privateer-agent 0.4.1 → 0.5.1

package/bin/privateer-tui

@@ -58,7 +58,7 @@ mkdir -p "$EXT_DIR"
 # ABSOLUTE path so the target's own relative imports resolve from the repo (a plain
 # symlink would resolve them relative to the shim's location and break). We remove
 # any shim we previously managed first, so a dropped package can't linger and reload.
-MANAGED="privateer-brand privateer-context privateer-gate privateer-account privateer-posture privateer-tools privateer-privacy pi-privacy pi-web-access rpiv-web-tools pi-mcp-adapter pi-hypa pi-subagents"
+MANAGED="privateer-brand privateer-context privateer-gate privateer-account privateer-models privateer-posture privateer-tools privateer-privacy pi-privacy pi-web-access rpiv-web-tools pi-mcp-adapter pi-hypa pi-subagents"
 for name in $MANAGED; do rm -f "$EXT_DIR/$name.ts"; done
 shim() { printf 'export { default } from "%s";\n' "$2" > "$EXT_DIR/$1.ts"; }
 # Branding + the account sign-in surface (banner, ⚓ badge, /signin /signout).
@@ -67,6 +67,10 @@ shim privateer-brand   "$REPO/extensions/privateer-brand.ts"
 shim privateer-context "$REPO/extensions/privateer-context.ts"
 shim privateer-gate    "$REPO/extensions/privateer-gate.ts"
 shim privateer-account "$REPO/extensions/privateer-account.ts"
+# The /models picker — searchable model selector with per-row privacy shields
+# (TEE / ZDR / standard). Pi's built-in /model is redirected here by the
+# patch-package patch (patches/@earendil-works+pi-coding-agent+*.patch).
+shim privateer-models  "$REPO/extensions/privateer-models.ts"
 shim privateer-posture "$REPO/extensions/privateer-posture.ts"
 shim privateer-tools   "$REPO/extensions/privateer-tools.ts"
 # pi-privacy wrapped with the account-channel tier resolver (privateer/near… = TEE),

