privateer-agent 0.12.18 → 0.12.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.12.18",
+  "version": "0.12.20",
   "description": "Privacy-first terminal coding agent — bring your own model across 20 providers (Anthropic, OpenAI, OpenRouter, Google, local Ollama…). Safe-by-default permissions, MCP, sub-agents, workflows, and verifiable TEE inference. Built on the Pi toolkit.",
   "type": "module",
   "license": "MIT",

package/src/config/moat.ts

@@ -1,14 +1,23 @@
 /**
  * buildMoat() — the one place that decides which extensions a session gets, in what order.
  *
- * WHAT THIS REPLACES. Five entry points each hand-assembled their own `extensionFactories`
+ * WHAT THIS REPLACES. Six entry points each hand-assembled their own `extensionFactories`
  * array: the harbor's sessions (routines, workflows, tasks), its live task spawns, the
- * channels runner, ACP, and the dev REPL. The five lists were the same list — same gate,
- * same privacy extension, same account provider, the same `webEnabled()`/`mediaEnabled()`
- * conditionals — copied with small deliberate differences and a large amount of duplicated
- * comment explaining them. Nothing held them together, so an extension added to one path
- * silently didn't exist on the other four (privateer-media had reached three of five), and
- * the ordering rule below lived as prose repeated in each copy.
+ * channels runner, ACP, the dev REPL, and the desktop app's per-window session. The lists
+ * were the same list — same gate, same privacy extension, same account provider, the same
+ * `webEnabled()`/`mediaEnabled()` conditionals — copied with small deliberate differences
+ * and a large amount of duplicated comment explaining them. Nothing held them together, so
+ * an extension added to one path silently didn't exist on the others (privateer-media had
+ * reached three of five), and the ordering rule below lived as prose repeated in each copy.
+ *
+ * THE DESKTOP IS WHY THIS NOTE IS NOW ABOUT SIX. It was left out of the first pass and
+ * proved the point within the month: the app's Super Computer had NO generation tools at
+ * all — no generate_image / _video / _model / _speech / _music / _sfx, no
+ * media_capabilities, and not even video_compose, which every other kind gets
+ * unconditionally because it is local ffmpeg work that costs nothing. Its MCP connectors
+ * worked, so Godot and Unreal drove the editor fine while the same window could not make
+ * a texture to put in it. The lesson is the one this module was written for: the fix is
+ * not "add the media factory to that array", it is "there are no arrays".
  *
  * ORDER MATTERS, ONCE. pi-privacy's own catalog registers a `privateer` provider (its
  * PUBLIC developer-key channel, one seed model), and Pi's registerProvider REPLACES a
@@ -51,7 +60,8 @@ export type MoatKind =
   | "live-task" // a drivable session the harbor spawns for the app
   | "channels" // Telegram / Slack / Discord / WhatsApp bridge sessions
   | "acp" // `privateer acp` — an ACP host (Zed, Buzz) drives
-  | "repl"; // the lean dev REPL (npm run chat)
+  | "repl" // the lean dev REPL (npm run chat)
+  | "desktop"; // the desktop app's Super Computer — one session per window
 
 export interface MoatOptions {
   kind: MoatKind;
@@ -72,24 +82,83 @@ export interface MoatOptions {
    * the point: a run whose result goes to a webhook or a file has nothing to attach to.
    */
   resultMedia?: import("../routines/resultMedia.ts").ResultMedia;
+  /**
+   * What a SIGNED-OUT session hears when it calls web_search / web_fetch. Required by
+   * `web: "guarded"` and ignored otherwise. It lives on the caller because only the caller
+   * knows what the user can do about it — a desktop window can point at its account menu,
+   * a headless host has no menu to point at (src/tools/web.ts).
+   */
+  webHint?: string;
+  /**
+   * How to import a THIRD-PARTY dependency (today: pi-mcp-adapter). Defaults to a plain
+   * dynamic import, which is right for every process that runs from a normal Node
+   * resolution root.
+   *
+   * The desktop is not one. It runs the agent's copy of every shared package — one Pi
+   * instance, one captured-cert map — so it resolves from privateer-agent's own
+   * package.json rather than the app's, and it needs a fallback for adapters whose entry
+   * is an `index.ts` (under Electron, tsx's `register()` patches only the ESM loader, so
+   * a vanilla CJS resolve looks for index.js and reports MODULE_NOT_FOUND). Taking the
+   * resolver from the host keeps that knowledge in the host, where it belongs, instead of
+   * teaching this module about Electron.
+   */
+  hostImport?: (spec: string) => Promise<any>;
 }
 
