@nanogpt/private-mode 0.2.0 → 0.2.2

package/README.md

@@ -32,6 +32,8 @@ const response = await client.chat.completions.create({
 
 The local proxy verifies TEE attestation, encrypts request bodies with EHBP, sends ciphertext through NanoGPT, decrypts encrypted responses locally, and returns normal OpenAI JSON to the calling app.
 
+After a long idle period (five minutes by default), the proxy re-verifies attestation and creates a fresh encrypted transport before the next request. This makes laptop sleep/resume safe without requiring a proxy restart. Set `NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS` to a positive millisecond value to adjust the idle threshold.
+
 NanoGPT can see account identity, selected private model, selected TEE target metadata, timing, sizes, status, and usage metadata. NanoGPT cannot read the prompt or completion body for supported private models.
 
 NanoGPT's web app can also use these models without running this local proxy. Select an eligible Private Mode model and use the Private Mode control in the model picker. This package is for API clients, CLIs, agents, and other OpenAI-compatible tools.

package/lib/secureClientLifecycle.js

@@ -0,0 +1,131 @@
+const DEFAULT_SECURE_CLIENT_IDLE_RESET_MS = 5 * 60 * 1000;
+
+function readSecureClientIdleResetMs() {
+  const parsed = Number(process.env.NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS || '');
+  if (Number.isFinite(parsed) && parsed > 0) return Math.floor(parsed);
+  return DEFAULT_SECURE_CLIENT_IDLE_RESET_MS;
+}
+
+export function createSecureState(apiBase, options = {}) {
+  const idleResetMs = Number.isFinite(options.idleResetMs) && options.idleResetMs > 0
+    ? Math.floor(options.idleResetMs)
+    : readSecureClientIdleResetMs();
+  const loadTinfoil = options.loadTinfoil || (() => import('tinfoil'));
+  const now = options.now || Date.now;
+  let clientState = null;
+  let verificationDocument = null;
+  let verificationError = null;
+
+  async function getClient(userCacheSecret = clientState?.userCacheSecret) {
+    if (!userCacheSecret) {
+      throw new Error('NanoGPT preflight must establish cache isolation before attestation.');
+    }
+    const nowMs = now();
+    const idleMs = clientState ? nowMs - clientState.lastUsedAtMs : 0;
+    if (
+      clientState?.userCacheSecret === userCacheSecret
+      && idleMs >= 0
+      && idleMs < idleResetMs
+    ) {
+      clientState.lastUsedAtMs = nowMs;
+      return clientState.promise;
+    }
+
+    // Re-attest after a long idle period or a wall-clock discontinuity. This
+    // covers laptops resuming after sleep without mutating a client that may
+    // still be finishing an older in-flight request.
+    verificationDocument = null;
+    verificationError = null;
+    const nextState = {
+      client: null,
+      lastUsedAtMs: nowMs,
+      promise: null,
+      userCacheSecret,
+    };
+    const promise = Promise.resolve(loadTinfoil()).then(async ({ SecureClient }) => {
+      const baseURL = `${apiBase}/api/v1/private/tinfoil/`;
+      const client = new SecureClient({
+        baseURL,
+        attestationBundleURL: `${apiBase}/api/v1/private/tinfoil`,
+        transport: 'ehbp',
+        userCacheSecret,
+      });
+      await client.ready();
+      nextState.client = client;
+      if (clientState === nextState) {
+        verificationDocument = client.getVerificationDocument();
+        verificationError = null;
+      }
+      return client;
+    });
+    nextState.promise = promise;
+    clientState = nextState;
+
+    try {
+      return await promise;
+    } catch (error) {
+      if (clientState === nextState) {
+        clientState = null;
+        verificationError = error;
+      }
+      throw error;
+    }
+  }
+
+  return {
+    getClient,
+    invalidateClient(client) {
+      if (!clientState) return false;
+      if (client && clientState.client !== client) return false;
+      clientState = null;
+      verificationDocument = null;
+      verificationError = null;
+      return true;
+    },
+    getVerificationState() {
+      return {
+        verified: verificationDocument?.securityVerified === true,
+        verificationDocument,
+        error: verificationError ? String(verificationError.message || verificationError) : null,
+      };
+    },
+  };
+}
+
+export async function isMissingEncryptedBodyHeaderResponse(response) {
+  if (response?.status !== 400) return false;
+  try {
+    const data = await response.clone().json();
+    return data?.error?.code === 'missing_encrypted_body_header';
+  } catch {
+    return false;
+  }
+}
+
+export async function fetchWithSecureClientRecovery({
+  fetchWithClient,
+  secureState,
+  shouldInvalidateError = () => true,
+  userCacheSecret,
+}) {
+  let client;
+  try {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      client = await secureState.getClient(userCacheSecret);
+      const response = await fetchWithClient(client);
+      if (attempt === 0 && await isMissingEncryptedBodyHeaderResponse(response)) {
+        await response.body?.cancel().catch(() => undefined);
+        secureState.invalidateClient(client);
+        continue;
+      }
+      return response;
+    }
+  } catch (error) {
+    if (client && shouldInvalidateError(error)) {
+      secureState.invalidateClient(client);
+    }
+    throw error;
+  }
+
+  throw new Error('Private Mode secure-client recovery exhausted unexpectedly.');
+}

package/lib/server.js

@@ -11,6 +11,10 @@ import {
   normalizePrivateModeUpstreamErrorMessage,
   readErrorMessage,
 } from './serverErrorNormalization.js';
+import {
+  createSecureState,
+  fetchWithSecureClientRecovery,
+} from './secureClientLifecycle.js';
 import { buildPrivateModeStatusContract } from './statusContract.js';
 
 const MODELS = JSON.parse(
@@ -150,56 +154,6 @@ function copyLocalHeaders(req) {
   return headers;
 }
 
