privateer-agent 0.15.3 → 0.15.5

package/bin/session-seal.mjs

@@ -0,0 +1,242 @@
+// Session sealing — Pi's session transcripts, encrypted at rest.
+//
+// Pi writes every conversation to ~/.privateer/agent/sessions/<cwd>/<ts>_<id>.jsonl,
+// one JSON entry per line, and until now in plaintext: every prompt, every reply,
+// every file the agent read and every command's output, readable by anything that
+// can read the home directory — backup and sync tools, indexers, a stray `grep -r`,
+// any other program the user runs.
+//
+// Now each line except the header is sealed with AES-256-GCM:
+//     {"pvs":1,"iv":"<b64 12 bytes>","ct":"<b64 ciphertext‖tag>"}
+// The HEADER (type "session": id, timestamp, cwd) stays readable on purpose. Pi
+// finds and lists sessions by reading only the first line of each file, and the cwd
+// it holds is already spelled out in the directory name, so sealing it would cost
+// session discovery and hide nothing.
+//
+// The patch in patches/@earendil-works+pi-coding-agent+*.patch routes Pi's reads
+// (parseSessionEntryLine / parseSessionEntries) and writes (every JSON.stringify of
+// an entry) through the codec this module installs on globalThis. Without the codec
+// — Pi run by hand, outside `privateer` — Pi writes plaintext as before, and sealed
+// lines read as absent rather than as garbage. Readers accept both forms forever, so
+// files written before this change, and files of mixed form, keep working.
+//
+// THE KEY, AND WHAT THIS DOES NOT DO. One random 32-byte key per machine, in
+// $PRIVATEER_HOME/session-key.json (0600) — next to the data, like this tool's other
+// secrets (terminal-key.json, credentials). So this protects transcripts from
+// anything that reads the session FILES (indexers, a shared or synced sessions
+// folder, an attachment pasted from the wrong directory, tools that scan for
+// .jsonl), and it does NOT protect them from someone who can read the whole
+// ~/.privateer as this user: that reader has the key too. Say exactly that, never
+// more. An OS keychain would move the key out of the folder, at the price of
+// sessions that can't open over ssh or with the keychain locked — a different
+// trade, not a free upgrade.
+//
+// Never mint a key over one that exists: a second key orphans every session sealed
+// under the first. A key file that is present but unreadable or malformed is an
+// error (sealing is switched off and the user is told), never a reason to start over.
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+export const CODEC_KEY = Symbol.for("privateer.sessionCodec");
+const KEY_FILE = "session-key.json";
+
+export function keyPath(home) {
+  return path.join(home, KEY_FILE);
+}
+
+function parseKeyFile(text) {
+  const parsed = JSON.parse(text);
+  const key = Buffer.from(String(parsed?.key ?? ""), "base64");
+  if (parsed?.v !== 1 || key.length !== 32) throw new Error("session key file is malformed");
+  return key;
+}
+
+/**
+ * Load this machine's session key, minting it only when no key file exists at all.
+ * Two terminals starting at once race on `wx`: the loser re-reads the winner's key.
+ */
+export function loadOrCreateKey(home) {
+  const file = keyPath(home);
+  try {
+    return parseKeyFile(fs.readFileSync(file, "utf8"));
+  } catch (e) {
+    if (e?.code !== "ENOENT") throw e;
+  }
+  fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+  const key = crypto.randomBytes(32);
+  try {
+    fs.writeFileSync(file, JSON.stringify({ v: 1, key: key.toString("base64"), created: new Date().toISOString() }) + "\n", { mode: 0o600, flag: "wx" });
+    return key;
+  } catch (e) {
+    if (e?.code === "EEXIST") return parseKeyFile(fs.readFileSync(file, "utf8"));
+    throw e;
+  }
+}
+
+export function isSealed(obj) {
+  return !!obj && typeof obj === "object" && obj.pvs === 1 && typeof obj.iv === "string" && typeof obj.ct === "string";
+}
+
+/** One entry → one line (no newline). The session header is never sealed. */
+export function encodeEntry(entry, key) {
+  if (entry?.type === "session") return JSON.stringify(entry);
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+  const ct = Buffer.concat([cipher.update(JSON.stringify(entry), "utf8"), cipher.final(), cipher.getAuthTag()]);
+  return JSON.stringify({ pvs: 1, iv: iv.toString("base64"), ct: ct.toString("base64") });
+}
+
+/** A parsed line → the entry. Plaintext passes through; a line that fails to open → null. */
+export function decodeEntry(obj, key) {
+  if (!isSealed(obj)) return obj;
+  try {
+    const iv = Buffer.from(obj.iv, "base64");
+    const raw = Buffer.from(obj.ct, "base64");
+    if (iv.length !== 12 || raw.length < 17) return null;
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(raw.subarray(raw.length - 16));
+    const text = Buffer.concat([decipher.update(raw.subarray(0, raw.length - 16)), decipher.final()]).toString("utf8");
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Install the codec Pi's patched session manager calls. Returns { ok, error? }.
