privateer-agent 0.3.6 → 0.4.0

package/bin/privateer-daemon.mjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// Launcher for the resident Privateer daemon (routines + app-driven headless task
+// spawns). Mirrors bin/privateer.mjs: load dev keys from the repo .env WITHOUT
+// changing cwd, register tsx so TS resolves regardless of the invocation cwd, then
+// hand off to the daemon CLI dispatcher (which imports ./boot.ts before any Pi code).
+//
+// Invoked two ways: interactively via the bash launcher (`privateer daemon …`), and
+// by the installed launchd/systemd service (`node privateer-daemon.mjs run`).
+import { register } from "tsx/esm/api";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const repo = resolve(here, "..");
+
+try {
+  process.loadEnvFile(resolve(repo, ".env"));
+} catch {
+  /* no .env — rely on the ambient environment / ~/.privateer */
+}
+
+// The daemon loads the moat as in-code factories, so its subagent children (routines /
+// task sessions) can't inherit it and `pi` isn't on PATH. Point pi-subagents at our
+// moat-injecting wrapper so those children spawn gated + private with no double-load.
+// Process-global is safe here: the wrapper is stateless (unlike a per-parent channel).
+process.env.PI_SUBAGENT_PI_BINARY ??= resolve(repo, "bin/privateer-subagent.mjs");
+
+register();
+const { runDaemonCli } = await import(resolve(repo, "src/cli/daemonCli.ts"));
+await runDaemonCli(process.argv.slice(2));

package/bin/privateer-subagent.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// The binary pi-subagents spawns for each subagent child (via PI_SUBAGENT_PI_BINARY)
+// when the PARENT loaded privateer's moat as IN-CODE extension factories (the lean
+// REPL, the daemon, live task sessions) rather than agent-dir discovery.
+//
+// Why a wrapper here (vs the plain cli.js the TUI uses): a subagent child is a fresh
+// `pi` subprocess that can't inherit the parent's in-code factories. It CAN auto-
+// discover agent-dir extensions — but if the parent ALSO loaded those same shims as
+// factories, Pi loads both (resource-loader merges discovered + inline) and the moat
+// double-loads (two gates, two provider registrations). So instead of relying on
+// discovery, this wrapper injects the moat EXPLICITLY as `-e` extensions and passes
+// `--no-extensions` to turn agent-dir discovery OFF. The child then loads exactly:
+//   • pi-subagents' own runtime extensions (already present in the argv it built), and
+//   • privateer's gate + privacy + account (the three `-e` below),
+// with no discovery, hence no double-load — while pi-subagents' explicit `--extension`
+// args still load (‑‑no‑extensions only disables DISCOVERY, not explicit `-e`).
+//
+// Exported helpers are pure and unit-tested (tests/subagentWrapper.test.ts); the
+// spawn only runs when this file is invoked as a binary.
+
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve, join } from "node:path";
+
+const HERE = dirname(fileURLToPath(import.meta.url)); // bin/
+const REPO = resolve(HERE, ".."); // repo root
+
+// Absolute paths to privateer's moat extension entry files (the same modules the TUI
+// installs as discovery shims). gate = the permission moat (fail-closed / forwards
+// child approvals to the parent); privacy = ZDR/TEE posture + attestation dispatcher;
+// account = the privateer/* provider so a child can run account models.
+export function moatExtensionPaths(repoRoot = REPO) {
+  return [
+    join(repoRoot, "extensions", "privateer-gate.ts"),
+    join(repoRoot, "extensions", "privateer-privacy.ts"),
+    join(repoRoot, "extensions", "privateer-account.ts"),
+  ];
+}
+
+// The bundled Pi CLI the child actually runs (executable, `#!/usr/bin/env node`).
+export function piCliPath(repoRoot = REPO) {
+  return join(repoRoot, "node_modules", "@earendil-works", "pi-coding-agent", "dist", "cli.js");
+}
+
+// Given the args pi-subagents built for the child, return the args to run the bundled
+// cli.js with: `--no-extensions` + one `-e <path>` per moat extension, THEN the
+// original args (so the injected flags precede the positional `Task:` prompt).
+export function buildChildArgs(originalArgs, repoRoot = REPO) {
+  const inject = ["--no-extensions"];
+  for (const p of moatExtensionPaths(repoRoot)) inject.push("-e", p);
+  return [...inject, ...originalArgs];
+}
+
+// Run only when invoked directly (not when imported by the test).
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = buildChildArgs(process.argv.slice(2));
+  const child = spawn(process.execPath, [piCliPath(), ...args], { stdio: "inherit", env: process.env });
+  // Propagate the child's exit faithfully so pi-subagents' parent reads the real
+  // outcome (a signal re-raises; otherwise exit with the same code).
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (e) => {
+    console.error(`privateer-subagent: failed to spawn pi — ${e.message}`);
+    process.exit(1);
+  });
+}

