privateer-agent 0.13.0 → 0.14.0

package/README.md

@@ -54,6 +54,10 @@ Privateer runs in three places, over one account and one config: the **terminal*
 - **Privacy you can verify, not just trust.** Confidential-enclave (TEE) inference is
   cryptographically **attested** — not a policy promise — and an **on-device PII gate**
   warns before structured personal data ever leaves your machine for an unverified model.
+- **A private subagent for your other agents.** Claude Code, Codex, or your own orchestrator
+  can hand Privateer the files it shouldn't read itself: `privateer -p --private "…"` reads
+  them on your machine, reasons over them in an attested enclave, and returns only the
+  answer. See [Hand off sensitive work](#hand-off-sensitive-work-to-privateer).
 - **It's Pi underneath.** Privateer is a distribution of the [Pi](https://pi.dev) coding agent —
   every Pi extension, skill, and command works, and Privateer's own features are just extensions
   you can read, swap, or build on. Nothing to compile. See [Built on Pi](#built-on-pi).
@@ -545,6 +549,8 @@ setup, config, and limitations: [`docs/acp.md`](docs/acp.md).
 Driving Privateer from **your own program or agent**? ACP is how that program gets asked:
 every approval arrives as a `session/request_permission` call it answers. The wire format,
 option ids and a minimal client are in [`docs/acp.md`](docs/acp.md#driving-privateer-from-another-agent).
+Handing it data your program shouldn't see? Set `"private": true` in the `acp` block; see
+[Hand off sensitive work](#hand-off-sensitive-work-to-privateer).
 
 ### One-shot runs (`-p`) and spending
 
@@ -566,6 +572,36 @@ call. `media_capabilities` shows the same prices. A call that can't be priced is
 under a dollar cap rather than let through. `--approve-in-app` reaches the app while it's
 open or running in the background.
 
+## Hand off sensitive work to Privateer
+
+Your coding agent's context goes to its provider. When a task touches files that
+shouldn't (patient records, a customer export, payroll, a database dump), the agent can
+hand that part to Privateer instead of reading the files itself:
+
+```bash
+privateer -p --private --model privateer/tinfoil/gemma4-31b \
+  "Read customers/export.csv. Reply with the number of customers per country. No row-level data."
+```
+
+The calling agent passes file *names*. Privateer reads the files on this machine, reasons
+over them on a verified-private model, and prints only the answer. `--private` is what
+makes that a guarantee rather than a hope:
+
+- **No file reaches an unverified model.** Before every tool call the model must be
+  `tee-verified` (an enclave quote Privateer checked itself) or `local`. A ZDR route, a
+  standard provider, or a failed attestation refuses the tool.
+- **Nothing leaves through a tool.** Only on-machine tools run. Web, MCP, media, uploads
+  and network shell commands (`curl`, `ssh`, `git push`, …) are refused.
+- **Nothing lifts it.** It sits above permission modes and approvals, `--no-quarter`
+  included, and subagents inherit it.
+- **The caller sees only the answer.** `-p` prints the reply. `--private --mode json`,
+  which would stream the file contents, is refused.
+
+The reply itself is the one channel left, so ask for aggregates, yes/no answers, or a
+summary, and have Privateer write detail to a file. Setup for Claude Code and other agents,
+the ACP route for your own programs, prompt patterns, and the honest limits are in
+[`docs/private-handoff.md`](docs/private-handoff.md).
+
 ## Connectors — MCP
 
 Privateer is an **MCP client**. Point it at a [Model Context Protocol](https://modelcontextprotocol.io)
@@ -737,7 +773,10 @@ agent is stuck),
 `privateer acp` (serve the agent to an ACP host like Buzz or Zed — see
 [`docs/acp.md`](docs/acp.md)), `privateer auth status` (is this machine signed in?),
 `privateer -p … [--allow-spend …] [--approve-in-app]` (see
-[one-shot runs](#one-shot-runs--p-and-spending)), `privateer --no-quarter`, `privateer --version`.
+[one-shot runs](#one-shot-runs--p-and-spending)), `privateer --private` (tools run only on a
+verified-private model and never reach the network; see
+[Hand off sensitive work](#hand-off-sensitive-work-to-privateer)), `privateer --no-quarter`,
+`privateer --version`.
 An unknown subcommand of `auth` is an error. It is never sent to the model as a prompt.
 
 ## Develop

package/bin/headless-flags.d.mts

@@ -6,6 +6,7 @@ export const BILLED_TOOLS: string[];
 export const CLI_SPEND_ENV: string;
 export const APPROVE_IN_APP_ENV: string;
 export const PI_SUBCOMMANDS: string[];
+export const PRIVATE_ENV: string;
 
 export interface CliSpendGrant {
   tools: string[];
@@ -22,4 +23,10 @@ export function extractHeadlessFlags(args: string[]): {
   error?: string;
 };
 
+/** Strips `--private` out of `args` in place; true when it was there. */
+export function extractPrivateFlag(args: string[]): boolean;
+
+/** Why these args can't run under --private, or null. */
+export function privateProblem(args: string[]): string | null;
+
 export function authProblem(args: string[], cmd?: string): string | null;

package/bin/headless-flags.mjs

@@ -137,6 +137,46 @@ export function extractHeadlessFlags(args) {
   };
 }
 
+/** The env var carrying `--private` (permissions/privateMode.ts) into every gate. */
+export const PRIVATE_ENV = "PRIVATEER_PRIVATE";
+
+/**
+ * Strip `--private` from `args` (in place). Returns true when it was there.
+ *
+ * Valid for any launch — the TUI, `-p`, `acp` — because it only ever makes a run
+ * stricter: tools run only while the model is verified-private, and only tools that
+ * stay on this machine. Unlike the spend env vars, an exported PRIVATEER_PRIVATE is
+ * honoured too, for the same reason.
+ */
+export function extractPrivateFlag(args) {
+  let found = false;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--") break;
+    if (args[i] === "--private") {
+      args.splice(i, 1);
+      i--;
+      found = true;
+    }
+  }
+  return found;
+}
+
+/**
+ * Why these args can't run in private mode, or null. `--mode json` streams every event
+ * to stdout, tool results included — the contents of every file the run read, handed to
+ * the very caller private mode exists to keep them from. `-p` prints only the answer.
+ */
+export function privateProblem(args) {
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") break;
+    if ((a === "--mode" && args[i + 1] === "json") || a === "--mode=json") {
+      return "--private can't be combined with --mode json: JSON mode streams every tool result (the files this run reads) to stdout. Use -p, which prints only the answer, or `privateer acp`.";
+    }
+  }
+  return null;
+}
+
 // Pi's own subcommands. Pi recognizes each only as args[0], so the launcher must hand
 // them over with NOTHING in front — the normal launch prepends --model, -e and --skill,
 // which is exactly how `privateer auth check` used to become a chat message.