 /**
  * Per-kind capabilities. `web` and `media` are the CEILING — each is still ANDed with its
  * runtime switch (webEnabled/mediaEnabled), so a false here means "never", not "by default".
  *
- * web is deliberately off for live-task and repl: makeWebTools() routes through the account
- * API precisely because an unattended run must not hold a search provider key, and both of
- * those paths have a human at the other end who can use their own provider (src/tools/web.ts).
- * compose is unconditional everywhere: local ffmpeg work, no account, no network, no spend —
- * so a run with generation off can still assemble media that already exists on disk.
+ * web is deliberately off for live-task and repl: the account form routes through the
+ * account API precisely because an unattended run must not hold a search provider key, and
+ * both of those paths have a human at the other end who can use their own provider
+ * (src/tools/web.ts). compose is unconditional everywhere: local ffmpeg work, no account,
+ * no network, no spend — so a run with generation off can still assemble media that
+ * already exists on disk.
+ *
+ * The three optional rows below are all FALSE for the unattended kinds, which is exactly
+ * what those five paths did before the desktop joined the table. They exist because the
+ * desktop is the first ATTENDED session built from here, and an attended session differs
+ * from a headless one in ways that are real rather than cosmetic — a project context file
+ * to load, a folder whose skills follow it, and a model PICKER whose registry has to be
+ * repaired. Leaving them off keeps every pre-existing kind byte-identical.
  */
-const CAPABILITIES: Record<MoatKind, { web: boolean; media: boolean; mcp: boolean }> = {
-  "harbor-session": { web: true, media: true, mcp: true },
+interface MoatCaps {
+  /**
+   * false     — never; the tools do not exist for this kind.
+   * "account" — registered only once webEnabled() says there are credentials. The
+   *             UNATTENDED shape: decide at build, because nothing will change mid-run.
+   * "guarded" — always registered, each call re-checks sign-in and answers with
+   *             `webHint` when there is none. The ATTENDED shape: the session outlives
+   *             `/signin`, so the question has to be asked when the tool RUNS
+   *             (src/tools/web.ts spells out why these are two functions, not one).
+   */
+  web: false | "account" | "guarded";
+  media: boolean;
+  mcp: boolean;
+  /** PRIVATEER.md project context + /init (extensions/privateer-context.ts). */
+  context?: boolean;
+  /** The folder's own skills, contributed from ~/.privateer rather than the user's tree. */
+  spawnSkills?: boolean;
+  /**
+   * Load the privacy SHIM (extensions/privateer-privacy.ts) rather than the bare
+   * privacyExtension() below — the same configuration plus two provider REPAIRS.
+   * pi-privacy re-registers `tinfoil` with a one-model seed catalog and `privateer` with
+   * its public developer-key channel, and registerProvider REPLACES a provider's models.
+   * A kind that resolves ONE configured model never notices; a kind with a model picker
+   * does, loudly — every build throwing "Model tinfoil/… not found" on a machine with a
+   * working key. See the shim's header for the full account.
+   */
+  privacyRepairs?: boolean;
+}
+
+const CAPABILITIES: Record<MoatKind, MoatCaps> = {
+  "harbor-session": { web: "account", media: true, mcp: true },
   "live-task": { web: false, media: true, mcp: false },
-  channels: { web: true, media: true, mcp: false },
-  acp: { web: true, media: true, mcp: false },
+  channels: { web: "account", media: true, mcp: false },
+  acp: { web: "account", media: true, mcp: false },
   repl: { web: false, media: true, mcp: false },
+  desktop: { web: "guarded", media: true, mcp: true, context: true, spawnSkills: true, privacyRepairs: true },
 };
 
