privateer-agent 0.15.4 → 0.15.6

package/dist-boot/ext-privateer-privacy.mjs

@@ -0,0 +1,4578 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  SecureClient
+} from "./c-FJ5T42DS.mjs";
+import "./c-L26VOJX4.mjs";
+import "./c-C67644MB.mjs";
+import "./c-65UZIZC7.mjs";
+import "./c-U4ITOXAN.mjs";
+import {
+  require_undici
+} from "./c-P63T3XL2.mjs";
+import {
+  x25519
+} from "./c-4WVR32AP.mjs";
+import {
+  __name,
+  __toESM
+} from "./c-CN77DCGF.mjs";
+
+// src/auth/privateer.ts?ext=privateer-privacy
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync4, chmodSync as chmodSync4, rmSync as rmSync3 } from "node:fs";
+import { hostname, userInfo } from "node:os";
+
+// src/config/paths.ts?ext=privateer-privacy
+import { homedir } from "node:os";
+import { join } from "node:path";
+function globalDir() {
+  return process.env.PRIVATEER_HOME ?? join(homedir(), ".privateer");
+}
+__name(globalDir, "globalDir");
+function agentDir() {
+  return join(globalDir(), "agent");
+}
+__name(agentDir, "agentDir");
+function credentialsPath() {
+  return join(globalDir(), "credentials.json");
+}
+__name(credentialsPath, "credentialsPath");
+function configPath() {
+  return join(globalDir(), "config.json");
+}
+__name(configPath, "configPath");
+function accountSessionsDir() {
+  return join(globalDir(), "account-sessions");
+}
+__name(accountSessionsDir, "accountSessionsDir");
+function accountSessionsPath() {
+  return join(globalDir(), "account-sessions.json");
+}
+__name(accountSessionsPath, "accountSessionsPath");
+
+// src/auth/accountSessions.ts?ext=privateer-privacy
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, renameSync, writeFileSync, chmodSync } from "node:fs";
+import { join as join2 } from "node:path";
+var ENTRY = /^(\d+)\.json$/;
+var CLAIM = /^(\d+)\.claim-(\d+)$/;
+function entryPath(pid) {
+  return join2(accountSessionsDir(), `${pid}.json`);
+}
+__name(entryPath, "entryPath");
+function claimPath(pid, claimant = process.pid) {
+  return join2(accountSessionsDir(), `${pid}.claim-${claimant}`);
+}
+__name(claimPath, "claimPath");
+function tryChmod(path, mode) {
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
+}
+__name(tryChmod, "tryChmod");
+function tryRm(path) {
+  try {
+    rmSync(path, { force: true });
+  } catch {
+  }
+}
+__name(tryRm, "tryRm");
+function readEntry(path, pid) {
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof raw?.refresh !== "string" || !raw.refresh) return null;
+    return { pid, refresh: raw.refresh, expires: typeof raw.expires === "number" ? raw.expires : 0 };
+  } catch {
+    return null;
+  }
+}
+__name(readEntry, "readEntry");
+function isAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+__name(isAlive, "isAlive");
+function recordOwnedSession(cred) {
+  try {
+    mkdirSync(accountSessionsDir(), { recursive: true });
+    tryChmod(globalDir(), 448);
+    tryChmod(accountSessionsDir(), 448);
+    const path = entryPath(process.pid);
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ refresh: cred.refresh, expires: cred.expires }) + "\n", {
+      encoding: "utf8",
+      mode: 384
+    });
+    tryChmod(tmp, 384);
+    renameSync(tmp, path);
+  } catch {
+  }
+}
+__name(recordOwnedSession, "recordOwnedSession");
+function orphanedSessions(now = Date.now()) {
+  let names;
+  try {
+    names = readdirSync(accountSessionsDir());
+  } catch {
+    return [];
+  }
+  const orphans = [];
+  for (const name of names) {
+    const path = join2(accountSessionsDir(), name);
+    const claim = CLAIM.exec(name);
+    if (claim) {
+      if (!isAlive(Number(claim[2]))) tryRm(path);
+      continue;
+    }
+    const m = ENTRY.exec(name);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    if (pid === process.pid || isAlive(pid)) continue;
+    const entry = readEntry(path, pid);
+    if (!entry || entry.expires > 0 && entry.expires <= now) {
+      tryRm(path);
+      continue;
+    }
+    orphans.push(entry);
+  }
+  return orphans;
+}
+__name(orphanedSessions, "orphanedSessions");
+function claimOrphan(pid) {
+  try {
+    renameSync(entryPath(pid), claimPath(pid));
+    return true;
+  } catch {
+    return false;
+  }
+}
+__name(claimOrphan, "claimOrphan");
+function releaseOrphan(pid) {
+  try {
+    renameSync(claimPath(pid), entryPath(pid));
+  } catch {
+    tryRm(claimPath(pid));
+  }
+}
+__name(releaseOrphan, "releaseOrphan");
+function dropOwnedSession(pid) {
+  tryRm(claimPath(pid));
+  if (pid !== process.pid) tryRm(entryPath(pid));
+}
+__name(dropOwnedSession, "dropOwnedSession");
+function clearOwnedSessions() {
+  tryRm(accountSessionsPath());
+  try {
+    if (existsSync(accountSessionsDir())) rmSync(accountSessionsDir(), { recursive: true, force: true });
+  } catch {
+  }
+}
+__name(clearOwnedSessions, "clearOwnedSessions");
+
+// src/engine/errors.ts?ext=privateer-privacy
+var CAP_CODE = /CAP|QUOTA|LIMIT_REACHED|INSUFFICIENT|TOP_?UP/i;
+function isAccountCapCode(code) {
+  return typeof code === "string" && CAP_CODE.test(code);
+}
+__name(isAccountCapCode, "isAccountCapCode");
+
+// src/crypto/terminalKey.ts?ext=privateer-privacy
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, chmodSync as chmodSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+function keyPath() {
+  return join3(globalDir(), "terminal-key.json");
+}
+__name(keyPath, "keyPath");
+var cached;
+function b64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+__name(b64, "b64");
+function fromB64(s, label) {
+  const buf = Buffer.from(s, "base64");
+  if (buf.length !== 32) throw new Error(`${label} must be 32 bytes`);
+  return new Uint8Array(buf);
+}
+__name(fromB64, "fromB64");
+function loadOrCreate() {
+  if (cached) return cached;
+  try {
+    const parsed = JSON.parse(readFileSync2(keyPath(), "utf8"));
+    if (parsed?.v === 1 && parsed.publicKey && parsed.secretKey) {
+      cached = {
+        publicKey: fromB64(parsed.publicKey, "terminal public key"),
+        secretKey: fromB64(parsed.secretKey, "terminal secret key")
+      };
+      return cached;
+    }
+  } catch {
+  }
+  const secretKey = x25519.utils.randomPrivateKey();
+  const publicKey = x25519.getPublicKey(secretKey);
+  const file = { v: 1, publicKey: b64(publicKey), secretKey: b64(secretKey) };
+  mkdirSync2(globalDir(), { recursive: true, mode: 448 });
+  writeFileSync2(keyPath(), JSON.stringify(file), { mode: 384 });
+  try {
+    chmodSync2(keyPath(), 384);
+  } catch {
+  }
+  cached = { publicKey, secretKey };
+  return cached;
+}
+__name(loadOrCreate, "loadOrCreate");
+function terminalPublicKeyBase64() {
+  return b64(loadOrCreate().publicKey);
+}
+__name(terminalPublicKeyBase64, "terminalPublicKeyBase64");
+
+// src/crypto/accountTrust.ts?ext=privateer-privacy
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, chmodSync as chmodSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+function trustPath() {
+  return join4(globalDir(), "account-trust.json");
+}
+__name(trustPath, "trustPath");
+function pinAccountSignKey(pub) {
+  const value = (pub ?? "").trim();
+  if (!value) return;
+  try {
+    const file = { v: 1, accountSignPub: value };
+    writeFileSync3(trustPath(), JSON.stringify(file), { mode: 384 });
+    try {
+      chmodSync3(trustPath(), 384);
+    } catch {
+    }
+  } catch {
+  }
+}
+__name(pinAccountSignKey, "pinAccountSignKey");
+function clearAccountSignKey() {
+  try {
+    rmSync2(trustPath(), { force: true });
+  } catch {
+  }
+}
+__name(clearAccountSignKey, "clearAccountSignKey");
+
+// src/auth/privateer.ts?ext=privateer-privacy
+var DEFAULT_SERVER_URL = "https://helix-server-m1ac.onrender.com";
+function isSafeServerUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "https:") return true;
+  if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "::1")) {
+    return true;
+  }
+  return false;
+}
+__name(isSafeServerUrl, "isSafeServerUrl");
+function serverBaseUrl() {
+  const env = process.env.PRIVATEER_SERVER_URL?.replace(/\/$/, "");
+  if (env) {
+    if (!isSafeServerUrl(env)) {
+      throw new Error(
+        `Refusing PRIVATEER_SERVER_URL=${env}: must be https:// (http allowed only for localhost). This protects your account token from being sent over an insecure or attacker-controlled connection.`
+      );
+    }
+    return env;
+  }
+  const base = (loadCredentials()?.serverBaseUrl || DEFAULT_SERVER_URL).replace(/\/$/, "");
+  if (!isSafeServerUrl(base)) {
+    throw new Error(`Stored Privateer server URL is not https (${base}). Run /logout then /login again.`);
+  }
+  return base;
+}
+__name(serverBaseUrl, "serverBaseUrl");
+function defaultDeviceLabel() {
+  try {
+    return `${userInfo().username}@${hostname()}`;
+  } catch {
+    return "terminal";
+  }
+}
+__name(defaultDeviceLabel, "defaultDeviceLabel");
+var SHARED = /* @__PURE__ */ Symbol.for("privateer.auth.shared");
+function shared() {
+  const g = globalThis;
+  return g[SHARED] ??= { cache: null, signedIn: /* @__PURE__ */ new Set(), expired: /* @__PURE__ */ new Set() };
+}
+__name(shared, "shared");
+var _child = null;
+var _spawnInFlight = null;
+var _refreshInFlight = null;
+var _account = null;
+function loadCredentials() {
+  const state = shared();
+  if (state.cache) return state.cache;
+  const path = credentialsPath();
+  if (!existsSync2(path)) return null;
+  try {
+    state.cache = JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return null;
+  }
+  return state.cache;
+}
+__name(loadCredentials, "loadCredentials");
+function saveCredentials(creds) {
+  const dir = globalDir();
+  mkdirSync3(dir, { recursive: true });
+  tryChmod2(dir, 448);
+  const path = credentialsPath();
+  writeFileSync4(path, JSON.stringify(creds, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  tryChmod2(path, 384);
+  shared().cache = creds;
+}
+__name(saveCredentials, "saveCredentials");
+var ARMED_SLOT = /* @__PURE__ */ Symbol.for("privateer.accountCredential");
+function forgetArmedAccountCredential() {
+  const slot = globalThis[ARMED_SLOT];
+  if (slot) slot.cred = void 0;
+}
+__name(forgetArmedAccountCredential, "forgetArmedAccountCredential");
+function clearCredentials() {
+  try {
+    rmSync3(credentialsPath(), { force: true });
+  } catch {
+  }
+  clearAccountSignKey();
+  shared().cache = null;
+  _child = null;
+  _account = null;
+  forgetArmedAccountCredential();
+}
+__name(clearCredentials, "clearCredentials");
+function hasCredentials() {
+  return loadCredentials() !== null;
+}
+__name(hasCredentials, "hasCredentials");
+function currentUser() {
+  return loadCredentials()?.user ?? null;
+}
+__name(currentUser, "currentUser");
+function tryChmod2(path, mode) {
+  try {
+    chmodSync4(path, mode);
+  } catch {
+  }
+}
+__name(tryChmod2, "tryChmod");
+function notifySessionExpired() {
+  for (const listener of shared().expired) {
+    try {
+      listener();
+    } catch {
+    }
+  }
+}
+__name(notifySessionExpired, "notifySessionExpired");
+function notifySignedIn() {
+  for (const listener of shared().signedIn) {
+    try {
+      listener();
+    } catch {
+    }
+  }
+}
+__name(notifySignedIn, "notifySignedIn");
+async function postJson(base, path, body, init = {}) {
+  return fetch(`${base}${path}`, {
+    ...init,
+    method: "POST",
+    headers: { "Content-Type": "application/json", ...init.headers || {} },
+    body: JSON.stringify(body)
+  });
+}
+__name(postJson, "postJson");
+async function requestDeviceCode(deviceLabel = defaultDeviceLabel()) {
+  const base = serverBaseUrl();
+  let terminalPub;
+  try {
+    terminalPub = terminalPublicKeyBase64();
+  } catch {
+  }
+  const res = await postJson(base, "/auth/device/code", { deviceLabel, terminalPub });
+  if (!res.ok) {
+    throw new Error(`Couldn't start login (${res.status}). Check your connection or PRIVATEER_SERVER_URL.`);
+  }
+  return await res.json();
+}
+__name(requestDeviceCode, "requestDeviceCode");
+async function pollForToken(code, opts = {}) {
+  const base = serverBaseUrl();
+  let interval = Math.max(1, code.interval || 5) * 1e3;
+  const deadline = Date.now() + (code.expires_in || 600) * 1e3;
+  while (Date.now() < deadline) {
+    if (opts.signal?.aborted) throw new Error("Login cancelled.");
+    await sleep(interval, opts.signal);
+    const res = await postJson(base, "/auth/device/token", { device_code: code.device_code });
+    if (res.ok) {
+      const data = await res.json();
+      const creds = { accessToken: data.accessToken, refreshToken: data.refreshToken, user: data.user, serverBaseUrl: base };
+      saveCredentials(creds);
+      pinAccountSignKey(data.accountSignPub);
+      notifySignedIn();
+      return creds;
+    }
+    let err = "";
+    try {
+      err = (await res.json()).error || "";
+    } catch {
+    }
+    if (err === "authorization_pending") {
+      opts.onPoll?.("pending");
+    } else if (err === "slow_down") {
+      interval += 2e3;
+      opts.onPoll?.("slow_down");
+    } else if (err === "access_denied") {
+      throw new Error("Login was denied in the app.");
+    } else if (err === "expired_token") {
+      throw new Error("This login code expired. Run /login again.");
+    } else {
+      throw new Error(`Login failed (${res.status}${err ? `: ${err}` : ""}).`);
+    }
+  }
+  throw new Error("This login code expired. Run /login again.");
+}
+__name(pollForToken, "pollForToken");
+async function runDeviceLogin(opts) {
+  const code = await requestDeviceCode(opts.deviceLabel);
+  opts.onCode(code);
+  const creds = await pollForToken(code, { onPoll: opts.onPoll, signal: opts.signal });
+  return creds.user;
+}
+__name(runDeviceLogin, "runDeviceLogin");
+async function spawnFailure(res) {
+  if (res.status === 401) {
+    if (hasCredentials()) {
+      clearCredentials();
+      notifySessionExpired();
+    }
+    return new Error("Your Privateer session expired. Run /login to sign in again.");
+  }
+  let message;
+  try {
+    message = (await res.json()).message;
+  } catch {
+  }
+  return new Error(message?.trim() || `Couldn't start a Privateer session (HTTP ${res.status}).`);
+}
+__name(spawnFailure, "spawnFailure");
+async function spawnChildSession() {
+  const parent = loadCredentials();
+  if (!parent) throw new Error("Not logged in to Privateer. Run /login.");
+  const res = await postJson(serverBaseUrl(), "/auth/session/spawn", {
+    refreshToken: parent.refreshToken,
+    deviceLabel: defaultDeviceLabel()
+  }, {
+    headers: { Authorization: `Bearer ${parent.accessToken}` }
+  });
+  if (!res.ok) throw await spawnFailure(res);
+  const { accessToken, refreshToken } = await res.json();
+  _child = { accessToken, refreshToken };
+  return _child;
+}
+__name(spawnChildSession, "spawnChildSession");
+function ensureChildSession() {
+  if (_child) return Promise.resolve(_child);
+  if (!_spawnInFlight) {
+    _spawnInFlight = spawnChildSession().finally(() => {
+      _spawnInFlight = null;
+    });
+  }
+  return _spawnInFlight;
+}
+__name(ensureChildSession, "ensureChildSession");
+function refreshChildSession() {
+  if (_refreshInFlight) return _refreshInFlight;
+  _refreshInFlight = (async () => {
+    if (_child) {
+      const res = await postJson(serverBaseUrl(), "/auth/refresh", { refreshToken: _child.refreshToken });
+      if (res.ok) {
+        const { accessToken, refreshToken } = await res.json();
+        _child = { accessToken, refreshToken };
+        return _child;
+      }
+    }
+    _child = null;
+    return spawnChildSession();
+  })().finally(() => {
+    _refreshInFlight = null;
+  });
+  return _refreshInFlight;
+}
+__name(refreshChildSession, "refreshChildSession");
+async function authedFetch(input, init = {}) {
+  const bodyBuf = init.body;
+  const withAuth = /* @__PURE__ */ __name((token) => {
+    const headers = new Headers(init.headers);
+    headers.set("Authorization", `Bearer ${token}`);
+    return { ...init, headers };
+  }, "withAuth");
+  let child = await ensureChildSession();
+  let res = await fetch(input, withAuth(child.accessToken));
+  if (res.status === 401) {
+    child = await refreshChildSession();
+    res = await fetch(input, { ...withAuth(child.accessToken), body: bodyBuf });
+  }
+  return await defuseRetryableCap(res);
+}
+__name(authedFetch, "authedFetch");
+async function defuseRetryableCap(res) {
+  if (res.status !== 429) return res;
+  const body = await res.text();
+  let code;
+  try {
+    const parsed = JSON.parse(body);
+    code = parsed.code ?? parsed.error?.code;
+  } catch {
+  }
+  const status = isAccountCapCode(typeof code === "string" ? code : void 0) ? 402 : 429;
+  return new Response(body, { status, statusText: res.statusText, headers: res.headers });
+}
+__name(defuseRetryableCap, "defuseRetryableCap");
+async function deleteSession(accessToken, timeoutMs) {
+  try {
+    await fetch(`${serverBaseUrl()}/auth/session/current`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch {
+  }
+}
+__name(deleteSession, "deleteSession");
+async function logout() {
+  const parent = loadCredentials();
+  if (parent) {
+    try {
+      const fresh = await rotateSession(parent.refreshToken);
+      await deleteSession(fresh.access, 5e3);
+    } catch {
+    }
+  }
+  _child = null;
+  _account = null;
+  clearOwnedSessions();
+  clearCredentials();
+}
+__name(logout, "logout");
+function jwtExpMs(token, fallbackMs = 5 * 6e4) {
+  try {
+    const seg = token.split(".")[1];
+    const payload = JSON.parse(Buffer.from(seg, "base64").toString("utf8"));
+    if (typeof payload.exp === "number") return payload.exp * 1e3 - 3e4;
+  } catch {
+  }
+  return Date.now() + fallbackMs;
+}
+__name(jwtExpMs, "jwtExpMs");
+async function spawnAccountCredentials() {
+  const parent = loadCredentials();
+  if (!parent) throw new Error("Not logged in to Privateer. Run /login.");
+  const res = await postJson(
+    serverBaseUrl(),
+    "/auth/session/spawn",
+    { refreshToken: parent.refreshToken, deviceLabel: defaultDeviceLabel() },
+    { headers: { Authorization: `Bearer ${parent.accessToken}` } }
+  );
+  if (!res.ok) throw await spawnFailure(res);
+  const { accessToken, refreshToken } = await res.json();
+  _account = { accessToken };
+  const cred = { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
+  recordOwnedSession(cred);
+  return cred;
+}
+__name(spawnAccountCredentials, "spawnAccountCredentials");
+function isRefreshRejection(e) {
+  return e instanceof Error && typeof e.status === "number";
+}
+__name(isRefreshRejection, "isRefreshRejection");
+async function rotateSession(refresh) {
+  const res = await postJson(serverBaseUrl(), "/auth/refresh", { refreshToken: refresh });
+  if (!res.ok) {
+    const err = new Error(`account refresh failed (${res.status})`);
+    err.status = res.status;
+    throw err;
+  }
+  const { accessToken, refreshToken } = await res.json();
+  return { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
+}
+__name(rotateSession, "rotateSession");
+async function refreshAccountCredentials(refresh) {
+  const cred = await rotateSession(refresh);
+  _account = { accessToken: cred.access };
+  recordOwnedSession(cred);
+  return cred;
+}
+__name(refreshAccountCredentials, "refreshAccountCredentials");
+async function acquireAccountCredential() {
+  const orphans = orphanedSessions();
+  let adopted = null;
+  let attempted = 0;
+  while (attempted < orphans.length && !adopted) {
+    const orphan = orphans[attempted++];
+    if (!claimOrphan(orphan.pid)) continue;
+    try {
+      adopted = await refreshAccountCredentials(orphan.refresh);
+      dropOwnedSession(orphan.pid);
+    } catch (e) {
+      if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+      else releaseOrphan(orphan.pid);
+    }
+  }
+  const leftovers = orphans.slice(attempted);
+  if (leftovers.length) void revokeOrphanedSessions(leftovers);
+  return adopted ?? await spawnAccountCredentials();
+}
+__name(acquireAccountCredential, "acquireAccountCredential");
+async function revokeOrphanedSessions(orphans, timeoutMs = 1500) {
+  for (const orphan of orphans) {
+    if (!claimOrphan(orphan.pid)) continue;
+    try {
+      const cred = await rotateSession(orphan.refresh);
+      await deleteSession(cred.access, timeoutMs);
+      dropOwnedSession(orphan.pid);
+    } catch (e) {
+      if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+      else releaseOrphan(orphan.pid);
+    }
+  }
+}
+__name(revokeOrphanedSessions, "revokeOrphanedSessions");
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    const t = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new Error("Login cancelled."));
+      },
+      { once: true }
+    );
+  });
+}
+__name(sleep, "sleep");
+
+// src/providers/account.ts?ext=privateer-privacy
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join7 } from "node:path";
+
+// src/util/openBrowser.ts?ext=privateer-privacy
+import { spawn } from "node:child_process";
+function canOpenBrowser(env = process.env, platform = process.platform) {
+  if (env.PRIVATEER_NO_BROWSER?.trim()) return false;
+  if (env.SSH_TTY || env.SSH_CONNECTION) return false;
+  if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return false;
+  return true;
+}
+__name(canOpenBrowser, "canOpenBrowser");
+function browsableUrl(raw) {
+  const s = (raw ?? "").trim();
+  if (!s) return void 0;
+  try {
+    const u = new URL(s);
+    if (u.protocol !== "https:" && u.protocol !== "http:") return void 0;
+    return u.href;
+  } catch {
+    return void 0;
+  }
+}
+__name(browsableUrl, "browsableUrl");
+function openInBrowser(rawUrl) {
+  const url = browsableUrl(rawUrl);
+  if (!url) return Promise.resolve(false);
+  let cmd;
+  let args;
+  if (process.platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    cmd = "cmd";
+    args = ["/c", "start", "", url.replace(/&/g, "^&")];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = /* @__PURE__ */ __name((ok) => {
+      if (!settled) {
+        settled = true;
+        resolve(ok);
+      }
+    }, "done");
+    try {
+      const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+      child.once("error", () => done(false));
+      child.once("exit", (code) => done(code === 0));
+      child.unref();
+      setTimeout(() => done(true), 2e3).unref?.();
+    } catch {
+      done(false);
+    }
+  });
+}
+__name(openInBrowser, "openInBrowser");
+
+// node_modules/pi-privacy/src/posture/tiers.ts?ext=privateer-privacy
+var TIERS = {
+  "tee-verified": {
+    tier: "tee-verified",
+    label: "Verified TEE",
+    verifiability: "cryptographic",
+    posture: "green",
+    blurb: "Confidential-enclave inference, cryptographically verified: remote attestation proved genuine TEE hardware and the live TLS key matched the attestation report."
+  },
+  "tee-unverified": {
+    tier: "tee-unverified",
+    label: "TEE (unconfirmed)",
+    verifiability: "none",
+    posture: "yellow",
+    blurb: "Provider claims a TEE, but attestation was incomplete or the live key could not be matched here \u2014 treat as unverified until it goes green."
