privateer-agent 0.12.6 → 0.12.8

package/src/ext/permissionGate.ts

@@ -43,7 +43,12 @@ export interface GateController {
   cwd: string;
   confineToCwd?: boolean;
   getRemote?(): boolean;
+  // The controller raised the flag: total bypass for remote turns — see
+  // ModeGate.getNoQuarter.
   getNoQuarter?(): boolean;
+  // The weaker "auto" posture used by the non-interactive runtimes (ACP, channels):
+  // bypass-equivalent, dangerous/destructive still relayed. See ModeGate.getAutoApprove.
+  getAutoApprove?(): boolean;
   // Total bypass — see ModeGate.getSkipAllPermissions. Set by the `--no-quarter`
   // launch flag (env PRIVATEER_NO_QUARTER); when true the gate auto-allows every
   // action with no prompt.
@@ -129,13 +134,15 @@ export async function decideToolCall(
     setMode: ctrl.setMode,
     allowlist: ctrl.allowlist,
     allowedOutsideRoots: ctrl.allowedOutsideRoots,
-    // Default to the built-in dangerous-command patterns so bypass / no-quarter /
+    // Default to the built-in dangerous-command patterns so bypass / "auto"-posture /
     // headless-subagent runs still force dangerous shell + secret-exfil to "ask"
     // (→ headless deny). A controller can extend, but never silently disable, this.
+    // The two no-quarter switches sit above the denylist by design and clear it.
     denylist: ctrl.denylist ?? DEFAULT_DENYLIST,
     ask,
     getRemote: ctrl.getRemote,
     getNoQuarter: ctrl.getNoQuarter,
+    getAutoApprove: ctrl.getAutoApprove,
     getSkipAllPermissions: ctrl.getSkipAllPermissions,
   });
 

package/src/harbor/ipc.ts

@@ -1,5 +1,6 @@
 import { createServer, createConnection, type Socket, type Server } from "node:net";
 import { existsSync, unlinkSync, chmodSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { globalDir } from "../config/paths.ts";
 import type { Routine } from "../routines/schema.ts";
@@ -8,7 +9,26 @@ import type { Routine } from "../routines/schema.ts";
 // is one JSON request per connection, answered with one JSON response, both
 // newline-terminated. Kept tiny and local — nothing crosses the machine boundary.
 
+const isWindows = process.platform === "win32";
+
+/**
+ * Where the harbor listens.
+ *
+ * POSIX: a unix socket inside PRIVATEER_HOME, so it inherits that directory's
+ * ownership and lives beside the log it writes.
+ *
+ * Windows has no unix sockets: `listen()` there accepts ONLY a name under
+ * \\.\pipe\, and handing it a file path fails — which is why `privateer harbor`
+ * could never start on Windows at all. The pipe name is derived from
+ * globalDir() so a non-default PRIVATEER_HOME still gets its own harbor (the
+ * pipe namespace is machine-global and has no directories to separate them),
+ * and hashed because that namespace takes no backslashes.
+ */
 export function harborSocketPath(): string {
+  if (isWindows) {
+    const id = createHash("sha256").update(globalDir().toLowerCase()).digest("hex").slice(0, 16);
+    return `\\\\.\\pipe\\privateer-harbor-${id}`;
+  }
   return join(globalDir(), "harbor.sock");
 }
 
@@ -115,6 +135,9 @@ export function startIpcServer(handler: IpcHandler): Promise<Server> {
       const server = build();
       server.once("error", (err: NodeJS.ErrnoException) => {
         if (err.code !== "EADDRINUSE") { reject(err); return; }
+        // Windows has nothing to reclaim: a named pipe exists only while a
+        // process holds it, so EADDRINUSE there always means a live harbor.
+        if (isWindows) { reject(new HarborAlreadyRunningError()); return; }
         void probeExistingListener(path).then((live) => {
           if (live) { reject(new HarborAlreadyRunningError()); return; }
           if (reclaimed) { reject(err); return; } // already reclaimed once — give up
@@ -140,7 +163,10 @@ export function startIpcServer(handler: IpcHandler): Promise<Server> {
 export function sendToHarbor(req: IpcRequest, timeoutMs = 5_000): Promise<IpcResponse> {
   const path = harborSocketPath();
   return new Promise<IpcResponse>((resolve, reject) => {
-    if (!existsSync(path)) {
+    // The fast "nothing is there" path. Skipped on Windows: a named pipe isn't a
+    // filesystem entry, so existsSync() is false even for a live harbor and this
+    // check would report every one of them as not running.
+    if (!isWindows && !existsSync(path)) {
       reject(new HarborNotRunningError());
       return;
     }

