privateer-agent 0.8.0 → 0.9.0

package/README.md

@@ -210,7 +210,7 @@ export PRIVATEER_API_KEY=sk-priv-...      # Privateer developer API (privateer.p
 ```
 
 Pick a model with **`/model`** (browse each configured provider's live catalog) or pass one
-directly as `provider/model` — e.g. `openrouter/anthropic/claude-opus-4.8`,
+directly as `provider/model` — e.g. `openrouter/anthropic/claude-opus-5`,
 `ollama/qwen3-coder`, `nearai/zai-org/GLM-5.1-FP8`. Any OpenAI-compatible server (LM Studio,
 vLLM, llama.cpp) works as a custom provider — just give it a base URL.
 
@@ -388,20 +388,35 @@ live in plaintext in `config.json` on your machine, and every channel action is
 Switch with **`/mode`**. Even in `bypass`, a danger filter blocks destructive shell commands,
 and protected files (`.env`, shell rc files…) are guarded — the gate is never fully off.
 
-### `--no-quarter` — lower the moat entirely
-
-For an unattended run in a directory and on a task you fully trust, launch with:
-
-```bash
-privateer --no-quarter
-```
+### No quarter — lower the moat entirely
 
 This is the one exception to "the gate is never fully off." It disables the permission
 gate for the **whole session** — every action auto-approves with no prompt, including
 destructive shell commands, out-of-cwd access, and protected files. Subagents spawned
-by the session inherit it. There is no `/mode` equivalent; it's a deliberate launch-time
-opt-out (env `PRIVATEER_NO_QUARTER=1`) and prints a red warning banner so it's never a
-surprise. Use it sparingly.
+after it goes on inherit it (env `PRIVATEER_NO_QUARTER=1`). Only for a directory and a
+task you fully trust.
+
+Three ways in, all the same switch:
+
+| | |
+|---|---|
+| **shift+tab** | toggle it mid-session — hit it and walk away, and the agent runs the task to the end instead of stopping at the next approval |
+| `/no-quarter [on\|off]` | the typed equivalent |
+| `privateer --no-quarter` | start a session with the moat already down |
+
+It's never quietly in effect: the launch flag prints a red warning banner, the toggle
+posts a warning to the transcript, and while it's on the footer carries a permanent red
+`⚑ no quarter — permission gate OFF` indicator. shift+tab again raises the moat.
+
+Toggling takes effect from the next gated action — an approval already on screen still
+needs an answer. It's a physical-terminal switch: a phone driving this terminal over
+`/remote-access` can't reach it. The app has its own no-quarter toggle for driven turns,
+which is `bypass` exactly — never less — so dangerous shell and destructive actions
+still surface an Allow there, precisely as they do under `/mode bypass` locally.
+
+> shift+tab is Pi's default "cycle thinking level" chord; Privateer takes it for this.
+> Thinking level is still under `/settings`, or bind `app.thinking.cycle` to another key
+> in `~/.privateer/agent/keybindings.json`.
