privateer-agent 0.6.7 → 0.6.8

package/SECURITY.md

@@ -30,7 +30,11 @@ npm audit signatures                          # verifies registry signatures + p
 ```
 
 If a version lacks provenance, it did not come from this workflow. Treat that as
-suspicious and report it.
+suspicious and report it — with one documented exception: **0.6.7 is the first release
+published this way.** Trusted publishing was misconfigured until then, so every earlier
+version (through 0.6.6) was published by hand from a maintainer's machine and carries no
+attestation. Those are not forgeries, but they are not independently verifiable either.
+If that distinction matters to you, use 0.6.7 or later.
 
 ## The permission gate
 

package/bin/privateer-launch.mjs

@@ -214,28 +214,39 @@ else {
   // auto-install. Fire-and-forget: the event loop stays alive while the TUI child runs.
   refreshUpdateCache();
 
-  // Default model. Explicit PRIVATEER_MODEL wins; else Tinfoil GLM 5.2 (client-attested
-  // TEE, strongest tier) when a Tinfoil key is present; else the signed-in account's
-  // NEAR channel; else a cheap OpenRouter fallback.
+  // Default model. Mirrors src/providers/defaultModel.ts resolveDefaultModel() — keep
+  // the two in step. Tinfoil's GLM 5.2 is the default either way: direct when the user
+  // has a Tinfoil key (pi-privacy can client-attest the enclave), over the Privateer
+  // subscription otherwise.
+  //
+  // The last branch is the important one. A signed-out, keyless terminal used to launch
+  // on `openrouter/openai/gpt-4o-mini`, which it had no key for — so the first prompt
+  // died on "No API key found for openrouter", /login couldn't fix it (nothing switched
+  // the live model), and the error named a provider the user had never heard of. It now
+  // launches on the SAME account model it will use once signed in: nothing to switch,
+  // the status bar shows what they're about to get, and the error until then names
+  // Privateer and points at /login.
   const CRED = path.join(PRIVATEER_HOME, "credentials.json");
   const signedIn = fs.existsSync(CRED);
+  const ACCOUNT_MODEL = "privateer/tinfoil/glm-5-2";
   const MODEL = process.env.PRIVATEER_MODEL
     ? process.env.PRIVATEER_MODEL
     : haveTinfoilKey()
       ? "tinfoil/glm-5-2"
       : signedIn
-        ? "privateer/near/zai-org/GLM-5.1-FP8"
-        : "openrouter/openai/gpt-4o-mini";
-
-  // Guard the keyless dead-end. We land on the OpenRouter fallback ONLY when the user
-  // named no model, has no Tinfoil key, AND isn't signed in (no credentials.json). If
-  // they also have no OpenRouter/other BYO key, the very first prompt errors with a bare
-  // "No API key found for openrouter" and nothing explains why. Worse, if this machine
-  // was signed in before (other ~/.privateer state exists but the login file is gone),
-  // that bare error hides a vanished session. Surface a clear, branded notice BEFORE the
-  // TUI loads — but still boot it, so `/login` inside works (and activateSignedInModel
-  // switches the live session onto the account channel the moment they sign back in).
-  if (MODEL === "openrouter/openai/gpt-4o-mini" && !haveByoKey()) {
+        ? ACCOUNT_MODEL
+        : haveKey("ANTHROPIC_API_KEY")
+          ? "anthropic/claude-opus-4-8"
+          : haveKey("OPENAI_API_KEY")
+            ? "openai/gpt-5.5"
+            : haveKey("OPENROUTER_API_KEY")
+              ? "openrouter/openai/gpt-4o-mini"
+              : ACCOUNT_MODEL;
+
+  // Nothing to run with: no model named, no BYO key, not signed in. The TUI still boots
+  // (that's where /login lives), but say why up front — a returning user whose login
+  // file vanished otherwise has no way to tell a cleared session from a first run.
+  if (!signedIn && !process.env.PRIVATEER_MODEL && !haveByoKey()) {
     warnKeylessLaunch();
   }
 
@@ -367,20 +378,17 @@ function warnKeylessLaunch() {
     ? [
         "",
         "  ⚓ Your Privateer login is missing — this terminal isn't signed in.",
-        `     (no ${path.join(PRIVATEER_HOME, "credentials.json")})`,
         "",
-        "  If you were signed in before, your session was cleared. Run /login to sign",
-        "  back in — you'll return to your subscription models right away. Until then,",
-        "  prompting fails with \"No API key found\" because no model key is set.",
+        "  Run /login and approve the code in the Privateer app. You'll be back on your",
+        "  subscription models straight away — no API key needed.",
         "",
       ]
     : [
         "",
-        "  ⚓ You're not signed in to Privateer and no provider API key is set.",
+        "  ⚓ Welcome aboard. Run /login to connect your Privateer account.",
         "",
-        "  Run /login to use your subscription, or set a provider key (e.g.",
-        "  ANTHROPIC_API_KEY / OPENAI_API_KEY / OPENROUTER_API_KEY). Until then,",
-        "  prompting fails with \"No API key found\".",
+        "  One approval in the Privateer app and you're running Tinfoil GLM 5.2 in a",
+        "  trusted enclave — no API key needed. Prefer your own key? /login keys.",
         "",
       ];
   process.stderr.write(lines.join("\n") + "\n");

package/extensions/privateer-brand.ts

@@ -5,25 +5,30 @@
 //   1. A branded startup header — the anchor mark + "✻ PRIVATEER" wordmark + the
 //      "Chart your own course privately." tagline (ported from tree-cli's Banner).
 //   2. A live status-bar badge (⚓ account) showing the sign-in state at a glance.
-//   3. Sign-in UX — /signin, /signout, and a /privateer hub — which drive the
+//   3. Auth UX — /login, /logout, and a /privateer hub — which drive the
 //      device-code flow the account channel needs.
 //
-// Pi already owns /login and /logout for PROVIDER auth (and /whoami), so we do NOT
-// shadow them. The account provider now registers unconditionally (see
-// makeAccountProvider), so Privateer appears under Pi's /login "Use a subscription"
-// list and a first-time user CAN sign in through provider auth. /signin remains as a
-// friendlier, dedicated shortcut that drives the same account device-code flow
-// directly — one obvious command instead of /login → pick a provider.
+// ONE vocabulary, deliberately: log in / log out. This file used to avoid shadowing
+// Pi's built-in /login and /logout and shipped /signin and /signout alongside them,
+// which left the user with two auth vocabularies and — worse — a /logout that did
+// not log you out. Pi's /logout only clears Pi's own authStorage; the Privateer
+// machine login lives in ~/.privateer/credentials.json and survived it, so /logout
+// on a signed-in machine reported "No stored credentials to remove" and changed
+// nothing. We now own both verbs: /logout here is canonical and Pi's built-in is
+// redirected to it (patches/, same mechanism as the /model → /models redirect).
+// /signin and /signout stay as undocumented aliases for muscle memory.
 //
-// On a successful /signin we hot-register the account provider so privateer/* models
-// appear immediately (the account catalog refreshes to the live listing without a
-// restart).
+// The account provider also registers unconditionally (see makeAccountProvider), so
+// Privateer appears under Pi's "Use a subscription" list and a first-time user can
+// log in that way too. On a successful login we hot-register the account provider so
+// privateer/* models appear immediately (the account catalog refreshes to the live
+// listing without a restart).
