privateer-agent 0.6.7 → 0.6.9

package/SECURITY.md

@@ -30,7 +30,11 @@ npm audit signatures                          # verifies registry signatures + p
 ```
 
 If a version lacks provenance, it did not come from this workflow. Treat that as
-suspicious and report it.
+suspicious and report it — with one documented exception: **0.6.7 is the first release
+published this way.** Trusted publishing was misconfigured until then, so every earlier
+version (through 0.6.6) was published by hand from a maintainer's machine and carries no
+attestation. Those are not forgeries, but they are not independently verifiable either.
+If that distinction matters to you, use 0.6.7 or later.
 
 ## The permission gate
 

package/bin/privateer-launch.mjs

@@ -146,6 +146,7 @@ else {
   const MANAGED = [
     "privateer-brand", "privateer-context", "privateer-gate", "privateer-account",
     "privateer-models", "privateer-posture", "privateer-tools", "privateer-privacy",
+    "privateer-connect",
     "pi-privacy", "pi-web-access", "rpiv-web-tools", "pi-mcp-adapter", "pi-hypa", "pi-subagents",
   ];
   for (const name of MANAGED) fs.rmSync(path.join(EXT_DIR, `${name}.ts`), { force: true });
@@ -171,6 +172,7 @@ else {
   shim("privateer-posture", ext("privateer-posture.ts"));
   shim("privateer-tools", ext("privateer-tools.ts"));
   shim("privateer-privacy", ext("privateer-privacy.ts"));   // pi-privacy + account tier resolver
+  shim("privateer-connect", ext("privateer-connect.ts"));   // /connect — MCP connector manager
   shim("rpiv-web-tools", dep("@juicesharp/rpiv-web-tools", "index.ts")); // private web tools
   shim("pi-mcp-adapter", dep("pi-mcp-adapter", "index.ts"));
   shim("pi-hypa", dep("@hypabolic/pi-hypa", "extensions", "index.ts"));
@@ -214,28 +216,39 @@ else {
   // auto-install. Fire-and-forget: the event loop stays alive while the TUI child runs.
   refreshUpdateCache();
 
-  // Default model. Explicit PRIVATEER_MODEL wins; else Tinfoil GLM 5.2 (client-attested
-  // TEE, strongest tier) when a Tinfoil key is present; else the signed-in account's
-  // NEAR channel; else a cheap OpenRouter fallback.
+  // Default model. Mirrors src/providers/defaultModel.ts resolveDefaultModel() — keep
+  // the two in step. Tinfoil's GLM 5.2 is the default either way: direct when the user
+  // has a Tinfoil key (pi-privacy can client-attest the enclave), over the Privateer
+  // subscription otherwise.
+  //
+  // The last branch is the important one. A signed-out, keyless terminal used to launch
+  // on `openrouter/openai/gpt-4o-mini`, which it had no key for — so the first prompt
+  // died on "No API key found for openrouter", /login couldn't fix it (nothing switched
+  // the live model), and the error named a provider the user had never heard of. It now
+  // launches on the SAME account model it will use once signed in: nothing to switch,
+  // the status bar shows what they're about to get, and the error until then names
+  // Privateer and points at /login.
   const CRED = path.join(PRIVATEER_HOME, "credentials.json");
   const signedIn = fs.existsSync(CRED);
+  const ACCOUNT_MODEL = "privateer/tinfoil/glm-5-2";
   const MODEL = process.env.PRIVATEER_MODEL
     ? process.env.PRIVATEER_MODEL
     : haveTinfoilKey()
       ? "tinfoil/glm-5-2"
       : signedIn
-        ? "privateer/near/zai-org/GLM-5.1-FP8"
-        : "openrouter/openai/gpt-4o-mini";
-
-  // Guard the keyless dead-end. We land on the OpenRouter fallback ONLY when the user
-  // named no model, has no Tinfoil key, AND isn't signed in (no credentials.json). If
-  // they also have no OpenRouter/other BYO key, the very first prompt errors with a bare
-  // "No API key found for openrouter" and nothing explains why. Worse, if this machine
-  // was signed in before (other ~/.privateer state exists but the login file is gone),
-  // that bare error hides a vanished session. Surface a clear, branded notice BEFORE the
-  // TUI loads — but still boot it, so `/login` inside works (and activateSignedInModel
-  // switches the live session onto the account channel the moment they sign back in).
