privateer-agent 0.12.6 → 0.12.8

package/extensions/privateer-spawn-skills.ts

@@ -0,0 +1,39 @@
+// Per-spawn skills — the skills a folder carries, without touching the folder.
+//
+// Pi discovers project skills at `<cwd>/.privateer/skills` (and `<cwd>/.pi/skills`),
+// resolved lexically from cwd with no override — see projectConfigDirCandidates. That
+// is the right home for skills a TEAM shares through the repo, and the wrong one for
+// "the skills I use in this folder on this machine": giving a folder its own skills
+// would mean writing into the user's tree, where it lands in their next `git status`.
+//
+// So per-spawn skills live under the global dir with that folder's other defaults
+// (src/config/spawns.ts), and this extension hands the directory to Pi through the
+// `resources_discover` hook — the supported way to contribute skill paths. Nothing is
+// patched, and the skills are loaded by the session itself, so the model can actually
+// invoke them rather than merely having them listed in the app's Skills manager.
+//
+// Note this contributes PATHS, not skills: Pi still owns discovery, precedence and
+// the disable-model-invocation flag inside them.
+
+import { existsSync } from "node:fs";
+import { spawnSkillsDir } from "../src/config/spawns.ts";
+
+export default function privateerSpawnSkills(pi: any): void {
+  pi.on("resources_discover", (event: any) => {
+    // `cwd` comes from the event rather than a captured value: the desktop rebuilds
+    // its session on a folder switch, and a stale closure would keep feeding the old
+    // folder's skills to the new one.
+    const cwd = event?.cwd ?? process.cwd();
+    let dir: string;
+    try {
+      dir = spawnSkillsDir(cwd);
+    } catch {
+      return; // no global dir (PRIVATEER_HOME unset in a stripped environment)
+    }
+    // Only offer a directory that exists. Pi tolerates a missing path, but an empty
+    // contribution is also how `emitResourcesDiscover` decides there is nothing to
+    // reload — so staying silent keeps a spawn with no skills of its own free.
+    if (!existsSync(dir)) return;
+    return { skillPaths: [dir] };
+  });
+}

