privateer-agent 0.14.0 → 0.14.2

package/README.md

@@ -402,8 +402,12 @@ including a new agent the moment its window opens in front. The window you left
 its mic. (That's [privateer-speak](https://www.npmjs.com/package/privateer-speak)'s focus
 awareness; it needs a terminal that reports focus.)
 
-Works in **macOS Terminal**, **iTerm2**, and inside **tmux** on any platform; other terminals
-get told so. macOS may ask once for permission to let the terminal control itself. Names are
+Works in **macOS Terminal**, **iTerm2**, **Git Bash's own window (mintty)** on Windows, and
+inside **tmux** on any platform; other terminals get told so. macOS may ask once for permission
+to let the terminal control itself. In Git Bash, new windows are mintty windows like the one
+you started in, and since mintty doesn't tell the program inside when it gains or loses focus,
+Privateer watches which window Windows has in front (a small PowerShell loop, one per window)
+so the voice still follows you. Names are
 shared across every Privateer on the machine (`~/.privateer/terminals.json`), and a window
 that's been closed drops off the list on its own.
 
@@ -479,10 +483,30 @@ privateer harbor uninstall
 ```
 
 Installs as a **launchd user agent** on macOS or a **`systemd --user` unit** on Linux — no
-root, no sudo. (There's no Windows service path yet; use `privateer harbor run`.)
+root, no sudo. (There's no Windows service path yet; use `privateer harbor run`.) Logs go to
+`~/.privateer/harbor.log` on macOS (kept under 5 MB, one previous copy as `harbor.log.1`) and
+to the journal on Linux: `journalctl --user -u privateer-harbor`.
 
 Everything the harbor does still runs through the permission gate. Actions needing approval
-surface in the app; routines you approved once run on their own schedule.
+surface in the app; routines you approved once run on their own schedule. Unattended runs
+are confined to their working directory and can't read credential stores (`~/.ssh`,
+`~/.aws`, Privateer's own login and config files), whatever tools they're allowed.
+
+**Chat channels** (Telegram, Slack, Discord, WhatsApp) run beside it, as their own service:
+
+```bash
+privateer channels install    # login service; re-run after changing channels from the app
+privateer channels status     # which platforms are live right now
+privateer channels run        # or in the foreground
+```
+
+**On a VPS:** run both as a dedicated, unprivileged user, never root. A routine you allow
+`bash` runs with that user's full rights. Sign in over SSH with `privateer` and `/login` (it
+prints a code to approve in the app). Nothing needs an inbound port, except WhatsApp's
+webhook. The Linux unit sets `NoNewPrivileges`, `UMask=0077` and a restart limit. It skips
+systemd's namespace sandboxing on purpose, because that fails to start on kernels without
+unprivileged user namespaces. In a container with no systemd, use `privateer harbor run`
+under the container's own restart policy.
 
 ## Workflows
 

package/bin/model-args.d.mts

@@ -0,0 +1,9 @@
+// Types for bin/model-args.mjs — plain .mjs because bin/ runs under a bare `node`.
+
+export function modelArgs(o: {
+  launchArgs: string[];
+  envModel?: string;
+  savedDefault?: string | null;
+  signedIn: boolean;
+  computed: string;
+}): string[];

package/bin/model-args.mjs

@@ -0,0 +1,43 @@
+// Which `--model` the launcher hands Pi, if any.
+//
+// Plain .mjs for the same reason as headless-flags.mjs: bin/ runs under a bare `node`,
+// and the launcher runs on import, so the rule lives where a test can reach it.
+// See tests/modelArgs.test.ts.
+//
+// Precedence:
+//   1. a --model the user typed (already in the args) → add nothing
+//   2. PRIVATEER_MODEL → the computed model
+//   3. a saved pick in settings.json → usually add nothing and let Pi resolve it, which
+//      falls back sanely when a BYO model has vanished from the registry. EXCEPT a
+//      `privateer/*` pick on a signed-in machine, which is passed explicitly (below).
