privateer-agent 0.5.0 → 0.6.0

package/bin/privateer-launch.mjs

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+// Cross-platform Privateer launcher — the single source of launch logic for every
+// platform (macOS, Linux, Windows). `bin/privateer-tui` (unix) and the Windows
+// `privateer.cmd` are thin shims that just pick a Node and run THIS file.
+//
+// It boots Pi's full interactive TUI with the Privateer moat + tool packs. The moat
+// is installed as re-export SHIMS in the agent dir's extensions/, so BOTH this TUI
+// and any subagents it spawns (child processes reading the same agent dir) load the
+// identical set — including our permission gate. One source of truth via discovery
+// (no `-e`, which would double-load vs discovery). Runs in the current directory;
+// model via PRIVATEER_MODEL=provider/id.
+//
+// Ported from the original bash launcher; behaviour is intended to match exactly.
+
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
+const REPO = path.resolve(HERE, "..");
+const isWin = process.platform === "win32";
+
+const PRIVATEER_HOME = process.env.PRIVATEER_HOME || path.join(os.homedir(), ".privateer");
+const ENV_FILE = path.join(REPO, ".env"); // dev-only; a real install has none
+
+// --- bundle detection ------------------------------------------------------
+// A self-contained bundle ships its own pinned Node at "$REPO/node[.exe]" plus a
+// BUNDLE_INFO.json marker (built by scripts/build-bundle.mjs). When present we use
+// that runtime and never touch system node/npm. Putting the bundle dir on PATH also
+// lets any child that boots via `#!/usr/bin/env node` (Pi's cli.js, the subagent
+// wrapper) resolve the bundled node.
+const bundledNode = path.join(REPO, isWin ? "node.exe" : "node");
+const BUNDLED = fs.existsSync(bundledNode) && fs.existsSync(path.join(REPO, "BUNDLE_INFO.json"));
+
+// The node used for child processes. When bundled, the bundled runtime; otherwise the
+// very node already running this script (a suitable >=22, since we booted under it).
+const NODE_BIN = BUNDLED ? bundledNode : process.execPath;
+// Make sure the chosen node's directory is on PATH for shebang-spawned grandchildren.
+process.env.PATH = path.dirname(NODE_BIN) + path.delimiter + (process.env.PATH || "");
+
+const args = process.argv.slice(2);
+const sub = args[0];
+
+// `privateer --version` — report OUR version, not Pi's. Left to Pi's cli.js it would
+// print the pi-coding-agent version (e.g. 0.80.3); intercept so users see the
+// Privateer release they installed. (The startup banner already shows this version.)
+if (sub === "--version" || sub === "-V") {
+  const ver = (p) => { try { return JSON.parse(fs.readFileSync(p, "utf8")).version; } catch { return null; } };
+  const pv = ver(path.join(REPO, "package.json")) || "unknown";
+  const pi = ver(path.join(REPO, "node_modules", "@earendil-works", "pi-coding-agent", "package.json"));
+  console.log(`privateer ${pv}${pi ? ` (pi ${pi})` : ""}`);
+  process.exit(0);
+}
+
+// Faithfully propagate a child's exit/signal, mirroring bash `exec`.
+function runToCompletion(cmd, cmdArgs, opts = {}) {
+  const child = spawn(cmd, cmdArgs, { stdio: "inherit", env: process.env, ...opts });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (e) => {
+    console.error(`privateer: failed to launch — ${e.message}`);
+    process.exit(1);
+  });
+}
+
+// --- `privateer update` ----------------------------------------------------
+// Fetch the latest release and exit. Bundle installs re-run the download+extract
+// installer; npm installs update the global package.
+if (sub === "update") {
+  if (BUNDLED) {
+    console.log("Updating Privateer to the latest release…");
+    if (isWin) {
+      runToCompletion("powershell", ["-NoProfile", "-Command", "irm https://privateer.pro/install.ps1 | iex"]);
+    } else {
+      runToCompletion("sh", ["-c", "curl -fsSL https://privateer.pro/install.sh | sh"]);
+    }
+  } else {
+    console.log("Updating privateer-agent to the latest release…");
+    runToCompletion(isWin ? "npm.cmd" : "npm", ["install", "-g", "privateer-agent@latest"]);
+  }
+  // runToCompletion exits via the child's exit handler.
