privateer-agent 0.3.4 → 0.3.6

package/README.md

@@ -63,6 +63,7 @@ What Privateer adds is a *moat* of Pi extensions layered on top:
 | Extension | What it adds |
 |---|---|
 | `privateer-gate` | safe-by-default permission gate + destructive-command danger filter |
+| `privateer-context` | loads `PRIVATEER.md` project context (like `AGENTS.md`/`CLAUDE.md`) + the `/init` command |
 | `privateer-privacy` | `pi-privacy` — TEE attestation, ZDR routing, on-device PII gate — bound to the account tier resolver |
 | `privateer-account` | `/signin` billed inference against a Privateer account (device flow) |
 | `privateer-posture`, `privateer-tools` | live attestation shield + Privateer tool pack |
@@ -168,6 +169,24 @@ vLLM, llama.cpp) works as a custom provider — just give it a base URL.
 
 Override the config location with `PRIVATEER_HOME`.
 
+## Context files — `PRIVATEER.md`
+
+Give the agent standing knowledge about your project — conventions, common commands,
+domain notes — by dropping a **`PRIVATEER.md`** in the directory. Privateer loads it
+automatically at the start of every turn and prepends it to the model's system prompt,
+exactly the way Pi loads `AGENTS.md` / `CLAUDE.md` (all three are recognized, and all
+matching files are concatenated).
+
+Run **`/init`** to scaffold a starter `PRIVATEER.md` in the current directory, then edit
+it. The startup banner shows a **⚓** line with the loaded file's path (and a `+N` count
+when ancestor files also apply), or a `/init` hint when none is found.
+
+Discovery mirrors Pi's context-file lookup: the global agent dir
+(`~/.privateer/agent/PRIVATEER.md`) first, then every directory from the filesystem root
+down to the current one — so a repo-root `PRIVATEER.md` applies to every subdirectory, and
+a deeper file can refine it. `AGENTS.md` and `CLAUDE.md` continue to work unchanged; use
+`--no-context-files` (`-nc`) to disable context-file loading entirely.
+
 ## Private & verifiable inference
 
 **NEAR AI Cloud** and **Tinfoil** run every model inside a **Trusted Execution Environment** —

package/bin/privateer-tui

@@ -46,11 +46,13 @@ mkdir -p "$EXT_DIR"
 # ABSOLUTE path so the target's own relative imports resolve from the repo (a plain
 # symlink would resolve them relative to the shim's location and break). We remove
 # any shim we previously managed first, so a dropped package can't linger and reload.
-MANAGED="privateer-brand privateer-gate privateer-account privateer-posture privateer-tools privateer-privacy pi-privacy pi-web-access rpiv-web-tools pi-mcp-adapter pi-hypa pi-subagents"
+MANAGED="privateer-brand privateer-context privateer-gate privateer-account privateer-posture privateer-tools privateer-privacy pi-privacy pi-web-access rpiv-web-tools pi-mcp-adapter pi-hypa pi-subagents"
 for name in $MANAGED; do rm -f "$EXT_DIR/$name.ts"; done
 shim() { printf 'export { default } from "%s";\n' "$2" > "$EXT_DIR/$1.ts"; }
 # Branding + the account sign-in surface (banner, ⚓ badge, /signin /signout).
 shim privateer-brand   "$REPO/extensions/privateer-brand.ts"
+# PRIVATEER.md project-context loading (like AGENTS.md/CLAUDE.md) + the /init command.
+shim privateer-context "$REPO/extensions/privateer-context.ts"
 shim privateer-gate    "$REPO/extensions/privateer-gate.ts"
 shim privateer-account "$REPO/extensions/privateer-account.ts"
 shim privateer-posture "$REPO/extensions/privateer-posture.ts"
@@ -108,13 +110,22 @@ if [ -z "$(find "$UPDATE_CACHE" -mtime -1 2>/dev/null)" ]; then
   ) </dev/null >/dev/null 2>&1 &
 fi
 
-# Default model: when signed in to a Privateer account, default to GLM 5.1 on the
-# account's NEAR confidential-compute (TEE) channel — attestable, strongest privacy
-# tier. Otherwise (BYO key, no account) fall back to a cheap OpenRouter model. An
-# explicit PRIVATEER_MODEL always wins.
+# Default model. An explicit PRIVATEER_MODEL always wins. Otherwise prefer Tinfoil's
+# GLM 5.2 when a Tinfoil key is available: verifiable TEE inference with CLIENT-side
+# attestation (the live TLS key is bound to the enclave's quote), the strongest privacy
+# tier we offer — stronger than the account's server-proxied NEAR channel. Failing that,
+# use the signed-in Privateer account's NEAR confidential-compute channel; with neither,
+# fall back to a cheap OpenRouter model. The Tinfoil key may sit in the ambient env or in
+# the dev .env the launcher loads below, so check both.
 CRED="${PRIVATEER_HOME:-$HOME/.privateer}/credentials.json"
+have_tinfoil_key() {
+  [ -n "${TINFOIL_API_KEY:-}" ] && return 0
+  [ -f "$REPO/.env" ] && grep -qE '^TINFOIL_API_KEY=.+' "$REPO/.env"
+}
 if [ -n "${PRIVATEER_MODEL:-}" ]; then
   MODEL="$PRIVATEER_MODEL"
+elif have_tinfoil_key; then
+  MODEL="tinfoil/glm-5-2"
 elif [ -f "$CRED" ]; then
   MODEL="privateer/near/zai-org/GLM-5.1-FP8"
 else

package/extensions/privateer-brand.ts

@@ -19,11 +19,12 @@
 // appear immediately (the account catalog refreshes to the live listing without a
 // restart).
 
-import { readFileSync } from "node:fs";
+import { readFileSync, appendFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import * as priv from "../src/auth/privateer.ts";
 import { makeAccountProvider } from "../src/providers/account.ts";
+import { discoverContextFiles, onContextChanged } from "../src/context.ts";
 
 const VERSION: string = (() => {
   try {
@@ -51,14 +52,14 @@ const YELLOW = `${ESC}33m`;
 
 // The Privateer mark in ASCII: a padlock (with keyhole) atop an anchor — "bring your
 // own model" meets lock-and-key privacy, echoing the app's anchor+padlock logo. Every
-// line is the same visible width (11) so the text column beside it stays aligned.
+// line is the SAME visible width (MARK_W) and centers on column 5 (the shank/keyhole),
+// so the text column beside it stays aligned. Keep them equal-width if you edit the art.
+const MARK_W = 11;
 const ANCHOR = [
   "    .-.    ", // shackle arch
-  "   |   |   ", // shackle legs
-  "  .-----.  ", // lock body top (the shackle's base)
-  "  |  o  |  ", // lock body + keyhole
-  "  '--+--'  ", // lock body base, shank exits
-  "  /\\ | /\\  ", // stock — arms flare from the shank (each \\ is one backslash)
+  "   |___|   ", // lock body top (the shackle's base)
+  "   |_t_|   ", // lock body + keyhole
+  " /\\  |  /\\ ", // stock — arms flare from the shank (each \\ is one backslash)
   "  \\  |  /  ", // arms
   "   \\_|_/   ", // flukes
 ];
@@ -82,11 +83,16 @@ function clean(s: unknown): string {
   return String(s ?? "").replace(CONTROL_RE, "");
 }
 
-function shortCwd(): string {
-  const cwd = process.cwd();
+// Collapse $HOME to ~ in an absolute path, and strip control bytes (paths come off the
+// filesystem). Shared by the cwd line and the PRIVATEER.md line.
+function shortPath(p: string): string {
   const home = homedir();
-  const path = cwd === home || cwd.startsWith(home + "/") ? "~" + cwd.slice(home.length) : cwd;
-  return clean(path);
+  const short = p === home || p.startsWith(home + "/") ? "~" + p.slice(home.length) : p;
+  return clean(short);
+}
+
+function shortCwd(): string {
+  return shortPath(process.cwd());
 }
 