+ * `failures` counts lines that would not open (a different machine's key, a damaged
+ * file), so the agent can say so instead of showing a silently shorter session.
+ */
+export function installCodec(home) {
+  let key;
+  try {
+    key = loadOrCreateKey(home);
+  } catch (e) {
+    delete globalThis[CODEC_KEY];
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+  const codec = {
+    failures: 0,
+    encode: (entry) => encodeEntry(entry, key),
+    decode: (obj) => {
+      const out = decodeEntry(obj, key);
+      if (out === null) codec.failures++;
+      return out;
+    },
+  };
+  globalThis[CODEC_KEY] = codec;
+  return { ok: true };
+}
+
+/**
+ * Seal one existing file in place. Lines that are already sealed, the header, and
+ * lines that don't parse are carried over byte-for-byte (a malformed line is Pi's to
+ * skip, not ours to drop). Written to a sibling temp file, VERIFIED by reading it
+ * back, then renamed over the original only if the original hasn't changed since it
+ * was read — a session another terminal is appending to is left for a later pass.
+ * The file keeps its original atime/mtime (Pi sorts sessions by mtime).
+ * Returns "sealed" | "unchanged" | "busy" | "failed".
+ */
+export function sealFile(file, key) {
+  let before, text;
+  try {
+    before = fs.statSync(file);
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    return "failed";
+  }
+  const lines = text.split("\n");
+  let changed = false;
+  const out = lines.map((line) => {
+    if (!line.trim()) return line;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      return line;
+    }
+    if (isSealed(obj) || obj?.type === "session") return line;
+    changed = true;
+    return encodeEntry(obj, key);
+  });
+  if (!changed) return "unchanged";
+
+  // Verify: every original entry must come back identical from what we will write.
+  for (let i = 0; i < lines.length; i++) {
+    if (out[i] === lines[i]) continue;
+    const back = decodeEntry(JSON.parse(out[i]), key);
+    if (JSON.stringify(back) !== JSON.stringify(JSON.parse(lines[i]))) return "failed";
+  }
+
+  const tmp = `${file}.sealing-${process.pid}`;
+  try {
+    fs.writeFileSync(tmp, out.join("\n"), { mode: 0o600 });
+    const now = fs.statSync(file);
+    if (now.size !== before.size || now.mtimeMs !== before.mtimeMs) {
+      fs.rmSync(tmp, { force: true });
+      return "busy";
+    }
+    // Keep the original times: Pi orders sessions by mtime (`privateer -c` continues
+    // the most recent one), so a conversion must not make an old session look new.
+    fs.utimesSync(tmp, before.atime, before.mtime);
+    fs.renameSync(tmp, file);
+    return "sealed";
+  } catch {
+    try { fs.rmSync(tmp, { force: true }); } catch { /* best-effort */ }
+    return "failed";
+  }
+}
+
+/** Every session file under Pi's sessions dir. */
+export function listSessionFiles(sessionsDir) {
+  const out = [];
+  let dirs = [];
+  try {
+    dirs = fs.readdirSync(sessionsDir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const d of dirs) {
+    if (!d.isDirectory()) continue;
+    const dir = path.join(sessionsDir, d.name);
+    try {
+      for (const f of fs.readdirSync(dir)) if (f.endsWith(".jsonl")) out.push(path.join(dir, f));
+    } catch { /* unreadable folder: skip */ }
+  }
+  return out;
+}
+
+/**
+ * Seal every plaintext session on this machine — once, then never again. Files
+ * touched in the last QUIET_MS are skipped (another terminal may be writing them);
+ * the done-marker is only written when nothing was skipped or failed, so a later
+ * launch finishes the job. Async-yielding so the launcher's event loop stays live.