 
 import { readFileSync, appendFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import * as priv from "../src/auth/privateer.ts";
-import { makeAccountProvider } from "../src/providers/account.ts";
+import { armAccountCredential, makeAccountProvider } from "../src/providers/account.ts";
 import { resolveSignedInModel } from "../src/providers/defaultModel.ts";
 import { discoverContextFiles, onContextChanged } from "../src/context.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
@@ -345,11 +350,18 @@ export default function privateerBrand(pi: any): void {
     }
   }
 
+  // /login. Signing in must leave the terminal ABLE TO PROMPT, not merely "connected" —
+  // so this runs the device flow, hot-registers the account provider, then hands off to
+  // activateSignedInModel to arm the channel and select the model. Every step reports.
   async function doSignIn(ctx: any): Promise<void> {
     if (priv.hasCredentials()) {
       const u = priv.currentUser();
+      // Already linked: still make sure THIS session can use the account (a terminal
+      // launched before the login, or one whose channel never armed, otherwise sits
+      // "signed in" and unusable), then point at the two things they might have meant.
+      await activateSignedInModel(ctx, { switchModel: false });
       return ctx?.ui?.notify?.(
-        `Already signed in as ${u?.email ?? u?.id}. Run /signout to switch accounts.`,
+        `Signed in as ${u?.email ?? u?.id}. Run /logout to switch accounts, or /login keys to add a provider API key.`,
         "info",
       );
     }
@@ -367,7 +379,7 @@ export default function privateerBrand(pi: any): void {
               `${p.DIM}Approve this terminal in the Privateer app:${p.RESET}`,
               `   code   ${p.BOLD}${p.ACCENT}${userCode}${p.RESET}`,
               uri ? `${p.DIM}   or open ${p.RESET}${p.INK}${uri}${p.RESET}` : "",
-              `${p.DIM}   waiting for approval…${p.RESET}`,
+              `${p.DIM}   waiting for approval… ${p.RESET}${p.DIM}(esc to cancel · ${p.RESET}${p.INK}/login keys${p.DIM} to use your own API key instead)${p.RESET}`,
             ].filter(Boolean),
             { placement: "aboveEditor" },
           );
@@ -381,20 +393,31 @@ export default function privateerBrand(pi: any): void {
         /* provider list fetch failed — models appear on next launch */
       }
       refresh(ctx);
-      ctx?.ui?.notify?.(`Signed in as ${user.email ?? user.id}. Your Privateer models are ready.`, "info");
+      ctx?.ui?.notify?.(`Signed in as ${user.email ?? user.id}.`, "info");
+      // Arm the account channel and select the model, IN THIS SESSION. runDeviceLogin
+      // fires onSignedIn too, which does the same work — this await is what makes the
+      // outcome (and any failure) land before we hand the prompt back to the user.
+      await activateSignedInModel(ctx);
     } catch (e) {
       ctx?.ui?.setWidget?.("privateer-signin", undefined);
       ctx?.ui?.notify?.((e as Error).message || "Sign-in failed.", "error");
     }
   }
 
+  // Log out of this MACHINE — the login and every terminal spawned from it (see
+  // priv.logout). Unlike the old terminal-scoped sign-out this makes a blocking
+  // network call, so say what's happening before the round trip rather than after.
   async function doSignOut(ctx: any): Promise<void> {
     if (!priv.hasCredentials()) return ctx?.ui?.notify?.("Not signed in.", "info");
     const u = priv.currentUser();
-    await priv.logout();
+    ctx?.ui?.notify?.("Signing out of Privateer…", "info");
+    await priv.logout(); // never throws: local state is wiped whatever the network did
     dropPersistedAccount(ctx);
     refresh(ctx);
-    ctx?.ui?.notify?.(`Signed out${u?.email ? ` (${u.email})` : ""}. Drop anchor for now.`, "info");
+    ctx?.ui?.notify?.(
+      `Signed out${u?.email ? ` (${u.email})` : ""} — this machine and its terminals. Drop anchor for now.`,
+      "info",
+    );
   }
 
   function showStatus(ctx: any): void {
@@ -402,50 +425,103 @@ export default function privateerBrand(pi: any): void {
     ctx?.ui?.notify?.(
       u
         ? `Signed in to Privateer as ${u.email ?? u.id}.`
-        : "Not signed in. Run /signin to connect your Privateer account.",
+        : "Not logged in. Run /login to connect your Privateer account.",
       "info",
     );
   }
 
-  // Move the LIVE session onto a confidential model the instant the user signs in. A
-  // terminal launched with no credentials is pinned by `--model` to the keyless
-  // OpenRouter fallback; without this switch it stays there and the first prompt after
-  // sign-in dead-ends on "No API key found for openrouter". resolveSignedInModel picks
-  // Tinfoil GLM 5.2 (client-attested TEE) when a key is present, else the account's NEAR
-  // channel — private inference that works out of the box. We only override an auto-picked
-  // launch model, never a deliberate PRIVATEER_MODEL, and never re-switch if we're already
-  // on the target. The account (NEAR) credential is spawned moments AFTER sign-in fires,
-  // so setModel can briefly return false ("no key yet"); retry a few times so the switch
-  // lands as soon as the credential is ready (Tinfoil, key already in env, succeeds first
-  // try). Best-effort throughout — a failure just leaves the launch model in place.
-  async function activateSignedInModel(ctx: any): Promise<void> {
-    if (process.env.PRIVATEER_MODEL?.trim()) return; // deliberate override — respect it
-    const reg = ctx?.modelRegistry;
-    if (!reg?.find || typeof pi.setModel !== "function") return;
-    const spec = resolveSignedInModel();
-    const slash = spec.indexOf("/");
-    if (slash <= 0) return;
-    const provider = spec.slice(0, slash), id = spec.slice(slash + 1);
-    const currentSpec = ctx?.model ? `${ctx.model.provider}/${ctx.model.id}` : "";
-    if (currentSpec === spec) return; // already there — nothing to do
-    const model = reg.find(provider, id);
-    if (!model) { dbg(`activateSignedInModel: ${spec} not in registry`); return; }
-    for (let attempt = 0; attempt < 4; attempt++) {
-      try {
-        const ok = await pi.setModel(model);
-        if (ok !== false) {
-          currentModelProvider = provider;
-          refresh(ctx);
-          ctx?.ui?.notify?.(`Now using ${spec} for private inference.`, "info");
-          dbg(`activateSignedInModel: switched to ${spec}`);
+  // Make the terminal USABLE the instant the user signs in — the whole point of
+  // logging in, and the step that used to be missing. Two halves, in this order:
+  //
+  //   1. ARM the account channel. Pi stores an OAuth credential only for a login it
+  //      drove itself, so after our own device-code /login the `privateer` provider has
+  //      no key at all. Arming first also matters for the now-common case where the
+  //      launch model ALREADY is the account model (a signed-out terminal boots on it,
+  //      see providers/defaultModel.ts): there's no switch to make, only a key to fetch,
+  //      and the old early-return skipped it and left the next prompt to fail.
