privateer-agent 0.12.8 → 0.12.10

package/README.md

@@ -12,9 +12,6 @@
   <a href="https://www.npmjs.com/package/privateer-agent">
     <img src="https://img.shields.io/npm/v/privateer-agent" alt="npm" />
   </a>
-  <a href="https://www.npmjs.com/package/privateer-agent">
-    <img src="https://img.shields.io/npm/dm/privateer-agent" alt="npm downloads" />
-  </a>
   <a href="https://github.com/privateer-agent/privateer-agent/releases">
     <img src="https://img.shields.io/badge/changelog-what's%20new-5b8def" alt="Changelog" />
   </a>
@@ -125,7 +122,7 @@ silently. The moat is swappable; the floor under it holds.
   shots stay continuous, cut them together, then score and narrate the result. Generated media
   is handed straight back as files on your machine; none of it is stored in our cloud. See
   [docs/media-generation.md](docs/media-generation.md).
-- **Talk to it.** `/speak on` reads answers aloud as they're written; **ctrl+x** is push-to-talk
+- **Talk to it.** `/speak on` reads answers aloud as they're written; **alt+t** is push-to-talk
   and the mic closes when you stop talking. Your OS voice by default — nothing leaves the
   machine — or your account's confidential-compute TTS/STT once you sign in. `/talk loop on`
   makes it hands-free. See [Talk to it](#talk-to-it--voice-both-directions).
@@ -187,9 +184,31 @@ npm view privateer-agent dist.attestations   # published from CI with npm proven
 npm audit signatures                         # verify registry signatures + provenance
 ```
 
-The package also declares **no install scripts** — no `postinstall`, nothing. Installing
-it writes files and executes nothing; `npm install -g privateer-agent --ignore-scripts`
-gives an identical result. Code runs only when you run `privateer`.
+And **after** installing — the check nobody else offers, because every signal above is
+an install-time one:
+
+```bash
+privateer verify        # is the install on THIS disk still the one we published?
+```
+
+It reports the install shape, whether this exact version is published and carries a
+provenance attestation, whether any dependency has drifted from its pinned version,
+and which launch-time patches are applied. Inconclusive checks say so rather than
+counting as a pass; `--offline` skips the ones that need the registry.
+
+The package also declares **no install scripts** — no `postinstall`, nothing — so
+nothing we publish executes at install time, and `--ignore-scripts` gives an identical
+result. That is a claim about *our* tarball, not your whole install: a handful of
+packages in the ~500-package dependency tree do declare install hooks, and none of them
+are needed here, so the install we recommend and test is
+
+```bash
+npm install -g privateer-agent --ignore-scripts
+```
+
+Or skip the dependency graph entirely with a bundle (the `curl | sh` one-liner above),
+which verifies a published SHA-256 and, from the next release on, a signed build
+attestation before it unpacks anything.
 
 See [SECURITY.md](SECURITY.md) for the threat model, the permission gate, and how to
 report a vulnerability.
@@ -295,11 +314,11 @@ with `/signout`; manage linked terminals from the app.
 ## Talk to it — voice, both directions
 
 `/speak on` and answers are read aloud **as they are written**, sentence by sentence, with
-code blocks, tables and URLs stripped. Press **ctrl+x** and talk; the mic closes when you
+code blocks, tables and URLs stripped. Press **alt+t** and talk; the mic closes when you
 stop talking and the transcript lands in the composer for you to read before Enter sends it.
