privateer-agent 0.14.2 → 0.14.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/auth/accountSessions.ts

@@ -21,21 +21,50 @@
 // RECYCLED pid makes a dead owner look alive, so we skip a reclaimable session and
 // spawn a fresh one — the old behaviour, no harm. The dangerous direction (a live
 // process reported dead) can't happen: a running pid never reports ESRCH.
+//
+// LAYOUT — one file per owning pid (`<pid>.json` in accountSessionsDir), and an orphan
+// is CLAIMED by renaming its file before anyone rotates it. This used to be a single
+// JSON file that every process read, modified and wrote back whole, and that was a real
+// outage under concurrency (an agent firing several `privateer -p` one-shots at once):
+//
+//   A reads {orphan: R}  ·  B reads {orphan: R}  ·  B adopts the orphan (R → R′) and
+//   writes it out  ·  A writes ITS stale copy back, orphan entry and all.
+//
+// The resurrected entry names a refresh token that was already rotated. The next launch
+// "reclaims" it, the server sees a spent token replayed past its 30s grace window, calls
+// it theft, and revokes the whole lineage — which is the session B (or whoever adopted
+// down the chain) is using right now, and possibly the one in the shared auth.json that
+// other running terminals read. They all 401 mid-run, and a one-shot run has no next
+// message to recover on, so the user is told to /login while signed in.
+//
+// Per-pid files mean no process ever writes another's entry, and rename is atomic on
+// every platform we ship on, so exactly one claimer wins an orphan and the rest get
+// ENOENT and move on. A claim whose claimant died is deleted rather than released: its
+// token may already have been rotated, and offering it again is the same hazard.
 
-import { existsSync, mkdirSync, readFileSync, rmSync, renameSync, writeFileSync, chmodSync } from "node:fs";
-import { dirname } from "node:path";
-import { accountSessionsPath, globalDir } from "../config/paths.ts";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, renameSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { accountSessionsDir, accountSessionsPath, globalDir } from "../config/paths.ts";
 
-// One spawned session, keyed in the file by the pid of its owning terminal. `refresh`
-// is what lets a later launch adopt or revoke it; `expires` is its access token's exp
-// (see jwtExpMs), used only to prune entries that are dead server-side anyway.
+// One spawned session, keyed by the pid of its owning terminal. `refresh` is what lets
+// a later launch adopt or revoke it; `expires` is its access token's exp (see
+// jwtExpMs), used only to prune entries that are dead server-side anyway.
 export interface OwnedSession {
   pid: number;
   refresh: string;
   expires: number;
 }
 
-type Registry = Record<string, { refresh?: unknown; expires?: unknown }>;
+const ENTRY = /^(\d+)\.json$/;
+const CLAIM = /^(\d+)\.claim-(\d+)$/;
+
+function entryPath(pid: number): string {
+  return join(accountSessionsDir(), `${pid}.json`);
+}
+
+function claimPath(pid: number, claimant = process.pid): string {
+  return join(accountSessionsDir(), `${pid}.claim-${claimant}`);
+}
 
 function tryChmod(path: string, mode: number): void {
   try {
@@ -45,31 +74,21 @@ function tryChmod(path: string, mode: number): void {
   }
 }
 
-function readRegistry(): Registry {
-  const path = accountSessionsPath();
-  if (!existsSync(path)) return {};
+function tryRm(path: string): void {
   try {
-    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? (parsed as Registry) : {};
+    rmSync(path, { force: true });
   } catch {
-    return {}; // corrupt/truncated — start clean rather than wedging every launch
+    /* already gone, or unremovable — nothing more to do */
   }
 }
 
-// Write via temp + rename so a concurrent reader never sees a half-written file. Two
-// terminals racing can still lose one entry (last writer wins); the cost is one
-// unreclaimable orphan, not a broken launch, so a lock file isn't worth it here.
-function writeRegistry(reg: Registry): void {
-  const path = accountSessionsPath();
+function readEntry(path: string, pid: number): OwnedSession | null {
   try {
-    mkdirSync(dirname(path), { recursive: true });
-    tryChmod(globalDir(), 0o700);
-    const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(reg, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
-    tryChmod(tmp, 0o600);
-    renameSync(tmp, path);
+    const raw = JSON.parse(readFileSync(path, "utf8")) as { refresh?: unknown; expires?: unknown };
+    if (typeof raw?.refresh !== "string" || !raw.refresh) return null;
+    return { pid, refresh: raw.refresh, expires: typeof raw.expires === "number" ? raw.expires : 0 };
   } catch {
-    /* best effort — losing the registry costs reclamation, never correctness */
+    return null; // corrupt/truncated — treated as malformed and pruned
   }
 }
 