+  },
+  local: {
+    tier: "local",
+    label: "On-device",
+    verifiability: "observable",
+    posture: "green",
+    blurb: "Runs against a loopback endpoint \u2014 inference is local; no prompt leaves the machine."
+  },
+  "zdr-enforced": {
+    tier: "zdr-enforced",
+    label: "ZDR (enforced)",
+    verifiability: "observable",
+    posture: "green",
+    blurb: "Routing is constrained to providers that contractually don't retain data \u2014 verified observable: OpenRouter refuses to serve when the policy can't be met. Enforcement of a policy, not hardware attestation."
+  },
+  "zdr-policy": {
+    tier: "zdr-policy",
+    label: "ZDR (by policy)",
+    verifiability: "policy",
+    posture: "yellow",
+    blurb: "The provider states it doesn't retain data, but this is a policy promise we can't verify \u2014 not hardware, not attested."
+  },
+  standard: {
+    tier: "standard",
+    label: "Standard",
+    verifiability: "none",
+    posture: "neutral",
+    blurb: "No special privacy guarantee."
+  }
+};
+var ORDER = [
+  "tee-verified",
+  "local",
+  "zdr-enforced",
+  "tee-unverified",
+  "zdr-policy",
+  "standard"
+];
+function tierRank(t) {
+  const i = ORDER.indexOf(t);
+  return i === -1 ? ORDER.length : i;
+}
+__name(tierRank, "tierRank");
+function tierFromTeePosture(p) {
+  return p === "green" ? "tee-verified" : p === "yellow" ? "tee-unverified" : "standard";
+}
+__name(tierFromTeePosture, "tierFromTeePosture");
+
+// node_modules/pi-privacy/src/providers/catalog.ts?ext=privateer-privacy
+var PRIVACY_PROVIDERS = [
+  {
+    id: "privateer",
+    label: "Privateer",
+    // Posture-aware, exactly like OpenRouter — tee-verified is the CEILING, not a
+    // promise. Privateer's in-app ACCOUNT channel offers verified-TEE inference, but
+    // pi-privacy only exercises the PUBLIC developer-key channel (sk-priv-…), which is
+    // server-proxied: the proxy mediates attestation, so a pi client can't verify the
+    // enclave itself. The public key therefore floors to zdr-policy at runtime (see
+    // effectiveTier) — verified TEE is never claimed from it alone. NOT `attestable`
+    // here: pi-privacy does not attest Privateer itself. The account channel (its own
+    // OAuth session + account server + sealed relay) lives in the host (privateer-agent),
+    // which reuses this package's interpretReport/teePosture and injects the verified
+    // verdict through the extension's resolveTier hook; the picker's `verifiedTee` signal
+    // reflects that the host channel is active (see PiPrivacyOptions.privateerVerifiedTee).
+    tier: "tee-verified",
+    // ceiling; resolves to zdr-policy on the public developer key
+    postureAware: true,
+    baseUrl: "https://api.privateer.pro/v1",
+    api: "openai-completions",
+    keyEnv: "${PRIVATEER_API_KEY}",
+    note: "privateer.pro \u2192 API keys (sk-priv-\u2026). Public developer key is server-proxied, zero-retention by policy (NOT TEE-attested here); verified TEE is the in-app account channel."
+  },
+  {
+    id: "tinfoil",
+    label: "Tinfoil (private TEE inference)",
+    tier: "tee-verified",
+    attestable: true,
+    baseUrl: "https://inference.tinfoil.sh/v1",
+    api: "openai-completions",
+    keyEnv: "${TINFOIL_API_KEY}",
+    note: "tinfoil.sh \u2192 dashboard \u2192 API Keys. Confidential-enclave inference; verified by attestation + live-TLS-key match."
+  },
+  {
+    id: "nearai",
+    label: "NEAR AI (private TEE inference)",
+    tier: "tee-verified",
+    attestable: true,
+    baseUrl: "https://cloud-api.near.ai/v1",
+    api: "openai-completions",
+    keyEnv: "${NEARAI_API_KEY}",
+    note: "cloud.near.ai \u2192 API Keys. Confidential-compute TEE; attestation carried in the report body (verified over HTTPS)."
+  },
+  {
+    id: "venice",
+    label: "Venice (no-retention inference)",
+    tier: "zdr-policy",
+    baseUrl: "https://api.venice.ai/api/v1",
+    api: "openai-completions",
+    keyEnv: "${VENICE_API_KEY}",
+    // Honest copy: policy, not hardware. Venice injects a body param to disable its
+    // system prompt — handled by a before_provider_request hook, not config.
+    note: 'venice.ai \u2192 API Keys (no retention by policy, not TEE-attested; "anonymized" models proxy upstream).',
+    compat: { veniceDisableSystemPrompt: true }
+  },
+  {
+    id: "fireworks",
+    label: "Fireworks (no-retention inference)",
+    tier: "zdr-policy",
+    baseUrl: "https://api.fireworks.ai/inference/v1",
+    api: "openai-completions",
+    keyEnv: "${FIREWORKS_API_KEY}",
+    // Honest copy: ZDR is the default for OPEN models only; Fireworks's own f1 /
+    // FireFunction may log. Not TEE-attested.
+    note: "fireworks.ai \u2192 API Keys (open models: zero retention by default, not TEE-attested; Fireworks's own f1/FireFunction may log)."
+  },
+  {
+    id: "openrouter",
+    label: "OpenRouter",
+    tier: "zdr-enforced",
+    // ceiling; posture-aware — see postureAware
+    postureAware: true,
+    baseUrl: "https://openrouter.ai/api/v1",
+    api: "openai-completions",
+    keyEnv: "${OPENROUTER_API_KEY}",
+    // Honest copy: ZDR is per-model/account. Yellow (zdr-policy) until enforcement
+    // pins requests to zero-retention endpoints, then green (zdr-enforced).
+    note: "openrouter.ai/keys. ZDR is per-model; not guaranteed until ZDR routing is enforced (then requests only hit zero-retention endpoints).",
+    compat: { openRouterRouting: { zdr: true } }
+  },
+  {
+    id: "ollama",
+    label: "Ollama (local)",
+    tier: "local",
+    local: true,
+    baseUrl: "http://localhost:11434/v1",
+    // OpenAI-compat surface, not native /api
+    api: "openai-completions",
+    note: "runs locally \u2014 no key needed. Inference on-device; nothing leaves the machine."
+  },
+  {
+    id: "custom",
+    label: "Custom (OpenAI-compatible)",
+    tier: "standard",
+    // resolved to `local` at runtime when the baseUrl is loopback
+    api: "openai-completions",
+    note: "any OpenAI-compatible endpoint \u2014 LM Studio, vLLM, llama.cpp, a proxy. Detected as on-device when the URL is loopback."
+  }
+];
+var PROVIDER_BY_ID = Object.fromEntries(
+  PRIVACY_PROVIDERS.map((p) => [p.id, p])
+);
+function isLocalEndpoint(baseUrl) {
+  if (!baseUrl) return false;
+  let host;
+  try {
+    host = new URL(baseUrl).hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+  const zone = host.indexOf("%");
+  if (zone !== -1) host = host.slice(0, zone);
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host === "::1" || host === "::") return true;
+  let v4 = host;
+  if (host.startsWith("::ffff:")) {
+    const rest = host.slice(7);
+    if (rest.includes(".")) v4 = rest;
+    else {
+      const groups = rest.split(":");
+      if (groups.length !== 2) return false;
+      const hi = Number.parseInt(groups[0], 16);
+      const lo = Number.parseInt(groups[1], 16);
+      if (!Number.isInteger(hi) || !Number.isInteger(lo) || hi > 65535 || lo > 65535) return false;
+      v4 = `${hi >>> 8}.${hi & 255}.${lo >>> 8}.${lo & 255}`;
+    }
+  }
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(v4);
+  if (!m) return false;
+  const octets = m.slice(1).map(Number);
+  if (octets.some((n) => n > 255)) return false;
+  return octets[0] === 127 || v4 === "0.0.0.0";
+}
+__name(isLocalEndpoint, "isLocalEndpoint");
+
+// node_modules/pi-privacy/src/attest/attestation.ts?ext=privateer-privacy
+import { randomBytes, createHash, X509Certificate } from "node:crypto";
+import { request as httpsRequest } from "node:https";
+import { gunzipSync } from "node:zlib";
+var TIMEOUT_MS = 12e3;
+var NEARAI_BASE_URL = "https://cloud-api.near.ai/v1";
+var TINFOIL_BASE_URL = "https://inference.tinfoil.sh/v1";
+function baseFor(cfg) {
+  return (cfg.baseURL ?? NEARAI_BASE_URL).replace(/\/+$/, "");
+}
+__name(baseFor, "baseFor");
+function randomNonce() {
+  return randomBytes(32).toString("hex");
+}
+__name(randomNonce, "randomNonce");
+function deepFindString(obj, keys) {
+  const want = new Set(keys.map((k) => k.toLowerCase()));
+  const stack = [obj];
+  while (stack.length) {
+    const cur = stack.pop();
+    if (Array.isArray(cur)) {
+      stack.push(...cur);
+    } else if (cur && typeof cur === "object") {
+      for (const [k, v] of Object.entries(cur)) {
+        if (typeof v === "string" && want.has(k.toLowerCase()) && v.trim()) return v.trim();
+        if (v && typeof v === "object") stack.push(v);
+      }
+    }
+  }
+  return void 0;
+}
+__name(deepFindString, "deepFindString");
+async function fetchAttestation(cfg, modelId) {
+  if (!cfg.apiKey) throw new Error("no API key");
+  const nonce = randomNonce();
+  const url = `${baseFor(cfg)}/attestation/report?model=${encodeURIComponent(modelId)}&signing_algo=ecdsa&nonce=${nonce}`;
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), TIMEOUT_MS);
+  let raw;
+  try {
+    const res = await fetch(url, {
+      headers: { authorization: `Bearer ${cfg.apiKey}` },
+      signal: ac.signal
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      const hint = body.slice(0, 200).trim();
+      throw new Error(`HTTP ${res.status} ${res.statusText}${hint ? ` \u2014 ${hint}` : ""}`);
+    }
+    raw = await res.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`timed out after ${TIMEOUT_MS / 1e3}s`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+  return interpretReport(modelId, nonce, raw);
+}
+__name(fetchAttestation, "fetchAttestation");
+function interpretReport(modelId, nonce, raw) {
+  const signingAddress = deepFindString(raw, ["signing_address", "signingAddress", "address"]);
+  const blob = JSON.stringify(raw).toLowerCase();
+  const hardware = [];
+  if (/nvidia|gpu/.test(blob)) hardware.push("NVIDIA");
+  if (/intel|tdx/.test(blob)) hardware.push("Intel TDX");
+  const nonceEchoed = nonce.length >= 16 && blob.includes(nonce.toLowerCase());
+  return { model: modelId, nonce, signingAddress, nonceEchoed, hardware, raw };
+}
+__name(interpretReport, "interpretReport");
+function teePosture(att) {
+  if (!att.signingAddress && att.hardware.length === 0) return "red";
+  if (att.signingAddress && att.hardware.length > 0 && att.nonceEchoed) return "green";
+  return "yellow";
+}
+__name(teePosture, "teePosture");
+var httpsTransport = /* @__PURE__ */ __name((host) => new Promise((resolve, reject) => {
+  const url = new URL(`https://${host}/.well-known/tinfoil-attestation`);
+  const req = httpsRequest(
+    {
+      hostname: url.hostname,
+      port: url.port ? Number(url.port) : 443,
+      path: url.pathname,
+      method: "GET",
+      timeout: TIMEOUT_MS,
+      // Force a fresh connection + full TLS handshake every time. A pooled/
+      // resumed TLS session skips re-sending the server cert, so
+      // getPeerCertificate() returns {} on the abbreviated handshake and the
+      // key binding silently fails (posture flips green→yellow on re-verify).
+      // Attestation must observe a real handshake anyway, so no session reuse.
+      agent: false
+    },
+    (res) => {
+      let liveTlsKeyFp;
+      try {
+        const peer = res.socket.getPeerCertificate(true);
+        if (peer?.raw) {
+          const spki = new X509Certificate(peer.raw).publicKey.export({ type: "spki", format: "der" });
+          liveTlsKeyFp = createHash("sha256").update(spki).digest("hex");
+        }
+      } catch {
+      }
+      let body = "";
+      res.on("data", (chunk) => body += chunk);
+      res.on("end", () => {
+        if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {
+          const hint = body.slice(0, 200).trim();
+          reject(new Error(`HTTP ${res.statusCode} ${res.statusMessage ?? ""}${hint ? ` \u2014 ${hint}` : ""}`));
+          return;
+        }
+        try {
+          resolve({ doc: JSON.parse(body), liveTlsKeyFp });
+        } catch {
+          reject(new Error("attestation endpoint returned non-JSON"));
+        }
+      });
+      res.on("error", reject);
+    }
+  );
+  req.on("timeout", () => req.destroy(new Error(`timed out after ${TIMEOUT_MS / 1e3}s`)));
+  req.on("error", reject);
+  req.end();
+}), "httpsTransport");
+async function fetchTinfoilAttestation(cfg, transport = httpsTransport) {
+  const host = new URL(cfg.baseURL ?? TINFOIL_BASE_URL).host;
+  const { doc, liveTlsKeyFp } = await transport(host);
+  return interpretTinfoilDoc(host, doc, liveTlsKeyFp);
+}
+__name(fetchTinfoilAttestation, "fetchTinfoilAttestation");
+function interpretTinfoilDoc(host, doc, liveTlsKeyFp) {
+  const d = doc ?? {};
+  const format = typeof d.format === "string" ? d.format : "";
+  const fmt = format.toLowerCase();
+  const hardware = [];
+  if (/sev|snp/.test(fmt)) hardware.push("AMD SEV-SNP");
+  if (/tdx/.test(fmt)) hardware.push("Intel TDX");
+  if (/nitro/.test(fmt)) hardware.push("AWS Nitro");
+  let report;
+  if (typeof d.body === "string" && d.body) {
+    try {
+      let bytes = Buffer.from(d.body, "base64");
+      if (bytes[0] === 31 && bytes[1] === 139) bytes = gunzipSync(bytes);
+      report = bytes;
+    } catch {
+    }
+  }
+  const attestedTlsKeyFp = /sev-snp-guest/.test(fmt) && report && report.length >= 144 ? report.subarray(80, 112).toString("hex") : void 0;
+  const tlsKeyMatched = !!liveTlsKeyFp && !!report && (attestedTlsKeyFp === liveTlsKeyFp || report.includes(Buffer.from(liveTlsKeyFp, "hex")));
+  return { host, format, hardware, attestedTlsKeyFp, liveTlsKeyFp, tlsKeyMatched, raw: doc };
+}
+__name(interpretTinfoilDoc, "interpretTinfoilDoc");
+function tinfoilTeePosture(att) {
+  if (att.hardware.length === 0 && !att.attestedTlsKeyFp) return "red";
+  if (att.hardware.length > 0 && att.tlsKeyMatched) return "green";
+  return "yellow";
+}
+__name(tinfoilTeePosture, "tinfoilTeePosture");
+
+// node_modules/pi-privacy/src/attest/dispatcher.ts?ext=privateer-privacy
+var import_undici = __toESM(require_undici());
+import crypto2 from "node:crypto";
+var captured = /* @__PURE__ */ new Map();
+var installed = false;
+function installAttestationDispatcher() {
+  if (installed) return;
+  installed = true;
+  const baseConnect = (0, import_undici.buildConnector)({});
+  const attestingConnector = /* @__PURE__ */ __name((opts, cb) => baseConnect(opts, (err, socket) => {
+    const host = opts.hostname;
+    if (!err && socket && host && !captured.has(host) && typeof socket.getPeerCertificate === "function") {
+      try {
+        const cert = socket.getPeerCertificate(true);
+        if (cert && cert.raw) {
+          const spkiDer = new crypto2.X509Certificate(cert.raw).publicKey.export({
+            type: "spki",
+            format: "der"
+          });
+          captured.set(host, {
+            subject: cert.subject?.CN ?? JSON.stringify(cert.subject),
+            issuer: cert.issuer?.O ?? cert.issuer?.CN ?? JSON.stringify(cert.issuer),
+            spkiSha256: crypto2.createHash("sha256").update(spkiDer).digest("hex"),
+            fingerprint256: cert.fingerprint256
+          });
+        }
+      } catch (e) {
+        captured.set(host, { error: String(e) });
+      }
+    }
+    cb(err, socket);
+  }), "attestingConnector");
+  (0, import_undici.setGlobalDispatcher)(new import_undici.Agent({ connect: attestingConnector, connectTimeout: 8e3 }));
+}
+__name(installAttestationDispatcher, "installAttestationDispatcher");
+function getCapturedCert(host) {
+  return captured.get(host);
+}
+__name(getCapturedCert, "getCapturedCert");
+var dispatcherTransport = /* @__PURE__ */ __name(async (host) => {
+  const res = await fetch(`https://${host}/.well-known/tinfoil-attestation`);
+  if (!res.ok) {
+    const hint = (await res.text().catch(() => "")).slice(0, 200).trim();
+    throw new Error(`HTTP ${res.status} ${res.statusText}${hint ? ` \u2014 ${hint}` : ""}`);
+  }
+  const doc = await res.json();
+  const cert = getCapturedCert(host);
+  return { doc, liveTlsKeyFp: cert && !cert.error ? cert.spkiSha256 : void 0 };
+}, "dispatcherTransport");
+
+// node_modules/pi-privacy/src/posture/effective.ts?ext=privateer-privacy
+function effectiveTier(providerId, opts = {}) {
+  const p = PROVIDER_BY_ID[providerId];
+  if (!p) return "standard";
+  if (p.local || isLocalEndpoint(opts.baseUrl)) return "local";
+  if (p.postureAware && p.id === "openrouter") {
+    return opts.zdrEnforced ? "zdr-enforced" : "zdr-policy";
+  }
+  if (p.postureAware && p.id === "privateer") {
+    return opts.verifiedTee ? "tee-verified" : "zdr-policy";
+  }
+  return p.tier;
+}
+__name(effectiveTier, "effectiveTier");
+
+// node_modules/pi-privacy/src/posture/picker.ts?ext=privateer-privacy
+function capabilityTier(providerId, baseUrl, opts = {}) {
+  if (isLocalEndpoint(baseUrl)) return "local";
+  return effectiveTier(providerId ?? "", {
+    baseUrl,
+    zdrEnforced: opts.zdrEnforced,
+    verifiedTee: opts.verifiedTee
+  });
+}
+__name(capabilityTier, "capabilityTier");
+function capabilityBadge(tier, attestable) {
+  switch (tier) {
+    case "tee-verified":
+      return attestable ? { glyph: "\u25C6", label: "Verifiable TEE" } : { glyph: "\u{1F6E1}", label: "Verified TEE" };
+    case "local":
+      return { glyph: "\u{1F6E1}", label: "On-device" };
+    case "zdr-enforced":
+      return { glyph: "\u{1F6E1}", label: "ZDR (enforced)" };
+    case "tee-unverified":
+      return { glyph: "\u26A0", label: "TEE (unconfirmed)" };
+    case "zdr-policy":
+      return { glyph: "\u26A0", label: "ZDR (by policy)" };
+    default:
+      return { glyph: "\u2022", label: "Standard" };
+  }
+}
+__name(capabilityBadge, "capabilityBadge");
+function pickerEntry(model, opts = {}) {
+  const provider = model.provider;
+  const verifiedTee = typeof opts.verifiedTee === "function" ? !!opts.verifiedTee(model) : !!opts.verifiedTee;
+  const attestable = provider === "privateer" ? verifiedTee : !!(provider && PROVIDER_BY_ID[provider]?.attestable);
+  const tier = capabilityTier(provider, model.baseUrl, { zdrEnforced: opts.zdrEnforced, verifiedTee });
+  const { glyph, label } = capabilityBadge(tier, attestable);
+  return { model, capabilityTier: tier, rank: tierRank(tier), glyph, label, attestable };
+}
+__name(pickerEntry, "pickerEntry");
+function rankModels(models, opts = {}) {
+  return models.map((m) => pickerEntry(m, opts)).sort(
+    (a, b) => a.rank - b.rank || (a.model.provider ?? "").localeCompare(b.model.provider ?? "") || (a.model.id ?? "").localeCompare(b.model.id ?? "")
+  );
+}
+__name(rankModels, "rankModels");
+function pickerOptionLabel(e, current = false) {
+  const who = `${e.model.provider ?? "?"}/${e.model.id ?? "?"}`;
+  return `${e.glyph} ${e.label}  \xB7  ${who}${current ? "  (current)" : ""}`;
+}
+__name(pickerOptionLabel, "pickerOptionLabel");
+
+// node_modules/pi-privacy/src/pii/detect.ts?ext=privateer-privacy
+var PLACEHOLDER = {
+  email: "\xABemail\xBB",
+  phone: "\xABphone\xBB",
+  ssn: "\xABssn\xBB",
+  "credit-card": "\xABcard\xBB",
+  ip: "\xABip\xBB",
+  iban: "\xABiban\xBB",
+  mac: "\xABmac\xBB",
+  "aws-key": "\xABaws-key\xBB",
+  "gh-token": "\xABtoken\xBB",
+  "api-key": "\xABapi-key\xBB",
+  jwt: "\xABjwt\xBB",
+  "private-key": "\xABprivate-key\xBB"
+};
+var SECRET_TYPES = /* @__PURE__ */ new Set([
+  "aws-key",
+  "gh-token",
+  "api-key",
+  "jwt",
+  "private-key"
+]);
+var PATTERNS = [
+  { type: "email", re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, validate: mailboxShaped },
+  { type: "ssn", re: /\b\d{3}-\d{2}-\d{4}\b/g },
+  // ── secrets (prefix-anchored, high precision) ──────────────────────────────
+  // PEM private-key block — match the whole block so redaction removes the key body.
+  { type: "private-key", re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g },
+  // AWS access key id (AKIA / ASIA + 16 upper-alnum).
+  { type: "aws-key", re: /\bA(?:KIA|SIA)[0-9A-Z]{16}\b/g },
+  // GitHub tokens: ghp_/gho_/ghu_/ghs_/ghr_ + 36+ base62.
+  { type: "gh-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  // JWT: three base64url segments. `eyJ` is base64 of `{"` — a strong header marker.
+  { type: "jwt", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  // OpenAI/Anthropic/Privateer & generic `sk-` secret keys.
+  { type: "api-key", re: /\bsk-[A-Za-z0-9_-]{16,}\b/g },
+  // Slack tokens (bot/user/app/refresh/legacy).
+  { type: "api-key", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+  // Google API key.
+  { type: "api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  // Stripe live secret / restricted keys.
+  { type: "api-key", re: /\b[sr]k_live_[0-9A-Za-z]{20,}\b/g },
+  // ── consumer PII ───────────────────────────────────────────────────────────
+  // 13–19 digit runs (optionally space/dash grouped) that pass the Luhn check — this
+  // sharply cuts false positives vs "any long number".
+  { type: "credit-card", re: /\b(?:\d[ -]?){13,19}\b/g, validate: cardShaped },
+  // IPv4 with each octet 0–255. The lookarounds keep it out of longer dotted runs —
+  // `1.2.3.4.5` (an OID), `v1.2.3.4` (a version) — see the precision note above.
+  { type: "ip", re: /(?<![\w.])(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)(?!\.?\d)/g },
+  // IBAN: 2-letter country + 2 check digits + 11–30 alphanumerics, mod-97 validated
+  // (cuts false positives on random alphanumeric runs sharply).
+  { type: "iban", re: /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/g, validate: ibanValid },
+  // MAC address (colon or dash separated). A MAC is exactly six octets, so a run that
+  // CONTINUES on either side is a hex dump or a certificate fingerprint, not an address.
+  { type: "mac", re: /(?<![0-9A-Fa-f][:-])(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}(?![:-][0-9A-Fa-f]{2})\b/g },
+  // North-American / international-ish phone. Deliberately last + conservative to
+  // avoid eating IDs; requires a plausible separator or leading +.