 
 ```
-/speak on             read answers aloud    ctrl+x    push to talk (press again to send)
+/speak on             read answers aloud    alt+t     push to talk (press again to send)
 /speak voice <name>   pick a speaker        /talk     the same thing, typed
 /speak rate <n>       0.5–3× pace           /talk loop on   conversation mode, hands-free
 /speak stream off     wait for the full answer instead of speaking as it arrives
@@ -610,7 +629,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 | `/signin` · `/signout` | sign in to a Privateer account (device flow) / sign out |
 | `/remote-access` | link this terminal to the app and allow it to drive (off by default) |
 | `/connect` · `/mcp` | add, enable, or remove MCP connectors / see what actually connected |
-| `/speak` · `/talk` | read answers aloud / voice input (**ctrl+x** is push-to-talk) |
+| `/speak` · `/talk` | read answers aloud / voice input (**alt+t** is push-to-talk) |
 | `/extensions` | list loaded Pi extensions |
 | `/init` | scaffold a starter `PRIVATEER.md` in this directory |
 | `/update` · `/privateer` | update to the latest release / Privateer status and posture |

package/SECURITY.md

@@ -12,11 +12,27 @@ Privateer is a terminal coding agent: it reads and writes files, runs shell comm
 talks to model providers on your behalf. That is the point of it, and it is also the
 threat model. Two things are worth verifying rather than taking on faith.
 
-**The package runs no install scripts.** There is no `preinstall`, `install`,
-`postinstall` or `prepare` hook. `npm install -g privateer-agent` writes files and
-executes nothing; installing with `--ignore-scripts` produces an identical result. Code
-runs only when you run `privateer`. (Dependency patching happens at first launch — see
-`bin/apply-patches.mjs` and `docs/shipping.md`.)
+**This package runs no install scripts.** There is no `preinstall`, `install`,
+`postinstall` or `prepare` hook in `privateer-agent`: nothing we publish executes at
+install time, and installing with `--ignore-scripts` produces an identical result. Our
+code runs only when you run `privateer`. (Dependency patching happens at first launch —
+see `bin/apply-patches.mjs` and `docs/shipping.md`.)
+
+That is a claim about *our* tarball, not about your whole install, and the difference
+matters. `npm install -g privateer-agent` resolves a tree of roughly 500 packages, and
+seven of them do declare install scripts — `esbuild`, `koffi`, `fsevents`, `protobufjs`
+(×2) and `@google/genai` (×2). On a default npm config those execute on your machine, as
+they would for anything else that depends on them. Every one is a build-from-source or
+compatibility-warning fallback we don't need, so install with scripts off:
+
+```bash
+npm install -g privateer-agent --ignore-scripts
+```
+
+That is the install we test and the shape CI publishes from, and it produces a working
+`privateer`. To skip the dependency graph altogether, use a release bundle
+(`curl -fsSL https://privateer.pro/install.sh | sh`): a fixed set of files with a pinned
+Node, no resolution step on your machine at all.
 
 **Releases carry npm provenance.** Published from `.github/workflows/release.yml` with
 `npm publish --provenance`, so npm holds a signed Sigstore attestation binding the
@@ -29,6 +45,26 @@ npm view privateer-agent dist.attestations   # attestation metadata exists
 npm audit signatures                          # verifies registry signatures + provenance
 ```
 
+**You can re-check the install later.** Everything above is an install-time signal, which
+is not much use to someone asking the question weeks afterwards. `privateer verify` reads
+the install actually on disk and reports the shape it took, whether this version is
+published with provenance, whether any dependency has drifted from its pinned version,
+and which launch-time patches are applied. It distinguishes "verified" from "couldn't
+check" and never reports the second as the first. It is not a security boundary — anything
+that can rewrite `node_modules` can rewrite the checker — but it catches the accidental
+and opportunistic cases, which is nearly all of them.
