privateer-agent 0.2.1 → 0.3.1

package/src/cli/chat.ts

@@ -0,0 +1,243 @@
+// A lean interactive REPL — enough to actually USE the agent and test the moat
+// before the full pi-tui rewrite (Phase 6). Reuses everything built: the gate
+// (with terminal y/n approval), the pi-privacy extension (providers + attestation),
+// the EngineEvent adapter, and Pi's real session.
+//
+// Run:  nvm use && node --env-file=.env --import tsx src/cli/chat.ts
+// Model: PRIVATEER_MODEL=provider/id  (default openrouter/openai/gpt-4o-mini)
+//        e.g. tinfoil/llama3-3-70b to watch TEE posture go green.
+
+import "../boot.ts"; // env + attestation dispatcher, before any Pi import
+import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
+
+const RESET = "\x1b[0m", DIM = "\x1b[2m", CYAN = "\x1b[36m", YELLOW = "\x1b[33m", RED = "\x1b[31m", GREEN = "\x1b[32m";
+
+async function main() {
+  const readline = await import("node:readline");
+  const {
+    createAgentSessionServices,
+    createAgentSessionFromServices,
+    SessionManager,
+  } = await import("@earendil-works/pi-coding-agent");
+  const { createEngineEventAdapter } = await import("../bridge/engineAdapter.ts");
+  const { makePermissionGate } = await import("../ext/permissionGate.ts");
+  const { makePiPrivacyExtension, verifyModelPosture, TIERS } = await import("pi-privacy");
+  const { agentDir } = await import("../config/paths.ts");
+  const { RemoteBridge } = await import("../remote/remoteBridge.ts");
+  const { RelayClient } = await import("../remote/relayClient.ts");
+  const priv = await import("../auth/privateer.ts");
+  const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
+
+  const spec = process.env.PRIVATEER_MODEL ?? "openrouter/openai/gpt-4o-mini";
+  const slash = spec.indexOf("/");
+  const provider = spec.slice(0, slash);
+  const modelId = spec.slice(slash + 1);
+  const cwd = process.cwd();
+
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  let closed = false;
+  rl.on("close", () => (closed = true));
+  // Resolve to /quit if the input stream ends (EOF / Ctrl-D / piped input), incl.
+  // if it closes while a question is pending, so we never throw USE_AFTER_CLOSE.
+  const ask = (q: string): Promise<string> =>
+    new Promise((res) => {
+      if (closed) return res("/quit");
+      const onClose = () => res("/quit");
+      rl.once("close", onClose);
+      rl.question(q, (a) => {
+        rl.off("close", onClose);
+        res(a);
+      });
+    });
+
+  // Session + remote state, declared up front so the gate and the relay bridge can
+  // reference them (they're assigned/used later, only at runtime).
+  let session: any = null;
+  let relay: any = null;
+  let turnActive = false;
+
+  // The relay bridge: wires the app (when /remote-access is on) to the same gate +
+  // turn loop. Its gate hooks (getRemote/remoteAsk) are handed to the gate below,
+  // so a remote-driven turn relays each tool to the phone instead of the terminal.
+  const bridge = new RemoteBridge({
+    onPrompt: (text) => void runTurn(text, true),
+    onInterrupt: () => void session?.abort?.(),
+    onControllerAttached: () => relay?.sendSnapshot([]),
+    onStatus: (t) => console.log(`\n${DIM}⟿ ${t}${RESET}`),
+  });
+
+  // Serialize turns so a remote prompt and a locally-typed one can't overlap.
+  async function runTurn(text: string, remote: boolean): Promise<void> {
+    if (turnActive) {
+      console.log(`\n${DIM}(busy — a turn is already running)${RESET}`);
+      return;
+    }
+    turnActive = true;
+    if (remote) console.log(`\n${DIM}⟿ [app] ${text.slice(0, 80)}${RESET}`);
+    try {
+      await session.prompt(text);
+    } catch (e) {
+      console.log(`\n${RED}${(e as Error).message}${RESET}`);