 /**
@@ -180,16 +249,32 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
   const { makePermissionGate } = await import("../ext/permissionGate.ts");
   const { makeAccountProvider } = await import("../providers/account.ts");
   const { webEnabled, mediaEnabled } = await import("./hosted.ts");
-  const { privacyExtension } = await import("./privacyPolicy.ts");
 
   const factories: ExtensionFactory[] = [makePermissionGate(opts.gate)];
 
   // pi-privacy is configured in exactly ONE place, shared with the DISCOVERED copy of this
   // extension (the TUI's, and every subagent child's) — see ./privacyPolicy.ts for the two
-  // bugs that came of configuring it in two.
-  factories.push(privacyExtension());
+  // bugs that came of configuring it in two. `privacyRepairs` picks which of the two
+  // ROUTES into that one configuration a kind takes, never which options it gets.
+  if (caps.privacyRepairs) {
+    const { default: privateerPrivacy } = await import("../../extensions/privateer-privacy.ts");
+    factories.push(privateerPrivacy);
+  } else {
+    const { privacyExtension } = await import("./privacyPolicy.ts");
+    factories.push(privacyExtension());
+  }
   factories.push(makeAccountProvider()); // must follow pi-privacy — see header
 
+  if (caps.context) {
+    const { default: privateerContext } = await import("../../extensions/privateer-context.ts");
+    factories.push(privateerContext);
+  }
+
+  if (caps.spawnSkills) {
+    const { default: privateerSpawnSkills } = await import("../../extensions/privateer-spawn-skills.ts");
+    factories.push(privateerSpawnSkills);
+  }
+
   if (opts.relayFiles) {
     const { makeRelayFileTools } = await import("../tools/relayFileTools.ts");
     factories.push(makeRelayFileTools(opts.relayFiles.bridge, opts.relayFiles.attachments));
@@ -200,9 +285,16 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
     factories.push(makeAttachResultTools(opts.resultMedia));
   }
 
-  if (caps.web && webEnabled()) {
+  if (caps.web === "account" && webEnabled()) {
     const { makeWebTools } = await import("../tools/web.ts");
     factories.push(makeWebTools());
+  } else if (caps.web === "guarded") {
+    if (!opts.webHint) throw new Error(`buildMoat: kind "${opts.kind}" needs a webHint for guarded web tools`);
+    const hint = opts.webHint;
+    const { guardedWebToolDefinitions } = await import("../tools/web.ts");
+    factories.push((pi: any) => {
+      for (const def of guardedWebToolDefinitions(hint)) pi.registerTool?.(def);
+    });
   }
 
   if (caps.media && mediaEnabled()) {
@@ -222,7 +314,8 @@ export async function buildMoat(opts: MoatOptions): Promise<ExtensionFactory[]>
     // (inside createAgentSessionServices), not when it is imported here, so the env has to
     // be set around session creation rather than around this call.
     const mcpAdapterSpec = "pi-mcp-adapter";
-    const { default: mcpAdapter } = await import(mcpAdapterSpec);
+    const hostImport = opts.hostImport ?? ((spec: string) => import(spec));
+    const { default: mcpAdapter } = await hostImport(mcpAdapterSpec);
     factories.push(mcpAdapter);
   }
 