+  //   2. SWITCH the live model, if we aren't already on it. A terminal that launched on
+  //      a BYO key stays on that key otherwise, so signing in appears to do nothing.
+  //
+  // resolveSignedInModel picks Tinfoil GLM 5.2 — direct (client-attested) when a Tinfoil
+  // key is present, over the subscription otherwise. A deliberate PRIVATEER_MODEL is
+  // never overridden. Idempotent: sign-in fires this twice by design (once when
+  // credentials land, once when the channel is ready), and a second run is a no-op.
+  // Best-effort — but a failure is now REPORTED, because silently leaving the user on an
+  // unusable model is exactly the bug this replaces.
+  let activating = false;
+  async function activateSignedInModel(ctx: any, opts: { switchModel?: boolean } = {}): Promise<void> {
+    if (activating || process.env.PRIVATEER_MODEL?.trim()) return; // in-flight, or a deliberate override
+    activating = true;
+    try {
+      const spec = resolveSignedInModel();
+      const slash = spec.indexOf("/");
+      if (slash <= 0) return;
+      const provider = spec.slice(0, slash), id = spec.slice(slash + 1);
+
+      // The account channel needs a live session token before any privateer/* model can
+      // run. Retry briefly: this can be racing the credential the login itself minted.
+      if (provider === "privateer") {
+        let armed = false;
+        for (let attempt = 0; attempt < 3 && !armed; attempt++) {
+          armed = await armAccountCredential(ctx, { notify: false });
+          if (!armed) await new Promise((r) => setTimeout(r, 500));
+        }
+        if (!armed) {
+          dbg("activateSignedInModel: account channel not armed");
+          ctx?.ui?.notify?.(
+            "Signed in, but this terminal couldn't open an account session. Check your connection and run /login again, or sign a terminal out in the app if you're at the device limit.",
+            "error",
+          );
           return;
         }
-      } catch (e) {
-        dbg(`activateSignedInModel: setModel threw ${(e as Error).message}`);
       }
-      await new Promise((r) => setTimeout(r, 400)); // credential still spawning — retry
+
+      // Re-running /login while already signed in arms the channel but must NOT move the
+      // user off a model they picked with /models. Only a genuine sign-in switches.
+      if (opts.switchModel === false) return;
+
+      // Already on the target — the common case now that a signed-out terminal launches
+      // on the account model. Nothing to switch, but SAY so: the channel just went live
+      // under them, and silence after a login is what made the old flow feel broken.
+      const currentSpec = ctx?.model ? `${ctx.model.provider}/${ctx.model.id}` : "";
+      if (currentSpec === spec) {
+        dbg(`activateSignedInModel: already on ${spec}`);
+        refresh(ctx);
+        ctx?.ui?.notify?.(`${spec} is ready — private inference on your Privateer account.`, "info");
+        return;
+      }
+
+      const reg = ctx?.modelRegistry;
+      if (!reg?.find || typeof pi.setModel !== "function") return;
+      const model = reg.find(provider, id);
+      if (!model) {
+        // The provider's live catalog may still be loading (or this is the first sign-in
+        // of the run, before the account provider was registered). Say something useful
+        // rather than stranding them on a model their account can't bill.
+        dbg(`activateSignedInModel: ${spec} not in registry`);
+        ctx?.ui?.notify?.(`Signed in. Run /models to pick a model — ${spec} isn't loaded yet.`, "warning");
+        return;
+      }
+      for (let attempt = 0; attempt < 4; attempt++) {
+        try {
+          const ok = await pi.setModel(model);
+          if (ok !== false) {
+            currentModelProvider = provider;
+            refresh(ctx);
+            ctx?.ui?.notify?.(`Now using ${spec} — private inference on your Privateer account.`, "info");
+            dbg(`activateSignedInModel: switched to ${spec}`);
+            return;
+          }
+        } catch (e) {
+          dbg(`activateSignedInModel: setModel threw ${(e as Error).message}`);
+        }
+        await new Promise((r) => setTimeout(r, 400)); // registry still settling — retry
+      }
+      dbg(`activateSignedInModel: gave up switching to ${spec}`);
+      ctx?.ui?.notify?.(`Signed in, but couldn't switch to ${spec}. Run /models to pick one.`, "warning");
+    } finally {
+      activating = false;
     }
-    dbg(`activateSignedInModel: gave up switching to ${spec}`);
   }
 
   dbg("extension loaded, onSignedIn listener registering");
@@ -529,27 +605,38 @@ export default function privateerBrand(pi: any): void {
     // that's now dead server-side (see dropPersistedAccount).
     dropPersistedAccount(ctxRef);
     refresh(ctxRef);
-    ctxRef?.ui?.notify?.("Your Privateer session expired. Run /signin to sign back in.", "warning");
+    ctxRef?.ui?.notify?.("Your Privateer session expired. Run /login to sign back in.", "warning");
   });
 
   pi.registerCommand?.("update", {
     description: "Update Privateer to the latest release (npm i -g privateer-agent@latest)",
     handler: (_args: string, ctx: any) => doUpdate(ctx),
   });
-  pi.registerCommand?.("signin", {
-    description: "Sign in to your Privateer account (device-code flow)",
+  // ONE vocabulary: log in / log out. Pi's own built-ins are /login and /logout, so
+  // matching them is what makes the pair feel like a single concept instead of two
+  // half-overlapping ones (Pi's /logout used to clear only Pi's authStorage while the
+  // machine login lived on, which read as "logout doesn't work"). /logout here is the
+  // canonical command; the Pi built-in is redirected to it by patches/, the same
+  // mechanism as the /model → /models redirect.
+  //
+  // signin/signout stay registered as undocumented aliases — they were the shipped
+  // names, they're in muscle memory and in older docs, and an alias costs nothing.
+  pi.registerCommand?.("login", {
+    description: "Log in to your Privateer account · /login keys for a provider API key",
     handler: (_args: string, ctx: any) => doSignIn(ctx),
   });
-  pi.registerCommand?.("signout", {
-    description: "Sign out of your Privateer account on this terminal",
+  pi.registerCommand?.("logout", {
+    description: "Log out of Privateer on this machine (revokes all its terminals)",
     handler: (_args: string, ctx: any) => doSignOut(ctx),
   });
+  pi.registerCommand?.("signin", { description: "", handler: (_a: string, ctx: any) => doSignIn(ctx) });
+  pi.registerCommand?.("signout", { description: "", handler: (_a: string, ctx: any) => doSignOut(ctx) });
   pi.registerCommand?.("privateer", {
-    description: "Privateer account: /privateer [status | signin | signout]",
+    description: "Privateer account: /privateer [status | login | logout]",
     handler: (args: string, ctx: any) => {
       const sub = String(args ?? "").trim().toLowerCase().split(/\s+/)[0];
-      if (sub === "signin" || sub === "login") return doSignIn(ctx);
-      if (sub === "signout" || sub === "logout") return doSignOut(ctx);
+      if (sub === "login" || sub === "signin") return doSignIn(ctx);
+      if (sub === "logout" || sub === "signout") return doSignOut(ctx);
       return showStatus(ctx);
     },
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -1,8 +1,23 @@
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-index e223ce1..2bdab10 100644
+index e223ce1..3615d74 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-@@ -711,6 +711,15 @@ export class AgentSession {
+@@ -163,6 +163,14 @@ export class AgentSession {
+         }
+         const isOAuth = this._modelRegistry.isUsingOAuth(model);
+         if (isOAuth) {
++            // Privateer patch: the account channel has no API key that could expire —
++            // the terminal is simply not signed in yet (a fresh install now boots on
++            // `privateer/*`, which is the model it will run once logged in). Stock Pi's
++            // wording describes a state that user was never in, and its "/login
++            // privateer" bypasses the branded sign-in. auth-guidance owns the words.
