privateer-agent 0.6.4 → 0.6.7

package/README.md

@@ -23,7 +23,8 @@
 </p>
 
 ```bash
-curl -fsSL https://privateer.pro/install.sh | sh    # installs the `privateer` command
+curl -fsSL https://privateer.pro/install.sh | sh    # macOS / Linux — installs the `privateer` command
+irm https://privateer.pro/install.ps1 | iex         # Windows (PowerShell)
 npx privateer-agent                                 # or run it instantly, nothing installed
 ```
 
@@ -33,9 +34,13 @@ Point it at a frontier model today and a local Ollama model tomorrow — **OpenR
 inference), **Venice** / **Fireworks** (no-retention inference), and any **custom
 OpenAI-compatible endpoint** (LM Studio, vLLM, llama.cpp…) are interchangeable at
 `/model` time, including mid-session. No model lock-in, no separate code paths. MCP
-servers, sub-agents, scheduled routines, and one-tap approval from your phone are
-included — and every one of the agent's actions runs through a **safe-by-default
-permission gate**.
+servers, sub-agents, scheduled routines, multi-step workflows, chat-app bridges, and
+one-tap approval from your phone are included — and every one of the agent's actions runs
+through a **safe-by-default permission gate**.
+
+Privateer runs in three places, over one account and one config: the **terminal**, a
+**background daemon** for unattended work, and the **Privateer app** on
+[phone, web](https://privateer.pro), and [desktop](#the-privateer-app).
 
 ## Why Privateer?
 
@@ -95,12 +100,21 @@ silently. The moat is swappable; the floor under it holds.
 - **Honest privacy posture, graded.** A verified TEE and a "we promise not to retain"
   policy are **never rendered the same** — the badge tells you exactly how strong the
   guarantee is (cryptographically verified → observable → policy → none).
-- **Approve it from your phone.** Link the terminal to the Privateer app with
-  `/remote-access` (off by default) and Allow/Deny every action remotely while execution
-  stays on your machine — supervise long agent runs from anywhere.
+- **Drive it from your phone.** Link the terminal with `/remote-access` (off by default) and
+  the Privateer app can send prompts, stream output, and Allow/Deny every action — while
+  execution stays on your machine. Sub-agent actions surface for approval the same way.
+- **Manage it from the app.** Extensions, skills, routines, workflows, MCP connectors, and
+  chat-app channels are all configurable from your phone or the web app, against any linked
+  terminal. See [The Privateer app](#the-privateer-app).
+- **A desktop app.** The same agent hosted inside a local Electron shell — no relay hop, works
+  offline, multi-window with per-window MCP connectors. Shares your CLI login and config.
 - **Scheduled routines.** A background daemon runs approved tasks unattended — cron or
   one-off — and the agent can schedule its own follow-up work. Results deliver to a file,
   the next session, your phone, email, or a webhook.
+- **Declarative workflows.** Multi-step agent pipelines as YAML — typed steps, conditional
+  routing between them, and `human_gate` steps that pause for your approval and resume.
+- **Chat-app channels.** Bridge the agent into Telegram, Slack, Discord, or WhatsApp with
+  role-based approval — admins can approve actions, members are read-only.
 - **MCP servers, sub-agents & skills.** Connect Model Context Protocol servers (local stdio
   or remote HTTP with OAuth), delegate work to bounded parallel sub-agents, and drop in
   skills — all gated like everything else.
@@ -124,14 +138,47 @@ No install at all: `npx privateer-agent`.
 ## Install
 
 ```bash
-npm install -g privateer-agent          # installs the `privateer` command
-# or run it without installing:
-npx privateer-agent
-# or the one-liner installer (verifies Node, then installs globally):
-curl -fsSL https://privateer.pro/install.sh | sh
+# the one-liner installer — downloads a self-contained bundle, no Node needed:
+curl -fsSL https://privateer.pro/install.sh | sh    # macOS / Linux
+irm https://privateer.pro/install.ps1 | iex        # Windows (PowerShell)
+
+# or via npm, if you'd rather manage it yourself (needs Node ≥ 22.19):
+npm install -g privateer-agent
+npx privateer-agent                                 # run without installing
 ```
 
-**Requirements:** macOS or Linux, Node.js ≥ 22.19.0.
