privateer-agent 0.6.4 → 0.6.7

package/src/providers/account.ts

@@ -15,7 +15,7 @@ import {
   hasCredentials,
   runDeviceLogin,
   authedFetch,
-  spawnAccountCredentials,
+  acquireAccountCredential,
   refreshAccountCredentials,
   notifySignedIn,
 } from "../auth/privateer.ts";
@@ -169,7 +169,7 @@ export const privateerOAuthProvider = {
       }
     }
     if (cb.signal?.aborted) throw new Error("Login cancelled");
-    const creds = await spawnAccountCredentials();
+    const creds = await acquireAccountCredential();
     // Seed Pi's saved model default to the account channel, so the next launch resolves
     // to a billable subscription model instead of falling through to a keyless built-in
     // (the "No API key found for openrouter" trap). No-op if the user already has a
@@ -184,8 +184,10 @@ export const privateerOAuthProvider = {
     try {
       return await refreshAccountCredentials(creds.refresh);
     } catch {
-      // child token expired/reused → spawn a fresh one from the parent login.
-      return spawnAccountCredentials();
+      // Child token expired/reused → get another. acquire (not spawn) so a terminal
+      // that already holds the device's last session slot can reclaim an orphan
+      // instead of being refused a fresh one mid-session.
+      return acquireAccountCredential();
     }
   },
   getApiKey(creds: { access: string }): string {
@@ -256,6 +258,7 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
 export function makeAccountProvider() {
   return (pi: {
     registerProvider?: (name: string, config: unknown) => void;
+    on?: (event: string, handler: (e: unknown, ctx: unknown) => void) => void;
   }): void => {
     if (typeof pi.registerProvider !== "function") return;
     const register = (ids: string[]): void =>
@@ -274,5 +277,57 @@ export function makeAccountProvider() {
       .catch(() => {
         /* keep the fallback model */
       });
+
+    // Seed the account channel's credential at launch. Nothing else does this in the
+    // TUI: Pi only obtains an OAuth credential by running /login, and our shutdown
+    // hook deliberately REVOKES the account session and deletes its persisted
+    // auth.json entry (see the LIFECYCLE HAZARD note in src/auth/privateer.ts). So a
+    // signed-in user who quits and relaunches lands on privateer/* with no key at
+    // all, and the first prompt dead-ends on "No API key found for privateer." — even
+    // though the banner says "connected". The REPL (cli/chat.ts) and the daemon
+    // already spawn one at startup; this gives the TUI the same seed.
+    pi.on?.("session_start", (_e, ctx) => void ensureAccountCredential(ctx));
   };
 }
+
+// One spawn per PROCESS. session_start also fires for new/resume/fork/reload — all of
+// which keep this process (and its account session) alive — so re-spawning there would
+// leak a device row per event. A fresh process always spawns: a run that crashed
+// without its shutdown hook can leave a REVOKED credential persisted in auth.json with
+// a still-valid-looking `expires`, which Pi would happily reuse and 401 on.
+//
+// The flag lives on globalThis, not in module scope, because jiti gives each extension
+// that imports this file its OWN module instance (see the note in auth/privateer.ts):
+// privateer-account and privateer-brand — which hot-registers the provider on /signin —
+// would otherwise hold separate flags and each spawn a session.
+const SEEDED = Symbol.for("privateer.accountCredentialSeeded");
+type SeedFlag = { [SEEDED]?: boolean };
+
+// `ctx` is Pi's ExtensionContext; the auth store hangs off its model registry (the same
+// path privateer-brand uses to DROP the credential on sign-out).
+type SeedContext = {
+  modelRegistry?: { authStorage?: { set?: (provider: string, cred: unknown) => void } };
+  hasUI?: boolean;
+  ui?: { notify?: (message: string, level: string) => void };
+};
+
+async function ensureAccountCredential(ctx: unknown): Promise<void> {
+  const flag = globalThis as SeedFlag;
+  if (flag[SEEDED] || !hasCredentials()) return;
+  flag[SEEDED] = true;
+  const store = (ctx as SeedContext)?.modelRegistry?.authStorage;
+  if (typeof store?.set !== "function") return;
+  try {
+    const creds = await acquireAccountCredential();
+    store.set("privateer", { type: "oauth", ...creds });
+  } catch (e) {
+    // The account channel is NOT armed: a dead machine login (401 → credentials cleared
+    // + onSessionExpired), the terminal cap (429), or a network blip. Say so now — the
+    // banner still reads "connected" (it only knows about the local credentials file),
+    // so staying silent leaves the user to discover it as a bare "No API key found for
+    // privateer" on their first prompt. Cleared so a later attempt can retry.
+    flag[SEEDED] = false;
+    const c = ctx as SeedContext;
+    if (c?.hasUI) c.ui?.notify?.(`Privateer account channel unavailable — ${(e as Error).message}`, "error");
+  }
+}