+  { type: "phone", re: /(?<![\d.])(?:\+\d{1,3}[\s.-]?)?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}\b/g }
+];
+var NOT_A_TLD = /* @__PURE__ */ new Set([
+  "png",
+  "jpg",
+  "jpeg",
+  "gif",
+  "webp",
+  "svg",
+  "ico",
+  "bmp",
+  "tif",
+  "tiff",
+  "avif",
+  "mp3",
+  "mp4",
+  "wav",
+  "avi",
+  "mkv",
+  "webm",
+  "ogg",
+  "flac",
+  "pdf",
+  "docx",
+  "xlsx",
+  "pptx",
+  "csv",
+  "json",
+  "yaml",
+  "yml",
+  "toml",
+  "xml",
+  "html",
+  "htm",
+  "css",
+  "scss",
+  "sass",
+  "less",
+  "tsx",
+  "jsx",
+  "mjs",
+  "cjs",
+  "java",
+  "php",
+  "sql",
+  "txt",
+  "log",
+  "lock",
+  "exe",
+  "dll",
+  "dmg",
+  "iso",
+  "tar",
+  "gz",
+  "tgz",
+  "bz2",
+  "rar",
+  "woff",
+  "woff2",
+  "ttf",
+  "otf",
+  "eot",
+  "bak",
+  "tmp",
+  "swp",
+  "map",
+  "min",
+  "snap",
+  "patch",
+  "diff"
+]);
+var VERSION_DOMAIN = /^\d+(?:\.\d+)+(?:-[A-Za-z0-9.]+)?$/;
+function mailboxShaped(value) {
+  const domain = value.slice(value.lastIndexOf("@") + 1).toLowerCase();
+  if (VERSION_DOMAIN.test(domain)) return false;
+  const tld = domain.slice(domain.lastIndexOf(".") + 1);
+  return !NOT_A_TLD.has(tld);
+}
+__name(mailboxShaped, "mailboxShaped");
+var CARD_LENGTHS = /* @__PURE__ */ new Set([13, 14, 15, 16, 19]);
+function cardShaped(s) {
+  const digits = s.replace(/\D/g, "");
+  if (!CARD_LENGTHS.has(digits.length)) return false;
+  const iin = digits.charCodeAt(0) - 48;
+  if (iin < 2 || iin > 6) return false;
+  return luhn(s);
+}
+__name(cardShaped, "cardShaped");
+function luhn(s) {
+  const digits = s.replace(/\D/g, "");
+  if (digits.length < 13 || digits.length > 19) return false;
+  let sum = 0;
+  let alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (alt) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+__name(luhn, "luhn");
+function ibanValid(s) {
+  const iban = s.toUpperCase();
+  if (iban.length < 15 || iban.length > 34) return false;
+  const rearranged = iban.slice(4) + iban.slice(0, 4);
+  let remainder = 0;
+  for (const ch of rearranged) {
+    const code = ch >= "A" && ch <= "Z" ? (ch.charCodeAt(0) - 55).toString() : ch;
+    for (const d of code) remainder = (remainder * 10 + (d.charCodeAt(0) - 48)) % 97;
+  }
+  return remainder === 1;
+}
+__name(ibanValid, "ibanValid");
+function maskPii(type, value) {
+  switch (type) {
+    case "email": {
+      const at = value.lastIndexOf("@");
+      const local = value.slice(0, at);
+      const domain = value.slice(at);
+      const head = local.length > 2 ? `${local[0]}\u2026${local[local.length - 1]}` : "\u2026";
+      return `${head}${domain}`;
+    }
+    case "ip":
+      return value.replace(/\.\d{1,3}$/, ".\u2022");
+    case "mac":
+      return `${value.slice(0, 8)}:\u2022\u2022:\u2022\u2022:\u2022\u2022`;
+    case "private-key":
+      return "-----BEGIN PRIVATE KEY----- block";
+    case "aws-key":
+    case "gh-token":
+    case "api-key":
+    case "jwt":
+      return `${value.slice(0, 6)}\u2026 (${value.length} chars)`;
+    default:
+      return void 0;
+  }
+}
+__name(maskPii, "maskPii");
+function scanPii(text, opts = {}) {
+  if (!text) return { hits: [], suppressed: [], samples: [] };
+  const { allow, samples: sampleCap = 4 } = opts;
+  const counts = /* @__PURE__ */ new Map();
+  const skipped = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Map();
+  for (const { type, re, validate } of PATTERNS) {
+    for (const m of text.matchAll(re)) {
+      if (validate && !validate(m[0])) continue;
+      if (allow?.(type, m[0])) {
+        skipped.set(type, (skipped.get(type) ?? 0) + 1);
+        continue;
+      }
+      counts.set(type, (counts.get(type) ?? 0) + 1);
+      if (sampleCap > 0) {
+        const masked = maskPii(type, m[0]);
+        if (masked) {
+          const set = seen.get(type) ?? /* @__PURE__ */ new Set();
+          if (set.size < sampleCap) set.add(masked);
+          seen.set(type, set);
+        }
+      }
+    }
+  }
+  const toHits = /* @__PURE__ */ __name((m) => [...m.entries()].map(([type, count]) => ({ type, count })), "toHits");
+  return {
+    hits: toHits(counts),
+    suppressed: toHits(skipped),
+    samples: [...seen.entries()].flatMap(([type, set]) => [...set].map((masked) => ({ type, masked })))
+  };
+}
+__name(scanPii, "scanPii");
+function detectPii(text, opts = {}) {
+  return scanPii(text, { ...opts, samples: 0 }).hits;
+}
+__name(detectPii, "detectPii");
+function hasSecrets(hits) {
+  return hits.some((h) => SECRET_TYPES.has(h.type));
+}
+__name(hasSecrets, "hasSecrets");
+function secretHits(hits) {
+  return hits.filter((h) => SECRET_TYPES.has(h.type));
+}
+__name(secretHits, "secretHits");
+function redactPii(text, only, allow) {
+  let out = text;
+  for (const { type, re, validate } of PATTERNS) {
+    if (only && !only.has(type)) continue;
+    out = out.replace(re, (m) => {
+      if (validate && !validate(m)) return m;
+      if (allow?.(type, m)) return m;
+      return PLACEHOLDER[type];
+    });
+  }
+  return out;
+}
+__name(redactPii, "redactPii");
+function summarizePii(hits) {
+  const label = {
+    email: ["email", "emails"],
+    phone: ["phone number", "phone numbers"],
+    ssn: ["SSN", "SSNs"],
+    "credit-card": ["card number", "card numbers"],
+    ip: ["IP address", "IP addresses"],
+    iban: ["IBAN", "IBANs"],
+    mac: ["MAC address", "MAC addresses"],
+    "aws-key": ["AWS key", "AWS keys"],
+    "gh-token": ["GitHub token", "GitHub tokens"],
+    "api-key": ["API key", "API keys"],
+    jwt: ["JWT", "JWTs"],
+    "private-key": ["private key", "private keys"]
+  };
+  return hits.map((h) => `${h.count} ${label[h.type][h.count === 1 ? 0 : 1]}`).join(", ");
+}
+__name(summarizePii, "summarizePii");
+function piiDetail(scan) {
+  const lines = [];
+  for (const hit of scan.hits) {
+    const shown = scan.samples.filter((s) => s.type === hit.type).map((s) => s.masked);
+    const more = hit.count - shown.length;
+    const tail = shown.length ? `: ${shown.join(", ")}${more > 0 ? `, +${more} more` : ""}` : " (masked \u2014 not shown)";
+    lines.push(`  \u2022 ${summarizePii([hit])}${tail}`);
+  }
+  if (scan.suppressed.length) {
+    lines.push(`  \u2022 allowlisted (not counted): ${summarizePii(scan.suppressed)}`);
+  }
+  lines.push("  Values are masked here; the full values are in what would be sent.");
+  return lines.join("\n");
+}
+__name(piiDetail, "piiDetail");
+function piiInline(scan) {
+  return scan.hits.map((h) => {
+    const shown = scan.samples.filter((s) => s.type === h.type).map((s) => s.masked);
+    const more = h.count - shown.length;
+    const tail = shown.length ? ` (${shown.join(", ")}${more > 0 ? `, +${more} more` : ""})` : "";
+    return `${summarizePii([h])}${tail}`;
+  }).join(", ");
+}
+__name(piiInline, "piiInline");
+function newPii(hits, baseline) {
+  const out = [];
+  for (const h of hits) {
+    const seen = baseline.get(h.type) ?? 0;
+    if (h.count > seen) out.push({ type: h.type, count: h.count - seen });
+  }
+  return out;
+}
+__name(newPii, "newPii");
+function mergePiiBaseline(baseline, hits) {
+  const out = new Map(baseline);
+  for (const h of hits) out.set(h.type, Math.max(out.get(h.type) ?? 0, h.count));
+  return out;
+}
+__name(mergePiiBaseline, "mergePiiBaseline");
+
+// node_modules/pi-privacy/src/posture/downgrade.ts?ext=privateer-privacy
+var EXPOSURE = {
+  "tee-verified": 0,
+  // provider cannot read the payload
+  local: 0,
+  // payload never leaves the machine
+  "zdr-enforced": 1,
+  // provider reads it; retention observably refused
+  "zdr-policy": 2,
+  // provider reads it; retention refused by promise only
+  "tee-unverified": 2,
+  // enclave claimed, unproven — assume it reads it
+  standard: 3
+  // read and retained at the provider's discretion
+};
+function exposureLevel(tier) {
+  return EXPOSURE[tier] ?? 3;
+}
+__name(exposureLevel, "exposureLevel");
+function assessDowngrade(from, to, hits = []) {
+  const a = from ?? "standard";
+  const b = to ?? "standard";
+  return {
+    downgrade: from !== void 0 && to !== void 0 && exposureLevel(b) > exposureLevel(a),
+    from: a,
+    to: b,
+    severity: hits.length === 0 ? "none" : hasSecrets(hits) ? "secret" : "pii"
+  };
+}
+__name(assessDowngrade, "assessDowngrade");
+function downgradeWarning(a, hits, modelLabel) {
+  const target = modelLabel ? ` to ${modelLabel}` : "";
+  const carried = hits.length ? `carrying ${summarizePii(hits)}` : "already in context";
+  return `\u26A0 Privacy downgrade: ${TIERS[a.from].label} \u2192 ${TIERS[a.to].label}. This session's history \u2014 ${carried} \u2014 will be re-sent${target} on the next turn. Detection is best-effort structured PII/secrets, so treat it as a floor, not a full inventory.`;
+}
+__name(downgradeWarning, "downgradeWarning");
+
+// node_modules/pi-privacy/src/posture/verify.ts?ext=privateer-privacy
+async function verifyModelPosture(providerId, modelId, opts = {}) {
+  const p = PROVIDER_BY_ID[providerId];
+  if (p?.id === "tinfoil") {
+    try {
+      const att = await fetchTinfoilAttestation(
+        { baseURL: opts.baseUrl },
+        opts.transport ?? httpsTransport
+      );
+      const tp = tinfoilTeePosture(att);
+      return { providerId, modelId, tier: tierFromTeePosture(tp), teePosture: tp, attestation: att };
+    } catch (e) {
+      return { providerId, modelId, tier: "tee-unverified", error: e.message };
+    }
+  }
+  if (p?.id === "nearai") {
+    try {
+      const att = await fetchAttestation({ apiKey: opts.apiKey, baseURL: opts.baseUrl }, modelId);
+      const tp = teePosture(att);
+      return { providerId, modelId, tier: tierFromTeePosture(tp), teePosture: tp, attestation: att };
+    } catch (e) {
+      return { providerId, modelId, tier: "tee-unverified", error: e.message };
+    }
+  }
+  return {
+    providerId,
+    modelId,
+    tier: effectiveTier(providerId, { baseUrl: opts.baseUrl, zdrEnforced: opts.zdrEnforced })
+  };
+}
+__name(verifyModelPosture, "verifyModelPosture");
+
+// node_modules/pi-privacy/src/ext/patches.ts?ext=privateer-privacy
+function asObject(payload) {
+  return payload && typeof payload === "object" ? { ...payload } : {};
+}
+__name(asObject, "asObject");
+function veniceRequestPatch(payload) {
+  const p = asObject(payload);
+  const vp = p.venice_parameters && typeof p.venice_parameters === "object" ? p.venice_parameters : {};
+  return { ...p, venice_parameters: { ...vp, include_venice_system_prompt: false } };
+}
+__name(veniceRequestPatch, "veniceRequestPatch");
+function openRouterZdrPatch(payload) {
+  const p = asObject(payload);
+  const provider = p.provider && typeof p.provider === "object" ? p.provider : {};
+  return { ...p, provider: { ...provider, zdr: true, data_collection: "deny" } };
+}
+__name(openRouterZdrPatch, "openRouterZdrPatch");
+
+// node_modules/pi-privacy/src/pii/allow.ts?ext=privateer-privacy
+var DEFAULT_ALLOW = [
+  // RFC 2606 example domains + RFC 6761 special-use TLDs, and their subdomains.
+  "@example.com",
+  "@example.org",
+  "@example.net",
+  "@example",
+  "@test",
+  "@invalid",
+  "@localhost",
+  "@local",
+  // Git/GitHub machine senders — the single biggest source of "N emails detected"
+  // in a repository, and by construction not a mailbox anyone reads.
+  "@users.noreply.github.com",
+  "noreply@*",
+  "no-reply@*",
+  "donotreply@*",
+  "do-not-reply@*",
+  // Loopback, unspecified, broadcast, link-local. NOTE private LAN ranges
+  // (10/8, 172.16/12, 192.168/16) are deliberately NOT here: they identify a real
+  // host on a real network, which is exactly the thing the gate is for.
+  "127.0.0.0/8",
+  "0.0.0.0",
+  "255.255.255.255",
+  "169.254.0.0/16"
+];
+var IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+function ipToInt(ip) {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return void 0;
+  return (parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
+}
+__name(ipToInt, "ipToInt");
+function globToRe(pattern) {
+  const body = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${body}$`, "i");
+}
+__name(globToRe, "globToRe");
+function parseRule(raw) {
+  const entry = raw.trim();
+  if (!entry) return void 0;
+  if (/^\*+$/.test(entry)) return void 0;
+  const cidr = /^(\d{1,3}(?:\.\d{1,3}){3})\/(\d{1,2})$/.exec(entry);
+  if (cidr) {
+    const net = ipToInt(cidr[1]);
+    const len = Number(cidr[2]);
+    if (net === void 0 || len > 32) return void 0;
+    const mask = len === 0 ? 0 : 4294967295 << 32 - len >>> 0;
+    return { kind: "cidr", net: (net & mask) >>> 0, mask };
+  }
+  if (entry.startsWith("@")) {
+    const domain = entry.slice(1).toLowerCase();
+    return domain ? { kind: "domain", domain } : void 0;
+  }
+  if (!entry.includes("@") && entry.includes(".") && !entry.includes("*") && !IPV4.test(entry)) {
+    return { kind: "domain", domain: entry.toLowerCase() };
+  }
+  return { kind: "glob", re: globToRe(entry) };
+}
+__name(parseRule, "parseRule");
+function ruleMatches(rule, type, value) {
+  switch (rule.kind) {
+    case "domain": {
+      if (type !== "email") return false;
+      const at = value.lastIndexOf("@");
+      if (at < 0) return false;
+      const domain = value.slice(at + 1).toLowerCase();
+      return domain === rule.domain || domain.endsWith(`.${rule.domain}`);
+    }
+    case "cidr": {
+      if (type !== "ip") return false;
+      const n = ipToInt(value);
+      return n !== void 0 && (n & rule.mask) >>> 0 === rule.net;
+    }
+    case "glob":
+      return rule.re.test(value);
+  }
+}
+__name(ruleMatches, "ruleMatches");
+function compileAllow(entries = [], opts = {}) {
+  const { defaults = true, warn } = opts;
+  const rules = [];
+  for (const raw of [...defaults ? DEFAULT_ALLOW : [], ...entries]) {
+    const rule = parseRule(raw);
+    if (rule) rules.push(rule);
+    else warn?.(`piiAllow entry ${JSON.stringify(raw)} is not a usable pattern \u2014 ignoring it.`);
+  }
+  return (type, value) => rules.some((r) => ruleMatches(r, type, value));
+}
+__name(compileAllow, "compileAllow");
+
+// node_modules/pi-privacy/src/pii/command.ts?ext=privateer-privacy
+var PII_COMMAND_WORDS = ["off", "warn", "redact", "on", "status"];
+var SYNONYMS = {
+  off: { kind: "set", mode: "off" },
+  bypass: { kind: "set", mode: "off" },
+  disable: { kind: "set", mode: "off" },
+  warn: { kind: "set", mode: "warn" },
+  ask: { kind: "set", mode: "warn" },
+  prompt: { kind: "set", mode: "warn" },
+  redact: { kind: "set", mode: "redact" },
+  mask: { kind: "set", mode: "redact" },
+  on: { kind: "restore" },
+  restore: { kind: "restore" },
+  reset: { kind: "restore" },
+  default: { kind: "restore" },
+  status: { kind: "status" },
+  show: { kind: "status" }
+};
+function parsePiiCommand(args) {
+  const word = (typeof args === "string" ? args : "").trim().split(/\s+/)[0]?.toLowerCase() ?? "";
+  if (!word) return { kind: "status" };
+  return SYNONYMS[word] ?? { kind: "unknown", word };
+}
+__name(parsePiiCommand, "parsePiiCommand");
+var MODE_BLURB = {
+  warn: "you are asked before PII goes down an unverified channel",
+  redact: "PII is masked before send, without asking",
+  off: "outbound requests are not gated on PII at all"
+};
+function stillOn(s) {
+  const on = [];
+  if (s.toolExfilPolicy !== "off") on.push("credentials leaving via a tool call");
+  if (s.toolResultPolicy !== "off") on.push("credentials arriving in a tool result");
+  if (s.downgradePolicy !== "off") on.push("a model downgrade carrying credentials");
+  return on;
+}
+__name(stillOn, "stillOn");
+function statusLine(s) {
+  const effective = s.session ?? s.configured;
+  const source = s.session ? `set by /${s.commandName} this session` : "configured";
+  return `PII gate: ${effective} (${source}) \u2014 ${MODE_BLURB[effective]}. Configured: ${s.configured}. Tool exfil: ${s.toolExfilPolicy}. Tool result: ${s.toolResultPolicy}. Downgrade: ${s.downgradePolicy}.`;
+}
+__name(statusLine, "statusLine");
+var usage = /* @__PURE__ */ __name((name) => `Usage: /${name} ${PII_COMMAND_WORDS.join(" | ")}.`, "usage");
+function runPiiCommand(args, s) {
+  const action = parsePiiCommand(args);
+  const before = s.session ?? s.configured;
+  if (action.kind === "status")
+    return { session: s.session, changed: false, message: `${statusLine(s)} ${usage(s.commandName)}`, level: "info" };
+  if (action.kind === "unknown")
+    return {
+      session: s.session,
+      changed: false,
+      // Say what is still in force, so a mistyped bypass can't be mistaken for a
+      // successful one: the user who typed `/pii of` must not walk away believing
+      // the gate is down.
+      message: `"${action.word}" is not a /${s.commandName} setting \u2014 nothing changed. ${statusLine(s)} ${usage(s.commandName)}`,
+      level: "warning"
+    };
+  if (action.kind === "restore") {
+    if (s.configured === "off")
+      return {
+        session: void 0,
+        changed: before !== "off",
+        message: `Your configured PII policy is "off", so there is nothing to restore \u2014 the gate stays off. Use /${s.commandName} warn or /${s.commandName} redact to turn it on for this session.`,
+        level: "warning"
+      };
+    return {
+      session: void 0,
+      changed: before !== s.configured,
+      message: `PII gate restored to your configured policy: ${s.configured} \u2014 ${MODE_BLURB[s.configured]}.`,
+      level: "info"
+    };
+  }
+  const changed = before !== action.mode;
+  if (action.mode === "off") {
+    const on = stillOn(s);
+    const remains = on.length ? `Still on: ${on.join(", ")}.` : `Nothing else is gating this session \u2014 the tool, result and downgrade guards are all off too.`;
+    return {
+      session: "off",
+      changed,
+      message: `\u2691 PII gate OFF for this session. Outbound requests are no longer scanned-and-gated for PII, and a tool call carrying PII but no credential no longer prompts. ${remains} This lasts for this session only \u2014 /${s.commandName} on restores "${s.configured}", and so does a restart.`,
+      // A bypass is not routine output. It stays at warning level so it reads as the
+      // guard coming down, which is what it is.
+      level: "warning"
+    };
+  }
+  return {
+    session: action.mode,
+    changed,
+    message: `PII gate: ${action.mode} for this session \u2014 ${MODE_BLURB[action.mode]}.` + (action.mode === s.configured ? "" : ` (Configured: ${s.configured}.)`) + (changed ? " Earlier answers this session are cleared, so the gate re-asks about PII already in context." : ""),
+    level: "info"
+  };
+}
+__name(runPiiCommand, "runPiiCommand");
+
+// node_modules/pi-privacy/src/ext/toolgate.ts?ext=privateer-privacy
+var LOCAL_TOOLS = /* @__PURE__ */ new Set(["read", "grep", "find", "ls", "edit", "write"]);
+var EGRESS_CMD = /(?:^|[\s|&;(`$])(?:curl|wget|nc|ncat|netcat|scp|sftp|rsync|telnet|ftp|xh|httpie|kubectl|aws|gcloud|az)\b|>\s*\/dev\/tcp\/|\bgit\s+push\b|\bssh\s/i;
+var URL_RE = /\bhttps?:\/\/[^\s"'`)<>]+/gi;
+var TOK_START = `(?:^|[\\s"'\`=@<(|])`;
+var TOK_END = `(?=$|[\\s"'\`)>;,|&])`;
+var DIR = `(?:[\\w.~/-]*/)?`;
+var SENSITIVE_FILES = [
+  { label: ".env file", re: new RegExp(`${TOK_START}${DIR}\\.env(?:\\.[\\w-]+)?${TOK_END}`, "i") },
+  { label: "SSH key material", re: new RegExp(`${TOK_START}${DIR}\\.ssh(?:/[\\w.-]+)?${TOK_END}`, "i") },
+  // id_rsa but NOT id_rsa.pub — the trailing "." fails TOK_END, so the public half
+  // (which is not a secret) never fires the gate.
+  { label: "SSH private key", re: new RegExp(`${TOK_START}${DIR}id_(?:rsa|dsa|ecdsa|ed25519)${TOK_END}`, "i") },
+  { label: "AWS credentials", re: new RegExp(`${DIR}\\.aws/(?:credentials|config)${TOK_END}`, "i") },
+  { label: "kubeconfig", re: new RegExp(`${DIR}\\.kube/config${TOK_END}`, "i") },
+  {
+    label: "stored credentials",
+    re: new RegExp(`${TOK_START}${DIR}\\.(?:npmrc|netrc|pypirc|git-credentials|docker/config\\.json)${TOK_END}`, "i")
+  },
+  // Private-key / keystore files. Requires a literal dot before the extension, so
+  // header names like `x-api-key` don't match.
