privateer-agent 0.5.0 → 0.6.0

package/src/providers/account.ts

@@ -47,20 +47,88 @@ function seedModel(id: string) {
   };
 }
 
-// Fetch the account channel's enabled model catalog. `GET /api/models` is the server's
-// public list of billable models (`{ models: [{ modelId }] }`) — the same set the app
-// shows. (The `/api/agent/v1` base only implements chat/completions, no /models route.)
-// Falls back to DEFAULT_MODELS on any failure.
-export async function fetchAccountModels(): Promise<string[]> {
+// One catalog entry with its server-asserted baseline privacy tier.
+export interface AccountModelInfo {
+  id: string;
+  tier: PrivacyTier;
+}
+
+// The set of tier strings pi-privacy defines (posture/tiers.ts). We only trust a
+// server-supplied tier if it's one of these — anything else falls back to a prefix
+// heuristic, so a server typo or older/newer server can never inject a bogus tier.
+const VALID_TIERS = new Set<PrivacyTier>([
+  "tee-verified",
+  "tee-unverified",
+  "local",
+  "zdr-enforced",
+  "zdr-policy",
+  "standard",
+]);
+
+// Baseline tier when the server doesn't (yet) send one. Honest-labeling rule: a
+// confidential-compute model is only *claimed* here (tee-unverified) — the picker
+// upgrades it to tee-verified live via attestation (accountPosture). Everything
+// else with no server signal is "standard": we don't assert ZDR we can't back.
+function tierFromPrefix(modelId: string): PrivacyTier {
+  return modelId.startsWith("near/") || modelId.startsWith("tinfoil/") ? "tee-unverified" : "standard";
+}
+
+function normalizeTier(tier: string | undefined, modelId: string): PrivacyTier {
+  return tier && VALID_TIERS.has(tier as PrivacyTier) ? (tier as PrivacyTier) : tierFromPrefix(modelId);
+}
+
+// Baseline tiers for the account catalog, keyed by modelId. Populated by
+// fetchAccountCatalog() so the /models picker can shield each row without re-fetching.
+// A live NEAR attestation (accountPosture) can still upgrade a row to tee-verified.
+const accountTierMap = new Map<string, PrivacyTier>();
+
+// The server-asserted baseline tier for an account model, or undefined if we haven't
+// seen it in a catalog fetch. Used by the /models picker (privateer-models.ts).
+export function accountBaselineTier(modelId: string): PrivacyTier | undefined {
+  return accountTierMap.get(modelId);
+}
+
+// Whether a catalog fetch has populated the tier map at least once. The /models
+// picker uses this to decide if it must fetch before opening (first-open race with
+// the provider's background fetch) vs. render immediately from the cached tiers.
+export function accountCatalogLoaded(): boolean {
+  return accountTierMap.size > 0;
+}
+
+// Fetch the account channel's enabled model catalog WITH per-model privacy tiers.
+// `GET /api/models` is the server's public list of billable models
+// (`{ models: [{ modelId, privacy: { tier } }] }`) — the same set the app shows.
+// (The `/api/agent/v1` base only implements chat/completions, no /models route.)
+// Falls back to DEFAULT_MODELS (prefix-derived tiers) on any failure. Side effect:
+// refreshes accountTierMap.
+export async function fetchAccountCatalog(): Promise<AccountModelInfo[]> {
+  const fallback = (): AccountModelInfo[] =>
+    DEFAULT_MODELS.map((id) => ({ id, tier: tierFromPrefix(id) }));
+  let infos: AccountModelInfo[];
   try {
     const res = await fetch(`${serverBaseUrl()}/api/models`);
-    if (!res.ok) return DEFAULT_MODELS;
-    const data = (await res.json()) as { models?: { modelId?: string }[] };
-    const ids = (data.models ?? []).map((m) => m.modelId).filter((x): x is string => !!x);
-    return ids.length ? ids : DEFAULT_MODELS;
+    if (!res.ok) {
+      infos = fallback();
+    } else {
+      const data = (await res.json()) as {
+        models?: { modelId?: string; privacy?: { tier?: string } }[];
+      };
+      const parsed = (data.models ?? [])
+        .map((m) => (m.modelId ? { id: m.modelId, tier: normalizeTier(m.privacy?.tier, m.modelId) } : null))
+        .filter((x): x is AccountModelInfo => !!x);
+      infos = parsed.length ? parsed : fallback();
+    }
   } catch {
-    return DEFAULT_MODELS;
+    infos = fallback();
   }
+  accountTierMap.clear();
+  for (const info of infos) accountTierMap.set(info.id, info.tier);
+  return infos;
+}
+
+// Back-compat id-only view over fetchAccountCatalog (registerProvider only needs ids).
+export async function fetchAccountModels(): Promise<string[]> {
+  return (await fetchAccountCatalog()).map((m) => m.id);
 }
 
