privateer-agent 0.3.1 → 0.3.3

package/README.md

@@ -12,6 +12,9 @@
   <a href="https://www.npmjs.com/package/privateer-agent">
     <img src="https://img.shields.io/npm/v/privateer-agent" alt="npm" />
   </a>
+  <a href="https://github.com/privateer-agent/privateer-agent/releases">
+    <img src="https://img.shields.io/badge/changelog-what's%20new-5b8def" alt="Changelog" />
+  </a>
   <img src="https://img.shields.io/badge/node-%E2%89%A522.19-brightgreen" alt="Node >= 22.19" />
   <img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License" />
   <img src="https://img.shields.io/badge/permissions-safe%20by%20default-2ea44f" alt="Safe by default" />
@@ -247,6 +250,12 @@ npm run typecheck
 npm test
 ```
 
+## Changelog
+
+Release notes and what's new in each version live on the
+[**GitHub releases page**](https://github.com/privateer-agent/privateer-agent/releases).
+Privateer keeps its startup clean — the app won't dump a changelog into your terminal.
+
 ## License
 
 [MIT](LICENSE) © Patrick

package/bin/privateer-tui

@@ -59,15 +59,27 @@ shim pi-subagents      "$REPO/node_modules/pi-subagents/src/extension/index.ts"
 
 CLI="$REPO/node_modules/@earendil-works/pi-coding-agent/dist/cli.js"
 export PI_CODING_AGENT_DIR="$AGENT_DIR"
+# Suppress Pi's upstream "Update Available — run `pi update`" banner. It's noise on a
+# Privateer install (our banner is the startup surface), it leaks the "pi" name, and
+# `pi update` would fight our npm-managed install. PI_SKIP_VERSION_CHECK disables ONLY
+# the version fetch — unlike PI_OFFLINE it still lets fd/rg download on first run.
+export PI_SKIP_VERSION_CHECK=1
 NODE_BIN="$(pick_node)"
 
-# Quiet Pi's built-in startup resource listing ([Extensions]/[Context]/[Skills]/…) by
-# default — our banner is the intended startup surface, and the extension list is noise.
-# Only set it when unset, so a later `--verbose` or a user's own settings toggle sticks.
+# Quiet Pi's built-in startup chatter so our banner is the only greeting. Each key is
+# set only when unset, so a user's own settings.json toggle (or --verbose) still wins:
+#   quietStartup       — hide the [Extensions]/[Context]/[Skills]/… resource listing
+#   collapseChangelog  — never dump Pi's "What's New" changelog wall into the chat
+#   lastChangelogVersion — sentinel so Pi finds no "new" entries to show on upgrade;
+#                          release notes live in the npm README / GitHub releases instead
 "$NODE_BIN" -e '
 const fs = require("fs"), p = process.argv[1];
 let s = {}; try { s = JSON.parse(fs.readFileSync(p, "utf8")); } catch {}
-if (s.quietStartup === undefined) { s.quietStartup = true; fs.writeFileSync(p, JSON.stringify(s, null, 2) + "\n"); }
+let m = false;
+if (s.quietStartup === undefined) { s.quietStartup = true; m = true; }
+if (s.collapseChangelog === undefined) { s.collapseChangelog = true; m = true; }
+if (s.lastChangelogVersion === undefined) { s.lastChangelogVersion = "9999.0.0"; m = true; }
+if (m) fs.writeFileSync(p, JSON.stringify(s, null, 2) + "\n");
 ' "$AGENT_DIR/settings.json" 2>/dev/null || true
 
 # Default model: when signed in to a Privateer account, default to GLM 5.1 on the
@@ -83,4 +95,10 @@ else
   MODEL="openrouter/openai/gpt-4o-mini"
 fi
 
-exec "$NODE_BIN" --env-file="$REPO/.env" "$CLI" --model "$MODEL" "$@"
+# Dev convenience: load provider keys from the repo's .env if present. A real install
+# has none — so only pass the flag when the file exists (using --env-file-if-exists
+# unconditionally would print "…/.env not found. Continuing without it." on every
+# launch, muddying the startup banner). No .env → rely on the ambient environment.
