidth;
++    }
++    flush();
++    return lines;
++}
+ /**
+  * Format token counts for compact footer display.
+  */
+@@ -211,9 +248,9 @@ export class FooterComponent {
+             const sortedStatuses = Array.from(extensionStatuses.entries())
+                 .sort(([a], [b]) => a.localeCompare(b))
+                 .map(([, text]) => sanitizeStatusText(text));
+-            const statusLine = sortedStatuses.join(" ");
+-            // Truncate to terminal width with dim ellipsis for consistency with footer style
+-            lines.push(truncateToWidth(statusLine, width, theme.fg("dim", "...")));
++            // Wrap onto extra lines instead of truncating: a status is there because
++            // something wants to be seen, so none of them may be cut off.
++            lines.push(...packStatusLines(sortedStatuses, width));
+         }
+         return lines;
+     }

package/src/acp/run.ts

@@ -125,7 +125,7 @@ export async function runAcp(): Promise<void> {
     cwd: baseCwd,
     confineToCwd: true,
     getRemote: () => true,
-    getNoQuarter: () => posture === "auto",
+    getAutoApprove: () => posture === "auto",
     async localAsk() {
       return "deny";
     },

package/src/channels/run.ts

@@ -191,7 +191,7 @@ async function main() {
     cwd,
     confineToCwd: true,
     getRemote: () => true,
-    getNoQuarter: () => posture() === "auto",
+    getAutoApprove: () => posture() === "auto",
     async localAsk() {
       return "deny";
     },

package/src/cli/chat.ts

@@ -47,6 +47,7 @@ async function main() {
     dropPersistedAccountCredential,
   } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
+  const { pickerCatalog, hiddenAccountNotice, hiddenAccountTitleSuffix } = await import("../providers/modelCatalog.ts");
   const { resolveDefaultModel, resolveSignedInModel, savedPiDefaultSpec } = await import("../providers/defaultModel.ts");
   const { postOutbox } = await import("../outbox/cloudOutbox.ts");
   const { addPendingCloud } = await import("../routines/store.ts");
@@ -625,11 +626,14 @@ async function main() {
   console.log(`${DIM}shift+tab toggles no quarter — unattended mode, no approval prompts.${RESET}`);
   await showPosture();
 
-  // The available model catalog as sorted "provider/id" specs. Same source the
-  // /models list and the app's picker draw from.
-  async function availableModelSpecs(): Promise<string[]> {
-    const all: any[] = (services.modelRegistry as any).getAvailable ? await (services.modelRegistry as any).getAvailable() : [];
-    return all.map((m) => `${m.provider}/${m.id}`).sort();
+  // The available model catalog as sorted "provider/id" specs, plus what the
+  // registry had to leave out. Same source the /models list and the app's picker
+  // draw from — see providers/modelCatalog.ts for the two things that make this
+  // more than a map+sort (sealed models register late; the whole account catalog
+  // is filtered out until the credential is armed).
+  const SIGN_IN_HINT = "Run /login.";
+  async function modelCatalog() {
+    return pickerCatalog(services.modelRegistry as any);
   }
 
   // Switch the live session's model in place (history preserved — see
@@ -660,9 +664,17 @@ async function main() {
   // as a selection prompt and switch to whatever the driver picks. This is the
   // remote /model flow — the terminal owns the options, the app just renders them.
   async function pickModelRemote(filter: string): Promise<void> {
-    const specs = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+    const cat = await modelCatalog();
+    const specs = cat.specs.filter((sp) => !filter || sp.toLowerCase().includes(filter));
+    // Say why the list is short BEFORE opening it — a driver looking at a catalog
+    // with no confidential models has no way to tell "we don't carry them" from
+    // "this terminal is signed out", and only one of those has a fix.
+    const notice = hiddenAccountNotice(cat, SIGN_IN_HINT);
+    if (notice) relay?.sendNotice(notice);
     const choice = await bridge.selectRemote({
-      title: "Choose a model",
+      // The suffix puts the same fact in the sheet itself, where the driver is
+      // actually looking. Terminal chrome, so English like the rest of the title.
+      title: `Choose a model${hiddenAccountTitleSuffix(cat)}`,
       options: specs.map((sp) => ({ value: sp, label: sp })),
       current: currentSpec,
     });
@@ -689,8 +701,11 @@ async function main() {
     if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
       const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
       if (remote) { await pickModelRemote(filter); return true; }
-      const rows = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+      const cat = await modelCatalog();
+      const rows = cat.specs.filter((sp) => !filter || sp.toLowerCase().includes(filter));
       console.log(rows.slice(0, 40).join("\n") + (rows.length > 40 ? `\n${DIM}… ${rows.length - 40} more (try /models <filter>)${RESET}` : ""));
+      const hidden = hiddenAccountNotice(cat, SIGN_IN_HINT);
+      if (hidden) console.log(`${DIM}${hidden}${RESET}`);
       return true;
     }
     // Extensions: remote drives the app's manager (list frame); local prints the list.