+}
+
+// --- `privateer daemon [run|install|uninstall|status]` ---------------------
+// The resident background daemon (routines + app-driven headless task spawns). Boots
+// straight into src/daemon via bin/privateer-daemon.mjs — no moat-shim install (the
+// daemon loads the moat as in-code factories, not interactive extensions).
+else if (sub === "daemon") {
+  const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
+  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-daemon.mjs"), ...args.slice(1)]);
+}
+
+// --- normal launch: install the moat, then exec Pi's TUI -------------------
+else {
+  const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");
+  const EXT_DIR = path.join(AGENT_DIR, "extensions");
+  fs.mkdirSync(EXT_DIR, { recursive: true });
+
+  // Install/refresh the moat + tool-pack shims. Each shim re-exports its target by
+  // ABSOLUTE path (as a file:// URL, portable across OSes) so the target's own
+  // relative imports resolve from the repo. We remove any shim we previously managed
+  // first, so a dropped package can't linger and reload.
+  const MANAGED = [
+    "privateer-brand", "privateer-context", "privateer-gate", "privateer-account",
+    "privateer-models", "privateer-posture", "privateer-tools", "privateer-privacy",
+    "pi-privacy", "pi-web-access", "rpiv-web-tools", "pi-mcp-adapter", "pi-hypa", "pi-subagents",
+  ];
+  for (const name of MANAGED) fs.rmSync(path.join(EXT_DIR, `${name}.ts`), { force: true });
+
+  const ext = (...p) => path.join(REPO, "extensions", ...p);
+  const dep = (...p) => path.join(REPO, "node_modules", ...p);
+  const shim = (name, target) =>
+    fs.writeFileSync(path.join(EXT_DIR, `${name}.ts`), `export { default } from ${JSON.stringify(pathToFileURL(target).href)};\n`);
+
+  shim("privateer-brand", ext("privateer-brand.ts"));       // banner, ⚓ badge, /signin /signout
+  shim("privateer-context", ext("privateer-context.ts"));   // PRIVATEER.md context + /init
+  shim("privateer-gate", ext("privateer-gate.ts"));         // the permission gate (moat)
+  shim("privateer-account", ext("privateer-account.ts"));
+  shim("privateer-models", ext("privateer-models.ts"));     // /models picker w/ privacy shields
+  shim("privateer-posture", ext("privateer-posture.ts"));
+  shim("privateer-tools", ext("privateer-tools.ts"));
+  shim("privateer-privacy", ext("privateer-privacy.ts"));   // pi-privacy + account tier resolver
+  shim("rpiv-web-tools", dep("@juicesharp", "rpiv-web-tools", "index.ts")); // private web tools
+  shim("pi-mcp-adapter", dep("pi-mcp-adapter", "index.ts"));
+  shim("pi-hypa", dep("@hypabolic", "pi-hypa", "extensions", "index.ts"));
+  shim("pi-subagents", dep("pi-subagents", "src", "extension", "index.ts"));
+
+  const CLI = dep("@earendil-works", "pi-coding-agent", "dist", "cli.js");
+  process.env.PI_CODING_AGENT_DIR = AGENT_DIR;
+  // The binary pi-subagents spawns for each child. Point it at OUR cli.js so the child
+  // reads this same PI_CODING_AGENT_DIR and DISCOVERS the moat shims (gated + private,
+  // no -e injection). Set only when unset so a power user can override.
+  if (!process.env.PI_SUBAGENT_PI_BINARY) process.env.PI_SUBAGENT_PI_BINARY = CLI;
+  // Suppress Pi's upstream update banner (our banner is the startup surface). Disables
+  // ONLY the version fetch — fd/rg can still download on first run.
