privateer-agent 0.7.0 → 0.8.2

package/README.md

@@ -210,7 +210,7 @@ export PRIVATEER_API_KEY=sk-priv-...      # Privateer developer API (privateer.p
 ```
 
 Pick a model with **`/model`** (browse each configured provider's live catalog) or pass one
-directly as `provider/model` — e.g. `openrouter/anthropic/claude-opus-4.8`,
+directly as `provider/model` — e.g. `openrouter/anthropic/claude-opus-5`,
 `ollama/qwen3-coder`, `nearai/zai-org/GLM-5.1-FP8`. Any OpenAI-compatible server (LM Studio,
 vLLM, llama.cpp) works as a custom provider — just give it a base URL.
 
@@ -388,20 +388,35 @@ live in plaintext in `config.json` on your machine, and every channel action is
 Switch with **`/mode`**. Even in `bypass`, a danger filter blocks destructive shell commands,
 and protected files (`.env`, shell rc files…) are guarded — the gate is never fully off.
 
-### `--no-quarter` — lower the moat entirely
-
-For an unattended run in a directory and on a task you fully trust, launch with:
-
-```bash
-privateer --no-quarter
-```
+### No quarter — lower the moat entirely
 
 This is the one exception to "the gate is never fully off." It disables the permission
 gate for the **whole session** — every action auto-approves with no prompt, including
 destructive shell commands, out-of-cwd access, and protected files. Subagents spawned
-by the session inherit it. There is no `/mode` equivalent; it's a deliberate launch-time
-opt-out (env `PRIVATEER_NO_QUARTER=1`) and prints a red warning banner so it's never a
-surprise. Use it sparingly.
+after it goes on inherit it (env `PRIVATEER_NO_QUARTER=1`). Only for a directory and a
+task you fully trust.
+
+Three ways in, all the same switch:
+
+| | |
+|---|---|
+| **shift+tab** | toggle it mid-session — hit it and walk away, and the agent runs the task to the end instead of stopping at the next approval |
+| `/no-quarter [on\|off]` | the typed equivalent |
+| `privateer --no-quarter` | start a session with the moat already down |
+
+It's never quietly in effect: the launch flag prints a red warning banner, the toggle
+posts a warning to the transcript, and while it's on the footer carries a permanent red
+`⚑ no quarter — permission gate OFF` indicator. shift+tab again raises the moat.
+
+Toggling takes effect from the next gated action — an approval already on screen still
+needs an answer. It's a physical-terminal switch: a phone driving this terminal over
+`/remote-access` can't reach it. The app has its own no-quarter toggle for driven turns,
+which is `bypass` exactly — never less — so dangerous shell and destructive actions
+still surface an Allow there, precisely as they do under `/mode bypass` locally.
+
+> shift+tab is Pi's default "cycle thinking level" chord; Privateer takes it for this.
+> Thinking level is still under `/settings`, or bind `app.thinking.cycle` to another key
+> in `~/.privateer/agent/keybindings.json`.
 
 ## Extend it
 
@@ -428,6 +443,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 |---|---|
 | `/model` · `/models` | switch model; `/models` is a searchable picker with TEE/ZDR privacy shields |
 | `/mode` | switch permission mode |
+| `/no-quarter` | lower the moat for this session and run unattended (**shift+tab**) |
 | `/verify` | fetch and check the TEE attestation for the current model |
 | `/signin` · `/signout` | sign in to a Privateer account (device flow) / sign out |
 | `/remote-access` | link this terminal to the app and allow it to drive (off by default) |

package/bin/privateer-launch.mjs

@@ -60,6 +60,7 @@ if (NO_QUARTER) {
       "  ⚓ \x1b[1;31mNo quarter\x1b[0m — permission gate DISABLED for this session.",
       "     Every action (shell, edits, destructive tools, out-of-cwd) runs WITHOUT a prompt.",
       "     Only use this in a directory and with a task you fully trust.",
+      "     shift+tab (or /no-quarter off) raises the moat again.",
       "",
     ].join("\n") + "\n",
   );

package/extensions/privateer-gate.ts

@@ -28,8 +28,10 @@ import { makeSkillsControl } from "../src/remote/skillsControl.ts";
 import { agentDir } from "../src/config/paths.ts";
 import { agentVersion } from "../src/config/version.ts";
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
+import { matchesKey } from "@earendil-works/pi-tui";
 import * as priv from "../src/auth/privateer.ts";
 import { paletteFor } from "../src/ui/palette.ts";
+import { noQuarterActive, setNoQuarter } from "../src/permissions/noQuarter.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
 const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
@@ -169,6 +171,17 @@ async function pickModelRemote(filter: string): Promise<void> {
 // the REPL's runCommand fall-through.