package/src/config/spawns.ts

@@ -0,0 +1,187 @@
+// Spawn records — the per-folder defaults an agent starts with on this machine.
+//
+// A "spawn" is one agent pointed at one folder: the desktop's window sessions are
+// the visible case, but the record is deliberately machine-level rather than
+// desktop-level, because ~/.privateer is shared with the CLI and a `privateer` run
+// in the same folder should be able to honour the same defaults later.
+//
+// WHY NOT THE PROJECT FOLDER. Pi already has a project scope — `.privateer/` and
+// `.pi/` under cwd (see PROJECT_CONFIG_DIR_NAMES) — and this is NOT that. Project
+// config lives in the tree, travels with a clone, and lands in the user's commits.
+// These records are the opposite by choice: which model YOU run in a folder on THIS
+// computer is a local preference, not a property of the project, and writing it into
+// someone's repo would be a surprise the first time they `git status`. So they live
+// under the global dir, keyed by the folder's real path, and the folder itself is
+// left untouched. (PRIVATEER.md is the deliberate exception — that one IS about the
+// project and belongs in the tree.)
+//
+// Keying is by REAL path: a symlinked checkout (/var → /private/var on macOS) must
+// not read as a second folder, or a spawn would silently lose its defaults depending
+// on which route the user opened it by.
+
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { globalDir } from "./paths.ts";
+
+export interface SpawnRecord {
+  /** The folder, as resolved when the record was written. */
+  path: string;
+  /** Preferred model as "provider/id", or null to take the account default. */
+  model: string | null;
+  /** MCP connector names this folder's agent starts with. */
+  connectors: string[];
+  /** Epoch ms. */
+  createdAt: number;
+  /** Epoch ms of the last spawn opened on this folder, or null if never. */
+  lastOpenedAt: number | null;
+}
+
+/** All spawn records: <globalDir>/spawns/<key>/spawn.json (+ a per-spawn skills/ dir). */
+export function spawnsDir(): string {
+  return join(globalDir(), "spawns");
+}
+
+// The identity of a folder for record purposes. realpathSync resolves symlinks so
+// two routes to one checkout share a record; a path that doesn't exist yet (a folder
+// the user is about to create) falls back to the lexical resolution rather than
+// throwing. Case-folded on Windows, where the same folder is reachable as C:\Foo and
+// c:\foo and neither spelling is more correct than the other.
+function identity(path: string): string {
+  let real: string;
+  try {
+    real = realpathSync(resolve(path));
+  } catch {
+    real = resolve(path);
+  }
+  return process.platform === "win32" ? real.toLowerCase() : real;
+}
+
+/** Stable per-folder key. 64 bits of sha256 — collisions are checked, not assumed. */
+export function spawnKey(path: string): string {
+  return createHash("sha256").update(identity(path)).digest("hex").slice(0, 16);
+}
+
+/** This spawn's own directory (records + per-folder skills). */
+export function spawnDir(path: string): string {
+  return join(spawnsDir(), spawnKey(path));
+}
+
+/**
+ * Per-spawn skills, injected into the session as an extra skill path so a folder can
+ * carry its own without a `.privateer/skills` appearing in the user's tree.
+ */
+export function spawnSkillsDir(path: string): string {
+  return join(spawnDir(path), "skills");
+}
+
+function recordPath(path: string): string {
+  return join(spawnDir(path), "spawn.json");
+}
+
+// Tolerant on read: these files sit in a directory users are invited to inspect, and
+// a hand-edited or half-written one must degrade to "no record" rather than take the
+// app down on launch. Unknown keys are dropped, not preserved — the shape is ours.
+function parse(raw: string): SpawnRecord | null {
+  let obj: any;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!obj || typeof obj !== "object" || typeof obj.path !== "string" || !obj.path) return null;
+  return {
+    path: obj.path,
+    model: typeof obj.model === "string" && obj.model.includes("/") ? obj.model : null,
+    connectors: Array.isArray(obj.connectors) ? obj.connectors.filter((c: unknown) => typeof c === "string") : [],
+    createdAt: Number.isFinite(obj.createdAt) ? obj.createdAt : 0,
+    lastOpenedAt: Number.isFinite(obj.lastOpenedAt) ? obj.lastOpenedAt : null,
+  };
+}
+
+/**
+ * The record for `path`, or null if there is none.
+ *
+ * A record whose stored path disagrees with the folder we asked about is treated as a
+ * miss: that is the 64-bit collision case, and answering with another folder's model
+ * and connectors would be worse than answering with nothing.
+ */
+export function readSpawn(path: string): SpawnRecord | null {
+  const file = recordPath(path);
+  if (!existsSync(file)) return null;
+  let rec: SpawnRecord | null;
+  try {
+    rec = parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!rec) return null;
+  return identity(rec.path) === identity(path) ? rec : null;
+}
+
+/**
+ * Create or update the record for `path` and return the result. Absent fields keep
+ * their stored value, so a caller that only knows the model doesn't have to read
+ * first and risk clobbering connectors written by another window.
+ */
+export function writeSpawn(path: string, patch: Partial<Omit<SpawnRecord, "path" | "createdAt">>, now = Date.now()): SpawnRecord {
+  const existing = readSpawn(path);
+  const next: SpawnRecord = {
+    path: resolve(path),
+    model: patch.model !== undefined ? patch.model : existing?.model ?? null,
+    connectors: patch.connectors !== undefined ? patch.connectors : existing?.connectors ?? [],
+    createdAt: existing?.createdAt || now,
+    lastOpenedAt: patch.lastOpenedAt !== undefined ? patch.lastOpenedAt : existing?.lastOpenedAt ?? null,
+  };
+  const dir = spawnDir(path);
+  mkdirSync(dir, { recursive: true });
+  // 0600 like the rest of the global dir: a record names a folder on this machine
+  // and the connectors it runs, which is nobody else's business on a shared box.
+  writeFileSync(recordPath(path), JSON.stringify(next, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  return next;
+}
+
+/** Stamp a spawn as opened now — the roster's "most recent first" ordering. */
+export function touchSpawn(path: string, now = Date.now()): SpawnRecord {
+  return writeSpawn(path, { lastOpenedAt: now }, now);
+}
+
+/**
+ * Every record, most recently opened first (never-opened ones last, then by path so
+ * the order is stable). Unreadable entries are skipped rather than surfaced as blanks.
+ */
+export function listSpawns(): SpawnRecord[] {
+  const dir = spawnsDir();
+  if (!existsSync(dir)) return [];
+  let keys: string[];
+  try {
+    keys = readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+  const out: SpawnRecord[] = [];
+  for (const key of keys) {
+    try {
+      const rec = parse(readFileSync(join(dir, key, "spawn.json"), "utf8"));
+      if (rec) out.push(rec);
+    } catch {
+      // No record file, or an unreadable one — not a spawn we can offer.
+    }
+  }
+  return out.sort((a, b) => (b.lastOpenedAt ?? 0) - (a.lastOpenedAt ?? 0) || a.path.localeCompare(b.path));
+}
+
+/** Drop a folder's record (and its per-spawn skills). True if there was one. */
+export function forgetSpawn(path: string): boolean {
+  const dir = spawnDir(path);
+  if (!existsSync(dir)) return false;
+  // Only remove a directory that actually holds THIS folder's record, so a collision
+  // (or a stale key) can't delete another spawn's skills.
+  if (!readSpawn(path)) return false;
+  try {
+    rmSync(dir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/ext/permissionGate.ts