 // The Pi OAuth provider (Omit<OAuthProviderInterface, "id"> — Pi supplies the id from
@@ -199,8 +267,10 @@ export function makeAccountProvider() {
         models: ids.map(seedModel),
       });
     register(DEFAULT_MODELS); // immediate: provider exists this tick
-    void fetchAccountModels()
-      .then((ids) => ids.length && register(ids)) // refine to the live catalog
+    // Refine to the live catalog. fetchAccountCatalog also populates accountTierMap
+    // as a side effect, so the /models picker can shield each row without re-fetching.
+    void fetchAccountCatalog()
+      .then((infos) => infos.length && register(infos.map((m) => m.id)))
       .catch(() => {
         /* keep the fallback model */
       });

package/src/providers/defaultModel.ts

@@ -16,11 +16,19 @@ import { hasCredentials } from "../auth/privateer.ts";
 import { agentDir } from "../config/paths.ts";
 
 // The signed-in default: a NEAR confidential-compute (TEE, attestable) model — the
-// strongest privacy tier, and the same id the app shows first. Kept here as the one
-// definition; providers/account.ts imports it so its seed catalog can't drift.
+// strongest privacy tier the account channel offers, and the same id the app shows
+// first. Kept here as the one definition; providers/account.ts imports it so its seed
+// catalog can't drift.
 export const ACCOUNT_DEFAULT_MODEL_ID = "near/zai-org/GLM-5.1-FP8";
 export const ACCOUNT_DEFAULT_SPEC = `privateer/${ACCOUNT_DEFAULT_MODEL_ID}`;
 
+// Tinfoil's GLM 5.2 — CLIENT-side-attested TEE inference (the live TLS key is bound to
+// the enclave's quote), the strongest privacy tier we offer, stronger than the account's
+// server-proxied NEAR channel. Preferred whenever a Tinfoil key is present. Kept as the
+// one definition so bin/privateer-tui and this resolver agree. See extensions/privateer-
+// privacy.ts, which registers `tinfoil/glm-5-2` (and friends) on the tinfoil provider.
+export const TINFOIL_DEFAULT_SPEC = "tinfoil/glm-5-2";
+
 // Last-resort BYO default, preserved from the pre-resolver code so a user who set an
 // OpenRouter key (and isn't signed in) keeps the old behaviour. If they have no key
 // either, this still surfaces the familiar "No API key found for openrouter" — a clear
@@ -48,12 +56,14 @@ export interface ResolveDefaultModelOptions {
 
 // Resolve the model spec ("provider/id") to use when no model is named. Pure and
 // synchronous (only reads env + the credentials file), so it's safe to call from any
-// entry point at startup. Precedence:
+// entry point at startup. Precedence (mirrors bin/privateer-tui's launch logic, so the
+// launcher, the REPL, and the next-launch seed all agree):
 //   1. explicit user choice (config/channel)      — deliberate, always wins
 //   2. PRIVATEER_MODEL env                         — dev/global override
-//   3. signed into Privateer → the account default — the fix: subscription users
-//   4. a BYO provider whose key is present         — anthropic, openai, openrouter
-//   5. LEGACY_BYO_FALLBACK                          — familiar "add a key" signal
+//   3. Tinfoil key present → Tinfoil GLM 5.2       — strongest (client-attested) privacy
+//   4. signed into Privateer → the account default — subscription users, no BYO key
+//   5. a BYO provider whose key is present         — anthropic, openai, openrouter
+//   6. LEGACY_BYO_FALLBACK                          — familiar "add a key" signal
 export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): string {
   const env = opts.env ?? process.env;
 