+ENV_ARGS=""
+[ -f "$REPO/.env" ] && ENV_ARGS="--env-file=$REPO/.env"
+exec "$NODE_BIN" ${ENV_ARGS:+"$ENV_ARGS"} "$CLI" --model "$MODEL" "$@"

package/extensions/privateer-account.ts

@@ -0,0 +1,6 @@
+// The Privateer account provider as a Pi extension (for `-e` into Pi's TUI).
+// Registers the `privateer` subscription channel when a machine login exists; Pi's
+// own OAuth /login flow drives the child-session credential.
+import { makeAccountProvider } from "../src/providers/account.ts";
+
+export default makeAccountProvider();

package/extensions/privateer-brand.ts

@@ -0,0 +1,271 @@
+// Privateer branding for Pi's TUI + the account (sign-in) surface. Three concerns
+// live together here because they share one piece of state — whether this terminal
+// is signed in to a Privateer account:
+//
+//   1. A branded startup header — the anchor mark + "✻ PRIVATEER" wordmark + the
+//      "Chart your own course privately." tagline (ported from tree-cli's Banner).
+//   2. A live status-bar badge (⚓ account) showing the sign-in state at a glance.
+//   3. Sign-in UX — /signin, /signout, and a /privateer hub — which drive the
+//      device-code flow the account channel needs.
+//
+// Pi already owns /login and /logout for PROVIDER auth (and /whoami), so we do NOT
+// shadow them. The account provider now registers unconditionally (see
+// makeAccountProvider), so Privateer appears under Pi's /login "Use a subscription"
+// list and a first-time user CAN sign in through provider auth. /signin remains as a
+// friendlier, dedicated shortcut that drives the same account device-code flow
+// directly — one obvious command instead of /login → pick a provider.
+//
+// On a successful /signin we hot-register the account provider so privateer/* models
+// appear immediately (the account catalog refreshes to the live listing without a
+// restart).
+
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import * as priv from "../src/auth/privateer.ts";
+import { makeAccountProvider } from "../src/providers/account.ts";
+
+const VERSION: string = (() => {
+  try {
+    return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+  } catch {
+    return "0.3.0";
+  }
+})();
+
+// ── palette (Privateer "Open Water" ocean-blue brand) ────────────────────────
+// 256-color (8-bit), NOT 24-bit truecolor: macOS Terminal.app doesn't support
+// truecolor and mangles it (the old indigo/cyan came out green). These indices are
+// universally supported. Navy (the logo mark) is too dark to read on a dark terminal,
+// so we use the app's ocean blues — the same "Open Water" gradient as the brand.
+const ESC = "\x1b[";
+const RESET = `${ESC}0m`;
+const BOLD = `${ESC}1m`;
+const c = (n: number): string => `${ESC}38;5;${n}m`;
+const OCEAN = c(39); // ≈ #00afff — primary ocean blue (anchor, wordmark "P")
+const OCEAN_LIGHT = c(81); // ≈ #5fd7ff — light sky accent (wordmark, version, path)
+const BORDER = c(32); // ≈ #0087d7 — deeper ocean, the frame
+const DIM = `${ESC}90m`;
+const GREEN = `${ESC}32m`;
+const YELLOW = `${ESC}33m`;
+
+// The Privateer mark in ASCII: a padlock (with keyhole) atop an anchor — "bring your
+// own model" meets lock-and-key privacy, echoing the app's anchor+padlock logo. Every
+// line is the same visible width (11) so the text column beside it stays aligned.
+const ANCHOR = [
+  "    .-.    ", // shackle arch
+  "   |   |   ", // shackle legs
+  "  .-----.  ", // lock body top (the shackle's base)
+  "  |  o  |  ", // lock body + keyhole
+  "  '--+--'  ", // lock body base, shank exits
+  "  /\\ | /\\  ", // stock — arms flare from the shank (each \\ is one backslash)
+  "  \\  |  /  ", // arms
+  "   \\_|_/   ", // flukes
+];
+
+// Visible width = characters after stripping SGR escapes. Everything we render inside
+// the box is ASCII or a BMP width-1 symbol, so a plain length is exact here.
+function vlen(s: string): number {
+  return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+}
+
+// Strip ESC/C0/C1 control bytes from any value we did NOT author before it lands in a
+// render line. Account email/id/pubkey come from the server (via credentials.json),
+// the device user_code + verification_uri come off the device-code response, and cwd
+// comes from the filesystem — none is guaranteed free of raw escape sequences, which
+// would otherwise reach the terminal unsanitized. Our own SGR color codes are added
+// AFTER cleaning the untrusted substring, so they're preserved; normal printable text
+// (including Unicode) is untouched.