package/extensions/privateer-update.ts

@@ -0,0 +1,187 @@
+// `/update` — fetch newer tool packs without leaving the terminal.
+//
+// A "tool pack" is what Pi calls a package: an npm or git source that contributes
+// extensions, skills, prompts or themes (pi-hermes-memory, a private tools repo, …).
+// Pi already checked for updates at startup and drew its own yellow box about it. We
+// suppress that box (patches/, in interactive-mode's run()) and own the surface here,
+// for two reasons:
+//
+//   1. THE BOX NAMED A COMMAND THAT DOES NOT EXIST. It said "Run pi update --extensions".
+//      No `pi` binary is installed on a Privateer machine, and `privateer update` means
+//      the CLI's own self-update — so the one instruction on screen either failed with
+//      "command not found" or reinstalled the wrong thing. The launcher now routes
+//      `privateer update --extensions` properly (bin/privateer-launch.mjs), and in the
+//      TUI the answer is simply /update.
+//   2. IT WAS THE WRONG SIZE. A warning-bordered box under the banner, for "a pack has a
+//      newer version". Privateer's own release notice is a single line INSIDE the banner;
+//      packs get a line beside it (extensions/privateer-brand.ts) and nothing more.
+//
+// WHY THIS CAN HAPPEN LIVE. Nothing here needs a restart, and that is a property of Pi's
+// own machinery rather than a trick of ours:
+//   - DefaultPackageManager.update() installs into the same on-disk locations the
+//     resolver reads from, so the new code is simply *there* when something looks again.
+//   - ctx.reload() runs the same path as /reload: resourceLoader.reload() re-runs
+//     packageManager.resolve() AND calls clearExtensionCache(), and extensions are loaded
+//     through jiti with moduleCache:false — so every extension file is re-read from disk,
+//     not served from a module cache. Keybindings, skills, prompts and themes come back
+//     with it, and the chat is rebuilt from the session's messages, so scrollback and
+//     context survive.
+// The honest caveat: in Node (not the bundle) jiti leaves `tryNative` on, so a dependency
+// DEEP inside an updated npm pack that Node already loaded natively can stay the old copy
+// in memory. The pack's own source always reloads; if something still looks stale after
+// an update, a restart is the guaranteed fix, and we say so rather than pretending.
+//
+// The CLI itself is the one thing that genuinely cannot be swapped live — updating it
+// replaces the program that is running — so /update reports it and points at the shell.
+
+import { DefaultPackageManager, SettingsManager, getAgentDir } from "@earendil-works/pi-coding-agent";
+import { agentVersion } from "../src/config/version.ts";
+import {
+  type PackUpdate,
+  pendingCliUpdate,
+  pendingPackUpdates,
+  setPendingPackUpdates,
+} from "../src/updates.ts";
+
+// A check costs an npm/git round trip per configured pack. Once at startup is the point;
+// the extra checks come from reload (including the one our own /update triggers), where
+// re-asking the registry seconds after we already know the answer is pure waste.
+const RECHECK_AFTER_MS = 60_000;
+let lastCheckedAt = 0;
+
+// Build a package manager against THIS session's cwd and trust decision. Mirrors what
+// interactive-mode does for its own startup check: an untrusted project's packages must
+// stay out, and trust is the session's answer (ctx.isProjectTrusted), not a fresh guess.
+function packageManagerFor(ctx: any): any {
+  const cwd = ctx?.cwd ?? process.cwd();
+  const agentDir = getAgentDir();
+  const settingsManager = SettingsManager.create(cwd, agentDir, {
+    projectTrusted: ctx?.isProjectTrusted?.() ?? false,
+  });
+  return new DefaultPackageManager({ cwd, agentDir, settingsManager });
+}
+
+async function runCheck(ctx: any, opts: { force?: boolean } = {}): Promise<readonly PackUpdate[]> {
+  if (!opts.force && Date.now() - lastCheckedAt < RECHECK_AFTER_MS) return pendingPackUpdates();
+  // --offline / PI_OFFLINE means "no startup network", and a registry check is exactly
+  // that. Pi's own check bails the same way.
+  if (process.env.PI_OFFLINE) return pendingPackUpdates();
+  lastCheckedAt = Date.now();
+  const updates = await packageManagerFor(ctx).checkForAvailableUpdates();
+  const packs: PackUpdate[] = updates.map((u: any) => ({
+    source: u.source,
+    displayName: u.displayName,
+    type: u.type,
+    scope: u.scope,
+  }));
+  setPendingPackUpdates(packs);
+  return packs;
+}
+
+// "pi-hermes-memory", "pi-hermes-memory and pi-speak", "pi-hermes-memory, pi-speak and 2 more".
+function nameList(packs: readonly PackUpdate[]): string {
+  const names = packs.map((p) => p.displayName);
+  if (names.length <= 2) return names.join(" and ");
+  return `${names.slice(0, 2).join(", ")} and ${names.length - 2} more`;
+}
+
+// The CLI half of "what's out of date", appended to /update's replies so the answer to
+// "am I current?" is complete in one place. Null when the CLI is current or unchecked.
+function cliNote(): string | null {
