privateer-agent 0.6.3 → 0.6.6

package/README.md

@@ -133,6 +133,26 @@ curl -fsSL https://privateer.pro/install.sh | sh
 
 **Requirements:** macOS or Linux, Node.js ≥ 22.19.0.
 
+### Verifying what you're about to run
+
+Privateer is a coding agent — it runs shell commands and edits files, so "should I trust
+this package?" is the right question to ask before `npx`. Two things are checkable
+without taking anyone's word for it:
+
+```bash
+npm view privateer-agent dist.attestations   # published from CI with npm provenance:
+                                             # a signed link from this tarball to the
+                                             # exact commit and build that produced it
+npm audit signatures                         # verify registry signatures + provenance
+```
+
+The package also declares **no install scripts** — no `postinstall`, nothing. Installing
+it writes files and executes nothing; `npm install -g privateer-agent --ignore-scripts`
+gives an identical result. Code runs only when you run `privateer`.
+
+See [SECURITY.md](SECURITY.md) for the threat model, the permission gate, and how to
+report a vulnerability.
+
 **From source:**
 
 ```bash
@@ -248,6 +268,21 @@ redactor before it leaves.
 Switch with **`/mode`**. Even in `bypass`, a danger filter blocks destructive shell commands,
 and protected files (`.env`, shell rc files…) are guarded — the gate is never fully off.
 
+### `--no-quarter` — lower the moat entirely
+
+For an unattended run in a directory and on a task you fully trust, launch with:
+
+```bash
+privateer --no-quarter
+```
+
+This is the one exception to "the gate is never fully off." It disables the permission
+gate for the **whole session** — every action auto-approves with no prompt, including
+destructive shell commands, out-of-cwd access, and protected files. Subagents spawned
+by the session inherit it. There is no `/mode` equivalent; it's a deliberate launch-time
+opt-out (env `PRIVATEER_NO_QUARTER=1`) and prints a red warning banner so it's never a
+surprise. Use it sparingly.
+
 ## Extend it
 
 Everything below is a **Pi extension** loaded by discovery (see [Built on Pi](#built-on-pi)) —

package/SECURITY.md

@@ -0,0 +1,54 @@
+# Security
+
+## Reporting a vulnerability
+
+Report privately via [GitHub Security Advisories](https://github.com/privateer-agent/privateer-agent/security/advisories/new),
+or email **support@privateer.pro**. Please don't open a public issue for anything
+exploitable. Expect an initial response within 72 hours.
+
+## What you're running
+
+Privateer is a terminal coding agent: it reads and writes files, runs shell commands and
+talks to model providers on your behalf. That is the point of it, and it is also the
+threat model. Two things are worth verifying rather than taking on faith.
+
+**The package runs no install scripts.** There is no `preinstall`, `install`,
+`postinstall` or `prepare` hook. `npm install -g privateer-agent` writes files and
+executes nothing; installing with `--ignore-scripts` produces an identical result. Code
+runs only when you run `privateer`. (Dependency patching happens at first launch — see
+`bin/apply-patches.mjs` and `docs/shipping.md`.)
+
+**Releases carry npm provenance.** Published from `.github/workflows/release.yml` with
+`npm publish --provenance`, so npm holds a signed Sigstore attestation binding the
+tarball to this repository, the exact commit and the workflow run that built it. The npm
+package page shows a verified *"Built and signed on GitHub Actions"* badge linking to
+the build. To check it yourself:
+
+```bash
+npm view privateer-agent dist.attestations   # attestation metadata exists
+npm audit signatures                          # verifies registry signatures + provenance
+```
+
+If a version lacks provenance, it did not come from this workflow. Treat that as
+suspicious and report it.
+
+## The permission gate
+
+By default every shell command, file write outside the working directory, and
+destructive tool call stops for explicit approval. This is the moat, and it is the main
+thing standing between a prompt-injected model and your filesystem.
