privateer-agent 0.6.9 → 0.7.0

package/README.md

@@ -38,8 +38,8 @@ servers, sub-agents, scheduled routines, multi-step workflows, chat-app bridges,
 one-tap approval from your phone are included — and every one of the agent's actions runs
 through a **safe-by-default permission gate**.
 
-Privateer runs in three places, over one account and one config: the **terminal**, a
-**background daemon** for unattended work, and the **Privateer app** on
+Privateer runs in three places, over one account and one config: the **terminal**,
+**Harbor** (a background service) for unattended work, and the **Privateer app** on
 [phone, web](https://privateer.pro), and [desktop](#the-privateer-app).
 
 ## Why Privateer?
@@ -108,7 +108,7 @@ silently. The moat is swappable; the floor under it holds.
   terminal. See [The Privateer app](#the-privateer-app).
 - **A desktop app.** The same agent hosted inside a local Electron shell — no relay hop, works
   offline, multi-window with per-window MCP connectors. Shares your CLI login and config.
-- **Scheduled routines.** A background daemon runs approved tasks unattended — cron or
+- **Scheduled routines.** Harbor, a background service, runs approved tasks unattended — cron or
   one-off — and the agent can schedule its own follow-up work. Results deliver to a file,
   the next session, your phone, email, or a webhook.
 - **Declarative workflows.** Multi-step agent pipelines as YAML — typed steps, conditional
@@ -298,7 +298,7 @@ and a management surface for it.
 | | |
 |---|---|
 | **Drive a session** | Send prompts, watch streamed output, and **Allow/Deny** each proposed action — including actions from sub-agents the session spawned |
-| **Spawn an agent** | Start a one-shot task on the daemon: *background* (headless, read-only toolset, result sealed to your outbox) or *live* (a fresh drivable session) |
+| **Spawn an agent** | Start a one-shot task on the harbor: *background* (headless, read-only toolset, result sealed to your outbox) or *live* (a fresh drivable session) |
 | **Routines** | Create, edit, pause, run, and delete scheduled unattended tasks |
 | **Workflows** | List, run, and monitor multi-step workflows; answer `human_gate` steps to resume a paused run |
 | **MCP connectors** | Add, edit, and enable MCP servers; credentials are sealed to the terminal and write-only |
@@ -325,24 +325,24 @@ Download for [macOS](https://privateer.pro/download/mac) (Apple silicon),
 
 It's an early release and **not yet code-signed or notarized** — macOS will warn on first
 open. Routines and channels deliberately aren't hosted here: those belong to the always-on
-daemon, so background work still wants `privateer daemon install`.
+harbor, so background work still wants `privateer harbor install`.
 
-## Run it unattended — the daemon
+## Run it unattended — Harbor
 
-A resident background daemon runs scheduled routines, executes workflows, and accepts task
-spawns from the app — with no terminal open.
+**Harbor** is a resident background service that runs scheduled routines, executes workflows,
+and accepts task spawns from the app — with no terminal open.
 
 ```bash
-privateer daemon install      # install as a login service (auto-starts, reachable from the app)
-privateer daemon status       # service installed? daemon answering?
-privateer daemon run          # or just run it in the foreground
-privateer daemon uninstall
+privateer harbor install      # install as a login service (auto-starts, reachable from the app)
+privateer harbor status       # service installed? harbor answering?
+privateer harbor run          # or just run it in the foreground
+privateer harbor uninstall
 ```
 
 Installs as a **launchd user agent** on macOS or a **`systemd --user` unit** on Linux — no
-root, no sudo. (There's no Windows service path yet; use `privateer daemon run`.)
+root, no sudo. (There's no Windows service path yet; use `privateer harbor run`.)
 
-Everything the daemon does still runs through the permission gate. Actions needing approval
+Everything the harbor does still runs through the permission gate. Actions needing approval
 surface in the app; routines you approved once run on their own schedule.
 
 ## Workflows
@@ -354,12 +354,12 @@ resumes when you answer it, including from your phone.
 
 The engine ships in the standalone
 [`privateer-workflow`](https://www.npmjs.com/package/privateer-workflow) package. Today the
-user-facing surface is the **app** (save, run, monitor, share) and the **daemon** that
+user-facing surface is the **app** (save, run, monitor, share) and the **harbor** that
 executes them — there's no `/workflow` command in the terminal yet. Schedule one by pointing
 a routine at it.
 