 
 ## Extend it
 
@@ -428,6 +443,7 @@ drop your own into `~/.privateer/agent/extensions/` and it loads the same way, g
 |---|---|
 | `/model` · `/models` | switch model; `/models` is a searchable picker with TEE/ZDR privacy shields |
 | `/mode` | switch permission mode |
+| `/no-quarter` | lower the moat for this session and run unattended (**shift+tab**) |
 | `/verify` | fetch and check the TEE attestation for the current model |
 | `/signin` · `/signout` | sign in to a Privateer account (device flow) / sign out |
 | `/remote-access` | link this terminal to the app and allow it to drive (off by default) |

package/bin/privateer-launch.mjs

@@ -60,6 +60,7 @@ if (NO_QUARTER) {
       "  ⚓ \x1b[1;31mNo quarter\x1b[0m — permission gate DISABLED for this session.",
       "     Every action (shell, edits, destructive tools, out-of-cwd) runs WITHOUT a prompt.",
       "     Only use this in a directory and with a task you fully trust.",
+      "     shift+tab (or /no-quarter off) raises the moat again.",
       "",
     ].join("\n") + "\n",
   );

package/extensions/privateer-brand.ts

@@ -28,7 +28,12 @@ import { readFileSync, appendFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import * as priv from "../src/auth/privateer.ts";
-import { armAccountCredential, makeAccountProvider } from "../src/providers/account.ts";
+import {
+  armAccountCredential,
+  dropPersistedAccountCredential,
+  makeAccountProvider,
+  verificationLink,
+} from "../src/providers/account.ts";
 import { resolveSignedInModel } from "../src/providers/defaultModel.ts";
 import { discoverContextFiles, onContextChanged } from "../src/context.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
@@ -317,12 +322,15 @@ export default function privateerBrand(pi: any): void {
   // and dead-ends on the first inference. Removing it makes the next /signin spawn a
   // fresh session. Reached via the model registry (constructed with the auth
   // storage; see session.ts). Best-effort: nothing persisted → nothing to do.
-  const dropPersistedAccount = (ctx: any): void => {
-    try {
-      ctx?.modelRegistry?.authStorage?.remove?.("privateer");
-    } catch {
-      /* no persisted credential / older Pi without this shape — nothing to do */
-    }
+  //
+  // Two flavours, because auth.json is machine-global and shared by every Privateer
+  // terminal (see providers/account.ts dropPersistedAccountCredential):
+  //   - `force` for sign-out / expiry, where the whole token family is revoked and the
+  //     entry is dead for every terminal;
+  //   - the default ownership-checked drop for THIS process's exit, which must not
+  //     delete the credential another running terminal is using.
+  const dropPersistedAccount = (ctx: any, opts: { force?: boolean } = {}): void => {
+    dropPersistedAccountCredential(ctx, opts);
   };
 
   // /update — run the global npm install in a child process and report the outcome via
@@ -370,7 +378,9 @@ export default function privateerBrand(pi: any): void {
       const p = paletteFor(ctx?.ui?.theme);
       const user = await priv.runDeviceLogin({
         onCode: (code: any) => {
-          const uri = clean(code.verification_uri_complete ?? code.verification_uri ?? "");
+          // Absolute url: the server sends it scheme-less, and this line is what the
+          // user copies into a browser. See providers/account.ts verificationLink.
+          const uri = clean(verificationLink(code.verification_uri_complete ?? code.verification_uri));
           const userCode = clean(code.user_code);
           ctx?.ui?.setWidget?.(
             "privateer-signin",
@@ -412,7 +422,7 @@ export default function privateerBrand(pi: any): void {
     const u = priv.currentUser();
     ctx?.ui?.notify?.("Signing out of Privateer…", "info");
     await priv.logout(); // never throws: local state is wiped whatever the network did
-    dropPersistedAccount(ctx);
+    dropPersistedAccount(ctx, { force: true }); // the whole family is revoked, not just ours
     refresh(ctx);
     ctx?.ui?.notify?.(
       `Signed out${u?.email ? ` (${u.email})` : ""} — this machine and its terminals. Drop anchor for now.`,
@@ -594,6 +604,8 @@ export default function privateerBrand(pi: any): void {
     // server-side, so leaving the persisted copy behind would make the NEXT launch
     // reuse a token that's already dead and dead-end on its first prompt (Pi doesn't
     // refresh on a 401). Mirrors the harbor's shutdown (harbor/index.ts).
+    // Ownership-checked (no force): revokeLocalSessions killed OUR sessions only, so a
+    // persisted entry belonging to another running terminal must survive our exit.
     dropPersistedAccount(ctxRef);
   });
 
@@ -602,8 +614,9 @@ export default function privateerBrand(pi: any): void {
   priv.onSessionExpired(() => {
     // clearCredentials() has already wiped the local machine login; also drop Pi's
     // persisted account credential so the next prompt/launch doesn't reuse a token
-    // that's now dead server-side (see dropPersistedAccount).