package/src/mcp/catalog.ts

@@ -8,6 +8,7 @@
  *   token — one prompt per env key (masked); `credUrl` is shown as "get one at …"
  *   path  — one prompt replacing the `fill` placeholder ARG (a folder, a DSN)
  *   oauth — nothing to type here; you authorize in a browser on THIS machine
+ *   url   — one prompt to confirm the endpoint of a server already running HERE
  *   none  — runs locally with no credentials, save it as-is
  *
  * Keep this list conservative and correct: a broken command in the catalog is worse
@@ -16,7 +17,7 @@
  */
 import type { McpDraft, McpTransport } from "../remote/mcpControl.ts";
 
-export type CatalogNeeds = "token" | "path" | "oauth" | "none";
+export type CatalogNeeds = "token" | "path" | "oauth" | "url" | "none";
 
 export interface CatalogEntry {
   // Stable key for the picker; also the default server name written to config.
@@ -36,6 +37,25 @@ export interface CatalogEntry {
   fill?: string;
   // Where to get the credential, shown as a hint in the form.
   credUrl?: string;
+  /**
+   * An HTTP server running on THIS MACHINE that needs no credential at all.
+   *
+   * A third shape alongside `oauth` and a stored bearer token, and it needs its own
+   * flag rather than falling out of the URL: every other http entry here is a remote
+   * service the user authorizes, so "must authenticate" is derived from
+   * `transport === "http"` alone. That is false here — there is nothing to authorize
+   * — so the flag is what makes draftFromCatalog emit `auth: "none"`. Without it the
+   * adapter goes hunting for an authorization server that does not exist.
+   *
+   * Always pair with `hosted: false`: a hosted enclave has no route to the user's
+   * loopback, and hostedCapable()'s derived rule keys on `oauth`, not on this.
+   */
+  localHttp?: boolean;
+  /**
+   * Where to learn how to TURN THE SERVER ON — deliberately not `credUrl`, which
+   * means "get a credential here" and would be a lie for an entry that has none.
+   */
+  docsUrl?: string;
   // Can this connector run on a HOSTED (Harbor) agent? Leave unset to take the derived
   // answer from hostedCapable() below; set it explicitly only to say "no" to something
   // that would otherwise qualify.
@@ -110,7 +130,10 @@ export const MCP_CATALOG: CatalogEntry[] = [
     label: "Linear",
     blurb: "Issues and projects. Sign in via browser.",
     transport: "http",
-    url: "https://mcp.linear.app/sse",
+    // /sse is GONE — it 404s on both GET and POST (checked 2026-07-31). Linear moved
+    // to the Streamable HTTP endpoint; the old URL silently failed for anyone who
+    // added Linear from this picker. Mirrored from the client copy on 2026-08-06.
+    url: "https://mcp.linear.app/mcp",
     oauth: true,
     needs: "oauth",
   },
@@ -320,6 +343,38 @@ export const MCP_CATALOG: CatalogEntry[] = [
     args: ["-y", "@modelcontextprotocol/server-sequential-thinking"],
     needs: "none",
   },
+
+  // ── Local apps that host their own MCP server ───────────────────────────────
+  // http, but on 127.0.0.1: nothing to install, nothing to authorize, nothing
+  // leaving the machine. See `localHttp` on CatalogEntry for why that needs a flag.
+  {
+    // Unreal Engine 5.8 embeds an MCP server in the EDITOR PROCESS (plugin
+    // `ModelContextProtocol`, surfaced as "Unreal MCP"; the tools come from the
+    // "All Toolsets" plugin, which has to be enabled too). Three facts shape this:
+    //
+    //  1. NO AUTHENTICATION, of any kind. Hence localHttp + auth:"none".
+    //  2. LOOPBACK ONLY. It binds per [HTTPServer.Listeners] DefaultBindAddress
+    //     (default `localhost`) AND rejects non-loopback `Origin` headers — so the
+    //     agent has to be on the same machine as the editor. True for this CLI and
+    //     for the desktop app; not true for a hosted agent, hence hosted: false.
+    //  3. IT IS ONLY UP WHILE THE EDITOR IS. A connector that fails here usually
+    //     means "Unreal isn't running", not "this is misconfigured".
+    //
+    // The port and path are editable in Editor Preferences → Model Context
+    // Protocol, so `needs: "url"`: the one setup step is confirming the endpoint
+    // rather than pasting a secret. `ModelContextProtocol.GenerateClientConfig` in
+    // the UE console prints the URL the editor is actually serving.
+    id: "unreal",
+    name: "unreal",
+    label: "Unreal Engine",
+    blurb: "Drive the Unreal Editor — actors, lighting, materials, tests.",
+    transport: "http",
+    url: "http://127.0.0.1:8000/mcp",
+    localHttp: true,
+    needs: "url",
+    hosted: false,
+    docsUrl: "https://dev.epicgames.com/documentation/unreal-engine/unreal-mcp-in-unreal-editor",
+  },
 ];
 
