privateer-agent 0.8.2 → 0.9.0

package/extensions/privateer-brand.ts

@@ -28,7 +28,12 @@ import { readFileSync, appendFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import * as priv from "../src/auth/privateer.ts";
-import { armAccountCredential, makeAccountProvider } from "../src/providers/account.ts";
+import {
+  armAccountCredential,
+  dropPersistedAccountCredential,
+  makeAccountProvider,
+  verificationLink,
+} from "../src/providers/account.ts";
 import { resolveSignedInModel } from "../src/providers/defaultModel.ts";
 import { discoverContextFiles, onContextChanged } from "../src/context.ts";
 import { type Palette, paletteFor } from "../src/ui/palette.ts";
@@ -317,12 +322,15 @@ export default function privateerBrand(pi: any): void {
   // and dead-ends on the first inference. Removing it makes the next /signin spawn a
   // fresh session. Reached via the model registry (constructed with the auth
   // storage; see session.ts). Best-effort: nothing persisted → nothing to do.
-  const dropPersistedAccount = (ctx: any): void => {
-    try {
-      ctx?.modelRegistry?.authStorage?.remove?.("privateer");
-    } catch {
-      /* no persisted credential / older Pi without this shape — nothing to do */
-    }
+  //
+  // Two flavours, because auth.json is machine-global and shared by every Privateer
+  // terminal (see providers/account.ts dropPersistedAccountCredential):
+  //   - `force` for sign-out / expiry, where the whole token family is revoked and the
+  //     entry is dead for every terminal;
+  //   - the default ownership-checked drop for THIS process's exit, which must not
+  //     delete the credential another running terminal is using.
+  const dropPersistedAccount = (ctx: any, opts: { force?: boolean } = {}): void => {
+    dropPersistedAccountCredential(ctx, opts);
   };
 
   // /update — run the global npm install in a child process and report the outcome via
@@ -370,7 +378,9 @@ export default function privateerBrand(pi: any): void {
       const p = paletteFor(ctx?.ui?.theme);
       const user = await priv.runDeviceLogin({
         onCode: (code: any) => {
-          const uri = clean(code.verification_uri_complete ?? code.verification_uri ?? "");
+          // Absolute url: the server sends it scheme-less, and this line is what the
+          // user copies into a browser. See providers/account.ts verificationLink.
+          const uri = clean(verificationLink(code.verification_uri_complete ?? code.verification_uri));
           const userCode = clean(code.user_code);
           ctx?.ui?.setWidget?.(
             "privateer-signin",
@@ -412,7 +422,7 @@ export default function privateerBrand(pi: any): void {
     const u = priv.currentUser();
     ctx?.ui?.notify?.("Signing out of Privateer…", "info");
     await priv.logout(); // never throws: local state is wiped whatever the network did
-    dropPersistedAccount(ctx);
+    dropPersistedAccount(ctx, { force: true }); // the whole family is revoked, not just ours
     refresh(ctx);
     ctx?.ui?.notify?.(
       `Signed out${u?.email ? ` (${u.email})` : ""} — this machine and its terminals. Drop anchor for now.`,
@@ -594,6 +604,8 @@ export default function privateerBrand(pi: any): void {
     // server-side, so leaving the persisted copy behind would make the NEXT launch
     // reuse a token that's already dead and dead-end on its first prompt (Pi doesn't
     // refresh on a 401). Mirrors the harbor's shutdown (harbor/index.ts).
+    // Ownership-checked (no force): revokeLocalSessions killed OUR sessions only, so a
+    // persisted entry belonging to another running terminal must survive our exit.
     dropPersistedAccount(ctxRef);
   });
 