+ */
+export const QUIET_MS = 10 * 60 * 1000;
+export async function sweepSessions(home, sessionsDir, { now = Date.now(), quietMs = QUIET_MS } = {}) {
+  const done = path.join(home, "run", "sessions-sealed-v1");
+  if (fs.existsSync(done)) return { skipped: true };
+  let key;
+  try {
+    key = loadOrCreateKey(home);
+  } catch {
+    return { error: true };
+  }
+  const tally = { sealed: 0, unchanged: 0, busy: 0, failed: 0, recent: 0 };
+  for (const file of listSessionFiles(sessionsDir)) {
+    try {
+      if (now - fs.statSync(file).mtimeMs < quietMs) { tally.recent++; continue; }
+    } catch { continue; }
+    tally[sealFile(file, key)]++;
+    await new Promise((r) => setImmediate(r));
+  }
+  if (!tally.busy && !tally.failed && !tally.recent) {
+    try {
+      fs.mkdirSync(path.dirname(done), { recursive: true, mode: 0o700 });
+      fs.writeFileSync(done, new Date().toISOString() + "\n", { mode: 0o600 });
+    } catch { /* retried next launch */ }
+  }
+  return tally;
+}

package/extensions/privateer-gate.ts

@@ -20,6 +20,7 @@ import {
   startParentApprovalRelay,
 } from "../src/remote/subagentRelay.ts";
 import { RelayClient } from "../src/remote/relayClient.ts";
+import { transcriptSnapshot } from "../src/remote/transcriptSnapshot.ts";
 import { makeSendFileTool } from "../src/tools/sendFile.ts";
 import { makeSaveCargoTool } from "../src/tools/cargo.ts";
 import { makeChartTools } from "../src/tools/charts.ts";
@@ -63,6 +64,41 @@ function piBusy(): boolean {
   try { return ctxRef?.isIdle?.() === false; } catch { return false; }
 }
 
+// Messages the app sent mid-turn that Pi has queued as steers but the model has not
+// read yet. Pi only reads a steer between steps, and a turn that ends on an error or
+// a Stop leaves it in the queue — the app showed "Added to the running turn" and then
+// nothing, so a driver had no way to tell a read message from a lost one. Each entry
+// is cleared (and the app told) when Pi puts it in the transcript.
+let unreadSteers: string[] = [];
+let stopRequested = false;
+const userText = (m: any): string =>
+  typeof m?.content === "string"
+    ? m.content
+    : Array.isArray(m?.content) ? m.content.filter((p: any) => p?.type === "text").map((p: any) => p.text).join("\n") : "";
+
+// After a run ends, wait for Pi to settle (it may start another run to drain the
+// queue itself), then say so if an app message is still sitting unread.
+function reportStrandedSteers(): void {
+  const stopped = stopRequested;
+  stopRequested = false;
+  if (!unreadSteers.length) return;
+  const startedAt = Date.now();
+  const check = () => {
+    if (!unreadSteers.length) return;
+    if (piBusy()) {
+      if (Date.now() - startedAt < 10_000) setTimeout(check, 250).unref?.();
+      return; // still running: the next step or agent_end reads/reports it
+    }
+    const n = unreadSteers.length;
+    const what = n === 1 ? "Your last message" : `Your last ${n} messages`;
+    relay?.sendNotice(
+      `${what} arrived after the agent's final step${stopped ? " (you stopped the turn)" : ""}, so it wasn't read. ` +
+        "It will go to the agent with your next prompt.",
+    );
+  };
+  setTimeout(check, 250).unref?.();
+}
+
 let piRef: any = null;
 let relay: any = null;
 // Pi-extension manager for the app's extensions screen. Built lazily on first use
@@ -381,7 +417,10 @@ const bridge = new RemoteBridge({
           relay?.sendNotice(`Couldn't attach: ${mentions.skipped.join(", ")} (must be a file inside ${cwd})`);
         }
         const body = mentions.text + note;
-        if (piBusy()) relay?.sendNotice("Added to the running turn — the agent reads it before its next step.");
+        if (piBusy()) {
+          unreadSteers.push(body);
+          relay?.sendNotice("Added to the running turn — the agent reads it before its next step.");
+        }
         // A message sent mid-turn STEERS it, as in the REPL and the desktop session.