 // The account line under the tagline — three states, ported from tree-cli's Banner:
@@ -134,25 +140,73 @@ function updateNotice(): string {
   return "";
 }
 
-// Compose the framed banner: anchor column + text column, inside a rounded accent box.
+// The PRIVATEER.md line under the block: green anchor when a project-context file is
+// loaded (so the moat's "the agent knows this project" state is visible), otherwise a
+// quiet tease that /init scaffolds one. Reads the filesystem at render time, so it
+// reflects the current cwd and updates after /init (via onContextChanged → refresh).
+function contextLine(): string {
+  const files = discoverContextFiles();
+  if (files.length === 0) {
+    return `${DIM}no PRIVATEER.md · ${OCEAN_LIGHT}/init${DIM} to add project context${RESET}`;
+  }
+  // Show the nearest (deepest, wins-last) file's path; note any additional ancestors
+  // with a "+N" so the header stays one line but the count isn't hidden.
+  const nearest = shortPath(files[files.length - 1].path);
+  const more = files.length > 1 ? `${DIM} +${files.length - 1}${RESET}` : "";
+  return `${GREEN}⚓${DIM} ${RESET}${OCEAN_LIGHT}${nearest}${RESET}${more}`;
+}
+
+// ── "What's New" — a tiny in-banner changelog ────────────────────────────────
+// A hand-curated highlights list (newest first). Not the full changelog — just the two
+// or three things a returning user should notice. `cmd`, when present, is rendered in the
+// accent color so the actionable bit stands out from the prose. Trim this as it ages.
+const WHATS_NEW: Array<{ text: string; cmd?: string }> = [
+  { text: "Privateer agent CLI is live —", cmd: "npm i -g privateer-agent" },
+  { text: "PRIVATEER.md project context —", cmd: "/init" },
+  { text: "Self-update built in —", cmd: "privateer update" },
+];
+
+function whatsNewRows(): string[] {
+  const head = `${BOLD}${OCEAN_LIGHT}✦ What's new${RESET}`;
+  const items = WHATS_NEW.map(
+    ({ text, cmd }) =>
+      `${OCEAN}·${RESET} ${DIM}${text}${RESET}${cmd ? ` ${OCEAN_LIGHT}${cmd}${RESET}` : ""}`,
+  );
+  return [head, ...items];
+}
+
+// Compose the framed banner: the mark on the left, an independent text column on the
+// right. The two columns have DIFFERENT heights (the text runs longer than the 6-line
+// mark), so we zip by row index and pad the short side — every text-only row lands in
+// the same column as the rows beside the mark. One place owns the left gutter, so
+// spacing can't drift between the mark rows and the trailing rows.
 function renderBanner(width: number, modelProvider?: string): string[] {
-  // Leading blanks drop the text block so the wordmark sits beside the lock body and
-  // the shackle rises above it (one entry per anchor line — 8 total).
-  const right = [
-    "",
+  // Right column, top to bottom. The two leading blanks drop the wordmark down so it
+  // sits beside the lock body (not the shackle); the rest follows in reading order.
+  const text: string[] = [
     "",
-    `${BOLD}${OCEAN_LIGHT}✻ ${OCEAN}P${OCEAN_LIGHT}RIVATEER${RESET}`,
+    `${BOLD}${OCEAN_LIGHT}✻ ${OCEAN}P${OCEAN_LIGHT}RIVATEER${RESET}${DIM}   privateer-agent ${OCEAN_LIGHT}v${VERSION}${RESET}`,
     `${DIM}Chart your own course privately.${RESET}`,
     "",
     accountLine(modelProvider),
-    `${DIM}privateer-agent ${OCEAN_LIGHT}v${VERSION}${RESET}`,
     `${OCEAN_LIGHT}${shortCwd()}${RESET}`,
+    contextLine(),
   ];
-  // Build the body rows (anchor + gutter + text). A pending-update notice, if any, gets
-  // its own row under the block, indented to sit beneath the text column.
-  const rows = ANCHOR.map((a, i) => `${OCEAN}${a}${RESET}  ${right[i] ?? ""}`);
   const notice = updateNotice();
-  if (notice) rows.push(`      ${notice}`);
+  if (notice) text.push(notice);
+  // A blank spacer, then the What's New block — set off below the identity lines.
+  text.push("", ...whatsNewRows());
+
+  // Zip the mark and the text column by row. Rows past the mark's height get a blank
+  // gutter of the mark's width, so the text stays in one column throughout.
+  const gap = "  ";
+  const height = Math.max(ANCHOR.length, text.length);
+  const rows: string[] = [];
+  for (let i = 0; i < height; i++) {
+    const left = i < ANCHOR.length ? `${OCEAN}${ANCHOR[i]}${RESET}` : " ".repeat(MARK_W);
+    rows.push(`${left}${gap}${text[i] ?? ""}`.trimEnd());
+  }
+
   const cap = Math.max(20, width - 4); // 2 border cells + 2 padding
   const inner = Math.min(cap, Math.max(...rows.map(vlen)));
   const bar = "─".repeat(inner + 2);
@@ -186,15 +240,45 @@ export default function privateerBrand(pi: any): void {
   let currentModelProvider: string | undefined;
   let ctxRef: any = null;
 
+  // TEMP debug trace (PRIVATEER_DEBUG=1): append a line to ~/.privateer/brand-debug.log
+  // so we can see, from a real sign-in, whether the refresh path fires and with what state.
+  const dbg = (msg: string): void => {
+    if (!process.env.PRIVATEER_DEBUG) return;
+    try {
+      const home = process.env.PRIVATEER_HOME || join(homedir(), ".privateer");
+      appendFileSync(join(home, "brand-debug.log"), `${new Date().toISOString()} ${msg}\n`);
+    } catch {
+      /* best effort */
+    }
+  };
+
   const setHeader = (ctx: any) =>
     ctx?.ui?.setHeader?.(() => headerComponent(currentModelProvider));
 
   const refresh = (ctx: any) => {
+    dbg(`refresh: hasUI=${!!ctx?.hasUI} hasSetHeader=${typeof ctx?.ui?.setHeader} user=${priv.currentUser()?.email ?? null}`);
     if (!ctx?.hasUI) return;
     setHeader(ctx);
     ctx?.ui?.setStatus?.("account", accountBadge());
   };
 
+  // Drop Pi's PERSISTED account credential (the "privateer" entry in auth.json).
+  // Pi reuses this credential on the next launch and refreshes it only when it
+  // EXPIRES — never reactively on a 401 (see the LIFECYCLE HAZARD note in
+  // src/auth/privateer.ts). So whenever the machine login goes away — an explicit
+  // /signout, or a revocation/expiry we detect server-side — we MUST also drop this
+  // persisted copy, or the next run reuses a token that's already dead server-side
+  // and dead-ends on the first inference. Removing it makes the next /signin spawn a
+  // fresh session. Reached via the model registry (constructed with the auth
+  // storage; see session.ts). Best-effort: nothing persisted → nothing to do.
+  const dropPersistedAccount = (ctx: any): void => {
+    try {
+      ctx?.modelRegistry?.authStorage?.remove?.("privateer");
+    } catch {
+      /* no persisted credential / older Pi without this shape — nothing to do */
+    }
+  };
+
   // /update — run the global npm install in a child process and report the outcome via
   // notify (the TUI keeps running the OLD code; npm swaps the global bin's inode in
   // place, so replacing it under us is safe and the new version loads on next launch).
@@ -266,6 +350,7 @@ export default function privateerBrand(pi: any): void {
     if (!priv.hasCredentials()) return ctx?.ui?.notify?.("Not signed in.", "info");
     const u = priv.currentUser();
     await priv.logout();
+    dropPersistedAccount(ctx);
     refresh(ctx);
     ctx?.ui?.notify?.(`Signed out${u?.email ? ` (${u.email})` : ""}. Drop anchor for now.`, "info");
   }
@@ -280,9 +365,26 @@ export default function privateerBrand(pi: any): void {
     );
   }
 
