privateer-agent 0.12.13 → 0.12.14

package/src/permissions/modeGate.ts

@@ -54,6 +54,16 @@ export interface ModeGateDeps {
   // the remote branch, even the dangerous-command denylist): the operator has
   // explicitly opted the whole session out of the moat. Off unless the flag is set.
   getSkipAllPermissions?: () => boolean;
+  // Spend the operator authorized IN ADVANCE, by tool name, at a moment when there WAS
+  // a human to ask: the media tools a routine names when it is saved (naming them is
+  // itself the decision — they are deliberately absent from the default allow-list, and
+  // saving a routine that grants egress is an alwaysAsk prompt of its own), handed to
+  // the run that fires hours later with nobody watching.
+  //
+  // Consulted ONLY to lift `alwaysAsk`, and only under the guards in ModeGate.request.
+  // Absent ⇒ nothing is pre-authorized, which is the posture every interactive session
+  // keeps: a terminal always asks its human, however cheap the call.
+  isSpendPreauthorized?: (req: PermissionRequest) => boolean;
 }
 
 // The permission gate used by the live TUI. It first applies the mode/allowlist
@@ -96,6 +106,35 @@ export class ModeGate implements PermissionGate {
 
     if (auto !== "ask") return auto;
 
+    // Pre-authorized spend. An unattended run reaches here with no one to ask, so an
+    // `alwaysAsk` tool — every billing media tool — was denied outright: the harbor
+    // let a routine NAME generate_video and then blocked every call it made, which is
+    // not a safe default so much as a capability that silently didn't exist.
+    //
+    // This lifts that one veto, and only that one. Four guards, all load-bearing:
+    //
+    //   • the controller must vouch for THIS tool by name (the harbor passes the media
+    //     tools this run's own allow-list names — see harbor/index.ts);
+    //   • `alwaysAsk` must be the ONLY reason we're asking. Re-deciding with the flag
+    //     cleared is how that is checked, so a pre-authorized tool in `plan` mode is
+    //     still denied and one at the default mode still prompts — pre-authorization
+    //     never grants what the mode wouldn't;
+    //   • never when the call leaves the working directory or touches a protected file.
+    //     bypass mode allows both outright, so this cannot lean on the re-decide above:
+    //     "you may generate video" must not become "you may upload ~/.ssh/id_rsa as a
+    //     reference image", which is exactly the shape classify.ts flags;
+    //   • never on a remote-driven turn — that branch returned above. A driven turn has
+    //     a human holding the phone, and they get the prompt.
+    if (
+      req.alwaysAsk &&
+      !req.outside &&
+      !req.protected &&
+      this.deps.isSpendPreauthorized?.(req) === true &&
+      decideAuto({ ...req, alwaysAsk: false }, this.deps.getMode(), this.deps.allowlist, denylist) === "allow"
+    ) {
+      return "allow";
+    }
+
     // A dangerous command (or an always-ask destructive action) can be approved
     // once, but is never remembered: adding it to the allowlist or relaxing the
     // mode would let a later variant slip through.

package/src/providers/account.ts

@@ -36,6 +36,7 @@ import {
   ensureSealedShim,
   attestSealed,
 } from "./sealedShim.ts";
+import type { PhalaEnclaveIdentity } from "./phalaSeal.ts";
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
@@ -502,6 +503,10 @@ export interface AccountPosture {
   tier: PrivacyTier;
   teePosture?: "green" | "yellow" | "red";
   error?: string;
+  // Phala sealed path only: what the verified quote says about the enclave that
+  // answered. Evidence about WHICH image it was, not part of the verdict — the tier
+  // above is decided by the crypto binding + quote alone. See phalaSeal.ts.
+  enclaveIdentity?: PhalaEnclaveIdentity;
 }
 