+    } finally {
+      turnActive = false;
+      if (remote) bridge.settleTurn();
+    }
+  }
+
+  // The gate: local terminal approval, plus the remote branch via the bridge.
+  let mode: "default" | "acceptEdits" | "bypass" | "plan" = "default";
+  const gate: GateController = {
+    getMode: () => mode,
+    setMode: (m) => (mode = m),
+    allowlist: [],
+    allowedOutsideRoots: [],
+    cwd,
+    async localAsk(req) {
+      const a = (await ask(`\n${YELLOW}⚠ Allow ${req.title}: ${req.detail}?${RESET} [y/N/a] `)).trim().toLowerCase();
+      return a === "y" || a === "yes" ? "allow" : a === "a" || a === "always" ? "always" : "deny";
+    },
+    getRemote: bridge.getRemote,
+    getNoQuarter: bridge.getNoQuarter,
+    remoteAsk: bridge.remoteAsk,
+  };
+
+  console.log(`${DIM}privateer-agent — lean REPL. Loading ${provider}/${modelId}…${RESET}`);
+
+  const services = await createAgentSessionServices({
+    cwd,
+    agentDir: agentDir(),
+    resourceLoaderOptions: {
+      // Structural ext types are intentionally narrow; cast to Pi's ExtensionFactory.
+      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+    },
+  });
+  for (const d of services.diagnostics) if (d.type === "error") console.log(`${RED}! ${d.message}${RESET}`);
+
+  // Account channel: seed the OAuth credential (a fresh child session) so getApiKey
+  // resolves it; Pi then manages refresh on expiry via the registered oauth provider.
+  if (provider === "privateer") {
+    try {
+      const creds = await priv.spawnAccountCredentials();
+      (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
+    } catch (e) {
+      console.log(`${RED}Account channel unavailable: ${(e as Error).message}${RESET}`);
+    }
+  }
+
+  const model = (services.modelRegistry as any).find(provider, modelId);
+  if (!model) {
+    console.log(`${RED}Model ${provider}/${modelId} not found.${RESET} Set PRIVATEER_MODEL=provider/id and check the key is in .env.`);
+    rl.close();
+    process.exit(1);
+  }
+
+  ({ session } = await createAgentSessionFromServices({
+    services,
+    sessionManager: SessionManager.inMemory(cwd),
+    model,
+  } as any));
+
+  // Stream the turn as EngineEvents — printed locally AND forwarded to the app
+  // (the relay only sends when a controller is attached, so this is safe always).
+  const adapter = createEngineEventAdapter();
+  session.subscribe((ev: any) => {
+    for (const ee of adapter.toEngineEvents(ev)) {
+      bridge.forwardEvent(ee);
+      if (ee.type === "text") process.stdout.write(ee.text);
+      else if (ee.type === "reasoning") process.stdout.write(`${DIM}${ee.text}${RESET}`);
+      else if (ee.type === "tool-call") process.stdout.write(`\n${CYAN}⏺ ${ee.name}${RESET} ${DIM}${JSON.stringify(ee.input).slice(0, 120)}${RESET}\n`);
+      else if (ee.type === "tool-result") process.stdout.write(`${DIM}  ↳ ${String(ee.output).slice(0, 200)}${RESET}\n`);
+      else if (ee.type === "tool-error") process.stdout.write(`\n${RED}✗ ${ee.name}: ${ee.error}${RESET}\n`);
+      else if (ee.type === "error") process.stdout.write(`\n${RED}error: ${ee.error}${RESET}\n`);
+      else if (ee.type === "finish") process.stdout.write("\n");
+    }
+  });
+
+  async function showPosture() {
+    // The account channel has its own posture (server-proxy attestation for near/,
+    // ZDR policy otherwise); other providers go through pi-privacy.
+    const res =
+      provider === "privateer"
+        ? await accountPosture(modelId)
+        : await verifyModelPosture(provider, modelId, {
+            apiKey: provider === "nearai" ? process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY : undefined,
+          });
+    const t = TIERS[res.tier];
