privateer-agent 0.2.1 → 0.3.1

package/src/tools/routine.ts

@@ -1,110 +1,129 @@
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-import { PermissionDeniedError } from "../permissions/gate.ts";
-import { DELIVERY_CHANNELS, newRoutineId, type Routine } from "../routines/schema.ts";
+// The `create_routine` tool — lets the agent turn "summarize the news every morning"
+// or "remind me at 3pm tomorrow" into a saved routine the scheduler daemon runs
+// unattended (see src/daemon). Ported from tree-cli/src/tools/routine.ts, adapted to
+// Pi's registerTool (TypeBox schema) with the in-tool ctx.gate.request removed: in
+// the Pi model our permission-gate extension gates the tool_call itself (classify.ts
+// gives it a "Create routine" prompt + flags email/webhook egress).
+
+import { Type } from "typebox";
+import { readFileSync } from "node:fs";
+import { configPath } from "../config/paths.ts";
+import { newRoutineId, webhookName, type Routine } from "../routines/schema.ts";
 import { triggerError, computeNextRun, describeTrigger } from "../routines/trigger.ts";
-import { splitRoutineTools } from "../routines/toolSelect.ts";
 import { upsertRoutine } from "../routines/store.ts";
 import { sendToDaemon, DaemonNotRunningError } from "../daemon/ipc.ts";
 
-// Lets the agent turn a request like "summarize world news every morning" or
-// "remind me at 3pm tomorrow" into a saved routine. Creating one is a persistent
-// mutation, so it routes through the permission gate — the agent proposes, the user
-// approves, then it lands in routines.json and the running daemon picks it up.
-export function routineTool(ctx: ToolContext) {
-  return tool({
-    description:
-      "Create a routine: a saved task the scheduler runs unattended, either recurring (a cron " +
-      "expression) or one-off (a specific datetime), and delivers the result. Use when the user " +
-      "asks to be notified/updated on a cadence ('every morning', 'nightly') or at a future time " +
-      "('at 3pm tomorrow'). Set exactly one of `cron` or `at`. Confirm timing + delivery with the " +
-      "user first; this prompts for approval before saving. Runs use a safe read/web toolset (no " +
-      "writing or shell) unless `tools` grants more.",
-    inputSchema: z.object({
-      name: z.string().describe("Short unique label, e.g. 'morning-news'."),
-      cron: z
-        .string()
-        .optional()
-        .describe("Recurring: standard 5-field cron, e.g. '0 8 * * *' for 08:00 daily. Omit for one-off."),
-      at: z
-        .string()
-        .optional()
-        .describe("One-off: ISO-8601 datetime, e.g. '2026-07-02T15:00:00'. Omit for recurring."),
-      prompt: z.string().describe("Self-contained instruction the agent runs when it fires."),
-      delivery: z
-        .array(z.enum(DELIVERY_CHANNELS))
-        .optional()
-        .describe("How to deliver the result. Defaults to ['file']. 'email' leaves the machine (opt-in)."),
-      cwd: z.string().optional().describe("Working directory for the run. Defaults to the current one."),
-      model: z.string().optional().describe("Optional 'provider:model' override."),
-      tools: z
-        .array(z.string())
-        .optional()
-        .describe(
-          "Tool allow-list: builtin names ('read') and/or MCP selectors '<server>__<tool>' or " +
-            "'<server>__*'. MCP tools run unattended with no approval prompts — grant only what " +
-            "the task needs. Omit for the default safe read/web set.",
-        ),
-    }),
-    execute: async ({ name, cron, at, prompt, delivery, cwd, model, tools }) => {
-      const err = triggerError({ cron, at });
-      if (err) return `Error: ${err}`;
+const KNOWN_CHANNELS = new Set(["file", "relay", "notice", "cloud", "email"]);
+
+function loadWebhooks(): Record<string, { url?: string }> {
+  try {
+    return JSON.parse(readFileSync(configPath(), "utf8")).webhooks ?? {};
+  } catch {
+    return {};
+  }
+}
+
+function text(t: string) {
+  return { content: [{ type: "text", text: t }], details: {} };
+}
 