 async function runRemoteCommand(text: string): Promise<void> {
   const line = text.trim();
+  // No quarter is a PHYSICAL-terminal action, like /remote-access. It's stronger than
+  // any mode — it also switches off the dangerous-command denylist and the protected-
+  // file guard — so a remote controller must not be able to reach it. (The app's own
+  // no_quarter toggle covers driven turns: ModeGate re-decides those through
+  // decideAuto(req, "bypass", …), so it IS /mode bypass — never weaker. Dangerous and
+  // destructive actions sit above bypass, so they come back to the phone for an
+  // explicit Allow there, exactly as bypass surfaces them locally.)
+  if (line === "/no-quarter" || line.startsWith("/no-quarter ")) {
+    relay?.sendNotice("/no-quarter is terminal-only — run it at the machine, or use the app's own no-quarter toggle.");
+    return;
+  }
   if (line.startsWith("/model ")) { await switchModelRemote(line.slice(7)); return; }
   if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
     const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
@@ -213,7 +226,9 @@ function advertiseCommands(): { name: string; description?: string }[] {
       })
       .filter(Boolean);
   } catch { /* no commands registered yet */ }
-  const seen = new Set(builtins.map((c) => c.name));
+  // Terminal-only commands are withheld rather than advertised-then-refused, so the
+  // app's composer never offers something it can't run. See runRemoteCommand.
+  const seen = new Set([...builtins.map((c) => c.name), "/no-quarter"]);
   return [...builtins, ...ext.filter((c: any) => !seen.has(c.name))];
 }
 
@@ -250,6 +265,61 @@ function setRemoteState(s: typeof remoteState): void {
   refreshRemoteStatus();
 }
 
+// ── no quarter (shift+tab) ────────────────────────────────────────────────────
+// The "step away from the keyboard" switch. On, the gate is fully lowered for the
+// rest of the session: every action auto-approves with no prompt, so a long task
+// runs to completion instead of stalling on the next approval. Off by default and
+// reversible with the same key; the state itself lives in src/permissions/noQuarter.ts
+// (shared with the launch flag and inherited by subagent children).
+//
+// The footer carries a permanent RED indicator while it's on — this is the one
+// setting that turns the whole moat off, so it must never be quietly in effect.
+const NO_QUARTER_STATUS_KEY = "privateer:no-quarter";
+
+function refreshNoQuarterStatus(): void {
+  const ui = uiRef;
+  if (!ui?.setStatus) return;
+  if (!noQuarterActive()) {
+    ui.setStatus(NO_QUARTER_STATUS_KEY, undefined);
+    return;
+  }
+  const p = paletteFor(ui.theme);
+  ui.setStatus(
+    NO_QUARTER_STATUS_KEY,
+    `${p.RED}${p.BOLD}⚑ no quarter — permission gate OFF${p.RESET} ${p.DIM}· shift+tab to raise the moat${p.RESET}`,
+  );
+}
+
+// Flip the state and tell the user, loudly on the way down. Takes effect from the
+// next gated action — an approval already on screen still needs an answer.
+function applyNoQuarter(on: boolean, ui: any): void {
+  setNoQuarter(on);
+  refreshNoQuarterStatus();
+  ui?.notify?.(
+    on
+      ? "⚑ No quarter — the permission gate is OFF for this session. Every action (shell, edits, destructive tools, out-of-cwd, protected files) now runs without asking. shift+tab to raise the moat again."