+  dbg("extension loaded, onSignedIn listener registering");
+
   pi.on("session_start", (_e: any, ctx: any) => {
+    dbg("session_start");
     ctxRef = ctx;
     currentModelProvider = ctx?.model?.provider ?? currentModelProvider;
+
+    // Validate the machine login against the server at launch. The banner/badge
+    // otherwise reflect ONLY local credentials.json, so a terminal that was signed
+    // out from the app (or whose login expired) keeps showing "connected as …"
+    // indefinitely — nothing else spawns a session at startup (Pi reuses its
+    // persisted account credential and refreshes it only on expiry, not on a 401).
+    // warmSession spawns this terminal's child session from the parent refresh
+    // token; if that token was revoked/expired the server 401s, which clears the
+    // local credentials and fires onSessionExpired — flipping the banner to "not
+    // signed in" right here at launch instead of dead-ending on the first prompt.
+    // Fire-and-forget: warmSession swallows transient errors, and the
+    // onSessionExpired handler below owns the UI update.
+    void priv.warmSession();
+
     if (!ctx?.hasUI) return; // headless (print/json): no banner or prompts
     ctx?.ui?.setTitle?.("Privateer");
     refresh(ctx);
@@ -301,9 +403,45 @@ export default function privateerBrand(pi: any): void {
     }
   });
 
+  // A machine login was newly established. This fires for BOTH sign-in paths — our
+  // /signin command AND Pi's /login → "Use a subscription" OAuth flow. doSignIn
+  // already refreshes itself, but a /login sign-in has no other hook back to us, so
+  // without this the header/badge would keep showing "not signed in" until relaunch.
+  priv.onSignedIn(() => {
+    dbg(`onSignedIn fired; ctxRef=${ctxRef ? "set" : "null"}`);
+    refresh(ctxRef);
+  });
+
+  // /init (in privateer-context) just created or changed a PRIVATEER.md — re-render the
+  // banner so its context line flips from the "/init" hint to "PRIVATEER.md loaded".
+  onContextChanged(() => refresh(ctxRef));
+
+  // The terminal is quitting (Ctrl+C, Ctrl+D, /quit, SIGTERM …). Pi awaits this
+  // handler inside runtimeHost.dispose() BEFORE process.exit, so it's our one
+  // reliable window to revoke the server-side sessions this run created — the
+  // account channel Pi drives AND any child session — so the terminal drops off the
+  // app's Linked Devices list immediately instead of lingering until the rows expire.
+  // Only on "quit": the other reasons (new/resume/fork/reload) keep this process
+  // alive and reuse the same account credential, so revoking would kill a live session.
+  // Best-effort and time-bounded (see revokeLocalSessions); exit must never hang.
+  pi.on("session_shutdown", async (e: any) => {
+    if (e?.reason && e.reason !== "quit") return;
+    await priv.revokeLocalSessions();
+    // Pair the revoke with dropping Pi's persisted account credential (the contract
+    // in src/auth/privateer.ts): revokeLocalSessions kills the account session
+    // server-side, so leaving the persisted copy behind would make the NEXT launch
+    // reuse a token that's already dead and dead-end on its first prompt (Pi doesn't
+    // refresh on a 401). Mirrors the daemon's shutdown (daemon/index.ts).
+    dropPersistedAccount(ctxRef);
+  });
+
   // The machine login was invalidated server-side (TTL lapsed or revoked in the app):
   // announce it and reflect it in the badge/header immediately.
   priv.onSessionExpired(() => {
+    // clearCredentials() has already wiped the local machine login; also drop Pi's
+    // persisted account credential so the next prompt/launch doesn't reuse a token
+    // that's now dead server-side (see dropPersistedAccount).
+    dropPersistedAccount(ctxRef);
     refresh(ctxRef);
     ctxRef?.ui?.notify?.("Your Privateer session expired. Run /signin to sign back in.", "warning");
   });

package/extensions/privateer-context.ts

@@ -0,0 +1,59 @@
+// PRIVATEER.md context loading + the /init command.
+//
+// Pi natively loads AGENTS.md / CLAUDE.md but its candidate list is hardcoded upstream,
+// so PRIVATEER.md would otherwise be ignored. This extension makes PRIVATEER.md a
+// first-class context file without patching node_modules:
+//
+//   1. before_agent_start — discover PRIVATEER.md (global agent dir + cwd ancestors) and
+//      append its contents to the turn's system prompt, framed exactly like Pi frames
+//      AGENTS.md, so the model treats them identically.
+//   2. /init — write a starter PRIVATEER.md into the current directory.
+//
+// The banner (privateer-brand) shows whether a PRIVATEER.md is loaded and, when none is,
+// advertises /init. After /init we emit the shared context-changed signal so that line
+// refreshes at once. See src/context.ts for the discovery/formatting details.
+
+import { contextBlock, writeTemplate, emitContextChanged, CONTEXT_BLOCK_MARKER } from "../src/context.ts";
+
+// Honor Pi's own "disable context files" switch, so --no-context-files / -nc silences
+// PRIVATEER.md too (not just AGENTS.md/CLAUDE.md) — otherwise the flag would half-work.
+const CONTEXT_FILES_DISABLED =
+  process.argv.includes("--no-context-files") || process.argv.includes("-nc");
+
+export default function privateerContext(pi: any): void {
+  // Inject PRIVATEER.md into every turn's system prompt. The prompt is rebuilt per turn
+  // and chained across before_agent_start handlers, so appending here is idempotent for
+  // the turn; the marker guard makes it a no-op if an earlier handler already added it.
+  pi.on("before_agent_start", (event: any) => {
+    if (CONTEXT_FILES_DISABLED) return;
+    const cwd = event?.systemPromptOptions?.cwd ?? process.cwd();
+    const base: string = event?.systemPrompt ?? "";
+    if (base.includes(CONTEXT_BLOCK_MARKER)) return; // already injected this chain
+    const block = contextBlock(cwd);
+    if (!block) return; // no PRIVATEER.md anywhere — leave the prompt untouched
+    return { systemPrompt: base + block };
+  });
+
+  // /init — scaffold a PRIVATEER.md in the working directory. Never clobbers an existing
+  // one; on success we signal the banner so its "PRIVATEER.md loaded" line updates now
+  // (the file is picked up automatically on the next turn — no reload needed).
+  pi.registerCommand?.("init", {
+    description: "Create a starter PRIVATEER.md project-context file in this directory",
+    handler: (_args: string, ctx: any) => {
+      try {
+        const { path, created } = writeTemplate(process.cwd());
+        if (!created) {
+          ctx?.ui?.notify?.(`PRIVATEER.md already exists at ${path} — left untouched.`, "info");
+          return;
+        }
+        emitContextChanged();
+        ctx?.ui?.notify?.(
+          `Created ${path}. Edit it with your project's context — it loads automatically each turn.`,
+          "info",
+        );
+      } catch (e) {
+        ctx?.ui?.notify?.(`Could not create PRIVATEER.md: ${(e as Error).message || e}`, "error");
+      }
+    },
+  });
+}

package/extensions/privateer-gate.ts

@@ -30,6 +30,45 @@ const allowedOutsideRoots: string[] = [];
 let piRef: any = null;
 let relay: any = null;
 
