privateer-agent 0.8.0 → 0.9.0

package/src/auth/privateer.ts

@@ -149,10 +149,12 @@ let _refreshInFlight: Promise<ChildSession> | null = null;
 // copy in place would let the next run send a token that still looks valid but is dead
 // server-side → inference fails with a dead-end `401 {code: SESSION_REVOKED}`.
 // The fix is to revoke it AND drop the persisted credential together: the caller must
-// remove the "privateer" entry from Pi's authStorage (authStorage.remove("privateer"))
-// right after revokeLocalSessions() so the next launch spawns a fresh session instead
-// of reusing the revoked one. Doing both is safe; doing only one is not. See
-// revokeLocalSessions and its callers (cli/chat.ts, harbor/index.ts).
+// drop the "privateer" entry from Pi's authStorage — via
+// providers/account.ts dropPersistedAccountCredential(), NOT a bare
+// authStorage.remove(), because auth.json is machine-global and the entry may belong to
+// another running terminal — right after revokeLocalSessions(), so the next launch
+// spawns a fresh session instead of reusing the revoked one. Doing both is safe; doing
+// only one is not. See revokeLocalSessions and its callers (cli/chat.ts, harbor/index.ts).
 //
 // That pairing only covers a CLEAN exit, though. A terminal killed without running its
 // shutdown hook leaves its row alive server-side for the full TTL, and the next launch
@@ -195,6 +197,21 @@ export function saveCredentials(creds: Credentials): void {
   shared().cache = creds;
 }
 
+// The account-provider credential this process armed is memoized on a registered
+// symbol by providers/account.ts (one slot across jiti's per-extension module copies).
+// Clearing it from here — rather than importing account.ts, which would make a cycle —
+// keeps a single rule: local credentials gone ⇒ armed credential gone.
+//
+// Without this, /logout followed by signing in as a DIFFERENT account reused the old
+// account's memoized session: logout() revokes that whole token family, so the new
+// sign-in armed Pi with a token already dead server-side and the first prompt 401'd.
+const ARMED_SLOT = Symbol.for("privateer.accountCredential");
+
+function forgetArmedAccountCredential(): void {
+  const slot = (globalThis as { [ARMED_SLOT]?: { cred?: unknown } })[ARMED_SLOT];
+  if (slot) slot.cred = undefined;
+}
+
 export function clearCredentials(): void {
   try {
     rmSync(credentialsPath(), { force: true });
@@ -207,6 +224,7 @@ export function clearCredentials(): void {
   shared().cache = null;
   _child = null;
   _account = null;
+  forgetArmedAccountCredential();
 }
 
 export function hasCredentials(): boolean {
@@ -623,7 +641,8 @@ export async function revokeAccountSession(timeoutMs = 1500): Promise<void> {
  *
  * IMPORTANT: the account session is persisted by Pi (auth.json) and reused on the next
  * launch without a reactive-on-401 refresh, so the caller MUST also drop the persisted
- * copy right after this resolves — `authStorage.remove("privateer")` — or the next run
+ * copy right after this resolves — `dropPersistedAccountCredential(ctx)` from
+ * providers/account.ts, which drops it only if THIS process minted it — or the next run
  * will reuse the token we just revoked and dead-end on a 401 (see the _account note).
  * Callers: cli/chat.ts cleanup() and harbor/index.ts shutdown().
  */

package/src/channels/run.ts

@@ -46,6 +46,9 @@
 
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { AsyncLocalStorage } from "node:async_hooks";
+// Names only — the factory itself is imported lazily in main() like every other
+// module here. Safe statically: this evaluates after boot.ts and pulls in no Pi.
+import { WEB_TOOL_NAMES } from "../tools/web.ts";
 