@@ -602,8 +614,9 @@ export default function privateerBrand(pi: any): void {
   priv.onSessionExpired(() => {
     // clearCredentials() has already wiped the local machine login; also drop Pi's
     // persisted account credential so the next prompt/launch doesn't reuse a token
-    // that's now dead server-side (see dropPersistedAccount).
-    dropPersistedAccount(ctxRef);
+    // that's now dead server-side (see dropPersistedAccount). Forced: the machine login
+    // is gone, so the entry can't be useful to any terminal on this machine.
+    dropPersistedAccount(ctxRef, { force: true });
     refresh(ctxRef);
     ctxRef?.ui?.notify?.("Your Privateer session expired. Run /login to sign back in.", "warning");
   });

package/extensions/privateer-connect.ts

@@ -37,9 +37,11 @@ import {
 import {
   MCP_CATALOG,
   draftFromCatalog,
+  hostedCapable,
   promptOrder,
   type CatalogEntry,
 } from "../src/mcp/catalog.ts";
+import { isHosted } from "../src/config/hosted.ts";
 
 // Minimal views of Pi's theme + TUI handle, mirroring privateer-models.ts — enough to
 // color text and request a redraw without coupling this file to Pi internals.
@@ -126,6 +128,15 @@ interface Step {
   // A step that may be submitted empty. For an edit, an empty secret means "keep
   // the value already on disk" — mcpControl's env merge rule makes that free.
   optional?: boolean;
+  // Ask this step only when the answers so far say it's relevant — the auth questions
+  // are meaningless for a local command, and three dead optional prompts in a row is
+  // how a wizard teaches people to hammer Enter without reading. Predicates may only
+  // read answers from EARLIER steps.
+  when?: (answers: Record<string, string>) => boolean;
+  // Reject an answer before it becomes an answer, returning the reason to show. For
+  // rules mcpControl can't check because it never sees the raw form input, or that it
+  // would only catch after the user has typed three more fields for nothing.
+  validate?: (value: string) => string | undefined;
 }
 