 export function catalogEntry(id: string): CatalogEntry | undefined {
@@ -341,9 +396,11 @@ export function promptOrder(e: CatalogEntry): string[] {
 //                and mcpControl treats that as "clear this key" — so a skipped
 //                optional credential is simply absent, never a bogus empty one.
 //   input.fill — the real path/DSN replacing the placeholder ARG (needs:"path").
+//   input.url  — the endpoint the user confirmed (needs:"url"); blank keeps the
+//                catalog default, so a straight <enter> is the documented port.
 export function draftFromCatalog(
   e: CatalogEntry,
-  input: { env?: Record<string, string>; fill?: string } = {},
+  input: { env?: Record<string, string>; fill?: string; url?: string } = {},
 ): McpDraft {
   const draft: McpDraft = { name: e.name, transport: e.transport };
 
@@ -354,11 +411,13 @@ export function draftFromCatalog(
     const filled = input.fill?.trim();
     draft.args = (e.args ?? []).map((a) => (e.fill && a === e.fill && filled ? filled : a));
   } else {
-    draft.url = e.url;
-    // Every http entry in this catalog is an OAuth connector. Emit the adapter's own
-    // vocabulary (`auth`) rather than the legacy boolean, so the projection carries
-    // `auth: "oauth"` and not a bogus boolean in the adapter's OAuthConfig slot.
-    draft.auth = (e.oauth ?? true) ? "oauth" : "none";
+    draft.url = input.url?.trim() || e.url;
+    // Emit the adapter's own vocabulary (`auth`) rather than the legacy boolean, so
+    // the projection carries a string and not a bogus boolean in the adapter's
+    // OAuthConfig slot. A localHttp entry authenticates to nothing — saying "oauth"
+    // there would send the adapter looking for an authorization server that does not
+    // exist, which fails at connect time rather than at save time.
+    draft.auth = e.localHttp ? "none" : (e.oauth ?? true) ? "oauth" : "none";
   }
 
   const keys = Object.keys(e.env ?? {});