 // Read-only default toolset — same rationale as the routines harbor's SAFE_TOOLS:
 // a turn nobody is watching can't mutate the filesystem or shell out. Now that the
@@ -54,6 +57,11 @@ import { AsyncLocalStorage } from "node:async_hooks";
 // prompts in-chat for a yes/no.
 const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 
+// Web tools join the default set when the agent has web access — see
+// config/hosted.ts. Kept out of SAFE_TOOLS proper because they're the one "read-only"
+// capability that still sends a query off the machine.
+const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
+
 // A channel's posture governs how an ADMIN's risky actions are handled (members are
 // always capped to read-only — see effectivePosture). Config + restart only; there
 // is deliberately no in-chat toggle.
@@ -111,6 +119,8 @@ async function main() {
   const { makePiPrivacyExtension } = await import("pi-privacy");
   const { makeAccountProvider, privateerChannel } = await import("../providers/account.ts");
   const { hasCredentials } = await import("../auth/privateer.ts");
+  const { makeWebTools } = await import("../tools/web.ts");
+  const { webEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
@@ -133,7 +143,10 @@ async function main() {
   }
   const ch = cfg.channels ?? {};
   const defaultModel: string = resolveDefaultModel({ explicit: ch.model ?? cfg.defaultModel });
-  const defaultTools: string[] = Array.isArray(ch.tools) && ch.tools.length ? ch.tools : SAFE_TOOLS;
+  const web = webEnabled();
+  const defaultTools: string[] = Array.isArray(ch.tools) && ch.tools.length
+    ? (web ? ch.tools : ch.tools.filter((t: string) => !WEB_TOOLS.includes(t)))
+    : (web ? [...SAFE_TOOLS, ...WEB_TOOLS] : [...SAFE_TOOLS]);
   const defaultPosture: Posture = normalizePosture(ch.posture) ?? "approve";
   const cwd: string = ch.cwd ?? process.cwd();
   const secrets = collectSecrets(cfg.providers);
@@ -190,6 +203,10 @@ async function main() {
           privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
         }),
         makeAccountProvider(),
+        // Web access (src/tools/web.ts) — same wiring as the harbor: registered here
+        // because this path builds its session explicitly, and omitted entirely when
+        // the agent isn't allowed the web.
+        ...(webEnabled() ? [makeWebTools()] : []),
       ] as any,
     },
   });

package/src/cli/chat.ts

@@ -11,6 +11,7 @@
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { fileURLToPath } from "node:url"; // builtin, safe pre-boot
 import { cliPalette } from "../ui/palette.ts"; // no Pi deps → safe pre-boot
+import { noQuarterActive, setNoQuarter } from "../permissions/noQuarter.ts"; // no Pi deps → safe pre-boot
 import type { GateController } from "../ext/permissionGate.ts"; // type-only → erased, safe pre-boot
 
 // This lean REPL has no Pi TUI (and so no Theme), so it detects the terminal background
@@ -38,7 +39,13 @@ async function main() {
   const { authorizeControl } = await import("../remote/controlAuth.ts");
   const { resolveMentions, completeMention, searchFiles } = await import("../util/fileMentions.ts");
   const priv = await import("../auth/privateer.ts");
-  const { makeAccountProvider, accountPosture, privateerChannel } = await import("../providers/account.ts");
+  const {
+    makeAccountProvider,
+    accountPosture,
+    privateerChannel,
+    rememberAccountCredential,
+    dropPersistedAccountCredential,
+  } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
   const { resolveDefaultModel, resolveSignedInModel } = await import("../providers/defaultModel.ts");
 
@@ -307,8 +314,9 @@ async function main() {
     },
     getRemote: bridge.getRemote,
     getNoQuarter: bridge.getNoQuarter,
-    // `--no-quarter` at launch (env PRIVATEER_NO_QUARTER) → total gate bypass, no prompts.
-    getSkipAllPermissions: () => process.env.PRIVATEER_NO_QUARTER === "1",
+    // Total gate bypass, no prompts — from `--no-quarter` at launch or shift+tab /
+    // `/no-quarter` mid-session. One shared state (../permissions/noQuarter.ts).
+    getSkipAllPermissions: noQuarterActive,
     remoteAsk: bridge.remoteAsk,
     // Subagents (and their child-only intercom tools) can't be driven from the app
     // yet — pi-subagents runs each in a child session whose gate/UI bypass the relay,
@@ -322,7 +330,37 @@ async function main() {
     },
   };
 
