privateer-agent 0.13.0 → 0.14.1

package/src/permissions/privateMode.ts

@@ -0,0 +1,136 @@
+// Private mode — the contract another agent relies on when it hands Privateer data it
+// must not see itself.
+//
+// The handoff: an agent running on a model that is NOT private (a hosted frontier model,
+// say) has a task that touches sensitive files. It keeps them out of its own context by
+// asking Privateer to do the reading: `privateer -p --private "…"`, or an ACP session
+// with `acp.private`. That only works if Privateer refuses to put those files in front of
+// a model that isn't private either. A config that quietly fell back to a BYO-key model,
+// a sealed shim that never came up, an attestation that came back yellow: each would
+// send the very data the caller was keeping out of its own provider to someone else's.
+//
+// So private mode is enforced where the data enters the model: at the TOOL CALL. Before
+// any tool runs, the session's current model must resolve to a verified-private tier —
+// `tee-verified` (an enclave quote we checked) or `local` (on this machine). Anything
+// else, including a check that throws, blocks the tool. The caller's own prompt still
+// reaches the model, by design: it is the caller's text, and the caller already holds it.
+// What never reaches an unverified model is anything Privateer READ on the caller's
+// behalf.
+//
+// The second half is egress. A private model does not make a tool call private: a
+// web_fetch carrying a file's contents leaves the machine no matter where inference ran.
+// Private mode therefore runs on an ALLOWLIST of tools that stay on this machine, and
+// refuses shell commands that reach the network, before any mode or approval is
+// consulted — so no-quarter, `acp.posture: "auto"` and an approval cannot lift it.
+//
+// Turned on by `--private` (the launcher sets PRIVATEER_PRIVATE=1) or `acp.private`.
+// The env var is honoured from the ambient environment on purpose: unlike the spend
+// grants it can only ever make a run STRICTER, so an orchestrator may export it once
+// for every Privateer it spawns. Subagent children inherit it with the rest of the env.
+//
+// IMPORT-SAFETY: the gate imports this module statically, and the gate must stay
+// import-order-safe, so the Pi-touching posture code is imported dynamically below.
+
+import type { PrivacyTier } from "pi-privacy";
+import { reachesNetwork } from "./danger.ts";
+
+export const PRIVATE_ENV = "PRIVATEER_PRIVATE";
+
+/** True when the environment asks for private mode. */
+export function privateModeFromEnv(env: NodeJS.ProcessEnv = process.env): boolean {
+  const v = (env[PRIVATE_ENV] ?? "").trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+
+/** The tiers a sensitive file may be shown to. Nothing weaker, and nothing asserted. */
+export const PRIVATE_TIERS: ReadonlySet<PrivacyTier> = new Set<PrivacyTier>(["tee-verified", "local"]);
+
+/**
+ * Tools that keep their effects on this machine. Everything else (web, crypto lookups,
+ * media generation, MCP, app/library uploads, routines, screen control) is refused in
+ * private mode, because each one can carry what was read to a third party. `bash` and
+ * `terminal` are here but also pass through reachesNetwork().
+ */
+export const PRIVATE_TOOLS: ReadonlySet<string> = new Set([
+  "read",
+  "grep",
+  "find",
+  "ls",
+  "write",
+  "edit",
+  "bash",
+  "terminal",
+  // Children inherit PRIVATEER_PRIVATE and run this same check against their own model.
+  "subagent",
+  "contact_supervisor",
+  "intercom",
+]);
+
+export interface ModelRef {
+  provider?: string;
+  id?: string;
+  baseUrl?: string;
+}
+
+const TTL_MS = 60_000;
+const tierCache = new Map<string, { tier: PrivacyTier; at: number }>();
+
+/** Test seam: swap how a model's tier is resolved. */
+let resolveTierImpl: (m: Required<Pick<ModelRef, "provider" | "id">> & ModelRef) => Promise<PrivacyTier> = defaultResolveTier;
+export function setTierResolverForTests(fn: typeof resolveTierImpl | undefined): void {
+  resolveTierImpl = fn ?? defaultResolveTier;
+  tierCache.clear();
+}
+
+async function defaultResolveTier(m: Required<Pick<ModelRef, "provider" | "id">> & ModelRef): Promise<PrivacyTier> {
+  // The account channel's verdict is ours to give (see config/privacyPolicy.ts
+  // resolveTier); every other provider is pi-privacy's, which attests TEE providers live
+  // and never returns tee-verified from a static claim.
+  if (m.provider === "privateer") {
+    const { accountPosture } = await import("../providers/account.ts");
+    return (await accountPosture(m.id)).tier;
+  }
+  const { verifyModelPosture } = await import("pi-privacy");
+  const apiKey = m.provider === "nearai" ? process.env.NEARAI_API_KEY : undefined;
+  return (await verifyModelPosture(m.provider, m.id, { baseUrl: m.baseUrl, apiKey })).tier;
+}
+
+/** The model's privacy tier, from a short cache. A failure is not a tier — it throws. */
+export async function modelTier(model: ModelRef): Promise<PrivacyTier> {
+  if (!model.provider || !model.id) throw new Error("no model selected");
+  const key = `${model.provider}/${model.id}@${model.baseUrl ?? ""}`;
+  const hit = tierCache.get(key);
+  if (hit && Date.now() - hit.at < TTL_MS) return hit.tier;
+  const tier = await resolveTierImpl({ ...model, provider: model.provider, id: model.id });
+  tierCache.set(key, { tier, at: Date.now() });
+  return tier;
+}
+
+const label = (m: ModelRef | undefined) => (m?.provider && m?.id ? `${m.provider}/${m.id}` : "no model");
+
+/**
+ * Why this tool call may not run in private mode, or undefined when it may. Never
+ * throws: any failure to establish privacy is itself the refusal.
+ */
+export async function privateRefusal(toolName: string, input: unknown, model: ModelRef | undefined): Promise<string | undefined> {
+  if (!PRIVATE_TOOLS.has(toolName)) {
+    return `${toolName} is unavailable in private mode: it can carry what this session has read off this machine. Work with local files only.`;
+  }
+  if (toolName === "bash" || toolName === "terminal") {
+    const obj = (input ?? {}) as Record<string, unknown>;
+    const command = String(obj.command ?? obj.cmd ?? obj.script ?? "");
+    if (reachesNetwork(command)) {
+      return `This command reaches the network, which private mode refuses: it could carry what this session has read off this machine. Use local commands only.`;
+    }
+  }
+  let tier: PrivacyTier;
+  try {
+    tier = await modelTier(model ?? {});
+  } catch (e) {
+    return `Private mode could not verify ${label(model)} (${e instanceof Error ? e.message : String(e)}), so no tool may run: its output would reach a model that isn't proven private. Stop and report this; do not retry.`;
+  }
+  if (!PRIVATE_TIERS.has(tier)) {
+    return `Private mode: ${label(model)} is "${tier}", not a verified-private model, so no tool may run: its output would reach a model that isn't proven private. Stop and report this; do not retry.`;
+  }
+  return undefined;
+}