@@ -43,7 +43,12 @@ export interface GateController {
   cwd: string;
   confineToCwd?: boolean;
   getRemote?(): boolean;
+  // The controller raised the flag: total bypass for remote turns — see
+  // ModeGate.getNoQuarter.
   getNoQuarter?(): boolean;
+  // The weaker "auto" posture used by the non-interactive runtimes (ACP, channels):
+  // bypass-equivalent, dangerous/destructive still relayed. See ModeGate.getAutoApprove.
+  getAutoApprove?(): boolean;
   // Total bypass — see ModeGate.getSkipAllPermissions. Set by the `--no-quarter`
   // launch flag (env PRIVATEER_NO_QUARTER); when true the gate auto-allows every
   // action with no prompt.
@@ -129,13 +134,15 @@ export async function decideToolCall(
     setMode: ctrl.setMode,
     allowlist: ctrl.allowlist,
     allowedOutsideRoots: ctrl.allowedOutsideRoots,
-    // Default to the built-in dangerous-command patterns so bypass / no-quarter /
+    // Default to the built-in dangerous-command patterns so bypass / "auto"-posture /
     // headless-subagent runs still force dangerous shell + secret-exfil to "ask"
     // (→ headless deny). A controller can extend, but never silently disable, this.
+    // The two no-quarter switches sit above the denylist by design and clear it.
     denylist: ctrl.denylist ?? DEFAULT_DENYLIST,
     ask,
     getRemote: ctrl.getRemote,
     getNoQuarter: ctrl.getNoQuarter,
+    getAutoApprove: ctrl.getAutoApprove,
     getSkipAllPermissions: ctrl.getSkipAllPermissions,
   });
 

package/src/harbor/ipc.ts

@@ -1,5 +1,6 @@
 import { createServer, createConnection, type Socket, type Server } from "node:net";
 import { existsSync, unlinkSync, chmodSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { globalDir } from "../config/paths.ts";
 import type { Routine } from "../routines/schema.ts";
@@ -8,7 +9,26 @@ import type { Routine } from "../routines/schema.ts";
 // is one JSON request per connection, answered with one JSON response, both
 // newline-terminated. Kept tiny and local — nothing crosses the machine boundary.
 