+      : "⚓ Moat raised — the permission gate is back on.",
+    on ? "warning" : "info",
+  );
+}
+
+// shift+tab, intercepted at the raw-input layer. Pi reserves that chord for
+// `app.thinking.cycle`, so pi.registerShortcut("shift+tab") would be dropped as a
+// conflict — a TUI input listener runs ahead of every component instead, and
+// consuming the key stops it reaching the thinking-level cycler. (Thinking level
+// stays reachable from /settings, or by binding app.thinking.cycle to another key.)
+let unsubscribeKeys: (() => void) | undefined;
+
+function bindNoQuarterKey(ui: any): void {
+  if (typeof ui?.onTerminalInput !== "function") return; // older Pi / non-TUI mode
+  unsubscribeKeys?.(); // a session replacement clears listeners — rebind, never double-bind
+  unsubscribeKeys = ui.onTerminalInput((data: string) => {
+    if (!matchesKey(data, "shift+tab")) return undefined;
+    applyNoQuarter(!noQuarterActive(), ui);
+    return { consume: true };
+  });
+}
+
 // Tear down the relay and clear the indicator. Used by `/remote-access off` AND by
 // the app's own "End remote access" action (onTerminate), so both paths converge.
 function disableRemote(): void {
@@ -353,10 +423,11 @@ const gate = makePermissionGate({
   localAsk,
   getRemote: bridge.getRemote,
   getNoQuarter: bridge.getNoQuarter,
-  // `--no-quarter` at launch (see bin/privateer-launch.mjs) sets PRIVATEER_NO_QUARTER
-  // and opts this whole session — TUI and any subagent children that inherit the env —
-  // out of the gate entirely: every action auto-approves, no prompt.
-  getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
+  // Session-wide TOTAL bypass: every action auto-approves, no prompt. Set either by
+  // `--no-quarter` at launch (see bin/privateer-launch.mjs, which exports
+  // PRIVATEER_NO_QUARTER) or by shift+tab mid-session — both land in the same state,
+  // which subagent children inherit through the env. See src/permissions/noQuarter.ts.
+  getSkipAllPermissions: noQuarterActive,
   remoteAsk: bridge.remoteAsk,
 });
 
@@ -401,6 +472,13 @@ export default function privateerControl(pi: any): void {
     if (ctx?.modelRegistry) modelReg = ctx.modelRegistry;
     if (!currentSpec && ctx?.model) currentSpec = modelSpec(ctx.model);
     refreshRemoteStatus();
+    // shift+tab → no quarter, and the red footer indicator when it's already on (a
+    // `--no-quarter` launch, or a session replacement mid-run). Interactive TUI only:
+    // headless modes and subagent children have no terminal to listen to.
+    if (ctx?.mode === "tui" && ctx?.ui) {
+      bindNoQuarterKey(ctx.ui);
+      refreshNoQuarterStatus();
+    }
     if (ctx?.mode && HEADLESS.has(ctx.mode) && (process.env.PRIVATEER_MODE ?? "") === "") {
       mode = "bypass";
     }
@@ -443,6 +521,20 @@ export default function privateerControl(pi: any): void {
     },
   });
 
+  // The typed equivalent of shift+tab, for anyone who'd rather not trust a chord with
+  // the whole moat. Deliberately NOT reachable from the app — see runRemoteCommand.