+  // ── no quarter (shift+tab) ──────────────────────────────────────────────────
+  // The "step away from the keyboard" switch: lower the moat for the rest of the
+  // session so a long task runs to completion instead of stalling on the next
+  // approval prompt. Same state the `--no-quarter` launch flag sets, and the same
+  // chord the full TUI uses (extensions/privateer-gate.ts). Reversible with the
+  // same key; takes effect from the next gated action, so an approval already on
+  // screen still needs an answer.
+  function applyNoQuarter(on: boolean): void {
+    setNoQuarter(on);
+    flushOut(); // land streamed output above the notice
+    console.log(
+      on
+        ? `\n${RED}⚑ No quarter — the permission gate is OFF for this session.${RESET}\n` +
+          `${DIM}  Every action (shell, edits, destructive tools, out-of-cwd, protected files) runs without asking.\n` +
+          `  shift+tab (or /no-quarter off) raises the moat again.${RESET}`
+        : `\n${GREEN}⚓ Moat raised — the permission gate is back on.${RESET}`,
+    );
+  }
+
+  // readline already emits keypress events for a TTY input, so we just listen. Node
+  // decodes shift+tab (CSI Z) as {name: "tab", shift: true}. We don't swallow it —
+  // readline still runs its own tab handler, which for a non-`@mention` line
+  // completes to nothing.
+  if (process.stdin.isTTY) {
+    process.stdin.on("keypress", (_s: string, key: any) => {
+      if (key?.name === "tab" && key.shift && !key.ctrl && !key.meta) applyNoQuarter(!noQuarterActive());
+    });
+  }
+
   console.log(`${DIM}privateer-agent — lean REPL. Loading ${provider}/${modelId}…${RESET}`);
+  if (noQuarterActive()) applyNoQuarter(true); // launched with --no-quarter: say so up front
 
   const services = await createAgentSessionServices({
     cwd,
@@ -365,7 +403,9 @@ async function main() {
     cleanedUp = true;
     try { relay?.stop(); } catch { /* already stopped */ }
     try { await priv.revokeLocalSessions(); } catch { /* best effort — server TTL is the fallback */ }
-    try { (services.authStorage as any).remove?.("privateer"); } catch { /* nothing persisted */ }
+    // Ownership-checked: auth.json is machine-global, so removing an entry another
+    // running terminal minted would strand it (see providers/account.ts).
+    try { dropPersistedAccountCredential({ modelRegistry: { authStorage: services.authStorage } }); } catch { /* nothing persisted */ }
   }
   const onSignal = (): void => { void cleanup().finally(() => process.exit(0)); };
   process.once("SIGINT", onSignal);
@@ -377,6 +417,7 @@ async function main() {
     try {
       const creds = await priv.acquireAccountCredential();
       (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
+      rememberAccountCredential(creds); // claim it, so cleanup drops OUR entry and only ours
     } catch (e) {
       console.log(`${RED}Account channel unavailable: ${(e as Error).message}${RESET}`);
     }
@@ -533,8 +574,9 @@ async function main() {
       : `${DIM}Not signed in. /login to enable remote access & the account provider.${RESET}`,
   );
 
-  const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /quit";
+  const HELP = "Commands: /remote-access <on|off>  /login  /model <provider/id>  /models [filter]  /verify  /mode <…>  /no-quarter [on|off]  /quit";
   console.log(`${DIM}Ready. Type a prompt — reference a file with @path (Tab completes). ${HELP}${RESET}`);
+  console.log(`${DIM}shift+tab toggles no quarter — unattended mode, no approval prompts.${RESET}`);
   await showPosture();
 
