privateer-agent 0.14.6 → 0.15.0

package/README.md

@@ -78,7 +78,7 @@ What Privateer adds is a *moat* of Pi extensions layered on top:
 | `privateer-posture`, `privateer-tools` | live attestation shield + Privateer tool pack |
 | `privateer-web` | `web_search`/`web_fetch` — your account's search once signed in, or your own provider (`rpiv-web-tools`: self-hosted SearXNG, Brave, Tavily…) |
 | `rpiv-ask-user-question` | `ask_user_question` — a structured questionnaire the agent puts to you instead of guessing |
-| `pi-mcp-adapter`, `pi-subagents` | MCP servers · bounded parallel sub-agents |
+| `privateer-codemode`, `pi-subagents` | codemode (how MCP tools are called — Pi's built-in MCP support) · bounded parallel sub-agents |
 
 They're ordinary Pi extensions — inspect them, replace them, or build your own alongside.
 **Extend by discovery:** drop an extension into `~/.privateer/agent/extensions/` (move the home
@@ -641,7 +641,7 @@ built-ins. Two kinds:
 
 ```
 /connect        # add, enable, disable, or remove connectors
-/mcp            # pi-mcp-adapter's own status view — what actually connected
+/mcp            # Pi's own status view — what connected; `/mcp login <name>` to sign in
 ```
 
 `/connect` opens a picker over a curated catalog of 21 connectors — GitHub, Slack, Notion,
@@ -748,9 +748,9 @@ plan-mode deny is the one thing it doesn't talk around.
 Everything below is a **Pi extension** loaded by discovery (see [Built on Pi](#built-on-pi)) —
 drop your own into `~/.privateer/agent/extensions/` and it loads the same way, gated like the rest.
 
-- **MCP servers** (`pi-mcp-adapter`) — declare them and their tools become first-class, gated
-  like the rest (local stdio, or remote HTTP with interactive OAuth). Add them with
-  `/connect`; see [Connectors — MCP](#connectors--mcp).
+- **MCP servers** (Pi's built-in MCP support) — declare them and the model reaches their tools
+  through codemode, each call gated like the rest (local stdio, or remote streamable HTTP with
+  interactive OAuth). Add them with `/connect`; see [Connectors — MCP](#connectors--mcp).
 - **Sub-agents** (`pi-subagents`) — delegate investigations to bounded parallel agents. Children
   run as headless child processes that **inherit the moat**, so their actions hit the same
   permission gate and their approvals surface on your phone.

package/bin/headless-flags.mjs

@@ -180,7 +180,7 @@ export function privateProblem(args) {
 // Pi's own subcommands. Pi recognizes each only as args[0], so the launcher must hand
 // them over with NOTHING in front — the normal launch prepends --model, -e and --skill,
 // which is exactly how `privateer auth check` used to become a chat message.
-export const PI_SUBCOMMANDS = ["auth", "install", "remove", "uninstall", "list", "config"];
+export const PI_SUBCOMMANDS = ["auth", "install", "remove", "uninstall", "list", "config", "mcp"];
 
 const AUTH_SUBCOMMANDS = ["check", "print-api-key", "print-bearer-token"];
 

