privateer-agent 0.13.0 → 0.14.1

package/src/channels/run.ts

@@ -53,6 +53,8 @@ import { modelRegistryOf } from "../providers/piAuthStore.ts";
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
 import { CRYPTO_TOOL_NAMES } from "../tools/crypto.ts";
 import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
+import { rotateLogIfLarge } from "../harbor/logRotate.ts";
+import { logFilePath } from "../harbor/service.ts";
 
 // Read-only default toolset — same rationale as the routines harbor's SAFE_TOOLS:
 // a turn nobody is watching can't mutate the filesystem or shell out. Now that the
@@ -147,10 +149,19 @@ async function main() {
 
   // ── config ──────────────────────────────────────────────────────────────────
   let cfg: any = {};
+  let raw: string;
   try {
-    cfg = JSON.parse(readFileSync(configPath(), "utf8"));
+    raw = readFileSync(configPath(), "utf8");
   } catch {
-    log(`no config at ${configPath()} — add a channels block (see run.ts header).`);
+    // Nothing configured yet is a clean exit (see the no-bridges case below for why).
+    log(`no config at ${configPath()} — add a channels block (see run.ts header), or set channels up from the app.`);
+    process.exit(0);
+  }
+  try {
+    cfg = JSON.parse(raw);
+  } catch (e) {
+    // A config that exists but won't parse IS a failure: say so, and exit non-zero.
+    log(`can't parse ${configPath()}: ${e instanceof Error ? e.message : String(e)}`);
     process.exit(1);
   }
   const ch = cfg.channels ?? {};
@@ -332,7 +343,12 @@ async function main() {
         // in providers/account.ts hangs off `before_agent_start`, which pi's prompt()
         // never reaches — it throws on its own `hasConfiguredAuth` precheck first.
         if (model?.provider === "privateer") await ensureAccountArmed(undefined);
-        await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () => session.prompt(text));
+        // A chat message is never a command: with expansion on, Pi runs a leading
+        // `/name` as an extension command, so any chat member could send `/privacy off`
+        // or `/privacy allow *` (persisted to config.json). Same rule as ACP.
+        await approvalCtx.run({ bridge, chatId, posture: effectivePosture }, () =>
+          session.prompt(text, { expandPromptTemplates: false }),
+        );
       } catch (e) {
         return { ok: false, error: e instanceof Error ? e.message : String(e) };
       } finally {
@@ -399,15 +415,23 @@ async function main() {
   }
 
   if (bridges.length === 0) {
-    log("no channels started — configure a channels.<platform> block in config.json.");
-    process.exit(1);
+    // Exit 0, not 1: under the login service (`privateer channels install`) a failure
+    // exit is restarted, and "nothing configured yet" doesn't get better by retrying —
+    // it got restarted until systemd's start limit, filling the log with this line.
+    // Configure a channel (from the app or config.json), then start it again.
+    log("no channels started — configure a channels.<platform> block in config.json (or from the app), then run `privateer channels install` again.");
+    process.exit(0);
   }
 
   // Heartbeat: announce the live platforms now and refresh on a cadence so the app's
   // channels manager can tell running from merely-configured. A stale/absent file
   // reads as offline (see channels/status.ts).
   writeChannelsStatus(startedPlatforms);
-  const heartbeat = setInterval(() => writeChannelsStatus(startedPlatforms), HEARTBEAT_MS);
+  const heartbeat = setInterval(() => {
+    writeChannelsStatus(startedPlatforms);
+    // Bound the log launchd appends to (macOS service; a no-op elsewhere). See logRotate.ts.
+    if (rotateLogIfLarge(logFilePath("channels"))) log("rotated channels.log (previous kept as channels.log.1)");
+  }, HEARTBEAT_MS);
   heartbeat.unref?.();
 