package/src/permissions/modeGate.ts

@@ -30,10 +30,23 @@ export interface ModeGateDeps {
   // Hard denies (e.g. plan mode) are still honored without bothering the phone.
   getRemote?: () => boolean;
   // True while the controller has toggled no-quarter (unattended) mode: remote
-  // turns auto-approve like bypass mode so the agent runs to completion without
-  // pinging the phone. Dangerous shell and alwaysAsk-destructive actions rank
-  // above bypass in decideAuto, so those still relay for an explicit Allow/Deny.
+  // turns auto-approve so the agent runs to completion without pinging the phone.
+  // This is the SAME total bypass as the `--no-quarter` launch flag below, only
+  // scoped to remote turns — dangerous shell, secret-exfil shapes and alwaysAsk-
+  // destructive tools included. It has to be: "no quarter" is a step-away-from-
+  // the-keyboard switch, and a mode that still stops on the one command the user
+  // walked away from isn't unattended, it's a turn that wedges until it times out
+  // (a relayed prompt with nobody to answer it fails closed). A hard "deny" — plan
+  // mode — is still honored, so a read-only stance can't be talked around remotely.
   getNoQuarter?: () => boolean;
+  // True while a non-interactive runtime is running under its "auto" posture (the
+  // ACP host's `posture: "auto"`, a channel whose role resolves to it). Weaker than
+  // no-quarter on purpose: re-decide as if in bypass mode, so ordinary writes and
+  // bash run unattended but dangerous shell / alwaysAsk-destructive actions still
+  // relay for an explicit Allow/Deny. The party choosing it there is a host config
+  // or a chat-app role, not someone who tapped through a confirm on their own
+  // terminal, so it does not get to clear the denylist.
+  getAutoApprove?: () => boolean;
   // True when the operator launched with `--no-quarter` (env PRIVATEER_NO_QUARTER):
   // a session-wide TOTAL bypass of the gate. Every request auto-approves — including
   // dangerous shell, destructive tools, out-of-cwd and protected-file access — with
@@ -66,10 +79,16 @@ export class ModeGate implements PermissionGate {
     // remembered — we don't let a remote operator mutate local allowlist/mode.
     if (this.deps.getRemote?.()) {
       if (auto === "deny") return "deny";
-      // No-quarter: re-evaluate as if in bypass mode. Dangerous/destructive
-      // actions still come back "ask" (they sit above bypass) and fall through
-      // to the relayed prompt; everything else runs unattended.
-      if (this.deps.getNoQuarter?.() && decideAuto(req, "bypass", this.deps.allowlist, denylist) === "allow") {
+      // No-quarter: the controller has lowered the moat for this session, so
+      // auto-allow everything the plan-mode deny above didn't already stop —
+      // dangerous shell and alwaysAsk-destructive tools included. Stronger than
+      // `/mode bypass` (which keeps those two above it) and deliberately so: it
+      // is the remote-scoped twin of the `--no-quarter` flag, and the app's
+      // confirm says as much before the flag goes up.
+      if (this.deps.getNoQuarter?.()) return "allow";
+      // "auto" posture: the weaker cousin — bypass-equivalent, with dangerous and
+      // alwaysAsk-destructive actions still falling through to the relayed prompt.
+      if (this.deps.getAutoApprove?.() && decideAuto(req, "bypass", this.deps.allowlist, denylist) === "allow") {
         return "allow";
       }
       return (await this.deps.ask(req)) === "deny" ? "deny" : "allow";

package/src/providers/account.ts

@@ -47,10 +47,11 @@ import {
 const DEFAULT_MODELS = [
   ACCOUNT_DEFAULT_MODEL_ID,
   ACCOUNT_NEAR_MODEL_ID,
-  // The default until 2026-08-01 (see TINFOIL_MODEL_ID). It stays in the floor so a
-  // user who saved it as their own default still resolves it synchronously at launch,
-  // rather than falling through to "first model with configured auth" — the BYO dead
-  // end this seed list exists to prevent.
+  // Both former defaults (see TINFOIL_MODEL_ID for the dates). They stay in the floor
+  // so a user who saved either as their own default still resolves it synchronously at
+  // launch, rather than falling through to "first model with configured auth" — the BYO
+  // dead end this seed list exists to prevent.
+  "tinfoil/kimi-k2-6",
   "tinfoil/glm-5-2",
   "anthropic/claude-opus-5",
   "anthropic/claude-sonnet-5",