package/extensions/privateer-models.ts

@@ -0,0 +1,429 @@
+// The Privateer `/models` picker — a searchable model selector that puts the
+// PRIVACY POSTURE of every model on screen. Pi's built-in `/model` picker (which
+// this shadows via the redirect patch in patches/@earendil-works+pi-coding-agent)
+// shows only `id [provider]`; it has no hook for a privacy shield and can't be
+// overridden from an extension (its command name is a reserved builtin, dispatched
+// before extension commands). So we ship our OWN picker through `ctx.ui.custom`,
+// which renders a full pi-tui component: fuzzy search + a per-row shield (⛉ TEE /
+// ◈ ZDR / · standard) + tier grouping + a legend, ranked strongest-privacy-first.
+//
+// Honest-labeling contract (pi-privacy posture/tiers.ts): a TEE row is only a
+// *claim* (tee-unverified, yellow) until a live attestation confirms it
+// (tee-verified, green). The picker seeds each row with the server's baseline tier
+// (GET /api/models `privacy.tier`, via account.ts) and then attests the TEE-capable
+// rows in the background, upgrading the shield in place. ZDR-enforced rows are never
+// downgraded by attestation — we only attest rows that claim a TEE.
+
+import {
+  Container,
+  fuzzyFilter,
+  getKeybindings,
+  Input,
+  Spacer,
+  Text,
+} from "@earendil-works/pi-tui";
+import { TIERS, tierRank, type PrivacyTier } from "pi-privacy";
+import { verifyModelPosture } from "pi-privacy";
+import {
+  accountBaselineTier,
+  accountCatalogLoaded,
+  accountPosture,
+  fetchAccountCatalog,
+} from "../src/providers/account.ts";
+
+// A minimal view of Pi's theme (passed to the ui.custom factory) — enough to color
+// text without pulling Pi's internal theme types into an extension.
+interface ThemeLike {
+  fg(color: string, text: string): string;
+  bold(text: string): string;
+}
+
+// A pi-tui TUI handle (the first arg the ui.custom factory receives). We only use
+// requestRender; keep the surface tiny so this doesn't couple to Pi internals.
+interface TuiLike {
+  requestRender(): void;
+}
+
+interface ModelLike {
+  provider: string;
+  id: string;
+  name?: string;
+}
+
+interface Row {
+  provider: string;
+  id: string;
+  name: string;
+  model: ModelLike;
+  tier: PrivacyTier;
+  // true once a live attestation has resolved this row (so we don't re-attest).
+  attested?: boolean;
+}
+
+// posture bucket → theme color name (Pi's palette) for the shield glyph.
+const POSTURE_COLOR: Record<string, string> = {
+  green: "success",
+  yellow: "warning",
+  red: "error",
+  neutral: "muted",
+};
+
+// The shield/marker glyph per tier family. TEE → shield; ZDR → diamond; local →
+// house; standard → dot. Color comes from the tier's posture bucket, so verified
+// (green) and merely-claimed (yellow) read differently at a glance — the same
+// distinction the status-bar badge (privateer-posture.ts) draws.
+function glyphFor(tier: PrivacyTier): string {
+  if (tier === "tee-verified" || tier === "tee-unverified") return "⛉";
+  if (tier === "local") return "⌂";
+  if (tier === "zdr-enforced" || tier === "zdr-policy") return "◈";
+  return "·";
+}
+
+function shield(theme: ThemeLike, tier: PrivacyTier): string {
+  const info = TIERS[tier];
+  const color = POSTURE_COLOR[info.posture] ?? "muted";
+  return theme.fg(color, glyphFor(tier));
+}
+
+// Server/prefix baseline tier for a provider+model, before any live attestation.
+function baselineTier(provider: string, id: string): PrivacyTier {
+  if (provider === "privateer") {
+    return (
+      accountBaselineTier(id) ??
+      (id.startsWith("near/") || id.startsWith("tinfoil/") ? "tee-unverified" : "standard")
+    );
+  }
+  if (provider === "tinfoil" || provider === "nearai") return "tee-unverified";
+  if (provider === "ollama") return "local";
+  return "standard";
+}
+
+// A row claims a TEE and is therefore worth attesting live (to go green — or to
+// honestly drop to standard if the attestation fails). ZDR/standard rows are left
+// on their server baseline; attesting them would only ever weaken an honest label.
+function isTeeCandidate(row: Row): boolean {
+  if (row.tier !== "tee-verified" && row.tier !== "tee-unverified") return false;
