@nanogpt/private-mode 0.2.14 → 0.2.18

package/README.md

@@ -25,7 +25,7 @@ const client = new OpenAI({
 });
 
 const response = await client.chat.completions.create({
-  model: "private/glm-5-2",
+  model: "private/glm-5-3",
   messages: [{ role: "user", content: "Hello" }],
 });
 ```
@@ -46,7 +46,17 @@ NanoGPT can see account identity, selected private model, selected TEE target me
 
 NanoGPT's web app can also use these models without running this local proxy. Select an eligible Private Mode model and use the Private Mode control in the model picker. This package is for API clients, CLIs, agents, and other OpenAI-compatible tools.
 
-The web app supports local image attachments for Private Mode vision models (Kimi K3 and Gemma 4 31B). Image bytes are converted to base64 in the browser and included inside the EHBP-encrypted request; they are not uploaded to NanoGPT object storage. Other attachment types, web search, URL-scraped content, project tools, multi-model chat, Context Memory injection, quick replies, and automatic title generation remain disabled for private turns.
+The web app supports local image attachments for Private Mode vision models (Kimi K3 and Gemma 4 31B). Image bytes are converted to base64 in the browser and included inside the EHBP-encrypted request; they are not uploaded to NanoGPT object storage. It also supports encrypted text extraction from one local PDF up to 3 MiB. Other attachment types, web search, URL-scraped content, project tools, multi-model chat, Context Memory injection, quick replies, and automatic title generation remain disabled for private turns.
+
+The localhost proxy exposes the same encrypted PDF conversion path:
+
+```bash
+curl --fail-with-body http://127.0.0.1:8787/v1/convert/file \
+  -H 'X-NanoGPT-Private-Model: private/glm-5-3' \
+  -F 'files=@document.pdf;type=application/pdf'
+```
+
+Send exactly one PDF in the `files` field and select any model returned by the proxy's `/v1/models` endpoint with `X-NanoGPT-Private-Model`. The proxy accepts PDFs up to 3 MiB, replaces the local filename before encryption, and returns extracted Markdown in `document.md_content`. Conversion is metered separately from model token usage; the successful response's `X-NanoGPT-Document-Cost-USD` header reports the settled conversion charge. A model catalog value of `capabilities.pdf_upload: false` means the model does not accept a PDF natively in its prompt. It does not disable this separate encrypted text-extraction step.
 
 In the hosted web app, decrypted Private Mode turns remain in local browser history. Cloud conversation sync is blocked for Private Mode chats unless password-based end-to-end sync is enabled; the recoverable default sync mode is not used for those chats.
 
@@ -56,7 +66,7 @@ Because the request body is encrypted before NanoGPT receives it, the service ca
 
 Private Mode streaming has a 29-minute soft deadline so billing can settle before the route's 30-minute hard runtime limit. If the decrypted upstream stream ends without both a non-null `finish_reason` and the OpenAI `[DONE]` marker, the local proxy emits an SSE error with code `private_stream_incomplete`. Any text received before that error may be partial.
 
-Private Mode currently supports Chat Completions only. The Responses API and Batch API are not available through the encrypted Private Mode endpoint. The standard Responses API outside Private Mode supports background requests within its configured 30-minute runtime limit; work that must reliably continue longer needs a durable job system.
+Private Mode supports Chat Completions for text generation and `/v1/convert/file` for encrypted PDF-to-Markdown conversion. The Responses API and Batch API are not available through the encrypted Private Mode endpoint. The standard Responses API outside Private Mode supports background requests within its configured 30-minute runtime limit; work that must reliably continue longer needs a durable job system.
 
 Useful local checks:
 
@@ -64,22 +74,21 @@ Useful local checks:
 GET http://127.0.0.1:8787/v1/models
 GET http://127.0.0.1:8787/v1/private-mode/status
 GET http://127.0.0.1:8787/v1/private-mode/attestation
+POST http://127.0.0.1:8787/v1/convert/file
 ```
 
 Supported private model IDs include:
 
-- `private/deepseek-v4-flash` - DeepSeek V4 Flash 0731
+- `private/deepseek-v4-1-flash` - DeepSeek V4.1 Flash
 - `private/kimi-k3`
 - `private/gpt-oss-120b`
 - `private/llama3-3-70b`
-- `private/glm-5-2`
-- `private/glm-5-2:thinking`
 - `private/glm-5-3`
 - `private/glm-5-3-flash`
 - `private/gemma4-31b`
 - `private/gemma4-31b:thinking`
 