@@ -63,6 +73,10 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
   const fromEnv = env.PRIVATEER_MODEL?.trim();
   if (fromEnv) return fromEnv;
 
+  // Privacy-first: a Tinfoil key means we can run verifiable TEE inference right now,
+  // which we prefer even over the account's NEAR channel — same order the launcher uses.
+  if (env.TINFOIL_API_KEY?.trim()) return TINFOIL_DEFAULT_SPEC;
+
   const signedIn = opts.signedIn ?? hasCredentials();
   if (signedIn) return ACCOUNT_DEFAULT_SPEC;
 
@@ -73,6 +87,17 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
   return LEGACY_BYO_FALLBACK;
 }
 
+// The confidential model to switch the LIVE session onto the moment a user signs in.
+// A terminal launched with no credentials is pinned by `--model` to the keyless
+// OpenRouter fallback; without an in-session switch it stays there and the first prompt
+// after /login dead-ends on "No API key found for openrouter". This resolves the model
+// sign-in should activate RIGHT AWAY: Tinfoil GLM 5.2 when a key is present, otherwise
+// the account's NEAR confidential channel (billable to the subscription, no BYO key).
+// PRIVATEER_MODEL still wins — a deliberate override is never stomped.
+export function resolveSignedInModel(env: NodeJS.ProcessEnv = process.env): string {
+  return resolveDefaultModel({ env, signedIn: true });
+}
+
 // Split a "provider/id" spec on its first slash (model ids themselves contain "/", so
 // only the first delimiter separates provider from model). Returns null for a spec
 // with no provider prefix.

