privateer-agent 0.3.0 → 0.3.2

package/README.md

@@ -5,7 +5,7 @@
 <h1 align="center">⚓ Privateer</h1>
 
 <p align="center">
-  <strong>A provider-agnostic terminal coding agent — bring your own model, keep your own privacy.</strong>
+  <strong>A privacy-first, safe-by-default distribution of the <a href="https://pi.dev">Pi</a> coding agent — bring your own model, keep your own privacy.</strong>
 </p>
 
 <p align="center">
@@ -46,8 +46,37 @@ permission gate**.
 - **Privacy you can verify, not just trust.** Confidential-enclave (TEE) inference is
   cryptographically **attested** — not a policy promise — and an **on-device PII gate**
   warns before structured personal data ever leaves your machine for an unverified model.
-- **Genuinely extensible.** MCP servers, sub-agents, custom commands, and skills — all just
-  files. Nothing to compile.
+- **It's Pi underneath.** Privateer is a distribution of the [Pi](https://pi.dev) coding agent —
+  every Pi extension, skill, and command works, and Privateer's own features are just extensions
+  you can read, swap, or build on. Nothing to compile. See [Built on Pi](#built-on-pi).
+
+## Built on Pi
+
+Privateer is a **distribution of the [Pi](https://pi.dev) coding agent**
+(`@earendil-works/pi-coding-agent`): Pi is the runtime, the model routing, the interactive TUI,
+and the extension / skill / prompt discovery system — **everything that works in Pi works here.**
+What Privateer adds is a *moat* of Pi extensions layered on top:
+
+| Extension | What it adds |
+|---|---|
+| `privateer-gate` | safe-by-default permission gate + destructive-command danger filter |
+| `privateer-privacy` | `pi-privacy` — TEE attestation, ZDR routing, on-device PII gate — bound to the account tier resolver |
+| `privateer-account` | `/signin` billed inference against a Privateer account (device flow) |
+| `privateer-posture`, `privateer-tools` | live attestation shield + Privateer tool pack |
+| `rpiv-web-tools` | private-by-default web search (self-hosted SearXNG, no WebView) |
+| `pi-mcp-adapter`, `pi-subagents` | MCP servers · bounded parallel sub-agents |
+
+They're ordinary Pi extensions — inspect them, replace them, or build your own alongside.
+**Extend by discovery:** drop an extension into `~/.privateer/agent/extensions/` (move the home
+with `PRIVATEER_HOME`), add a skill or prompt beside it, or list an npm/git package under
+`packages` in `~/.privateer/agent/settings.json` — Pi auto-loads them on next launch, right next
+to Privateer's own. Any extension from the Pi ecosystem loads the same way. (There's no CLI flag
+for this — discovery is the entry point.)
+
+**The floor you can't lower is the safety gate.** While it's loaded, its block on destructive
+shell commands, secret exfiltration, and plan-mode escapes sits *above* every relaxation —
+`bypass` mode, the approval allowlist, even a phone-approved remote turn can't fire them
+silently. The moat is swappable; the floor under it holds.
 
 ## Highlights
 
@@ -126,6 +155,7 @@ export OLLAMA_BASE_URL=http://localhost:11434/v1   # local, keyless
 export NEAR_AI_API_KEY=...               # verifiable TEE inference (cloud.near.ai)
 export TINFOIL_API_KEY=...               # verifiable TEE inference (tinfoil.sh)
 export VENICE_API_KEY=vapi_...           # no-retention inference
+export PRIVATEER_API_KEY=sk-priv-...      # Privateer developer API (privateer.pro); or /signin instead
 ```
 
 Pick a model with **`/model`** (browse each configured provider's live catalog) or pass one
@@ -198,14 +228,17 @@ and protected files (`.env`, shell rc files…) are guarded — the gate is neve
 
 ## Extend it
 
-- **MCP servers** — declare them and their tools become first-class, gated like the rest
-  (local stdio, or remote HTTP with interactive OAuth).
-- **Sub-agents** — delegate investigations to bounded parallel agents that run under the same
-  permission gate.