+//   4. nothing saved → the computed model
+//
+// Why the exception. Pi resolves a saved default only when that provider HAS AUTH at
+// the moment the session starts (model-resolver.js findInitialModel, step 3), and if not
+// it silently takes the first model that does: with an OPENROUTER_API_KEY around, that
+// is Pi's openrouter default, moonshotai/kimi-k2.6. The account provider's auth is the
+// one `privateer` entry in auth.json, which is machine-global and removed whenever ANY
+// Privateer process exits (it revokes its own account session on the way out). So a
+// launch that happened to follow another process's exit came up on OpenRouter with no
+// message at all, while settings.json still said privateer/near/…. A `-p` run then sent
+// its work to a ZDR provider instead of the enclave the user picked; under --private it
+// refused every tool and said the model was "zdr-policy", which is how this was found.
+//
+// An explicit --model resolves against every REGISTERED model, auth or not
+// (resolveCliModel → getModels()), and the account credential is armed at
+// session_start, before the first prompt. Being signed in is the condition because
+// that is when arming will succeed; signed out, the saved pick couldn't run anyway and
+// Pi's own resolution is no worse.
+
+/**
+ * @param {{ launchArgs: string[], envModel?: string, savedDefault?: string | null, signedIn: boolean, computed: string }} o
+ * @returns {string[]} args to prepend: [] or ["--model", spec]
+ */
+export function modelArgs({ launchArgs, envModel, savedDefault, signedIn, computed }) {
+  if (launchArgs.includes("--model")) return [];
+  if (envModel) return ["--model", computed];
+  if (savedDefault) {
+    return signedIn && savedDefault.startsWith("privateer/") ? ["--model", savedDefault] : [];
+  }
+  return ["--model", computed];
+}

package/bin/privateer-channels.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// Launcher for the channels runner (Telegram/Slack/Discord/WhatsApp → agent turns).
+// Mirrors bin/privateer-harbor.mjs: load dev keys from the repo .env WITHOUT changing
+// cwd, register tsx so TS resolves regardless of the invocation cwd, then hand off to
+// the channels CLI dispatcher (whose `run` imports ./boot.ts before any Pi code).
+//
+// Invoked two ways: interactively via the launcher (`privateer channels …`), and by the
+// installed launchd/systemd service (`node privateer-channels.mjs run`). This is what
+// makes channels runnable from an npm install; it used to need a source checkout
+// (`npm run channels`, tsx and a .env).
+import { register } from "tsx/esm/api";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const repo = resolve(here, "..");
+
+try {
+  process.loadEnvFile(resolve(repo, ".env"));
+} catch {
+  /* no .env — rely on the ambient environment / ~/.privateer */
+}
+
+// Same reason as the harbor: channel sessions load the moat in code, so subagent
+// children need the moat-injecting wrapper rather than a bare `pi`.
+process.env.PI_SUBAGENT_PI_BINARY ??= resolve(repo, "bin/privateer-subagent.mjs");
+
+register();
+const { runChannelsCli } = await import(pathToFileURL(resolve(repo, "src/cli/channelsCli.ts")).href);
+await runChannelsCli(process.argv.slice(2));

package/bin/privateer-launch.mjs

@@ -31,6 +31,7 @@ import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 import { routeUpdate } from "./update-route.mjs";
 import { APPROVE_IN_APP_ENV, CLI_SPEND_ENV, PI_SUBCOMMANDS, PRIVATE_ENV, authProblem, extractHeadlessFlags, extractPrivateFlag, privateProblem } from "./headless-flags.mjs";
 import { runToCompletion } from "./run-to-completion.mjs";
+import { modelArgs } from "./model-args.mjs";
 import { filterRespawnArgs, listTerminals, requestFresh, runSupervised } from "./fresh-supervisor.mjs";
 import { configureCompileCache } from "./startup-cache.mjs";
 
@@ -555,6 +556,16 @@ else if (sub === "harbor" || sub === "daemon") {
   runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-harbor.mjs"), ...args.slice(1)], { forwardSignals: true });
 }
 
+// --- `privateer channels [run|install|uninstall|status]` -------------------
+// The chat-platform bridges (Telegram/Slack/Discord/WhatsApp). Same shape as the
+// harbor: a resident process, its own launcher, its own optional login service.
