privateer-agent 0.5.1 → 0.6.1

package/bin/privateer-launch.mjs

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+// Cross-platform Privateer launcher — the single source of launch logic for every
+// platform (macOS, Linux, Windows). `bin/privateer-tui` (unix) and the Windows
+// `privateer.cmd` are thin shims that just pick a Node and run THIS file.
+//
+// It boots Pi's full interactive TUI with the Privateer moat + tool packs. The moat
+// is installed as re-export SHIMS in the agent dir's extensions/, so BOTH this TUI
+// and any subagents it spawns (child processes reading the same agent dir) load the
+// identical set — including our permission gate. One source of truth via discovery
+// (no `-e`, which would double-load vs discovery). Runs in the current directory;
+// model via PRIVATEER_MODEL=provider/id.
+//
+// Ported from the original bash launcher; behaviour is intended to match exactly.
+
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
+const REPO = path.resolve(HERE, "..");
+const isWin = process.platform === "win32";
+
+const PRIVATEER_HOME = process.env.PRIVATEER_HOME || path.join(os.homedir(), ".privateer");
+const ENV_FILE = path.join(REPO, ".env"); // dev-only; a real install has none
+
+// --- bundle detection ------------------------------------------------------
+// A self-contained bundle ships its own pinned Node at "$REPO/node[.exe]" plus a
+// BUNDLE_INFO.json marker (built by scripts/build-bundle.mjs). When present we use
+// that runtime and never touch system node/npm. Putting the bundle dir on PATH also
+// lets any child that boots via `#!/usr/bin/env node` (Pi's cli.js, the subagent
+// wrapper) resolve the bundled node.
+const bundledNode = path.join(REPO, isWin ? "node.exe" : "node");
+const BUNDLED = fs.existsSync(bundledNode) && fs.existsSync(path.join(REPO, "BUNDLE_INFO.json"));
+
+// The node used for child processes. When bundled, the bundled runtime; otherwise the
+// very node already running this script (a suitable >=22, since we booted under it).
+const NODE_BIN = BUNDLED ? bundledNode : process.execPath;
+// Make sure the chosen node's directory is on PATH for shebang-spawned grandchildren.
+process.env.PATH = path.dirname(NODE_BIN) + path.delimiter + (process.env.PATH || "");
+
+const args = process.argv.slice(2);
+const sub = args[0];
+
+// `privateer --version` — report OUR version, not Pi's. Left to Pi's cli.js it would
+// print the pi-coding-agent version (e.g. 0.80.3); intercept so users see the
+// Privateer release they installed. (The startup banner already shows this version.)
+if (sub === "--version" || sub === "-V") {
+  const ver = (p) => { try { return JSON.parse(fs.readFileSync(p, "utf8")).version; } catch { return null; } };
+  const pv = ver(path.join(REPO, "package.json")) || "unknown";
+  const pi = ver(path.join(REPO, "node_modules", "@earendil-works", "pi-coding-agent", "package.json"));
+  console.log(`privateer ${pv}${pi ? ` (pi ${pi})` : ""}`);
+  process.exit(0);
+}
+
+// Faithfully propagate a child's exit/signal, mirroring bash `exec`.
+function runToCompletion(cmd, cmdArgs, opts = {}) {
+  const child = spawn(cmd, cmdArgs, { stdio: "inherit", env: process.env, ...opts });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    else process.exit(code ?? 0);
+  });
+  child.on("error", (e) => {
+    console.error(`privateer: failed to launch — ${e.message}`);
+    process.exit(1);
+  });
+}
+
+// --- `privateer update` ----------------------------------------------------
+// Fetch the latest release and exit. Bundle installs re-run the download+extract
+// installer; npm installs update the global package.
+if (sub === "update") {
+  if (BUNDLED) {
+    console.log("Updating Privateer to the latest release…");
+    if (isWin) {
+      runToCompletion("powershell", ["-NoProfile", "-Command", "irm https://privateer.pro/install.ps1 | iex"]);
+    } else {
+      runToCompletion("sh", ["-c", "curl -fsSL https://privateer.pro/install.sh | sh"]);
+    }
+  } else {
+    console.log("Updating privateer-agent to the latest release…");
+    runToCompletion(isWin ? "npm.cmd" : "npm", ["install", "-g", "privateer-agent@latest"]);
+  }
+  // runToCompletion exits via the child's exit handler.
+}
+
+// --- `privateer daemon [run|install|uninstall|status]` ---------------------
+// The resident background daemon (routines + app-driven headless task spawns). Boots
+// straight into src/daemon via bin/privateer-daemon.mjs — no moat-shim install (the
+// daemon loads the moat as in-code factories, not interactive extensions).
+else if (sub === "daemon") {
+  const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
+  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-daemon.mjs"), ...args.slice(1)]);
+}
+
+// --- normal launch: install the moat, then exec Pi's TUI -------------------
+else {
+  const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");
+  const EXT_DIR = path.join(AGENT_DIR, "extensions");
+  fs.mkdirSync(EXT_DIR, { recursive: true });
+
+  // Install/refresh the moat + tool-pack shims. Each shim re-exports its target by
+  // ABSOLUTE path (as a file:// URL, portable across OSes) so the target's own
+  // relative imports resolve from the repo. We remove any shim we previously managed
+  // first, so a dropped package can't linger and reload.
+  const MANAGED = [
+    "privateer-brand", "privateer-context", "privateer-gate", "privateer-account",
+    "privateer-models", "privateer-posture", "privateer-tools", "privateer-privacy",
+    "pi-privacy", "pi-web-access", "rpiv-web-tools", "pi-mcp-adapter", "pi-hypa", "pi-subagents",
+  ];
+  for (const name of MANAGED) fs.rmSync(path.join(EXT_DIR, `${name}.ts`), { force: true });
+
+  const ext = (...p) => path.join(REPO, "extensions", ...p);
+  const dep = (...p) => path.join(REPO, "node_modules", ...p);
+  const shim = (name, target) =>
+    fs.writeFileSync(path.join(EXT_DIR, `${name}.ts`), `export { default } from ${JSON.stringify(pathToFileURL(target).href)};\n`);
+
+  shim("privateer-brand", ext("privateer-brand.ts"));       // banner, ⚓ badge, /signin /signout
+  shim("privateer-context", ext("privateer-context.ts"));   // PRIVATEER.md context + /init
+  shim("privateer-gate", ext("privateer-gate.ts"));         // the permission gate (moat)
+  shim("privateer-account", ext("privateer-account.ts"));
+  shim("privateer-models", ext("privateer-models.ts"));     // /models picker w/ privacy shields
+  shim("privateer-posture", ext("privateer-posture.ts"));
+  shim("privateer-tools", ext("privateer-tools.ts"));
+  shim("privateer-privacy", ext("privateer-privacy.ts"));   // pi-privacy + account tier resolver
+  shim("rpiv-web-tools", dep("@juicesharp", "rpiv-web-tools", "index.ts")); // private web tools
+  shim("pi-mcp-adapter", dep("pi-mcp-adapter", "index.ts"));
+  shim("pi-hypa", dep("@hypabolic", "pi-hypa", "extensions", "index.ts"));
+  shim("pi-subagents", dep("pi-subagents", "src", "extension", "index.ts"));
+
+  const CLI = dep("@earendil-works", "pi-coding-agent", "dist", "cli.js");
+  process.env.PI_CODING_AGENT_DIR = AGENT_DIR;
+  // The binary pi-subagents spawns for each child. Point it at OUR cli.js so the child
+  // reads this same PI_CODING_AGENT_DIR and DISCOVERS the moat shims (gated + private,
+  // no -e injection). Set only when unset so a power user can override.
+  if (!process.env.PI_SUBAGENT_PI_BINARY) process.env.PI_SUBAGENT_PI_BINARY = CLI;
+  // Suppress Pi's upstream update banner (our banner is the startup surface). Disables
+  // ONLY the version fetch — fd/rg can still download on first run.
+  if (!process.env.PI_SKIP_VERSION_CHECK) process.env.PI_SKIP_VERSION_CHECK = "1";
+
+  // Quiet Pi's built-in startup chatter so our banner is the only greeting. Each key is
+  // set only when unset, so a user's own settings.json toggle still wins.
+  try {
+    const sp = path.join(AGENT_DIR, "settings.json");
+    let s = {};
+    try { s = JSON.parse(fs.readFileSync(sp, "utf8")); } catch { /* new/absent */ }
+    let m = false;
+    if (s.quietStartup === undefined) { s.quietStartup = true; m = true; }
+    if (s.collapseChangelog === undefined) { s.collapseChangelog = true; m = true; }
+    if (s.lastChangelogVersion === undefined) { s.lastChangelogVersion = "9999.0.0"; m = true; }
+    if (m) fs.writeFileSync(sp, JSON.stringify(s, null, 2) + "\n");
+  } catch { /* best-effort */ }
+
+  // Passive update check: refresh the cached "latest version" at most ~daily, in the
+  // background so it never blocks or breaks launch (offline-safe). The banner reads
+  // this cache and shows a "↑ vX available · run privateer update" notice. We never
+  // auto-install. Fire-and-forget: the event loop stays alive while the TUI child runs.
+  refreshUpdateCache();
+
+  // Default model. Explicit PRIVATEER_MODEL wins; else Tinfoil GLM 5.2 (client-attested
+  // TEE, strongest tier) when a Tinfoil key is present; else the signed-in account's
+  // NEAR channel; else a cheap OpenRouter fallback.
+  const CRED = path.join(PRIVATEER_HOME, "credentials.json");
+  const MODEL = process.env.PRIVATEER_MODEL
+    ? process.env.PRIVATEER_MODEL
+    : haveTinfoilKey()
+      ? "tinfoil/glm-5-2"
+      : fs.existsSync(CRED)
+        ? "privateer/near/zai-org/GLM-5.1-FP8"
+        : "openrouter/openai/gpt-4o-mini";
+
+  // Dev convenience: load provider keys from the repo's .env if present.
+  const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
+  runToCompletion(NODE_BIN, [...nodeArgs, CLI, "--model", MODEL, ...args]);
+}
+
+// --- helpers ---------------------------------------------------------------
+function haveTinfoilKey() {
+  if (process.env.TINFOIL_API_KEY) return true;
+  try { return /^TINFOIL_API_KEY=.+/m.test(fs.readFileSync(ENV_FILE, "utf8")); }
+  catch { return false; }
+}
+
+function refreshUpdateCache() {
+  const cache = path.join(PRIVATEER_HOME, "update-check.json");
+  try {
+    const stat = fs.statSync(cache);
+    if (Date.now() - stat.mtimeMs < 24 * 60 * 60 * 1000) return; // fresh (<1 day)
+  } catch { /* missing — refresh */ }
+
+  const write = (latest) => {
+    if (!/^[0-9]/.test(latest || "")) return;
+    try {
+      fs.mkdirSync(PRIVATEER_HOME, { recursive: true });
+      fs.writeFileSync(cache, JSON.stringify({ latest }) + "\n");
+    } catch { /* best-effort */ }
+  };
+
+  if (BUNDLED) {
+    // No npm in a bundle — read the latest tag off GitHub Releases.
+    fetch("https://api.github.com/repos/privateer-agent/privateer-agent/releases/latest", {
+      headers: { "User-Agent": "privateer-cli", Accept: "application/vnd.github+json" },
+    })
+      .then((r) => (r.ok ? r.json() : null))
+      .then((j) => write(String(j?.tag_name || "").replace(/^v/, "")))
+      .catch(() => { /* offline — keep stale cache */ });
+  } else {
+    const p = spawn(isWin ? "npm.cmd" : "npm", ["view", "privateer-agent", "version"], {
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    let out = "";
+    p.stdout.on("data", (d) => { out += d; });
+    p.on("close", () => write(out.trim()));
+    p.on("error", () => { /* no npm — ignore */ });
+    p.unref();
+  }
+}