+const isWindows = process.platform === "win32";
+
+/**
+ * Where the harbor listens.
+ *
+ * POSIX: a unix socket inside PRIVATEER_HOME, so it inherits that directory's
+ * ownership and lives beside the log it writes.
+ *
+ * Windows has no unix sockets: `listen()` there accepts ONLY a name under
+ * \\.\pipe\, and handing it a file path fails — which is why `privateer harbor`
+ * could never start on Windows at all. The pipe name is derived from
+ * globalDir() so a non-default PRIVATEER_HOME still gets its own harbor (the
+ * pipe namespace is machine-global and has no directories to separate them),
+ * and hashed because that namespace takes no backslashes.
+ */
 export function harborSocketPath(): string {
+  if (isWindows) {
+    const id = createHash("sha256").update(globalDir().toLowerCase()).digest("hex").slice(0, 16);
+    return `\\\\.\\pipe\\privateer-harbor-${id}`;
+  }
   return join(globalDir(), "harbor.sock");
 }
 
@@ -115,6 +135,9 @@ export function startIpcServer(handler: IpcHandler): Promise<Server> {
       const server = build();
       server.once("error", (err: NodeJS.ErrnoException) => {
         if (err.code !== "EADDRINUSE") { reject(err); return; }
+        // Windows has nothing to reclaim: a named pipe exists only while a
+        // process holds it, so EADDRINUSE there always means a live harbor.
+        if (isWindows) { reject(new HarborAlreadyRunningError()); return; }
         void probeExistingListener(path).then((live) => {
           if (live) { reject(new HarborAlreadyRunningError()); return; }
           if (reclaimed) { reject(err); return; } // already reclaimed once — give up
@@ -140,7 +163,10 @@ export function startIpcServer(handler: IpcHandler): Promise<Server> {
 export function sendToHarbor(req: IpcRequest, timeoutMs = 5_000): Promise<IpcResponse> {
   const path = harborSocketPath();
   return new Promise<IpcResponse>((resolve, reject) => {
-    if (!existsSync(path)) {
+    // The fast "nothing is there" path. Skipped on Windows: a named pipe isn't a
+    // filesystem entry, so existsSync() is false even for a live harbor and this
+    // check would report every one of them as not running.
+    if (!isWindows && !existsSync(path)) {
       reject(new HarborNotRunningError());
       return;
     }

package/src/mcp/catalog.ts

@@ -8,6 +8,7 @@
  *   token — one prompt per env key (masked); `credUrl` is shown as "get one at …"
  *   path  — one prompt replacing the `fill` placeholder ARG (a folder, a DSN)
  *   oauth — nothing to type here; you authorize in a browser on THIS machine
+ *   url   — one prompt to confirm the endpoint of a server already running HERE
  *   none  — runs locally with no credentials, save it as-is
  *
  * Keep this list conservative and correct: a broken command in the catalog is worse
@@ -16,7 +17,7 @@
  */
 import type { McpDraft, McpTransport } from "../remote/mcpControl.ts";
 
-export type CatalogNeeds = "token" | "path" | "oauth" | "none";
+export type CatalogNeeds = "token" | "path" | "oauth" | "url" | "none";
 
 export interface CatalogEntry {
   // Stable key for the picker; also the default server name written to config.
@@ -36,6 +37,25 @@ export interface CatalogEntry {
   fill?: string;
   // Where to get the credential, shown as a hint in the form.
   credUrl?: string;
+  /**
+   * An HTTP server running on THIS MACHINE that needs no credential at all.
+   *
+   * A third shape alongside `oauth` and a stored bearer token, and it needs its own
+   * flag rather than falling out of the URL: every other http entry here is a remote
+   * service the user authorizes, so "must authenticate" is derived from
+   * `transport === "http"` alone. That is false here — there is nothing to authorize
+   * — so the flag is what makes draftFromCatalog emit `auth: "none"`. Without it the
+   * adapter goes hunting for an authorization server that does not exist.
+   *
+   * Always pair with `hosted: false`: a hosted enclave has no route to the user's
+   * loopback, and hostedCapable()'s derived rule keys on `oauth`, not on this.
+   */
+  localHttp?: boolean;
+  /**
+   * Where to learn how to TURN THE SERVER ON — deliberately not `credUrl`, which
+   * means "get a credential here" and would be a lie for an entry that has none.
+   */
+  docsUrl?: string;
   // Can this connector run on a HOSTED (Harbor) agent? Leave unset to take the derived
   // answer from hostedCapable() below; set it explicitly only to say "no" to something
   // that would otherwise qualify.
@@ -110,7 +130,10 @@ export const MCP_CATALOG: CatalogEntry[] = [
     label: "Linear",
     blurb: "Issues and projects. Sign in via browser.",
     transport: "http",
-    url: "https://mcp.linear.app/sse",
+    // /sse is GONE — it 404s on both GET and POST (checked 2026-07-31). Linear moved
+    // to the Streamable HTTP endpoint; the old URL silently failed for anyone who
+    // added Linear from this picker. Mirrored from the client copy on 2026-08-06.
+    url: "https://mcp.linear.app/mcp",
     oauth: true,
     needs: "oauth",
   },
@@ -320,6 +343,38 @@ export const MCP_CATALOG: CatalogEntry[] = [
     args: ["-y", "@modelcontextprotocol/server-sequential-thinking"],
     needs: "none",
   },
+
+  // ── Local apps that host their own MCP server ───────────────────────────────
+  // http, but on 127.0.0.1: nothing to install, nothing to authorize, nothing
+  // leaving the machine. See `localHttp` on CatalogEntry for why that needs a flag.
+  {
+    // Unreal Engine 5.8 embeds an MCP server in the EDITOR PROCESS (plugin
+    // `ModelContextProtocol`, surfaced as "Unreal MCP"; the tools come from the
+    // "All Toolsets" plugin, which has to be enabled too). Three facts shape this:
+    //
+    //  1. NO AUTHENTICATION, of any kind. Hence localHttp + auth:"none".
+    //  2. LOOPBACK ONLY. It binds per [HTTPServer.Listeners] DefaultBindAddress
+    //     (default `localhost`) AND rejects non-loopback `Origin` headers — so the
+    //     agent has to be on the same machine as the editor. True for this CLI and
+    //     for the desktop app; not true for a hosted agent, hence hosted: false.
+    //  3. IT IS ONLY UP WHILE THE EDITOR IS. A connector that fails here usually
+    //     means "Unreal isn't running", not "this is misconfigured".
+    //
+    // The port and path are editable in Editor Preferences → Model Context
+    // Protocol, so `needs: "url"`: the one setup step is confirming the endpoint
+    // rather than pasting a secret. `ModelContextProtocol.GenerateClientConfig` in
+    // the UE console prints the URL the editor is actually serving.
+    id: "unreal",
+    name: "unreal",
+    label: "Unreal Engine",
+    blurb: "Drive the Unreal Editor — actors, lighting, materials, tests.",
+    transport: "http",
+    url: "http://127.0.0.1:8000/mcp",
+    localHttp: true,
+    needs: "url",
+    hosted: false,
+    docsUrl: "https://dev.epicgames.com/documentation/unreal-engine/unreal-mcp-in-unreal-editor",
+  },
 ];
 