-Both GLM 5.2 variants are deployed with a 393,216-token total context limit, with prompt and output sharing that window. GLM 5.3 Private and GLM 5.3 Flash Private each have a 1,048,576-token total context limit and a 131,072-token output ceiling. Kimi K3 Private has a 256,000-token context limit. DeepSeek V4 Flash 0731 Private has a 1,048,576-token total context limit. The model-list extension `context_length` is the combined prompt-and-output window, while `max_output_tokens` is the output ceiling within that same window. These values are not additive.
+GLM 5.3 Private and GLM 5.3 Flash Private each have a 1,048,576-token total context limit and a 131,072-token output ceiling. Kimi K3 Private has a 256,000-token context limit. DeepSeek V4.1 Flash Private has a 1,048,576-token total context limit and a 384,000-token output ceiling. The model-list extension `context_length` is the combined prompt-and-output window, while `max_output_tokens` is the output ceiling within that same window. These values are not additive.
 
 ### Thinking without leaving Private Mode
 
@@ -87,14 +96,14 @@ Keep the same private model ID when enabling thinking. For example:
 
 ```json
 {
-  "model": "private/deepseek-v4-flash",
+  "model": "private/deepseek-v4-1-flash",
   "messages": [{ "role": "user", "content": "What is 17 times 19?" }],
   "reasoning_effort": "high",
   "stream": true
 }
 ```
 
-DeepSeek V4 Flash uses the 0731 release and supports optional thinking. GLM 5.2 and Gemma 4 also support optional thinking. Use `thinking: true` or `enable_thinking: true` to enable it; `thinking: false` disables it for these optional-thinking models. Kimi K3, GLM 5.3, and GLM 5.3 Flash always generate reasoning. GLM 5.3 models accept `low`, `high`, or `max` effort. `reasoning: { "exclude": true }` controls response visibility and does not disable thinking.
+DeepSeek V4.1 Flash and Gemma 4 support optional thinking. Use `thinking: true` or `enable_thinking: true` to enable it; `thinking: false` disables it for these optional-thinking models. Kimi K3, GLM 5.3, and GLM 5.3 Flash always generate reasoning. GLM 5.3 models accept `low`, `high`, or `max` effort. `reasoning: { "exclude": true }` controls response visibility and does not disable thinking.
 
 Non-streaming reasoning requests may take more than five minutes. The CLI allows the encrypted request to wait for the hosted route's response, with a 30-minute transport limit. The hosted route stops non-streaming generation after at most 29 minutes to leave time before its platform deadline. Use `stream: true` for earlier output, and configure your API client's timeout to allow long generations. Upgrade the local proxy as well as the hosted service to receive both timeout fixes.
 