-    dropPersistedAccount(ctxRef);
+    // that's now dead server-side (see dropPersistedAccount). Forced: the machine login
+    // is gone, so the entry can't be useful to any terminal on this machine.
+    dropPersistedAccount(ctxRef, { force: true });
     refresh(ctxRef);
     ctxRef?.ui?.notify?.("Your Privateer session expired. Run /login to sign back in.", "warning");
   });

package/extensions/privateer-connect.ts

@@ -37,9 +37,11 @@ import {
 import {
   MCP_CATALOG,
   draftFromCatalog,
+  hostedCapable,
   promptOrder,
   type CatalogEntry,
 } from "../src/mcp/catalog.ts";
+import { isHosted } from "../src/config/hosted.ts";
 
 // Minimal views of Pi's theme + TUI handle, mirroring privateer-models.ts — enough to
 // color text and request a redraw without coupling this file to Pi internals.
@@ -126,6 +128,15 @@ interface Step {
   // A step that may be submitted empty. For an edit, an empty secret means "keep
   // the value already on disk" — mcpControl's env merge rule makes that free.
   optional?: boolean;
+  // Ask this step only when the answers so far say it's relevant — the auth questions
+  // are meaningless for a local command, and three dead optional prompts in a row is
+  // how a wizard teaches people to hammer Enter without reading. Predicates may only
+  // read answers from EARLIER steps.
+  when?: (answers: Record<string, string>) => boolean;
+  // Reject an answer before it becomes an answer, returning the reason to show. For
+  // rules mcpControl can't check because it never sees the raw form input, or that it
+  // would only catch after the user has typed three more fields for nothing.
+  validate?: (value: string) => string | undefined;
 }
 
 type View = "list" | "catalog" | "form";
@@ -147,7 +158,15 @@ interface Pending {
 // from the answer rather than asked as a separate question: an https:// answer is an
 // http server, anything else is a stdio command line. That matches mcpControl's own
 // inference (`draft.url || prev.url ? "http" : "stdio"`), so there's one rule, not two.
+const isHttpTarget = (answers: Record<string, string>) => /^https?:\/\//i.test((answers.target ?? "").trim());
+
 function customSteps(existing?: RemoteMcpServer): Step[] {
+  // A hosted agent takes remote OAuth connectors and nothing else (Option B —
+  // treeview/docs/HARBOR_CONNECTORS_PLAN.md §2), so the custom form drops to that
+  // shape: no local command, and no stored token. Both are refused at the question
+  // rather than at first call, because a connector that saves cleanly and then never
+  // works is the worse of the two failures.
+  const hosted = isHosted();
   const target = existing
     ? existing.transport === "http"
       ? existing.url
@@ -162,15 +181,48 @@ function customSteps(existing?: RemoteMcpServer): Step[] {
     },
     {
       key: "target",
-      prompt: "Launch command, or an https:// URL",
-      hint: "e.g. npx -y @modelcontextprotocol/server-memory  ·  or  https://mcp.example.com/sse",
+      prompt: hosted ? "Server URL" : "Launch command, or an https:// URL",
+      hint: hosted
+        ? "e.g. https://mcp.example.com/sse — a hosted agent can't run a local command."
+        : "e.g. npx -y @modelcontextprotocol/server-memory  ·  or  https://mcp.example.com/sse",
       initial: target,
+      validate: hosted
+        ? (v) =>
+            /^https?:\/\//i.test(v.trim())
+              ? undefined
+              : "A hosted agent can only reach remote connectors — this needs an https:// URL."
+        : undefined,
     },
     {
       key: "env",
       prompt: "Environment variables (optional)",
       hint: "KEY=value, comma-separated. Leave blank for none.",
       optional: true,
+      // Nothing to set them ON when there is no local process to spawn, and their
+      // values are credentials at rest — both reasons a hosted agent skips this.
+      when: () => !hosted,
+    },
+    {
+      key: "bearerToken",
+      prompt: "Bearer token (optional)",
+      hint: existing?.bearerTokenSet
+        ? "Leave blank to keep the token already saved."