+// Persistent footer indicator for remote access. When the relay is up, the footer
+// shows a GREEN "⟿ remote access" line so it's always obvious this terminal can be
+// driven from the phone — with a reminder that `/remote-access off` stops it. We
+// keep a UI handle (captured from session_start / the command ctx) so the relay's
+// own connect/disconnect callbacks can refresh the indicator, not just the command.
+const GREEN = "\x1b[32m", YELLOW = "\x1b[33m", DIM = "\x1b[2m", RESET = "\x1b[0m";
+const REMOTE_STATUS_KEY = "privateer:remote-access";
+let uiRef: any = null;
+// "off" → no indicator; "connecting" → relay starting or reconnecting (yellow);
+// "connected" → socket open, controller reachable (green).
+let remoteState: "off" | "connecting" | "connected" = "off";
+
+function refreshRemoteStatus(): void {
+  const ui = uiRef;
+  if (!ui?.setStatus) return;
+  if (remoteState === "off") {
+    ui.setStatus(REMOTE_STATUS_KEY, undefined);
+    return;
+  }
+  const text =
+    remoteState === "connected"
+      ? `${GREEN}⟿ remote access${RESET} ${DIM}· /remote-access off to stop${RESET}`
+      : `${YELLOW}⟿ remote access · connecting…${RESET} ${DIM}· /remote-access off to stop${RESET}`;
+  ui.setStatus(REMOTE_STATUS_KEY, text);
+}
+
+function setRemoteState(s: typeof remoteState): void {
+  remoteState = s;
+  refreshRemoteStatus();
+}
+
+// Tear down the relay and clear the indicator. Used by `/remote-access off` AND by
+// the app's own "End remote access" action (onTerminate), so both paths converge.
+function disableRemote(): void {
+  relay?.stop();
+  relay = null;
+  setRemoteState("off");
+}
+
 // Inbound app→CLI files land here (keyed by "#n"); save_attachment persists them.
 const attachments = new AttachmentStore();
 let sinceLastPrompt: StoredAttachment[] = [];
@@ -47,9 +86,22 @@ const bridge = new RemoteBridge({
     piRef?.sendUserMessage?.(text + note); // drive a turn in Pi's TUI
   },
   onInterrupt: () => {}, // Pi owns interrupt; best-effort no-op
-  onControllerAttached: () => relay?.sendSnapshot([{ kind: "notice", text: "Privateer terminal connected." }]),
+  // The app asked to end remote access from its side — stop the relay locally too so
+  // the terminal doesn't keep reconnecting, and clear the green indicator.
+  onTerminate: () => disableRemote(),
+  onControllerAttached: () => {
+    // A controller reached us → the socket is up and driving: go green.
+    setRemoteState("connected");
+    relay?.sendSnapshot([{ kind: "notice", text: "Privateer terminal connected." }]);
+  },
   onAttachment: (file) => sinceLastPrompt.push(attachments.register(file)),
-  onStatus: () => {},
+  // Drive the indicator from the relay's own status stream: "connected" → green;
+  // its reconnect/retry notices → yellow "connecting…". Ignored once we're off.
+  onStatus: (text) => {
+    if (!relay) return;
+    if (/disconnect|reconnect|retry|couldn't|could not/i.test(text)) setRemoteState("connecting");
+    else if (/connected/i.test(text)) setRemoteState("connected");
+  },
 });
 
 const gate = makePermissionGate({
@@ -88,6 +140,11 @@ export default function privateerControl(pi: any): void {
   // and the user hasn't pinned a mode via PRIVATEER_MODE.
   const HEADLESS = new Set(["json", "print", "rpc"]);
   pi.on("session_start", (_e: any, ctx: any) => {
+    // Capture the UI handle so the relay's connect/disconnect callbacks can refresh
+    // the footer indicator (they fire outside any command's ctx). Re-render in case
+    // remote access was already on when the session (re)started.
+    if (ctx?.ui) uiRef = ctx.ui;
+    refreshRemoteStatus();
     if (ctx?.mode && HEADLESS.has(ctx.mode) && (process.env.PRIVATEER_MODE ?? "") === "") {
       mode = "bypass";
     }
@@ -123,16 +180,17 @@ export default function privateerControl(pi: any): void {
   pi.registerCommand?.("remote-access", {
     description: "Drive this terminal from the Privateer app: /remote-access on | off",
     handler: async (args: string, ctx: any) => {
+      if (ctx?.ui) uiRef = ctx.ui; // keep the handle fresh for relay-driven refreshes
       const off = String(args ?? "").trim().toLowerCase() === "off";
       if (off) {
-        relay?.stop();
-        relay = null;
+        disableRemote();
         return ctx.ui?.notify?.("remote access off", "info");
       }
       if (relay) return ctx.ui?.notify?.("remote access already on", "info");
       if (!priv.hasCredentials()) return ctx.ui?.notify?.("Not signed in to Privateer.", "warning");
       relay = new RelayClient(bridge.callbacks, { label: "privateer-cli" });
       bridge.attachRelay(relay);
+      setRemoteState("connecting"); // yellow until the relay reports connected
       await relay.start();
       ctx.ui?.notify?.("Remote access on — approve this terminal in the Privateer app, then drive it from there.", "info");
     },

package/extensions/privateer-posture.ts

@@ -1,7 +1,7 @@
 // The privacy-posture badge in Pi's status bar (Phase 6 polish). On model select
 // (and at session start) it computes the current model's posture and pins it to the
-// footer via ctx.ui.setStatus — so the moat is *visible*: a green "Verified TEE"
-// for an attested enclave, a distinct label for a mere ZDR claim.
+// footer via ctx.ui.setStatus — so the moat is *visible*: a green shield "Trusted
+// Execution" for an attested enclave, a distinct label for a mere ZDR claim.
 //
 // Handles both surfaces: the account channel (privateer/*, via server-proxy
 // attestation) which pi-privacy doesn't know, and everything else via pi-privacy.
@@ -11,6 +11,20 @@ import { accountPosture } from "../src/providers/account.ts";
 
 const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
 
+// ANSI so the shield "references the previous color": the TEE tiers used to show a
+// green/yellow traffic-light dot — now they show a shield tinted the same color
+// (green = verified, yellow = unconfirmed). The status bar renders these escapes.
+const GREEN = "\x1b[32m", YELLOW = "\x1b[33m", RESET = "\x1b[0m";
+
+// The TEE tiers render as a colored shield + "Trusted Execution" (pi-privacy labels
+// these "Verified TEE" / "TEE (unconfirmed)"; we rename to Trusted Execution for the
+// privateer badge and swap the dot for a shield). Everything else keeps the dot.
+function badgeLabel(tier: PrivacyTier): string | null {
+  if (tier === "tee-verified") return `${GREEN}⛉ Trusted Execution${RESET}`;
+  if (tier === "tee-unverified") return `${YELLOW}⛉ Trusted Execution (unconfirmed)${RESET}`;
+  return null;
+}
+
 async function badgeFor(provider: string, modelId: string): Promise<string> {
   const res =
     provider === "privateer"
@@ -18,6 +32,8 @@ async function badgeFor(provider: string, modelId: string): Promise<string> {
       : await verifyModelPosture(provider, modelId, {
           apiKey: provider === "nearai" ? process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY : undefined,
         });
+  const shield = badgeLabel(res.tier as PrivacyTier);
+  if (shield) return shield;
   const info = TIERS[res.tier as PrivacyTier];
   return `${DOT[info.posture] ?? "⚪"} ${info.label}`;
 }

package/extensions/privateer-privacy.ts

@@ -4,12 +4,61 @@
 // (actually confidential-compute TEE) is treated as verified-private (no PII
 // over-warning), and a zdr account model as zdr-policy. Replaces loading pi-privacy's
 // default entry directly.
+//
+// It also WIDENS the tinfoil provider's model list. pi-privacy registers `tinfoil` with
+// a single seed model, so any other Tinfoil model — notably our default `tinfoil/glm-5-2`
+// — resolves as a "custom model id" with a startup warning and never shows in the picker.
+// We re-register tinfoil with its current chat catalog AFTER pi-privacy runs (a second
+// registerProvider call replaces the provider's model list; pi-privacy registers
+// synchronously, so ours lands second and wins). This is purely a display/resolution
+// list — posture and attestation are dispatcher-bound and unaffected by the model set.
 import { makePiPrivacyExtension } from "pi-privacy";
 import { accountPosture } from "../src/providers/account.ts";
 