 Because a workflow can carry `script` steps, saving one from the app requires your **account
-signature** — the server can't inject a workflow onto your daemon.
+signature** — the server can't inject a workflow onto your harbor.
 
 ## Chat-app channels
 
@@ -410,14 +410,14 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 
 - **MCP servers** (`pi-mcp-adapter`) — declare them and their tools become first-class, gated
   like the rest (local stdio, or remote HTTP with interactive OAuth). One catalog at
-  `~/.privateer/agent/mcp-desktop.json` is shared by the CLI, the daemon, and the desktop
+  `~/.privateer/agent/mcp-desktop.json` is shared by the CLI, the harbor, and the desktop
   app, so a machine has one coherent connector config.
 - **Sub-agents** (`pi-subagents`) — delegate investigations to bounded parallel agents. Children
   run as headless child processes that **inherit the moat**, so their actions hit the same
   permission gate and their approvals surface on your phone.
-- **Routines** — saved tasks the daemon runs unattended; ask the agent to schedule work and
+- **Routines** — saved tasks the harbor runs unattended; ask the agent to schedule work and
   approve it once.
-- **Workflows** — declarative multi-step pipelines the daemon executes; see
+- **Workflows** — declarative multi-step pipelines the harbor executes; see
   [Workflows](#workflows).
 - **Web tools** (`rpiv-web-tools`) — private-by-default web search/fetch with pluggable backends
   (self-hosted SearXNG for fully private search).
@@ -435,7 +435,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 | `/init` | scaffold a starter `PRIVATEER.md` in this directory |
 | `/update` · `/privateer` | update to the latest release / Privateer status and posture |
 
-Shell subcommands: `privateer` (interactive), `privateer update`, `privateer daemon …`,
+Shell subcommands: `privateer` (interactive), `privateer update`, `privateer harbor …`,
 `privateer --no-quarter`, `privateer --version`.
 
 ## Develop

package/SECURITY.md

@@ -55,4 +55,4 @@ are sent only to the provider you selected. Bot tokens for messaging channels ar
 to a terminal keypair before they reach our relay, and channel configuration is verified
 against a link-pinned account key — the relay can neither read those tokens nor forge
 configuration. Architecture and residual risks are documented in
-`docs/daemon-channels-and-app.md`.
+`docs/harbor-channels-and-app.md`.

package/bin/{privateer-daemon.mjs → privateer-harbor.mjs}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-// Launcher for the resident Privateer daemon (routines + app-driven headless task
+// Launcher for the resident Privateer harbor (routines + app-driven headless task
 // spawns). Mirrors bin/privateer.mjs: load dev keys from the repo .env WITHOUT
 // changing cwd, register tsx so TS resolves regardless of the invocation cwd, then
-// hand off to the daemon CLI dispatcher (which imports ./boot.ts before any Pi code).
+// hand off to the harbor CLI dispatcher (which imports ./boot.ts before any Pi code).
 //
-// Invoked two ways: interactively via the bash launcher (`privateer daemon …`), and
-// by the installed launchd/systemd service (`node privateer-daemon.mjs run`).
+// Invoked two ways: interactively via the bash launcher (`privateer harbor …`), and
+// by the installed launchd/systemd service (`node privateer-harbor.mjs run`).
 import { register } from "tsx/esm/api";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
@@ -19,12 +19,12 @@ try {
   /* no .env — rely on the ambient environment / ~/.privateer */
 }
 
-// The daemon loads the moat as in-code factories, so its subagent children (routines /
+// The harbor loads the moat as in-code factories, so its subagent children (routines /
 // task sessions) can't inherit it and `pi` isn't on PATH. Point pi-subagents at our
 // moat-injecting wrapper so those children spawn gated + private with no double-load.
 // Process-global is safe here: the wrapper is stateless (unlike a per-parent channel).
 process.env.PI_SUBAGENT_PI_BINARY ??= resolve(repo, "bin/privateer-subagent.mjs");
 
 register();
-const { runDaemonCli } = await import(resolve(repo, "src/cli/daemonCli.ts"));
-await runDaemonCli(process.argv.slice(2));
+const { runHarborCli } = await import(resolve(repo, "src/cli/harborCli.ts"));
+await runHarborCli(process.argv.slice(2));

package/bin/privateer-launch.mjs

@@ -111,13 +111,14 @@ if (sub === "update") {
   // runToCompletion exits via the child's exit handler.
 }
 