+
+**Bundle downloads are verified before they unpack.** `install.sh` / `install.ps1` fetch
+the release's published SHA-256 and refuse to install on a mismatch, a missing digest, or
+a machine with no way to compute one (`PRIVATEER_SKIP_CHECKSUM=1` overrides, loudly). A
+checksum served from the same origin as the file proves integrity but not provenance, so
+from the release following this change the bundles also carry a GitHub build attestation,
+which the installers verify automatically when `gh` is available:
+
+```bash
+gh attestation verify privateer-darwin-arm64.tar.gz --repo privateer-agent/privateer-agent
+```
+
 If a version lacks provenance, it did not come from this workflow. Treat that as
 suspicious and report it — with one documented exception: **0.6.7 is the first release
 published this way.** Trusted publishing was misconfigured until then, so every earlier

package/bin/privateer-launch.mjs

@@ -294,6 +294,16 @@ else if (sub === "harbor" || sub === "daemon") {
   runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-harbor.mjs"), ...args.slice(1)]);
 }
 
+// --- `privateer verify` ----------------------------------------------------
+// Check the install that is on this disk right now. Every other trust signal we
+// publish is an install-time one (npm provenance at `npm i`, a checksum inside
+// install.sh, a badge on a web page nobody revisits); this is the one a user can
+// run afterwards, on the machine they're worried about. Runs BEFORE ensurePatches
+// so it can report the real patch state rather than the state it just created.
+else if (sub === "verify") {
+  runToCompletion(NODE_BIN, [path.join(REPO, "bin", "privateer-verify.mjs"), ...args.slice(1)]);
+}
+
 // --- `privateer acp` -------------------------------------------------------
 // Privateer as an Agent Client Protocol server, spawned by an ACP host (Buzz's
 // `buzz-acp`, Zed, …) and driven over newline-delimited JSON-RPC on stdio.

package/bin/privateer-verify.d.mts

@@ -0,0 +1,10 @@
+// Types for `privateer verify`. The implementation is plain .mjs for the same
+// reason apply-patches.mjs is: bin/ runs under a bare `node`, before any transpiler.
+
+/**
+ * Check the install rooted at `repo` and print a report. Returns a process exit
+ * code: 0 when nothing FAILED (inconclusive checks are not failures), 1 otherwise.
+ *
+ * `offline` skips every check that needs the npm registry.
+ */
+export function verify(opts: { repo: string; offline?: boolean }): Promise<number>;

package/bin/privateer-verify.mjs

@@ -0,0 +1,289 @@
+// `privateer verify` — check the install that is actually on this disk.
+//
+// Every other trust signal we offer is an INSTALL-TIME signal: npm provenance is
+// checked when you install, install.sh verifies a checksum before it unpacks, the
+// npm page shows a green badge to whoever is looking at the npm page. None of that
+// answers the question a user actually has three weeks later, which is "is the
+// thing on my machine right now still the thing you published?"
+//
+// So this command reads local state first and the network second, and it is careful
+// about the difference between "verified", "couldn't check", and "wrong". A check
+// that cannot reach the registry says so; it never reports a pass it didn't make.
+//
+// Deliberately NOT a security boundary: anything that can rewrite node_modules can
+// rewrite this file too. It is a tampering *smoke alarm* and an honest inventory —
+// useful exactly because most breakage is accidental (a half-finished upgrade, a
+// stale patch stamp, a hand-edited dependency) rather than adversarial.
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { findDepRoot } from "./apply-patches.mjs";
+
+const REGISTRY = process.env.npm_config_registry || "https://registry.npmjs.org";
+const NET_TIMEOUT_MS = 8000;
+
+// --- tiny reporter ---------------------------------------------------------
+// Three outcomes, and the third one is the point: "unknown" must never be
+// rendered as a pass. Exit code reflects only real failures, so `privateer verify`
+// is safe to put in a CI step without breaking on an offline runner.