+  if (row.provider === "privateer") return row.id.startsWith("near/") || row.id.startsWith("tinfoil/");
+  return row.provider === "tinfoil" || row.provider === "nearai";
+}
+
+// Run the live attestation for one TEE-candidate row. privateer/* goes through the
+// account server-proxy path (accountPosture); other providers use pi-privacy's
+// direct client attestation. Returns undefined on any failure (keep the baseline).
+async function attestRow(row: Row): Promise<PrivacyTier | undefined> {
+  try {
+    if (row.provider === "privateer") {
+      const res = await accountPosture(row.id);
+      return res.tier;
+    }
+    const apiKey =
+      row.provider === "nearai"
+        ? process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY
+        : undefined;
+    const res = await verifyModelPosture(row.provider, row.id, { apiKey });
+    return res.tier;
+  } catch {
+    return undefined;
+  }
+}
+
+// The search text a row is matched against — id, provider, name, and the tier label
+// so a user can type "tee" or "zdr" to filter by posture.
+function searchText(row: Row): string {
+  return `${row.provider} ${row.provider}/${row.id} ${row.id} ${row.name} ${TIERS[row.tier].label}`;
+}
+
+// Strongest-privacy-first, then provider, then id — so the safest options surface at
+// the top of an unfiltered list.
+function sortRows(rows: Row[]): Row[] {
+  return [...rows].sort((a, b) => {
+    const r = tierRank(a.tier) - tierRank(b.tier);
+    if (r !== 0) return r;
+    if (a.provider !== b.provider) return a.provider.localeCompare(b.provider);
+    return a.id.localeCompare(b.id);
+  });
+}
+
+const MAX_VISIBLE = 12;
+
+class ModelsPicker extends Container {
+  private tui: TuiLike;
+  private theme: ThemeLike;
+  private rows: Row[];
+  private filtered: Row[];
+  private selectedIndex = 0;
+  private searchInput: Input;
+  private listContainer: Container;
+  private legendText: Text;
+  private blurbText: Text;
+  private currentId: string | undefined;
+  private onSelect: (row: Row) => void;
+  private onCancel: () => void;
+  private _focused = false;
+
+  constructor(opts: {
+    tui: TuiLike;
+    theme: ThemeLike;
+    rows: Row[];
+    current: ModelLike | undefined;
+    onSelect: (row: Row) => void;
+    onCancel: () => void;
+  }) {
+    super();
+    this.tui = opts.tui;
+    this.theme = opts.theme;
+    this.rows = sortRows(opts.rows);
+    this.filtered = this.rows;
+    this.currentId = opts.current ? `${opts.current.provider}/${opts.current.id}` : undefined;
+    this.onSelect = opts.onSelect;
+    this.onCancel = opts.onCancel;
+
+    const t = this.theme;
+    this.addChild(new Text(t.fg("accent", t.bold("Select a model")), 1, 0));
+    this.legendText = new Text(this.legend(), 1, 0);
+    this.addChild(this.legendText);
+    this.addChild(new Spacer(1));
+
+    this.searchInput = new Input();
+    this.searchInput.onSubmit = () => {
+      const row = this.filtered[this.selectedIndex];
+      if (row) this.onSelect(row);
+    };
+    this.addChild(this.searchInput);
+    this.addChild(new Spacer(1));
+
+    this.listContainer = new Container();
+    this.addChild(this.listContainer);
+    this.addChild(new Spacer(1));
+
+    this.blurbText = new Text("", 1, 0);
+    this.addChild(this.blurbText);
+    this.addChild(
+      new Text(
+        t.fg("muted", "↑↓ navigate   ⏎ select   type to search   esc cancel"),
+        1,
+        0,
+      ),
+    );
+
+    // Keep selection on the current model if it's in the list.
+    const cur = this.rows.findIndex((r) => `${r.provider}/${r.id}` === this.currentId);
+    if (cur >= 0) this.selectedIndex = cur;
+
+    this.updateList();
+    void this.attestTeeRows();
+  }
+
+  get focused(): boolean {
+    return this._focused;
+  }
+  set focused(v: boolean) {
+    this._focused = v;
+    this.searchInput.focused = v;
+  }
+
+  private legend(): string {
+    const t = this.theme;
+    return (
+      `${shield(t, "tee-verified")} ${t.fg("muted", "TEE")}   ` +
+      `${shield(t, "zdr-enforced")} ${t.fg("muted", "ZDR")}   ` +
+      `${shield(t, "standard")} ${t.fg("muted", "Standard")}   ` +
+      t.fg("muted", "— green = verified/enforced, yellow = claimed")