package/src/permissions/protected.ts

@@ -1,4 +1,7 @@
-import { basename } from "node:path";
+import { basename, dirname, join, sep } from "node:path";
+import { homedir } from "node:os";
+import { realpathSync } from "node:fs";
+import { agentDir, globalDir } from "../config/paths.ts";
 
 // Files we never auto-edit, even under acceptEdits/allowlist: shell rc / git /
 // package-manager / secrets that a coding task should not silently rewrite. A
@@ -27,3 +30,35 @@ export function isProtectedPath(p: string): boolean {
   const name = basename(p);
   return PROTECTED_BASENAMES.has(name) || looksSensitive(name);
 }
+
+// Where this machine keeps credentials that are never a coding task's business: the
+// standard per-user secret directories, and the files at the top of our OWN state
+// dirs — credentials.json, agent/auth.json, terminal-key.json, config.json (bot
+// tokens, provider keys), mcp.json, account-trust.json and the rest. Only the TOP
+// level of ~/.privateer and its agent dir: their subdirectories (routines output,
+// projects, sessions) are ordinary data a run may legitimately be pointed at.
+//
+// Consulted only by surfaces that opt in (ScopeOptions.guardSecretReads — the
+// harbor's unattended runs), where a READ of one of these is refused even inside the
+// working directory: an unattended run that fetches a web page is one prompt
+// injection away from reading a token and putting it in the next URL it fetches.
+const SECRET_DIRS = [".ssh", ".aws", ".gnupg", ".kube", ".docker", join(".config", "gh"), join(".config", "gcloud")];
+
+function canonical(p: string): string {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+
+function within(root: string, abs: string): boolean {
+  return abs === root || abs.startsWith(root.endsWith(sep) ? root : root + sep);
+}
+
+export function isCredentialStorePath(abs: string): boolean {
+  const home = homedir();
+  if (SECRET_DIRS.some((d) => within(canonical(join(home, d)), abs))) return true;
+  const parent = dirname(abs);
+  return parent === canonical(globalDir()) || parent === canonical(agentDir());
+}