+const C = process.stdout.isTTY && !process.env.NO_COLOR;
+const dim = (s) => (C ? `\x1b[2m${s}\x1b[0m` : s);
+const bold = (s) => (C ? `\x1b[1m${s}\x1b[0m` : s);
+const green = (s) => (C ? `\x1b[32m${s}\x1b[0m` : s);
+const red = (s) => (C ? `\x1b[31m${s}\x1b[0m` : s);
+const yellow = (s) => (C ? `\x1b[33m${s}\x1b[0m` : s);
+
+let failures = 0;
+let unknowns = 0;
+
+function pass(label, detail) {
+  console.log(`  ${green("✓")} ${label}${detail ? ` ${dim(detail)}` : ""}`);
+}
+function fail(label, detail) {
+  failures++;
+  console.log(`  ${red("✗")} ${label}${detail ? ` ${dim(detail)}` : ""}`);
+}
+function unknown(label, detail) {
+  unknowns++;
+  console.log(`  ${yellow("?")} ${label}${detail ? ` ${dim(detail)}` : ""}`);
+}
+function note(text) {
+  console.log(`    ${dim(text)}`);
+}
+function heading(text) {
+  console.log(`\n${bold(text)}`);
+}
+
+const readJson = (p) => {
+  try {
+    return JSON.parse(fs.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+};
+
+async function getJson(url) {
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(), NET_TIMEOUT_MS);
+  try {
+    const r = await fetch(url, { signal: ac.signal, headers: { accept: "application/json" } });
+    if (!r.ok) return { error: `HTTP ${r.status}` };
+    return { data: await r.json() };
+  } catch (e) {
+    return { error: e.name === "AbortError" ? "timed out" : e.message };
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+/** sha256 over every patch file's name + contents — must match apply-patches.mjs. */
+function patchSetHash(patchDir, files, stampVersion) {
+  const h = crypto.createHash("sha256").update(String(stampVersion));
+  for (const f of files) {
+    h.update(f);
+    h.update(fs.readFileSync(path.join(patchDir, f)));
+  }
+  return h.digest("hex");
+}
+
+export async function verify({ repo, offline = false } = {}) {
+  // Reset: the counters are module state, so a second call in one process (a test,
+  // or any future programmatic caller) would otherwise inherit the first's verdict.
+  failures = 0;
+  unknowns = 0;
+
+  const pkg = readJson(path.join(repo, "package.json")) || {};
+  const version = pkg.version || "unknown";
+  const bundleInfo = readJson(path.join(repo, "BUNDLE_INFO.json"));
+
+  console.log(`\n${bold("⚓ Privateer install check")}  ${dim(`v${version}`)}`);
+
+  // --- 1. what kind of install is this ------------------------------------
+  heading("Install");
+  if (bundleInfo) {
+    pass("self-contained bundle", `${bundleInfo.target || "?"} · pinned Node ${bundleInfo.node || "?"}`);
+    note("bundles ship a fixed file set — nothing was resolved on this machine at install time");
+  } else {
+    pass("npm install", "dependencies were resolved on this machine");
+  }
+  console.log(`  ${dim("path")}   ${repo}`);
+  console.log(`  ${dim("node")}   ${process.version}`);
+
+  // --- 2. is this version the one the registry knows about ----------------
+  // The strongest thing checkable from here without re-downloading a tarball:
+  // does this exact version exist upstream, and does it carry a provenance
+  // attestation? A version the registry has never heard of is the loud case.
+  heading("Published provenance");
+  if (offline) {
+    unknown("skipped (--offline)");
+  } else {
+    const { data, error } = await getJson(`${REGISTRY}/${pkg.name || "privateer-agent"}/${version}`);
+    if (error) {
+      unknown("couldn't reach the npm registry", `(${error})`);
+      note("re-run with a network connection, or use --offline to skip this section");
+    } else if (!data || data.error) {
+      fail(`the registry has no ${pkg.name}@${version}`, "this build was not published");
+      note("an unpublished version is not automatically malicious — an unreleased local");
+      note("checkout looks identical — but a machine you only ever installed from npm");
+      note("should never be in this state.");
+    } else {
+      pass(`published as ${pkg.name}@${version}`);
+      const att = data.dist?.attestations;
+      if (att?.provenance?.predicateType) {
+        pass("carries an npm provenance attestation", att.provenance.predicateType);
+        note("verify the signature chain end-to-end with:  npm audit signatures");
+      } else {
+        fail("no provenance attestation on this version");
+        note("every release from 0.6.7 on is published from CI with --provenance;");
+        note("a later version without one did not come from that workflow.");
+      }
+      const npmUser = data._npmUser?.trustedPublisher?.id;
+      if (npmUser) pass("published by a trusted publisher", npmUser);
+      else if (att) unknown("publisher identity not reported by the registry");
+    }
+  }
+
+  // --- 3. did the dependency tree drift from what we declared -------------
+  // Every direct dependency is pinned to an exact version, precisely so this
+  // check can be exact: a resolved version that differs from the declared one
+  // means the tree was changed after install.