package/bin/privateer-launch.mjs

@@ -29,7 +29,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 import { routeUpdate } from "./update-route.mjs";
-import { APPROVE_IN_APP_ENV, CLI_SPEND_ENV, PI_SUBCOMMANDS, authProblem, extractHeadlessFlags } from "./headless-flags.mjs";
+import { APPROVE_IN_APP_ENV, CLI_SPEND_ENV, PI_SUBCOMMANDS, PRIVATE_ENV, authProblem, extractHeadlessFlags, extractPrivateFlag, privateProblem } from "./headless-flags.mjs";
 import { runToCompletion } from "./run-to-completion.mjs";
 import { filterRespawnArgs, listTerminals, requestFresh, runSupervised } from "./fresh-supervisor.mjs";
 import { configureCompileCache } from "./startup-cache.mjs";
@@ -248,6 +248,16 @@ delete process.env[APPROVE_IN_APP_ENV];
   if (headless.spend) process.env[CLI_SPEND_ENV] = JSON.stringify(headless.spend);
   if (headless.approveInAppMs) process.env[APPROVE_IN_APP_ENV] = String(headless.approveInAppMs);
 }
+// --private: NOT cleared from the inherited env first, unlike the two above — it can only
+// tighten a run, so an orchestrator exporting it for every child is the point.
+if (extractPrivateFlag(args)) process.env[PRIVATE_ENV] = "1";
+if (/^(1|true|yes)$/i.test((process.env[PRIVATE_ENV] ?? "").trim())) {
+  const problem = privateProblem(args);
+  if (problem) {
+    process.stderr.write(`privateer: ${problem}\n`);
+    process.exit(2);
+  }
+}
 
 const sub = args[0];
 

package/extensions/privateer-brand.ts

@@ -281,17 +281,21 @@ function contextLine(p: Palette): string {
 }
 
 // ── "What's New" — a tiny in-banner changelog ────────────────────────────────
-// A hand-curated highlights list (newest first). Not the full changelog — just the two
-// or three things a returning user should notice. `cmd`, when present, is rendered in the
-// accent color so the actionable bit stands out from the prose. Trim this as it ages.
-const WHATS_NEW: Array<{ text: string; cmd?: string }> = [
-  { text: "Open and switch named terminals —", cmd: "/term" },
-  { text: "Voice follows the window you're in" },
-  { text: "Searchable model picker —", cmd: "/models" },
-  { text: "Start over with a new agent —", cmd: "/fresh" },
-];
+// A hand-curated highlights list (newest first), kept in src/config/whatsNew.json so the
+// release guard (scripts/check-whats-new.mjs) can read it without loading the TUI. Not the
+// full changelog — just the two to four things a returning user should notice. `cmd`, when
+// present, is rendered in the accent color so the actionable bit stands out from the prose.
+const WHATS_NEW: Array<{ text: string; cmd?: string }> = (() => {
+  try {
+    const list = JSON.parse(readFileSync(new URL("../src/config/whatsNew.json", import.meta.url), "utf8"));
+    return Array.isArray(list?.items) ? list.items : [];
+  } catch {
+    return []; // a banner without the list beats no banner
+  }
+})();
 
 function whatsNewRows(p: Palette): string[] {
+  if (!WHATS_NEW.length) return [];
   const head = `${p.BOLD}${p.INK}✦ What's new${p.RESET}`;
   const items = WHATS_NEW.map(
     ({ text, cmd }) =>
@@ -322,7 +326,8 @@ function renderBanner(width: number, p: Palette, mark: string[], modelProvider?:
   const packs = packNotice(p);
   if (packs) text.push(packs);
   // A blank spacer, then the What's New block — set off below the identity lines.
-  text.push("", ...whatsNewRows(p));
+  const news = whatsNewRows(p);
+  if (news.length) text.push("", ...news);
 
   // Zip the mark and the text column by row. Rows past the mark's height get a blank
   // gutter of the mark's width, so the text stays in one column throughout.

package/extensions/privateer-gate.ts

@@ -40,6 +40,7 @@ import { updatePostureBadge } from "./privateer-posture.ts";
 import { childSpendAllows } from "../src/permissions/childSpend.ts";
 import { CliSpendLedger, headlessSpendGuidance, isSpendRequest, readCliSpendGrant } from "../src/permissions/cliSpend.ts";
 import { BILLED_MEDIA_TOOLS } from "../src/permissions/classify.ts";
+import { privateModeFromEnv } from "../src/permissions/privateMode.ts";
 import type { PermissionRequest } from "../src/permissions/gate.ts";
 import { HeadlessAppApprover } from "../src/remote/headlessApproval.ts";
 import { describeErrorText } from "../src/engine/errors.ts";
@@ -694,7 +695,9 @@ export default function privateerControl(pi: any): void {
   // prompt, before it plans). Quiet when nothing billable is enabled, or when no quarter
   // lifts the gate anyway.
   function uncoveredBilledTools(): string[] {
-    if (noQuarterActive()) return [];
+    // Private mode refuses every billed tool outright (they send text off the machine),
+    // so "add --allow-spend" would be advice that cannot work.
+    if (noQuarterActive() || privateModeFromEnv()) return [];
     const active: string[] = (() => {
       try {
         return pi.getActiveTools?.() ?? [];
@@ -750,6 +753,25 @@ export default function privateerControl(pi: any): void {
   });
   pi.on("session_shutdown", () => appApprover?.close());
 
+  // Private mode (src/permissions/privateMode.ts), told to the model before it plans:
+  // otherwise it reaches for web_search, gets refused, and narrates the refusal instead
+  // of doing the local work. And the reply is the one channel the gate can't close, so
+  // the model is asked to keep raw records out of it — a request, not a control.
+  pi.on("before_agent_start", (event: any) => {
+    if (!privateModeFromEnv()) return;
+    return {
+      systemPrompt:
+        `${event.systemPrompt}\n\n# Private mode\n` +
+        "This run handles data that must not leave this machine except through a verified-private model. " +
+        "Only local tools work: read, grep, find, ls, write, edit, and shell commands that don't use the network. " +
+        "Web, MCP, media and upload tools, and network commands, are refused. Every tool is refused if the model " +
+        "can't be verified as private; if that happens, stop and say so.\n" +
+        "Your reply leaves private mode: whoever asked will see it. Answer exactly what was asked. Don't quote raw " +
+        "records, names, emails, identifiers or other personal data from the files unless the task explicitly asks " +
+        "for them. When asked for detail, write it to a file and reply with the path.",
+    };
+  });
+
   // Print mode prints a failed turn's raw SDK text — "401 status code (no body)",
   // "Connection error." — and exits. Follow it with what that means and what to do,
   // on stderr so stdout stays the answer (or the JSON stream).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -64,6 +64,7 @@
     "dev": "node bin/privateer-launch.mjs",
     "dev:fresh": "PRIVATEER_HOME=\"$PWD/.dev-home\" node bin/privateer-launch.mjs",
     "typecheck": "tsc --noEmit",
+    "check:whats-new": "node scripts/check-whats-new.mjs",
     "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
   },
   "engines": {

package/src/acp/run.ts

@@ -21,7 +21,8 @@
 //       "model":   "openrouter/openai/gpt-4o-mini",   // optional
 //       "tools":   ["read","grep","find","ls"],        // optional ceiling
 //       "posture": "approve",                          // readonly | approve | auto
-//       "cwd":     "/path/to/project"        // optional; else this process's cwd
+//       "cwd":     "/path/to/project",       // optional; else this process's cwd
+//       "private": true                         // optional; see permissions/privateMode.ts
 //     }
 //   }
 //
@@ -115,6 +116,10 @@ export async function runAcp(): Promise<void> {
     : (web ? [...SAFE_TOOLS, ...WEB_TOOLS] : [...SAFE_TOOLS]);
   const posture: Posture = normalizePosture(block.posture) ?? "approve";
   const baseCwd: string = block.cwd ?? process.cwd();
+  // Private mode: `acp.private`, or `privateer acp --private` / PRIVATEER_PRIVATE (read by
+  // the gate itself). The handoff surface for an agent that must not see the data.
+  const { privateModeFromEnv, modelTier, PRIVATE_TIERS } = await import("../permissions/privateMode.ts");
+  const privateMode: boolean = block.private === true || privateModeFromEnv();
 