-  if (MODEL === "openrouter/openai/gpt-4o-mini" && !haveByoKey()) {
+        ? ACCOUNT_MODEL
+        : haveKey("ANTHROPIC_API_KEY")
+          ? "anthropic/claude-opus-4-8"
+          : haveKey("OPENAI_API_KEY")
+            ? "openai/gpt-5.5"
+            : haveKey("OPENROUTER_API_KEY")
+              ? "openrouter/openai/gpt-4o-mini"
+              : ACCOUNT_MODEL;
+
+  // Nothing to run with: no model named, no BYO key, not signed in. The TUI still boots
+  // (that's where /login lives), but say why up front — a returning user whose login
+  // file vanished otherwise has no way to tell a cleared session from a first run.
+  if (!signedIn && !process.env.PRIVATEER_MODEL && !haveByoKey()) {
     warnKeylessLaunch();
   }
 
@@ -367,20 +380,17 @@ function warnKeylessLaunch() {
     ? [
         "",
         "  ⚓ Your Privateer login is missing — this terminal isn't signed in.",
-        `     (no ${path.join(PRIVATEER_HOME, "credentials.json")})`,
         "",
-        "  If you were signed in before, your session was cleared. Run /login to sign",
-        "  back in — you'll return to your subscription models right away. Until then,",
-        "  prompting fails with \"No API key found\" because no model key is set.",
+        "  Run /login and approve the code in the Privateer app. You'll be back on your",
+        "  subscription models straight away — no API key needed.",
         "",
       ]
     : [
         "",
-        "  ⚓ You're not signed in to Privateer and no provider API key is set.",
+        "  ⚓ Welcome aboard. Run /login to connect your Privateer account.",
         "",
-        "  Run /login to use your subscription, or set a provider key (e.g.",
-        "  ANTHROPIC_API_KEY / OPENAI_API_KEY / OPENROUTER_API_KEY). Until then,",
-        "  prompting fails with \"No API key found\".",
+        "  One approval in the Privateer app and you're running Tinfoil GLM 5.2 in a",
+        "  trusted enclave — no API key needed. Prefer your own key? /login keys.",
         "",
       ];
   process.stderr.write(lines.join("\n") + "\n");

package/extensions/privateer-brand.ts

@@ -5,25 +5,30 @@
 //   1. A branded startup header — the anchor mark + "✻ PRIVATEER" wordmark + the
 //      "Chart your own course privately." tagline (ported from tree-cli's Banner).
 //   2. A live status-bar badge (⚓ account) showing the sign-in state at a glance.
-//   3. Sign-in UX — /signin, /signout, and a /privateer hub — which drive the
+//   3. Auth UX — /login, /logout, and a /privateer hub — which drive the
 //      device-code flow the account channel needs.
 //
-// Pi already owns /login and /logout for PROVIDER auth (and /whoami), so we do NOT
-// shadow them. The account provider now registers unconditionally (see
-// makeAccountProvider), so Privateer appears under Pi's /login "Use a subscription"
-// list and a first-time user CAN sign in through provider auth. /signin remains as a
-// friendlier, dedicated shortcut that drives the same account device-code flow
-// directly — one obvious command instead of /login → pick a provider.