+else if (sub === "channels") {
+  sweepLegacyShims();
+  sweepBashLogs();
+  const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
+  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-channels.mjs"), ...args.slice(1)], { forwardSignals: true });
+}
+
 // --- `privateer verify` ----------------------------------------------------
 // Check the install that is on this disk right now. Every other trust signal we
 // publish is an install-time one (npm provenance at `npm i`, a checksum inside
@@ -817,14 +828,15 @@ else {
   //   1. a --model the user typed on the privateer command line (already in `args`)
   //   2. PRIVATEER_MODEL — deliberate override, folded into MODEL above
   //   3. a saved pick in settings.json → pass NO flag; Pi resolves it itself (and
-  //      falls back sanely if that model has vanished from the registry)
+  //      falls back sanely if that model has vanished from the registry). Except a
+  //      signed-in `privateer/*` pick, passed explicitly — see bin/model-args.mjs for
+  //      the silent OpenRouter fallback that prevents
   //   4. nothing saved (first run / fresh home) → the computed MODEL above
   //
   // A FUNCTION, called per launch: a fresh agent (bin/fresh-supervisor.mjs) re-reads it,
   // so a model picked in the old session boots the new one instead of being stomped by
   // a first-run --model computed before that pick existed.
   const modelArgsFor = (launchArgs) => {
-    const userPassedModel = launchArgs.includes("--model");
     let savedDefault = null;
     try {
       const s = JSON.parse(fs.readFileSync(path.join(AGENT_DIR, "settings.json"), "utf8"));
@@ -835,7 +847,7 @@ else {
         savedDefault = `${s.defaultProvider}/${s.defaultModel}`;
       }
     } catch { /* absent/unreadable → no saved pick */ }
-    return userPassedModel || (savedDefault && !process.env.PRIVATEER_MODEL) ? [] : ["--model", MODEL];
+    return modelArgs({ launchArgs, envModel: process.env.PRIVATEER_MODEL, savedDefault, signedIn, computed: MODEL });
   };
 
   // Dev convenience: load provider keys from the repo's .env if present.
@@ -866,7 +878,9 @@ else {
   // command, or `privateer fresh` from another terminal can swap this agent for a new
   // process with the old tree reaped. Print/export/version runs have nothing to swap.
   const tuiArgs = (launchArgs) => [...nodeArgs, CLI, ...modelArgsFor(launchArgs), ...extArgs, ...skillArgs, ...launchArgs];
-  if (isNonInteractive) runToCompletion(NODE_BIN, tuiArgs(args));
+  // forwardSignals: a `kill` reaches only this launcher, and a -p run left behind keeps
+  // working (and spending) with nobody waiting for its answer.
+  if (isNonInteractive) runToCompletion(NODE_BIN, tuiArgs(args), { forwardSignals: true });
   else runSupervised(NODE_BIN, (first) => tuiArgs(first ? args : filterRespawnArgs(args)), { home: PRIVATEER_HOME });
 }
 
@@ -1047,7 +1061,8 @@ function printPrivateerHelp(cmd = process.env.PRIVATEER_CMD || "privateer") {
       "Commands:",
       `  ${cmd} init [directory]     Create a starter PRIVATEER.md project-context file`,
       `  ${cmd} update [--all]       Fetch the latest release or newer tool packs`,
-      `  ${cmd} harbor <command>     Manage the resident background Harbor daemon (run/install/uninstall/status)`,
+      `  ${cmd} harbor <command>     Manage Harbor, the always-on agent behind the app (run/install/uninstall/status)`,
+      `  ${cmd} channels <command>   Run chat channels: Telegram, Slack, Discord, WhatsApp (run/install/uninstall/status)`,
       `  ${cmd} verify               Check local installation integrity and patch state`,
       `  ${cmd} acp                  Run as an Agent Client Protocol server (JSON-RPC on stdio)`,
       `  ${cmd} fresh [n]            Replace a running terminal's agent with a new one (stops everything it started)`,

package/extensions/privateer-gate.ts

@@ -41,6 +41,7 @@ import { childSpendAllows } from "../src/permissions/childSpend.ts";
 import { CliSpendLedger, headlessSpendGuidance, isSpendRequest, readCliSpendGrant } from "../src/permissions/cliSpend.ts";
 import { BILLED_MEDIA_TOOLS } from "../src/permissions/classify.ts";
 import { privateModeFromEnv } from "../src/permissions/privateMode.ts";
+import { REPLY_TIMEOUT_ENV, StallWatchdog, replyTimeoutMs } from "../src/engine/stallWatchdog.ts";
 import type { PermissionRequest } from "../src/permissions/gate.ts";
 import { HeadlessAppApprover } from "../src/remote/headlessApproval.ts";
 import { describeErrorText } from "../src/engine/errors.ts";
@@ -772,11 +773,44 @@ export default function privateerControl(pi: any): void {
     };
   });
 
+  // A headless run must not wait forever on a provider that went silent (see
+  // src/engine/stallWatchdog.ts). Armed per request, re-armed by every streamed event,
+  // off between requests. On a stall: say so on stderr, abort the turn, exit non-zero.