   const shutdown = () => {

package/src/cli/channelsCli.ts

@@ -0,0 +1,67 @@
+// `privateer channels [run|install|uninstall|status]` dispatcher.
+//
+// ORDERING CONTRACT: `run` dynamically imports channels/run.ts, which imports
+// ./boot.ts first (env pin + attestation dispatcher) and starts on import. The service
+// subcommands touch no Pi code (harbor/service.ts is import-safe), so they don't pay
+// the session-stack import cost.
+
+function usage(): string {
+  return [
+    "Usage: privateer channels [command]",
+    "",
+    "  run          Run the channels in the foreground (default). Bridges every",
+    "               channels.<platform> block in ~/.privateer/config.json.",
+    "  install      Install it as a login service so it starts at login and stays up.",
+    "               Re-run after changing channels from the app: it restarts them.",
+    "  uninstall    Remove the login service.",
+    "  status       Show whether the service is installed and which channels are live.",
+  ].join("\n");
+}
+
+export async function runChannelsCli(argv: string[]): Promise<void> {
+  const sub = argv[0] ?? "run";
+  switch (sub) {
+    case "run": {
+      await import("../channels/run.ts"); // starts on import, installs its own signal handlers
+      return;
+    }
+    case "install": {
+      const { installService } = await import("../harbor/service.ts");
+      try {
+        const info = installService("channels");
+        process.stdout.write(
+          `Channels installed as a login service.\n  unit: ${info.unitPath}\n  logs: ${info.logPath}\n` +
+            "They start now and at every login. Manage with `privateer channels status|uninstall`.\n",
+        );
+      } catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+      }
+      return;
+    }
+    case "uninstall": {
+      const { uninstallService } = await import("../harbor/service.ts");
+      try {
+        uninstallService("channels");
+        process.stdout.write("Channels login service removed.\n");
+      } catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+      }
+      return;
+    }
+    case "status": {
+      const { channelsStatusReport } = await import("../harbor/service.ts");
+      process.stdout.write((await channelsStatusReport()) + "\n");
+      return;
+    }
+    case "-h":
+    case "--help":
+    case "help":
+      process.stdout.write(usage() + "\n");
+      return;
+    default:
+      process.stderr.write(`Unknown channels command: ${sub}\n\n${usage()}\n`);
+      process.exit(1);
+  }
+}

package/src/config/mediaModels.ts

@@ -18,9 +18,10 @@
  * Missing file, unreadable file and malformed JSON all mean "no choice" — the account
  * default — never a crash in the middle of a tool call.
  */
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { configPath } from "./paths.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 export type MediaKind = "image" | "video";
 
@@ -55,7 +56,7 @@ export function setMediaModelPref(kind: MediaKind, id: string | null): void {
   const next: Record<string, unknown> = { ...cfg, media };
   if (Object.keys(media).length === 0) delete next.media;
   mkdirSync(dirname(configPath()), { recursive: true });
-  writeFileSync(configPath(), JSON.stringify(next, null, 2) + "\n");
+  writeFileAtomic(configPath(), JSON.stringify(next, null, 2) + "\n");
 }
 
 /** The model a call should send: its own `model`, else this machine's choice, else none. */

package/src/config/piiAllow.ts

@@ -28,8 +28,9 @@
 // made in an editor is picked up on the next scan, exactly like one made through the
 // command — there is no "restart to apply" step to explain.
 
-import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { configPath } from "./paths.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 let cached: string[] = [];
 let cachedStamp = "";
@@ -89,7 +90,7 @@ function write(entries: string[]): void {
     /* new or unreadable — a fresh object, so one bad file doesn't lose the edit */
   }
   const privacy = { ...((cfg.privacy as Record<string, unknown>) ?? {}), piiAllow: entries };
-  writeFileSync(configPath(), JSON.stringify({ ...cfg, privacy }, null, 2) + "\n");
+  writeFileAtomic(configPath(), JSON.stringify({ ...cfg, privacy }, null, 2) + "\n");
   invalidate();
 }
 

package/src/config/whatsNew.json

@@ -0,0 +1,10 @@
+{
+  "$comment": "The banner's What's New list, newest first: the two to four things a returning user should notice, not a changelog. `reviewedFor` is the release this list was last looked at for. A release can't ship until it equals package.json's version (scripts/check-whats-new.mjs, run by `npm test` and by release.yml before anything builds), so every release, patches included, is a deliberate look at this list. If nothing new is worth a line, bumping `reviewedFor` alone is the answer. `since` is the release an entry arrived in. `cmd` is shown in the accent colour.",
+  "reviewedFor": "0.14.1",
+  "items": [
+    { "text": "Chat channels as a login service: privateer channels install", "since": "0.14.1" },
+    { "text": "Hand off sensitive files: privateer --private", "since": "0.14.0" },
+    { "text": "Open and switch named terminals —", "cmd": "/term", "since": "0.13.0" },
+    { "text": "Voice follows the window you're in", "since": "0.13.0" }
+  ]
+}