-// --- `privateer daemon [run|install|uninstall|status]` ---------------------
-// The resident background daemon (routines + app-driven headless task spawns). Boots
-// straight into src/daemon via bin/privateer-daemon.mjs — no moat-shim install (the
-// daemon loads the moat as in-code factories, not interactive extensions).
-else if (sub === "daemon") {
+// --- `privateer harbor [run|install|uninstall|status]` ---------------------
+// The resident background harbor (routines + app-driven headless task spawns). Boots
+// straight into src/harbor via bin/privateer-harbor.mjs — no moat-shim install (the
+// harbor loads the moat as in-code factories, not interactive extensions).
+// `daemon` is a hidden back-compat alias for the pre-rename command name.
+else if (sub === "harbor" || sub === "daemon") {
   const nodeArgs = fs.existsSync(ENV_FILE) ? [`--env-file=${ENV_FILE}`] : [];
-  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-daemon.mjs"), ...args.slice(1)]);
+  runToCompletion(NODE_BIN, [...nodeArgs, path.join(REPO, "bin", "privateer-harbor.mjs"), ...args.slice(1)]);
 }
 
 // --- normal launch: install the moat, then exec Pi's TUI -------------------

package/bin/privateer-subagent.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // The binary pi-subagents spawns for each subagent child (via PI_SUBAGENT_PI_BINARY)
 // when the PARENT loaded privateer's moat as IN-CODE extension factories (the lean
-// REPL, the daemon, live task sessions) rather than agent-dir discovery.
+// REPL, the harbor, live task sessions) rather than agent-dir discovery.
 //
 // Why a wrapper here (vs the plain cli.js the TUI uses): a subagent child is a fresh
 // `pi` subprocess that can't inherit the parent's in-code factories. It CAN auto-

package/extensions/privateer-brand.ts

@@ -593,7 +593,7 @@ export default function privateerBrand(pi: any): void {
     // in src/auth/privateer.ts): revokeLocalSessions kills the account session
     // server-side, so leaving the persisted copy behind would make the NEXT launch
     // reuse a token that's already dead and dead-end on its first prompt (Pi doesn't
-    // refresh on a 401). Mirrors the daemon's shutdown (daemon/index.ts).
+    // refresh on a 401). Mirrors the harbor's shutdown (harbor/index.ts).
     dropPersistedAccount(ctxRef);
   });
 

package/extensions/privateer-connect.ts

@@ -12,7 +12,7 @@
  * makeMcpControl() the relay uses (src/remote/mcpControl.ts) — which is why that
  * module was written framework-agnostic. A connector added here lands in
  * `agent/mcp-desktop.json` and is projected into `agent/mcp.json`, so it shows up in
- * the app's MCP screen, survives a toggle from the phone, and is read by the daemon's
+ * the app's MCP screen, survives a toggle from the phone, and is read by the harbor's
  * routine runs. Nothing about this panel is terminal-specific except the pixels.
  *
  * SECRETS: env values are typed into a masked field and written in PLAINTEXT to the
@@ -74,6 +74,17 @@ class SecretField {
   // are swallowed rather than inserted — the naive "strip control chars" approach
   // would leave "[A" behind from an up-arrow and silently corrupt the token.
   handleInput(data: string): boolean {
+    // A PASTE MUST BE UNWRAPPED FIRST. pi-tui's Terminal re-wraps pasted text in
+    // bracketed-paste markers and delivers it as ONE chunk (`\x1b[200~…\x1b[201~`,
+    // see pi-tui terminal.ts) — which starts with ESC, so the arrow-key guard below
+    // would otherwise swallow the entire token and leave the field empty.
+    const paste = /^\x1b\[200~([\s\S]*?)\x1b\[201~$/.exec(data);
+    if (paste) {
+      // Control chars (a trailing newline from the clipboard, most often) are stripped
+      // the same way typed input is — a token never legitimately contains one.
+      this.value += paste[1].replace(/[\x00-\x1f\x7f]/g, "");
+      return true;
+    }
     if (data.startsWith("\x1b")) return true;
     if (data === "\x7f" || data === "\b") {
       this.value = this.value.slice(0, -1);
@@ -84,7 +95,7 @@ class SecretField {
       this.value = "";
       return true;
     }
-    // Everything printable, including a bracketed-paste chunk arriving at once.
+    // Ordinary typed input (pastes took the branch above).
     const printable = data.replace(/[\x00-\x1f\x7f]/g, "");
     if (!printable) return false;
     this.value += printable;
@@ -383,7 +394,7 @@ class ConnectPanel extends Container {
     const t = this.theme;
     this.body.addChild(new Text(t.fg("accent", t.bold("Connect a service")), 1, 0));
     this.body.addChild(
-      new Text(t.fg("muted", "MCP connectors on this machine — shared with the app and the daemon."), 1, 0),
+      new Text(t.fg("muted", "MCP connectors on this machine — shared with the app and the harbor."), 1, 0),
     );
     this.body.addChild(new Spacer(1));
 