+
+`--no-quarter` disables it entirely — every action runs unprompted. It exists for
+trusted, disposable environments (throwaway containers, CI). Do not use it on a machine
+whose contents you care about, and do not use it on a repository or task involving
+untrusted content: a coding agent reading an attacker-controlled file is a realistic
+injection path.
+
+## Keys and credentials
+
+Provider API keys and account credentials live under `~/.privateer/` on your machine and
+are sent only to the provider you selected. Bot tokens for messaging channels are sealed
+to a terminal keypair before they reach our relay, and channel configuration is verified
+against a link-pinned account key — the relay can neither read those tokens nor forge
+configuration. Architecture and residual risks are documented in
+`docs/daemon-channels-and-app.md`.

package/bin/apply-patches.d.mts

@@ -0,0 +1,18 @@
+// Types for the launcher's patch/resolve helpers. The implementation is plain .mjs
+// because bin/ must run under a bare `node` with no transpiler (the launcher is the
+// very first thing to execute, before tsx/jiti are in play).
+
+/** Directory CONTAINING the node_modules that holds `name`, or null if not installed. */
+export function findDepRoot(from: string, name: string): string | null;
+
+/** Absolute path to a file inside an installed dependency, or null if absent. */
+export function resolveDep(from: string, name: string, ...rest: string[]): string | null;
+
+/**
+ * Apply `patches/` into whichever node_modules the targets landed in. Idempotent and
+ * best-effort; see the implementation for why this runs at launch, not on install.
+ */
+export function applyPatchesIfNeeded(
+  repo: string,
+  nodeBin?: string,
+): "current" | "applied" | "skipped" | "failed";

package/bin/apply-patches.mjs

@@ -0,0 +1,143 @@
+// Apply the patches/ directory into node_modules — at LAUNCH, not at install.
+//
+// Why not a `postinstall` script (the obvious place)? Because `npm install` /
+// `npx privateer-agent` would then execute our code on the user's machine BEFORE
+// they ever decided to run Privateer. That is exactly the install-time-execution
+// risk a careful reviewer — human or agent — flags on an unfamiliar package, and
+// it is the one npm-side signal we can remove outright. With no install scripts,
+// `npm install -g privateer-agent --ignore-scripts` is completely inert: it writes
+// files and runs nothing. Patching moves to the first actual launch, which the
+// user explicitly asked for.
+//
+// Contract: idempotent, cheap on the hot path (a stamp file short-circuits every
+// launch after the first), and BEST-EFFORT — every patch here is a UX/robustness
+// improvement, never a correctness prerequisite, so a failure to apply degrades to
+// stock Pi behaviour rather than blocking launch. That matters for the common
+// `sudo npm install -g` case, where node_modules is root-owned and an unprivileged
+// launch simply cannot write to it.
+
+import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+// Bump when the applier's own semantics change, to force a re-apply on upgrade.
+const STAMP_VERSION = 1;
+
+/**
+ * Where do our patch targets actually live?
+ *
+ * NOT necessarily `<repo>/node_modules`. When Privateer is installed as a dependency
+ * (`npm i privateer-agent`, `npx privateer-agent`), npm HOISTS pi-coding-agent to the
+ * parent project's node_modules and leaves us with no node_modules of our own — so
+ * assuming a local one means the patches silently never apply. Resolve the real target
+ * from our own package instead, and return the directory that CONTAINS the node_modules
+ * it landed in: that is the cwd patch-package needs, in every layout (hoisted, nested,
+ * global, bundled).
+ */
+/**
+ * Find the directory CONTAINING the node_modules that holds `name`, starting at
+ * `from` and walking up. Returns null if the dependency isn't installed anywhere.
+ *
+ * This is the one resolution primitive both the launcher and the patcher need,
+ * because `<repo>/node_modules` is NOT where dependencies reliably live:
+ *   - `npm i -g privateer-agent`  -> nested:  <repo>/node_modules/<name>
+ *   - `npx privateer-agent`       -> hoisted: <repo>/../node_modules/<name>
+ *   - `npm i privateer-agent`     -> hoisted into the host project
+ * Hardcoding the nested case silently breaks every hoisted install.