 export function catalogEntry(id: string): CatalogEntry | undefined {
@@ -341,9 +396,11 @@ export function promptOrder(e: CatalogEntry): string[] {
 //                and mcpControl treats that as "clear this key" — so a skipped
 //                optional credential is simply absent, never a bogus empty one.
 //   input.fill — the real path/DSN replacing the placeholder ARG (needs:"path").
+//   input.url  — the endpoint the user confirmed (needs:"url"); blank keeps the
+//                catalog default, so a straight <enter> is the documented port.
 export function draftFromCatalog(
   e: CatalogEntry,
-  input: { env?: Record<string, string>; fill?: string } = {},
+  input: { env?: Record<string, string>; fill?: string; url?: string } = {},
 ): McpDraft {
   const draft: McpDraft = { name: e.name, transport: e.transport };
 
@@ -354,11 +411,13 @@ export function draftFromCatalog(
     const filled = input.fill?.trim();
     draft.args = (e.args ?? []).map((a) => (e.fill && a === e.fill && filled ? filled : a));
   } else {
-    draft.url = e.url;
-    // Every http entry in this catalog is an OAuth connector. Emit the adapter's own
-    // vocabulary (`auth`) rather than the legacy boolean, so the projection carries
-    // `auth: "oauth"` and not a bogus boolean in the adapter's OAuthConfig slot.
-    draft.auth = (e.oauth ?? true) ? "oauth" : "none";
+    draft.url = input.url?.trim() || e.url;
+    // Emit the adapter's own vocabulary (`auth`) rather than the legacy boolean, so
+    // the projection carries a string and not a bogus boolean in the adapter's
+    // OAuthConfig slot. A localHttp entry authenticates to nothing — saying "oauth"
+    // there would send the adapter looking for an authorization server that does not
+    // exist, which fails at connect time rather than at save time.
+    draft.auth = e.localHttp ? "none" : (e.oauth ?? true) ? "oauth" : "none";
   }
 
   const keys = Object.keys(e.env ?? {});