package/lib/documentConversion.js

@@ -0,0 +1,90 @@
+export const MAX_PRIVATE_DOCUMENT_BYTES = 3 * 1024 * 1024;
+export const MAX_PRIVATE_DOCUMENT_MULTIPART_BYTES = 4 * 1024 * 1024;
+export const MAX_PRIVATE_DOCUMENT_RESPONSE_BYTES = 4 * 1024 * 1024;
+export const PRIVATE_DOCUMENT_CONVERSION_PATH = '/v1/convert/file';
+export const HOSTED_PRIVATE_DOCUMENT_CONVERSION_PATH = '/api/v1/private/tinfoil/v1/convert/file';
+
+export function resolvePrivateDocumentMultipartLimit(maxBodyBytes) {
+  return Math.min(maxBodyBytes, MAX_PRIVATE_DOCUMENT_MULTIPART_BYTES);
+}
+
+export function createPrivateDocumentRequestLifecycle(res) {
+  const controller = new AbortController();
+  let complete = false;
+  res.once('close', () => {
+    if (!complete) controller.abort();
+  });
+
+  return {
+    signal: controller.signal,
+    isCancelled: () => Boolean(res.destroyed || controller.signal.aborted),
+    complete: () => {
+      complete = true;
+    },
+  };
+}
+
+export function isPrivateDocumentMultipartContentType(value) {
+  return typeof value === 'string'
+    && /^multipart\/form-data\s*;[^\r\n]*\bboundary=(?:"[^"]+"|[^;\s]+)/i.test(value);
+}
+
+export function hasPrivateDocumentConversionResult(value) {
+  return Boolean(
+    value
+    && typeof value === 'object'
+    && value.document
+    && typeof value.document === 'object'
+    && typeof value.document.md_content === 'string'
+    && value.document.md_content.trim(),
+  );
+}
+
+export async function preparePrivateDocumentMultipart(rawBody, contentType) {
+  let form;
+  try {
+    form = await new Request('http://127.0.0.1/', {
+      method: 'POST',
+      headers: { 'content-type': contentType },
+      body: rawBody,
+    }).formData();
+  } catch {
+    return {
+      ok: false,
+      status: 400,
+      code: 'invalid_document_multipart',
+      message: 'Private PDF conversion requires valid multipart form data.',
+    };
+  }
+
+  const entries = [...form.entries()];
+  const file = entries.length === 1 && entries[0][0] === 'files' ? entries[0][1] : null;
+  if (!file || typeof file === 'string' || typeof file.arrayBuffer !== 'function') {
+    return {
+      ok: false,
+      status: 400,
+      code: 'invalid_document_fields',
+      message: 'Private PDF conversion requires exactly one PDF in the files field.',
+    };
+  }
+  if (file.size > MAX_PRIVATE_DOCUMENT_BYTES) {
+    return {
+      ok: false,
+      status: 413,
+      code: 'document_too_large',
+      message: 'Private PDF conversion accepts a PDF up to 3 MiB.',
+    };
+  }
+  if (file.size === 0 || await file.slice(0, 5).text() !== '%PDF-') {
+    return {
+      ok: false,
+      status: 400,
+      code: 'invalid_document',
+      message: 'Private PDF conversion requires a non-empty file with a valid PDF signature.',
+    };
+  }
+
+  const forwardedForm = new FormData();
+  forwardedForm.append('files', new Blob([await file.arrayBuffer()], { type: 'application/pdf' }), 'document.pdf');
+  return { ok: true, body: forwardedForm, fileSize: file.size };
+}

package/lib/originPolicy.js

@@ -111,6 +111,11 @@ export function getCorsHeadersForOrigin(originPolicy, origin) {
 
   return {
     'access-control-allow-origin': normalizedOrigin,
+    'access-control-expose-headers': [
+      'x-request-id',
+      'x-nanogpt-private-mode',
+      'x-nanogpt-document-cost-usd',
+    ].join(', '),
     vary: 'Origin',
   };
 }

package/lib/requestTransforms.js

@@ -236,8 +236,16 @@ function isReasoningEnabled(reasoning) {
   return undefined;
 }
 
-function normalizeDeepSeekV4ReasoningEffort(value) {
+function normalizeDeepSeekV4ReasoningEffort(value, model, nativeTemplateValue = false) {
   const normalized = typeof value === 'string' ? value.trim().toLowerCase() : '';
+  if (model?.thinkingMode === 'deepseek-v4.1') {
+    if (nativeTemplateValue && ['low', 'high', 'xhigh'].includes(normalized)) {
+      return normalized;
+    }
+    if (normalized === 'low' || normalized === 'minimal') return 'low';
+    if (normalized === 'medium') return 'high';
+    return 'xhigh';
+  }
   if (normalized === 'max' || normalized === 'xhigh') return 'max';
   if (normalized === 'medium') return 'medium';
   if (normalized === 'low' || normalized === 'minimal') return 'low';
@@ -606,14 +614,17 @@ function applyPrivateModeKimiK3RequestParams(body, model) {
   );
 }
 