-export default makePiPrivacyExtension({
+// Tinfoil's live chat models (inference.tinfoil.sh/v1/models), glm-5-2 first — the
+// launcher's default. Non-chat endpoints (embeddings, tts, whisper, websearch,
+// doc-upload) are intentionally omitted. Refresh from the live catalog if Tinfoil adds
+// models; this static list just needs to cover what we default to and commonly pick.
+const TINFOIL_MODELS = [
+  "glm-5-2",
+  "kimi-k2-6",
+  "deepseek-v4-pro",
+  "gpt-oss-120b",
+  "gpt-oss-safeguard-120b",
+  "gemma4-31b",
+  "llama3-3-70b",
+];
+
+function tinfoilModel(id: string) {
+  return {
+    id,
+    name: id,
+    reasoning: false,
+    input: ["text"] as ("text" | "image")[],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: 128000,
+    maxTokens: 4096,
+  };
+}
+
+const privacy = makePiPrivacyExtension({
   resolveTier: async (provider, modelId) => {
     if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
     return (await accountPosture(modelId)).tier;
   },
 });
+
+export default function privateerPrivacy(pi: any): void {
+  privacy(pi);
+  // Re-register tinfoil with the fuller catalog. Mirrors pi-privacy's provider config
+  // (baseUrl/api + ${TINFOIL_API_KEY} template with authHeader); only the model list is
+  // widened so `tinfoil/glm-5-2` and friends resolve without the "custom model id" warning.
+  pi.registerProvider?.("tinfoil", {
+    name: "Tinfoil (private TEE inference)",
+    baseUrl: "https://inference.tinfoil.sh/v1",
+    api: "openai-completions",
+    apiKey: "${TINFOIL_API_KEY}",
+    authHeader: true,
+    models: TINFOIL_MODELS.map(tinfoilModel),
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",

package/src/auth/privateer.ts

@@ -97,6 +97,26 @@ let _child: ChildSession | null = null;
 let _spawnInFlight: Promise<ChildSession> | null = null;
 let _refreshInFlight: Promise<ChildSession> | null = null;
 
+// The most recent ACCOUNT-provider session (spawnAccountCredentials /
+// refreshAccountCredentials). Pi owns this credential's lifecycle — it drives the
+// account inference channel in the TUI — so it's a distinct server-side session
+// (device row) from _child. We record only its latest access token here so exit
+// cleanup / an explicit sign-out (revokeAccountSession) can kill it. Rotations
+// overwrite it; the previous token is already dead server-side, so tracking only
+// the latest is right.
+//
+// LIFECYCLE HAZARD: Pi PERSISTS this session to auth.json (with a ~24h `expires`) and
+// reuses it on the next launch, refreshing only when `Date.now() >= expires` — it does
+// NOT refresh reactively on a 401. So revoking it at exit while leaving the persisted
+// copy in place would let the next run send a token that still looks valid but is dead
+// server-side → inference fails with a dead-end `401 {code: SESSION_REVOKED}`.
+// The fix is to revoke it AND drop the persisted credential together: the caller must
+// remove the "privateer" entry from Pi's authStorage (authStorage.remove("privateer"))
+// right after revokeLocalSessions() so the next launch spawns a fresh session instead
+// of reusing the revoked one. Doing both is safe; doing only one is not. See
+// revokeLocalSessions and its callers (cli/chat.ts, daemon/index.ts).
+let _account: { accessToken: string } | null = null;
+
 export function loadCredentials(): Credentials | null {
   if (_cache !== undefined) return _cache;
   const path = credentialsPath();
@@ -127,6 +147,7 @@ export function clearCredentials(): void {
   }
   _cache = null;
   _child = null;
+  _account = null;
 }
 
 export function hasCredentials(): boolean {
@@ -171,6 +192,39 @@ function notifySessionExpired(): void {
   }
 }
 
+// ── Sign-in notification ─────────────────────────────────────────────────────
+// Fired when a Privateer login completes on this terminal — the cue for the UI to
+// re-render its header/badge to the signed-in state. It reaches every sign-in entry
+// point:
+//   - our dedicated /signin command and a FRESH /login → "Use a subscription" OAuth
+//     login both run the device-code flow, which fires this from pollForToken once
+//     credentials are written; and
+//   - an ALREADY-LINKED machine selecting the subscription runs no device code (it
+//     just spawns an account session), so privateerOAuthProvider.login() fires this
+//     itself — otherwise that path had no hook back to the header and it kept showing
+//     the stale "not signed in" banner until the next launch.
+// A listener here refreshes the UI regardless of which path the user took.
+
+type SignedInListener = () => void;
+const _signedInListeners = new Set<SignedInListener>();
+
+export function onSignedIn(listener: SignedInListener): () => void {
+  _signedInListeners.add(listener);
+  return () => _signedInListeners.delete(listener);
+}
+
+// Emit the sign-in signal. Exported so the account OAuth provider can announce a
+// completed subscription login on the already-linked path (see the note above).
+export function notifySignedIn(): void {
+  for (const listener of _signedInListeners) {
+    try {
+      listener();
+    } catch {
+      /* a failing listener must not break the auth path */
+    }
+  }
+}
+
 // ── Device authorization flow ────────────────────────────────────────────────
 
 export interface DeviceCode {
@@ -229,6 +283,7 @@ export async function pollForToken(
       const data = (await res.json()) as Omit<Credentials, "serverBaseUrl">;
       const creds: Credentials = { ...data, serverBaseUrl: base };
       saveCredentials(creds);
+      notifySignedIn();
       return creds;
     }
 
@@ -409,23 +464,17 @@ export async function apiRequest(path: string, init: RequestInit = {}): Promise<
 }
 
 /**
- * Best-effort revoke of THIS terminal's child session on exit, so the terminal
- * disappears from the app's Linked Devices list immediately instead of
- * lingering until its access-token rows expire (24h server-side).
- *
- * Deliberately NOT authedFetch: that would spawn/refresh a session just to kill
- * it. If no child was ever spawned (e.g. BYO-key run), there's nothing to do.
- * Bounded by a short timeout — exit must never hang on a slow network — and all
- * failures are swallowed; the server's TTL remains the fallback.
+ * DELETE the server-side session identified by `accessToken` (RFC-style bearer
+ * possession proof). Deliberately a raw fetch, NOT authedFetch — authedFetch would
+ * spawn/refresh a brand-new session just to kill this one. Bounded by a short
+ * timeout so exit never hangs on a slow network, and all failures are swallowed;
+ * the server's TTL is the fallback.
  */
-export async function revokeChildSession(timeoutMs = 1500): Promise<void> {
-  const child = _child;
-  if (!child) return;
-  _child = null; // never reuse a session we've asked the server to revoke
+async function deleteSession(accessToken: string, timeoutMs: number): Promise<void> {
   try {
     await fetch(`${serverBaseUrl()}/auth/session/current`, {
       method: "DELETE",
-      headers: { Authorization: `Bearer ${child.accessToken}` },
+      headers: { Authorization: `Bearer ${accessToken}` },
       signal: AbortSignal.timeout(timeoutMs),
     });
   } catch {
@@ -433,6 +482,48 @@ export async function revokeChildSession(timeoutMs = 1500): Promise<void> {
   }
 }
 
