pi-privacy 0.2.0 → 0.3.0

package/README.md

@@ -43,6 +43,7 @@ them look the same.
 | `nearai` | Verified TEE | Attestation report (Intel TDX + NVIDIA CC) fetched over HTTPS, bound to a fresh nonce |
 | `openrouter` | ZDR (posture-aware) | `zdr-policy` until enforcement pins routing → `zdr-enforced` |
 | `venice`, `fireworks` | ZDR (by policy) | Provider policy; honest limits noted (e.g. Venice is not TEE-attested) |
+| `privateer-api` | ZDR (by policy) | Privateer developer key (`sk-priv-…`); server-proxied inference — the proxy mediates attestation, so it's a zero-retention *policy*, not a client-verified enclave |
 | `ollama`, `custom` | On-device | Detected when the endpoint is a loopback URL |
 
 Providers with no verifiable or default privacy channel (Together, DeepSeek, MiniMax,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-privacy",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Privacy posture + TEE attestation for Pi providers: cryptographically verified confidential-enclave (TEE) inference, enforced/labeled zero-data-retention (ZDR), and on-device detection — honestly graded so a verified guarantee never reads like a claimed one.",
   "type": "module",
   "license": "MIT",
@@ -25,7 +25,9 @@
     "sev-snp"
   ],
   "pi": {
-    "extensions": ["./extensions"]
+    "extensions": [
+      "./extensions"
+    ]
   },
   "exports": {
     ".": "./src/index.ts",
@@ -54,8 +56,12 @@
     "@earendil-works/pi-ai": ">=0.80.0"
   },
   "peerDependenciesMeta": {
-    "@earendil-works/pi-coding-agent": { "optional": true },
-    "@earendil-works/pi-ai": { "optional": true }
+    "@earendil-works/pi-coding-agent": {
+      "optional": true
+    },
+    "@earendil-works/pi-ai": {
+      "optional": true
+    }
   },
   "dependencies": {
     "undici": "^7.28.0"

package/src/attest/attestation.ts

@@ -115,7 +115,12 @@ export function interpretReport(modelId: string, nonce: string, raw: unknown): A
   const hardware: string[] = [];
   if (/nvidia|gpu/.test(blob)) hardware.push("NVIDIA");
   if (/intel|tdx/.test(blob)) hardware.push("Intel TDX");
-  const nonceEchoed = blob.includes(nonce.toLowerCase());
+  // Freshness/anti-replay: our nonce must appear in the report. Require a non-trivial
+  // nonce — a real attestation nonce is 32 bytes (64 hex, see randomNonce). Guard
+  // against an empty/short nonce, since blob.includes("") is vacuously true and would
+  // score a missing nonce as "echoed" (matters when the nonce is externally supplied,
+  // e.g. a server-proxied report rather than one bound to our own randomNonce).
+  const nonceEchoed = nonce.length >= 16 && blob.includes(nonce.toLowerCase());
 
   return { model: modelId, nonce, signingAddress, nonceEchoed, hardware, raw };
 }

package/src/extension.ts

@@ -70,8 +70,9 @@ export interface PiPrivacyOptions {
   // Install the process-wide attestation dispatcher (default true). Set false if the
   // host already installed one (e.g. privateer-agent's boot.ts).
   installDispatcher?: boolean;
-  // Register the config-only privacy providers (tinfoil/nearai/venice/ollama) with
-  // seed models (default true). Built-in providers (openrouter/fireworks) are left
+  // Register the config-only privacy providers (tinfoil/nearai/venice/ollama/
+  // privateer-api) with seed models (default true). Built-in providers
+  // (openrouter/fireworks) are left
   // to Pi so their model listings aren't clobbered.
   registerProviders?: boolean;
   // Enforce OpenRouter ZDR routing (default false — opt-in, since a model with no
@@ -103,6 +104,7 @@ const SEED_MODELS: Record<string, string> = {
   nearai: "zai-org/GLM-5.1-FP8",
   venice: "qwen3-coder-480b-a35b-instruct-turbo",
   ollama: "llama3.1",
+  "privateer-api": "near/zai-org/GLM-5.1-FP8",
 };
 
 function registerable(p: PrivacyProvider): boolean {

package/src/providers/catalog.ts

@@ -80,6 +80,19 @@ export const PRIVACY_PROVIDERS: PrivacyProvider[] = [
     // FireFunction may log. Not TEE-attested.
     note: "fireworks.ai → API Keys (open models: zero retention by default, not TEE-attested; Fireworks's own f1/FireFunction may log).",
   },
+  {
+    id: "privateer-api",
+    label: "Privateer (developer API)",
+    tier: "zdr-policy",
+    baseUrl: "https://api.privateer.pro/v1",
+    api: "openai-completions",
+    keyEnv: "${PRIVATEER_API_KEY}",
+    // Honest copy: a server-proxied developer key (sk-priv-…). Privateer asserts
+    // zero retention, but the proxy mediates attestation — a pi client can't verify
+    // the underlying enclave end-to-end through it — so this is POLICY, not a
+    // client-verified TEE. (Verified-TEE access is the in-app account channel's job.)
+    note: "privateer.pro → API keys (sk-priv-…). Server-proxied, zero-retention by policy; NOT TEE-attested end-to-end (the proxy mediates attestation).",
+  },
   {
     id: "openrouter",
     label: "OpenRouter",