+    const color = t.posture === "green" ? GREEN : t.posture === "yellow" ? YELLOW : DIM;
+    console.log(`\n${color}⛉ ${t.label}${RESET} ${DIM}(${res.tier}${res.teePosture ? "/" + res.teePosture : ""}) — ${t.blurb}${RESET}${res.error ? `\n${RED}  ${res.error}${RESET}` : ""}`);
+  }
+
+  async function remoteAccess(on: boolean) {
+    if (on) {
+      if (relay) return console.log(`${DIM}remote access already on${RESET}`);
+      if (!priv.hasCredentials()) return console.log(`${RED}Not signed in.${RESET} Run /login first.`);
+      relay = new RelayClient(bridge.callbacks, { label: "privateer-cli" });
+      bridge.attachRelay(relay);
+      await relay.start();
+      console.log(`${DIM}Remote access enabling — approve this terminal in the Privateer app, then drive it from there.${RESET}`);
+    } else {
+      relay?.stop();
+      relay = null;
+      console.log(`${DIM}remote access off${RESET}`);
+    }
+  }
+
+  async function login() {
+    console.log(`${DIM}Requesting a device code…${RESET}`);
+    try {
+      const user = await priv.runDeviceLogin({
+        onCode: (code: any) => {
+          console.log(`\n${CYAN}Approve this terminal in the Privateer app:${RESET}`);
+          console.log(`  code: ${YELLOW}${code.user_code}${RESET}`);
+          if (code.verification_uri_complete) console.log(`  or open: ${DIM}${code.verification_uri_complete}${RESET}`);
+          console.log(`${DIM}  waiting for approval…${RESET}`);
+        },
+      });
+      console.log(`${GREEN}Signed in as ${user.email ?? user.id}.${RESET}`);
+    } catch (e) {
+      console.log(`${RED}${(e as Error).message}${RESET}`);
+    }
+  }
+
+  // Surface the account state so an inherited login (shared ~/.privateer/credentials.json
+  // with the 0.2 CLI) isn't a surprise when /remote-access "just works".
+  const who = priv.currentUser();
+  console.log(
+    who
+      ? `${DIM}Signed in as ${who.email ?? who.id} ${DIM}(Privateer account — shared ~/.privateer login).${RESET}`
+      : `${DIM}Not signed in. /login to enable remote access & the account provider.${RESET}`,
+  );
+
+  const HELP = "Commands: /remote-access <on|off>  /login  /models [filter]  /verify  /mode <…>  /quit";
+  console.log(`${DIM}Ready. Type a prompt. ${HELP}${RESET}`);
+  await showPosture();
+
+  for (;;) {
+    const line = (await ask(`\n${CYAN}›${RESET} `)).trim();
+    if (line === "/quit" || line === "/exit") break;
+    if (line === "/verify") { await showPosture(); continue; }
+    if (line === "/remote-access" || line === "/remote-access on" || line === "/remote") { await remoteAccess(true); continue; }
+    if (line === "/remote-access off") { await remoteAccess(false); continue; }
+    if (line === "/login") { await login(); continue; }
+    if (line === "/help" || line === "?") { console.log(`${DIM}${HELP}${RESET}`); continue; }
+    if (line.startsWith("/models")) {
+      const filter = line.slice(7).trim().toLowerCase();
+      const all: any[] = (services.modelRegistry as any).getAvailable ? await (services.modelRegistry as any).getAvailable() : [];
+      const rows = all.map((m) => `${m.provider}/${m.id}`).filter((s) => !filter || s.toLowerCase().includes(filter)).sort();
+      console.log(rows.slice(0, 40).join("\n") + (rows.length > 40 ? `\n${DIM}… ${rows.length - 40} more (try /models <filter>)${RESET}` : ""));
+      continue;
+    }
+    if (line.startsWith("/mode ")) { mode = line.slice(6).trim() as typeof mode; console.log(`${DIM}mode → ${mode}${RESET}`); continue; }
+    if (!line) continue;
+    await runTurn(line, false);
+  }
+  relay?.stop();
+  rl.close();
+  console.log(`${DIM}bye.${RESET}`);
+  process.exit(0);
+}
+
+main().catch((e) => {
+  console.error(e?.stack ?? e);
+  process.exit(1);
+});