   // The gate. Identical posture semantics to the channels runtime: "readonly" maps to
   // plan mode (hard-deny writes), "auto" relaxes non-dangerous actions, and every ask
@@ -129,6 +134,7 @@ export async function runAcp(): Promise<void> {
     confineToCwd: true,
     getRemote: () => true,
     getAutoApprove: () => posture === "auto",
+    getPrivate: () => privateMode,
     async localAsk() {
       return "deny";
     },
@@ -272,8 +278,22 @@ export async function runAcp(): Promise<void> {
   const modelCount = listModels()?.available.length ?? 0;
   log(
     `ready — model ${defaultModel}, ${modelCount} selectable, ` +
-      `ceiling [${tools.join(", ")}], posture ${posture}`,
+      `ceiling [${tools.join(", ")}], posture ${posture}${privateMode ? ", PRIVATE" : ""}`,
   );
+  // Say up front when private mode will refuse every tool, rather than letting the
+  // caller find out from its first denial. The gate re-checks per call regardless.
+  if (privateMode) {
+    try {
+      const tier = await modelTier({ provider: model.provider, id: model.id, baseUrl: model.baseUrl });
+      log(
+        PRIVATE_TIERS.has(tier)
+          ? `private mode: ${defaultModel} is ${tier}`
+          : `private mode: ${defaultModel} is ${tier}, NOT verified-private — every tool will be refused. Pick a TEE or local model.`,
+      );
+    } catch (e) {
+      log(`private mode: could not verify ${defaultModel} (${e instanceof Error ? e.message : String(e)}) — tools will be refused until it verifies`);
+    }
+  }
 
   // One Pi session per ACP session. A single subscription routes streamed text into a
   // mutable holder, which the running turn owns — safe because a session runs at most
@@ -353,7 +373,12 @@ export async function runAcp(): Promise<void> {
           // its own `hasConfiguredAuth` precheck before it emits `before_agent_start`,
           // where providers/account.ts installs the equivalent net.
           await ensureAccountArmed(currentProvider);
-          await session.prompt(text);
+          // Prompt text is the HOST's, so it is never a command: with expansion on, Pi
+          // runs a leading `/name` as an extension command, and anyone who can post to
+          // the host (a Buzz channel, a calling agent) could send `/privacy off` or
+          // `/privacy allow *` — the second persisted to config.json. Text goes to the
+          // model as text.
+          await session.prompt(text, { expandPromptTemplates: false });
         } catch (e) {
           return { ok: false, error: e instanceof Error ? e.message : String(e) };
         } finally {
@@ -371,7 +396,7 @@ export async function runAcp(): Promise<void> {
 
   let agent: InstanceType<typeof PrivateerAcpAgent> | undefined;
   new AgentSideConnection((conn) => {
-    agent = new PrivateerAcpAgent(conn, { createSession, models: listModels, onLog: log });
+    agent = new PrivateerAcpAgent(conn, { createSession, models: listModels, onLog: log, private: privateMode });
     return agent;
   }, stream);
 

package/src/channels/run.ts

@@ -332,7 +332,12 @@ async function main() {
         // in providers/account.ts hangs off `before_agent_start`, which pi's prompt()
         // never reaches — it throws on its own `hasConfiguredAuth` precheck first.
         if (model?.provider === "privateer") await ensureAccountArmed(undefined);
-        await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () => session.prompt(text));
+        // A chat message is never a command: with expansion on, Pi runs a leading
+        // `/name` as an extension command, so any chat member could send `/privacy off`
+        // or `/privacy allow *` (persisted to config.json). Same rule as ACP.
+        await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () =>
+          session.prompt(text, { expandPromptTemplates: false }),
+        );
       } catch (e) {
         return { ok: false, error: e instanceof Error ? e.message : String(e) };
       } finally {

package/src/config/whatsNew.json

@@ -0,0 +1,10 @@
+{
+  "$comment": "The banner's What's New list, newest first: the two to four things a returning user should notice, not a changelog. `reviewedFor` is the release this list was last looked at for. A release can't ship until it equals package.json's version (scripts/check-whats-new.mjs, run by `npm test` and by release.yml before anything builds), so every release, patches included, is a deliberate look at this list. If nothing new is worth a line, bumping `reviewedFor` alone is the answer. `since` is the release an entry arrived in. `cmd` is shown in the accent colour.",
+  "reviewedFor": "0.14.0",
+  "items": [
+    { "text": "Hand off sensitive files: privateer --private", "since": "0.14.0" },
+    { "text": "Open and switch named terminals —", "cmd": "/term", "since": "0.13.0" },
+    { "text": "Voice follows the window you're in", "since": "0.13.0" },
+    { "text": "Searchable model picker —", "cmd": "/models", "since": "0.12.53" }
+  ]
+}

package/src/ext/permissionGate.ts

@@ -18,6 +18,7 @@ import { classifyToolCall } from "../permissions/classify.ts";
 import { redactText } from "../util/redact.ts";
 import { coauthorGitCommits } from "../util/coauthor.ts";
 import { DEFAULT_DENYLIST } from "../permissions/danger.ts";
+import { privateModeFromEnv, privateRefusal, type ModelRef } from "../permissions/privateMode.ts";
 
 // The per-tool_call hook context we read (structural subset of Pi's ctx — kept
 // local so the gate stays import-order-safe and unit-testable).
@@ -25,6 +26,8 @@ export interface ToolCallCtx {
   signal?: AbortSignal;
   hasUI?: boolean;
   mode?: "tui" | "rpc" | "json" | "print" | string;
+  // The session's current model — what private mode checks before any tool runs.
+  model?: ModelRef;
   // Pi's ExtensionUIContext shape (verified against pi-coding-agent 0.80):
   // select(title, options: string[]) → chosen string | undefined; confirm(title, message).
   ui?: {
@@ -43,6 +46,10 @@ export interface GateController {
   denylist?: string[];
   cwd: string;
   confineToCwd?: boolean;
+  // Unattended confinement: deny outside-cwd and protected access in every mode, and
+  // treat a read of a credential store as protected even inside cwd. See
+  // ModeGate.hardConfine and ScopeOptions.guardSecretReads.
+  hardConfine?: boolean;
   getRemote?(): boolean;
   // The controller raised the flag: total bypass for remote turns — see
   // ModeGate.getNoQuarter.
@@ -54,6 +61,11 @@ export interface GateController {
   // launch flag (env PRIVATEER_NO_QUARTER); when true the gate auto-allows every
   // action with no prompt.
   getSkipAllPermissions?(): boolean;
+  // Private mode (permissions/privateMode.ts): no tool runs unless the session's model is
+  // verified-private, and only tools that stay on this machine run at all. ORed with
+  // PRIVATEER_PRIVATE, which any controller honours, so a controller can switch it on but
+  // never off.
+  getPrivate?(): boolean;
   // Billing tools the operator authorized before this run started, so an unattended
   // session can spend what it was told it may spend instead of denying every media
   // call for want of a human. Lifts `alwaysAsk` and nothing else — see
@@ -138,10 +150,18 @@ export async function decideToolCall(
     };
   }
 