+**Requirements:** macOS (arm64/x64), Linux (x64), or Windows (x64). The installers ship a
+**pinned Node runtime inside the bundle**, so you don't need Node or npm on your machine at
+all — Node ≥ 22.19.0 is only required for the `npm` / `npx` path.
+
+Update in place with **`privateer update`** (bundle-aware: it re-runs the right installer
+for how you installed) or check your version with `privateer --version`.
+
+> **Windows:** the agent's command tool needs a bash, which Windows doesn't ship. Install
+> Git for Windows (or WSL) and Privateer will find it; the launcher checks at startup and
+> tells you how to fix it if not. Override the choice with `shellPath` in
+> `~/.privateer/agent/settings.json`. Linux arm64 and Windows arm64 bundles aren't built
+> yet — arm64 Windows runs the x64 bundle under emulation.
+
+### Verifying what you're about to run
+
+Privateer is a coding agent — it runs shell commands and edits files, so "should I trust
+this package?" is the right question to ask before `npx`. Two things are checkable
+without taking anyone's word for it:
+
+```bash
+npm view privateer-agent dist.attestations   # published from CI with npm provenance:
+                                             # a signed link from this tarball to the
+                                             # exact commit and build that produced it
+npm audit signatures                         # verify registry signatures + provenance
+```
+
+The package also declares **no install scripts** — no `postinstall`, nothing. Installing
+it writes files and executes nothing; `npm install -g privateer-agent --ignore-scripts`
+gives an identical result. Code runs only when you run `privateer`.
+
+See [SECURITY.md](SECURITY.md) for the threat model, the permission gate, and how to
+report a vulnerability.
 
 **From source:**
 
@@ -228,13 +275,106 @@ with `/signout`; manage linked terminals from the app.
 > to spend on your account. If someone sends you a code and asks you to approve it, don't —
 > that hands *them* a billed session on *your* account.
 
-## Approve from your phone
+## The Privateer app
+
+The same account drives Privateer from **iOS, Android, [the web app](https://privateer.pro),
+and a desktop app**. The terminal stays where the work happens — the app is a remote control
+and a management surface for it.
+
+### Linking a terminal
+
+1. Run **`privateer`** and **`/signin`**. It prints a short device code.
+2. Open the app → **Link a terminal**, enter the code (or tap the deep link). No password or
+   wallet key ever touches the terminal, and the app pins the terminal's public key on first
+   link.
+3. In the terminal, turn on **`/remote-access`** (off by default). The terminal now shows
+   **Online** in the app.
+
+> **Only approve a code you generated yourself.** Approving someone else's code hands *them*
+> a billed session on *your* account.
+
+### What you can do from the app
+
+| | |
+|---|---|
+| **Drive a session** | Send prompts, watch streamed output, and **Allow/Deny** each proposed action — including actions from sub-agents the session spawned |
+| **Spawn an agent** | Start a one-shot task on the daemon: *background* (headless, read-only toolset, result sealed to your outbox) or *live* (a fresh drivable session) |
+| **Routines** | Create, edit, pause, run, and delete scheduled unattended tasks |
+| **Workflows** | List, run, and monitor multi-step workflows; answer `human_gate` steps to resume a paused run |
+| **MCP connectors** | Add, edit, and enable MCP servers; credentials are sealed to the terminal and write-only |
+| **Channels** | Configure the Telegram / Slack / Discord / WhatsApp bridges — admins, members, posture, tool ceiling, model |
+| **Extensions & skills** | Install Pi extensions from the catalog; create, edit, and run `SKILL.md` skills |
+
+Config changes that carry secrets or executable content (MCP credentials, channel bot
+tokens, workflows with `script` steps) are **sealed to the terminal's pinned key and signed
+by your account** — the relay forwards them blind and can neither read nor forge them.