+    );
+  }
+
+  // Fire attestation for every TEE-candidate row in parallel; upgrade each shield in
+  // place as its result lands. Cheap in practice (the enabled catalog is mostly
+  // ZDR/standard), and never blocks the picker — the baseline renders immediately.
+  private async attestTeeRows(): Promise<void> {
+    const candidates = this.rows.filter((r) => isTeeCandidate(r) && !r.attested);
+    if (!candidates.length) return;
+    await Promise.allSettled(
+      candidates.map(async (row) => {
+        const tier = await attestRow(row);
+        row.attested = true;
+        if (tier && tier !== row.tier) {
+          row.tier = tier;
+        }
+      }),
+    );
+    // Re-sort (a newly-verified TEE may move up) and re-render once, preserving the
+    // highlighted model across the reshuffle.
+    const selected = this.filtered[this.selectedIndex];
+    this.rows = sortRows(this.rows);
+    this.applyFilter(this.searchInput.getValue(), selected);
+    this.legendText.setText(this.legend());
+    this.tui.requestRender();
+  }
+
+  private applyFilter(query: string, keep?: Row): void {
+    this.filtered = query
+      ? fuzzyFilter(this.rows, query, (r: Row) => searchText(r))
+      : this.rows;
+    if (keep) {
+      const i = this.filtered.findIndex((r) => r.provider === keep.provider && r.id === keep.id);
+      this.selectedIndex = i >= 0 ? i : 0;
+    } else {
+      this.selectedIndex = 0;
+    }
+    this.updateList();
+  }
+
+  private updateList(): void {
+    const t = this.theme;
+    this.listContainer.clear();
+    if (this.filtered.length === 0) {
+      this.listContainer.addChild(new Text(t.fg("muted", "  No matching models"), 1, 0));
+      this.blurbText.setText("");
+      return;
+    }
+    if (this.selectedIndex >= this.filtered.length) this.selectedIndex = this.filtered.length - 1;
+
+    const start = Math.max(
+      0,
+      Math.min(this.selectedIndex - Math.floor(MAX_VISIBLE / 2), this.filtered.length - MAX_VISIBLE),
+    );
+    const end = Math.min(start + MAX_VISIBLE, this.filtered.length);
+    for (let i = start; i < end; i++) {
+      const row = this.filtered[i];
+      const isSel = i === this.selectedIndex;
+      const isCur = `${row.provider}/${row.id}` === this.currentId;
+      const mark = shield(t, row.tier);
+      const label = TIERS[row.tier].label;
+      const idText = isSel ? t.fg("accent", row.id) : t.fg("text", row.id);
+      const prov = t.fg("muted", `[${row.provider}]`);
+      const tierText = t.fg(POSTURE_COLOR[TIERS[row.tier].posture] ?? "muted", label);
+      const check = isCur ? t.fg("success", " ✓") : "";
+      const prefix = isSel ? t.fg("accent", "→ ") : "  ";
+      this.listContainer.addChild(
+        new Text(`${prefix}${mark} ${idText} ${prov} ${tierText}${check}`, 1, 0),
+      );
+    }
+    if (start > 0 || end < this.filtered.length) {
+      this.listContainer.addChild(
+        new Text(t.fg("muted", `  (${this.selectedIndex + 1}/${this.filtered.length})`), 1, 0),
+      );
+    }
+    // Honest one-liner for the highlighted model — states the LIMIT of the claim.
+    const sel = this.filtered[this.selectedIndex];
+    if (sel) this.blurbText.setText(t.fg("muted", `  ${TIERS[sel.tier].blurb}`));
+  }
+
+  // Seed the search box (from `/models <query>`) and filter to match.
+  setQuery(q: string): void {
+    this.searchInput.setValue(q);
+    this.applyFilter(q);
+  }
+
+  handleInput(keyData: string): void {
+    const kb = getKeybindings();
+    if (kb.matches(keyData, "tui.select.up")) {
+      if (!this.filtered.length) return;
+      this.selectedIndex =
+        this.selectedIndex === 0 ? this.filtered.length - 1 : this.selectedIndex - 1;
+      this.updateList();
+    } else if (kb.matches(keyData, "tui.select.down")) {
+      if (!this.filtered.length) return;
+      this.selectedIndex =
+        this.selectedIndex === this.filtered.length - 1 ? 0 : this.selectedIndex + 1;
+      this.updateList();
+    } else if (kb.matches(keyData, "tui.select.confirm")) {
+      const row = this.filtered[this.selectedIndex];
+      if (row) this.onSelect(row);
+    } else if (kb.matches(keyData, "tui.select.cancel")) {