package/bin/privateer-tui

@@ -38,6 +38,18 @@ pick_node() {
   echo "node"
 }
 
+# `privateer daemon [run|install|uninstall|status]` — the resident background daemon
+# (routines + app-driven headless task spawns). Handled HERE, before the Pi TUI exec
+# and before the moat-shim install (the daemon doesn't need the interactive extension
+# set), so it boots straight into src/daemon via bin/privateer-daemon.mjs.
+if [ "${1:-}" = "daemon" ]; then
+  shift
+  DAEMON_NODE="$(pick_node)"
+  DAEMON_ENV_ARGS=""
+  [ -f "$REPO/.env" ] && DAEMON_ENV_ARGS="--env-file=$REPO/.env"
+  exec "$DAEMON_NODE" ${DAEMON_ENV_ARGS:+"$DAEMON_ENV_ARGS"} "$REPO/bin/privateer-daemon.mjs" "$@"
+fi
+
 AGENT_DIR="${PRIVATEER_HOME:-$HOME/.privateer}/agent"
 EXT_DIR="$AGENT_DIR/extensions"
 mkdir -p "$EXT_DIR"
@@ -70,6 +82,13 @@ shim pi-subagents      "$REPO/node_modules/pi-subagents/src/extension/index.ts"
 
 CLI="$REPO/node_modules/@earendil-works/pi-coding-agent/dist/cli.js"
 export PI_CODING_AGENT_DIR="$AGENT_DIR"
+# The binary pi-subagents spawns for each subagent child. Without this it falls back
+# to `pi` on PATH (getPiSpawnCommand) — which a Privateer install does NOT provide, so
+# every subagent spawn would fail with ENOENT. Point it at OUR bundled cli.js (it's
+# executable, `#!/usr/bin/env node`): the child then reads this same PI_CODING_AGENT_DIR
+# and DISCOVERS the moat shims above — so subagents run gated + private, no -e injection
+# (hence no double-load). Set only when unset so a power user can override it.
+export PI_SUBAGENT_PI_BINARY="${PI_SUBAGENT_PI_BINARY:-$CLI}"
 # Suppress Pi's upstream "Update Available — run `pi update`" banner. It's noise on a
 # Privateer install (our banner is the startup surface), it leaks the "pi" name, and
 # `pi update` would fight our npm-managed install. PI_SKIP_VERSION_CHECK disables ONLY

package/extensions/privateer-brand.ts

@@ -34,35 +34,75 @@ const VERSION: string = (() => {
   }
 })();
 
-// ── palette (Privateer "Open Water" ocean-blue brand) ────────────────────────
+// ── palette (Privateer brand) ────────────────────────────────────────────────
 // 256-color (8-bit), NOT 24-bit truecolor: macOS Terminal.app doesn't support
 // truecolor and mangles it (the old indigo/cyan came out green). These indices are
-// universally supported. Navy (the logo mark) is too dark to read on a dark terminal,
-// so we use the app's ocean blues — the same "Open Water" gradient as the brand.
+// universally supported. Navy (the logo mark) is too dark to read on a dark terminal, so
+// the whole banner — silhouette, wordmark, frame, and accents — is painted white: a clean
+// single-color mark, like the logo but legible on dark.
 const ESC = "\x1b[";
 const RESET = `${ESC}0m`;
 const BOLD = `${ESC}1m`;
 const c = (n: number): string => `${ESC}38;5;${n}m`;
-const OCEAN = c(39); // ≈ #00afff — primary ocean blue (anchor, wordmark "P")
-const OCEAN_LIGHT = c(81); // ≈ #5fd7ff — light sky accent (wordmark, version, path)
-const BORDER = c(32); // ≈ #0087d7 — deeper ocean, the frame
+const OCEAN = c(231); // white (#ffffff) — anchor / wordmark "P"
+const OCEAN_LIGHT = c(231); // white (#ffffff) — wordmark, version, path
+const BORDER = c(231); // white (#ffffff) — the frame
 const DIM = `${ESC}90m`;
 const GREEN = `${ESC}32m`;
 const YELLOW = `${ESC}33m`;
 