++            if (model.provider === "privateer") {
++                throw new Error(formatNoApiKeyFoundMessage(model.provider));
++            }
+             throw new Error(`Authentication failed for "${model.provider}". ` +
+                 `Credentials may have expired or network is unavailable. ` +
+                 `Run '/login ${model.provider}' to re-authenticate.`);
+@@ -711,6 +719,15 @@ export class AgentSession {
                  finalError: msg.errorMessage,
              });
              this._retryAttempt = 0;
@@ -18,8 +33,52 @@ index e223ce1..2bdab10 100644
          }
          if (await this._checkCompaction(msg)) {
              return true;
+diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js
+index 197bccc..27f6429 100644
+--- a/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js
++++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js
+@@ -1,21 +1,33 @@
+ import { join } from "node:path";
+ import { getDocsPath } from "../config.js";
+ const UNKNOWN_PROVIDER = "unknown";
++// Privateer patch: speak Privateer, and stop printing absolute node_modules doc paths.
++//
++// Stock Pi answered every auth failure with four lines, two of them full paths into
++// node_modules/@earendil-works/pi-coding-agent/docs/. On a terminal that isn't signed
++// in, that wall repeats on every prompt and buries the one sentence that matters. It
++// also told a Privateer user to go find a provider API key when their subscription
++// already covers the model. Same information, one actionable line.
+ export function getProviderLoginHelp() {
+-    return [
+-        "Use /login to log into a provider via OAuth or API key. See:",
+-        `  ${join(getDocsPath(), "providers.md")}`,
+-        `  ${join(getDocsPath(), "models.md")}`,
+-    ].join("\n");
++    return "Run /login to connect your Privateer account, or /login keys to use your own provider API key.";
+ }
+ export function formatNoModelsAvailableMessage() {
+     return `No models available. ${getProviderLoginHelp()}`;
+ }
+ export function formatNoModelSelectedMessage() {
+-    return `No model selected.\n\n${getProviderLoginHelp()}\n\nThen use /model to select a model.`;
++    return `No model selected. ${getProviderLoginHelp()}\n\nThen use /models to select a model.`;
+ }
+ export function formatNoApiKeyFoundMessage(provider) {
++    // The account channel: there is no API key to find — you're just not signed in (or
++    // the session didn't arm). Naming the real problem is the whole fix here.
++    if (provider === "privateer") {
++        return "This terminal isn't signed in to Privateer, so it can't run your subscription models.\n\nRun /login — it takes one approval in the Privateer app, and no API key.";
++    }
+     const providerDisplay = provider === UNKNOWN_PROVIDER ? "the selected model" : provider;
+     return `No API key found for ${providerDisplay}.\n\n${getProviderLoginHelp()}`;
+ }
++// Kept so the module's imports stay meaningful for anything that still wants the docs.
++export function getProviderDocsPaths() {
++    return [join(getDocsPath(), "providers.md"), join(getDocsPath(), "models.md")];
++}
+ //# sourceMappingURL=auth-guidance.js.map
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
-index 5d65200..a997ad7 100644
+index 5d65200..fef6005 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/interactive-mode.js
 @@ -2042,7 +2042,17 @@ export class InteractiveMode {
@@ -41,3 +100,51 @@ index 5d65200..a997ad7 100644
                  return;
              }
              if (text === "/export" || text.startsWith("/export ")) {
+@@ -2105,14 +2115,44 @@ export class InteractiveMode {
+                 this.editor.setText("");
+                 return;
+             }
+-            if (text === "/login") {
+-                this.showOAuthSelector("login");
++            if (text === "/login" || text.startsWith("/login ")) {
+                 this.editor.setText("");
++                // Privateer redirect: a bare /login IS the account sign-in. Pi's built-in
++                // opens a two-step menu ("Use a subscription" → a list of 20+ providers)
++                // that buries the one option a Privateer user wants, and — because it
++                // only auto-selects a model when the current one is UNKNOWN — a
++                // successful login through it left the terminal on its launch model and
++                // the next prompt died on "No API key found". The extension's own flow
++                // signs in, arms the account channel, and selects the model.
++                // `/login <anything>` (documented as `/login keys`) still opens Pi's own
++                // selector, so BYO provider keys stay reachable; and if the extension
++                // isn't loaded we fall back to Pi's selector for both.
++                if (text === "/login" && this.isExtensionCommand("/privateer")) {
++                    await this.session.prompt("/privateer login");
++                }
++                else {
++                    this.showOAuthSelector("login");
++                }
+                 return;
+             }
+             if (text === "/logout") {
+-                this.showOAuthSelector("logout");
+                 this.editor.setText("");
++                // Privateer redirect: /logout must actually log you out. Pi's built-in
++                // only clears Pi's authStorage, which leaves the Privateer machine
++                // login in ~/.privateer/credentials.json untouched — so on a signed-in
++                // machine it reported "No stored credentials to remove" and changed
++                // nothing. Route to the account logout instead, which revokes this
++                // machine's whole token family (login + every terminal spawned from it)
++                // and wipes local state. Target is `/privateer logout` rather than the
++                // extension's own `/logout` so this can never re-enter the branch it
++                // was dispatched from. Falls back to Pi's selector when the extension
++                // isn't loaded.
++                if (this.isExtensionCommand("/privateer")) {
++                    await this.session.prompt("/privateer logout");
++                }
++                else {
++                    this.showOAuthSelector("logout");
++                }
+                 return;
+             }
+             if (text === "/new") {

package/src/auth/accountSessions.ts

@@ -144,7 +144,10 @@ export function dropOwnedSession(pid: number): void {
   writeRegistry(reg);
 }
 
-// Test seam: wipe the registry file.
+// Wipe the registry. Used by logout(), where the server has just revoked this
+// machine's whole token family: every entry now names a dead session, and leaving
+// them behind would offer the next login a list of orphans to "reclaim" that can
+// only fail. Also a test seam.
 export function clearOwnedSessions(): void {
   try {
     rmSync(accountSessionsPath(), { force: true });

package/src/auth/privateer.ts

@@ -21,6 +21,7 @@ import {
   forgetOwnedSession,
   orphanedSessions,
   dropOwnedSession,
+  clearOwnedSessions,
 } from "./accountSessions.ts";
 import { isAccountCapCode } from "../engine/errors.ts";
 import { terminalPublicKeyBase64 } from "../crypto/terminalKey.ts";
@@ -94,9 +95,37 @@ export function defaultDeviceLabel(): string {
   }
 }
 
-// ── Credential storage (0600, like saveGlobalConfig) ─────────────────────────
+// ── Cross-instance state ─────────────────────────────────────────────────────
+//
+// Pi loads every extension with a FRESH jiti instance (`moduleCache: false`, see
+// core/extensions/loader.js), so privateer-brand and privateer-account each get their
+// OWN copy of this module — separate credential cache, separate listener sets.