+        : "Leave blank to sign in through the browser instead (OAuth).",
+      secret: true,
+      optional: true,
+      // Never asked on a hosted agent: the home is tmpfs and a stored token would have
+      // to rest somewhere we can read. OAuth is the only credential it may hold.
+      when: (a) => !hosted && isHttpTarget(a),
+    },
+    {
+      key: "headers",
+      prompt: "Extra HTTP headers (optional)",
+      hint: "KEY=value, comma-separated — e.g. X-Api-Version=2. Leave blank for none.",
+      // Header values are credentials as often as not, so this is masked like a token
+      // — and for the same reason a hosted agent is never offered it.
+      secret: true,
+      optional: true,
+      when: (a) => !hosted && isHttpTarget(a),
     },
   ];
 }
@@ -196,7 +248,22 @@ function buildCustomDraft(answers: Record<string, string>): McpDraft {
   if (/^https?:\/\//i.test(target)) {
     draft.transport = "http";
     draft.url = target;
-    draft.oauth = true;
+    const token = (answers.bearerToken ?? "").trim();
+    const headers = parseEnv(answers.headers ?? "");
+    const hasHeaders = Object.keys(headers).length > 0;
+    if (hasHeaders) draft.headers = headers;
+    if (token) {
+      // A static token: the adapter only sends the Authorization header when auth is
+      // explicitly "bearer", so this pairing is not optional.
+      draft.auth = "bearer";
+      draft.bearerToken = token;
+    } else if (hasHeaders) {
+      // Custom headers ARE the credential here — the adapter's supportsOAuth() refuses
+      // OAuth once headers are configured, so claiming "oauth" would be a lie.
+      draft.auth = "none";
+    } else {
+      draft.auth = "oauth";
+    }
   } else {
     draft.transport = "stdio";
     const parts = target.split(/\s+/).filter(Boolean);
@@ -265,8 +332,16 @@ const NEEDS_LABEL: Record<string, string> = {
   none: "no setup",
 };
 
+// On a hosted (Harbor) agent the picker offers only what the runtime can actually
+// hold — see hostedCapable(). Offering the other 16 would be offering a connector that
+// installs nothing, keeps nothing, and fails at first call: the tenant is `--read-only`
+// with no uv/uvx/Python and a tmpfs home wiped on every suspend. Filtering here rather
+// than letting them fail later is the difference between "not available on a hosted
+// agent" and "I set it up and it just doesn't work."
 function catalogRows(): CatalogRow[] {
-  const rows: CatalogRow[] = MCP_CATALOG.map((e) => ({
+  const hosted = isHosted();
+  const entries = hosted ? MCP_CATALOG.filter(hostedCapable) : MCP_CATALOG;
+  const rows: CatalogRow[] = entries.map((e) => ({
     entry: e,
     label: e.label,
     blurb: e.blurb,
@@ -274,7 +349,9 @@ function catalogRows(): CatalogRow[] {
   }));
   rows.push({
     label: "Custom…",
-    blurb: "Any stdio command or http URL.",
+    // Custom survives the filter because a custom REMOTE OAuth connector is fine here;
+    // it's stdio and stored tokens that aren't. customSteps enforces that.
+    blurb: hosted ? "Any https:// URL with browser sign-in." : "Any stdio command or http URL.",
     needsLabel: "",
   });
   return rows;
@@ -359,6 +436,36 @@ class ConnectPanel extends Container {
     return this.pending?.steps[this.stepIndex];
   }
 
+  // A step is asked only when its `when` predicate (if any) passes against the answers
+  // collected so far. Navigation walks over the hidden ones in both directions, and
+  // the position counter reports the VISIBLE steps so "2/3" doesn't count a question
+  // the user will never see.