package/src/remote/mcpControl.ts

@@ -0,0 +1,268 @@
+/**
+ * MCP connector management for the app — the sibling of channelsControl.ts, but for
+ * MCP server config rather than messaging channels. It is what lets the phone/web
+ * client add, toggle, and remove MCP connectors on a Node HOST it drives over the
+ * relay (the daemon today; an interactive terminal by the same shape).
+ *
+ * The client itself can NEVER run MCP — a browser tab / RN runtime can't spawn a
+ * stdio child or hold the adapter. So "serving MCP to phone/web" means MANAGING the
+ * config here, on a host that executes it. This control owns that config.
+ *
+ * SAME FILE MODEL AS THE DESKTOP (treeview/desktop/src/main/mcpService.ts): the
+ * source of truth is `${agentDir}/mcp-desktop.json` — every server with an `enabled`
+ * flag — and from it we PROJECT the standard `${agentDir}/mcp.json` (enabled servers
+ * only, `{mcpServers:{}}` shape) that pi-mcp-adapter reads. Sharing those two files
+ * means a machine has ONE coherent MCP config whether it was edited from the desktop
+ * over IPC or from the phone over the relay.
+ *
+ * SECRETS: MCP env values are credentials (GITHUB_PERSONAL_ACCESS_TOKEN, …). Over the
+ * untrusted relay they are WRITE-ONLY, exactly like channel bot tokens: list() NEVER
+ * returns an env VALUE — only which env keys exist (`envKeys`) and which are non-empty
+ * (`secretsSet`), by name. save() persists whatever env VALUES it is handed in
+ * `draft.env`; the seal/open of those values in transit is the caller's job (the
+ * daemon opens a sealed-box addressed to its terminal, mirroring applyChannelSave), so
+ * this module only ever deals in the plaintext files it already owns.
+ *
+ * Framework-agnostic: nothing here imports React or the relay. The caller owns the
+ * frame plumbing and the sealed-secret open.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { agentDir } from "../config/paths.ts";
+
+export type McpTransport = "stdio" | "http";
+
+// One server as stored in the source file (mcp-desktop.json). Mirrors the desktop's
+// SourceEntry: the standard fields the adapter needs plus our `enabled` flag.
+interface SourceEntry {
+  transport?: McpTransport;
+  command?: string;
+  args?: string[];
+  env?: Record<string, string>;
+  url?: string;
+  oauth?: boolean;
+  enabled?: boolean;
+}
+interface SourceFile {
+  servers: Record<string, SourceEntry>;
+}
+
+// Non-secret projection of one server, sent to the app. No env VALUES, ever — only
+// which env keys exist and which are set (`secretsSet`). `host` is surfaced for the
+// app's privacy badge ("Sends data to <host>" for http; stdio runs locally).
+export interface RemoteMcpServer {
+  name: string;
+  transport: McpTransport;
+  enabled: boolean;
+  command?: string; // stdio: the launch binary (not a secret — e.g. "npx")
+  argsPreview?: string; // stdio: args joined, for a one-line summary
+  url?: string; // http: the endpoint (not a secret; the vendor host)
+  host?: string; // http: parsed host for the privacy badge
+  oauth: boolean; // http servers negotiate OAuth; stdio never does
+  envKeys: string[]; // env var NAMES only (e.g. ["GITHUB_PERSONAL_ACCESS_TOKEN"])
+  secretsSet: string[]; // subset of envKeys whose value is non-empty — names only
+}
+
+// An app-submitted edit. Non-secret fields REPLACE when present; `env` maps a var
+// name → its (already-opened) value, and only present, non-empty values overwrite —
+// an omitted key keeps the existing value (so a re-save without re-typing the token
+// preserves it, matching the channels-manager rule).
+export interface McpDraft {
+  name: string;
+  transport?: McpTransport;
+  command?: string;
+  args?: string[];
+  url?: string;
+  oauth?: boolean;
+  env?: Record<string, string>;
+}
+
+export interface McpControl {
+  // Every managed server, non-secret projection. Enabled or not — the app shows