-// The Privateer mark in ASCII: a padlock (with keyhole) atop an anchor — "bring your
-// own model" meets lock-and-key privacy, echoing the app's anchor+padlock logo. Every
-// line is the SAME visible width (MARK_W) and centers on column 5 (the shank/keyhole),
-// so the text column beside it stays aligned. Keep them equal-width if you edit the art.
-const MARK_W = 11;
-const ANCHOR = [
-  "    .-.    ", // shackle arch
-  "   |___|   ", // lock body top (the shackle's base)
-  "   |_t_|   ", // lock body + keyhole
-  " /\\  |  /\\ ", // stock — arms flare from the shank (each \\ is one backslash)
-  "  \\  |  /  ", // arms
-  "   \\_|_/   ", // flukes
+// The Privateer mark: our symbol — a padlock (with a keyhole) fused into an anchor,
+// "bring your own model" meets lock-and-key privacy — drawn from the app's logo. It's
+// rendered with terminal HALF-BLOCKS, so each text row packs TWO pixel rows: a "▀"
+// whose FOREGROUND paints the top pixel and BACKGROUND the bottom (one pixel → "▀"/"▄"
+// on the default bg; none → a plain space). 256-color indices only, same reason as the
+// palette above. Every built line is MARK_W visible cells wide (SGR escapes don't
+// count), so the text column beside it stays aligned. To redraw: edit PIXELS (each char
+// is a PX palette key), keeping every row MARK_W long and the row COUNT even — the
+// builder derives the escapes from that.
+const MARK_W = 12;
+const PX: Record<string, number | null> = {
+  ".": null, // transparent — the frame (and the knocked-out keyhole) shows through
+  O: 231, // white (#ffffff, top of the 256-color cube) — the silhouette, a clean single-color mark
+};
+// 12 wide; an EVEN number of rows so they pair cleanly into half-block cells. Two blank
+// leading rows give the lock a little headroom without dropping the whole mark too low.
+// A small padlock rides on top as the anchor's ring: a narrow rounded shackle over an
+// 8-wide body that OVERHANGS the shackle on both sides (matching the logo's proportions,
+// where the body is clearly wider than the shackle), with a small centered 2×2 keyhole
+// knocked out of it — reads clearly as a lock without dominating the anchor. Then a short
+// shank → hooked fluke barbs (a 2-tall blade tip that turns up-and-out) → crown → bill.
+const PIXELS = [
+  "............", "............",
+  "....OOOO....", "...OO..OO...", "...OO..OO...",
+  "..OOOOOOOO..", "..OOOOOOOO..",
+  "..OOO..OOO..", "..OOO..OOO..",
+  "..OOOOOOOO..", "..OOOOOOOO..",
+  ".....OO.....", ".....OO.....",
+  "O....OO....O", "OO...OO...OO", "OO...OO...OO",
+  ".OO..OO..OO.", "..OO.OO.OO..",
+  "..OOOOOOOO..", "...OOOOOO...", "....OOOO....", ".....OO.....",
 ];
+// Build the mark once at load. Each cell resets SGR so a background color can never
+// bleed into the row padding the framer adds after it.
+const MARK: string[] = (() => {
+  const rows: string[] = [];
+  for (let r = 0; r < PIXELS.length; r += 2) {
+    const top = PIXELS[r];
+    const bot = PIXELS[r + 1] ?? ".".repeat(MARK_W);
+    let line = "";
+    for (let x = 0; x < MARK_W; x++) {
+      const t = PX[top[x]];
+      const bcol = PX[bot[x]];
+      if (t == null && bcol == null) line += " ";
+      else if (t != null && bcol != null) line += `${ESC}38;5;${t}m${ESC}48;5;${bcol}m▀${RESET}`;
+      else if (t != null) line += `${ESC}38;5;${t}m▀${RESET}`;
+      else line += `${ESC}38;5;${bcol}m▄${RESET}`;
+    }
+    rows.push(line);
+  }
+  return rows;
+})();
 