+Everything below is a **Pi extension** loaded by discovery (see [Built on Pi](#built-on-pi)) —
+drop your own into `~/.privateer/agent/extensions/` and it loads the same way, gated like the rest.
+
+- **MCP servers** (`pi-mcp-adapter`) — declare them and their tools become first-class, gated
+  like the rest (local stdio, or remote HTTP with interactive OAuth).
+- **Sub-agents** (`pi-subagents`) — delegate investigations to bounded parallel agents that run
+  under the same permission gate.
 - **Routines** — saved tasks the daemon runs unattended; ask the agent to schedule work and
   approve it once.
-- **Web tools** — private-by-default web search/fetch with pluggable backends (self-hosted
-  SearXNG for fully private search).
+- **Web tools** (`rpiv-web-tools`) — private-by-default web search/fetch with pluggable backends
+  (self-hosted SearXNG for fully private search).
 
 ## Develop
 

package/bin/privateer-tui

@@ -83,4 +83,10 @@ else
   MODEL="openrouter/openai/gpt-4o-mini"
 fi
 
-exec "$NODE_BIN" --env-file="$REPO/.env" "$CLI" --model "$MODEL" "$@"
+# Dev convenience: load provider keys from the repo's .env if present. A real install
+# has none — so only pass the flag when the file exists (using --env-file-if-exists
+# unconditionally would print "…/.env not found. Continuing without it." on every
+# launch, muddying the startup banner). No .env → rely on the ambient environment.
+ENV_ARGS=""
+[ -f "$REPO/.env" ] && ENV_ARGS="--env-file=$REPO/.env"
+exec "$NODE_BIN" ${ENV_ARGS:+"$ENV_ARGS"} "$CLI" --model "$MODEL" "$@"

package/extensions/privateer-account.ts

@@ -0,0 +1,6 @@
+// The Privateer account provider as a Pi extension (for `-e` into Pi's TUI).
+// Registers the `privateer` subscription channel when a machine login exists; Pi's
+// own OAuth /login flow drives the child-session credential.
+import { makeAccountProvider } from "../src/providers/account.ts";
+
+export default makeAccountProvider();

package/extensions/privateer-brand.ts

@@ -0,0 +1,274 @@
+// Privateer branding for Pi's TUI + the account (sign-in) surface. Three concerns
+// live together here because they share one piece of state — whether this terminal
+// is signed in to a Privateer account:
+//
+//   1. A branded startup header — the anchor mark + "✻ PRIVATEER" wordmark + the
+//      "Chart your own course privately." tagline (ported from tree-cli's Banner).
+//   2. A live status-bar badge (⚓ account) showing the sign-in state at a glance.
+//   3. Sign-in UX — /signin, /signout, and a /privateer hub — which drive the
+//      device-code flow the account channel needs.
+//
+// Pi already owns /login and /logout for PROVIDER auth (and /whoami), so we do NOT
+// shadow them. /signin drives the Privateer *account* device flow directly — which
+// has to exist separately, because the `privateer` inference provider only registers
+// once credentials exist, so a first-time user can't reach it through provider auth.
+//
+// On a successful /signin we hot-register the account provider so privateer/* models
+// appear immediately, without a restart.
+
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import * as priv from "../src/auth/privateer.ts";
+import { makeAccountProvider } from "../src/providers/account.ts";
+
+const VERSION: string = (() => {
+  try {
+    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return "0.3.0";
+  }
+})();
+
+// ── palette (Privateer "Open Water" ocean-blue brand) ────────────────────────
+// 256-color (8-bit), NOT 24-bit truecolor: macOS Terminal.app doesn't support
+// truecolor and mangles it (the old indigo/cyan came out green). These indices are
+// universally supported. Navy (the logo mark) is too dark to read on a dark terminal,
+// so we use the app's ocean blues — the same "Open Water" gradient as the brand.