 type View = "list" | "catalog" | "form";
@@ -147,7 +158,15 @@ interface Pending {
 // from the answer rather than asked as a separate question: an https:// answer is an
 // http server, anything else is a stdio command line. That matches mcpControl's own
 // inference (`draft.url || prev.url ? "http" : "stdio"`), so there's one rule, not two.
+const isHttpTarget = (answers: Record<string, string>) => /^https?:\/\//i.test((answers.target ?? "").trim());
+
 function customSteps(existing?: RemoteMcpServer): Step[] {
+  // A hosted agent takes remote OAuth connectors and nothing else (Option B —
+  // treeview/docs/HARBOR_CONNECTORS_PLAN.md §2), so the custom form drops to that
+  // shape: no local command, and no stored token. Both are refused at the question
+  // rather than at first call, because a connector that saves cleanly and then never
+  // works is the worse of the two failures.
+  const hosted = isHosted();
   const target = existing
     ? existing.transport === "http"
       ? existing.url
@@ -162,15 +181,48 @@ function customSteps(existing?: RemoteMcpServer): Step[] {
     },
     {
       key: "target",
-      prompt: "Launch command, or an https:// URL",
-      hint: "e.g. npx -y @modelcontextprotocol/server-memory  ·  or  https://mcp.example.com/sse",
+      prompt: hosted ? "Server URL" : "Launch command, or an https:// URL",
+      hint: hosted
+        ? "e.g. https://mcp.example.com/sse — a hosted agent can't run a local command."
+        : "e.g. npx -y @modelcontextprotocol/server-memory  ·  or  https://mcp.example.com/sse",
       initial: target,
+      validate: hosted
+        ? (v) =>
+            /^https?:\/\//i.test(v.trim())
+              ? undefined
+              : "A hosted agent can only reach remote connectors — this needs an https:// URL."
+        : undefined,
     },
     {
       key: "env",
       prompt: "Environment variables (optional)",
       hint: "KEY=value, comma-separated. Leave blank for none.",
       optional: true,
+      // Nothing to set them ON when there is no local process to spawn, and their
+      // values are credentials at rest — both reasons a hosted agent skips this.
+      when: () => !hosted,
+    },
+    {
+      key: "bearerToken",
+      prompt: "Bearer token (optional)",
+      hint: existing?.bearerTokenSet
+        ? "Leave blank to keep the token already saved."
+        : "Leave blank to sign in through the browser instead (OAuth).",
+      secret: true,
+      optional: true,
+      // Never asked on a hosted agent: the home is tmpfs and a stored token would have
+      // to rest somewhere we can read. OAuth is the only credential it may hold.
+      when: (a) => !hosted && isHttpTarget(a),
+    },
+    {
+      key: "headers",
+      prompt: "Extra HTTP headers (optional)",
+      hint: "KEY=value, comma-separated — e.g. X-Api-Version=2. Leave blank for none.",
+      // Header values are credentials as often as not, so this is masked like a token
+      // — and for the same reason a hosted agent is never offered it.
+      secret: true,
+      optional: true,
+      when: (a) => !hosted && isHttpTarget(a),
     },
   ];
 }
@@ -196,7 +248,22 @@ function buildCustomDraft(answers: Record<string, string>): McpDraft {
   if (/^https?:\/\//i.test(target)) {
     draft.transport = "http";
     draft.url = target;
-    draft.oauth = true;
+    const token = (answers.bearerToken ?? "").trim();
+    const headers = parseEnv(answers.headers ?? "");
+    const hasHeaders = Object.keys(headers).length > 0;
+    if (hasHeaders) draft.headers = headers;
+    if (token) {
+      // A static token: the adapter only sends the Authorization header when auth is
+      // explicitly "bearer", so this pairing is not optional.
+      draft.auth = "bearer";
+      draft.bearerToken = token;
+    } else if (hasHeaders) {
+      // Custom headers ARE the credential here — the adapter's supportsOAuth() refuses
+      // OAuth once headers are configured, so claiming "oauth" would be a lie.
+      draft.auth = "none";
+    } else {
+      draft.auth = "oauth";
+    }
   } else {
     draft.transport = "stdio";
     const parts = target.split(/\s+/).filter(Boolean);
@@ -265,8 +332,16 @@ const NEEDS_LABEL: Record<string, string> = {
   none: "no setup",
 };
 
+// On a hosted (Harbor) agent the picker offers only what the runtime can actually
+// hold — see hostedCapable(). Offering the other 16 would be offering a connector that
+// installs nothing, keeps nothing, and fails at first call: the tenant is `--read-only`
+// with no uv/uvx/Python and a tmpfs home wiped on every suspend. Filtering here rather
+// than letting them fail later is the difference between "not available on a hosted
+// agent" and "I set it up and it just doesn't work."
 function catalogRows(): CatalogRow[] {
-  const rows: CatalogRow[] = MCP_CATALOG.map((e) => ({
+  const hosted = isHosted();
+  const entries = hosted ? MCP_CATALOG.filter(hostedCapable) : MCP_CATALOG;
+  const rows: CatalogRow[] = entries.map((e) => ({
     entry: e,
     label: e.label,
     blurb: e.blurb,
@@ -274,7 +349,9 @@ function catalogRows(): CatalogRow[] {
   }));
   rows.push({
     label: "Custom…",
-    blurb: "Any stdio command or http URL.",
+    // Custom survives the filter because a custom REMOTE OAuth connector is fine here;
+    // it's stdio and stored tokens that aren't. customSteps enforces that.
+    blurb: hosted ? "Any https:// URL with browser sign-in." : "Any stdio command or http URL.",
     needsLabel: "",
   });
   return rows;
@@ -359,6 +436,36 @@ class ConnectPanel extends Container {
     return this.pending?.steps[this.stepIndex];
   }
 