         // This used to be refused with "busy — a turn is already running" behind a flag
         // that only agent_end cleared — but the extension API's sendUserMessage is
@@ -402,7 +441,17 @@ const bridge = new RemoteBridge({
       }
     });
   },
-  onInterrupt: () => {}, // Pi owns interrupt; best-effort no-op
+  // The app's Stop. This was a no-op, so Stop only closed the turn in the app while the
+  // agent kept working — and the next message from the app landed as a steer on a turn
+  // the driver believed was over.
+  onInterrupt: () => {
+    try {
+      if (ctxRef?.isIdle?.() === false) {
+        stopRequested = true;
+        ctxRef.abort();
+      }
+    } catch { /* a replaced session's context throws — nothing to stop */ }
+  },
   // The app asked to end remote access from its side — stop the relay locally too so
   // the terminal doesn't keep reconnecting, and clear the green indicator.
   onTerminate: () => disableRemote(),
@@ -423,7 +472,19 @@ const bridge = new RemoteBridge({
     // snapshot, push live context (model + version) so the app banner reflects this
     // terminal, and advertise the slash commands for the composer's autocomplete.
     setRemoteState("connected");
-    relay?.sendSnapshot([{ kind: "notice", text: "Privateer terminal connected." }]);
+    // The session's transcript, not a "connected" notice: an app coming back from
+    // sleep holds a feed frozen where its socket died, and this is how it learns what
+    // happened since — including that the turn it last saw is over (`running`).
+    let entries: ReturnType<typeof transcriptSnapshot> = [];
+    let running = false;
+    try {
+      entries = transcriptSnapshot(ctxRef?.sessionManager?.getBranch?.() ?? []);
+      running = ctxRef?.isIdle?.() === false;
+    } catch { /* a replaced session's context throws — fall back to the notice */ }
+    relay?.sendSnapshot(
+      entries.length ? entries : [{ kind: "notice", text: "Privateer terminal connected." }],
+      { full: entries.length > 0, running },
+    );
     // cwd rides along here (home-collapsed on the way out, see RelayClient.sendContext).
     // Without it the app's composer shows no working-directory strip at all — and that
     // strip is the only place a driver can see which folder the prompts they type are
@@ -667,6 +728,8 @@ export default function privateerControl(pi: any): void {
     // remote access was already on when the session (re)started.
     if (ctx?.ui) uiRef = ctx.ui;
     ctxRef = ctx;
+    unreadSteers = []; // a new session has a new queue
+    stopRequested = false;
     // Capture the model registry + launch model so the app's /model picker has this
     // machine's real catalog and the banner shows the current spec from the start.
     if (ctx?.modelRegistry) modelReg = ctx.modelRegistry;
@@ -796,6 +859,14 @@ export default function privateerControl(pi: any): void {
   });
   pi.on("message_start", (ev: any) => {
     if (headlessRun && ev?.message?.role === "assistant") watchdog.arm();
+    // A queued app message entering the transcript — the model reads it this step.
+    // Match by text; an input handler (the privacy filter) may have rewritten it, in
+    // which case the oldest unread one is the one Pi just delivered (FIFO).
+    if (ev?.message?.role === "user" && unreadSteers.length) {
+      const i = unreadSteers.indexOf(userText(ev.message));
+      unreadSteers.splice(i >= 0 ? i : 0, 1);
+      relay?.sendNotice("The agent read your message.");
+    }
   });
   pi.on("message_update", () => {
     if (headlessRun) watchdog.arm();
@@ -840,6 +911,7 @@ export default function privateerControl(pi: any): void {
   pi.on("agent_end", (ev: any) => {
     fwd(ev);
     bridge.settleTurn();
+    reportStrandedSteers();
   });
 
   pi.registerCommand?.("mode", {

package/extensions/privateer-recovery.ts

@@ -0,0 +1,175 @@
+// Session recovery, agent side — keeps this process's live marker current and, when
+// this session is a resumption of one whose agent died, tells the model and the user.
+// Also the one place that tells the user when session sealing (bin/session-seal.mjs)
+// is off for this run, or when lines of the session couldn't be decrypted.