+  pi.registerCommand?.("no-quarter", {
+    description: "Lower the moat for this session — run unattended with no approval prompts: /no-quarter [on|off]",
+    handler: (args: string, ctx: any) => {
+      if (ctx?.ui) uiRef = ctx.ui;
+      const arg = String(args ?? "").trim().toLowerCase();
+      if (arg && arg !== "on" && arg !== "off") {
+        return ctx.ui?.notify?.(`usage: /no-quarter [on|off] (currently ${noQuarterActive() ? "on" : "off"})`, "warning");
+      }
+      applyNoQuarter(arg ? arg === "on" : !noQuarterActive(), ctx.ui);
+    },
+  });
+
   // Local extension management. Mirrors what the app's extensions screen does over
   // the relay, but here we CAN hot-activate: ctx.reload() rebuilds the live runner,
   // so a just-added/removed extension takes effect without relaunching (a luxury the

package/extensions/privateer-privacy.ts

@@ -46,6 +46,27 @@ const privacy = makePiPrivacyExtension({
     if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
     return (await accountPosture(modelId)).tier;
   },
+  // pi-privacy 0.8 added an INGEST gate: credentials arriving in a tool result are
+  // redacted before they enter context (they'd otherwise be re-sent every turn and
+  // written to the session file on disk). We already redact tool output in
+  // src/ext/permissionGate.ts, so its default "warn" would put an interactive prompt
+  // in front of something this app has always handled silently — "redact" keeps our
+  // UX and still takes the added coverage.
+  //
+  // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
+  // ours masks the configured provider keys by exact value (from env/config) plus the
+  // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
+  // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
+  // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which
+  // our patterns match.
+  //
+  // Order between the two is NOT guaranteed: pi discovers extensions with a bare
+  // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this
+  // box today, not by contract). "redact" makes that moot — both handlers run
+  // unconditionally and each masks its own patterns, so the surviving content is the
+  // same either way. Under "warn" the order WOULD matter, since it decides whether
+  // the prompt is raised on a raw key or one we already masked.
+  toolResultPolicy: "redact",
 });
 
 export default function privateerPrivacy(pi: any): void {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.7.0",
+  "version": "0.8.2",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -67,12 +67,14 @@
     "@noble/ciphers": "^2.1.1",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.7.1",
+    "@phala/dcap-qvl": "^0.5.2",
     "patch-package": "^8.0.1",
     "pi-mcp-adapter": "^2.11.0",
-    "pi-privacy": "^0.3.0",
+    "pi-privacy": "^0.8.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
     "privateer-workflow": "^0.1.0",
+    "tinfoil": "^1.1.11",
     "tsx": "^4.16.0",
     "typebox": "^1.3.4",
     "undici": "^7.28.0",

package/src/channels/run.ts

@@ -109,7 +109,8 @@ async function main() {
   const { makePermissionGate } = await import("../ext/permissionGate.ts");
   type GateController = import("../ext/permissionGate.ts").GateController;
   const { makePiPrivacyExtension } = await import("pi-privacy");
-  const { makeAccountProvider } = await import("../providers/account.ts");
+  const { makeAccountProvider, privateerChannel } = await import("../providers/account.ts");
+  const { hasCredentials } = await import("../auth/privateer.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
@@ -181,7 +182,15 @@ async function main() {
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+      extensionFactories: [
+        makePermissionGate(gate),
+        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
+        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
+        makePiPrivacyExtension({
+          privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+        }),
+        makeAccountProvider(),
+      ] as any,
     },
   });
 

package/src/cli/chat.ts

@@ -11,6 +11,7 @@
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { fileURLToPath } from "node:url"; // builtin, safe pre-boot
 import { cliPalette } from "../ui/palette.ts"; // no Pi deps → safe pre-boot
+import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts"; // no Pi deps → safe pre-boot
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 
 // This lean REPL has no Pi TUI (and so no Theme), so it detects the terminal background
@@ -38,7 +39,7 @@ async function main() {
   const { authorizeControl } = await import("../remote/controlAuth.ts");
   const { resolveMentions, completeMention, searchFiles } = await import("../util/fileMentions.ts");
   const priv = await import("../auth/privateer.ts");
-  const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
+  const { makeAccountProvider, accountPosture, privateerChannel } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
   const { resolveDefaultModel, resolveSignedInModel } = await import("../providers/defaultModel.ts");
 
@@ -307,8 +308,9 @@ async function main() {
     },
     getRemote: bridge.getRemote,
     getNoQuarter: bridge.getNoQuarter,
-    // `--no-quarter` at launch (env PRIVATEER_NO_QUARTER) → total gate bypass, no prompts.
-    getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
+    // Total gate bypass, no prompts — from `--no-quarter` at launch or shift+tab /
+    // `/no-quarter` mid-session. One shared state (../permissions/noQuarter.ts).