+// eslint-disable-next-line no-control-regex
+const CONTROL_RE = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f]", "g");
+function clean(s: unknown): string {
+  return String(s ?? "").replace(CONTROL_RE, "");
+}
+
+function shortCwd(): string {
+  const cwd = process.cwd();
+  const home = homedir();
+  const path = cwd === home || cwd.startsWith(home + "/") ? "~" + cwd.slice(home.length) : cwd;
+  return clean(path);
+}
+
+// The account line under the tagline — three states, ported from tree-cli's Banner:
+//  - signed in                              → "connected as <account>"
+//  - signed out AND the current model bills to a Privateer account → it can't run
+//    until they sign in, so say so plainly (warning)
+//  - signed out on their own key            → a quiet tease that /signin adds more
+function accountLine(modelProvider?: string): string {
+  const u = priv.currentUser();
+  if (u) {
+    const label = clean(u.email ?? (u.solanaPublicKey ? u.solanaPublicKey.slice(0, 6) + "…" : u.id));
+    return `${GREEN}connected${DIM} as ${RESET}${OCEAN_LIGHT}${label}${RESET}`;
+  }
+  if (modelProvider === "privateer") {
+    return `${YELLOW}not signed in · /signin to use this model${RESET}`;
+  }
+  return `${DIM}not signed in · ${OCEAN_LIGHT}/signin${DIM} to connect your account${RESET}`;
+}
+
+// Compose the framed banner: anchor column + text column, inside a rounded accent box.
+function renderBanner(width: number, modelProvider?: string): string[] {
+  // Leading blanks drop the text block so the wordmark sits beside the lock body and
+  // the shackle rises above it (one entry per anchor line — 8 total).
+  const right = [
+    "",
+    "",
+    `${BOLD}${OCEAN_LIGHT}✻ ${OCEAN}P${OCEAN_LIGHT}RIVATEER${RESET}`,
+    `${DIM}Chart your own course privately.${RESET}`,
+    "",
+    accountLine(modelProvider),
+    `${DIM}privateer-agent ${OCEAN_LIGHT}v${VERSION}${RESET}`,
+    `${OCEAN_LIGHT}${shortCwd()}${RESET}`,
+  ];
+  // Build the body rows (anchor + gutter + text).
+  const rows = ANCHOR.map((a, i) => `${OCEAN}${a}${RESET}  ${right[i] ?? ""}`);
+  const cap = Math.max(20, width - 4); // 2 border cells + 2 padding
+  const inner = Math.min(cap, Math.max(...rows.map(vlen)));
+  const bar = "─".repeat(inner + 2);
+  const out = [`${BORDER}╭${bar}╮${RESET}`];
+  for (const row of rows) {
+    const pad = Math.max(0, inner - vlen(row));
+    out.push(`${BORDER}│${RESET} ${row}${" ".repeat(pad)} ${BORDER}│${RESET}`);
+  }
+  out.push(`${BORDER}╰${bar}╯${RESET}`);
+  return out;
+}
+
+// A Pi header Component (setHeader factory return). Static banner; captures the model
+// provider so the account line reflects the picked model.
+function headerComponent(modelProvider?: string) {
+  return {
+    render: (width: number): string[] => renderBanner(width, modelProvider),
+    invalidate() {},
+  };
+}
+
+// Short account label for the footer badge.