+const ESC = "\x1b[";
+const RESET = `${ESC}0m`;
+const BOLD = `${ESC}1m`;
+const c = (n: number): string => `${ESC}38;5;${n}m`;
+const OCEAN = c(39); // ≈ #00afff — primary ocean blue (anchor, wordmark "P")
+const OCEAN_LIGHT = c(81); // ≈ #5fd7ff — light sky accent (wordmark, version, path)
+const BORDER = c(32); // ≈ #0087d7 — deeper ocean, the frame
+const DIM = `${ESC}90m`;
+const GREEN = `${ESC}32m`;
+const YELLOW = `${ESC}33m`;
+
+// The Privateer mark in ASCII: a padlock (with keyhole) atop an anchor — "bring your
+// own model" meets lock-and-key privacy, echoing the app's anchor+padlock logo. Every
+// line is the same visible width (11) so the text column beside it stays aligned.
+const ANCHOR = [
+  "    .-.    ", // shackle arch
+  "   |   |   ", // shackle legs
+  "  .-----.  ", // lock body top (the shackle's base)
+  "  |  o  |  ", // lock body + keyhole
+  "  '--+--'  ", // lock body base, shank exits
+  "  ---+---  ", // stock (crossbar)
+  "  \\  |  /  ", // arms
+  "   \\_|_/   ", // flukes
+];
+
+// Visible width = characters after stripping SGR escapes. Everything we render inside
+// the box is ASCII or a BMP width-1 symbol, so a plain length is exact here.
+function vlen(s: string): number {
+  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+}
+
+// Strip ESC/C0/C1 control bytes from any value we did NOT author before it lands in a
+// render line. Account email/id/pubkey come from the server (via credentials.json),
+// the device user_code + verification_uri come off the device-code response, and cwd
+// comes from the filesystem — none is guaranteed free of raw escape sequences, which
+// would otherwise reach the terminal unsanitized. Our own SGR color codes are added
+// AFTER cleaning the untrusted substring, so they're preserved; normal printable text
+// (including Unicode) is untouched.
+// eslint-disable-next-line no-control-regex
+const CONTROL_RE = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f]", "g");
+function clean(s: unknown): string {
+  return String(s ?? "").replace(CONTROL_RE, "");
+}
+
+function shortCwd(): string {
+  const cwd = process.cwd();
+  const home = homedir();
+  const path = cwd === home || cwd.startsWith(home + "/") ? "~" + cwd.slice(home.length) : cwd;
+  return clean(path);
+}
+
+// The account line under the tagline — three states, ported from tree-cli's Banner:
+//  - signed in                              → "connected as <account>"
+//  - signed out AND the current model bills to a Privateer account → it can't run
+//    until they sign in, so say so plainly (warning)
+//  - signed out on their own key            → a quiet tease that /signin adds more
+function accountLine(modelProvider?: string): string {
+  const u = priv.currentUser();
+  if (u) {
+    const label = clean(u.email ?? (u.solanaPublicKey ? u.solanaPublicKey.slice(0, 6) + "…" : u.id));
+    return `${GREEN}connected${DIM} as ${RESET}${OCEAN_LIGHT}${label}${RESET}`;
+  }
+  if (modelProvider === "privateer") {
+    return `${YELLOW}not signed in · /signin to use this model${RESET}`;
+  }
+  return `${DIM}not signed in · ${OCEAN_LIGHT}/signin${DIM} to connect your account${RESET}`;
+}
+
+// Compose the framed banner: anchor column + text column, inside a rounded accent box.
+function renderBanner(width: number, modelProvider?: string): string[] {
+  // Leading blanks drop the text block so the wordmark sits beside the lock body and
+  // the shackle rises above it (one entry per anchor line — 8 total).
+  const right = [
+    "",
+    "",
+    `${BOLD}${OCEAN_LIGHT}✻ ${OCEAN}P${OCEAN_LIGHT}RIVATEER${RESET}`,
+    `${DIM}Chart your own course privately.${RESET}`,
+    "",
+    accountLine(modelProvider),
+    `${DIM}privateer-agent ${OCEAN_LIGHT}v${VERSION}${RESET}`,
+    `${OCEAN_LIGHT}${shortCwd()}${RESET}`,
+  ];
+  // Build the body rows (anchor + gutter + text).