+// ONE vocabulary, deliberately: log in / log out. This file used to avoid shadowing
+// Pi's built-in /login and /logout and shipped /signin and /signout alongside them,
+// which left the user with two auth vocabularies and — worse — a /logout that did
+// not log you out. Pi's /logout only clears Pi's own authStorage; the Privateer
+// machine login lives in ~/.privateer/credentials.json and survived it, so /logout
+// on a signed-in machine reported "No stored credentials to remove" and changed
+// nothing. We now own both verbs: /logout here is canonical and Pi's built-in is
+// redirected to it (patches/, same mechanism as the /model → /models redirect).
+// /signin and /signout stay as undocumented aliases for muscle memory.
 //
-// On a successful /signin we hot-register the account provider so privateer/* models
-// appear immediately (the account catalog refreshes to the live listing without a
-// restart).
+// The account provider also registers unconditionally (see makeAccountProvider), so
+// Privateer appears under Pi's "Use a subscription" list and a first-time user can
+// log in that way too. On a successful login we hot-register the account provider so
+// privateer/* models appear immediately (the account catalog refreshes to the live
+// listing without a restart).
 
 import { readFileSync, appendFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import * as priv from "../src/auth/privateer.ts";
-import { makeAccountProvider } from "../src/providers/account.ts";
+import { armAccountCredential, makeAccountProvider } from "../src/providers/account.ts";
 import { resolveSignedInModel } from "../src/providers/defaultModel.ts";
 import { discoverContextFiles, onContextChanged } from "../src/context.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
@@ -345,11 +350,18 @@ export default function privateerBrand(pi: any): void {
     }
   }
 
+  // /login. Signing in must leave the terminal ABLE TO PROMPT, not merely "connected" —
+  // so this runs the device flow, hot-registers the account provider, then hands off to
+  // activateSignedInModel to arm the channel and select the model. Every step reports.
   async function doSignIn(ctx: any): Promise<void> {
     if (priv.hasCredentials()) {
       const u = priv.currentUser();
+      // Already linked: still make sure THIS session can use the account (a terminal
+      // launched before the login, or one whose channel never armed, otherwise sits
+      // "signed in" and unusable), then point at the two things they might have meant.
+      await activateSignedInModel(ctx, { switchModel: false });
       return ctx?.ui?.notify?.(
-        `Already signed in as ${u?.email ?? u?.id}. Run /signout to switch accounts.`,
+        `Signed in as ${u?.email ?? u?.id}. Run /logout to switch accounts, or /login keys to add a provider API key.`,
         "info",
       );
     }
@@ -367,7 +379,7 @@ export default function privateerBrand(pi: any): void {
               `${p.DIM}Approve this terminal in the Privateer app:${p.RESET}`,
               `   code   ${p.BOLD}${p.ACCENT}${userCode}${p.RESET}`,
               uri ? `${p.DIM}   or open ${p.RESET}${p.INK}${uri}${p.RESET}` : "",
-              `${p.DIM}   waiting for approval…${p.RESET}`,
+              `${p.DIM}   waiting for approval… ${p.RESET}${p.DIM}(esc to cancel · ${p.RESET}${p.INK}/login keys${p.DIM} to use your own API key instead)${p.RESET}`,
             ].filter(Boolean),
             { placement: "aboveEditor" },
           );
@@ -381,20 +393,31 @@ export default function privateerBrand(pi: any): void {
         /* provider list fetch failed — models appear on next launch */
       }
       refresh(ctx);
-      ctx?.ui?.notify?.(`Signed in as ${user.email ?? user.id}. Your Privateer models are ready.`, "info");
+      ctx?.ui?.notify?.(`Signed in as ${user.email ?? user.id}.`, "info");
+      // Arm the account channel and select the model, IN THIS SESSION. runDeviceLogin
+      // fires onSignedIn too, which does the same work — this await is what makes the
+      // outcome (and any failure) land before we hand the prompt back to the user.
