privateer-agent 0.8.0 → 0.8.2

package/README.md

@@ -210,7 +210,7 @@ export PRIVATEER_API_KEY=sk-priv-...      # Privateer developer API (privateer.p
 ```
 
 Pick a model with **`/model`** (browse each configured provider's live catalog) or pass one
-directly as `provider/model` — e.g. `openrouter/anthropic/claude-opus-4.8`,
+directly as `provider/model` — e.g. `openrouter/anthropic/claude-opus-5`,
 `ollama/qwen3-coder`, `nearai/zai-org/GLM-5.1-FP8`. Any OpenAI-compatible server (LM Studio,
 vLLM, llama.cpp) works as a custom provider — just give it a base URL.
 
@@ -388,20 +388,35 @@ live in plaintext in `config.json` on your machine, and every channel action is
 Switch with **`/mode`**. Even in `bypass`, a danger filter blocks destructive shell commands,
 and protected files (`.env`, shell rc files…) are guarded — the gate is never fully off.
 
-### `--no-quarter` — lower the moat entirely
-
-For an unattended run in a directory and on a task you fully trust, launch with:
-
-```bash
-privateer --no-quarter
-```
+### No quarter — lower the moat entirely
 
 This is the one exception to "the gate is never fully off." It disables the permission
 gate for the **whole session** — every action auto-approves with no prompt, including
 destructive shell commands, out-of-cwd access, and protected files. Subagents spawned
-by the session inherit it. There is no `/mode` equivalent; it's a deliberate launch-time
-opt-out (env `PRIVATEER_NO_QUARTER=1`) and prints a red warning banner so it's never a
-surprise. Use it sparingly.
+after it goes on inherit it (env `PRIVATEER_NO_QUARTER=1`). Only for a directory and a
+task you fully trust.
+
+Three ways in, all the same switch:
+
+| | |
+|---|---|
+| **shift+tab** | toggle it mid-session — hit it and walk away, and the agent runs the task to the end instead of stopping at the next approval |
+| `/no-quarter [on\|off]` | the typed equivalent |
+| `privateer --no-quarter` | start a session with the moat already down |
+
+It's never quietly in effect: the launch flag prints a red warning banner, the toggle
+posts a warning to the transcript, and while it's on the footer carries a permanent red
+`⚑ no quarter — permission gate OFF` indicator. shift+tab again raises the moat.
+
+Toggling takes effect from the next gated action — an approval already on screen still
+needs an answer. It's a physical-terminal switch: a phone driving this terminal over
+`/remote-access` can't reach it. The app has its own no-quarter toggle for driven turns,
+which is `bypass` exactly — never less — so dangerous shell and destructive actions
+still surface an Allow there, precisely as they do under `/mode bypass` locally.
+
+> shift+tab is Pi's default "cycle thinking level" chord; Privateer takes it for this.
+> Thinking level is still under `/settings`, or bind `app.thinking.cycle` to another key
+> in `~/.privateer/agent/keybindings.json`.
 
 ## Extend it
 
@@ -428,6 +443,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 |---|---|
 | `/model` · `/models` | switch model; `/models` is a searchable picker with TEE/ZDR privacy shields |
 | `/mode` | switch permission mode |
+| `/no-quarter` | lower the moat for this session and run unattended (**shift+tab**) |
 | `/verify` | fetch and check the TEE attestation for the current model |
 | `/signin` · `/signout` | sign in to a Privateer account (device flow) / sign out |
 | `/remote-access` | link this terminal to the app and allow it to drive (off by default) |

package/bin/privateer-launch.mjs

@@ -60,6 +60,7 @@ if (NO_QUARTER) {
       "  ⚓ \x1b[1;31mNo quarter\x1b[0m — permission gate DISABLED for this session.",
       "     Every action (shell, edits, destructive tools, out-of-cwd) runs WITHOUT a prompt.",
       "     Only use this in a directory and with a task you fully trust.",
+      "     shift+tab (or /no-quarter off) raises the moat again.",
       "",
     ].join("\n") + "\n",
   );

package/extensions/privateer-gate.ts

@@ -28,8 +28,10 @@ import { makeSkillsControl } from "../src/remote/skillsControl.ts";
 import { agentDir } from "../src/config/paths.ts";
 import { agentVersion } from "../src/config/version.ts";
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
+import { matchesKey } from "@earendil-works/pi-tui";
 import * as priv from "../src/auth/privateer.ts";
 import { paletteFor } from "../src/ui/palette.ts";
+import { noQuarterActive, setNoQuarter } from "../src/permissions/noQuarter.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
 const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
@@ -169,6 +171,17 @@ async function pickModelRemote(filter: string): Promise<void> {
 // the REPL's runCommand fall-through.