+  const rows = ANCHOR.map((a, i) => `${OCEAN}${a}${RESET}  ${right[i] ?? ""}`);
+  const cap = Math.max(20, width - 4); // 2 border cells + 2 padding
+  const inner = Math.min(cap, Math.max(...rows.map(vlen)));
+  const bar = "─".repeat(inner + 2);
+  const out = [`${BORDER}╭${bar}╮${RESET}`];
+  for (const row of rows) {
+    const pad = Math.max(0, inner - vlen(row));
+    out.push(`${BORDER}│${RESET} ${row}${" ".repeat(pad)} ${BORDER}│${RESET}`);
+  }
+  out.push(`${BORDER}╰${bar}╯${RESET}`);
+  return out;
+}
+
+// A Pi header Component (setHeader factory return). Static banner; captures the model
+// provider so the account line reflects the picked model.
+function headerComponent(modelProvider?: string) {
+  return {
+    render: (width: number): string[] => renderBanner(width, modelProvider),
+    invalidate() {},
+  };
+}
+
+// Short account label for the footer badge.
+function accountBadge(): string {
+  const u = priv.currentUser();
+  if (!u) return "⚓ guest";
+  const label = clean(u.email ? u.email.split("@")[0] : u.solanaPublicKey ? u.solanaPublicKey.slice(0, 6) + "…" : u.id);
+  return `⚓ ${label}`;
+}
+
+export default function privateerBrand(pi: any): void {
+  let currentModelProvider: string | undefined;
+  let ctxRef: any = null;
+  let greeted = false;
+
+  const setHeader = (ctx: any) =>
+    ctx?.ui?.setHeader?.(() => headerComponent(currentModelProvider));
+
+  const refresh = (ctx: any) => {
+    if (!ctx?.hasUI) return;
+    setHeader(ctx);
+    ctx?.ui?.setStatus?.("account", accountBadge());
+  };
+
+  async function doSignIn(ctx: any): Promise<void> {
+    if (priv.hasCredentials()) {
+      const u = priv.currentUser();
+      return ctx?.ui?.notify?.(
+        `Already signed in as ${u?.email ?? u?.id}. Run /signout to switch accounts.`,
+        "info",
+      );
+    }
+    ctx?.ui?.notify?.("Connecting to Privateer — requesting a device code…", "info");
+    try {
+      const user = await priv.runDeviceLogin({
+        onCode: (code: any) => {
+          const uri = clean(code.verification_uri_complete ?? code.verification_uri ?? "");
+          const userCode = clean(code.user_code);
+          ctx?.ui?.setWidget?.(
+            "privateer-signin",
+            [
+              `${OCEAN_LIGHT}⚓ Sign in to Privateer${RESET}`,
+              `${DIM}Approve this terminal in the Privateer app:${RESET}`,
+              `   code   ${BOLD}${OCEAN}${userCode}${RESET}`,
+              uri ? `${DIM}   or open ${RESET}${OCEAN_LIGHT}${uri}${RESET}` : "",
+              `${DIM}   waiting for approval…${RESET}`,
+            ].filter(Boolean),
+            { placement: "aboveEditor" },
+          );
+        },
+      });
+      ctx?.ui?.setWidget?.("privateer-signin", undefined);
+      // Hot-register the account provider so privateer/* models appear without a restart.