-      const chans = delivery && delivery.length > 0 ? delivery : ["file" as const];
-      const next = computeNextRun({ cron, at });
-      const detail =
-        `${name}: ${describeTrigger({ cron, at })}` +
-        (next ? ` (next ${next.toLocaleString()})` : "") +
-        ` → ${chans.join(",")}`;
+export const routineToolDefinition = {
+  name: "create_routine",
+  label: "Create Routine",
+  description:
+    "Create a routine: a saved task the scheduler runs unattended, either recurring (a cron " +
+    "expression) or one-off (a specific datetime), and delivers the result. Use when the user asks " +
+    "to be notified/updated on a cadence ('every morning', 'nightly') or at a future time ('at 3pm " +
+    "tomorrow'). Set exactly one of `cron` or `at`. Confirm timing + delivery with the user first; " +
+    "creating a routine prompts for approval. Runs use a safe read-only toolset unless `tools` grants more.",
+  parameters: Type.Object({
+    name: Type.String({ description: "Short unique label, e.g. 'morning-news'." }),
+    cron: Type.Optional(Type.String({ description: "Recurring: 5-field cron, e.g. '0 8 * * *' (08:00 daily). Omit for one-off." })),
+    at: Type.Optional(Type.String({ description: "One-off: ISO-8601 datetime, e.g. '2026-07-02T15:00:00'. Omit for recurring." })),
+    prompt: Type.String({ description: "Self-contained instruction the agent runs when it fires." }),
+    delivery: Type.Optional(
+      Type.Array(Type.String(), {
+        description:
+          "Where to deliver: 'file' (default), 'notice', 'relay', 'cloud' (E2E-encrypted to your Privateer " +
+          "account), 'email' (plaintext, opt-in), or 'webhook:<name>' (name must exist in config webhooks).",
+      }),
+    ),
+    cwd: Type.Optional(Type.String({ description: "Working directory for the run. Defaults to the current one." })),
+    model: Type.Optional(Type.String({ description: "Optional 'provider:model' or 'provider/model' override." })),
+    tools: Type.Optional(Type.Array(Type.String(), { description: "Tool allow-list; omit for the default safe set." })),
+  }),
+  async execute(
+    _toolCallId: string,
+    params: {
+      name: string;
+      cron?: string;
+      at?: string;
+      prompt: string;
+      delivery?: string[];
+      cwd?: string;
+      model?: string;
+      tools?: string[];
+    },
+    _signal?: AbortSignal,
+    _onUpdate?: unknown,
+    ctx?: { cwd?: string },
+  ) {
+    const { name, cron, at, prompt, delivery, cwd, model, tools } = params;
 
-      // Confirm with the user. Egress grants are flagged so the human sees them:
-      // email delivery, and any MCP tools — those run unattended under the daemon's
-      // auto-approve gate, so this approval is the only human decision they get.
-      const split = splitRoutineTools(tools);
-      const flags: string[] = [];
-      if (chans.includes("email")) flags.push("email leaves your machine");
-      if (split.mcp.length > 0) flags.push(`grants external MCP tools, unattended: ${split.mcp.join(", ")}`);
-      const decision = await ctx.gate.request({
-        tool: "routine",
-        kind: "write",
-        title: "Create routine",
-        detail: flags.length > 0 ? `${detail}  [${flags.join("] [")}]` : detail,
-        // An MCP grant must always reach the human, above bypass mode/allowlists.
-        alwaysAsk: split.mcp.length > 0,
-      });
-      if (decision === "deny") throw new PermissionDeniedError("routine");
+    const err = triggerError({ cron, at });
+    if (err) return text(`Error: ${err}`);
 
-      const routine: Routine = {
-        id: newRoutineId(),
-        name,
-        cron,
-        at,
-        prompt,
-        cwd: cwd ?? ctx.cwd,
-        model,
-        delivery: chans,
-        tools,
-        enabled: true,
-        nextRun: next?.toISOString(),
-      };
+    const chans = delivery && delivery.length > 0 ? delivery : ["file"];
+    // Validate channels: known names or webhook:<name>.
+    const bad = chans.filter((c) => !KNOWN_CHANNELS.has(c) && webhookName(c) === null);
+    if (bad.length > 0) return text(`Error: unknown delivery channel(s): ${bad.join(", ")}.`);
 