-function clampPrivateModeDeepSeekV4Output(body) {
+function clampPrivateModeDeepSeekV4Output(body, model) {
+  const maxCompletionTokens = Number.isFinite(model?.maxOutputTokens)
+    ? Math.max(1, Math.floor(model.maxOutputTokens))
+    : DEEPSEEK_V4_MAX_COMPLETION_TOKENS;
   const requestedMaxTokens = typeof body.max_tokens === 'number' && Number.isFinite(body.max_tokens)
     ? body.max_tokens
     : undefined;
   if (requestedMaxTokens === undefined) return;
 
   const normalizedMaxTokens = requestedMaxTokens < 0
-    ? DEEPSEEK_V4_MAX_COMPLETION_TOKENS
+    ? maxCompletionTokens
     : requestedMaxTokens;
   const promptTokenEstimate = estimatePrivateModeKimiK3PromptTokens(body);
   const remainingContext = Math.max(
@@ -624,7 +635,7 @@ function clampPrivateModeDeepSeekV4Output(body) {
   );
   body.max_tokens = Math.min(
     Math.max(1, Math.floor(normalizedMaxTokens)),
-    DEEPSEEK_V4_MAX_COMPLETION_TOKENS,
+    maxCompletionTokens,
     remainingContext,
   );
 }
@@ -1051,8 +1062,11 @@ export function applyPrivateModelRequestMutations(body, model) {
   applyTinfoilCompatibilityMutations(body, model);
   if (isPrivateModeKimiK3Model(model)) {
     applyPrivateModeKimiK3RequestParams(body, model);
-  } else if (model.thinkingMode === 'deepseek-v4') {
-    clampPrivateModeDeepSeekV4Output(body);
+  } else if (
+    model.thinkingMode === 'deepseek-v4' ||
+    model.thinkingMode === 'deepseek-v4.1'
+  ) {
+    clampPrivateModeDeepSeekV4Output(body, model);
   } else if (model.thinkingMode === 'glm-5.3') {
     clampPrivateModeGlm53Output(body);
   }
@@ -1067,14 +1081,16 @@ export function applyPrivateModelRequestMutations(body, model) {
   } else if (
     model.thinkingMode === 'glm-5.2' ||
     model.thinkingMode === 'glm-5.3' ||
-    model.thinkingMode === 'deepseek-v4'
+    model.thinkingMode === 'deepseek-v4' ||
+    model.thinkingMode === 'deepseek-v4.1'
   ) {
     const thinkingEnabled = model.thinkingMode === 'glm-5.3'
       ? true
       : shouldEnableThinking(body, model);
-    const requestedReasoningEffort = body.reasoning_effort
-      ?? (isPlainObject(body.reasoning) ? body.reasoning.effort : undefined)
-      ?? body.chat_template_kwargs?.reasoning_effort;
+    const publicReasoningEffort = body.reasoning_effort
+      ?? (isPlainObject(body.reasoning) ? body.reasoning.effort : undefined);
+    const nativeTemplateReasoningEffort = body.chat_template_kwargs?.reasoning_effort;
+    const requestedReasoningEffort = publicReasoningEffort ?? nativeTemplateReasoningEffort;
     body.chat_template_kwargs = {
       ...mergeChatTemplateKwargs(body),
       thinking: thinkingEnabled,
@@ -1086,7 +1102,11 @@ export function applyPrivateModelRequestMutations(body, model) {
       body.reasoning_effort = normalizeGlm53ReasoningEffort(requestedReasoningEffort);
       delete body.chat_template_kwargs.reasoning_effort;
     } else if (thinkingEnabled) {
-      body.chat_template_kwargs.reasoning_effort = normalizeDeepSeekV4ReasoningEffort(requestedReasoningEffort);
+      body.chat_template_kwargs.reasoning_effort = normalizeDeepSeekV4ReasoningEffort(
+        requestedReasoningEffort,
+        model,
+        publicReasoningEffort === undefined && nativeTemplateReasoningEffort !== undefined,
+      );
     } else {
       delete body.chat_template_kwargs.reasoning_effort;
     }

package/lib/server.js

@@ -12,6 +12,17 @@ import {
   PRIVATE_MODE_DEFAULT_RESERVE_MAX_OUTPUT_TOKENS,
   PRIVATE_MODE_STREAM_SOFT_DEADLINE_MS,
 } from './constants.js';
+import {
+  createPrivateDocumentRequestLifecycle,
+  hasPrivateDocumentConversionResult,
+  HOSTED_PRIVATE_DOCUMENT_CONVERSION_PATH,
+  isPrivateDocumentMultipartContentType,
+  MAX_PRIVATE_DOCUMENT_BYTES,
+  MAX_PRIVATE_DOCUMENT_RESPONSE_BYTES,
+  preparePrivateDocumentMultipart,
+  PRIVATE_DOCUMENT_CONVERSION_PATH,
+  resolvePrivateDocumentMultipartLimit,
+} from './documentConversion.js';
 import {
   buildPrivateModeOriginPolicy,
   getCorsHeadersForRequest,
@@ -53,6 +64,7 @@ function readMaxBodyBytes() {
 }
 