 // Posture for an account-channel model. For NEAR models the attestation is fetched
@@ -526,7 +531,9 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
   const sealedProvider = sealedEnabled() ? sealedProviderFor(modelId) : null;
   if (sealedProvider) {
     const att = await attestSealed(sealedProvider);
-    return att.ok ? { tier: "tee-verified" } : { tier: "tee-unverified", error: att.error };
+    return att.ok
+      ? { tier: "tee-verified", enclaveIdentity: att.enclaveIdentity }
+      : { tier: "tee-unverified", error: att.error };
   }
   // Honest labelling for the non-NEAR enclaves when we are NOT sealing — sealed mode
   // explicitly disabled (PRIVATEER_SEALED=0), or on but the shim never came up. Tinfoil

package/src/providers/phala/measurements.ts

@@ -0,0 +1,170 @@
+// TDX measurement verification for the Phala ACI report — the layer above the quote
+// signature check in ../phalaSeal.ts.
+//
+// The quote proves genuine Intel silicon and binds the E2EE key we seal to. It does
+// NOT say which image answered. These are the checks that start to close that gap,
+// and they split into two kinds that must never be confused:
+//
+//   SELF-CONSISTENCY (gates, verified here from the report alone)
+//     - the event log replays to the RTMRs the hardware signed
+//     - sha256(app_compose) equals the compose-hash the log claims
+//     Both are checkable with no outside knowledge, so a failure means the report is
+//     malformed or doctored and we refuse it.
+//
+//   IDENTITY (evidence, NOT a gate)
+//     - is this the same image we saw last time?
+//     Phala publishes no registry of known-good measurements; expected MRTD/RTMR0-2
+//     are computed with dstack-mr from the reproducible dstack OS build. Until we do
+//     that, first contact is trust-on-first-use: we can detect that the image CHANGED,
+//     never that it is the RIGHT one. Reporting drift as a hard failure would be a
+//     false alarm on every legitimate upgrade; reporting first-sight as "verified"
+//     would be the overclaim. So it surfaces as its own state and moves no verdict.
+//
+// Verified against the live gateway 2026-08-17: all four RTMRs replay and the
+// compose-hash matches.
+
+import { createHash } from "node:crypto";
+
+// One entry of the dstack event log. `imr` selects the register it extends; `digest`
+// is what actually gets hashed in. `event`/`event_payload` are the human-readable
+// name and value (app-id, compose-hash, os-image-hash, …).
+export interface TdxEvent {
+  imr: number;
+  digest: string;
+  event?: string;
+  event_payload?: string;
+}
+
+// The app-layer values the IMR3 log names. Every one is a string we can pin.
+export interface PhalaAppIdentity {
+  appId?: string;
+  composeHash?: string;
+  osImageHash?: string;
+  instanceId?: string;
+  mrKms?: string;
+  keyProvider?: string;
+}
+
+export interface ReplayedRtmrs {
+  rtMr0: string;
+  rtMr1: string;
+  rtMr2: string;
+  rtMr3: string;
+}
+
+const RTMR_KEYS = ["rtMr0", "rtMr1", "rtMr2", "rtMr3"] as const;
+
+// The event log arrives as a JSON *string* inside evidence (not an array), so it has
+// to be parsed before anything can replay it. Lenient: a shape we don't recognise
+// yields [] and the caller decides — an absent log is a missing check, not a forgery.
+export function parseEventLog(raw: unknown): TdxEvent[] {
+  let value: unknown = raw;
+  if (typeof raw === "string") {
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      return [];
+    }
+  }
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (e): e is TdxEvent =>
