privateer-agent 0.12.13 → 0.12.15

package/src/providers/phala/pin.ts

@@ -0,0 +1,98 @@
+// Trust-on-first-use pinning for the Phala enclave's identity.
+//
+// Why TOFU and not a real pin: Phala publishes no registry of known-good measurements.
+// The expected MRTD/RTMR0-2 are *computed* with dstack-mr from the reproducible dstack
+// OS build, and the gateway's compose-hash from its published source — neither of which
+// we do yet. So the honest guarantee is narrow and worth stating plainly: we can tell
+// you the image CHANGED, never that it was right to begin with.
+//
+// That shapes the semantics deliberately:
+//   - first sight records and reports `first-seen` — never "verified"
+//   - a later mismatch reports `changed` with the exact fields that moved
+//   - `changed` is NOT a failure. Phala upgrades the gateway legitimately, and hard-
+//     failing on every upgrade would train the user to ignore the one that matters.
+// The verdict stays where the cryptography is; this only ever adds a visible state.
+
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { globalDir } from "../../config/paths.ts";
+
+// The fields worth pinning: the image identity (MRTD + boot registers, os-image-hash)
+// and the app identity (app-id, compose-hash, key-management root). Deliberately NOT
+// instance-id — it changes on every restart of the same image, so pinning it would
+// cry wolf constantly and bury a real change.
+export interface PhalaPin {
+  mrTd?: string;
+  rtMr0?: string;
+  rtMr1?: string;
+  rtMr2?: string;
+  appId?: string;
+  composeHash?: string;
+  osImageHash?: string;
+  mrKms?: string;
+}
+
+export type PinState = "first-seen" | "unchanged" | "changed";
+
+export interface PinResult {
+  state: PinState;
+  // Field-level drift, e.g. "composeHash: 73fa4608… → 91bd0c2a…". Empty unless changed.
+  changed: string[];
+  firstSeenAt?: string;
+}
+
+const PIN_VERSION = 1;
+
+function pinPath(): string {
+  return join(globalDir(), "phala-enclave-pin.json");
+}
+
+function readPin(): { v?: number; firstSeenAt?: string; pin?: PhalaPin } | null {
+  try {
+    const parsed = JSON.parse(readFileSync(pinPath(), "utf8")) as { v?: number; firstSeenAt?: string; pin?: PhalaPin };
+    if (parsed?.v !== PIN_VERSION || !parsed.pin || typeof parsed.pin !== "object") return null;
+    return parsed;
+  } catch {
+    return null; // absent, unreadable, or garbage — treated as first sight
+  }
+}
+
+function writePin(pin: PhalaPin, firstSeenAt: string): void {
+  try {
+    mkdirSync(globalDir(), { recursive: true });
+    writeFileSync(pinPath(), JSON.stringify({ v: PIN_VERSION, firstSeenAt, pin }, null, 2) + "\n", "utf8");
+  } catch {
+    // Unwritable home: every run then reports first-seen. Degrading to "no memory" is
+    // right — the alternative is inventing an "unchanged" we cannot substantiate.
+  }
+}
+
+// Compare against the stored pin, recording it on first sight.
+//
+// `now` is injected rather than read from the clock so tests are deterministic; the
+// timestamp is display-only (it never participates in the comparison).
+export function checkPin(current: PhalaPin, now: () => string = () => new Date().toISOString()): PinResult {
+  const stored = readPin();
+  if (!stored?.pin) {
+    const firstSeenAt = now();
+    writePin(current, firstSeenAt);
+    return { state: "first-seen", changed: [], firstSeenAt };
+  }
+
+  const changed: string[] = [];
+  for (const key of Object.keys(current) as (keyof PhalaPin)[]) {
+    const was = stored.pin[key];
+    const is = current[key];
+    // Only compare fields present on BOTH sides. A field the gateway stopped sending
+    // is an absence, not a substitution, and calling it drift would be a false alarm.
+    if (was && is && was !== is) changed.push(`${key}: ${was.slice(0, 12)}… → ${is.slice(0, 12)}…`);
+  }
+
+  if (changed.length === 0) return { state: "unchanged", changed: [], firstSeenAt: stored.firstSeenAt };
+
+  // Re-pin to the new identity so the change is reported ONCE. Leaving the old pin in
+  // place would repeat the same warning every turn until it became wallpaper — and the
+  // user has already been shown exactly what moved.
+  writePin(current, stored.firstSeenAt ?? now());
+  return { state: "changed", changed, firstSeenAt: stored.firstSeenAt };
+}

