privateer-agent 0.14.5 → 0.14.6

package/bin/headless-flags.d.mts

@@ -30,3 +30,13 @@ export function extractPrivateFlag(args: string[]): boolean;
 export function privateProblem(args: string[]): string | null;
 
 export function authProblem(args: string[], cmd?: string): string | null;
+
+/** `auth check|print-*` for the privateer provider, answered by the launcher; null for Pi. */
+export function privateerAuthAnswer(
+  args: string[],
+  signedIn: boolean,
+  cmd?: string,
+): { out: string; err: string; code: number } | null;
+
+/** `auth --help` with our command name and the provider agents look for. */
+export function authHelp(cmd?: string): string;

package/bin/headless-flags.mjs

@@ -204,3 +204,74 @@ export function authProblem(args, cmd = "privateer") {
     `Nothing was sent to a model. To sign in, run \`${cmd}\` and type /login.`,
   ].join("\n");
 }
+
+// The value of --provider / --model in `args`, in either `--flag v` or `--flag=v` form.
+function flagValue(args, flag) {
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === flag) return args[i + 1];
+    if (args[i].startsWith(flag + "=")) return args[i].slice(flag.length + 1);
+  }
+  return undefined;
+}
+
+/**
+ * `auth check|print-api-key|print-bearer-token` for the `privateer` provider, answered
+ * here. Pi runs these with no extensions loaded, and `privateer` is registered by ours,
+ * so Pi always said `provider_not_found` — and agents probing a signed-in machine with
+ * the exact command `auth status` suggests concluded it was signed out. Readiness comes
+ * from the account login (the same file `auth status` reads); the per-launch session
+ * in auth.json is minted from it. The account token is never printed: it's the login
+ * itself, and nothing outside Privateer can use it as a provider key anyway.
+ *
+ * Returns { out, err, code } to print, or null for Pi to handle.
+ */
+export function privateerAuthAnswer(args, signedIn, cmd = "privateer") {
+  if (args[0] !== "auth" || !AUTH_SUBCOMMANDS.includes(args[1])) return null;
+  if (args.includes("--help") || args.includes("-h")) return null;
+  const provider = flagValue(args, "--provider");
+  const model = flagValue(args, "--model");
+  if (provider !== "privateer" && !(provider === undefined && model?.startsWith("privateer/"))) return null;
+
+  const run = `${cmd} -p "<task>"`;
+  if (args[1] !== "check") {
+    return {
+      out: "",
+      err: [
+        `${cmd} auth ${args[1]}: the privateer provider's credential is your account login, and it isn't printed.`,
+        signedIn ? `This machine is signed in — run a task with: ${run}` : `Sign in first: run \`${cmd}\` and type /login.`,
+      ].join("\n"),
+      code: 1,
+    };
+  }
+  if (args.includes("--credentials")) {
+    // Pi's contract: --credentials emits the credential or reports it unavailable.
+    const result = { status: "not_ready", provider: "privateer", reason: "credential_not_available" };
+    return { out: args.includes("--json") ? JSON.stringify(result) : result.status, err: "", code: 1 };
+  }
+  const result = signedIn
+    ? { status: "ready", provider: "privateer", authType: "oauth" }
+    : { status: "not_ready", provider: "privateer", reason: "credentials_not_configured" };
+  return {
+    out: args.includes("--json") ? JSON.stringify(result) : result.status,
+    err: signedIn ? "" : `Not signed in: run \`${cmd}\` and type /login.`,
+    code: signedIn ? 0 : 1,
+  };
+}
+
+/** `auth --help` with our command name, the provider agents look for, and how to run a task. */
+export function authHelp(cmd = "privateer") {
+  return [
+    "Usage:",
+    `  ${cmd} auth status`,
+    `  ${cmd} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]`,
+    `  ${cmd} auth print-api-key [--provider <provider>] [--model <model>]`,
+    `  ${cmd} auth print-bearer-token [--provider <provider>] [--model <model>] [--min-expiry <duration>]`,
+    "",
+    "status reports whether this machine is signed in to a Privateer account.",
+    "check and print-* need --provider or --model. Your account's models are provider",
+    `\`privateer\`: \`${cmd} auth check --provider privateer\`. Its credential is the account`,
+    "login and is never printed. Other providers (openai, anthropic, …) use their own keys.",
+    "",
+    `To run a task non-interactively once signed in: ${cmd} -p "<task>"`,
+  ].join("\n");
+}