+
+The relay itself is live-only (nothing is archived), carries no API keys, and output is
+size-truncated and run through a best-effort secret redactor before it leaves your machine.
+
+### Desktop app
 
-Turn on **`/remote-access`** (off by default) to link this terminal to the Privateer app. The
-app can then drive the terminal — prompts come down, and each proposed action goes up for
-**Allow/Deny** — while execution stays on your machine. The relay is live-only (nothing is
-archived), carries no keys, and output is size-truncated and run through a best-effort secret
-redactor before it leaves.
+The desktop app hosts the agent **in-process** and talks to it over loopback IPC — no relay,
+no network hop, and it works offline. It reads the same `~/.privateer` home, so it shares
+your CLI login, model config, and MCP catalog. Multi-window, with a per-window subset of
+your MCP connectors and a native folder picker.
+
+Download for [macOS](https://privateer.pro/download/mac) (Apple silicon),
+[macOS Intel](https://privateer.pro/download/mac-intel), or
+[Windows](https://privateer.pro/download/windows).
+
+It's an early release and **not yet code-signed or notarized** — macOS will warn on first
+open. Routines and channels deliberately aren't hosted here: those belong to the always-on
+daemon, so background work still wants `privateer daemon install`.
+
+## Run it unattended — the daemon
+
+A resident background daemon runs scheduled routines, executes workflows, and accepts task
+spawns from the app — with no terminal open.
+
+```bash
+privateer daemon install      # install as a login service (auto-starts, reachable from the app)
+privateer daemon status       # service installed? daemon answering?
+privateer daemon run          # or just run it in the foreground
+privateer daemon uninstall
+```
+
+Installs as a **launchd user agent** on macOS or a **`systemd --user` unit** on Linux — no
+root, no sudo. (There's no Windows service path yet; use `privateer daemon run`.)
+
+Everything the daemon does still runs through the permission gate. Actions needing approval
+surface in the app; routines you approved once run on their own schedule.
+
+## Workflows
+
+A workflow is a **YAML file describing a multi-step agent pipeline** — a flat graph of typed
+steps (`agent`, `script`, `human_gate`) with conditional routes between them and `{{ }}`
+templating to pass values along. A `human_gate` step pauses the run for your approval and
+resumes when you answer it, including from your phone.
+
+The engine ships in the standalone
+[`privateer-workflow`](https://www.npmjs.com/package/privateer-workflow) package. Today the
+user-facing surface is the **app** (save, run, monitor, share) and the **daemon** that
+executes them — there's no `/workflow` command in the terminal yet. Schedule one by pointing
+a routine at it.
+
+Because a workflow can carry `script` steps, saving one from the app requires your **account
+signature** — the server can't inject a workflow onto your daemon.
+
+## Chat-app channels
+
+Bridge the agent into **Telegram, Slack, Discord, or WhatsApp** so you can hand it work from
+a group chat. Each channel has:
+
+- **Roles** — `admins` can approve actions; `members` are always read-only, no exceptions.
+- **A posture** — `readonly`, `approve` (default), or `auto`.
+- **A hard tool ceiling** — a per-channel allowlist the agent can't exceed even in `auto`.
+
+Configure a channel from the app, or by hand in the `channels` block of
+`~/.privateer/config.json`. Changes take effect on restart, by design. Bot tokens set from
+the app are write-only — the app can name them but never read them back. Note that tokens
+live in plaintext in `config.json` on your machine, and every channel action is appended to
+`~/.privateer/channels-audit.log`.
 
 ## Permission modes
 
@@ -269,14 +409,35 @@ Everything below is a **Pi extension** loaded by discovery (see [Built on Pi](#b
 drop your own into `~/.privateer/agent/extensions/` and it loads the same way, gated like the rest.