+      !!e && typeof e === "object" && typeof (e as TdxEvent).imr === "number" && typeof (e as TdxEvent).digest === "string",
+  );
+}
+
+// Replay the hash chain each register accumulates: starting from 48 zero bytes,
+// rtmr = SHA384(rtmr ‖ digest) for every event extending that register, in log order.
+// Order is load-bearing — the same events in a different sequence give a different
+// register, which is exactly what makes the log unforgeable against a signed quote.
+export function replayRtmrs(events: TdxEvent[]): ReplayedRtmrs {
+  const out = {} as Record<(typeof RTMR_KEYS)[number], string>;
+  RTMR_KEYS.forEach((key, imr) => {
+    let acc = Buffer.alloc(48);
+    for (const ev of events) {
+      if (ev.imr !== imr) continue;
+      let digest: Buffer;
+      try {
+        digest = Buffer.from(ev.digest, "hex");
+      } catch {
+        continue;
+      }
+      acc = createHash("sha384").update(Buffer.concat([acc, digest])).digest();
+    }
+    out[key] = acc.toString("hex");
+  });
+  return out;
+}
+
+// The named app-layer values out of the IMR3 events.
+export function appIdentityFrom(events: TdxEvent[]): PhalaAppIdentity {
+  const byName = new Map<string, string>();
+  for (const ev of events) {
+    if (ev.imr === 3 && ev.event && typeof ev.event_payload === "string" && ev.event_payload) {
+      byName.set(ev.event, ev.event_payload);
+    }
+  }
+  return {
+    appId: byName.get("app-id"),
+    composeHash: byName.get("compose-hash"),
+    osImageHash: byName.get("os-image-hash"),
+    instanceId: byName.get("instance-id"),
+    mrKms: byName.get("mr-kms"),
+    keyProvider: byName.get("key-provider"),
+  };
+}
+
+// sha256 over the app-compose document exactly as shipped. Hashing a re-serialized
+// object would silently "fix" any difference in key order or whitespace and match a
+// document that isn't the measured one, so a string is hashed verbatim.
+export function computeComposeHash(appCompose: unknown): string | undefined {
+  if (typeof appCompose !== "string" || !appCompose) return undefined;
+  return createHash("sha256").update(Buffer.from(appCompose, "utf8")).digest("hex");
+}
+
+export interface ConsistencyCheck {
+  name: string;
+  ok: boolean;
+  detail?: string;
+}
+
+// The self-consistency gates. `skipped` (no material to check) is reported as its own
+// outcome rather than silently passing — a check we did not run must never read as a
+// check that succeeded.
+export function checkReportConsistency(args: {
+  events: TdxEvent[];
+  quoted: ReplayedRtmrs;
+  appCompose: unknown;
+  identity: PhalaAppIdentity;
+}): { checks: ConsistencyCheck[]; ok: boolean; skipped: string[] } {
+  const checks: ConsistencyCheck[] = [];
+  const skipped: string[] = [];
+
+  if (args.events.length === 0) {
+    skipped.push("rtmr-replay");
+  } else {
+    const replayed = replayRtmrs(args.events);
+    for (const key of RTMR_KEYS) {
+      const ok = replayed[key] === args.quoted[key];
+      checks.push({
+        name: `rtmr-replay:${key}`,
+        ok,
+        detail: ok ? undefined : `replayed ${replayed[key].slice(0, 16)}… but the quote signed ${args.quoted[key].slice(0, 16)}…`,
+      });
+    }
+  }
+
+  const computed = computeComposeHash(args.appCompose);
+  if (!computed || !args.identity.composeHash) {
+    skipped.push("compose-hash");
+  } else {
+    const ok = computed === args.identity.composeHash;
+    checks.push({
+      name: "compose-hash",
+      ok,
+      detail: ok ? undefined : `sha256(app_compose)=${computed.slice(0, 16)}… but the log attests ${args.identity.composeHash.slice(0, 16)}…`,
+    });
+  }
+
+  return { checks, ok: checks.every((c) => c.ok), skipped };
+}