+  let stallCtx: any;
+  const stallMs = replyTimeoutMs();
+  const watchdog = new StallWatchdog(stallMs, () => {
+    const secs = Math.round(stallMs / 1000);
+    process.stderr.write(
+      `privateer: no reply from ${currentSpec || "the model"} for ${secs}s — stopped. The provider accepted the ` +
+        `request and then sent nothing.\n  Re-run, or pick another model with --model. ` +
+        `${REPLY_TIMEOUT_ENV}=<seconds> changes the limit (0 turns it off).\n`,
+    );
+    process.exitCode = 1;
+    try {
+      stallCtx?.abort?.();
+    } catch {
+      /* the turn is already ending */
+    }
+  });
+  pi.on("before_provider_request", (_e: any, ctx: any) => {
+    if (!headlessRun) return;
+    stallCtx = ctx;
+    watchdog.arm();
+  });
+  pi.on("message_start", (ev: any) => {
+    if (headlessRun && ev?.message?.role === "assistant") watchdog.arm();
+  });
+  pi.on("message_update", () => {
+    if (headlessRun) watchdog.arm();
+  });
+  pi.on("message_end", () => watchdog.disarm());
+
   // Print mode prints a failed turn's raw SDK text — "401 status code (no body)",
   // "Connection error." — and exits. Follow it with what that means and what to do,
   // on stderr so stdout stays the answer (or the JSON stream).
   pi.on("agent_end", (ev: any) => {
-    if (!headlessRun) return;
+    watchdog.disarm();
+    if (!headlessRun || watchdog.stalled) return; // a stall already said what happened
     const msgs: any[] = Array.isArray(ev?.messages) ? ev.messages : [];
     const last = [...msgs].reverse().find((m) => m?.role === "assistant");
     if (last?.stopReason !== "error" || typeof last.errorMessage !== "string") return;

package/extensions/privateer-hints.ts

@@ -21,11 +21,12 @@
 // /hints on|off persists { hints: { enabled } } in ~/.privateer/config.json (ours;
 // Pi never reads that file) — read-modify-write, preserving unrelated keys.