package/bin/privateer-tui

@@ -1,15 +1,10 @@
 #!/usr/bin/env bash
-# Launch Pi's full interactive TUI with the Privateer moat + tool packs. The moat is
-# installed as re-export SHIMS in the agent dir's extensions/, so BOTH this TUI and
-# any subagents it spawns (which run as child `pi` processes reading the agent dir)
-# load the identical set — including our permission gate. So subagent tool calls are
-# gated too (the gate runs bypass-within-restricted-tools headlessly; danger.ts still
-# blocks destructive shell). One source of truth via discovery — no -e (which would
-# double-load vs discovery).
-#
-# Runs in the current directory. Model via PRIVATEER_MODEL=provider/id.
+# Thin unix shim: pick a Node, then hand off to the cross-platform launcher
+# (bin/privateer-launch.mjs), which is the single source of launch logic shared with
+# the Windows privateer.cmd. All the real work — moat-shim install, model pick,
+# update/daemon dispatch, exec into Pi's TUI — lives in the launcher.
 set -euo pipefail
-# Resolve through symlinks so REPO points at the real repo, not the symlink dir.
+# Resolve through symlinks so REPO points at the real bundle/repo dir.
 SOURCE="${BASH_SOURCE[0]}"
 while [ -h "$SOURCE" ]; do
   DIR="$(cd -P "$(dirname "$SOURCE")" && pwd)"
@@ -18,16 +13,9 @@ while [ -h "$SOURCE" ]; do
 done
 REPO="$(cd -P "$(dirname "$SOURCE")/.." && pwd)"
 
-# `privateer update` — pull the latest release from npm and exit. Handled here in the
-# launcher (not the TUI) so it works even when a broken install won't boot. npm rewrites
-# the global bin in place; replacing it while this process runs is safe on unix.
-if [ "${1:-}" = "update" ]; then
-  echo "Updating privateer-agent to the latest release…"
-  npm install -g privateer-agent@latest
-  exit $?
-fi
-
+# Bundled runtime wins; else a system node >=22; else an nvm node; else PATH `node`.
 pick_node() {
+  if [ -x "$REPO/node" ] && [ -f "$REPO/BUNDLE_INFO.json" ]; then echo "$REPO/node"; return; fi
   if command -v node >/dev/null 2>&1 \
      && node -e 'process.exit((+process.versions.node.split(".")[0]) >= 22 ? 0 : 1)' 2>/dev/null; then
     command -v node; return
@@ -38,127 +26,4 @@ pick_node() {
   echo "node"
 }
 