+  // A step is asked only when its `when` predicate (if any) passes against the answers
+  // collected so far. Navigation walks over the hidden ones in both directions, and
+  // the position counter reports the VISIBLE steps so "2/3" doesn't count a question
+  // the user will never see.
+  private stepVisible(i: number): boolean {
+    const step = this.pending?.steps[i];
+    if (!step) return false;
+    return step.when ? step.when(this.answers) : true;
+  }
+
+  private seekStep(from: number, dir: 1 | -1): number | undefined {
+    const total = this.pending?.steps.length ?? 0;
+    for (let i = from; i >= 0 && i < total; i += dir) {
+      if (this.stepVisible(i)) return i;
+    }
+    return undefined;
+  }
+
+  private visiblePosition(): { at: number; of: number } {
+    const total = this.pending?.steps.length ?? 0;
+    let at = 0;
+    let of = 0;
+    for (let i = 0; i < total; i++) {
+      if (!this.stepVisible(i)) continue;
+      of++;
+      if (i <= this.stepIndex) at = of;
+    }
+    return { at, of };
+  }
+
   // -- rendering ------------------------------------------------------------
 
   private refresh(): void {
@@ -429,6 +536,13 @@ class ConnectPanel extends Container {
   private renderCatalog(): void {
     const t = this.theme;
     this.body.addChild(new Text(t.fg("accent", t.bold("Add a connector")), 1, 0));
+    // Say why the list is short before the user goes looking for GitHub. A filter with
+    // no explanation reads as a missing connector, which is a support question.
+    if (isHosted()) {
+      this.body.addChild(
+        new Text(t.fg("muted", "  Hosted agent — remote connectors with browser sign-in only."), 1, 0),
+      );
+    }
     this.body.addChild(new Spacer(1));
     this.body.addChild(this.search);
     this.body.addChild(new Spacer(1));
@@ -458,7 +572,8 @@ class ConnectPanel extends Container {
     const t = this.theme;
     const p = this.pending!;
     const step = this.currentStep()!;
-    const counter = p.steps.length > 1 ? `  ${this.stepIndex + 1}/${p.steps.length}` : "";
+    const pos = this.visiblePosition();
+    const counter = pos.of > 1 ? `  ${pos.at}/${pos.of}` : "";
     this.body.addChild(new Text(t.fg("accent", t.bold(p.title)) + t.fg("muted", counter), 1, 0));
     this.body.addChild(new Spacer(1));
     this.body.addChild(new Text(`  ${t.fg("text", step.prompt)}`, 1, 0));
@@ -555,10 +670,19 @@ class ConnectPanel extends Container {
       this.refresh();
       return;
     }
+    // Validate only what was actually typed: a blank optional answer means "skip", and
+    // a rule about the shape of a value has nothing to say about its absence.
+    const bad = value && step.validate ? step.validate(value) : undefined;
+    if (bad) {
+      this.status = bad;
+      this.refresh();
+      return;
+    }
     this.answers[step.key] = value;
     this.status = "";
-    if (this.stepIndex < this.pending!.steps.length - 1) {
-      this.stepIndex++;
+    const next = this.seekStep(this.stepIndex + 1, 1);
+    if (next !== undefined) {
+      this.stepIndex = next;
       this.loadStep();
       return;
     }
@@ -701,8 +825,9 @@ class ConnectPanel extends Container {
     const step = this.currentStep()!;
     if (kb.matches(data, "tui.select.cancel")) {
       // Back a step, or out of the form entirely from the first one.
-      if (this.stepIndex > 0) {
-        this.stepIndex--;
+      const prev = this.stepIndex > 0 ? this.seekStep(this.stepIndex - 1, -1) : undefined;
+      if (prev !== undefined) {
+        this.stepIndex = prev;
         this.loadStep();
       } else {
         this.view = this.pending?.origin ?? "list";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -70,7 +70,7 @@
     "@phala/dcap-qvl": "^0.5.2",
     "patch-package": "^8.0.1",
     "pi-mcp-adapter": "^2.11.0",
-    "pi-privacy": "^0.8.0",
+    "pi-privacy": "^0.9.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
     "privateer-workflow": "^0.1.0",

