@nanogpt/private-mode 0.2.8 → 0.2.9

package/lib/requestTransforms.js

@@ -14,8 +14,7 @@ const MAX_TOKEN_ALIAS_FIELDS = [
 ];
 const KIMI_K3_STANDARD_DEFAULT_MAX_COMPLETION_TOKENS = 16_384;
 const KIMI_K3_DEFAULT_MAX_COMPLETION_TOKENS = 65_536;
-const KIMI_K3_MAX_COMPLETION_TOKENS = 1_048_576;
-const KIMI_K3_CONTEXT_WINDOW_TOKENS = 1_048_576;
+const KIMI_K3_PRIVATE_CONTEXT_WINDOW_TOKENS = 256_000;
 const KIMI_K3_CONTEXT_SAFETY_MARGIN_TOKENS = 10;
 const KIMI_K3_ESTIMATED_TEXT_BYTES_PER_TOKEN = 3;
 const KIMI_K3_HIGH_ENTROPY_TEXT_MIN_LENGTH = 2_048;
@@ -549,8 +548,18 @@ function resolvePrivateModeKimiK3ReasoningEffort(body) {
   return excludesReasoning ? normalizedEffort ?? 'low' : normalizedEffort ?? 'max';
 }
 
-function applyPrivateModeKimiK3RequestParams(body) {
+function applyPrivateModeKimiK3RequestParams(body, model) {
   const reasoningEffort = resolvePrivateModeKimiK3ReasoningEffort(body);
+  const contextWindowTokens = typeof model.maxInputTokens === 'number'
+    && Number.isFinite(model.maxInputTokens)
+    && model.maxInputTokens > 0
+      ? Math.floor(model.maxInputTokens)
+      : KIMI_K3_PRIVATE_CONTEXT_WINDOW_TOKENS;
+  const maxCompletionTokens = typeof model.maxOutputTokens === 'number'
+    && Number.isFinite(model.maxOutputTokens)
+    && model.maxOutputTokens > 0
+      ? Math.floor(model.maxOutputTokens)
+      : contextWindowTokens;
   const requestedMaxTokens = typeof body.max_tokens === 'number' && Number.isFinite(body.max_tokens)
     ? body.max_tokens
     : undefined;
@@ -559,13 +568,13 @@ function applyPrivateModeKimiK3RequestParams(body) {
       ? KIMI_K3_DEFAULT_MAX_COMPLETION_TOKENS
       : KIMI_K3_STANDARD_DEFAULT_MAX_COMPLETION_TOKENS
     : requestedMaxTokens < 0
-      ? KIMI_K3_MAX_COMPLETION_TOKENS
+      ? maxCompletionTokens
       : requestedMaxTokens;
   normalizePrivateModeKimiK3NamedToolChoice(body);
   const promptTokenEstimate = estimatePrivateModeKimiK3PromptTokens(body);
   const remainingContext = Math.max(
     1,
-    KIMI_K3_CONTEXT_WINDOW_TOKENS -
+    contextWindowTokens -
       promptTokenEstimate -
       KIMI_K3_CONTEXT_SAFETY_MARGIN_TOKENS,
   );
@@ -899,7 +908,7 @@ export function applyPrivateModelRequestMutations(body, model) {
   normalizeStreamOptions(body);
   applyTinfoilCompatibilityMutations(body, model);
   if (isPrivateModeKimiK3Model(model)) {
-    applyPrivateModeKimiK3RequestParams(body);
+    applyPrivateModeKimiK3RequestParams(body, model);
   } else if (model.thinkingMode === 'deepseek-v4') {
     clampPrivateModeDeepSeekV4Output(body);
   }