 
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { keyText } from "@earendil-works/pi-coding-agent";
 import { configPath, globalDir } from "../src/config/paths.ts";
 import { desktopAppPath } from "../src/config/desktopApp.ts";
+import { writeFileAtomic } from "../src/util/atomicWrite.ts";
 
 const FIRST_MS = 6_000; // a turn shorter than this never shows a tip
 const EVERY_MS = 12_000;
@@ -120,7 +121,7 @@ function persistEnabled(enabled: boolean): void {
   cfg.hints = { ...(cfg.hints ?? {}), enabled };
   try {
     mkdirSync(globalDir(), { recursive: true });
-    writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + "\n");
+    writeFileAtomic(configPath(), JSON.stringify(cfg, null, 2) + "\n");
   } catch {
     /* best effort — the toggle still holds for this session */
   }

package/extensions/privateer-speak.ts

@@ -61,7 +61,7 @@ import {
 } from "privateer-speak";
 import { apiRequest, hasCredentials } from "../src/auth/privateer.ts";
 import { globalDir } from "../src/config/paths.ts";
-import { thisTerminalIsFront } from "../src/terminals/index.ts";
+import { thisTerminalIsFront, watchThisTerminalFocus } from "../src/terminals/index.ts";
 import { VOICE_DESCRIPTIONS } from "./speak-voices.data.ts";
 
 const QWEN3_TTS_VOICES = ["serena", "aiden", "dylan", "eric", "ono_anna", "ryan", "sohee", "uncle_fu", "vivian"];
@@ -362,10 +362,14 @@ export default function privateerSpeak(pi: any): void {
   // isFocused: a window that has just started (say, one the agent opened with the
   // terminal tool) asks Terminal/iTerm2 whether it's in front, so a hands-free mode
   // carries on in the new agent without a keypress — see src/terminals/.
+  // watchFocus: Git Bash's window (mintty) never tells the program inside when it gains
+  // or loses focus, so there Windows is watched instead, or the mic wouldn't follow you
+  // between windows.
   makePiSpeakExtension({
     configFile: join(globalDir(), "speak.json"),
     voiceCommands: VOICE_COMMANDS,
     isFocused: thisTerminalIsFront,
+    watchFocus: watchThisTerminalFocus,
   })(pi);
 }
 

package/extensions/privateer-truncation.ts

@@ -0,0 +1,43 @@
+// Keep the agent going when a reply is cut off at the output limit.
+//
+// A run that ends on a full-budget length stop ("Response was truncated before
+// completion.") just stops in stock pi — the agent abandons the task until the user
+// types "continue". This queues that follow-up for them, at most MAX_AUTO_CONTINUES
+// times in a row. The decision, and why it is shaped this way, lives in
+// src/engine/truncationRecovery.ts.
+
+import { MAX_AUTO_CONTINUES, decideTruncationRecovery } from "../src/engine/truncationRecovery.ts";
+
+export default function privateerTruncation(pi: any): void {
+  let consecutive = 0;
+
+  // Something the user typed starts a fresh count: giving up once must not disarm
+  // recovery for the rest of the session.
+  pi.on("input", () => {
+    consecutive = 0;
+  });
+
+  pi.on("agent_end", (ev: any, ctx: any) => {
+    const decision = decideTruncationRecovery(ev?.messages, Number(ctx?.model?.maxTokens) || 0, consecutive);
+    if (decision.action === "none") {
+      consecutive = 0;
+      return;
+    }
+    if (decision.action === "give-up") {
+      ctx?.ui?.notify?.(
+        `The reply was cut off at the output limit ${MAX_AUTO_CONTINUES + 1} times in a row — stopped. ` +
+          `Type "continue" to try again, lower the thinking level (shift+tab), or pick another model.`,
+        "warning",
+      );
+      return;
+    }
+    consecutive = decision.attempt;
+    ctx?.ui?.notify?.(`Reply cut off at the output limit — continuing (${decision.attempt}/${MAX_AUTO_CONTINUES}).`, "info");
+    // Queued from agent_end while the run is still active, so pi continues it in the
+    // same run (agent-session _handlePostAgentRun) instead of waiting for the user.
