privateer-agent 0.10.0 → 0.12.0

package/src/providers/sealedShim.ts

@@ -40,13 +40,22 @@ import { iterateSSE } from "./phala/sse.ts";
 // (unsealed) path, not sealed. See docs/tee-verified-tinfoil-ehbp.md §12.
 export type SealedProvider = "tinfoil" | "phala";
 
-// Sealed mode is OFF until verified end-to-end against a live relay (a real EHBP
-// round-trip needs the deployed relay + TINFOIL_API_KEY; see the live checklist in
-// docs/tee-privateer-tinfoil-ehbp.md). Off = the current plaintext path + honest
-// yellow badge, untouched. Flip with PRIVATEER_SEALED=1.
+// Sealed mode is ON by default as of 2026-07-31, when the live checklist in
+// docs/tee-verified-tinfoil-ehbp.md passed end to end against the deployed relay:
+// both enclaves attest client-side (Tinfoil HPKE-key match; Phala report binding +
+// TDX quote), a sealed turn round-trips and streams incrementally, a bogus enclave is
+// refused rather than silently greened, and the server bills the turn.
+//
+// What it buys: the prompt is sealed to the enclave the client itself attested, so the
+// badge is a quote WE checked rather than the account's word — green instead of
+// "Trusted Execution (unconfirmed)".
+//
+// PRIVATEER_SEALED=0 (or =false) drops back to the cleartext `/api/agent/v1` path and
+// the honest yellow badge. Note that is a real downgrade for `phala/*`, which is
+// sealed-only and simply disappears from the catalog (see isServableAccountModel).
 export function sealedEnabled(): boolean {
   const v = process.env.PRIVATEER_SEALED;
-  return v === "1" || v === "true";
+  return !(v === "0" || v === "false");
 }
 
 // The sealed provider a model id routes through, or null if it isn't a sealed
@@ -151,7 +160,12 @@ export function buildForward(
     // Not JSON — forward unchanged (X-Sealed-Model stays "unknown"; relay logs it).
   }
   const headers: Record<string, string> = {
-    "Content-Type": "application/json",
+    // MUST carry the charset. EHBP seals the body but headers travel in cleartext
+    // (tinfoil/dist/encrypted-body-fetch.js: "EHBP only seals the body"), so this
+    // Content-Type is what the enclave's router actually validates — and it rejects a
+    // bare `application/json` with "Unsupported Media Type: Only 'application/json' is
+    // allowed" (verified live 2026-07-31: bare → 400, any `charset=` variant → 200).
+    "Content-Type": "application/json; charset=utf-8",
     "X-Sealed-Model": sealedModel,
   };
   if (authHeader) headers.Authorization = authHeader;
@@ -165,6 +179,7 @@ const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
 
 let shimBase: string | null = null;
 let shimStarting: Promise<string> | null = null;
+let shimServer: http.Server | null = null;
 
 // The shim's base URL once listening, else null. account.ts reads this to decide
 // whether a sealed model can point its baseUrl at the shim yet.
@@ -179,6 +194,19 @@ export function ensureSealedShim(): Promise<string> {
   return shimStarting;
 }
 
+// Close the shim and forget it, so a later ensureSealedShim() starts a fresh one.
+// The listener is `unref`'d and never blocks exit, so this is not needed for
+// shutdown — it exists so a caller that stops sealing (or a test) can drop the
+// socket deterministically rather than leaving a port open for the process lifetime.
+export function stopSealedShim(): Promise<void> {
+  const server = shimServer;
+  shimServer = null;
+  shimBase = null;
+  shimStarting = null;
+  if (!server) return Promise.resolve();
+  return new Promise((resolve) => server.close(() => resolve()));
+}
+
 function startShim(): Promise<string> {
   return new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
@@ -192,6 +220,7 @@ function startShim(): Promise<string> {
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
       if (addr && typeof addr === "object") {
+        shimServer = server;
         shimBase = `http://127.0.0.1:${addr.port}`;
         resolve(shimBase);
       } else {