-# `privateer daemon [run|install|uninstall|status]` — the resident background daemon
-# (routines + app-driven headless task spawns). Handled HERE, before the Pi TUI exec
-# and before the moat-shim install (the daemon doesn't need the interactive extension
-# set), so it boots straight into src/daemon via bin/privateer-daemon.mjs.
-if [ "${1:-}" = "daemon" ]; then
-  shift
-  DAEMON_NODE="$(pick_node)"
-  DAEMON_ENV_ARGS=""
-  [ -f "$REPO/.env" ] && DAEMON_ENV_ARGS="--env-file=$REPO/.env"
-  exec "$DAEMON_NODE" ${DAEMON_ENV_ARGS:+"$DAEMON_ENV_ARGS"} "$REPO/bin/privateer-daemon.mjs" "$@"
-fi
-
-AGENT_DIR="${PRIVATEER_HOME:-$HOME/.privateer}/agent"
-EXT_DIR="$AGENT_DIR/extensions"
-mkdir -p "$EXT_DIR"
-
-# Install/refresh the moat + tool-pack shims. Each shim re-exports its target by
-# ABSOLUTE path so the target's own relative imports resolve from the repo (a plain
-# symlink would resolve them relative to the shim's location and break). We remove
-# any shim we previously managed first, so a dropped package can't linger and reload.
-MANAGED="privateer-brand privateer-context privateer-gate privateer-account privateer-models privateer-posture privateer-tools privateer-privacy pi-privacy pi-web-access rpiv-web-tools pi-mcp-adapter pi-hypa pi-subagents"
-for name in $MANAGED; do rm -f "$EXT_DIR/$name.ts"; done
-shim() { printf 'export { default } from "%s";\n' "$2" > "$EXT_DIR/$1.ts"; }
-# Branding + the account sign-in surface (banner, ⚓ badge, /signin /signout).
-shim privateer-brand   "$REPO/extensions/privateer-brand.ts"
-# PRIVATEER.md project-context loading (like AGENTS.md/CLAUDE.md) + the /init command.
-shim privateer-context "$REPO/extensions/privateer-context.ts"
-shim privateer-gate    "$REPO/extensions/privateer-gate.ts"
-shim privateer-account "$REPO/extensions/privateer-account.ts"
-# The /models picker — searchable model selector with per-row privacy shields
-# (TEE / ZDR / standard). Pi's built-in /model is redirected here by the
-# patch-package patch (patches/@earendil-works+pi-coding-agent+*.patch).
-shim privateer-models  "$REPO/extensions/privateer-models.ts"
-shim privateer-posture "$REPO/extensions/privateer-posture.ts"
-shim privateer-tools   "$REPO/extensions/privateer-tools.ts"
-# pi-privacy wrapped with the account-channel tier resolver (privateer/near… = TEE),
-# so it replaces loading pi-privacy's default entry.
-shim privateer-privacy "$REPO/extensions/privateer-privacy.ts"
-# Privacy-aligned web tools: pluggable backends (SearXNG self-hosted = private; no
-# WebView). Pick the backend with /web-tools, or set SEARXNG_URL. Replaces
-# pi-web-access (opened a WebView + defaulted to Exa, a 3rd-party search).
-shim rpiv-web-tools    "$REPO/node_modules/@juicesharp/rpiv-web-tools/index.ts"
-shim pi-mcp-adapter    "$REPO/node_modules/pi-mcp-adapter/index.ts"
-shim pi-hypa           "$REPO/node_modules/@hypabolic/pi-hypa/extensions/index.ts"
-shim pi-subagents      "$REPO/node_modules/pi-subagents/src/extension/index.ts"
-
-CLI="$REPO/node_modules/@earendil-works/pi-coding-agent/dist/cli.js"
-export PI_CODING_AGENT_DIR="$AGENT_DIR"
-# The binary pi-subagents spawns for each subagent child. Without this it falls back
-# to `pi` on PATH (getPiSpawnCommand) — which a Privateer install does NOT provide, so
-# every subagent spawn would fail with ENOENT. Point it at OUR bundled cli.js (it's
-# executable, `#!/usr/bin/env node`): the child then reads this same PI_CODING_AGENT_DIR
-# and DISCOVERS the moat shims above — so subagents run gated + private, no -e injection
-# (hence no double-load). Set only when unset so a power user can override it.
-export PI_SUBAGENT_PI_BINARY="${PI_SUBAGENT_PI_BINARY:-$CLI}"
-# Suppress Pi's upstream "Update Available — run `pi update`" banner. It's noise on a
-# Privateer install (our banner is the startup surface), it leaks the "pi" name, and
-# `pi update` would fight our npm-managed install. PI_SKIP_VERSION_CHECK disables ONLY
-# the version fetch — unlike PI_OFFLINE it still lets fd/rg download on first run.
-export PI_SKIP_VERSION_CHECK=1
-NODE_BIN="$(pick_node)"
-
-# Quiet Pi's built-in startup chatter so our banner is the only greeting. Each key is
-# set only when unset, so a user's own settings.json toggle (or --verbose) still wins:
-#   quietStartup       — hide the [Extensions]/[Context]/[Skills]/… resource listing
-#   collapseChangelog  — never dump Pi's "What's New" changelog wall into the chat
-#   lastChangelogVersion — sentinel so Pi finds no "new" entries to show on upgrade;
-#                          release notes live in the npm README / GitHub releases instead
-"$NODE_BIN" -e '
-const fs = require("fs"), p = process.argv[1];
-let s = {}; try { s = JSON.parse(fs.readFileSync(p, "utf8")); } catch {}
-let m = false;
-if (s.quietStartup === undefined) { s.quietStartup = true; m = true; }
-if (s.collapseChangelog === undefined) { s.collapseChangelog = true; m = true; }
-if (s.lastChangelogVersion === undefined) { s.lastChangelogVersion = "9999.0.0"; m = true; }
-if (m) fs.writeFileSync(p, JSON.stringify(s, null, 2) + "\n");
-' "$AGENT_DIR/settings.json" 2>/dev/null || true
-
-# Passive update check: refresh the cached "latest npm version" at most ~daily, in the
-# BACKGROUND so it never blocks or breaks launch (offline-safe — a failed fetch just
-# leaves the stale cache in place). The banner (privateer-brand) reads this cache and
-# shows a one-line "↑ vX available · run privateer update" notice when we're behind. We
-# never auto-install — the user stays in control of when new code lands (the whole point
-# of an attestable tool). Detached with </dev/null &, so it outlives our exec into node.
-UPDATE_CACHE="${PRIVATEER_HOME:-$HOME/.privateer}/update-check.json"
-if [ -z "$(find "$UPDATE_CACHE" -mtime -1 2>/dev/null)" ]; then
-  (
-    latest="$(npm view privateer-agent version 2>/dev/null || true)"
-    case "$latest" in
-      [0-9]*) printf '{"latest":"%s"}\n' "$latest" > "$UPDATE_CACHE.tmp" 2>/dev/null \
-                && mv -f "$UPDATE_CACHE.tmp" "$UPDATE_CACHE" 2>/dev/null ;;
-    esac
-  ) </dev/null >/dev/null 2>&1 &
-fi
-
-# Default model. An explicit PRIVATEER_MODEL always wins. Otherwise prefer Tinfoil's
-# GLM 5.2 when a Tinfoil key is available: verifiable TEE inference with CLIENT-side
-# attestation (the live TLS key is bound to the enclave's quote), the strongest privacy
-# tier we offer — stronger than the account's server-proxied NEAR channel. Failing that,
-# use the signed-in Privateer account's NEAR confidential-compute channel; with neither,
-# fall back to a cheap OpenRouter model. The Tinfoil key may sit in the ambient env or in
-# the dev .env the launcher loads below, so check both.
-CRED="${PRIVATEER_HOME:-$HOME/.privateer}/credentials.json"
-have_tinfoil_key() {
-  [ -n "${TINFOIL_API_KEY:-}" ] && return 0
-  [ -f "$REPO/.env" ] && grep -qE '^TINFOIL_API_KEY=.+' "$REPO/.env"
-}
-if [ -n "${PRIVATEER_MODEL:-}" ]; then
-  MODEL="$PRIVATEER_MODEL"
-elif have_tinfoil_key; then
-  MODEL="tinfoil/glm-5-2"
-elif [ -f "$CRED" ]; then
-  MODEL="privateer/near/zai-org/GLM-5.1-FP8"
-else
-  MODEL="openrouter/openai/gpt-4o-mini"
-fi
-
-# Dev convenience: load provider keys from the repo's .env if present. A real install
-# has none — so only pass the flag when the file exists (using --env-file-if-exists
-# unconditionally would print "…/.env not found. Continuing without it." on every
-# launch, muddying the startup banner). No .env → rely on the ambient environment.
-ENV_ARGS=""
-[ -f "$REPO/.env" ] && ENV_ARGS="--env-file=$REPO/.env"
-exec "$NODE_BIN" ${ENV_ARGS:+"$ENV_ARGS"} "$CLI" --model "$MODEL" "$@"
+exec "$(pick_node)" "$REPO/bin/privateer-launch.mjs" "$@"

package/bin/privateer.cmd

@@ -0,0 +1,6 @@
+@echo off
+REM Windows entry point for a Privateer bundle. Mirrors the unix bin/privateer-tui
+REM shim: run the bundled Node against the shared cross-platform launcher. %~dp0 is
+REM this file's dir (<app>\bin\), so ..\node.exe is the bundled runtime.
+"%~dp0..\node.exe" "%~dp0privateer-launch.mjs" %*
+exit /b %errorlevel%

package/extensions/privateer-brand.ts

@@ -24,7 +24,9 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import * as priv from "../src/auth/privateer.ts";
 import { makeAccountProvider } from "../src/providers/account.ts";
+import { resolveSignedInModel } from "../src/providers/defaultModel.ts";
 import { discoverContextFiles, onContextChanged } from "../src/context.ts";
+import { type Palette, paletteFor } from "../src/ui/palette.ts";
 
 const VERSION: string = (() => {
   try {
@@ -34,37 +36,26 @@ const VERSION: string = (() => {
   }
 })();
 