+  // disabled connectors so they can be toggled back on.
+  list(): RemoteMcpServer[];
+  // Create or edit a server. Validates transport ⟷ required field (stdio→command,
+  // http→url). Returns a one-line result. Re-projects mcp.json on success.
+  save(draft: McpDraft): { ok: boolean; message?: string };
+  // Enable/disable a server (re-projects). ok:false when the name is unknown.
+  setEnabled(name: string, enabled: boolean): { ok: boolean; message?: string };
+  // Delete a server entirely (re-projects). ok:false when nothing was configured.
+  remove(name: string): { ok: boolean; message?: string };
+}
+
+const TRANSPORTS: readonly McpTransport[] = ["stdio", "http"];
+function isTransport(v: unknown): v is McpTransport {
+  return typeof v === "string" && TRANSPORTS.includes(v as McpTransport);
+}
+
+function hostOf(url: string): string | undefined {
+  try {
+    return new URL(url).host || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function cleanArgs(v: unknown): string[] | undefined {
+  if (!Array.isArray(v)) return undefined;
+  return v.map((x) => String(x ?? "")).filter((s) => s.length > 0);
+}
+
+export function makeMcpControl(opts?: {
+  // Override the source/projection dir (tests). Defaults to the shared agent dir, so
+  // this control and the desktop's mcpService edit the SAME two files.
+  dir?: () => string;
+}): McpControl {
+  const dir = opts?.dir ?? agentDir;
+  const sourcePath = () => join(dir(), "mcp-desktop.json");
+  const projectionPath = () => join(dir(), "mcp.json");
+
+  function readSource(): SourceFile {
+    // Seed from an existing standard mcp.json on first run (a machine that already
+    // had connectors before this control existed), so nothing is silently dropped.
+    try {
+      const raw = JSON.parse(readFileSync(sourcePath(), "utf8"));
+      if (raw && typeof raw === "object" && raw.servers) return { servers: raw.servers };
+    } catch {
+      /* fall through to seed */
+    }
+    const servers: Record<string, SourceEntry> = {};
+    try {
+      const proj = JSON.parse(readFileSync(projectionPath(), "utf8"));
+      for (const [name, entry] of Object.entries(proj?.mcpServers ?? {})) {
+        servers[name] = { ...(entry as SourceEntry), enabled: true };
+      }
+    } catch {
+      /* no prior config */
+    }
+    return { servers };
+  }
+
+  function writeSource(src: SourceFile): void {
+    mkdirSync(dirname(sourcePath()), { recursive: true });
+    writeFileSync(sourcePath(), JSON.stringify(src, null, 2) + "\n");
+    project(src);
+  }
+
+  // Project the enabled servers into the standard mcp.json the adapter reads. An
+  // entry with no explicit transport is treated as stdio if it has a command, http
+  // if it has a url — matching the adapter's own inference.
+  function project(src: SourceFile): void {
+    const mcpServers: Record<string, unknown> = {};
+    for (const [name, e] of Object.entries(src.servers)) {
+      if (e.enabled === false) continue;
+      const { enabled, ...std } = e;
+      mcpServers[name] = std;
+    }
+    mkdirSync(dirname(projectionPath()), { recursive: true });
+    writeFileSync(projectionPath(), JSON.stringify({ mcpServers }, null, 2) + "\n");
+  }
+
+  function toRemote(name: string, e: SourceEntry): RemoteMcpServer {
+    const transport: McpTransport = e.transport ?? (e.url ? "http" : "stdio");
+    const env = e.env ?? {};
+    const envKeys = Object.keys(env);
+    return {
+      name,
+      transport,
+      enabled: e.enabled !== false,
+      command: transport === "stdio" ? e.command : undefined,
+      argsPreview: transport === "stdio" && e.args?.length ? e.args.join(" ") : undefined,
+      url: transport === "http" ? e.url : undefined,
+      host: transport === "http" && e.url ? hostOf(e.url) : undefined,
+      // http servers negotiate OAuth; stdio never does (matches mcpService.list()).