+      try {
+        await makeAccountProvider()(pi);
+      } catch {
+        /* provider list fetch failed — models appear on next launch */
+      }
+      refresh(ctx);
+      ctx?.ui?.notify?.(`Signed in as ${user.email ?? user.id}. Your Privateer models are ready.`, "info");
+    } catch (e) {
+      ctx?.ui?.setWidget?.("privateer-signin", undefined);
+      ctx?.ui?.notify?.((e as Error).message || "Sign-in failed.", "error");
+    }
+  }
+
+  async function doSignOut(ctx: any): Promise<void> {
+    if (!priv.hasCredentials()) return ctx?.ui?.notify?.("Not signed in.", "info");
+    const u = priv.currentUser();
+    await priv.logout();
+    refresh(ctx);
+    ctx?.ui?.notify?.(`Signed out${u?.email ? ` (${u.email})` : ""}. Drop anchor for now.`, "info");
+  }
+
+  function showStatus(ctx: any): void {
+    const u = priv.currentUser();
+    ctx?.ui?.notify?.(
+      u
+        ? `Signed in to Privateer as ${u.email ?? u.id}.`
+        : "Not signed in. Run /signin to connect your Privateer account.",
+      "info",
+    );
+  }
+
+  pi.on("session_start", (_e: any, ctx: any) => {
+    ctxRef = ctx;
+    currentModelProvider = ctx?.model?.provider ?? currentModelProvider;
+    if (!ctx?.hasUI) return; // headless (print/json): no banner or prompts
+    ctx?.ui?.setTitle?.("Privateer");
+    refresh(ctx);
+    if (!priv.hasCredentials() && !greeted) {
+      greeted = true;
+      ctx?.ui?.notify?.(
+        "Not signed in — run /signin to connect your Privateer account (adds hosted models + remote access).",
+        "info",
+      );
+    }
+  });
+
+  // Keep the header's account line in sync with the picked model (the "this model
+  // needs sign-in" state depends on the current provider).
+  pi.on("model_select", (e: any, ctx: any) => {
+    ctxRef = ctx;
+    const next = e?.model?.provider;
+    if (next && next !== currentModelProvider) {
+      currentModelProvider = next;
+      setHeader(ctx);
+    }
+  });
+
+  // The machine login was invalidated server-side (TTL lapsed or revoked in the app):
+  // announce it and reflect it in the badge/header immediately.
+  priv.onSessionExpired(() => {
+    refresh(ctxRef);
+    ctxRef?.ui?.notify?.("Your Privateer session expired. Run /signin to sign back in.", "warning");
+  });
+
+  pi.registerCommand?.("signin", {
+    description: "Sign in to your Privateer account (device-code flow)",
+    handler: (_args: string, ctx: any) => doSignIn(ctx),
+  });
+  pi.registerCommand?.("signout", {
+    description: "Sign out of your Privateer account on this terminal",
+    handler: (_args: string, ctx: any) => doSignOut(ctx),
+  });
+  pi.registerCommand?.("privateer", {
+    description: "Privateer account: /privateer [status | signin | signout]",
+    handler: (args: string, ctx: any) => {
+      const sub = String(args ?? "").trim().toLowerCase().split(/\s+/)[0];
+      if (sub === "signin" || sub === "login") return doSignIn(ctx);
+      if (sub === "signout" || sub === "logout") return doSignOut(ctx);
+      return showStatus(ctx);
+    },
+  });
+}

package/extensions/privateer-gate.ts

@@ -0,0 +1,140 @@
+// The Privateer control extension for Pi's TUI (Phase 6): the permission gate PLUS
+// remote access, so the app can drive the real TUI (not just the lean REPL).
+//
+//   - gate: tool_call → block/allow via Pi's native approval UI (ctx.ui); /mode command.
+//   - remote access: /remote-access on connects the relay; the bridge routes the
+//     gate's approvals to the phone (getRemote/remoteAsk) and drives turns from app
+//     prompts (pi.sendUserMessage). Turn events forward to the app via the adapter —
+//     the same pi.on(...) stream the adapter already speaks.
+//
+// The gate + bridge share one extension so the gate's remote branch and the relay
+// are wired to the same state.