+  const latest = pendingCliUpdate(agentVersion());
+  return latest
+    ? `Privateer v${latest} is out too — that one replaces the running program, so run \`privateer update\` from a shell.`
+    : null;
+}
+
+export default function privateerUpdate(pi: any): void {
+  // Check in the background on startup and after a reload. Never on a headless surface
+  // (harbor, ACP, print, channels): there's no banner to flag it on and nobody to type
+  // /update, so the network call would buy nothing.
+  pi.on("session_start", (event: any, ctx: any) => {
+    if (!ctx?.hasUI) return;
+    if (event?.reason !== "startup" && event?.reason !== "reload") return;
+    void runCheck(ctx).catch(() => {
+      // Offline, a private registry that won't answer, a git remote behind a VPN — an
+      // update check is never worth an error in the user's face. The flag just stays down.
+    });
+  });
+
+  pi.registerCommand?.("update", {
+    description: "Fetch tool pack updates in place: /update [<pack> | check]",
+    handler: async (args: string, ctx: any) => {
+      const arg = String(args ?? "").trim();
+      const notify = (msg: string, kind: "info" | "warning" | "error" = "info") =>
+        ctx?.ui?.notify?.(msg, kind);
+
+      if (arg === "check") {
+        try {
+          const packs = await runCheck(ctx, { force: true });
+          const cli = cliNote();
+          notify(
+            packs.length
+              ? `${packs.length} tool pack update${packs.length === 1 ? "" : "s"} ready: ${nameList(packs)} — /update to fetch${cli ? `. ${cli}` : ""}`
+              : `Tool packs are current.${cli ? ` ${cli}` : ""}`,
+          );
+        } catch (err) {
+          notify(`Update check failed: ${err instanceof Error ? err.message : String(err)}`, "error");
+        }
+        return;
+      }
+
+      // A named pack is passed straight through to the package manager, which matches it
+      // against configured sources and reports a better "no such pack" than we could.
+      // With no argument we act on what the check found, re-checking first if it never
+      // ran (a terminal that started offline, or a pack installed since launch).
+      let targets = pendingPackUpdates();
+      if (!arg) {
+        try {
+          targets = await runCheck(ctx, { force: pendingPackUpdates().length === 0 });
+        } catch {
+          // fall through with whatever the last check knew — update() re-checks anyway.
+        }
+        if (targets.length === 0) {
+          const cli = cliNote();
+          notify(`Tool packs are current.${cli ? ` ${cli}` : ""}`);
+          return;
+        }
+      }
+
+      const label = arg || nameList(targets);
+      ctx?.ui?.setStatus?.("update", `⚑ updating ${arg || `${targets.length} pack${targets.length === 1 ? "" : "s"}`}`);
+      try {
+        const pm = packageManagerFor(ctx);
+        // Progress goes to the footer, not the transcript: an install emits several
+        // events per pack and each one as a notification would bury the chat.
+        pm.setProgressCallback((e: any) => {
+          if (e?.type === "error") return; // update() throws; the catch below reports it
+          ctx?.ui?.setStatus?.("update", `⚑ ${e?.action ?? "update"} ${e?.source ?? ""}`.trimEnd());
+        });
+        await pm.update(arg || undefined);
+        pm.setProgressCallback(undefined);
+      } catch (err) {
+        ctx?.ui?.setStatus?.("update", undefined);
+        notify(`Update failed: ${err instanceof Error ? err.message : String(err)}`, "error");
+        return;
+      }
+      ctx?.ui?.setStatus?.("update", undefined);
+      // Whatever was pending is on disk now. Clear the flag before the reload so the
+      // banner that comes back is already correct, rather than flying a stale one until
+      // the post-reload check answers.
+      setPendingPackUpdates([]);
+      lastCheckedAt = 0;
+
+      // The reload is refused mid-turn (Pi guards on streaming/compaction), so don't ask
+      // for one — say plainly that the new code is on disk and waiting.
+      if (ctx?.isIdle?.() === false) {
+        notify(`Updated ${label}. Run /reload when this turn finishes to load it.`);
+        return;
+      }
+
+      notify(`Updated ${label} — reloading.`);
+      // ⚠️ ctx is STALE after this line (Pi invalidates it when the runtime is replaced).
+      // Nothing may touch it, so this is the last statement in the handler.
+      await ctx.reload();
+    },
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.6",
+  "version": "0.12.8",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -904,8 +904,76 @@ index 3355a47..8c6bba9 100644
      }
      getResourcePattern(item) {
          const scope = item.metadata.scope;
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
+index 68d0308..f7208f1 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/components/footer.js
+@@ -1,5 +1,5 @@
+ import { isAbsolute, relative, resolve, sep } from "node:path";
+-import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
++import { truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@earendil-works/pi-tui";