+  {
+    label: "key or certificate file",
+    re: new RegExp(`${TOK_START}${DIR}[\\w.-]+\\.(?:pem|key|p12|pfx|jks|keystore|kdbx)${TOK_END}`, "i")
+  },
+  {
+    label: "secrets file",
+    re: new RegExp(`${TOK_START}${DIR}(?:secrets?|credentials?)\\.(?:json|ya?ml|env|txt|toml|csv)${TOK_END}`, "i")
+  }
+];
+function sensitiveFileRefs(text) {
+  const out = [];
+  for (const { label, re } of SENSITIVE_FILES) {
+    if (re.test(text) && !out.includes(label)) out.push(label);
+  }
+  return out;
+}
+__name(sensitiveFileRefs, "sensitiveFileRefs");
+function safeStringify(input) {
+  if (typeof input === "string") return input;
+  try {
+    return JSON.stringify(input ?? "");
+  } catch {
+    return String(input ?? "");
+  }
+}
+__name(safeStringify, "safeStringify");
+function firstRemoteUrl(text) {
+  const urls = text.match(URL_RE);
+  if (!urls) return void 0;
+  return urls.find((u) => !isLocalEndpoint(u));
+}
+__name(firstRemoteUrl, "firstRemoteUrl");
+function splitCommands(cmd) {
+  return cmd.split(/\|\||&&|[;\n|]/).map((s) => s.trim()).filter(Boolean);
+}
+__name(splitCommands, "splitCommands");
+function assessToolCall(toolName, input) {
+  const name = toolName ?? "";
+  if (LOCAL_TOOLS.has(name)) return { egress: false };
+  const text = safeStringify(input);
+  const remote = firstRemoteUrl(text);
+  if (name === "bash") {
+    const cmd = typeof input?.command === "string" ? input.command : text;
+    let target;
+    let egress = false;
+    const files2 = [];
+    for (const seg of splitCommands(cmd)) {
+      const remote2 = firstRemoteUrl(seg);
+      const hasUrl = URL_RE.test(seg);
+      URL_RE.lastIndex = 0;
+      if (remote2 || !hasUrl && EGRESS_CMD.test(seg)) {
+        egress = true;
+        target ??= remote2;
+      }
+    }
+    if (egress) files2.push(...sensitiveFileRefs(cmd));
+    return { egress, target, sensitiveFiles: files2.length ? files2 : void 0 };
+  }
+  if (!remote) return { egress: false };
+  const files = sensitiveFileRefs(text);
+  return { egress: true, target: remote, sensitiveFiles: files.length ? files : void 0 };
+}
+__name(assessToolCall, "assessToolCall");
+
+// node_modules/pi-privacy/src/surface/tools.ts?ext=privateer-privacy
+var BUILTIN_TOOLS = /* @__PURE__ */ new Set([
+  "bash",
+  "read",
+  "write",
+  "edit",
+  "grep",
+  "find",
+  "ls"
+]);
+var SHELL_TOOLS = /* @__PURE__ */ new Set(["bash"]);
+var URL_PARAM = /^(?:url|uri|endpoint|host|hostname|origin|webhook|server|base_?url|address)$/i;
+var URL_IN_TEXT = /\bhttps?:\/\//i;
+function schemaNamesNetwork(schema, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  if (depth > 6 || schema === null || typeof schema !== "object") return false;
+  if (seen.has(schema)) return false;
+  seen.add(schema);
+  if (Array.isArray(schema)) return schema.some((s) => schemaNamesNetwork(s, depth + 1, seen));
+  const obj = schema;
+  const props = obj.properties;
+  if (props && typeof props === "object" && !Array.isArray(props)) {
+    for (const [key, val] of Object.entries(props)) {
+      if (URL_PARAM.test(key)) return true;
+      if (schemaNamesNetwork(val, depth + 1, seen)) return true;
+    }
+  }
+  for (const key of ["items", "additionalProperties", "oneOf", "anyOf", "allOf", "$defs"]) {
+    if (key in obj && schemaNamesNetwork(obj[key], depth + 1, seen)) return true;
+  }
+  return false;
+}
+__name(schemaNamesNetwork, "schemaNamesNetwork");
+function toolProvenance(info) {
+  const si = info.sourceInfo;
+  if (si?.scope === "project") return "project";
+  if (si?.scope === "temporary") return "temporary";
+  if (info.name && BUILTIN_TOOLS.has(info.name)) return "builtin";
+  if (si?.origin === "package") return "package";
+  if (si?.scope === "user") return "user";
+  return "unknown";
+}
+__name(toolProvenance, "toolProvenance");
+function toolReach(info, provenance) {
+  const name = info.name ?? "";
+  if (SHELL_TOOLS.has(name) && provenance === "builtin") return "shell";
+  if (LOCAL_TOOLS.has(name) && provenance === "builtin") return "local";
+  if (SHELL_TOOLS.has(name)) return "shell";
+  if (schemaNamesNetwork(info.parameters)) return "network";
+  if (URL_IN_TEXT.test(info.description ?? "") || URL_IN_TEXT.test(info.promptGuidelines ?? "")) return "network";
+  return "unknown";
+}
+__name(toolReach, "toolReach");
+var PROVENANCE_LABEL = {
+  builtin: "builtin",
+  user: "user",
+  package: "package",
+  project: "project",
+  temporary: "temporary",
+  unknown: "unattributed"
+};
+var REACH_LABEL = {
+  local: "local files only",
+  shell: "shell (unbounded)",
+  network: "network (declared)",
+  unknown: "unassessed"
+};
+function isRepoSupplied(p) {
+  return p === "project" || p === "temporary";
+}
+__name(isRepoSupplied, "isRepoSupplied");
+function classifyTool(info) {
+  const provenance = toolProvenance(info);
+  const reach = toolReach(info, provenance);
+  const name = info.name ?? "(unnamed)";
+  const flagged = isRepoSupplied(provenance) || provenance === "unknown";
+  return {
+    name,
+    provenance,
+    reach,
+    sourcePath: info.sourceInfo?.path,
+    glyph: flagged ? "\u26A0" : "\u2022",
+    provenanceLabel: PROVENANCE_LABEL[provenance],
+    reachLabel: REACH_LABEL[reach],
+    concern: concernFor(provenance, info.sourceInfo?.path)
+  };
+}
+__name(classifyTool, "classifyTool");
+function concernFor(p, path) {
+  const where = path ? ` (${path})` : "";
+  switch (p) {
+    case "project":
+      return `supplied by this project${where}, not by you \u2014 it arrived with the repository`;
+    case "temporary":
+      return `supplied by a CLI override for this run${where}, not by your configuration`;
+    case "unknown":
+      return "no source metadata \u2014 pi-privacy can't say where this came from";
+    default:
+      return void 0;
+  }
+}
+__name(concernFor, "concernFor");
+var PROVENANCE_ORDER = ["project", "temporary", "unknown", "package", "user", "builtin"];
+function rankSurface(tools) {
+  return tools.map(classifyTool).sort(
+    (a, b) => PROVENANCE_ORDER.indexOf(a.provenance) - PROVENANCE_ORDER.indexOf(b.provenance) || a.name.localeCompare(b.name)
+  );
+}
+__name(rankSurface, "rankSurface");
+function summarizeSurface(entries) {
+  const byProvenance = {
+    builtin: 0,
+    user: 0,
+    package: 0,
+    project: 0,
+    temporary: 0,
+    unknown: 0
+  };
+  for (const e of entries) byProvenance[e.provenance]++;
+  return {
+    total: entries.length,
+    notYours: byProvenance.project + byProvenance.temporary + byProvenance.unknown,
+    byProvenance
+  };
+}
+__name(summarizeSurface, "summarizeSurface");
+function surfaceLine(e) {
+  const where = e.sourcePath ? `  ${e.sourcePath}` : "";
+  return `${e.glyph} ${e.provenanceLabel.padEnd(9)} ${e.name.padEnd(14)}${where} \u2014 ${e.reachLabel}`;
+}
+__name(surfaceLine, "surfaceLine");
+function surfaceReport(entries, collapseBuiltins = true) {
+  const s = summarizeSurface(entries);
+  const head = `${s.total} tool${s.total === 1 ? "" : "s"} available \xB7 ` + (s.notYours === 0 ? "all supplied by you or pi" : `${s.notYours} not supplied by you`);
+  const shown = collapseBuiltins ? entries.filter((e) => e.provenance !== "builtin") : entries;
+  const lines = shown.map(surfaceLine);
+  if (collapseBuiltins && s.byProvenance.builtin > 0) lines.push(`  \u2026 ${s.byProvenance.builtin} builtin`);
+  return [head, ...lines];
+}
+__name(surfaceReport, "surfaceReport");
+
+// node_modules/pi-privacy/src/extension.ts?ext=privateer-privacy
+import { readFileSync as readFileSync5 } from "node:fs";
+
+// node_modules/pi-privacy/src/surface/ledger.ts?ext=privateer-privacy
+var UNNAMED_HOST = "(unnamed host)";
+function createLedger() {
+  return { entries: /* @__PURE__ */ new Map() };
+}
+__name(createLedger, "createLedger");
+function hostOf(assessment) {
+  const target = assessment.target;
+  if (!target) return UNNAMED_HOST;
+  try {
+    const h = new URL(target).hostname;
+    return h || UNNAMED_HOST;
+  } catch {
+    return UNNAMED_HOST;
+  }
+}
+__name(hostOf, "hostOf");
+function recordEgress(led, tool, assessment, opts = {}) {
+  if (!assessment.egress) return;
+  const host = hostOf(assessment);
+  const key = `${tool}\0${host}`;
+  const cur = led.entries.get(key) ?? { tool, host, calls: 0, withPii: 0, blocked: 0 };
+  cur.calls++;
+  if (opts.pii) cur.withPii++;
+  if (opts.blocked) cur.blocked++;
+  led.entries.set(key, cur);
+}
+__name(recordEgress, "recordEgress");
+function ledgerHosts(led) {
+  return [...led.entries.values()].sort(
+    (a, b) => b.calls - a.calls || a.tool.localeCompare(b.tool) || a.host.localeCompare(b.host)
+  );
+}
+__name(ledgerHosts, "ledgerHosts");
+function observationLine(o) {
+  const notes = [];
+  if (o.withPii) notes.push(`${o.withPii} carried PII/credentials`);
+  if (o.blocked) notes.push(`${o.blocked} blocked`);
+  const suffix = notes.length ? `  (${notes.join(", ")})` : "";
+  return `${o.tool} \u2192 ${o.host}   ${o.calls} call${o.calls === 1 ? "" : "s"}${suffix}`;
+}
+__name(observationLine, "observationLine");
+function ledgerReport(led) {
+  return ledgerHosts(led).map(observationLine);
+}
+__name(ledgerReport, "ledgerReport");
+
+// node_modules/pi-privacy/src/ext/results.ts?ext=privateer-privacy
+function toolResultText(content) {
+  if (content === void 0 || content === null) return "";
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    return content.map((p) => typeof p === "string" ? p : typeof p?.text === "string" ? p.text : "").join("\n");
+  }
+  try {
+    return JSON.stringify(content);
+  } catch {
+    return String(content);
+  }
+}
+__name(toolResultText, "toolResultText");
+function redactToolResultContent(content, only = SECRET_TYPES, allow) {
+  if (typeof content === "string") {
+    const out = redactPii(content, only, allow);
+    return out === content ? void 0 : out;
+  }
+  if (Array.isArray(content)) {
+    let changed = false;
+    const out = content.map((p) => {
+      if (typeof p === "string") {
+        const r = redactPii(p, only, allow);
+        if (r !== p) changed = true;
+        return r;
+      }
+      const text = p?.text;
+      if (typeof text === "string") {
+        const r = redactPii(text, only, allow);
+        if (r !== text) changed = true;
+        return { ...p, text: r };
+      }
+      return p;
+    });
+    return changed ? out : void 0;
+  }
+  return void 0;
+}
+__name(redactToolResultContent, "redactToolResultContent");
+
+// node_modules/pi-privacy/src/ext/badge.ts?ext=privateer-privacy
+var DEFAULT_BADGE_SINKS = ["status", "widget", "title"];
+function postureBadge(tier) {
+  if (!tier) return "\u22EF checking privacy";
+  const info = TIERS[tier];
+  const glyph = info.posture === "green" ? "\u{1F6E1}" : info.posture === "yellow" ? "\u26A0" : info.posture === "red" ? "\u26D4" : "\u2022";
+  return `${glyph} ${info.label}`;
+}
+__name(postureBadge, "postureBadge");
+function renderBadgeTo(ui, sink, key, badge, tier) {
+  switch (sink) {
+    case "status":
+      if (typeof ui.setStatus === "function") return ui.setStatus(key, badge), true;
+      return false;
+    case "widget":
+      if (typeof ui.setWidget === "function") return ui.setWidget(key, [badge]), true;
+      return false;
+    case "title":
+      if (typeof ui.setTitle === "function") return ui.setTitle(badge), true;
+      return false;
+    case "notify":
+      if (typeof ui.notify === "function")
+        return ui.notify(badge, TIERS[tier ?? "standard"].posture === "green" ? "info" : "warning"), true;
+      return false;
+    default:
+      return false;
+  }
+}
+__name(renderBadgeTo, "renderBadgeTo");
+
+// node_modules/pi-privacy/src/ext/register.ts?ext=privateer-privacy
+var BUILTIN = /* @__PURE__ */ new Set(["openrouter", "fireworks"]);
+var SEED_MODELS = {
+  tinfoil: "deepseek-v4-pro",
+  nearai: "zai-org/GLM-5.1-FP8",
+  venice: "qwen3-coder-480b-a35b-instruct-turbo",
+  ollama: "llama3.1",
+  privateer: "near/zai-org/GLM-5.1-FP8"
+};
+function registerable(p) {
+  return !!p.baseUrl && !BUILTIN.has(p.id) && p.id !== "custom";
+}
+__name(registerable, "registerable");
+function providerConfig(p) {
+  const seed = SEED_MODELS[p.id];
+  const models = seed ? [
+    {
+      id: seed,
+      name: seed,
+      reasoning: false,
+      input: ["text"],
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+      contextWindow: 128e3,
+      maxTokens: 4096
+    }
+  ] : [];
+  const cfg = { name: p.label, baseUrl: p.baseUrl, api: p.api, models };
+  if (p.keyEnv) {
+    cfg.apiKey = p.keyEnv;
+    cfg.authHeader = true;
+  } else if (p.local && models.length) {
+    cfg.apiKey = "local";
+  }
+  return cfg;
+}
+__name(providerConfig, "providerConfig");
+function nearApiKey(env = process.env) {
+  return env.NEARAI_API_KEY ?? env.NEAR_AI_API_KEY;
+}
+__name(nearApiKey, "nearApiKey");
+
+// node_modules/pi-privacy/src/ext/payload.ts?ext=privateer-privacy
+function payloadText(payload) {
+  try {
+    return JSON.stringify(payload?.messages ?? payload ?? "");
+  } catch {
+    return "";
+  }
+}
+__name(payloadText, "payloadText");
+function redactPayloadPii(payload, allow) {
+  if (!payload || typeof payload !== "object" || !Array.isArray(payload.messages)) return payload;
+  const mask = /* @__PURE__ */ __name((s) => redactPii(s, void 0, allow), "mask");
+  const messages = payload.messages.map((m) => {
+    if (typeof m?.content === "string") return { ...m, content: mask(m.content) };
+    if (Array.isArray(m?.content)) {
+      return {
+        ...m,
+        content: m.content.map((p) => typeof p?.text === "string" ? { ...p, text: mask(p.text) } : p)
+      };
+    }
+    return m;
+  });
+  return { ...payload, messages };
+}
+__name(redactPayloadPii, "redactPayloadPii");
+
+// node_modules/pi-privacy/src/extension.ts?ext=privateer-privacy
+function isVerifiedPrivate(tier) {
+  return tier === "tee-verified" || tier === "local";
+}
+__name(isVerifiedPrivate, "isVerifiedPrivate");
+var PII_WORD_HELP = {
+  off: "bypass the PII gate for this session (credentials still gated)",
+  warn: "ask before PII goes down an unverified channel",
+  redact: "mask PII before send, without asking",
+  on: "restore the configured policy",
+  status: "what is in force right now"
+};
+function makePiPrivacyExtension(opts = {}) {
+  const {
+    installDispatcher = true,
+    registerProviders = true,
+    enforceOpenRouterZdr = false,
+    onPosture,
+    useDispatcherTransport = true,
+    piiPolicy = "warn",
+    piiUnattended = false,
+    renderPiiAutoRedact: renderPiiAutoRedact2,
+    piiAllow = [],
+    piiAllowDefaults = true,
+    showBadge = true,
+    badgeSinks = DEFAULT_BADGE_SINKS,
+    badgeKey = "pi-privacy",
+    renderBadge,
+    toolExfilPolicy = "warn",
+    toolResultPolicy = "warn",
+    downgradePolicy = "warn",
+    modelPicker = true,
+    modelPickerCommand = "models",
+    toolSurfacePolicy = "warn",
+    toolSurfaceCommand = "surface",
+    piiCommand = true,
+    piiCommandName = "pii",
+    resolveTier,
+    privateerVerifiedTee = false
+  } = opts;
+  return /* @__PURE__ */ __name(function piPrivacy(pi) {
+    if (installDispatcher) installAttestationDispatcher();
+    if (registerProviders && typeof pi.registerProvider === "function") {
+      for (const p of PRIVACY_PROVIDERS) {
+        if (registerable(p)) pi.registerProvider(p.id, providerConfig(p));
+      }
+    }
+    let currentProviderId;
+    let currentModelId;
+    let currentTier;
+    let piiChoice = "ask";
+    let piiSession;
+    const piiMode = /* @__PURE__ */ __name(() => piiSession ?? piiPolicy, "piiMode");
+    const piiBypassed = /* @__PURE__ */ __name(() => piiSession === "off", "piiBypassed");
+    const piiUnattendedNow = /* @__PURE__ */ __name(() => typeof piiUnattended === "function" ? !!piiUnattended() : !!piiUnattended, "piiUnattendedNow");
+    let piiSeen = /* @__PURE__ */ new Map();
+    let piiLastAction;
+    const piiAllowEntries2 = /* @__PURE__ */ __name(() => (typeof piiAllow === "function" ? piiAllow() : piiAllow) ?? [], "piiAllowEntries");
+    let allowKey;
+    let allowMatcher;
+    const piiAllowed = /* @__PURE__ */ __name((type, value) => {
+      const entries = piiAllowEntries2();
+      const key = entries.join("\0");
+      if (key !== allowKey || !allowMatcher) {
+        allowKey = key;
+        allowMatcher = compileAllow(entries, {
+          defaults: piiAllowDefaults,
+          warn: /* @__PURE__ */ __name((m) => console.warn(`[pi-privacy] ${m}`), "warn")
+        });
+      }
+      return allowMatcher(type, value);
+    }, "piiAllowed");
+    const scanOpts = { allow: piiAllowed };
+    let toolAllow = false;
+    let resultChoice = "ask";
+    let toolSnapshot = [];
+    let surfaceByName = /* @__PURE__ */ new Map();
+    const ledger = createLedger();
+    const surfaceOn = toolSurfacePolicy !== "off";
+    const captureTools = /* @__PURE__ */ __name((ctx) => {
+      if (!surfaceOn || typeof ctx?.getAllTools !== "function") return;
+      try {
+        const tools = ctx.getAllTools();
+        if (!Array.isArray(tools)) return;
+        toolSnapshot = tools;
+        surfaceByName = new Map(rankSurface(tools).map((e) => [e.name, e]));
+      } catch {
+      }
+    }, "captureTools");
+    const provenanceSeen = /* @__PURE__ */ new Set();
+    let projectToolsAllowed = false;
+    const previewSource = /* @__PURE__ */ __name((entry) => {
+      const path = entry.sourcePath;
+      if (!path) return "No source path recorded for this tool \u2014 nothing to show.";
+      try {
+        const text = readFileSync5(path, "utf8");
+        const clipped = text.length > 4e3 ? `${text.slice(0, 4e3)}
+\u2026 (truncated)` : text;
+        return `${path}:
+${clipped}`;
+      } catch (e) {
+        return `Could not read ${path}: ${e.message}`;
+      }
+    }, "previewSource");
+    const guardProvenance = /* @__PURE__ */ __name(async (toolName, ctx) => {
+      if (toolSurfacePolicy !== "warn" || projectToolsAllowed) return "allow";
+      const entry = surfaceByName.get(toolName);
+      if (!entry || !isRepoSupplied(entry.provenance)) return "allow";
+      if (provenanceSeen.has(toolName)) return "allow";
+      const warning = `\u26A0 \`${toolName}\` was ${entry.concern}. It is about to run for the first time this session. This says where it came FROM, not that it is unsafe.`;
+      if (!canPrompt(ctx)) {
+        provenanceSeen.add(toolName);
+        notify(ctx, warning, "warning");
+        return "allow";
+      }
+      for (let i = 0; i < 3; i++) {
+        const choice = await ask(ctx, warning, [
+          "Run it",
+          "Show me the file",
+          "Allow project tools for this session",
+          "Block"
+        ]);
+        if (choice === "Show me the file") {
+          notify(ctx, previewSource(entry), "info");
+          continue;
+        }
+        if (choice === "Allow project tools for this session") {
+          projectToolsAllowed = true;
+          provenanceSeen.add(toolName);
+          return "allow";
+        }
+        if (choice === "Run it") {
+          provenanceSeen.add(toolName);
+          return "allow";
+        }
+        return "block";
+      }
+      return "block";
+    }, "guardProvenance");
+    let previousTier;
+    let previousModel;
+    let downgradeHandled = true;
+    let contextHits = [];
+    let lastUi;
+    let lastCtx;
+    let lastBadge;
+    let lastHasUI = false;
+    const captureUi = /* @__PURE__ */ __name((ctx) => {
+      if (ctx?.ui) lastUi = ctx.ui, lastCtx = ctx, lastHasUI = !!ctx.hasUI;
+    }, "captureUi");
+    const uiOf = /* @__PURE__ */ __name((ctx) => ctx?.ui ?? lastUi, "uiOf");
+    const canPrompt = /* @__PURE__ */ __name((ctx) => (ctx?.hasUI ?? lastHasUI) && typeof uiOf(ctx)?.select === "function", "canPrompt");
+    const ask = /* @__PURE__ */ __name((ctx, title, options) => canPrompt(ctx) ? uiOf(ctx).select(title, options) : Promise.resolve(void 0), "ask");
+    const notify = /* @__PURE__ */ __name((ctx, message, level) => uiOf(ctx)?.notify?.(message, level), "notify");
+    const postureOpts = /* @__PURE__ */ __name(() => ({
+      apiKey: currentProviderId === "nearai" ? nearApiKey() : void 0,
+      zdrEnforced: currentProviderId === "openrouter" && enforceOpenRouterZdr,
+      transport: useDispatcherTransport && installDispatcher ? dispatcherTransport : void 0
+    }), "postureOpts");
+    const paintBadge = /* @__PURE__ */ __name(() => {
+      if (!showBadge || !lastUi) return;
+      const badge = postureBadge(currentTier);
+      if (badge === lastBadge) return;
+      let rendered = false;
+      if (renderBadge) renderBadge(badge, currentTier, lastCtx), rendered = true;
+      else {
+        for (const sink of badgeSinks) {
+          if (renderBadgeTo(lastUi, sink, badgeKey, badge, currentTier)) {
+            rendered = true;
+            break;
+          }
+        }
+      }
+      if (rendered) lastBadge = badge;
+    }, "paintBadge");
+    const refreshPosture = /* @__PURE__ */ __name(async () => {
+      if (!currentProviderId || !currentModelId) return;
+      if (resolveTier) {
+        const t = await resolveTier(currentProviderId, currentModelId);
+        if (t !== void 0) {
+          currentTier = t;
+          onPosture?.({ providerId: currentProviderId, modelId: currentModelId, tier: t });
+          paintBadge();
+          void guardDowngrade(t);
+          return;
+        }
+      }
+      const result = await verifyModelPosture(currentProviderId, currentModelId, postureOpts());
+      currentTier = result.tier;
+      onPosture?.(result);
+      paintBadge();
+      void guardDowngrade(result.tier);
+    }, "refreshPosture");
+    const guardDowngrade = /* @__PURE__ */ __name(async (toTier, ctx) => {
+      if (downgradePolicy === "off" || downgradeHandled) return;
+      const a = assessDowngrade(previousTier, toTier, contextHits);
+      if (!a.downgrade || a.severity === "none") return;
+      if (piiBypassed() && a.severity !== "secret") return;
+      downgradeHandled = true;
+      const label = currentProviderId ? `${currentProviderId}${currentModelId ? `/${currentModelId}` : ""}` : void 0;
+      const warning = downgradeWarning(a, contextHits, label);
+      const revert = /* @__PURE__ */ __name(async () => {
+        if (previousModel === void 0 || typeof pi.setModel !== "function") {
+          notify(ctx, `${warning} Could not revert the switch automatically.`, "warning");
+          return;
+        }
+        await pi.setModel(previousModel);
+        notify(ctx, `Reverted to ${TIERS[a.from].label} \u2014 session context stays put.`, "info");
+      }, "revert");
+      if (downgradePolicy === "block") return revert();
+      if (canPrompt(ctx)) {
+        const choice = await ask(ctx, warning, [
+          "Stay on the previous model",
+          "Switch anyway",
+          "Switch, redacting PII from now on"
+        ]);
+        if (choice === "Switch anyway") return;
+        if (choice === "Switch, redacting PII from now on") {
+          piiChoice = "redact";
+          return;
+        }
+        return revert();
+      }
+      if (a.severity === "secret") return revert();
+      notify(ctx, warning, "warning");
+    }, "guardDowngrade");
+    pi.on("session_start", (_event, ctx) => {
+      captureUi(ctx);
+      captureTools(ctx);
+    });
+    pi.on("model_select", (event, ctx) => {
+      const model = event?.model;
+      previousTier = currentTier;
+      previousModel = event?.previousModel;
+      downgradeHandled = false;
+      if (model?.provider !== currentProviderId) {
+        piiSeen = /* @__PURE__ */ new Map();
+        piiLastAction = void 0;
+      }
+      currentProviderId = model?.provider;
+      currentModelId = model?.id;
+      captureUi(ctx);
+      currentTier = void 0;
+      paintBadge();
+      void guardDowngrade(
+        effectiveTier(currentProviderId ?? "", {