package/src/providers/phalaSeal.ts

@@ -34,6 +34,13 @@ import {
 // refuses. This wrapper delegates ed25519 to it unchanged and adds the secp256k1 arm
 // the spec allows (§4.3), leaving aci-verifier/ pristine for re-pulls.
 import { verifyAciReportBinding } from "./phala/reportBinding.ts";
+import {
+  parseEventLog,
+  appIdentityFrom,
+  checkReportConsistency,
+  type PhalaAppIdentity,
+} from "./phala/measurements.ts";
+import { checkPin, type PinResult } from "./phala/pin.ts";
 import { serverBaseUrl } from "../auth/privateer.ts";
 
 const DEFAULT_ACCEPTABLE_TCB = ["UpToDate"];
@@ -56,6 +63,51 @@ function acceptableTcb(): Set<string> {
   return new Set(list);
 }
 
+// The launch measurements carried by a verified TDX quote. MRTD measures the initial
+// TD build (the dstack OS image); RTMR0-2 accumulate firmware/kernel/config and RTMR3
+// carries the app-level extensions (compose hash, app id).
+//
+// READING these is not CHECKING them. Nothing here compares a measurement against a
+// known-good value, so they are evidence to display and pin later — never a verdict.
+// The quote's signature is verified before we get here, so the bytes are authentic:
+// what is unproven is that this particular image is the one we intend to be talking to.
+export interface PhalaMeasurements {
+  mrTd: string;
+  rtMr0: string;
+  rtMr1: string;
+  rtMr2: string;
+  rtMr3: string;
+}
+
+// Pull the measurements off a verified quote report (TD1.0/1.5 layouts), or undefined
+// when the report carries no TD measurement block (e.g. an SGX quote).
+export function extractQuoteMeasurements(report: Report): PhalaMeasurements | undefined {
+  const td = report.asTd10?.() ?? report.asTd15?.()?.base;
+  const fields = [td?.mrTd, td?.rtMr0, td?.rtMr1, td?.rtMr2, td?.rtMr3];
+  // All five or none. A partial set still reads as evidence while silently omitting
+  // the register that would have contradicted it — RTMR3 (the app layer) most of all.
+  if (fields.some((f) => !f?.length)) return undefined;
+  const [mrTd, rtMr0, rtMr1, rtMr2, rtMr3] = fields.map((f) => toHex(new Uint8Array(f as Uint8Array)));
+  return { mrTd, rtMr0, rtMr1, rtMr2, rtMr3 };
+}
+
+// Everything we can say about the enclave that answered, once its quote verified.
+// `measurements` and `identity` are what the hardware signed; `pin` is our own memory
+// of it; the provenance and downstream fields are the enclave's self-declarations,
+// carried for display precisely because they are NOT proven by the quote.
+export interface PhalaEnclaveIdentity {
+  measurements: PhalaMeasurements;
+  identity: PhalaAppIdentity;
+  pin: PinResult;
+  // Self-consistency checks we could not run (absent event log / app_compose). Named
+  // so "we didn't check" can never be read as "we checked and it passed".
+  skippedChecks: string[];
+  repoUrl?: string;
+  repoCommit?: string;
+  downstreamDomain?: string;
+  downstreamSpkiSha256?: string;
+}
+
 // The 64-byte report_data from a verified TDX quote report (TD1.0/1.5 layouts).
 function extractQuoteReportData(report: Report): Uint8Array {
   const td10 = report.asTd10?.();
@@ -70,6 +122,9 @@ function extractQuoteReportData(report: Report): Uint8Array {
 interface VerifiedAttestation {
   report: AttestationReport;
   verification: ReportVerification;
+  // Absent when the hardware quote was skipped (requireQuote off): with no verified
+  // quote there is nothing about the enclave we are entitled to show.
+  enclave?: PhalaEnclaveIdentity;
 }
 