 const MAX_BODY_BYTES = readMaxBodyBytes();
+const MAX_DOCUMENT_MULTIPART_BODY_BYTES = resolvePrivateDocumentMultipartLimit(MAX_BODY_BYTES);
 
 function normalizeApiBase(apiBase) {
   const parsed = new URL(apiBase);
@@ -111,6 +123,9 @@ export function privateModeStatus(apiBase, secureState, localBase, originPolicy,
     status_path: '/v1/private-mode/status',
     attestation_path: '/v1/private-mode/attestation',
     chat_completions_path: '/v1/chat/completions',
+    document_conversion_path: PRIVATE_DOCUMENT_CONVERSION_PATH,
+    document_conversion_max_file_bytes: MAX_PRIVATE_DOCUMENT_BYTES,
+    document_conversion_max_multipart_bytes: MAX_DOCUMENT_MULTIPART_BODY_BYTES,
     max_body_bytes: MAX_BODY_BYTES,
     transport: 'ehbp',
     request_body_encrypted: true,
@@ -163,14 +178,14 @@ function notFound(res, corsHeaders) {
   }, corsHeaders);
 }
 
-function readBody(req) {
+function readBody(req, maxBytes = MAX_BODY_BYTES) {
   return new Promise((resolve, reject) => {
     const chunks = [];
     let size = 0;
     req.on('data', (chunk) => {
-      if (size > MAX_BODY_BYTES) return;
+      if (size > maxBytes) return;
       size += chunk.length;
-      if (size > MAX_BODY_BYTES) {
+      if (size > maxBytes) {
         reject(new Error('Request body is too large.'));
         return;
       }
@@ -190,8 +205,11 @@ function copyLocalHeaders(req) {
   return headers;
 }
 
-async function runPreflight({ apiBase, apiKey, model, req, requestBodyBytes }) {
-  const preflightBody = { model: model.id };
+async function runPreflight({ apiBase, apiKey, model, req, requestBodyBytes, operation, signal }) {
+  const preflightBody = {
+    model: model.id,
+    ...(operation ? { operation } : {}),
+  };
   if (Number.isSafeInteger(requestBodyBytes) && requestBodyBytes >= 0) {
     preflightBody.requestBodyBytes = requestBodyBytes;
   }
@@ -205,6 +223,7 @@ async function runPreflight({ apiBase, apiKey, model, req, requestBodyBytes }) {
       ...copyLocalHeaders(req),
     },
     body: JSON.stringify(preflightBody),
+    signal,
   });
 
   if (response.ok) {
@@ -244,6 +263,221 @@ async function runPreflight({ apiBase, apiKey, model, req, requestBodyBytes }) {
   return { ok: false, status: response.status, body: errorBody };
 }
 