+    pi.sendMessage(
+      { customType: "privateer-truncation", content: decision.prompt, display: true, details: { attempt: decision.attempt } },
+      { deliverAs: "followUp", triggerTurn: true },
+    );
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -87,7 +87,7 @@
     "pi-privacy": "0.14.1",
     "pi-subagents": "0.70.0",
     "picomatch": "4.0.5",
-    "privateer-speak": "0.7.0",
+    "privateer-speak": "0.8.0",
     "privateer-workflow": "0.1.0",
     "tinfoil": "1.1.11",
     "tsx": "4.23.0",

package/src/channels/run.ts

@@ -53,6 +53,8 @@ import { modelRegistryOf } from "../providers/piAuthStore.ts";
 import { WEB_TOOL_NAMES } from "../tools/web.ts";
 import { CRYPTO_TOOL_NAMES } from "../tools/crypto.ts";
 import { MEDIA_TOOL_NAMES } from "../tools/media.ts";
+import { rotateLogIfLarge } from "../harbor/logRotate.ts";
+import { logFilePath } from "../harbor/service.ts";
 
 // Read-only default toolset — same rationale as the routines harbor's SAFE_TOOLS:
 // a turn nobody is watching can't mutate the filesystem or shell out. Now that the
@@ -147,10 +149,19 @@ async function main() {
 
   // ── config ──────────────────────────────────────────────────────────────────
   let cfg: any = {};
+  let raw: string;
   try {
-    cfg = JSON.parse(readFileSync(configPath(), "utf8"));
+    raw = readFileSync(configPath(), "utf8");
   } catch {
-    log(`no config at ${configPath()} — add a channels block (see run.ts header).`);
+    // Nothing configured yet is a clean exit (see the no-bridges case below for why).
+    log(`no config at ${configPath()} — add a channels block (see run.ts header), or set channels up from the app.`);
+    process.exit(0);
+  }
+  try {
+    cfg = JSON.parse(raw);
+  } catch (e) {
+    // A config that exists but won't parse IS a failure: say so, and exit non-zero.
+    log(`can't parse ${configPath()}: ${e instanceof Error ? e.message : String(e)}`);
     process.exit(1);
   }
   const ch = cfg.channels ?? {};
@@ -404,15 +415,23 @@ async function main() {
   }
 
   if (bridges.length === 0) {
-    log("no channels started — configure a channels.<platform> block in config.json.");
-    process.exit(1);
+    // Exit 0, not 1: under the login service (`privateer channels install`) a failure
+    // exit is restarted, and "nothing configured yet" doesn't get better by retrying —
+    // it got restarted until systemd's start limit, filling the log with this line.
+    // Configure a channel (from the app or config.json), then start it again.
+    log("no channels started — configure a channels.<platform> block in config.json (or from the app), then run `privateer channels install` again.");
+    process.exit(0);
   }
 
   // Heartbeat: announce the live platforms now and refresh on a cadence so the app's
   // channels manager can tell running from merely-configured. A stale/absent file
   // reads as offline (see channels/status.ts).
   writeChannelsStatus(startedPlatforms);
-  const heartbeat = setInterval(() => writeChannelsStatus(startedPlatforms), HEARTBEAT_MS);
+  const heartbeat = setInterval(() => {
+    writeChannelsStatus(startedPlatforms);
+    // Bound the log launchd appends to (macOS service; a no-op elsewhere). See logRotate.ts.
+    if (rotateLogIfLarge(logFilePath("channels"))) log("rotated channels.log (previous kept as channels.log.1)");
+  }, HEARTBEAT_MS);
   heartbeat.unref?.();
 
   const shutdown = () => {

package/src/cli/channelsCli.ts

@@ -0,0 +1,67 @@
+// `privateer channels [run|install|uninstall|status]` dispatcher.
+//
+// ORDERING CONTRACT: `run` dynamically imports channels/run.ts, which imports
+// ./boot.ts first (env pin + attestation dispatcher) and starts on import. The service
+// subcommands touch no Pi code (harbor/service.ts is import-safe), so they don't pay
+// the session-stack import cost.