+  if (!process.env.PI_SKIP_VERSION_CHECK) process.env.PI_SKIP_VERSION_CHECK = "1";
+
+  // Quiet Pi's built-in startup chatter so our banner is the only greeting. Each key is
+  // set only when unset, so a user's own settings.json toggle still wins.
+  try {
+    const sp = path.join(AGENT_DIR, "settings.json");
+    let s = {};
+    try { s = JSON.parse(fs.readFileSync(sp, "utf8")); } catch { /* new/absent */ }
+    let m = false;
+    if (s.quietStartup === undefined) { s.quietStartup = true; m = true; }
+    if (s.collapseChangelog === undefined) { s.collapseChangelog = true; m = true; }
+    if (s.lastChangelogVersion === undefined) { s.lastChangelogVersion = "9999.0.0"; m = true; }
+    if (m) fs.writeFileSync(sp, JSON.stringify(s, null, 2) + "\n");
+  } catch { /* best-effort */ }
+
+  // Passive update check: refresh the cached "latest version" at most ~daily, in the
+  // background so it never blocks or breaks launch (offline-safe). The banner reads
+  // this cache and shows a "↑ vX available · run privateer update" notice. We never
+  // auto-install. Fire-and-forget: the event loop stays alive while the TUI child runs.
+  refreshUpdateCache();
+
+  // Default model. Explicit PRIVATEER_MODEL wins; else Tinfoil GLM 5.2 (client-attested
+  // TEE, strongest tier) when a Tinfoil key is present; else the signed-in account's
+  // NEAR channel; else a cheap OpenRouter fallback.
+  const CRED = path.join(PRIVATEER_HOME, "credentials.json");
+  const MODEL = process.env.PRIVATEER_MODEL
+    ? process.env.PRIVATEER_MODEL
+    : haveTinfoilKey()
+      ? "tinfoil/glm-5-2"
+      : fs.existsSync(CRED)
+        ? "privateer/near/zai-org/GLM-5.1-FP8"
+        : "openrouter/openai/gpt-4o-mini";
+
+  // Dev convenience: load provider keys from the repo's .env if present.
+  const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
+  runToCompletion(NODE_BIN, [...nodeArgs, CLI, "--model", MODEL, ...args]);
+}
+
+// --- helpers ---------------------------------------------------------------
+function haveTinfoilKey() {
+  if (process.env.TINFOIL_API_KEY) return true;
+  try { return /^TINFOIL_API_KEY=.+/m.test(fs.readFileSync(ENV_FILE, "utf8")); }
+  catch { return false; }
+}
+
+function refreshUpdateCache() {
+  const cache = path.join(PRIVATEER_HOME, "update-check.json");
+  try {
+    const stat = fs.statSync(cache);
+    if (Date.now() - stat.mtimeMs < 24 * 60 * 60 * 1000) return; // fresh (<1 day)
+  } catch { /* missing — refresh */ }
+
+  const write = (latest) => {
+    if (!/^[0-9]/.test(latest || "")) return;
+    try {
+      fs.mkdirSync(PRIVATEER_HOME, { recursive: true });
+      fs.writeFileSync(cache, JSON.stringify({ latest }) + "\n");
+    } catch { /* best-effort */ }
+  };
+
+  if (BUNDLED) {
+    // No npm in a bundle — read the latest tag off GitHub Releases.
