privateer-agent 0.12.8 → 0.12.11

package/src/session.ts

@@ -16,8 +16,18 @@ import {
   SessionManager,
   SettingsManager,
   ModelRegistry,
-  AuthStorage,
+  ModelRuntime,
 } from "@earendil-works/pi-coding-agent";
+// From pi-ai, deliberately, not pi-coding-agent's `AuthStorage.inMemory()`. 0.84
+// stopped exporting AuthStorage and our pi patch puts the export back — which is
+// fine for the one caller that genuinely needs the file-backed store
+// (providers/piAuthStore.ts) and wrong here, because patches are best-effort by
+// design: `bin/apply-patches.mjs` degrades to stock pi when it cannot write to
+// node_modules (the `sudo npm i -g` case it calls out). A static import of a
+// patched-in export turns that graceful degradation into a hard ERR_IMPORT crash
+// on every session start. pi-ai exports this store unpatched and it implements the
+// same CredentialStore interface, so nothing about the session changes.
+import { InMemoryCredentialStore } from "@earendil-works/pi-ai";
 
 import { agentDir as defaultAgentDir } from "./config/paths.ts";
 import { createEngineEventAdapter } from "./bridge/engineAdapter.ts";
@@ -46,15 +56,23 @@ export interface PrivateerSession {
 export async function createSession(opts: CreateSessionOptions): Promise<PrivateerSession> {
   const AGENT_DIR = opts.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? defaultAgentDir();
 
-  const authStorage = AuthStorage.inMemory();
-  const modelRegistry = ModelRegistry.create(authStorage, `${AGENT_DIR}/models.json`);
-  if (typeof (modelRegistry as any).refresh === "function") await (modelRegistry as any).refresh();
-  else if (typeof (modelRegistry as any).loadModels === "function")
-    await (modelRegistry as any).loadModels();
+  // pi 0.84: ModelRegistry.create(authStorage, modelsPath) is gone. The registry is now
+  // a synchronous facade over a ModelRuntime, and the runtime is what owns credentials —
+  // so the store this session used to hand to the registry is injected into the runtime
+  // instead. Still in-memory: a headless session must not touch the machine's auth.json.
+  const authStorage = new InMemoryCredentialStore();
+  const modelRuntime = await ModelRuntime.create({
+    credentials: authStorage,
+    modelsPath: `${AGENT_DIR}/models.json`,
+  });
+  const modelRegistry = new ModelRegistry(modelRuntime);
+  // Explicit, and awaited: find() below is synchronous, so models.json has to be loaded
+  // before it runs or the lookup fails on a cold cache.
+  await modelRegistry.refresh();
 
   const model = modelRegistry.find(opts.provider, opts.modelId);
   if (!model) {
-    const ids = ((modelRegistry as any).getAll?.() ?? []).map(
+    const ids = (modelRegistry.getAll() ?? []).map(
       (m: any) => `${m.provider}/${m.id}`,
     );
     throw new Error(
@@ -75,8 +93,7 @@ export async function createSession(opts: CreateSessionOptions): Promise<Private
     cwd: opts.cwd,
     agentDir: AGENT_DIR,
     model,
-    authStorage,
-    modelRegistry,
+    modelRuntime,
     settingsManager,
     sessionManager: SessionManager.inMemory(opts.cwd),
     resourceLoader: loader,