   // The available model catalog as sorted "provider/id" specs. Same source the
@@ -620,6 +662,24 @@ async function main() {
       console.log(items.length ? items.map((s) => `  ${s.name}${s.disabled ? ` ${DIM}(disabled)${RESET}` : ""}${s.editable ? "" : ` ${DIM}(read-only)${RESET}`} — ${s.description}`).join("\n") : `${DIM}No skills yet. Create them from the Privateer app.${RESET}`);
       return true;
     }
+    // The typed equivalent of shift+tab. A PHYSICAL-terminal action, like
+    // /remote-access: it's stronger than any mode (it also switches off the
+    // dangerous-command denylist and the protected-file guard), so a remote
+    // controller must not be able to reach it. The app's own no-quarter toggle
+    // covers driven turns and is `bypass` exactly — never weaker than /mode bypass.
+    if (line === "/no-quarter" || line.startsWith("/no-quarter ")) {
+      if (remote) {
+        relay?.sendNotice("/no-quarter is terminal-only — run it at the machine, or use the app's own no-quarter toggle.");
+        return true;
+      }
+      const arg = line.slice(11).trim().toLowerCase();
+      if (arg && arg !== "on" && arg !== "off") {
+        console.log(`${YELLOW}usage: /no-quarter [on|off] (currently ${noQuarterActive() ? "on" : "off"})${RESET}`);
+        return true;
+      }
+      applyNoQuarter(arg ? arg === "on" : !noQuarterActive());
+      return true;
+    }
     if (line.startsWith("/mode ")) { mode = line.slice(6).trim() as typeof mode; const m = `mode → ${mode}`; console.log(`${DIM}${m}${RESET}`); if (remote) relay?.sendNotice(m); return true; }
     // Bare /mode → the picker (remote) or a hint (local).
     if (line === "/mode") {
@@ -648,6 +708,7 @@ async function main() {
     const builtins = [
       { name: "/model", description: "Switch the model" },
       { name: "/mode", description: "Change the approval mode (default/acceptEdits/plan/bypass)" },
+      // /no-quarter is deliberately absent — terminal-only, see runCommand.
       { name: "/models", description: "List available models" },
       { name: "/extensions", description: "Manage installed Pi extensions" },
       { name: "/skills", description: "Manage the terminal's skills" },

package/src/config/hosted.ts

@@ -2,6 +2,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { globalDir } from "./paths.ts";
 import { terminalPublicKeyBase64 } from "../crypto/terminalKey.ts";
+import { hasCredentials } from "../auth/privateer.ts";
 
 // Harbor hosted mode.
 //
@@ -17,6 +18,26 @@ export function isHosted(): boolean {
   return process.env.HARBOR_HOSTED === "1";
 }
 
+/**
+ * Is this agent allowed to reach the live web (web_search / web_fetch)?
+ *
+ * Both tools are served by the account API, so credentials are a hard prerequisite —
+ * without them there is nothing to authenticate with and every call would 401.
+ *
+ * `HARBOR_WEB` is authoritative when set. Hosted agents always set it explicitly, from
+ * the per-agent switch in the app (harborOrchestrator/tenants.js → tenantEnv), because
+ * a search sends the derived query out of the enclave to our servers and that has to be
+ * the user's call. Unset — a daemon on someone's own laptop — defaults to on once
+ * signed in: the same account, the same billing, and nothing to disclose beyond what
+ * the tool description already says.
+ */
+export function webEnabled(): boolean {
+  const flag = process.env.HARBOR_WEB;
+  if (flag === "1") return hasCredentials();
+  if (flag === "0") return false;
+  return hasCredentials();
+}
+
 /**
  * Publish this harbor's relay identity key so the Harbor host can attest it.
  *