package/src/config/paths.ts

@@ -3,61 +3,39 @@ import { join } from "node:path";
 
 // Global config/data dir. Overridable via PRIVATEER_HOME (portability + tests).
 // Computed lazily so the env var can be set before first use.
+//
+// KEEP — ported verbatim from tree-cli/src/config/paths.ts. This is the anchor
+// the whole config layout hangs off, including Pi's agent dir (see boot.ts).
 export function globalDir(): string {
   return process.env.PRIVATEER_HOME ?? join(homedir(), ".privateer");
 }
 
-// Project-scoped config dir (./.privateer).
-export function projectDir(cwd: string = process.cwd()): string {
-  return join(cwd, ".privateer");
+// Pi's agent dir, nested UNDER the privateer home so there is one tree to
+// back up / inspect / delete, and zero collision with a user's standalone Pi at
+// ~/.pi/agent (we never read or write theirs). This is the value boot.ts pins
+// into PI_CODING_AGENT_DIR before any Pi import.
+//
+//   ~/.privateer/                 ← PRIVATEER_HOME
+//   ├── credentials.json          relay/account JWT (KEEP — privateer identity)
+//   ├── config.json               webhooks/remote/posture prefs (ours; Pi never reads it)
+//   ├── routines/
+//   └── agent/                    ← PI_CODING_AGENT_DIR
+//       ├── auth.json  models.json  settings.json  trust.json
+//       ├── sessions/
+//       └── extensions/
+export function agentDir(): string {
+  return join(globalDir(), "agent");
 }
 
 // Privateer-account session credentials (JWT access/refresh + user). Kept in a
-// SEPARATE file from config.json: these are session tokens, not BYO provider
-// keys, and have a different lifecycle (rotated on refresh, cleared on logout).
+// SEPARATE file from Pi's provider keys (agent/auth.json): these are session
+// tokens with a different lifecycle (rotated on refresh, cleared on logout).
 export function credentialsPath(): string {
   return join(globalDir(), "credentials.json");
 }
 
-// Optional enterprise-managed settings file (highest precedence). Opt-in via env
-// so it stays out of the way for individuals and tests.
-export function managedSettingsPath(): string | undefined {
-  return process.env.PRIVATEER_MANAGED_SETTINGS || undefined;
-}
-
-// The standard file/dir layout under a scope's .privateer directory. Later
-// milestones (commands, agents, mcp, output styles) resolve their roots here so
-// the convention lives in one place.
-export interface ScopePaths {
-  dir: string;
-  config: string; // config.json — credentials + prefs (existing single file)
-  settings: string; // settings.json — layered settings
-  settingsLocal: string; // settings.local.json — gitignored local overrides
-  commands: string; // commands/ — custom slash commands (M2)
-  agents: string; // agents/ — custom subagents (M4)
-  skills: string; // skills/ — agent skills, one SKILL.md directory each
-  outputStyles: string; // output-styles/ — persona prompts (M2)
-  mcp: string; // mcp.json — MCP server declarations (M4)
-}
-
-function scopePaths(dir: string): ScopePaths {
-  return {
-    dir,
-    config: join(dir, "config.json"),
-    settings: join(dir, "settings.json"),
-    settingsLocal: join(dir, "settings.local.json"),
-    commands: join(dir, "commands"),
-    agents: join(dir, "agents"),
-    skills: join(dir, "skills"),
-    outputStyles: join(dir, "output-styles"),
-    mcp: join(dir, "mcp.json"),
-  };
-}
-
-export function globalPaths(): ScopePaths {
-  return scopePaths(globalDir());
-}
-
-export function projectPaths(cwd: string = process.cwd()): ScopePaths {
-  return scopePaths(projectDir(cwd));
+// Privateer-only preferences read exclusively by our code (webhooks, remote
+// access, posture, redaction). Pi never reads this file.
+export function configPath(): string {
+  return join(globalDir(), "config.json");
 }