+  private stepVisible(i: number): boolean {
+    const step = this.pending?.steps[i];
+    if (!step) return false;
+    return step.when ? step.when(this.answers) : true;
+  }
+
+  private seekStep(from: number, dir: 1 | -1): number | undefined {
+    const total = this.pending?.steps.length ?? 0;
+    for (let i = from; i >= 0 && i < total; i += dir) {
+      if (this.stepVisible(i)) return i;
+    }
+    return undefined;
+  }
+
+  private visiblePosition(): { at: number; of: number } {
+    const total = this.pending?.steps.length ?? 0;
+    let at = 0;
+    let of = 0;
+    for (let i = 0; i < total; i++) {
+      if (!this.stepVisible(i)) continue;
+      of++;
+      if (i <= this.stepIndex) at = of;
+    }
+    return { at, of };
+  }
+
   // -- rendering ------------------------------------------------------------
 
   private refresh(): void {
@@ -429,6 +536,13 @@ class ConnectPanel extends Container {
   private renderCatalog(): void {
     const t = this.theme;
     this.body.addChild(new Text(t.fg("accent", t.bold("Add a connector")), 1, 0));
+    // Say why the list is short before the user goes looking for GitHub. A filter with
+    // no explanation reads as a missing connector, which is a support question.
+    if (isHosted()) {
+      this.body.addChild(
+        new Text(t.fg("muted", "  Hosted agent — remote connectors with browser sign-in only."), 1, 0),
+      );
+    }
     this.body.addChild(new Spacer(1));
     this.body.addChild(this.search);
     this.body.addChild(new Spacer(1));
@@ -458,7 +572,8 @@ class ConnectPanel extends Container {
     const t = this.theme;
     const p = this.pending!;
     const step = this.currentStep()!;
-    const counter = p.steps.length > 1 ? `  ${this.stepIndex + 1}/${p.steps.length}` : "";
+    const pos = this.visiblePosition();
+    const counter = pos.of > 1 ? `  ${pos.at}/${pos.of}` : "";
     this.body.addChild(new Text(t.fg("accent", t.bold(p.title)) + t.fg("muted", counter), 1, 0));
     this.body.addChild(new Spacer(1));
     this.body.addChild(new Text(`  ${t.fg("text", step.prompt)}`, 1, 0));
@@ -555,10 +670,19 @@ class ConnectPanel extends Container {
       this.refresh();
       return;
     }
+    // Validate only what was actually typed: a blank optional answer means "skip", and
+    // a rule about the shape of a value has nothing to say about its absence.
+    const bad = value && step.validate ? step.validate(value) : undefined;
+    if (bad) {
+      this.status = bad;
+      this.refresh();
+      return;
+    }
     this.answers[step.key] = value;
     this.status = "";
-    if (this.stepIndex < this.pending!.steps.length - 1) {
-      this.stepIndex++;
+    const next = this.seekStep(this.stepIndex + 1, 1);
+    if (next !== undefined) {
+      this.stepIndex = next;
       this.loadStep();
       return;
     }
@@ -701,8 +825,9 @@ class ConnectPanel extends Container {
     const step = this.currentStep()!;
     if (kb.matches(data, "tui.select.cancel")) {
       // Back a step, or out of the form entirely from the first one.
-      if (this.stepIndex > 0) {
-        this.stepIndex--;
+      const prev = this.stepIndex > 0 ? this.seekStep(this.stepIndex - 1, -1) : undefined;
+      if (prev !== undefined) {
+        this.stepIndex = prev;
         this.loadStep();
       } else {
         this.view = this.pending?.origin ?? "list";

package/extensions/privateer-gate.ts

@@ -28,8 +28,10 @@ import { makeSkillsControl } from "../src/remote/skillsControl.ts";
 import { agentDir } from "../src/config/paths.ts";
 import { agentVersion } from "../src/config/version.ts";
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
+import { matchesKey } from "@earendil-works/pi-tui";
 import * as priv from "../src/auth/privateer.ts";
 import { paletteFor } from "../src/ui/palette.ts";
+import { noQuarterActive, setNoQuarter } from "../src/permissions/noQuarter.ts";
 import type { PermissionMode } from "../src/config/permissionMode.ts";
 
 const MODES: PermissionMode[] = ["default", "acceptEdits", "bypass", "plan"];
@@ -169,6 +171,17 @@ async function pickModelRemote(filter: string): Promise<void> {
 // the REPL's runCommand fall-through.