 async function runRemoteCommand(text: string): Promise<void> {
   const line = text.trim();
+  // No quarter is a PHYSICAL-terminal action, like /remote-access. It's stronger than
+  // any mode — it also switches off the dangerous-command denylist and the protected-
+  // file guard — so a remote controller must not be able to reach it. (The app's own
+  // no_quarter toggle covers driven turns: ModeGate re-decides those through
+  // decideAuto(req, "bypass", …), so it IS /mode bypass — never weaker. Dangerous and
+  // destructive actions sit above bypass, so they come back to the phone for an
+  // explicit Allow there, exactly as bypass surfaces them locally.)
+  if (line === "/no-quarter" || line.startsWith("/no-quarter ")) {
+    relay?.sendNotice("/no-quarter is terminal-only — run it at the machine, or use the app's own no-quarter toggle.");
+    return;
+  }
   if (line.startsWith("/model ")) { await switchModelRemote(line.slice(7)); return; }
   if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
     const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
@@ -213,7 +226,9 @@ function advertiseCommands(): { name: string; description?: string }[] {
       })
       .filter(Boolean);
   } catch { /* no commands registered yet */ }
-  const seen = new Set(builtins.map((c) => c.name));
+  // Terminal-only commands are withheld rather than advertised-then-refused, so the
+  // app's composer never offers something it can't run. See runRemoteCommand.
+  const seen = new Set([...builtins.map((c) => c.name), "/no-quarter"]);
   return [...builtins, ...ext.filter((c: any) => !seen.has(c.name))];
 }
 
@@ -250,6 +265,61 @@ function setRemoteState(s: typeof remoteState): void {
   refreshRemoteStatus();
 }
 
+// ── no quarter (shift+tab) ────────────────────────────────────────────────────
+// The "step away from the keyboard" switch. On, the gate is fully lowered for the
+// rest of the session: every action auto-approves with no prompt, so a long task
+// runs to completion instead of stalling on the next approval. Off by default and
+// reversible with the same key; the state itself lives in src/permissions/noQuarter.ts
+// (shared with the launch flag and inherited by subagent children).
+//
+// The footer carries a permanent RED indicator while it's on — this is the one
+// setting that turns the whole moat off, so it must never be quietly in effect.
+const NO_QUARTER_STATUS_KEY = "privateer:no-quarter";
+
+function refreshNoQuarterStatus(): void {
+  const ui = uiRef;
+  if (!ui?.setStatus) return;
+  if (!noQuarterActive()) {
+    ui.setStatus(NO_QUARTER_STATUS_KEY, undefined);
+    return;
+  }
+  const p = paletteFor(ui.theme);
+  ui.setStatus(
+    NO_QUARTER_STATUS_KEY,
+    `${p.RED}${p.BOLD}⚑ no quarter — permission gate OFF${p.RESET} ${p.DIM}· shift+tab to raise the moat${p.RESET}`,
+  );
+}
+
+// Flip the state and tell the user, loudly on the way down. Takes effect from the
+// next gated action — an approval already on screen still needs an answer.
+function applyNoQuarter(on: boolean, ui: any): void {
+  setNoQuarter(on);
+  refreshNoQuarterStatus();
+  ui?.notify?.(
+    on
+      ? "⚑ No quarter — the permission gate is OFF for this session. Every action (shell, edits, destructive tools, out-of-cwd, protected files) now runs without asking. shift+tab to raise the moat again."