+
+function usage(): string {
+  return [
+    "Usage: privateer channels [command]",
+    "",
+    "  run          Run the channels in the foreground (default). Bridges every",
+    "               channels.<platform> block in ~/.privateer/config.json.",
+    "  install      Install it as a login service so it starts at login and stays up.",
+    "               Re-run after changing channels from the app: it restarts them.",
+    "  uninstall    Remove the login service.",
+    "  status       Show whether the service is installed and which channels are live.",
+  ].join("\n");
+}
+
+export async function runChannelsCli(argv: string[]): Promise<void> {
+  const sub = argv[0] ?? "run";
+  switch (sub) {
+    case "run": {
+      await import("../channels/run.ts"); // starts on import, installs its own signal handlers
+      return;
+    }
+    case "install": {
+      const { installService } = await import("../harbor/service.ts");
+      try {
+        const info = installService("channels");
+        process.stdout.write(
+          `Channels installed as a login service.\n  unit: ${info.unitPath}\n  logs: ${info.logPath}\n` +
+            "They start now and at every login. Manage with `privateer channels status|uninstall`.\n",
+        );
+      } catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+      }
+      return;
+    }
+    case "uninstall": {
+      const { uninstallService } = await import("../harbor/service.ts");
+      try {
+        uninstallService("channels");
+        process.stdout.write("Channels login service removed.\n");
+      } catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+      }
+      return;
+    }
+    case "status": {
+      const { channelsStatusReport } = await import("../harbor/service.ts");
+      process.stdout.write((await channelsStatusReport()) + "\n");
+      return;
+    }
+    case "-h":
+    case "--help":
+    case "help":
+      process.stdout.write(usage() + "\n");
+      return;
+    default:
+      process.stderr.write(`Unknown channels command: ${sub}\n\n${usage()}\n`);
+      process.exit(1);
+  }
+}

package/src/config/mediaModels.ts

@@ -18,9 +18,10 @@
  * Missing file, unreadable file and malformed JSON all mean "no choice" — the account
  * default — never a crash in the middle of a tool call.
  */
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { configPath } from "./paths.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 export type MediaKind = "image" | "video";
 
@@ -55,7 +56,7 @@ export function setMediaModelPref(kind: MediaKind, id: string | null): void {
   const next: Record<string, unknown> = { ...cfg, media };
   if (Object.keys(media).length === 0) delete next.media;
   mkdirSync(dirname(configPath()), { recursive: true });
-  writeFileSync(configPath(), JSON.stringify(next, null, 2) + "\n");
+  writeFileAtomic(configPath(), JSON.stringify(next, null, 2) + "\n");
 }
 
 /** The model a call should send: its own `model`, else this machine's choice, else none. */

package/src/config/moatManifest.json

@@ -23,6 +23,7 @@
     { "entry": "extensions/privateer-terminals.ts", "name": "privateer-terminals", "note": "named terminal windows — the terminal tool + /term to switch between them" },
     { "entry": "extensions/privateer-hints.ts", "name": "privateer-hints", "note": "rotating tips in the working line + /hints" },
     { "entry": "extensions/privateer-update.ts", "name": "privateer-update", "note": "tool pack updates in place — banner flag + /update" },
+    { "entry": "extensions/privateer-truncation.ts", "name": "privateer-truncation", "note": "picks the task back up when a reply is cut off at the output limit" },
     { "entry": "extensions/privateer-fresh.ts", "name": "privateer-fresh", "note": "/fresh — replace the agent with a new one and stop everything it started" },
     { "entry": "extensions/privateer-speak.ts", "name": "privateer-speak", "note": "spoken responses (/speak) + voice input (/talk) — pi-speak + confidential account TTS/STT" },
     { "entry": "extensions/privateer-web.ts", "name": "privateer-web", "note": "web_search/web_fetch — account search when signed in, else the user's own provider (rpiv-web-tools); crypto_lookup — account market data, in both cases" },

package/src/config/piiAllow.ts

@@ -28,8 +28,9 @@
 // made in an editor is picked up on the next scan, exactly like one made through the
 // command — there is no "restart to apply" step to explain.