+      this.onCancel();
+    } else {
+      // Everything else edits the search box, then re-filters.
+      this.searchInput.handleInput(keyData);
+      this.applyFilter(this.searchInput.getValue());
+    }
+  }
+}
+
+// The extension entrypoint. Registers `/models`; the redirect patch also routes
+// `/model` here so the shielded picker is the single model surface.
+export default function privateerModels(pi: {
+  registerCommand?: (name: string, opts: unknown) => void;
+  setModel?: (model: ModelLike) => Promise<boolean> | boolean;
+}): void {
+  if (typeof pi.registerCommand !== "function") return;
+
+  pi.registerCommand("models", {
+    description: "Pick a model with its privacy posture (TEE / ZDR / standard) — searchable",
+    argumentHint: "[search]",
+    handler: async (args: string, ctx: any): Promise<void> => {
+      const ui = ctx?.ui;
+      if (!ui?.custom) {
+        ctx?.ui?.notify?.("The model picker needs an interactive terminal.", "warning");
+        return;
+      }
+      const registry = ctx.modelRegistry;
+      // Refresh so a just-fetched account catalog / models.json edit is reflected.
+      try {
+        registry?.refresh?.();
+      } catch {
+        /* non-fatal */
+      }
+      // Make sure the account baseline tiers are loaded (first-open may race the
+      // provider's background fetch). Best-effort; falls back to prefix heuristics.
+      if (!accountCatalogLoaded()) {
+        try {
+          await fetchAccountCatalog();
+        } catch {
+          /* keep heuristics */
+        }
+      }
+
+      let available: ModelLike[] = [];
+      try {
+        available = (await registry.getAvailable()) as ModelLike[];
+      } catch (e) {
+        ui.notify?.(`Couldn't list models: ${(e as Error).message}`, "error");
+        return;
+      }
+      if (!available.length) {
+        ui.notify?.("No models available. Use /login to add a provider.", "warning");
+        return;
+      }
+
+      const rows: Row[] = available.map((m) => ({
+        provider: m.provider,
+        id: m.id,
+        name: m.name ?? m.id,
+        model: m,
+        tier: baselineTier(m.provider, m.id),
+      }));
+
+      const initialQuery = String(args ?? "").trim();
+      const chosen: Row | undefined = await ui.custom(
+        (tui: TuiLike, theme: ThemeLike, _kb: unknown, close: (result?: Row) => void) => {
+          const picker = new ModelsPicker({
+            tui,
+            theme,
+            rows,
+            current: ctx.model,
+            onSelect: (row) => close(row),
+            onCancel: () => close(undefined),
+          });
+          if (initialQuery) picker.setQuery(initialQuery);
+          return picker;
+        },
+      );
+
+      if (!chosen) return;
+      try {
+        const ok = await pi.setModel!(chosen.model);
+        if (ok === false) {
+          ui.notify?.(`No API key for ${chosen.provider}/${chosen.id}.`, "warning");
+          return;
+        }
+        ui.notify?.(
+          `Model: ${chosen.provider}/${chosen.id}  ·  ${TIERS[chosen.tier].label}`,
+          "info",
+        );
+      } catch (e) {
+        ui.notify?.(`Couldn't switch model: ${(e as Error).message}`, "error");
+      }
+    },
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -37,6 +37,7 @@
     "bin",
     "src",
     "extensions",
+    "patches",
     "README.md",
     "LICENSE"
   ],
@@ -46,7 +47,8 @@
     "channels": "node --env-file=.env --import tsx src/channels/run.ts",
     "dev": "tsx watch src/main.ts",
     "typecheck": "tsc --noEmit",
-    "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
+    "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done",
+    "postinstall": "patch-package"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -60,11 +62,12 @@
     "@noble/ciphers": "^2.1.1",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.7.1",
+    "patch-package": "^8.0.1",
     "pi-mcp-adapter": "^2.11.0",
     "pi-privacy": "^0.3.0",
     "pi-subagents": "^0.34.0",
-    "privateer-workflow": "^0.1.0",
     "picomatch": "^4.0.4",
+    "privateer-workflow": "^0.1.0",
     "tsx": "^4.16.0",
     "typebox": "^1.3.4",
     "undici": "^7.28.0",