package/lib/secureClientLifecycle.js

@@ -1,5 +1,40 @@
 const DEFAULT_SECURE_CLIENT_IDLE_RESET_MS = 5 * 60 * 1000;
+const DEFAULT_VERIFICATION_MAX_AGE_MS = 5 * 60 * 1000;
 const EHBP_RESPONSE_NONCE_HEADER = 'ehbp-response-nonce';
+const REQUIRED_VERIFICATION_STEPS = [
+  'fetchDigest',
+  'verifyCode',
+  'verifyEnclave',
+  'compareMeasurements',
+];
+
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function hasCompleteVerificationEvidence(document) {
+  return document?.securityVerified === true
+    && isNonEmptyString(document.codeFingerprint)
+    && isNonEmptyString(document.enclaveFingerprint)
+    && isNonEmptyString(document.releaseDigest)
+    && isNonEmptyString(document.hpkePublicKey)
+    && REQUIRED_VERIFICATION_STEPS.every(
+      (step) => document.steps?.[step]?.status === 'success',
+    )
+    && !Object.values(document.steps || {}).some((step) => step?.status === 'failed');
+}
+
+function isMeasurementMismatchError(error) {
+  let current = error;
+  for (let depth = 0; depth < 5 && current; depth += 1) {
+    const message = String(current.message || current);
+    if (/\b(?:code\s+)?measurement mismatch\b|\bcannot compare measurements\b/i.test(message)) {
+      return true;
+    }
+    current = current.cause;
+  }
+  return false;
+}
 
 function readSecureClientIdleResetMs() {
   const configured = process.env.NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS?.trim();
@@ -14,9 +49,14 @@ export function createSecureState(apiBase, options = {}) {
     : readSecureClientIdleResetMs();
   const loadTinfoil = options.loadTinfoil || (() => import('tinfoil'));
   const now = options.now || Date.now;
+  const verificationMaxAgeMs = Number.isFinite(options.verificationMaxAgeMs)
+    && options.verificationMaxAgeMs >= 0
+    ? Math.floor(options.verificationMaxAgeMs)
+    : DEFAULT_VERIFICATION_MAX_AGE_MS;
   let clientState = null;
   let verificationDocument = null;
   let verificationError = null;
+  let verifiedAtMs = null;
 
