privateer-agent 0.9.1 → 0.9.2

package/extensions/privateer-gate.ts

@@ -26,6 +26,7 @@ import { AttachmentStore, type StoredAttachment } from "../src/util/attachmentSt
 import { makeExtensionsControl } from "../src/remote/extensionsControl.ts";
 import { makeSkillsControl } from "../src/remote/skillsControl.ts";
 import { agentDir } from "../src/config/paths.ts";
+import { inHarborDaemon } from "../src/config/harborDaemon.ts";
 import { agentVersion } from "../src/config/version.ts";
 import { SettingsManager } from "@earendil-works/pi-coding-agent";
 import { matchesKey } from "@earendil-works/pi-tui";
@@ -446,8 +447,18 @@ export default function privateerControl(pi: any): void {
   // File transfer both ways: send_file_to_client (CLI→app, via the bridge's relay) and
   // save_attachment (app→CLI, from the AttachmentStore inbound files land in). Both
   // live here because they share the RemoteBridge / its attachment stream.
-  pi.registerTool?.(makeSendFileTool(bridge));
-  pi.registerTool?.(makeSaveAttachmentTool(attachments));
+  //
+  // NOT inside the harbor daemon. This extension is auto-discovered from the shared
+  // ~/.privateer/agent/extensions into every session the daemon runs, but `bridge` only
+  // ever gets a relay from THIS file's /remote-access command — which the daemon never
+  // runs. Registering there would shadow (Pi: first registration per name wins, and
+  // discovered extensions load before inline factories) the session-scoped pair a live
+  // task spawn registers against its own connected relay, so send_file_to_client would
+  // always answer "remote access is off" while the app was attached and driving.
+  if (!inHarborDaemon()) {
+    pi.registerTool?.(makeSendFileTool(bridge));
+    pi.registerTool?.(makeSaveAttachmentTool(attachments));
+  }
 
   // Subagents (and print/rpc) run as headless child `pi` processes with no UI. There
   // no one can approve, so a "default" gate would fail-closed on every tool and the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",

package/src/config/harborDaemon.ts

@@ -0,0 +1,31 @@
+// "Am I running inside the harbor daemon?" — a process-level marker, set once by
+// Harbor.start() and read by code that must behave differently there.
+//
+// The harbor daemon shares ~/.privateer/agent with the interactive TUI, so Pi
+// auto-discovers the shipped TUI extensions (extensions/*.ts shims installed by
+// bin/privateer-launch.mjs) into every session the daemon creates. Most of that is
+// harmless, but the gate extension also registers the relay file tools against ITS
+// module-level bridge — the one only `/remote-access` ever attaches a relay to. In the
+// daemon that bridge is permanently unattached, and because Pi resolves duplicate tool
+// names first-registration-wins (discovered extensions load before inline factories), it
+// would shadow the session-scoped pair a live task registers against its own live relay.
+// So the gate stands its file tools down here and each daemon session registers its own
+// (see src/tools/relayFileTools.ts, src/remote/liveTaskSession.ts).
+//
+// An env var rather than a module singleton on purpose: discovered extensions are loaded
+// through jiti with its module cache off, so they may hold a SEPARATE copy of our modules.
+// process.env is the one piece of state both copies are guaranteed to share.
+//
+// IMPORT-SAFETY: no Pi imports, no node builtins — safe to load from anywhere.
+
+const ENV = "PRIVATEER_HARBOR_DAEMON";
+
+/** Called once by the daemon as it starts. Idempotent. */
+export function markHarborDaemon(): void {
+  process.env[ENV] = "1";
+}
+
+/** True inside the harbor daemon process (routines, workflows, tasks, live spawns). */
+export function inHarborDaemon(): boolean {
+  return process.env[ENV] === "1";
+}

package/src/harbor/index.ts

@@ -48,6 +48,7 @@ import {
   loadPendingCloud,
   savePendingCloud,
   type PendingCloud,
+  type OutboxKind,
   routineRelayId,
 } from "../routines/store.ts";
 import type { Routine } from "../routines/schema.ts";
@@ -59,6 +60,7 @@ import { sealJson, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
 import { redactText, collectSecrets } from "../util/redact.ts";
 import { startIpcServer, sendToHarbor, describeRelay, formatDuration, HarborAlreadyRunningError, type IpcRequest, type IpcResponse, type RelayStatus } from "./ipc.ts";
 import { isHosted, publishRelayPub, webEnabled } from "../config/hosted.ts";
+import { markHarborDaemon } from "../config/harborDaemon.ts";
 import { makeWebTools, WEB_TOOL_NAMES } from "../tools/web.ts";
 