+ *
+ * We walk directories rather than using require.resolve because modern packages
+ * (pi-coding-agent among them) declare an `exports` map with no "./package.json"
+ * entry, so require.resolve throws ERR_PACKAGE_PATH_NOT_EXPORTED even when the
+ * package is sitting right there. Directory lookup sees through `exports`.
+ */
+export function findDepRoot(from, name) {
+  const segs = name.split("/");
+  for (let dir = path.resolve(from); ; dir = path.dirname(dir)) {
+    if (fs.existsSync(path.join(dir, "node_modules", ...segs, "package.json"))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null; // hit the filesystem root
+  }
+}
+
+/** Absolute path to an installed dependency's file, or null if the dep isn't present. */
+export function resolveDep(from, name, ...rest) {
+  const root = findDepRoot(from, name);
+  return root ? path.join(root, "node_modules", ...name.split("/"), ...rest) : null;
+}
+
+function resolvePatchRoots(repo, patchFiles) {
+  const roots = new Set();
+  for (const file of patchFiles) {
+    // "@earendil-works+pi-coding-agent+0.80.3.patch" -> "@earendil-works/pi-coding-agent"
+    const parts = path.basename(file, ".patch").split("+");
+    const name = parts[0].startsWith("@") ? `${parts[0]}/${parts[1]}` : parts[0];
+    const root = findDepRoot(repo, name);
+    if (root) roots.add(root);
+  }
+  return [...roots];
+}
+
+/** sha256 over every patch file's name + contents — the identity of "what should be applied". */
+function patchSetHash(patchDir, files) {
+  const h = crypto.createHash("sha256").update(String(STAMP_VERSION));
+  for (const f of files) {
+    h.update(f);
+    h.update(fs.readFileSync(path.join(patchDir, f)));
+  }
+  return h.digest("hex");
+}
+
+/**
+ * Ensure patches/ is applied to repo/node_modules. Returns one of:
+ *   "current"   — already applied (stamp matches); nothing done
+ *   "applied"   — patches were just applied successfully
+ *   "skipped"   — nothing to do (no patches / no node_modules / patch-package absent)
+ *   "failed"    — apply was attempted and did not succeed (caller may warn)
+ */
+export function applyPatchesIfNeeded(repo, nodeBin = process.execPath) {
+  try {
+    repo = path.resolve(repo); // roots come back absolute; a relative repo would break path.relative
+    const patchDir = path.join(repo, "patches");
+    if (!fs.existsSync(patchDir)) return "skipped";
+    const patchFiles = fs.readdirSync(patchDir).filter((f) => f.endsWith(".patch")).sort();
+    if (patchFiles.length === 0) return "skipped";
+
+    const want = patchSetHash(patchDir, patchFiles);
+    const roots = resolvePatchRoots(repo, patchFiles);
+    if (roots.length === 0) return "skipped"; // targets not installed
+
+    // patch-package is a runtime dependency precisely so this works post-install.
+    const pp = resolveDep(repo, "patch-package", "index.js");
+    if (!pp || !fs.existsSync(pp)) return "skipped";
+
+    let did = false;
+    for (const root of roots) {
+      const stampFile = path.join(root, "node_modules", ".privateer-patches.json");
+      try {
+        if (JSON.parse(fs.readFileSync(stampFile, "utf8")).hash === want) continue; // current
+      } catch { /* missing or unreadable stamp — (re)apply */ }
+
+      // --patch-dir points at OUR patches even though cwd is wherever the deps landed.
+      // It MUST be relative: patch-package resolves it against cwd, so an absolute path
+      // is silently mangled into a non-existent one and every patch "fails" to apply.
+      const relPatchDir = path.relative(root, patchDir);
+      const r = spawnSync(nodeBin, [pp, "--error-on-fail", "--patch-dir", relPatchDir], {
+        cwd: root,
+        stdio: ["ignore", "ignore", "pipe"],
+        timeout: 60_000,
+        windowsHide: true,
+      });
+      if (r.status !== 0) return "failed";
+      did = true;
+
+      // Only stamp after a clean apply, so a partial/failed run retries next launch.
