privateer-agent 0.15.5 → 0.15.6

package/README.md

@@ -505,6 +505,17 @@ privateer -p --approve-in-app --approval-timeout 300 "make a 6s intro clip"
 `--max-spend` is checked before each call against the server's estimate for that call
 (`media_capabilities` shows the same prices). A call that can't be priced is refused.
 
+Piped input is waited for, however long the pipe stays silent
+(`pytest | privateer -p "why did this fail?"`). If a program starts Privateer with stdin
+open and never writes to it, a run that already has a prompt continues after 3 seconds.
+Scripts with nothing to send can skip the wait with `< /dev/null`.
+
+Before a one-shot run that used tools ends, Privateer asks the model to check its result
+against what actually happened and to open its final message with anything it invented,
+could not verify or lost. That is one extra model call; `PRIVATEER_FINAL_AUDIT=0` turns it
+off. If the provider goes silent mid-run, the request is resent up to twice before the run
+stops with an error.
+
 ## Hand off sensitive work
 
 Your coding agent's context goes to its provider. When a task touches files that shouldn't

package/bin/boot-bundle.d.mts

@@ -0,0 +1,2 @@
+export const BOOT_DIR: string;
+export function bootCliPath(repo: string, env?: NodeJS.ProcessEnv | Record<string, string | undefined>): string | null;

package/bin/boot-bundle.mjs

@@ -0,0 +1,44 @@
+// Which Pi entry should this launch run: the compiled boot build, or the source tree?
+// scripts/build-boot.mjs makes the build; docs/startup-performance.md explains why.
+//
+// The answer is the build only when it is certainly the same code as the source next
+// to it. Every other case returns null and the launcher runs from source, which is
+// slower and always correct, so nothing here is ever a reason a launch fails.
+
+import fs from "node:fs";
+import path from "node:path";
+
+export const BOOT_DIR = "dist-boot";
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/** Absolute path of the build's entry script, or null to run from source. */
+export function bootCliPath(repo, env = process.env) {
+  if (env.PRIVATEER_NO_BOOT_BUNDLE === "1") return null;
+
+  // A checkout is where source gets edited, and the build wouldn't see those edits.
+  if (fs.existsSync(path.join(repo, ".git")) && env.PRIVATEER_BOOT_BUNDLE !== "1") return null;
+
+  const dir = path.join(repo, BOOT_DIR);
+  const manifest = readJson(path.join(dir, "manifest.json"));
+  if (!manifest) return null;
+
+  // A build left behind by an upgrade is older code wearing the new version's name.
+  const pkg = readJson(path.join(repo, "package.json"));
+  if (!pkg || manifest.version !== pkg.version) return null;
+
+  // The build maps each file back to its place under <repo>/node_modules. A hoisted
+  // install (npx, or a dependency of another project) has no such place.
+  if (!fs.existsSync(path.join(repo, "node_modules", "@earendil-works", "pi-coding-agent", "package.json"))) {
+    return null;
+  }
+
+  const entry = path.join(dir, "boot.mjs");
+  return fs.existsSync(entry) && fs.existsSync(path.join(dir, "cli.mjs")) ? entry : null;
+}