+ import { areExperimentalFeaturesEnabled } from "../../../core/experimental.js";
+ import { theme } from "../theme/theme.js";
+ /**
+@@ -13,6 +13,43 @@ function sanitizeStatusText(text) {
+         .replace(/ +/g, " ")
+         .trim();
+ }
++/**
++ * Lay extension statuses out over as many lines as the terminal needs, keeping
++ * each status whole. Upstream joined them into ONE line and truncated it to the
++ * width, which silently hid whatever didn't fit — and what didn't fit was often
++ * the loudest indicator on screen (Privateer's "permission gate OFF" flag). A
++ * status too wide to fit on a line of its own is wrapped, never clipped.
++ */
++function packStatusLines(statuses, width) {
++    if (width <= 0)
++        return [];
++    const lines = [];
++    let current = "";
++    let currentWidth = 0;
++    const flush = () => {
++        if (current)
++            lines.push(current);
++        current = "";
++        currentWidth = 0;
++    };
++    for (const status of statuses) {
++        if (!status)
++            continue;
++        const statusWidth = visibleWidth(status);
++        if (statusWidth > width) {
++            flush();
++            lines.push(...wrapTextWithAnsi(status, width));
++            continue;
++        }
++        const separator = current ? 1 : 0;
++        if (currentWidth + separator + statusWidth > width)
++            flush();
++        current = current ? `${current} ${status}` : status;
++        currentWidth += separator + statusWidth;
++    }
++    flush();
++    return lines;
++}
+ /**
+  * Format token counts for compact footer display.
+  */
+@@ -211,9 +248,9 @@ export class FooterComponent {
+             const sortedStatuses = Array.from(extensionStatuses.entries())
+                 .sort(([a], [b]) => a.localeCompare(b))
+                 .map(([, text]) => sanitizeStatusText(text));
+-            const statusLine = sortedStatuses.join(" ");
+-            // Truncate to terminal width with dim ellipsis for consistency with footer style
+-            lines.push(truncateToWidth(statusLine, width, theme.fg("dim", "...")));
++            // Wrap onto extra lines instead of truncating: a status is there because
++            // something wants to be seen, so none of them may be cut off.
++            lines.push(...packStatusLines(sortedStatuses, width));
+         }
+         return lines;
+     }
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
-index 5d65200..f827cd7 100644
+index 5d65200..397a7b7 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 @@ -10,7 +10,7 @@ import { getProviders, } from "@earendil-works/pi-ai/compat";
@@ -948,7 +1016,28 @@ index 5d65200..f827cd7 100644
              .map((command) => ({
              type: "warning",
              message: command.invocationName === command.name
-@@ -2042,7 +2053,17 @@ export class InteractiveMode {
+@@ -549,12 +560,14 @@ export class InteractiveMode {
+                 this.showNewVersionNotification(newRelease);
+             }
+         });
+-        // Start package update check asynchronously
+-        this.checkForPackageUpdates().then((updates) => {
+-            if (updates.length > 0) {
+-                this.showPackageUpdateNotification(updates);
+-            }
+-        });
++        // Privateer owns the package ("tool pack") update surface — see
++        // extensions/privateer-update.ts. Upstream ran its own check here and drew a
++        // warning-bordered box telling the user to run `pi update --extensions`: a
++        // binary that is installed nowhere on a Privateer machine, so the only
++        // instruction on screen could not be followed. We replace it with a single
++        // line in the startup banner plus /update, which applies packs in place. The
++        // CHECK is removed too, not just the box, so this costs no registry round
++        // trip — the extension does exactly one, on the same startup.
+         // Check tmux keyboard setup asynchronously
+         this.checkTmuxKeyboardSetup().then((warning) => {
+             if (warning) {
+@@ -2042,7 +2055,17 @@ export class InteractiveMode {
              if (text === "/model" || text.startsWith("/model ")) {
                  const searchTerm = text.startsWith("/model ") ? text.slice(7).trim() : undefined;
                  this.editor.setText("");
@@ -967,7 +1056,7 @@ index 5d65200..f827cd7 100644
                  return;
              }
              if (text === "/export" || text.startsWith("/export ")) {
-@@ -2105,14 +2126,44 @@ export class InteractiveMode {
+@@ -2105,14 +2128,44 @@ export class InteractiveMode {
                  this.editor.setText("");
                  return;
              }
@@ -1015,7 +1104,7 @@ index 5d65200..f827cd7 100644
                  return;
              }
              if (text === "/new") {
-@@ -2650,7 +2701,7 @@ export class InteractiveMode {
+@@ -2650,7 +2703,7 @@ export class InteractiveMode {
          if (this.chatContainer.children.length > 0) {
              this.chatContainer.addChild(new Spacer(1));
          }