+      try {
+        fs.writeFileSync(stampFile, JSON.stringify({ hash: want, at: new Date().toISOString() }) + "\n");
+      } catch { /* unwritable node_modules — applied fine, we just re-check next launch */ }
+    }
+    return did ? "applied" : "current";
+  } catch {
+    return "failed";
+  }
+}

package/bin/privateer-launch.mjs

@@ -17,6 +17,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
 const REPO = path.resolve(HERE, "..");
@@ -41,6 +42,29 @@ const NODE_BIN = BUNDLED ? bundledNode : process.execPath;
 process.env.PATH = path.dirname(NODE_BIN) + path.delimiter + (process.env.PATH || "");
 
 const args = process.argv.slice(2);
+
+// `--no-quarter` — total permission bypass ("take no prisoners"). Strip it from the
+// args BEFORE anything else so it never reaches Pi's cli.js (which doesn't know it)
+// and so `sub`/`args.slice(1)` see only real subcommands. When present we export
+// PRIVATEER_NO_QUARTER=1; the permission gate (extensions/privateer-gate.ts, and any
+// subagent child that inherits this env) then auto-approves EVERY action with no
+// prompt — dangerous shell, destructive tools, out-of-cwd, protected files, all of
+// it. This is the moat fully lowered; only pass it when you trust the whole session.
+const NO_QUARTER = args.some((a) => a === "--no-quarter");
+if (NO_QUARTER) {
+  for (let i = args.length - 1; i >= 0; i--) if (args[i] === "--no-quarter") args.splice(i, 1);
+  process.env.PRIVATEER_NO_QUARTER = "1";
+  process.stderr.write(
+    [
+      "",
+      "  ⚓ \x1b[1;31mNo quarter\x1b[0m — permission gate DISABLED for this session.",
+      "     Every action (shell, edits, destructive tools, out-of-cwd) runs WITHOUT a prompt.",
+      "     Only use this in a directory and with a task you fully trust.",
+      "",
+    ].join("\n") + "\n",
+  );
+}
+
 const sub = args[0];
 
 // `privateer --version` — report OUR version, not Pi's. Left to Pi's cli.js it would
@@ -49,7 +73,8 @@ const sub = args[0];
 if (sub === "--version" || sub === "-V") {
   const ver = (p) => { try { return JSON.parse(fs.readFileSync(p, "utf8")).version; } catch { return null; } };
   const pv = ver(path.join(REPO, "package.json")) || "unknown";
-  const pi = ver(path.join(REPO, "node_modules", "@earendil-works", "pi-coding-agent", "package.json"));
+  const piPkg = resolveDep(REPO, "@earendil-works/pi-coding-agent", "package.json");
+  const pi = piPkg ? ver(piPkg) : null;
   console.log(`privateer ${pv}${pi ? ` (pi ${pi})` : ""}`);
   process.exit(0);
 }
@@ -103,6 +128,13 @@ else {
   // time the agent tries to run a command. Unix always has a shell, so this is a no-op.
   ensureShellOrExit();
 
+  // Apply our pi-coding-agent patches. This happens HERE, on a launch the user asked
+  // for, rather than in a postinstall — so installing the package runs no code at all.
+  // Stamped, so it's a single file read on every launch after the first. Best-effort:
+  // both patches are UX fixes, so a root-owned node_modules (sudo npm i -g) just means
+  // stock Pi behaviour, not a broken boot. Bundles ship pre-patched and no-op here.
+  ensurePatches();
+
   const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");
   const EXT_DIR = path.join(AGENT_DIR, "extensions");
   fs.mkdirSync(EXT_DIR, { recursive: true });
@@ -119,9 +151,17 @@ else {
   for (const name of MANAGED) fs.rmSync(path.join(EXT_DIR, `${name}.ts`), { force: true });
 
   const ext = (...p) => path.join(REPO, "extensions", ...p);
-  const dep = (...p) => path.join(REPO, "node_modules", ...p);
-  const shim = (name, target) =>
+  // Resolve dependencies by walking the node_modules chain, NOT as REPO/node_modules.
