privateer-agent 0.4.0 → 0.4.1

package/extensions/privateer-brand.ts

@@ -139,7 +139,7 @@ function shortCwd(): string {
 //  - signed in                              → "connected as <account>"
 //  - signed out AND the current model bills to a Privateer account → it can't run
 //    until they sign in, so say so plainly (warning)
-//  - signed out on their own key            → a quiet tease that /signin adds more
+//  - signed out on their own key            → a quiet tease that /login adds more
 function accountLine(modelProvider?: string): string {
   const u = priv.currentUser();
   if (u) {
@@ -147,9 +147,9 @@ function accountLine(modelProvider?: string): string {
     return `${GREEN}connected${DIM} as ${RESET}${OCEAN_LIGHT}${label}${RESET}`;
   }
   if (modelProvider === "privateer") {
-    return `${YELLOW}not signed in · /signin to use this model${RESET}`;
+    return `${YELLOW}not signed in · /login to use this model${RESET}`;
   }
-  return `${DIM}not signed in · ${OCEAN_LIGHT}/signin${DIM} to connect your account${RESET}`;
+  return `${DIM}not signed in · ${OCEAN_LIGHT}/login${DIM} to connect your account${RESET}`;
 }
 
 // Is dotted version `a` newer than `b`? Plain numeric compare of major.minor.patch —
@@ -430,7 +430,7 @@ export default function privateerBrand(pi: any): void {
     ctx?.ui?.setTitle?.("Privateer");
     refresh(ctx);
     // No startup notify here: the banner's account line already surfaces the
-    // "not signed in · /signin" prompt, so a second line would just be noise.
+    // "not signed in · /login" prompt, so a second line would just be noise.
   });
 
   // Keep the header's account line in sync with the picked model (the "this model

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",

package/src/channels/run.ts

@@ -110,6 +110,7 @@ async function main() {
   type GateController = import("../ext/permissionGate.ts").GateController;
   const { makePiPrivacyExtension } = await import("pi-privacy");
   const { makeAccountProvider } = await import("../providers/account.ts");
+  const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
   const { MessagingBridge } = await import("./bridge.ts");
@@ -130,7 +131,7 @@ async function main() {
     process.exit(1);
   }
   const ch = cfg.channels ?? {};
-  const defaultModel: string = ch.model ?? cfg.defaultModel ?? "openrouter/openai/gpt-4o-mini";
+  const defaultModel: string = resolveDefaultModel({ explicit: ch.model ?? cfg.defaultModel });
   const defaultTools: string[] = Array.isArray(ch.tools) && ch.tools.length ? ch.tools : SAFE_TOOLS;
   const defaultPosture: Posture = normalizePosture(ch.posture) ?? "approve";
   const cwd: string = ch.cwd ?? process.cwd();

package/src/cli/chat.ts

@@ -4,7 +4,8 @@
 // the EngineEvent adapter, and Pi's real session.
 //
 // Run:  nvm use && node --env-file=.env --import tsx src/cli/chat.ts
-// Model: PRIVATEER_MODEL=provider/id  (default openrouter/openai/gpt-4o-mini)
+// Model: PRIVATEER_MODEL=provider/id  (else the account default when signed in, or a
+//        BYO-keyed provider — see providers/defaultModel.ts)
 //        e.g. tinfoil/llama3-3-70b to watch TEE posture go green.
 
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
@@ -33,8 +34,11 @@ async function main() {
   const priv = await import("../auth/privateer.ts");
   const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
+  const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
 
-  const spec = process.env.PRIVATEER_MODEL ?? "openrouter/openai/gpt-4o-mini";
+  // resolveDefaultModel() already honours PRIVATEER_MODEL first, then the account
+  // default when signed in, then a BYO key — one source of truth (defaultModel.ts).
+  const spec = resolveDefaultModel();
   const slash = spec.indexOf("/");
   const provider = spec.slice(0, slash);
   const modelId = spec.slice(slash + 1);