 
 - **MCP servers** (`pi-mcp-adapter`) — declare them and their tools become first-class, gated
-  like the rest (local stdio, or remote HTTP with interactive OAuth).
-- **Sub-agents** (`pi-subagents`) — delegate investigations to bounded parallel agents that run
-  under the same permission gate.
+  like the rest (local stdio, or remote HTTP with interactive OAuth). One catalog at
+  `~/.privateer/agent/mcp-desktop.json` is shared by the CLI, the daemon, and the desktop
+  app, so a machine has one coherent connector config.
+- **Sub-agents** (`pi-subagents`) — delegate investigations to bounded parallel agents. Children
+  run as headless child processes that **inherit the moat**, so their actions hit the same
+  permission gate and their approvals surface on your phone.
 - **Routines** — saved tasks the daemon runs unattended; ask the agent to schedule work and
   approve it once.
+- **Workflows** — declarative multi-step pipelines the daemon executes; see
+  [Workflows](#workflows).
 - **Web tools** (`rpiv-web-tools`) — private-by-default web search/fetch with pluggable backends
   (self-hosted SearXNG for fully private search).
 
+## Command reference
+
+| Command | What it does |
+|---|---|
+| `/model` · `/models` | switch model; `/models` is a searchable picker with TEE/ZDR privacy shields |
+| `/mode` | switch permission mode |
+| `/verify` | fetch and check the TEE attestation for the current model |
+| `/signin` · `/signout` | sign in to a Privateer account (device flow) / sign out |
+| `/remote-access` | link this terminal to the app and allow it to drive (off by default) |
+| `/extensions` | list loaded Pi extensions |
+| `/init` | scaffold a starter `PRIVATEER.md` in this directory |
+| `/update` · `/privateer` | update to the latest release / Privateer status and posture |
+
+Shell subcommands: `privateer` (interactive), `privateer update`, `privateer daemon …`,
+`privateer --no-quarter`, `privateer --version`.
+
 ## Develop
 
 ```bash

package/SECURITY.md

@@ -0,0 +1,54 @@
+# Security
+
+## Reporting a vulnerability
+
+Report privately via [GitHub Security Advisories](https://github.com/privateer-agent/privateer-agent/security/advisories/new),
+or email **support@privateer.pro**. Please don't open a public issue for anything
+exploitable. Expect an initial response within 72 hours.
+
+## What you're running
+
+Privateer is a terminal coding agent: it reads and writes files, runs shell commands and
+talks to model providers on your behalf. That is the point of it, and it is also the
+threat model. Two things are worth verifying rather than taking on faith.
+
+**The package runs no install scripts.** There is no `preinstall`, `install`,
+`postinstall` or `prepare` hook. `npm install -g privateer-agent` writes files and
+executes nothing; installing with `--ignore-scripts` produces an identical result. Code
+runs only when you run `privateer`. (Dependency patching happens at first launch — see
+`bin/apply-patches.mjs` and `docs/shipping.md`.)
+
+**Releases carry npm provenance.** Published from `.github/workflows/release.yml` with
+`npm publish --provenance`, so npm holds a signed Sigstore attestation binding the
+tarball to this repository, the exact commit and the workflow run that built it. The npm
+package page shows a verified *"Built and signed on GitHub Actions"* badge linking to
+the build. To check it yourself:
+
+```bash
+npm view privateer-agent dist.attestations   # attestation metadata exists
+npm audit signatures                          # verifies registry signatures + provenance
+```
+
+If a version lacks provenance, it did not come from this workflow. Treat that as
+suspicious and report it.
+
+## The permission gate
+
+By default every shell command, file write outside the working directory, and
+destructive tool call stops for explicit approval. This is the moat, and it is the main
+thing standing between a prompt-injected model and your filesystem.