package/src/engine/stallWatchdog.ts

@@ -0,0 +1,61 @@
+// A stall watchdog for headless runs.
+//
+// `privateer -p` waits on the model with no limit. A provider that accepts the request
+// and then sends nothing (measured on the account channel: glm-5-2 stalled 5 of 14
+// requests, see providers/defaultModel.ts) leaves the run hanging forever with nothing
+// on stdout. That is what a 14-minute "hang" on 2026-10-02 looked like from the outside;
+// the session file never appeared, because Pi writes it only once a first reply lands.
+//
+// So: armed when a request goes out, re-armed by every streamed event (text, thinking,
+// tool-call deltas all count, so a slow but live stream never trips it), disarmed when
+// the message ends. Between requests (tool execution) it is off — a long local command
+// is not a provider stall. If it fires, the caller aborts the turn and says why.
+//
+// The limit: PRIVATEER_REPLY_TIMEOUT seconds, default 180, 0 turns it off. Silence, not
+// total time, is what is measured, so a long answer is never cut off for being long.
+
+export const REPLY_TIMEOUT_ENV = "PRIVATEER_REPLY_TIMEOUT";
+export const DEFAULT_REPLY_TIMEOUT_MS = 180_000;
+
+/** The stall limit in ms from the environment; 0 means off. Garbage falls back to the default. */
+export function replyTimeoutMs(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = (env[REPLY_TIMEOUT_ENV] ?? "").trim();
+  if (!raw) return DEFAULT_REPLY_TIMEOUT_MS;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return DEFAULT_REPLY_TIMEOUT_MS;
+  return Math.round(n * 1000);
+}
+
+export class StallWatchdog {
+  private timer: ReturnType<typeof setTimeout> | undefined;
+  private fired = false;
+
+  constructor(
+    private readonly ms: number,
+    private readonly onStall: () => void,
+    private readonly timers: { set: typeof setTimeout; clear: typeof clearTimeout } = { set: setTimeout, clear: clearTimeout },
+  ) {}
+
+  /** A request went out, or something streamed: (re)start the silence clock. */
+  arm(): void {
+    if (this.ms <= 0 || this.fired) return;
+    this.disarm();
+    this.timer = this.timers.set(() => {
+      this.timer = undefined;
+      this.fired = true;
+      this.onStall();
+    }, this.ms);
+    // Never the reason a finished run stays alive (see docs/one-shot-exit.md).
+    (this.timer as { unref?: () => void })?.unref?.();
+  }
+
+  /** The message ended, or the run did: nothing to wait on. */
+  disarm(): void {
+    if (this.timer !== undefined) this.timers.clear(this.timer);
+    this.timer = undefined;
+  }
+
+  get stalled(): boolean {
+    return this.fired;
+  }
+}

package/src/ext/permissionGate.ts

@@ -18,6 +18,7 @@ import { classifyToolCall } from "../permissions/classify.ts";
 import { redactText } from "../util/redact.ts";
 import { coauthorGitCommits } from "../util/coauthor.ts";
 import { DEFAULT_DENYLIST } from "../permissions/danger.ts";
+import { privateModeFromEnv, privateRefusal, type ModelRef } from "../permissions/privateMode.ts";
 
 // The per-tool_call hook context we read (structural subset of Pi's ctx — kept
 // local so the gate stays import-order-safe and unit-testable).
@@ -25,6 +26,8 @@ export interface ToolCallCtx {
   signal?: AbortSignal;
   hasUI?: boolean;
   mode?: "tui" | "rpc" | "json" | "print" | string;
+  // The session's current model — what private mode checks before any tool runs.
+  model?: ModelRef;
   // Pi's ExtensionUIContext shape (verified against pi-coding-agent 0.80):
   // select(title, options: string[]) → chosen string | undefined; confirm(title, message).
   ui?: {
@@ -43,6 +46,10 @@ export interface GateController {
   denylist?: string[];
   cwd: string;
   confineToCwd?: boolean;
+  // Unattended confinement: deny outside-cwd and protected access in every mode, and
+  // treat a read of a credential store as protected even inside cwd. See
+  // ModeGate.hardConfine and ScopeOptions.guardSecretReads.
+  hardConfine?: boolean;
   getRemote?(): boolean;
   // The controller raised the flag: total bypass for remote turns — see
   // ModeGate.getNoQuarter.
@@ -54,6 +61,11 @@ export interface GateController {
   // launch flag (env PRIVATEER_NO_QUARTER); when true the gate auto-allows every
   // action with no prompt.
   getSkipAllPermissions?(): boolean;
+  // Private mode (permissions/privateMode.ts): no tool runs unless the session's model is
+  // verified-private, and only tools that stay on this machine run at all. ORed with
+  // PRIVATEER_PRIVATE, which any controller honours, so a controller can switch it on but
+  // never off.
+  getPrivate?(): boolean;
   // Billing tools the operator authorized before this run started, so an unattended
   // session can spend what it was told it may spend instead of denying every media
   // call for want of a human. Lifts `alwaysAsk` and nothing else — see
@@ -138,10 +150,18 @@ export async function decideToolCall(
     };
   }
 
+  // Private mode sits above every mode, allowlist and approval: nothing a person or a
+  // host answers can show a file to an unverified model or send it off the machine.
+  if (ctrl.getPrivate?.() || privateModeFromEnv()) {
+    const refusal = await privateRefusal(toolName, input, ctx.model);
+    if (refusal) return { block: true, reason: refusal };
+  }
+
   const req = classifyToolCall(toolName, input, {
     cwd: ctrl.cwd,
     confineToCwd: ctrl.confineToCwd,
     allowedOutsideRoots: ctrl.allowedOutsideRoots,
+    guardSecretReads: ctrl.hardConfine,
   });
   if (!req) return undefined; // no gate needed — read-only/in-scope/meta
 