+
+import { makePermissionGate, defaultLocalAsk } from "../src/ext/permissionGate.ts";
+import { createEngineEventAdapter } from "../src/bridge/engineAdapter.ts";
+import { RemoteBridge } from "../src/remote/remoteBridge.ts";
+import { RelayClient } from "../src/remote/relayClient.ts";
+import { makeSendFileTool } from "../src/tools/sendFile.ts";
+import { makeSaveAttachmentTool } from "../src/tools/saveAttachment.ts";
+import { AttachmentStore, type StoredAttachment } from "../src/util/attachmentStore.ts";
+import * as priv from "../src/auth/privateer.ts";
+import type { PermissionMode } from "../src/config/permissionMode.ts";
+
+const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
+let mode: PermissionMode = MODES.includes(process.env.PRIVATEER_MODE as PermissionMode)
+  ? (process.env.PRIVATEER_MODE as PermissionMode)
+  : "default";
+const allowlist: string[] = [];
+const allowedOutsideRoots: string[] = [];
+
+let piRef: any = null;
+let relay: any = null;
+
+// Inbound app→CLI files land here (keyed by "#n"); save_attachment persists them.
+const attachments = new AttachmentStore();
+let sinceLastPrompt: StoredAttachment[] = [];
+
+const bridge = new RemoteBridge({
+  onPrompt: (text) => {
+    // Fold any files the app sent since the last prompt into a reference note so the
+    // model knows they exist and can save_attachment them.
+    const atts = sinceLastPrompt;
+    sinceLastPrompt = [];
+    const note = atts.length
+      ? `\n\n[Files attached from the app: ${atts.map((a) => `#${a.n} ${a.name} (${a.mediaType})`).join(", ")}. ` +
+        `Use the save_attachment tool with the ref number to write one to disk.]`
+      : "";
+    piRef?.sendUserMessage?.(text + note); // drive a turn in Pi's TUI
+  },
+  onInterrupt: () => {}, // Pi owns interrupt; best-effort no-op
+  onControllerAttached: () => relay?.sendSnapshot([{ kind: "notice", text: "Privateer terminal connected." }]),
+  onAttachment: (file) => sinceLastPrompt.push(attachments.register(file)),
+  onStatus: () => {},
+});
+
+const gate = makePermissionGate({
+  getMode: () => mode,
+  setMode: (m) => (mode = m),
+  allowlist,
+  allowedOutsideRoots,
+  cwd: process.cwd(),
+  localAsk: defaultLocalAsk,
+  getRemote: bridge.getRemote,
+  getNoQuarter: bridge.getNoQuarter,
+  remoteAsk: bridge.remoteAsk,
+});
+
+export default function privateerControl(pi: any): void {
+  piRef = pi;
+  gate(pi); // tool_call (block/allow) + tool_result (redact)
+
+  // File transfer both ways: send_file_to_client (CLI→app, via the bridge's relay) and
+  // save_attachment (app→CLI, from the AttachmentStore inbound files land in). Both
+  // live here because they share the RemoteBridge / its attachment stream.
+  pi.registerTool?.(makeSendFileTool(bridge));
+  pi.registerTool?.(makeSaveAttachmentTool(attachments));
+
+  // Subagents (and print/rpc) run as headless child `pi` processes with no UI. There
+  // no one can approve, so a "default" gate would fail-closed on every tool and the
+  // subagent couldn't work. Instead switch to bypass: auto-approve within the agent's
+  // OWN restricted tool set (pi-subagents' per-role `tools:` allowlist), while
+  // decideAuto STILL forces dangerous shell / secret-exfil / destructive actions to
+  // "ask" → headless → denied. So delegation is gated in the parent (the spawn tool
+  // call), and the subagent is bounded by its role + danger detection. The TUI
+  // (mode "tui") keeps the interactive default gate.
+  // Explicit ALLOWLIST of headless run modes — never an "anything but tui" denylist,
+  // so an unexpected/undefined mode in the interactive TUI can't silently drop us into
+  // bypass (which would run tools ungated). Only switch when we're *sure* it's headless
+  // and the user hasn't pinned a mode via PRIVATEER_MODE.
+  const HEADLESS = new Set(["json", "print", "rpc"]);
+  pi.on("session_start", (_e: any, ctx: any) => {
+    if (ctx?.mode && HEADLESS.has(ctx.mode) && (process.env.PRIVATEER_MODE ?? "") === "") {
+      mode = "bypass";
+    }
+  });
+
+  // Forward turn events to the app. The relay only sends when a controller is
+  // attached, so this is safe on every turn (local or remote).