   async function getClient(userCacheSecret = clientState?.userCacheSecret) {
     if (!userCacheSecret) {
@@ -24,12 +64,18 @@ export function createSecureState(apiBase, options = {}) {
     }
     const nowMs = now();
     const idleMs = clientState ? nowMs - clientState.lastUsedAtMs : 0;
+    const verificationAgeMs = verifiedAtMs === null ? 0 : nowMs - verifiedAtMs;
     if (
       clientState?.userCacheSecret === userCacheSecret
       && (
         idleResetMs === 0
         || (idleMs >= 0 && idleMs < idleResetMs)
       )
+      && (
+        verifiedAtMs === null
+        || verificationMaxAgeMs === 0
+        || (verificationAgeMs >= 0 && verificationAgeMs < verificationMaxAgeMs)
+      )
     ) {
       clientState.lastUsedAtMs = nowMs;
       return clientState.promise;
@@ -40,6 +86,7 @@ export function createSecureState(apiBase, options = {}) {
     // still be finishing an older in-flight request.
     verificationDocument = null;
     verificationError = null;
+    verifiedAtMs = null;
     const nextState = {
       client: null,
       lastUsedAtMs: nowMs,
@@ -54,10 +101,19 @@ export function createSecureState(apiBase, options = {}) {
         transport: 'ehbp',
         userCacheSecret,
       });
-      await client.ready();
       nextState.client = client;
+      try {
+        await client.ready();
+      } finally {
+        if (clientState === nextState) {
+          verificationDocument = client.getVerificationDocument();
+        }
+      }
+      if (!hasCompleteVerificationEvidence(verificationDocument)) {
+        throw new Error('Private Mode attestation evidence was incomplete.');
+      }
       if (clientState === nextState) {
-        verificationDocument = client.getVerificationDocument();
+        verifiedAtMs = now();
         verificationError = null;
       }
       return client;
@@ -80,7 +136,23 @@ export function createSecureState(apiBase, options = {}) {
     getClient,
     markClientUsed(client) {
       if (!clientState || clientState.client !== client) return false;
-      clientState.lastUsedAtMs = now();
+      const nowMs = now();
+      const currentDocument = client.getVerificationDocument();
+      if (currentDocument !== verificationDocument) {
+        verificationDocument = currentDocument;
+        if (hasCompleteVerificationEvidence(currentDocument)) {
+          verifiedAtMs = nowMs;
+          verificationError = null;
+        } else {
+          verifiedAtMs = null;
+          // Preserve the incomplete document for status visibility, but never
+          // reuse a transport after the SDK has invalidated its evidence.
+          clientState.lastUsedAtMs = nowMs;
+          clientState = null;
+          return true;
+        }
+      }
+      clientState.lastUsedAtMs = nowMs;
       return true;
     },
     invalidateClient(client) {
@@ -89,11 +161,49 @@ export function createSecureState(apiBase, options = {}) {
       clientState = null;
       verificationDocument = null;
       verificationError = null;
+      verifiedAtMs = null;
       return true;
     },
     getVerificationState() {
+      const nowMs = now();
+      // Tinfoil 1.1.12 resets its document to "pending" after an exhausted
+      // AttestationError retry, so retain the SDK's explicit mismatch signal.
+      const mismatch = verificationDocument?.steps?.compareMeasurements?.status === 'failed'
+        || isMeasurementMismatchError(verificationError);
+      const verified = hasCompleteVerificationEvidence(verificationDocument)
+        && !mismatch
+        && verifiedAtMs !== null;
+      const verificationAgeMs = verifiedAtMs === null ? null : nowMs - verifiedAtMs;
+      const clockRolledBack = verificationAgeMs !== null && verificationAgeMs < 0;
+      const expiresAtMs = verifiedAtMs === null || verificationMaxAgeMs === 0
+        ? null
+        : verifiedAtMs + verificationMaxAgeMs;
+      const isStale = verified && (
+        clockRolledBack
+        || (expiresAtMs !== null && nowMs >= expiresAtMs)
+      );
+      const freshnessSeconds = expiresAtMs === null
+        ? null
+        : clockRolledBack
+          ? 0
+          : Math.max(0, Math.floor((expiresAtMs - nowMs) / 1000));
+      const verificationStatus = mismatch
+        ? 'measurement_mismatch'
+        : verified && verifiedAtMs !== null
+          ? isStale
+            ? 'stale'
+            : 'verified'
+          : verificationError || verificationDocument
+            ? 'verification_failed'
+            : 'not_checked';
       return {
-        verified: verificationDocument?.securityVerified === true,
+        verified,
+        verificationStatus,
+        verifiedAt: verifiedAtMs === null ? null : new Date(verifiedAtMs).toISOString(),
+        expiresAt: expiresAtMs === null
+          ? null
+          : new Date(expiresAtMs).toISOString(),
+        freshnessSeconds,
         verificationDocument,
         error: verificationError ? String(verificationError.message || verificationError) : null,
       };

package/lib/server.js

@@ -23,7 +23,10 @@ import {
   createSecureState,
   fetchWithSecureClientRecovery,
 } from './secureClientLifecycle.js';
-import { buildPrivateModeStatusContract } from './statusContract.js';
+import {
+  buildPrivateModeStatusContract,
+  buildPublicAttestationSummary,
+} from './statusContract.js';
 
 const MODELS = JSON.parse(
   readFileSync(new URL('../models/private-tee.json', import.meta.url), 'utf8'),
@@ -82,6 +85,7 @@ function openAIModelList() {
 }
 
 export function privateModeStatus(apiBase, secureState, localBase, originPolicy) {
+  const verificationState = secureState.getVerificationState();
   return {
     ok: true,
     mode: 'private_tee',
@@ -99,10 +103,10 @@ export function privateModeStatus(apiBase, secureState, localBase, originPolicy)
     streaming_billing: 'precharged_reserve_with_verified_usage_refund',
     api_local_proxy_required: true,
     browser_frontend_local_proxy_required: false,
-    ...buildPrivateModeStatusContract(),
+    ...buildPrivateModeStatusContract(verificationState),
     browser_origins_allowed: originPolicy.allowedOrigins,
     models: openAIModelList().data,
-    attestation: secureState.getVerificationState(),
+    attestation: buildPublicAttestationSummary(verificationState),
   };
 }
 

package/lib/statusContract.js

@@ -1,3 +1,5 @@
+import { createHash } from 'node:crypto';
+
 export const PRIVATE_MODE_FRONTEND_SUPPORTED_FEATURES = Object.freeze([
   'text_chat',
   'streaming',
@@ -43,12 +45,88 @@ export const PRIVATE_MODE_PLAINTEXT_VISIBLE_TO = Object.freeze([
   'verified_tee_target',
 ]);
 