+          zdrEnforced: currentProviderId === "openrouter" && enforceOpenRouterZdr
+        }),
+        ctx
+      );
+      void refreshPosture();
+    });
+    pi.on("before_provider_request", async (event, ctx) => {
+      captureUi(ctx);
+      paintBadge();
+      let payload = event?.payload;
+      if (currentProviderId === "venice") payload = veniceRequestPatch(payload);
+      else if (currentProviderId === "openrouter" && enforceOpenRouterZdr) payload = openRouterZdrPatch(payload);
+      const scan = scanPii(payloadText(payload), scanOpts);
+      const hits = scan.hits;
+      contextHits = hits;
+      if (!piiBypassed() && !isVerifiedPrivate(currentTier)) {
+        if (hits.length > 0) {
+          let action = piiChoice !== "ask" ? piiChoice : piiMode() === "redact" ? "redact" : "send";
+          const fresh = newPii(hits, piiSeen);
+          const decided = piiChoice !== "ask" ? piiChoice : piiLastAction;
+          if (fresh.length === 0 && decided) action = decided;
+          if (fresh.length > 0 && piiChoice === "ask" && piiMode() === "warn" && piiUnattendedNow()) {
+            action = "redact";
+            const notice = `\u2691 unattended \u2014 PII auto-redacted before send: ${piiInline(scan)} \u2192 ${TIERS[currentTier ?? "standard"].label} channel. Best-effort structured detection only, not a guarantee.`;
+            const rendered = renderPiiAutoRedact2?.(notice);
+            notify(ctx, rendered ?? notice, rendered ? "info" : "warning");
+          } else if (fresh.length > 0 && piiChoice === "ask" && piiMode() === "warn" && canPrompt(ctx)) {
+            const tierLabel = TIERS[currentTier ?? "standard"].label;
+            const kind = hasSecrets(hits) ? "secrets/PII" : "structured PII";
+            const again = piiLastAction ? ` (${summarizePii(fresh)} new since your last answer)` : "";
+            const head = `\u26A0 ${summarizePii(hits)} detected${again} \u2014 sending to an unverified channel (${tierLabel}). Best-effort ${kind} detection only, not a guarantee.`;
+            let title = head;
+            for (let round = 0; round < 2; round++) {
+              const options = [
+                "Send as-is",
+                "Redact PII",
+                ...round === 0 ? ["Show what was detected"] : [],
+                "Redact + remember for session",
+                "Send + remember for session"
+              ];
+              const choice = await ask(ctx, title, options);
+              if (choice === "Show what was detected") {
+                title = `${head}
+
+${piiDetail(scan)}`;
+                continue;
+              }
+              if (choice === "Redact PII") action = "redact";
+              else if (choice === "Redact + remember for session") action = "redact", piiChoice = "redact";
+              else if (choice === "Send + remember for session") action = "send", piiChoice = "send";
+              else action = "send";
+              break;
+            }
+          }
+          piiSeen = mergePiiBaseline(piiSeen, hits);
+          piiLastAction = action;
+          if (action === "redact") payload = redactPayloadPii(payload, piiAllowed);
+        }
+      }
+      return payload === event?.payload ? void 0 : payload;
+    });
+    const egressVerdict = /* @__PURE__ */ __name((assessment, label, input) => {
+      if (!assessment.egress) return void 0;
+      const hits = detectPii(payloadText(input), scanOpts);
+      const files = assessment.sensitiveFiles ?? [];
+      if (hits.length === 0 && files.length === 0) return void 0;
+      const secret = hasSecrets(hits) || files.length > 0;
+      const what = [files.length ? `${files.join(", ")} contents` : "", hits.length ? summarizePii(hits) : ""].filter(Boolean).join(" + ");
+      const dest = assessment.target ? ` \u2192 ${assessment.target}` : "";
+      const reason = `pi-privacy blocked ${secret ? "credential" : "PII"} exfiltration via ${label}`;
+      const warning = `\u26A0 ${label} is about to send ${what} off this machine${dest}. A private (TEE/ZDR) model does NOT protect a tool call. Best-effort detection, not a guarantee.`;
+      return { warning, reason, secret };
+    }, "egressVerdict");
+    const egressGated = /* @__PURE__ */ __name((v) => v.secret || !piiBypassed(), "egressGated");
+    const decideEgress = /* @__PURE__ */ __name(async (v, ctx) => {
+      if (toolAllow) {
+        notify(ctx, v.warning, "warning");
+        return "allow";
+      }
+      if (toolExfilPolicy === "block") return "block";
+      if (canPrompt(ctx)) {
+        const choice = await ask(ctx, v.warning, ["Block", "Allow once", "Allow for session"]);
+        if (choice === "Allow for session") {
+          toolAllow = true;
+          return "allow";
+        }
+        if (choice === "Allow once") return "allow";
+        return "block";
+      }
+      if (v.secret) return "block";
+      notify(ctx, v.warning, "warning");
+      return "allow";
+    }, "decideEgress");
+    pi.on("tool_call", async (event, ctx) => {
+      if (toolExfilPolicy === "off" && !surfaceOn) return;
+      captureUi(ctx);
+      const name = event?.toolName ?? "a tool";
+      if (await guardProvenance(name, ctx) === "block")
+        return {
+          block: true,
+          reason: `pi-privacy blocked ${name}: supplied by this project, not by you`
+        };
+      const assessment = assessToolCall(event?.toolName, event?.input);
+      const v = egressVerdict(assessment, name, event?.input);
+      let blocked = false;
+      if (toolExfilPolicy !== "off" && v && egressGated(v)) blocked = await decideEgress(v, ctx) === "block";
+      if (surfaceOn) recordEgress(ledger, name, assessment, { pii: !!v, blocked });
+      if (blocked) return { block: true, reason: v.reason };
+      return;
+    });
+    pi.on("user_bash", async (event, ctx) => {
+      if (toolExfilPolicy === "off" && !surfaceOn) return;
+      captureUi(ctx);
+      const command = typeof event?.command === "string" ? event.command : "";
+      if (!command) return;
+      const assessment = assessToolCall("bash", { command });
+      const v = egressVerdict(assessment, "this ! command", { command });
+      let blocked = false;
+      if (toolExfilPolicy !== "off" && v && egressGated(v)) blocked = await decideEgress(v, ctx) === "block";
+      if (surfaceOn) recordEgress(ledger, "! command", assessment, { pii: !!v, blocked });
+      if (blocked) {
+        return {
+          result: {
+            output: `${v.reason}. Set PI_PRIVACY_TOOL_EXFIL_POLICY=off (or allow it when prompted) if this is intended.`,
+            exitCode: 1,
+            cancelled: false,
+            truncated: false
+          }
+        };
+      }
+      return;
+    });
+    pi.on("tool_result", async (event, ctx) => {
+      if (toolResultPolicy === "off") return;
+      captureUi(ctx);
+      const content = event?.content;
+      const hits = secretHits(detectPii(toolResultText(content), scanOpts));
+      if (hits.length === 0) return;
+      const summary = summarizePii(hits);
+      const warning = `\u26A0 ${event?.toolName ?? "a tool"} returned ${summary}. Keeping ${hits.length === 1 && hits[0].count === 1 ? "it" : "them"} in context means re-sending to the provider on every later turn, and writing to the session file on disk in plaintext. Best-effort secret detection, not a guarantee.`;
+      let action = resultChoice !== "ask" ? resultChoice : toolResultPolicy === "redact" ? "redact" : "keep";
+      if (resultChoice === "ask" && toolResultPolicy === "warn") {
+        if (canPrompt(ctx)) {
+          const choice = await ask(ctx, warning, [
+            "Redact the credentials",
+            "Keep them in context",
+            "Redact for the rest of the session",
+            "Keep for the rest of the session"
+          ]);
+          if (choice === "Redact the credentials") action = "redact";
+          else if (choice === "Redact for the rest of the session") action = "redact", resultChoice = "redact";
+          else if (choice === "Keep for the rest of the session") action = "keep", resultChoice = "keep";
+          else action = "keep";
+        } else {
+          action = "redact";
+          notify(ctx, `${warning} Redacted (no UI to ask).`, "warning");
+        }
+      }
+      if (action !== "redact") return;
+      const redacted = redactToolResultContent(content, void 0, piiAllowed);
+      if (redacted === void 0) {
+        notify(
+          ctx,
+          `Could not redact ${summary} from ${event?.toolName ?? "the tool"} result \u2014 unrecognized result shape. It stays in context.`,
+          "warning"
+        );
+        return;
+      }
+      return { content: redacted };
+    });
+    const surfaceSection = /* @__PURE__ */ __name((ctx, full) => {
+      captureTools(ctx);
+      const lines = [];
+      const entries = rankSurface(toolSnapshot);
+      if (entries.length === 0) {
+        if (full) lines.push("Tools     inventory unavailable \u2014 this host did not expose the tool list.");
+      } else {
+        const report = surfaceReport(entries, !full);
+        lines.push(`Tools     ${report[0]}`);
+        for (const l of report.slice(1)) lines.push(`          ${l}`);
+        if (summarizeSurface(entries).notYours > 0)
+          lines.push(
+            "          \u26A0 marks a tool that came with this working directory or a CLI flag, not from your configuration. That is where it came FROM \u2014 pi-privacy does not judge what it does."
+          );
+      }
+      const obs = ledgerReport(ledger);
+      if (obs.length) {
+        lines.push(`Observed  ${obs[0]}`);
+        for (const l of obs.slice(1)) lines.push(`          ${l}`);
+        lines.push(
+          "          (observed via tool calls only \u2014 an extension's own fetch() never appears here, so this is a floor)"
+        );
+      }
+      return lines.join("\n");
+    }, "surfaceSection");
+    if (typeof pi.registerCommand === "function") {
+      pi.registerCommand("verify", {
+        description: "Verify the current model's privacy posture (TEE attestation)",
+        handler: /* @__PURE__ */ __name(async (_args, ctx) => {
+          if (!currentProviderId || !currentModelId) {
+            ctx.ui?.notify?.("No model selected.", "warning");
+            return;
+          }
+          const res = await verifyModelPosture(currentProviderId, currentModelId, postureOpts());
+          const info = TIERS[res.tier];
+          const detail = res.teePosture ? ` [${res.teePosture}]` : "";
+          const err = res.error ? ` \u2014 ${res.error}` : "";
+          ctx.ui?.notify?.(`${info.label}${detail}: ${info.blurb}${err}`, "info");
+          if (res.attestation !== void 0) {
+            let report;
+            try {
+              report = JSON.stringify(res.attestation, null, 2);
+            } catch {
+              report = String(res.attestation);
+            }
+            ctx.ui?.notify?.(`attestation report (verify independently):
+${report}`, "info");
+          }
+          if (surfaceOn) {
+            const section = surfaceSection(ctx, false);
+            if (section) ctx.ui?.notify?.(section, "info");
+          }
+        }, "handler")
+      });
+      if (piiCommand) {
+        pi.registerCommand(piiCommandName, {
+          description: "Set or bypass the PII gate for this session (off | warn | redact | on | status)",
+          handler: /* @__PURE__ */ __name((args, ctx) => {
+            const out = runPiiCommand(args, {
+              configured: piiPolicy,
+              session: piiSession,
+              toolExfilPolicy,
+              toolResultPolicy,
+              downgradePolicy,
+              commandName: piiCommandName
+            });
+            piiSession = out.session;
+            if (out.changed) {
+              piiChoice = "ask";
+              piiSeen = /* @__PURE__ */ new Map();
+              piiLastAction = void 0;
+            }
+            ctx.ui?.notify?.(out.message, out.level);
+          }, "handler"),
+          // Hint the words rather than making the user find them in a README.
+          getArgumentCompletions: /* @__PURE__ */ __name((prefix) => {
+            const p = prefix.trim().toLowerCase();
+            return PII_COMMAND_WORDS.filter((w) => w.startsWith(p)).map((w) => ({
+              value: w,
+              label: w,
+              description: PII_WORD_HELP[w]
+            }));
+          }, "getArgumentCompletions")
+        });
+      }
+      if (surfaceOn) {
+        pi.registerCommand(toolSurfaceCommand, {
+          description: "List the session's tools by who supplied them, plus observed egress",
+          handler: /* @__PURE__ */ __name((_args, ctx) => {
+            ctx.ui?.notify?.(surfaceSection(ctx, true), "info");
+          }, "handler")
+        });
+      }
+      if (modelPicker) {
+        pi.registerCommand(modelPickerCommand, {
+          description: "Pick a model ranked by privacy (verified TEE / on-device / ZDR first)",
+          handler: /* @__PURE__ */ __name(async (_args, ctx) => {
+            const reg = ctx.modelRegistry;
+            const models = reg?.getAvailable?.() ?? reg?.getAll?.() ?? [];
+            if (models.length === 0) {
+              ctx.ui?.notify?.(
+                "No models to rank (none with configured auth were found).",
+                "warning"
+              );
+              return;
+            }
+            const ranked = rankModels(models, {
+              zdrEnforced: enforceOpenRouterZdr,
+              verifiedTee: privateerVerifiedTee
+            });
+            const cur = ctx.getModel?.() ?? { provider: currentProviderId, id: currentModelId };
+            const isCurrent = /* @__PURE__ */ __name((m) => m.provider === cur.provider && m.id === cur.id, "isCurrent");
+            const byLabel = /* @__PURE__ */ new Map();
+            const options = ranked.map((e) => {
+              const label = pickerOptionLabel(e, isCurrent(e.model));
+              byLabel.set(label, e.model);
+              return label;
+            });
+            if (!ctx.hasUI || typeof ctx.ui?.select !== "function") {
+              ctx.ui?.notify?.(
+                `Models by privacy (strongest first):
+${options.join("\n")}
+\u25C6 = TEE that verifies when selected. Switch with /model.`,
+                "info"
+              );
+              return;
+            }
+            const choice = await ctx.ui.select(
+              "Pick a model (strongest privacy first \u2014 \u25C6 verifies on select):",
+              options
+            );
+            if (!choice) return;
+            const model = byLabel.get(choice);
+            if (!model) return;
+            if (isCurrent(model)) {
+              ctx.ui?.notify?.("Already on that model.", "info");
+              return;
+            }
+            if (typeof pi.setModel !== "function") {
+              ctx.ui?.notify?.("This host can't switch models programmatically.", "warning");
+              return;
+            }
+            const ok = await pi.setModel(model);
+            if (!ok)
+              ctx.ui?.notify?.(
+                `Could not switch to ${model.provider}/${model.id} \u2014 no API key configured for it.`,
+                "warning"
+              );
+          }, "handler")
+        });
+      }
+    }
+  }, "piPrivacy");
+}
+__name(makePiPrivacyExtension, "makePiPrivacyExtension");
+var extension_default = makePiPrivacyExtension();
+
+// node_modules/pi-privacy/src/options.ts?ext=privateer-privacy
+var CODE_ONLY_OPTIONS = [
+  "onPosture",
+  "resolveTier",
+  "renderBadge",
+  "privateerVerifiedTee",
+  "piiUnattended",
+  "renderPiiAutoRedact"
+];
+
+// node_modules/pi-privacy/src/config.ts?ext=privateer-privacy
+import { readFileSync as readFileSync6 } from "node:fs";
+var POLICY3 = ["warn", "redact", "off"];
+var TOOL_POLICY = ["warn", "block", "off"];
+var DOWNGRADE_POLICY = ["warn", "block", "off"];
+var SURFACE_POLICY = ["warn", "report", "off"];
+var SINKS = ["status", "widget", "title", "notify"];
+function parseBool(name, raw, warn) {
+  const v = raw.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(v)) return true;
+  if (["0", "false", "no", "off"].includes(v)) return false;
+  warn(`${name}="${raw}" is not a boolean (true/false) \u2014 ignoring, using the default.`);
+  return void 0;
+}
+__name(parseBool, "parseBool");
+function parseEnum(name, raw, allowed, warn) {
+  const v = raw.trim().toLowerCase();
+  if (allowed.includes(v)) return v;
+  warn(`${name}="${raw}" is not one of ${allowed.join("|")} \u2014 ignoring, using the default.`);
+  return void 0;
+}
+__name(parseEnum, "parseEnum");
+function parseSinks(name, raw, warn) {
+  const parts = raw.split(/[,\s]+/).map((s) => s.trim().toLowerCase()).filter(Boolean);
+  const out = [];
+  for (const p of parts) {
+    if (SINKS.includes(p)) out.push(p);
+    else warn(`${name}: "${p}" is not a badge sink (${SINKS.join("|")}) \u2014 dropping it.`);
+  }
+  return out.length ? out : (warn(`${name}="${raw}" has no valid sinks \u2014 using the default chain.`), void 0);
+}
+__name(parseSinks, "parseSinks");
+function boolVar(opts, env, name, key, warn) {
+  const raw = env[name];
+  if (raw === void 0 || raw === "") return;
+  const b = parseBool(name, raw, warn);
+  if (b !== void 0) opts[key] = b;
+}
+__name(boolVar, "boolVar");
+function optionsFromEnv(env, warn) {
+  const opts = {};
+  const pii = env.PI_PRIVACY_PII_POLICY;
+  if (pii) {
+    const v = parseEnum("PI_PRIVACY_PII_POLICY", pii, POLICY3, warn);
+    if (v) opts.piiPolicy = v;
+  }
+  const tool = env.PI_PRIVACY_TOOL_EXFIL_POLICY;
+  if (tool) {
+    const v = parseEnum("PI_PRIVACY_TOOL_EXFIL_POLICY", tool, TOOL_POLICY, warn);
+    if (v) opts.toolExfilPolicy = v;
+  }
+  const result = env.PI_PRIVACY_TOOL_RESULT_POLICY;
+  if (result) {
+    const v = parseEnum("PI_PRIVACY_TOOL_RESULT_POLICY", result, POLICY3, warn);
+    if (v) opts.toolResultPolicy = v;
+  }
+  const down = env.PI_PRIVACY_DOWNGRADE_POLICY;
+  if (down) {
+    const v = parseEnum("PI_PRIVACY_DOWNGRADE_POLICY", down, DOWNGRADE_POLICY, warn);
+    if (v) opts.downgradePolicy = v;
+  }
+  const surface = env.PI_PRIVACY_TOOL_SURFACE_POLICY;
+  if (surface) {
+    const v = parseEnum("PI_PRIVACY_TOOL_SURFACE_POLICY", surface, SURFACE_POLICY, warn);
+    if (v) opts.toolSurfacePolicy = v;
+  }
+  boolVar(opts, env, "PI_PRIVACY_ENFORCE_OPENROUTER_ZDR", "enforceOpenRouterZdr", warn);
+  boolVar(opts, env, "PI_PRIVACY_SHOW_BADGE", "showBadge", warn);
+  boolVar(opts, env, "PI_PRIVACY_INSTALL_DISPATCHER", "installDispatcher", warn);
+  boolVar(opts, env, "PI_PRIVACY_REGISTER_PROVIDERS", "registerProviders", warn);
+  boolVar(opts, env, "PI_PRIVACY_USE_DISPATCHER_TRANSPORT", "useDispatcherTransport", warn);
+  boolVar(opts, env, "PI_PRIVACY_MODEL_PICKER", "modelPicker", warn);
+  boolVar(opts, env, "PI_PRIVACY_PII_COMMAND", "piiCommand", warn);
+  const sinks = env.PI_PRIVACY_BADGE_SINKS;
+  if (sinks) {
+    const v = parseSinks("PI_PRIVACY_BADGE_SINKS", sinks, warn);
+    if (v) opts.badgeSinks = v;
+  }
+  const allow = env.PI_PRIVACY_PII_ALLOW;
+  if (allow) {
+    const parts = allow.split(/[,\s]+/).map((s) => s.trim()).filter(Boolean);
+    if (parts.length) opts.piiAllow = parts;
+    else warn(`PI_PRIVACY_PII_ALLOW="${allow}" has no entries \u2014 ignoring it.`);
+  }
+  boolVar(opts, env, "PI_PRIVACY_PII_ALLOW_DEFAULTS", "piiAllowDefaults", warn);
+  const key = env.PI_PRIVACY_BADGE_KEY;
+  if (key && key.trim()) opts.badgeKey = key.trim();
+  const cmd = env.PI_PRIVACY_MODEL_PICKER_COMMAND;
+  if (cmd && cmd.trim()) opts.modelPickerCommand = cmd.trim();
+  const scmd = env.PI_PRIVACY_TOOL_SURFACE_COMMAND;
+  if (scmd && scmd.trim()) opts.toolSurfaceCommand = scmd.trim();
+  const pcmd = env.PI_PRIVACY_PII_COMMAND_NAME;
+  if (pcmd && pcmd.trim()) opts.piiCommandName = pcmd.trim();
+  return opts;
+}
+__name(optionsFromEnv, "optionsFromEnv");
+function sanitizeConfig(raw, warn) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    warn(`config file is not a JSON object \u2014 ignoring it.`);
+    return {};
+  }
+  const src = raw;
+  const opts = {};
+  const enumKey = /* @__PURE__ */ __name((k, allowed, set) => {
+    if (!(k in src)) return;
+    const val = src[k];
+    if (typeof val === "string" && allowed.includes(val.toLowerCase()))
+      set(val.toLowerCase());
+    else warn(`config.${k}=${JSON.stringify(val)} is not one of ${allowed.join("|")} \u2014 ignoring.`);
+  }, "enumKey");
+  const boolKey = /* @__PURE__ */ __name((k) => {
+    if (!(k in src)) return;
+    const val = src[k];
+    if (typeof val === "boolean") opts[k] = val;
+    else warn(`config.${k}=${JSON.stringify(val)} is not a boolean \u2014 ignoring.`);
+  }, "boolKey");
+  enumKey("piiPolicy", POLICY3, (v) => opts.piiPolicy = v);
+  enumKey("toolExfilPolicy", TOOL_POLICY, (v) => opts.toolExfilPolicy = v);
+  enumKey("toolResultPolicy", POLICY3, (v) => opts.toolResultPolicy = v);
+  enumKey("downgradePolicy", DOWNGRADE_POLICY, (v) => opts.downgradePolicy = v);
+  enumKey("toolSurfacePolicy", SURFACE_POLICY, (v) => opts.toolSurfacePolicy = v);
+  boolKey("enforceOpenRouterZdr");
+  boolKey("showBadge");
+  boolKey("installDispatcher");
+  boolKey("registerProviders");
+  boolKey("useDispatcherTransport");
+  boolKey("modelPicker");
+  boolKey("piiAllowDefaults");
+  boolKey("piiCommand");
+  if ("piiAllow" in src) {
+    const val = src.piiAllow;
+    if (Array.isArray(val)) {
+      const out = val.filter((s) => typeof s === "string" && s.trim().length > 0).map((s) => s.trim());
+      if (out.length !== val.length) warn(`config.piiAllow has non-string/empty entries \u2014 dropping them.`);
+      if (out.length) opts.piiAllow = out;
+    } else warn(`config.piiAllow is not an array of strings \u2014 ignoring.`);
+  }
+  if ("badgeSinks" in src) {
+    const val = src.badgeSinks;
+    if (Array.isArray(val)) {
+      const out = val.filter(
+        (s) => typeof s === "string" && SINKS.includes(s)
+      );
+      if (out.length) opts.badgeSinks = out;
+      else warn(`config.badgeSinks has no valid sinks (${SINKS.join("|")}) \u2014 using the default chain.`);
+    } else warn(`config.badgeSinks is not an array \u2014 ignoring.`);
+  }
+  if ("badgeKey" in src) {
+    const val = src.badgeKey;
+    if (typeof val === "string" && val.trim()) opts.badgeKey = val.trim();
+    else warn(`config.badgeKey=${JSON.stringify(val)} is not a non-empty string \u2014 ignoring.`);
+  }
+  if ("modelPickerCommand" in src) {
+    const val = src.modelPickerCommand;
+    if (typeof val === "string" && val.trim()) opts.modelPickerCommand = val.trim();
+    else warn(`config.modelPickerCommand=${JSON.stringify(val)} is not a non-empty string \u2014 ignoring.`);
+  }
+  if ("toolSurfaceCommand" in src) {
+    const val = src.toolSurfaceCommand;
+    if (typeof val === "string" && val.trim()) opts.toolSurfaceCommand = val.trim();
+    else warn(`config.toolSurfaceCommand=${JSON.stringify(val)} is not a non-empty string \u2014 ignoring.`);
+  }
+  if ("piiCommandName" in src) {
+    const val = src.piiCommandName;
+    if (typeof val === "string" && val.trim()) opts.piiCommandName = val.trim();
+    else warn(`config.piiCommandName=${JSON.stringify(val)} is not a non-empty string \u2014 ignoring.`);
+  }
+  for (const k of Object.keys(src)) {
+    if (CODE_ONLY_OPTIONS.includes(k))
+      warn(`config.${k} is a code-only option and can't be set from JSON \u2014 import makePiPrivacyExtension() to use it.`);
+  }
+  return opts;
+}
+__name(sanitizeConfig, "sanitizeConfig");
+var PROTECTIVENESS = {
+  piiPolicy: { off: 0, warn: 1, redact: 2 },
+  toolExfilPolicy: { off: 0, warn: 1, block: 2 },
+  toolResultPolicy: { off: 0, warn: 1, redact: 2 },
+  downgradePolicy: { off: 0, warn: 1, block: 2 },
+  // "report" keeps the inventory but stops warning; "off" removes the axis entirely.