-// ── palette (Privateer brand) ────────────────────────────────────────────────
-// 256-color (8-bit), NOT 24-bit truecolor: macOS Terminal.app doesn't support
-// truecolor and mangles it (the old indigo/cyan came out green). These indices are
-// universally supported. Navy (the logo mark) is too dark to read on a dark terminal, so
-// the whole banner — silhouette, wordmark, frame, and accents — is painted white: a clean
-// single-color mark, like the logo but legible on dark.
-const ESC = "\x1b[";
-const RESET = `${ESC}0m`;
-const BOLD = `${ESC}1m`;
-const c = (n: number): string => `${ESC}38;5;${n}m`;
-const OCEAN = c(231); // white (#ffffff) — anchor / wordmark "P"
-const OCEAN_LIGHT = c(231); // white (#ffffff) — wordmark, version, path
-const BORDER = c(231); // white (#ffffff) — the frame
-const DIM = `${ESC}90m`;
-const GREEN = `${ESC}32m`;
-const YELLOW = `${ESC}33m`;
+// The banner paints from Pi's ACTIVE theme (paletteFor, in src/ui/palette.ts) rather
+// than a fixed colour. It used to hardcode everything to white (256-color 231) "because
+// navy is too dark on a dark terminal" — which inverts the problem on a LIGHT terminal
+// (white-on-white → the whole mark, wordmark, and frame vanish). Pi auto-detects the
+// terminal background and picks a light or dark theme; ctx.ui.setHeader hands our factory
+// that live Theme (and ctx.ui.theme exposes it to the sign-in widget), so the banner's
+// colours resolve to dark ink on a light bg and light ink on a dark bg.
 
 // The Privateer mark: our symbol — a padlock (with a keyhole) fused into an anchor,
 // "bring your own model" meets lock-and-key privacy — drawn from the app's logo. It's
-// rendered with terminal HALF-BLOCKS, so each text row packs TWO pixel rows: a "▀"
-// whose FOREGROUND paints the top pixel and BACKGROUND the bottom (one pixel → "▀"/"▄"
-// on the default bg; none → a plain space). 256-color indices only, same reason as the
-// palette above. Every built line is MARK_W visible cells wide (SGR escapes don't
-// count), so the text column beside it stays aligned. To redraw: edit PIXELS (each char
-// is a PX palette key), keeping every row MARK_W long and the row COUNT even — the
-// builder derives the escapes from that.
+// rendered with terminal HALF-BLOCKS, so each text row packs TWO pixel rows. The mark is
+// a SINGLE colour (every set pixel is the accent), so a cell never needs two different
+// colours: both pixels set → a full block "█", top only → "▀", bottom only → "▄", none →
+// a space — all painted with the accent as FOREGROUND, no background cells at all. That
+// makes the mark inherit the theme's ink (dark on light, light on dark) with one colour,
+// and sidesteps the old bg-bleed hazard entirely. Every built line is MARK_W visible
+// cells wide (SGR escapes don't count), so the text column beside it stays aligned. To
+// redraw: edit PIXELS (each char is "O" ink or "." transparent), keeping every row MARK_W
+// long and the row COUNT even — the builder pairs rows into half-block cells.
 const MARK_W = 12;
-const PX: Record<string, number | null> = {
-  ".": null, // transparent — the frame (and the knocked-out keyhole) shows through
-  O: 231, // white (#ffffff, top of the 256-color cube) — the silhouette, a clean single-color mark
-};
 // 12 wide; an EVEN number of rows so they pair cleanly into half-block cells. Two blank
 // leading rows give the lock a little headroom without dropping the whole mark too low.
 // A small padlock rides on top as the anchor's ring: a narrow rounded shackle over an
@@ -83,26 +74,27 @@ const PIXELS = [
   ".OO..OO..OO.", "..OO.OO.OO..",
   "..OOOOOOOO..", "...OOOOOO...", "....OOOO....", ".....OO.....",
 ];
-// Build the mark once at load. Each cell resets SGR so a background color can never
-// bleed into the row padding the framer adds after it.
-const MARK: string[] = (() => {
+// Build the mark for a given palette (the accent is the ink). Cheap — called once per
+// header factory invocation, i.e. once per theme, not per frame. Each cell resets SGR so
+// the accent can never bleed into the row padding the framer adds after it.
+function buildMark(p: Palette): string[] {
   const rows: string[] = [];
   for (let r = 0; r < PIXELS.length; r += 2) {
     const top = PIXELS[r];
     const bot = PIXELS[r + 1] ?? ".".repeat(MARK_W);
     let line = "";
     for (let x = 0; x < MARK_W; x++) {
-      const t = PX[top[x]];
-      const bcol = PX[bot[x]];
-      if (t == null && bcol == null) line += " ";
-      else if (t != null && bcol != null) line += `${ESC}38;5;${t}m${ESC}48;5;${bcol}m▀${RESET}`;
-      else if (t != null) line += `${ESC}38;5;${t}m▀${RESET}`;
-      else line += `${ESC}38;5;${bcol}m▄${RESET}`;
+      const t = top[x] === "O";
+      const b = bot[x] === "O";
+      if (t && b) line += `${p.ACCENT}█${p.RESET}`;
+      else if (t) line += `${p.ACCENT}▀${p.RESET}`;
+      else if (b) line += `${p.ACCENT}▄${p.RESET}`;
+      else line += " ";
     }
     rows.push(line);
   }
   return rows;
-})();
+}
 
 // Visible width = characters after stripping SGR escapes. Everything we render inside
 // the box is ASCII or a BMP width-1 symbol, so a plain length is exact here.
@@ -140,16 +132,16 @@ function shortCwd(): string {
 //  - signed out AND the current model bills to a Privateer account → it can't run
 //    until they sign in, so say so plainly (warning)
 //  - signed out on their own key            → a quiet tease that /login adds more
-function accountLine(modelProvider?: string): string {
+function accountLine(p: Palette, modelProvider?: string): string {
   const u = priv.currentUser();
   if (u) {
     const label = clean(u.email ?? (u.solanaPublicKey ? u.solanaPublicKey.slice(0, 6) + "…" : u.id));
-    return `${GREEN}connected${DIM} as ${RESET}${OCEAN_LIGHT}${label}${RESET}`;
+    return `${p.GREEN}connected${p.DIM} as ${p.RESET}${p.INK}${label}${p.RESET}`;
   }
   if (modelProvider === "privateer") {
-    return `${YELLOW}not signed in · /login to use this model${RESET}`;
+    return `${p.YELLOW}not signed in · /login to use this model${p.RESET}`;
   }
-  return `${DIM}not signed in · ${OCEAN_LIGHT}/login${DIM} to connect your account${RESET}`;
+  return `${p.DIM}not signed in · ${p.INK}/login${p.DIM} to connect your account${p.RESET}`;
 }
 