package/extensions/privateer-tools.ts

@@ -1,5 +1,5 @@
 // Privateer-specific custom tools for Pi's TUI (Phase 5). Today: create_routine
-// (schedule unattended tasks → the daemon runs them). The generic tools (read/edit/
+// (schedule unattended tasks → the harbor runs them). The generic tools (read/edit/
 // bash/grep, web, subagents, todo) come from Pi builtins + adopted packages, so only
 // the privateer-only tools live here. Gated by our permission-gate extension.
 import { routineToolDefinition } from "../src/tools/routine.ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.6.9",
+  "version": "0.7.0",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",

package/src/auth/privateer.ts

@@ -152,7 +152,7 @@ let _refreshInFlight: Promise<ChildSession> | null = null;
 // remove the "privateer" entry from Pi's authStorage (authStorage.remove("privateer"))
 // right after revokeLocalSessions() so the next launch spawns a fresh session instead
 // of reusing the revoked one. Doing both is safe; doing only one is not. See
-// revokeLocalSessions and its callers (cli/chat.ts, daemon/index.ts).
+// revokeLocalSessions and its callers (cli/chat.ts, harbor/index.ts).
 //
 // That pairing only covers a CLEAN exit, though. A terminal killed without running its
 // shutdown hook leaves its row alive server-side for the full TTL, and the next launch
@@ -625,7 +625,7 @@ export async function revokeAccountSession(timeoutMs = 1500): Promise<void> {
  * launch without a reactive-on-401 refresh, so the caller MUST also drop the persisted
  * copy right after this resolves — `authStorage.remove("privateer")` — or the next run
  * will reuse the token we just revoked and dead-end on a 401 (see the _account note).
- * Callers: cli/chat.ts cleanup() and daemon/index.ts shutdown().
+ * Callers: cli/chat.ts cleanup() and harbor/index.ts shutdown().
  */
 export async function revokeLocalSessions(timeoutMs = 1500): Promise<void> {
   await Promise.all([revokeChildSession(timeoutMs), revokeAccountSession(timeoutMs)]);

package/src/channels/run.ts

@@ -1,6 +1,6 @@
 // Headless entry for the messaging channels — `npm run channels` (or
 // `node --env-file=.env --import tsx src/channels/run.ts`). Boots the Pi stack the
-// same way the routines daemon does, then bridges any configured chat platform
+// same way the routines harbor does, then bridges any configured chat platform
 // (Telegram, Slack) to per-conversation agent sessions.
 //
 // AUTHORIZATION MODEL (per channel):
@@ -23,7 +23,7 @@
 // posture). Every prompt/approval is appended to ~/.privateer/channels-audit.log.
 // Tokens live in config.json in plaintext — protect that file's permissions.
 //
-// Config lives in ~/.privateer/config.json (the same file the daemon reads):
+// Config lives in ~/.privateer/config.json (the same file the harbor reads):
 //   {
 //     "defaultModel": "openrouter/openai/gpt-4o-mini",
 //     "channels": {
@@ -47,7 +47,7 @@
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { AsyncLocalStorage } from "node:async_hooks";
 
-// Read-only default toolset — same rationale as the routines daemon's SAFE_TOOLS:
+// Read-only default toolset — same rationale as the routines harbor's SAFE_TOOLS:
 // a turn nobody is watching can't mutate the filesystem or shell out. Now that the
 // gate routes approvals into the chat (see below), a user can safely widen this per
 // channel via `channels.tools` — e.g. add "edit","write","bash" and each risky call
@@ -64,7 +64,7 @@ const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 type Posture = "readonly" | "approve" | "auto";
 const POSTURES: Posture[] = ["readonly", "approve", "auto"];
 