package/patches/@earendil-works+pi-coding-agent+0.80.3.patch

@@ -1,5 +1,5 @@
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
-index e223ce1..3615d74 100644
+index e223ce1..cc853e7 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 +++ b/node_modules/@earendil-works/pi-coding-agent/dist/core/agent-session.js
 @@ -163,6 +163,14 @@ export class AgentSession {
@@ -33,6 +33,25 @@ index e223ce1..3615d74 100644
          }
          if (await this._checkCompaction(msg)) {
              return true;
+@@ -1996,6 +2013,18 @@ export class AgentSession {
+         // Context overflow is handled by compaction, not retry.
+         if (isContextOverflow(message, this.model?.contextWindow ?? 0))
+             return false;
++        // Privateer patch: a Privateer ACCOUNT CAP is not a throttle. Daily/monthly
++        // message or token limits (and an exhausted balance) come back from the account
++        // channel as a 429 carrying the backend's machine `code` and a ready-to-show
++        // message. pi classifies anything containing "429" as transient, so the agent
++        // spent its whole retry budget — with exponential backoff — on a limit that
++        // cannot clear, and only then showed the user the one message that says what to
++        // do (upgrade, top up, or /login keys for a BYO key). Scoped to the `privateer`
++        // provider and to the backend's own cap wording so no other provider's transient
++        // rate limit is affected. Mirrors isAccountCapCode in src/engine/errors.ts.
++        if (this.model?.provider === "privateer" &&
++            /"code"\s*:\s*"[A-Z0-9_]*(?:CAP|QUOTA|LIMIT_REACHED|INSUFFICIENT|TOP_?UP)[A-Z0-9_]*"|limit of [^.]*reached|upgrade or top ?up|usage limit reached/i.test(message.errorMessage ?? ""))
++            return false;
+         return isRetryableAssistantError(message);
+     }
+     /**
 diff --git a/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js b/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js
 index 197bccc..27f6429 100644
 --- a/node_modules/@earendil-works/pi-coding-agent/dist/core/auth-guidance.js

package/src/auth/privateer.ts

@@ -149,10 +149,12 @@ let _refreshInFlight: Promise<ChildSession> | null = null;
 // copy in place would let the next run send a token that still looks valid but is dead
 // server-side → inference fails with a dead-end `401 {code: SESSION_REVOKED}`.
 // The fix is to revoke it AND drop the persisted credential together: the caller must
-// remove the "privateer" entry from Pi's authStorage (authStorage.remove("privateer"))
-// right after revokeLocalSessions() so the next launch spawns a fresh session instead
-// of reusing the revoked one. Doing both is safe; doing only one is not. See
-// revokeLocalSessions and its callers (cli/chat.ts, harbor/index.ts).
+// drop the "privateer" entry from Pi's authStorage — via
+// providers/account.ts dropPersistedAccountCredential(), NOT a bare
+// authStorage.remove(), because auth.json is machine-global and the entry may belong to
+// another running terminal — right after revokeLocalSessions(), so the next launch
+// spawns a fresh session instead of reusing the revoked one. Doing both is safe; doing
+// only one is not. See revokeLocalSessions and its callers (cli/chat.ts, harbor/index.ts).
 //
 // That pairing only covers a CLEAN exit, though. A terminal killed without running its
 // shutdown hook leaves its row alive server-side for the full TTL, and the next launch
@@ -195,6 +197,21 @@ export function saveCredentials(creds: Credentials): void {
   shared().cache = creds;
 }
 