package/src/providers/defaultModel.ts

@@ -22,22 +22,43 @@ import { agentDir } from "../config/paths.ts";
 // One definition, three consumers: this resolver, providers/account.ts's seed catalog,
 // and bin/privateer-launch.mjs (which mirrors the id — keep them in step).
 //
-// It was `tinfoil/glm-5-2` until 2026-08-01, and the swap is a LATENCY decision, not a
-// capability one. Measured over 22 requests spaced 20s apart on the account channel,
-// glm-5-2 stalled before its first token on 9 of them — 33s to 98s each, with the
-// model demonstrably warm 20 seconds earlier, so it is contention in that deployment
-// rather than a cold start anything here can warm up. kimi-k2-6 and gpt-oss-120b, same
-// enclave provider, same tier, same transport, stalled 0 times in 20 (medians 1.2s and
-// 1.0s). The same run reproduced glm-5-2's stalls on BOTH the sealed and the cleartext
-// path, which is what rules out the shim, the relay and the proxy as the cause.
+// This has moved twice. The history matters, because both moves were about the same
+// two axes — first-token latency and reasoning control — pulling in opposite directions:
 //
-// Two consequences worth knowing when revisiting this: glm-5-2 remains in the live
-// catalog and is one pick away for anyone who wants it, and kimi-k2-6 reasons on every
-// turn with no working off switch (see thinkingProfile in providers/account.ts — its
-// levers were probed and none of them moved the reasoning volume). Its reasoning is
-// short and it always reaches an answer, which is why that is acceptable here and was
-// not for glm-5-2.
-export const TINFOIL_MODEL_ID = "tinfoil/kimi-k2-6";
+//   • until 2026-08-01 — glm-5-2.
+//   • 2026-08-01 → 2026-08-06 — kimi-k2-6, a LATENCY swap, not a capability one. Over
+//     22 requests spaced 20s apart on the account channel, glm-5-2 stalled before its
+//     first token on 9 of them — 33s to 98s each, with the model demonstrably warm 20
+//     seconds earlier, so it was contention in that deployment rather than a cold start
+//     anything here can warm up. kimi-k2-6 and gpt-oss-120b, same enclave provider,
+//     same tier, same transport, stalled 0 times in 20 (medians 1.2s and 1.0s). That
+//     run reproduced the stalls on BOTH the sealed and the cleartext path, which is
+//     what ruled out the shim, the relay and the proxy as the cause.
+//   • 2026-08-06 — gpt-oss-120b, on REASONING CONTROL, having ruled out a return to
+//     glm-5-2 by re-measuring. kimi-k2-6 reasons on every turn with no working off
+//     switch: thinkingProfile (providers/account.ts) omits it deliberately because both
+//     levers were probed and neither moved the reasoning volume. On an agent that makes
+//     many small tool calls, a toggle that works is worth real latency — but not glm's
+//     latency. Re-run of the probe above (14 rounds, 20s apart, TTFT to the first token
+//     of any kind, all three models per round):
+//
+//         glm-5-2        median 4.6s  max 55.0s  stalls(>10s) 5/14
+//         kimi-k2-6      median 0.9s  max  1.1s  stalls        0/14
+//         gpt-oss-120b   median 0.4s  max  0.4s  stalls        0/14
+//
+//     glm-5-2's stalls (55.0 / 46.3 / 46.3 / 55.0 / 29.9s) interleave with 1.0s
+//     responses on the same key in the same minute while the other two never waver —
+//     the 2026-08-01 signature, unchanged. At ~36% per request a ten-tool-call task
+//     stalls with ~99% probability, so it is not defaultable however good the model is.
+//     gpt-oss-120b takes the latency crown outright AND honours reasoning_effort
+//     (verified: low → 9 reasoning deltas, high → 61), so it is the only one of the
+//     three that gives the user a working dial. It is a smaller model than GLM 5.2 and
+//     Kimi K2.6; that capability trade was made knowingly. It also serves from NEAR as
+//     well as Tinfoil — the only capable model here with two attested homes.
+//
+// Re-measure before moving this again. The stall behaviour is a property of a
+// provider's deployment, not of a model, and it has already changed under us twice.
+export const TINFOIL_MODEL_ID = "tinfoil/gpt-oss-120b";
 