 // Attest once, cache the verified report; drop the memo on failure so a later call
@@ -103,17 +158,24 @@ async function establishAttestation(): Promise<VerifiedAttestation> {
     const failed = verification.checks.filter((c) => !c.ok).map((c) => c.name).join(", ");
     throw new Error(`phala attestation binding failed: ${failed}`);
   }
-  await verifyHardwareQuote(report);
-  return { report, verification };
+  const enclave = await verifyHardwareQuote(report);
+  return { report, verification, enclave };
 }
 
-async function verifyHardwareQuote(report: AttestationReport): Promise<void> {
-  if (!requireQuote()) return;
+async function verifyHardwareQuote(report: AttestationReport): Promise<PhalaEnclaveIdentity | undefined> {
+  if (!requireQuote()) return undefined;
 
   const attestation = report.attestation as unknown as {
     tee_type?: string;
     report_data?: string;
-    evidence?: { quote?: string; quote_report_data?: string };
+    source_provenance?: { repo_url?: string; repo_commit?: string };
+    evidence?: {
+      quote?: string;
+      quote_report_data?: string;
+      event_log?: unknown;
+      app_compose?: unknown;
+      downstream_tls_binding?: { domain?: string; spki_sha256?: string };
+    };
   };
   const teeType = String(attestation?.tee_type || "");
   if (teeType !== "tdx") throw new Error(`phala: unsupported/absent tee_type "${teeType}" (only tdx is wired)`);
@@ -141,14 +203,74 @@ async function verifyHardwareQuote(report: AttestationReport): Promise<void> {
   if (typeof declared === "string" && declared && toHex(quoteReportData) !== declared.toLowerCase()) {
     throw new Error("phala: evidence.quote_report_data does not match the verified quote");
   }
+
+  // 4) The quote is authentic, so its measurement registers are trustworthy bytes.
+  const measurements = extractQuoteMeasurements(verified.report);
+  if (!measurements) return undefined; // non-TD quote: nothing further to check
+
+  // 5) SELF-CONSISTENCY GATES. The event log must replay to the registers the hardware
+  //    signed, and the shipped app_compose must hash to the compose-hash the log
+  //    attests. Both are checkable from the report alone, so a failure means the report
+  //    is doctored or malformed — refuse it rather than showing a green shield over it.
+  const events = parseEventLog(attestation.evidence?.event_log);
+  const identity = appIdentityFrom(events);
+  const consistency = checkReportConsistency({
+    events,
+    quoted: measurements,
+    appCompose: attestation.evidence?.app_compose,
+    identity,
+  });
+  if (!consistency.ok) {
+    const failed = consistency.checks.filter((c) => !c.ok).map((c) => `${c.name} (${c.detail})`).join("; ");
+    throw new Error(`phala: attestation self-consistency failed: ${failed}`);
+  }
+
+  // 6) IDENTITY, as evidence only. TOFU against the stored pin — this can say the image
+  //    CHANGED, never that it is the right one (no published registry to check against;
+  //    see phala/pin.ts). It moves no verdict and never throws.
+  const pin = checkPin({
+    mrTd: measurements.mrTd,
+    rtMr0: measurements.rtMr0,
+    rtMr1: measurements.rtMr1,
+    rtMr2: measurements.rtMr2,
+    appId: identity.appId,
+    composeHash: identity.composeHash,
+    osImageHash: identity.osImageHash,
+    mrKms: identity.mrKms,
+  });
+
+  const provenance = attestation.source_provenance;
+  const downstream = attestation.evidence?.downstream_tls_binding;
+  return {
+    measurements,
+    identity,
+    pin,
+    skippedChecks: consistency.skipped,
+    // Named so a human can go read the source; self-declared by the enclave and NOT
+    // proven by the quote (image_digest/image_provenance come back null), so it is a
+    // pointer to audit, never evidence that this binary came from that commit.
+    repoUrl: provenance?.repo_url,
+    repoCommit: provenance?.repo_commit,
+    // The attested enclave forwards to this downstream host over TLS. Surfaced because
+    // it marks where our attested boundary ENDS — that host is a separate trust domain
+    // we do not attest.
+    downstreamDomain: downstream?.domain,
+    downstreamSpkiSha256: downstream?.spki_sha256,
+  };
 }
 