+      oauth: transport === "http",
+      envKeys,
+      secretsSet: envKeys.filter((k) => String(env[k] ?? "").length > 0),
+    };
+  }
+
+  return {
+    list(): RemoteMcpServer[] {
+      const src = readSource();
+      return Object.entries(src.servers).map(([name, e]) => toRemote(name, e));
+    },
+
+    save(draft: McpDraft): { ok: boolean; message?: string } {
+      const name = String(draft?.name ?? "").trim();
+      if (!name) return { ok: false, message: "A connector needs a name." };
+      if (draft.transport !== undefined && !isTransport(draft.transport))
+        return { ok: false, message: "Unknown transport." };
+
+      const src = readSource();
+      const prev: SourceEntry = src.servers[name] ?? {};
+      const entry: SourceEntry = { ...prev };
+
+      const transport: McpTransport =
+        (draft.transport as McpTransport) ?? prev.transport ?? (draft.url || prev.url ? "http" : "stdio");
+      entry.transport = transport;
+
+      if (transport === "stdio") {
+        if (draft.command !== undefined) entry.command = String(draft.command).trim();
+        const args = cleanArgs(draft.args);
+        if (args !== undefined) entry.args = args;
+        // A stdio server can't reach a url and never does OAuth — clear stale fields.
+        delete entry.url;
+        delete entry.oauth;
+        if (!entry.command) return { ok: false, message: "A local (stdio) connector needs a command." };
+      } else {
+        if (draft.url !== undefined) entry.url = String(draft.url).trim();
+        if (draft.oauth !== undefined) entry.oauth = !!draft.oauth;
+        delete entry.command;
+        delete entry.args;
+        if (!entry.url) return { ok: false, message: "A remote (http) connector needs a URL." };
+      }
+
+      // Env/secrets: a present, non-empty value overwrites; an omitted key keeps the
+      // existing value (re-save without re-typing the token preserves it). An explicit
+      // empty string clears that key.
+      if (draft.env !== undefined) {
+        const merged: Record<string, string> = { ...(prev.env ?? {}) };
+        for (const [k, v] of Object.entries(draft.env)) {
+          const key = String(k).trim();
+          if (!key) continue;
+          const val = String(v ?? "");
+          if (val.length > 0) merged[key] = val;
+          else delete merged[key];
+        }
+        if (Object.keys(merged).length > 0) entry.env = merged;
+        else delete entry.env;
+      }
+
+      // A brand-new server comes up enabled; an edit preserves the prior flag.
+      entry.enabled = prev.enabled ?? true;
+
+      src.servers[name] = entry;
+      try {
+        writeSource(src);
+      } catch (e) {
+        return { ok: false, message: `Couldn't write MCP config: ${e instanceof Error ? e.message : String(e)}` };
+      }
+      return { ok: true, message: `Saved "${name}".` };
+    },
+
+    setEnabled(name: string, enabled: boolean): { ok: boolean; message?: string } {
+      const src = readSource();
+      if (!src.servers[name]) return { ok: false, message: "No such connector." };
+      src.servers[name].enabled = !!enabled;
+      try {
+        writeSource(src);
+      } catch (e) {
+        return { ok: false, message: `Couldn't write MCP config: ${e instanceof Error ? e.message : String(e)}` };
+      }
+      return { ok: true, message: `${enabled ? "Enabled" : "Disabled"} "${name}".` };
+    },
+
+    remove(name: string): { ok: boolean; message?: string } {
+      const src = readSource();
+      if (!src.servers[name]) return { ok: false, message: "Not configured." };
+      delete src.servers[name];
+      try {
+        writeSource(src);
+      } catch (e) {
+        return { ok: false, message: `Couldn't write MCP config: ${e instanceof Error ? e.message : String(e)}` };
+      }
+      return { ok: true, message: `Removed "${name}".` };
+    },
+  };
+}