+//
+// The marker (bin/session-recovery.mjs has the whole design) is written at:
+//   session_start          → which session file, no turn open
+//   agent_start            → a turn is open
+//   tool_execution_start   → which tool, and a one-line summary of its target
+//   tool_execution_end     → no tool running (the turn may still be open)
+//   agent_end              → turn closed
+//   session_shutdown       → removed, UNLESS a turn is still open — a terminal closed
+//                            mid-task is an interrupted task, and the next launch in
+//                            that folder should say so
+//
+// On session_start this agent also looks for a dead agent's marker for the SAME
+// session file — handed over by the supervisor in $PRIVATEER_RECOVERY when it
+// relaunched us after a crash, or found on disk when the user resumed by hand
+// (--session / -c / -r) — and turns it into one note for the model (delivered with
+// the user's next message, never triggering a turn on its own) plus one line for
+// the user. Nothing is re-run.
+//
+// TUI only: print/json runs are one-shot and scripted, and the desktop and harbor
+// sessions are in-memory, with no session file to resume into.
+
+import fs from "node:fs";
+import { globalDir } from "../src/config/paths.ts";
+import {
+  RECOVERY_ENV,
+  decodeRecovery,
+  listStale,
+  recoveryNote,
+  recoveryNotice,
+  removeMarker,
+  resumeHint,
+  staleForSession,
+  summarizeToolCall,
+  writeMarker,
+} from "../bin/session-recovery.mjs";
+
+// Read once and taken out of the environment, like the fresh-agent key: every bash
+// command the agent runs inherits process.env, and none of them should see this.
+const HANDOFF = Symbol.for("privateer.recovery.handoff");
+function takeHandoff(): string | undefined {
+  const g = globalThis as any;
+  if (!(HANDOFF in g)) {
+    g[HANDOFF] = process.env[RECOVERY_ENV];
+    delete process.env[RECOVERY_ENV];
+  }
+  const v = g[HANDOFF];
+  g[HANDOFF] = undefined; // one resumption, one note
+  return v;
+}
+
+let sealingWarned = false;
+function sealingNotice(ctx: any): void {
+  const g = globalThis as any;
+  const codec = g[Symbol.for("privateer.sessionCodec")];
+  const error = g[Symbol.for("privateer.sessionCodecError")];
+  if (!codec) {
+    if (sealingWarned || !error) return; // no preload at all = not launched by privateer
+    sealingWarned = true;
+    ctx?.ui?.notify?.(`Session encryption is off for this run (${error}). This session is being saved unencrypted. Your key file was left untouched — sessions sealed with it are unreadable until it's fixed.`, "warning");
+    return;
+  }
+  if (codec.failures > 0) {
+    const n = codec.failures;
+    codec.failures = 0;
+    ctx?.ui?.notify?.(`${n} saved line${n === 1 ? "" : "s"} of this session couldn't be decrypted with this machine's session key and ${n === 1 ? "isn't" : "aren't"} shown. The file itself is unchanged.`, "warning");
+  }
+}
+
+export default function privateerRecovery(pi: any): void {
+  const home = globalDir();
+  const pid = process.pid;
+  let state: {
+    sessionFile: string;
+    cwd: string;
+    startedAt: number;
+    turnOpen: boolean;
+    tool: { name: string; summary: string; startedAt: number } | null;
+  } | null = null;
+
+  const save = () => {
+    if (!state) return;
+    try {
+      writeMarker(home, { v: 1, pid, ...state, updatedAt: Date.now() });
+    } catch {
+      // A marker we can't write costs only the recovery, never the session.
+    }
+  };
+
+  pi.on("session_start", (_event: any, ctx: any) => {
+    if (ctx?.mode !== "tui") return;
+    const sessionFile: string | undefined = ctx?.sessionManager?.getSessionFile?.();
+    if (!sessionFile) {
+      state = null;
+      removeMarker(home, pid);
+      return;
+    }
+    state = { sessionFile, cwd: ctx?.cwd ?? process.cwd(), startedAt: Date.now(), turnOpen: false, tool: null };
+    save();
+
+    // Session sealing (bin/session-seal.mjs) is installed by a preload; say when it
+    // isn't working rather than let a session silently save in plaintext, or open
+    // shorter than it is.
+    sealingNotice(ctx);
+
+    // Sessions written before Pi tightened its file mode are world-readable.