+      await activateSignedInModel(ctx);
     } catch (e) {
       ctx?.ui?.setWidget?.("privateer-signin", undefined);
       ctx?.ui?.notify?.((e as Error).message || "Sign-in failed.", "error");
     }
   }
 
+  // Log out of this MACHINE — the login and every terminal spawned from it (see
+  // priv.logout). Unlike the old terminal-scoped sign-out this makes a blocking
+  // network call, so say what's happening before the round trip rather than after.
   async function doSignOut(ctx: any): Promise<void> {
     if (!priv.hasCredentials()) return ctx?.ui?.notify?.("Not signed in.", "info");
     const u = priv.currentUser();
-    await priv.logout();
+    ctx?.ui?.notify?.("Signing out of Privateer…", "info");
+    await priv.logout(); // never throws: local state is wiped whatever the network did
     dropPersistedAccount(ctx);
     refresh(ctx);
-    ctx?.ui?.notify?.(`Signed out${u?.email ? ` (${u.email})` : ""}. Drop anchor for now.`, "info");
+    ctx?.ui?.notify?.(
+      `Signed out${u?.email ? ` (${u.email})` : ""} — this machine and its terminals. Drop anchor for now.`,
+      "info",
+    );
   }
 
   function showStatus(ctx: any): void {
@@ -402,50 +425,103 @@ export default function privateerBrand(pi: any): void {
     ctx?.ui?.notify?.(
       u
         ? `Signed in to Privateer as ${u.email ?? u.id}.`
-        : "Not signed in. Run /signin to connect your Privateer account.",
+        : "Not logged in. Run /login to connect your Privateer account.",
       "info",
     );
   }
 
-  // Move the LIVE session onto a confidential model the instant the user signs in. A
-  // terminal launched with no credentials is pinned by `--model` to the keyless
-  // OpenRouter fallback; without this switch it stays there and the first prompt after
-  // sign-in dead-ends on "No API key found for openrouter". resolveSignedInModel picks
-  // Tinfoil GLM 5.2 (client-attested TEE) when a key is present, else the account's NEAR
-  // channel — private inference that works out of the box. We only override an auto-picked
-  // launch model, never a deliberate PRIVATEER_MODEL, and never re-switch if we're already
-  // on the target. The account (NEAR) credential is spawned moments AFTER sign-in fires,
-  // so setModel can briefly return false ("no key yet"); retry a few times so the switch
-  // lands as soon as the credential is ready (Tinfoil, key already in env, succeeds first
-  // try). Best-effort throughout — a failure just leaves the launch model in place.
-  async function activateSignedInModel(ctx: any): Promise<void> {
-    if (process.env.PRIVATEER_MODEL?.trim()) return; // deliberate override — respect it
-    const reg = ctx?.modelRegistry;
-    if (!reg?.find || typeof pi.setModel !== "function") return;
-    const spec = resolveSignedInModel();
-    const slash = spec.indexOf("/");
-    if (slash <= 0) return;
-    const provider = spec.slice(0, slash), id = spec.slice(slash + 1);
-    const currentSpec = ctx?.model ? `${ctx.model.provider}/${ctx.model.id}` : "";
-    if (currentSpec === spec) return; // already there — nothing to do
-    const model = reg.find(provider, id);
-    if (!model) { dbg(`activateSignedInModel: ${spec} not in registry`); return; }
-    for (let attempt = 0; attempt < 4; attempt++) {
-      try {
-        const ok = await pi.setModel(model);
-        if (ok !== false) {
-          currentModelProvider = provider;
-          refresh(ctx);
-          ctx?.ui?.notify?.(`Now using ${spec} for private inference.`, "info");
-          dbg(`activateSignedInModel: switched to ${spec}`);
+  // Make the terminal USABLE the instant the user signs in — the whole point of
+  // logging in, and the step that used to be missing. Two halves, in this order:
+  //
+  //   1. ARM the account channel. Pi stores an OAuth credential only for a login it
+  //      drove itself, so after our own device-code /login the `privateer` provider has
+  //      no key at all. Arming first also matters for the now-common case where the
+  //      launch model ALREADY is the account model (a signed-out terminal boots on it,
+  //      see providers/defaultModel.ts): there's no switch to make, only a key to fetch,
+  //      and the old early-return skipped it and left the next prompt to fail.