@@ -86,72 +105,109 @@ function isAlive(pid: number): boolean {
   }
 }
 
-function parseEntry(pid: string, raw: { refresh?: unknown; expires?: unknown }): OwnedSession | null {
-  const n = Number(pid);
-  if (!Number.isInteger(n) || typeof raw?.refresh !== "string" || !raw.refresh) return null;
-  return { pid: n, refresh: raw.refresh, expires: typeof raw.expires === "number" ? raw.expires : 0 };
-}
-
 // Claim (or re-claim) a session for THIS process. Called wherever the account
 // credential is minted or rotated — spawnAccountCredentials and
 // refreshAccountCredentials — so the registry always holds the token that would
-// actually work, including the rotations Pi drives on its own.
+// actually work, including the rotations Pi drives on its own. Written via temp +
+// rename so a concurrent reader never sees a half-written file.
 export function recordOwnedSession(cred: { refresh: string; expires: number }): void {
-  const reg = readRegistry();
-  reg[String(process.pid)] = { refresh: cred.refresh, expires: cred.expires };
-  writeRegistry(reg);
+  try {
+    mkdirSync(accountSessionsDir(), { recursive: true });
+    tryChmod(globalDir(), 0o700);
+    tryChmod(accountSessionsDir(), 0o700);
+    const path = entryPath(process.pid);
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ refresh: cred.refresh, expires: cred.expires }) + "\n", {
+      encoding: "utf8",
+      mode: 0o600,
+    });
+    tryChmod(tmp, 0o600);
+    renameSync(tmp, path);
+  } catch {
+    /* best effort — losing the registry costs reclamation, never correctness */
+  }
 }
 
 // Drop this process's entry — the session is being revoked (clean exit, /signout), so
 // it is about to stop existing server-side. Leaving it behind would advertise a dead
 // session as a reclaimable orphan to the next launch.
 export function forgetOwnedSession(): void {
-  const reg = readRegistry();
-  if (!(String(process.pid) in reg)) return;
-  delete reg[String(process.pid)];
-  writeRegistry(reg);
+  tryRm(entryPath(process.pid));
 }
 
-// Sessions whose owning terminal is gone: candidates to adopt or revoke. Prunes
-// entries that are unusable anyway (malformed, or past their expiry) as a side
-// effect, so the file can't grow without bound. Our own pid is never a candidate.
+// Sessions whose owning terminal is gone: candidates to adopt or revoke. Listing is NOT
+// claiming — call claimOrphan before rotating one. Prunes entries that are unusable
+// anyway (malformed, or past their expiry) and claims left by a dead claimant, so the
+// directory can't grow without bound. Our own pid is never a candidate.
 export function orphanedSessions(now = Date.now()): OwnedSession[] {
-  const reg = readRegistry();
+  let names: string[];
+  try {
+    names = readdirSync(accountSessionsDir());
+  } catch {
+    return []; // no registry yet
+  }
   const orphans: OwnedSession[] = [];
-  let pruned = false;
-
-  for (const [pid, raw] of Object.entries(reg)) {
-    const entry = parseEntry(pid, raw);
+  for (const name of names) {
+    const path = join(accountSessionsDir(), name);
+    const claim = CLAIM.exec(name);
+    if (claim) {
+      // Mid-adoption by a live process: theirs. Claimant died: its token may already
+      // be rotated, so it is junk — never put back up for reclamation.
+      if (!isAlive(Number(claim[2]))) tryRm(path);
+      continue;
+    }
+    const m = ENTRY.exec(name);
+    if (!m) continue; // a temp file mid-write, or something that isn't ours
+    const pid = Number(m[1]);
+    if (pid === process.pid || isAlive(pid)) continue; // ours, or a live terminal's
+    const entry = readEntry(path, pid);
     if (!entry || (entry.expires > 0 && entry.expires <= now)) {
-      delete reg[pid]; // malformed, or dead server-side — nothing to reclaim
-      pruned = true;
+      tryRm(path); // malformed, or dead server-side — nothing to reclaim
       continue;
     }
-    if (entry.pid === process.pid || isAlive(entry.pid)) continue; // ours, or a live terminal's
     orphans.push(entry);
   }
-
-  if (pruned) writeRegistry(reg);
   return orphans;
 }
 