+  const adapter = createEngineEventAdapter();
+  const fwd = (ev: any) => {
+    for (const ee of adapter.toEngineEvents(ev)) bridge.forwardEvent(ee);
+  };
+  pi.on("message_update", (ev: any) => fwd(ev));
+  pi.on("tool_execution_start", (ev: any) => fwd(ev));
+  pi.on("tool_execution_end", (ev: any) => fwd(ev));
+  pi.on("turn_end", (ev: any) => fwd(ev));
+  // A remote-initiated agent run ends here → clear the remote flag so a later
+  // locally-typed turn isn't treated as remote.
+  pi.on("agent_end", (ev: any) => {
+    fwd(ev);
+    bridge.settleTurn();
+  });
+
+  pi.registerCommand?.("mode", {
+    description: "Show or set the permission mode: default | acceptEdits | bypass | plan",
+    handler: (args: string, ctx: any) => {
+      const m = String(args ?? "").trim() as PermissionMode;
+      if (m && MODES.includes(m)) mode = m;
+      else if (m) return ctx.ui?.notify?.(`unknown mode "${m}" — use ${MODES.join(" | ")}`, "warning");
+      ctx.ui?.notify?.(`permission mode: ${mode}`, "info");
+    },
+  });
+
+  pi.registerCommand?.("remote-access", {
+    description: "Drive this terminal from the Privateer app: /remote-access on | off",
+    handler: async (args: string, ctx: any) => {
+      const off = String(args ?? "").trim().toLowerCase() === "off";
+      if (off) {
+        relay?.stop();
+        relay = null;
+        return ctx.ui?.notify?.("remote access off", "info");
+      }
+      if (relay) return ctx.ui?.notify?.("remote access already on", "info");
+      if (!priv.hasCredentials()) return ctx.ui?.notify?.("Not signed in to Privateer.", "warning");
+      relay = new RelayClient(bridge.callbacks, { label: "privateer-cli" });
+      bridge.attachRelay(relay);
+      await relay.start();
+      ctx.ui?.notify?.("Remote access on — approve this terminal in the Privateer app, then drive it from there.", "info");
+    },
+  });
+}

package/extensions/privateer-posture.ts

@@ -0,0 +1,42 @@
+// The privacy-posture badge in Pi's status bar (Phase 6 polish). On model select
+// (and at session start) it computes the current model's posture and pins it to the
+// footer via ctx.ui.setStatus — so the moat is *visible*: a green "Verified TEE"
+// for an attested enclave, a distinct label for a mere ZDR claim.
+//
+// Handles both surfaces: the account channel (privateer/*, via server-proxy
+// attestation) which pi-privacy doesn't know, and everything else via pi-privacy.
+
+import { verifyModelPosture, TIERS, type PrivacyTier } from "pi-privacy";
+import { accountPosture } from "../src/providers/account.ts";
+
+const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
+
+async function badgeFor(provider: string, modelId: string): Promise<string> {
+  const res =
+    provider === "privateer"
+      ? await accountPosture(modelId)
+      : await verifyModelPosture(provider, modelId, {
+          apiKey: provider === "nearai" ? process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY : undefined,
+        });
+  const info = TIERS[res.tier as PrivacyTier];
+  return `${DOT[info.posture] ?? "⚪"} ${info.label}`;
+}
+
+export default function privateerPosture(pi: any): void {
+  // "latest wins" so rapid model cycling (Ctrl+P) doesn't leave a stale badge.