+//
+// That silently broke /login. The account provider's OAuth login() ran inside the
+// privateer-account copy and called notifySignedIn() there, while the UI's listener
+// (the one that switches the live session onto a model the account can actually
+// serve) was registered on the privateer-brand copy. The signal never crossed, so a
+// successful sign-in left the terminal pinned to its keyless launch model and the
+// very next prompt died with "No API key found for openrouter" — exactly the state
+// the login was supposed to fix. The same split let a /logout in one copy leave a
+// stale `user` memoized in another.
+//
+// So anything that must be observed ACROSS extensions lives on globalThis, keyed by
+// a registered Symbol — one bus, however many module instances jiti creates.
+const SHARED = Symbol.for("privateer.auth.shared");
+
+interface SharedAuthState {
+  cache: Credentials | null;
+  signedIn: Set<SignedInListener>;
+  expired: Set<SessionExpiredListener>;
+}
 
-let _cache: Credentials | null | undefined;
+function shared(): SharedAuthState {
+  const g = globalThis as { [SHARED]?: SharedAuthState };
+  return (g[SHARED] ??= { cache: null, signedIn: new Set(), expired: new Set() });
+}
+
+// ── Credential storage (0600, like saveGlobalConfig) ─────────────────────────
 
 // Per-terminal child session (see spawnChildSession). Held in memory ONLY — it
 // is never written to the shared credentials file, so each running terminal
@@ -144,15 +173,16 @@ export function loadCredentials(): Credentials | null {
   // memoized the pre-login "absent" as null, that instance would report "not signed
   // in" forever (e.g. /remote-access refusing after a successful sign-in). Re-reading
   // disk on each miss lets a later call see what a sign-in just wrote.
-  if (_cache) return _cache;
+  const state = shared();
+  if (state.cache) return state.cache;
   const path = credentialsPath();
   if (!existsSync(path)) return null;
   try {
-    _cache = JSON.parse(readFileSync(path, "utf8")) as Credentials;
+    state.cache = JSON.parse(readFileSync(path, "utf8")) as Credentials;
   } catch {
     return null;
   }
-  return _cache;
+  return state.cache;
 }
 
 export function saveCredentials(creds: Credentials): void {
@@ -162,7 +192,7 @@ export function saveCredentials(creds: Credentials): void {
   const path = credentialsPath();
   writeFileSync(path, JSON.stringify(creds, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
   tryChmod(path, 0o600);
-  _cache = creds;
+  shared().cache = creds;
 }
 
 export function clearCredentials(): void {
@@ -174,7 +204,7 @@ export function clearCredentials(): void {
   // Drop the pinned account signing key too — it belongs to the account that just
   // signed out; a different account must re-pin its own at link.
   clearAccountSignKey();
-  _cache = null;
+  shared().cache = null;
   _child = null;
   _account = null;
 }
@@ -204,15 +234,15 @@ function tryChmod(path: string, mode: number): void {
 // stops working; the UI subscribes to announce the sign-out prominently.
 
 type SessionExpiredListener = () => void;
-const _expiredListeners = new Set<SessionExpiredListener>();
 
 export function onSessionExpired(listener: SessionExpiredListener): () => void {
-  _expiredListeners.add(listener);
-  return () => _expiredListeners.delete(listener);
+  const listeners = shared().expired;
+  listeners.add(listener);
+  return () => listeners.delete(listener);
 }
 
 function notifySessionExpired(): void {
-  for (const listener of _expiredListeners) {
+  for (const listener of shared().expired) {
     try {
       listener();
     } catch {
@@ -248,17 +278,19 @@ export function handleServerRevoke(): void {
 // A listener here refreshes the UI regardless of which path the user took.
 
 type SignedInListener = () => void;
-const _signedInListeners = new Set<SignedInListener>();
 
 export function onSignedIn(listener: SignedInListener): () => void {
-  _signedInListeners.add(listener);
-  return () => _signedInListeners.delete(listener);
+  const listeners = shared().signedIn;
+  listeners.add(listener);
+  return () => listeners.delete(listener);
 }
 
 // Emit the sign-in signal. Exported so the account OAuth provider can announce a
 // completed subscription login on the already-linked path (see the note above).
+// Listeners MUST be idempotent: a device-code login fires this once the credentials
+// land and again once the account channel is armed (see privateerOAuthProvider.login).
 export function notifySignedIn(): void {
-  for (const listener of _signedInListeners) {
+  for (const listener of shared().signedIn) {
     try {
       listener();
     } catch {
@@ -602,15 +634,55 @@ export async function revokeLocalSessions(timeoutMs = 1500): Promise<void> {
 // ── Logout ───────────────────────────────────────────────────────────────────
 
 /**
- * Log out this terminal: revoke its session server-side (best effort) and wipe
- * local credentials. Other devices/sessions are untouched.
+ * Log out this MACHINE: revoke the machine login and every terminal session
+ * spawned from it, then wipe all local auth state. Other devices (the phone app,
+ * another laptop) keep their own logins — each has its own token family.
+ *
+ * Two things this deliberately does NOT do, both of which it used to:
+ *
+ * 1. It does not POST /auth/logout. That endpoint calls revokeAllUserSessions —
+ *    the entire ACCOUNT, every device including the app — while this function's
+ *    contract (and its old doc comment) promised the opposite. Signing out of one
+ *    terminal must not sign you out of your phone.
+ *
+ * 2. It does not go through apiRequest/authedFetch. Those authenticate with a CHILD
+ *    session and spawn one if absent — so at the per-machine child cap the spawn
+ *    throws 429 and the logout never reaches the server AT ALL. That was a deadlock:
+ *    the cap blocked the one call that clears the cap. We authenticate with the
+ *    PARENT instead, which is never subject to the cap.
+ *
+ * The parent's stored access token is usually expired (it is minted once at /login
+ * and never rotated — the refresh token is the liveness proof), so we rotate for a
+ * fresh one first. Rotation is free here precisely because we are destroying the
+ * credential either way: nothing downstream needs the token we burn. rotateSession
+ * is the no-ownership-side-effects variant, so this cannot clobber the registry
+ * entry of a session we are about to revoke wholesale anyway.
+ *
+ * DELETE /auth/session/current then revokes the parent's family, which the server
+ * cascades to every row with `parentFamilyId === familyId` — i.e. all this machine's
+ * terminals, including the orphans left by terminals that died without their
+ * shutdown hook. That cascade is what makes an accumulated cap self-clearing:
+ * logout, log back in, and the machine starts from zero live children.
+ *
+ * Local state is wiped unconditionally at the end, whatever the network did. A
+ * logout that can't reach the server must still leave you logged out locally —
+ * the rows it failed to revoke age out on their TTL.
  */
 export async function logout(): Promise<void> {
-  try {
-    await apiRequest("/auth/logout", { method: "POST" });
-  } catch {
-    /* best effort — clear locally regardless */
+  const parent = loadCredentials();
+  if (parent) {
+    try {
+      const fresh = await rotateSession(parent.refreshToken);
+      await deleteSession(fresh.access, 5000);
+    } catch {
+      /* offline, or the login was already dead server-side — wipe locally anyway */
+    }
   }
+  // In-memory sessions are gone with the family above; drop the handles so nothing
+  // tries to revoke them individually on the way out.