package/src/harbor/index.ts

@@ -651,6 +651,16 @@ export class Harbor {
   }
 
   private async tick(): Promise<void> {
+    // Retry the relay every tick, not just at startup. syncRelay() bails when the
+    // account isn't signed in on this machine — and a harbor that came up in that
+    // state used to stay off the relay FOREVER, because start() was the only caller
+    // that mattered (the three IPC commands that also call it are ones the desktop
+    // app never sends). Signing in afterwards wrote credentials.json and changed
+    // nothing: the harbor kept answering IPC, so the app called it running, while
+    // its relay socket had never been opened — the permanent "Connecting" with a
+    // harbor that fires no routine and answers no spawn. Cheap and idempotent: it
+    // returns immediately once a client exists, or while remote access is off.
+    this.syncRelay();
     void this.flushPendingCloud();
     const now = Date.now();
     for (const r of loadRoutines()) {
@@ -1269,19 +1279,35 @@ export class Harbor {
   private relayStatus(): RelayStatus {
     const termId = routineRelayId();
     if (this.relayTerminated) {
-      return { termId, connected: false, detail: "remote access was turned off from the app — restart the harbor to re-enable it" };
+      return { termId, connected: false, reason: "terminated", detail: "remote access was turned off from the app — restart the harbor to re-enable it" };
     }
     if (!this.relay) {
+      // "relay not started" with credentials present is now a sub-tick window, not a
+      // permanent state: tick() re-runs syncRelay(), so a harbor that came up signed
+      // out connects on its own once you sign in. Reported as "connecting" because
+      // that is what it now is.
+      const signedIn = hasCredentials();
       return {
         termId,
         connected: false,
-        detail: hasCredentials()
+        reason: signedIn ? "connecting" : "signed-out",
+        detail: signedIn
           ? "relay not started"
-          : "no account signed in on this machine — run `privateer` and /login, then restart the harbor",
+          : "no account signed in on this machine — run `privateer` and /login",
       };
     }
     const conn = this.relay.connectionStatus();
-    if (!conn.connected) return { termId, connected: false, detail: "connecting…" };
+    // The client knows why it isn't up — a refused ticket, an unreachable server —
+    // and reporting a flat "connecting…" over the top of that is what made a harbor
+    // that will never connect look like one that is about to.
+    if (!conn.connected) {
+      return {
+        termId,
+        connected: false,
+        reason: conn.refused ? "refused" : "connecting",
+        detail: conn.detail ?? "connecting…",
+      };
+    }
     return { termId, connected: true, upSec: conn.upSec, quietSec: conn.quietSec };
   }
 

package/src/harbor/ipc.ts

@@ -42,6 +42,21 @@ export type IpcRequest =
   | { cmd: "run-now"; idOrName: string }
   | { cmd: "reload" };
 
+/**
+ * Why a harbor isn't on the relay, as a code rather than a sentence.
+ *
+ * `detail` below is written for a terminal — it names CLI commands and is English
+ * only — so the app can't put it in front of a user. It used to have nothing else
+ * to go on, and said "give it a moment" about every one of these, including the
+ * three that never clear on their own. This is the machine-readable half.
+ *
+ *   terminated  remote access was switched off from the app; needs a restart
+ *   signed-out  no account credentials on this machine
+ *   refused     the server said no (plan's agent cap, rejected ticket) — standing
+ *   connecting  genuinely still trying; this one really is worth a moment
+ */
+export type RelayReason = "terminated" | "signed-out" | "refused" | "connecting";
+
 /**
  * The harbor's view of its own relay connection, reported by `status`.
  *
@@ -62,6 +77,8 @@ export interface RelayStatus {
   quietSec?: number;
   /** Why it isn't connected, when we know: signed out, turned off from the app, … */
   detail?: string;
+  /** The same fact as `detail`, for a caller that has to localize it. */
+  reason?: RelayReason;
 }
 
 export interface IpcResponse {

package/src/mcp/catalog.ts

@@ -375,6 +375,47 @@ export const MCP_CATALOG: CatalogEntry[] = [
     hosted: false,
     docsUrl: "https://dev.epicgames.com/documentation/unreal-engine/unreal-mcp-in-unreal-editor",
   },
+  {
+    // Godot ships no MCP server of its own. This is the "Godot MCP Native" editor
+    // plugin (MIT, Godot Asset Library) — chosen because it serves streamable HTTP
+    // from INSIDE the editor process, which is the same shape as the Unreal entry
+    // above and needs nothing installed on the machine outside Godot itself.
+    //
+    // Deliberately NOT one of the npx-launched Godot servers: those shell out to the
+    // `godot` BINARY headlessly (a second, non-interactive copy of the project rather
+    // than the editor the user is looking at), and every one of them is configured by
+    // a GODOT_PATH env var — a filesystem path, which is neither a token nor a
+    // placeholder arg, so this catalog has no `needs` that could ask for it honestly.
+    //
+    // Two things differ from Unreal, and they are the only two:
+    //  1. THE PLUGIN IS NOT PART OF THE ENGINE. Install "Godot MCP Native" from the
+    //     Asset Library and enable it in Project → Project Settings → Plugins. Until
+    //     that is done the port is simply closed, which looks identical to "Godot is
+    //     not running" — so the setup guide below matters more here than it does for
+    //     Unreal, where the plugin ships with 5.8.
+    //  2. ITS BIND ADDRESS IS NOT DOCUMENTED UPSTREAM. Unreal's is (loopback, plus an
+    //     Origin check); this one's is not, so the honest claim is only that WE dial
+    //     127.0.0.1 — never that the editor cannot be reached from the LAN. Its own
+    //     `auth_enabled` is off by default (user://mcp_settings.cfg), which is the
+    //     knob to turn on when the machine sits on a network you don't trust.
+    //
+    // Everything else matches Unreal: nothing to authorize on the wire we use (hence
+    // localHttp + auth:"none"), it answers only while the editor is open, and the port
+    // is editable (`http_port`) — hence needs:"url", confirm the endpoint.
+    id: "godot",
+    name: "godot",
+    label: "Godot Engine",
+    blurb: "Drive the Godot editor — scenes, nodes, scripts, resources.",
+    transport: "http",
+    url: "http://127.0.0.1:9080/mcp",
+    localHttp: true,
+    needs: "url",
+    // Same reason as Unreal: hostedCapable() derives its answer from `oauth`, so
+    // http-with-no-auth would otherwise read as hostable. An enclave cannot reach a
+    // loopback port on the user's desk.
+    hosted: false,
+    docsUrl: "https://github.com/yurineko73/Godot-MCP-Native",
+  },
 ];
 