+function accountBadge(): string {
+  const u = priv.currentUser();
+  if (!u) return "⚓ guest";
+  const label = clean(u.email ? u.email.split("@")[0] : u.solanaPublicKey ? u.solanaPublicKey.slice(0, 6) + "…" : u.id);
+  return `⚓ ${label}`;
+}
+
+export default function privateerBrand(pi: any): void {
+  let currentModelProvider: string | undefined;
+  let ctxRef: any = null;
+
+  const setHeader = (ctx: any) =>
+    ctx?.ui?.setHeader?.(() => headerComponent(currentModelProvider));
+
+  const refresh = (ctx: any) => {
+    if (!ctx?.hasUI) return;
+    setHeader(ctx);
+    ctx?.ui?.setStatus?.("account", accountBadge());
+  };
+
+  async function doSignIn(ctx: any): Promise<void> {
+    if (priv.hasCredentials()) {
+      const u = priv.currentUser();
+      return ctx?.ui?.notify?.(
+        `Already signed in as ${u?.email ?? u?.id}. Run /signout to switch accounts.`,
+        "info",
+      );
+    }
+    ctx?.ui?.notify?.("Connecting to Privateer — requesting a device code…", "info");
+    try {
+      const user = await priv.runDeviceLogin({
+        onCode: (code: any) => {
+          const uri = clean(code.verification_uri_complete ?? code.verification_uri ?? "");
+          const userCode = clean(code.user_code);
+          ctx?.ui?.setWidget?.(
+            "privateer-signin",
+            [
+              `${OCEAN_LIGHT}⚓ Sign in to Privateer${RESET}`,
+              `${DIM}Approve this terminal in the Privateer app:${RESET}`,
+              `   code   ${BOLD}${OCEAN}${userCode}${RESET}`,
+              uri ? `${DIM}   or open ${RESET}${OCEAN_LIGHT}${uri}${RESET}` : "",
+              `${DIM}   waiting for approval…${RESET}`,
+            ].filter(Boolean),
+            { placement: "aboveEditor" },
+          );
+        },
+      });
+      ctx?.ui?.setWidget?.("privateer-signin", undefined);
+      // Hot-register the account provider so privateer/* models appear without a restart.
+      try {
+        await makeAccountProvider()(pi);
+      } catch {
+        /* provider list fetch failed — models appear on next launch */
+      }
+      refresh(ctx);
+      ctx?.ui?.notify?.(`Signed in as ${user.email ?? user.id}. Your Privateer models are ready.`, "info");
+    } catch (e) {
+      ctx?.ui?.setWidget?.("privateer-signin", undefined);
+      ctx?.ui?.notify?.((e as Error).message || "Sign-in failed.", "error");
+    }
+  }
+
+  async function doSignOut(ctx: any): Promise<void> {
+    if (!priv.hasCredentials()) return ctx?.ui?.notify?.("Not signed in.", "info");
+    const u = priv.currentUser();
+    await priv.logout();
+    refresh(ctx);
+    ctx?.ui?.notify?.(`Signed out${u?.email ? ` (${u.email})` : ""}. Drop anchor for now.`, "info");
+  }
+
+  function showStatus(ctx: any): void {
+    const u = priv.currentUser();
+    ctx?.ui?.notify?.(
+      u
+        ? `Signed in to Privateer as ${u.email ?? u.id}.`
+        : "Not signed in. Run /signin to connect your Privateer account.",
+      "info",
+    );
+  }
+
+  pi.on("session_start", (_e: any, ctx: any) => {
+    ctxRef = ctx;
+    currentModelProvider = ctx?.model?.provider ?? currentModelProvider;
+    if (!ctx?.hasUI) return; // headless (print/json): no banner or prompts
+    ctx?.ui?.setTitle?.("Privateer");
+    refresh(ctx);
+    // No startup notify here: the banner's account line already surfaces the
+    // "not signed in · /signin" prompt, so a second line would just be noise.
+  });
+
+  // Keep the header's account line in sync with the picked model (the "this model
+  // needs sign-in" state depends on the current provider).
+  pi.on("model_select", (e: any, ctx: any) => {
+    ctxRef = ctx;
+    const next = e?.model?.provider;
+    if (next && next !== currentModelProvider) {
+      currentModelProvider = next;
+      setHeader(ctx);
+    }
+  });
+
+  // The machine login was invalidated server-side (TTL lapsed or revoked in the app):
+  // announce it and reflect it in the badge/header immediately.
+  priv.onSessionExpired(() => {
+    refresh(ctxRef);
+    ctxRef?.ui?.notify?.("Your Privateer session expired. Run /signin to sign back in.", "warning");
+  });
+
+  pi.registerCommand?.("signin", {
+    description: "Sign in to your Privateer account (device-code flow)",
+    handler: (_args: string, ctx: any) => doSignIn(ctx),
+  });
+  pi.registerCommand?.("signout", {
+    description: "Sign out of your Privateer account on this terminal",
+    handler: (_args: string, ctx: any) => doSignOut(ctx),
+  });
+  pi.registerCommand?.("privateer", {
+    description: "Privateer account: /privateer [status | signin | signout]",
+    handler: (args: string, ctx: any) => {
+      const sub = String(args ?? "").trim().toLowerCase().split(/\s+/)[0];
+      if (sub === "signin" || sub === "login") return doSignIn(ctx);
+      if (sub === "signout" || sub === "logout") return doSignOut(ctx);
+      return showStatus(ctx);
+    },
+  });
+}

package/extensions/privateer-gate.ts

@@ -0,0 +1,140 @@
+// The Privateer control extension for Pi's TUI (Phase 6): the permission gate PLUS
+// remote access, so the app can drive the real TUI (not just the lean REPL).