+async function readResponseBodyWithLimit(response, maxBytes) {
+  const reader = response.body?.getReader();
+  if (!reader) return Buffer.alloc(0);
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > maxBytes) {
+        await reader.cancel();
+        throw new Error('Response body is too large.');
+      }
+      chunks.push(Buffer.from(value));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks);
+}
+
+async function handleDocumentConversion({ apiBase, apiKey, secureState, req, res, corsHeaders }) {
+  const contentType = typeof req.headers['content-type'] === 'string'
+    ? req.headers['content-type']
+    : '';
+  if (!isPrivateDocumentMultipartContentType(contentType)) {
+    jsonResponse(res, 415, {
+      error: {
+        message: 'Private PDF conversion requires multipart/form-data with one files field.',
+        type: 'invalid_request_error',
+        code: 'invalid_document_content_type',
+      },
+    }, corsHeaders);
+    return;
+  }
+
+  const model = resolveModel(req.headers['x-nanogpt-private-model']);
+  if (!model) {
+    jsonResponse(res, 400, {
+      error: {
+        message: 'Set X-NanoGPT-Private-Model to a model returned by this proxy\'s /v1/models endpoint.',
+        type: 'invalid_request_error',
+        code: 'model_not_supported',
+      },
+    }, corsHeaders);
+    return;
+  }
+
+  let rawBody;
+  try {
+    rawBody = await readBody(req, MAX_DOCUMENT_MULTIPART_BODY_BYTES);
+  } catch {
+    jsonResponse(res, 413, {
+      error: {
+        message: 'Multipart request is too large. Private PDF conversion accepts a PDF up to 3 MiB.',
+        type: 'invalid_request_error',
+        code: 'body_too_large',
+      },
+    }, corsHeaders);
+    return;
+  }
+  if (rawBody.length === 0) {
+    jsonResponse(res, 400, {
+      error: {
+        message: 'Private PDF conversion requires one PDF in the files field.',
+        type: 'invalid_request_error',
+        code: 'missing_document',
+      },
+    }, corsHeaders);
+    return;
+  }
+
+  const prepared = await preparePrivateDocumentMultipart(rawBody, contentType);
+  if (!prepared.ok) {
+    jsonResponse(res, prepared.status, {
+      error: {
+        message: prepared.message,
+        type: 'invalid_request_error',
+        code: prepared.code,
+      },
+    }, corsHeaders);
+    return;
+  }
+
+  const requestLifecycle = createPrivateDocumentRequestLifecycle(res);
+
+  let preflight;
+  try {
+    preflight = await runPreflight({
+      apiBase,
+      apiKey,
+      model,
+      req,
+      requestBodyBytes: prepared.fileSize,
+      operation: 'document_conversion',
+      signal: requestLifecycle.signal,
+    });
+  } catch (error) {
+    requestLifecycle.complete();
+    if (requestLifecycle.isCancelled()) return;
+    throw error;
+  }
+  if (requestLifecycle.isCancelled()) {
+    requestLifecycle.complete();
+    return;
+  }
+  if (!preflight.ok) {
+    requestLifecycle.complete();
+    jsonResponse(res, preflight.status, preflight.body, corsHeaders);
+    return;
+  }
+
+  let responseClient;
+
+  let response;
+  try {
+    response = await fetchWithSecureClientRecovery({
+      secureState,
+      userCacheSecret: preflight.cacheScope,
+      shouldInvalidateError: () => !requestLifecycle.signal.aborted,
+      fetchWithClient: (client) => client.fetch(`${apiBase}${HOSTED_PRIVATE_DOCUMENT_CONVERSION_PATH}`, {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${apiKey}`,
+          accept: 'application/json',
+          'x-nanogpt-private-model': model.id,
+          'x-nanogpt-private-cache-scope': buildPrivateModeCacheScopeProof(preflight.cacheScope),
+          [PRIVATE_MODE_PROXY_VERSION_HEADER]: PRIVATE_MODE_PROXY_VERSION,
+          'x-query-source': 'api',
+          ...copyLocalHeaders(req),
+        },
+        body: prepared.body,
+        signal: requestLifecycle.signal,
+      }),
+      onResponseClient: (client) => {
+        responseClient = client;
+      },
+    });
+  } catch (error) {
+    requestLifecycle.complete();
+    if (requestLifecycle.isCancelled()) return;
+    jsonResponse(res, 502, {
+      error: {
+        message: normalizePrivateModeUpstreamErrorMessage(
+          error instanceof Error ? error.message : String(error),
+          'Private PDF conversion failed.',
+        ),
+        type: 'api_error',
+        code: 'private_document_processing_failed',
+      },
+    }, corsHeaders);
+    return;
+  }
+
+  const responseHeaders = { ...corsHeaders };
+  for (const name of ['content-type', 'x-request-id', 'x-nanogpt-private-mode', 'x-nanogpt-document-cost-usd']) {
+    const value = response.headers.get(name);
+    if (value) responseHeaders[name] = value;
+  }
+  if (!response.ok) {
+    requestLifecycle.complete();
+    const errorHeaders = { ...responseHeaders };
+    delete errorHeaders['content-type'];
+    jsonResponse(res, response.status, {
+      error: {
+        message: await readErrorMessage(response, `Private PDF conversion failed with HTTP ${response.status}`),
+        type: 'api_error',
+        code: 'private_document_processing_failed',
+      },
+    }, errorHeaders);
+    secureState.markClientUsed(responseClient);
+    return;
+  }
+
+  if (response.headers.get('x-nanogpt-private-mode') !== 'tinfoil'
+    || !response.headers.has('ehbp-response-nonce')) {
+    requestLifecycle.complete();
+    await response.body?.cancel().catch(() => undefined);
+    secureState.invalidateClient(responseClient);
+    jsonResponse(res, 502, {
+      error: {
+        message: 'Private PDF conversion returned an unverified response.',
+        type: 'api_error',
+        code: 'private_document_response_unverified',
+      },
+    }, corsHeaders);
+    return;
+  }
+
+  let responseBody;
+  try {
+    responseBody = await readResponseBodyWithLimit(response, MAX_PRIVATE_DOCUMENT_RESPONSE_BYTES);
+    const parsed = JSON.parse(responseBody.toString('utf8'));
+    if (!hasPrivateDocumentConversionResult(parsed)) throw new Error('missing_document_content');
+  } catch {
+    requestLifecycle.complete();
+    secureState.markClientUsed(responseClient);
+    jsonResponse(res, 502, {
+      error: {
+        message: 'Private PDF conversion returned an invalid response.',
+        type: 'api_error',
+        code: 'private_document_response_invalid',
+      },
+    }, corsHeaders);
+    return;
+  }
+
+  secureState.markClientUsed(responseClient);
+  responseHeaders['content-length'] = String(responseBody.length);
+  requestLifecycle.complete();
+  res.writeHead(response.status, responseHeaders);
+  res.end(responseBody);
+}
+
 async function getPreflightedClient({ apiBase, apiKey, secureState, req, model = MODELS[0] }) {
   const preflight = await runPreflight({
     apiBase,
@@ -454,7 +688,7 @@ function resolveAccessControlAllowHeaders(req) {
       .join(', ');
   }
 