+
+`--no-quarter` disables it entirely — every action runs unprompted. It exists for
+trusted, disposable environments (throwaway containers, CI). Do not use it on a machine
+whose contents you care about, and do not use it on a repository or task involving
+untrusted content: a coding agent reading an attacker-controlled file is a realistic
+injection path.
+
+## Keys and credentials
+
+Provider API keys and account credentials live under `~/.privateer/` on your machine and
+are sent only to the provider you selected. Bot tokens for messaging channels are sealed
+to a terminal keypair before they reach our relay, and channel configuration is verified
+against a link-pinned account key — the relay can neither read those tokens nor forge
+configuration. Architecture and residual risks are documented in
+`docs/daemon-channels-and-app.md`.

package/bin/apply-patches.d.mts

@@ -0,0 +1,18 @@
+// Types for the launcher's patch/resolve helpers. The implementation is plain .mjs
+// because bin/ must run under a bare `node` with no transpiler (the launcher is the
+// very first thing to execute, before tsx/jiti are in play).
+
+/** Directory CONTAINING the node_modules that holds `name`, or null if not installed. */
+export function findDepRoot(from: string, name: string): string | null;
+
+/** Absolute path to a file inside an installed dependency, or null if absent. */
+export function resolveDep(from: string, name: string, ...rest: string[]): string | null;
+
+/**
+ * Apply `patches/` into whichever node_modules the targets landed in. Idempotent and
+ * best-effort; see the implementation for why this runs at launch, not on install.
+ */
+export function applyPatchesIfNeeded(
+  repo: string,
+  nodeBin?: string,
+): "current" | "applied" | "skipped" | "failed";

package/bin/apply-patches.mjs

@@ -0,0 +1,143 @@
+// Apply the patches/ directory into node_modules — at LAUNCH, not at install.
+//
+// Why not a `postinstall` script (the obvious place)? Because `npm install` /
+// `npx privateer-agent` would then execute our code on the user's machine BEFORE
+// they ever decided to run Privateer. That is exactly the install-time-execution
+// risk a careful reviewer — human or agent — flags on an unfamiliar package, and
+// it is the one npm-side signal we can remove outright. With no install scripts,
+// `npm install -g privateer-agent --ignore-scripts` is completely inert: it writes
+// files and runs nothing. Patching moves to the first actual launch, which the
+// user explicitly asked for.
+//
+// Contract: idempotent, cheap on the hot path (a stamp file short-circuits every
+// launch after the first), and BEST-EFFORT — every patch here is a UX/robustness
+// improvement, never a correctness prerequisite, so a failure to apply degrades to
+// stock Pi behaviour rather than blocking launch. That matters for the common
+// `sudo npm install -g` case, where node_modules is root-owned and an unprivileged
+// launch simply cannot write to it.
+
+import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+// Bump when the applier's own semantics change, to force a re-apply on upgrade.
+const STAMP_VERSION = 1;
+
+/**
+ * Where do our patch targets actually live?
+ *
+ * NOT necessarily `<repo>/node_modules`. When Privateer is installed as a dependency
+ * (`npm i privateer-agent`, `npx privateer-agent`), npm HOISTS pi-coding-agent to the
+ * parent project's node_modules and leaves us with no node_modules of our own — so
+ * assuming a local one means the patches silently never apply. Resolve the real target
+ * from our own package instead, and return the directory that CONTAINS the node_modules
+ * it landed in: that is the cwd patch-package needs, in every layout (hoisted, nested,
+ * global, bundled).
+ */
+/**
+ * Find the directory CONTAINING the node_modules that holds `name`, starting at
+ * `from` and walking up. Returns null if the dependency isn't installed anywhere.
+ *
+ * This is the one resolution primitive both the launcher and the patcher need,
+ * because `<repo>/node_modules` is NOT where dependencies reliably live:
+ *   - `npm i -g privateer-agent`  -> nested:  <repo>/node_modules/<name>
+ *   - `npx privateer-agent`       -> hoisted: <repo>/../node_modules/<name>
+ *   - `npm i privateer-agent`     -> hoisted into the host project
+ * Hardcoding the nested case silently breaks every hoisted install.