+  // Both are weaker than the default, and this is the sharpest case the floor exists
+  // for: the tool-surface axis is what reports tools THE PROJECT SUPPLIED, so a
+  // project-local config turning it down is not a hypothetical attack — it is the
+  // whole attack, and it would leave no trace by construction.
+  toolSurfacePolicy: { off: 0, report: 1, warn: 2 }
+};
+var DEFAULT_POLICY = {
+  piiPolicy: "warn",
+  toolExfilPolicy: "warn",
+  toolResultPolicy: "warn",
+  downgradePolicy: "warn",
+  toolSurfacePolicy: "warn"
+};
+var PROTECTIVE_WHEN_TRUE = [
+  "showBadge",
+  // hides the live posture badge
+  "installDispatcher",
+  // no dispatcher → no TLS-key binding for Tinfoil attestation
+  "useDispatcherTransport",
+  // attestation stops binding to the real inference connection
+  "registerProviders",
+  // removes the private providers from the model list
+  "modelPicker"
+  // removes the privacy-ranked picker
+];
+var PROJECT_MAY_NOT_SET = {
+  // The sharpest of the lot: `{"piiAllow": ["*@*", "@acme.com"]}` in a cloned repo is
+  // piiPolicy:"off" for exactly the data that repo cares about, and it would read as a
+  // gate that simply found nothing. An allowlist only ever REMOVES detection, so it
+  // can only come from you.
+  piiAllow: "an allowlist entry can hide PII from the gate entirely",
+  badgeSinks: "a sink list can hide the posture badge",
+  toolSurfaceCommand: "renaming the command can hide the tool-surface listing",
+  modelPickerCommand: "renaming the command can hide the privacy-ranked model picker",
+  // Not because hiding /pii would weaken anything — it wouldn't — but because a name
+  // is a way to SHADOW: `{"piiCommandName": "surface"}` registers the PII lever over
+  // the tool-surface listing, and the listing is exactly what would have named the
+  // repo's own tools.
+  piiCommandName: "renaming the command can shadow another command's name"
+};
+function clampProjectConfig(opts, warn) {
+  const src = opts;
+  const out = {};
+  const note = /* @__PURE__ */ __name((key, val, floor) => warn(
+    `project-local pi-privacy.config.json sets ${key}=${JSON.stringify(val)}, which is WEAKER than the built-in default (${floor}) \u2014 ignoring it. A project you open must not be able to turn off your privacy guards. If you meant it, set the PI_PRIVACY_* env var, or point PI_PRIVACY_CONFIG at this file.`
+  ), "note");
+  for (const [key, val] of Object.entries(src)) {
+    const ranks = PROTECTIVENESS[key];
+    if (ranks) {
+      const floor = DEFAULT_POLICY[key];
+      if ((ranks[String(val)] ?? 0) < ranks[floor]) {
+        note(key, val, `"${floor}"`);
+        continue;
+      }
+    } else if (PROTECTIVE_WHEN_TRUE.includes(key) && val === false) {
+      note(key, val, "true");
+      continue;
+    } else if (key in PROJECT_MAY_NOT_SET) {
+      warn(
+        `project-local pi-privacy.config.json sets ${key} \u2014 ignoring it, since ${PROJECT_MAY_NOT_SET[key]}. Set the PI_PRIVACY_* env var, or point PI_PRIVACY_CONFIG at this file, if you meant it.`
+      );
+      continue;
+    }
+    out[key] = val;
+  }
+  return out;
+}
+__name(clampProjectConfig, "clampProjectConfig");
+function loadConfig(deps = {}) {
+  const env = deps.env ?? process.env;
+  const warn = deps.warn ?? ((m) => console.warn(`[pi-privacy] ${m}`));
+  const fromFile = loadFileConfig(env, deps, warn);
+  const fromEnv = optionsFromEnv(env, warn);
+  return { ...fromFile, ...fromEnv };
+}
+__name(loadConfig, "loadConfig");
+function loadFileConfig(env, deps, warn) {
+  const explicit = env.PI_PRIVACY_CONFIG?.trim();
+  const cwd = deps.cwd ?? process.cwd();
+  const path = explicit && explicit.length ? explicit : `${cwd}/pi-privacy.config.json`;
+  let text;
+  try {
+    const read = deps.readFile ?? ((p) => readFileSync6(p, "utf8"));
+    text = read(path);
+  } catch (e) {
+    if (explicit) warn(`config file "${path}" could not be read: ${e.message}`);
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (e) {
+    warn(`config file "${path}" is not valid JSON: ${e.message} \u2014 ignoring it.`);
+    return {};
+  }
+  const opts = sanitizeConfig(parsed, warn);
+  if (explicit || deps.projectTrusted) return opts;
+  return clampProjectConfig(opts, warn);
+}
+__name(loadFileConfig, "loadFileConfig");
+
+// src/providers/defaultModel.ts?ext=privateer-privacy
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+var TINFOIL_MODEL_ID = "tinfoil/gemma4-31b";
+var TINFOIL_DEFAULT_SPEC = TINFOIL_MODEL_ID;
+var ACCOUNT_DEFAULT_MODEL_ID = TINFOIL_MODEL_ID;
+var ACCOUNT_DEFAULT_SPEC = `privateer/${ACCOUNT_DEFAULT_MODEL_ID}`;
+var ACCOUNT_NEAR_MODEL_ID = "near/zai-org/GLM-5.1-FP8";
+var LEGACY_BYO_FALLBACK = "openrouter/openai/gpt-4o-mini";
+var BYO_BY_KEY = [
+  { env: "ANTHROPIC_API_KEY", spec: "anthropic/claude-opus-4-8" },
+  { env: "OPENAI_API_KEY", spec: "openai/gpt-5.5" },
+  { env: "OPENROUTER_API_KEY", spec: LEGACY_BYO_FALLBACK }
+];
+function savedPiDefaultSpec() {
+  try {
+    const raw = readFileSync7(join5(agentDir(), "settings.json"), "utf8").trim();
+    if (!raw) return null;
+    const s = JSON.parse(raw);
+    const provider = typeof s.defaultProvider === "string" ? s.defaultProvider.trim() : "";
+    const modelId = typeof s.defaultModel === "string" ? s.defaultModel.trim() : "";
+    return provider && modelId ? `${provider}/${modelId}` : null;
+  } catch {
+    return null;
+  }
+}
+__name(savedPiDefaultSpec, "savedPiDefaultSpec");
+function resolveDefaultModel(opts = {}) {
+  const env = opts.env ?? process.env;
+  const explicit = opts.explicit?.trim();
+  if (explicit) return explicit;
+  const fromEnv = env.PRIVATEER_MODEL?.trim();
+  if (fromEnv) return fromEnv;
+  const saved = opts.saved === void 0 ? savedPiDefaultSpec() : opts.saved;
+  if (saved) return saved;
+  if (env.TINFOIL_API_KEY?.trim()) return TINFOIL_DEFAULT_SPEC;
+  const signedIn = opts.signedIn ?? hasCredentials();
+  if (signedIn) return ACCOUNT_DEFAULT_SPEC;
+  for (const { env: keyName, spec } of BYO_BY_KEY) {
+    if (env[keyName]?.trim()) return spec;
+  }
+  return ACCOUNT_DEFAULT_SPEC;
+}
+__name(resolveDefaultModel, "resolveDefaultModel");
+function resolveSignedInModel(env = process.env) {
+  return resolveDefaultModel({ env, signedIn: true, saved: null });
+}
+__name(resolveSignedInModel, "resolveSignedInModel");
+function splitSpec(spec) {
+  const slash = spec.indexOf("/");
+  if (slash <= 0 || slash === spec.length - 1) return null;
+  return { provider: spec.slice(0, slash), modelId: spec.slice(slash + 1) };
+}
+__name(splitSpec, "splitSpec");
+function ensurePiDefaultModel(spec = resolveSignedInModel()) {
+  return writeSettingsDefaultModel(spec, true);
+}
+__name(ensurePiDefaultModel, "ensurePiDefaultModel");
+function writePiDefaultModel(spec) {
+  return writeSettingsDefaultModel(spec, false);
+}
+__name(writePiDefaultModel, "writePiDefaultModel");
+function writeSettingsDefaultModel(spec, onlyIfUnset) {
+  const parts = splitSpec(spec);
+  if (!parts) return null;
+  const dir = agentDir();
+  const settingsPath = join5(dir, "settings.json");
+  try {
+    mkdirSync4(dir, { recursive: true });
+    let settings = {};
+    if (existsSync3(settingsPath)) {
+      const raw = readFileSync7(settingsPath, "utf8").trim();
+      if (raw) settings = JSON.parse(raw);
+    }
+    if (onlyIfUnset && typeof settings.defaultModel === "string" && settings.defaultModel.trim()) {
+      return null;
+    }
+    settings.defaultProvider = parts.provider;
+    settings.defaultModel = parts.modelId;
+    writeFileSync5(settingsPath, `${JSON.stringify(settings, null, 2)}
+`);
+    return spec;
+  } catch {
+    return null;
+  }
+}
+__name(writeSettingsDefaultModel, "writeSettingsDefaultModel");
+
+// src/providers/vision.ts?ext=privateer-privacy
+var VISION_PATTERNS = [
+  // ── Named in the id ────────────────────────────────────────────────────────
+  // Qwen's vision line (qwen3-vl-*, qwen2.5-vl-72b, near/Qwen/Qwen3-VL-30B-A3B) and
+  // Baidu's (ernie-4.5-vl-424b). Qwen ships VL as a SEPARATE line, which is also why
+  // the plain qwen3.x ids below are deliberately absent.
+  /-vl[-_.]/i,
+  // Z.ai marks vision with a trailing v on the version: glm-4.5v, glm-4.6v,
+  // glm-5v-turbo. Same reasoning — the unsuffixed glm-5.x are their text siblings.
+  /\bglm-\d+(?:\.\d+)?v\b/i,
+  // ByteDance's GUI agent reads screenshots; that is the whole point of it.
+  /\bui-tars\b/i,
+  // ── Families that are multimodal throughout ────────────────────────────────
+  // Every Claude from 3 onwards takes images, and 3 is the oldest in the catalog.
+  /(^|\/)anthropic\/claude-/i,
+  // Gemini has been multimodal since 1.0.
+  /(^|\/)google\/gemini-/i,
+  // Gemma from 3 on is multimodal; gemma-2 is not, so the version is part of the
+  // match. Covers google/gemma-3-27b-it, google/gemma-4-31b-it, tinfoil/gemma4-31b,
+  // near/google/gemma-4-31B-it, phala/google/gemma-4-31b-it and the Phala
+  // gemma-4 derivatives.
+  /gemma-?[34]/i,
+  // gpt-4o, gpt-4.1 and the whole gpt-5 line. Deliberately NOT `openai/gpt-4`
+  // (the original is text-only), not gpt-3.5, and not gpt-oss — the open-weights
+  // models are text-only, which is what our own default was until this change.
+  /(^|\/)openai\/gpt-(?:4o|4\.1|5)/i,
+  // Llama 4 (maverick, scout) is natively multimodal; 3.x is not.
+  /(^|\/)meta-llama\/llama-4-/i,
+  // Nova lite/pro/premier take images; nova-micro is text-only.
+  /(^|\/)amazon\/nova-(?:2-)?(?:lite|pro|premier)/i,
+  // Grok 4 and up.
+  /(^|\/)x-ai\/grok-4/i,
+  // Mistral's multimodal tiers: small 3.2 and the medium 3 line.
+  /(^|\/)mistralai\/mistral-(?:small-3\.2|medium-3)/i
+];
+function acceptsImages(modelId) {
+  return VISION_PATTERNS.some((re) => re.test(modelId));
+}
+__name(acceptsImages, "acceptsImages");
+function visionInput(modelId) {
+  return acceptsImages(modelId) ? ["text", "image"] : ["text"];
+}
+__name(visionInput, "visionInput");
+
+// src/providers/phala/aci-verifier/errors.ts?ext=privateer-privacy
+var AciError = class extends Error {
+  static {
+    __name(this, "AciError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "AciError";
+  }
+};
+var AciFormatError = class extends AciError {
+  static {
+    __name(this, "AciFormatError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "AciFormatError";
+  }
+};
+
+// src/providers/phala/aci-verifier/jcs.ts?ext=privateer-privacy
+function canonicalize(value) {
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number":
+      if (!Number.isInteger(value)) {
+        throw new AciFormatError(
+          `JCS: ACI restricts numbers to integers, got ${value} (\xA73)`
+        );
+      }
+      return Object.is(value, -0) ? "0" : String(value);
+    case "string":
+      return JSON.stringify(value);
+    case "object":
+      if (Array.isArray(value)) {
+        return "[" + value.map(canonicalize).join(",") + "]";
+      }
+      return serializeObject(value);
+    default:
+      throw new AciFormatError(`JCS: unsupported type ${typeof value}`);
+  }
+}
+__name(canonicalize, "canonicalize");
+function serializeObject(obj) {
+  const keys = Object.keys(obj).filter((k) => obj[k] !== void 0).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  let out = "{";
+  for (let i = 0; i < keys.length; i++) {
+    const k = keys[i];
+    if (i > 0) out += ",";
+    out += JSON.stringify(k) + ":" + canonicalize(obj[k]);
+  }
+  return out + "}";
+}
+__name(serializeObject, "serializeObject");
+function jcsBytes(value) {
+  return new TextEncoder().encode(canonicalize(value));
+}
+__name(jcsBytes, "jcsBytes");
+
+// src/providers/phala/aci-verifier/crypto.ts?ext=privateer-privacy
+var subtle = globalThis.crypto.subtle;
+function toHex(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+__name(toHex, "toHex");
+function fromHex(hex) {
+  const h = hex.startsWith("0x") || hex.startsWith("0X") ? hex.slice(2) : hex;
+  if (h.length % 2 !== 0) {
+    throw new AciFormatError(`hex string has odd length: ${hex.length} chars`);
+  }
+  const out = new Uint8Array(h.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const byte = Number.parseInt(h.slice(i * 2, i * 2 + 2), 16);
+    if (Number.isNaN(byte)) {
+      throw new AciFormatError(`invalid hex at offset ${i * 2}: "${h.slice(i * 2, i * 2 + 2)}"`);
+    }
+    out[i] = byte;
+  }
+  return out;
+}
+__name(fromHex, "fromHex");
+async function sha256(bytes) {
+  return new Uint8Array(await subtle.digest("SHA-256", bytes));
+}
+__name(sha256, "sha256");
+async function sha256Hex(bytes) {
+  return toHex(await sha256(bytes));
+}
+__name(sha256Hex, "sha256Hex");
+async function sha256Prefixed(bytes) {
+  return "sha256:" + await sha256Hex(bytes);
+}
+__name(sha256Prefixed, "sha256Prefixed");
+
+// src/providers/phala/aci-verifier/digest.ts?ext=privateer-privacy
+var DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+var NONCE_RE = /^[0-9a-f]{64}$/;
+async function computeKeysetDigest(keyset) {
+  return sha256Prefixed(jcsBytes(keyset));
+}
+__name(computeKeysetDigest, "computeKeysetDigest");
+function attestationStatement(keysetDigest, nonce) {
+  if (!DIGEST_RE.test(keysetDigest)) {
+    throw new AciFormatError(`keyset digest is not sha256:<64-hex>: "${keysetDigest}"`);
+  }
+  if (nonce != null && !NONCE_RE.test(nonce)) {
+    throw new AciFormatError("nonce must be exactly 64 lowercase hex characters (\xA73.2)");
+  }
+  const noncePart = nonce == null ? "null" : `"${nonce}"`;
+  return new TextEncoder().encode(
+    `{"keyset_digest":"${keysetDigest}","nonce":${noncePart},"purpose":"aci.report_data.v1"}`
+  );
+}
+__name(attestationStatement, "attestationStatement");
+async function computeReportData(keysetDigest, nonce) {
+  return sha256Hex(attestationStatement(keysetDigest, nonce));
+}
+__name(computeReportData, "computeReportData");
+
+// src/providers/phala/aci-verifier/e2ee-channel.ts?ext=privateer-privacy
+var subtle2 = globalThis.crypto.subtle;
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+var HKDF_INFO = enc.encode("aci.e2ee.v2.x25519");
+
+// src/providers/phala/aci-verifier/report.ts?ext=privateer-privacy
+async function verifyReportBinding(report, nonce, options = {}) {
+  const now = options.now ?? Math.floor(Date.now() / 1e3);
+  const checks = [];
+  const versionOk = report.api_version === "aci/1";
+  checks.push({
+    name: "api_version",
+    ok: versionOk,
+    ...versionOk ? {} : { detail: `api_version "${report.api_version}" is not "aci/1"` }
+  });
+  const keysetValue = report.attestation.workload_keyset;
+  if (keysetValue === null || typeof keysetValue !== "object" || Array.isArray(keysetValue)) {
+    const detail = "workload_keyset is not a JSON object";
+    for (const name of ["workload_keyset_digest", "report_data", "not_after"]) {
+      checks.push({ name, ok: false, detail });
+    }
+    return { ok: false, checks };
+  }
+  const digest = await computeKeysetDigest(keysetValue);
+  pushEqual(checks, "workload_keyset_digest", report.workload_keyset_digest, digest);
+  const expectedReportData = await computeReportData(digest, nonce);
+  pushEqual(checks, "report_data", report.attestation.report_data, expectedReportData);
+  const keyset = keysetValue;
+  if (typeof keyset.not_after !== "number") {
+    checks.push({
+      name: "not_after",
+      ok: false,
+      detail: "keyset has no numeric not_after"
+    });
+  } else {
+    const ok = now < keyset.not_after;
+    checks.push({
+      name: "not_after",
+      ok,
+      ...ok ? {} : { detail: `now ${now} >= not_after ${keyset.not_after}` }
+    });
+  }
+  return {
+    ok: checks.every((c2) => c2.ok),
+    checks,
+    workloadKeysetDigest: digest,
+    keyset
+  };
+}
+__name(verifyReportBinding, "verifyReportBinding");
+function pushEqual(checks, name, actual, expected) {
+  const ok = actual === expected;
+  checks.push({ name, ok, ...ok ? {} : { detail: `report ${actual} != recomputed ${expected}` } });
+}
+__name(pushEqual, "pushEqual");
+
+// src/providers/phala/measurements.ts?ext=privateer-privacy
+import { createHash as createHash2 } from "node:crypto";
+var RTMR_KEYS = ["rtMr0", "rtMr1", "rtMr2", "rtMr3"];
+function parseEventLog(raw) {
+  let value = raw;
+  if (typeof raw === "string") {
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      return [];
+    }
+  }
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (e) => !!e && typeof e === "object" && typeof e.imr === "number" && typeof e.digest === "string"
+  );
+}
+__name(parseEventLog, "parseEventLog");
+function replayRtmrs(events) {
+  const out = {};
+  RTMR_KEYS.forEach((key, imr) => {
+    let acc = Buffer.alloc(48);
+    for (const ev of events) {
+      if (ev.imr !== imr) continue;
+      let digest;
+      try {
+        digest = Buffer.from(ev.digest, "hex");
+      } catch {
+        continue;
+      }
+      acc = createHash2("sha384").update(Buffer.concat([acc, digest])).digest();
+    }
+    out[key] = acc.toString("hex");
+  });
+  return out;
+}
+__name(replayRtmrs, "replayRtmrs");
+function appIdentityFrom(events) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const ev of events) {
+    if (ev.imr === 3 && ev.event && typeof ev.event_payload === "string" && ev.event_payload) {
+      byName.set(ev.event, ev.event_payload);
+    }
+  }
+  return {
+    appId: byName.get("app-id"),
+    composeHash: byName.get("compose-hash"),
+    osImageHash: byName.get("os-image-hash"),
+    instanceId: byName.get("instance-id"),
+    mrKms: byName.get("mr-kms"),
+    keyProvider: byName.get("key-provider")
+  };
+}
+__name(appIdentityFrom, "appIdentityFrom");
+function computeComposeHash(appCompose) {
+  if (typeof appCompose !== "string" || !appCompose) return void 0;
+  return createHash2("sha256").update(Buffer.from(appCompose, "utf8")).digest("hex");
+}
+__name(computeComposeHash, "computeComposeHash");
+function checkReportConsistency(args) {
+  const checks = [];
+  const skipped = [];
+  if (args.events.length === 0) {
+    skipped.push("rtmr-replay");
+  } else {
+    const replayed = replayRtmrs(args.events);
+    for (const key of RTMR_KEYS) {
+      const ok = replayed[key] === args.quoted[key];
+      checks.push({
+        name: `rtmr-replay:${key}`,
+        ok,
+        detail: ok ? void 0 : `replayed ${replayed[key].slice(0, 16)}\u2026 but the quote signed ${args.quoted[key].slice(0, 16)}\u2026`
+      });
+    }
+  }
+  const computed = computeComposeHash(args.appCompose);
+  if (!computed || !args.identity.composeHash) {
+    skipped.push("compose-hash");
+  } else {
+    const ok = computed === args.identity.composeHash;
+    checks.push({
+      name: "compose-hash",
+      ok,
+      detail: ok ? void 0 : `sha256(app_compose)=${computed.slice(0, 16)}\u2026 but the log attests ${args.identity.composeHash.slice(0, 16)}\u2026`
+    });
+  }
+  return { checks, ok: checks.every((c2) => c2.ok), skipped };
+}
+__name(checkReportConsistency, "checkReportConsistency");
+
+// src/providers/phala/pin.ts?ext=privateer-privacy
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join6 } from "node:path";
+var PIN_VERSION = 1;
+function pinPath() {
+  return join6(globalDir(), "phala-enclave-pin.json");
+}
+__name(pinPath, "pinPath");
+function readPin() {
+  try {
+    const parsed = JSON.parse(readFileSync8(pinPath(), "utf8"));
+    if (parsed?.v !== PIN_VERSION || !parsed.pin || typeof parsed.pin !== "object") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+__name(readPin, "readPin");
+function writePin(pin, firstSeenAt) {
+  try {
+    mkdirSync5(globalDir(), { recursive: true });
+    writeFileSync6(pinPath(), JSON.stringify({ v: PIN_VERSION, firstSeenAt, pin }, null, 2) + "\n", "utf8");
+  } catch {
+  }
+}
+__name(writePin, "writePin");
+function checkPin(current, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+  const stored = readPin();
+  if (!stored?.pin) {
+    const firstSeenAt = now();
+    writePin(current, firstSeenAt);
+    return { state: "first-seen", changed: [], firstSeenAt };
+  }
+  const changed = [];
+  for (const key of Object.keys(current)) {
+    const was = stored.pin[key];
+    const is = current[key];
+    if (was && is && was !== is) changed.push(`${key}: ${was.slice(0, 12)}\u2026 \u2192 ${is.slice(0, 12)}\u2026`);
+  }
+  if (changed.length === 0) return { state: "unchanged", changed: [], firstSeenAt: stored.firstSeenAt };
+  writePin(current, stored.firstSeenAt ?? now());
+  return { state: "changed", changed, firstSeenAt: stored.firstSeenAt };
+}
+__name(checkPin, "checkPin");
+
+// src/providers/phalaSeal.ts?ext=privateer-privacy
+var DEFAULT_ACCEPTABLE_TCB = ["UpToDate"];
+function relayBase() {
+  return `${serverBaseUrl().replace(/\/+$/, "")}/api/sealed/phala`;
+}
+__name(relayBase, "relayBase");
+function requireQuote() {