+//
+//   - gate: tool_call → block/allow via Pi's native approval UI (ctx.ui); /mode command.
+//   - remote access: /remote-access on connects the relay; the bridge routes the
+//     gate's approvals to the phone (getRemote/remoteAsk) and drives turns from app
+//     prompts (pi.sendUserMessage). Turn events forward to the app via the adapter —
+//     the same pi.on(...) stream the adapter already speaks.
+//
+// The gate + bridge share one extension so the gate's remote branch and the relay
+// are wired to the same state.
+
+import { makePermissionGate, defaultLocalAsk } from "../src/ext/permissionGate.ts";
+import { createEngineEventAdapter } from "../src/bridge/engineAdapter.ts";
+import { RemoteBridge } from "../src/remote/remoteBridge.ts";
+import { RelayClient } from "../src/remote/relayClient.ts";
+import { makeSendFileTool } from "../src/tools/sendFile.ts";
+import { makeSaveAttachmentTool } from "../src/tools/saveAttachment.ts";
+import { AttachmentStore, type StoredAttachment } from "../src/util/attachmentStore.ts";
+import * as priv from "../src/auth/privateer.ts";
+import type { PermissionMode } from "../src/config/permissionMode.ts";
+
+const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
+let mode: PermissionMode = MODES.includes(process.env.PRIVATEER_MODE as PermissionMode)
+  ? (process.env.PRIVATEER_MODE as PermissionMode)
+  : "default";
+const allowlist: string[] = [];
+const allowedOutsideRoots: string[] = [];
+
+let piRef: any = null;
+let relay: any = null;
+
+// Inbound app→CLI files land here (keyed by "#n"); save_attachment persists them.
+const attachments = new AttachmentStore();
+let sinceLastPrompt: StoredAttachment[] = [];
+
+const bridge = new RemoteBridge({
+  onPrompt: (text) => {
+    // Fold any files the app sent since the last prompt into a reference note so the
+    // model knows they exist and can save_attachment them.
+    const atts = sinceLastPrompt;
+    sinceLastPrompt = [];
+    const note = atts.length
+      ? `\n\n[Files attached from the app: ${atts.map((a) => `#${a.n} ${a.name} (${a.mediaType})`).join(", ")}. ` +
+        `Use the save_attachment tool with the ref number to write one to disk.]`
+      : "";
+    piRef?.sendUserMessage?.(text + note); // drive a turn in Pi's TUI
+  },
+  onInterrupt: () => {}, // Pi owns interrupt; best-effort no-op
+  onControllerAttached: () => relay?.sendSnapshot([{ kind: "notice", text: "Privateer terminal connected." }]),
+  onAttachment: (file) => sinceLastPrompt.push(attachments.register(file)),
+  onStatus: () => {},
+});
+
+const gate = makePermissionGate({
+  getMode: () => mode,
+  setMode: (m) => (mode = m),
+  allowlist,
+  allowedOutsideRoots,
+  cwd: process.cwd(),
+  localAsk: defaultLocalAsk,
+  getRemote: bridge.getRemote,
+  getNoQuarter: bridge.getNoQuarter,
+  remoteAsk: bridge.remoteAsk,
+});
+
+export default function privateerControl(pi: any): void {
+  piRef = pi;
+  gate(pi); // tool_call (block/allow) + tool_result (redact)
+
+  // File transfer both ways: send_file_to_client (CLI→app, via the bridge's relay) and
+  // save_attachment (app→CLI, from the AttachmentStore inbound files land in). Both
+  // live here because they share the RemoteBridge / its attachment stream.