+  // Private mode sits above every mode, allowlist and approval: nothing a person or a
+  // host answers can show a file to an unverified model or send it off the machine.
+  if (ctrl.getPrivate?.() || privateModeFromEnv()) {
+    const refusal = await privateRefusal(toolName, input, ctx.model);
+    if (refusal) return { block: true, reason: refusal };
+  }
+
   const req = classifyToolCall(toolName, input, {
     cwd: ctrl.cwd,
     confineToCwd: ctrl.confineToCwd,
     allowedOutsideRoots: ctrl.allowedOutsideRoots,
+    guardSecretReads: ctrl.hardConfine,
   });
   if (!req) return undefined; // no gate needed — read-only/in-scope/meta
 
@@ -181,6 +201,7 @@ export async function decideToolCall(
     getNoQuarter: ctrl.getNoQuarter,
     getAutoApprove: ctrl.getAutoApprove,
     getSkipAllPermissions: ctrl.getSkipAllPermissions,
+    hardConfine: ctrl.hardConfine,
     isSpendPreauthorized: ctrl.isSpendPreauthorized
       ? (r: PermissionRequest) => ctrl.isSpendPreauthorized!(r, input, ctx.signal)
       : undefined,

package/src/harbor/accountLease.ts

@@ -0,0 +1,76 @@
+// One account inference session for the whole harbor, shared by every run in flight.
+//
+// The account credential is a single slot per process — `_account` in auth/privateer.ts,
+// one row per pid in accountSessions.ts, one `privateer` entry in auth.json — but the
+// harbor runs several sessions at once: overlapping ticks, a submitted task, a workflow
+// step and a live spawn can all be mid-turn together. Each used to mint its own session
+// on start and revoke "the" session on finish, so the first run to finish revoked
+// whichever session was minted LAST (another run's, mid-turn → 401) and its own leaked
+// server-side until the TTL, with its registry row overwritten so no later launch could
+// reclaim it.
+//
+// A lease fits what the slot can actually hold: the first run to need the account mints
+// it, later runs share it, and the last one out revokes it. Pure — the mint and revoke
+// are injected — so the ordering is testable without a server.
+
+export interface AccountLeaseDeps {
+  /** Mint the account session and arm it (persist + remember). Throws on failure. */
+  mint: () => Promise<void>;
+  /** Revoke the session and drop its persisted copy. Best-effort; must not throw. */
+  revoke: () => Promise<void>;
+  log?: (msg: string) => void;
+}
+
+export interface AccountLease {
+  /** Take a reference. Resolves true when the account session is armed. ALWAYS pair with release(). */
+  acquire(): Promise<boolean>;
+  /** Drop a reference; the last one out revokes the session. */
+  release(): Promise<void>;
+  /** References held right now (tests, status). */
+  readonly refs: number;
+}
+
+export function createAccountLease(deps: AccountLeaseDeps): AccountLease {
+  let refs = 0;
+  // The session the current holders share: resolves true once armed, false if the mint
+  // failed. Undefined when nobody holds one.
+  let current: Promise<boolean> | undefined;
+  // The previous session's revoke. A mint waits on it, so a run that starts as the last
+  // one ends never has its fresh credential dropped by the old one's teardown.
+  let teardown: Promise<void> = Promise.resolve();
+
+  return {
+    get refs() {
+      return refs;
+    },
+    async acquire() {
+      refs++;
+      if (!current) {
+        current = teardown.then(deps.mint).then(
+          () => true,
+          (e) => {
+            deps.log?.(`  account channel unavailable: ${e instanceof Error ? e.message : String(e)}`);
+            return false;
+          },
+        );
+      }
+      const mine = current;
+      const ok = await mine;
+      // A failed mint is not cached: the next run should try again rather than inherit it.
+      if (!ok && current === mine) current = undefined;
+      return ok;
+    },
+    async release() {
+      if (refs === 0) return;
+      refs--;
+      if (refs > 0) return;
+      const held = current;
+      current = undefined;
+      if (!held) return;
+      teardown = teardown.then(async () => {
+        if (await held) await deps.revoke().catch(() => {});
+      });
+      await teardown;
+    },
+  };
+}

package/src/harbor/closeSession.ts

@@ -0,0 +1,20 @@
+// Tear a headless session all the way down. dispose() alone stops the agent but never
+// emits session_shutdown — that is AgentSessionRuntime's job, and we build sessions
+// without one — so every extension that cleans up on it (pi-mcp-adapter's connections,
+// OAuth runtime and lifecycle state among them) leaked once per run, for the life of a
+// resident process. Reason "new", not "quit": to our own extensions "quit" means the
+// PROCESS is exiting (privateer-brand revokes the machine's sessions on it), and the
+// harbor process lives on. Best-effort: teardown must never fail a finished run.
+export async function closeSession(session: any): Promise<void> {
+  try {
+    const runner = session?.extensionRunner;
+    if (runner?.hasHandlers?.("session_shutdown")) await runner.emit({ type: "session_shutdown", reason: "new" });
+  } catch {
+    /* a handler threw — dispose anyway */
+  }
+  try {
+    session?.dispose?.();
+  } catch {
+    /* already disposed */
+  }
+}

package/src/harbor/index.ts

@@ -64,6 +64,8 @@ import { postOutbox as sealToOutbox, type OutboxSource } from "../outbox/cloudOu
 import { redactText, collectSecrets } from "../util/redact.ts";
 import { startIpcServer, sendToHarbor, describeRelay, formatDuration, HarborAlreadyRunningError, type IpcRequest, type IpcResponse, type RelayStatus } from "./ipc.ts";
 import { serializeBuild } from "./buildLock.ts";
+import { createAccountLease } from "./accountLease.ts";
+import { closeSession } from "./closeSession.ts";
 import { isHosted, publishRelayPub, webEnabled, mediaEnabled } from "../config/hosted.ts";
 import { relayExposureAllowed } from "../config/relayExposure.ts";
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
@@ -134,6 +136,11 @@ const GATE_TIMEOUT_MS = 5 * 60_000;
 // endpoint or an expired OAuth token from stalling a scheduled run.
 const WARM_TIMEOUT_MS = Number(process.env.PRIVATEER_MCP_WARM_MS) || 30_000;
 const WARM_POLL_MS = 250;
+// Hard ceiling on one unattended run (a routine, a submitted task, a workflow agent
+// step). Nothing else bounds a provider stream that stops sending without closing, and a
+// run stuck there holds its routine's `running` slot until the harbor restarts — the
+// routine silently never fires again. Live spawns have their own cap (liveTaskSession).
+const RUN_TIMEOUT_MS = Number(process.env.PRIVATEER_RUN_TIMEOUT_MS) || 30 * 60_000;
 