+// Take an orphan for THIS process, atomically. True only for the one caller whose rename
+// landed; everyone else racing for the same orphan gets false and must leave it alone.
+// Pair with dropOwnedSession (handled) or releaseOrphan (couldn't reach the server).
+export function claimOrphan(pid: number): boolean {
+  try {
+    renameSync(entryPath(pid), claimPath(pid));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Put back an orphan we claimed but couldn't settle: its refresh never reached the
+// server, so the token is still the live one and the row is still worth reclaiming.
+export function releaseOrphan(pid: number): void {
+  try {
+    renameSync(claimPath(pid), entryPath(pid));
+  } catch {
+    tryRm(claimPath(pid));
+  }
+}
+
 // Forget one orphan, once it has been definitively handled (adopted, or confirmed dead
-// server-side). A entry whose refresh merely FAILED TO REACH the server is deliberately
-// kept: dropping it on a network blip would leak that row until its TTL.
+// server-side). An entry whose refresh merely FAILED TO REACH the server goes back via
+// releaseOrphan instead: dropping it on a network blip would leak that row until its TTL.
 export function dropOwnedSession(pid: number): void {
-  const reg = readRegistry();
-  if (!(String(pid) in reg)) return;
-  delete reg[String(pid)];
-  writeRegistry(reg);
+  tryRm(claimPath(pid));
+  if (pid !== process.pid) tryRm(entryPath(pid));
 }
 
 // Wipe the registry. Used by logout(), where the server has just revoked this
 // machine's whole token family: every entry now names a dead session, and leaving
 // them behind would offer the next login a list of orphans to "reclaim" that can
-// only fail. Also a test seam.
+// only fail. Also removes the legacy single-file registry. Also a test seam.
 export function clearOwnedSessions(): void {
+  tryRm(accountSessionsPath());
   try {
-    rmSync(accountSessionsPath(), { force: true });
+    if (existsSync(accountSessionsDir())) rmSync(accountSessionsDir(), { recursive: true, force: true });
   } catch {
     /* nothing to remove */
   }

package/src/auth/privateer.ts

@@ -20,6 +20,8 @@ import {
   recordOwnedSession,
   forgetOwnedSession,
   orphanedSessions,
+  claimOrphan,
+  releaseOrphan,
   dropOwnedSession,
   clearOwnedSessions,
 } from "./accountSessions.ts";
@@ -811,13 +813,17 @@ export async function acquireAccountCredential(): Promise<AccountCredential> {
 
   while (attempted < orphans.length && !adopted) {
     const orphan = orphans[attempted++];
+    // Another launch racing us may already have it. Rotating it anyway would replay a
+    // token that launch just spent — reuse detection, and its session revoked mid-run.
+    if (!claimOrphan(orphan.pid)) continue;
     try {
       adopted = await refreshAccountCredentials(orphan.refresh);
       dropOwnedSession(orphan.pid); // the rotation above re-recorded it under OUR pid
     } catch (e) {
-      // Refused → the session is gone; stop tracking it. Unreachable → keep it, so a
-      // network blip doesn't strand a live row we could have reclaimed next launch.
+      // Refused → the session is gone; stop tracking it. Unreachable → put it back, so
+      // a network blip doesn't strand a live row we could have reclaimed next launch.
       if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+      else releaseOrphan(orphan.pid);
     }
   }
 
@@ -836,12 +842,14 @@ export async function acquireAccountCredential(): Promise<AccountCredential> {
 // overwrite the entry for the credential this terminal is actually using.
 async function revokeOrphanedSessions(orphans: OwnedSession[], timeoutMs = 1500): Promise<void> {
   for (const orphan of orphans) {
+    if (!claimOrphan(orphan.pid)) continue; // another launch got there first
     try {
       const cred = await rotateSession(orphan.refresh);
       await deleteSession(cred.access, timeoutMs);
       dropOwnedSession(orphan.pid);
     } catch (e) {
       if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+      else releaseOrphan(orphan.pid);
     }
   }
 }

package/src/config/paths.ts

@@ -45,6 +45,18 @@ export function configPath(): string {
 // session belonging to a STILL-RUNNING terminal from one orphaned by a crash, so it
 // can reclaim the orphan instead of spawning another and walking into the server's
 // per-device terminal cap. Holds refresh tokens — written 0600, like credentials.json.
+//
+// One file per owning pid in a directory, not one shared JSON file: concurrent launches
+// (an agent firing several `privateer -p` runs at once) each read-modify-wrote the whole
+// file, so one could write back an orphan another had already adopted (see
+// auth/accountSessions.ts).
+export function accountSessionsDir(): string {
+  return join(globalDir(), "account-sessions");
+}
+
+// The pre-directory single-file registry. Only ever deleted now (clearOwnedSessions);
+// its entries are never offered for reclamation, because a stale one is exactly the
+// token that trips the server's reuse detection.
 export function accountSessionsPath(): string {
   return join(globalDir(), "account-sessions.json");
 }

