privateer-agent 0.3.6 → 0.4.0

package/src/cli/chat.ts

@@ -8,6 +8,7 @@
 //        e.g. tinfoil/llama3-3-70b to watch TEE posture go green.
 
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
+import { fileURLToPath } from "node:url"; // builtin, safe pre-boot
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 
 const RESET = "\x1b[0m", DIM = "\x1b[2m", CYAN = "\x1b[36m", YELLOW = "\x1b[33m", RED = "\x1b[31m", GREEN = "\x1b[32m";
@@ -20,11 +21,15 @@ async function main() {
     SessionManager,
   } = await import("@earendil-works/pi-coding-agent");
   const { createEngineEventAdapter } = await import("../bridge/engineAdapter.ts");
-  const { makePermissionGate } = await import("../ext/permissionGate.ts");
+  const { makePermissionGate, isRemoteUnsafeTool } = await import("../ext/permissionGate.ts");
   const { makePiPrivacyExtension, verifyModelPosture, TIERS } = await import("pi-privacy");
   const { agentDir } = await import("../config/paths.ts");
   const { RemoteBridge } = await import("../remote/remoteBridge.ts");
+  const { startParentApprovalRelay } = await import("../remote/subagentRelay.ts");
   const { RelayClient } = await import("../remote/relayClient.ts");
+  const { makeExtensionsControl } = await import("../remote/extensionsControl.ts");
+  const { makeSkillsControl } = await import("../remote/skillsControl.ts");
+  const { authorizeControl } = await import("../remote/controlAuth.ts");
   const priv = await import("../auth/privateer.ts");
   const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
@@ -34,20 +39,63 @@ async function main() {
   const provider = spec.slice(0, slash);
   const modelId = spec.slice(slash + 1);
   const cwd = process.cwd();
+  // Point pi-subagents at our moat-injecting wrapper (unless overridden). This REPL
+  // loads the gate/privacy/account as in-code factories, which a subagent child can't
+  // inherit; the wrapper injects them explicitly (‑e) with discovery off, so children
+  // run gated + private with no parent double-load. Also fixes the plain ENOENT: `pi`
+  // isn't on PATH, so without this every subagent spawn would fail. See bin/privateer-
+  // subagent.mjs. Absolute path, resolved relative to this module (src/cli/chat.ts).
+  process.env.PI_SUBAGENT_PI_BINARY ??= fileURLToPath(new URL("../../bin/privateer-subagent.mjs", import.meta.url));
+  // The live model spec ("provider/id"). Starts at the launch model and follows
+  // /model switches, so the app banner + picker reflect what's actually selected.
+  let currentSpec = spec;
 
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   let closed = false;
   rl.on("close", () => (closed = true));
+  // Local terminal output is coalesced and prompt-aware. Two stutter sources it kills:
+  //  1. Streaming a turn emits one delta per token; thousands of tiny stdout writes
+  //     visibly stutter a TTY when a turn makes a lot of changes. We batch each burst
+  //     into ~one write per frame (16 ms) instead.
+  //  2. A mid-turn prompt (approval / input) awaits the user via rl.question. Output
+  //     that streams in while it's pending prints INTO the question line, and readline
+  //     redraws that line on every keystroke — the "action required" flicker. While a
+  //     mid-turn prompt is pending we HOLD streamed output and flush it once they
+  //     answer, so the question line stays clean.
+  // Only the local path is batched; the relay path (bridge.forwardEvent) already does
+  // its own coalescing (TEXT_FLUSH_MS) and is untouched.
+  let outBuf = "";
+  let outTimer: ReturnType<typeof setTimeout> | undefined;
+  let holdDepth = 0; // >0 while a mid-turn prompt is awaiting the user
+  const flushOut = (): void => {
+    if (outTimer) { clearTimeout(outTimer); outTimer = undefined; }
+    if (outBuf) { process.stdout.write(outBuf); outBuf = ""; }
+  };
+  const out = (s: string): void => {
+    outBuf += s;
+    if (holdDepth > 0) return; // held until the prompt resolves
+    if (!outTimer) outTimer = setTimeout(flushOut, 16);
+  };
+
   // Resolve to /quit if the input stream ends (EOF / Ctrl-D / piped input), incl.
   // if it closes while a question is pending, so we never throw USE_AFTER_CLOSE.
   const ask = (q: string): Promise<string> =>
     new Promise((res) => {
       if (closed) return res("/quit");
-      const onClose = () => res("/quit");
+      flushOut(); // land buffered output ABOVE the prompt line
+      // Hold streamed output only for a MID-TURN prompt. The idle top-level `›` must
+      // still show a remote-driven turn streaming live, so don't hold when idle.
+      const hold = turnActive;
+      if (hold) holdDepth++;
+      const settle = (v: string): void => {
+        if (hold && holdDepth > 0 && --holdDepth === 0) flushOut();
+        res(v);
+      };
+      const onClose = () => settle("/quit");
       rl.once("close", onClose);
       rl.question(q, (a) => {
         rl.off("close", onClose);
-        res(a);
+        settle(a);
       });
     });
 