-  return 'authorization, content-type, x-team-id';
+  return 'authorization, content-type, x-team-id, x-nanogpt-private-model';
 }
 
 function handleOptions(req, res, corsHeaders) {
@@ -552,8 +786,20 @@ export async function startPrivateModeProxy(options) {
         return;
       }
 
+      if (req.method === 'POST' && url.pathname === PRIVATE_DOCUMENT_CONVERSION_PATH) {
+        await handleDocumentConversion({
+          apiBase,
+          apiKey: options.apiKey,
+          secureState,
+          req,
+          res,
+          corsHeaders,
+        });
+        return;
+      }
+
       if (req.method === 'GET' && url.pathname === '/') {
-        textResponse(res, 200, `NanoGPT Private Mode Proxy v${PRIVATE_MODE_PROXY_VERSION}\nOpenAI base URL: ${localBase}\nStatus: /v1/private-mode/status\n`, corsHeaders);
+        textResponse(res, 200, `NanoGPT Private Mode Proxy v${PRIVATE_MODE_PROXY_VERSION}\nOpenAI base URL: ${localBase}\nStatus: /v1/private-mode/status\nPDF conversion: ${PRIVATE_DOCUMENT_CONVERSION_PATH}\n`, corsHeaders);
         return;
       }
 

package/lib/statusContract.js

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto';
 export const PRIVATE_MODE_FRONTEND_SUPPORTED_FEATURES = Object.freeze([
   'text_chat',
   'vision_image_inputs',
+  'encrypted_pdf_conversion',
   'streaming',
   'conversation_history',
   'model_settings',
@@ -10,7 +11,7 @@ export const PRIVATE_MODE_FRONTEND_SUPPORTED_FEATURES = Object.freeze([
 ]);
 
 export const PRIVATE_MODE_FRONTEND_DISABLED_FEATURES = Object.freeze([
-  'non_image_attachments',
+  'non_image_non_pdf_attachments',
   'web_search',
   'url_scraped_content',
   'project_chats',

package/lib/transportTimeouts.js

@@ -5,6 +5,7 @@ export class PrivateModeDispatcher extends Agent {
   constructor(apiBase) {
     super();
     this.chatUrl = new URL(`${apiBase.replace(/\/+$/, '')}/api/v1/private/tinfoil/v1/chat/completions`);
+    this.documentUrl = new URL(`${apiBase.replace(/\/+$/, '')}/api/v1/private/tinfoil/v1/convert/file`);
   }
 