-// Bound the live session map so a long-running daemon can't grow without limit or
+// Bound the live session map so a long-running harbor can't grow without limit or
 // hold stale context forever.
 const MAX_SESSIONS = 500;
 const SESSION_IDLE_MS = 30 * 60 * 1000; // evict a conversation unused for 30 min
@@ -255,7 +255,7 @@ async function main() {
   // ── build a bridge per configured platform ───────────────────────────────────
   const bridges: { stop(): void }[] = [];
   // Platforms with a live bridge — written to the heartbeat file so the app's
-  // channels manager (running on the daemon's relay, a separate process) can show
+  // channels manager (running on the harbor's relay, a separate process) can show
   // a live/offline badge without talking to this process.
   const startedPlatforms: string[] = [];
 

package/src/channels/status.ts

@@ -1,9 +1,9 @@
-// Channels daemon heartbeat — the one bit of shared state between the channels
-// daemon (channels/run.ts, the WRITER) and the always-on management relay
-// (daemon/index.ts → channelsControl, the READER).
+// Channels harbor heartbeat — the one bit of shared state between the channels
+// harbor (channels/run.ts, the WRITER) and the always-on management relay
+// (harbor/index.ts → channelsControl, the READER).
 //
 // The two run as SEPARATE processes, so the manager can't ask the channels
-// daemon directly whether it's live. Instead the channels daemon writes a small
+// harbor directly whether it's live. Instead the channels harbor writes a small
 // heartbeat file with the platforms it's currently serving; the reader treats a
 // FRESH heartbeat as "running" and a stale/absent one as "not running". This is
 // best-effort presence, never a dependency: a missing file just means the app
@@ -13,7 +13,7 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { globalDir } from "../config/paths.ts";
 
-// Heartbeat cadence + freshness window. The channels daemon rewrites the file
+// Heartbeat cadence + freshness window. The channels harbor rewrites the file
 // every HEARTBEAT_MS; a heartbeat older than STALE_MS is treated as dead (the
 // process exited without clearing it, or wedged).
 export const HEARTBEAT_MS = 30_000;
@@ -40,8 +40,8 @@ export function writeChannelsStatus(platforms: string[]): void {
   }
 }
 
-// READER: the set of platforms the channels daemon is currently serving, or an
-// empty set when the daemon is down / the heartbeat is stale. Never throws.
+// READER: the set of platforms the channels harbor is currently serving, or an
+// empty set when the harbor is down / the heartbeat is stale. Never throws.
 export function readRunningPlatforms(): Set<string> {
   try {
     const status = JSON.parse(readFileSync(statusPath(), "utf8")) as ChannelsStatus;

package/src/cli/chat.ts

@@ -36,6 +36,7 @@ async function main() {
   const { makeExtensionsControl } = await import("../remote/extensionsControl.ts");
   const { makeSkillsControl } = await import("../remote/skillsControl.ts");
   const { authorizeControl } = await import("../remote/controlAuth.ts");
+  const { resolveMentions, completeMention, searchFiles } = await import("../util/fileMentions.ts");
   const priv = await import("../auth/privateer.ts");
   const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
@@ -59,7 +60,14 @@ async function main() {
   // /model switches, so the app banner + picker reflect what's actually selected.
   let currentSpec = spec;
 