package/src/acp/run.ts

@@ -125,7 +125,7 @@ export async function runAcp(): Promise<void> {
     cwd: baseCwd,
     confineToCwd: true,
     getRemote: () => true,
-    getNoQuarter: () => posture === "auto",
+    getAutoApprove: () => posture === "auto",
     async localAsk() {
       return "deny";
     },

package/src/channels/run.ts

@@ -191,7 +191,7 @@ async function main() {
     cwd,
     confineToCwd: true,
     getRemote: () => true,
-    getNoQuarter: () => posture() === "auto",
+    getAutoApprove: () => posture() === "auto",
     async localAsk() {
       return "deny";
     },

package/src/cli/chat.ts

@@ -47,6 +47,7 @@ async function main() {
     dropPersistedAccountCredential,
   } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
+  const { pickerCatalog, hiddenAccountNotice, hiddenAccountTitleSuffix } = await import("../providers/modelCatalog.ts");
   const { resolveDefaultModel, resolveSignedInModel, savedPiDefaultSpec } = await import("../providers/defaultModel.ts");
   const { postOutbox } = await import("../outbox/cloudOutbox.ts");
   const { addPendingCloud } = await import("../routines/store.ts");
@@ -625,11 +626,14 @@ async function main() {
   console.log(`${DIM}shift+tab toggles no quarter — unattended mode, no approval prompts.${RESET}`);
   await showPosture();
 