 // Distinguishes concurrent runs in the child-spend registry. A counter rather than a
 // timestamp: two runs starting in the same millisecond would share a key, and the second
@@ -177,6 +184,12 @@ function log(msg: string): void {
   process.stdout.write(`[${new Date().toISOString()}] ${msg}\n`);
 }
 
+// Identity of a queued outbox item, for removing the ones a flush delivered from a
+// queue that may have grown while it was posting.
+function pendingKey(p: PendingCloud): string {
+  return JSON.stringify([p.routine, p.at, p.kind ?? "routine", p.status, p.content]);
+}
+
 // Connector notes are things the RUN could not do — a selected connector that isn't
 // configured, or one that wouldn't hand over a tool list. They ride the result
 // because the alternative is the failure mode RoutineIssues exists to prevent: an
@@ -271,6 +284,25 @@ export class Harbor {
   // Live, app-drivable sessions spawned on demand (task_spawn). Each has its OWN relay
   // terminal (task-<uuid>); the harbor just keeps handles so it can reap them on shutdown.
   private readonly liveTasks = new Map<string, LiveTaskHandle>();
+  // The one account inference session every concurrent run shares — see accountLease.ts.
+  private readonly account = createAccountLease({
+    mint: async () => {
+      const creds = await acquireAccountCredential();
+      await persistAccountCredential(creds);
+      rememberAccountCredential(creds); // claim it, so the teardown drops OUR entry only
+    },
+    revoke: async () => {
+      try { await revokeAccountSession(); } catch { /* best effort — server TTL is the fallback */ }
+      // Ownership-checked: an interactive terminal on this machine shares auth.json,
+      // and its entry must survive a harbor run's teardown (see providers/account.ts).
+      try { await dropPersistedAccountCredential(); } catch { /* nothing persisted */ }
+    },
+    log,
+  });
+  // The cloud-outbox flush in progress, if any. Every tick starts one; without this two
+  // could post the same items (duplicates in the Inbox) and the slower one's save would
+  // overwrite what the faster one left.
+  private flushing?: Promise<void>;
 
   // App-facing routine management (list/save/delete/pause/run) over the harbor's
   // relay. Run-now is injected here since only the harbor can actually fire one;
@@ -633,22 +665,33 @@ export class Harbor {
     return sealToOutbox(name, at, status, content, kind, media, source);
   }
 
-  private async flushPendingCloud(): Promise<void> {
+  private flushPendingCloud(): Promise<void> {
+    this.flushing ??= this.doFlushPendingCloud()
+      .catch((e) => log(`outbox flush failed: ${e instanceof Error ? e.message : String(e)}`))
+      .finally(() => {
+        this.flushing = undefined;
+      });
+    return this.flushing;
+  }
+
+  private async doFlushPendingCloud(): Promise<void> {
     if (!hasCredentials()) return;
     const queue = loadPendingCloud();
     if (queue.length === 0) return;
-    const remaining: PendingCloud[] = [];
+    const sent = new Set<string>();
     for (const p of queue) {
-      if (
-        remaining.length === 0 &&
-        (await this.postOutbox(p.routine, p.at, p.status, p.content, p.kind ?? "routine", p.media ?? [], p.source))
-      ) continue;
-      remaining.push(p);
-    }
-    if (remaining.length !== queue.length) {
-      savePendingCloud(remaining);
-      log(`flushed ${queue.length - remaining.length} pending cloud outbox item(s); ${remaining.length} remaining`);
+      // Stop at the first failure: order is preserved, and whatever broke this one
+      // (offline, no outbox key yet) will break the rest too.
+      if (!(await this.postOutbox(p.routine, p.at, p.status, p.content, p.kind ?? "routine", p.media ?? [], p.source))) break;
+      sent.add(pendingKey(p));
     }
+    if (sent.size === 0) return;
+    // Re-read rather than save what we loaded: a run that finished while we were
+    // posting queued its result in the meantime, and overwriting with our snapshot
+    // would delete it.
+    const remaining = loadPendingCloud().filter((p) => !sent.has(pendingKey(p)));
+    savePendingCloud(remaining);
+    log(`flushed ${sent.size} pending cloud outbox item(s); ${remaining.length} remaining`);
   }
 
   private primeSchedule(): void {
@@ -778,32 +821,56 @@ export class Harbor {
     const toInbox = routine.delivery.includes("cloud");
     const media = toInbox ? new ResultMedia() : undefined;
 
-    const { out, status, error, notes } = await this.runSession({
-      prompt: withBrief(routine.prompt, { inbox: toInbox, canAttach: !!media }),
-      cwd: routine.cwd,
-      model: modelSpec,
-      tools: routine.tools ?? [],
-      media,
-    });
-
-    const content = formatResult(routine, out, status, error, notes);
-    const report = await deliver(routine, content, status, {
-      media: media?.list() ?? [],
-      pushRelay: this.pushRelay,
-      pushCloud: this.pushCloud,
-      webhooks: config.webhooks,
-      redact: (text) => redactText(text, collectSecrets(config.providers)),
-    });
-    log(`  "${routine.name}" ${status}; delivered via ${report.delivered.join(", ") || "(none)"}`);
+    let status: "ok" | "error" = "error";
+    let error: string | undefined;
+    let delivered: string[] = [];
+    try {
+      const run = await this.runSession({
+        prompt: withBrief(routine.prompt, { inbox: toInbox, canAttach: !!media }),
+        cwd: routine.cwd,
+        model: modelSpec,
+        tools: routine.tools ?? [],
+        media,
+      });
+      ({ status, error } = run);
 
-    this.persistRun(routine.id, {
-      lastRun: new Date().toISOString(),
-      lastStatus: status,
-      lastError: error,
-      ...advanceAfterRun(routine),
-    });
-    this.running.delete(routine.id);
-    return { ok: status === "ok", message: report.delivered.join(", ") || undefined };
+      const content = formatResult(routine, run.out, status, error, run.notes);
+      try {
+        const report = await deliver(routine, content, status, {
+          media: media?.list() ?? [],
+          pushRelay: this.pushRelay,
+          pushCloud: this.pushCloud,
+          webhooks: config.webhooks,
+          redact: (text) => redactText(text, collectSecrets(config.providers)),
+        });
+        delivered = report.delivered;
+      } catch (e) {
+        // A full disk, an unwritable output dir. The run happened and was paid for; say
+        // so in the log and on the routine rather than throwing past the schedule
+        // advance below — that throw is what used to re-fire (and re-bill) the routine
+        // on every restart.
+        error = `delivery failed: ${e instanceof Error ? e.message : String(e)}`;
+        status = "error";
+      }
+      log(`  "${routine.name}" ${status}; delivered via ${delivered.join(", ") || "(none)"}${error && delivered.length === 0 ? ` (${error})` : ""}`);
+    } finally {
+      // Always advance the schedule and free the slot, whatever threw above. Without the
+      // finally, one exception left the routine marked running forever (it never fired
+      // again) — or, as an unhandled rejection, crashed the harbor before nextRun moved,
+      // so the restart fired it again straight away.
+      try {
+        this.persistRun(routine.id, {
+          lastRun: new Date().toISOString(),
+          lastStatus: status,
+          lastError: error,
+          ...advanceAfterRun(routine),
+        });
+      } catch (e) {
+        log(`  couldn't record the run of "${routine.name}": ${e instanceof Error ? e.message : String(e)}`);
+      }
+      this.running.delete(routine.id);
+    }
+    return { ok: status === "ok", message: delivered.join(", ") || undefined };
   }
 