 // Posture signal: does the attested keyset verify (crypto binding + hardware quote)?
-// A green result is a quote WE checked, bound to the E2EE key we seal to.
-export async function attestPhala(): Promise<{ ok: boolean; error?: string }> {
+// A green result is a quote WE checked, bound to the E2EE key we seal to. The
+// measurements ride along as evidence of WHICH image answered — unpinned, so they
+// inform the display without moving the verdict.
+export async function attestPhala(): Promise<{
+  ok: boolean;
+  error?: string;
+  enclaveIdentity?: PhalaEnclaveIdentity;
+}> {
   try {
-    await attest();
-    return { ok: true };
+    const { enclave } = await attest();
+    return { ok: true, enclaveIdentity: enclave };
   } catch (e) {
     return { ok: false, error: (e as Error).message };
   }

package/src/providers/sealedShim.ts

@@ -31,7 +31,7 @@ import http from "node:http";
 import { Readable } from "node:stream";
 import { SecureClient } from "tinfoil";
 import { serverBaseUrl } from "../auth/privateer.ts";
-import { attestPhala, phalaSealedFetch } from "./phalaSeal.ts";
+import { attestPhala, phalaSealedFetch, type PhalaEnclaveIdentity } from "./phalaSeal.ts";
 import { iterateSSE } from "./phala/sse.ts";
 
 // Providers whose enclave supports application-layer body encryption + client-verified
@@ -109,6 +109,11 @@ export interface SealedAttestation {
   ok: boolean;
   enclave?: string;
   error?: string;
+  // Phala only: what the verified quote says about the enclave that answered (see
+  // phalaSeal.ts). Distinct from `enclave` above, which is Tinfoil's enclave URL —
+  // Tinfoil's SecureClient verifies its enclave internally and exposes no equivalent
+  // identity, so a green Tinfoil result carries none of this. Absence is not a failure.
+  enclaveIdentity?: PhalaEnclaveIdentity;
 }
 
 // Drive the provider's client-side attestation (the SAME client/keyset the shim

package/src/remote/liveTaskSession.ts

@@ -20,7 +20,7 @@ import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
 import { moatResourceOptions } from "../config/moat.ts";
-import { rememberAccountCredential, persistAccountCredential, dropPersistedAccountCredential } from "../providers/account.ts";
+import { rememberAccountCredential, persistAccountCredential, dropPersistedAccountCredential, ensureAccountArmed } from "../providers/account.ts";
 // Pi-free static graph by design — see the header of piAuthStore.ts.
 import { modelRegistryOf } from "../providers/piAuthStore.ts";
 import { RelayClient, type TaskSpec } from "./relayClient.ts";
@@ -130,6 +130,13 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     lastAnswer = "";   // keep the CLOSING answer, not the whole session
     turnErrored = false;
     try {
+      // auth.json's `privateer` entry is machine-global and single-slot, so another
+      // terminal arming over ours and then exiting deletes the credential this session
+      // is running on — every later turn would fail with "This terminal isn't signed in
+      // to Privateer" while the session we hold stays valid. Re-arm here rather than in
+      // providers/account.ts's `before_agent_start` net, which pi's prompt() throws
+      // past on its own `hasConfiguredAuth` precheck.
+      if (modelSpec.startsWith("privateer/")) await ensureAccountArmed(undefined);
       // Fold any files the app sent since the last prompt into a reference note, so the
       // model knows they exist and can save_attachment them to disk.
       const atts = sinceLastPrompt;

package/src/remote/relayClient.ts

@@ -19,6 +19,7 @@ import WebSocket from "ws";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { apiRequest, serverBaseUrl } from "../auth/privateer.ts";
+import { MOAT_SHIMS, reservedNames } from "../config/moatManifest.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
 