+  //   2. SWITCH the live model, if we aren't already on it. A terminal that launched on
+  //      a BYO key stays on that key otherwise, so signing in appears to do nothing.
+  //
+  // resolveSignedInModel picks Tinfoil GLM 5.2 — direct (client-attested) when a Tinfoil
+  // key is present, over the subscription otherwise. A deliberate PRIVATEER_MODEL is
+  // never overridden. Idempotent: sign-in fires this twice by design (once when
+  // credentials land, once when the channel is ready), and a second run is a no-op.
+  // Best-effort — but a failure is now REPORTED, because silently leaving the user on an
+  // unusable model is exactly the bug this replaces.
+  let activating = false;
+  async function activateSignedInModel(ctx: any, opts: { switchModel?: boolean } = {}): Promise<void> {
+    if (activating || process.env.PRIVATEER_MODEL?.trim()) return; // in-flight, or a deliberate override
+    activating = true;
+    try {
+      const spec = resolveSignedInModel();
+      const slash = spec.indexOf("/");
+      if (slash <= 0) return;
+      const provider = spec.slice(0, slash), id = spec.slice(slash + 1);
+
+      // The account channel needs a live session token before any privateer/* model can
+      // run. Retry briefly: this can be racing the credential the login itself minted.
+      if (provider === "privateer") {
+        let armed = false;
+        for (let attempt = 0; attempt < 3 && !armed; attempt++) {
+          armed = await armAccountCredential(ctx, { notify: false });
+          if (!armed) await new Promise((r) => setTimeout(r, 500));
+        }
+        if (!armed) {
+          dbg("activateSignedInModel: account channel not armed");
+          ctx?.ui?.notify?.(
+            "Signed in, but this terminal couldn't open an account session. Check your connection and run /login again, or sign a terminal out in the app if you're at the device limit.",
+            "error",
+          );
           return;
         }
-      } catch (e) {
-        dbg(`activateSignedInModel: setModel threw ${(e as Error).message}`);
       }
-      await new Promise((r) => setTimeout(r, 400)); // credential still spawning — retry
+
+      // Re-running /login while already signed in arms the channel but must NOT move the
+      // user off a model they picked with /models. Only a genuine sign-in switches.
+      if (opts.switchModel === false) return;
+
+      // Already on the target — the common case now that a signed-out terminal launches
+      // on the account model. Nothing to switch, but SAY so: the channel just went live
+      // under them, and silence after a login is what made the old flow feel broken.
+      const currentSpec = ctx?.model ? `${ctx.model.provider}/${ctx.model.id}` : "";
+      if (currentSpec === spec) {
+        dbg(`activateSignedInModel: already on ${spec}`);
+        refresh(ctx);
+        ctx?.ui?.notify?.(`${spec} is ready — private inference on your Privateer account.`, "info");
+        return;
+      }
+
+      const reg = ctx?.modelRegistry;
+      if (!reg?.find || typeof pi.setModel !== "function") return;
+      const model = reg.find(provider, id);
+      if (!model) {
+        // The provider's live catalog may still be loading (or this is the first sign-in
+        // of the run, before the account provider was registered). Say something useful
+        // rather than stranding them on a model their account can't bill.