 // Is dotted version `a` newer than `b`? Plain numeric compare of major.minor.patch —
@@ -167,12 +159,12 @@ function isNewer(a: string, b: string): boolean {
 // The "update available" banner line, or "" when we're current / offline / unchecked.
 // Reads the cache the launcher refreshes in the background (see bin/privateer-tui) —
 // never fetches here, so the banner stays synchronous and never blocks on the network.
-function updateNotice(): string {
+function updateNotice(p: Palette): string {
   try {
     const home = process.env.PRIVATEER_HOME || join(homedir(), ".privateer");
     const { latest } = JSON.parse(readFileSync(join(home, "update-check.json"), "utf8"));
     if (typeof latest === "string" && isNewer(latest, VERSION)) {
-      return `${YELLOW}↑ v${latest} available${DIM} · run ${RESET}${OCEAN_LIGHT}privateer update${RESET}`;
+      return `${p.YELLOW}↑ v${latest} available${p.DIM} · run ${p.RESET}${p.INK}privateer update${p.RESET}`;
     }
   } catch {
     // no cache yet, unreadable, or malformed — show nothing.
@@ -184,16 +176,16 @@ function updateNotice(): string {
 // loaded (so the moat's "the agent knows this project" state is visible), otherwise a
 // quiet tease that /init scaffolds one. Reads the filesystem at render time, so it
 // reflects the current cwd and updates after /init (via onContextChanged → refresh).
-function contextLine(): string {
+function contextLine(p: Palette): string {
   const files = discoverContextFiles();
   if (files.length === 0) {
-    return `${DIM}no PRIVATEER.md · ${OCEAN_LIGHT}/init${DIM} to add project context${RESET}`;
+    return `${p.DIM}no PRIVATEER.md · ${p.INK}/init${p.DIM} to add project context${p.RESET}`;
   }
   // Show the nearest (deepest, wins-last) file's path; note any additional ancestors
   // with a "+N" so the header stays one line but the count isn't hidden.
   const nearest = shortPath(files[files.length - 1].path);
-  const more = files.length > 1 ? `${DIM} +${files.length - 1}${RESET}` : "";
-  return `${GREEN}⚓${DIM} ${RESET}${OCEAN_LIGHT}${nearest}${RESET}${more}`;
+  const more = files.length > 1 ? `${p.DIM} +${files.length - 1}${p.RESET}` : "";
+  return `${p.GREEN}⚓${p.DIM} ${p.RESET}${p.INK}${nearest}${p.RESET}${more}`;
 }
 
 // ── "What's New" — a tiny in-banner changelog ────────────────────────────────
@@ -206,11 +198,11 @@ const WHATS_NEW: Array<{ text: string; cmd?: string }> = [
   { text: "Self-update built in —", cmd: "privateer update" },
 ];
 
-function whatsNewRows(): string[] {
-  const head = `${BOLD}${OCEAN_LIGHT}✦ What's new${RESET}`;
+function whatsNewRows(p: Palette): string[] {
+  const head = `${p.BOLD}${p.INK}✦ What's new${p.RESET}`;
   const items = WHATS_NEW.map(
     ({ text, cmd }) =>
-      `${OCEAN}·${RESET} ${DIM}${text}${RESET}${cmd ? ` ${OCEAN_LIGHT}${cmd}${RESET}` : ""}`,
+      `${p.ACCENT}·${p.RESET} ${p.DIM}${text}${p.RESET}${cmd ? ` ${p.INK}${cmd}${p.RESET}` : ""}`,
   );
   return [head, ...items];
 }
@@ -220,51 +212,55 @@ function whatsNewRows(): string[] {
 // mark), so we zip by row index and pad the short side — every text-only row lands in
 // the same column as the rows beside the mark. One place owns the left gutter, so
 // spacing can't drift between the mark rows and the trailing rows.
-function renderBanner(width: number, modelProvider?: string): string[] {
+function renderBanner(width: number, p: Palette, mark: string[], modelProvider?: string): string[] {
   // Right column, top to bottom. The two leading blanks drop the wordmark down so it
   // sits beside the lock body (not the shackle); the rest follows in reading order.
   const text: string[] = [
     "",
-    `${BOLD}${OCEAN_LIGHT}✻ ${OCEAN}P${OCEAN_LIGHT}RIVATEER${RESET}${DIM}   privateer-agent ${OCEAN_LIGHT}v${VERSION}${RESET}`,
-    `${DIM}Chart your own course privately.${RESET}`,
+    `${p.BOLD}${p.ACCENT}✻ ${p.ACCENT}P${p.INK}RIVATEER${p.RESET}${p.DIM}   privateer-agent ${p.INK}v${VERSION}${p.RESET}`,
+    `${p.DIM}Chart your own course privately.${p.RESET}`,
     "",
-    accountLine(modelProvider),
-    `${OCEAN_LIGHT}${shortCwd()}${RESET}`,
-    contextLine(),
+    accountLine(p, modelProvider),
+    `${p.INK}${shortCwd()}${p.RESET}`,
+    contextLine(p),
   ];
-  const notice = updateNotice();
+  const notice = updateNotice(p);
   if (notice) text.push(notice);
   // A blank spacer, then the What's New block — set off below the identity lines.
-  text.push("", ...whatsNewRows());
+  text.push("", ...whatsNewRows(p));
 
   // Zip the mark and the text column by row. Rows past the mark's height get a blank
   // gutter of the mark's width, so the text stays in one column throughout.
   const gap = "  ";
-  const height = Math.max(MARK.length, text.length);
+  const height = Math.max(mark.length, text.length);
   const rows: string[] = [];
   for (let i = 0; i < height; i++) {
     // The mark lines already carry their own per-pixel colors, so we don't wrap them.
-    const left = i < MARK.length ? MARK[i] : " ".repeat(MARK_W);
+    const left = i < mark.length ? mark[i] : " ".repeat(MARK_W);
     rows.push(`${left}${gap}${text[i] ?? ""}`.trimEnd());
   }
 
   const cap = Math.max(20, width - 4); // 2 border cells + 2 padding
   const inner = Math.min(cap, Math.max(...rows.map(vlen)));
   const bar = "─".repeat(inner + 2);
-  const out = [`${BORDER}╭${bar}╮${RESET}`];
+  const out = [`${p.BORDER}╭${bar}╮${p.RESET}`];
   for (const row of rows) {
     const pad = Math.max(0, inner - vlen(row));
-    out.push(`${BORDER}│${RESET} ${row}${" ".repeat(pad)} ${BORDER}│${RESET}`);
+    out.push(`${p.BORDER}│${p.RESET} ${row}${" ".repeat(pad)} ${p.BORDER}│${p.RESET}`);
   }
-  out.push(`${BORDER}╰${bar}╯${RESET}`);
+  out.push(`${p.BORDER}╰${bar}╯${p.RESET}`);
   return out;
 }
 
 // A Pi header Component (setHeader factory return). Static banner; captures the model
-// provider so the account line reflects the picked model.
-function headerComponent(modelProvider?: string) {
+// provider so the account line reflects the picked model, and the live theme so every
+// colour tracks the terminal background (dark ink on light, light ink on dark). The
+// palette and mark are resolved once here (per theme), not per frame.
+function headerComponent(theme: any, modelProvider?: string) {
+  const p = paletteFor(theme);
+  const mark = buildMark(p);
   return {
-    render: (width: number): string[] => renderBanner(width, modelProvider),
+    render: (width: number): string[] => renderBanner(width, p, mark, modelProvider),
     invalidate() {},
   };
 }
@@ -293,8 +289,12 @@ export default function privateerBrand(pi: any): void {
     }
   };
 