-  // The available model catalog as sorted "provider/id" specs. Same source the
-  // /models list and the app's picker draw from.
-  async function availableModelSpecs(): Promise<string[]> {
-    const all: any[] = (services.modelRegistry as any).getAvailable ? await (services.modelRegistry as any).getAvailable() : [];
-    return all.map((m) => `${m.provider}/${m.id}`).sort();
+  // The available model catalog as sorted "provider/id" specs, plus what the
+  // registry had to leave out. Same source the /models list and the app's picker
+  // draw from — see providers/modelCatalog.ts for the two things that make this
+  // more than a map+sort (sealed models register late; the whole account catalog
+  // is filtered out until the credential is armed).
+  const SIGN_IN_HINT = "Run /login.";
+  async function modelCatalog() {
+    return pickerCatalog(services.modelRegistry as any);
   }
 
   // Switch the live session's model in place (history preserved — see
@@ -660,9 +664,17 @@ async function main() {
   // as a selection prompt and switch to whatever the driver picks. This is the
   // remote /model flow — the terminal owns the options, the app just renders them.
   async function pickModelRemote(filter: string): Promise<void> {
-    const specs = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+    const cat = await modelCatalog();
+    const specs = cat.specs.filter((sp) => !filter || sp.toLowerCase().includes(filter));
+    // Say why the list is short BEFORE opening it — a driver looking at a catalog
+    // with no confidential models has no way to tell "we don't carry them" from
+    // "this terminal is signed out", and only one of those has a fix.
+    const notice = hiddenAccountNotice(cat, SIGN_IN_HINT);
+    if (notice) relay?.sendNotice(notice);
     const choice = await bridge.selectRemote({
-      title: "Choose a model",
+      // The suffix puts the same fact in the sheet itself, where the driver is
+      // actually looking. Terminal chrome, so English like the rest of the title.
+      title: `Choose a model${hiddenAccountTitleSuffix(cat)}`,
       options: specs.map((sp) => ({ value: sp, label: sp })),
       current: currentSpec,
     });
@@ -689,8 +701,11 @@ async function main() {
     if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
       const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
       if (remote) { await pickModelRemote(filter); return true; }
-      const rows = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+      const cat = await modelCatalog();
+      const rows = cat.specs.filter((sp) => !filter || sp.toLowerCase().includes(filter));
       console.log(rows.slice(0, 40).join("\n") + (rows.length > 40 ? `\n${DIM}… ${rows.length - 40} more (try /models <filter>)${RESET}` : ""));
+      const hidden = hiddenAccountNotice(cat, SIGN_IN_HINT);
+      if (hidden) console.log(`${DIM}${hidden}${RESET}`);
       return true;
     }
     // Extensions: remote drives the app's manager (list frame); local prints the list.

package/src/config/moatManifest.json

@@ -12,6 +12,7 @@
     { "name": "privateer-connect", "entry": "extensions/privateer-connect.ts", "note": "/connect — MCP connector manager" },
     { "name": "privateer-media", "entry": "extensions/privateer-media.ts", "note": "image/video/speech/music + ffmpeg compose" },
     { "name": "privateer-hints", "entry": "extensions/privateer-hints.ts", "note": "rotating tips in the working line + /hints" },
+    { "name": "privateer-update", "entry": "extensions/privateer-update.ts", "note": "tool pack updates in place — banner flag + /update" },
     { "name": "privateer-speak", "entry": "extensions/privateer-speak.ts", "note": "spoken responses (/speak) + voice input (/talk) — pi-speak + confidential account TTS/STT" },
     { "name": "rpiv-web-tools", "dep": ["@juicesharp/rpiv-web-tools", "index.ts"], "note": "private web tools (user's own provider key)" },
     { "name": "rpiv-ask-user-question", "dep": ["@juicesharp/rpiv-ask-user-question", "index.ts"], "note": "ask_user_question" },