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  // Tab-completes an `@path` mention against the cwd tree (files the user can
+  // reference in a prompt). readline calls this with the line up to the cursor; a
+  // non-mention line returns no hits, leaving normal input untouched. Async form
+  // (callback) so the filesystem read doesn't block the event loop.
+  const completer = (line: string, cb: (err: null, result: [string[], string]) => void): void => {
+    void completeMention(line, cwd).then((r) => cb(null, r)).catch(() => cb(null, [[], line]));
+  };
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, completer });
   let closed = false;
   rl.on("close", () => (closed = true));
   // Local terminal output is coalesced and prompt-aware. Two stutter sources it kills:
@@ -152,6 +160,13 @@ async function main() {
       relay?.sendCommands(availableCommands());
     },
     onStatus: (t) => console.log(`\n${DIM}⟿ ${t}${RESET}`),
+    // The app composer is autocompleting an `@file` mention — list the cwd entries
+    // matching the query and reply. Read-only + cwd-constrained (searchFiles never
+    // escapes the subtree); resolution of the picked path happens on the prompt turn.
+    onFilesSearch: (id, query) => void (async () => {
+      try { bridge.sendFileMatches(id, await searchFiles(query, cwd)); }
+      catch { bridge.sendFileMatches(id, []); }
+    })(),
     // The app's extensions manager: list the user's installed Pi extensions, or
     // add/remove one. add/remove persist immediately but only load on the next
     // terminal launch — so the final frame flags needsRestart. See runExtMutation.
@@ -258,7 +273,18 @@ async function main() {
     turnActive = true;
     if (remote && echo) console.log(`\n${DIM}⟿ [app] ${text.slice(0, 80)}${RESET}`);
     try {
-      await session.prompt(text);
+      // Expand any `@path` mentions into appended <file> blocks + image attachments,
+      // resolved against this terminal's cwd (constrained to the cwd subtree). Both a
+      // locally-typed prompt and an app-driven one land here, so both get it. A prompt
+      // with no resolvable mention passes through unchanged. Unresolved tokens stay
+      // inline; note them so a typo'd path isn't silently ignored.
+      const mentions = await resolveMentions(text, cwd);
+      if (mentions.skipped.length) {
+        const m = `Couldn't attach: ${mentions.skipped.join(", ")} (must be a file inside ${cwd})`;
+        console.log(`${DIM}${m}${RESET}`);
+        if (remote) relay?.sendNotice(m);
+      }
+      await session.prompt(mentions.text, mentions.images.length ? { images: mentions.images } : undefined);
     } catch (e) {
       console.log(`\n${RED}${(e as Error).message}${RESET}`);
     } finally {
@@ -500,7 +526,7 @@ async function main() {
   );
 
   const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /quit";
-  console.log(`${DIM}Ready. Type a prompt. ${HELP}${RESET}`);
+  console.log(`${DIM}Ready. Type a prompt — reference a file with @path (Tab completes). ${HELP}${RESET}`);
   await showPosture();
 
   // The available model catalog as sorted "provider/id" specs. Same source the

package/src/cli/{daemonCli.ts → harborCli.ts}

@@ -1,7 +1,7 @@
-// `privateer daemon [run|install|uninstall|status]` dispatcher.
+// `privateer harbor [run|install|uninstall|status]` dispatcher.
 //
 // ORDERING CONTRACT: import ./boot.ts FIRST (env pin + attestation dispatcher), then
-// DYNAMICALLY import the daemon (which pulls the Pi session stack) only when we
+// DYNAMICALLY import the harbor (which pulls the Pi session stack) only when we
 // actually run it — so boot's side effects are guaranteed to precede any Pi import.
 // The service/status subcommands touch no Pi code, so they can run without paying the
 // session-stack import cost.
@@ -9,30 +9,30 @@ import "../boot.ts";
 
 function usage(): string {
   return [
-    "Usage: privateer daemon [command]",
+    "Usage: privateer harbor [command]",
     "",
-    "  run          Run the daemon in the foreground (default).",
+    "  run          Run Harbor in the foreground (default).",
     "  install      Install it as a login service so it auto-starts and stays",
     "               reachable from the app even with no terminal open.",
     "  uninstall    Remove the login service.",
-    "  status       Show whether the service is installed and the daemon is live.",
+    "  status       Show whether the service is installed and Harbor is live.",
   ].join("\n");
 }
 
-export async function runDaemonCli(argv: string[]): Promise<void> {
+export async function runHarborCli(argv: string[]): Promise<void> {
   const sub = argv[0] ?? "run";
   switch (sub) {
     case "run": {
       // Pi-touching — dynamic import AFTER boot.
-      const { runDaemon } = await import("../daemon/index.ts");
-      runDaemon(); // installs its own SIGINT/SIGTERM handlers and blocks
+      const { runHarbor } = await import("../harbor/index.ts");
+      runHarbor(); // installs its own SIGINT/SIGTERM handlers and blocks
       return;
     }
     case "install": {
-      const { installService } = await import("../daemon/service.ts");
+      const { installService } = await import("../harbor/service.ts");
       try {
         const info = installService();
-        process.stdout.write(`Privateer daemon installed as a login service.\n  unit: ${info.unitPath}\n  logs: ${info.logPath}\nIt will start now and on every login. Manage with \`privateer daemon status|uninstall\`.\n`);
+        process.stdout.write(`Harbor installed as a login service.\n  unit: ${info.unitPath}\n  logs: ${info.logPath}\nIt will start now and on every login. Manage with \`privateer harbor status|uninstall\`.\n`);
       } catch (err) {
         process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
         process.exit(1);
@@ -40,10 +40,10 @@ export async function runDaemonCli(argv: string[]): Promise<void> {
       return;
     }
     case "uninstall": {
-      const { uninstallService } = await import("../daemon/service.ts");
+      const { uninstallService } = await import("../harbor/service.ts");
       try {
         uninstallService();
-        process.stdout.write("Privateer daemon login service removed.\n");
+        process.stdout.write("Harbor login service removed.\n");
       } catch (err) {
         process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
         process.exit(1);
@@ -51,7 +51,7 @@ export async function runDaemonCli(argv: string[]): Promise<void> {
       return;
     }
     case "status": {
-      const { statusReport } = await import("../daemon/service.ts");
+      const { statusReport } = await import("../harbor/service.ts");
       process.stdout.write((await statusReport()) + "\n");
       return;
     }
@@ -61,7 +61,7 @@ export async function runDaemonCli(argv: string[]): Promise<void> {
       process.stdout.write(usage() + "\n");
       return;
     default:
-      process.stderr.write(`Unknown daemon command: ${sub}\n\n${usage()}\n`);
+      process.stderr.write(`Unknown harbor command: ${sub}\n\n${usage()}\n`);
       process.exit(1);
   }
 }