+  // Pi calls the factory with (tui, theme) — pass the live theme through so the banner
+  // paints from it. Falls back to ctx.ui.theme when a Pi build hands the factory no theme.
   const setHeader = (ctx: any) =>
-    ctx?.ui?.setHeader?.(() => headerComponent(currentModelProvider));
+    ctx?.ui?.setHeader?.((_tui: any, theme: any) =>
+      headerComponent(theme ?? ctx?.ui?.theme, currentModelProvider),
+    );
 
   const refresh = (ctx: any) => {
     dbg(`refresh: hasUI=${!!ctx?.hasUI} hasSetHeader=${typeof ctx?.ui?.setHeader} user=${priv.currentUser()?.email ?? null}`);
@@ -355,6 +355,7 @@ export default function privateerBrand(pi: any): void {
     }
     ctx?.ui?.notify?.("Connecting to Privateer — requesting a device code…", "info");
     try {
+      const p = paletteFor(ctx?.ui?.theme);
       const user = await priv.runDeviceLogin({
         onCode: (code: any) => {
           const uri = clean(code.verification_uri_complete ?? code.verification_uri ?? "");
@@ -362,11 +363,11 @@ export default function privateerBrand(pi: any): void {
           ctx?.ui?.setWidget?.(
             "privateer-signin",
             [
-              `${OCEAN_LIGHT}⚓ Sign in to Privateer${RESET}`,
-              `${DIM}Approve this terminal in the Privateer app:${RESET}`,
-              `   code   ${BOLD}${OCEAN}${userCode}${RESET}`,
-              uri ? `${DIM}   or open ${RESET}${OCEAN_LIGHT}${uri}${RESET}` : "",
-              `${DIM}   waiting for approval…${RESET}`,
+              `${p.INK}⚓ Sign in to Privateer${p.RESET}`,
+              `${p.DIM}Approve this terminal in the Privateer app:${p.RESET}`,
+              `   code   ${p.BOLD}${p.ACCENT}${userCode}${p.RESET}`,
+              uri ? `${p.DIM}   or open ${p.RESET}${p.INK}${uri}${p.RESET}` : "",
+              `${p.DIM}   waiting for approval…${p.RESET}`,
             ].filter(Boolean),
             { placement: "aboveEditor" },
           );
@@ -406,6 +407,47 @@ export default function privateerBrand(pi: any): void {
     );
   }
 
+  // Move the LIVE session onto a confidential model the instant the user signs in. A
+  // terminal launched with no credentials is pinned by `--model` to the keyless
+  // OpenRouter fallback; without this switch it stays there and the first prompt after
+  // sign-in dead-ends on "No API key found for openrouter". resolveSignedInModel picks
+  // Tinfoil GLM 5.2 (client-attested TEE) when a key is present, else the account's NEAR
+  // channel — private inference that works out of the box. We only override an auto-picked
+  // launch model, never a deliberate PRIVATEER_MODEL, and never re-switch if we're already
+  // on the target. The account (NEAR) credential is spawned moments AFTER sign-in fires,
+  // so setModel can briefly return false ("no key yet"); retry a few times so the switch
+  // lands as soon as the credential is ready (Tinfoil, key already in env, succeeds first
+  // try). Best-effort throughout — a failure just leaves the launch model in place.
+  async function activateSignedInModel(ctx: any): Promise<void> {
+    if (process.env.PRIVATEER_MODEL?.trim()) return; // deliberate override — respect it
+    const reg = ctx?.modelRegistry;
+    if (!reg?.find || typeof pi.setModel !== "function") return;
+    const spec = resolveSignedInModel();
+    const slash = spec.indexOf("/");
+    if (slash <= 0) return;
+    const provider = spec.slice(0, slash), id = spec.slice(slash + 1);
+    const currentSpec = ctx?.model ? `${ctx.model.provider}/${ctx.model.id}` : "";
+    if (currentSpec === spec) return; // already there — nothing to do
+    const model = reg.find(provider, id);
+    if (!model) { dbg(`activateSignedInModel: ${spec} not in registry`); return; }
+    for (let attempt = 0; attempt < 4; attempt++) {
+      try {
+        const ok = await pi.setModel(model);
+        if (ok !== false) {
+          currentModelProvider = provider;
+          refresh(ctx);
+          ctx?.ui?.notify?.(`Now using ${spec} for private inference.`, "info");
+          dbg(`activateSignedInModel: switched to ${spec}`);
+          return;
+        }
+      } catch (e) {
+        dbg(`activateSignedInModel: setModel threw ${(e as Error).message}`);
+      }
+      await new Promise((r) => setTimeout(r, 400)); // credential still spawning — retry
+    }
+    dbg(`activateSignedInModel: gave up switching to ${spec}`);
+  }
+
   dbg("extension loaded, onSignedIn listener registering");
 
   pi.on("session_start", (_e: any, ctx: any) => {
@@ -451,6 +493,9 @@ export default function privateerBrand(pi: any): void {
   priv.onSignedIn(() => {
     dbg(`onSignedIn fired; ctxRef=${ctxRef ? "set" : "null"}`);
     refresh(ctxRef);
+    // Activate a confidential model in the live session so the user can prompt right
+    // away instead of dead-ending on the keyless launch model. See activateSignedInModel.
+    void activateSignedInModel(ctxRef);
   });
 
   // /init (in privateer-context) just created or changed a PRIVATEER.md — re-render the

package/extensions/privateer-gate.ts

@@ -29,6 +29,7 @@ import { agentDir } from "../src/config/paths.ts";
 import { agentVersion } from "../src/config/version.ts";
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
 import * as priv from "../src/auth/privateer.ts";
+import { paletteFor } from "../src/ui/palette.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
 const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
@@ -221,7 +222,6 @@ function advertiseCommands(): { name: string; description?: string }[] {
 // driven from the phone — with a reminder that `/remote-access off` stops it. We
 // keep a UI handle (captured from session_start / the command ctx) so the relay's
 // own connect/disconnect callbacks can refresh the indicator, not just the command.
-const GREEN = "\x1b[32m", YELLOW = "\x1b[33m", DIM = "\x1b[2m", RESET = "\x1b[0m";
 const REMOTE_STATUS_KEY = "privateer:remote-access";
 let uiRef: any = null;
 // "off" → no indicator; "connecting" → relay starting or reconnecting (yellow);
@@ -235,10 +235,13 @@ function refreshRemoteStatus(): void {
     ui.setStatus(REMOTE_STATUS_KEY, undefined);
     return;
   }
+  // Paint from the active theme so the footer reads on a light terminal too (a bare
+  // green/yellow escape can wash out on white) — falls back to white on no theme.
+  const p = paletteFor(ui.theme);
   const text =
     remoteState === "connected"
-      ? `${GREEN}⟿ remote access${RESET} ${DIM}· /remote-access off to stop${RESET}`
-      : `${YELLOW}⟿ remote access · connecting…${RESET} ${DIM}· /remote-access off to stop${RESET}`;
+      ? `${p.GREEN}⟿ remote access${p.RESET} ${p.DIM}· /remote-access off to stop${p.RESET}`
+      : `${p.YELLOW}⟿ remote access · connecting…${p.RESET} ${p.DIM}· /remote-access off to stop${p.RESET}`;
   ui.setStatus(REMOTE_STATUS_KEY, text);
 }
 

package/extensions/privateer-posture.ts

@@ -8,31 +8,28 @@
 
 import { verifyModelPosture, TIERS, type PrivacyTier } from "pi-privacy";
 import { accountPosture } from "../src/providers/account.ts";
+import { type Palette, paletteFor } from "../src/ui/palette.ts";
 
 const DOT: Record<string, string> = { green: "🟢", yellow: "🟡", red: "🔴", neutral: "⚪" };
 