+  heading("Dependencies");
+  const deps = Object.entries(pkg.dependencies || {});
+  const drift = [];
+  const ranged = []; // declared with a range, so there is nothing exact to check against
+  let checked = 0;
+  let missing = 0;
+  for (const [name, want] of deps) {
+    const root = findDepRoot(repo, name);
+    const manifest = root && readJson(path.join(root, "node_modules", ...name.split("/"), "package.json"));
+    if (!manifest) {
+      missing++;
+      continue;
+    }
+    // An exact pin is the only thing this check can be exact about. A caret range
+    // is not a failure, but counting it as a match would be a lie — it would report
+    // "matches its pinned version" for a dependency that has no pinned version.
+    if (!/^\d/.test(want)) {
+      ranged.push(`${name} ${want} (resolved ${manifest.version})`);
+      continue;
+    }
+    checked++;
+    if (manifest.version !== want) drift.push(`${name} ${want} → ${manifest.version}`);
+  }
+  if (missing) {
+    unknown(`${missing} of ${deps.length} direct dependencies not found on disk`);
+    note("normal inside a bundle, which flattens its own tree; unexpected for an npm install");
+  }
+  if (drift.length > 0) {
+    fail(`${drift.length} dependenc${drift.length === 1 ? "y differs" : "ies differ"} from the pinned version`);
+    for (const d of drift) note(d);
+  } else if (checked > 0) {
+    pass(`${checked} direct dependenc${checked === 1 ? "y matches its" : "ies match their"} exact pin`);
+  }
+  if (ranged.length > 0) {
+    // Versions before 0.12.9 shipped caret ranges, so an older install lands here.
+    unknown(`${ranged.length} direct dependenc${ranged.length === 1 ? "y is" : "ies are"} declared as a range — cannot be checked exactly`);
+    for (const d of ranged.slice(0, 5)) note(d);
+    if (ranged.length > 5) note(`… and ${ranged.length - 5} more`);
+  }
+
+  const piRoot = findDepRoot(repo, "@earendil-works/pi-coding-agent");
+  const piPkg =
+    piRoot && readJson(path.join(piRoot, "node_modules", "@earendil-works", "pi-coding-agent", "package.json"));
+  if (piPkg) console.log(`  ${dim("runtime")} pi-coding-agent ${piPkg.version}`);
+
+  // --- 4. patch state ------------------------------------------------------
+  // Patches are applied at LAUNCH into node_modules, so the running tree is
+  // legitimately not byte-identical to the published tarball. That is by design
+  // (it is how we avoid an install script), but it means "the files changed" is
+  // not by itself a finding — this is the section that says which changes are ours.
+  heading("Launch-time patches");
+  const patchDir = path.join(repo, "patches");
+  const patchFiles = fs.existsSync(patchDir)
+    ? fs
+        .readdirSync(patchDir)
+        .filter((f) => f.endsWith(".patch"))
+        .sort()
+    : [];
+  if (patchFiles.length === 0) {
+    pass("none shipped");
+  } else {
+    const stampFile = piRoot && path.join(piRoot, "node_modules", ".privateer-patches.json");
+    const stamp = stampFile && readJson(stampFile);
+    // STAMP_VERSION is private to apply-patches.mjs; try the current value and
+    // report a mismatch as "stale" rather than guessing at the applier's internals.