package/src/remote/extensionsControl.ts

@@ -8,11 +8,11 @@
  * of these and route the extensions_* relay frames through it.
  *
  * Only the user's OWN packages surface here. The Privateer moat (privateer-*,
- * pi-privacy, rpiv-web-tools, …) is installed by bin/privateer-tui as shim .ts
- * files in the agent dir's extensions/ folder — auto-discovered, NOT recorded in
- * settings.json "packages". listConfiguredPackages() reads only "packages", so the
- * moat is naturally excluded. We keep a RESERVED name guard as defence in depth in
- * case a user ever hand-adds one of our package names.
+ * rpiv-web-tools, …) never appears in settings.json "packages": the launcher passes it to
+ * Pi as `-e` arguments, and the in-process entries build it from factories. So
+ * listConfiguredPackages(), which reads only "packages", excludes it naturally. The
+ * RESERVED guard is defence in depth for a user who hand-adds one of our names — which
+ * would load a second copy of an extension the moat already supplies.
  *
  * Framework-agnostic: nothing here imports React or the relay. The caller owns the
  * frame plumbing and hands us a SettingsManager (the REPL reuses the session's;
@@ -20,6 +20,7 @@
  */
 import { DefaultPackageManager } from "@earendil-works/pi-coding-agent";
 import type { ProgressEvent, SettingsManager } from "@earendil-works/pi-coding-agent";
+import { reservedNames } from "../config/moatManifest.ts";
 
 // One installed extension as surfaced to the app. NON-PII: a package source
 // (npm:/git: spec) plus its scope — no cwd, no absolute paths beyond what Pi
@@ -49,23 +50,12 @@ export interface ExtensionsControl {
 // Package names we never manage from the app: the Privateer moat + adopted packs
 // installed as shims by the launcher. A guard only — listConfiguredPackages()
 // already omits them since they aren't settings "packages".
-const RESERVED = new Set([
-  "privateer-brand",
-  "privateer-context",
-  "privateer-gate",
-  "privateer-account",
-  "privateer-posture",
-  "privateer-tools",
-  "privateer-privacy",
-  "pi-privacy",
-  "pi-web-access",
-  "rpiv-web-tools",
-  "@juicesharp/rpiv-web-tools",
-  "pi-mcp-adapter",
-  "pi-hypa",
-  "@hypabolic/pi-hypa",
-  "pi-subagents",
-]);
+//
+// Derived from the shipping manifest rather than hand-listed. The hand-written version
+// had drifted: privateer-models and privateer-connect were shimmed by the launcher but
+// missing here, so the app would have offered to install a user package under a name the
+// launcher overwrites on every launch. See src/config/moatManifest.ts.
+const RESERVED = new Set(reservedNames());
 
 // The bare package name inside a source spec, for the RESERVED check. Strips the
 // npm:/git: scheme and any @version / #ref suffix; leaves scoped names intact.

package/src/remote/liveTaskSession.ts

@@ -18,19 +18,13 @@ import {
 import { agentDir } from "../config/paths.ts";
 import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
-import { makePermissionGate, isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
-import { makePiPrivacyExtension } from "pi-privacy";
-import {
-  makeAccountProvider,
-  privateerChannel,
-  rememberAccountCredential,
-  dropPersistedAccountCredential,
-} from "../providers/account.ts";
+import { isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
+import { moatResourceOptions } from "../config/moat.ts";
+import { rememberAccountCredential, dropPersistedAccountCredential } from "../providers/account.ts";
 import { RelayClient, type TaskSpec } from "./relayClient.ts";
 import { RemoteBridge } from "./remoteBridge.ts";
-import { makeRelayFileTools } from "../tools/relayFileTools.ts";
 import { AttachmentStore, type StoredAttachment } from "../util/attachmentStore.ts";
-import { spawnAccountCredentials, revokeAccountSession, hasCredentials } from "../auth/privateer.ts";
+import { spawnAccountCredentials, revokeAccountSession } from "../auth/privateer.ts";
 import { createUIContext } from "../ext/headlessUi.ts";
 import { noQuarterActive } from "../permissions/noQuarter.ts";
 
@@ -207,24 +201,21 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     onRemoteBlocked: (toolName) => bridge.sendNotice(`${toolName} is disabled while driving remotely — its prompts can't reach the app.`),
   };
 