package/bin/privateer-launch.mjs

@@ -690,6 +690,18 @@ else if (PI_SUBCOMMANDS.includes(sub)) {
   configureCompileCache(PRIVATEER_HOME); // same Pi module graph as a launch — reuse its compiled code
   ensurePatches(); // project `.privateer/` config dirs are a patch; -l scope needs them
   process.env.PI_CODING_AGENT_DIR = AGENT_DIR;
+  // `mcp list` / `mcp login` read agent/mcp.json. A file an older release wrote for
+  // pi-mcp-adapter is rejected entry by entry, so upgrade it first — the same one-time
+  // step every session runs (src/remote/mcpControl.ts). Best-effort: a failure leaves
+  // Pi to report the file as it stands.
+  if (sub === "mcp") {
+    const mcpControl = pathToFileURL(path.join(REPO, "src", "remote", "mcpControl.ts")).href;
+    spawnSync(NODE_BIN, ["--import", "tsx", "--input-type=module", "-e", `(await import(${JSON.stringify(mcpControl)})).migrateMcpProjection()`], {
+      cwd: REPO,
+      stdio: "ignore",
+      env: process.env,
+    });
+  }
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
   runToCompletion(NODE_BIN, [...nodeArgs, CLI, ...args]);
 }
@@ -754,6 +766,11 @@ else {
     process.env.PI_SUBAGENT_PI_BINARY = path.join(REPO, "bin", "privateer-subagent.mjs");
   }
   process.env.PRIVATEER_CHILD_EXTENSIONS = MOAT_PATHS.join(path.delimiter);
+  // A child also gets Pi's MCP support and tool_search, which it loads as built-ins:
+  // children run --no-extensions (bin/privateer-subagent.mjs), which turns built-ins off
+  // too, so a subagent of this terminal would otherwise lose the connectors its parent
+  // has. codemode reaches it as our own moat extension (privateer-codemode).
+  process.env.PRIVATEER_CHILD_BUILTINS = "mcp,tool-search";
   // Suppress Pi's upstream update banner (our banner is the startup surface). Disables
   // ONLY the version fetch — fd/rg can still download on first run.
   if (!process.env.PI_SKIP_VERSION_CHECK) process.env.PI_SKIP_VERSION_CHECK = "1";
@@ -769,6 +786,22 @@ else {
     if (s.quietStartup === undefined) { s.quietStartup = true; m = true; }
     if (s.collapseChangelog === undefined) { s.collapseChangelog = true; m = true; }
     if (s.lastChangelogVersion === undefined) { s.lastChangelogVersion = "9999.0.0"; m = true; }
+    // Pi 1.0 made fullscreen the default; our footer, splash and compaction patches are
+    // built for the regular scrollback UI. A user who picks fullscreen keeps it.
+    if (s.tuiMode === undefined) { s.tuiMode = "regular"; m = true; }
+    // Pi 1.3's `/share` defaults to "auto", which uploads to Earendil's Radius when the
+    // user is signed in there. A share leaves the machine only to the user's own gist.
+    if (s.sessionShareDestination === undefined) { s.sessionShareDestination = "gist"; m = true; }
+    // Pi 0.99 auto-loads built-in extensions. builtin:mcp and builtin:tool-search are
+    // ours to keep — Pi's MCP support IS our MCP support. builtin:codemode is replaced by
+    // extensions/privateer-codemode.ts (the same tool without the `models` global), and
+    // builtin:llama.cpp, a local-model integration, stays off until adopted on purpose.
+    // Each is added once — a user's own +/- entry for that built-in is left alone.
+    const ext = Array.isArray(s.extensions) ? s.extensions : [];
+    for (const name of ["builtin:codemode", "builtin:llama.cpp"]) {
+      if (!ext.some((e) => typeof e === "string" && e.replace(/^[+\-!]/, "") === name)) { ext.push(`-${name}`); m = true; }
+    }
+    if (ext.length) s.extensions = ext;
     if (m) fs.writeFileSync(sp, JSON.stringify(s, null, 2) + "\n");
   } catch { /* best-effort */ }
 