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -0,0 +1,23 @@
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
+index 5d65200..a997ad7 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
+@@ -2042,7 +2042,17 @@ export class InteractiveMode {
+             if (text === "/model" || text.startsWith("/model ")) {
+                 const searchTerm = text.startsWith("/model ") ? text.slice(7).trim() : undefined;
+                 this.editor.setText("");
+-                await this.handleModelCommand(searchTerm);
++                // Privateer redirect: when the shielded picker extension is loaded
++                // (registers `/models`), route `/model` to it so users get the
++                // privacy-posture picker via muscle memory. Falls back to Pi's
++                // built-in picker when the extension isn't present.
++                const privateerModels = searchTerm ? `/models ${searchTerm}` : "/models";
++                if (this.isExtensionCommand(privateerModels)) {
++                    await this.session.prompt(privateerModels);
++                }
++                else {
++                    await this.handleModelCommand(searchTerm);
++                }
+                 return;
+             }
+             if (text === "/export" || text.startsWith("/export ")) {

package/src/config/hosted.ts

@@ -0,0 +1,13 @@
+// Harbor hosted mode.
+//
+// When true, this daemon is running inside Privateer's confidential-VM fleet
+// (the host orchestrator sets HARBOR_HOSTED=1), not on a user's own machine.
+// Hosted daemons run on-demand: they report their next routine fire time to the
+// server and idle-suspend when there's no work, so the server can wake them
+// again in time. A daemon on a user's laptop leaves this off and keeps running
+// its own cron continuously.
+//
+// Read via process.env at call time, mirroring PRIVATEER_HOME / PRIVATEER_SERVER_URL.
+export function isHosted(): boolean {
+  return process.env.HARBOR_HOSTED === "1";
+}

package/src/daemon/index.ts

@@ -50,6 +50,7 @@ import { deliver, type RelayPusher, type CloudPusher } from "../routines/deliver
 import { sealJson, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
 import { redactText, collectSecrets } from "../util/redact.ts";
 import { startIpcServer, type IpcRequest, type IpcResponse } from "./ipc.ts";
+import { isHosted } from "../config/hosted.ts";
 
 // The safe, read-only toolset for unattended runs — Pi builtins with no
 // write/edit/bash, so a routine firing with nobody watching can't mutate the
@@ -59,6 +60,10 @@ import { startIpcServer, type IpcRequest, type IpcResponse } from "./ipc.ts";
 const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 
 const TICK_MS = 60_000; // scan for due routines once a minute
+// Harbor hosted mode (isHosted): suspend after this much idle time with no work,
+// and stay up if a routine is due within the lead window (avoids suspend→wake churn).
+const HOSTED_IDLE_MS = Number(process.env.HARBOR_IDLE_MS) || 5 * 60_000;
+const HOSTED_SUSPEND_MIN_LEAD_MS = Number(process.env.HARBOR_SUSPEND_MIN_LEAD_MS) || 2 * 60_000;
 const MAX_CLOUD_PLAINTEXT = 45_000;
 // How long a workflow `human_gate` (or a script-approval prompt) waits for the app to
 // answer before it fail-closes to "no response" (the runner then defers the run). Bounds
@@ -158,6 +163,11 @@ export class Daemon {
   private relay?: RelayClient;
   private controllerAttached = false;
   private relayTerminated = false;
+  // Harbor hosted mode: last time a controller attached or a routine ran. Drives
+  // idle-suspend (no `controller_detached` frame exists, so we gate on inactivity
+  // + no live work rather than on controllerAttached, which never resets while the
+  // socket stays open).
+  private lastActivityAt = Date.now();
   // Live, app-drivable sessions spawned on demand (task_spawn). Each has its OWN relay
   // terminal (task-<uuid>); the daemon just keeps handles so it can reap them on shutdown.
   private readonly liveTasks = new Map<string, LiveTaskHandle>();
@@ -406,6 +416,8 @@ export class Daemon {
 