+      : "⚓ Moat raised — the permission gate is back on.",
+    on ? "warning" : "info",
+  );
+}
+
+// shift+tab, intercepted at the raw-input layer. Pi reserves that chord for
+// `app.thinking.cycle`, so pi.registerShortcut("shift+tab") would be dropped as a
+// conflict — a TUI input listener runs ahead of every component instead, and
+// consuming the key stops it reaching the thinking-level cycler. (Thinking level
+// stays reachable from /settings, or by binding app.thinking.cycle to another key.)
+let unsubscribeKeys: (() => void) | undefined;
+
+function bindNoQuarterKey(ui: any): void {
+  if (typeof ui?.onTerminalInput !== "function") return; // older Pi / non-TUI mode
+  unsubscribeKeys?.(); // a session replacement clears listeners — rebind, never double-bind
+  unsubscribeKeys = ui.onTerminalInput((data: string) => {
+    if (!matchesKey(data, "shift+tab")) return undefined;
+    applyNoQuarter(!noQuarterActive(), ui);
+    return { consume: true };
+  });
+}
+
 // Tear down the relay and clear the indicator. Used by `/remote-access off` AND by
 // the app's own "End remote access" action (onTerminate), so both paths converge.
 function disableRemote(): void {
@@ -353,10 +423,11 @@ const gate = makePermissionGate({
   localAsk,
   getRemote: bridge.getRemote,
   getNoQuarter: bridge.getNoQuarter,
-  // `--no-quarter` at launch (see bin/privateer-launch.mjs) sets PRIVATEER_NO_QUARTER
-  // and opts this whole session — TUI and any subagent children that inherit the env —
-  // out of the gate entirely: every action auto-approves, no prompt.
-  getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
+  // Session-wide TOTAL bypass: every action auto-approves, no prompt. Set either by
+  // `--no-quarter` at launch (see bin/privateer-launch.mjs, which exports
+  // PRIVATEER_NO_QUARTER) or by shift+tab mid-session — both land in the same state,
+  // which subagent children inherit through the env. See src/permissions/noQuarter.ts.
+  getSkipAllPermissions: noQuarterActive,
   remoteAsk: bridge.remoteAsk,
 });
 
@@ -401,6 +472,13 @@ export default function privateerControl(pi: any): void {
     if (ctx?.modelRegistry) modelReg = ctx.modelRegistry;
     if (!currentSpec && ctx?.model) currentSpec = modelSpec(ctx.model);
     refreshRemoteStatus();
+    // shift+tab → no quarter, and the red footer indicator when it's already on (a
+    // `--no-quarter` launch, or a session replacement mid-run). Interactive TUI only:
+    // headless modes and subagent children have no terminal to listen to.
+    if (ctx?.mode === "tui" && ctx?.ui) {
+      bindNoQuarterKey(ctx.ui);
+      refreshNoQuarterStatus();
+    }
     if (ctx?.mode && HEADLESS.has(ctx.mode) && (process.env.PRIVATEER_MODE ?? "") === "") {
       mode = "bypass";
     }
@@ -443,6 +521,20 @@ export default function privateerControl(pi: any): void {
     },
   });
 
+  // The typed equivalent of shift+tab, for anyone who'd rather not trust a chord with
+  // the whole moat. Deliberately NOT reachable from the app — see runRemoteCommand.
+  pi.registerCommand?.("no-quarter", {
+    description: "Lower the moat for this session — run unattended with no approval prompts: /no-quarter [on|off]",
+    handler: (args: string, ctx: any) => {
+      if (ctx?.ui) uiRef = ctx.ui;
+      const arg = String(args ?? "").trim().toLowerCase();
+      if (arg && arg !== "on" && arg !== "off") {
+        return ctx.ui?.notify?.(`usage: /no-quarter [on|off] (currently ${noQuarterActive() ? "on" : "off"})`, "warning");
+      }
+      applyNoQuarter(arg ? arg === "on" : !noQuarterActive(), ctx.ui);
+    },
+  });
+
   // Local extension management. Mirrors what the app's extensions screen does over
   // the relay, but here we CAN hot-activate: ctx.reload() rebuilds the live runner,
   // so a just-added/removed extension takes effect without relaunching (a luxury the

package/extensions/privateer-privacy.ts

@@ -46,6 +46,27 @@ const privacy = makePiPrivacyExtension({
     if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
     return (await accountPosture(modelId)).tier;
   },
+  // pi-privacy 0.8 added an INGEST gate: credentials arriving in a tool result are
+  // redacted before they enter context (they'd otherwise be re-sent every turn and
+  // written to the session file on disk). We already redact tool output in
+  // src/ext/permissionGate.ts, so its default "warn" would put an interactive prompt
+  // in front of something this app has always handled silently — "redact" keeps our
+  // UX and still takes the added coverage.