+// The account-provider credential this process armed is memoized on a registered
+// symbol by providers/account.ts (one slot across jiti's per-extension module copies).
+// Clearing it from here — rather than importing account.ts, which would make a cycle —
+// keeps a single rule: local credentials gone ⇒ armed credential gone.
+//
+// Without this, /logout followed by signing in as a DIFFERENT account reused the old
+// account's memoized session: logout() revokes that whole token family, so the new
+// sign-in armed Pi with a token already dead server-side and the first prompt 401'd.
+const ARMED_SLOT = Symbol.for("privateer.accountCredential");
+
+function forgetArmedAccountCredential(): void {
+  const slot = (globalThis as { [ARMED_SLOT]?: { cred?: unknown } })[ARMED_SLOT];
+  if (slot) slot.cred = undefined;
+}
+
 export function clearCredentials(): void {
   try {
     rmSync(credentialsPath(), { force: true });
@@ -207,6 +224,7 @@ export function clearCredentials(): void {
   shared().cache = null;
   _child = null;
   _account = null;
+  forgetArmedAccountCredential();
 }
 
 export function hasCredentials(): boolean {
@@ -623,7 +641,8 @@ export async function revokeAccountSession(timeoutMs = 1500): Promise<void> {
  *
  * IMPORTANT: the account session is persisted by Pi (auth.json) and reused on the next
  * launch without a reactive-on-401 refresh, so the caller MUST also drop the persisted
- * copy right after this resolves — `authStorage.remove("privateer")` — or the next run
+ * copy right after this resolves — `dropPersistedAccountCredential(ctx)` from
+ * providers/account.ts, which drops it only if THIS process minted it — or the next run
  * will reuse the token we just revoked and dead-end on a 401 (see the _account note).
  * Callers: cli/chat.ts cleanup() and harbor/index.ts shutdown().
  */

package/src/channels/run.ts

@@ -46,6 +46,9 @@
 
 import "../boot.ts"; // env + attestation dispatcher, before any Pi import
 import { AsyncLocalStorage } from "node:async_hooks";
+// Names only — the factory itself is imported lazily in main() like every other
+// module here. Safe statically: this evaluates after boot.ts and pulls in no Pi.
+import { WEB_TOOL_NAMES } from "../tools/web.ts";
 
 // Read-only default toolset — same rationale as the routines harbor's SAFE_TOOLS:
 // a turn nobody is watching can't mutate the filesystem or shell out. Now that the
@@ -54,6 +57,11 @@ import { AsyncLocalStorage } from "node:async_hooks";
 // prompts in-chat for a yes/no.
 const SAFE_TOOLS = ["read", "grep", "find", "ls"];
 
+// Web tools join the default set when the agent has web access — see
+// config/hosted.ts. Kept out of SAFE_TOOLS proper because they're the one "read-only"
+// capability that still sends a query off the machine.
+const WEB_TOOLS: string[] = [...WEB_TOOL_NAMES];
+
 // A channel's posture governs how an ADMIN's risky actions are handled (members are
 // always capped to read-only — see effectivePosture). Config + restart only; there
 // is deliberately no in-chat toggle.
@@ -111,6 +119,8 @@ async function main() {
   const { makePiPrivacyExtension } = await import("pi-privacy");
   const { makeAccountProvider, privateerChannel } = await import("../providers/account.ts");
   const { hasCredentials } = await import("../auth/privateer.ts");
+  const { makeWebTools } = await import("../tools/web.ts");
+  const { webEnabled } = await import("../config/hosted.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
@@ -133,7 +143,10 @@ async function main() {
   }
   const ch = cfg.channels ?? {};
   const defaultModel: string = resolveDefaultModel({ explicit: ch.model ?? cfg.defaultModel });
-  const defaultTools: string[] = Array.isArray(ch.tools) && ch.tools.length ? ch.tools : SAFE_TOOLS;
+  const web = webEnabled();
+  const defaultTools: string[] = Array.isArray(ch.tools) && ch.tools.length
+    ? (web ? ch.tools : ch.tools.filter((t: string) => !WEB_TOOLS.includes(t)))
+    : (web ? [...SAFE_TOOLS, ...WEB_TOOLS] : [...SAFE_TOOLS]);
   const defaultPosture: Posture = normalizePosture(ch.posture) ?? "approve";
   const cwd: string = ch.cwd ?? process.cwd();
   const secrets = collectSecrets(cfg.providers);
@@ -190,6 +203,10 @@ async function main() {
           privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
         }),
         makeAccountProvider(),
+        // Web access (src/tools/web.ts) — same wiring as the harbor: registered here
+        // because this path builds its session explicitly, and omitted entirely when
+        // the agent isn't allowed the web.
+        ...(webEnabled() ? [makeWebTools()] : []),
       ] as any,
     },
   });