+  let seq = 0;
+  const update = async (provider?: string, modelId?: string, ctx?: any) => {
+    if (!provider || !modelId || !ctx?.ui?.setStatus) return;
+    const mine = ++seq;
+    try {
+      ctx.ui.setStatus("privacy", "⛉ …"); // immediate placeholder while attesting
+      const badge = await badgeFor(provider, modelId);
+      if (mine === seq) ctx.ui.setStatus("privacy", badge);
+    } catch {
+      if (mine === seq) ctx.ui.setStatus("privacy", undefined);
+    }
+  };
+
+  pi.on("model_select", (event: any, ctx: any) => update(event?.model?.provider, event?.model?.id, ctx));
+  pi.on("session_start", (_event: any, ctx: any) => update(ctx?.model?.provider, ctx?.model?.id, ctx));
+}

package/extensions/privateer-privacy.ts

@@ -0,0 +1,15 @@
+// pi-privacy for privateer-agent: the standard pi-privacy extension (providers +
+// attestation + posture badge feed + PII gate) PLUS a tier resolver that teaches it
+// about the private ACCOUNT channel it doesn't ship — so a privateer/near… model
+// (actually confidential-compute TEE) is treated as verified-private (no PII
+// over-warning), and a zdr account model as zdr-policy. Replaces loading pi-privacy's
+// default entry directly.
+import { makePiPrivacyExtension } from "pi-privacy";
+import { accountPosture } from "../src/providers/account.ts";
+
+export default makePiPrivacyExtension({
+  resolveTier: async (provider, modelId) => {
+    if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
+    return (await accountPosture(modelId)).tier;
+  },
+});

package/extensions/privateer-tools.ts

@@ -0,0 +1,9 @@
+// Privateer-specific custom tools for Pi's TUI (Phase 5). Today: create_routine
+// (schedule unattended tasks → the daemon runs them). The generic tools (read/edit/
+// bash/grep, web, subagents, todo) come from Pi builtins + adopted packages, so only
+// the privateer-only tools live here. Gated by our permission-gate extension.
+import { routineToolDefinition } from "../src/tools/routine.ts";
+
+export default function privateerTools(pi: any): void {
+  pi.registerTool?.(routineToolDefinition);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -28,7 +28,7 @@
     "venice"
   ],
   "bin": {
-    "privateer": "./bin/privateer.mjs"
+    "privateer": "./bin/privateer-tui"
   },
   "publishConfig": {
     "access": "public"
@@ -36,6 +36,7 @@
   "files": [
     "bin",
     "src",
+    "extensions",
     "README.md",
     "LICENSE"
   ],
@@ -59,7 +60,7 @@
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.7.1",
     "pi-mcp-adapter": "^2.11.0",
-    "pi-privacy": "^0.2.0",
+    "pi-privacy": "^0.3.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
     "tsx": "^4.16.0",

package/src/providers/catalog.ts

@@ -1,9 +1,10 @@
-// The provider landscape — the single map of how each of privateer's 21 providers
+// The provider landscape — the single map of how each of privateer's 22 providers
 // becomes reachable under Pi. Written after verifying (2026-07-07) that:
 //   - pi-ai ships STATIC model catalogs for its 14 built-in providers, so they're
 //     selectable once a key is present — privateer emits NO models.json entry for them;
-//   - the `pi-privacy` extension registers the 5 privacy providers (tinfoil, nearai,
-//     venice, ollama, custom) at load — privateer emits NO entry for them either;
+//   - the `pi-privacy` extension registers the 6 privacy providers (tinfoil, nearai,
+//     venice, ollama, custom, privateer-api) at load — privateer emits NO entry for
+//     them either;
 //   - so the ONLY provider this generator must emit is `qwen` (config-only,
 //     non-privacy, no built-in catalog), and `privateer` (the account OAuth channel)
 //     is handled in code, not config (Phase 4).
@@ -65,6 +66,9 @@ export const PROVIDERS: ProviderEntry[] = [
   { id: "tinfoil", source: "pi-privacy" },
   { id: "venice", source: "pi-privacy" },
   { id: "custom", source: "pi-privacy" },
+  // Public developer-API surface (sk-priv-… key). Registered by the pi-privacy
+  // extension like the others; distinct from the in-app `privateer` account channel.
+  { id: "privateer-api", source: "pi-privacy" },
   { id: "privateer", source: "account" },
 ];