package/src/daemon/index.ts

@@ -15,6 +15,7 @@ import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { makePermissionGate, type GateController } from "../ext/permissionGate.ts";
 import { makePiPrivacyExtension } from "pi-privacy";
 import { makeAccountProvider } from "../providers/account.ts";
+import { resolveDefaultModel } from "../providers/defaultModel.ts";
 import { RelayClient, type TaskSpec } from "../remote/relayClient.ts";
 import { createLiveTaskSession, type LiveTaskHandle } from "../remote/liveTaskSession.ts";
 import { makeRoutinesControl } from "../remote/routinesControl.ts";
@@ -76,12 +77,14 @@ function loadDaemonConfig(): DaemonConfig {
   try {
     const raw = JSON.parse(readFileSync(configPath(), "utf8"));
     return {
-      defaultModel: typeof raw.defaultModel === "string" ? raw.defaultModel : "openrouter/openai/gpt-4o-mini",
+      // config.defaultModel is the explicit choice; absent it, resolve (account default
+      // when signed in, else BYO) rather than assuming a BYO OpenRouter key.
+      defaultModel: resolveDefaultModel({ explicit: typeof raw.defaultModel === "string" ? raw.defaultModel : undefined }),
       webhooks: raw.webhooks,
       providers: raw.providers,
     };
   } catch {
-    return { defaultModel: "openrouter/openai/gpt-4o-mini" };
+    return { defaultModel: resolveDefaultModel() };
   }
 }
 

package/src/providers/account.ts

@@ -20,6 +20,7 @@ import {
   notifySignedIn,
 } from "../auth/privateer.ts";
 import { interpretReport, teePosture, tierFromTeePosture, type PrivacyTier } from "pi-privacy";
+import { ACCOUNT_DEFAULT_MODEL_ID, ensurePiDefaultModel } from "./defaultModel.ts";
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
@@ -28,7 +29,7 @@ import { interpretReport, teePosture, tierFromTeePosture, type PrivacyTier } fro
 // confidential-compute (TEE, attestable) model — the strongest privacy tier. Also the
 // fallback list if the live listing can't be reached.
 const DEFAULT_MODELS = [
-  "near/zai-org/GLM-5.1-FP8",
+  ACCOUNT_DEFAULT_MODEL_ID,
   "anthropic/claude-sonnet-4.6",
   "openai/gpt-5.5",
   "deepseek/deepseek-v4-flash",
@@ -101,6 +102,11 @@ export const privateerOAuthProvider = {
     }
     if (cb.signal?.aborted) throw new Error("Login cancelled");
     const creds = await spawnAccountCredentials();
+    // Seed Pi's saved model default to the account channel, so the next launch resolves
+    // to a billable subscription model instead of falling through to a keyless built-in
+    // (the "No API key found for openrouter" trap). No-op if the user already has a
+    // chosen default. See providers/defaultModel.ts.
+    ensurePiDefaultModel();
     // The fresh path already fired notifySignedIn (pollForToken); fire here for the
     // already-linked path so the header re-renders to "connected" on this terminal too.
     if (wasLinked) notifySignedIn();