package/bin/privateer-launch.mjs

@@ -34,6 +34,7 @@ import { runToCompletion } from "./run-to-completion.mjs";
 import { modelArgs } from "./model-args.mjs";
 import { filterRespawnArgs, listTerminals, requestFresh, runSupervised } from "./fresh-supervisor.mjs";
 import { configureCompileCache } from "./startup-cache.mjs";
+import { bootCliPath } from "./boot-bundle.mjs";
 import { sweepSessions } from "./session-seal.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
@@ -133,7 +134,16 @@ const BUNDLED = fs.existsSync(bundledNode) && fs.existsSync(path.join(REPO, "BUN
 // very node already running this script (a suitable >=22, since we booted under it).
 const NODE_BIN = BUNDLED ? bundledNode : process.execPath;
 // Make sure the chosen node's directory is on PATH for shebang-spawned grandchildren.
-process.env.PATH = path.dirname(NODE_BIN) + path.delimiter + (process.env.PATH || "");
+// The agent's own shells get that entry filtered back out (getShellEnv and the background
+// task registry, both patched): seeing a `node` the machine does not really have, it wrote
+// `#!/usr/bin/env node` tools that die the moment Privateer exits. PRIVATEER_NODE is how a
+// shell reaches this runtime on purpose. A directory the user already had on PATH stays.
+const runtimeDir = path.dirname(NODE_BIN);
+if (!(process.env.PATH || "").split(path.delimiter).includes(runtimeDir)) {
+  process.env.PRIVATEER_PRIVATE_RUNTIME_DIR = runtimeDir;
+}
+process.env.PRIVATEER_NODE = NODE_BIN;
+process.env.PATH = runtimeDir + path.delimiter + (process.env.PATH || "");
 
 const args = process.argv.slice(2);
 
@@ -754,6 +764,8 @@ else {
     );
     process.exit(1);
   }
+  // The compiled build when it is valid for this install, else the source tree.
+  const ENTRY = bootCliPath(REPO) ?? CLI;
   process.env.PI_CODING_AGENT_DIR = AGENT_DIR;
   // The binary pi-subagents spawns for each child, and the moat that child must load.
   //
@@ -924,7 +936,7 @@ else {
   // Supervised rather than runToCompletion: the launcher stays up so /fresh, a voice
   // command, or `privateer fresh` from another terminal can swap this agent for a new
   // process with the old tree reaped. Print/export/version runs have nothing to swap.
-  const tuiArgs = (launchArgs) => [...nodeArgs, CLI, ...modelArgsFor(launchArgs), ...extArgs, ...skillArgs, ...launchArgs];
+  const tuiArgs = (launchArgs) => [...nodeArgs, ENTRY, ...modelArgsFor(launchArgs), ...extArgs, ...skillArgs, ...launchArgs];
   // forwardSignals: a `kill` reaches only this launcher, and a -p run left behind keeps
   // working (and spending) with nobody waiting for its answer.
   if (isNonInteractive) runToCompletion(NODE_BIN, tuiArgs(args), { forwardSignals: true });

package/bin/privateer-verify.mjs

@@ -21,6 +21,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { findDepRoot } from "./apply-patches.mjs";
+import { BOOT_DIR, bootCliPath } from "./boot-bundle.mjs";
 
 const REGISTRY = process.env.npm_config_registry || "https://registry.npmjs.org";
 const NET_TIMEOUT_MS = 8000;
@@ -228,6 +229,17 @@ export async function verify({ repo, offline = false } = {}) {
     }
   }
 
+  // Which code a launch actually runs: the compiled build, when valid, is the patched
+  // source above in one place, so "patched" is only half the answer without this.
+  heading("Boot build");
+  const bootBuild = readJson(path.join(repo, BOOT_DIR, "manifest.json"));
+  if (bootCliPath(repo)) {
+    pass("compiled entry in use", `${bootBuild.modules} modules · pi ${bootBuild.pi}`);
+    note("built from this release's source and patches; PRIVATEER_NO_BOOT_BUNDLE=1 runs the source tree");
+  } else {
+    note(bootBuild ? "present but not used here, so launches run from source" : "none, so launches run from source");
+  }
+
   // --- 5. where config and credentials live -------------------------------
   heading("Config");
   const home = process.env.PRIVATEER_HOME || path.join(process.env.HOME || "", ".privateer");

package/dist-boot/boot.mjs

@@ -0,0 +1,3 @@
+import { fileURLToPath } from "node:url";
+process.argv[1] = fileURLToPath(new URL("../node_modules/@earendil-works/pi-coding-agent/dist/cli.js", import.meta.url));
+await import("./cli.mjs");