+  // npm only nests deps under us for a global install; `npx privateer-agent` and
+  // `npm i privateer-agent` HOIST them to a sibling/parent node_modules, where the
+  // hardcoded path resolves to nothing and every shim below points at a missing file.
+  const dep = (name, ...rest) => resolveDep(REPO, name, ...rest);
+  // A missing target means that optional tool pack isn't installed — skip its shim
+  // rather than writing one that points at nothing (which fails at extension load).
+  const shim = (name, target) => {
+    if (!target || !fs.existsSync(target)) return;
     fs.writeFileSync(path.join(EXT_DIR, `${name}.ts`), `export { default } from ${JSON.stringify(pathToFileURL(target).href)};\n`);
+  };
 
   shim("privateer-brand", ext("privateer-brand.ts"));       // banner, ⚓ badge, /signin /signout
   shim("privateer-context", ext("privateer-context.ts"));   // PRIVATEER.md context + /init
@@ -131,12 +171,21 @@ else {
   shim("privateer-posture", ext("privateer-posture.ts"));
   shim("privateer-tools", ext("privateer-tools.ts"));
   shim("privateer-privacy", ext("privateer-privacy.ts"));   // pi-privacy + account tier resolver
-  shim("rpiv-web-tools", dep("@juicesharp", "rpiv-web-tools", "index.ts")); // private web tools
+  shim("rpiv-web-tools", dep("@juicesharp/rpiv-web-tools", "index.ts")); // private web tools
   shim("pi-mcp-adapter", dep("pi-mcp-adapter", "index.ts"));
-  shim("pi-hypa", dep("@hypabolic", "pi-hypa", "extensions", "index.ts"));
+  shim("pi-hypa", dep("@hypabolic/pi-hypa", "extensions", "index.ts"));
   shim("pi-subagents", dep("pi-subagents", "src", "extension", "index.ts"));
 
-  const CLI = dep("@earendil-works", "pi-coding-agent", "dist", "cli.js");
+  // Unlike the tool packs above, Pi's CLI is not optional — it IS the agent. If it
+  // didn't resolve, the install is broken; say so instead of spawning `undefined`.
+  const CLI = dep("@earendil-works/pi-coding-agent", "dist", "cli.js");
+  if (!CLI || !fs.existsSync(CLI)) {
+    console.error(
+      "privateer: couldn't find pi-coding-agent — the install looks incomplete.\n" +
+        "  Try reinstalling: npm install -g privateer-agent@latest",
+    );
+    process.exit(1);
+  }
   process.env.PI_CODING_AGENT_DIR = AGENT_DIR;
   // The binary pi-subagents spawns for each child. Point it at OUR cli.js so the child
   // reads this same PI_CODING_AGENT_DIR and DISCOVERS the moat shims (gated + private,
@@ -169,17 +218,41 @@ else {
   // TEE, strongest tier) when a Tinfoil key is present; else the signed-in account's
   // NEAR channel; else a cheap OpenRouter fallback.
   const CRED = path.join(PRIVATEER_HOME, "credentials.json");
+  const signedIn = fs.existsSync(CRED);
   const MODEL = process.env.PRIVATEER_MODEL
     ? process.env.PRIVATEER_MODEL
     : haveTinfoilKey()
       ? "tinfoil/glm-5-2"
-      : fs.existsSync(CRED)
+      : signedIn
         ? "privateer/near/zai-org/GLM-5.1-FP8"
         : "openrouter/openai/gpt-4o-mini";
 
+  // Guard the keyless dead-end. We land on the OpenRouter fallback ONLY when the user
+  // named no model, has no Tinfoil key, AND isn't signed in (no credentials.json). If
+  // they also have no OpenRouter/other BYO key, the very first prompt errors with a bare
+  // "No API key found for openrouter" and nothing explains why. Worse, if this machine
+  // was signed in before (other ~/.privateer state exists but the login file is gone),
+  // that bare error hides a vanished session. Surface a clear, branded notice BEFORE the
+  // TUI loads — but still boot it, so `/login` inside works (and activateSignedInModel
+  // switches the live session onto the account channel the moment they sign back in).