+    fetch("https://api.github.com/repos/privateer-agent/privateer-agent/releases/latest", {
+      headers: { "User-Agent": "privateer-cli", Accept: "application/vnd.github+json" },
+    })
+      .then((r) => (r.ok ? r.json() : null))
+      .then((j) => write(String(j?.tag_name || "").replace(/^v/, "")))
+      .catch(() => { /* offline — keep stale cache */ });
+  } else {
+    const p = spawn(isWin ? "npm.cmd" : "npm", ["view", "privateer-agent", "version"], {
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    let out = "";
+    p.stdout.on("data", (d) => { out += d; });
+    p.on("close", () => write(out.trim()));
+    p.on("error", () => { /* no npm — ignore */ });
+    p.unref();
+  }
+}

package/bin/privateer-tui

@@ -1,15 +1,10 @@
 #!/usr/bin/env bash
-# Launch Pi's full interactive TUI with the Privateer moat + tool packs. The moat is
-# installed as re-export SHIMS in the agent dir's extensions/, so BOTH this TUI and
-# any subagents it spawns (which run as child `pi` processes reading the agent dir)
-# load the identical set — including our permission gate. So subagent tool calls are
-# gated too (the gate runs bypass-within-restricted-tools headlessly; danger.ts still
-# blocks destructive shell). One source of truth via discovery — no -e (which would
-# double-load vs discovery).
-#
-# Runs in the current directory. Model via PRIVATEER_MODEL=provider/id.
+# Thin unix shim: pick a Node, then hand off to the cross-platform launcher
+# (bin/privateer-launch.mjs), which is the single source of launch logic shared with
+# the Windows privateer.cmd. All the real work — moat-shim install, model pick,
+# update/daemon dispatch, exec into Pi's TUI — lives in the launcher.
 set -euo pipefail
-# Resolve through symlinks so REPO points at the real repo, not the symlink dir.
+# Resolve through symlinks so REPO points at the real bundle/repo dir.
 SOURCE="${BASH_SOURCE[0]}"
 while [ -h "$SOURCE" ]; do
   DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
@@ -18,16 +13,9 @@ while [ -h "$SOURCE" ]; do
 done
 REPO="$(cd -P "$(dirname "$SOURCE")/.." && pwd)"
 
-# `privateer update` — pull the latest release from npm and exit. Handled here in the
-# launcher (not the TUI) so it works even when a broken install won't boot. npm rewrites
-# the global bin in place; replacing it while this process runs is safe on unix.
-if [ "${1:-}" = "update" ]; then
-  echo "Updating privateer-agent to the latest release…"
-  npm install -g privateer-agent@latest
-  exit $?
-fi
-
+# Bundled runtime wins; else a system node >=22; else an nvm node; else PATH `node`.
 pick_node() {
+  if [ -x "$REPO/node" ] && [ -f "$REPO/BUNDLE_INFO.json" ]; then echo "$REPO/node"; return; fi
   if command -v node >/dev/null 2>&1 \
      && node -e 'process.exit((+process.versions.node.split(".")[0]) >= 22 ? 0 : 1)' 2>/dev/null; then
     command -v node; return
@@ -38,123 +26,4 @@ pick_node() {
   echo "node"
 }
 
-# `privateer daemon [run|install|uninstall|status]` — the resident background daemon
-# (routines + app-driven headless task spawns). Handled HERE, before the Pi TUI exec
-# and before the moat-shim install (the daemon doesn't need the interactive extension
-# set), so it boots straight into src/daemon via bin/privateer-daemon.mjs.
-if [ "${1:-}" = "daemon" ]; then
-  shift
-  DAEMON_NODE="$(pick_node)"
-  DAEMON_ENV_ARGS=""
-  [ -f "$REPO/.env" ] && DAEMON_ENV_ARGS="--env-file=$REPO/.env"
-  exec "$DAEMON_NODE" ${DAEMON_ENV_ARGS:+"$DAEMON_ENV_ARGS"} "$REPO/bin/privateer-daemon.mjs" "$@"
-fi
-
-AGENT_DIR="${PRIVATEER_HOME:-$HOME/.privateer}/agent"
-EXT_DIR="$AGENT_DIR/extensions"
-mkdir -p "$EXT_DIR"
-
-# Install/refresh the moat + tool-pack shims. Each shim re-exports its target by
-# ABSOLUTE path so the target's own relative imports resolve from the repo (a plain
-# symlink would resolve them relative to the shim's location and break). We remove
-# any shim we previously managed first, so a dropped package can't linger and reload.