-export function buildPrivateModeStatusContract() {
+export const PRIVATE_MODE_KNOWN_LIMITATIONS = Object.freeze([
+  'NanoGPT still observes account, routing, timing, size, status, and usage metadata.',
+  'Provider-reported usage metrics are trusted for billing and are not end-to-end signed.',
+  'A verification receipt does not prove usage correctness, prompt non-retention, or response content authenticity on its own.',
+  'Verification receipts are browser-generated and unsigned; the hashed request identifier is for opaque correlation, not proof of server issuance.',
+  'NanoGPT does not implement attestation-gated KMS release of upstream credentials; the inference enclave is provider-operated.',
+]);
+
+const PRIVATE_MODE_VERIFICATION_STATUSES = new Set([
+  'verified',
+  'unavailable',
+  'stale',
+  'measurement_mismatch',
+  'verification_failed',
+  'unsupported',
+  'not_checked',
+]);
+
+function stringIdentifier(value) {
+  return typeof value === 'string' && value.trim() ? value.trim().slice(0, 512) : undefined;
+}
+
+function publicKeyFingerprint(value) {
+  return typeof value === 'string' && value
+    ? createHash('sha256').update(value).digest('hex')
+    : undefined;
+}
+
+export function buildPublicAttestationSummary(verificationState = {}) {
+  return {
+    verified: verificationState.verified === true,
+    verificationStatus: verificationState.verificationStatus,
+    verifiedAt: verificationState.verifiedAt,
+    expiresAt: verificationState.expiresAt,
+    freshnessSeconds: verificationState.freshnessSeconds,
+    error: verificationState.error ? 'Private Mode attestation failed.' : null,
+  };
+}
+
+export function buildPrivateModeStatusContract(verificationState = {}) {
+  const verificationStatus = PRIVATE_MODE_VERIFICATION_STATUSES.has(verificationState.verificationStatus)
+    ? verificationState.verificationStatus
+    : 'not_checked';
+  const document = verificationState.verificationDocument || {};
+  const keyFingerprint = publicKeyFingerprint(document.hpkePublicKey);
   return {
     frontend_supported_features: [...PRIVATE_MODE_FRONTEND_SUPPORTED_FEATURES],
     frontend_disabled_features: [...PRIVATE_MODE_FRONTEND_DISABLED_FEATURES],
     nanogpt_visible: [...PRIVATE_MODE_NANOGPT_VISIBLE],
     encrypted_from_nanogpt: [...PRIVATE_MODE_ENCRYPTED_FROM_NANOGPT],
     plaintext_visible_to: [...PRIVATE_MODE_PLAINTEXT_VISIBLE_TO],
+    assurance: {
+      contract_version: 1,
+      assurance_level: 'private_mode',
+      transport: 'ehbp',
+      verification_status: verificationStatus,
+      eligible: verificationStatus === 'verified',
+      verified_by: verificationState.verifiedAt || verificationStatus !== 'not_checked'
+        ? ['local_proxy:tinfoil-js']
+        : [],
+      ...(verificationState.verifiedAt ? { verified_at: verificationState.verifiedAt } : {}),
+      ...(verificationState.expiresAt ? { expires_at: verificationState.expiresAt } : {}),
+      ...(Number.isFinite(verificationState.freshnessSeconds)
+        ? { freshness_seconds: Math.max(0, Math.floor(verificationState.freshnessSeconds)) }
+        : {}),
+      ...(stringIdentifier(document.codeFingerprint)
+        ? { expected_measurement: stringIdentifier(document.codeFingerprint) }
+        : {}),
+      ...(stringIdentifier(document.enclaveFingerprint)
+        ? { observed_measurement: stringIdentifier(document.enclaveFingerprint) }
+        : {}),
+      ...(stringIdentifier(document.releaseDigest)
+        ? { release_digest: stringIdentifier(document.releaseDigest) }
+        : {}),
+      ...(keyFingerprint ? { public_key_fingerprint: keyFingerprint } : {}),
+      receipt_available: true,
+      verifier: { name: 'tinfoil-js', version: '1.1.12' },
+      documentation_url: 'https://nano-gpt.com/private-mode-verification',
+      known_limitations: [...PRIVATE_MODE_KNOWN_LIMITATIONS],
+      ...(verificationStatus !== 'verified' && verificationStatus !== 'not_checked'
+        ? { error_code: verificationStatus }
+        : {}),
+    },
   };
 }