 // Visible width = characters after stripping SGR escapes. Everything we render inside
 // the box is ASCII or a BMP width-1 symbol, so a plain length is exact here.
@@ -200,10 +240,11 @@ function renderBanner(width: number, modelProvider?: string): string[] {
   // Zip the mark and the text column by row. Rows past the mark's height get a blank
   // gutter of the mark's width, so the text stays in one column throughout.
   const gap = "  ";
-  const height = Math.max(ANCHOR.length, text.length);
+  const height = Math.max(MARK.length, text.length);
   const rows: string[] = [];
   for (let i = 0; i < height; i++) {
-    const left = i < ANCHOR.length ? `${OCEAN}${ANCHOR[i]}${RESET}` : " ".repeat(MARK_W);
+    // The mark lines already carry their own per-pixel colors, so we don't wrap them.
+    const left = i < MARK.length ? MARK[i] : " ".repeat(MARK_W);
     rows.push(`${left}${gap}${text[i] ?? ""}`.trimEnd());
   }
 

package/extensions/privateer-gate.ts

@@ -13,10 +13,21 @@
 import { makePermissionGate, defaultLocalAsk } from "../src/ext/permissionGate.ts";
 import { createEngineEventAdapter } from "../src/bridge/engineAdapter.ts";
 import { RemoteBridge } from "../src/remote/remoteBridge.ts";
+import {
+  isSubagentChild,
+  inheritedChannelDir,
+  makeChildGateAsk,
+  startParentApprovalRelay,
+} from "../src/remote/subagentRelay.ts";
 import { RelayClient } from "../src/remote/relayClient.ts";
 import { makeSendFileTool } from "../src/tools/sendFile.ts";
 import { makeSaveAttachmentTool } from "../src/tools/saveAttachment.ts";
 import { AttachmentStore, type StoredAttachment } from "../src/util/attachmentStore.ts";
+import { makeExtensionsControl } from "../src/remote/extensionsControl.ts";
+import { makeSkillsControl } from "../src/remote/skillsControl.ts";
+import { agentDir } from "../src/config/paths.ts";
+import { agentVersion } from "../src/config/version.ts";
+import { SettingsManager } from "@earendil-works/pi-coding-agent";
 import * as priv from "../src/auth/privateer.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
@@ -27,8 +38,183 @@ let mode: PermissionMode = MODES.includes(process.env.PRIVATEER_MODE as Permissi
 const allowlist: string[] = [];
 const allowedOutsideRoots: string[] = [];
 