-      // Prefer handing it to the running daemon (it validates + schedules); fall back
-      // to writing the file directly so the routine persists until the daemon starts.
-      try {
-        const res = await sendToDaemon({ cmd: "add", routine });
-        if (!res.ok) return `Error saving routine: ${res.message ?? "unknown"}`;
-        return `Created routine "${name}" (${describeTrigger({ cron, at })}). Next run ${next ? next.toLocaleString() : "unknown"}, delivery: ${chans.join(", ")}.`;
-      } catch (e) {
-        if (e instanceof DaemonNotRunningError) {
-          upsertRoutine(routine);
-          return (
-            `Saved routine "${name}" (${describeTrigger({ cron, at })}), but the scheduler daemon isn't ` +
-            `running yet, so it won't fire until you start it: run \`privateer daemon\` (or \`privateer daemon --detach\`).`
-          );
-        }
-        return `Error contacting the scheduler: ${e instanceof Error ? e.message : String(e)}`;
+    // Webhook targets must be pre-declared in config (the routine never carries a URL).
+    const hooks = chans.map(webhookName).filter((n): n is string => n !== null);
+    if (hooks.length > 0) {
+      const configured = loadWebhooks();
+      const unknown = hooks.filter((n) => !configured[n]);
+      if (unknown.length > 0) {
+        return text(
+          `Error: webhook${unknown.length > 1 ? "s" : ""} not configured: ${unknown.join(", ")}. ` +
+            `Declare them under "webhooks" in ~/.privateer/config.json first.`,
+        );
       }
-    },
-  });
-}
+    }
+
+    const next = computeNextRun({ cron, at });
+    const routine: Routine = {
+      id: newRoutineId(),
+      name,
+      cron,
+      at,
+      prompt,
+      cwd: cwd ?? ctx?.cwd ?? process.cwd(),
+      model,
+      delivery: chans as Routine["delivery"],
+      tools,
+      enabled: true,
+      nextRun: next?.toISOString(),
+    };
+
+    // Hand to the running daemon (it validates + schedules); fall back to writing the
+    // file so the routine persists until the daemon starts.
+    try {
+      const res = await sendToDaemon({ cmd: "add", routine });
+      if (!res.ok) return text(`Error saving routine: ${res.message ?? "unknown"}`);
+      return text(
+        `Created routine "${name}" (${describeTrigger({ cron, at })}). ` +
+          `Next run ${next ? next.toLocaleString() : "unknown"}, delivery: ${chans.join(", ")}.`,
+      );
+    } catch (e) {
+      if (e instanceof DaemonNotRunningError) {
+        upsertRoutine(routine);
+        return text(
+          `Saved routine "${name}" (${describeTrigger({ cron, at })}), but the scheduler daemon isn't ` +
+            `running yet, so it won't fire until you start it.`,
+        );
+      }
+      return text(`Error contacting the scheduler: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  },
+};

package/src/tools/saveAttachment.ts

@@ -1,53 +1,50 @@
+// The `save_attachment` tool — persist a file the user attached from the app (shown
+// in the prompt as "[Attachment #n] name") to a real path on disk. Ported from
+// tree-cli to Pi registerTool; the in-tool ctx.gate.request is dropped (our gate
+// extension gates the tool_call, classified as a write against the destination path).
+
+import { Type } from "typebox";
 import { writeFileSync, mkdirSync, readFileSync } from "node:fs";
-import { dirname } from "node:path";
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-import { resolveInCwd, displayPath, isOutsideScope } from "./context.ts";
-import { PermissionDeniedError } from "../permissions/gate.ts";
-import { isProtectedPath } from "../permissions/protected.ts";
+import { dirname, isAbsolute, resolve } from "node:path";
+import type { AttachmentStore } from "../util/attachmentStore.ts";
+
+function text(t: string) {
+  return { content: [{ type: "text", text: t }], details: {} };
+}
 