+        dbg(`activateSignedInModel: ${spec} not in registry`);
+        ctx?.ui?.notify?.(`Signed in. Run /models to pick a model — ${spec} isn't loaded yet.`, "warning");
+        return;
+      }
+      for (let attempt = 0; attempt < 4; attempt++) {
+        try {
+          const ok = await pi.setModel(model);
+          if (ok !== false) {
+            currentModelProvider = provider;
+            refresh(ctx);
+            ctx?.ui?.notify?.(`Now using ${spec} — private inference on your Privateer account.`, "info");
+            dbg(`activateSignedInModel: switched to ${spec}`);
+            return;
+          }
+        } catch (e) {
+          dbg(`activateSignedInModel: setModel threw ${(e as Error).message}`);
+        }
+        await new Promise((r) => setTimeout(r, 400)); // registry still settling — retry
+      }
+      dbg(`activateSignedInModel: gave up switching to ${spec}`);
+      ctx?.ui?.notify?.(`Signed in, but couldn't switch to ${spec}. Run /models to pick one.`, "warning");
+    } finally {
+      activating = false;
     }
-    dbg(`activateSignedInModel: gave up switching to ${spec}`);
   }
 
   dbg("extension loaded, onSignedIn listener registering");
@@ -529,27 +605,43 @@ export default function privateerBrand(pi: any): void {
     // that's now dead server-side (see dropPersistedAccount).
     dropPersistedAccount(ctxRef);
     refresh(ctxRef);
-    ctxRef?.ui?.notify?.("Your Privateer session expired. Run /signin to sign back in.", "warning");
+    ctxRef?.ui?.notify?.("Your Privateer session expired. Run /login to sign back in.", "warning");
   });
 
   pi.registerCommand?.("update", {
     description: "Update Privateer to the latest release (npm i -g privateer-agent@latest)",
     handler: (_args: string, ctx: any) => doUpdate(ctx),
   });
-  pi.registerCommand?.("signin", {
-    description: "Sign in to your Privateer account (device-code flow)",
+  // ONE vocabulary: log in / log out. Pi's own built-ins are /login and /logout, so
+  // matching them is what makes the pair feel like a single concept instead of two
+  // half-overlapping ones (Pi's /logout used to clear only Pi's authStorage while the
+  // machine login lived on, which read as "logout doesn't work"). doSignIn/doSignOut
+  // are canonical; patches/ redirects Pi's built-ins to `/privateer login|logout`
+  // rather than to these registrations, so the redirect can't re-enter the branch it
+  // was dispatched from — the same mechanism as the /model → /models redirect.
+  //
+  // In interactive mode that redirect means the built-in wins and these two never
+  // dispatch (patches/ also silences the resulting conflict warning). They stay
+  // registered for rpc/print mode, which has no such redirect and reaches them by name.
+  //
+  // signin/signout stay registered as undocumented aliases — they were the shipped
+  // names, they're in muscle memory and in older docs, and an alias costs nothing.
+  pi.registerCommand?.("login", {
+    description: "Log in to your Privateer account · /login keys for a provider API key",
     handler: (_args: string, ctx: any) => doSignIn(ctx),
   });
-  pi.registerCommand?.("signout", {
-    description: "Sign out of your Privateer account on this terminal",
+  pi.registerCommand?.("logout", {
+    description: "Log out of Privateer on this machine (revokes all its terminals)",
     handler: (_args: string, ctx: any) => doSignOut(ctx),
   });
+  pi.registerCommand?.("signin", { description: "", handler: (_a: string, ctx: any) => doSignIn(ctx) });
+  pi.registerCommand?.("signout", { description: "", handler: (_a: string, ctx: any) => doSignOut(ctx) });
   pi.registerCommand?.("privateer", {
-    description: "Privateer account: /privateer [status | signin | signout]",
+    description: "Privateer account: /privateer [status | login | logout]",
     handler: (args: string, ctx: any) => {
       const sub = String(args ?? "").trim().toLowerCase().split(/\s+/)[0];
-      if (sub === "signin" || sub === "login") return doSignIn(ctx);
-      if (sub === "signout" || sub === "logout") return doSignOut(ctx);
+      if (sub === "login" || sub === "signin") return doSignIn(ctx);
+      if (sub === "logout" || sub === "signout") return doSignOut(ctx);
       return showStatus(ctx);
     },
   });