+// A turn driven from the app is in flight. Guards the remote onPrompt path against a
+// SECOND prompt arriving while Pi is still processing — which throws "Agent is already
+// processing" and wedges the session. This happens in normal use when the app drops
+// (backgrounded → socket suspended) and re-sends its prompt on reconnect. Mirrors the
+// REPL's `turnActive` guard. Set on a successful sendUserMessage, cleared on agent_end.
+let remoteTurnActive = false;
+
 let piRef: any = null;
 let relay: any = null;
+// Pi-extension manager for the app's extensions screen. Built lazily on first use
+// with a fresh SettingsManager (the ExtensionAPI exposes no package/settings manager),
+// reading the same ~/.privateer/agent/settings.json Pi loads from.
+let extensions: ReturnType<typeof makeExtensionsControl> | null = null;
+function extControl(): ReturnType<typeof makeExtensionsControl> {
+  if (!extensions) {
+    const cwd = process.cwd();
+    extensions = makeExtensionsControl({ cwd, agentDir: agentDir(), settingsManager: SettingsManager.create(cwd, agentDir()) });
+  }
+  return extensions;
+}
+
+// Run an extensions add/remove for the app and relay progress → result. The persist
+// is immediate but the extension only loads on the next terminal launch, so the final
+// frame flags needsRestart. (A live ctx.reload() is only reachable from the local
+// /extensions command handler — not from a relay frame — see registerCommand below.)
+async function runExtMutation(kind: "add" | "remove", source: string): Promise<void> {
+  const ext = extControl();
+  ext.setProgress((ev) =>
+    relay?.sendExtensions({
+      installed: ext.listInstalled(),
+      busy: ev.type !== "complete" && ev.type !== "error",
+      message: ev.message,
+    }),
+  );
+  try {
+    const res = kind === "add" ? await ext.add(source) : await ext.remove(source);
+    relay?.sendExtensions({
+      installed: ext.listInstalled(),
+      message: res.ok
+        ? `${kind === "add" ? "Added" : "Removed"} ${source} — restart the terminal to activate.`
+        : res.message,
+      needsRestart: res.ok,
+    });
+  } finally {
+    ext.setProgress(undefined);
+  }
+}
+
+// Skills manager for the app's skills screen. Built lazily like extControl(), with a
+// fresh SettingsManager reading the same ~/.privateer/agent/settings.json Pi loads.
+let skills: ReturnType<typeof makeSkillsControl> | null = null;
+function skillControl(): ReturnType<typeof makeSkillsControl> {
+  if (!skills) {
+    const cwd = process.cwd();
+    skills = makeSkillsControl({ cwd, agentDir: agentDir(), settingsManager: SettingsManager.create(cwd, agentDir()) });
+  }
+  return skills;
+}
+
+// Run a skills create/delete/toggle for the app and relay the fresh list + result.
+// The write is immediate but only reaches the model's <available_skills> on the next
+// launch (needsRestart); Run-now via /skill:name works without a restart.
+async function runSkillMutation(op: () => Promise<{ ok: boolean; message?: string }>, verb: string): Promise<void> {
+  const sk = skillControl();
+  const res = await op();
+  relay?.sendSkills({
+    items: sk.listSkills(),
+    message: res.ok ? `${verb} — restart the terminal to update the model's skill list.` : res.message,
+    needsRestart: res.ok,
+  });
+}
+
+// ── app-driven model switching (parity with the REPL's /model picker) ──────────
+// The TUI's own /model command isn't reachable over the relay, so we reproduce it:
+// the model registry + selected spec are captured from session_start / model_select,
+// and currentSpec ("provider/id") follows both app- and locally-driven switches so
+// the app's banner + picker always reflect what's actually selected.
+let modelReg: any = null;
+let currentSpec = "";
+
+function modelSpec(m: any): string {
+  return m ? `${m.provider}/${m.id}` : "";
+}
+
+// This machine's real model catalog as sorted "provider/id" specs — the same list
+// the app's picker draws from (relayed on demand via /model, never pushed).
+function availableModelSpecs(): string[] {
+  const all: any[] = modelReg?.getAvailable ? modelReg.getAvailable() : [];