+    getSkipAllPermissions: noQuarterActive,
     remoteAsk: bridge.remoteAsk,
     // Subagents (and their child-only intercom tools) can't be driven from the app
     // yet — pi-subagents runs each in a child session whose gate/UI bypass the relay,
@@ -322,14 +324,52 @@ async function main() {
     },
   };
 
+  // ── no quarter (shift+tab) ──────────────────────────────────────────────────
+  // The "step away from the keyboard" switch: lower the moat for the rest of the
+  // session so a long task runs to completion instead of stalling on the next
+  // approval prompt. Same state the `--no-quarter` launch flag sets, and the same
+  // chord the full TUI uses (extensions/privateer-gate.ts). Reversible with the
+  // same key; takes effect from the next gated action, so an approval already on
+  // screen still needs an answer.
+  function applyNoQuarter(on: boolean): void {
+    setNoQuarter(on);
+    flushOut(); // land streamed output above the notice
+    console.log(
+      on
+        ? `\n${RED}⚑ No quarter — the permission gate is OFF for this session.${RESET}\n` +
+          `${DIM}  Every action (shell, edits, destructive tools, out-of-cwd, protected files) runs without asking.\n` +
+          `  shift+tab (or /no-quarter off) raises the moat again.${RESET}`
+        : `\n${GREEN}⚓ Moat raised — the permission gate is back on.${RESET}`,
+    );
+  }
+
+  // readline already emits keypress events for a TTY input, so we just listen. Node
+  // decodes shift+tab (CSI Z) as {name: "tab", shift: true}. We don't swallow it —
+  // readline still runs its own tab handler, which for a non-`@mention` line
+  // completes to nothing.
+  if (process.stdin.isTTY) {
+    process.stdin.on("keypress", (_s: string, key: any) => {
+      if (key?.name === "tab" && key.shift && !key.ctrl && !key.meta) applyNoQuarter(!noQuarterActive());
+    });
+  }
+
   console.log(`${DIM}privateer-agent — lean REPL. Loading ${provider}/${modelId}…${RESET}`);
+  if (noQuarterActive()) applyNoQuarter(true); // launched with --no-quarter: say so up front
 
   const services = await createAgentSessionServices({
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
       // Structural ext types are intentionally narrow; cast to Pi's ExtensionFactory.
-      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+      extensionFactories: [
+        makePermissionGate(gate),
+        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
+        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
+        makePiPrivacyExtension({
+          privateerVerifiedTee: (m) => priv.hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+        }),
+        makeAccountProvider(),
+      ] as any,
     },
   });
   for (const d of services.diagnostics) if (d.type === "error") console.log(`${RED}! ${d.message}${RESET}`);
@@ -525,8 +565,9 @@ async function main() {
       : `${DIM}Not signed in. /login to enable remote access & the account provider.${RESET}`,
   );
 
-  const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /quit";
+  const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /no-quarter [on|off]  /quit";
   console.log(`${DIM}Ready. Type a prompt — reference a file with @path (Tab completes). ${HELP}${RESET}`);
+  console.log(`${DIM}shift+tab toggles no quarter — unattended mode, no approval prompts.${RESET}`);
   await showPosture();
 
   // The available model catalog as sorted "provider/id" specs. Same source the
@@ -612,6 +653,24 @@ async function main() {
       console.log(items.length ? items.map((s) => `  ${s.name}${s.disabled ? ` ${DIM}(disabled)${RESET}` : ""}${s.editable ? "" : ` ${DIM}(read-only)${RESET}`} — ${s.description}`).join("\n") : `${DIM}No skills yet. Create them from the Privateer app.${RESET}`);
       return true;
     }
+    // The typed equivalent of shift+tab. A PHYSICAL-terminal action, like
+    // /remote-access: it's stronger than any mode (it also switches off the
+    // dangerous-command denylist and the protected-file guard), so a remote
+    // controller must not be able to reach it. The app's own no-quarter toggle
+    // covers driven turns and is `bypass` exactly — never weaker than /mode bypass.