package/src/remote/channelsControl.ts

@@ -21,13 +21,14 @@
  * Framework-agnostic: nothing here imports React or the relay. The caller owns the
  * frame plumbing and the running-presence read.
  */
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { configPath } from "../config/paths.ts";
 // The platform roster, per-platform secret field names, and the "is this block
 // startable" predicate all live in ONE place, shared with the channels runtime —
 // see channels/platforms.ts. Re-exported here so existing importers of
 // CHANNEL_PLATFORMS/ChannelPlatform from this module keep working unchanged.
 import { CHANNEL_PLATFORMS, SECRET_FIELDS, isChannelPlatform, type ChannelPlatform } from "../channels/platforms.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 export { CHANNEL_PLATFORMS };
 export type { ChannelPlatform };
@@ -161,7 +162,7 @@ export function makeChannelsControl(opts: {
 
       cfg.channels[draft.platform] = block;
       try {
-        writeFileSync(configPath(), JSON.stringify(cfg, null, 2));
+        writeFileAtomic(configPath(), JSON.stringify(cfg, null, 2) + "\n");
       } catch (e) {
         return { ok: false, message: `Couldn't write config: ${e instanceof Error ? e.message : String(e)}` };
       }
@@ -174,7 +175,7 @@ export function makeChannelsControl(opts: {
       if (!cfg.channels?.[platform]) return { ok: false, message: "Not configured." };
       delete cfg.channels[platform];
       try {
-        writeFileSync(configPath(), JSON.stringify(cfg, null, 2));
+        writeFileAtomic(configPath(), JSON.stringify(cfg, null, 2) + "\n");
       } catch (e) {
         return { ok: false, message: `Couldn't write config: ${e instanceof Error ? e.message : String(e)}` };
       }

package/src/remote/liveTaskSession.ts

@@ -29,6 +29,8 @@ import { AttachmentStore, type StoredAttachment } from "../util/attachmentStore.
 import { spawnAccountCredentials, revokeAccountSession } from "../auth/privateer.ts";
 import { createUIContext } from "../ext/headlessUi.ts";
 import { noQuarterActive } from "../permissions/noQuarter.ts";
+import type { AccountLease } from "../harbor/accountLease.ts";
+import { closeSession } from "../harbor/closeSession.ts";
 
 export interface LiveTaskHandle {
   termId: string;
@@ -41,6 +43,10 @@ export interface LiveTaskDeps {
   parseSpec: (spec: string) => { provider: string; modelId: string };
   log: (msg: string) => void;
   onClosed: (termId: string) => void;
+  // The harbor's shared account session (harbor/accountLease.ts). The credential slot is
+  // one per process, so a spawn minting and revoking its own killed whatever routine was
+  // mid-turn beside it. Absent → this session mints and revokes its own (standalone use).
+  account?: AccountLease;
   // Deliver the session's closing answer durably (the harbor seals it to the account
   // outbox, so it lands in the app's inbox). A live spawn's feed is otherwise purely
   // ephemeral: close the screen, reap the session, and everything it said is gone —
@@ -72,6 +78,7 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   let initialPromptSent = false;
   let stopped = false;
   let spawnedAccount = false;
+  let leasedAccount = false;
 
   let attachTimer: ReturnType<typeof setTimeout> | undefined;
   let lifeTimer: ReturnType<typeof setTimeout> | undefined;
@@ -111,10 +118,16 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     if (attachTimer) clearTimeout(attachTimer);
     if (lifeTimer) clearTimeout(lifeTimer);
     try { relay?.stop(); } catch { /* already stopped */ }
+    if (session) {
+      try { await session.abort?.(); } catch { /* nothing in flight */ }
+      await closeSession(session); // MCP connections, listeners — see closeSession.ts
+    }
     attachments.cleanup(); // drop the scratch dir holding inbound file bytes
     // Revoke ONLY this session's account inference session so it doesn't linger in the
     // app's Linked Devices; the harbor's own child session stays alive. Best-effort.
-    if (spawnedAccount) {
+    if (leasedAccount) {
+      await deps.account!.release();
+    } else if (spawnedAccount) {
       try { await revokeAccountSession(); } catch { /* server TTL is the fallback */ }
       // Ownership-checked: auth.json is shared machine-wide, so a live task's teardown
       // must not delete an interactive terminal's entry (see providers/account.ts).
@@ -228,7 +241,10 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   });
 