@@ -56,6 +104,10 @@ async function main() {
   let session: any = null;
   let relay: any = null;
   let turnActive = false;
+  // Pi-extension manager for the app's extensions screen (built after services below).
+  let extensions: ReturnType<typeof makeExtensionsControl> | null = null;
+  // Skills manager for the app's skills screen (built after services below).
+  let skills: ReturnType<typeof makeSkillsControl> | null = null;
 
   // The relay bridge: wires the app (when /remote-access is on) to the same gate +
   // turn loop. Its gate hooks (getRemote/remoteAsk) are handed to the gate below,
@@ -63,24 +115,139 @@ async function main() {
   const bridge = new RemoteBridge({
     onPrompt: (text) => void runTurn(text, true),
     onInterrupt: () => void session?.abort?.(),
-    // On (re)attach, resync the transcript AND push live context (model +
-    // version) so the app's session banner shows what this terminal is really
-    // running. NON-PII: no cwd — see RelayClient.sendContext.
+    // The account signed this terminal out from the app (session revoked). Drop the
+    // relay and wipe the local machine login so we don't keep reconnecting with a dead
+    // token; the user re-runs /login to sign back in.
+    onRevoked: () => {
+      try { relay?.stop(); } catch { /* already stopped */ }
+      relay = null;
+      priv.handleServerRevoke();
+      console.log(`\n${YELLOW}⟿ Signed out — this terminal's Privateer session was revoked from the app. Run /login to sign back in.${RESET}`);
+    },
+    // A slash command typed in the app composer (e.g. /model) — echo it (like the
+    // prompt echo), then run it through the same dispatcher the local REPL uses.
+    // Anything the dispatcher doesn't recognize falls through to the turn loop, so
+    // Pi/extension/skill commands (which session.prompt executes) work remotely too.
+    onCommand: (text) => {
+      console.log(`\n${DIM}⟿ [app] ${text}${RESET}`);
+      void (async () => { if (!(await runCommand(text, true))) await runTurn(text, true, false); })();
+    },
+    // On (re)attach, resync the transcript, push live context (model + version) so
+    // the app's banner shows what this terminal runs, AND advertise the available
+    // commands so the composer can autocomplete them (incl. extension commands). The
+    // model catalog isn't pushed — /model relays it on demand as a selection prompt.
+    // NON-PII: no cwd — see RelayClient.sendContext.
     onControllerAttached: () => {
       relay?.sendSnapshot([]);
-      relay?.sendContext({ model: spec, version: agentVersion() });
+      relay?.sendContext({ model: currentSpec, version: agentVersion() });
+      relay?.sendCommands(availableCommands());
     },
     onStatus: (t) => console.log(`\n${DIM}⟿ ${t}${RESET}`),
+    // The app's extensions manager: list the user's installed Pi extensions, or
+    // add/remove one. add/remove persist immediately but only load on the next
+    // terminal launch — so the final frame flags needsRestart. See runExtMutation.
+    onExtensionsList: () => relay?.sendExtensions({ installed: extensions?.listInstalled() ?? [] }),
+    onExtensionsAdd: (source, sig, ts) => void runExtMutation("add", source, sig, ts),
+    onExtensionsRemove: (source, sig, ts) => void runExtMutation("remove", source, sig, ts),
+    // The app's skills manager: list the terminal's skills, or create/delete/toggle
+    // a user one. A create/delete/toggle only reaches the model's <available_skills>
+    // on the next launch (needsRestart); Run-now goes through the command frame as
+    // /skill:name, which Pi expands immediately. See runSkillMutation.
+    onSkillsList: () => relay?.sendSkills({ items: skills?.listSkills() ?? [] }),
+    onSkillCreate: (skill, sig, ts) =>
+      void runSkillMutation("skills_create", { name: skill.name, description: skill.description, instructions: skill.instructions }, () => skills!.createSkill(skill), "Saved", sig, ts),
+    onSkillDelete: (name, sig, ts) => void runSkillMutation("skills_delete", { name }, () => skills!.deleteSkill(name), "Deleted", sig, ts),
+    onSkillSetEnabled: (name, enabled, sig, ts) =>
+      void runSkillMutation("skills_set_enabled", { name, enabled }, () => skills!.setEnabled(name, enabled), enabled ? "Enabled" : "Disabled", sig, ts),
   });
 