+    try {
+      if (fs.existsSync(sessionFile)) fs.chmodSync(sessionFile, 0o600);
+    } catch { /* not ours to fail over */ }
+
+    const handed = decodeRecovery(takeHandoff());
+    const dead = handed && handed.sessionFile === sessionFile ? handed : staleForSession(home, sessionFile);
+    if (!dead || dead.pid === pid) {
+      if (_event?.reason === "startup") hintInterrupted(ctx, sessionFile);
+      return;
+    }
+    removeMarker(home, dead.pid);
+
+    const note = recoveryNote(dead);
+    if (note) {
+      pi.sendMessage?.(
+        { customType: "privateer-recovery", content: note, display: false },
+        { deliverAs: "nextTurn" },
+      );
+    }
+    ctx?.ui?.notify?.(recoveryNotice(dead), dead.turnOpen ? "warning" : "info");
+  });
+
+  // A NEW session in a folder whose last session died mid-task (the terminal closed,
+  // the machine slept and was killed, the supervisor died with it): say how to get it
+  // back, once. Never resumed on our own here — the user may have come back on purpose
+  // to start something else.
+  const hintInterrupted = (ctx: any, current: string) => {
+    const cwd = ctx?.cwd ?? process.cwd();
+    const m = listStale(home, { cwd }).find((x) => x.turnOpen && !x.hinted && x.sessionFile !== current);
+    if (!m) return;
+    ctx?.ui?.notify?.(resumeHint(m, { cmd: process.env.PRIVATEER_CMD || "privateer" }), "info");
+    try { writeMarker(home, { ...m, hinted: true }); } catch { /* shown once is a nicety */ }
+  };
+
+  pi.on("agent_start", () => {
+    if (!state) return;
+    state.turnOpen = true;
+    save();
+  });
+
+  pi.on("tool_execution_start", (event: any) => {
+    if (!state || event?.parentToolCallId) return; // the outer call is what the user saw
+    state.tool = { name: String(event?.toolName ?? "tool"), summary: summarizeToolCall(event?.toolName, event?.args), startedAt: Date.now() };
+    save();
+  });
+
+  pi.on("tool_execution_end", (event: any) => {
+    if (!state || event?.parentToolCallId) return;
+    state.tool = null;
+    save();
+  });
+
+  pi.on("agent_end", () => {
+    if (!state) return;
+    state.turnOpen = false;
+    state.tool = null;
+    save();
+  });
+
+  pi.on("session_shutdown", () => {
+    if (!state) return;
+    if (state.turnOpen) save(); // interrupted: leave it for whoever comes next
+    else removeMarker(home, pid);
+    state = null;
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.15.3",
+  "version": "0.15.5",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-coding-agent+1.3.0.patch

@@ -826,6 +826,95 @@ index 563d7d5..4f669b6 100644
              return projectPath;
          }
          const globalPath = join(this.agentDir, "APPEND_SYSTEM.md");
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/session-manager.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/session-manager.js
+index 62b469b..7e3c2c1 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/core/session-manager.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/session-manager.js
+@@ -1,6 +1,22 @@
+ import { getCurrentSystemMessage, uuidv7, } from "@earendil-works/pi-ai";
+ import { randomUUID } from "crypto";
+ import { appendFileSync, closeSync, createReadStream, existsSync, mkdirSync, openSync, readdirSync, readSync, statSync, writeFileSync, } from "fs";
++// [privateer] Session sealing (privateer-agent bin/session-seal.mjs): every entry
++// line except the header is written and read through a codec the launcher installs
++// on globalThis before Pi starts. Absent codec → plaintext, as upstream; a sealed
++// line read without the codec is skipped like any other line Pi can't parse.