package/src/config/permissionMode.ts

@@ -0,0 +1,5 @@
+// Permission modes, split out from the (Phase 7) zod config schema so the
+// permission layer can depend on just this without pulling zod. Ported from
+// tree-cli/src/config/schema.ts.
+export const PERMISSION_MODES = ["default", "acceptEdits", "bypass", "plan"] as const;
+export type PermissionMode = (typeof PERMISSION_MODES)[number];

package/src/crypto/outboxSeal.ts

@@ -0,0 +1,61 @@
+/**
+ * Outbox sealed-box crypto — SENDER (terminal) side.
+ *
+ * A running terminal seals summaries of unattended results (completed routines,
+ * finished agent tasks) to the account's outbox public key and POSTs the
+ * ciphertext to the server, so the app can catch up on next open without any
+ * push notification.
+ *
+ * This terminal holds NO account key material. By design this module can ONLY
+ * seal — there is no `open` and no way to derive the account private key here.
+ * A stolen terminal can post messages but can never read the outbox, other
+ * terminals' results, or any history. That "write-only terminal" property is
+ * the whole reason the outbox is asymmetric rather than symmetric.
+ *
+ * Construction and domain-separation constants MUST stay byte-for-byte in sync
+ * with treeview/client/services/outboxSeal.ts (the recipient side):
+ *   X25519 → HKDF-SHA256 → AES-256-GCM. Wire: epk(32) ‖ iv(12) ‖ ct‖tag, base64.
+ */
+
+import { x25519 } from "@noble/curves/ed25519";
+import { hkdf } from "@noble/hashes/hkdf";
+import { sha256 } from "@noble/hashes/sha256";
+import { gcm } from "@noble/ciphers/aes.js";
+import { randomBytes } from "@noble/hashes/utils";
+
+const enc = new TextEncoder();
+
+// MUST match treeview/client/services/outboxSeal.ts.
+const KDF_SEAL = enc.encode("privateer-outbox-seal-v1");
+
+function concat(...arrs: Uint8Array[]): Uint8Array {
+  const total = arrs.reduce((n, a) => n + a.length, 0);
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const a of arrs) { out.set(a, off); off += a.length; }
+  return out;
+}
+
+/** Decode the account public key the server hands us (base64 → 32 raw bytes). */
+export function decodeAccountPublicKey(b64: string): Uint8Array {
+  const buf = Buffer.from(b64, "base64");
+  if (buf.length !== 32) throw new Error("outbox public key must be 32 bytes");
+  return new Uint8Array(buf);
+}
+
+/** Seal plaintext to the account public key. Returns the base64 wire string. */
+export function seal(accountPub: Uint8Array, plaintext: Uint8Array): string {
+  const esk = x25519.utils.randomPrivateKey();
+  const epk = x25519.getPublicKey(esk);
+  const shared = x25519.getSharedSecret(esk, accountPub);
+  const salt = concat(epk, accountPub);          // binds ephemeral + recipient
+  const key = hkdf(sha256, shared, salt, KDF_SEAL, 32);
+  const iv = randomBytes(12);
+  const ct = gcm(key, iv).encrypt(plaintext);    // ct includes the 16-byte tag
+  return Buffer.from(concat(epk, iv, ct)).toString("base64");
+}
+
+/** Seal a JSON-serializable value. */
+export function sealJson(accountPub: Uint8Array, obj: unknown): string {
+  return seal(accountPub, enc.encode(JSON.stringify(obj)));
+}