package/bin/privateer-subagent.mjs

@@ -67,9 +67,22 @@ export function piCliPath(repoRoot = REPO) {
 // Given the args pi-subagents built for the child, return the args to run the bundled
 // cli.js with: `--no-extensions` + one `-e <path>` per moat extension, THEN the
 // original args (so the injected flags precede the positional `Task:` prompt).
+// Pi's built-in extensions the parent wants its children to keep (MCP, tool_search),
+// by bare name. `--no-extensions` turns built-ins off too, so each is loaded back with
+// `-e builtin:<name>`. A separate, comma-separated variable rather than entries in
+// PRIVATEER_CHILD_EXTENSIONS: that one splits on path.delimiter, which is ":" on
+// macOS and Linux — the very character in "builtin:mcp".
+export function childBuiltins(env = process.env) {
+  return (env.PRIVATEER_CHILD_BUILTINS ?? "")
+    .split(",")
+    .map((n) => n.trim())
+    .filter((n) => /^[a-z0-9.-]+$/i.test(n));
+}
+
 export function buildChildArgs(originalArgs, repoRoot = REPO, env = process.env) {
   const inject = ["--no-extensions"];
   for (const p of moatExtensionPaths(repoRoot, env)) inject.push("-e", p);
+  for (const name of childBuiltins(env)) inject.push("-e", `builtin:${name}`);
   return [...inject, ...originalArgs];
 }
 

package/extensions/privateer-codemode.ts

@@ -0,0 +1,15 @@
+// codemode — the model writes a short script that calls tools, and only the script's
+// output comes back. It is how Pi's built-in MCP support reaches server tools by
+// default, and it runs in a QuickJS sandbox with no file system, network or timers:
+// every effect is a tool call, each one sent through the permission gate like a direct
+// call (see classifyToolCall).
+//
+// Loaded here instead of as Pi's `builtin:codemode` (which the launcher turns off) for
+// one option: `models: false`. Pi's copy gives scripts a `models` global that runs
+// classifier and image models with the session's credentials — model calls the gate
+// never sees, to whichever provider has a key, not necessarily the one this session was
+// chosen for. Registering a tool named `codemode` replaces the built-in one, and Pi's
+// MCP support activates it exactly as it would its own.
+import { createCodemodeExtension } from "@earendil-works/pi-coding-agent";
+
+export default createCodemodeExtension({ models: false });

package/extensions/privateer-connect.ts

@@ -2,10 +2,9 @@
  * The Privateer `/connect` panel — add, toggle, and remove MCP connectors without
  * leaving the terminal.
  *
- * WHY THIS EXISTS: pi-mcp-adapter owns `/mcp`, but that command is a *status and
- * connection* surface — its setup flow can only adopt configs from other hosts,
- * scaffold an EMPTY `.mcp.json`, or quick-add RepoPrompt. There is no way to type in
- * a server. So the terminal was the one surface where adding a connector meant
+ * WHY THIS EXISTS: Pi's `/mcp` is a *status and connection* surface — inspect,
+ * sign in, reconnect, toggle. It has no catalog and no form for typing in a server, so
+ * without this the terminal was the one surface where adding a connector meant
  * hand-editing JSON, while the phone and the desktop both had a real editor.
  *
  * ONE CONFIG, THREE SURFACES: this is deliberately a thin UI over the SAME
@@ -16,8 +15,8 @@
  * routine runs. Nothing about this panel is terminal-specific except the pixels.
  *
  * SECRETS: env values are typed into a masked field and written in PLAINTEXT to the
- * config on this machine — correct, and the same thing the desktop does: the adapter
- * has to hand the real token to the server process. The masking is shoulder-surfing
+ * config on this machine — correct, and the same thing the desktop does: Pi has to
+ * hand the real token to the server process. The masking is shoulder-surfing
  * and screen-share hygiene, not a storage claim. (Over the relay it's different —
  * there the value is sealed to the terminal's key; see mcpControl's header.)
  */
@@ -31,6 +30,7 @@ import {
 } from "@earendil-works/pi-tui";
 import {
   makeMcpControl,
+  migrateMcpProjection,
   type McpDraft,
   type RemoteMcpServer,
 } from "../src/remote/mcpControl.ts";
@@ -55,7 +55,7 @@ interface TuiLike {
 