package/src/ui/palette.ts

@@ -0,0 +1,135 @@
+// Shared terminal-colour palettes — the one place that decides how Privateer's CLI
+// surfaces paint on a light vs dark terminal. Two audiences:
+//
+//   1. Pi extensions (brand banner, posture badge, remote-access footer) run inside
+//      Pi's TUI, which ALREADY auto-detects the terminal background (OSC 11 / COLORFGBG)
+//      and picks a light or dark theme. They get a live `Theme` (via ctx.ui.setHeader's
+//      factory arg or ctx.ui.theme), so paletteFor(theme) reads the theme's semantic
+//      colours — dark ink on a light bg, light ink on a dark bg — instead of a fixed
+//      colour. That's the fix for the old "everything painted white → invisible on a
+//      white terminal" bug.
+//
+//   2. The lean standalone REPL (src/cli/chat.ts) runs its OWN readline loop with no Pi
+//      TUI and therefore no Theme. It detects the scheme itself from COLORFGBG and picks
+//      a matching CliPalette — on a light bg, explicit 256-colour indices that are
+//      guaranteed high-contrast (a pale terminal yellow on white is the classic
+//      unreadable case), on a dark bg the standard named colours it always used.
+//
+// IMPORT-SAFETY: this module imports NOTHING (no Pi, no node builtins beyond the ambient
+// process global), so it's safe to load from boot-ordered entrypoints — see boot.ts's
+// ORDERING CONTRACT. `theme` is typed `any` because the whole extension layer treats Pi
+// objects loosely and we don't want a Pi type import here.
+
+// ── SGR primitives ───────────────────────────────────────────────────────────
+// 256-color (8-bit), NOT 24-bit truecolor: macOS Terminal.app mangles truecolor. These
+// indices are universally supported.
+const ESC = "\x1b[";
+export const RESET = `${ESC}0m`;
+export const BOLD = `${ESC}1m`;
+const c = (n: number): string => `${ESC}38;5;${n}m`;
+
+// ── theme-derived palette (Pi extensions) ────────────────────────────────────
+export type Palette = {
+  RESET: string;
+  BOLD: string;
+  INK: string; // primary readable text (wordmark body, version, paths, labels)
+  ACCENT: string; // brand accent (marks, highlights, codes, command hints)
+  BORDER: string; // frames / box drawing
+  DIM: string; // secondary / muted prose
+  GREEN: string; // success (connected, verified, context loaded)
+  YELLOW: string; // warning (not-signed-in, unconfirmed, update available)
+};
+
+// Last-resort palette for when no theme is reachable (headless surfaces have no banner,
+// and any Pi new enough to render UI exposes the theme — so this is belt-and-suspenders).
+// Kept white so behaviour on a dark terminal is unchanged if the theme lookup ever fails.
+export const FALLBACK: Palette = {
+  RESET,
+  BOLD,
+  INK: c(231),
+  ACCENT: c(231),
+  BORDER: c(231),
+  DIM: `${ESC}90m`,
+  GREEN: `${ESC}32m`,
+  YELLOW: `${ESC}33m`,
+};
+
+// Build a Palette from a Pi Theme. getFgAnsi(name) returns the raw SGR foreground escape
+// for a theme colour; every lookup falls back to the white default so a theme missing a
+// given colour name can never blank a surface.
+export function paletteFor(theme: any): Palette {
+  if (!theme || typeof theme.getFgAnsi !== "function") return FALLBACK;
+  const g = (name: string, fallback: string): string => {
+    try {
+      const a = theme.getFgAnsi(name);
+      return typeof a === "string" && a.length > 0 ? a : fallback;
+    } catch {
+      return fallback;
+    }
+  };
+  return {
+    RESET,
+    BOLD,
+    INK: g("text", FALLBACK.INK),
+    ACCENT: g("accent", FALLBACK.ACCENT),
+    BORDER: g("border", FALLBACK.BORDER),
+    DIM: g("dim", FALLBACK.DIM),
+    GREEN: g("success", FALLBACK.GREEN),
+    YELLOW: g("warning", FALLBACK.YELLOW),
+  };
+}
+
+// ── standalone REPL palette (no Pi Theme) ────────────────────────────────────
+export type TerminalScheme = "light" | "dark";
+
+export type CliPalette = {
+  RESET: string;
+  BOLD: string;
+  DIM: string;
+  GREEN: string;
+  YELLOW: string;
+  RED: string;
+  CYAN: string; // used as the REPL's accent (prompts, app-relay echoes)
+};
+
+// Dark bg: the standard named SGR colours the REPL always used — the terminal maps them
+// to its own readable palette.
+const CLI_DARK: CliPalette = {
+  RESET,
+  BOLD,
+  DIM: `${ESC}2m`,
+  GREEN: `${ESC}32m`,
+  YELLOW: `${ESC}33m`,
+  RED: `${ESC}31m`,
+  CYAN: `${ESC}36m`,
+};
+
+// Light bg: explicit dark 256-colour indices so contrast doesn't depend on the terminal's
+// ANSI palette (a pale terminal yellow/cyan on white is unreadable; faint `2m` washes
+// out). These are all mid-to-dark tones that read cleanly on white.
+const CLI_LIGHT: CliPalette = {
+  RESET,
+  BOLD,
+  DIM: c(243), // solid medium gray instead of faint
+  GREEN: c(28), // dark green
+  YELLOW: c(130), // dark amber (plain 33m is invisible-pale on white)
+  RED: c(124), // dark red
+  CYAN: c(24), // dark teal-blue accent
+};
+
+// Detect the terminal background from COLORFGBG (set by many terminals as "fg;bg", the
+// last field being the background ANSI index). 7/15 = light; everything else — or no
+// COLORFGBG at all — defaults to dark, matching the REPL's historical assumption.
+export function detectScheme(env: Record<string, string | undefined> = process.env): TerminalScheme {
+  const fgbg = env.COLORFGBG;
+  if (fgbg) {
+    const parts = fgbg.split(";");
+    const bg = parseInt(parts[parts.length - 1], 10);
+    if (!Number.isNaN(bg)) return bg === 7 || bg === 15 ? "light" : "dark";
+  }
+  return "dark";
+}
+
+export function cliPalette(scheme: TerminalScheme = detectScheme()): CliPalette {
+  return scheme === "light" ? CLI_LIGHT : CLI_DARK;
+}