package/src/config/whatsNew.json

@@ -1,10 +1,10 @@
 {
   "$comment": "The banner's What's New list, newest first: the two to four things a returning user should notice, not a changelog. `reviewedFor` is the release this list was last looked at for. A release can't ship until it equals package.json's version (scripts/check-whats-new.mjs, run by `npm test` and by release.yml before anything builds), so every release, patches included, is a deliberate look at this list. If nothing new is worth a line, bumping `reviewedFor` alone is the answer. `since` is the release an entry arrived in. `cmd` is shown in the accent colour.",
-  "reviewedFor": "0.14.2",
+  "reviewedFor": "0.14.3",
   "items": [
+    { "text": "Several privateer -p runs at once no longer sign each other out", "since": "0.14.3" },
     { "text": "A reply cut off at the output limit picks back up on its own", "since": "0.14.2" },
     { "text": "Chat channels as a login service: privateer channels install", "since": "0.14.1" },
-    { "text": "Hand off sensitive files: privateer --private", "since": "0.14.0" },
-    { "text": "Open and switch named terminals —", "cmd": "/term", "since": "0.13.0" }
+    { "text": "Hand off sensitive files: privateer --private", "since": "0.14.0" }
   ]
 }

package/src/engine/errors.ts

@@ -597,7 +597,7 @@ export function describeErrorText(
         bare ? `${who} ${refused} this request was sent with (${status}).` : compactProviderError(s),
       ),
       hint: account
-        ? "This terminal's Privateer session was refused. It is renewed automatically on your next message; if it keeps failing, run /login (or `privateer auth status` to see whether this machine is signed in)."
+        ? "This run's Privateer session was refused. A fresh one is opened automatically — send the message again, or re-run a one-shot (`-p`) command. Only if it keeps failing, check `privateer auth status`."
         : `Check the API key for ${who} — run /login, or set the provider's API key env var.`,
     };
   }

package/src/tools/media.ts

@@ -227,12 +227,22 @@ async function callAccount<T>(
   if (res.status === 402 || /INSUFFICIENT|QUOTA|TOP_?UP/i.test(code)) {
     return { ok: false, status: res.status, message: serverMessage || "the account is out of credit for media generation — top up or upgrade to continue" };
   }
-  if (res.status === 401 || res.status === 403) {
+  // Same split as callRag (tools/web.ts): a 401 survived authedFetch's retry, a 403 is
+  // a refusal that signing in again won't change.
+  if (res.status === 401) {
     return {
       ok: false, status: res.status,
       message:
         serverMessage ||
-        "this agent is not signed in to a Privateer account (or the plan doesn't include this), so it cannot generate media",
+        "Privateer refused this agent's session (401) — running the command again opens a fresh one; if it keeps failing, check `privateer auth status`",
+    };
+  }
+  if (res.status === 403) {
+    return {
+      ok: false, status: res.status,
+      message:
+        serverMessage ||
+        "Privateer refused this media request (403) — the plan may not include it; this is not a sign-in problem",
     };
   }
   if (res.status === 400 || res.status === 413) {

package/src/tools/web.ts

@@ -129,8 +129,23 @@ export async function callRag<T>(path: string, body: unknown): Promise<({ ok: tr
   if (res.status === 402 || /CAP|QUOTA|INSUFFICIENT|TOP_?UP/i.test(code)) {
     return { ok: false, message: serverMessage || "the account is out of credit for web access — top up or upgrade to continue" };
   }
-  if (res.status === 401 || res.status === 403) {
-    return { ok: false, message: "this agent is not signed in to a Privateer account, so it has no web access" };
+  // A 401 here has already survived authedFetch's refresh-and-retry, so the session
+  // really couldn't be renewed. A 403 is NOT a sign-in problem — a plan or account
+  // refusal, or the edge firewall in front of the API — and calling it "not signed in"
+  // had models telling signed-in users to log in. Pass the server's reason through.
+  if (res.status === 401) {
+    return {
+      ok: false,
+      message:
+        serverMessage ||
+        "Privateer refused this agent's session for web access (401) — running the command again opens a fresh one; if it keeps failing, check `privateer auth status`",
+    };
+  }
+  if (res.status === 403) {
+    return {
+      ok: false,
+      message: serverMessage || "Privateer refused this web request (403) — not a sign-in problem, so logging in again won't change it",
+    };
   }
   if (res.status === 400) {
     return { ok: false, message: serverMessage || `Privateer rejected the request${code ? ` (${code})` : ""}` };