package/src/remote/relayClient.ts

@@ -182,6 +182,22 @@ export interface RelayCallbacks {
   // The app asked to delete a platform's channel config, by platform name. Signed
   // (H2) — a forged removal is a DoS (the bot stops until re-added).
   onChannelsRemove?: (platform: string, sig?: string, ts?: number) => void;
+  // The app opened the MCP connectors manager — reply with the current MCP config
+  // (a sendMcp frame). Owned by the daemon (the host that runs the adapter), so these
+  // only fire on its relay. Read-only, so unsigned.
+  onMcpList?: () => void;
+  // The app asked to create/edit an MCP connector. `draft` carries only NON-secret
+  // fields (name/transport/command/args/url/oauth). `sealedSecrets`, when present, is
+  // a base64 sealed-box the app sealed to THIS terminal's pinned pubkey, opening to
+  // `{ termId, env: {NAME: value} }` — the connector's credential env. `sig`+`ts`
+  // authenticate the WHOLE save with the pinned account key (same shape as
+  // channels_save), so a hostile relay can neither forge a token nor inject a command.
+  onMcpSave?: (draft: Record<string, unknown>, sealedSecrets?: string, sig?: string, ts?: number) => void;
+  // The app asked to enable/disable a connector by name. Signed (H2) — a forged toggle
+  // silently arms/disarms a tool surface. Idempotent (non-strict ts).
+  onMcpSetEnabled?: (name: string, enabled: boolean, sig?: string, ts?: number) => void;
+  // The app asked to delete a connector by name. Signed (H2) — a forged removal is a DoS.
+  onMcpRemove?: (name: string, sig?: string, ts?: number) => void;
   // The app opened the workflows manager — reply with the current workflow summaries
   // (a sendWorkflows frame). Owned by the daemon, so these only fire on its relay.
   onWorkflowsList?: () => void;
@@ -519,6 +535,27 @@ export class RelayClient {
       case "channels_remove":
         if (typeof frame.platform === "string") this.cb.onChannelsRemove?.(frame.platform, sig(frame), tsOf(frame));
         break;
+      case "mcp_list":
+        this.cb.onMcpList?.();
+        break;
+      case "mcp_save":
+        // The connector rides in `draft` (same slot as channels_save), untyped — the
+        // daemon strict-validates it via mcpControl.save after the signature check.
+        if (frame.draft && typeof frame.draft === "object") {
+          this.cb.onMcpSave?.(
+            frame.draft,
+            typeof frame.sealedSecrets === "string" ? frame.sealedSecrets : undefined,
+            sig(frame),
+            tsOf(frame),
+          );
+        }
+        break;
+      case "mcp_set_enabled":
+        if (typeof frame.name === "string") this.cb.onMcpSetEnabled?.(frame.name, frame.enabled === true, sig(frame), tsOf(frame));
+        break;
+      case "mcp_remove":
+        if (typeof frame.name === "string") this.cb.onMcpRemove?.(frame.name, sig(frame), tsOf(frame));
+        break;
       case "workflows_list":
         this.cb.onWorkflowsList?.();
         break;
@@ -875,6 +912,47 @@ export class RelayClient {
     });
   }
 