-// ANSI so the shield "references the previous color": the TEE tiers used to show a
-// green/yellow traffic-light dot — now they show a shield tinted the same color
-// (green = verified, yellow = unconfirmed). The status bar renders these escapes.
-const GREEN = "\x1b[32m", YELLOW = "\x1b[33m", RESET = "\x1b[0m";
-
-// The TEE tiers render as a colored shield + "Trusted Execution" (pi-privacy labels
-// these "Verified TEE" / "TEE (unconfirmed)"; we rename to Trusted Execution for the
-// privateer badge and swap the dot for a shield). Everything else keeps the dot.
-function badgeLabel(tier: PrivacyTier): string | null {
-  if (tier === "tee-verified") return `${GREEN}⛉ Trusted Execution${RESET}`;
-  if (tier === "tee-unverified") return `${YELLOW}⛉ Trusted Execution (unconfirmed)${RESET}`;
+// The shield "references the previous color": the TEE tiers show a shield tinted like the
+// old traffic-light dot (green = verified, yellow = unconfirmed). The colours come from
+// the active theme (paletteFor) so the badge stays legible on a light terminal too — a
+// bare "\x1b[33m" yellow washes out on white. The status bar renders these escapes.
+function badgeLabel(tier: PrivacyTier, p: Palette): string | null {
+  if (tier === "tee-verified") return `${p.GREEN}⛉ Trusted Execution${p.RESET}`;
+  if (tier === "tee-unverified") return `${p.YELLOW}⛉ Trusted Execution (unconfirmed)${p.RESET}`;
   return null;
 }
 
-async function badgeFor(provider: string, modelId: string): Promise<string> {
+async function badgeFor(provider: string, modelId: string, p: Palette): Promise<string> {
   const res =
     provider === "privateer"
       ? await accountPosture(modelId)
       : await verifyModelPosture(provider, modelId, {
           apiKey: provider === "nearai" ? process.env.NEARAI_API_KEY ?? process.env.NEAR_AI_API_KEY : undefined,
         });
-  const shield = badgeLabel(res.tier as PrivacyTier);
+  const shield = badgeLabel(res.tier as PrivacyTier, p);
   if (shield) return shield;
   const info = TIERS[res.tier as PrivacyTier];
   return `${DOT[info.posture] ?? "⚪"} ${info.label}`;
@@ -46,7 +43,7 @@ export default function privateerPosture(pi: any): void {
     const mine = ++seq;
     try {
       ctx.ui.setStatus("privacy", "⛉ …"); // immediate placeholder while attesting
-      const badge = await badgeFor(provider, modelId);
+      const badge = await badgeFor(provider, modelId, paletteFor(ctx?.ui?.theme));
       if (mine === seq) ctx.ui.setStatus("privacy", badge);
     } catch {
       if (mine === seq) ctx.ui.setStatus("privacy", undefined);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -48,14 +48,14 @@
     "dev": "tsx watch src/main.ts",
     "typecheck": "tsc --noEmit",
     "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done",
-    "postinstall": "patch-package"
+    "postinstall": "patch-package --error-on-fail"
   },
   "engines": {
     "node": ">=22.19.0"
   },
   "dependencies": {
     "@earendil-works/pi-ai": "^0.80.3",
-    "@earendil-works/pi-coding-agent": "^0.80.3",
+    "@earendil-works/pi-coding-agent": "0.80.3",
     "@earendil-works/pi-tui": "^0.80.3",
     "@hypabolic/pi-hypa": "^0.1.6",
     "@juicesharp/rpiv-web-tools": "^1.20.0",

package/src/cli/chat.ts

@@ -10,9 +10,14 @@
 
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { fileURLToPath } from "node:url"; // builtin, safe pre-boot
+import { cliPalette } from "../ui/palette.ts"; // no Pi deps → safe pre-boot
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 
-const RESET = "\x1b[0m", DIM = "\x1b[2m", CYAN = "\x1b[36m", YELLOW = "\x1b[33m", RED = "\x1b[31m", GREEN = "\x1b[32m";
+// This lean REPL has no Pi TUI (and so no Theme), so it detects the terminal background
+// itself (COLORFGBG) and picks a palette — on a light terminal the standard "\x1b[33m"
+// yellow / "\x1b[36m" cyan and faint "\x1b[2m" dim wash out, so cliPalette swaps in dark
+// 256-colour indices there. On a dark terminal it's the same named colours as before.
+const { RESET, DIM, CYAN, YELLOW, RED, GREEN } = cliPalette();
 
 async function main() {
   const readline = await import("node:readline");
@@ -34,7 +39,7 @@ async function main() {
   const priv = await import("../auth/privateer.ts");
   const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
-  const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
+  const { resolveDefaultModel, resolveSignedInModel } = await import("../providers/defaultModel.ts");
 
   // resolveDefaultModel() already honours PRIVATEER_MODEL first, then the account
   // default when signed in, then a BYO key — one source of truth (defaultModel.ts).
@@ -470,6 +475,14 @@ async function main() {
         },
       });
       console.log(`${GREEN}Signed in as ${user.email ?? user.id}.${RESET}`);
+      // Move the live session onto a confidential model right away, so the next prompt
+      // doesn't dead-end on the keyless launch model ("No API key found for openrouter").
+      // resolveSignedInModel prefers Tinfoil GLM 5.2, else the account's NEAR channel;
+      // PRIVATEER_MODEL (a deliberate override) is respected and left alone.
+      if (!process.env.PRIVATEER_MODEL?.trim()) {
+        const target = resolveSignedInModel();
+        if (target !== currentSpec) await switchModel(target, false);
+      }
     } catch (e) {
       console.log(`${RED}${(e as Error).message}${RESET}`);
     }

package/src/providers/defaultModel.ts

@@ -16,11 +16,19 @@ import { hasCredentials } from "../auth/privateer.ts";
 import { agentDir } from "../config/paths.ts";
 
 // The signed-in default: a NEAR confidential-compute (TEE, attestable) model — the
-// strongest privacy tier, and the same id the app shows first. Kept here as the one
-// definition; providers/account.ts imports it so its seed catalog can't drift.
+// strongest privacy tier the account channel offers, and the same id the app shows
+// first. Kept here as the one definition; providers/account.ts imports it so its seed
+// catalog can't drift.
 export const ACCOUNT_DEFAULT_MODEL_ID = "near/zai-org/GLM-5.1-FP8";
 export const ACCOUNT_DEFAULT_SPEC = `privateer/${ACCOUNT_DEFAULT_MODEL_ID}`;
 
+// Tinfoil's GLM 5.2 — CLIENT-side-attested TEE inference (the live TLS key is bound to
+// the enclave's quote), the strongest privacy tier we offer, stronger than the account's
+// server-proxied NEAR channel. Preferred whenever a Tinfoil key is present. Kept as the
+// one definition so bin/privateer-tui and this resolver agree. See extensions/privateer-
+// privacy.ts, which registers `tinfoil/glm-5-2` (and friends) on the tinfoil provider.
+export const TINFOIL_DEFAULT_SPEC = "tinfoil/glm-5-2";
+
 // Last-resort BYO default, preserved from the pre-resolver code so a user who set an
 // OpenRouter key (and isn't signed in) keeps the old behaviour. If they have no key
 // either, this still surfaces the familiar "No API key found for openrouter" — a clear
@@ -48,12 +56,14 @@ export interface ResolveDefaultModelOptions {
 
 // Resolve the model spec ("provider/id") to use when no model is named. Pure and
 // synchronous (only reads env + the credentials file), so it's safe to call from any
-// entry point at startup. Precedence:
+// entry point at startup. Precedence (mirrors bin/privateer-tui's launch logic, so the
+// launcher, the REPL, and the next-launch seed all agree):
 //   1. explicit user choice (config/channel)      — deliberate, always wins
 //   2. PRIVATEER_MODEL env                         — dev/global override
-//   3. signed into Privateer → the account default — the fix: subscription users
-//   4. a BYO provider whose key is present         — anthropic, openai, openrouter
-//   5. LEGACY_BYO_FALLBACK                          — familiar "add a key" signal
+//   3. Tinfoil key present → Tinfoil GLM 5.2       — strongest (client-attested) privacy
+//   4. signed into Privateer → the account default — subscription users, no BYO key
+//   5. a BYO provider whose key is present         — anthropic, openai, openrouter
+//   6. LEGACY_BYO_FALLBACK                          — familiar "add a key" signal
 export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): string {
   const env = opts.env ?? process.env;
 
