privateer-agent 0.3.3 → 0.3.5

package/bin/privateer-tui

@@ -18,6 +18,15 @@ while [ -h "$SOURCE" ]; do
 done
 REPO="$(cd -P "$(dirname "$SOURCE")/.." && pwd)"
 
+# `privateer update` — pull the latest release from npm and exit. Handled here in the
+# launcher (not the TUI) so it works even when a broken install won't boot. npm rewrites
+# the global bin in place; replacing it while this process runs is safe on unix.
+if [ "${1:-}" = "update" ]; then
+  echo "Updating privateer-agent to the latest release…"
+  npm install -g privateer-agent@latest
+  exit $?
+fi
+
 pick_node() {
   if command -v node >/dev/null 2>&1 \
      && node -e 'process.exit((+process.versions.node.split(".")[0]) >= 22 ? 0 : 1)' 2>/dev/null; then
@@ -82,6 +91,23 @@ if (s.lastChangelogVersion === undefined) { s.lastChangelogVersion = "9999.0.0";
 if (m) fs.writeFileSync(p, JSON.stringify(s, null, 2) + "\n");
 ' "$AGENT_DIR/settings.json" 2>/dev/null || true
 
+# Passive update check: refresh the cached "latest npm version" at most ~daily, in the
+# BACKGROUND so it never blocks or breaks launch (offline-safe — a failed fetch just
+# leaves the stale cache in place). The banner (privateer-brand) reads this cache and
+# shows a one-line "↑ vX available · run privateer update" notice when we're behind. We
+# never auto-install — the user stays in control of when new code lands (the whole point
+# of an attestable tool). Detached with </dev/null &, so it outlives our exec into node.
+UPDATE_CACHE="${PRIVATEER_HOME:-$HOME/.privateer}/update-check.json"
+if [ -z "$(find "$UPDATE_CACHE" -mtime -1 2>/dev/null)" ]; then
+  (
+    latest="$(npm view privateer-agent version 2>/dev/null || true)"
+    case "$latest" in
+      [0-9]*) printf '{"latest":"%s"}\n' "$latest" > "$UPDATE_CACHE.tmp" 2>/dev/null \
+                && mv -f "$UPDATE_CACHE.tmp" "$UPDATE_CACHE" 2>/dev/null ;;
+    esac
+  ) </dev/null >/dev/null 2>&1 &
+fi
+
 # Default model: when signed in to a Privateer account, default to GLM 5.1 on the
 # account's NEAR confidential-compute (TEE) channel — attestable, strongest privacy
 # tier. Otherwise (BYO key, no account) fall back to a cheap OpenRouter model. An

package/extensions/privateer-brand.ts

@@ -21,6 +21,7 @@
 
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
+import { join } from "node:path";
 import * as priv from "../src/auth/privateer.ts";
 import { makeAccountProvider } from "../src/providers/account.ts";
 
@@ -57,7 +58,7 @@ const ANCHOR = [
   "  .-----.  ", // lock body top (the shackle's base)
   "  |  o  |  ", // lock body + keyhole
   "  '--+--'  ", // lock body base, shank exits
-  "  /\\ | /\\  ", // stock — arms flare from the shank (each \\ is one backslash)
+  " /\\  |  /\\  ", // stock — arms flare from the shank (each \\ is one backslash)
   "  \\  |  /  ", // arms
   "   \\_|_/   ", // flukes
 ];
@@ -105,6 +106,34 @@ function accountLine(modelProvider?: string): string {
   return `${DIM}not signed in · ${OCEAN_LIGHT}/signin${DIM} to connect your account${RESET}`;
 }
 
+// Is dotted version `a` newer than `b`? Plain numeric compare of major.minor.patch —
+// enough for our npm releases; anything unparseable sorts as 0 and is treated as older.
+function isNewer(a: string, b: string): boolean {
+  const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] ?? 0) > (pb[i] ?? 0)) return true;
+    if ((pa[i] ?? 0) < (pb[i] ?? 0)) return false;
+  }
+  return false;
+}
+
+// The "update available" banner line, or "" when we're current / offline / unchecked.
+// Reads the cache the launcher refreshes in the background (see bin/privateer-tui) —
+// never fetches here, so the banner stays synchronous and never blocks on the network.
+function updateNotice(): string {
+  try {
+    const home = process.env.PRIVATEER_HOME || join(homedir(), ".privateer");
+    const { latest } = JSON.parse(readFileSync(join(home, "update-check.json"), "utf8"));
+    if (typeof latest === "string" && isNewer(latest, VERSION)) {
+      return `${YELLOW}↑ v${latest} available${DIM} · run ${RESET}${OCEAN_LIGHT}privateer update${RESET}`;
+    }
+  } catch {
+    // no cache yet, unreadable, or malformed — show nothing.
+  }
+  return "";
+}
+
 // Compose the framed banner: anchor column + text column, inside a rounded accent box.
 function renderBanner(width: number, modelProvider?: string): string[] {
   // Leading blanks drop the text block so the wordmark sits beside the lock body and
@@ -119,8 +148,11 @@ function renderBanner(width: number, modelProvider?: string): string[] {
     `${DIM}privateer-agent ${OCEAN_LIGHT}v${VERSION}${RESET}`,
     `${OCEAN_LIGHT}${shortCwd()}${RESET}`,
   ];
-  // Build the body rows (anchor + gutter + text).
+  // Build the body rows (anchor + gutter + text). A pending-update notice, if any, gets
+  // its own row under the block, indented to sit beneath the text column.
   const rows = ANCHOR.map((a, i) => `${OCEAN}${a}${RESET}  ${right[i] ?? ""}`);
+  const notice = updateNotice();
+  if (notice) rows.push(`      ${notice}`);
   const cap = Math.max(20, width - 4); // 2 border cells + 2 padding
   const inner = Math.min(cap, Math.max(...rows.map(vlen)));
   const bar = "─".repeat(inner + 2);
@@ -163,6 +195,31 @@ export default function privateerBrand(pi: any): void {
     ctx?.ui?.setStatus?.("account", accountBadge());
   };
 