package/src/config/spawns.ts

@@ -0,0 +1,187 @@
+// Spawn records — the per-folder defaults an agent starts with on this machine.
+//
+// A "spawn" is one agent pointed at one folder: the desktop's window sessions are
+// the visible case, but the record is deliberately machine-level rather than
+// desktop-level, because ~/.privateer is shared with the CLI and a `privateer` run
+// in the same folder should be able to honour the same defaults later.
+//
+// WHY NOT THE PROJECT FOLDER. Pi already has a project scope — `.privateer/` and
+// `.pi/` under cwd (see PROJECT_CONFIG_DIR_NAMES) — and this is NOT that. Project
+// config lives in the tree, travels with a clone, and lands in the user's commits.
+// These records are the opposite by choice: which model YOU run in a folder on THIS
+// computer is a local preference, not a property of the project, and writing it into
+// someone's repo would be a surprise the first time they `git status`. So they live
+// under the global dir, keyed by the folder's real path, and the folder itself is
+// left untouched. (PRIVATEER.md is the deliberate exception — that one IS about the
+// project and belongs in the tree.)
+//
+// Keying is by REAL path: a symlinked checkout (/var → /private/var on macOS) must
+// not read as a second folder, or a spawn would silently lose its defaults depending
+// on which route the user opened it by.
+
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { globalDir } from "./paths.ts";
+
+export interface SpawnRecord {
+  /** The folder, as resolved when the record was written. */
+  path: string;
+  /** Preferred model as "provider/id", or null to take the account default. */
+  model: string | null;
+  /** MCP connector names this folder's agent starts with. */
+  connectors: string[];
+  /** Epoch ms. */
+  createdAt: number;
+  /** Epoch ms of the last spawn opened on this folder, or null if never. */
+  lastOpenedAt: number | null;
+}
+
+/** All spawn records: <globalDir>/spawns/<key>/spawn.json (+ a per-spawn skills/ dir). */
+export function spawnsDir(): string {
+  return join(globalDir(), "spawns");
+}
+
+// The identity of a folder for record purposes. realpathSync resolves symlinks so
+// two routes to one checkout share a record; a path that doesn't exist yet (a folder
+// the user is about to create) falls back to the lexical resolution rather than
+// throwing. Case-folded on Windows, where the same folder is reachable as C:\Foo and
+// c:\foo and neither spelling is more correct than the other.
+function identity(path: string): string {
+  let real: string;
+  try {
+    real = realpathSync(resolve(path));
+  } catch {
+    real = resolve(path);
+  }
+  return process.platform === "win32" ? real.toLowerCase() : real;
+}
+
+/** Stable per-folder key. 64 bits of sha256 — collisions are checked, not assumed. */
+export function spawnKey(path: string): string {
+  return createHash("sha256").update(identity(path)).digest("hex").slice(0, 16);
+}
+
+/** This spawn's own directory (records + per-folder skills). */
+export function spawnDir(path: string): string {
+  return join(spawnsDir(), spawnKey(path));
+}
+
+/**
+ * Per-spawn skills, injected into the session as an extra skill path so a folder can
+ * carry its own without a `.privateer/skills` appearing in the user's tree.
+ */
+export function spawnSkillsDir(path: string): string {
+  return join(spawnDir(path), "skills");
+}
+
+function recordPath(path: string): string {
+  return join(spawnDir(path), "spawn.json");
+}
+
+// Tolerant on read: these files sit in a directory users are invited to inspect, and
+// a hand-edited or half-written one must degrade to "no record" rather than take the
+// app down on launch. Unknown keys are dropped, not preserved — the shape is ours.
+function parse(raw: string): SpawnRecord | null {
+  let obj: any;
+  try {
+    obj = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!obj || typeof obj !== "object" || typeof obj.path !== "string" || !obj.path) return null;
+  return {
+    path: obj.path,
+    model: typeof obj.model === "string" && obj.model.includes("/") ? obj.model : null,
+    connectors: Array.isArray(obj.connectors) ? obj.connectors.filter((c: unknown) => typeof c === "string") : [],
+    createdAt: Number.isFinite(obj.createdAt) ? obj.createdAt : 0,
+    lastOpenedAt: Number.isFinite(obj.lastOpenedAt) ? obj.lastOpenedAt : null,
+  };
+}
+
+/**
+ * The record for `path`, or null if there is none.
+ *
+ * A record whose stored path disagrees with the folder we asked about is treated as a
+ * miss: that is the 64-bit collision case, and answering with another folder's model
+ * and connectors would be worse than answering with nothing.
+ */
+export function readSpawn(path: string): SpawnRecord | null {
+  const file = recordPath(path);
+  if (!existsSync(file)) return null;
+  let rec: SpawnRecord | null;
+  try {
+    rec = parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!rec) return null;
+  return identity(rec.path) === identity(path) ? rec : null;
+}
+
+/**
+ * Create or update the record for `path` and return the result. Absent fields keep
+ * their stored value, so a caller that only knows the model doesn't have to read
+ * first and risk clobbering connectors written by another window.
+ */
+export function writeSpawn(path: string, patch: Partial<Omit<SpawnRecord, "path" | "createdAt">>, now = Date.now()): SpawnRecord {
+  const existing = readSpawn(path);
+  const next: SpawnRecord = {
+    path: resolve(path),
+    model: patch.model !== undefined ? patch.model : existing?.model ?? null,
+    connectors: patch.connectors !== undefined ? patch.connectors : existing?.connectors ?? [],
+    createdAt: existing?.createdAt || now,
+    lastOpenedAt: patch.lastOpenedAt !== undefined ? patch.lastOpenedAt : existing?.lastOpenedAt ?? null,
+  };
+  const dir = spawnDir(path);
+  mkdirSync(dir, { recursive: true });
+  // 0600 like the rest of the global dir: a record names a folder on this machine
+  // and the connectors it runs, which is nobody else's business on a shared box.
+  writeFileSync(recordPath(path), JSON.stringify(next, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  return next;
+}
+
+/** Stamp a spawn as opened now — the roster's "most recent first" ordering. */
+export function touchSpawn(path: string, now = Date.now()): SpawnRecord {
+  return writeSpawn(path, { lastOpenedAt: now }, now);
+}
+
+/**
+ * Every record, most recently opened first (never-opened ones last, then by path so
+ * the order is stable). Unreadable entries are skipped rather than surfaced as blanks.
+ */
+export function listSpawns(): SpawnRecord[] {
+  const dir = spawnsDir();
+  if (!existsSync(dir)) return [];
+  let keys: string[];
+  try {
+    keys = readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+  const out: SpawnRecord[] = [];
+  for (const key of keys) {
+    try {
+      const rec = parse(readFileSync(join(dir, key, "spawn.json"), "utf8"));
+      if (rec) out.push(rec);
+    } catch {
+      // No record file, or an unreadable one — not a spawn we can offer.
+    }
+  }
+  return out.sort((a, b) => (b.lastOpenedAt ?? 0) - (a.lastOpenedAt ?? 0) || a.path.localeCompare(b.path));
+}
+
+/** Drop a folder's record (and its per-spawn skills). True if there was one. */
+export function forgetSpawn(path: string): boolean {
+  const dir = spawnDir(path);
+  if (!existsSync(dir)) return false;
+  // Only remove a directory that actually holds THIS folder's record, so a collision
+  // (or a stale key) can't delete another spawn's skills.
+  if (!readSpawn(path)) return false;
+  try {
+    rmSync(dir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/context.ts

@@ -153,8 +153,16 @@ export function writeTemplate(dir: string = process.cwd()): WriteResult {
 // Lets /init (in the context extension) tell the banner (in the brand extension) that
 // PRIVATEER.md state changed, so the header re-renders its loaded/hint line immediately —
 // without either extension importing the other. Mirrors priv.onSignedIn.
+//
+// ⚠️ The listener set CANNOT be plain module state. Pi gives every extension its own jiti
+// instance with moduleCache:false, so this module is instantiated once per extension that
+// imports it: /init's copy and the banner's copy are different objects, and an emit on one
+// never reaches a listener registered on the other — the refresh silently did nothing.
+// globalThis is the one thing the two copies share. Same fix, same reason, as the pack
+// state in src/updates.ts.
 type Listener = () => void;
-const listeners = new Set<Listener>();
+const LISTENERS = Symbol.for("privateer.context.listeners");
+const listeners: Set<Listener> = (((globalThis as any)[LISTENERS] ??= new Set<Listener>()) as Set<Listener>);
 
 export function onContextChanged(fn: Listener): void {
   listeners.add(fn);