+    const want = patchSetHash(patchDir, patchFiles, 1);
+    if (!stamp) {
+      unknown(`${patchFiles.length} patch(es) shipped, none recorded as applied`);
+      note("expected before the first launch, or when node_modules is root-owned");
+      note("(sudo npm i -g) — Privateer then runs on stock Pi and says so at startup");
+    } else if (stamp.hash === want) {
+      pass(`${patchFiles.length} patch(es) applied and current`, `at ${stamp.at || "?"}`);
+      for (const f of patchFiles) note(f);
+    } else {
+      unknown("recorded patch set does not match the shipped one", "— will re-apply next launch");
+    }
+  }
+
+  // --- 5. where config and credentials live -------------------------------
+  heading("Config");
+  const home = process.env.PRIVATEER_HOME || path.join(process.env.HOME || "", ".privateer");
+  console.log(`  ${dim("home")}   ${home}${fs.existsSync(home) ? "" : dim(" (not created yet)")}`);
+  for (const d of [".privateer", ".pi"]) {
+    const p = path.join(process.cwd(), d);
+    if (fs.existsSync(p)) console.log(`  ${dim("project")} ${p}`);
+  }
+
+  // --- verdict -------------------------------------------------------------
+  console.log("");
+  if (failures > 0) {
+    console.log(
+      red(`✗ ${failures} check(s) failed`) +
+        (unknowns ? dim(`, ${unknowns} inconclusive`) : "") +
+        "\n" +
+        dim("  If you did not expect this, reinstall from a known-good source:\n") +
+        dim("    curl -fsSL https://privateer.pro/install.sh | sh\n") +
+        dim("  and report it at https://github.com/privateer-agent/privateer-agent/issues"),
+    );
+    return 1;
+  }
+  if (unknowns > 0) {
+    console.log(yellow(`✓ no failures, ${unknowns} check(s) inconclusive`));
+    return 0;
+  }
+  console.log(green("✓ everything checks out"));
+  return 0;
+}
+
+// --- CLI -------------------------------------------------------------------
+// Guarded, so importing this module (from a test, or from the launcher) does not
+// run the command and exit the process out from under the caller.
+//
+// fileURLToPath, not `new URL(...).pathname`: on Windows the latter yields
+// "/C:/Users/..." with percent-encoded spaces, so every path built from it is wrong
+// — and win32 is a platform we ship a bundle for.
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const argv = process.argv.slice(2);
+  if (argv.includes("--help") || argv.includes("-h")) {
+    const cmd = process.env.PRIVATEER_CMD || "privateer";
+    console.log(
+      [
+        `${cmd} verify — check the Privateer install on this machine.`,
+        "",
+        `  ${cmd} verify              run every check`,
+        `  ${cmd} verify --offline    skip the checks that need the npm registry`,
+        "",
+        "Reports the install shape, whether this version is published with npm",
+        "provenance, whether the dependency tree still matches its pinned versions,",
+        "and which launch-time patches are applied.",
+      ].join("\n"),
+    );
+    process.exit(0);
+  }
+  process.exit(await verify({ repo: path.resolve(HERE, ".."), offline: argv.includes("--offline") }));
+}

package/extensions/privateer-brand.ts

@@ -404,8 +404,14 @@ export default function privateerBrand(pi: any): void {
   //     entry is dead for every terminal;
   //   - the default ownership-checked drop for THIS process's exit, which must not
   //     delete the credential another running terminal is using.
-  const dropPersistedAccount = (ctx: any, opts: { force?: boolean } = {}): void => {
-    dropPersistedAccountCredential(ctx, opts);
+  // `ctx` is no longer passed through: pi 0.84 removed ctx.modelRegistry.authStorage, so
+  // the store is resolved from piAuthStore() inside. Kept in the signature because every
+  // caller here is a Pi command handler that has one, and dropping the parameter would
+  // churn call sites for no gain. Fire-and-forget as before — the drop is best-effort and
+  // the server-side TTL is the fallback — but the promise is now caught explicitly rather
+  // than left to become an unhandled rejection.