package/src/providers/defaultModel.ts

@@ -0,0 +1,119 @@
+// The single source of truth for "which model do we default to?" — shared by every
+// entry point that has to pick a model when the user hasn't named one: the REPL
+// (cli/chat.ts), the daemon (routines), the channels runner, and the login-time hook
+// that seeds Pi's TUI default (ensurePiDefaultModel).
+//
+// The bug this fixes: each of those sites used to hardcode `openrouter/openai/gpt-4o-
+// mini`, which assumes a BYO OpenRouter key. A user who is ONLY signed into their
+// Privateer subscription has no such key, so the runtime resolved to OpenRouter and
+// then failed at request time with "No API key found for openrouter". Being signed in
+// never nominated a model. resolveDefaultModel() makes the account channel the default
+// the moment credentials exist, and keeps the legacy BYO behaviour otherwise.
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { hasCredentials } from "../auth/privateer.ts";
+import { agentDir } from "../config/paths.ts";
+
+// The signed-in default: a NEAR confidential-compute (TEE, attestable) model — the
+// strongest privacy tier, and the same id the app shows first. Kept here as the one
+// definition; providers/account.ts imports it so its seed catalog can't drift.
+export const ACCOUNT_DEFAULT_MODEL_ID = "near/zai-org/GLM-5.1-FP8";
+export const ACCOUNT_DEFAULT_SPEC = `privateer/${ACCOUNT_DEFAULT_MODEL_ID}`;
+
+// Last-resort BYO default, preserved from the pre-resolver code so a user who set an
+// OpenRouter key (and isn't signed in) keeps the old behaviour. If they have no key
+// either, this still surfaces the familiar "No API key found for openrouter" — a clear
+// signal to run /login or set a key, which is better than an empty/undefined model.
+export const LEGACY_BYO_FALLBACK = "openrouter/openai/gpt-4o-mini";
+
+// BYO providers we can positively detect from the environment, in preference order.
+// Each model id matches Pi's own defaultModelPerProvider so it actually resolves once
+// the key is present. OpenRouter stays on the legacy cheap default for continuity.
+const BYO_BY_KEY: Array<{ env: string; spec: string }> = [
+  { env: "ANTHROPIC_API_KEY", spec: "anthropic/claude-opus-4-8" },
+  { env: "OPENAI_API_KEY", spec: "openai/gpt-5.5" },
+  { env: "OPENROUTER_API_KEY", spec: LEGACY_BYO_FALLBACK },
+];
+
+export interface ResolveDefaultModelOptions {
+  // An explicit, user-chosen spec (e.g. config.defaultModel, a channel's `model`).
+  // Wins over everything when non-empty — it's a deliberate choice, not a fallback.
+  explicit?: string | null;
+  // Override for testing / non-process callers. Defaults to process.env.
+  env?: NodeJS.ProcessEnv;
+  // Override the signed-in check (testing). Defaults to hasCredentials().
+  signedIn?: boolean;
+}
+
+// Resolve the model spec ("provider/id") to use when no model is named. Pure and
+// synchronous (only reads env + the credentials file), so it's safe to call from any
+// entry point at startup. Precedence:
+//   1. explicit user choice (config/channel)      — deliberate, always wins
+//   2. PRIVATEER_MODEL env                         — dev/global override
+//   3. signed into Privateer → the account default — the fix: subscription users
+//   4. a BYO provider whose key is present         — anthropic, openai, openrouter
+//   5. LEGACY_BYO_FALLBACK                          — familiar "add a key" signal
+export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): string {
+  const env = opts.env ?? process.env;
+
+  const explicit = opts.explicit?.trim();
+  if (explicit) return explicit;
+
+  const fromEnv = env.PRIVATEER_MODEL?.trim();
+  if (fromEnv) return fromEnv;
+
+  const signedIn = opts.signedIn ?? hasCredentials();
+  if (signedIn) return ACCOUNT_DEFAULT_SPEC;
+
+  for (const { env: keyName, spec } of BYO_BY_KEY) {
+    if (env[keyName]?.trim()) return spec;
+  }
+
+  return LEGACY_BYO_FALLBACK;
+}
+
+// Split a "provider/id" spec on its first slash (model ids themselves contain "/", so
+// only the first delimiter separates provider from model). Returns null for a spec
+// with no provider prefix.
+function splitSpec(spec: string): { provider: string; modelId: string } | null {
+  const slash = spec.indexOf("/");
+  if (slash <= 0 || slash === spec.length - 1) return null;
+  return { provider: spec.slice(0, slash), modelId: spec.slice(slash + 1) };
+}
+
+// The TUI consumer. Pi's own model resolution (findInitialModel) checks its saved
+// settings default BEFORE it falls through to a keyless built-in, but nothing ever
+// pointed that default at the account channel — Pi's provider-default table has no
+// `privateer` entry, so a signed-in-only user landed on OpenRouter and errored. On a
+// successful login we seed Pi's global settings.json (agentDir/settings.json — the
+// same file its SettingsManager reads) with the account default, so the NEXT launch
+// resolves cleanly.
+//
+// Guarded: we only write when the user has NOT already chosen a default (no
+// `defaultModel` key), so a deliberate /model choice is never stomped. Best-effort —
+// any read/parse/write failure is swallowed; a missing seed just means the user picks
+// a model once via /model. Returns the spec written, or null if we left it alone.
+export function ensurePiDefaultModel(spec: string = ACCOUNT_DEFAULT_SPEC): string | null {
+  const parts = splitSpec(spec);
+  if (!parts) return null;
+  const settingsPath = join(agentDir(), "settings.json");
+  try {
+    let settings: Record<string, unknown> = {};
+    if (existsSync(settingsPath)) {
+      const raw = readFileSync(settingsPath, "utf8").trim();
+      if (raw) settings = JSON.parse(raw) as Record<string, unknown>;
+    }
+    // Respect an existing choice — presence of the key means the user (or Pi) already
+    // has a default; don't override it.
+    if (typeof settings.defaultModel === "string" && settings.defaultModel.trim()) {
+      return null;
+    }
+    settings.defaultProvider = parts.provider;
+    settings.defaultModel = parts.modelId;
+    writeFileSync(settingsPath, `${JSON.stringify(settings, null, 2)}\n`);
+    return spec;
+  } catch {
+    return null;
+  }
+}