package/src/permissions/modeGate.ts

@@ -30,10 +30,23 @@ export interface ModeGateDeps {
   // Hard denies (e.g. plan mode) are still honored without bothering the phone.
   getRemote?: () => boolean;
   // True while the controller has toggled no-quarter (unattended) mode: remote
-  // turns auto-approve like bypass mode so the agent runs to completion without
-  // pinging the phone. Dangerous shell and alwaysAsk-destructive actions rank
-  // above bypass in decideAuto, so those still relay for an explicit Allow/Deny.
+  // turns auto-approve so the agent runs to completion without pinging the phone.
+  // This is the SAME total bypass as the `--no-quarter` launch flag below, only
+  // scoped to remote turns — dangerous shell, secret-exfil shapes and alwaysAsk-
+  // destructive tools included. It has to be: "no quarter" is a step-away-from-
+  // the-keyboard switch, and a mode that still stops on the one command the user
+  // walked away from isn't unattended, it's a turn that wedges until it times out
+  // (a relayed prompt with nobody to answer it fails closed). A hard "deny" — plan
+  // mode — is still honored, so a read-only stance can't be talked around remotely.
   getNoQuarter?: () => boolean;
+  // True while a non-interactive runtime is running under its "auto" posture (the
+  // ACP host's `posture: "auto"`, a channel whose role resolves to it). Weaker than
+  // no-quarter on purpose: re-decide as if in bypass mode, so ordinary writes and
+  // bash run unattended but dangerous shell / alwaysAsk-destructive actions still
+  // relay for an explicit Allow/Deny. The party choosing it there is a host config
+  // or a chat-app role, not someone who tapped through a confirm on their own
+  // terminal, so it does not get to clear the denylist.
+  getAutoApprove?: () => boolean;
   // True when the operator launched with `--no-quarter` (env PRIVATEER_NO_QUARTER):
   // a session-wide TOTAL bypass of the gate. Every request auto-approves — including
   // dangerous shell, destructive tools, out-of-cwd and protected-file access — with
@@ -66,10 +79,16 @@ export class ModeGate implements PermissionGate {
     // remembered — we don't let a remote operator mutate local allowlist/mode.
     if (this.deps.getRemote?.()) {
       if (auto === "deny") return "deny";
-      // No-quarter: re-evaluate as if in bypass mode. Dangerous/destructive
-      // actions still come back "ask" (they sit above bypass) and fall through
-      // to the relayed prompt; everything else runs unattended.
-      if (this.deps.getNoQuarter?.() && decideAuto(req, "bypass", this.deps.allowlist, denylist) === "allow") {
+      // No-quarter: the controller has lowered the moat for this session, so
+      // auto-allow everything the plan-mode deny above didn't already stop —
+      // dangerous shell and alwaysAsk-destructive tools included. Stronger than
+      // `/mode bypass` (which keeps those two above it) and deliberately so: it
+      // is the remote-scoped twin of the `--no-quarter` flag, and the app's
+      // confirm says as much before the flag goes up.
+      if (this.deps.getNoQuarter?.()) return "allow";
+      // "auto" posture: the weaker cousin — bypass-equivalent, with dangerous and
+      // alwaysAsk-destructive actions still falling through to the relayed prompt.
+      if (this.deps.getAutoApprove?.() && decideAuto(req, "bypass", this.deps.allowlist, denylist) === "allow") {
         return "allow";
       }
       return (await this.deps.ask(req)) === "deny" ? "deny" : "allow";

package/src/providers/account.ts

@@ -47,10 +47,11 @@ import {
 const DEFAULT_MODELS = [
   ACCOUNT_DEFAULT_MODEL_ID,
   ACCOUNT_NEAR_MODEL_ID,
-  // The default until 2026-08-01 (see TINFOIL_MODEL_ID). It stays in the floor so a
-  // user who saved it as their own default still resolves it synchronously at launch,
-  // rather than falling through to "first model with configured auth" — the BYO dead
-  // end this seed list exists to prevent.
+  // Both former defaults (see TINFOIL_MODEL_ID for the dates). They stay in the floor
+  // so a user who saved either as their own default still resolves it synchronously at
+  // launch, rather than falling through to "first model with configured auth" — the BYO
+  // dead end this seed list exists to prevent.
+  "tinfoil/kimi-k2-6",
   "tinfoil/glm-5-2",
   "anthropic/claude-opus-5",
   "anthropic/claude-sonnet-5",