+    if (line === "/no-quarter" || line.startsWith("/no-quarter ")) {
+      if (remote) {
+        relay?.sendNotice("/no-quarter is terminal-only — run it at the machine, or use the app's own no-quarter toggle.");
+        return true;
+      }
+      const arg = line.slice(11).trim().toLowerCase();
+      if (arg && arg !== "on" && arg !== "off") {
+        console.log(`${YELLOW}usage: /no-quarter [on|off] (currently ${noQuarterActive() ? "on" : "off"})${RESET}`);
+        return true;
+      }
+      applyNoQuarter(arg ? arg === "on" : !noQuarterActive());
+      return true;
+    }
     if (line.startsWith("/mode ")) { mode = line.slice(6).trim() as typeof mode; const m = `mode → ${mode}`; console.log(`${DIM}${m}${RESET}`); if (remote) relay?.sendNotice(m); return true; }
     // Bare /mode → the picker (remote) or a hint (local).
     if (line === "/mode") {
@@ -640,6 +699,7 @@ async function main() {
     const builtins = [
       { name: "/model", description: "Switch the model" },
       { name: "/mode", description: "Change the approval mode (default/acceptEdits/plan/bypass)" },
+      // /no-quarter is deliberately absent — terminal-only, see runCommand.
       { name: "/models", description: "List available models" },
       { name: "/extensions", description: "Manage installed Pi extensions" },
       { name: "/skills", description: "Manage the terminal's skills" },

package/src/harbor/index.ts

@@ -14,7 +14,7 @@ import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { makePermissionGate, type GateController } from "../ext/permissionGate.ts";
 import { makePiPrivacyExtension } from "pi-privacy";
-import { makeAccountProvider } from "../providers/account.ts";
+import { makeAccountProvider, privateerChannel } from "../providers/account.ts";
 import { resolveDefaultModel } from "../providers/defaultModel.ts";
 import { RelayClient, type TaskSpec } from "../remote/relayClient.ts";
 import { createLiveTaskSession, type LiveTaskHandle } from "../remote/liveTaskSession.ts";
@@ -30,7 +30,7 @@ import { openJsonFromApp } from "../crypto/terminalUnseal.ts";
 import { verifyChannelSave, verifyOutboxKey } from "../crypto/accountVerify.ts";
 import { loadAccountSignKey, loadLastControlTs, saveLastControlTs } from "../crypto/accountTrust.ts";
 import { authorizeControl } from "../remote/controlAuth.ts";
-import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke } from "../auth/privateer.ts";
+import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke, defaultDeviceLabel } from "../auth/privateer.ts";
 import {
   loadRoutines,
   upsertRoutine,
@@ -50,7 +50,7 @@ import { splitRoutineTools } from "../routines/toolSelect.ts";
 import { deliver, type RelayPusher, type CloudPusher } from "../routines/delivery.ts";
 import { sealJson, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
 import { redactText, collectSecrets } from "../util/redact.ts";
-import { startIpcServer, type IpcRequest, type IpcResponse } from "./ipc.ts";
+import { startIpcServer, HarborAlreadyRunningError, type IpcRequest, type IpcResponse } from "./ipc.ts";
 import { isHosted, publishRelayPub } from "../config/hosted.ts";
 
 // The safe, read-only toolset for unattended runs — Pi builtins with no
@@ -226,13 +226,19 @@ export class Harbor {
     return "queued";
   };
 
-  start(): void {
+  async start(): Promise<void> {
+    // Single-instance lock FIRST, before any other side effect: binding the IPC
+    // socket is the machine's mutex. If a live harbor already holds it this throws
+    // HarborAlreadyRunningError — two harbors under one ~/.privateer share a single
+    // routineRelayId(), so a second would collide on the relay and double-fire
+    // routines. Doing this first means a rejected second instance never publishes a
+    // relay key, connects, or fires a tick.