   // Build the Pi services for one unattended run: the auto-approve gate, the account
@@ -831,6 +898,11 @@ export class Harbor {
         allowedOutsideRoots: [],
         cwd,
         confineToCwd: true,
+        // Bypass mode lets anything through that the allow-list registered — including
+        // reads outside cwd and of protected files, which bypass allows outright. A run
+        // nobody is watching, that may well have fetched a hostile web page, must not
+        // read ~/.ssh or our own auth.json and put it in the next URL: refuse both.
+        hardConfine: true,
         async localAsk() {
           return "deny";
         },
@@ -954,7 +1026,7 @@ export class Harbor {
           await new Promise((r) => setTimeout(r, WARM_POLL_MS));
         }
       } finally {
-        session.dispose?.();
+        await closeSession(session);
       }
     } catch (e) {
       log(`  connector warm-up failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -977,7 +1049,8 @@ export class Harbor {
     let out = "";
     let status: "ok" | "error" = "ok";
     let error: string | undefined;
-    let spawnedAccount = false;
+    let leasedAccount = false;
+    let session: any;
     const resolved = await this.resolveRunTools(spec.tools, spec.cwd, spec.model);
     // attach_to_result rides with the staging area rather than the allow-list: it is
     // how the answer is DELIVERED, not a capability the run gains. A routine that
@@ -997,14 +1070,10 @@ export class Harbor {
 
       const { provider, modelId } = parseSpec(spec.model);
       if (provider === "privateer") {
-        try {
-          const creds = await acquireAccountCredential();
-          await persistAccountCredential(creds);
-          rememberAccountCredential(creds); // claim it, so the teardown drops OUR entry only
-          spawnedAccount = true;
-        } catch (e) {
-          log(`  account channel unavailable: ${(e as Error).message}`);
-        }
+        // Shared with every other run in flight — see accountLease.ts. A failed mint is
+        // logged by the lease; the run goes ahead and fails on auth with that context.
+        leasedAccount = true;
+        await this.account.acquire();
       }
 
       const model = (modelRegistryOf(services) as any).find(provider, modelId);
@@ -1012,12 +1081,12 @@ export class Harbor {
         status = "error";
         error = `model ${provider}/${modelId} not found`;
       } else {
-        const { session } = await createAgentSessionFromServices({
+        ({ session } = await createAgentSessionFromServices({
           services,
           sessionManager: SessionManager.inMemory(spec.cwd),
           model,
           tools: allowedTools,
-        } as any);
+        } as any));
         const adapter = createEngineEventAdapter();
         session.subscribe((ev: any) => {
           for (const ee of adapter.toEngineEvents(ev)) {
@@ -1028,21 +1097,30 @@ export class Harbor {
             }
           }
         });
-        await session.prompt(spec.prompt);
+        let timedOut = false;
+        const deadline = setTimeout(() => {
+          timedOut = true;
+          void Promise.resolve(session.abort?.()).catch(() => {});
+        }, RUN_TIMEOUT_MS);
+        try {
+          await session.prompt(spec.prompt);
+        } finally {
+          clearTimeout(deadline);
+        }
+        if (timedOut) {
+          status = "error";
+          error = `run stopped after ${Math.round(RUN_TIMEOUT_MS / 60_000)} minutes (PRIVATEER_RUN_TIMEOUT_MS)`;
+        }
       }
     } catch (err) {
       status = "error";
       error = err instanceof Error ? err.message : String(err);
     } finally {
-      // Revoke ONLY this run's account inference session (the harbor's own child API
-      // session — relay/outbox — stays alive until shutdown). Drop Pi's persisted copy
-      // too so a later run's fallback never reuses a revoked token. Best-effort.
-      if (spawnedAccount) {
-        try { await revokeAccountSession(); } catch { /* best effort — server TTL is the fallback */ }
-        // Ownership-checked: an interactive terminal on this machine shares auth.json,
-        // and its entry must survive a harbor run's teardown (see providers/account.ts).
-        try { await dropPersistedAccountCredential(); } catch { /* nothing persisted */ }
-      }
+      if (session) await closeSession(session);
+      // Drop this run's reference to the shared account session; the last run out
+      // revokes it (and its persisted copy). The harbor's own child API session —
+      // relay/outbox — is separate and stays alive until shutdown.
+      if (leasedAccount) await this.account.release();
       // Drop this run's child grant. Unconditional and last: a grant left behind would
       // authorize the NEXT run's subagents for tools that run never named.
       releaseChildSpend();
@@ -1108,6 +1186,7 @@ export class Harbor {
           defaultModel: loadHarborConfig().defaultModel,
           parseSpec,
           log,
+          account: this.account,
           onClosed: (id) => this.liveTasks.delete(id),
           // A live spawn's feed lives only in the attached app; when the session ends
           // (closed, reaped, or timed out) its answer would otherwise be gone. Seal the
@@ -1401,6 +1480,12 @@ export function runHarbor(): void {
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
+  // A resident service: one stray rejection from a fire-and-forget promise (a relay
+  // callback, a run started from IPC) must not take every routine down with it — and,
+  // under launchd/systemd, restart into the same state and do it again. Log it instead.
+  process.on("unhandledRejection", (reason) => {
+    log(`unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}`);
+  });
   harbor.start().catch(async (err) => {
     if (err instanceof HarborAlreadyRunningError) {
       // A resident harbor already owns this machine — leave it in charge. Exit 0 so a

package/src/permissions/classify.ts

@@ -2,7 +2,7 @@ import { resolve, isAbsolute, relative, dirname, join, basename } from "node:pat
 import { realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { isProtectedPath } from "./protected.ts";
+import { isProtectedPath, isCredentialStorePath } from "./protected.ts";
 import type { PermissionRequest } from "./gate.ts";
 
 // NEW glue for the Pi rewrite. In 0.2 each tool built its own PermissionRequest
@@ -19,6 +19,11 @@ export interface ScopeOptions {
   cwd: string;
   confineToCwd?: boolean; // default true
   allowedOutsideRoots?: string[];
+  // Gate a READ of a protected file or credential store (isCredentialStorePath) even
+  // inside cwd, flagged `protected`. Off by default — an interactive session reading
+  // its own project's .env is normal. The harbor's unattended runs turn it on and pair
+  // it with GateController.hardConfine, which refuses anything flagged.
+  guardSecretReads?: boolean;
 }
 
 // Resolve symlinks so an in-cwd symlink can't smuggle a path outside scope past the
@@ -619,13 +624,16 @@ export function classifyToolCall(
     const p = firstPath(obj);
     if (!p) return null; // e.g. grep with no explicit path → in-cwd, no gate
     const abs = resolveInCwd(scope.cwd, p);
-    if (!isOutsideScope(scope, abs)) return null;
+    const outside = isOutsideScope(scope, abs);
+    const secret = scope.guardSecretReads === true && (isProtectedPath(abs) || isCredentialStorePath(abs));
+    if (!outside && !secret) return null;
     return {
       tool: toolName,
       kind: "read",
-      title: "Read outside working directory",
+      title: secret ? "Read a protected file" : "Read outside working directory",
       detail: abs,
-      outside: true,
+      outside,
+      ...(secret ? { protected: true } : {}),
       path: abs,
     };
   }

package/src/permissions/danger.ts

@@ -37,6 +37,15 @@ export function looksLikeSecretExfil(command: string): boolean {
   return SECRET_FILE.test(command) && NETWORK_SINK.test(command);
 }
 