package/src/providers/phala/pin.ts

@@ -0,0 +1,98 @@
+// Trust-on-first-use pinning for the Phala enclave's identity.
+//
+// Why TOFU and not a real pin: Phala publishes no registry of known-good measurements.
+// The expected MRTD/RTMR0-2 are *computed* with dstack-mr from the reproducible dstack
+// OS build, and the gateway's compose-hash from its published source — neither of which
+// we do yet. So the honest guarantee is narrow and worth stating plainly: we can tell
+// you the image CHANGED, never that it was right to begin with.
+//
+// That shapes the semantics deliberately:
+//   - first sight records and reports `first-seen` — never "verified"
+//   - a later mismatch reports `changed` with the exact fields that moved
+//   - `changed` is NOT a failure. Phala upgrades the gateway legitimately, and hard-
+//     failing on every upgrade would train the user to ignore the one that matters.
+// The verdict stays where the cryptography is; this only ever adds a visible state.
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { globalDir } from "../../config/paths.ts";
+
+// The fields worth pinning: the image identity (MRTD + boot registers, os-image-hash)
+// and the app identity (app-id, compose-hash, key-management root). Deliberately NOT
+// instance-id — it changes on every restart of the same image, so pinning it would
+// cry wolf constantly and bury a real change.
+export interface PhalaPin {
+  mrTd?: string;
+  rtMr0?: string;
+  rtMr1?: string;
+  rtMr2?: string;
+  appId?: string;
+  composeHash?: string;
+  osImageHash?: string;
+  mrKms?: string;
+}
+
+export type PinState = "first-seen" | "unchanged" | "changed";
+
+export interface PinResult {
+  state: PinState;
+  // Field-level drift, e.g. "composeHash: 73fa4608… → 91bd0c2a…". Empty unless changed.
+  changed: string[];
+  firstSeenAt?: string;
+}
+
+const PIN_VERSION = 1;
+
+function pinPath(): string {
+  return join(globalDir(), "phala-enclave-pin.json");
+}
+
+function readPin(): { v?: number; firstSeenAt?: string; pin?: PhalaPin } | null {
+  try {
+    const parsed = JSON.parse(readFileSync(pinPath(), "utf8")) as { v?: number; firstSeenAt?: string; pin?: PhalaPin };
+    if (parsed?.v !== PIN_VERSION || !parsed.pin || typeof parsed.pin !== "object") return null;
+    return parsed;
+  } catch {
+    return null; // absent, unreadable, or garbage — treated as first sight
+  }
+}
+
+function writePin(pin: PhalaPin, firstSeenAt: string): void {
+  try {
+    mkdirSync(globalDir(), { recursive: true });
+    writeFileSync(pinPath(), JSON.stringify({ v: PIN_VERSION, firstSeenAt, pin }, null, 2) + "\n", "utf8");
+  } catch {
+    // Unwritable home: every run then reports first-seen. Degrading to "no memory" is
+    // right — the alternative is inventing an "unchanged" we cannot substantiate.
+  }
+}
+
+// Compare against the stored pin, recording it on first sight.
+//
+// `now` is injected rather than read from the clock so tests are deterministic; the
+// timestamp is display-only (it never participates in the comparison).
+export function checkPin(current: PhalaPin, now: () => string = () => new Date().toISOString()): PinResult {
+  const stored = readPin();
+  if (!stored?.pin) {
+    const firstSeenAt = now();
+    writePin(current, firstSeenAt);
+    return { state: "first-seen", changed: [], firstSeenAt };
+  }
+
+  const changed: string[] = [];
+  for (const key of Object.keys(current) as (keyof PhalaPin)[]) {
+    const was = stored.pin[key];
+    const is = current[key];
+    // Only compare fields present on BOTH sides. A field the gateway stopped sending
+    // is an absence, not a substitution, and calling it drift would be a false alarm.
+    if (was && is && was !== is) changed.push(`${key}: ${was.slice(0, 12)}… → ${is.slice(0, 12)}…`);
+  }
+
+  if (changed.length === 0) return { state: "unchanged", changed: [], firstSeenAt: stored.firstSeenAt };
+
+  // Re-pin to the new identity so the change is reported ONCE. Leaving the old pin in
+  // place would repeat the same warning every turn until it became wallpaper — and the
+  // user has already been shown exactly what moved.
+  writePin(current, stored.firstSeenAt ?? now());
+  return { state: "changed", changed, firstSeenAt: stored.firstSeenAt };
+}