+  //
+  // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
+  // ours masks the configured provider keys by exact value (from env/config) plus the
+  // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
+  // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
+  // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which
+  // our patterns match.
+  //
+  // Order between the two is NOT guaranteed: pi discovers extensions with a bare
+  // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this
+  // box today, not by contract). "redact" makes that moot — both handlers run
+  // unconditionally and each masks its own patterns, so the surviving content is the
+  // same either way. Under "warn" the order WOULD matter, since it decides whether
+  // the prompt is raised on a raw key or one we already masked.
+  toolResultPolicy: "redact",
 });
 
 export default function privateerPrivacy(pi: any): void {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -70,7 +70,7 @@
     "@phala/dcap-qvl": "^0.5.2",
     "patch-package": "^8.0.1",
     "pi-mcp-adapter": "^2.11.0",
-    "pi-privacy": "^0.7.0",
+    "pi-privacy": "^0.8.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
     "privateer-workflow": "^0.1.0",

package/src/cli/chat.ts

@@ -11,6 +11,7 @@
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { fileURLToPath } from "node:url"; // builtin, safe pre-boot
 import { cliPalette } from "../ui/palette.ts"; // no Pi deps → safe pre-boot
+import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts"; // no Pi deps → safe pre-boot
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 
 // This lean REPL has no Pi TUI (and so no Theme), so it detects the terminal background
@@ -307,8 +308,9 @@ async function main() {
     },
     getRemote: bridge.getRemote,
     getNoQuarter: bridge.getNoQuarter,
-    // `--no-quarter` at launch (env PRIVATEER_NO_QUARTER) → total gate bypass, no prompts.
-    getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
+    // Total gate bypass, no prompts — from `--no-quarter` at launch or shift+tab /
+    // `/no-quarter` mid-session. One shared state (../permissions/noQuarter.ts).
+    getSkipAllPermissions: noQuarterActive,
     remoteAsk: bridge.remoteAsk,
     // Subagents (and their child-only intercom tools) can't be driven from the app
     // yet — pi-subagents runs each in a child session whose gate/UI bypass the relay,
@@ -322,7 +324,37 @@ async function main() {
     },
   };
 
+  // ── no quarter (shift+tab) ──────────────────────────────────────────────────
+  // The "step away from the keyboard" switch: lower the moat for the rest of the
+  // session so a long task runs to completion instead of stalling on the next
+  // approval prompt. Same state the `--no-quarter` launch flag sets, and the same
+  // chord the full TUI uses (extensions/privateer-gate.ts). Reversible with the
+  // same key; takes effect from the next gated action, so an approval already on
+  // screen still needs an answer.
+  function applyNoQuarter(on: boolean): void {
+    setNoQuarter(on);
+    flushOut(); // land streamed output above the notice
+    console.log(
+      on
+        ? `\n${RED}⚑ No quarter — the permission gate is OFF for this session.${RESET}\n` +
+          `${DIM}  Every action (shell, edits, destructive tools, out-of-cwd, protected files) runs without asking.\n` +
+          `  shift+tab (or /no-quarter off) raises the moat again.${RESET}`
+        : `\n${GREEN}⚓ Moat raised — the permission gate is back on.${RESET}`,
+    );
+  }
+
+  // readline already emits keypress events for a TTY input, so we just listen. Node
+  // decodes shift+tab (CSI Z) as {name: "tab", shift: true}. We don't swallow it —
+  // readline still runs its own tab handler, which for a non-`@mention` line
+  // completes to nothing.