package/bin/privateer-launch.mjs

@@ -29,7 +29,7 @@ import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 import { routeUpdate } from "./update-route.mjs";
-import { APPROVE_IN_APP_ENV, CLI_SPEND_ENV, PI_SUBCOMMANDS, PRIVATE_ENV, authProblem, extractHeadlessFlags, extractPrivateFlag, privateProblem } from "./headless-flags.mjs";
+import { APPROVE_IN_APP_ENV, CLI_SPEND_ENV, PI_SUBCOMMANDS, PRIVATE_ENV, authHelp, authProblem, extractHeadlessFlags, privateerAuthAnswer, extractPrivateFlag, privateProblem } from "./headless-flags.mjs";
 import { runToCompletion } from "./run-to-completion.mjs";
 import { modelArgs } from "./model-args.mjs";
 import { filterRespawnArgs, listTerminals, requestFresh, runSupervised } from "./fresh-supervisor.mjs";
@@ -669,6 +669,16 @@ else if (PI_SUBCOMMANDS.includes(sub)) {
     printAuthStatus(cmd);
     process.exit(0);
   }
+  if (sub === "auth" && (args[1] === undefined || args[1] === "help" || args.includes("--help") || args.includes("-h"))) {
+    console.log(authHelp(cmd));
+    process.exit(0);
+  }
+  const own = sub === "auth" ? privateerAuthAnswer(args, accountSignedIn(), cmd) : null;
+  if (own) {
+    if (own.out) console.log(own.out);
+    if (own.err) process.stderr.write(own.err + "\n");
+    process.exit(own.code);
+  }
   const CLI = resolveDep(REPO, "@earendil-works/pi-coding-agent", "dist", "cli.js");
   if (!CLI || !fs.existsSync(CLI)) {
     console.error(
@@ -1030,13 +1040,21 @@ function warnKeylessLaunch() {
 
 // `privateer auth status` — the question people (and agents) actually ask, answered
 // from local state only: no network, nothing sent anywhere, and no secret printed.
-function printAuthStatus(cmd) {
-  let creds = null;
+function readAccountCredentials() {
   try {
-    creds = JSON.parse(fs.readFileSync(path.join(PRIVATEER_HOME, "credentials.json"), "utf8"));
-  } catch { /* absent or unreadable → signed out */ }
+    const creds = JSON.parse(fs.readFileSync(path.join(PRIVATEER_HOME, "credentials.json"), "utf8"));
+    return creds && typeof creds.accessToken === "string" ? creds : null;
+  } catch { return null; /* absent or unreadable → signed out */ }
+}
+
+function accountSignedIn() {
+  return readAccountCredentials() !== null;
+}
+
+function printAuthStatus(cmd) {
+  const creds = readAccountCredentials();
   const lines = [];
-  if (creds && typeof creds.accessToken === "string") {
+  if (creds) {
     const who = creds.user?.email || "your account";
     lines.push(`Privateer account: signed in as ${who}${creds.serverBaseUrl ? ` (${creds.serverBaseUrl})` : ""}`);
     lines.push("  This checks the local login only; a session revoked from the app shows up on the next request.");
@@ -1046,7 +1064,8 @@ function printAuthStatus(cmd) {
   }
   const keys = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "OPENROUTER_API_KEY", "TINFOIL_API_KEY", "PRIVATEER_API_KEY"].filter(haveKey);
   lines.push(`Provider keys in the environment: ${keys.length ? keys.join(", ") : "none"}`);
-  lines.push(`To check one provider end to end: ${cmd} auth check --provider <name>`);
+  lines.push(`Your account's models are provider \`privateer\`: ${cmd} auth check --provider privateer`);
+  if (creds) lines.push(`To run a task non-interactively: ${cmd} -p "<task>"`);
   console.log(lines.join("\n"));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.14.5",
+  "version": "0.14.6",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/config/whatsNew.json

@@ -1,10 +1,10 @@
 {
   "$comment": "The banner's What's New list, newest first: the two to four things a returning user should notice, not a changelog. `reviewedFor` is the release this list was last looked at for. A release can't ship until it equals package.json's version (scripts/check-whats-new.mjs, run by `npm test` and by release.yml before anything builds), so every release, patches included, is a deliberate look at this list. If nothing new is worth a line, bumping `reviewedFor` alone is the answer. `since` is the release an entry arrived in. `cmd` is shown in the accent colour.",
-  "reviewedFor": "0.14.5",
+  "reviewedFor": "0.14.6",
   "items": [
+    { "text": "API keys can expire and carry their own credit limit — set them in the app", "since": "0.14.6" },
     { "text": "Save to Cargo with no app attached — it lands on your next app open", "since": "0.14.4" },
     { "text": "Several privateer -p runs at once no longer sign each other out", "since": "0.14.3" },
-    { "text": "A reply cut off at the output limit picks back up on its own", "since": "0.14.2" },
-    { "text": "Chat channels as a login service: privateer channels install", "since": "0.14.1" }
+    { "text": "A reply cut off at the output limit picks back up on its own", "since": "0.14.2" }
   ]
 }