+  // Watch the subagent approval channel: a subagent child's gated action (dangerous
+  // shell / out-of-scope / destructive — the ones decideAuto forces to "ask") forwards
+  // here and relays to the app over this session's bridge. The bridge fails closed while
+  // no controller is attached, so an undriven terminal denies rather than auto-approves.
+  startParentApprovalRelay(bridge, { onError: () => { /* best-effort; a poll error must not crash a turn */ } });
+
+  // Verify an account-signed mutating control frame (H2) for this interactive terminal
+  // before it acts — a forged extensions_add installs code, a forged skills_create
+  // injects an auto-invoked skill. Binds this terminal's own relay id. Fail-closed: a
+  // missing relay or an unsigned/forged/stale frame refuses the mutation.
+  function guardInteractive(
+    action: string,
+    args: Record<string, unknown>,
+    sig?: string,
+    ts?: number,
+  ): { ok: boolean; message?: string } {
+    const termId = relay?.id as string | undefined;
+    if (!termId) return { ok: false, message: "Remote access isn't active on this terminal." };
+    return authorizeControl(termId, action, args, sig, ts);
+  }
+
+  // Run a skills create/delete/toggle for the app and relay the fresh list + result.
+  // The final frame flags needsRestart on success so the app tells the user the
+  // change reaches the model on relaunch (Run-now works without a restart).
+  async function runSkillMutation(
+    action: string,
+    args: Record<string, unknown>,
+    op: () => Promise<{ ok: boolean; message?: string }>,
+    verb: string,
+    sig?: string,
+    ts?: number,
+  ): Promise<void> {
+    if (!skills) return;
+    const auth = guardInteractive(action, args, sig, ts);
+    if (!auth.ok) {
+      relay?.sendSkills({ items: skills.listSkills(), message: auth.message });
+      return;
+    }
+    const res = await op();
+    relay?.sendSkills({
+      items: skills.listSkills(),
+      message: res.ok ? `${verb} — restart the terminal to update the model's skill list.` : res.message,
+      needsRestart: res.ok,
+    });
+  }
+
+  // Run an extensions add/remove for the app and relay progress → result. Progress
+  // events (npm install / git clone steps) push busy frames; the final frame carries
+  // the fresh list plus needsRestart so the app tells the user to relaunch to activate.
+  async function runExtMutation(kind: "add" | "remove", source: string, sig?: string, ts?: number): Promise<void> {
+    if (!extensions) return;
+    const auth = guardInteractive(kind === "add" ? "extensions_add" : "extensions_remove", { source }, sig, ts);
+    if (!auth.ok) {
+      relay?.sendExtensions({ installed: extensions.listInstalled(), message: auth.message });
+      return;
+    }
+    extensions.setProgress((ev) =>
+      relay?.sendExtensions({
+        installed: extensions!.listInstalled(),
+        busy: ev.type !== "complete" && ev.type !== "error",
+        message: ev.message,
+      }),
+    );
+    try {
+      const res = kind === "add" ? await extensions.add(source) : await extensions.remove(source);
+      relay?.sendExtensions({
+        installed: extensions.listInstalled(),
+        message: res.ok
+          ? `${kind === "add" ? "Added" : "Removed"} ${source} — restart the terminal to activate.`
+          : res.message,
+        needsRestart: res.ok,
+      });
+    } finally {
+      extensions.setProgress(undefined);
+    }
+  }
+
   // Serialize turns so a remote prompt and a locally-typed one can't overlap.
-  async function runTurn(text: string, remote: boolean): Promise<void> {
+  // `echo` prints the "⟿ [app] …" line; the caller suppresses it when it already
+  // echoed (a fall-through command from onCommand).
+  async function runTurn(text: string, remote: boolean, echo = true): Promise<void> {
     if (turnActive) {
       console.log(`\n${DIM}(busy — a turn is already running)${RESET}`);
       return;
     }
     turnActive = true;
-    if (remote) console.log(`\n${DIM}⟿ [app] ${text.slice(0, 80)}${RESET}`);
+    if (remote && echo) console.log(`\n${DIM}⟿ [app] ${text.slice(0, 80)}${RESET}`);
     try {
       await session.prompt(text);
     } catch (e) {
@@ -106,6 +273,16 @@ async function main() {
     getRemote: bridge.getRemote,
     getNoQuarter: bridge.getNoQuarter,
     remoteAsk: bridge.remoteAsk,
+    // Subagents (and their child-only intercom tools) can't be driven from the app
+    // yet — pi-subagents runs each in a child session whose gate/UI bypass the relay,
+    // so its prompts surface on THIS terminal, invisible to the driver. Block them on
+    // a driven turn (fail-closed) and post a notice so the app shows why it stopped.
+    blockedWhenRemote: isRemoteUnsafeTool,
+    onRemoteBlocked: (toolName) => {
+      const msg = `${toolName} is disabled while driving remotely — its prompts can't reach the app.`;
+      console.log(`\n${DIM}⛔ ${msg}${RESET}`);
+      bridge.sendNotice(msg);
+    },
   };
 