 async function runRemoteCommand(text: string): Promise<void> {
   const line = text.trim();
+  // No quarter is a PHYSICAL-terminal action, like /remote-access. It's stronger than
+  // any mode — it also switches off the dangerous-command denylist and the protected-
+  // file guard — so a remote controller must not be able to reach it. (The app's own
+  // no_quarter toggle covers driven turns: ModeGate re-decides those through
+  // decideAuto(req, "bypass", …), so it IS /mode bypass — never weaker. Dangerous and
+  // destructive actions sit above bypass, so they come back to the phone for an
+  // explicit Allow there, exactly as bypass surfaces them locally.)
+  if (line === "/no-quarter" || line.startsWith("/no-quarter ")) {
+    relay?.sendNotice("/no-quarter is terminal-only — run it at the machine, or use the app's own no-quarter toggle.");
+    return;
+  }
   if (line.startsWith("/model ")) { await switchModelRemote(line.slice(7)); return; }
   if (line === "/model" || line === "/models" || line.startsWith("/models ")) {
     const filter = line.startsWith("/models ") ? line.slice(8).trim().toLowerCase() : "";
@@ -213,7 +226,9 @@ function advertiseCommands(): { name: string; description?: string }[] {
       })
       .filter(Boolean);
   } catch { /* no commands registered yet */ }
-  const seen = new Set(builtins.map((c) => c.name));
+  // Terminal-only commands are withheld rather than advertised-then-refused, so the
+  // app's composer never offers something it can't run. See runRemoteCommand.
+  const seen = new Set([...builtins.map((c) => c.name), "/no-quarter"]);
   return [...builtins, ...ext.filter((c: any) => !seen.has(c.name))];
 }
 
@@ -250,6 +265,61 @@ function setRemoteState(s: typeof remoteState): void {
   refreshRemoteStatus();
 }
 
+// ── no quarter (shift+tab) ────────────────────────────────────────────────────
+// The "step away from the keyboard" switch. On, the gate is fully lowered for the
+// rest of the session: every action auto-approves with no prompt, so a long task
+// runs to completion instead of stalling on the next approval. Off by default and
+// reversible with the same key; the state itself lives in src/permissions/noQuarter.ts
+// (shared with the launch flag and inherited by subagent children).
+//
+// The footer carries a permanent RED indicator while it's on — this is the one
+// setting that turns the whole moat off, so it must never be quietly in effect.
+const NO_QUARTER_STATUS_KEY = "privateer:no-quarter";
+
+function refreshNoQuarterStatus(): void {
+  const ui = uiRef;
+  if (!ui?.setStatus) return;
+  if (!noQuarterActive()) {
+    ui.setStatus(NO_QUARTER_STATUS_KEY, undefined);
+    return;
+  }
+  const p = paletteFor(ui.theme);
+  ui.setStatus(
+    NO_QUARTER_STATUS_KEY,
+    `${p.RED}${p.BOLD}⚑ no quarter — permission gate OFF${p.RESET} ${p.DIM}· shift+tab to raise the moat${p.RESET}`,
+  );
+}
+
+// Flip the state and tell the user, loudly on the way down. Takes effect from the
+// next gated action — an approval already on screen still needs an answer.
+function applyNoQuarter(on: boolean, ui: any): void {
+  setNoQuarter(on);
+  refreshNoQuarterStatus();
+  ui?.notify?.(
+    on
+      ? "⚑ No quarter — the permission gate is OFF for this session. Every action (shell, edits, destructive tools, out-of-cwd, protected files) now runs without asking. shift+tab to raise the moat again."