+/**
+ * Best-effort revoke of THIS terminal's child session (from authedFetch/apiRequest).
+ * If no child was ever spawned (e.g. BYO-key run), there's nothing to do.
+ */
+export async function revokeChildSession(timeoutMs = 1500): Promise<void> {
+  const child = _child;
+  if (!child) return;
+  _child = null; // never reuse a session we've asked the server to revoke
+  await deleteSession(child.accessToken, timeoutMs);
+}
+
+/**
+ * Best-effort revoke of the account-provider session (the one Pi drives for account
+ * inference). Called both on EXPLICIT sign-out AND as part of exit cleanup (via
+ * revokeLocalSessions) — safe in the exit path ONLY because the caller also drops Pi's
+ * persisted copy (authStorage.remove("privateer")) so the next launch spawns fresh
+ * rather than reusing this now-dead token. See the _account note and revokeLocalSessions.
+ */
+export async function revokeAccountSession(timeoutMs = 1500): Promise<void> {
+  const account = _account;
+  if (!account) return;
+  _account = null;
+  await deleteSession(account.accessToken, timeoutMs);
+}
+
+/**
+ * Revoke ALL server-side sessions this terminal created — the in-memory child session
+ * (authedFetch/apiRequest) AND the account-provider inference session — so the terminal
+ * drops off the app's Linked Devices list the moment it exits (Ctrl+C, /quit, SIGTERM …)
+ * instead of lingering until its token TTL (~24h). Best-effort, time-bounded, and the
+ * two revokes run in parallel so a slow network can't double the exit delay.
+ *
+ * IMPORTANT: the account session is persisted by Pi (auth.json) and reused on the next
+ * launch without a reactive-on-401 refresh, so the caller MUST also drop the persisted
+ * copy right after this resolves — `authStorage.remove("privateer")` — or the next run
+ * will reuse the token we just revoked and dead-end on a 401 (see the _account note).
+ * Callers: cli/chat.ts cleanup() and daemon/index.ts shutdown().
+ */
+export async function revokeLocalSessions(timeoutMs = 1500): Promise<void> {
+  await Promise.all([revokeChildSession(timeoutMs), revokeAccountSession(timeoutMs)]);
+}
+
 // ── Logout ───────────────────────────────────────────────────────────────────
 
 /**
@@ -493,6 +584,7 @@ export async function spawnAccountCredentials(): Promise<AccountCredential> {
     throw new Error("Your Privateer session expired. Run /login to sign in again.");
   }
   const { accessToken, refreshToken } = (await res.json()) as { accessToken: string; refreshToken: string };
+  _account = { accessToken }; // track for explicit sign-out revoke (revokeAccountSession)
   return { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
 }
 
@@ -502,6 +594,7 @@ export async function refreshAccountCredentials(refresh: string): Promise<Accoun
   const res = await postJson(serverBaseUrl(), "/auth/refresh", { refreshToken: refresh });
   if (!res.ok) throw new Error(`account refresh failed (${res.status})`);
   const { accessToken, refreshToken } = (await res.json()) as { accessToken: string; refreshToken: string };
+  _account = { accessToken }; // the rotated session is the one an explicit sign-out revokes
   return { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
 }
 

package/src/cli/chat.ts

@@ -27,6 +27,7 @@ async function main() {
   const { RelayClient } = await import("../remote/relayClient.ts");
   const priv = await import("../auth/privateer.ts");
   const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
+  const { agentVersion } = await import("../config/version.ts");
 
   const spec = process.env.PRIVATEER_MODEL ?? "openrouter/openai/gpt-4o-mini";
   const slash = spec.indexOf("/");
@@ -62,7 +63,13 @@ async function main() {
   const bridge = new RemoteBridge({
     onPrompt: (text) => void runTurn(text, true),
     onInterrupt: () => void session?.abort?.(),
-    onControllerAttached: () => relay?.sendSnapshot([]),
+    // On (re)attach, resync the transcript AND push live context (model +
+    // version) so the app's session banner shows what this terminal is really
+    // running. NON-PII: no cwd — see RelayClient.sendContext.
+    onControllerAttached: () => {
+      relay?.sendSnapshot([]);
+      relay?.sendContext({ model: spec, version: agentVersion() });
+    },
     onStatus: (t) => console.log(`\n${DIM}⟿ ${t}${RESET}`),
   });
 
@@ -113,6 +120,26 @@ async function main() {
   });
   for (const d of services.diagnostics) if (d.type === "error") console.log(`${RED}! ${d.message}${RESET}`);
 
+  // Exit cleanup: revoke the server-side sessions THIS run created (the child API
+  // session AND the account inference session) so the terminal drops off the app's
+  // Linked Devices list the instant it closes — instead of lingering ~24h until its
+  // token TTL. We also drop Pi's persisted account credential (auth.json) so the next
+  // launch spawns a fresh session rather than reusing the one we just revoked (which
+  // Pi wouldn't reactively refresh on the resulting 401). Idempotent + time-bounded so
+  // a Ctrl+C during a slow network never hangs the exit. Registered BEFORE the account
+  // spawn below so an early Ctrl+C still tears down whatever was created.
+  let cleanedUp = false;
+  async function cleanup(): Promise<void> {
+    if (cleanedUp) return;
+    cleanedUp = true;
+    try { relay?.stop(); } catch { /* already stopped */ }
+    try { await priv.revokeLocalSessions(); } catch { /* best effort — server TTL is the fallback */ }
+    try { (services.authStorage as any).remove?.("privateer"); } catch { /* nothing persisted */ }
+  }
+  const onSignal = (): void => { void cleanup().finally(() => process.exit(0)); };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+
   // Account channel: seed the OAuth credential (a fresh child session) so getApiKey
   // resolves it; Pi then manages refresh on expiry via the registered oauth provider.
   if (provider === "privateer") {
@@ -231,7 +258,7 @@ async function main() {
     if (!line) continue;
     await runTurn(line, false);
   }
-  relay?.stop();
+  await cleanup();
   rl.close();
   console.log(`${DIM}bye.${RESET}`);
   process.exit(0);

package/src/config/version.ts

@@ -0,0 +1,16 @@
+import { createRequire } from "node:module";
+
+// The privateer-agent package version, read once from package.json. Used for the
+// relay `context` frame so the app's session banner can show the real agent
+// version. Returns "" if unreadable (never throws) — the app just omits the row.
+let cached: string | null = null;
+export function agentVersion(): string {
+  if (cached === null) {
+    try {
+      cached = String(createRequire(import.meta.url)("../../package.json").version ?? "");
+    } catch {
+      cached = "";
+    }
+  }
+  return cached;
+}