+  // relayFiles binds send_file_to_client / save_attachment to THIS session's bridge — the
+  // one whose relay the app is attached to. The shipped gate extension is discovered into
+  // this session too but stands its own pair down inside the daemon, so these are the ones
+  // the model gets (see tools/relayFileTools.ts). Media generation is on for a live spawn:
+  // it is driven from the app, so "make me a video of X" is one of the things it is FOR —
+  // and the gate still routes each call to the phone for approval like any other write.
   const services = await createAgentSessionServices({
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      extensionFactories: [
-        makePermissionGate(gate),
-        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
-        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
-        makePiPrivacyExtension({
-          privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
-        }),
-        makeAccountProvider(),
-        // send_file_to_client / save_attachment bound to THIS session's bridge — the one
-        // whose relay the app is attached to. The shipped gate extension is discovered
-        // into this session too but stands its own pair down inside the daemon, so these
-        // are the ones the model gets (see tools/relayFileTools.ts).
-        makeRelayFileTools(bridge, attachments),
-      ] as any,
+      ...((await moatResourceOptions({
+        kind: "live-task",
+        gate,
+        relayFiles: { bridge, attachments },
+      })) as any),
     },
   });
   servicesRef = services as any;

package/src/remote/relayClient.ts

@@ -118,6 +118,11 @@ export interface RelayCallbacks {
   onNoQuarter?: (on: boolean) => void;
   // A controller attached — push a transcript snapshot so it can catch up.
   onControllerAttached: () => void;
+  // The last controller went away (app closed / socket reaped). The terminal keeps
+  // running; the owner should stop assuming anything it sends up is being read, and
+  // deliver finished work durably instead (the cloud outbox → the app's Inbox).
+  // Optional so callbacks that predate the frame keep compiling.
+  onControllerDetached?: () => void;
   // The app ran a slash command from its composer (e.g. "/model provider/id").
   // Routed to the same command dispatcher the local REPL uses. Optional so
   // callbacks that predate the app command UI keep compiling.
@@ -353,6 +358,11 @@ export class RelayClient {
   private heartbeatTimer: ReturnType<typeof setInterval> | undefined;
   private lastInboundAt = 0;
   private connectedAt = 0;
+  // Is somebody actually on the other end? An open socket is NOT the same thing —
+  // the server holds our frames' route open and simply drops what it forwards when
+  // no controller is attached, so without this an unwatched turn writes its answer
+  // into a socket nobody is reading. See hasController() and the `handle` note.
+  private controllerHere = false;
   // Current backoff delay for the next unqualified scheduleReconnect(); reset on 'open'.
   private reconnectDelay = RECONNECT_MS;
   // Last refusal reason reported, so a 4xx is logged once instead of on every retry.
@@ -507,6 +517,9 @@ export class RelayClient {
         this.stopHeartbeat();
         if (this.ws === ws) this.ws = null;
         this.connectedAt = 0;
+        // A dead socket means no controller is reachable, whatever the last
+        // attach/detach frame said. Re-learned on the next attach or inbound frame.
+        this.controllerHere = false;
         this.cb.onDisconnected?.();
         if (!this.closed) {
           this.cb.onStatus?.(
@@ -660,6 +673,12 @@ export class RelayClient {
       return;
     }
     this.debug(`recv ${frame.type}`);
+    // Presence, learned from the traffic itself. The server forwards a frame to us
+    // only when a controller sent it (or when it announces one attaching), so ANY
+    // inbound frame is proof somebody is on the other end — which matters because
+    // `controller_attached` is missed by a terminal whose own socket reconnected
+    // mid-session. Cleared by `controller_detached` and by a dead socket.
+    if (frame.type !== "controller_detached") this.controllerHere = true;
     switch (frame.type) {
       case "prompt":
         // Forward even an empty/whitespace prompt: a file-only send carries no text,
@@ -685,6 +704,16 @@ export class RelayClient {
       case "controller_attached":
         this.cb.onControllerAttached();
         break;
+      // The app's socket went away (closed the app, lost the network, backgrounded
+      // long enough for the server's heartbeat to reap it). The relay stays up — the
+      // terminal is still reachable — but anything we send now lands nowhere, so the
+      // owner delivers finished work through the outbox instead. Published only when
+      // the LAST controller left (CAS-guarded server-side), so a take-over doesn't
+      // masquerade as "nobody is watching".
+      case "controller_detached":
+        this.controllerHere = false;
+        this.cb.onControllerDetached?.();
+        break;
       case "command":
         if (typeof frame.text === "string") this.cb.onCommand?.(frame.text);
         break;
@@ -876,6 +905,16 @@ export class RelayClient {
     return this.ws?.readyState === WebSocket.OPEN;
   }
 