 export function catalogEntry(id: string): CatalogEntry | undefined {

package/src/providers/phala/aci-verifier/VENDORED.md

@@ -1,39 +1,63 @@
-# Vendored: `@dstack/aci-verifier`
+# Vendored: the ACI verifier
 
-Faithful copy of the zero-dependency TypeScript ACI verifier from
+Copy of the zero-dependency TypeScript ACI verifier from
 [Dstack-TEE/private-ai-gateway](https://github.com/Dstack-TEE/private-ai-gateway)
 (`clients/verifier-ts/src`), Apache-2.0. It is `private: true` upstream (not on
 npm), so it is vendored here rather than installed.
 
-Provides the pieces `PhalaProvider` needs:
-- **`verifyReportBinding`** (`report.ts`) — §10.1 checks 2–6 (crypto binding of the
-  attestation report to the attested keyset for a supplied nonce). NOT the hardware
-  TDX quote (check 1) — that is layered on with `@phala/dcap-qvl` in the provider.
-- **`openE2eeChannel`** (`e2ee-channel.ts`) — the ACI E2EE channel:
+Current drop: commit `1a044e960fbec8ab20f38524bc93aa0ced83d5b0` — the `aci/1`
+protocol, which is what `inference.phala.com` actually serves as of 2026-08-24.
+
+Provides the pieces the Phala sealed transport needs:
+- **`verifyReportBinding`** (`report.ts`) — §9.1 checks 2–3: the served keyset
+  canonicalizes to the digest that the attestation statement for our nonce hashes
+  into `report_data`, and the keyset has not expired. NOT the hardware TDX quote
+  (check 1) — that is layered on with `@phala/dcap-qvl` in `../../phalaSeal.ts`.
+- **`openE2eeChannel`** (`e2ee-channel.ts`) — the E2EE v2 channel:
   `x25519-aes-256-gcm-hkdf-sha256`, per-field seal/open, `X-E2EE-*` headers.
 