-function createSecureState(apiBase, apiKey) {
-  let clientState = null;
-  let verificationDocument = null;
-  let verificationError = null;
-
-  async function getClient(userCacheSecret = clientState?.userCacheSecret) {
-    if (!userCacheSecret) {
-      throw new Error('NanoGPT preflight must establish cache isolation before attestation.');
-    }
-    if (clientState?.userCacheSecret === userCacheSecret) {
-      return clientState.promise;
-    }
-
-    const promise = import('tinfoil').then(async ({ SecureClient }) => {
-      const baseURL = `${apiBase}/api/v1/private/tinfoil/`;
-      const client = new SecureClient({
-        baseURL,
-        attestationBundleURL: `${apiBase}/api/v1/private/tinfoil`,
-        transport: 'ehbp',
-        userCacheSecret,
-      });
-      await client.ready();
-      verificationDocument = client.getVerificationDocument();
-      verificationError = null;
-      return client;
-    });
-    const nextState = { userCacheSecret, promise };
-    clientState = nextState;
-
-    try {
-      return await promise;
-    } catch (error) {
-      if (clientState === nextState) clientState = null;
-      verificationError = error;
-      throw error;
-    }
-  }
-
-  return {
-    getClient,
-    getVerificationState() {
-      return {
-        verified: verificationDocument?.securityVerified === true,
-        verificationDocument,
-        error: verificationError ? String(verificationError.message || verificationError) : null,
-      };
-    },
-  };
-}
-
 async function runPreflight({ apiBase, apiKey, model, req, requestBodyBytes }) {
   const preflightBody = { model: model.id };
   if (Number.isSafeInteger(requestBodyBytes) && requestBodyBytes >= 0) {
@@ -334,21 +288,25 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
   });
 
   try {
-    const client = await secureState.getClient(preflight.cacheScope);
-    response = await client.fetch(`${apiBase}/api/v1/private/tinfoil/v1/chat/completions`, {
-      method: 'POST',
-      headers: {
-        authorization: `Bearer ${apiKey}`,
-        'content-type': 'application/json',
-        accept: privateStreamRequested ? 'text/event-stream' : 'application/json',
-        'x-nanogpt-private-model': model.id,
-        'x-nanogpt-private-stream': privateStreamRequested ? 'true' : 'false',
-        'x-nanogpt-private-cache-scope': buildPrivateModeCacheScopeProof(preflight.cacheScope),
-        'x-query-source': 'api',
-        ...copyLocalHeaders(req),
-      },
-      body: privateRequestBody,
-      signal: upstreamAbortController.signal,
+    response = await fetchWithSecureClientRecovery({
+      secureState,
+      userCacheSecret: preflight.cacheScope,
+      shouldInvalidateError: () => !upstreamAbortController.signal.aborted,
+      fetchWithClient: (client) => client.fetch(`${apiBase}/api/v1/private/tinfoil/v1/chat/completions`, {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${apiKey}`,
+          'content-type': 'application/json',
+          accept: privateStreamRequested ? 'text/event-stream' : 'application/json',
+          'x-nanogpt-private-model': model.id,
+          'x-nanogpt-private-stream': privateStreamRequested ? 'true' : 'false',
+          'x-nanogpt-private-cache-scope': buildPrivateModeCacheScopeProof(preflight.cacheScope),
+          'x-query-source': 'api',
+          ...copyLocalHeaders(req),
+        },
+        body: privateRequestBody,
+        signal: upstreamAbortController.signal,
+      }),
     });
   } catch (error) {
     responseComplete = true;
@@ -448,7 +406,7 @@ function handleOptions(req, res, corsHeaders) {
 
 export async function startPrivateModeProxy(options) {
   const apiBase = normalizeApiBase(options.apiBase);
-  const secureState = createSecureState(apiBase, options.apiKey);
+  const secureState = createSecureState(apiBase);
   const localBase = `http://${options.host}:${options.port}/v1`;
   const originPolicy = buildPrivateModeOriginPolicy(options);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanogpt/private-mode",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "OpenAI-compatible localhost proxy for NanoGPT Private Mode.",
   "type": "module",
   "publishConfig": {
@@ -15,6 +15,7 @@
     "lib/cacheScope.js",
     "lib/originPolicy.js",
     "lib/requestTransforms.js",
+    "lib/secureClientLifecycle.js",
     "lib/server.js",
     "lib/serverErrorNormalization.js",
     "lib/statusContract.js",
@@ -22,9 +23,6 @@
     "models",
     "README.md"
   ],
-  "scripts": {
-    "start": "node ./bin/nanogpt-private-mode.js"
-  },
   "dependencies": {
     "ai": "6.0.220",
     "tinfoil": "1.1.12"
@@ -32,5 +30,8 @@
   "engines": {
     "node": ">=22"
   },
-  "license": "MIT"
-}
+  "license": "MIT",
+  "scripts": {
+    "start": "node ./bin/nanogpt-private-mode.js"
+  }
+}