+  // Is the app actually on the other end right now? Requires an open socket AND a
+  // controller known to be attached — learned from `controller_attached`, from any
+  // frame a controller sent us, and un-learned by `controller_detached` or a dropped
+  // socket. Conservative in the useful direction: it only reads true when we have
+  // positive evidence someone is there, so "deliver it durably instead" is the
+  // default for a turn whose audience we can't account for.
+  hasController(): boolean {
+    return this.isConnected() && this.controllerHere;
+  }
+
   // Connection health, for `privateer harbor status` / the IPC status reply. `quietSec`
   // is how long since the server last said anything: a connected socket that has been
   // quiet for longer than the server's 25s ping cadence is the shape of the half-open
@@ -996,13 +1035,14 @@ export class RelayClient {
   // stance (the server/controller learns as little as possible about the machine).
   // Empty/absent fields are omitted so the app renders less rather than blank.
   //
-  // `cwd` is the one scoped exception, and ONLY a harbor-spawned live session passes
-  // it (see liveTaskSession): the driver chose that directory in the spawn form — or,
-  // having left it blank, needs to see which one the harbor picked — because it is
-  // where everything that session reads, writes and `@`-mentions lives, and unlike an
-  // interactive terminal there is no human sitting in it to already know. It is
-  // home-collapsed (`~/…`) on the way out, so the banner reads like the CLI's own and
-  // the OS username still never crosses the relay.
+  // `cwd` is the one scoped exception, sent by BOTH session kinds: it is where
+  // everything the agent reads, writes and `@`-mentions lives, so a driver who can't
+  // see it is guessing at the blast radius of every prompt they send. (It used to be
+  // harbor-spawned sessions only — on the theory that a human sits in an interactive
+  // terminal and already knows the folder. They don't when they're driving it from a
+  // phone, which is the entire point of this transport.) It is home-collapsed (`~/…`)
+  // on the way out, so the banner reads like the CLI's own and the OS username still
+  // never crosses the relay.
   sendContext(ctx: { model?: string; version?: string; cwd?: string; terminalPub?: string }): void {
     const frame: Record<string, unknown> = { type: "context" };
     if (typeof ctx.model === "string" && ctx.model) frame.model = ctx.model;

package/src/remote/remoteBridge.ts

@@ -16,11 +16,20 @@ import type { PermissionRequest } from "../permissions/gate.ts";
 import type { AskOutcome } from "../permissions/modeGate.ts";
 import type { RelayCallbacks } from "./relayClient.ts";
 
+// How much of a driven turn's reply we hold for possible outbox delivery. The
+// sealed item is capped at 45k plaintext anyway; this just stops a pathological
+// turn from growing the buffer without bound.
+const MAX_TURN_CAPTURE = 60_000;
+
 // The outbound surface the bridge needs; RelayClient implements all of it.
 export interface RelayLike {
   requestApproval(id: string, req: PermissionRequest): void;
   sendEvent(ev: EngineEvent): void;
   isConnected(): boolean;
+  // Is a controller actually attached (not merely "our socket is up")? Optional:
+  // a relay that can't tell is treated as attached, so an unknown audience never
+  // turns into a duplicate of something the app already displayed.
+  hasController?(): boolean;
   sendNoQuarter(on: boolean): void;
   sendFile(file: { name: string; mediaType: string; base64: string; size: number }): Promise<{ ok: boolean; reason?: string }>;
   sendNotice(text: string): void;
@@ -99,6 +108,15 @@ export interface RemoteBridgeConfig {
   onFilesSearch?: (id: string, query: string) => void;
   // A controller (re)attached — the owner should push a transcript snapshot.
   onControllerAttached?: () => void;
+  // The last controller went away. Informational for the owner (the bridge already
+  // fails pending approvals closed); a driven turn in flight keeps running.
+  onControllerDetached?: () => void;
+  // A driven turn finished with NOBODY on the other end — the app was closed, killed,
+  // or its socket was reaped while the agent worked. Everything the turn streamed up
+  // was dropped by the relay, so the owner should deliver this durably instead (seal
+  // it to the account outbox → the app's Inbox). Called once per unwatched turn, after
+  // the turn settles; `prompt` is what was asked, `content` the reply as streamed.
+  onUnwatchedResult?: (result: { prompt: string; content: string }) => void;
   onStatus?: (text: string) => void;
   // A file finished transferring down from the app. The owner registers it (e.g. into
   // an AttachmentStore) so the save_attachment tool can persist it.
@@ -113,6 +131,17 @@ export class RemoteBridge {
   private readonly pendingSelects = new Map<string, (v: string | null) => void>();
   private readonly pendingInputs = new Map<string, (v: string | null) => void>();
   private pendingAttachments: RemoteAttachment[] = [];
+  // The driven turn in flight, kept only so it can be delivered to the outbox if it
+  // turns out nobody was watching (see settleTurn). Bounded: the outbox truncates at
+  // 45k anyway, and this must not grow with a runaway turn.
+  //
+  // `turnDriven` is deliberately NOT `remote`: a mid-turn disconnect clears `remote`
+  // (so the gate stops waiting on a controller that's gone) and that is exactly the
+  // case this feature exists for — the turn was still driven by the app, and its
+  // answer still has to reach the account. Only settleTurn clears it.
+  private turnDriven = false;
+  private turnPrompt = "";
+  private turnText = "";
 