+  const v = process.env.PRIVATEER_PHALA_REQUIRE_QUOTE;
+  return !(v === "0" || v === "false");
+}
+__name(requireQuote, "requireQuote");
+function pccsUrl() {
+  return process.env.PRIVATEER_PHALA_PCCS_URL || void 0;
+}
+__name(pccsUrl, "pccsUrl");
+function acceptableTcb() {
+  const v = process.env.PRIVATEER_PHALA_TCB;
+  const list = v ? v.split(",").map((s) => s.trim()).filter(Boolean) : DEFAULT_ACCEPTABLE_TCB;
+  return new Set(list);
+}
+__name(acceptableTcb, "acceptableTcb");
+function extractQuoteMeasurements(report) {
+  const td = report.asTd10?.() ?? report.asTd15?.()?.base;
+  const fields = [td?.mrTd, td?.rtMr0, td?.rtMr1, td?.rtMr2, td?.rtMr3];
+  if (fields.some((f) => !f?.length)) return void 0;
+  const [mrTd, rtMr0, rtMr1, rtMr2, rtMr3] = fields.map((f) => toHex(new Uint8Array(f)));
+  return { mrTd, rtMr0, rtMr1, rtMr2, rtMr3 };
+}
+__name(extractQuoteMeasurements, "extractQuoteMeasurements");
+function extractQuoteReportData(report) {
+  const td10 = report.asTd10?.();
+  if (td10?.reportData) return new Uint8Array(td10.reportData);
+  const td15 = report.asTd15?.();
+  if (td15?.base?.reportData) return new Uint8Array(td15.base.reportData);
+  const data = report.data;
+  if (data?.reportData) return new Uint8Array(data.reportData);
+  throw new Error("phala: verified quote report has no reportData");
+}
+__name(extractQuoteReportData, "extractQuoteReportData");
+var attestationPromise = null;
+function attest() {
+  if (!attestationPromise) {
+    attestationPromise = establishAttestation().catch((err) => {
+      attestationPromise = null;
+      throw err;
+    });
+  }
+  return attestationPromise;
+}
+__name(attest, "attest");
+async function establishAttestation() {
+  const nonce = toHex(globalThis.crypto.getRandomValues(new Uint8Array(32)));
+  const res = await fetch(`${relayBase()}/attestation?nonce=${nonce}`, { method: "GET" });
+  if (!res.ok) throw new Error(`phala attestation HTTP ${res.status}`);
+  const report = await res.json();
+  const verification = await verifyReportBinding(report, nonce);
+  if (!verification.ok) {
+    const failed = verification.checks.filter((c2) => !c2.ok).map((c2) => c2.name).join(", ");
+    throw new Error(`phala attestation binding failed: ${failed}`);
+  }
+  const enclave = await verifyHardwareQuote(report);
+  return { report, verification, enclave };
+}
+__name(establishAttestation, "establishAttestation");
+async function verifyHardwareQuote(report) {
+  if (!requireQuote()) return void 0;
+  const attestation = report.attestation;
+  const teeType = String(attestation?.tee_type || "");
+  if (teeType !== "tdx") throw new Error(`phala: unsupported/absent tee_type "${teeType}" (only tdx is wired)`);
+  const quoteHex = attestation.evidence?.quote;
+  if (typeof quoteHex !== "string" || !quoteHex) throw new Error("phala: attestation evidence has no TDX quote");
+  const reportDataHex = String(attestation.report_data || "").toLowerCase();
+  if (!reportDataHex) throw new Error("phala: report has no report_data");
+  const { getCollateralAndVerify } = await import("./c-77GO5L5Y.mjs");
+  const verified = await getCollateralAndVerify(fromHex(quoteHex), pccsUrl());
+  const status = String(verified.status);
+  if (!acceptableTcb().has(status)) throw new Error(`phala: TDX quote TCB status not accepted: "${status}"`);
+  const quoteReportData = extractQuoteReportData(verified.report);
+  if (toHex(quoteReportData.slice(0, 32)) !== reportDataHex) {
+    throw new Error("phala: TDX quote report_data does not bind the attested report_data");
+  }
+  const declared = attestation.evidence?.quote_report_data;
+  if (typeof declared === "string" && declared && toHex(quoteReportData) !== declared.toLowerCase()) {
+    throw new Error("phala: evidence.quote_report_data does not match the verified quote");
+  }
+  const measurements = extractQuoteMeasurements(verified.report);
+  if (!measurements) return void 0;
+  const events = parseEventLog(attestation.evidence?.event_log);
+  const identity = appIdentityFrom(events);
+  const consistency = checkReportConsistency({
+    events,
+    quoted: measurements,
+    appCompose: attestation.evidence?.app_compose,
+    identity
+  });
+  if (!consistency.ok) {
+    const failed = consistency.checks.filter((c2) => !c2.ok).map((c2) => `${c2.name} (${c2.detail})`).join("; ");
+    throw new Error(`phala: attestation self-consistency failed: ${failed}`);
+  }
+  const pin = checkPin({
+    mrTd: measurements.mrTd,
+    rtMr0: measurements.rtMr0,
+    rtMr1: measurements.rtMr1,
+    rtMr2: measurements.rtMr2,
+    appId: identity.appId,
+    composeHash: identity.composeHash,
+    osImageHash: identity.osImageHash,
+    mrKms: identity.mrKms
+  });
+  const provenance = attestation.source_provenance;
+  const downstream = attestation.evidence?.downstream_tls_binding;
+  return {
+    measurements,
+    identity,
+    pin,
+    skippedChecks: consistency.skipped,
+    // Named so a human can go read the source; self-declared by the enclave and NOT
+    // proven by the quote (image_digest/image_provenance come back null), so it is a
+    // pointer to audit, never evidence that this binary came from that commit.
+    repoUrl: provenance?.repo_url,
+    repoCommit: provenance?.repo_commit,
+    // The attested enclave forwards to this downstream host over TLS. Surfaced because
+    // it marks where our attested boundary ENDS — that host is a separate trust domain
+    // we do not attest.
+    downstreamDomain: downstream?.domain,
+    downstreamSpkiSha256: downstream?.spki_sha256
+  };
+}
+__name(verifyHardwareQuote, "verifyHardwareQuote");
+async function attestPhala() {
+  try {
+    const { enclave } = await attest();
+    return { ok: true, enclaveIdentity: enclave };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+__name(attestPhala, "attestPhala");
+
+// src/providers/sealedShim.ts?ext=privateer-privacy
+function sealedEnabled() {
+  const v = process.env.PRIVATEER_SEALED;
+  return !(v === "0" || v === "false");
+}
+__name(sealedEnabled, "sealedEnabled");
+function sealedProviderFor(modelId) {
+  if (modelId.startsWith("tinfoil/")) return "tinfoil";
+  if (modelId.startsWith("phala/")) return "phala";
+  return null;
+}
+__name(sealedProviderFor, "sealedProviderFor");
+function relayBase2(provider) {
+  return `${serverBaseUrl().replace(/\/+$/, "")}/api/sealed/${provider}`;
+}
+__name(relayBase2, "relayBase");
+var clients = /* @__PURE__ */ new Map();
+var readyPromises = /* @__PURE__ */ new Map();
+function client(provider) {
+  let c2 = clients.get(provider);
+  if (!c2) {
+    const base = relayBase2(provider);
+    c2 = new SecureClient({ baseURL: base, attestationBundleURL: base, transport: "ehbp" });
+    clients.set(provider, c2);
+  }
+  return c2;
+}
+__name(client, "client");
+function ready(provider) {
+  let p = readyPromises.get(provider);
+  if (!p) {
+    p = client(provider).ready().catch((err) => {
+      readyPromises.delete(provider);
+      throw err;
+    });
+    readyPromises.set(provider, p);
+  }
+  return p;
+}
+__name(ready, "ready");
+async function attestSealed(provider) {
+  if (provider === "phala") return attestPhala();
+  try {
+    await ready(provider);
+    return { ok: true, enclave: client(provider).getEnclaveURL() };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
+__name(attestSealed, "attestSealed");
+var shimBase = null;
+function sealedShimBase() {
+  return shimBase;
+}
+__name(sealedShimBase, "sealedShimBase");
+
+// src/providers/account.ts?ext=privateer-privacy
+var DEFAULT_MODELS = [
+  ACCOUNT_DEFAULT_MODEL_ID,
+  ACCOUNT_NEAR_MODEL_ID,
+  // All three former defaults (see TINFOIL_MODEL_ID for the dates). They stay in the
+  // floor so a user who saved any of them as their own default still resolves it
+  // synchronously at launch, rather than falling through to "first model with
+  // configured auth" — the BYO dead end this seed list exists to prevent.
+  "tinfoil/gpt-oss-120b",
+  "tinfoil/kimi-k2-6",
+  "tinfoil/glm-5-2",
+  "anthropic/claude-opus-5",
+  "anthropic/claude-sonnet-5",
+  "openai/gpt-5.6-sol",
+  "deepseek/deepseek-v4-flash",
+  // 2026-08 releases, confirmed live on OpenRouter (ZDR-covered ids reach the
+  // account catalog automatically; these seeds just make them resolve at launch).
+  "moonshotai/kimi-k3",
+  "z-ai/glm-5.2",
+  // Both verified 2026-08-19 against /endpoints/zdr and GET /api/models: ZDR-covered
+  // and servable. Same reason as the line above — the live catalog already carries
+  // them, this only closes the first-launch window where a saved default that isn't
+  // yet in the cache would fall through to a BYO provider.
+  "x-ai/grok-4.6",
+  "openai/gpt-5.6-luna"
+];
+var DEFAULT_CONTEXT_WINDOW = 128e3;
+var MIN_PUBLISHED_CONTEXT_WINDOW = 8192;
+var MAX_PUBLISHED_CONTEXT_WINDOW = 1e7;
+function validContextWindow(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= MIN_PUBLISHED_CONTEXT_WINDOW && value <= MAX_PUBLISHED_CONTEXT_WINDOW ? Math.floor(value) : void 0;
+}
+__name(validContextWindow, "validContextWindow");
+var DEFAULT_MAX_OUTPUT_TOKENS = 16384;
+var ACCOUNT_MAX_OUTPUT_TOKENS = 32e3;
+var MIN_PUBLISHED_MAX_OUTPUT = 1024;
+function validMaxOutputTokens(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= MIN_PUBLISHED_MAX_OUTPUT ? Math.min(Math.floor(value), ACCOUNT_MAX_OUTPUT_TOKENS) : void 0;
+}
+__name(validMaxOutputTokens, "validMaxOutputTokens");
+function seedModel(id) {
+  return {
+    id,
+    name: id,
+    // reasoning + how to steer it, for the enclave models where we verified the
+    // control shape live; `reasoning: false` (Pi's "not a thinking model") for the rest.
+    ...thinkingProfile(id) ?? { reasoning: false },
+    // Honest modalities. This was hardcoded to text for the whole catalog, which made
+    // Pi strip every image from every account request — including the ones `read`
+    // attaches when the user points at a screenshot. See providers/vision.ts.
+    input: visionInput(id),
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    // The model's real window when the server published one, else the fallback.
+    // This is not cosmetic: pi sizes each turn's answer budget as
+    // (contextWindow − estimated prompt − 4096) and clamps max_tokens to it
+    // (pi-ai clampMaxTokensToContext, and see src/engine/contextBudget.ts). A window
+    // that under-states the model's real one therefore throttles the answer — and
+    // used to collapse it to a single token — while the model still has room.
+    contextWindow: accountContextWindow(id) ?? DEFAULT_CONTEXT_WINDOW,
+    // The model's real output cap when published. Not cosmetic either: reasoning and
+    // the answer share this one budget, and pi only compact-and-retries a length stop
+    // that ended BELOW it — a thinking model that spends all of a too-small budget
+    // reasoning ends the run with "Response was truncated before completion."
+    // (measured: glm-5.3-flash spending all 16384 on 50k+ chars of reasoning, whose
+    // real cap is far higher). See also ext/truncationRecovery.ts.
+    maxTokens: accountMaxOutputTokens(id) ?? DEFAULT_MAX_OUTPUT_TOKENS
+  };
+}
+__name(seedModel, "seedModel");
+var CHAT_TEMPLATE_THINKING = {
+  reasoning: true,
+  thinkingLevelMap: { minimal: null, low: null, high: null, xhigh: null },
+  compat: { thinkingFormat: "qwen-chat-template" }
+};
+var REASONING_EFFORT_THINKING = {
+  reasoning: true,
+  thinkingLevelMap: { off: "low", minimal: "low", xhigh: null }
+};
+var OPENROUTER_THINKING = {
+  reasoning: true,
+  thinkingLevelMap: { off: "low", minimal: "low" },
+  compat: { thinkingFormat: "openrouter" }
+};
+var PROXIED_THINKING_MODEL = [
+  /^google\/gemini-/i,
+  //           gemini-2.5+ all take an effort; gemma-* deliberately excluded
+  /^z-ai\/glm-/i,
+  //                the whole GLM line reasons, vision variants included
+  /^deepseek\/deepseek-(r1|v3\.[12]|v4)/i,
+  // NOT deepseek-chat*, which is the non-thinking split
+  /^x-ai\/grok-4/i,
+  //              grok-4.x; grok-build-0.1 is unprobed
+  /^openai\/gpt-(5|6|oss)/i
+  //     gpt-4*/gpt-3.5* do not reason
+];
+var NON_THINKING_VARIANT = /(?:^|[-/])(?:chat|instruct)(?:[-.]|$)/i;
+var TEE_MODEL = /^(tinfoil|phala|near)\//;
+function teeThinkingProfile(id) {
+  if (/instruct/i.test(id)) return null;
+  if (/gpt-oss/i.test(id)) return REASONING_EFFORT_THINKING;
+  if (/glm|qwen/i.test(id)) return CHAT_TEMPLATE_THINKING;
+  return null;
+}
+__name(teeThinkingProfile, "teeThinkingProfile");
+function proxiedThinkingProfile(id) {
+  if (NON_THINKING_VARIANT.test(id)) return null;
+  return PROXIED_THINKING_MODEL.some((re) => re.test(id)) ? OPENROUTER_THINKING : null;
+}
+__name(proxiedThinkingProfile, "proxiedThinkingProfile");
+function thinkingProfile(id) {
+  const profile = TEE_MODEL.test(id) ? teeThinkingProfile(id) : proxiedThinkingProfile(id);
+  return profile && { ...profile, thinkingLevelMap: { ...profile.thinkingLevelMap }, ...profile.compat ? { compat: { ...profile.compat } } : {} };
+}
+__name(thinkingProfile, "thinkingProfile");
+var CATALOG_CACHE_MAX = 2e3;
+function catalogCachePath() {
+  return join7(globalDir(), "account-models.json");
+}
+__name(catalogCachePath, "catalogCachePath");
+var cachedCapabilities = null;
+function cachedCapabilityMaps() {
+  if (cachedCapabilities) return cachedCapabilities;
+  cachedCapabilities = { windows: /* @__PURE__ */ new Map(), maxOutputs: /* @__PURE__ */ new Map() };
+  try {
+    const path = catalogCachePath();
+    if (existsSync4(path)) {
+      const parsed = JSON.parse(readFileSync9(path, "utf8"));
+      readCapability(parsed.windows, validContextWindow, cachedCapabilities.windows);
+      readCapability(parsed.maxOutputs, validMaxOutputTokens, cachedCapabilities.maxOutputs);
+    }
+  } catch {
+  }
+  return cachedCapabilities;
+}
+__name(cachedCapabilityMaps, "cachedCapabilityMaps");
+function readCapability(raw, valid, into) {
+  if (!raw || typeof raw !== "object") return;
+  for (const [id, value] of Object.entries(raw)) {
+    const n = valid(value);
+    if (n !== void 0 && into.size < CATALOG_CACHE_MAX) into.set(id, n);
+  }
+}
+__name(readCapability, "readCapability");
+function cachedContextWindows() {
+  return cachedCapabilityMaps().windows;
+}
+__name(cachedContextWindows, "cachedContextWindows");
+function loadCachedCatalogIds() {
+  try {
+    const path = catalogCachePath();
+    if (!existsSync4(path)) return [];
+    const parsed = JSON.parse(readFileSync9(path, "utf8"));
+    if (!Array.isArray(parsed.ids)) return [];
+    return parsed.ids.filter((id) => typeof id === "string" && id.length > 0).slice(0, CATALOG_CACHE_MAX);
+  } catch {
+    return [];
+  }
+}
+__name(loadCachedCatalogIds, "loadCachedCatalogIds");
+function isServableAccountModel(id) {
+  if (!id.startsWith("phala/")) return true;
+  return sealedEnabled() && sealedShimBase() !== null;
+}
+__name(isServableAccountModel, "isServableAccountModel");
+function seedCatalogIds() {
+  const ids = [...DEFAULT_MODELS];
+  const seen = new Set(ids);
+  for (const id of loadCachedCatalogIds()) {
+    if (!seen.has(id)) {
+      seen.add(id);
+      ids.push(id);
+    }
+  }
+  return ids;
+}
+__name(seedCatalogIds, "seedCatalogIds");
+var accountWindowMap = /* @__PURE__ */ new Map();
+function accountContextWindow(id) {
+  return accountWindowMap.get(id) ?? cachedContextWindows().get(id);
+}
+__name(accountContextWindow, "accountContextWindow");
+var accountMaxOutputMap = /* @__PURE__ */ new Map();
+function accountMaxOutputTokens(id) {
+  return accountMaxOutputMap.get(id) ?? cachedCapabilityMaps().maxOutputs.get(id);
+}
+__name(accountMaxOutputTokens, "accountMaxOutputTokens");
+function verificationLink(raw) {
+  const uri = (raw ?? "").trim();
+  if (!uri) return "";
+  if (/^https?:\/\//i.test(uri)) return uri;
+  return `https://${uri.replace(/^\/+/, "")}`;
+}
+__name(verificationLink, "verificationLink");
+var privateerOAuthProvider = {
+  name: "Privateer account",
+  usesCallbackServer: false,
+  // Pi's login dialog passes `signal` (its cancel AbortController) alongside the
+  // callbacks. We MUST thread it into runDeviceLogin — otherwise escape/ctrl+c
+  // aborts the dialog's signal but our poll loop never sees it, the login()
+  // promise never settles, and Pi never restores the editor: the "Waiting for
+  // authentication…" screen hangs with no way out. See auth/privateer.ts
+  // pollForToken, which checks the signal and rejects with "Login cancelled.".
+  async login(cb) {
+    let wasLinked = hasCredentials();
+    if (wasLinked && cb.onSelect) {
+      const user = currentUser();
+      const who = user?.email ?? user?.id ?? "this account";
+      const choice = await cb.onSelect({
+        message: `Already signed in as ${who}.`,
+        options: [
+          { id: "keep", label: `Stay signed in as ${who}` },
+          { id: "switch", label: "Sign in as a different account (signs this machine out first)" }
+        ]
+      });
+      if (choice === void 0) throw new Error("Login cancelled");
+      if (choice === "switch") {
+        await logout();
+        wasLinked = false;
+      }
+    }
+    if (!wasLinked) {
+      try {
+        await runDeviceLogin({
+          signal: cb.signal,
+          onCode: /* @__PURE__ */ __name((code) => {
+            const uri = verificationLink(code.verification_uri_complete ?? code.verification_uri);
+            if (uri && canOpenBrowser()) void openInBrowser(uri);
+            cb.onDeviceCode?.({
+              userCode: code.user_code,
+              verificationUri: uri,
+              intervalSeconds: code.interval,
+              expiresInSeconds: code.expires_in
+            });
+          }, "onCode")
+        });
+      } catch (e) {
+        if (cb.signal?.aborted) throw new Error("Login cancelled");
+        throw e;
+      }
+    }
+    if (cb.signal?.aborted) throw new Error("Login cancelled");
+    const creds = await accountCredential();
+    ensurePiDefaultModel();
+    notifySignedIn();
+    return creds;
+  },
+  async refreshToken(creds) {
+    const mine = armSlot().cred?.refresh;
+    const refresh = mine && creds.refresh !== mine ? mine : creds.refresh;
+    let next;
+    try {
+      next = await refreshAccountCredentials(refresh);
+    } catch {
+      next = await acquireAccountCredential();
+    }
+    rememberAccountCredential(next);
+    return next;
+  },
+  getApiKey(creds) {
+    return creds.access;
+  }
+};
+var TEE_PREFIXES = ["near/", "tinfoil/", "phala/"];
+function privateerChannel(modelId) {
+  return TEE_PREFIXES.some((p) => modelId.startsWith(p)) ? "tee" : "zdr";
+}
+__name(privateerChannel, "privateerChannel");
+async function accountPosture(modelId) {
+  if (privateerChannel(modelId) === "zdr") {
+    return { tier: "zdr-policy" };
+  }
+  const sealedProvider = sealedEnabled() ? sealedProviderFor(modelId) : null;
+  if (sealedProvider) {
+    const att = await attestSealed(sealedProvider);
+    return att.ok ? { tier: "tee-verified", enclaveIdentity: att.enclaveIdentity } : { tier: "tee-unverified", error: att.error };
+  }
+  if (!modelId.startsWith("near/")) {
+    return { tier: "tee-unverified" };
+  }
+  try {
+    const res = await authedFetch(
+      `${serverBaseUrl()}/api/models/near/attestation?model=${encodeURIComponent(modelId)}`
+    );
+    if (!res.ok) return { tier: "tee-unverified", error: `HTTP ${res.status}` };
+    const data = await res.json();
+    const att = interpretReport(modelId, data.nonce ?? "", data.report ?? {});
+    const tp = teePosture(att);
+    const tier = tierFromTeePosture(tp);
+    return { tier, teePosture: tp };
+  } catch (e) {
+    return { tier: "tee-unverified", error: e.message };
+  }
+}
+__name(accountPosture, "accountPosture");
+function modelEntry(id) {
+  const base = seedModel(id);
+  const provider = sealedEnabled() ? sealedProviderFor(id) : null;
+  const shim = sealedShimBase();
+  return provider && shim ? { ...base, baseUrl: `${shim}/${provider}/v1` } : base;
+}
+__name(modelEntry, "modelEntry");
+function accountProviderConfig(ids) {
+  return {
+    name: "Privateer account",
+    baseUrl: `${serverBaseUrl()}/api/agent/v1`,
+    api: "openai-completions",
+    oauth: privateerOAuthProvider,
+    // Filter HERE rather than at the catalog, so callers keep passing the server's
+    // full list and every registration re-evaluates servability against the CURRENT
+    // shim state. That is what lets the post-shim re-registration in makeAccountProvider
+    // put `phala/*` back: had the ids been filtered upstream, the sealed-only models
+    // would have been dropped from `lastIds` before the shim ever finished starting and
+    // nothing would have brought them back.