+  // /update — run the global npm install in a child process and report the outcome via
+  // notify (the TUI keeps running the OLD code; npm swaps the global bin's inode in
+  // place, so replacing it under us is safe and the new version loads on next launch).
+  async function doUpdate(ctx: any): Promise<void> {
+    ctx?.ui?.notify?.("Updating Privateer — running npm install -g privateer-agent@latest…", "info");
+    try {
+      const { execFile } = await import("node:child_process");
+      const stderr: string = await new Promise((resolve, reject) => {
+        execFile(
+          "npm",
+          ["install", "-g", "privateer-agent@latest"],
+          { timeout: 180_000 },
+          (err, _out, errOut) => (err ? reject(new Error(String(errOut || err.message).trim())) : resolve(String(errOut || ""))),
+        );
+      });
+      void stderr;
+      ctx?.ui?.notify?.("Updated. Restart `privateer` to run the new version.", "info");
+    } catch (e) {
+      ctx?.ui?.notify?.(
+        `Update failed: ${(e as Error).message || e}. Try manually: npm install -g privateer-agent@latest`,
+        "error",
+      );
+    }
+  }
+
   async function doSignIn(ctx: any): Promise<void> {
     if (priv.hasCredentials()) {
       const u = priv.currentUser();
@@ -251,6 +308,10 @@ export default function privateerBrand(pi: any): void {
     ctxRef?.ui?.notify?.("Your Privateer session expired. Run /signin to sign back in.", "warning");
   });
 
+  pi.registerCommand?.("update", {
+    description: "Update Privateer to the latest release (npm i -g privateer-agent@latest)",
+    handler: (_args: string, ctx: any) => doUpdate(ctx),
+  });
   pi.registerCommand?.("signin", {
     description: "Sign in to your Privateer account (device-code flow)",
     handler: (_args: string, ctx: any) => doSignIn(ctx),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",

package/src/providers/account.ts

@@ -66,18 +66,34 @@ export async function fetchAccountModels(): Promise<string[]> {
 export const privateerOAuthProvider = {
   name: "Privateer account",
   usesCallbackServer: false,
-  async login(cb: { onDeviceCode?: (info: unknown) => void }) {
+  // Pi's login dialog passes `signal` (its cancel AbortController) alongside the
+  // callbacks. We MUST thread it into runDeviceLogin — otherwise escape/ctrl+c
+  // aborts the dialog's signal but our poll loop never sees it, the login()
+  // promise never settles, and Pi never restores the editor: the "Waiting for
+  // authentication…" screen hangs with no way out. See auth/privateer.ts
+  // pollForToken, which checks the signal and rejects with "Login cancelled.".
+  async login(cb: { onDeviceCode?: (info: unknown) => void; signal?: AbortSignal }) {
     if (!hasCredentials()) {
-      await runDeviceLogin({
-        onCode: (code) =>
-          cb.onDeviceCode?.({
-            userCode: code.user_code,
-            verificationUri: code.verification_uri_complete ?? code.verification_uri ?? "",
-            intervalSeconds: code.interval,
-            expiresInSeconds: code.expires_in,
-          }),
-      });
+      try {
+        await runDeviceLogin({
+          signal: cb.signal,
+          onCode: (code) =>
+            cb.onDeviceCode?.({
+              userCode: code.user_code,
+              verificationUri: code.verification_uri_complete ?? code.verification_uri ?? "",
+              intervalSeconds: code.interval,
+              expiresInSeconds: code.expires_in,
+            }),
+        });
+      } catch (e) {
+        // Normalize the cancel message to exactly "Login cancelled" (no period):
+        // Pi's login dialog only suppresses its "Failed to login…" error toast for
+        // that exact string, so a cancel should exit quietly, not flash an error.
+        if (cb.signal?.aborted) throw new Error("Login cancelled");
+        throw e;
+      }
     }
+    if (cb.signal?.aborted) throw new Error("Login cancelled");
     return spawnAccountCredentials();
   },
   async refreshToken(creds: { refresh: string }) {