+  return all.map(modelSpec).sort();
+}
+
+// Switch the live TUI model in place via Pi's setModel, then push context + a notice
+// so the app's banner and feed follow. setModel returns false when no API key is
+// configured for the target provider.
+async function switchModelRemote(spec: string): Promise<void> {
+  const sp = spec.trim();
+  const at = sp.indexOf("/");
+  if (at < 0) { relay?.sendNotice("Usage: /model provider/id"); return; }
+  const p = sp.slice(0, at), id = sp.slice(at + 1);
+  const model = modelReg?.find?.(p, id);
+  if (!model) { relay?.sendNotice(`Model ${sp} not found — try /models.`); return; }
+  try {
+    const ok = await piRef?.setModel?.(model);
+    if (ok === false) { relay?.sendNotice(`No API key for ${p} — can't switch to ${sp}.`); return; }
+    currentSpec = sp;
+    relay?.sendContext({ model: currentSpec, version: agentVersion() }); // banner follows
+    relay?.sendNotice(`model → ${sp}`);
+  } catch (e) {
+    relay?.sendNotice(`Couldn't switch model: ${(e as Error).message}`);
+  }
+}
+
+// The app /model picker: relay this machine's catalog as a selection prompt and
+// switch to the driver's choice. Mirrors the REPL's pickModelRemote.
+async function pickModelRemote(filter: string): Promise<void> {
+  const specs = availableModelSpecs().filter((sp) => !filter || sp.toLowerCase().includes(filter));
+  const choice = await bridge.selectRemote({
+    title: "Choose a model",
+    options: specs.map((sp) => ({ value: sp, label: sp })),
+    current: currentSpec,
+  });
+  if (choice) await switchModelRemote(choice);
+}
+
+// Dispatch an app-composer slash command. The model/mode pickers are handled here
+// (the TUI's native /model can't be reached over the relay); anything else is handed
+// to Pi as a user message so extension/skill commands still run remotely — mirrors
+// the REPL's runCommand fall-through.
+async function runRemoteCommand(text: string): Promise<void> {
+  const line = text.trim();
+  if (line.startsWith("/model ")) { await switchModelRemote(line.slice(7)); return; }
+  if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
+    const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
+    await pickModelRemote(filter);
+    return;
+  }
+  if (line.startsWith("/mode ")) {
+    const m = line.slice(6).trim() as PermissionMode;
+    if (MODES.includes(m)) { mode = m; relay?.sendNotice(`mode → ${mode}`); }
+    else relay?.sendNotice(`unknown mode "${m}" — use ${MODES.join(" | ")}`);
+    return;
+  }
+  if (line === "/mode") {
+    const choice = await bridge.selectRemote({
+      title: "Permission mode",
+      options: MODES.map((v) => ({ value: v, label: v })),
+      current: mode,
+    });
+    if (choice && MODES.includes(choice as PermissionMode)) { mode = choice as PermissionMode; relay?.sendNotice(`mode → ${mode}`); }
+    return;
+  }
+  piRef?.sendUserMessage?.(line); // fall through: let Pi run it (or treat as a prompt)
+}
+
+// The slash commands to advertise to the app's composer: our built-in pickers plus
+// whatever Pi has registered (extension/skill/template commands), deduped. Pushed on
+// controller attach. NON-PII: command names + descriptions only.
+function advertiseCommands(): { name: string; description?: string }[] {
+  const builtins = [
+    { name: "/model", description: "Switch the model" },
+    { name: "/models", description: "List available models" },
+    { name: "/mode", description: "Change the approval mode (default/acceptEdits/plan/bypass)" },
+  ];
+  let ext: { name: string; description?: string }[] = [];
+  try {
+    const cmds = piRef?.getCommands?.() ?? [];
+    ext = cmds
+      .map((c: any) => {
+        const raw = c?.invocationName ?? c?.name ?? c?.command;
+        if (!raw) return null;
+        return { name: String(raw).startsWith("/") ? String(raw) : `/${raw}`, description: c?.description };
+      })
+      .filter(Boolean);
+  } catch { /* no commands registered yet */ }
+  const seen = new Set(builtins.map((c) => c.name));
+  return [...builtins, ...ext.filter((c: any) => !seen.has(c.name))];
+}
 