+ *
+ * We walk directories rather than using require.resolve because modern packages
+ * (pi-coding-agent among them) declare an `exports` map with no "./package.json"
+ * entry, so require.resolve throws ERR_PACKAGE_PATH_NOT_EXPORTED even when the
+ * package is sitting right there. Directory lookup sees through `exports`.
+ */
+export function findDepRoot(from, name) {
+  const segs = name.split("/");
+  for (let dir = path.resolve(from); ; dir = path.dirname(dir)) {
+    if (fs.existsSync(path.join(dir, "node_modules", ...segs, "package.json"))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null; // hit the filesystem root
+  }
+}
+
+/** Absolute path to an installed dependency's file, or null if the dep isn't present. */
+export function resolveDep(from, name, ...rest) {
+  const root = findDepRoot(from, name);
+  return root ? path.join(root, "node_modules", ...name.split("/"), ...rest) : null;
+}
+
+function resolvePatchRoots(repo, patchFiles) {
+  const roots = new Set();
+  for (const file of patchFiles) {
+    // "@earendil-works+pi-coding-agent+0.80.3.patch" -> "@earendil-works/pi-coding-agent"
+    const parts = path.basename(file, ".patch").split("+");
+    const name = parts[0].startsWith("@") ? `${parts[0]}/${parts[1]}` : parts[0];
+    const root = findDepRoot(repo, name);
+    if (root) roots.add(root);
+  }
+  return [...roots];
+}
+
+/** sha256 over every patch file's name + contents — the identity of "what should be applied". */
+function patchSetHash(patchDir, files) {
+  const h = crypto.createHash("sha256").update(String(STAMP_VERSION));
+  for (const f of files) {
+    h.update(f);
+    h.update(fs.readFileSync(path.join(patchDir, f)));
+  }
+  return h.digest("hex");
+}
+
+/**
+ * Ensure patches/ is applied to repo/node_modules. Returns one of:
+ *   "current"   — already applied (stamp matches); nothing done
+ *   "applied"   — patches were just applied successfully
+ *   "skipped"   — nothing to do (no patches / no node_modules / patch-package absent)
+ *   "failed"    — apply was attempted and did not succeed (caller may warn)
+ */
+export function applyPatchesIfNeeded(repo, nodeBin = process.execPath) {
+  try {
+    repo = path.resolve(repo); // roots come back absolute; a relative repo would break path.relative
+    const patchDir = path.join(repo, "patches");
+    if (!fs.existsSync(patchDir)) return "skipped";
+    const patchFiles = fs.readdirSync(patchDir).filter((f) => f.endsWith(".patch")).sort();
+    if (patchFiles.length === 0) return "skipped";
+
+    const want = patchSetHash(patchDir, patchFiles);
+    const roots = resolvePatchRoots(repo, patchFiles);
+    if (roots.length === 0) return "skipped"; // targets not installed
+
+    // patch-package is a runtime dependency precisely so this works post-install.
+    const pp = resolveDep(repo, "patch-package", "index.js");
+    if (!pp || !fs.existsSync(pp)) return "skipped";
+
+    let did = false;
+    for (const root of roots) {
+      const stampFile = path.join(root, "node_modules", ".privateer-patches.json");
+      try {
+        if (JSON.parse(fs.readFileSync(stampFile, "utf8")).hash === want) continue; // current
+      } catch { /* missing or unreadable stamp — (re)apply */ }
+
+      // --patch-dir points at OUR patches even though cwd is wherever the deps landed.
+      // It MUST be relative: patch-package resolves it against cwd, so an absolute path
+      // is silently mangled into a non-existent one and every patch "fails" to apply.