+    models: ids.filter(isServableAccountModel).map(modelEntry)
+  };
+}
+__name(accountProviderConfig, "accountProviderConfig");
+function registerAccountModels(pi) {
+  pi.registerProvider?.("privateer", accountProviderConfig(seedCatalogIds()));
+}
+__name(registerAccountModels, "registerAccountModels");
+var ARMED = /* @__PURE__ */ Symbol.for("privateer.accountCredential");
+function armSlot() {
+  const g = globalThis;
+  return g[ARMED] ??= {};
+}
+__name(armSlot, "armSlot");
+function rememberAccountCredential(cred) {
+  armSlot().cred = cred;
+}
+__name(rememberAccountCredential, "rememberAccountCredential");
+function liveAccountCredential() {
+  const cred = armSlot().cred;
+  return cred && cred.expires > Date.now() + 6e4 ? cred : void 0;
+}
+__name(liveAccountCredential, "liveAccountCredential");
+async function accountCredential() {
+  const live = liveAccountCredential();
+  if (live) return live;
+  const slot = armSlot();
+  slot.inFlight ??= acquireAccountCredential().then((cred) => {
+    slot.cred = cred;
+    return cred;
+  }).finally(() => {
+    slot.inFlight = void 0;
+  });
+  return slot.inFlight;
+}
+__name(accountCredential, "accountCredential");
+
+// src/config/privacyDisabled.ts?ext=privateer-privacy
+var ENV = "PRIVATEER_PRIVACY_OFF";
+var ALT_ENV = "PI_PRIVACY_OFF";
+var NO_QUARTER_PRIVACY_MARK = "PRIVATEER_PRIVACY_OFF_BY_NO_QUARTER";
+function privacyDisabled() {
+  return process.env[ENV] === "1" || process.env[ALT_ENV] === "1";
+}
+__name(privacyDisabled, "privacyDisabled");
+var listeners = /* @__PURE__ */ new Set();
+function setPrivacyDisabled(disabled) {
+  const before = privacyDisabled();
+  delete process.env[NO_QUARTER_PRIVACY_MARK];
+  if (disabled) {
+    process.env[ENV] = "1";
+    process.env[ALT_ENV] = "1";
+  } else {
+    delete process.env[ENV];
+    delete process.env[ALT_ENV];
+  }
+  if (before !== disabled) {
+    for (const fn of listeners) {
+      try {
+        fn(disabled);
+      } catch {
+      }
+    }
+  }
+  return disabled;
+}
+__name(setPrivacyDisabled, "setPrivacyDisabled");
+
+// src/permissions/noQuarter.ts?ext=privateer-privacy
+var ENV2 = "PRIVATEER_NO_QUARTER";
+function noQuarterActive() {
+  return process.env[ENV2] === "1";
+}
+__name(noQuarterActive, "noQuarterActive");
+
+// src/config/piiAllow.ts?ext=privateer-privacy
+import { readFileSync as readFileSync10, statSync as statSync2 } from "node:fs";
+
+// src/util/atomicWrite.ts?ext=privateer-privacy
+import { chmodSync as chmodSync5, realpathSync, renameSync as renameSync2, statSync, unlinkSync, writeFileSync as writeFileSync8 } from "node:fs";
+import { randomBytes as randomBytes2 } from "node:crypto";
+function writeFileAtomic(path, data, opts = {}) {
+  let target = path;
+  let mode = opts.mode ?? 384;
+  try {
+    target = realpathSync(path);
+    if (opts.mode === void 0) mode = statSync(target).mode & 511;
+  } catch {
+  }
+  const tmp = `${target}.${process.pid}.${randomBytes2(4).toString("hex")}.tmp`;
+  try {
+    writeFileSync8(tmp, data, { encoding: "utf8", mode });
+    try {
+      chmodSync5(tmp, mode);
+    } catch {
+    }
+    renameSync2(tmp, target);
+  } catch (e) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+    throw e;
+  }
+}
+__name(writeFileAtomic, "writeFileAtomic");
+
+// src/config/piiAllow.ts?ext=privateer-privacy
+var cached2 = [];
+var cachedStamp = "";
+function parse(raw) {
+  const list = raw?.privacy?.piiAllow;
+  if (!Array.isArray(list)) return [];
+  return list.filter((e) => typeof e === "string" && e.trim() !== "").map((e) => e.trim());
+}
+__name(parse, "parse");
+function piiAllowEntries() {
+  try {
+    const st = statSync2(configPath());
+    const stamp = `${st.mtimeMs}:${st.size}`;
+    if (stamp === cachedStamp) return cached2;
+    cachedStamp = stamp;
+    cached2 = parse(JSON.parse(readFileSync10(configPath(), "utf8")));
+  } catch {
+    cachedStamp = "";
+    cached2 = [];
+  }
+  return cached2;
+}
+__name(piiAllowEntries, "piiAllowEntries");
+function invalidate() {
+  cachedStamp = "";
+}
+__name(invalidate, "invalidate");
+function invalidReason(entry) {
+  if (!entry) return "an empty entry matches nothing";
+  if (/^\*+$/.test(entry)) return "a bare `*` would allowlist everything \u2014 turn the gate off explicitly if that's what you mean";
+  return void 0;
+}
+__name(invalidReason, "invalidReason");
+function write(entries) {
+  let cfg = {};
+  try {
+    cfg = JSON.parse(readFileSync10(configPath(), "utf8"));
+  } catch {
+  }
+  const privacy2 = { ...cfg.privacy ?? {}, piiAllow: entries };
+  writeFileAtomic(configPath(), JSON.stringify({ ...cfg, privacy: privacy2 }, null, 2) + "\n");
+  invalidate();
+}
+__name(write, "write");
+function addPiiAllow(raw) {
+  const entry = raw.trim();
+  const bad = invalidReason(entry);
+  if (bad) return { ok: false, message: bad, entries: piiAllowEntries() };
+  const entries = [...piiAllowEntries()];
+  if (entries.includes(entry)) return { ok: true, message: `${entry} is already allowlisted`, entries };
+  entries.push(entry);
+  write(entries);
+  return { ok: true, message: `${entry} is no longer treated as PII in this and future sessions`, entries };
+}
+__name(addPiiAllow, "addPiiAllow");
+function removePiiAllow(raw) {
+  const entry = raw.trim();
+  const entries = [...piiAllowEntries()];
+  const i = entries.indexOf(entry);
+  if (i < 0) return { ok: false, message: `${entry || "(empty)"} is not in the allowlist`, entries };
+  entries.splice(i, 1);
+  write(entries);
+  return { ok: true, message: `${entry} is gated again`, entries };
+}
+__name(removePiiAllow, "removePiiAllow");
+
+// src/ui/palette.ts?ext=privateer-privacy
+var ESC = "\x1B[";
+var RESET = `${ESC}0m`;
+var BOLD = `${ESC}1m`;
+var c = /* @__PURE__ */ __name((n) => `${ESC}38;5;${n}m`, "c");
+var FALLBACK = {
+  RESET,
+  BOLD,
+  INK: c(231),
+  ACCENT: c(231),
+  BORDER: c(231),
+  DIM: `${ESC}90m`,
+  GREEN: `${ESC}32m`,
+  YELLOW: `${ESC}33m`,
+  RED: `${ESC}31m`,
+  SKY: c(117),
+  WHITE: c(231)
+};
+function paletteFor(theme) {
+  if (!theme || typeof theme.getFgAnsi !== "function") return FALLBACK;
+  const g = /* @__PURE__ */ __name((name, fallback) => {
+    try {
+      const a = theme.getFgAnsi(name);
+      return typeof a === "string" && a.length > 0 ? a : fallback;
+    } catch {
+      return fallback;
+    }
+  }, "g");
+  return {
+    RESET,
+    BOLD,
+    INK: g("text", FALLBACK.INK),
+    ACCENT: g("accent", FALLBACK.ACCENT),
+    BORDER: g("border", FALLBACK.BORDER),
+    DIM: g("dim", FALLBACK.DIM),
+    GREEN: g("success", FALLBACK.GREEN),
+    YELLOW: g("warning", FALLBACK.YELLOW),
+    RED: g("error", FALLBACK.RED),
+    // Fixed colours, not theme tokens — but a pale blue or white vanishes on a light
+    // background, so a light theme gets a deeper blue and plain ink instead.
+    ...lightAppearance(theme) ? { SKY: c(32), WHITE: g("text", FALLBACK.INK) } : { SKY: FALLBACK.SKY, WHITE: FALLBACK.WHITE }
+  };
+}
+__name(paletteFor, "paletteFor");
+function lightAppearance(theme) {
+  try {
+    return theme.appearance === "light";
+  } catch {
+    return false;
+  }
+}
+__name(lightAppearance, "lightAppearance");
+var CLI_DARK = {
+  RESET,
+  BOLD,
+  DIM: `${ESC}2m`,
+  GREEN: `${ESC}32m`,
+  YELLOW: `${ESC}33m`,
+  RED: `${ESC}31m`,
+  CYAN: `${ESC}36m`
+};
+var CLI_LIGHT = {
+  RESET,
+  BOLD,
+  DIM: c(243),
+  // solid medium gray instead of faint
+  GREEN: c(28),
+  // dark green
+  YELLOW: c(130),
+  // dark amber (plain 33m is invisible-pale on white)
+  RED: c(124),
+  // dark red
+  CYAN: c(24)
+  // dark teal-blue accent
+};
+function detectScheme(env = process.env) {
+  const fgbg = env.COLORFGBG;
+  if (fgbg) {
+    const parts = fgbg.split(";");
+    const bg = parseInt(parts[parts.length - 1], 10);
+    if (!Number.isNaN(bg)) return bg === 7 || bg === 15 ? "light" : "dark";
+  }
+  return "dark";
+}
+__name(detectScheme, "detectScheme");
+function cliPalette(scheme = detectScheme()) {
+  return scheme === "light" ? CLI_LIGHT : CLI_DARK;
+}
+__name(cliPalette, "cliPalette");
+
+// extensions/privateer-posture.ts?ext=privateer-privacy
+var DOT = { green: "\u{1F7E2}", yellow: "\u{1F7E1}", red: "\u{1F534}", neutral: "\u26AA" };
+function badgeLabel(tier, p) {
+  if (tier === "tee-verified") return `${p.GREEN}\u26C9 Trusted Execution${p.RESET}`;
+  if (tier === "tee-unverified") return `${p.YELLOW}\u26C9 Trusted Execution (unconfirmed)${p.RESET}`;
+  return null;
+}
+__name(badgeLabel, "badgeLabel");
+async function badgeFor(provider, modelId, p) {
+  const res = provider === "privateer" ? await accountPosture(modelId) : await verifyModelPosture(provider, modelId, {
+    apiKey: provider === "nearai" ? process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY : void 0
+  });
+  const shield = badgeLabel(res.tier, p);
+  if (shield) return shield;
+  const info = TIERS[res.tier];
+  return `${DOT[info.posture] ?? "\u26AA"} ${info.label}`;
+}
+__name(badgeFor, "badgeFor");
+async function updatePostureBadge(ctx, provider, modelId) {
+  if (!ctx?.ui?.setStatus) return;
+  if (privacyDisabled()) {
+    ctx.ui.setStatus("privacy", "\u2691 privacy off");
+    ctx.ui.setStatus("pi-privacy", void 0);
+    return;
+  }
+  const p = provider ?? ctx?.model?.provider;
+  const m = modelId ?? ctx?.model?.id;
+  if (!p || !m) {
+    ctx.ui.setStatus("privacy", void 0);
+    return;
+  }
+  try {
+    ctx.ui.setStatus("privacy", "\u26C9 \u2026");
+    const badge = await badgeFor(p, m, paletteFor(ctx?.ui?.theme));
+    ctx.ui.setStatus("privacy", badge);
+  } catch {
+    ctx.ui.setStatus("privacy", void 0);
+  }
+}
+__name(updatePostureBadge, "updatePostureBadge");
+
+// src/config/privacyPolicy.ts?ext=privateer-privacy
+function renderPiiAutoRedact(notice) {
+  const p = cliPalette(detectScheme());
+  const body = notice.startsWith("\u2691 ") ? notice.slice(2) : notice;
+  return `${p.RED}\u2691${p.RESET} ${p.CYAN}${body}${p.RESET} ${p.DIM}\xB7 /privacy allow <value> if it shouldn't be masked${p.RESET}`;
+}
+__name(renderPiiAutoRedact, "renderPiiAutoRedact");
+function sharedPrivacyOptions() {
+  const ambient = loadConfig();
+  return {
+    ...ambient,
+    disabled: privacyDisabled,
+    // The account channel's real posture. pi-privacy ships a `privateer` provider, but it
+    // is the PUBLIC developer-key channel (sk-priv-…, server-proxied and unverifiable
+    // end-to-end), so from the package alone every privateer/* model floors to
+    // zdr-policy. The in-app ACCOUNT channel is a different thing — its own OAuth
+    // session, account server and sealed relay — and only the host can say what it
+    // resolves to: tee-verified for a quote WE checked over the sealed path,
+    // tee-unverified for a proxied enclave we can't bind to this connection, zdr-policy
+    // for the ZDR-channel models. Without this hook a session running an ATTESTED TEE
+    // model is judged unverified, so the badge lies and the PII gate asks about every
+    // turn — the over-warning c2ee0fa fixed for the terminal and nowhere else.
+    resolveTier: /* @__PURE__ */ __name(async (provider, modelId) => {
+      if (provider !== "privateer") return void 0;
+      return (await accountPosture(modelId)).tier;
+    }, "resolveTier"),
+    // pi-privacy ships its own `/models`, a plain select over the models you hold keys
+    // for. Ours (extensions/privateer-models.ts) is the searchable one over the whole
+    // account catalog, and with both registered Pi renamed them /models:1 and /models:2 —
+    // so typing `/models` could land you in the short, unsearchable list.
+    modelPicker: false,
+    // No quarter = unattended. No quarter also takes the whole filter down (noQuarter.ts),
+    // so this only answers when the operator has run `/privacy on` with the moat down.
+    // The PII send-or-redact question would stall a session the
+    // operator explicitly stepped away from, so pi-privacy swallows it the SAFE way —
+    // redact, then send — and reports what it masked as output instead of asking. A live
+    // function, not a boolean: shift+tab / `/no-quarter` flips this mid-session and the
+    // gate re-reads it on every request.
+    piiUnattended: noQuarterActive,
+    renderPiiAutoRedact,
+    // pi-privacy's INGEST gate: credentials arriving in a tool result are masked before
+    // they enter context (otherwise they're re-sent every turn and written to the session
+    // file on disk). We already redact tool output in src/ext/permissionGate.ts, so its
+    // default "warn" would put an interactive prompt in front of something this app has
+    // always handled silently — "redact" keeps our UX and still takes the added coverage.
+    //
+    // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
+    // ours masks the configured provider keys by exact value (from env/config) plus the
+    // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
+    // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
+    // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which our
+    // patterns match.
+    //
+    // Order between the two is NOT guaranteed: pi discovers extensions with a bare
+    // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this box
+    // today, not by contract). "redact" makes that moot — both handlers run
+    // unconditionally and each masks its own patterns, so the surviving content is the
+    // same either way. Under "warn" the order WOULD matter, since it decides whether the
+    // prompt is raised on a raw key or one we already masked.
+    toolResultPolicy: ambient.toolResultPolicy ?? "redact",
+    // The operator's own "that is not personal data" list, read LIVE (see
+    // ./piiAllow.ts): `/privacy allow @acme.com` applies on the next turn, not the next
+    // launch. Ambient config entries come first — both lists are additive, since an
+    // allowlist can only ever remove detection and there is no sense in which one of
+    // them should silence the other.
+    piiAllow: /* @__PURE__ */ __name(() => [...ambient.piiAllow ?? [], ...piiAllowEntries()], "piiAllow")
+  };
+}
+__name(sharedPrivacyOptions, "sharedPrivacyOptions");
+function registerPrivacyCommand(pi) {
+  const handler = /* @__PURE__ */ __name(async (args, ctx) => {
+    const raw = String(args ?? "").trim();
+    const [verb, ...rest] = raw.split(/\s+/);
+    const value = rest.join(" ").trim();
+    const notify = /* @__PURE__ */ __name((msg, level = "info") => ctx?.ui?.notify?.(msg, level), "notify");
+    if (verb === "off" || verb === "disable") {
+      setPrivacyDisabled(true);
+      await updatePostureBadge(ctx);
+      return notify(
+        "\u2691 pi-privacy is completely OFF for this session. Outbound requests will not be scanned or gated for PII, and tool exfiltration, result, and downgrade guards are disabled. Run /privacy on to restore.",
+        "warning"
+      );
+    }
+    if (verb === "on" || verb === "enable" || verb === "restore") {
+      setPrivacyDisabled(false);
+      await updatePostureBadge(ctx);
+      return notify(
+        "pi-privacy is ON for this session. PII scanning, tool exfiltration guards, and privacy checks restored.",
+        "info"
+      );
+    }
+    if (verb === "status") {
+      const state2 = privacyDisabled() ? "OFF (disabled for this session)" : "ON (active)";
+      const mine2 = piiAllowEntries();
+      return notify(
+        [
+          `pi-privacy status: ${state2}`,
+          mine2.length ? `PII allowlist (~/.privateer/config.json):
+  ${mine2.join("\n  ")}` : "PII allowlist: empty",
+          "Reserved shapes (example.com, loopback, noreply@\u2026) are allowed by default.",
+          "Commands: /privacy off | /privacy on | /privacy status | /privacy allow <value> | /privacy unallow <value>"
+        ].join("\n"),
+        "info"
+      );
+    }
+    if (verb === "allow" || verb === "unallow") {
+      if (!value) return notify(`usage: /privacy ${verb} <value>`, "warning");
+      const r = verb === "allow" ? addPiiAllow(value) : removePiiAllow(value);
+      return notify(r.message, r.ok ? "info" : "warning");
+    }
+    if (verb && verb !== "help") {
+      return notify(`unknown option "${verb}" \u2014 usage: /privacy [off | on | status | allow <value> | unallow <value>]`, "warning");
+    }
+    const state = privacyDisabled() ? "OFF (disabled for this session)" : "ON (active)";
+    const mine = piiAllowEntries();
+    notify(
+      [
+        `pi-privacy status: ${state}`,
+        mine.length ? `PII allowlist (~/.privateer/config.json):
+  ${mine.join("\n  ")}` : "PII allowlist: empty",
+        "Reserved shapes (example.com, loopback, noreply@\u2026) are allowed by default and not listed here.",
+        "Commands:",
+        "  /privacy off              \u2014 turn off pi-privacy completely for this session",
+        "  /privacy on               \u2014 restore pi-privacy protections",
+        "  /privacy status           \u2014 show current status and allowlist",
+        "  /privacy allow <value>    \u2014 add value to PII allowlist",
+        "  /privacy unallow <value>  \u2014 remove value from PII allowlist"
+      ].join("\n"),
+      "info"
+    );
+  }, "handler");
+  const spec = {
+    description: "Manage privacy protections: /privacy [off | on | status | allow <value> | unallow <value>]",
+    handler,
+    getArgumentCompletions: /* @__PURE__ */ __name((prefix) => {
+      const p = prefix.trim().toLowerCase();
+      const verbs = ["off", "on", "status", "allow", "unallow"];
+      return verbs.filter((v) => v.startsWith(p)).map((v) => ({ value: v, label: v }));
+    }, "getArgumentCompletions")
+  };
+  pi.registerCommand?.("privacy", spec);
+  pi.registerCommand?.("pi-privacy", {
+    ...spec,
+    description: "Alias for /privacy: /pi-privacy [off | on | status | allow <value> | unallow <value>]"
+  });
+}
+__name(registerPrivacyCommand, "registerPrivacyCommand");
+function gatingPrivacyPi(pi) {
+  const on = /* @__PURE__ */ __name((event, handler) => {
+    if (typeof pi?.on !== "function") return;
+    if (typeof handler !== "function") return pi.on(event, handler);
+    if (event === "before_provider_request" || event === "tool_call" || event === "user_bash" || event === "tool_result" || event === "model_select") {
+      return pi.on(event, async (ev, ctx) => {
+        if (privacyDisabled()) return void 0;
+        return handler(ev, ctx);
+      });
+    }
+    return pi.on(event, handler);
+  }, "on");
+  const registerCommand = /* @__PURE__ */ __name((name, spec) => {
+    if (typeof pi?.registerCommand !== "function") return;
+    if (name === "pii" && spec && typeof spec.handler === "function") {
+      const orig = spec.handler;
+      const wrappedHandler = /* @__PURE__ */ __name(async (args, ctx) => {
+        const raw = String(args ?? "").trim().toLowerCase();
+        const [verb] = raw.split(/\s+/);
+        if (verb === "off" || verb === "disable") {
+          setPrivacyDisabled(true);
+          await updatePostureBadge(ctx);
+        } else if (verb === "on" || verb === "enable" || verb === "restore") {
+          setPrivacyDisabled(false);
+          await updatePostureBadge(ctx);
+        }
+        return orig(args, ctx);
+      }, "wrappedHandler");
+      return pi.registerCommand(name, { ...spec, handler: wrappedHandler });
+    }
+    return pi.registerCommand(name, spec);
+  }, "registerCommand");
+  return new Proxy(pi, {
+    get(target, prop, receiver) {
+      if (prop === "on") return on;
+      if (prop === "registerCommand") return registerCommand;
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+__name(gatingPrivacyPi, "gatingPrivacyPi");
+function privacyExtension() {
+  const privacy2 = makePiPrivacyExtension(sharedPrivacyOptions());
+  return /* @__PURE__ */ __name(function privateerPrivacyCore(pi) {
+    privacy2(gatingPrivacyPi(persistingModelPicks(pi)));
+    registerPrivacyCommand(pi);
+  }, "privateerPrivacyCore");
+}
+__name(privacyExtension, "privacyExtension");
+function persistingModelPicks(pi) {
+  if (typeof pi?.setModel !== "function") return pi;
+  const setModel = /* @__PURE__ */ __name(async (model) => {
+    const ok = await pi.setModel(model);
+    if (ok !== false && model?.provider && model?.id) writePiDefaultModel(`${model.provider}/${model.id}`);
+    return ok;
+  }, "setModel");
+  return new Proxy(pi, {
+    get(target, prop, receiver) {
+      if (prop === "setModel") return setModel;
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+__name(persistingModelPicks, "persistingModelPicks");
+
+// extensions/privateer-privacy.ts?ext=privateer-privacy
+var TINFOIL_MODELS = [
+  "gemma4-31b",
+  "kimi-k2-6",
+  "glm-5-2",
+  "deepseek-v4-pro",
+  "gpt-oss-120b",
+  "gpt-oss-safeguard-120b",
+  "llama3-3-70b"
+];
+function tinfoilModel(id) {
+  return {
+    id,
+    name: id,
+    reasoning: false,
+    // Tinfoil ids are bare here (`gemma4-31b`), so scope it before asking — the
+    // allowlist is written against full `provider/model` ids. Getting this wrong is
+    // not cosmetic: `input` is what Pi checks before it will send an image at all.
+    input: visionInput(`tinfoil/${id}`),
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: 128e3,
+    maxTokens: 4096
+  };
+}
+__name(tinfoilModel, "tinfoilModel");
+var privacy = privacyExtension();
+function privateerPrivacy(pi) {
+  privacy(pi);
+  pi.registerProvider?.("tinfoil", {
+    name: "Tinfoil (private TEE inference)",
+    baseUrl: "https://inference.tinfoil.sh/v1",
+    api: "openai-completions",
+    apiKey: "${TINFOIL_API_KEY}",
+    authHeader: true,
+    models: TINFOIL_MODELS.map(tinfoilModel)
+  });
+  registerAccountModels(pi);
+}
+__name(privateerPrivacy, "privateerPrivacy");
+export {
+  privateerPrivacy as default
+};