 // The safe, read-only toolset for unattended runs — Pi builtins with no
@@ -282,6 +284,11 @@ export class Harbor {
   };
 
   async start(): Promise<void> {
+    // Mark the process before anything can create a session: the shipped TUI extensions
+    // are auto-discovered from the shared agent dir into every session we run, and the
+    // gate one has to stand its relay file tools down here so a live task's own pair
+    // (bound to that task's live relay) isn't shadowed. See config/harborDaemon.ts.
+    markHarborDaemon();
     // Single-instance lock FIRST, before any other side effect: binding the IPC
     // socket is the machine's mutex. If a live harbor already holds it this throws
     // HarborAlreadyRunningError — two harbors under one ~/.privateer share a single
@@ -596,7 +603,7 @@ export class Harbor {
     return this.originCache;
   }
 
-  private async postOutbox(name: string, at: string, status: "ok" | "error", content: string, kind: "routine" | "task" = "routine"): Promise<boolean> {
+  private async postOutbox(name: string, at: string, status: "ok" | "error", content: string, kind: OutboxKind = "routine"): Promise<boolean> {
     const pub = await this.ensureOutboxPub();
     if (!pub) return false;
     const body = content.length > MAX_CLOUD_PLAINTEXT ? content.slice(0, MAX_CLOUD_PLAINTEXT) + "\n…truncated" : content;
@@ -1047,6 +1054,19 @@ export class Harbor {
           parseSpec,
           log,
           onClosed: (id) => this.liveTasks.delete(id),
+          // A live spawn's feed lives only in the attached app; when the session ends
+          // (closed, reaped, or timed out) its answer would otherwise be gone. Seal the
+          // closing one to the outbox like a submitted task's, so the app's inbox holds
+          // every agent result, not just the unattended ones. Same queue-on-failure path.
+          onResult: ({ title, status, content }) => {
+            void (async () => {
+              const at = new Date().toISOString();
+              const body = redactText(content, collectSecrets(loadHarborConfig().providers));
+              if (!(await this.postOutbox(title, at, status, body, "task"))) {
+                addPendingCloud({ routine: title, at, status, content: body, kind: "task" });
+              }
+            })();
+          },
         });
         this.liveTasks.set(handle.termId, handle);
         this.relay?.sendTaskSpawned(handle.termId, handle.label);
@@ -1111,8 +1131,8 @@ export class Harbor {
       const content = formatWorkflowResult(wf.workflow.name, result);
       const at = new Date().toISOString();
       // Durable delivery: seal to the outbox (queue on failure to re-seal later).
-      if (!(await this.postOutbox(wf.workflow.name, at, status, content, "task"))) {
-        addPendingCloud({ routine: wf.workflow.name, at, status, content, kind: "task" });
+      if (!(await this.postOutbox(wf.workflow.name, at, status, content, "workflow"))) {
+        addPendingCloud({ routine: wf.workflow.name, at, status, content, kind: "workflow" });
       }
       if (this.controllerAttached) this.relay?.sendWorkflowResult(wf.workflow.name, content);
       log(`  workflow "${wf.workflow.name}" ${result.status}${result.reason ? `: ${result.reason}` : ""}`);

package/src/remote/liveTaskSession.ts

@@ -28,6 +28,8 @@ import {
 } from "../providers/account.ts";
 import { RelayClient, type TaskSpec } from "./relayClient.ts";
 import { RemoteBridge } from "./remoteBridge.ts";
+import { makeRelayFileTools } from "../tools/relayFileTools.ts";
+import { AttachmentStore, type StoredAttachment } from "../util/attachmentStore.ts";
 import { spawnAccountCredentials, revokeAccountSession, hasCredentials } from "../auth/privateer.ts";
 