 // Same model, reached two ways:
 //   - TINFOIL_DEFAULT_SPEC — direct to inference.tinfoil.sh with the user's own

package/src/providers/modelCatalog.ts

@@ -0,0 +1,115 @@
+// What the `/model` picker is allowed to offer, and why it might be short.
+//
+// Three surfaces build that list — the REPL (`cli/chat.ts`), the desktop session
+// (`desktop/src/main/agentSession.ts`) and, through the relay, the app's picker
+// sheet — and all three used the same two lines: `modelRegistry.getAvailable()`,
+// mapped to `provider/id` and sorted. Two things about that list are surprising
+// enough that they belong here rather than being rediscovered at each call site:
+//
+//  1. **Sealed-only models are registered late.** `phala/*` is registered only once
+//     the sealed loopback shim is bound (isServableAccountModel — the cleartext
+//     `/api/agent/v1` has no Phala route and rejects those ids outright), and the
+//     shim binds a beat AFTER the session's first synchronous registration. The
+//     account provider re-registers when it comes up, so the catalog heals itself
+//     within ~half a second — but a picker opened inside that window listed a
+//     catalog quietly missing the whole Phala tier. Waiting for the shim first
+//     costs milliseconds (`startShim` is a loopback `listen(0)` — no network and no
+//     attestation) and removes the race.
+//
+//  2. **The account catalog can be registered and yet entirely unavailable.** Pi's
+//     `getAvailable()` is `models.filter(hasConfiguredAuth)`, and hasConfiguredAuth
+//     is "the provider has an auth entry, or its config's apiKey resolves". The
+//     account provider has no apiKey — it authenticates with an OAuth child token —
+//     so every `privateer/*` model (the NEAR and Tinfoil confidential tiers, and the
+//     bulk of the 240-odd catalog) is filtered out until the credential is armed
+//     into Pi's auth store, which needs a machine login. On a signed-out box the
+//     picker therefore drops the entire account catalog and says nothing: it looks
+//     like we don't carry those models, rather than like you're signed out.
+//
+// So: one place computes the list, and the same place reports what it had to hide.
+
+import { hasCredentials } from "../auth/privateer.ts";
+import { ensureSealedShim, sealedEnabled, sealedShimBase } from "./sealedShim.ts";
+
+/** The routing provider for the account channel — `privateer/<catalog id>`. */
+export const ACCOUNT_PROVIDER = "privateer";
+
+/** The shape we need from Pi's model registry (kept structural — it's untyped here). */
+export interface CatalogRegistry {
+  getAll?: () => unknown[];
+  getAvailable?: () => unknown[] | Promise<unknown[]>;
+}
+
+interface RegistryModel {
+  provider?: string;
+  id?: string;
+}
+
+const specOf = (m: RegistryModel): string => `${m.provider}/${m.id}`;
+
+/**
+ * Wait for the sealed shim if it's coming, so a catalog read can't miss the
+ * sealed-only models purely because it happened early (see note 1 above).
+ *
+ * The account provider attached its own post-shim re-registration at extension
+ * init, i.e. BEFORE this one — promise callbacks run in attachment order, so by the
+ * time this resolves, `phala/*` is already in the registry. Failure is not fatal:
+ * the catalog is then honestly the one we can serve.
+ */
+export async function readySealedCatalog(): Promise<void> {
+  if (!sealedEnabled() || sealedShimBase()) return;
+  try {
+    await ensureSealedShim();
+  } catch {
+    /* no shim → no sealed models, which is exactly what the list should show */
+  }
+}
+
+export interface PickerCatalog {
+  /** Sorted `provider/id` specs the session can actually reach — what to offer. */
+  specs: string[];
+  /** Account models registered but unreachable right now (0 when all is well). */
+  hiddenAccountModels: number;
+  /** Whether this machine holds a Privateer login at all. */
+  signedIn: boolean;
+}
+
+/** The picker's list, plus what it had to leave out. */
+export async function pickerCatalog(registry: CatalogRegistry | null | undefined): Promise<PickerCatalog> {
+  await readySealedCatalog();
+  const available = ((await registry?.getAvailable?.()) ?? []) as RegistryModel[];
+  const all = (registry?.getAll?.() ?? []) as RegistryModel[];
+  const offeredAccount = available.filter((m) => m.provider === ACCOUNT_PROVIDER).length;
+  const registeredAccount = all.filter((m) => m.provider === ACCOUNT_PROVIDER).length;
+  return {
+    specs: available.map(specOf).sort(),
+    hiddenAccountModels: Math.max(0, registeredAccount - offeredAccount),
+    signedIn: hasCredentials(),
+  };
+}
+
+/**
+ * One line explaining an account catalog we registered but can't offer, or null
+ * when there's nothing to explain.
+ *
+ * `signInHint` is the caller's own instruction for getting signed in — the REPL
+ * says `/login`, the desktop points at its Account menu — because "sign in" without
+ * saying where is the half of this message that was already implicit.
+ */
+export function hiddenAccountNotice(cat: PickerCatalog, signInHint: string): string | null {
+  if (cat.hiddenAccountModels === 0) return null;
+  const n = cat.hiddenAccountModels;
+  const models = `${n} Privateer account model${n === 1 ? "" : "s"} (including the confidential TEE ones)`;
+  return cat.signedIn
+    // Signed in but still unavailable: the credential never reached Pi's auth store
+    // — a revoked machine login, the terminal cap, or a network blip while arming.
+    ? `${models} are hidden — the account channel isn't armed. ${signInHint}`
+    : `Not signed in — ${models} are hidden. ${signInHint}`;
+}
+
+/** A short suffix for the picker's own title, so the shortfall shows where you're looking. */
+export function hiddenAccountTitleSuffix(cat: PickerCatalog): string {
+  return cat.hiddenAccountModels === 0
+    ? ""
+    : ` · sign in for ${cat.hiddenAccountModels} more`;
+}