+  if (process.stdin.isTTY) {
+    process.stdin.on("keypress", (_s: string, key: any) => {
+      if (key?.name === "tab" && key.shift && !key.ctrl && !key.meta) applyNoQuarter(!noQuarterActive());
+    });
+  }
+
   console.log(`${DIM}privateer-agent — lean REPL. Loading ${provider}/${modelId}…${RESET}`);
+  if (noQuarterActive()) applyNoQuarter(true); // launched with --no-quarter: say so up front
 
   const services = await createAgentSessionServices({
     cwd,
@@ -533,8 +565,9 @@ async function main() {
       : `${DIM}Not signed in. /login to enable remote access & the account provider.${RESET}`,
   );
 
-  const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /quit";
+  const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /no-quarter [on|off]  /quit";
   console.log(`${DIM}Ready. Type a prompt — reference a file with @path (Tab completes). ${HELP}${RESET}`);
+  console.log(`${DIM}shift+tab toggles no quarter — unattended mode, no approval prompts.${RESET}`);
   await showPosture();
 
   // The available model catalog as sorted "provider/id" specs. Same source the
@@ -620,6 +653,24 @@ async function main() {
       console.log(items.length ? items.map((s) => `  ${s.name}${s.disabled ? ` ${DIM}(disabled)${RESET}` : ""}${s.editable ? "" : ` ${DIM}(read-only)${RESET}`} — ${s.description}`).join("\n") : `${DIM}No skills yet. Create them from the Privateer app.${RESET}`);
       return true;
     }
+    // The typed equivalent of shift+tab. A PHYSICAL-terminal action, like
+    // /remote-access: it's stronger than any mode (it also switches off the
+    // dangerous-command denylist and the protected-file guard), so a remote
+    // controller must not be able to reach it. The app's own no-quarter toggle
+    // covers driven turns and is `bypass` exactly — never weaker than /mode bypass.
+    if (line === "/no-quarter" || line.startsWith("/no-quarter ")) {
+      if (remote) {
+        relay?.sendNotice("/no-quarter is terminal-only — run it at the machine, or use the app's own no-quarter toggle.");
+        return true;
+      }
+      const arg = line.slice(11).trim().toLowerCase();
+      if (arg && arg !== "on" && arg !== "off") {
+        console.log(`${YELLOW}usage: /no-quarter [on|off] (currently ${noQuarterActive() ? "on" : "off"})${RESET}`);
+        return true;
+      }
+      applyNoQuarter(arg ? arg === "on" : !noQuarterActive());
+      return true;
+    }
     if (line.startsWith("/mode ")) { mode = line.slice(6).trim() as typeof mode; const m = `mode → ${mode}`; console.log(`${DIM}${m}${RESET}`); if (remote) relay?.sendNotice(m); return true; }
     // Bare /mode → the picker (remote) or a hint (local).
     if (line === "/mode") {
@@ -648,6 +699,7 @@ async function main() {
     const builtins = [
       { name: "/model", description: "Switch the model" },
       { name: "/mode", description: "Change the approval mode (default/acceptEdits/plan/bypass)" },
+      // /no-quarter is deliberately absent — terminal-only, see runCommand.
       { name: "/models", description: "List available models" },
       { name: "/extensions", description: "Manage installed Pi extensions" },
       { name: "/skills", description: "Manage the terminal's skills" },

package/src/harbor/index.ts

@@ -862,8 +862,12 @@ export class Harbor {
         this.relay?.sendTaskSpawned(handle.termId, handle.label);
         log(`live task spawned: ${handle.termId} (${handle.label})`);
       } catch (e) {
-        const msg = `Couldn't spawn a live session: ${(e as Error).message}`;
+        const reason = (e as Error).message;
+        const msg = `Couldn't spawn a live session: ${reason}`;
         log(msg);
+        // Typed failure reply so the app's spawn screen stops waiting and shows why. Also send
+        // a notice as a back-compat fallback for older app builds that don't handle the frame.