 
-import { readFileSync, statSync, writeFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { configPath } from "./paths.ts";
+import { writeFileAtomic } from "../util/atomicWrite.ts";
 
 let cached: string[] = [];
 let cachedStamp = "";
@@ -89,7 +90,7 @@ function write(entries: string[]): void {
     /* new or unreadable — a fresh object, so one bad file doesn't lose the edit */
   }
   const privacy = { ...((cfg.privacy as Record<string, unknown>) ?? {}), piiAllow: entries };
-  writeFileSync(configPath(), JSON.stringify({ ...cfg, privacy }, null, 2) + "\n");
+  writeFileAtomic(configPath(), JSON.stringify({ ...cfg, privacy }, null, 2) + "\n");
   invalidate();
 }
 

package/src/config/whatsNew.json

@@ -1,10 +1,10 @@
 {
   "$comment": "The banner's What's New list, newest first: the two to four things a returning user should notice, not a changelog. `reviewedFor` is the release this list was last looked at for. A release can't ship until it equals package.json's version (scripts/check-whats-new.mjs, run by `npm test` and by release.yml before anything builds), so every release, patches included, is a deliberate look at this list. If nothing new is worth a line, bumping `reviewedFor` alone is the answer. `since` is the release an entry arrived in. `cmd` is shown in the accent colour.",
-  "reviewedFor": "0.14.0",
+  "reviewedFor": "0.14.2",
   "items": [
+    { "text": "A reply cut off at the output limit picks back up on its own", "since": "0.14.2" },
+    { "text": "Chat channels as a login service: privateer channels install", "since": "0.14.1" },
     { "text": "Hand off sensitive files: privateer --private", "since": "0.14.0" },
-    { "text": "Open and switch named terminals —", "cmd": "/term", "since": "0.13.0" },
-    { "text": "Voice follows the window you're in", "since": "0.13.0" },
-    { "text": "Searchable model picker —", "cmd": "/models", "since": "0.12.53" }
+    { "text": "Open and switch named terminals —", "cmd": "/term", "since": "0.13.0" }
   ]
 }

package/src/engine/stallWatchdog.ts

@@ -0,0 +1,61 @@
+// A stall watchdog for headless runs.
+//
+// `privateer -p` waits on the model with no limit. A provider that accepts the request
+// and then sends nothing (measured on the account channel: glm-5-2 stalled 5 of 14
+// requests, see providers/defaultModel.ts) leaves the run hanging forever with nothing
+// on stdout. That is what a 14-minute "hang" on 2026-10-02 looked like from the outside;
+// the session file never appeared, because Pi writes it only once a first reply lands.
+//
+// So: armed when a request goes out, re-armed by every streamed event (text, thinking,
+// tool-call deltas all count, so a slow but live stream never trips it), disarmed when
+// the message ends. Between requests (tool execution) it is off — a long local command
+// is not a provider stall. If it fires, the caller aborts the turn and says why.
+//
+// The limit: PRIVATEER_REPLY_TIMEOUT seconds, default 180, 0 turns it off. Silence, not
+// total time, is what is measured, so a long answer is never cut off for being long.
+
+export const REPLY_TIMEOUT_ENV = "PRIVATEER_REPLY_TIMEOUT";
+export const DEFAULT_REPLY_TIMEOUT_MS = 180_000;
+
+/** The stall limit in ms from the environment; 0 means off. Garbage falls back to the default. */
+export function replyTimeoutMs(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = (env[REPLY_TIMEOUT_ENV] ?? "").trim();
+  if (!raw) return DEFAULT_REPLY_TIMEOUT_MS;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return DEFAULT_REPLY_TIMEOUT_MS;
+  return Math.round(n * 1000);
+}
+
+export class StallWatchdog {
+  private timer: ReturnType<typeof setTimeout> | undefined;
+  private fired = false;
+
+  constructor(
+    private readonly ms: number,
+    private readonly onStall: () => void,
+    private readonly timers: { set: typeof setTimeout; clear: typeof clearTimeout } = { set: setTimeout, clear: clearTimeout },
+  ) {}
+
+  /** A request went out, or something streamed: (re)start the silence clock. */
+  arm(): void {
+    if (this.ms <= 0 || this.fired) return;
+    this.disarm();
+    this.timer = this.timers.set(() => {
+      this.timer = undefined;
+      this.fired = true;
+      this.onStall();
+    }, this.ms);
+    // Never the reason a finished run stays alive (see docs/one-shot-exit.md).
+    (this.timer as { unref?: () => void })?.unref?.();
+  }
+
+  /** The message ended, or the run did: nothing to wait on. */
+  disarm(): void {
+    if (this.timer !== undefined) this.timers.clear(this.timer);
+    this.timer = undefined;
+  }
+
+  get stalled(): boolean {
+    return this.fired;
+  }
+}