   dispatch(options, handler) {
@@ -12,7 +13,9 @@ export class PrivateModeDispatcher extends Agent {
     // dispatcher. Scope the CLI's override to its configured encrypted endpoint.
     // Override dispatch options, not Agent defaults: fetch supplies its own
     // five-minute timeout values on every dispatch.
-    if (String(options.origin) === this.chatUrl.origin && options.path === this.chatUrl.pathname) {
+    const isPrivateModeRoute = String(options.origin) === this.chatUrl.origin
+      && (options.path === this.chatUrl.pathname || options.path === this.documentUrl.pathname);
+    if (isPrivateModeRoute) {
       options = {
         ...options,
         headersTimeout: PRIVATE_MODE_STREAM_ROUTE_MAX_DURATION_MS,

package/models/private-tee.json

@@ -1,17 +1,17 @@
 [
   {
-    "id": "private/deepseek-v4-flash",
-    "name": "DeepSeek V4 Flash 0731 Private",
-    "upstreamModel": "deepseek-v4-flash",
-    "billingModel": "private/deepseek-v4-flash",
-    "providerPricingModel": "TEE/deepseek-v4-flash",
-    "teeTargetModel": "deepseek-v4-flash",
-    "thinkingMode": "deepseek-v4",
+    "id": "private/deepseek-v4-1-flash",
+    "name": "DeepSeek V4.1 Flash Private",
+    "upstreamModel": "deepseek-v4-1-flash",
+    "billingModel": "TEE/deepseek-v4.1-flash",
+    "providerPricingModel": "TEE/deepseek-v4.1-flash",
+    "teeTargetModel": "deepseek-v4-1-flash",
+    "thinkingMode": "deepseek-v4.1",
     "maxInputTokens": 1048576,
-    "maxOutputTokens": 1048576,
-    "created": 1786406400,
+    "maxOutputTokens": 384000,
+    "created": 1789084800,
     "ownedBy": "nanogpt-private-mode",
-    "aliases": ["TEE/deepseek-v4-flash"]
+    "aliases": ["private/deepseek-v4.1-flash", "TEE/deepseek-v4.1-flash"]
   },
   {
     "id": "private/kimi-k3",
@@ -48,34 +48,6 @@
     "ownedBy": "nanogpt-private-mode",
     "aliases": ["private/llama-3.3-70b", "TEE/llama3-3-70b"]
   },
-  {
-    "id": "private/glm-5-2",
-    "name": "GLM 5.2 Private",
-    "upstreamModel": "glm-5-2",
-    "billingModel": "TEE/glm-5-2",
-    "providerPricingModel": "TEE/glm-5.2",
-    "teeTargetModel": "glm-5-2",
-    "thinkingMode": "glm-5.2",
-    "maxInputTokens": 393216,
-    "maxOutputTokens": 131072,
-    "created": 1781827200,
-    "ownedBy": "nanogpt-private-mode",
-    "aliases": ["private/glm-5.2", "TEE/glm-5-2", "TEE/glm-5.2"]
-  },
-  {
-    "id": "private/glm-5-2:thinking",
-    "name": "GLM 5.2 Thinking Private",
-    "upstreamModel": "glm-5-2",
-    "billingModel": "TEE/glm-5-2:thinking",
-    "providerPricingModel": "TEE/glm-5.2:thinking",
-    "teeTargetModel": "glm-5-2",
-    "thinkingMode": "glm-5.2",
-    "maxInputTokens": 393216,
-    "maxOutputTokens": 131072,
-    "created": 1781827200,
-    "ownedBy": "nanogpt-private-mode",
-    "aliases": ["private/glm-5.2:thinking", "TEE/glm-5-2:thinking", "TEE/glm-5.2:thinking"]
-  },
   {
     "id": "private/glm-5-3",
     "name": "GLM 5.3 Private",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanogpt/private-mode",
-  "version": "0.2.14",
+  "version": "0.2.18",
   "description": "OpenAI-compatible localhost proxy for NanoGPT Private Mode.",
   "type": "module",
   "publishConfig": {
@@ -15,6 +15,7 @@
     "lib/cacheScope.js",
     "lib/catalogCompatibility.js",
     "lib/constants.js",
+    "lib/documentConversion.js",
     "lib/originPolicy.js",
     "lib/packageInfo.js",
     "lib/requestTransforms.js",