+        this.relay?.sendTaskSpawnError(reason);
         this.relay?.sendNotice(msg);
       }
     })();

package/src/mcp/catalog.ts

@@ -226,6 +226,62 @@ export const MCP_CATALOG: CatalogEntry[] = [
     fill: "FIGMA_API_KEY",
     credUrl: "https://www.figma.com/developers/api#access-tokens",
   },
+  // ── Google Workspace (needs a Google Cloud OAuth client, then browser sign-in) ─
+  // One server (workspace-mcp) scoped per service via --tools. Runs on uv (uvx),
+  // not npx. Create an OAuth client in Google Cloud once and paste its ID + secret;
+  // the first request opens Google's consent screen on THIS machine.
+  {
+    id: "gmail",
+    name: "gmail",
+    label: "Gmail",
+    blurb: "Read, search, and send email. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "gmail"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials",
+  },
+  {
+    id: "google-calendar",
+    name: "google-calendar",
+    label: "Google Calendar",
+    blurb: "Events and scheduling. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "calendar"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials",
+  },
+  {
+    id: "google-drive",
+    name: "google-drive",
+    label: "Google Drive",
+    blurb: "Files and folders in your Drive. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "drive"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials",
+  },
+  {
+    id: "google-docs",
+    name: "google-docs",
+    label: "Google Docs",
+    blurb: "Read and edit your documents. Google sign-in.",
+    transport: "stdio",
+    command: "uvx",
+    args: ["workspace-mcp", "--tools", "docs"],
+    env: { GOOGLE_OAUTH_CLIENT_ID: "", GOOGLE_OAUTH_CLIENT_SECRET: "" },
+    needs: "token",
+    fill: "GOOGLE_OAUTH_CLIENT_ID",
+    credUrl: "https://console.cloud.google.com/apis/credentials",
+  },
   {
     id: "sequential-thinking",
     name: "sequential-thinking",

package/src/permissions/noQuarter.ts

@@ -0,0 +1,42 @@
+// No-quarter: the moat fully lowered for a session — every action auto-approves
+// with no prompt (dangerous shell, destructive tools, out-of-cwd, protected files).
+// This is the single source of truth for that state; the gate reads it through
+// ModeGate.getSkipAllPermissions, which sits above every other policy check.
+//
+// Two ways in, one state:
+//   1. `privateer --no-quarter` at launch → PRIVATEER_NO_QUARTER=1 (see
+//      bin/privateer-launch.mjs), which seeds `active` below.
+//   2. shift+tab in a live session → toggleNoQuarter(). This is the "step away from
+//      the keyboard" switch: flip it on and the agent runs to completion instead of
+//      stopping on the next approval prompt.
+//
+// Toggling MIRRORS the env var, because that's how the state reaches subagents: a
+// pi-subagents child is a `pi` subprocess that inherits this process's env and reads
+// PRIVATEER_NO_QUARTER in its own gate. Children spawned after a toggle therefore
+// match the parent; ones already running keep the posture they started with.
+//
+// IMPORT-SAFETY: no Pi imports, no node builtins — safe to load from anywhere,
+// including boot-ordered entrypoints (see boot.ts's ORDERING CONTRACT).
+
+const ENV = "PRIVATEER_NO_QUARTER";
+
+// Seeded from the launch flag so `--no-quarter` and the toggle share one state.
+let active = process.env[ENV] === "1";
+
+/** True while the gate is fully lowered for this session. */
+export function noQuarterActive(): boolean {
+  return active;
+}
+
+/** Set the state (and mirror it to the env for future subagent children). Returns the new state. */
+export function setNoQuarter(on: boolean): boolean {
+  active = on;
+  if (on) process.env[ENV] = "1";
+  else delete process.env[ENV];
+  return active;
+}
+
+/** Flip the state. Returns the new state. */
+export function toggleNoQuarter(): boolean {
+  return setNoQuarter(!active);
+}

package/src/providers/account.ts

@@ -40,8 +40,9 @@ import {
 const DEFAULT_MODELS = [
   ACCOUNT_DEFAULT_MODEL_ID,
   ACCOUNT_NEAR_MODEL_ID,
-  "anthropic/claude-sonnet-4.6",
-  "openai/gpt-5.5",
+  "anthropic/claude-opus-5",
+  "anthropic/claude-sonnet-5",
+  "openai/gpt-5.6-sol",
   "deepseek/deepseek-v4-flash",
 ];
 

package/src/remote/liveTaskSession.ts

@@ -43,6 +43,10 @@ export interface LiveTaskDeps {
 // abandoned spawn can't run the account meter or hold resources forever).