+// Does this command look like it can move bytes off the machine? Private mode refuses
+// these outright (permissions/privateMode.ts). Same heuristic as the exfil check, plus
+// the git and package-manager verbs that upload: a regex over the raw text, not a shell
+// parser, so it is a net, not a proof.
+const UPLOAD_VERB = /\bgit\s+push\b|\b(npm|pnpm|yarn)\s+publish\b/i;
+export function reachesNetwork(command: string): boolean {
+  return NETWORK_SINK.test(command) || UPLOAD_VERB.test(command);
+}
+
 export function matchesDenylist(command: string, patterns: string[]): boolean {
   return patterns.some((src) => {
     if (!src.trim()) return false;

package/src/permissions/modeGate.ts

@@ -69,6 +69,12 @@ export interface ModeGateDeps {
   // budget RECORDS what it allows — asking it about a call the mode would refuse anyway
   // would spend budget on nothing.
   isSpendPreauthorized?: (req: PermissionRequest) => boolean | Promise<boolean>;
+  // Refuse every request that leaves cwd or touches a protected file, whatever the mode.
+  // For the harbor's unattended runs, which run in `bypass` (their safety is the tool
+  // allow-list) — and bypass allows outside/protected outright (mode.ts), which left
+  // their `confineToCwd` meaning nothing. Sits below no-quarter only: an operator who
+  // launched with --no-quarter asked for no gate at all.
+  hardConfine?: boolean;
 }
 
 // The permission gate used by the live TUI. It first applies the mode/allowlist
@@ -85,6 +91,8 @@ export class ModeGate implements PermissionGate {
     // first check so nothing below can force an "ask" back on.
     if (this.deps.getSkipAllPermissions?.()) return "allow";
 
+    if (this.deps.hardConfine && (req.outside || req.protected)) return "deny";
+
     const denylist = this.deps.denylist ?? [];
     const auto = decideAuto(req, this.deps.getMode(), this.deps.allowlist, denylist);
 

package/src/permissions/privateMode.ts

@@ -0,0 +1,136 @@
+// Private mode — the contract another agent relies on when it hands Privateer data it
+// must not see itself.
+//
+// The handoff: an agent running on a model that is NOT private (a hosted frontier model,
+// say) has a task that touches sensitive files. It keeps them out of its own context by
+// asking Privateer to do the reading: `privateer -p --private "…"`, or an ACP session
+// with `acp.private`. That only works if Privateer refuses to put those files in front of
+// a model that isn't private either. A config that quietly fell back to a BYO-key model,
+// a sealed shim that never came up, an attestation that came back yellow: each would
+// send the very data the caller was keeping out of its own provider to someone else's.
+//
+// So private mode is enforced where the data enters the model: at the TOOL CALL. Before
+// any tool runs, the session's current model must resolve to a verified-private tier —
+// `tee-verified` (an enclave quote we checked) or `local` (on this machine). Anything
+// else, including a check that throws, blocks the tool. The caller's own prompt still
+// reaches the model, by design: it is the caller's text, and the caller already holds it.
+// What never reaches an unverified model is anything Privateer READ on the caller's
+// behalf.
+//
+// The second half is egress. A private model does not make a tool call private: a
+// web_fetch carrying a file's contents leaves the machine no matter where inference ran.
+// Private mode therefore runs on an ALLOWLIST of tools that stay on this machine, and
+// refuses shell commands that reach the network, before any mode or approval is
+// consulted — so no-quarter, `acp.posture: "auto"` and an approval cannot lift it.
+//
+// Turned on by `--private` (the launcher sets PRIVATEER_PRIVATE=1) or `acp.private`.
+// The env var is honoured from the ambient environment on purpose: unlike the spend
+// grants it can only ever make a run STRICTER, so an orchestrator may export it once
+// for every Privateer it spawns. Subagent children inherit it with the rest of the env.
+//
+// IMPORT-SAFETY: the gate imports this module statically, and the gate must stay
+// import-order-safe, so the Pi-touching posture code is imported dynamically below.
+
+import type { PrivacyTier } from "pi-privacy";
+import { reachesNetwork } from "./danger.ts";
+
+export const PRIVATE_ENV = "PRIVATEER_PRIVATE";
+
+/** True when the environment asks for private mode. */
+export function privateModeFromEnv(env: NodeJS.ProcessEnv = process.env): boolean {
+  const v = (env[PRIVATE_ENV] ?? "").trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+
+/** The tiers a sensitive file may be shown to. Nothing weaker, and nothing asserted. */
+export const PRIVATE_TIERS: ReadonlySet<PrivacyTier> = new Set<PrivacyTier>(["tee-verified", "local"]);
+
+/**
+ * Tools that keep their effects on this machine. Everything else (web, crypto lookups,
+ * media generation, MCP, app/library uploads, routines, screen control) is refused in
+ * private mode, because each one can carry what was read to a third party. `bash` and
+ * `terminal` are here but also pass through reachesNetwork().
+ */
+export const PRIVATE_TOOLS: ReadonlySet<string> = new Set([
+  "read",
+  "grep",
+  "find",
+  "ls",
+  "write",
+  "edit",
+  "bash",
+  "terminal",
+  // Children inherit PRIVATEER_PRIVATE and run this same check against their own model.
+  "subagent",
+  "contact_supervisor",
+  "intercom",
+]);
+
+export interface ModelRef {
+  provider?: string;
+  id?: string;
+  baseUrl?: string;
+}
+
+const TTL_MS = 60_000;
+const tierCache = new Map<string, { tier: PrivacyTier; at: number }>();
+
+/** Test seam: swap how a model's tier is resolved. */
+let resolveTierImpl: (m: Required<Pick<ModelRef, "provider" | "id">> & ModelRef) => Promise<PrivacyTier> = defaultResolveTier;
+export function setTierResolverForTests(fn: typeof resolveTierImpl | undefined): void {
+  resolveTierImpl = fn ?? defaultResolveTier;
+  tierCache.clear();
+}
+
+async function defaultResolveTier(m: Required<Pick<ModelRef, "provider" | "id">> & ModelRef): Promise<PrivacyTier> {
+  // The account channel's verdict is ours to give (see config/privacyPolicy.ts
+  // resolveTier); every other provider is pi-privacy's, which attests TEE providers live
+  // and never returns tee-verified from a static claim.
+  if (m.provider === "privateer") {
+    const { accountPosture } = await import("../providers/account.ts");
+    return (await accountPosture(m.id)).tier;
+  }
+  const { verifyModelPosture } = await import("pi-privacy");
+  const apiKey = m.provider === "nearai" ? process.env.NEARAI_API_KEY : undefined;
+  return (await verifyModelPosture(m.provider, m.id, { baseUrl: m.baseUrl, apiKey })).tier;
+}
+
+/** The model's privacy tier, from a short cache. A failure is not a tier — it throws. */
+export async function modelTier(model: ModelRef): Promise<PrivacyTier> {
+  if (!model.provider || !model.id) throw new Error("no model selected");
+  const key = `${model.provider}/${model.id}@${model.baseUrl ?? ""}`;
+  const hit = tierCache.get(key);
+  if (hit && Date.now() - hit.at < TTL_MS) return hit.tier;
+  const tier = await resolveTierImpl({ ...model, provider: model.provider, id: model.id });
+  tierCache.set(key, { tier, at: Date.now() });
+  return tier;
+}
+
+const label = (m: ModelRef | undefined) => (m?.provider && m?.id ? `${m.provider}/${m.id}` : "no model");
+
+/**
+ * Why this tool call may not run in private mode, or undefined when it may. Never
+ * throws: any failure to establish privacy is itself the refusal.
+ */
+export async function privateRefusal(toolName: string, input: unknown, model: ModelRef | undefined): Promise<string | undefined> {
+  if (!PRIVATE_TOOLS.has(toolName)) {
+    return `${toolName} is unavailable in private mode: it can carry what this session has read off this machine. Work with local files only.`;
+  }
+  if (toolName === "bash" || toolName === "terminal") {
+    const obj = (input ?? {}) as Record<string, unknown>;
+    const command = String(obj.command ?? obj.cmd ?? obj.script ?? "");
+    if (reachesNetwork(command)) {
+      return `This command reaches the network, which private mode refuses: it could carry what this session has read off this machine. Use local commands only.`;
+    }
+  }
+  let tier: PrivacyTier;
+  try {
+    tier = await modelTier(model ?? {});
+  } catch (e) {
+    return `Private mode could not verify ${label(model)} (${e instanceof Error ? e.message : String(e)}), so no tool may run: its output would reach a model that isn't proven private. Stop and report this; do not retry.`;
+  }
+  if (!PRIVATE_TIERS.has(tier)) {
+    return `Private mode: ${label(model)} is "${tier}", not a verified-private model, so no tool may run: its output would reach a model that isn't proven private. Stop and report this; do not retry.`;
+  }
+  return undefined;
+}