package/src/providers/defaultModel.ts

@@ -22,22 +22,43 @@ import { agentDir } from "../config/paths.ts";
 // One definition, three consumers: this resolver, providers/account.ts's seed catalog,
 // and bin/privateer-launch.mjs (which mirrors the id — keep them in step).
 //
-// It was `tinfoil/glm-5-2` until 2026-08-01, and the swap is a LATENCY decision, not a
-// capability one. Measured over 22 requests spaced 20s apart on the account channel,
-// glm-5-2 stalled before its first token on 9 of them — 33s to 98s each, with the
-// model demonstrably warm 20 seconds earlier, so it is contention in that deployment
-// rather than a cold start anything here can warm up. kimi-k2-6 and gpt-oss-120b, same
-// enclave provider, same tier, same transport, stalled 0 times in 20 (medians 1.2s and
-// 1.0s). The same run reproduced glm-5-2's stalls on BOTH the sealed and the cleartext
-// path, which is what rules out the shim, the relay and the proxy as the cause.
+// This has moved twice. The history matters, because both moves were about the same
+// two axes — first-token latency and reasoning control — pulling in opposite directions:
 //
-// Two consequences worth knowing when revisiting this: glm-5-2 remains in the live
-// catalog and is one pick away for anyone who wants it, and kimi-k2-6 reasons on every
-// turn with no working off switch (see thinkingProfile in providers/account.ts — its
-// levers were probed and none of them moved the reasoning volume). Its reasoning is
-// short and it always reaches an answer, which is why that is acceptable here and was
-// not for glm-5-2.
-export const TINFOIL_MODEL_ID = "tinfoil/kimi-k2-6";
+//   • until 2026-08-01 — glm-5-2.
+//   • 2026-08-01 → 2026-08-06 — kimi-k2-6, a LATENCY swap, not a capability one. Over
+//     22 requests spaced 20s apart on the account channel, glm-5-2 stalled before its
+//     first token on 9 of them — 33s to 98s each, with the model demonstrably warm 20
+//     seconds earlier, so it was contention in that deployment rather than a cold start
+//     anything here can warm up. kimi-k2-6 and gpt-oss-120b, same enclave provider,
+//     same tier, same transport, stalled 0 times in 20 (medians 1.2s and 1.0s). That
+//     run reproduced the stalls on BOTH the sealed and the cleartext path, which is
+//     what ruled out the shim, the relay and the proxy as the cause.
+//   • 2026-08-06 — gpt-oss-120b, on REASONING CONTROL, having ruled out a return to
+//     glm-5-2 by re-measuring. kimi-k2-6 reasons on every turn with no working off
+//     switch: thinkingProfile (providers/account.ts) omits it deliberately because both
+//     levers were probed and neither moved the reasoning volume. On an agent that makes
+//     many small tool calls, a toggle that works is worth real latency — but not glm's
+//     latency. Re-run of the probe above (14 rounds, 20s apart, TTFT to the first token
+//     of any kind, all three models per round):
+//
+//         glm-5-2        median 4.6s  max 55.0s  stalls(>10s) 5/14
+//         kimi-k2-6      median 0.9s  max  1.1s  stalls        0/14
+//         gpt-oss-120b   median 0.4s  max  0.4s  stalls        0/14
+//
+//     glm-5-2's stalls (55.0 / 46.3 / 46.3 / 55.0 / 29.9s) interleave with 1.0s
+//     responses on the same key in the same minute while the other two never waver —
+//     the 2026-08-01 signature, unchanged. At ~36% per request a ten-tool-call task
+//     stalls with ~99% probability, so it is not defaultable however good the model is.
+//     gpt-oss-120b takes the latency crown outright AND honours reasoning_effort
+//     (verified: low → 9 reasoning deltas, high → 61), so it is the only one of the
+//     three that gives the user a working dial. It is a smaller model than GLM 5.2 and
+//     Kimi K2.6; that capability trade was made knowingly. It also serves from NEAR as
+//     well as Tinfoil — the only capable model here with two attested homes.
+//
+// Re-measure before moving this again. The stall behaviour is a property of a
+// provider's deployment, not of a model, and it has already changed under us twice.
+export const TINFOIL_MODEL_ID = "tinfoil/gpt-oss-120b";
 
 // Same model, reached two ways:
 //   - TINFOIL_DEFAULT_SPEC — direct to inference.tinfoil.sh with the user's own