 const ATTACH_GRACE_MS = 180_000; // 3 min to attach after spawn
 const MAX_LIFETIME_MS = 30 * 60_000; // 30 min absolute cap
+// How long to wait for the spawned terminal to actually register on the relay before we give
+// up and report the spawn as failed. `start()` resolves before the socket opens, so without
+// this confirmation the harbor would announce a terminal the app can never attach to.
+const REGISTER_TIMEOUT_MS = 20_000;
 
 export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps): Promise<LiveTaskHandle> {
   const cwd = spec.cwd && spec.cwd.trim() ? spec.cwd : process.cwd();
@@ -213,6 +217,11 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   relay = new RelayClient(bridge.callbacks, { termId, label });
   bridge.attachRelay(relay);
   await relay.start();
+  // start() resolves before the socket registers; confirm the terminal is actually live on
+  // the relay BEFORE returning (→ the harbor announces task_spawned). Rejects on a hard
+  // failure (e.g. the concurrency cap) or timeout → the catch below tears down and propagates,
+  // so the harbor reports task_spawn_error instead of pointing the app at a dead terminal.
+  await relay.awaitRegistered(REGISTER_TIMEOUT_MS);
 
   // Reap if nobody ever attaches, and cap the absolute lifetime regardless.
   attachTimer = setTimeout(() => { if (!attached) void stop(); }, ATTACH_GRACE_MS);

package/src/remote/relayClient.ts

@@ -295,6 +295,14 @@ export class RelayClient {
   // random one each time).
   private readonly termId: string;
   private readonly label: string;
+  // First-registration signal (opt-in via awaitRegistered): `start()` resolves before the
+  // socket actually opens, so a caller that must not act until the terminal is truly live on
+  // the relay — e.g. a live-task spawn that announces `task_spawned` — waits on this instead.
+  // Settled once: resolved on the first ws `open`, rejected on a hard (4xx) ticket-mint
+  // failure. Reconnect blips after a successful first open do NOT re-settle it.
+  private firstConnectSettled = false;
+  private firstConnectError: Error | null = null;
+  private firstConnectWaiters: Array<{ resolve: () => void; reject: (e: Error) => void }> = [];
   // In-progress file transfers from the app, keyed by the controller's attachment
   // id. Reassembled from attach_begin/chunk/end frames, then handed to onAttachment.
   private readonly incoming = new Map<
@@ -322,8 +330,43 @@ export class RelayClient {
     await this.connect();
   }
 
+  // Resolve once this terminal has actually registered on the relay (ws `open`), reject on a
+  // hard registration failure (e.g. a 403 concurrency-cap denial) or after `timeoutMs`.
+  // `start()` resolves before the socket opens, so a live-task spawn calls this to confirm the
+  // app can attach BEFORE it announces the terminal — otherwise the app is told to drive a
+  // terminal that never came up and hangs. Idempotent; settling stores its result so a caller
+  // that awaits after the fact still gets it (no dangling/unhandled rejection).
+  awaitRegistered(timeoutMs: number): Promise<void> {
+    if (this.firstConnectSettled) {
+      return this.firstConnectError ? Promise.reject(this.firstConnectError) : Promise.resolve();
+    }
+    return new Promise<void>((resolve, reject) => {
+      const waiter = {
+        resolve: () => { clearTimeout(timer); resolve(); },
+        reject: (e: Error) => { clearTimeout(timer); reject(e); },
+      };
+      const timer = setTimeout(() => {
+        this.firstConnectWaiters = this.firstConnectWaiters.filter((w) => w !== waiter);
+        reject(new Error(`relay registration timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+      this.firstConnectWaiters.push(waiter);
+    });
+  }
+
+  private settleFirstConnect(err?: Error): void {
+    if (this.firstConnectSettled) return;
+    this.firstConnectSettled = true;
+    this.firstConnectError = err ?? null;
+    const waiters = this.firstConnectWaiters;
+    this.firstConnectWaiters = [];
+    for (const w of waiters) err ? w.reject(err) : w.resolve();
+  }
+
   stop(): void {
     this.closed = true;
+    // Fail any awaitRegistered() waiter promptly instead of leaving it to time out — a
+    // terminal stopped before it ever registered is never coming up.