package/src/remote/skillsControl.ts

@@ -79,6 +79,17 @@ export function makeSkillsControl(opts: {
   cwd: string;
   agentDir: string;
   settingsManager: SettingsManager;
+  /**
+   * Extra skill directories to load beyond settings' own `skillPaths`.
+   *
+   * The desktop passes this folder's per-spawn skills dir (config/spawns.ts). Pi
+   * discovers project skills only under `<cwd>/.privateer/skills`, which would mean
+   * writing into the user's tree to give a folder its own skills — so they live
+   * under the global dir with the folder's other defaults and arrive here instead.
+   * Read-only from this control's point of view: `editable` still means "under
+   * <agentDir>/skills", so create/delete keep targeting the one dir they always did.
+   */
+  extraSkillPaths?: string[];
 }): SkillsControl {
   // The user's own global skills live here; only these are editable.
   const userSkillsDir = path.join(opts.agentDir, "skills");
@@ -99,6 +110,12 @@ export function makeSkillsControl(opts: {
     } catch {
       skillPaths = [];
     }
+    // Appended, not prepended: a path the user configured in settings outranks a
+    // per-spawn one on a name clash, the same way an explicit setting outranks a
+    // default everywhere else. De-duplicated so a dir named in both is loaded once.
+    for (const extra of opts.extraSkillPaths ?? []) {
+      if (extra && !skillPaths.includes(extra)) skillPaths.push(extra);
+    }
     let result;
     try {
       result = loadSkills({ cwd: opts.cwd, agentDir: opts.agentDir, skillPaths, includeDefaults: true });