+      const relPatchDir = path.relative(root, patchDir);
+      const r = spawnSync(nodeBin, [pp, "--error-on-fail", "--patch-dir", relPatchDir], {
+        cwd: root,
+        stdio: ["ignore", "ignore", "pipe"],
+        timeout: 60_000,
+        windowsHide: true,
+      });
+      if (r.status !== 0) return "failed";
+      did = true;
+
+      // Only stamp after a clean apply, so a partial/failed run retries next launch.
+      try {
+        fs.writeFileSync(stampFile, JSON.stringify({ hash: want, at: new Date().toISOString() }) + "\n");
+      } catch { /* unwritable node_modules — applied fine, we just re-check next launch */ }
+    }
+    return did ? "applied" : "current";
+  } catch {
+    return "failed";
+  }
+}

package/bin/privateer-launch.mjs

@@ -17,6 +17,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { applyPatchesIfNeeded, resolveDep } from "./apply-patches.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url)); // bin/
 const REPO = path.resolve(HERE, "..");
@@ -72,7 +73,8 @@ const sub = args[0];
 if (sub === "--version" || sub === "-V") {
   const ver = (p) => { try { return JSON.parse(fs.readFileSync(p, "utf8")).version; } catch { return null; } };
   const pv = ver(path.join(REPO, "package.json")) || "unknown";
-  const pi = ver(path.join(REPO, "node_modules", "@earendil-works", "pi-coding-agent", "package.json"));
+  const piPkg = resolveDep(REPO, "@earendil-works/pi-coding-agent", "package.json");
+  const pi = piPkg ? ver(piPkg) : null;
   console.log(`privateer ${pv}${pi ? ` (pi ${pi})` : ""}`);
   process.exit(0);
 }
@@ -126,6 +128,13 @@ else {
   // time the agent tries to run a command. Unix always has a shell, so this is a no-op.
   ensureShellOrExit();
 
+  // Apply our pi-coding-agent patches. This happens HERE, on a launch the user asked
+  // for, rather than in a postinstall — so installing the package runs no code at all.
+  // Stamped, so it's a single file read on every launch after the first. Best-effort:
+  // both patches are UX fixes, so a root-owned node_modules (sudo npm i -g) just means
+  // stock Pi behaviour, not a broken boot. Bundles ship pre-patched and no-op here.
+  ensurePatches();
+
   const AGENT_DIR = path.join(PRIVATEER_HOME, "agent");
   const EXT_DIR = path.join(AGENT_DIR, "extensions");
   fs.mkdirSync(EXT_DIR, { recursive: true });
@@ -142,9 +151,17 @@ else {
   for (const name of MANAGED) fs.rmSync(path.join(EXT_DIR, `${name}.ts`), { force: true });
 
   const ext = (...p) => path.join(REPO, "extensions", ...p);
-  const dep = (...p) => path.join(REPO, "node_modules", ...p);
-  const shim = (name, target) =>
+  // Resolve dependencies by walking the node_modules chain, NOT as REPO/node_modules.
+  // npm only nests deps under us for a global install; `npx privateer-agent` and
+  // `npm i privateer-agent` HOIST them to a sibling/parent node_modules, where the
+  // hardcoded path resolves to nothing and every shim below points at a missing file.
+  const dep = (name, ...rest) => resolveDep(REPO, name, ...rest);
+  // A missing target means that optional tool pack isn't installed — skip its shim
+  // rather than writing one that points at nothing (which fails at extension load).