+    this.settleFirstConnect(new Error("relay stopped before registering"));
     if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = undefined; }
     if (this.flushTimer) { clearTimeout(this.flushTimer); this.flushTimer = undefined; }
     this.bufKind = null;
@@ -344,7 +387,11 @@ export class RelayClient {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ role: "agent", termId: this.termId, label: this.label }),
       });
-      if (!res.ok) throw new Error(`relay ticket HTTP ${res.status}`);
+      if (!res.ok) {
+        const e: Error & { status?: number } = new Error(`relay ticket HTTP ${res.status}`);
+        e.status = res.status;
+        throw e;
+      }
       const { ticket } = (await res.json()) as { ticket: string };
 
       const wsUrl =
@@ -357,6 +404,7 @@ export class RelayClient {
 
       ws.on("open", () => {
         opened = true;
+        this.settleFirstConnect(); // terminal is live on the relay — awaitRegistered() resolves
         this.cb.onStatus?.("Remote access connected — drive this terminal from the Privateer app.");
       });
       ws.on("message", (data) => this.handle(data));
@@ -381,6 +429,13 @@ export class RelayClient {
       // Ticket mint failed (auth/network/route) — surface it; a silent failure
       // looks identical to "connected but ignoring me".
       const msg = err instanceof Error ? err.message : String(err);
+      // A 4xx (e.g. 403 concurrency cap) won't self-heal by retrying the same request —
+      // fail-fast any awaitRegistered() caller (a live-task spawn) so it stops hanging.
+      // The management terminal ignores this signal, so its reconnect behavior is unchanged.
+      const status = (err as { status?: number })?.status;
+      if (typeof status === "number" && status >= 400 && status < 500) {
+        this.settleFirstConnect(err instanceof Error ? err : new Error(msg));
+      }
       this.cb.onStatus?.(`Remote access couldn't reach the relay (${msg}) — retrying…`);
       this.scheduleReconnect();
     } finally {
@@ -691,6 +746,13 @@ export class RelayClient {
     this.rawSend({ type: "task_spawned", termId, label });
   }
 
+  // Tell the app a live task spawn FAILED (reply to task_spawn), with a short reason, so the
+  // spawn screen can stop waiting and show it — a live spawn otherwise has no failure signal
+  // and the app would spin until its own timeout. Fire-and-forget over the management relay.
+  sendTaskSpawnError(reason: string): void {
+    this.rawSend({ type: "task_spawn_error", reason: safe(reason, 300) });
+  }
+
   sendEvent(ev: EngineEvent): void {
     if (ev.type === "text") return this.bufferDelta("text", ev.text);
     if (ev.type === "reasoning") return this.bufferDelta("reasoning", ev.text);

package/src/ui/palette.ts

@@ -38,6 +38,7 @@ export type Palette = {
   DIM: string; // secondary / muted prose
   GREEN: string; // success (connected, verified, context loaded)
   YELLOW: string; // warning (not-signed-in, unconfirmed, update available)
+  RED: string; // alarm (the moat lowered — no-quarter)
 };
 
 // Last-resort palette for when no theme is reachable (headless surfaces have no banner,
@@ -52,6 +53,7 @@ export const FALLBACK: Palette = {
   DIM: `${ESC}90m`,
   GREEN: `${ESC}32m`,
   YELLOW: `${ESC}33m`,
+  RED: `${ESC}31m`,
 };
 
 // Build a Palette from a Pi Theme. getFgAnsi(name) returns the raw SGR foreground escape
@@ -76,6 +78,7 @@ export function paletteFor(theme: any): Palette {
     DIM: g("dim", FALLBACK.DIM),
     GREEN: g("success", FALLBACK.GREEN),
     YELLOW: g("warning", FALLBACK.YELLOW),
+    RED: g("error", FALLBACK.RED),
   };
 }