+  if (MODEL === "openrouter/openai/gpt-4o-mini" && !haveByoKey()) {
+    warnKeylessLaunch();
+  }
+
+  // Privateer's own bundled skills. Loaded by explicit path (Pi's `--skill`, which
+  // takes a file or directory) rather than seeded into the agent dir, so they load
+  // read-only from the shipped release — always matching this version, never
+  // clobbering or resurrecting anything in the user's own editable skills dir. Each
+  // is a directory holding a SKILL.md. Skip any that aren't present (e.g. a partial
+  // dev checkout) so a missing dir can't wedge launch.
+  const SKILL_DIRS = ["resolve-dependencies"]
+    .map((name) => path.join(REPO, "skills", name))
+    .filter((dir) => fs.existsSync(dir));
+  const skillArgs = SKILL_DIRS.flatMap((dir) => ["--skill", dir]);
+
   // Dev convenience: load provider keys from the repo's .env if present.
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
-  runToCompletion(NODE_BIN, [...nodeArgs, CLI, "--model", MODEL, ...args]);
+  runToCompletion(NODE_BIN, [...nodeArgs, CLI, "--model", MODEL, ...skillArgs, ...args]);
 }
 
 // --- helpers ---------------------------------------------------------------
@@ -239,12 +312,80 @@ function findWindowsBash() {
   return null;
 }
 
+// Run the patch applier and, on the one interesting outcome (we tried and couldn't),
+// tell the user why in a way they can act on. "current"/"applied"/"skipped" are silent.
+function ensurePatches() {
+  if (applyPatchesIfNeeded(REPO, NODE_BIN) !== "failed") return;
+  process.stderr.write(
+    [
+      "",
+      "  ⚓ Couldn't apply Privateer's bundled patches to node_modules — continuing without them.",
+      "     Two upstream fixes (retry-loop guard, /model → /models redirect) stay off.",
+      `     Usually a permissions issue: ${path.join(REPO, "node_modules")} isn't writable`,
+      "     by this user (a `sudo npm install -g` install). Re-run once with sudo, or",
+      "     install without sudo (nvm, or an npm prefix you own) to fix it for good.",
+      "",
+    ].join("\n") + "\n",
+  );
+}
+
 function haveTinfoilKey() {
-  if (process.env.TINFOIL_API_KEY) return true;
-  try { return /^TINFOIL_API_KEY=.+/m.test(fs.readFileSync(ENV_FILE, "utf8")); }
+  return haveKey("TINFOIL_API_KEY");
+}
+
+// True if `name` is set in the environment or (dev convenience) present and non-empty in
+// the repo .env — the same two sources the child inherits, so this matches what Pi will
+// actually see for the provider key at request time.
+function haveKey(name) {
+  if (process.env[name]) return true;
+  try { return new RegExp(`^${name}=.+`, "m").test(fs.readFileSync(ENV_FILE, "utf8")); }
   catch { return false; }
 }
 
+// Any BYO provider key that would make the keyless OpenRouter launch model usable (or at
+// least give the runtime SOME working provider). Mirrors defaultModel.ts's BYO_BY_KEY.
+function haveByoKey() {
+  return ["OPENROUTER_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "TINFOIL_API_KEY"]
+    .some(haveKey);
+}
+
+// Explain the keyless launch instead of letting the first prompt dead-end on a bare
+// "No API key found for openrouter". Distinguishes a returning user whose login file is
+// missing (other ~/.privateer state exists → likely signed out unexpectedly) from a
+// genuine first run. Non-fatal: we print and carry on so `/login` inside still works.