-MANAGED="privateer-brand privateer-context privateer-gate privateer-account privateer-posture privateer-tools privateer-privacy pi-privacy pi-web-access rpiv-web-tools pi-mcp-adapter pi-hypa pi-subagents"
-for name in $MANAGED; do rm -f "$EXT_DIR/$name.ts"; done
-shim() { printf 'export { default } from "%s";\n' "$2" > "$EXT_DIR/$1.ts"; }
-# Branding + the account sign-in surface (banner, ⚓ badge, /signin /signout).
-shim privateer-brand   "$REPO/extensions/privateer-brand.ts"
-# PRIVATEER.md project-context loading (like AGENTS.md/CLAUDE.md) + the /init command.
-shim privateer-context "$REPO/extensions/privateer-context.ts"
-shim privateer-gate    "$REPO/extensions/privateer-gate.ts"
-shim privateer-account "$REPO/extensions/privateer-account.ts"
-shim privateer-posture "$REPO/extensions/privateer-posture.ts"
-shim privateer-tools   "$REPO/extensions/privateer-tools.ts"
-# pi-privacy wrapped with the account-channel tier resolver (privateer/near… = TEE),
-# so it replaces loading pi-privacy's default entry.
-shim privateer-privacy "$REPO/extensions/privateer-privacy.ts"
-# Privacy-aligned web tools: pluggable backends (SearXNG self-hosted = private; no
-# WebView). Pick the backend with /web-tools, or set SEARXNG_URL. Replaces
-# pi-web-access (opened a WebView + defaulted to Exa, a 3rd-party search).
-shim rpiv-web-tools    "$REPO/node_modules/@juicesharp/rpiv-web-tools/index.ts"
-shim pi-mcp-adapter    "$REPO/node_modules/pi-mcp-adapter/index.ts"
-shim pi-hypa           "$REPO/node_modules/@hypabolic/pi-hypa/extensions/index.ts"
-shim pi-subagents      "$REPO/node_modules/pi-subagents/src/extension/index.ts"
-
-CLI="$REPO/node_modules/@earendil-works/pi-coding-agent/dist/cli.js"
-export PI_CODING_AGENT_DIR="$AGENT_DIR"
-# The binary pi-subagents spawns for each subagent child. Without this it falls back
-# to `pi` on PATH (getPiSpawnCommand) — which a Privateer install does NOT provide, so
-# every subagent spawn would fail with ENOENT. Point it at OUR bundled cli.js (it's
-# executable, `#!/usr/bin/env node`): the child then reads this same PI_CODING_AGENT_DIR
-# and DISCOVERS the moat shims above — so subagents run gated + private, no -e injection
-# (hence no double-load). Set only when unset so a power user can override it.
-export PI_SUBAGENT_PI_BINARY="${PI_SUBAGENT_PI_BINARY:-$CLI}"
-# Suppress Pi's upstream "Update Available — run `pi update`" banner. It's noise on a
-# Privateer install (our banner is the startup surface), it leaks the "pi" name, and
-# `pi update` would fight our npm-managed install. PI_SKIP_VERSION_CHECK disables ONLY
-# the version fetch — unlike PI_OFFLINE it still lets fd/rg download on first run.
-export PI_SKIP_VERSION_CHECK=1
-NODE_BIN="$(pick_node)"
-
-# Quiet Pi's built-in startup chatter so our banner is the only greeting. Each key is
-# set only when unset, so a user's own settings.json toggle (or --verbose) still wins:
-#   quietStartup       — hide the [Extensions]/[Context]/[Skills]/… resource listing
-#   collapseChangelog  — never dump Pi's "What's New" changelog wall into the chat
-#   lastChangelogVersion — sentinel so Pi finds no "new" entries to show on upgrade;
-#                          release notes live in the npm README / GitHub releases instead
-"$NODE_BIN" -e '
-const fs = require("fs"), p = process.argv[1];
-let s = {}; try { s = JSON.parse(fs.readFileSync(p, "utf8")); } catch {}
-let m = false;
-if (s.quietStartup === undefined) { s.quietStartup = true; m = true; }
-if (s.collapseChangelog === undefined) { s.collapseChangelog = true; m = true; }
-if (s.lastChangelogVersion === undefined) { s.lastChangelogVersion = "9999.0.0"; m = true; }
-if (m) fs.writeFileSync(p, JSON.stringify(s, null, 2) + "\n");
-' "$AGENT_DIR/settings.json" 2>/dev/null || true
-
-# Passive update check: refresh the cached "latest npm version" at most ~daily, in the
-# BACKGROUND so it never blocks or breaks launch (offline-safe — a failed fetch just
-# leaves the stale cache in place). The banner (privateer-brand) reads this cache and
-# shows a one-line "↑ vX available · run privateer update" notice when we're behind. We
-# never auto-install — the user stays in control of when new code lands (the whole point
-# of an attestable tool). Detached with </dev/null &, so it outlives our exec into node.