-export function saveAttachmentTool(ctx: ToolContext) {
-  return tool({
+export function makeSaveAttachmentTool(store: AttachmentStore) {
+  return {
+    name: "save_attachment",
+    label: "Save Attachment",
     description:
-      "Save a user-attached file (image, PDF, audio, or video — shown in the prompt as a " +
-      '"[Image #n]" / "[PDF #n]" / etc. chip) to a path on disk. Use this to persist a pasted ' +
-      "or dragged-in attachment instead of trying to copy it from a temp or drop path, which is " +
-      "unreliable and may be an empty placeholder. `ref` is the number n from the chip.",
-    inputSchema: z.object({
-      ref: z
-        .number()
-        .int()
-        .describe("The attachment reference number n, taken from its [Kind #n] chip."),
-      path: z.string().describe("Destination file path to write the attachment to."),
+      "Save a file the user attached from the Privateer app (shown in the prompt as a \"[Attachment #n] " +
+      "name\" chip) to a path on disk. Use this to persist a received attachment. `ref` is the number n.",
+    parameters: Type.Object({
+      ref: Type.Integer({ description: "The attachment reference number n from its [Attachment #n] chip." }),
+      path: Type.String({ description: "Destination file path to write the attachment to." }),
     }),
-    execute: async ({ ref, path }) => {
-      const store = ctx.attachments;
-      const entry = store?.get(ref);
+    async execute(
+      _toolCallId: string,
+      params: { ref: number; path: string },
+      _signal?: AbortSignal,
+      _onUpdate?: unknown,
+      ctx?: { cwd?: string },
+    ) {
+      const entry = store.get(params.ref);
       if (!entry) {
-        const avail = store?.refs() ?? [];
-        return avail.length
-          ? `No attachment #${ref}. Available this session: ${avail.map((n) => `#${n}`).join(", ")}.`
-          : `No attachment #${ref}: nothing has been attached this session.`;
+        const avail = store.refs();
+        return text(
+          avail.length
+            ? `No attachment #${params.ref}. Available this session: ${avail.map((n) => `#${n}`).join(", ")}.`
+            : `No attachment #${params.ref}: nothing has been attached this session.`,
+        );
       }
-      const abs = resolveInCwd(ctx, path);
-      const outside = isOutsideScope(ctx, abs);
-      const decision = await ctx.gate.request({
-        tool: "save_attachment",
-        kind: "write",
-        title: outside ? "Save attachment outside working directory" : "Save attachment",
-        detail: `[#${ref}] → ${outside ? abs : displayPath(ctx, abs)} (${entry.mediaType})`,
-        protected: isProtectedPath(abs),
-        outside,
-        path: abs,
-      });
-      if (decision === "deny") throw new PermissionDeniedError("save_attachment");
-
-      ctx.recordMutation?.(abs);
+      const cwd = ctx?.cwd ?? process.cwd();
+      const abs = isAbsolute(params.path) ? params.path : resolve(cwd, params.path);
       mkdirSync(dirname(abs), { recursive: true });
       const bytes = readFileSync(entry.path);
       writeFileSync(abs, bytes);
-      return `Saved attachment #${ref} to ${displayPath(ctx, abs)} (${bytes.length} bytes).`;
+      return text(`Saved attachment #${params.ref} (${entry.name}, ${entry.mediaType}) to ${params.path} (${bytes.length} bytes).`);
     },
-  });
+  };
 }