package/src/providers/modelCatalog.ts

@@ -0,0 +1,115 @@
+// What the `/model` picker is allowed to offer, and why it might be short.
+//
+// Three surfaces build that list — the REPL (`cli/chat.ts`), the desktop session
+// (`desktop/src/main/agentSession.ts`) and, through the relay, the app's picker
+// sheet — and all three used the same two lines: `modelRegistry.getAvailable()`,
+// mapped to `provider/id` and sorted. Two things about that list are surprising
+// enough that they belong here rather than being rediscovered at each call site:
+//
+//  1. **Sealed-only models are registered late.** `phala/*` is registered only once
+//     the sealed loopback shim is bound (isServableAccountModel — the cleartext
+//     `/api/agent/v1` has no Phala route and rejects those ids outright), and the
+//     shim binds a beat AFTER the session's first synchronous registration. The
+//     account provider re-registers when it comes up, so the catalog heals itself
+//     within ~half a second — but a picker opened inside that window listed a
+//     catalog quietly missing the whole Phala tier. Waiting for the shim first
+//     costs milliseconds (`startShim` is a loopback `listen(0)` — no network and no
+//     attestation) and removes the race.
+//
+//  2. **The account catalog can be registered and yet entirely unavailable.** Pi's
+//     `getAvailable()` is `models.filter(hasConfiguredAuth)`, and hasConfiguredAuth
+//     is "the provider has an auth entry, or its config's apiKey resolves". The
+//     account provider has no apiKey — it authenticates with an OAuth child token —
+//     so every `privateer/*` model (the NEAR and Tinfoil confidential tiers, and the
+//     bulk of the 240-odd catalog) is filtered out until the credential is armed
+//     into Pi's auth store, which needs a machine login. On a signed-out box the
+//     picker therefore drops the entire account catalog and says nothing: it looks
+//     like we don't carry those models, rather than like you're signed out.
+//
+// So: one place computes the list, and the same place reports what it had to hide.
+
+import { hasCredentials } from "../auth/privateer.ts";
+import { ensureSealedShim, sealedEnabled, sealedShimBase } from "./sealedShim.ts";
+
+/** The routing provider for the account channel — `privateer/<catalog id>`. */
+export const ACCOUNT_PROVIDER = "privateer";
+
+/** The shape we need from Pi's model registry (kept structural — it's untyped here). */
+export interface CatalogRegistry {
+  getAll?: () => unknown[];
+  getAvailable?: () => unknown[] | Promise<unknown[]>;
+}
+
+interface RegistryModel {
+  provider?: string;
+  id?: string;
+}
+
+const specOf = (m: RegistryModel): string => `${m.provider}/${m.id}`;
+
+/**
+ * Wait for the sealed shim if it's coming, so a catalog read can't miss the
+ * sealed-only models purely because it happened early (see note 1 above).
+ *
+ * The account provider attached its own post-shim re-registration at extension
+ * init, i.e. BEFORE this one — promise callbacks run in attachment order, so by the
+ * time this resolves, `phala/*` is already in the registry. Failure is not fatal:
+ * the catalog is then honestly the one we can serve.
+ */
+export async function readySealedCatalog(): Promise<void> {
+  if (!sealedEnabled() || sealedShimBase()) return;
+  try {
+    await ensureSealedShim();
+  } catch {
+    /* no shim → no sealed models, which is exactly what the list should show */
+  }
+}
+
+export interface PickerCatalog {
+  /** Sorted `provider/id` specs the session can actually reach — what to offer. */
+  specs: string[];
+  /** Account models registered but unreachable right now (0 when all is well). */
+  hiddenAccountModels: number;
+  /** Whether this machine holds a Privateer login at all. */
+  signedIn: boolean;
+}
+
+/** The picker's list, plus what it had to leave out. */
+export async function pickerCatalog(registry: CatalogRegistry | null | undefined): Promise<PickerCatalog> {
+  await readySealedCatalog();
+  const available = ((await registry?.getAvailable?.()) ?? []) as RegistryModel[];
+  const all = (registry?.getAll?.() ?? []) as RegistryModel[];
+  const offeredAccount = available.filter((m) => m.provider === ACCOUNT_PROVIDER).length;
+  const registeredAccount = all.filter((m) => m.provider === ACCOUNT_PROVIDER).length;
+  return {
+    specs: available.map(specOf).sort(),
+    hiddenAccountModels: Math.max(0, registeredAccount - offeredAccount),
+    signedIn: hasCredentials(),
+  };
+}
+
+/**
+ * One line explaining an account catalog we registered but can't offer, or null
+ * when there's nothing to explain.
+ *
+ * `signInHint` is the caller's own instruction for getting signed in — the REPL
+ * says `/login`, the desktop points at its Account menu — because "sign in" without
+ * saying where is the half of this message that was already implicit.
+ */
+export function hiddenAccountNotice(cat: PickerCatalog, signInHint: string): string | null {
+  if (cat.hiddenAccountModels === 0) return null;
+  const n = cat.hiddenAccountModels;
+  const models = `${n} Privateer account model${n === 1 ? "" : "s"} (including the confidential TEE ones)`;
+  return cat.signedIn
+    // Signed in but still unavailable: the credential never reached Pi's auth store
+    // — a revoked machine login, the terminal cap, or a network blip while arming.
+    ? `${models} are hidden — the account channel isn't armed. ${signInHint}`
+    : `Not signed in — ${models} are hidden. ${signInHint}`;
+}
+
+/** A short suffix for the picker's own title, so the shortfall shows where you're looking. */
+export function hiddenAccountTitleSuffix(cat: PickerCatalog): string {
+  return cat.hiddenAccountModels === 0
+    ? ""
+    : ` · sign in for ${cat.hiddenAccountModels} more`;
+}

package/src/remote/skillsControl.ts

@@ -79,6 +79,17 @@ export function makeSkillsControl(opts: {
   cwd: string;
   agentDir: string;
   settingsManager: SettingsManager;
+  /**
+   * Extra skill directories to load beyond settings' own `skillPaths`.
+   *
+   * The desktop passes this folder's per-spawn skills dir (config/spawns.ts). Pi
+   * discovers project skills only under `<cwd>/.privateer/skills`, which would mean
+   * writing into the user's tree to give a folder its own skills — so they live
+   * under the global dir with the folder's other defaults and arrive here instead.
+   * Read-only from this control's point of view: `editable` still means "under
+   * <agentDir>/skills", so create/delete keep targeting the one dir they always did.
+   */
+  extraSkillPaths?: string[];
 }): SkillsControl {
   // The user's own global skills live here; only these are editable.
   const userSkillsDir = path.join(opts.agentDir, "skills");
@@ -99,6 +110,12 @@ export function makeSkillsControl(opts: {
     } catch {
       skillPaths = [];
     }
+    // Appended, not prepended: a path the user configured in settings outranks a
+    // per-spawn one on a name clash, the same way an explicit setting outranks a
+    // default everywhere else. De-duplicated so a dir named in both is loaded once.
+    for (const extra of opts.extraSkillPaths ?? []) {
+      if (extra && !skillPaths.includes(extra)) skillPaths.push(extra);
+    }
     let result;
     try {
       result = loadSkills({ cwd: opts.cwd, agentDir: opts.agentDir, skillPaths, includeDefaults: true });