+  _child = null;
+  _account = null;
+  clearOwnedSessions(); // every entry named a session the cascade just killed
   clearCredentials();
 }
 
@@ -622,7 +694,7 @@ export async function logout(): Promise<void> {
 // = the JWT's exp (so Pi refreshes just before the server would reject it). These are
 // independent of authedFetch's in-memory _child (Pi owns this credential's lifecycle).
 
-interface AccountCredential {
+export interface AccountCredential {
   access: string;
   refresh: string;
   expires: number; // ms epoch

package/src/cli/chat.ts

@@ -478,8 +478,8 @@ async function main() {
       });
       console.log(`${GREEN}Signed in as ${user.email ?? user.id}.${RESET}`);
       // Move the live session onto a confidential model right away, so the next prompt
-      // doesn't dead-end on the keyless launch model ("No API key found for openrouter").
-      // resolveSignedInModel prefers Tinfoil GLM 5.2, else the account's NEAR channel;
+      // doesn't dead-end on the launch model's missing key. resolveSignedInModel picks
+      // Tinfoil GLM 5.2 — direct with a Tinfoil key, over the subscription otherwise;
       // PRIVATEER_MODEL (a deliberate override) is respected and left alone.
       if (!process.env.PRIVATEER_MODEL?.trim()) {
         const target = resolveSignedInModel();

package/src/daemon/index.ts

@@ -326,7 +326,7 @@ export class Daemon {
         // The account signed this daemon out server-side (revoked from the app's Linked
         // Devices). Beyond ending remote access (onTerminate), this wipes the machine
         // login: drop the relay and clear credentials, so routines/tasks stop cleanly
-        // instead of dead-ending on a 401 each run. Stays idle until you /signin on this
+        // instead of dead-ending on a 401 each run. Stays idle until you /login on this
         // machine and restart the daemon (the relayTerminated guard, as with onTerminate).
         onRevoked: () => {
           this.relayTerminated = true;
@@ -334,7 +334,7 @@ export class Daemon {
           this.relay?.stop();
           this.relay = undefined;
           handleServerRevoke();
-          log("account signed out from the app (session revoked) — cleared credentials; idle until you run /signin on this machine and restart the daemon");
+          log("account signed out from the app (session revoked) — cleared credentials; idle until you run /login on this machine and restart the daemon");
         },
         onStatus: (text) => log(`relay: ${text}`),
         onDisconnected: () => {

package/src/providers/account.ts

@@ -11,6 +11,7 @@
 // only a first-ever machine login runs the device-code flow.
 
 import {
+  type AccountCredential,
   serverBaseUrl,
   hasCredentials,
   runDeviceLogin,
@@ -20,16 +21,18 @@ import {
   notifySignedIn,
 } from "../auth/privateer.ts";
 import { interpretReport, teePosture, tierFromTeePosture, type PrivacyTier } from "pi-privacy";
-import { ACCOUNT_DEFAULT_MODEL_ID, ensurePiDefaultModel } from "./defaultModel.ts";
+import { ACCOUNT_DEFAULT_MODEL_ID, ACCOUNT_NEAR_MODEL_ID, ensurePiDefaultModel } from "./defaultModel.ts";
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
-// particular the signed-in default, near/zai-org/GLM-5.1-FP8, resolves at startup
-// without a "model not found" warning. The first entry is that default: a NEAR
-// confidential-compute (TEE, attestable) model — the strongest privacy tier. Also the
-// fallback list if the live listing can't be reached.
+// particular the default, tinfoil/glm-5-2, resolves at startup without a "model not
+// found" warning, which matters more than ever now that a signed-OUT terminal also
+// launches on it. The first two entries are the TEE tiers (Tinfoil, then NEAR); the
+// rest are the familiar names. Also the fallback list if the live listing is
+// unreachable.
 const DEFAULT_MODELS = [
   ACCOUNT_DEFAULT_MODEL_ID,
+  ACCOUNT_NEAR_MODEL_ID,
   "anthropic/claude-sonnet-4.6",
   "openai/gpt-5.5",
   "deepseek/deepseek-v4-flash",
@@ -169,37 +172,62 @@ export const privateerOAuthProvider = {
       }
     }
     if (cb.signal?.aborted) throw new Error("Login cancelled");
-    const creds = await acquireAccountCredential();
+    // Go through the process-wide, single-flighted accessor rather than acquiring
+    // directly. The device flow above already fired notifySignedIn, whose listeners arm
+    // the account channel — so a bare acquire here would race that one and mint a SECOND
+    // server-side session (a duplicate row in Linked Devices, and a step closer to
+    // 429 CHILD_SESSION_CAP). Sharing the in-flight promise makes it exactly one.
+    const creds = await accountCredential();
     // Seed Pi's saved model default to the account channel, so the next launch resolves
     // to a billable subscription model instead of falling through to a keyless built-in
     // (the "No API key found for openrouter" trap). No-op if the user already has a
     // chosen default. See providers/defaultModel.ts.
     ensurePiDefaultModel();
-    // The fresh path already fired notifySignedIn (pollForToken); fire here for the
-    // already-linked path so the header re-renders to "connected" on this terminal too.
-    if (wasLinked) notifySignedIn();
+    // Announce the completed login — ALWAYS, on both paths, and only now that the
+    // account channel actually holds a credential.
+    //
+    // The fresh path fires this once already, from pollForToken, the instant
+    // credentials.json is written. That's the right moment for the header, and the
+    // wrong one for the model: the listener that moves the live session onto an
+    // account model would run while this spawn was still in flight and find no key.
+    // Firing again here is what makes the switch land. Listeners are documented as
+    // idempotent (see notifySignedIn), and the model switch no-ops when it's already
+    // on target, so the double signal costs nothing.
+    notifySignedIn();
     return creds;
   },
   async refreshToken(creds: { refresh: string }) {
+    let next: AccountCredential;
     try {
-      return await refreshAccountCredentials(creds.refresh);
+      next = await refreshAccountCredentials(creds.refresh);
     } catch {
       // Child token expired/reused → get another. acquire (not spawn) so a terminal
       // that already holds the device's last session slot can reclaim an orphan
       // instead of being refused a fresh one mid-session.
-      return acquireAccountCredential();
+      next = await acquireAccountCredential();
     }
+    // Keep the process memo on the CURRENT token: the one it replaced is dead, and
+    // handing a dead token to a later arm() would 401 on the first prompt.
+    rememberAccountCredential(next);
+    return next;
   },
   getApiKey(creds: { access: string }): string {
     return creds.access;
   },
 };
 
-// Which privacy channel an account model routes through: NEAR confidential-compute
-// (TEE, attestable) for `near/`-prefixed ids, else a server-side ZDR channel.
-// Ported from tree-cli resolve.ts.
+// Confidential-compute prefixes in the account catalog: every model the server serves
+// out of a TEE. `near/` is the one we can attest end to end from here (the server
+// proxies a nonce'd quote); `tinfoil/` and `phala/` are equally real enclaves whose
+// attestation we cannot bind to THIS connection through the proxy — see accountPosture.