package/src/tools/sendFile.ts

@@ -0,0 +1,75 @@
+// The `send_file_to_client` tool — stream a file from disk up to the connected
+// Privateer app (the phone/web client driving this terminal via /remote-access) so
+// the user can preview/save it on their device. Ported from tree-cli, adapted to Pi
+// registerTool + the RemoteBridge (which owns the relay's chunked sendFile). Gated by
+// our permission-gate extension like any tool.
+
+import { Type } from "typebox";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { basename, isAbsolute, resolve } from "node:path";
+
+const MAX_SEND_BYTES = 10 * 1024 * 1024; // mirrors the relay's per-file cap
+
+const MEDIA: Record<string, string> = {
+  png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp",
+  svg: "image/svg+xml", pdf: "application/pdf", txt: "text/plain", md: "text/markdown",
+  json: "application/json", csv: "text/csv", html: "text/html", mp4: "video/mp4",
+  mov: "video/quicktime", mp3: "audio/mpeg", wav: "audio/wav", zip: "application/zip",
+};
+function mediaTypeForPath(p: string): string {
+  const ext = p.split(".").pop()?.toLowerCase() ?? "";
+  return MEDIA[ext] ?? "application/octet-stream";
+}
+
+function text(t: string) {
+  return { content: [{ type: "text", text: t }], details: {} };
+}
+
+export interface SendFileBridge {
+  isConnected(): boolean;
+  sendFile(file: { name: string; mediaType: string; base64: string; size: number }): Promise<{ ok: boolean; reason?: string }>;
+}
+
+export function makeSendFileTool(bridge: SendFileBridge) {
+  return {
+    name: "send_file_to_client",
+    label: "Send File to App",
+    description:
+      "Send a file from disk to the connected Privateer app (the phone/web client driving this terminal " +
+      "remotely), where the user can preview it and save/share it on their device. Use when the user asks " +
+      "to see, download, or receive a file on their phone or browser. Only works while remote access is on " +
+      "and the app is connected; max 10 MB per file.",
+    parameters: Type.Object({
+      path: Type.String({ description: "Path of the file to send, relative to cwd or absolute." }),
+    }),
+    async execute(
+      _toolCallId: string,
+      params: { path: string },
+      _signal?: AbortSignal,
+      _onUpdate?: unknown,
+      ctx?: { cwd?: string },
+    ) {
+      if (!bridge.isConnected()) {
+        return text(
+          "Cannot send: remote access is off or the app isn't connected right now. " +
+            "Turn it on with /remote-access and open the Privateer app, then try again.",
+        );
+      }
+      const cwd = ctx?.cwd ?? process.cwd();
+      const abs = isAbsolute(params.path) ? params.path : resolve(cwd, params.path);
+      if (!existsSync(abs)) return text(`File not found: ${params.path}`);
+      const stat = statSync(abs);
+      if (stat.isDirectory()) return text(`${params.path} is a directory — send a single file.`);
+      if (stat.size === 0) return text(`${params.path} is empty — nothing to send.`);
+      if (stat.size > MAX_SEND_BYTES) {
+        return text(`${params.path} is ${(stat.size / 1048576).toFixed(1)} MB; the relay caps at ${MAX_SEND_BYTES / 1048576} MB per file.`);
+      }
+      const bytes = readFileSync(abs);
+      const mediaType = mediaTypeForPath(abs);
+      const res = await bridge.sendFile({ name: basename(abs), mediaType, base64: bytes.toString("base64"), size: bytes.length });
+      return res.ok
+        ? text(`Sent ${basename(abs)} (${bytes.length} bytes, ${mediaType}) to the connected app.`)
+        : text(`Couldn't send ${basename(abs)}: ${res.reason ?? "unknown error"}. Is the app currently connected?`);
+    },
+  };
+}

package/src/util/attachmentStore.ts

@@ -1,54 +1,39 @@
 import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, extname } from "node:path";
-import type { Attachment, Modality } from "./images.ts";
 
-// One stored attachment: its bytes persisted to a stable scratch file, keyed by the
-// "#n" reference the user sees in the prompt.
+// Holds the decoded bytes of files the app sends down over the relay, in a private
+// scratch dir keyed by the "#n" reference the model sees, so the save_attachment tool
+// can write one back out to a real path on demand. Ported/adapted from tree-cli
+// (which persisted paste/drop bytes); here the source is inbound relay attachments.
+
 export interface StoredAttachment {
   n: number;
   path: string; // absolute scratch-file path holding the decoded bytes
   mediaType: string;
-  modality: Modality;
-  origin: string; // the token the user referenced (for display/debugging)
+  name: string; // original filename from the app
 }
 