   private onControllerAttached(): void {
     this.controllerAttached = true;
+    this.markActivity(); // hosted: a driver is present — reset the idle timer
+
     this.relay?.sendSnapshot([{ kind: "notice", text: "Privateer routines — results will appear here as they run." }]);
     // Version + this terminal's identity public key (so the app can confirm this is
     // the terminal it PINNED at link time before sealing channel tokens to it). No
@@ -506,6 +518,74 @@ export class Daemon {
         await this.runRoutine(r);
       }
     }
+    await this.hostedTick();
+  }
+
+  // ── Harbor hosted mode ──────────────────────────────────────────────────────
+  // A hosted daemon runs on-demand: it reports its earliest upcoming fire time so
+  // the server can wake it while suspended, and idle-suspends when there's no work.
+  // No-op on a user's own machine (isHosted() === false).
+
+  private markActivity(): void { this.lastActivityAt = Date.now(); }
+
+  // Earliest fire time (ms) across enabled, valid routines — mirrors tick()'s fire
+  // filters so we never report/wait on a routine the scheduler won't actually fire.
+  private earliestFireMs(): number | null {
+    let earliest: number | null = null;
+    for (const r of loadRoutines()) {
+      if (!r.enabled || triggerError(r)) continue;
+      const nrStr = r.nextRun ?? computeNextRun(r)?.toISOString();
+      if (!nrStr) continue;
+      const t = Date.parse(nrStr);
+      if (Number.isNaN(t)) continue;
+      if (earliest === null || t < earliest) earliest = t;
+    }
+    return earliest;
+  }
+
+  // Report our next fire time to the server so its scheduler can wake us. When
+  // `suspending`, also flip the server-side status to suspended (we're about to
+  // exit) so the sweeper knows to wake us again. Best-effort: an offline instance
+  // retries next tick; a suspend report failing means we stay up this tick.
+  private async reportSchedule(suspending = false): Promise<boolean> {
+    if (!isHosted() || !hasCredentials()) return true;
+    const earliest = this.earliestFireMs();
+    try {
+      const res = await apiRequest("/api/harbor/agent/schedule", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          termId: routineRelayId(),
+          nextRoutineAt: earliest !== null ? new Date(earliest).toISOString() : null,
+          ...(suspending ? { suspended: true } : {}),
+        }),
+      });
+      return res.ok;
+    } catch {
+      return false;
+    }
+  }
+
+  private shouldSuspend(): boolean {
+    if (this.running.size > 0 || this.liveTasks.size > 0) return false;
+    if (Date.now() - this.lastActivityAt < HOSTED_IDLE_MS) return false;
+    const earliest = this.earliestFireMs();
+    if (earliest !== null && earliest - Date.now() < HOSTED_SUSPEND_MIN_LEAD_MS) return false;
+    return true;
+  }
+
+  private async hostedTick(): Promise<void> {
+    if (!isHosted()) return;
+    if (this.shouldSuspend()) {
+      // Tell the server we're suspending (+ our next fire) BEFORE exiting; only
+      // then tear down. If the report fails, stay up and try again next tick.
+      if (!(await this.reportSchedule(true))) return;
+      log("hosted: idle — suspending (server will wake for the next routine)");
+      this.stop();
+      void revokeLocalSessions().finally(() => process.exit(0));
+      return;
+    }
+    await this.reportSchedule();
   }
 
   // Execute a routine to completion and deliver the result. The one rewired seam:
@@ -514,6 +594,7 @@ export class Daemon {
   async runRoutine(routine: Routine): Promise<IpcResponse> {
     if (this.running.has(routine.id)) return { ok: false, message: "already running" };
     this.running.add(routine.id);
+    this.markActivity(); // hosted: work in progress — don't idle-suspend under it
     log(`running routine "${routine.name}"`);
 
     const config = loadDaemonConfig();