+  // Push the host's MCP connectors to the app's MCP manager. Sent on request and after
+  // each save/set_enabled/remove. Like sendChannels this is the user's OWN config echoed
+  // to their OWN app — but an env VALUE (a token) NEVER crosses this wire: only `envKeys`
+  // (names) and `secretsSet` (which of those are non-empty, by name) are sent, so a relay
+  // / server compromise can't lift a credential from this frame. List bounded like the
+  // other managers.
+  sendMcp(payload: {
+    items: {
+      name: string;
+      transport: string;
+      enabled: boolean;
+      command?: string;
+      argsPreview?: string;
+      url?: string;
+      host?: string;
+      oauth: boolean;
+      envKeys: string[];
+      secretsSet: string[];
+    }[];
+    busy?: boolean;
+    message?: string;
+  }): void {
+    this.rawSend({
+      type: "mcp",
+      items: payload.items.slice(0, 50).map((m) => ({
+        name: clip(String(m.name), 128),
+        transport: m.transport === "http" ? "http" : "stdio",
+        enabled: !!m.enabled,
+        command: m.command ? clip(m.command, 200) : undefined,
+        argsPreview: m.argsPreview ? clip(m.argsPreview, 500) : undefined,
+        url: m.url ? clip(m.url, 500) : undefined,
+        host: m.host ? clip(m.host, 200) : undefined,
+        oauth: !!m.oauth,
+        envKeys: (m.envKeys ?? []).slice(0, 30).map((k) => clip(String(k), 128)),
+        secretsSet: (m.secretsSet ?? []).slice(0, 30).map((k) => clip(String(k), 128)),
+      })),
+      busy: !!payload.busy,
+      message: payload.message ? clip(payload.message, 500) : undefined,
+    });
+  }
+
   // Push the daemon's saved workflows to the app's workflows manager as SUMMARIES (not
   // the full graphs — the editor fetches one at a time via sendWorkflow). Sent on request
   // and after each save/remove/run. The user's OWN config echoed to their OWN app, so

package/src/remote/remoteBridge.ts

@@ -158,6 +158,13 @@ export class RemoteBridge {
     onChannelsList: () => {},
     onChannelsSave: () => {},
     onChannelsRemove: () => {},
+    // MCP connectors, like channels, are managed on the daemon (the host that runs the
+    // adapter) — the daemon's own relay handles mcp_*. These no-ops just satisfy Required;
+    // an interactive terminal manages MCP over IPC (desktop), never over this relay.
+    onMcpList: () => {},
+    onMcpSave: () => {},
+    onMcpSetEnabled: () => {},
+    onMcpRemove: () => {},
     // Workflows, like routines/channels, are daemon-owned — the daemon's own relay handles
     // workflows_*. These no-ops just satisfy Required; an interactive terminal never
     // surfaces workflows.

package/src/routines/schema.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { z } from "zod";
 
 // Where a routine's result is delivered after it runs. `file`/`relay`/`notice` stay
@@ -79,6 +80,13 @@ export const RoutineFile = z.object({
 export type RoutineFile = z.infer<typeof RoutineFile>;
 
 // A time-ordered routine id minted once at creation.
+//
+// The random suffix is load-bearing, not decoration. This was `r-${Date.now()}` alone,
+// so two routines created in the SAME MILLISECOND got the same id — and upsertRoutine
+// keys on id, so the second silently overwrote the first. Creating routines in quick
+// succession (an import, a scripted setup, a fast tap-tap in the app) could therefore
+// lose one with no error anywhere. The timestamp prefix still sorts by creation order;
+// the suffix just makes collisions vanishingly unlikely.
 export function newRoutineId(): string {
-  return `r-${Date.now()}`;
+  return `r-${Date.now()}-${randomBytes(4).toString("hex")}`;
 }