-// Keeps the decoded bytes of every attachment seen this session in a private scratch
-// dir, keyed by its "[Kind #n]" reference, so the `save_attachment` tool can write one
-// back out to a real path on demand.
-//
-// This exists to close the macOS file-promise drop gap: the bytes we capture at
-// paste-time (in resolveAttachments) are the only durable copy — the terminal's
-// …/T/drop-XXXXXX/ file is a volatile stub that may already be gone or truncated by the
-// time the agent goes looking. We copy what we captured into a place we control, once,
-// instead of trusting that path twice.
 export class AttachmentStore {
   private dir: string | null = null;
   private readonly byN = new Map<number, StoredAttachment>();
+  private nextN = 1;
 
   private ensureDir(): string {
-    // mkdtemp gives a 0700 dir; created lazily so a session that never attaches
-    // anything leaves no temp files behind.
+    // mkdtemp gives a 0700 dir; created lazily so a session that never receives an
+    // attachment leaves no temp files behind.
     if (!this.dir) this.dir = mkdtempSync(join(tmpdir(), "privateer-att-"));
     return this.dir;
   }
 
-  // Persist an attachment's bytes to the scratch dir, keyed by n. Idempotent: the same
-  // n (a file referenced twice in a session) is written once and reused.
-  register(att: Attachment): StoredAttachment | undefined {
-    if (att.n == null) return undefined;
-    const existing = this.byN.get(att.n);
-    if (existing) return existing;
-    const file = join(this.ensureDir(), `att-${att.n}${extname(att.path)}`);
-    writeFileSync(file, Buffer.from(att.data, "base64"));
-    const stored: StoredAttachment = {
-      n: att.n,
-      path: file,
-      mediaType: att.mediaType,
-      modality: att.modality,
-      origin: att.path,
-    };
-    this.byN.set(att.n, stored);
+  // Persist an inbound attachment's bytes, assign it the next ref number, and return
+  // the stored record (its ref + scratch path).
+  register(file: { name: string; mediaType: string; base64: string }): StoredAttachment {
+    const n = this.nextN++;
+    const path = join(this.ensureDir(), `att-${n}${extname(file.name) || ""}`);
+    writeFileSync(path, Buffer.from(file.base64, "base64"));
+    const stored: StoredAttachment = { n, path, mediaType: file.mediaType, name: file.name };
+    this.byN.set(n, stored);
     return stored;
   }
 
@@ -56,13 +41,11 @@ export class AttachmentStore {
     return this.byN.get(n);
   }
 
-  // The reference numbers currently held, ascending — for a helpful error when the
-  // model asks for one that isn't there.
+  // Held reference numbers, ascending — for a helpful error when a missing one is asked for.
   refs(): number[] {
     return [...this.byN.keys()].sort((a, b) => a - b);
   }
 
-  // Remove the scratch dir (e.g. on session exit). Safe to call when nothing was stored.
   cleanup(): void {
     if (!this.dir) return;
     rmSync(this.dir, { recursive: true, force: true });

package/src/util/redact.ts

@@ -6,11 +6,22 @@
 const PLACEHOLDER = "«redacted»";
 
 // Common API-key shapes, masked even when we don't have the exact value on hand:
-// OpenAI `sk-…`, Anthropic `sk-ant-…`, OpenRouter `sk-or-v1-…`, and bare
-// "Bearer <token>" / "x-api-key: <token>" header fragments.
+// OpenAI `sk-…`, Anthropic `sk-ant-…`, OpenRouter `sk-or-v1-…`, Google `AIza…`,
+// xAI `xai-…`, Groq `gsk_…`, Z.ai/Zhipu `<32 hex>.<suffix>`, Cerebras `csk-…`,
+// Venice `vapi_…`, Fireworks `fw_…`, and bare
+// "Bearer <token>" / "x-api-key: <token>" / "x-goog-api-key: <token>" header
+// fragments. (Mistral and Together keys are prefix-less, so they rely on
+// exact-value masking and the header patterns.)
 const KEY_PATTERNS: RegExp[] = [
   /\bsk-(ant|or|proj|live|test)?-?[A-Za-z0-9_-]{16,}\b/g,
-  /\b(authorization|x-api-key)\b\s*[:=]\s*(bearer\s+)?["']?[A-Za-z0-9_\-.]{16,}["']?/gi,
+  /\bAIza[A-Za-z0-9_-]{20,}\b/g,
+  /\bxai-[A-Za-z0-9_-]{16,}\b/g,
+  /\bgsk_[A-Za-z0-9_-]{16,}\b/g,
+  /\bcsk-[A-Za-z0-9_-]{16,}\b/g,
+  /\bvapi_[A-Za-z0-9_-]{16,}\b/g,
+  /\bfw_[A-Za-z0-9_-]{16,}\b/g,
+  /\b[a-f0-9]{32}\.[A-Za-z0-9]{10,}\b/g,
+  /\b(authorization|x-api-key|x-goog-api-key)\b\s*[:=]\s*(bearer\s+)?["']?[A-Za-z0-9_\-.]{16,}["']?/gi,
 ];
 