package/lib/verifyReceipt.js

@@ -2,6 +2,9 @@ import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { fetchAttestationBundle, Verifier } from 'tinfoil';
 
+const PRIVATE_MODE_ATTESTATION_MAX_AGE_MS = 5 * 60 * 1000;
+const PRIVATE_MODE_RECEIPT_CLOCK_SKEW_MS = 60 * 1000;
+
 function isRecord(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
@@ -84,7 +87,7 @@ function assertReceiptFlag(failures, label, value) {
 }
 
 export async function verifyPrivateModeReceipt(receipt) {
-  if (!isRecord(receipt) || receipt.schemaVersion !== 1) {
+  if (!isRecord(receipt) || (receipt.schemaVersion !== 1 && receipt.schemaVersion !== 2)) {
     throw new Error('Unsupported or invalid Private Mode receipt.');
   }
 
@@ -113,6 +116,29 @@ export async function verifyPrivateModeReceipt(receipt) {
   if (receipt.status !== 'verified') {
     failures.push(`Receipt status is ${receipt.status || 'missing'}; expected verified.`);
   }
+  if (receipt.schemaVersion === 2) {
+    if (receipt.assuranceLevel !== 'private_mode') {
+      failures.push('Receipt assurance level is not private_mode.');
+    }
+    const verifiedAt = Date.parse(receipt.verifiedAt);
+    const expiresAt = Date.parse(receipt.expiresAt);
+    const now = Date.now();
+    if (
+      !Number.isFinite(verifiedAt)
+      || !Number.isFinite(expiresAt)
+      || expiresAt <= verifiedAt
+      || expiresAt - verifiedAt > PRIVATE_MODE_ATTESTATION_MAX_AGE_MS
+      || verifiedAt > now + PRIVATE_MODE_RECEIPT_CLOCK_SKEW_MS
+    ) {
+      failures.push('Receipt freshness timestamps are invalid.');
+    } else if (expiresAt <= now) {
+      warnings.push('Receipt attestation freshness window has expired; fresh evidence was verified again now.');
+    }
+    const requestIdSha256 = receipt.response?.requestIdSha256;
+    if (requestIdSha256 !== undefined && !/^[a-f0-9]{64}$/i.test(requestIdSha256)) {
+      failures.push('Request identifier binding is not a SHA-256 digest.');
+    }
+  }
 
   const encryption = isRecord(receipt.encryption) ? receipt.encryption : {};
   if (encryption.transport !== 'EHBP') {
@@ -126,6 +152,16 @@ export async function verifyPrivateModeReceipt(receipt) {
   assertRequiredEqual(failures, 'Runtime measurement', doc?.enclaveFingerprint, receipt.verifier?.enclaveFingerprint);
   assertRequiredEqual(failures, 'Release digest', doc?.releaseDigest, receipt.verifier?.releaseDigest);
   assertRequiredEqual(failures, 'HPKE public key', doc?.hpkePublicKey, receipt.verifier?.hpkePublicKey);
+  if (receipt.schemaVersion === 2) {
+    assertRequiredEqual(
+      failures,
+      'HPKE public-key fingerprint',
+      isNonEmptyString(doc?.hpkePublicKey)
+        ? createHash('sha256').update(doc.hpkePublicKey).digest('hex')
+        : undefined,
+      receipt.verifier?.hpkePublicKeySha256,
+    );
+  }
   assertOptionalEqual(warnings, 'Attestation bundle SHA-256', attestationBundleSha256, receipt.verifier?.attestationBundleSha256);
 
   return {
@@ -137,6 +173,7 @@ export async function verifyPrivateModeReceipt(receipt) {
     enclaveFingerprint: doc?.enclaveFingerprint,
     attestationBundleSha256,
     verificationDocumentSha256,
+    schemaVersion: receipt.schemaVersion,
   };
 }
 