   console.log(`${DIM}privateer-agent — lean REPL. Loading ${provider}/${modelId}…${RESET}`);
@@ -120,6 +297,15 @@ async function main() {
   });
   for (const d of services.diagnostics) if (d.type === "error") console.log(`${RED}! ${d.message}${RESET}`);
 
+  // Pi-extension management for the app's extensions screen. Reuse the session's own
+  // SettingsManager so the list reflects exactly what Pi loaded (and add/remove write
+  // the same settings.json). The Privateer moat is excluded — it's shim files, not
+  // configured "packages" (see extensionsControl).
+  extensions = makeExtensionsControl({ cwd, agentDir: agentDir(), settingsManager: services.settingsManager });
+  // Skills manager for the app's skills screen. Same SettingsManager so configured
+  // skill paths + the user's <agentDir>/skills are both discovered.
+  skills = makeSkillsControl({ cwd, agentDir: agentDir(), settingsManager: services.settingsManager });
+
   // Exit cleanup: revoke the server-side sessions THIS run created (the child API
   // session AND the account inference session) so the terminal drops off the app's
   // Linked Devices list the instant it closes — instead of lingering ~24h until its
@@ -164,19 +350,78 @@ async function main() {
     model,
   } as any));
 
+  // Dialog UI for extensions/skills that ask the user to CHOOSE mid-turn (Pi's
+  // ctx.ui.select/confirm/input). Without a bound uiContext Pi hands extensions a
+  // no-op UI, so those prompts silently resolve to "cancelled" — the agent could
+  // never ask a question. A remote-driven turn relays the choice to the app as the
+  // same `select_request` the /model picker uses (→ the app's SelectionSheet, then
+  // a `select_response` back); a local turn falls back to the terminal. This is a
+  // separate channel from the permission gate (which relays as `approval_request`
+  // → the app's global approval modal). Binding it also flips ctx.hasUI true, which
+  // is correct: this REPL is interactive. The abort signal Pi passes (to dismiss a
+  // dialog on interrupt) is threaded through so a cancelled turn doesn't wedge.
+  const driven = (): boolean => bridge.getRemote() && bridge.isConnected();
+  const uiContext = {
+    // Pick one of `options`. Returns the chosen string, or undefined if cancelled.
+    async select(title: string, options: string[], opts?: { signal?: AbortSignal }): Promise<string | undefined> {
+      if (!options.length) return undefined;
+      if (driven()) {
+        const choice = await bridge.selectRemote(
+          { title, options: options.map((o) => ({ value: o, label: o })) },
+          opts?.signal,
+        );
+        return choice ?? undefined;
+      }
+      flushOut(); // drain buffered stream output before the option list prints
+      console.log(`\n${YELLOW}${title}${RESET}`);
+      options.forEach((o, i) => console.log(`  ${DIM}${i + 1}.${RESET} ${o}`));
+      const n = Number((await ask(`Choose [1-${options.length}]: `)).trim());
+      return Number.isInteger(n) && n >= 1 && n <= options.length ? options[n - 1] : undefined;
+    },
+    // Yes/No. Remotely a two-option selection (the app has no dedicated confirm UI).