package/src/providers/phalaSeal.ts

@@ -34,6 +34,13 @@ import {
 // refuses. This wrapper delegates ed25519 to it unchanged and adds the secp256k1 arm
 // the spec allows (§4.3), leaving aci-verifier/ pristine for re-pulls.
 import { verifyAciReportBinding } from "./phala/reportBinding.ts";
+import {
+  parseEventLog,
+  appIdentityFrom,
+  checkReportConsistency,
+  type PhalaAppIdentity,
+} from "./phala/measurements.ts";
+import { checkPin, type PinResult } from "./phala/pin.ts";
 import { serverBaseUrl } from "../auth/privateer.ts";
 
 const DEFAULT_ACCEPTABLE_TCB = ["UpToDate"];
@@ -56,6 +63,51 @@ function acceptableTcb(): Set<string> {
   return new Set(list);
 }
 
+// The launch measurements carried by a verified TDX quote. MRTD measures the initial
+// TD build (the dstack OS image); RTMR0-2 accumulate firmware/kernel/config and RTMR3
+// carries the app-level extensions (compose hash, app id).
+//
+// READING these is not CHECKING them. Nothing here compares a measurement against a
+// known-good value, so they are evidence to display and pin later — never a verdict.
+// The quote's signature is verified before we get here, so the bytes are authentic:
+// what is unproven is that this particular image is the one we intend to be talking to.
+export interface PhalaMeasurements {
+  mrTd: string;
+  rtMr0: string;
+  rtMr1: string;
+  rtMr2: string;
+  rtMr3: string;
+}
+
+// Pull the measurements off a verified quote report (TD1.0/1.5 layouts), or undefined
+// when the report carries no TD measurement block (e.g. an SGX quote).
+export function extractQuoteMeasurements(report: Report): PhalaMeasurements | undefined {
+  const td = report.asTd10?.() ?? report.asTd15?.()?.base;
+  const fields = [td?.mrTd, td?.rtMr0, td?.rtMr1, td?.rtMr2, td?.rtMr3];
+  // All five or none. A partial set still reads as evidence while silently omitting
+  // the register that would have contradicted it — RTMR3 (the app layer) most of all.
+  if (fields.some((f) => !f?.length)) return undefined;
+  const [mrTd, rtMr0, rtMr1, rtMr2, rtMr3] = fields.map((f) => toHex(new Uint8Array(f as Uint8Array)));
+  return { mrTd, rtMr0, rtMr1, rtMr2, rtMr3 };
+}
+
+// Everything we can say about the enclave that answered, once its quote verified.
+// `measurements` and `identity` are what the hardware signed; `pin` is our own memory
+// of it; the provenance and downstream fields are the enclave's self-declarations,
+// carried for display precisely because they are NOT proven by the quote.
+export interface PhalaEnclaveIdentity {
+  measurements: PhalaMeasurements;
+  identity: PhalaAppIdentity;
+  pin: PinResult;
+  // Self-consistency checks we could not run (absent event log / app_compose). Named
+  // so "we didn't check" can never be read as "we checked and it passed".
+  skippedChecks: string[];
+  repoUrl?: string;
+  repoCommit?: string;
+  downstreamDomain?: string;
+  downstreamSpkiSha256?: string;
+}
+
 // The 64-byte report_data from a verified TDX quote report (TD1.0/1.5 layouts).
 function extractQuoteReportData(report: Report): Uint8Array {
   const td10 = report.asTd10?.();
@@ -70,6 +122,9 @@ function extractQuoteReportData(report: Report): Uint8Array {
 interface VerifiedAttestation {
   report: AttestationReport;
   verification: ReportVerification;
+  // Absent when the hardware quote was skipped (requireQuote off): with no verified
+  // quote there is nothing about the enclave we are entitled to show.
+  enclave?: PhalaEnclaveIdentity;
 }
 