@@ -155,6 +192,7 @@ export async function verifyPrivateModeReceiptCli(positionals, io = process) {
   }
 
   io.stdout.write('Private Mode receipt verified.\n');
+  io.stdout.write(`Receipt schema: v${result.schemaVersion}\n`);
   io.stdout.write(`Enclave: ${result.enclaveURL}\n`);
   io.stdout.write(`Expected measurement: ${result.codeFingerprint}\n`);
   io.stdout.write(`Runtime measurement: ${result.enclaveFingerprint}\n`);

package/models/private-tee.json

@@ -4,6 +4,7 @@
     "name": "DeepSeek V4 Flash Private",
     "upstreamModel": "deepseek-v4-flash",
     "billingModel": "private/deepseek-v4-flash",
+    "providerPricingModel": "TEE/deepseek-v4-flash",
     "teeTargetModel": "deepseek-v4-flash",
     "thinkingMode": "deepseek-v4",
     "maxOutputTokens": 1048576,
@@ -16,8 +17,10 @@
     "name": "Kimi K3 Private",
     "upstreamModel": "kimi-k3",
     "billingModel": "TEE/kimi-k3",
+    "providerPricingModel": "TEE/kimi-k3",
     "teeTargetModel": "kimi-k3",
-    "maxOutputTokens": 1048576,
+    "maxInputTokens": 256000,
+    "maxOutputTokens": 256000,
     "created": 1786147200,
     "ownedBy": "nanogpt-private-mode",
     "aliases": ["TEE/kimi-k3"]
@@ -27,6 +30,7 @@
     "name": "GPT OSS 120B Private",
     "upstreamModel": "gpt-oss-120b",
     "billingModel": "TEE/gpt-oss-120b",
+    "providerPricingModel": "openai/gpt-oss-120b",
     "teeTargetModel": "gpt-oss-120b",
     "created": 1764547200,
     "ownedBy": "nanogpt-private-mode",
@@ -37,6 +41,7 @@
     "name": "Llama 3.3 70B Private",
     "upstreamModel": "llama3-3-70b",
     "billingModel": "TEE/llama3-3-70b",
+    "providerPricingModel": "meta-llama/llama-3.3-70b-instruct",
     "teeTargetModel": "llama3-3-70b",
     "created": 1764547200,
     "ownedBy": "nanogpt-private-mode",
@@ -47,6 +52,7 @@
     "name": "GLM 5.2 Private",
     "upstreamModel": "glm-5-2",
     "billingModel": "TEE/glm-5-2",
+    "providerPricingModel": "TEE/glm-5.2",
     "teeTargetModel": "glm-5-2",
     "thinkingMode": "glm-5.2",
     "created": 1781827200,
@@ -58,6 +64,7 @@
     "name": "GLM 5.2 Thinking Private",
     "upstreamModel": "glm-5-2",
     "billingModel": "TEE/glm-5-2:thinking",
+    "providerPricingModel": "TEE/glm-5.2:thinking",
     "teeTargetModel": "glm-5-2",
     "thinkingMode": "glm-5.2",
     "created": 1781827200,
@@ -69,6 +76,7 @@
     "name": "Gemma 4 31B Private",
     "upstreamModel": "gemma4-31b",
     "billingModel": "TEE/gemma4-31b",
+    "providerPricingModel": "TEE/gemma4-31b",
     "teeTargetModel": "gemma4-31b",
     "thinkingMode": "gemma",
     "created": 1764547200,
@@ -80,6 +88,7 @@
     "name": "Gemma 4 31B Thinking Private",
     "upstreamModel": "gemma4-31b",
     "billingModel": "TEE/gemma4-31b:thinking",
+    "providerPricingModel": "TEE/gemma4-31b:thinking",
     "teeTargetModel": "gemma4-31b",
     "thinkingMode": "gemma",
     "created": 1764547200,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanogpt/private-mode",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "OpenAI-compatible localhost proxy for NanoGPT Private Mode.",
   "type": "module",
   "publishConfig": {