++const PRIVATEER_SESSION_CODEC = Symbol.for("privateer.sessionCodec");
++function serializeSessionEntry(entry) {
++    const codec = globalThis[PRIVATEER_SESSION_CODEC];
++    return codec ? codec.encode(entry) : JSON.stringify(entry);
++}
++function decodeSessionEntry(entry) {
++    if (entry && typeof entry === "object" && entry.pvs !== undefined) {
++        const codec = globalThis[PRIVATEER_SESSION_CODEC];
++        return codec ? codec.decode(entry) : null;
++    }
++    return entry;
++}
+ import { readdir, stat } from "fs/promises";
+ import { basename, join, resolve } from "path";
+ import { createInterface } from "readline";
+@@ -95,8 +111,9 @@ export function parseSessionEntries(content) {
+         if (!line.trim())
+             continue;
+         try {
+-            const entry = JSON.parse(line);
+-            entries.push(entry);
++            const entry = decodeSessionEntry(JSON.parse(line));
++            if (entry)
++                entries.push(entry);
+         }
+         catch {
+             // Skip malformed lines
+@@ -314,7 +331,7 @@ function parseSessionEntryLine(line) {
+     if (!line.trim())
+         return null;
+     try {
+-        return JSON.parse(line);
++        return decodeSessionEntry(JSON.parse(line));
+     }
+     catch {
+         // Skip malformed lines
+@@ -757,7 +774,7 @@ export class SessionManager {
+         const fd = openSync(this.sessionFile, "w");
+         try {
+             for (const entry of this.fileEntries) {
+-                writeFileSync(fd, `${JSON.stringify(entry)}\n`);
++                writeFileSync(fd, `${serializeSessionEntry(entry)}\n`);
+             }
+         }
+         finally {
+@@ -800,7 +817,7 @@ export class SessionManager {
+             const fd = openSync(this.sessionFile, "wx");
+             try {
+                 for (const e of this.fileEntries) {
+-                    writeFileSync(fd, `${JSON.stringify(e)}\n`);
++                    writeFileSync(fd, `${serializeSessionEntry(e)}\n`);
+                 }
+             }
+             finally {
+@@ -809,7 +826,7 @@ export class SessionManager {
+             this.flushed = true;
+         }
+         else {
+-            appendFileSync(this.sessionFile, `${JSON.stringify(entry)}\n`);
++            appendFileSync(this.sessionFile, `${serializeSessionEntry(entry)}\n`);
+         }
+     }
+     _appendEntry(entry) {
+@@ -1403,11 +1420,11 @@ export class SessionManager {
+             cwd: resolvedTargetCwd,
+             parentSession: resolvedSourcePath,
+         };
+-        writeFileSync(newSessionFile, `${JSON.stringify(newHeader)}\n`, { flag: "wx" });
++        writeFileSync(newSessionFile, `${serializeSessionEntry(newHeader)}\n`, { flag: "wx" });
+         // Copy all non-header entries from source
+         for (const entry of sourceEntries) {
+             if (entry.type !== "session") {
+-                appendFileSync(newSessionFile, `${JSON.stringify(entry)}\n`);
++                appendFileSync(newSessionFile, `${serializeSessionEntry(entry)}\n`);
+             }
+         }
+         return new SessionManager(resolvedTargetCwd, dir, newSessionFile, true);
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/settings-manager.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/settings-manager.js
 index d5ce9cd..a456908 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/settings-manager.js

package/src/cli/chat.ts

@@ -16,6 +16,7 @@ import { privacyDisabled } from "../config/privacyDisabled.ts"; // no Pi deps
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 import { createUIContext } from "../ext/headlessUi.ts"; // no Pi deps → safe pre-boot
 import { canOpenBrowser, openInBrowser } from "../util/openBrowser.ts"; // node:child_process only → safe pre-boot
+import { transcriptSnapshot, type SnapshotEntry } from "../remote/transcriptSnapshot.ts"; // no deps → safe pre-boot
 
 // This lean REPL has no Pi TUI (and so no Theme), so it detects the terminal background
 // itself (COLORFGBG) and picks a palette — on a light terminal the standard "\x1b[33m"
@@ -181,7 +182,12 @@ async function main() {
     // the driver learns which folder they're driving without the OS username
     // crossing the relay.
     onControllerAttached: () => {
-      relay?.sendSnapshot([]);
+      // The session's transcript, so an app back from sleep catches up (transcriptSnapshot.ts).
+      {
+        let entries: SnapshotEntry[] = [];
+        try { entries = transcriptSnapshot(session?.sessionManager?.getBranch?.() ?? []); } catch { /* no session yet */ }
+        relay?.sendSnapshot(entries, { full: entries.length > 0, running: turnActive });
+      }
       relay?.sendContext({ model: currentSpec, cwd, version: agentVersion() });
       relay?.sendCommands(availableCommands());
     },