 // Attest once, cache the verified report; drop the memo on failure so a later call
@@ -103,17 +158,24 @@ async function establishAttestation(): Promise<VerifiedAttestation> {
     const failed = verification.checks.filter((c) => !c.ok).map((c) => c.name).join(", ");
     throw new Error(`phala attestation binding failed: ${failed}`);
   }
-  await verifyHardwareQuote(report);
-  return { report, verification };
+  const enclave = await verifyHardwareQuote(report);
+  return { report, verification, enclave };
 }
 
-async function verifyHardwareQuote(report: AttestationReport): Promise<void> {
-  if (!requireQuote()) return;
+async function verifyHardwareQuote(report: AttestationReport): Promise<PhalaEnclaveIdentity | undefined> {
+  if (!requireQuote()) return undefined;
 
   const attestation = report.attestation as unknown as {
     tee_type?: string;
     report_data?: string;
-    evidence?: { quote?: string; quote_report_data?: string };
+    source_provenance?: { repo_url?: string; repo_commit?: string };
+    evidence?: {
+      quote?: string;
+      quote_report_data?: string;
+      event_log?: unknown;
+      app_compose?: unknown;
+      downstream_tls_binding?: { domain?: string; spki_sha256?: string };
+    };
   };
   const teeType = String(attestation?.tee_type || "");
   if (teeType !== "tdx") throw new Error(`phala: unsupported/absent tee_type "${teeType}" (only tdx is wired)`);
@@ -141,14 +203,74 @@ async function verifyHardwareQuote(report: AttestationReport): Promise<void> {
   if (typeof declared === "string" && declared && toHex(quoteReportData) !== declared.toLowerCase()) {
     throw new Error("phala: evidence.quote_report_data does not match the verified quote");
   }
+
+  // 4) The quote is authentic, so its measurement registers are trustworthy bytes.
+  const measurements = extractQuoteMeasurements(verified.report);
+  if (!measurements) return undefined; // non-TD quote: nothing further to check
+
+  // 5) SELF-CONSISTENCY GATES. The event log must replay to the registers the hardware
+  //    signed, and the shipped app_compose must hash to the compose-hash the log
+  //    attests. Both are checkable from the report alone, so a failure means the report
+  //    is doctored or malformed — refuse it rather than showing a green shield over it.
+  const events = parseEventLog(attestation.evidence?.event_log);
+  const identity = appIdentityFrom(events);
+  const consistency = checkReportConsistency({
+    events,
+    quoted: measurements,
+    appCompose: attestation.evidence?.app_compose,
+    identity,
+  });
+  if (!consistency.ok) {
+    const failed = consistency.checks.filter((c) => !c.ok).map((c) => `${c.name} (${c.detail})`).join("; ");
+    throw new Error(`phala: attestation self-consistency failed: ${failed}`);
+  }
+
+  // 6) IDENTITY, as evidence only. TOFU against the stored pin — this can say the image
+  //    CHANGED, never that it is the right one (no published registry to check against;
+  //    see phala/pin.ts). It moves no verdict and never throws.
+  const pin = checkPin({
+    mrTd: measurements.mrTd,
+    rtMr0: measurements.rtMr0,
+    rtMr1: measurements.rtMr1,
+    rtMr2: measurements.rtMr2,
+    appId: identity.appId,
+    composeHash: identity.composeHash,
+    osImageHash: identity.osImageHash,
+    mrKms: identity.mrKms,
+  });
+
+  const provenance = attestation.source_provenance;
+  const downstream = attestation.evidence?.downstream_tls_binding;
+  return {
+    measurements,
+    identity,
+    pin,
+    skippedChecks: consistency.skipped,
+    // Named so a human can go read the source; self-declared by the enclave and NOT
+    // proven by the quote (image_digest/image_provenance come back null), so it is a
+    // pointer to audit, never evidence that this binary came from that commit.
+    repoUrl: provenance?.repo_url,
+    repoCommit: provenance?.repo_commit,
+    // The attested enclave forwards to this downstream host over TLS. Surfaced because
+    // it marks where our attested boundary ENDS — that host is a separate trust domain
+    // we do not attest.
+    downstreamDomain: downstream?.domain,
+    downstreamSpkiSha256: downstream?.spki_sha256,
+  };
 }
 