package/src/providers/account.ts

@@ -47,20 +47,88 @@ function seedModel(id: string) {
   };
 }
 
-// Fetch the account channel's enabled model catalog. `GET /api/models` is the server's
-// public list of billable models (`{ models: [{ modelId }] }`) — the same set the app
-// shows. (The `/api/agent/v1` base only implements chat/completions, no /models route.)
-// Falls back to DEFAULT_MODELS on any failure.
-export async function fetchAccountModels(): Promise<string[]> {
+// One catalog entry with its server-asserted baseline privacy tier.
+export interface AccountModelInfo {
+  id: string;
+  tier: PrivacyTier;
+}
+
+// The set of tier strings pi-privacy defines (posture/tiers.ts). We only trust a
+// server-supplied tier if it's one of these — anything else falls back to a prefix
+// heuristic, so a server typo or older/newer server can never inject a bogus tier.
+const VALID_TIERS = new Set<PrivacyTier>([
+  "tee-verified",
+  "tee-unverified",
+  "local",
+  "zdr-enforced",
+  "zdr-policy",
+  "standard",
+]);
+
+// Baseline tier when the server doesn't (yet) send one. Honest-labeling rule: a
+// confidential-compute model is only *claimed* here (tee-unverified) — the picker
+// upgrades it to tee-verified live via attestation (accountPosture). Everything
+// else with no server signal is "standard": we don't assert ZDR we can't back.
+function tierFromPrefix(modelId: string): PrivacyTier {
+  return modelId.startsWith("near/") || modelId.startsWith("tinfoil/") ? "tee-unverified" : "standard";
+}
+
+function normalizeTier(tier: string | undefined, modelId: string): PrivacyTier {
+  return tier && VALID_TIERS.has(tier as PrivacyTier) ? (tier as PrivacyTier) : tierFromPrefix(modelId);
+}
+
+// Baseline tiers for the account catalog, keyed by modelId. Populated by
+// fetchAccountCatalog() so the /models picker can shield each row without re-fetching.
+// A live NEAR attestation (accountPosture) can still upgrade a row to tee-verified.
+const accountTierMap = new Map<string, PrivacyTier>();
+
+// The server-asserted baseline tier for an account model, or undefined if we haven't
+// seen it in a catalog fetch. Used by the /models picker (privateer-models.ts).
+export function accountBaselineTier(modelId: string): PrivacyTier | undefined {
+  return accountTierMap.get(modelId);
+}
+
+// Whether a catalog fetch has populated the tier map at least once. The /models
+// picker uses this to decide if it must fetch before opening (first-open race with
+// the provider's background fetch) vs. render immediately from the cached tiers.
+export function accountCatalogLoaded(): boolean {
+  return accountTierMap.size > 0;
+}
+
+// Fetch the account channel's enabled model catalog WITH per-model privacy tiers.
+// `GET /api/models` is the server's public list of billable models
+// (`{ models: [{ modelId, privacy: { tier } }] }`) — the same set the app shows.
+// (The `/api/agent/v1` base only implements chat/completions, no /models route.)
+// Falls back to DEFAULT_MODELS (prefix-derived tiers) on any failure. Side effect:
+// refreshes accountTierMap.
+export async function fetchAccountCatalog(): Promise<AccountModelInfo[]> {
+  const fallback = (): AccountModelInfo[] =>
+    DEFAULT_MODELS.map((id) => ({ id, tier: tierFromPrefix(id) }));
+  let infos: AccountModelInfo[];
   try {
     const res = await fetch(`${serverBaseUrl()}/api/models`);
-    if (!res.ok) return DEFAULT_MODELS;
-    const data = (await res.json()) as { models?: { modelId?: string }[] };
-    const ids = (data.models ?? []).map((m) => m.modelId).filter((x): x is string => !!x);
-    return ids.length ? ids : DEFAULT_MODELS;
+    if (!res.ok) {
+      infos = fallback();
+    } else {
+      const data = (await res.json()) as {
+        models?: { modelId?: string; privacy?: { tier?: string } }[];
+      };
+      const parsed = (data.models ?? [])
+        .map((m) => (m.modelId ? { id: m.modelId, tier: normalizeTier(m.privacy?.tier, m.modelId) } : null))
+        .filter((x): x is AccountModelInfo => !!x);
+      infos = parsed.length ? parsed : fallback();
+    }
   } catch {
-    return DEFAULT_MODELS;
+    infos = fallback();
   }
+  accountTierMap.clear();
+  for (const info of infos) accountTierMap.set(info.id, info.tier);
+  return infos;
+}
+
+// Back-compat id-only view over fetchAccountCatalog (registerProvider only needs ids).
+export async function fetchAccountModels(): Promise<string[]> {
+  return (await fetchAccountCatalog()).map((m) => m.id);
 }
 
 // The Pi OAuth provider (Omit<OAuthProviderInterface, "id"> — Pi supplies the id from
@@ -199,8 +267,10 @@ export function makeAccountProvider() {
         models: ids.map(seedModel),
       });
     register(DEFAULT_MODELS); // immediate: provider exists this tick
-    void fetchAccountModels()
-      .then((ids) => ids.length && register(ids)) // refine to the live catalog
+    // Refine to the live catalog. fetchAccountCatalog also populates accountTierMap
+    // as a side effect, so the /models picker can shield each row without re-fetching.
+    void fetchAccountCatalog()
+      .then((infos) => infos.length && register(infos.map((m) => m.id)))
       .catch(() => {
         /* keep the fallback model */
       });