 // Exact secret strings to mask, gathered from the resolved config + environment.
@@ -26,8 +37,27 @@ export function collectSecrets(providers?: Record<string, { apiKey?: string } |
     "OPENROUTER_API_KEY",
     "ANTHROPIC_API_KEY",
     "OPENAI_API_KEY",
+    "GOOGLE_GENERATIVE_AI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "XAI_API_KEY",
+    "GROQ_API_KEY",
+    "MISTRAL_API_KEY",
+    "ZAI_API_KEY",
+    "Z_AI_API_KEY",
+    "MOONSHOT_API_KEY",
+    "CEREBRAS_API_KEY",
+    "FIREWORKS_API_KEY",
+    "TOGETHER_API_KEY",
+    "TOGETHER_AI_API_KEY",
+    "DEEPSEEK_API_KEY",
+    "MINIMAX_API_KEY",
+    "DASHSCOPE_API_KEY",
+    "QWEN_API_KEY",
     "NEAR_AI_API_KEY",
     "NEARAI_API_KEY",
+    "TINFOIL_API_KEY",
+    "VENICE_API_KEY",
   ])
     add(process.env[k]);
   return [...out];

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Patrick
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/src/agents/loader.ts

@@ -1,49 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { globalPaths, projectPaths } from "../config/paths.ts";
-import { walkFiles } from "../tools/walk.ts";
-import { parseFrontmatter } from "../commands/custom.ts";
-
-// A user-defined sub-agent loaded from .privateer/agents/<name>.md. The body is the
-// agent's instructions (system prompt); frontmatter narrows its tools and model.
-export interface AgentDefinition {
-  name: string;
-  description: string;
-  tools?: string[]; // tool names the agent may use (default: read/glob/grep)
-  model?: string; // optional "provider:model" override
-  prompt: string; // the agent's instructions
-  scope: "project" | "user";
-}
-
-function loadFromDir(dir: string, scope: "project" | "user"): AgentDefinition[] {
-  if (!existsSync(dir)) return [];
-  const out: AgentDefinition[] = [];
-  for (const rel of walkFiles(dir)) {
-    if (!rel.endsWith(".md")) continue;
-    const { meta, body } = parseFrontmatter(readFileSync(join(dir, rel), "utf8"));
-    out.push({
-      name: meta.name || rel.replace(/\.md$/, "").split("/").join(":"),
-      description: meta.description ?? `custom ${scope} sub-agent`,
-      tools: meta.tools
-        ?.split(",")
-        .map((s) => s.trim())
-        .filter(Boolean),
-      model: meta.model,
-      prompt: body.trim(),
-      scope,
-    });
-  }
-  return out;
-}
-
-// User (~/.privateer) then project (./.privateer) agents; project overrides user.
-export function loadAgents(cwd: string = process.cwd()): AgentDefinition[] {
-  const byName = new Map<string, AgentDefinition>();
-  for (const a of loadFromDir(globalPaths().agents, "user")) byName.set(a.name, a);
-  for (const a of loadFromDir(projectPaths(cwd).agents, "project")) byName.set(a.name, a);
-  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
-}
-
-export function findAgent(name: string, cwd: string = process.cwd()): AgentDefinition | undefined {
-  return loadAgents(cwd).find((a) => a.name === name);
-}