 // Persistent footer indicator for remote access. When the relay is up, the footer
 // shows a GREEN "⟿ remote access" line so it's always obvious this terminal can be
@@ -75,6 +261,13 @@ let sinceLastPrompt: StoredAttachment[] = [];
 
 const bridge = new RemoteBridge({
   onPrompt: (text) => {
+    // Drop a prompt that arrives while a driven turn is already running (e.g. the app
+    // re-sending after a reconnect) — sendUserMessage would otherwise throw "Agent is
+    // already processing" and wedge the session. Tell the app why, don't crash.
+    if (remoteTurnActive) {
+      relay?.sendNotice("busy — a turn is already running; wait for it to finish.");
+      return;
+    }
     // Fold any files the app sent since the last prompt into a reference note so the
     // model knows they exist and can save_attachment them.
     const atts = sinceLastPrompt;
@@ -83,16 +276,39 @@ const bridge = new RemoteBridge({
       ? `\n\n[Files attached from the app: ${atts.map((a) => `#${a.n} ${a.name} (${a.mediaType})`).join(", ")}. ` +
         `Use the save_attachment tool with the ref number to write one to disk.]`
       : "";
-    piRef?.sendUserMessage?.(text + note); // drive a turn in Pi's TUI
+    try {
+      piRef?.sendUserMessage?.(text + note); // drive a turn in Pi's TUI
+      remoteTurnActive = true; // cleared on agent_end
+    } catch (e) {
+      // A synchronous "already processing" (or any send failure) must not wedge the
+      // bridge — surface it and stay idle so the next prompt still works.
+      relay?.sendNotice(`couldn't start turn: ${(e as Error).message}`);
+    }
   },
   onInterrupt: () => {}, // Pi owns interrupt; best-effort no-op
   // The app asked to end remote access from its side — stop the relay locally too so
   // the terminal doesn't keep reconnecting, and clear the green indicator.
   onTerminate: () => disableRemote(),
+  // The account signed this terminal out server-side (revoked from the app's Linked
+  // Devices). Unlike onTerminate, this wipes the machine login too: drop the relay,
+  // then tear down the session. handleServerRevoke fires onSessionExpired, which the
+  // brand extension handles (drops Pi's persisted account credential, refreshes the
+  // banner, and notifies "your session was signed out — run /signin").
+  onRevoked: () => {
+    disableRemote();
+    priv.handleServerRevoke();
+  },
+  // A slash command typed in the app composer (e.g. /model) — dispatch it through the
+  // same picker flow the REPL uses. Feedback returns as notice/select_request/context.
+  onCommand: (text) => void runRemoteCommand(text),
   onControllerAttached: () => {
-    // A controller reached us → the socket is up and driving: go green.
+    // A controller reached us → the socket is up and driving: go green. Resync the
+    // snapshot, push live context (model + version) so the app banner reflects this
+    // terminal, and advertise the slash commands for the composer's autocomplete.
     setRemoteState("connected");
     relay?.sendSnapshot([{ kind: "notice", text: "Privateer terminal connected." }]);
+    relay?.sendContext({ model: currentSpec, version: agentVersion() });
+    relay?.sendCommands(advertiseCommands());
   },
   onAttachment: (file) => sinceLastPrompt.push(attachments.register(file)),
   // Drive the indicator from the relay's own status stream: "connected" → green;
@@ -102,15 +318,36 @@ const bridge = new RemoteBridge({
     if (/disconnect|reconnect|retry|couldn't|could not/i.test(text)) setRemoteState("connecting");
     else if (/connected/i.test(text)) setRemoteState("connected");
   },
+  // The app's extensions manager: list the user's installed Pi extensions (the moat
+  // is excluded), or add/remove one. See runExtMutation for the progress/restart flow.
+  onExtensionsList: () => relay?.sendExtensions({ installed: extControl().listInstalled() }),
+  onExtensionsAdd: (source) => void runExtMutation("add", source),
+  onExtensionsRemove: (source) => void runExtMutation("remove", source),
+  // The app's skills manager: list the terminal's skills, or create/delete/toggle a
+  // user one. See runSkillMutation for the restart flow; Run-now is a /skill:name
+  // command frame handled by Pi, not here.
+  onSkillsList: () => relay?.sendSkills({ items: skillControl().listSkills() }),
+  onSkillCreate: (skill) => void runSkillMutation(() => skillControl().createSkill(skill), "Saved"),
+  onSkillDelete: (name) => void runSkillMutation(() => skillControl().deleteSkill(name), "Deleted"),
+  onSkillSetEnabled: (name, enabled) => void runSkillMutation(() => skillControl().setEnabled(name, enabled), enabled ? "Enabled" : "Disabled"),
 });
 
+// Inside a subagent child (headless `pi`, stdin ignored), a gated action can't be
+// approved locally — decideAuto still forces dangerous shell / destructive / secret-
+// exfil to "ask", which would otherwise fail-closed to deny. If the root parent wired
+// an approval channel (env-inherited), forward those asks to it so they reach the app;
+// otherwise keep the fail-closed defaultLocalAsk (headless deny). A top-level TUI keeps
+// its own interactive/remote gate.
+const childChannel = isSubagentChild() ? inheritedChannelDir() : undefined;
+const localAsk = childChannel ? makeChildGateAsk(childChannel) : defaultLocalAsk;
+
 const gate = makePermissionGate({
   getMode: () => mode,
   setMode: (m) => (mode = m),
   allowlist,
   allowedOutsideRoots,
   cwd: process.cwd(),
-  localAsk: defaultLocalAsk,
+  localAsk,
   getRemote: bridge.getRemote,
   getNoQuarter: bridge.getNoQuarter,
   remoteAsk: bridge.remoteAsk,
@@ -120,6 +357,14 @@ export default function privateerControl(pi: any): void {
   piRef = pi;
   gate(pi); // tool_call (block/allow) + tool_result (redact)
 
+  // Top-level session: watch the subagent approval channel and relay each child's
+  // gated action to the app over this session's bridge. The bridge fails closed while
+  // no controller is attached, so an undriven terminal denies a subagent's gated
+  // action rather than auto-approving it. A subagent child never watches (it forwards).
+  if (!isSubagentChild()) {
+    startParentApprovalRelay(bridge, { onError: () => { /* best-effort; a poll error must not crash the turn */ } });
+  }
+
   // File transfer both ways: send_file_to_client (CLI→app, via the bridge's relay) and
   // save_attachment (app→CLI, from the AttachmentStore inbound files land in). Both
   // live here because they share the RemoteBridge / its attachment stream.
@@ -144,12 +389,25 @@ export default function privateerControl(pi: any): void {
     // the footer indicator (they fire outside any command's ctx). Re-render in case
     // remote access was already on when the session (re)started.
     if (ctx?.ui) uiRef = ctx.ui;
+    // Capture the model registry + launch model so the app's /model picker has this
+    // machine's real catalog and the banner shows the current spec from the start.
+    if (ctx?.modelRegistry) modelReg = ctx.modelRegistry;
+    if (!currentSpec && ctx?.model) currentSpec = modelSpec(ctx.model);
     refreshRemoteStatus();
     if (ctx?.mode && HEADLESS.has(ctx.mode) && (process.env.PRIVATEER_MODE ?? "") === "") {
       mode = "bypass";
     }
   });
 