+    this.server = await startIpcServer((req) => this.handleIpc(req));
     // Hosted only: publish our relay pubkey for the host to bind into the SEV-SNP
     // report. Before syncRelay() so the key exists by the time we're reachable.
     publishRelayPub();
     this.primeSchedule();
     this.timer = setInterval(() => void this.tick(), TICK_MS);
-    this.server = startIpcServer((req) => this.handleIpc(req));
     this.syncRelay();
     void this.flushPendingCloud();
     const count = loadRoutines().filter((r) => r.enabled).length;
@@ -517,11 +523,22 @@ export class Harbor {
     }
   }
 
+  // This machine's origin tag, embedded (E2EE) in every sealed result so the app can
+  // show WHICH box/environment produced it — the outbox record itself is account-only,
+  // so attribution can only live inside the sealed blob (where hostnames are allowed;
+  // the server never sees it). `id` is this install's stable relay id; `label` is the
+  // hostname-based device name. Cached — it never changes for the process lifetime.
+  private originCache?: { id: string; label: string };
+  private machineOrigin(): { id: string; label: string } {
+    if (!this.originCache) this.originCache = { id: routineRelayId(), label: defaultDeviceLabel() };
+    return this.originCache;
+  }
+
   private async postOutbox(name: string, at: string, status: "ok" | "error", content: string, kind: "routine" | "task" = "routine"): Promise<boolean> {
     const pub = await this.ensureOutboxPub();
     if (!pub) return false;
     const body = content.length > MAX_CLOUD_PLAINTEXT ? content.slice(0, MAX_CLOUD_PLAINTEXT) + "\n…truncated" : content;
-    const sealed = sealJson(pub, { v: 1, kind, name, status, at, content: body });
+    const sealed = sealJson(pub, { v: 1, kind, name, status, at, content: body, origin: this.machineOrigin() });
     try {
       const res = await apiRequest("/api/outbox", {
         method: "POST",
@@ -727,7 +744,18 @@ export class Harbor {
         cwd: spec.cwd,
         agentDir: agentDir(),
         resourceLoaderOptions: {
-          extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider(), mcpAdapter] as any,
+          extensionFactories: [
+            makePermissionGate(gate),
+            // Per-model verified-TEE capability for pi-privacy's /models picker: show
+            // Privateer's TEE-channel models (near/tinfoil/phala) as "◆ Verifiable TEE"
+            // when logged in; ZDR-channel models stay at their honest floor. The live
+            // verdict still comes from accountPosture on select — this only lifts the label.
+            makePiPrivacyExtension({
+              privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+            }),
+            makeAccountProvider(),
+            mcpAdapter,
+          ] as any,
         },
       });
       servicesRef = services as any;
@@ -834,8 +862,12 @@ export class Harbor {
         this.relay?.sendTaskSpawned(handle.termId, handle.label);
         log(`live task spawned: ${handle.termId} (${handle.label})`);
       } catch (e) {
-        const msg = `Couldn't spawn a live session: ${(e as Error).message}`;
+        const reason = (e as Error).message;
+        const msg = `Couldn't spawn a live session: ${reason}`;
         log(msg);
+        // Typed failure reply so the app's spawn screen stops waiting and shows why. Also send
+        // a notice as a back-compat fallback for older app builds that don't handle the frame.
+        this.relay?.sendTaskSpawnError(reason);
         this.relay?.sendNotice(msg);
       }
     })();
@@ -1034,7 +1066,6 @@ export class Harbor {
 // Entry point for `privateer harbor`. Caller must have imported ./boot.ts first.
 export function runHarbor(): void {
   const harbor = new Harbor();
-  harbor.start();
   const shutdown = () => {
     log("shutting down");
     harbor.stop();
@@ -1042,4 +1073,14 @@ export function runHarbor(): void {
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
+  harbor.start().catch((err) => {
+    if (err instanceof HarborAlreadyRunningError) {
+      // A resident harbor already owns this machine — leave it in charge. Exit 0 so a
+      // manual `privateer harbor run` beside the installed login service isn't an error.
+      process.stderr.write("A Harbor is already running on this machine — leaving the existing one in charge.\n");
+      process.exit(0);
+    }
+    process.stderr.write(`Harbor failed to start: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+  });
 }