+    async confirm(title: string, message: string, opts?: { signal?: AbortSignal }): Promise<boolean> {
+      if (driven()) {
+        const choice = await bridge.selectRemote(
+          { title: title || message, options: [{ value: "yes", label: "Yes" }, { value: "no", label: "No" }] },
+          opts?.signal,
+        );
+        return choice === "yes";
+      }
+      const a = (await ask(`\n${YELLOW}${title}${message ? ` — ${message}` : ""}${RESET} [y/N] `)).trim().toLowerCase();
+      return a === "y" || a === "yes";
+    },
+    // Free-form text. A remote turn relays a text-input prompt to the app (its
+    // own input sheet); a local turn reads the line over the terminal.
+    async input(title: string, placeholder?: string, opts?: { signal?: AbortSignal }): Promise<string | undefined> {
+      if (driven()) {
+        const value = await bridge.inputRemote({ title, placeholder }, opts?.signal);
+        return value ?? undefined;
+      }
+      const a = await ask(`\n${YELLOW}${title}${placeholder ? ` (${placeholder})` : ""}: ${RESET}`);
+      return a === "/quit" ? undefined : a;
+    },
+    // A one-line status message: printed locally and surfaced in the app's feed.
+    notify(message: string, type?: "info" | "warning" | "error"): void {
+      const color = type === "error" ? RED : type === "warning" ? YELLOW : DIM;
+      console.log(`${color}${message}${RESET}`);
+      if (driven()) bridge.sendNotice(message);
+    },
+  };
+  await (session as any).bindExtensions({ uiContext });
+
   // Stream the turn as EngineEvents — printed locally AND forwarded to the app
   // (the relay only sends when a controller is attached, so this is safe always).
   const adapter = createEngineEventAdapter();
   session.subscribe((ev: any) => {
     for (const ee of adapter.toEngineEvents(ev)) {
       bridge.forwardEvent(ee);
-      if (ee.type === "text") process.stdout.write(ee.text);
-      else if (ee.type === "reasoning") process.stdout.write(`${DIM}${ee.text}${RESET}`);
-      else if (ee.type === "tool-call") process.stdout.write(`\n${CYAN}⏺ ${ee.name}${RESET} ${DIM}${JSON.stringify(ee.input).slice(0, 120)}${RESET}\n`);
-      else if (ee.type === "tool-result") process.stdout.write(`${DIM}  ↳ ${String(ee.output).slice(0, 200)}${RESET}\n`);
-      else if (ee.type === "tool-error") process.stdout.write(`\n${RED}✗ ${ee.name}: ${ee.error}${RESET}\n`);
-      else if (ee.type === "error") process.stdout.write(`\n${RED}error: ${ee.error}${RESET}\n`);
-      else if (ee.type === "finish") process.stdout.write("\n");
+      if (ee.type === "text") out(ee.text);
+      else if (ee.type === "reasoning") out(`${DIM}${ee.text}${RESET}`);
+      else if (ee.type === "tool-call") out(`\n${CYAN}⏺ ${ee.name}${RESET} ${DIM}${JSON.stringify(ee.input).slice(0, 120)}${RESET}\n`);
+      else if (ee.type === "tool-result") out(`${DIM}  ↳ ${String(ee.output).slice(0, 200)}${RESET}\n`);
+      else if (ee.type === "tool-error") out(`\n${RED}✗ ${ee.name}: ${ee.error}${RESET}\n`);
+      else if (ee.type === "error") out(`\n${RED}error: ${ee.error}${RESET}\n`);
+      else if (ee.type === "finish") { out("\n"); flushOut(); }
     }
   });
 