@@ -63,6 +73,10 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
   const fromEnv = env.PRIVATEER_MODEL?.trim();
   if (fromEnv) return fromEnv;
 
+  // Privacy-first: a Tinfoil key means we can run verifiable TEE inference right now,
+  // which we prefer even over the account's NEAR channel — same order the launcher uses.
+  if (env.TINFOIL_API_KEY?.trim()) return TINFOIL_DEFAULT_SPEC;
+
   const signedIn = opts.signedIn ?? hasCredentials();
   if (signedIn) return ACCOUNT_DEFAULT_SPEC;
 
@@ -73,6 +87,17 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
   return LEGACY_BYO_FALLBACK;
 }
 
+// The confidential model to switch the LIVE session onto the moment a user signs in.
+// A terminal launched with no credentials is pinned by `--model` to the keyless
+// OpenRouter fallback; without an in-session switch it stays there and the first prompt
+// after /login dead-ends on "No API key found for openrouter". This resolves the model
+// sign-in should activate RIGHT AWAY: Tinfoil GLM 5.2 when a key is present, otherwise
+// the account's NEAR confidential channel (billable to the subscription, no BYO key).
+// PRIVATEER_MODEL still wins — a deliberate override is never stomped.
+export function resolveSignedInModel(env: NodeJS.ProcessEnv = process.env): string {
+  return resolveDefaultModel({ env, signedIn: true });
+}
+
 // Split a "provider/id" spec on its first slash (model ids themselves contain "/", so
 // only the first delimiter separates provider from model). Returns null for a spec
 // with no provider prefix.

package/src/ui/palette.ts

@@ -0,0 +1,135 @@
+// Shared terminal-colour palettes — the one place that decides how Privateer's CLI
+// surfaces paint on a light vs dark terminal. Two audiences:
+//
+//   1. Pi extensions (brand banner, posture badge, remote-access footer) run inside
+//      Pi's TUI, which ALREADY auto-detects the terminal background (OSC 11 / COLORFGBG)
+//      and picks a light or dark theme. They get a live `Theme` (via ctx.ui.setHeader's
+//      factory arg or ctx.ui.theme), so paletteFor(theme) reads the theme's semantic
+//      colours — dark ink on a light bg, light ink on a dark bg — instead of a fixed
+//      colour. That's the fix for the old "everything painted white → invisible on a
+//      white terminal" bug.
+//
+//   2. The lean standalone REPL (src/cli/chat.ts) runs its OWN readline loop with no Pi
+//      TUI and therefore no Theme. It detects the scheme itself from COLORFGBG and picks
+//      a matching CliPalette — on a light bg, explicit 256-colour indices that are
+//      guaranteed high-contrast (a pale terminal yellow on white is the classic
+//      unreadable case), on a dark bg the standard named colours it always used.
+//
+// IMPORT-SAFETY: this module imports NOTHING (no Pi, no node builtins beyond the ambient
+// process global), so it's safe to load from boot-ordered entrypoints — see boot.ts's
+// ORDERING CONTRACT. `theme` is typed `any` because the whole extension layer treats Pi
+// objects loosely and we don't want a Pi type import here.
+
+// ── SGR primitives ───────────────────────────────────────────────────────────
+// 256-color (8-bit), NOT 24-bit truecolor: macOS Terminal.app mangles truecolor. These
+// indices are universally supported.
+const ESC = "\x1b[";
+export const RESET = `${ESC}0m`;
+export const BOLD = `${ESC}1m`;
+const c = (n: number): string => `${ESC}38;5;${n}m`;
+
+// ── theme-derived palette (Pi extensions) ────────────────────────────────────
+export type Palette = {
+  RESET: string;
+  BOLD: string;
+  INK: string; // primary readable text (wordmark body, version, paths, labels)
+  ACCENT: string; // brand accent (marks, highlights, codes, command hints)
+  BORDER: string; // frames / box drawing
+  DIM: string; // secondary / muted prose
+  GREEN: string; // success (connected, verified, context loaded)
+  YELLOW: string; // warning (not-signed-in, unconfirmed, update available)
+};
+
+// Last-resort palette for when no theme is reachable (headless surfaces have no banner,
+// and any Pi new enough to render UI exposes the theme — so this is belt-and-suspenders).
+// Kept white so behaviour on a dark terminal is unchanged if the theme lookup ever fails.
+export const FALLBACK: Palette = {
+  RESET,
+  BOLD,
+  INK: c(231),
+  ACCENT: c(231),
+  BORDER: c(231),
+  DIM: `${ESC}90m`,
+  GREEN: `${ESC}32m`,
+  YELLOW: `${ESC}33m`,
+};
+
+// Build a Palette from a Pi Theme. getFgAnsi(name) returns the raw SGR foreground escape
+// for a theme colour; every lookup falls back to the white default so a theme missing a
+// given colour name can never blank a surface.
+export function paletteFor(theme: any): Palette {
+  if (!theme || typeof theme.getFgAnsi !== "function") return FALLBACK;
+  const g = (name: string, fallback: string): string => {
+    try {
+      const a = theme.getFgAnsi(name);
+      return typeof a === "string" && a.length > 0 ? a : fallback;
+    } catch {
+      return fallback;
+    }
+  };
+  return {
+    RESET,
+    BOLD,
+    INK: g("text", FALLBACK.INK),
+    ACCENT: g("accent", FALLBACK.ACCENT),
+    BORDER: g("border", FALLBACK.BORDER),
+    DIM: g("dim", FALLBACK.DIM),
+    GREEN: g("success", FALLBACK.GREEN),
+    YELLOW: g("warning", FALLBACK.YELLOW),
+  };
+}
+
+// ── standalone REPL palette (no Pi Theme) ────────────────────────────────────
+export type TerminalScheme = "light" | "dark";
+
+export type CliPalette = {
+  RESET: string;
+  BOLD: string;
+  DIM: string;
+  GREEN: string;
+  YELLOW: string;
+  RED: string;
+  CYAN: string; // used as the REPL's accent (prompts, app-relay echoes)
+};
+
+// Dark bg: the standard named SGR colours the REPL always used — the terminal maps them
+// to its own readable palette.
+const CLI_DARK: CliPalette = {
+  RESET,
+  BOLD,
+  DIM: `${ESC}2m`,
+  GREEN: `${ESC}32m`,
+  YELLOW: `${ESC}33m`,
+  RED: `${ESC}31m`,
+  CYAN: `${ESC}36m`,
+};
+
+// Light bg: explicit dark 256-colour indices so contrast doesn't depend on the terminal's
+// ANSI palette (a pale terminal yellow/cyan on white is unreadable; faint `2m` washes
+// out). These are all mid-to-dark tones that read cleanly on white.
+const CLI_LIGHT: CliPalette = {
+  RESET,
+  BOLD,
+  DIM: c(243), // solid medium gray instead of faint
+  GREEN: c(28), // dark green
+  YELLOW: c(130), // dark amber (plain 33m is invisible-pale on white)
+  RED: c(124), // dark red
+  CYAN: c(24), // dark teal-blue accent
+};
+
+// Detect the terminal background from COLORFGBG (set by many terminals as "fg;bg", the
+// last field being the background ANSI index). 7/15 = light; everything else — or no
+// COLORFGBG at all — defaults to dark, matching the REPL's historical assumption.
+export function detectScheme(env: Record<string, string | undefined> = process.env): TerminalScheme {
+  const fgbg = env.COLORFGBG;
+  if (fgbg) {
+    const parts = fgbg.split(";");
+    const bg = parseInt(parts[parts.length - 1], 10);
+    if (!Number.isNaN(bg)) return bg === 7 || bg === 15 ? "light" : "dark";
+  }
+  return "dark";
+}
+
+export function cliPalette(scheme: TerminalScheme = detectScheme()): CliPalette {
+  return scheme === "light" ? CLI_LIGHT : CLI_DARK;
+}