+const TEE_PREFIXES = ["near/", "tinfoil/", "phala/"];
+
+// Which privacy channel an account model routes through: confidential compute (TEE)
+// for the prefixes above, else a server-side ZDR channel. Ported from tree-cli
+// resolve.ts, then widened — it used to say `near/` only, which quietly labelled the
+// default model (tinfoil/glm-5-2, a TEE model) as a mere ZDR policy claim.
 export function privateerChannel(modelId: string): "tee" | "zdr" {
-  return modelId.startsWith("near/") ? "tee" : "zdr";
+  return TEE_PREFIXES.some((p) => modelId.startsWith(p)) ? "tee" : "zdr";
 }
 
 export interface AccountPosture {
@@ -220,6 +248,16 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
   if (privateerChannel(modelId) === "zdr") {
     return { tier: "zdr-policy" };
   }
+  // Honest labelling for the non-NEAR enclaves. Tinfoil and Phala publish real
+  // attestations, but the server proxies the inference, so from here we cannot bind a
+  // quote to the connection actually carrying our tokens — only the account's word
+  // that it did. That's `tee-unverified` (yellow "confidential compute, unconfirmed"),
+  // never the green tee-verified we reserve for a quote we checked ourselves. A user
+  // who wants the verified shield sets TINFOIL_API_KEY and runs `tinfoil/*` direct,
+  // where pi-privacy attests the enclave client-side.
+  if (!modelId.startsWith("near/")) {
+    return { tier: "tee-unverified" };
+  }
   try {
     const res = await authedFetch(
       `${serverBaseUrl()}/api/models/near/attestation?model=${encodeURIComponent(modelId)}`,
@@ -286,22 +324,67 @@ export function makeAccountProvider() {
     // all, and the first prompt dead-ends on "No API key found for privateer." — even
     // though the banner says "connected". The REPL (cli/chat.ts) and the daemon
     // already spawn one at startup; this gives the TUI the same seed.
-    pi.on?.("session_start", (_e, ctx) => void ensureAccountCredential(ctx));
+    pi.on?.("session_start", (_e, ctx) => void armAccountCredential(ctx));
   };
 }
 
-// One spawn per PROCESS. session_start also fires for new/resume/fork/reload — all of
-// which keep this process (and its account session) alive — so re-spawning there would
-// leak a device row per event. A fresh process always spawns: a run that crashed
-// without its shutdown hook can leave a REVOKED credential persisted in auth.json with
-// a still-valid-looking `expires`, which Pi would happily reuse and 401 on.
+// ── Arming the account channel ───────────────────────────────────────────────
+//
+// ONE account session per PROCESS. Every mint is expensive and visible: it's a row in
+// the app's Linked Devices list, and the server caps how many a device may hold
+// (429 CHILD_SESSION_CAP). session_start alone fires for new/resume/fork/reload, and a
+// mid-session /login wants the channel armed too — so the credential is minted once
+// and then remembered, and later callers reuse it instead of stacking another row.
+//
+// Both the memo and its in-flight promise live on globalThis rather than in module
+// scope, because jiti gives each extension its OWN instance of this file (see the note
+// in auth/privateer.ts). privateer-account seeds at launch and privateer-brand arms
+// after a sign-in; module-scoped state would let each mint its own session.
 //
-// The flag lives on globalThis, not in module scope, because jiti gives each extension
-// that imports this file its OWN module instance (see the note in auth/privateer.ts):
-// privateer-account and privateer-brand — which hot-registers the provider on /signin —
-// would otherwise hold separate flags and each spawn a session.
-const SEEDED = Symbol.for("privateer.accountCredentialSeeded");
-type SeedFlag = { [SEEDED]?: boolean };
+// A fresh PROCESS always mints: a run that crashed without its shutdown hook can leave
+// a REVOKED credential persisted in auth.json with a still-valid-looking `expires`,
+// which Pi would happily reuse and 401 on.
+const ARMED = Symbol.for("privateer.accountCredential");
+type ArmedSlot = {
+  [ARMED]?: { cred?: AccountCredential; inFlight?: Promise<AccountCredential> };
+};
+
+function armSlot(): NonNullable<ArmedSlot[typeof ARMED]> {
+  const g = globalThis as ArmedSlot;
+  return (g[ARMED] ??= {});
+}
+
+// Record a credential this process minted so nothing mints a second one. Exported for
+// the OAuth login path, which acquires its credential for Pi to own and would
+// otherwise leave the next arm() with nothing to reuse.
+export function rememberAccountCredential(cred: AccountCredential): void {
+  armSlot().cred = cred;
+}
+
+// The remembered credential, if it's still usable. A minute of headroom: handing back
+// one that expires mid-request just trades a spawn for a 401.
+function liveAccountCredential(): AccountCredential | undefined {
+  const cred = armSlot().cred;
+  return cred && cred.expires > Date.now() + 60_000 ? cred : undefined;
+}
+
+// Get this process's account credential, minting one only if we don't already hold a
+// live one. Single-flighted, so two callers racing (session_start and a sign-in) share
+// one spawn rather than opening two sessions.
+async function accountCredential(): Promise<AccountCredential> {
+  const live = liveAccountCredential();
+  if (live) return live;
+  const slot = armSlot();
+  slot.inFlight ??= acquireAccountCredential()
+    .then((cred) => {
+      slot.cred = cred;
+      return cred;
+    })
+    .finally(() => {
+      slot.inFlight = undefined;
+    });
+  return slot.inFlight;
+}
 
 // `ctx` is Pi's ExtensionContext; the auth store hangs off its model registry (the same
 // path privateer-brand uses to DROP the credential on sign-out).
@@ -311,23 +394,35 @@ type SeedContext = {
   ui?: { notify?: (message: string, level: string) => void };
 };
 
-async function ensureAccountCredential(ctx: unknown): Promise<void> {
-  const flag = globalThis as SeedFlag;
-  if (flag[SEEDED] || !hasCredentials()) return;
-  flag[SEEDED] = true;
+// Put a working account credential into Pi's auth store, so `privateer/*` models can
+// actually run. Called at session_start (the launch seed) and again right after a
+// sign-in (see the brand extension) — a mid-session /login has to arm the channel
+// itself, because Pi writes an OAuth credential only for a login IT drove, never for
+// our own /login device-code command.
+//
+// Returns true when the channel is armed. `notify` controls whether a failure is
+// announced: the launch seed says so out loud, while a caller that reports the outcome
+// itself (the sign-in path) passes false so the user doesn't read it twice.
+export async function armAccountCredential(
+  ctx: unknown,
+  opts: { notify?: boolean } = {},
+): Promise<boolean> {
+  if (!hasCredentials()) return false;
   const store = (ctx as SeedContext)?.modelRegistry?.authStorage;
-  if (typeof store?.set !== "function") return;
+  if (typeof store?.set !== "function") return false;
   try {
-    const creds = await acquireAccountCredential();
-    store.set("privateer", { type: "oauth", ...creds });
+    store.set("privateer", { type: "oauth", ...(await accountCredential()) });
+    return true;
   } catch (e) {
     // The account channel is NOT armed: a dead machine login (401 → credentials cleared
     // + onSessionExpired), the terminal cap (429), or a network blip. Say so now — the
     // banner still reads "connected" (it only knows about the local credentials file),
     // so staying silent leaves the user to discover it as a bare "No API key found for
-    // privateer" on their first prompt. Cleared so a later attempt can retry.