 // Posture signal: does the attested keyset verify (crypto binding + hardware quote)?
-// A green result is a quote WE checked, bound to the E2EE key we seal to.
-export async function attestPhala(): Promise<{ ok: boolean; error?: string }> {
+// A green result is a quote WE checked, bound to the E2EE key we seal to. The
+// measurements ride along as evidence of WHICH image answered — unpinned, so they
+// inform the display without moving the verdict.
+export async function attestPhala(): Promise<{
+  ok: boolean;
+  error?: string;
+  enclaveIdentity?: PhalaEnclaveIdentity;
+}> {
   try {
-    await attest();
-    return { ok: true };
+    const { enclave } = await attest();
+    return { ok: true, enclaveIdentity: enclave };
   } catch (e) {
     return { ok: false, error: (e as Error).message };
   }

package/src/providers/sealedShim.ts

@@ -31,7 +31,7 @@ import http from "node:http";
 import { Readable } from "node:stream";
 import { SecureClient } from "tinfoil";
 import { serverBaseUrl } from "../auth/privateer.ts";
-import { attestPhala, phalaSealedFetch } from "./phalaSeal.ts";
+import { attestPhala, phalaSealedFetch, type PhalaEnclaveIdentity } from "./phalaSeal.ts";
 import { iterateSSE } from "./phala/sse.ts";
 
 // Providers whose enclave supports application-layer body encryption + client-verified
@@ -109,6 +109,11 @@ export interface SealedAttestation {
   ok: boolean;
   enclave?: string;
   error?: string;
+  // Phala only: what the verified quote says about the enclave that answered (see
+  // phalaSeal.ts). Distinct from `enclave` above, which is Tinfoil's enclave URL —
+  // Tinfoil's SecureClient verifies its enclave internally and exposes no equivalent
+  // identity, so a green Tinfoil result carries none of this. Absence is not a failure.
+  enclaveIdentity?: PhalaEnclaveIdentity;
 }
 
 // Drive the provider's client-side attestation (the SAME client/keyset the shim

package/src/remote/liveTaskSession.ts

@@ -20,7 +20,7 @@ import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
 import { moatResourceOptions } from "../config/moat.ts";
-import { rememberAccountCredential, persistAccountCredential, dropPersistedAccountCredential } from "../providers/account.ts";
+import { rememberAccountCredential, persistAccountCredential, dropPersistedAccountCredential, ensureAccountArmed } from "../providers/account.ts";
 // Pi-free static graph by design — see the header of piAuthStore.ts.
 import { modelRegistryOf } from "../providers/piAuthStore.ts";
 import { RelayClient, type TaskSpec } from "./relayClient.ts";
@@ -130,6 +130,13 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     lastAnswer = "";   // keep the CLOSING answer, not the whole session
     turnErrored = false;
     try {
+      // auth.json's `privateer` entry is machine-global and single-slot, so another
+      // terminal arming over ours and then exiting deletes the credential this session
+      // is running on — every later turn would fail with "This terminal isn't signed in
+      // to Privateer" while the session we hold stays valid. Re-arm here rather than in
+      // providers/account.ts's `before_agent_start` net, which pi's prompt() throws
+      // past on its own `hasConfiguredAuth` precheck.
+      if (modelSpec.startsWith("privateer/")) await ensureAccountArmed(undefined);
       // Fold any files the app sent since the last prompt into a reference note, so the
       // model knows they exist and can save_attachment them to disk.
       const atts = sinceLastPrompt;

package/src/remote/relayClient.ts

@@ -19,6 +19,7 @@ import WebSocket from "ws";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { apiRequest, serverBaseUrl } from "../auth/privateer.ts";
+import { MOAT_SHIMS, reservedNames } from "../config/moatManifest.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
 