package/src/tools/attachResult.ts

@@ -0,0 +1,66 @@
+// The `attach_to_result` tool — hand a file from disk to the Privateer Inbox
+// alongside the answer this unattended run is about to deliver.
+//
+// The sibling of `send_file_to_client`, for the case that tool cannot serve: there
+// is no controller attached and there won't be one. A routine that fires at 7am,
+// or a task submitted from a phone that then went in a pocket, finishes into the
+// cloud outbox — so its media has to travel the same way, sealed to the account
+// key and collected when the app next syncs (src/routines/resultMedia.ts explains
+// the transport; the ceilings live there too).
+//
+// Staging only. Nothing is read, sealed or uploaded here — the run may still fail
+// after this call, and delivery decides what actually goes. That also keeps the
+// tool cheap enough for a model to use freely: it is a promise about the answer,
+// not an upload.
+
+import { Type } from "typebox";
+import type { ResultMedia } from "../routines/resultMedia.ts";
+import { MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES } from "../routines/resultMedia.ts";
+
+function text(t: string) {
+  return { content: [{ type: "text", text: t }], details: {} };
+}
+
+export const ATTACH_RESULT_TOOL = "attach_to_result";
+
+export function makeAttachResultTool(media: ResultMedia) {
+  return {
+    name: ATTACH_RESULT_TOOL,
+    label: "Attach to Result",
+    description:
+      "Attach a file from disk — an image, video, audio clip or document — to the result this run " +
+      "delivers to the user's Privateer Inbox, where they can view, save and share it on their device. " +
+      "Use it for anything you generated or found that is better seen than described; the user is NOT " +
+      "at this machine, so a file path in the answer is not something they can open. Attach the file " +
+      `itself rather than pasting base64 into the answer. Up to ${MAX_ATTACHMENTS} files per result, ` +
+      `${Math.round(MAX_ATTACHMENT_BYTES / 1048576)} MB each. Attaching the same path twice replaces the earlier entry.`,
+    parameters: Type.Object({
+      path: Type.String({ description: "Path of the file to attach, relative to cwd or absolute." }),
+      caption: Type.Optional(
+        Type.String({ description: "One short line shown under the attachment in the app." }),
+      ),
+    }),
+    async execute(
+      _toolCallId: string,
+      params: { path: string; caption?: string },
+      _signal?: AbortSignal,
+      _onUpdate?: unknown,
+      ctx?: { cwd?: string },
+    ) {
+      const res = media.stage(params.path, ctx?.cwd ?? process.cwd(), params.caption);
+      if (!res.ok) return text(`Not attached — ${res.reason}`);
+      const kb = Math.max(1, Math.round(res.item.size / 1024));
+      return text(
+        `Attached ${res.item.name} (${kb} KB, ${res.item.mediaType}). It will be delivered with this result. ` +
+          `Write the answer as if the user can see it — don't paste the file path as the way to open it.`,
+      );
+    },
+  };
+}
+
+/** Registers the tool for a session that has a staging area. */
+export function makeAttachResultTools(media: ResultMedia) {
+  return function attachResultTools(pi: any): void {
+    pi.registerTool?.(makeAttachResultTool(media));
+  };
+}

package/src/tools/media.ts

@@ -9,12 +9,12 @@
 // user has explicitly opted into non-ZDR media (`ZDR_MEDIA_BLOCKED`), and these tools
 // surface that refusal verbatim rather than papering over it.
 //
-// WHAT THIS COSTS, HONESTLY. Generation is NOT end-to-end encrypted and cannot be. The
+// WHAT THIS COSTS, HONESTLY. Generation is NOT encrypted and cannot be. The
 // prompt, any input image, and the finished bytes pass through Privateer's servers in
 // plaintext on the way to and from the model provider — that is what generation IS.
 // What we do control: nothing is persisted server-side. The bytes come back inline and
 // land only in the file you name. Never describe a routine that generates media as
-// private end-to-end; do say the output isn't stored in our cloud.
+// fully private; do say the output isn't stored in our cloud.
 //
 // MUSIC IS THE LOOSEST OF THESE. Neither Lyria SKU has a zero-retention endpoint and no
 // confidential music model exists, so music is deliberately exempt from the ZDR gate

package/src/tools/sendFile.ts

@@ -16,7 +16,10 @@ const MEDIA: Record<string, string> = {
   json: "application/json", csv: "text/csv", html: "text/html", mp4: "video/mp4",
   mov: "video/quicktime", mp3: "audio/mpeg", wav: "audio/wav", zip: "application/zip",
 };
-function mediaTypeForPath(p: string): string {
+// Exported because the inbox-attachment path (routines/resultMedia.ts) types files
+// by the same table: two tables would drift, and the type decides how the app
+// presents an attachment (image inline, video in a player, everything else a chip).
+export function mediaTypeForPath(p: string): string {
   const ext = p.split(".").pop()?.toLowerCase() ?? "";
   return MEDIA[ext] ?? "application/octet-stream";
 }

package/src/tools/videoCompose.ts

@@ -255,7 +255,7 @@ async function opProbe(cwd: string, p: Params, signal?: AbortSignal): Promise<st
     .join("\n");
 }
 
-// Stitch clips end to end, optionally with a crossfade between them.
+// Stitch clips back-to-back, optionally with a crossfade between them.
 async function opConcat(cwd: string, p: Params, signal?: AbortSignal): Promise<string> {
   const list = p.inputs ?? [];
   if (list.length < 2) throw new ToolError("`concat` needs at least two paths in `inputs`.");

package/src/tools/web.ts

@@ -16,7 +16,7 @@
 // not, but the derived query does. That is the same residual metadata leak already
 // documented for Sealed mode in the server's routes/rag.js header, and it is why web
 // access is a switch on the agent rather than an unconditional capability. Never
-// describe a routine that searches as private end-to-end.
+// describe a routine that searches as fully private.
 //
 // SCOPE. These are the UNATTENDED paths' web tools: the harbor (routines, tasks,
 // workflow agent steps) and channels, both of which build a session from an explicit