   const { provider, modelId } = deps.parseSpec(modelSpec);
-  if (provider === "privateer") {
+  if (provider === "privateer" && deps.account) {
+    leasedAccount = true; // set before the await, so stop() always releases what we took
+    await deps.account.acquire();
+  } else if (provider === "privateer") {
     try {
       const creds = await spawnAccountCredentials();
       await persistAccountCredential(creds);

package/src/remote/mcpControl.ts

@@ -35,9 +35,10 @@
  * Framework-agnostic: nothing here imports React or the relay. The caller owns the
  * frame plumbing and the sealed-secret open.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { readFileSync, existsSync, mkdirSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { agentDir } from "../config/paths.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 export type McpTransport = "stdio" | "http";
 
@@ -200,7 +201,7 @@ export function makeMcpControl(opts?: {
 
   function writeSource(src: SourceFile): void {
     mkdirSync(dirname(sourcePath()), { recursive: true });
-    writeFileSync(sourcePath(), JSON.stringify(src, null, 2) + "\n");
+    writeFileAtomic(sourcePath(), JSON.stringify(src, null, 2) + "\n");
     project(src);
   }
 
@@ -220,7 +221,7 @@ export function makeMcpControl(opts?: {
       mcpServers[name] = toStandard(e);
     }
     mkdirSync(dirname(projectionPath()), { recursive: true });
-    writeFileSync(
+    writeFileAtomic(
       projectionPath(),
       JSON.stringify({ mcpServers, settings: { toolPrefix: "server" } }, null, 2) + "\n",
     );

package/src/routines/store.ts

@@ -1,4 +1,5 @@
-import { mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync, readdirSync, unlinkSync } from "node:fs";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { globalDir } from "../config/paths.ts";
@@ -64,11 +65,9 @@ export function saveRoutines(routines: Routine[]): void {
   mkdirSync(dir, { recursive: true });
   tryChmod(dir, 0o700);
   const payload: RoutineFile = { routines };
-  writeFileSync(routinesFilePath(), JSON.stringify(payload, null, 2) + "\n", {
-    encoding: "utf8",
-    mode: 0o600,
-  });
-  tryChmod(routinesFilePath(), 0o600);
+  // Atomic: a half-written routines.json reads as "no routines" (loadRoutines), and the
+  // next save would then persist only the one routine it was given.
+  writeFileAtomic(routinesFilePath(), JSON.stringify(payload, null, 2) + "\n", { mode: 0o600 });
 }
 
 // Look up by id first, then by (case-insensitive) name for CLI convenience.
@@ -99,18 +98,48 @@ export function removeRoutine(idOrName: string): Routine | null {
   return target;
 }
 
-// Write a run's result to the routine's output dir: a dated file plus latest.md.
+// Dated result files kept per routine. An hourly routine on an always-on box wrote one
+// every hour, forever; latest.md is what anything reads, and this many is history enough.
+export const ROUTINE_OUTPUT_KEEP = Number(process.env.PRIVATEER_ROUTINE_OUTPUT_KEEP) || 30;
+
+// Write a run's result to the routine's output dir: a dated file plus latest.md, then
+// prune the dated files to the newest ROUTINE_OUTPUT_KEEP. Owner-only, like the rest of
+// the global dir: a result can quote whatever the routine read.
 // Returns the absolute path of latest.md.
 export function writeRoutineOutput(name: string, content: string): string {
   const dir = routineOutputDir(name);
   mkdirSync(dir, { recursive: true });
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
-  writeFileSync(join(dir, `${stamp}.md`), content, "utf8");
+  writeFileSync(join(dir, `${stamp}.md`), content, { encoding: "utf8", mode: 0o600 });
   const latest = join(dir, "latest.md");
-  writeFileSync(latest, content, "utf8");
+  writeFileAtomic(latest, content, { mode: 0o600 });
+  pruneRoutineOutput(dir, ROUTINE_OUTPUT_KEEP);
   return latest;
 }
 