+  // Follow local model switches too (the user picking a model in the TUI): keep
+  // currentSpec current and push context so a driving app's banner stays in sync.
+  pi.on("model_select", (ev: any) => {
+    if (ev?.model) {
+      currentSpec = modelSpec(ev.model);
+      relay?.sendContext({ model: currentSpec, version: agentVersion() });
+    }
+  });
+
   // Forward turn events to the app. The relay only sends when a controller is
   // attached, so this is safe on every turn (local or remote).
   const adapter = createEngineEventAdapter();
@@ -165,6 +423,7 @@ export default function privateerControl(pi: any): void {
   pi.on("agent_end", (ev: any) => {
     fwd(ev);
     bridge.settleTurn();
+    remoteTurnActive = false; // turn finished → the next app prompt may start one
   });
 
   pi.registerCommand?.("mode", {
@@ -177,6 +436,34 @@ export default function privateerControl(pi: any): void {
     },
   });
 
+  // Local extension management. Mirrors what the app's extensions screen does over
+  // the relay, but here we CAN hot-activate: ctx.reload() rebuilds the live runner,
+  // so a just-added/removed extension takes effect without relaunching (a luxury the
+  // relay path lacks — no command ctx there). Usage: /extensions [add|remove <src>].
+  pi.registerCommand?.("extensions", {
+    description: "Manage installed Pi extensions: /extensions [add <npm:pkg> | remove <npm:pkg>]",
+    handler: async (args: string, ctx: any) => {
+      const raw = String(args ?? "").trim();
+      const [verb, ...rest] = raw.split(/\s+/);
+      const source = rest.join(" ").trim();
+      const ext = extControl();
+      if (verb === "add" || verb === "remove") {
+        if (!source) return ctx.ui?.notify?.(`Usage: /extensions ${verb} <npm:package>`, "warning");
+        const res = verb === "add" ? await ext.add(source) : await ext.remove(source);
+        if (!res.ok) return ctx.ui?.notify?.(res.message ?? `Couldn't ${verb} ${source}`, "warning");
+        await ctx.reload?.(); // hot-activate: rebuild the live extension runner
+        // Keep the app's screen in sync if it's attached.
+        relay?.sendExtensions({ installed: ext.listInstalled() });
+        return ctx.ui?.notify?.(`${verb === "add" ? "Added" : "Removed"} ${source}`, "info");
+      }
+      const installed = ext.listInstalled();
+      ctx.ui?.notify?.(
+        installed.length ? `Installed extensions:\n${installed.map((e) => `  ${e.source}`).join("\n")}` : "No extensions installed. Add them from the Privateer app or /extensions add <npm:pkg>.",
+        "info",
+      );
+    },
+  });
+
   pi.registerCommand?.("remote-access", {
     description: "Drive this terminal from the Privateer app: /remote-access on | off",
     handler: async (args: string, ctx: any) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.3.6",
+  "version": "0.4.0",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -43,6 +43,7 @@
   "scripts": {
     "start": "tsx src/main.ts",
     "chat": "node --env-file=.env --import tsx src/cli/chat.ts",
+    "channels": "node --env-file=.env --import tsx src/channels/run.ts",
     "dev": "tsx watch src/main.ts",
     "typecheck": "tsc --noEmit",
     "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
@@ -62,11 +63,13 @@
     "pi-mcp-adapter": "^2.11.0",
     "pi-privacy": "^0.3.0",
     "pi-subagents": "^0.34.0",
+    "privateer-workflow": "^0.1.0",
     "picomatch": "^4.0.4",
     "tsx": "^4.16.0",
     "typebox": "^1.3.4",
     "undici": "^7.28.0",
     "ws": "^8.21.0",
+    "yaml": "^2.5.0",
     "zod": "^4.0.16"
   },
   "devDependencies": {