+      : "⚓ Moat raised — the permission gate is back on.",
+    on ? "warning" : "info",
+  );
+}
+
+// shift+tab, intercepted at the raw-input layer. Pi reserves that chord for
+// `app.thinking.cycle`, so pi.registerShortcut("shift+tab") would be dropped as a
+// conflict — a TUI input listener runs ahead of every component instead, and
+// consuming the key stops it reaching the thinking-level cycler. (Thinking level
+// stays reachable from /settings, or by binding app.thinking.cycle to another key.)
+let unsubscribeKeys: (() => void) | undefined;
+
+function bindNoQuarterKey(ui: any): void {
+  if (typeof ui?.onTerminalInput !== "function") return; // older Pi / non-TUI mode
+  unsubscribeKeys?.(); // a session replacement clears listeners — rebind, never double-bind
+  unsubscribeKeys = ui.onTerminalInput((data: string) => {
+    if (!matchesKey(data, "shift+tab")) return undefined;
+    applyNoQuarter(!noQuarterActive(), ui);
+    return { consume: true };
+  });
+}
+
 // Tear down the relay and clear the indicator. Used by `/remote-access off` AND by
 // the app's own "End remote access" action (onTerminate), so both paths converge.
 function disableRemote(): void {
@@ -353,10 +423,11 @@ const gate = makePermissionGate({
   localAsk,
   getRemote: bridge.getRemote,
   getNoQuarter: bridge.getNoQuarter,
-  // `--no-quarter` at launch (see bin/privateer-launch.mjs) sets PRIVATEER_NO_QUARTER
-  // and opts this whole session — TUI and any subagent children that inherit the env —
-  // out of the gate entirely: every action auto-approves, no prompt.
-  getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
+  // Session-wide TOTAL bypass: every action auto-approves, no prompt. Set either by
+  // `--no-quarter` at launch (see bin/privateer-launch.mjs, which exports
+  // PRIVATEER_NO_QUARTER) or by shift+tab mid-session — both land in the same state,
+  // which subagent children inherit through the env. See src/permissions/noQuarter.ts.
+  getSkipAllPermissions: noQuarterActive,
   remoteAsk: bridge.remoteAsk,
 });
 
@@ -401,6 +472,13 @@ export default function privateerControl(pi: any): void {
     if (ctx?.modelRegistry) modelReg = ctx.modelRegistry;
     if (!currentSpec && ctx?.model) currentSpec = modelSpec(ctx.model);
     refreshRemoteStatus();
+    // shift+tab → no quarter, and the red footer indicator when it's already on (a
+    // `--no-quarter` launch, or a session replacement mid-run). Interactive TUI only:
+    // headless modes and subagent children have no terminal to listen to.
+    if (ctx?.mode === "tui" && ctx?.ui) {
+      bindNoQuarterKey(ctx.ui);
+      refreshNoQuarterStatus();
+    }
     if (ctx?.mode && HEADLESS.has(ctx.mode) && (process.env.PRIVATEER_MODE ?? "") === "") {
       mode = "bypass";
     }
@@ -443,6 +521,20 @@ export default function privateerControl(pi: any): void {
     },
   });
 
+  // The typed equivalent of shift+tab, for anyone who'd rather not trust a chord with
+  // the whole moat. Deliberately NOT reachable from the app — see runRemoteCommand.