@@ -1089,6 +1090,21 @@ export class RelayClient {
   // each add/remove. `busy` drives a progress indicator; `needsRestart` tells the app
   // the change only takes effect on the next terminal launch. NON-PII: package
   // sources + scope only. Installed list bounded like sendCommands.
+  //
+  // `builtIn` + `managed` describe the MOAT, which is deliberately absent from
+  // `installed` (it never enters settings "packages"). Without them the app's Browse
+  // tab — an unfiltered npm `keywords:pi-package` search — offers Add on packages we
+  // already ship: pi-mcp-adapter, pi-subagents and the rpiv packs are on its first
+  // page. Every one of those round-trips to extensionsControl.add() only to come back
+  // refused ("managed by Privateer"), and until it does the row reads as *not*
+  // installed, which is the opposite of the truth. So:
+  //   • `builtIn` — what we ship, in load order, for a read-only section.
+  //   • `managed` — every name add()/remove() will refuse (builtIn + retired + the
+  //     scoped aliases), so the app can drop the Add affordance instead of offering
+  //     a button that always fails.
+  // Stamped here rather than passed by the caller: it is a constant of the build, and
+  // six call sites that each had to remember it is the drift moatManifest.json exists
+  // to make unrepresentable. An older app ignores both fields.
   sendExtensions(payload: {
     installed: { source: string; scope: string; filtered?: boolean; installed?: boolean }[];
     busy?: boolean;
@@ -1103,6 +1119,11 @@ export class RelayClient {
         filtered: !!e.filtered,
         installed: !!e.installed,
       })),
+      builtIn: MOAT_SHIMS.slice(0, 100).map((s) => ({
+        name: safe(s.name, 120),
+        note: s.note ? safe(s.note, 200) : undefined,
+      })),
+      managed: reservedNames().slice(0, 200).map((n) => safe(n, 120)),
       busy: !!payload.busy,
       message: payload.message ? safe(payload.message, 500) : undefined,
       needsRestart: !!payload.needsRestart,

package/src/remote/remoteBridge.ts

@@ -42,8 +42,17 @@ export interface RelayLike {
 }
 
 // The installed-extensions snapshot relayed to the app's extensions manager.
+//
+// `managed`/`builtIn` describe the moat, which `installed` never contains (it is loaded
+// as launch shims, not settings "packages"). Callers do NOT set them: each transport
+// stamps them on the way out — RelayClient.sendExtensions from the shipping manifest,
+// IpcRelay from reservedNames() — because a constant of the build passed by hand at six
+// call sites is the drift moatManifest.json exists to make unrepresentable. Declared
+// here only so a transport can type what it adds.
 export interface ExtensionsPayload {
   installed: { source: string; scope: string; filtered?: boolean; installed?: boolean }[];
+  builtIn?: { name: string; note?: string }[];
+  managed?: string[];
   busy?: boolean;
   message?: string;
   needsRestart?: boolean;

package/src/routines/store.ts

@@ -230,6 +230,17 @@ export interface PendingCloud {
   // instead. Copying megabytes into this queue would be the same content twice on
   // the one box that already has it.
   media?: StagedMedia[];
+  // What the run was asked to do (outbox/cloudOutbox.ts OutboxSource), so a flush
+  // hours later still seals the context a follow-up needs. Structurally typed rather
+  // than imported: this module is the queue's shape, and cloudOutbox already imports
+  // from here (importing back would make the cycle).
+  source?: {
+    routineId?: string;
+    prompt?: string;
+    cwd?: string;
+    model?: string;
+    schedule?: string;
+  };
 }
 
 function pendingCloudPath(): string {