package/src/context.ts

@@ -0,0 +1,171 @@
+// PRIVATEER.md — Privateer's own project-context file, loaded like AGENTS.md / CLAUDE.md.
+//
+// Pi's built-in context loader only recognizes AGENTS.md and CLAUDE.md (the candidate
+// list is hardcoded in the upstream resource-loader and isn't extensible via a hook).
+// Rather than patch node_modules, we discover PRIVATEER.md ourselves and inject its
+// contents into the system prompt from the privateer-context extension — using the
+// exact <project_context>/<project_instructions> framing Pi uses for AGENTS.md, so the
+// model treats a PRIVATEER.md indistinguishably from a native context file.
+//
+// Discovery mirrors Pi's loadProjectContextFiles: the global agent dir first, then every
+// ancestor directory from the filesystem root down to cwd (nearest-wins ordering, deeper
+// files last so they can refine broader ones). All matches are concatenated.
+//
+// This module is pure (no Pi imports) so both the injection extension and the brand
+// banner can share it. The onContextChanged / emitContextChanged pair lets /init poke the
+// banner to re-render its "PRIVATEER.md loaded" line without either extension reaching
+// into the other — the same listener idiom as priv.onSignedIn in the auth module.
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+
+export const PRIVATEER_MD = "PRIVATEER.md";
+
+// Case variants we accept on disk (matches Pi's AGENTS.md / AGENTS.MD tolerance).
+const CANDIDATES = ["PRIVATEER.md", "PRIVATEER.MD"];
+
+export interface ContextFile {
+  path: string;
+  content: string;
+}
+
+// The global agent dir the launcher points Pi at (PRIVATEER_HOME/agent). We read the
+// same PI_CODING_AGENT_DIR env the launcher exports so a global ~/.privateer/agent/
+// PRIVATEER.md is honored just like a global AGENTS.md; fall back for `npm start`/dev
+// runs that don't go through bin/privateer-tui.
+function globalAgentDir(): string {
+  const fromEnv = process.env.PI_CODING_AGENT_DIR;
+  if (fromEnv) return resolve(fromEnv);
+  const home = process.env.PRIVATEER_HOME || join(homedir(), ".privateer");
+  return join(home, "agent");
+}
+
+function readCandidate(dir: string): ContextFile | null {
+  for (const name of CANDIDATES) {
+    const path = join(dir, name);
+    if (existsSync(path)) {
+      try {
+        return { path, content: readFileSync(path, "utf-8") };
+      } catch {
+        // unreadable (perms, races) — skip silently; the model just won't see it.
+      }
+    }
+  }
+  return null;
+}
+
+// All PRIVATEER.md files that apply to `cwd`, in prompt order: global agent dir first,
+// then root→cwd so the nearest (deepest) file lands last. De-duplicated by absolute path
+// (the global dir can coincide with an ancestor).
+export function discoverContextFiles(cwd: string = process.cwd()): ContextFile[] {
+  const files: ContextFile[] = [];
+  const seen = new Set<string>();
+  const push = (f: ContextFile | null) => {
+    if (f && !seen.has(f.path)) {
+      files.push(f);
+      seen.add(f.path);
+    }
+  };
+
+  push(readCandidate(globalAgentDir()));
+
+  // Walk cwd → root collecting matches, then reverse so root comes first (matching Pi's
+  // ancestorContextFiles.unshift ordering).
+  const ancestors: ContextFile[] = [];
+  let dir = resolve(cwd);
+  const root = resolve("/");
+  while (true) {
+    const f = readCandidate(dir);
+    if (f && !seen.has(f.path)) {
+      ancestors.unshift(f);
+      seen.add(f.path);
+    }
+    if (dir === root) break;
+    const parent = resolve(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  files.push(...ancestors);
+  return files;
+}
+
+// A unique sentinel opening the injected block, so before_agent_start can no-op if the
+// block is already present in the chained system prompt (defensive against re-entrancy).
+export const CONTEXT_BLOCK_MARKER = "<!-- privateer:PRIVATEER.md -->";
+
+// Format the discovered files into a system-prompt fragment using the same framing Pi
+// applies to AGENTS.md (see core/system-prompt.js), so the model can't tell the two
+// apart. Returns "" when there's nothing to inject.
+export function contextBlock(cwd: string = process.cwd()): string {
+  const files = discoverContextFiles(cwd);
+  if (files.length === 0) return "";
+  let out = `\n\n${CONTEXT_BLOCK_MARKER}\n<project_context>\n\nProject-specific instructions and guidelines:\n\n`;
+  for (const { path, content } of files) {
+    out += `<project_instructions path="${path}">\n${content}\n</project_instructions>\n\n`;
+  }
+  out += "</project_context>\n";
+  return out;
+}
+
+// The starter template `/init` writes. Kept deliberately short and self-explaining — the
+// first line tells a reader (and the model) exactly what the file is and how it's used.
+export const PRIVATEER_TEMPLATE = `# PRIVATEER.md
+
+Project context for the Privateer agent. Privateer loads this file automatically at
+startup (the same way it loads AGENTS.md / CLAUDE.md) and prepends it to the model's
+system prompt — so put anything the agent should always know about THIS project here.
+
+## Project
+
+<One or two lines: what this project is and what it does.>
+
+## Conventions
+
+- <Coding style, patterns, and idioms to follow.>
+- <Things to avoid.>
+
+## Commands
+
+- build: <command>
+- test: <command>
+- run: <command>
+
+## Notes for the agent
+
+- <Domain context, gotchas, or constraints worth stating once.>
+`;
+
+export interface WriteResult {
+  path: string;
+  created: boolean; // false when a file was already there and we left it untouched
+}
+
+// Write a starter PRIVATEER.md into `dir`, never clobbering an existing one.
+export function writeTemplate(dir: string = process.cwd()): WriteResult {
+  const path = join(dir, PRIVATEER_MD);
+  if (existsSync(path)) return { path, created: false };
+  writeFileSync(path, PRIVATEER_TEMPLATE, "utf-8");
+  return { path, created: true };
+}
+
+// ── change notification ──────────────────────────────────────────────────────
+// Lets /init (in the context extension) tell the banner (in the brand extension) that
+// PRIVATEER.md state changed, so the header re-renders its loaded/hint line immediately —
+// without either extension importing the other. Mirrors priv.onSignedIn.
+type Listener = () => void;
+const listeners = new Set<Listener>();
+
+export function onContextChanged(fn: Listener): void {
+  listeners.add(fn);
+}
+
+export function emitContextChanged(): void {
+  for (const fn of listeners) {
+    try {
+      fn();
+    } catch {
+      // a stale/broken listener must not break /init.
+    }
+  }
+}

package/src/daemon/index.ts

@@ -8,12 +8,13 @@ import {
   SessionManager,
 } from "@earendil-works/pi-coding-agent";
 import { agentDir, configPath } from "../config/paths.ts";
+import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { makePermissionGate, type GateController } from "../ext/permissionGate.ts";
 import { makePiPrivacyExtension } from "pi-privacy";
 import { makeAccountProvider } from "../providers/account.ts";
 import { RelayClient } from "../remote/relayClient.ts";
-import { hasCredentials, revokeChildSession, apiRequest, spawnAccountCredentials } from "../auth/privateer.ts";
+import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, spawnAccountCredentials } from "../auth/privateer.ts";
 import {
   loadRoutines,
   upsertRoutine,
@@ -161,6 +162,9 @@ export class Daemon {
   private onControllerAttached(): void {
     this.controllerAttached = true;
     this.relay?.sendSnapshot([{ kind: "notice", text: "Privateer routines — results will appear here as they run." }]);
+    // Version only — the routines terminal isn't a single-model session, so no
+    // model field (and no cwd, per RelayClient.sendContext's non-PII stance).
+    this.relay?.sendContext({ version: agentVersion() });
     const pending = drainPendingRelay();
     if (pending.length === 0) return;
     log(`controller attached — flushing ${pending.length} pending routine result(s)`);
@@ -260,6 +264,12 @@ export class Daemon {
     let out = "";
     let status: "ok" | "error" = "ok";
     let error: string | undefined;
+    // Track this run's account inference session so it can be torn down when the
+    // routine finishes — each run force-spawns a fresh one (below), so without this
+    // a long-lived daemon would leave one orphaned account "device" per run lingering
+    // in the app's Linked Devices until its token TTL.
+    let servicesRef: { authStorage?: { remove?: (p: string) => void } } | null = null;
+    let spawnedAccount = false;
     try {
       // Auto-approve (bypass) gate — safety is `tools: allowedTools`; a dangerous
       // shell command still fail-closes headlessly (localAsk denies).
@@ -281,12 +291,14 @@ export class Daemon {
           extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
         },
       });
+      servicesRef = services as any;
 