+// Our dated names (ISO with ':' and '.' → '-') sort chronologically as strings, so the
+// oldest are first. Only files of that shape are touched — anything else a user put in
+// the folder is theirs. Best-effort: a prune failure never fails a delivery.
+const DATED_OUTPUT = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z\.md$/;
+
+export function pruneRoutineOutput(dir: string, keep: number): number {
+  let removed = 0;
+  try {
+    const dated = readdirSync(dir).filter((f) => DATED_OUTPUT.test(f)).sort();
+    for (const f of dated.slice(0, Math.max(0, dated.length - keep))) {
+      try {
+        unlinkSync(join(dir, f));
+        removed++;
+      } catch {
+        /* already gone */
+      }
+    }
+  } catch {
+    /* unreadable dir */
+  }
+  return removed;
+}
+
 // A pending routine result queued for the next interactive session ("notice"
 // delivery). The TUI drains these on startup so results surface even when no
 // terminal was attached at fire time.
@@ -144,7 +173,7 @@ export function addNotice(notice: RoutineNotice): void {
   notices.push(notice);
   // Keep the queue bounded so an offline stretch can't grow it without limit.
   const trimmed = notices.slice(-50);
-  writeFileSync(noticesPath(), JSON.stringify(trimmed, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  writeFileAtomic(noticesPath(), JSON.stringify(trimmed, null, 2) + "\n", { mode: 0o600 });
   tryChmod(noticesPath(), 0o600);
 }
 
@@ -189,7 +218,7 @@ export function addPendingRelay(entry: PendingRelay): void {
   const queue = loadPendingRelay();
   queue.push(entry);
   const trimmed = queue.slice(-50); // bound the backlog
-  writeFileSync(pendingRelayPath(), JSON.stringify(trimmed, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  writeFileAtomic(pendingRelayPath(), JSON.stringify(trimmed, null, 2) + "\n", { mode: 0o600 });
   tryChmod(pendingRelayPath(), 0o600);
 }
 
@@ -271,6 +300,6 @@ export function addPendingCloud(entry: PendingCloud): void {
 export function savePendingCloud(entries: PendingCloud[]): void {
   const dir = join(globalDir(), "routines");
   mkdirSync(dir, { recursive: true });
-  writeFileSync(pendingCloudPath(), JSON.stringify(entries, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  writeFileAtomic(pendingCloudPath(), JSON.stringify(entries, null, 2) + "\n", { mode: 0o600 });
   tryChmod(pendingCloudPath(), 0o600);
 }

package/src/util/atomicWrite.ts

@@ -0,0 +1,46 @@
+// Replace a file all at once: write a sibling temp file, then rename it over the target.
+//
+// A plain writeFileSync truncates first and writes second, so a crash, a full disk or a
+// kill in between leaves a short or empty file. For the files this is used on that is
+// worse than losing the write: loadRoutines() reads a half-written routines.json as "no
+// routines", and the next save from the app then writes just the one routine it holds —
+// every other routine gone. rename() is atomic on one filesystem, so a reader sees the
+// old file or the new one and never anything between.
+//
+// Permissions carry over from the file being replaced (a config.json someone chmod'ed
+// 0600 stays 0600). A new file gets `mode`, default 0600: everything written through
+// here is config that can hold tokens.
+//
+// IMPORT-SAFETY: node builtins only.
+import { chmodSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+
+export function writeFileAtomic(path: string, data: string, opts: { mode?: number } = {}): void {
+  // Follow a symlinked config to the file it names, so we replace the file rather than
+  // the link (which would quietly detach a dotfiles-managed config).
+  let target = path;
+  let mode = opts.mode ?? 0o600;
+  try {
+    target = realpathSync(path);
+    if (opts.mode === undefined) mode = statSync(target).mode & 0o777;
+  } catch {
+    /* new file */
+  }
+  const tmp = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tmp, data, { encoding: "utf8", mode });
+    try {
+      chmodSync(tmp, mode); // writeFileSync's mode is filtered by the umask
+    } catch {
+      /* non-POSIX filesystem */
+    }
+    renameSync(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      /* never created */
+    }
+    throw e;
+  }
+}