-## Local adaptation (the only change from upstream)
-- Relative import specifiers had their `.js` extension stripped (`'./jcs.js'` →
-  `'./jcs'`) so Metro + TS (`moduleResolution: bundler`) resolve to the `.ts` files.
+## Protocol note: what `aci/1` changed
+The previous drop verified a *keyset endorsement*: the keyset carried a
+`workload_identity` key, that key signed the keyset digest, and `workload_id` was
+the digest of the identity key. `aci/1` removes all three. The keyset is now bound
+straight into `report_data` — the statement is
+`{"keyset_digest":…,"nonce":…,"purpose":"aci.report_data.v1"}` — so the hardware
+quote is the only signature over it, and per-key custody (`evidence.key_custody`,
+the dstack-KMS chain) is explicitly policy/caller territory (§9.1 checks 5–6),
+which we do not check.
+
+Practical consequence: a client written against the old shape does not degrade,
+it *crashes* — `workload_keyset.workload_identity` is simply absent. That is what
+broke sealed `phala/*` turns with `sealed shim: Cannot read properties of
+undefined (reading 'public_key')` before this drop.
+
+## Local adaptations (the only changes from upstream)
+1. Relative import specifiers had their `.js` extension stripped (`'./jcs.js'` →
+   `'./jcs'`) so Metro + TS (`moduleResolution: bundler`) resolve to the `.ts` files.
+2. `jcs.ts` is kept as its own module. Upstream folded JCS into `crypto.ts` as a
+   sort-and-`JSON.stringify` helper; ours is the stricter RFC 8785 implementation
+   from the earlier drop (it *rejects* non-integer numbers rather than
+   mis-serializing them), and the E2EE AAD builders depend on it. `digest.ts`,
+   `receipt.ts`, and `session.ts` therefore import `jcsBytes` from `./jcs`
+   instead of `./crypto`.
+3. `report.ts` carries only `verifyReportBinding`. Upstream's `verifyQuote` and
+   `verifyComposeMeasurement` are omitted: `../../phalaSeal.ts` owns the quote (it
+   also gates TCB status and pins the measurements) and `../measurements.ts` owns
+   the event-log replay across all four RTMRs, not just RTMR3. Omitting them keeps
+   this tree dependency-free and `@phala/dcap-qvl` off every startup's import path.
+4. `e2ee.ts` and `e2ee-channel.ts` are carried forward from the earlier drop.
+   Upstream moved E2EE out of the verifier package ("specified by §6 but not
+   constructed by this verifier"); the wire format itself is unchanged and still
+   specified in `spec/e2ee-v2.md`, and the gateway still advertises
+   `supported_e2ee_versions: ["2"]`.
+5. `transcript.ts` (upstream's one-call `verifyService` + verdict rendering) is not
+   vendored — `phalaSeal.ts` composes its own verdict and enclave identity.
 
 Everything else is byte-for-byte upstream. The crypto runs on `globalThis.crypto`
-(Web Crypto: X25519, HKDF, AES-GCM, Ed25519, `getRandomValues`). In privateer-agent
-(Node ≥ 22) these are all native — **no polyfills needed** (unlike the treeview RN app,
-which bridges them via `react-native-quick-crypto`). Re-pull from upstream to update;
-re-apply only the `.js`-extension strip.
-
-## What lives OUTSIDE this directory (and why)
-`../reportBinding.ts` — `verifyAciReportBinding`, the algorithm dispatch for §10.1
-checks 2–6. Callers use it instead of importing `verifyReportBinding` from here.
-
-Upstream's verifier is Web-Crypto-only, so it throws `UnsupportedAlgorithmError` on
-an `ecdsa-secp256k1` keyset endorsement — which §4.3 explicitly permits alongside
-ed25519, and which the deployed `inference.phala.com` gateway actually uses. Rather
-than patch this tree (and re-patch it on every re-pull), the dispatch sits outside:
-ed25519 delegates here verbatim, secp256k1 takes a parallel path over `@noble/curves`,
-and any other algorithm still throws. Nothing here changed, so the re-pull recipe
-above stays exactly the `.js`-extension strip.
-
-If upstream ever adds secp256k1 (or a check 7) to `report.ts`, collapse
-`reportBinding.ts` back to a straight re-export — `tests/phalaReportBinding.test.ts`
-pins the behaviour either way.
+(Web Crypto: X25519, HKDF, AES-GCM, Ed25519, SHA-384, `getRandomValues`). In
+privateer-agent (Node ≥ 22) these are all native — **no polyfills needed** (unlike
+the treeview RN app, which bridges them via `react-native-quick-crypto`).
+
+Re-pull recipe: copy `clients/verifier-ts/src/*.ts`, strip the `.js` extensions,
+then re-apply adaptations 2–5. `tests/phalaReportBinding.test.ts` pins the binding
+behaviour against a real report captured from the live gateway.

package/src/providers/phala/aci-verifier/crypto.ts

@@ -1,10 +1,11 @@
 /**
  * Cryptographic primitives, all via the Web Crypto API (`globalThis.crypto`) so
- * the same code runs in browsers and in Node 20+ with no third-party deps.
- * Only SHA-256 and Ed25519 verification are needed for Level 1.
+ * the same code runs in browsers and in Node 20+ with no dependencies. ACI's
+ * only signature algorithm is Ed25519 and its only hash is SHA-256 (spec
+ * Appendix B) — both are in Web Crypto, so nothing needs injecting.
  */
 