       const { provider, modelId } = parseSpec(modelSpec);
       if (provider === "privateer") {
         try {
           const creds = await spawnAccountCredentials();
           (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
+          spawnedAccount = true;
         } catch (e) {
           log(`  account channel unavailable: ${(e as Error).message}`);
         }
@@ -318,6 +330,17 @@ export class Daemon {
     } catch (err) {
       status = "error";
       error = err instanceof Error ? err.message : String(err);
+    } finally {
+      // Tear down THIS run's account inference session so it doesn't linger in the
+      // app's Linked Devices after the routine finishes. Revoke only the account
+      // session — the daemon's child API session (relay/outbox) must stay alive for
+      // the daemon's lifetime and is revoked on shutdown. Also drop Pi's persisted
+      // copy so a later run's fallback never reuses this revoked token. Best-effort;
+      // the next run force-spawns a fresh account session.
+      if (spawnedAccount) {
+        try { await revokeAccountSession(); } catch { /* best effort — server TTL is the fallback */ }
+        try { servicesRef?.authStorage?.remove?.("privateer"); } catch { /* nothing persisted */ }
+      }
     }
 
     const content = formatResult(routine, out, status, error);
@@ -398,7 +421,7 @@ export function runDaemon(): void {
   const shutdown = () => {
     log("shutting down");
     daemon.stop();
-    void revokeChildSession().finally(() => process.exit(0));
+    void revokeLocalSessions().finally(() => process.exit(0));
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);

package/src/providers/account.ts

@@ -17,8 +17,9 @@ import {
   authedFetch,
   spawnAccountCredentials,
   refreshAccountCredentials,
+  notifySignedIn,
 } from "../auth/privateer.ts";
-import { interpretReport, teePosture, type PrivacyTier } from "pi-privacy";
+import { interpretReport, teePosture, tierFromTeePosture, type PrivacyTier } from "pi-privacy";
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
@@ -66,19 +67,44 @@ export async function fetchAccountModels(): Promise<string[]> {
 export const privateerOAuthProvider = {
   name: "Privateer account",
   usesCallbackServer: false,
-  async login(cb: { onDeviceCode?: (info: unknown) => void }) {
-    if (!hasCredentials()) {
-      await runDeviceLogin({
-        onCode: (code) =>
-          cb.onDeviceCode?.({
-            userCode: code.user_code,
-            verificationUri: code.verification_uri_complete ?? code.verification_uri ?? "",
-            intervalSeconds: code.interval,
-            expiresInSeconds: code.expires_in,
-          }),
-      });
+  // Pi's login dialog passes `signal` (its cancel AbortController) alongside the
+  // callbacks. We MUST thread it into runDeviceLogin — otherwise escape/ctrl+c
+  // aborts the dialog's signal but our poll loop never sees it, the login()
+  // promise never settles, and Pi never restores the editor: the "Waiting for
+  // authentication…" screen hangs with no way out. See auth/privateer.ts
+  // pollForToken, which checks the signal and rejects with "Login cancelled.".
+  async login(cb: { onDeviceCode?: (info: unknown) => void; signal?: AbortSignal }) {
+    // Fresh machine? The device-code flow below fires notifySignedIn itself (via
+    // pollForToken). Already linked? No device code runs — so we announce the
+    // completed subscription login ourselves at the end, or the header/badge would
+    // keep showing "not signed in" until the next launch.
+    const wasLinked = hasCredentials();
+    if (!wasLinked) {
+      try {
+        await runDeviceLogin({
+          signal: cb.signal,
+          onCode: (code) =>
+            cb.onDeviceCode?.({
+              userCode: code.user_code,
+              verificationUri: code.verification_uri_complete ?? code.verification_uri ?? "",
+              intervalSeconds: code.interval,
+              expiresInSeconds: code.expires_in,
+            }),
+        });
+      } catch (e) {
+        // Normalize the cancel message to exactly "Login cancelled" (no period):
+        // Pi's login dialog only suppresses its "Failed to login…" error toast for
+        // that exact string, so a cancel should exit quietly, not flash an error.
+        if (cb.signal?.aborted) throw new Error("Login cancelled");
+        throw e;
+      }
     }
-    return spawnAccountCredentials();
+    if (cb.signal?.aborted) throw new Error("Login cancelled");
+    const creds = await spawnAccountCredentials();
+    // The fresh path already fired notifySignedIn (pollForToken); fire here for the
+    // already-linked path so the header re-renders to "connected" on this terminal too.
+    if (wasLinked) notifySignedIn();
+    return creds;
   },
   async refreshToken(creds: { refresh: string }) {
     try {
@@ -108,13 +134,11 @@ export interface AccountPosture {
 
 // Posture for an account-channel model. For NEAR models the attestation is fetched
 // through the SERVER proxy (the account's NEAR key stays server-side): the server
-// mints the nonce AND returns the report, so the CLIENT contributes no freshness and
-// can't bind the report to the live TLS key. That is a trust-the-server posture, not
-// client-verified — materially weaker than the direct nearai path (which supplies its
-// own randomNonce). So we must NOT promote it to `tee-verified`: that tier reads as
-// cryptographically proven and, critically, disables pi-privacy's PII gate. We cap a
-// green server posture at `tee-unverified` (honest yellow — the PII gate stays on) and
-// still surface the raw teePosture for display. ZDR-channel models route to
+// mints the nonce and returns the report. A green attestation is trusted as a genuine
+// TEE — promoted to `tee-verified` (green shield "Trusted Execution" in the badge) —
+// so an attested confidential-compute model reads as verified-private. A yellow report
+// stays `tee-unverified` (unconfirmed) and red falls back to `standard`; the raw
+// teePosture is still surfaced for display. ZDR-channel models route to
 // zero-retention endpoints server-side, which we can't observe here — a policy claim.
 export async function accountPosture(modelId: string): Promise<AccountPosture> {
   if (privateerChannel(modelId) === "zdr") {
@@ -128,8 +152,8 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
     const data = (await res.json()) as { nonce?: string; report?: unknown };
     const att = interpretReport(modelId, data.nonce ?? "", data.report ?? {});
     const tp = teePosture(att);
-    // Cap at client-unverifiable: server-proxied green never earns `tee-verified`.
-    const tier: PrivacyTier = tp === "red" ? "standard" : "tee-unverified";
+    // green → tee-verified, yellow → tee-unverified, red → standard.
+    const tier: PrivacyTier = tierFromTeePosture(tp);
     return { tier, teePosture: tp };
   } catch (e) {
     return { tier: "tee-unverified", error: (e as Error).message };

package/src/remote/relayClient.ts

@@ -422,6 +422,19 @@ export class RelayClient {
     this.rawSend({ type: "no_quarter", on });
   }
 
+  // Push this terminal's live context (selected model, agent version) to a
+  // controller so the app's session banner reflects reality instead of a stub.
+  // Sent on controller attach — like the snapshot/no_quarter resync. NON-PII ONLY
+  // by design: deliberately NO cwd / hostname / username, matching terminalLabel's
+  // stance (the server/controller learns as little as possible about the machine).
+  // Empty/absent fields are omitted so the app renders less rather than blank.
+  sendContext(ctx: { model?: string; version?: string }): void {
+    const frame: Record<string, unknown> = { type: "context" };
+    if (typeof ctx.model === "string" && ctx.model) frame.model = ctx.model;
+    if (typeof ctx.version === "string" && ctx.version) frame.version = ctx.version;
+    this.rawSend(frame);
+  }
+
   requestApproval(id: string, req: PermissionRequest): void {
     this.rawSend({
       type: "approval_request",