@@ -235,27 +480,141 @@ async function main() {
       : `${DIM}Not signed in. /login to enable remote access & the account provider.${RESET}`,
   );
 
-  const HELP = "Commands: /remote-access <on|off>  /login  /models [filter]  /verify  /mode <…>  /quit";
+  const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /quit";
   console.log(`${DIM}Ready. Type a prompt. ${HELP}${RESET}`);
   await showPosture();
 
+  // The available model catalog as sorted "provider/id" specs. Same source the
+  // /models list and the app's picker draw from.
+  async function availableModelSpecs(): Promise<string[]> {
+    const all: any[] = (services.modelRegistry as any).getAvailable ? await (services.modelRegistry as any).getAvailable() : [];
+    return all.map((m) => `${m.provider}/${m.id}`).sort();
+  }
+
+  // Switch the live session's model in place (history preserved — see
+  // AgentSession.setModel). Re-pushes context so the app's banner follows the
+  // change; feedback goes to the console AND (when driven) the app.
+  async function switchModel(specArg: string, remote: boolean): Promise<void> {
+    const sp = specArg.trim();
+    const at = sp.indexOf("/");
+    if (at < 0) { const m = "Usage: /model provider/id"; console.log(`${RED}${m}${RESET}`); if (remote) relay?.sendNotice(m); return; }
+    const p = sp.slice(0, at), id = sp.slice(at + 1);
+    const model = (session.modelRegistry as any).find?.(p, id) ?? (services.modelRegistry as any).find?.(p, id);
+    if (!model) { const m = `Model ${sp} not found — try /models.`; console.log(`${RED}${m}${RESET}`); if (remote) relay?.sendNotice(m); return; }
+    try {
+      await session.setModel(model);
+      currentSpec = sp;
+      const m = `model → ${sp}`;
+      console.log(`${DIM}${m}${RESET}`);
+      relay?.sendContext({ model: currentSpec, version: agentVersion() }); // banner follows the switch
+      if (remote) relay?.sendNotice(m);
+    } catch (e) {
+      const m = `Couldn't switch model: ${(e as Error).message}`;
+      console.log(`${RED}${m}${RESET}`);
+      if (remote) relay?.sendNotice(m);
+    }
+  }
+
+  // The terminal-driven model picker: relay THIS machine's real catalog to the app
+  // as a selection prompt and switch to whatever the driver picks. This is the
+  // remote /model flow — the terminal owns the options, the app just renders them.
+  async function pickModelRemote(filter: string): Promise<void> {
+    const specs = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+    const choice = await bridge.selectRemote({
+      title: "Choose a model",
+      options: specs.map((sp) => ({ value: sp, label: sp })),
+      current: currentSpec,
+    });
+    if (choice) await switchModel(choice, true);
+  }
+
+  // Shared slash-command dispatcher for the local REPL and app-sent commands (the
+  // relay `command` frame). Returns true when `line` was a recognized command, so
+  // the REPL knows not to fall through and treat it as a prompt. `remote` commands
+  // are driven from the app: they never touch local stdin and mirror feedback back
+  // over the relay.
+  async function runCommand(line: string, remote: boolean): Promise<boolean> {
+    if (line === "/help" || line === "?") { console.log(`${DIM}${HELP}${RESET}`); if (remote) relay?.sendNotice(HELP); return true; }
+    if (line === "/verify") { await showPosture(); return true; }
+    // Enabling remote access is a physical-terminal action; ignore it if the app
+    // (already remote) asks. Disabling remotely is the /remote-access off path,
+    // which has its own terminate frame, so we don't handle it here for remote.
+    if (line === "/remote-access" || line === "/remote-access on" || line === "/remote") { if (!remote) await remoteAccess(true); return true; }
+    if (line === "/remote-access off") { if (!remote) await remoteAccess(false); return true; }
+    if (line === "/login") { if (!remote) await login(); return true; }
+    if (line.startsWith("/model ")) { await switchModel(line.slice(7), remote); return true; }
+    // Bare /model (or /models [filter]) → the picker. Remote: relay the catalog as
+    // a selection prompt the app renders; local: just print the list.
+    if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
+      const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
+      if (remote) { await pickModelRemote(filter); return true; }
+      const rows = (await availableModelSpecs()).filter((sp) => !filter || sp.toLowerCase().includes(filter));
+      console.log(rows.slice(0, 40).join("\n") + (rows.length > 40 ? `\n${DIM}… ${rows.length - 40} more (try /models <filter>)${RESET}` : ""));
+      return true;
+    }
+    // Extensions: remote drives the app's manager (list frame); local prints the list.