 // What the panel hands back to the command handler when it closes.
 export interface ConnectResult {
-  // True when the config changed, so the handler knows to reload the adapter.
+  // True when the config changed, so the handler knows to reload MCP.
   changed: boolean;
   message?: string;
 }
@@ -183,8 +183,8 @@ function customSteps(existing?: RemoteMcpServer): Step[] {
       key: "target",
       prompt: hosted ? "Server URL" : "Launch command, or an https:// URL",
       hint: hosted
-        ? "e.g. https://mcp.example.com/sse — a hosted agent can't run a local command."
-        : "e.g. npx -y @modelcontextprotocol/server-memory  ·  or  https://mcp.example.com/sse",
+        ? "e.g. https://mcp.example.com/mcp — a hosted agent can't run a local command."
+        : "e.g. npx -y @modelcontextprotocol/server-memory  ·  or  https://mcp.example.com/mcp",
       initial: target,
       validate: hosted
         ? (v) =>
@@ -253,13 +253,12 @@ function buildCustomDraft(answers: Record<string, string>): McpDraft {
     const hasHeaders = Object.keys(headers).length > 0;
     if (hasHeaders) draft.headers = headers;
     if (token) {
-      // A static token: the adapter only sends the Authorization header when auth is
-      // explicitly "bearer", so this pairing is not optional.
+      // A static token: mcpControl projects it into an Authorization header only when
+      // auth is "bearer", so this pairing is not optional.
       draft.auth = "bearer";
       draft.bearerToken = token;
     } else if (hasHeaders) {
-      // Custom headers ARE the credential here — the adapter's supportsOAuth() refuses
-      // OAuth once headers are configured, so claiming "oauth" would be a lie.
+      // Custom headers ARE the credential here, so claiming "oauth" would be a lie.
       draft.auth = "none";
     } else {
       draft.auth = "oauth";
@@ -325,7 +324,7 @@ function pendingFromCatalog(e: CatalogEntry): Pending {
     },
     note:
       e.needs === "oauth"
-        ? `Authorize it in a browser on THIS machine: /mcp-auth ${e.name}`
+        ? `Authorize it in a browser on THIS machine: /mcp login ${e.name}`
         : e.localHttp
           // Not a warning — a localHttp connector is correct the moment it saves. But
           // it answers only while its host app is up, so a later failure means "the
@@ -507,7 +506,7 @@ class ConnectPanel extends Container {
   private statusOf(s: RemoteMcpServer): string {
     const t = this.theme;
     if (s.transport === "http" && s.oauth) {
-      return t.fg("warning", `⚠ authorize: /mcp-auth ${s.name}`);
+      return t.fg("warning", `⚠ authorize: /mcp login ${s.name}`);
     }
     if (s.envKeys.length > 0) {
       const missing = s.envKeys.filter((k) => !s.secretsSet.includes(k));
@@ -880,6 +879,9 @@ export default function privateerConnect(pi: {
   registerCommand?: (name: string, opts: unknown) => void;
 }): void {
   if (typeof pi.registerCommand !== "function") return;
+  // Before Pi's MCP support reads mcp.json at session_start: a file an older release
+  // wrote in pi-mcp-adapter's format would otherwise lose every HTTP connector in it.
+  migrateMcpProjection();
 
   pi.registerCommand("connect", {
     description: "Add, enable, or remove MCP connectors (GitHub, Notion, Linear, …)",
@@ -896,9 +898,10 @@ export default function privateerConnect(pi: {
       );
 
       if (!result?.changed) return;
-      // Reload so pi-mcp-adapter re-reads mcp.json in this session — the same thing
-      // its own `/mcp setup` does after a write. Without it the new connector only
-      // appears on the next launch, which reads as "it didn't work".
+      // Reload so Pi's MCP support re-reads mcp.json in this session (its own docs:
+      // "Run /reload after adding, removing, or changing a server outside the
+      // session"). Without it the new connector only appears on the next launch,
+      // which reads as "it didn't work".
       try {
         await ctx.reload?.();
       } catch {