@@ -1089,6 +1090,21 @@ export class RelayClient {
   // each add/remove. `busy` drives a progress indicator; `needsRestart` tells the app
   // the change only takes effect on the next terminal launch. NON-PII: package
   // sources + scope only. Installed list bounded like sendCommands.
+  //
+  // `builtIn` + `managed` describe the MOAT, which is deliberately absent from
+  // `installed` (it never enters settings "packages"). Without them the app's Browse
+  // tab — an unfiltered npm `keywords:pi-package` search — offers Add on packages we
+  // already ship: pi-mcp-adapter, pi-subagents and the rpiv packs are on its first
+  // page. Every one of those round-trips to extensionsControl.add() only to come back
+  // refused ("managed by Privateer"), and until it does the row reads as *not*
+  // installed, which is the opposite of the truth. So:
+  //   • `builtIn` — what we ship, in load order, for a read-only section.
+  //   • `managed` — every name add()/remove() will refuse (builtIn + retired + the
+  //     scoped aliases), so the app can drop the Add affordance instead of offering
+  //     a button that always fails.
+  // Stamped here rather than passed by the caller: it is a constant of the build, and
+  // six call sites that each had to remember it is the drift moatManifest.json exists
+  // to make unrepresentable. An older app ignores both fields.
   sendExtensions(payload: {
     installed: { source: string; scope: string; filtered?: boolean; installed?: boolean }[];
     busy?: boolean;
@@ -1103,6 +1119,11 @@ export class RelayClient {
         filtered: !!e.filtered,
         installed: !!e.installed,
       })),
+      builtIn: MOAT_SHIMS.slice(0, 100).map((s) => ({
+        name: safe(s.name, 120),
+        note: s.note ? safe(s.note, 200) : undefined,
+      })),
+      managed: reservedNames().slice(0, 200).map((n) => safe(n, 120)),
       busy: !!payload.busy,
       message: payload.message ? safe(payload.message, 500) : undefined,
       needsRestart: !!payload.needsRestart,

package/src/remote/remoteBridge.ts

@@ -42,8 +42,17 @@ export interface RelayLike {
 }
 
 // The installed-extensions snapshot relayed to the app's extensions manager.
+//
+// `managed`/`builtIn` describe the moat, which `installed` never contains (it is loaded
+// as launch shims, not settings "packages"). Callers do NOT set them: each transport
+// stamps them on the way out — RelayClient.sendExtensions from the shipping manifest,
+// IpcRelay from reservedNames() — because a constant of the build passed by hand at six
+// call sites is the drift moatManifest.json exists to make unrepresentable. Declared
+// here only so a transport can type what it adds.
 export interface ExtensionsPayload {
   installed: { source: string; scope: string; filtered?: boolean; installed?: boolean }[];
+  builtIn?: { name: string; note?: string }[];
+  managed?: string[];
   busy?: boolean;
   message?: string;
   needsRestart?: boolean;

package/src/routines/store.ts

@@ -230,6 +230,17 @@ export interface PendingCloud {
   // instead. Copying megabytes into this queue would be the same content twice on
   // the one box that already has it.
   media?: StagedMedia[];
+  // What the run was asked to do (outbox/cloudOutbox.ts OutboxSource), so a flush
+  // hours later still seals the context a follow-up needs. Structurally typed rather
+  // than imported: this module is the queue's shape, and cloudOutbox already imports
+  // from here (importing back would make the cycle).
+  source?: {
+    routineId?: string;
+    prompt?: string;
+    cwd?: string;
+    model?: string;
+    schedule?: string;
+  };
 }
 
 function pendingCloudPath(): string {