+  pi.registerCommand?.("no-quarter", {
+    description: "Lower the moat for this session — run unattended with no approval prompts: /no-quarter [on|off]",
+    handler: (args: string, ctx: any) => {
+      if (ctx?.ui) uiRef = ctx.ui;
+      const arg = String(args ?? "").trim().toLowerCase();
+      if (arg && arg !== "on" && arg !== "off") {
+        return ctx.ui?.notify?.(`usage: /no-quarter [on|off] (currently ${noQuarterActive() ? "on" : "off"})`, "warning");
+      }
+      applyNoQuarter(arg ? arg === "on" : !noQuarterActive(), ctx.ui);
+    },
+  });
+
   // Local extension management. Mirrors what the app's extensions screen does over
   // the relay, but here we CAN hot-activate: ctx.reload() rebuilds the live runner,
   // so a just-added/removed extension takes effect without relaunching (a luxury the

package/extensions/privateer-privacy.ts

@@ -46,6 +46,27 @@ const privacy = makePiPrivacyExtension({
     if (provider !== "privateer") return undefined; // pi-privacy handles its own providers
     return (await accountPosture(modelId)).tier;
   },
+  // pi-privacy 0.8 added an INGEST gate: credentials arriving in a tool result are
+  // redacted before they enter context (they'd otherwise be re-sent every turn and
+  // written to the session file on disk). We already redact tool output in
+  // src/ext/permissionGate.ts, so its default "warn" would put an interactive prompt
+  // in front of something this app has always handled silently — "redact" keeps our
+  // UX and still takes the added coverage.
+  //
+  // The two redactors are COMPLEMENTARY, not duplicative, which is why we run both:
+  // ours masks the configured provider keys by exact value (from env/config) plus the
+  // provider-specific shapes (sk-/AIza/xai-/gsk_/csk-/vapi_/fw_/Z.ai, auth headers);
+  // pi-privacy's catches what shows up in USER code and shell output — AWS AKIA/ASIA,
+  // GitHub gh[pousr]_, JWTs, PEM private-key blocks, Slack, Stripe — none of which
+  // our patterns match.
+  //
+  // Order between the two is NOT guaranteed: pi discovers extensions with a bare
+  // readdirSync and never sorts, so it's filesystem-dependent (alphabetical on this
+  // box today, not by contract). "redact" makes that moot — both handlers run
+  // unconditionally and each masks its own patterns, so the surviving content is the
+  // same either way. Under "warn" the order WOULD matter, since it decides whether
+  // the prompt is raised on a raw key or one we already masked.
+  toolResultPolicy: "redact",
 });
 
 export default function privateerPrivacy(pi: any): void {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -70,7 +70,7 @@
     "@phala/dcap-qvl": "^0.5.2",
     "patch-package": "^8.0.1",
     "pi-mcp-adapter": "^2.11.0",
-    "pi-privacy": "^0.7.0",
+    "pi-privacy": "^0.9.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
     "privateer-workflow": "^0.1.0",

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -1,5 +1,5 @@
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-index e223ce1..3615d74 100644
+index e223ce1..cc853e7 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 @@ -163,6 +163,14 @@ export class AgentSession {
@@ -33,6 +33,25 @@ index e223ce1..3615d74 100644
          }
          if (await this._checkCompaction(msg)) {
              return true;
+@@ -1996,6 +2013,18 @@ export class AgentSession {
+         // Context overflow is handled by compaction, not retry.
+         if (isContextOverflow(message, this.model?.contextWindow ?? 0))
+             return false;
++        // Privateer patch: a Privateer ACCOUNT CAP is not a throttle. Daily/monthly
++        // message or token limits (and an exhausted balance) come back from the account
++        // channel as a 429 carrying the backend's machine `code` and a ready-to-show
++        // message. pi classifies anything containing "429" as transient, so the agent
++        // spent its whole retry budget — with exponential backoff — on a limit that
++        // cannot clear, and only then showed the user the one message that says what to
++        // do (upgrade, top up, or /login keys for a BYO key). Scoped to the `privateer`
++        // provider and to the backend's own cap wording so no other provider's transient
++        // rate limit is affected. Mirrors isAccountCapCode in src/engine/errors.ts.
++        if (this.model?.provider === "privateer" &&
++            /"code"\s*:\s*"[A-Z0-9_]*(?:CAP|QUOTA|LIMIT_REACHED|INSUFFICIENT|TOP_?UP)[A-Z0-9_]*"|limit of [^.]*reached|upgrade or top ?up|usage limit reached/i.test(message.errorMessage ?? ""))
++            return false;
+         return isRetryableAssistantError(message);
+     }
+     /**
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js
 index 197bccc..27f6429 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js