   constructor(private readonly cfg: RemoteBridgeConfig) {}
 
@@ -128,6 +157,9 @@ export class RemoteBridge {
   readonly callbacks: Required<RelayCallbacks> = {
     onPrompt: (text) => {
       this.remote = true; // a remote turn is now in flight → gate relays each action
+      this.turnDriven = true;
+      this.turnPrompt = text;
+      this.turnText = "";
       const attachments = this.pendingAttachments;
       this.pendingAttachments = [];
       this.cfg.onPrompt(text, attachments);
@@ -195,6 +227,16 @@ export class RemoteBridge {
       this.relay?.sendNoQuarter(on); // echo the ack back so the app's toggle syncs
     },
     onControllerAttached: () => this.cfg.onControllerAttached?.(),
+    // The app left while we're still running. Same posture as a dropped socket: stop
+    // treating the turn as remote (the gate must not wait on a controller that isn't
+    // there) and fail every pending approval closed. The turn itself keeps going —
+    // and settleTurn will deliver its answer to the outbox, since `turnDriven` (unlike
+    // `remote`) survives the departure.
+    onControllerDetached: () => {
+      this.remote = false;
+      this.rejectAllPending();
+      this.cfg.onControllerDetached?.();
+    },
     onAttachment: (file) => {
       this.pendingAttachments.push(file);
       this.cfg.onAttachment?.(file);
@@ -307,13 +349,36 @@ export class RemoteBridge {
 
   // Mark the end of a turn so the next (possibly local) turn isn't treated as
   // remote. Call after each driven turn completes.
+  //
+  // Also the one moment we can tell whether the turn had an audience. If the app
+  // drove it and is now gone, everything the turn streamed up was dropped by the
+  // relay — so hand the answer to the owner for durable delivery rather than letting
+  // a completed piece of work evaporate because someone closed their phone.
   settleTurn(): void {
+    const driven = this.turnDriven;
+    const prompt = this.turnPrompt;
+    const content = this.turnText.trim();
     this.remote = false;
+    this.turnDriven = false;
+    this.turnPrompt = "";
+    this.turnText = "";
+    if (!driven || !content) return;
+    // Unknown (a relay that can't report presence) counts as watched: better to skip
+    // delivery than to duplicate something the app already showed in its feed.
+    const watched = this.relay?.hasController ? this.relay.hasController() : !!this.relay?.isConnected();
+    if (watched) return;
+    this.cfg.onUnwatchedResult?.({ prompt, content });
   }
 
   // Forward an EngineEvent up to the app. Safe to call for every event of every
   // turn (local included) — the relay only sends when a socket is open.
   forwardEvent(ev: EngineEvent): void {
+    // Keep the driven turn's reply as it streams, in case settleTurn finds nobody
+    // was there to read it. Text only: the outbox item is the answer, not a
+    // transcript of every tool call.
+    if (this.turnDriven && ev.type === "text" && this.turnText.length < MAX_TURN_CAPTURE) {
+      this.turnText += String(ev.text ?? "");
+    }
     this.relay?.sendEvent(ev);
   }