+function warnKeylessLaunch() {
+  // Heuristic "was signed in before": the agent dir or our own config.json exists even
+  // though credentials.json doesn't. A true first run has neither yet.
+  let returning = false;
+  try {
+    returning =
+      fs.existsSync(path.join(PRIVATEER_HOME, "agent")) ||
+      fs.existsSync(path.join(PRIVATEER_HOME, "config.json"));
+  } catch { /* best-effort — default to the first-run wording */ }
+
+  const lines = returning
+    ? [
+        "",
+        "  ⚓ Your Privateer login is missing — this terminal isn't signed in.",
+        `     (no ${path.join(PRIVATEER_HOME, "credentials.json")})`,
+        "",
+        "  If you were signed in before, your session was cleared. Run /login to sign",
+        "  back in — you'll return to your subscription models right away. Until then,",
+        "  prompting fails with \"No API key found\" because no model key is set.",
+        "",
+      ]
+    : [
+        "",
+        "  ⚓ You're not signed in to Privateer and no provider API key is set.",
+        "",
+        "  Run /login to use your subscription, or set a provider key (e.g.",
+        "  ANTHROPIC_API_KEY / OPENAI_API_KEY / OPENROUTER_API_KEY). Until then,",
+        "  prompting fails with \"No API key found\".",
+        "",
+      ];
+  process.stderr.write(lines.join("\n") + "\n");
+}
+
 function refreshUpdateCache() {
   const cache = path.join(PRIVATEER_HOME, "update-check.json");
   try {

package/extensions/privateer-gate.ts

@@ -353,6 +353,10 @@ const gate = makePermissionGate({
   localAsk,
   getRemote: bridge.getRemote,
   getNoQuarter: bridge.getNoQuarter,
+  // `--no-quarter` at launch (see bin/privateer-launch.mjs) sets PRIVATEER_NO_QUARTER
+  // and opts this whole session — TUI and any subagent children that inherit the env —
+  // out of the gate entirely: every action auto-approves, no prompt.
+  getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
   remoteAsk: bridge.remoteAsk,
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.6.3",
+  "version": "0.6.6",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -9,6 +9,10 @@
     "type": "git",
     "url": "git+https://github.com/privateer-agent/privateer-agent.git"
   },
+  "homepage": "https://privateer.pro",
+  "bugs": {
+    "url": "https://github.com/privateer-agent/privateer-agent/issues"
+  },
   "keywords": [
     "ai",
     "coding-agent",
@@ -37,7 +41,9 @@
     "bin",
     "src",
     "extensions",
+    "skills",
     "patches",
+    "SECURITY.md",
     "README.md",
     "LICENSE"
   ],
@@ -47,8 +53,7 @@
     "channels": "node --env-file=.env --import tsx src/channels/run.ts",
     "dev": "tsx watch src/main.ts",
     "typecheck": "tsc --noEmit",
-    "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done",
-    "postinstall": "patch-package --error-on-fail"
+    "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
   },
   "engines": {
     "node": ">=22.19.0"

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -1,3 +1,23 @@
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
+index e223ce1..2bdab10 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
+@@ -711,6 +711,15 @@ export class AgentSession {
+                 finalError: msg.errorMessage,
+             });
+             this._retryAttempt = 0;
++            // Privateer patch: a transient error that survived the full retry budget
++            // is terminal. Ending the turn here (instead of falling through to
++            // compaction / queued-message continuation) prevents the agent loop from
++            // re-entering agent.continue(), hitting the identical error, and — because
++            // the retry counter was just reset to 0 — starting a fresh burst of 3.
++            // That re-entry is what produced the endless "retrying 1/3…2/3…3/3" loop
++            // on a persistently-failing provider/tool. Context-overflow errors never
++            // reach this branch (_isRetryableError → false), so compaction is untouched.
++            return false;
+         }
+         if (await this._checkCompaction(msg)) {
+             return true;
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 index 5d65200..a997ad7 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js