package/src/cli/chat.ts

@@ -39,7 +39,13 @@ async function main() {
   const { authorizeControl } = await import("../remote/controlAuth.ts");
   const { resolveMentions, completeMention, searchFiles } = await import("../util/fileMentions.ts");
   const priv = await import("../auth/privateer.ts");
-  const { makeAccountProvider, accountPosture, privateerChannel } = await import("../providers/account.ts");
+  const {
+    makeAccountProvider,
+    accountPosture,
+    privateerChannel,
+    rememberAccountCredential,
+    dropPersistedAccountCredential,
+  } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
   const { resolveDefaultModel, resolveSignedInModel } = await import("../providers/defaultModel.ts");
 
@@ -397,7 +403,9 @@ async function main() {
     cleanedUp = true;
     try { relay?.stop(); } catch { /* already stopped */ }
     try { await priv.revokeLocalSessions(); } catch { /* best effort — server TTL is the fallback */ }
-    try { (services.authStorage as any).remove?.("privateer"); } catch { /* nothing persisted */ }
+    // Ownership-checked: auth.json is machine-global, so removing an entry another
+    // running terminal minted would strand it (see providers/account.ts).
+    try { dropPersistedAccountCredential({ modelRegistry: { authStorage: services.authStorage } }); } catch { /* nothing persisted */ }
   }
   const onSignal = (): void => { void cleanup().finally(() => process.exit(0)); };
   process.once("SIGINT", onSignal);
@@ -409,6 +417,7 @@ async function main() {
     try {
       const creds = await priv.acquireAccountCredential();
       (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
+      rememberAccountCredential(creds); // claim it, so cleanup drops OUR entry and only ours
     } catch (e) {
       console.log(`${RED}Account channel unavailable: ${(e as Error).message}${RESET}`);
     }

package/src/config/hosted.ts

@@ -2,6 +2,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { globalDir } from "./paths.ts";
 import { terminalPublicKeyBase64 } from "../crypto/terminalKey.ts";
+import { hasCredentials } from "../auth/privateer.ts";
 
 // Harbor hosted mode.
 //
@@ -17,6 +18,26 @@ export function isHosted(): boolean {
   return process.env.HARBOR_HOSTED === "1";
 }
 
+/**
+ * Is this agent allowed to reach the live web (web_search / web_fetch)?
+ *
+ * Both tools are served by the account API, so credentials are a hard prerequisite —
+ * without them there is nothing to authenticate with and every call would 401.
+ *
+ * `HARBOR_WEB` is authoritative when set. Hosted agents always set it explicitly, from
+ * the per-agent switch in the app (harborOrchestrator/tenants.js → tenantEnv), because
+ * a search sends the derived query out of the enclave to our servers and that has to be
+ * the user's call. Unset — a daemon on someone's own laptop — defaults to on once
+ * signed in: the same account, the same billing, and nothing to disclose beyond what
+ * the tool description already says.
+ */
+export function webEnabled(): boolean {
+  const flag = process.env.HARBOR_WEB;
+  if (flag === "1") return hasCredentials();
+  if (flag === "0") return false;
+  return hasCredentials();
+}
+
 /**
  * Publish this harbor's relay identity key so the Harbor host can attest it.
  *