 export interface LiveTaskHandle {
@@ -41,6 +43,11 @@ export interface LiveTaskDeps {
   parseSpec: (spec: string) => { provider: string; modelId: string };
   log: (msg: string) => void;
   onClosed: (termId: string) => void;
+  // Deliver the session's closing answer durably (the harbor seals it to the account
+  // outbox, so it lands in the app's inbox). A live spawn's feed is otherwise purely
+  // ephemeral: close the screen, reap the session, and everything it said is gone —
+  // unlike a submitted task or a routine, whose results are always sealed.
+  onResult?: (result: { title: string; status: "ok" | "error"; content: string }) => void;
 }
 
 // How long to keep a spawned session alive with NO controller ever attaching, and the
@@ -72,12 +79,42 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   let attachTimer: ReturnType<typeof setTimeout> | undefined;
   let lifeTimer: ReturnType<typeof setTimeout> | undefined;
 
+  // Files the app sends down mid-session, keyed by the "#n" ref save_attachment writes
+  // back out. `sinceLastPrompt` is drained into the next prompt so the model is told what
+  // it just received — same contract as the TUI's (extensions/privateer-gate.ts).
+  const attachments = new AttachmentStore();
+  let sinceLastPrompt: StoredAttachment[] = [];
+
+  // The assistant text of the most recent turn, accumulated from the event stream and
+  // reset at the start of each one, so what we keep is the session's CLOSING answer
+  // rather than a transcript. Bounded — the outbox truncates anyway, and a long
+  // session's scrollback is not what makes a useful inbox entry.
+  const MAX_RESULT_CHARS = 8000;
+  let lastAnswer = "";
+  let turnErrored = false;
+
   const stop = async (): Promise<void> => {
     if (stopped) return;
     stopped = true;
+    // Hand the closing answer over BEFORE tearing anything down. Best-effort by
+    // design: no answer (nothing ever ran, or the model only used tools) means
+    // nothing to deliver, and a delivery failure must never block teardown.
+    const answer = lastAnswer.trim();
+    if (answer && deps.onResult) {
+      try {
+        deps.onResult({
+          title: title || "Spawned agent",
+          status: turnErrored ? "error" : "ok",
+          content: answer.slice(0, MAX_RESULT_CHARS),
+        });
+      } catch (e) {
+        deps.log(`live task ${termId} result delivery failed: ${(e as Error).message}`);
+      }
+    }
     if (attachTimer) clearTimeout(attachTimer);
     if (lifeTimer) clearTimeout(lifeTimer);
     try { relay?.stop(); } catch { /* already stopped */ }
+    attachments.cleanup(); // drop the scratch dir holding inbound file bytes
     // Revoke ONLY this session's account inference session so it doesn't linger in the
     // app's Linked Devices; the harbor's own child session stays alive. Best-effort.
     if (spawnedAccount) {
@@ -93,9 +130,20 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   const runTurn = async (text: string): Promise<void> => {
     if (turnActive || stopped) return;
     turnActive = true;
+    lastAnswer = "";   // keep the CLOSING answer, not the whole session
+    turnErrored = false;
     try {
-      await session.prompt(text);
+      // Fold any files the app sent since the last prompt into a reference note, so the
+      // model knows they exist and can save_attachment them to disk.
+      const atts = sinceLastPrompt;
+      sinceLastPrompt = [];
+      const note = atts.length
+        ? `\n\n[Files attached from the app: ${atts.map((a) => `#${a.n} ${a.name} (${a.mediaType})`).join(", ")}. ` +
+          `Use the save_attachment tool with the ref number to write one to disk.]`
+        : "";
+      await session.prompt(text + note);
     } catch (e) {
+      turnErrored = true;
       deps.log(`live task ${termId} turn error: ${(e as Error).message}`);
     } finally {
       turnActive = false;
@@ -122,6 +170,7 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
         bridge.callbacks.onPrompt(spec.prompt);
       }
     },
+    onAttachment: (file) => sinceLastPrompt.push(attachments.register(file)),
     onTerminate: () => void stop(),
     onStatus: (t) => deps.log(`live task ${termId}: ${t}`),
   });
@@ -157,6 +206,11 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
           privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
         }),
         makeAccountProvider(),
+        // send_file_to_client / save_attachment bound to THIS session's bridge — the one
+        // whose relay the app is attached to. The shipped gate extension is discovered
+        // into this session too but stands its own pair down inside the daemon, so these
+        // are the ones the model gets (see tools/relayFileTools.ts).
+        makeRelayFileTools(bridge, attachments),
       ] as any,
     },
   });
@@ -219,7 +273,12 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
 