-    flag[SEEDED] = false;
+    // privateer" on their first prompt.
     const c = ctx as SeedContext;
-    if (c?.hasUI) c.ui?.notify?.(`Privateer account channel unavailable — ${(e as Error).message}`, "error");
+    if (opts.notify !== false && c?.hasUI) {
+      c.ui?.notify?.(`Privateer account channel unavailable — ${(e as Error).message}`, "error");
+    }
+    return false;
   }
 }

package/src/providers/defaultModel.ts

@@ -15,24 +15,35 @@ import { join } from "node:path";
 import { hasCredentials } from "../auth/privateer.ts";
 import { agentDir } from "../config/paths.ts";
 
-// The signed-in default: a NEAR confidential-compute (TEE, attestable) model — the
-// strongest privacy tier the account channel offers, and the same id the app shows
-// first. Kept here as the one definition; providers/account.ts imports it so its seed
-// catalog can't drift.
-export const ACCOUNT_DEFAULT_MODEL_ID = "near/zai-org/GLM-5.1-FP8";
+// Tinfoil's most capable chat model, and Privateer's default everywhere. Tinfoil runs
+// GLM 5.2 inside an attestable TEE (the serving enclave's quote is published and the
+// live TLS key is bound to it), which is the strongest privacy tier we offer — so the
+// most capable model on that tier is what a privacy-first agent should boot on.
+// One definition, three consumers: this resolver, providers/account.ts's seed catalog,
+// and bin/privateer-launch.mjs (which mirrors the id — keep them in step).
+export const TINFOIL_MODEL_ID = "tinfoil/glm-5-2";
+
+// Same model, reached two ways:
+//   - TINFOIL_DEFAULT_SPEC — direct to inference.tinfoil.sh with the user's own
+//     TINFOIL_API_KEY, where pi-privacy can CLIENT-attest the enclave live.
+//   - ACCOUNT_DEFAULT_SPEC — through the Privateer subscription (the `privateer`
+//     provider proxies it), so a signed-in user needs no BYO key at all.
+// The direct route wins when a key is present; otherwise being signed in is enough.
+export const TINFOIL_DEFAULT_SPEC = TINFOIL_MODEL_ID;
+export const ACCOUNT_DEFAULT_MODEL_ID = TINFOIL_MODEL_ID;
 export const ACCOUNT_DEFAULT_SPEC = `privateer/${ACCOUNT_DEFAULT_MODEL_ID}`;
 
-// Tinfoil's GLM 5.2 — CLIENT-side-attested TEE inference (the live TLS key is bound to
-// the enclave's quote), the strongest privacy tier we offer, stronger than the account's
-// server-proxied NEAR channel. Preferred whenever a Tinfoil key is present. Kept as the
-// one definition so bin/privateer-tui and this resolver agree. See extensions/privateer-
-// privacy.ts, which registers `tinfoil/glm-5-2` (and friends) on the tinfoil provider.
-export const TINFOIL_DEFAULT_SPEC = "tinfoil/glm-5-2";
-
-// Last-resort BYO default, preserved from the pre-resolver code so a user who set an
-// OpenRouter key (and isn't signed in) keeps the old behaviour. If they have no key
-// either, this still surfaces the familiar "No API key found for openrouter" — a clear
-// signal to run /login or set a key, which is better than an empty/undefined model.
+// The account channel's NEAR confidential-compute model — no longer the default, but
+// still the one account model we can attest end-to-end through the server proxy, so
+// it stays first in the seed catalog after the default. See providers/account.ts.
+export const ACCOUNT_NEAR_MODEL_ID = "near/zai-org/GLM-5.1-FP8";
+
+// The legacy BYO default, kept ONLY for a user who set an OpenRouter key and isn't
+// signed in — it's what their key actually pays for. It is deliberately no longer the
+// keyless fallback: landing a signed-out, keyless terminal on OpenRouter is what
+// produced the "No API key found for openrouter" dead end that /login couldn't
+// explain. With no key and no login we now point at the account channel instead, so
+// the error names Privateer and /login is visibly the fix.
 export const LEGACY_BYO_FALLBACK = "openrouter/openai/gpt-4o-mini";
 
 // BYO providers we can positively detect from the environment, in preference order.
@@ -56,14 +67,15 @@ export interface ResolveDefaultModelOptions {
 
 // Resolve the model spec ("provider/id") to use when no model is named. Pure and
 // synchronous (only reads env + the credentials file), so it's safe to call from any
-// entry point at startup. Precedence (mirrors bin/privateer-tui's launch logic, so the
-// launcher, the REPL, and the next-launch seed all agree):
+// entry point at startup. Precedence (mirrors bin/privateer-launch.mjs's launch logic,
+// so the launcher, the REPL, and the next-launch seed all agree):
 //   1. explicit user choice (config/channel)      — deliberate, always wins
 //   2. PRIVATEER_MODEL env                         — dev/global override
 //   3. Tinfoil key present → Tinfoil GLM 5.2       — strongest (client-attested) privacy
-//   4. signed into Privateer → the account default — subscription users, no BYO key
+//   4. signed into Privateer → the same model over the subscription
 //   5. a BYO provider whose key is present         — anthropic, openai, openrouter
-//   6. LEGACY_BYO_FALLBACK                          — familiar "add a key" signal
+//   6. nothing at all → the account default anyway — so the failure names Privateer
+//      and /login is the visible fix, instead of a keyless OpenRouter dead end
 export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): string {
   const env = opts.env ?? process.env;
 
@@ -84,15 +96,19 @@ export function resolveDefaultModel(opts: ResolveDefaultModelOptions = {}): stri
     if (env[keyName]?.trim()) return spec;
   }
 
-  return LEGACY_BYO_FALLBACK;
+  // No key, no login. Point at the account channel regardless: it's the model this
+  // terminal will run the moment they /login, so signing in needs no model switch at
+  // all, and until then the error reads "No API key found for privateer" — which our
+  // guidance turns into "you're not signed in · run /login".
+  return ACCOUNT_DEFAULT_SPEC;
 }
 
 // The confidential model to switch the LIVE session onto the moment a user signs in.
-// A terminal launched with no credentials is pinned by `--model` to the keyless
-// OpenRouter fallback; without an in-session switch it stays there and the first prompt
-// after /login dead-ends on "No API key found for openrouter". This resolves the model
-// sign-in should activate RIGHT AWAY: Tinfoil GLM 5.2 when a key is present, otherwise
-// the account's NEAR confidential channel (billable to the subscription, no BYO key).
+// A terminal launched with a BYO key (or an explicit --model) is pinned to whatever it
+// resolved at launch; without an in-session switch a mid-session /login changes nothing
+// visible and the user is left wondering what signing in bought them. This resolves the
+// model sign-in should activate RIGHT AWAY: Tinfoil GLM 5.2, direct when a Tinfoil key
+// is present and over the subscription otherwise — no BYO key needed.
 // PRIVATEER_MODEL still wins — a deliberate override is never stomped.
 export function resolveSignedInModel(env: NodeJS.ProcessEnv = process.env): string {
   return resolveDefaultModel({ env, signedIn: true });