-import { AciFormatError, UnsupportedAlgorithmError } from './errors';
+import { AciFormatError } from './errors';
 
 const subtle = globalThis.crypto.subtle;
 
@@ -23,20 +24,45 @@ export function fromHex(hex: string): Uint8Array {
   }
   const out = new Uint8Array(h.length / 2);
   for (let i = 0; i < out.length; i++) {
-    const byte = Number.parseInt(h.substr(i * 2, 2), 16);
+    const byte = Number.parseInt(h.slice(i * 2, i * 2 + 2), 16);
     if (Number.isNaN(byte)) {
-      throw new AciFormatError(`invalid hex at offset ${i * 2}: "${h.substr(i * 2, 2)}"`);
+      throw new AciFormatError(`invalid hex at offset ${i * 2}: "${h.slice(i * 2, i * 2 + 2)}"`);
     }
     out[i] = byte;
   }
   return out;
 }
 
+/** Encode bytes as standard base64 (RFC 4648 §4, with padding) — the `_b64` field form (Appendix A). */
+export function toBase64(bytes: Uint8Array): string {
+  let bin = '';
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+
+/** Decode standard base64 to the exact underlying bytes. */
+export function fromBase64(b64: string): Uint8Array {
+  let bin: string;
+  try {
+    bin = atob(b64);
+  } catch {
+    throw new AciFormatError('invalid base64');
+  }
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
 /** SHA-256 of the given bytes. */
 export async function sha256(bytes: Uint8Array): Promise<Uint8Array> {
   return new Uint8Array(await subtle.digest('SHA-256', bytes as BufferSource));
 }
 
+/** SHA-384 of the given bytes — the dstack RTMR replay hash (§9.1 policy). */
+export async function sha384(bytes: Uint8Array): Promise<Uint8Array> {
+  return new Uint8Array(await subtle.digest('SHA-384', bytes as BufferSource));
+}
+
 /** Lowercase-hex SHA-256 of the given bytes. */
 export async function sha256Hex(bytes: Uint8Array): Promise<string> {
   return toHex(await sha256(bytes));
@@ -44,16 +70,16 @@ export async function sha256Hex(bytes: Uint8Array): Promise<string> {
 
 /**
  * `sha256:<lowercase-hex>` digest string of the given bytes — the ACI digest
- * form (§3) used for `workload_id`, keyset digests, and body hashes.
+ * form (Appendix A) used for keyset digests, body hashes, and session ids.
  */
 export async function sha256Prefixed(bytes: Uint8Array): Promise<string> {
   return 'sha256:' + (await sha256Hex(bytes));
 }
 
 /**
- * Verify an Ed25519 signature (RFC 8032, §4.3/§8.5) over `message`.
- * `publicKeyRaw` is the 32-byte raw key; `signature` the 64-byte value.
- * Returns false on a bad signature or malformed key — never throws for those.
+ * Verify an Ed25519 signature (RFC 8032) over `message`. `publicKeyRaw` is the
+ * 32-byte raw key; `signature` the 64-byte value. Returns false on a bad
+ * signature or malformed key — never throws for those.
  */
 export async function verifyEd25519(
   publicKeyRaw: Uint8Array,
@@ -75,21 +101,3 @@ export async function verifyEd25519(
     return false;
   }
 }
-
-/**
- * Verify a signature by ACI signature `algo`, dispatching on the algorithm the
- * attested keyset entry declares. Only `ed25519` is verifiable here; every other
- * algorithm (including `ecdsa-secp256k1`) raises {@link UnsupportedAlgorithmError}.
- */
-export async function verifySignature(
-  algo: string,
-  publicKeyRaw: Uint8Array,
-  signature: Uint8Array,
-  message: Uint8Array,
-  context: string,
-): Promise<boolean> {
-  if (algo === 'ed25519') {
-    return verifyEd25519(publicKeyRaw, signature, message);
-  }
-  throw new UnsupportedAlgorithmError(algo, context);
-}