+    if (line === "/extensions" || line === "/ext") {
+      const installed = extensions?.listInstalled() ?? [];
+      if (remote) { relay?.sendExtensions({ installed }); return true; }
+      console.log(installed.length ? installed.map((e) => `  ${e.source}${e.installed ? "" : ` ${DIM}(not installed)${RESET}`}`).join("\n") : `${DIM}No extensions installed. Add them from the Privateer app.${RESET}`);
+      return true;
+    }
+    // Skills: remote drives the app's manager (list frame); local prints the list.
+    // Note `/skill:name` (invoke) is NOT handled here — it falls through to Pi.
+    if (line === "/skills") {
+      const items = skills?.listSkills() ?? [];
+      if (remote) { relay?.sendSkills({ items }); return true; }
+      console.log(items.length ? items.map((s) => `  ${s.name}${s.disabled ? ` ${DIM}(disabled)${RESET}` : ""}${s.editable ? "" : ` ${DIM}(read-only)${RESET}`} — ${s.description}`).join("\n") : `${DIM}No skills yet. Create them from the Privateer app.${RESET}`);
+      return true;
+    }
+    if (line.startsWith("/mode ")) { mode = line.slice(6).trim() as typeof mode; const m = `mode → ${mode}`; console.log(`${DIM}${m}${RESET}`); if (remote) relay?.sendNotice(m); return true; }
+    // Bare /mode → the picker (remote) or a hint (local).
+    if (line === "/mode") {
+      if (remote) {
+        const choice = await bridge.selectRemote({
+          title: "Permission mode",
+          options: ["default", "acceptEdits", "plan", "bypass"].map((v) => ({ value: v, label: v })),
+          current: mode,
+        });
+        if (choice) { mode = choice as typeof mode; relay?.sendNotice(`mode → ${mode}`); }
+      } else {
+        console.log(`${DIM}modes: default · acceptEdits · plan · bypass (current: ${mode})${RESET}`);
+      }
+      return true;
+    }
+    // Not one of THIS CLI's built-ins → not handled here. Both the local REPL and
+    // the remote onCommand fall through to the turn loop, where Pi executes any
+    // extension/skill command (or treats it as a prompt).
+    return false;
+  }
+
+  // The commands the app should offer in its composer: this CLI's built-ins plus
+  // whatever Pi extensions have registered (so the palette reflects the real,
+  // extension-dependent command set — not a hardcoded list). Pushed on attach.
+  function availableCommands(): { name: string; description?: string }[] {
+    const builtins = [
+      { name: "/model", description: "Switch the model" },
+      { name: "/mode", description: "Change the approval mode (default/acceptEdits/plan/bypass)" },
+      { name: "/models", description: "List available models" },
+      { name: "/extensions", description: "Manage installed Pi extensions" },
+      { name: "/skills", description: "Manage the terminal's skills" },
+      { name: "/verify", description: "Re-check the model's privacy posture" },
+      { name: "/help", description: "Show available commands" },
+    ];
+    let ext: { name: string; description?: string }[] = [];
+    try {
+      const reg = (session?.extensionRunner as any)?.getRegisteredCommands?.() ?? [];
+      ext = reg.map((c: any) => ({ name: `/${c.invocationName ?? c.name}`, description: c.description }));
+    } catch { /* no session/extensions yet */ }
+    const seen = new Set(builtins.map((c) => c.name));
+    return [...builtins, ...ext.filter((c) => !seen.has(c.name))];
+  }
+
   for (;;) {
     const line = (await ask(`\n${CYAN}›${RESET} `)).trim();
     if (line === "/quit" || line === "/exit") break;
-    if (line === "/verify") { await showPosture(); continue; }
-    if (line === "/remote-access" || line === "/remote-access on" || line === "/remote") { await remoteAccess(true); continue; }
-    if (line === "/remote-access off") { await remoteAccess(false); continue; }
-    if (line === "/login") { await login(); continue; }
-    if (line === "/help" || line === "?") { console.log(`${DIM}${HELP}${RESET}`); continue; }
-    if (line.startsWith("/models")) {
-      const filter = line.slice(7).trim().toLowerCase();
-      const all: any[] = (services.modelRegistry as any).getAvailable ? await (services.modelRegistry as any).getAvailable() : [];
-      const rows = all.map((m) => `${m.provider}/${m.id}`).filter((s) => !filter || s.toLowerCase().includes(filter)).sort();
-      console.log(rows.slice(0, 40).join("\n") + (rows.length > 40 ? `\n${DIM}… ${rows.length - 40} more (try /models <filter>)${RESET}` : ""));
-      continue;
-    }
-    if (line.startsWith("/mode ")) { mode = line.slice(6).trim() as typeof mode; console.log(`${DIM}mode → ${mode}${RESET}`); continue; }
     if (!line) continue;
+    if ((line.startsWith("/") || line === "?") && (await runCommand(line, false))) continue;
     await runTurn(line, false);
   }
   await cleanup();