+  pi.registerTool?.(makeSendFileTool(bridge));
+  pi.registerTool?.(makeSaveAttachmentTool(attachments));
+
+  // Subagents (and print/rpc) run as headless child `pi` processes with no UI. There
+  // no one can approve, so a "default" gate would fail-closed on every tool and the
+  // subagent couldn't work. Instead switch to bypass: auto-approve within the agent's
+  // OWN restricted tool set (pi-subagents' per-role `tools:` allowlist), while
+  // decideAuto STILL forces dangerous shell / secret-exfil / destructive actions to
+  // "ask" → headless → denied. So delegation is gated in the parent (the spawn tool
+  // call), and the subagent is bounded by its role + danger detection. The TUI
+  // (mode "tui") keeps the interactive default gate.
+  // Explicit ALLOWLIST of headless run modes — never an "anything but tui" denylist,
+  // so an unexpected/undefined mode in the interactive TUI can't silently drop us into
+  // bypass (which would run tools ungated). Only switch when we're *sure* it's headless
+  // and the user hasn't pinned a mode via PRIVATEER_MODE.
+  const HEADLESS = new Set(["json", "print", "rpc"]);
+  pi.on("session_start", (_e: any, ctx: any) => {
+    if (ctx?.mode && HEADLESS.has(ctx.mode) && (process.env.PRIVATEER_MODE ?? "") === "") {
+      mode = "bypass";
+    }
+  });
+
+  // Forward turn events to the app. The relay only sends when a controller is
+  // attached, so this is safe on every turn (local or remote).
+  const adapter = createEngineEventAdapter();
+  const fwd = (ev: any) => {
+    for (const ee of adapter.toEngineEvents(ev)) bridge.forwardEvent(ee);
+  };
+  pi.on("message_update", (ev: any) => fwd(ev));
+  pi.on("tool_execution_start", (ev: any) => fwd(ev));
+  pi.on("tool_execution_end", (ev: any) => fwd(ev));
+  pi.on("turn_end", (ev: any) => fwd(ev));
+  // A remote-initiated agent run ends here → clear the remote flag so a later
+  // locally-typed turn isn't treated as remote.
+  pi.on("agent_end", (ev: any) => {
+    fwd(ev);
+    bridge.settleTurn();
+  });
+
+  pi.registerCommand?.("mode", {
+    description: "Show or set the permission mode: default | acceptEdits | bypass | plan",
+    handler: (args: string, ctx: any) => {
+      const m = String(args ?? "").trim() as PermissionMode;
+      if (m && MODES.includes(m)) mode = m;
+      else if (m) return ctx.ui?.notify?.(`unknown mode "${m}" — use ${MODES.join(" | ")}`, "warning");
+      ctx.ui?.notify?.(`permission mode: ${mode}`, "info");
+    },
+  });
+
+  pi.registerCommand?.("remote-access", {
+    description: "Drive this terminal from the Privateer app: /remote-access on | off",
+    handler: async (args: string, ctx: any) => {
+      const off = String(args ?? "").trim().toLowerCase() === "off";
+      if (off) {
+        relay?.stop();
+        relay = null;
+        return ctx.ui?.notify?.("remote access off", "info");
+      }
+      if (relay) return ctx.ui?.notify?.("remote access already on", "info");
+      if (!priv.hasCredentials()) return ctx.ui?.notify?.("Not signed in to Privateer.", "warning");
+      relay = new RelayClient(bridge.callbacks, { label: "privateer-cli" });
+      bridge.attachRelay(relay);
+      await relay.start();
+      ctx.ui?.notify?.("Remote access on — approve this terminal in the Privateer app, then drive it from there.", "info");
+    },
+  });
+}

package/extensions/privateer-posture.ts

@@ -0,0 +1,42 @@
+// The privacy-posture badge in Pi's status bar (Phase 6 polish). On model select
+// (and at session start) it computes the current model's posture and pins it to the
+// footer via ctx.ui.setStatus — so the moat is *visible*: a green "Verified TEE"
+// for an attested enclave, a distinct label for a mere ZDR claim.
+//
+// Handles both surfaces: the account channel (privateer/*, via server-proxy
+// attestation) which pi-privacy doesn't know, and everything else via pi-privacy.
+
+import { verifyModelPosture, TIERS, type PrivacyTier } from "pi-privacy";
+import { accountPosture } from "../src/providers/account.ts";
+
+const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
+
+async function badgeFor(provider: string, modelId: string): Promise<string> {
+  const res =
+    provider === "privateer"
+      ? await accountPosture(modelId)
+      : await verifyModelPosture(provider, modelId, {
+          apiKey: provider === "nearai" ? process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY : undefined,
+        });
+  const info = TIERS[res.tier as PrivacyTier];
+  return `${DOT[info.posture] ?? "⚪"} ${info.label}`;
+}
+
+export default function privateerPosture(pi: any): void {
+  // "latest wins" so rapid model cycling (Ctrl+P) doesn't leave a stale badge.