package/src/permissions/protected.ts

@@ -1,4 +1,7 @@
-import { basename } from "node:path";
+import { basename, dirname, join, sep } from "node:path";
+import { homedir } from "node:os";
+import { realpathSync } from "node:fs";
+import { agentDir, globalDir } from "../config/paths.ts";
 
 // Files we never auto-edit, even under acceptEdits/allowlist: shell rc / git /
 // package-manager / secrets that a coding task should not silently rewrite. A
@@ -27,3 +30,35 @@ export function isProtectedPath(p: string): boolean {
   const name = basename(p);
   return PROTECTED_BASENAMES.has(name) || looksSensitive(name);
 }
+
+// Where this machine keeps credentials that are never a coding task's business: the
+// standard per-user secret directories, and the files at the top of our OWN state
+// dirs — credentials.json, agent/auth.json, terminal-key.json, config.json (bot
+// tokens, provider keys), mcp.json, account-trust.json and the rest. Only the TOP
+// level of ~/.privateer and its agent dir: their subdirectories (routines output,
+// projects, sessions) are ordinary data a run may legitimately be pointed at.
+//
+// Consulted only by surfaces that opt in (ScopeOptions.guardSecretReads — the
+// harbor's unattended runs), where a READ of one of these is refused even inside the
+// working directory: an unattended run that fetches a web page is one prompt
+// injection away from reading a token and putting it in the next URL it fetches.
+const SECRET_DIRS = [".ssh", ".aws", ".gnupg", ".kube", ".docker", join(".config", "gh"), join(".config", "gcloud")];
+
+function canonical(p: string): string {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+
+function within(root: string, abs: string): boolean {
+  return abs === root || abs.startsWith(root.endsWith(sep) ? root : root + sep);
+}
+
+export function isCredentialStorePath(abs: string): boolean {
+  const home = homedir();
+  if (SECRET_DIRS.some((d) => within(canonical(join(home, d)), abs))) return true;
+  const parent = dirname(abs);
+  return parent === canonical(globalDir()) || parent === canonical(agentDir());
+}

package/src/remote/liveTaskSession.ts

@@ -29,6 +29,8 @@ import { AttachmentStore, type StoredAttachment } from "../util/attachmentStore.
 import { spawnAccountCredentials, revokeAccountSession } from "../auth/privateer.ts";
 import { createUIContext } from "../ext/headlessUi.ts";
 import { noQuarterActive } from "../permissions/noQuarter.ts";
+import type { AccountLease } from "../harbor/accountLease.ts";
+import { closeSession } from "../harbor/closeSession.ts";
 
 export interface LiveTaskHandle {
   termId: string;
@@ -41,6 +43,10 @@ export interface LiveTaskDeps {
   parseSpec: (spec: string) => { provider: string; modelId: string };
   log: (msg: string) => void;
   onClosed: (termId: string) => void;
+  // The harbor's shared account session (harbor/accountLease.ts). The credential slot is
+  // one per process, so a spawn minting and revoking its own killed whatever routine was
+  // mid-turn beside it. Absent → this session mints and revokes its own (standalone use).
+  account?: AccountLease;
   // Deliver the session's closing answer durably (the harbor seals it to the account
   // outbox, so it lands in the app's inbox). A live spawn's feed is otherwise purely
   // ephemeral: close the screen, reap the session, and everything it said is gone —
@@ -72,6 +78,7 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   let initialPromptSent = false;
   let stopped = false;
   let spawnedAccount = false;
+  let leasedAccount = false;
 
   let attachTimer: ReturnType<typeof setTimeout> | undefined;
   let lifeTimer: ReturnType<typeof setTimeout> | undefined;
@@ -111,10 +118,16 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     if (attachTimer) clearTimeout(attachTimer);
     if (lifeTimer) clearTimeout(lifeTimer);
     try { relay?.stop(); } catch { /* already stopped */ }
+    if (session) {
+      try { await session.abort?.(); } catch { /* nothing in flight */ }
+      await closeSession(session); // MCP connections, listeners — see closeSession.ts
+    }
     attachments.cleanup(); // drop the scratch dir holding inbound file bytes
     // Revoke ONLY this session's account inference session so it doesn't linger in the
     // app's Linked Devices; the harbor's own child session stays alive. Best-effort.
-    if (spawnedAccount) {
+    if (leasedAccount) {
+      await deps.account!.release();
+    } else if (spawnedAccount) {
       try { await revokeAccountSession(); } catch { /* server TTL is the fallback */ }
       // Ownership-checked: auth.json is shared machine-wide, so a live task's teardown
       // must not delete an interactive terminal's entry (see providers/account.ts).
@@ -228,7 +241,10 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   });
 
   const { provider, modelId } = deps.parseSpec(modelSpec);
-  if (provider === "privateer") {
+  if (provider === "privateer" && deps.account) {
+    leasedAccount = true; // set before the await, so stop() always releases what we took
+    await deps.account.acquire();
+  } else if (provider === "privateer") {
     try {
       const creds = await spawnAccountCredentials();
       await persistAccountCredential(creds);