package/src/updates.ts

@@ -0,0 +1,106 @@
+// What's out of date — the two kinds of update a Privateer terminal can have pending,
+// owned in one place so every surface gives the same answer.
+//
+//   1. THE CLI ITSELF (privateer-agent). Read from the cache the launcher refreshes in
+//      the background at most ~daily (bin/privateer-launch.mjs refreshUpdateCache). We
+//      never fetch here, so the banner stays synchronous and offline-safe. Applying it
+//      REPLACES the running program, so it can only ever be `privateer update` from a
+//      shell — never live.
+//   2. TOOL PACKS (Pi "packages": extensions/skills/prompts/themes installed from npm or
+//      git). Checked in-process by extensions/privateer-update.ts, held here in memory,
+//      and applied live — see that file for why a running terminal can swap them out.
+//
+// The two consumers are different extensions (the banner draws the pending state, /update
+// acts on it), so the pack list gets the same listener idiom as src/context.ts's
+// onContextChanged: a setter fires listeners, and neither extension imports the other.
+// In memory rather than on disk ON PURPOSE — a cache file outlives the update that
+// cleared it, and a banner still flying the flag after you've fetched everything is worse
+// than one that shows up a second late.
+//
+// IMPORT-SAFETY: no Pi imports, no side effects — safe to load from a jiti-loaded
+// extension and from pre-boot code alike.
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { globalDir } from "./config/paths.ts";
+
+// ── the CLI release ──────────────────────────────────────────────────────────
+
+// Is dotted version `a` newer than `b`? Plain numeric compare of major.minor.patch —
+// enough for our npm releases; anything unparseable sorts as 0 and is treated as older.
+function isNewer(a: string, b: string): boolean {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] ?? 0) > (pb[i] ?? 0)) return true;
+    if ((pa[i] ?? 0) < (pb[i] ?? 0)) return false;
+  }
+  return false;
+}
+
+/**
+ * The newer privateer-agent release the launcher's cache knows about, or null when we're
+ * current / offline / never checked. Reads only — the refresh is the launcher's job.
+ */
+export function pendingCliUpdate(current: string): string | null {
+  try {
+    const { latest } = JSON.parse(readFileSync(join(globalDir(), "update-check.json"), "utf8"));
+    if (typeof latest === "string" && isNewer(latest, current)) return latest;
+  } catch {
+    // no cache yet, unreadable, or malformed — nothing pending as far as we know.
+  }
+  return null;
+}
+
+// ── tool packs ───────────────────────────────────────────────────────────────
+
+/** One installed pack with a newer version available. Mirrors Pi's PackageUpdate. */
+export interface PackUpdate {
+  /** The configured source string ("pi-hermes-memory", "github:owner/repo", …). */
+  source: string;
+  /** What to show a human — Pi's own label for the pack. */
+  displayName: string;
+  type: "npm" | "git";
+  scope: "user" | "project";
+}
+
+type Listener = () => void;
+
+// ⚠️ MODULE STATE IS NOT SHARED BETWEEN EXTENSIONS. Pi loads every extension through its
+// OWN jiti instance with moduleCache:false (core/extensions/loader.js), so a module two
+// extensions both import is instantiated TWICE — a plain module-level `let` here would
+// leave the banner reading a different copy from the one /update writes, and the flag
+// would never appear. Verified rather than assumed: two jiti instances importing the same
+// relative module see completely independent state, and a globalThis-keyed store is what
+// crosses between them. Symbol.for so both copies resolve the same key.
+const STATE = Symbol.for("privateer.updates.packs");
+interface PackState {
+  pending: readonly PackUpdate[];
+  listeners: Set<Listener>;
+}
+const state: PackState = (((globalThis as any)[STATE] ??= {
+  pending: [],
+  listeners: new Set<Listener>(),
+}) as PackState);
+
+/** Packs with an update waiting, as of the last check. Empty until the check lands. */
+export function pendingPackUpdates(): readonly PackUpdate[] {
+  return state.pending;
+}
+
+/** Record the result of a check (or of an update that cleared the list) and notify. */
+export function setPendingPackUpdates(next: readonly PackUpdate[]): void {
+  state.pending = [...next];
+  for (const fn of state.listeners) {
+    try {
+      fn();
+    } catch {
+      // a broken listener must not break the check that called us.
+    }
+  }
+}
+
+/** Called whenever the pending list changes — the banner re-renders from it. */
+export function onPackUpdatesChanged(fn: Listener): void {
+  state.listeners.add(fn);
+}