   const adapter = createEngineEventAdapter();
   session.subscribe((ev: any) => {
-    for (const ee of adapter.toEngineEvents(ev)) bridge.forwardEvent(ee);
+    for (const ee of adapter.toEngineEvents(ev)) {
+      // Assistant prose only — reasoning, tool calls and results are deliberately not
+      // kept: the inbox entry should read like the agent's answer, not a trace.
+      if (ee.type === "text" && lastAnswer.length < MAX_RESULT_CHARS) lastAnswer += ee.text;
+      bridge.forwardEvent(ee);
+    }
   });
 
   relay = new RelayClient(bridge.callbacks, { termId, label });

package/src/routines/store.ts

@@ -204,6 +204,11 @@ export function drainPendingRelay(): PendingRelay[] {
   return queue;
 }
 
+// What produced a result delivered to the account outbox. Travels inside the sealed
+// envelope, so the app can label and filter its inbox without the server learning
+// anything. Kept here (not in the harbor) because the pending-cloud queue persists it.
+export type OutboxKind = "routine" | "task" | "workflow";
+
 // A `cloud`-delivery result that couldn't be sealed+posted to the account outbox
 // yet (offline, server down, or the app hasn't published its outbox key). Held on
 // disk until a later flush succeeds. Unlike PendingRelay this carries `status`, so
@@ -214,9 +219,10 @@ export interface PendingCloud {
   status: "ok" | "error";
   content: string;
   // What produced this — a scheduled routine (default, for back-compat with items
-  // written before ad-hoc tasks existed) or an app-submitted one-shot task. Preserved
-  // so the flush re-seals with the right `kind` and the app labels it correctly.
-  kind?: "routine" | "task";
+  // written before ad-hoc tasks existed), an app-submitted one-shot task, or a
+  // workflow run. Preserved so the flush re-seals with the right `kind` and the app
+  // labels it correctly in the inbox.
+  kind?: OutboxKind;
 }
 
 function pendingCloudPath(): string {

package/src/tools/relayFileTools.ts

@@ -0,0 +1,24 @@
+// The two relay file tools as a Pi extension factory bound to ONE specific bridge.
+//
+// `send_file_to_client` / `save_attachment` are normally registered by the shipped TUI
+// extension (extensions/privateer-gate.ts), against that extension's module-level
+// RemoteBridge — the one `/remote-access` attaches a relay to. That is right for the TUI
+// and wrong everywhere else: the extension is AUTO-DISCOVERED from ~/.privateer/agent/
+// extensions into every session that shares the agent dir, including the sessions the
+// harbor daemon stands up (live task spawns), which own their OWN bridge + relay. Pi
+// resolves duplicate tool names first-registration-wins and loads discovered extensions
+// before inline factories, so the discovered pair would shadow a session's own and answer
+// "remote access is off" while the session's relay is connected and driving.
+//
+// Hence this factory: a session that has its own bridge registers the pair here, and the
+// gate extension stands down inside the daemon (PRIVATEER_HARBOR_DAEMON).
+import { makeSendFileTool, type SendFileBridge } from "./sendFile.ts";
+import { makeSaveAttachmentTool } from "./saveAttachment.ts";
+import type { AttachmentStore } from "../util/attachmentStore.ts";
+
+export function makeRelayFileTools(bridge: SendFileBridge, attachments: AttachmentStore) {
+  return function relayFileTools(pi: any): void {
+    pi.registerTool?.(makeSendFileTool(bridge));
+    pi.registerTool?.(makeSaveAttachmentTool(attachments));
+  };
+}