package/src/cli/daemonCli.ts

@@ -0,0 +1,67 @@
+// `privateer daemon [run|install|uninstall|status]` dispatcher.
+//
+// ORDERING CONTRACT: import ./boot.ts FIRST (env pin + attestation dispatcher), then
+// DYNAMICALLY import the daemon (which pulls the Pi session stack) only when we
+// actually run it — so boot's side effects are guaranteed to precede any Pi import.
+// The service/status subcommands touch no Pi code, so they can run without paying the
+// session-stack import cost.
+import "../boot.ts";
+
+function usage(): string {
+  return [
+    "Usage: privateer daemon [command]",
+    "",
+    "  run          Run the daemon in the foreground (default).",
+    "  install      Install it as a login service so it auto-starts and stays",
+    "               reachable from the app even with no terminal open.",
+    "  uninstall    Remove the login service.",
+    "  status       Show whether the service is installed and the daemon is live.",
+  ].join("\n");
+}
+
+export async function runDaemonCli(argv: string[]): Promise<void> {
+  const sub = argv[0] ?? "run";
+  switch (sub) {
+    case "run": {
+      // Pi-touching — dynamic import AFTER boot.
+      const { runDaemon } = await import("../daemon/index.ts");
+      runDaemon(); // installs its own SIGINT/SIGTERM handlers and blocks
+      return;
+    }
+    case "install": {
+      const { installService } = await import("../daemon/service.ts");
+      try {
+        const info = installService();
+        process.stdout.write(`Privateer daemon installed as a login service.\n  unit: ${info.unitPath}\n  logs: ${info.logPath}\nIt will start now and on every login. Manage with \`privateer daemon status|uninstall\`.\n`);
+      } catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+      }
+      return;
+    }
+    case "uninstall": {
+      const { uninstallService } = await import("../daemon/service.ts");
+      try {
+        uninstallService();
+        process.stdout.write("Privateer daemon login service removed.\n");
+      } catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+      }
+      return;
+    }
+    case "status": {
+      const { statusReport } = await import("../daemon/service.ts");
+      process.stdout.write((await statusReport()) + "\n");
+      return;
+    }
+    case "-h":
+    case "--help":
+    case "help":
+      process.stdout.write(usage() + "\n");
+      return;
+    default:
+      process.stderr.write(`Unknown daemon command: ${sub}\n\n${usage()}\n`);
+      process.exit(1);
+  }
+}