+  let seq = 0;
+  const update = async (provider?: string, modelId?: string, ctx?: any) => {
+    if (!provider || !modelId || !ctx?.ui?.setStatus) return;
+    const mine = ++seq;
+    try {
+      ctx.ui.setStatus("privacy", "⛉ …"); // immediate placeholder while attesting
+      const badge = await badgeFor(provider, modelId);
+      if (mine === seq) ctx.ui.setStatus("privacy", badge);
+    } catch {
+      if (mine === seq) ctx.ui.setStatus("privacy", undefined);
+    }
+  };
+
+  pi.on("model_select", (event: any, ctx: any) => update(event?.model?.provider, event?.model?.id, ctx));
+  pi.on("session_start", (_event: any, ctx: any) => update(ctx?.model?.provider, ctx?.model?.id, ctx));
+}

package/extensions/privateer-privacy.ts

@@ -0,0 +1,15 @@
+// pi-privacy for privateer-agent: the standard pi-privacy extension (providers +
+// attestation + posture badge feed + PII gate) PLUS a tier resolver that teaches it
+// about the private ACCOUNT channel it doesn't ship — so a privateer/near… model
+// (actually confidential-compute TEE) is treated as verified-private (no PII
+// over-warning), and a zdr account model as zdr-policy. Replaces loading pi-privacy's
+// default entry directly.
+import { makePiPrivacyExtension } from "pi-privacy";
+import { accountPosture } from "../src/providers/account.ts";
+
+export default makePiPrivacyExtension({
+  resolveTier: async (provider, modelId) => {
+    if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
+    return (await accountPosture(modelId)).tier;
+  },
+});

package/extensions/privateer-tools.ts

@@ -0,0 +1,9 @@
+// Privateer-specific custom tools for Pi's TUI (Phase 5). Today: create_routine
+// (schedule unattended tasks → the daemon runs them). The generic tools (read/edit/
+// bash/grep, web, subagents, todo) come from Pi builtins + adopted packages, so only
+// the privateer-only tools live here. Gated by our permission-gate extension.
+import { routineToolDefinition } from "../src/tools/routine.ts";
+
+export default function privateerTools(pi: any): void {
+  pi.registerTool?.(routineToolDefinition);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -28,7 +28,7 @@
     "venice"
   ],
   "bin": {
-    "privateer": "./bin/privateer.mjs"
+    "privateer": "./bin/privateer-tui"
   },
   "publishConfig": {
     "access": "public"
@@ -36,6 +36,7 @@
   "files": [
     "bin",
     "src",
+    "extensions",
     "README.md",
     "LICENSE"
   ],

package/src/providers/account.ts

@@ -136,8 +136,16 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
   }
 }
 
-// Extension factory: registers the account provider when a machine login exists. No
-// login → nothing registered (BYO-key only).
+// Extension factory: registers the account provider so `/login` can offer it.
+//
+// We register UNCONDITIONALLY (not only when a machine login already exists). Pi's
+// `/login` builds its "Use a subscription" list from the OAuth providers registered
+// here (authStorage.getOAuthProviders()); a not-yet-logged-in machine has no
+// credentials, so gating registration on hasCredentials() left `/login` with no
+// Privateer option — the classic chicken-and-egg where you can't log in because
+// you're not logged in. The OAuth provider's login() itself runs the device-code
+// flow when hasCredentials() is false (see privateerOAuthProvider.login), so first
+// login works entirely through Pi once the provider is present.
 //
 // Registration is SYNCHRONOUS (seeded with the fallback), then refined once the live
 // catalog is fetched. This matters: Pi flushes provider registrations made during the
@@ -151,7 +159,7 @@ export function makeAccountProvider() {
   return (pi: {
     registerProvider?: (name: string, config: unknown) => void;
   }): void => {
-    if (!hasCredentials() || typeof pi.registerProvider !== "function") return;
+    if (typeof pi.registerProvider !== "function") return;
     const register = (ids: string[]): void =>
       pi.registerProvider!("privateer", {
         name: "Privateer account",