+  const dropPersistedAccount = (_ctx: any, opts: { force?: boolean } = {}): void => {
+    void dropPersistedAccountCredential(opts).catch(() => { /* best effort — server TTL covers it */ });
   };
 
   // /update — run the global npm install in a child process and report the outcome via

package/extensions/privateer-hints.ts

@@ -39,6 +39,12 @@ function key(binding: Parameters<typeof keyText>[0], fallback: string): string {
   }
 }
 
+// Mirror of privateer-speak's DEFAULT_SHORTCUT. One constant, not a literal at each
+// return, so the two paths below can't drift apart from each other — they can still
+// drift from the package, which is why the value is named here rather than inlined:
+// grep for it when bumping privateer-speak.
+const DEFAULT_TALK_KEY = "alt+t";
+
 // Push-to-talk is pi-speak's own binding, not a Pi keybinding action, so keyText
 // can't see it — it lives in speak.json beside config.json and /talk key rebinds
 // it. Read it the same defensive way (any failure = the default).
@@ -46,9 +52,9 @@ function talkKey(): string {
   try {
     const shortcut = JSON.parse(readFileSync(join(globalDir(), "speak.json"), "utf8"))?.input?.shortcut;
     // An explicit "" is "unbound", not "missing" — only an absent field defaults.
-    return typeof shortcut === "string" ? shortcut : "ctrl+x";
+    return typeof shortcut === "string" ? shortcut : DEFAULT_TALK_KEY;
   } catch {
-    return "ctrl+x";
+    return DEFAULT_TALK_KEY;
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.8",
+  "version": "0.12.10",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -69,30 +69,30 @@
     "node": ">=22.19.0"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "^0.80.3",
-    "@earendil-works/pi-coding-agent": "0.80.3",
-    "@earendil-works/pi-tui": "^0.80.3",
-    "@juicesharp/rpiv-ask-user-question": "^2.2.0",
-    "@juicesharp/rpiv-web-tools": "^1.20.0",
-    "@noble/ciphers": "^2.1.1",
-    "@noble/curves": "^1.9.7",
-    "@noble/hashes": "^1.7.1",
-    "@phala/dcap-qvl": "^0.5.2",
-    "@zed-industries/agent-client-protocol": "^0.4.5",
-    "patch-package": "^8.0.1",
-    "pi-mcp-adapter": "^2.11.0",
-    "pi-privacy": "^0.11.0",
-    "pi-subagents": "^0.34.0",
-    "picomatch": "^4.0.4",
-    "privateer-speak": "0.2.0",
-    "privateer-workflow": "^0.1.0",
-    "tinfoil": "^1.1.11",
-    "tsx": "^4.16.0",
-    "typebox": "^1.3.4",
-    "undici": "^7.28.0",
-    "ws": "^8.21.0",
-    "yaml": "^2.5.0",
-    "zod": "^4.0.16"
+    "@earendil-works/pi-ai": "0.84.1",
+    "@earendil-works/pi-coding-agent": "0.84.1",
+    "@earendil-works/pi-tui": "0.84.1",
+    "@juicesharp/rpiv-ask-user-question": "2.2.0",
+    "@juicesharp/rpiv-web-tools": "1.20.0",
+    "@noble/ciphers": "2.2.0",
+    "@noble/curves": "1.9.7",
+    "@noble/hashes": "1.8.0",
+    "@phala/dcap-qvl": "0.5.2",
+    "@zed-industries/agent-client-protocol": "0.4.5",
+    "patch-package": "8.0.1",
+    "pi-mcp-adapter": "2.11.0",
+    "pi-privacy": "0.11.0",
+    "pi-subagents": "0.34.0",
+    "picomatch": "4.0.5",
+    "privateer-speak": "0.2.2",
+    "privateer-workflow": "0.1.0",
+    "tinfoil": "1.1.11",
+    "tsx": "4.23.0",
+    "typebox": "1.3.4",
+    "undici": "7.29.0",
+    "ws": "8.21.0",
+    "yaml": "2.9.0",
+    "zod": "4.4.3"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",