package/src/config/hosted.ts

@@ -5,11 +5,11 @@ import { terminalPublicKeyBase64 } from "../crypto/terminalKey.ts";
 
 // Harbor hosted mode.
 //
-// When true, this daemon is running inside Privateer's confidential-VM fleet
+// When true, this harbor is running inside Privateer's confidential-VM fleet
 // (the host orchestrator sets HARBOR_HOSTED=1), not on a user's own machine.
-// Hosted daemons run on-demand: they report their next routine fire time to the
+// Hosted harbors run on-demand: they report their next routine fire time to the
 // server and idle-suspend when there's no work, so the server can wake them
-// again in time. A daemon on a user's laptop leaves this off and keeps running
+// again in time. A harbor on a user's laptop leaves this off and keeps running
 // its own cron continuously.
 //
 // Read via process.env at call time, mirroring PRIVATEER_HOME / PRIVATEER_SERVER_URL.
@@ -18,7 +18,7 @@ export function isHosted(): boolean {
 }
 
 /**
- * Publish this daemon's relay identity key so the Harbor host can attest it.
+ * Publish this harbor's relay identity key so the Harbor host can attest it.
  *
  * ATTESTATION CONTRACT (host side: treeview `server/services/harborOrchestrator/`):
  * the orchestrator mints the SEV-SNP report on the CVM host — configfs-tsm is a
@@ -34,7 +34,7 @@ export function isHosted(): boolean {
  * before the relay registers.
  *
  * Hosted-only and best-effort: on a user's own machine this is a no-op, and a write
- * failure must never take the daemon down — attestation simply fail-closes host-side
+ * failure must never take the harbor down — attestation simply fail-closes host-side
  * with HARBOR_ATTEST_NO_KEY rather than reporting a false "attested".
  */
 export function publishRelayPub(): void {

package/src/crypto/accountTrust.ts

@@ -72,11 +72,11 @@ export function clearAccountSignKey(): void {
 // watermark for its terminal is a replay/rollback of an older signed envelope and is
 // refused; at-or-above is accepted (an idempotent replay of the latest is harmless).
 //
-// Keyed by termId — NOT global — so the always-on daemon (stable routines-… id) and
+// Keyed by termId — NOT global — so the always-on harbor (stable routines-… id) and
 // each interactive terminal (its own id) don't cross-reject each other's frames when
 // the app drives them near-simultaneously with independent ts streams. Each signed
 // frame binds its termId (see accountVerify.controlMessage), so a per-terminal
-// watermark is the matching granularity. Persisted so it survives a daemon restart;
+// watermark is the matching granularity. Persisted so it survives a harbor restart;
 // deliberately NOT cleared on logout (see clearAccountSignKey — M1).
 function tsPath(): string {
   return join(globalDir(), "control-sig.json");

package/src/crypto/accountVerify.ts

@@ -32,7 +32,7 @@ function canonicalize(value: unknown): string {
 
 // The signed envelope. `termId` binds the intended recipient terminal (so a signature
 // for terminal X can't be replayed against Y — verification uses OUR termId). `ts`
-// binds freshness (the daemon rejects a ts it has already applied → no replay/rollback).
+// binds freshness (the harbor rejects a ts it has already applied → no replay/rollback).
 export interface ChannelSaveEnvelope {
   termId: string;
   ts: number;