-UPDATE_CACHE="${PRIVATEER_HOME:-$HOME/.privateer}/update-check.json"
-if [ -z "$(find "$UPDATE_CACHE" -mtime -1 2>/dev/null)" ]; then
-  (
-    latest="$(npm view privateer-agent version 2>/dev/null || true)"
-    case "$latest" in
-      [0-9]*) printf '{"latest":"%s"}\n' "$latest" > "$UPDATE_CACHE.tmp" 2>/dev/null \
-                && mv -f "$UPDATE_CACHE.tmp" "$UPDATE_CACHE" 2>/dev/null ;;
-    esac
-  ) </dev/null >/dev/null 2>&1 &
-fi
-
-# Default model. An explicit PRIVATEER_MODEL always wins. Otherwise prefer Tinfoil's
-# GLM 5.2 when a Tinfoil key is available: verifiable TEE inference with CLIENT-side
-# attestation (the live TLS key is bound to the enclave's quote), the strongest privacy
-# tier we offer — stronger than the account's server-proxied NEAR channel. Failing that,
-# use the signed-in Privateer account's NEAR confidential-compute channel; with neither,
-# fall back to a cheap OpenRouter model. The Tinfoil key may sit in the ambient env or in
-# the dev .env the launcher loads below, so check both.
-CRED="${PRIVATEER_HOME:-$HOME/.privateer}/credentials.json"
-have_tinfoil_key() {
-  [ -n "${TINFOIL_API_KEY:-}" ] && return 0
-  [ -f "$REPO/.env" ] && grep -qE '^TINFOIL_API_KEY=.+' "$REPO/.env"
-}
-if [ -n "${PRIVATEER_MODEL:-}" ]; then
-  MODEL="$PRIVATEER_MODEL"
-elif have_tinfoil_key; then
-  MODEL="tinfoil/glm-5-2"
-elif [ -f "$CRED" ]; then
-  MODEL="privateer/near/zai-org/GLM-5.1-FP8"
-else
-  MODEL="openrouter/openai/gpt-4o-mini"
-fi
-
-# Dev convenience: load provider keys from the repo's .env if present. A real install
-# has none — so only pass the flag when the file exists (using --env-file-if-exists
-# unconditionally would print "…/.env not found. Continuing without it." on every
-# launch, muddying the startup banner). No .env → rely on the ambient environment.
-ENV_ARGS=""
-[ -f "$REPO/.env" ] && ENV_ARGS="--env-file=$REPO/.env"
-exec "$NODE_BIN" ${ENV_ARGS:+"$ENV_ARGS"} "$CLI" --model "$MODEL" "$@"
+exec "$(pick_node)" "$REPO/bin/privateer-launch.mjs" "$@"

package/bin/privateer.cmd

@@ -0,0 +1,6 @@
+@echo off
+REM Windows entry point for a Privateer bundle. Mirrors the unix bin/privateer-tui
+REM shim: run the bundled Node against the shared cross-platform launcher. %~dp0 is
+REM this file's dir (<app>\bin\), so ..\node.exe is the bundled runtime.
+"%~dp0..\node.exe" "%~dp0privateer-launch.mjs" %*
+exit /b %errorlevel%