package/extensions/privateer-web.ts

@@ -33,7 +33,7 @@
 //
 // The specifiers are built rather than written as literals on purpose: it keeps tsc from
 // pulling that package's own .ts sources into our typecheck, the same trick config/moat.ts
-// uses for pi-mcp-adapter.
+// used for pi-mcp-adapter.
 import { guardedWebToolDefinitions } from "../src/tools/web.ts";
 import { guardedCryptoToolDefinitions } from "../src/tools/crypto.ts";
 import { readWebToolsConfig, resolveWebMode, type ProviderMetaLike } from "../src/tools/webMode.ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.14.6",
+  "version": "0.15.0",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",
@@ -71,21 +71,20 @@
     "node": ">=22.19.0"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "0.86.0",
-    "@earendil-works/pi-coding-agent": "0.86.0",
-    "@earendil-works/pi-tui": "0.86.0",
-    "@juicesharp/rpiv-ask-user-question": "2.10.1",
-    "@juicesharp/rpiv-web-tools": "2.10.1",
+    "@earendil-works/pi-ai": "1.3.0",
+    "@earendil-works/pi-coding-agent": "1.3.0",
+    "@earendil-works/pi-tui": "1.3.0",
+    "@juicesharp/rpiv-ask-user-question": "2.13.8",
+    "@juicesharp/rpiv-web-tools": "2.13.8",
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "1.9.7",
     "@noble/hashes": "1.8.0",
     "@phala/dcap-qvl": "0.5.2",
     "@zed-industries/agent-client-protocol": "0.4.5",
     "patch-package": "8.0.1",
-    "pi-background-tasks": "2.5.0",
-    "pi-mcp-adapter": "2.34.0",
+    "pi-background-tasks": "2.6.10",
     "pi-privacy": "0.14.1",
-    "pi-subagents": "0.70.0",
+    "pi-subagents": "0.78.0",
     "picomatch": "4.0.5",
     "privateer-speak": "0.8.0",
     "privateer-workflow": "0.1.0",

package/patches/{@earendil-works+pi-ai+0.86.0.patch → @earendil-works+pi-ai+1.3.0.patch}

@@ -1,11 +1,11 @@
 diff --git a/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js b/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
-index 216a45f..a1e3214 100644
+index 4e36f35..8a3f8a5 100644
 --- a/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
 +++ b/node_modules/@earendil-works/pi-ai/dist/api/simple-options.js
-@@ -1,11 +1,38 @@
+@@ -2,11 +2,39 @@ import { clampThinkingLevel } from "../models.js";
  import { estimateContextTokens } from "../utils/estimate.js";
  const CONTEXT_SAFETY_TOKENS = 4096;
--const MIN_MAX_TOKENS = 1;
+ const MIN_MAX_TOKENS = 1;
 +// Privateer patch: floor the answer budget at a usable answer, not at one token.
 +//
 +// Stock pi floored this at 1, so the moment the (chars/4) context estimate reached
@@ -36,11 +36,10 @@ index 216a45f..a1e3214 100644
 +// Mirrors src/engine/contextBudget.ts, which is where this is specified and tested.
  export function clampMaxTokensToContext(model, context, maxTokens) {
      if (model.contextWindow <= 0)
--        return Math.max(MIN_MAX_TOKENS, maxTokens);
-+        return Math.max(1, maxTokens);
+         return Math.max(MIN_MAX_TOKENS, maxTokens);
      const available = model.contextWindow - estimateContextTokens(context).tokens - CONTEXT_SAFETY_TOKENS;
 -    return Math.min(maxTokens, Math.max(MIN_MAX_TOKENS, available));
 +    return Math.min(maxTokens, Math.max(MIN_ANSWER_TOKENS, available));
  }
- export function buildBaseOptions(model, context, options, apiKey) {
-     const samplingParams = model.samplingParams || options?.samplingParams
+ export function resolveSamplingParams(model, thinkingLevel, requestParams) {
+     const effectiveThinkingLevel = clampThinkingLevel(model, thinkingLevel);