@@ -181,6 +201,7 @@ export async function decideToolCall(
     getNoQuarter: ctrl.getNoQuarter,
     getAutoApprove: ctrl.getAutoApprove,
     getSkipAllPermissions: ctrl.getSkipAllPermissions,
+    hardConfine: ctrl.hardConfine,
     isSpendPreauthorized: ctrl.isSpendPreauthorized
       ? (r: PermissionRequest) => ctrl.isSpendPreauthorized!(r, input, ctx.signal)
       : undefined,

package/src/harbor/accountLease.ts

@@ -0,0 +1,76 @@
+// One account inference session for the whole harbor, shared by every run in flight.
+//
+// The account credential is a single slot per process — `_account` in auth/privateer.ts,
+// one row per pid in accountSessions.ts, one `privateer` entry in auth.json — but the
+// harbor runs several sessions at once: overlapping ticks, a submitted task, a workflow
+// step and a live spawn can all be mid-turn together. Each used to mint its own session
+// on start and revoke "the" session on finish, so the first run to finish revoked
+// whichever session was minted LAST (another run's, mid-turn → 401) and its own leaked
+// server-side until the TTL, with its registry row overwritten so no later launch could
+// reclaim it.
+//
+// A lease fits what the slot can actually hold: the first run to need the account mints
+// it, later runs share it, and the last one out revokes it. Pure — the mint and revoke
+// are injected — so the ordering is testable without a server.
+
+export interface AccountLeaseDeps {
+  /** Mint the account session and arm it (persist + remember). Throws on failure. */
+  mint: () => Promise<void>;
+  /** Revoke the session and drop its persisted copy. Best-effort; must not throw. */
+  revoke: () => Promise<void>;
+  log?: (msg: string) => void;
+}
+
+export interface AccountLease {
+  /** Take a reference. Resolves true when the account session is armed. ALWAYS pair with release(). */
+  acquire(): Promise<boolean>;
+  /** Drop a reference; the last one out revokes the session. */
+  release(): Promise<void>;
+  /** References held right now (tests, status). */
+  readonly refs: number;
+}
+
+export function createAccountLease(deps: AccountLeaseDeps): AccountLease {
+  let refs = 0;
+  // The session the current holders share: resolves true once armed, false if the mint
+  // failed. Undefined when nobody holds one.
+  let current: Promise<boolean> | undefined;
+  // The previous session's revoke. A mint waits on it, so a run that starts as the last
+  // one ends never has its fresh credential dropped by the old one's teardown.
+  let teardown: Promise<void> = Promise.resolve();
+
+  return {
+    get refs() {
+      return refs;
+    },
+    async acquire() {
+      refs++;
+      if (!current) {
+        current = teardown.then(deps.mint).then(
+          () => true,
+          (e) => {
+            deps.log?.(`  account channel unavailable: ${e instanceof Error ? e.message : String(e)}`);
+            return false;
+          },
+        );
+      }
+      const mine = current;
+      const ok = await mine;
+      // A failed mint is not cached: the next run should try again rather than inherit it.
+      if (!ok && current === mine) current = undefined;
+      return ok;
+    },
+    async release() {
+      if (refs === 0) return;
+      refs--;
+      if (refs > 0) return;
+      const held = current;
+      current = undefined;
+      if (!held) return;
+      teardown = teardown.then(async () => {
+        if (await held) await deps.revoke().catch(() => {});
+      });
+      await teardown;
+    },
+  };
+}

package/src/harbor/closeSession.ts

@@ -0,0 +1,20 @@
+// Tear a headless session all the way down. dispose() alone stops the agent but never
+// emits session_shutdown — that is AgentSessionRuntime's job, and we build sessions
+// without one — so every extension that cleans up on it (pi-mcp-adapter's connections,
+// OAuth runtime and lifecycle state among them) leaked once per run, for the life of a
+// resident process. Reason "new", not "quit": to our own extensions "quit" means the
+// PROCESS is exiting (privateer-brand revokes the machine's sessions on it), and the
+// harbor process lives on. Best-effort: teardown must never fail a finished run.
+export async function closeSession(session: any): Promise<void> {
+  try {
+    const runner = session?.extensionRunner;
+    if (runner?.hasHandlers?.("session_shutdown")) await runner.emit({ type: "session_shutdown", reason: "new" });
+  } catch {
+    /* a handler threw — dispose anyway */
+  }
+  try {
+    session?.dispose?.();
+  } catch {
+    /* already disposed */
+  }
+}