+  const shim = (name, target) => {
+    if (!target || !fs.existsSync(target)) return;
     fs.writeFileSync(path.join(EXT_DIR, `${name}.ts`), `export { default } from ${JSON.stringify(pathToFileURL(target).href)};\n`);
+  };
 
   shim("privateer-brand", ext("privateer-brand.ts"));       // banner, ⚓ badge, /signin /signout
   shim("privateer-context", ext("privateer-context.ts"));   // PRIVATEER.md context + /init
@@ -154,12 +171,21 @@ else {
   shim("privateer-posture", ext("privateer-posture.ts"));
   shim("privateer-tools", ext("privateer-tools.ts"));
   shim("privateer-privacy", ext("privateer-privacy.ts"));   // pi-privacy + account tier resolver
-  shim("rpiv-web-tools", dep("@juicesharp", "rpiv-web-tools", "index.ts")); // private web tools
+  shim("rpiv-web-tools", dep("@juicesharp/rpiv-web-tools", "index.ts")); // private web tools
   shim("pi-mcp-adapter", dep("pi-mcp-adapter", "index.ts"));
-  shim("pi-hypa", dep("@hypabolic", "pi-hypa", "extensions", "index.ts"));
+  shim("pi-hypa", dep("@hypabolic/pi-hypa", "extensions", "index.ts"));
   shim("pi-subagents", dep("pi-subagents", "src", "extension", "index.ts"));
 
-  const CLI = dep("@earendil-works", "pi-coding-agent", "dist", "cli.js");
+  // Unlike the tool packs above, Pi's CLI is not optional — it IS the agent. If it
+  // didn't resolve, the install is broken; say so instead of spawning `undefined`.
+  const CLI = dep("@earendil-works/pi-coding-agent", "dist", "cli.js");
+  if (!CLI || !fs.existsSync(CLI)) {
+    console.error(
+      "privateer: couldn't find pi-coding-agent — the install looks incomplete.\n" +
+        "  Try reinstalling: npm install -g privateer-agent@latest",
+    );
+    process.exit(1);
+  }
   process.env.PI_CODING_AGENT_DIR = AGENT_DIR;
   // The binary pi-subagents spawns for each child. Point it at OUR cli.js so the child
   // reads this same PI_CODING_AGENT_DIR and DISCOVERS the moat shims (gated + private,
@@ -286,6 +312,23 @@ function findWindowsBash() {
   return null;
 }
 
+// Run the patch applier and, on the one interesting outcome (we tried and couldn't),
+// tell the user why in a way they can act on. "current"/"applied"/"skipped" are silent.
+function ensurePatches() {
+  if (applyPatchesIfNeeded(REPO, NODE_BIN) !== "failed") return;
+  process.stderr.write(
+    [
+      "",
+      "  ⚓ Couldn't apply Privateer's bundled patches to node_modules — continuing without them.",
+      "     Two upstream fixes (retry-loop guard, /model → /models redirect) stay off.",
+      `     Usually a permissions issue: ${path.join(REPO, "node_modules")} isn't writable`,
+      "     by this user (a `sudo npm install -g` install). Re-run once with sudo, or",
+      "     install without sudo (nvm, or an npm prefix you own) to fix it for good.",
+      "",
+    ].join("\n") + "\n",
+  );
+}
+
 function haveTinfoilKey() {
   return haveKey("TINFOIL_API_KEY");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.6.4",
+  "version": "0.6.7",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -9,6 +9,10 @@
     "type": "git",
     "url": "git+https://github.com/privateer-agent/privateer-agent.git"
   },
+  "homepage": "https://privateer.pro",
+  "bugs": {
+    "url": "https://github.com/privateer-agent/privateer-agent/issues"
+  },
   "keywords": [
     "ai",
     "coding-agent",
@@ -39,6 +43,7 @@
     "extensions",
     "skills",
     "patches",
+    "SECURITY.md",
     "README.md",
     "LICENSE"
   ],
@@ -48,8 +53,7 @@
     "channels": "node --env-file=.env --import tsx src/channels/run.ts",
     "dev": "tsx watch src/main.ts",
     "typecheck": "tsc --noEmit",
-    "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done",
-    "postinstall": "patch-package --error-on-fail"
+    "test": "for f in tests/*.test.ts; do node --import tsx --test \"$f\" || exit 1; done"
   },
   "engines": {
     "node": ">=22.19.0"