privateer-agent 0.7.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "privateer-agent",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Privateer — a provider-agnostic, safe-by-default terminal coding agent with TEE/Tinfoil attestation, rebuilt on the Pi toolkit. Bring your own model across 20 providers.",
   "type": "module",
   "license": "MIT",
@@ -67,12 +67,14 @@
     "@noble/ciphers": "^2.1.1",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.7.1",
+    "@phala/dcap-qvl": "^0.5.2",
     "patch-package": "^8.0.1",
     "pi-mcp-adapter": "^2.11.0",
-    "pi-privacy": "^0.3.0",
+    "pi-privacy": "^0.7.0",
     "pi-subagents": "^0.34.0",
     "picomatch": "^4.0.4",
     "privateer-workflow": "^0.1.0",
+    "tinfoil": "^1.1.11",
     "tsx": "^4.16.0",
     "typebox": "^1.3.4",
     "undici": "^7.28.0",

package/src/channels/run.ts

@@ -109,7 +109,8 @@ async function main() {
   const { makePermissionGate } = await import("../ext/permissionGate.ts");
   type GateController = import("../ext/permissionGate.ts").GateController;
   const { makePiPrivacyExtension } = await import("pi-privacy");
-  const { makeAccountProvider } = await import("../providers/account.ts");
+  const { makeAccountProvider, privateerChannel } = await import("../providers/account.ts");
+  const { hasCredentials } = await import("../auth/privateer.ts");
   const { resolveDefaultModel } = await import("../providers/defaultModel.ts");
   const { agentDir, configPath, globalDir } = await import("../config/paths.ts");
   const { redactText, collectSecrets } = await import("../util/redact.ts");
@@ -181,7 +182,15 @@ async function main() {
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+      extensionFactories: [
+        makePermissionGate(gate),
+        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
+        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
+        makePiPrivacyExtension({
+          privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+        }),
+        makeAccountProvider(),
+      ] as any,
     },
   });
 

package/src/cli/chat.ts

@@ -38,7 +38,7 @@ async function main() {
   const { authorizeControl } = await import("../remote/controlAuth.ts");
   const { resolveMentions, completeMention, searchFiles } = await import("../util/fileMentions.ts");
   const priv = await import("../auth/privateer.ts");
-  const { makeAccountProvider, accountPosture } = await import("../providers/account.ts");
+  const { makeAccountProvider, accountPosture, privateerChannel } = await import("../providers/account.ts");
   const { agentVersion } = await import("../config/version.ts");
   const { resolveDefaultModel, resolveSignedInModel } = await import("../providers/defaultModel.ts");
 
@@ -329,7 +329,15 @@ async function main() {
     agentDir: agentDir(),
     resourceLoaderOptions: {
       // Structural ext types are intentionally narrow; cast to Pi's ExtensionFactory.
-      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+      extensionFactories: [
+        makePermissionGate(gate),
+        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
+        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
+        makePiPrivacyExtension({
+          privateerVerifiedTee: (m) => priv.hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+        }),
+        makeAccountProvider(),
+      ] as any,
     },
   });
   for (const d of services.diagnostics) if (d.type === "error") console.log(`${RED}! ${d.message}${RESET}`);

package/src/harbor/index.ts

@@ -14,7 +14,7 @@ import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { makePermissionGate, type GateController } from "../ext/permissionGate.ts";
 import { makePiPrivacyExtension } from "pi-privacy";
-import { makeAccountProvider } from "../providers/account.ts";
+import { makeAccountProvider, privateerChannel } from "../providers/account.ts";
 import { resolveDefaultModel } from "../providers/defaultModel.ts";
 import { RelayClient, type TaskSpec } from "../remote/relayClient.ts";
 import { createLiveTaskSession, type LiveTaskHandle } from "../remote/liveTaskSession.ts";
@@ -30,7 +30,7 @@ import { openJsonFromApp } from "../crypto/terminalUnseal.ts";
 import { verifyChannelSave, verifyOutboxKey } from "../crypto/accountVerify.ts";
 import { loadAccountSignKey, loadLastControlTs, saveLastControlTs } from "../crypto/accountTrust.ts";
 import { authorizeControl } from "../remote/controlAuth.ts";
-import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke } from "../auth/privateer.ts";
+import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke, defaultDeviceLabel } from "../auth/privateer.ts";
 import {
   loadRoutines,
   upsertRoutine,
@@ -50,7 +50,7 @@ import { splitRoutineTools } from "../routines/toolSelect.ts";
 import { deliver, type RelayPusher, type CloudPusher } from "../routines/delivery.ts";
 import { sealJson, decodeAccountPublicKey } from "../crypto/outboxSeal.ts";
 import { redactText, collectSecrets } from "../util/redact.ts";
-import { startIpcServer, type IpcRequest, type IpcResponse } from "./ipc.ts";
+import { startIpcServer, HarborAlreadyRunningError, type IpcRequest, type IpcResponse } from "./ipc.ts";
 import { isHosted, publishRelayPub } from "../config/hosted.ts";
 
 // The safe, read-only toolset for unattended runs — Pi builtins with no
@@ -226,13 +226,19 @@ export class Harbor {
     return "queued";
   };
 
-  start(): void {
+  async start(): Promise<void> {
+    // Single-instance lock FIRST, before any other side effect: binding the IPC
+    // socket is the machine's mutex. If a live harbor already holds it this throws
+    // HarborAlreadyRunningError — two harbors under one ~/.privateer share a single
+    // routineRelayId(), so a second would collide on the relay and double-fire
+    // routines. Doing this first means a rejected second instance never publishes a
+    // relay key, connects, or fires a tick.
+    this.server = await startIpcServer((req) => this.handleIpc(req));
     // Hosted only: publish our relay pubkey for the host to bind into the SEV-SNP
     // report. Before syncRelay() so the key exists by the time we're reachable.
     publishRelayPub();
     this.primeSchedule();
     this.timer = setInterval(() => void this.tick(), TICK_MS);
-    this.server = startIpcServer((req) => this.handleIpc(req));
     this.syncRelay();
     void this.flushPendingCloud();
     const count = loadRoutines().filter((r) => r.enabled).length;
@@ -517,11 +523,22 @@ export class Harbor {
     }
   }
 
+  // This machine's origin tag, embedded (E2EE) in every sealed result so the app can
+  // show WHICH box/environment produced it — the outbox record itself is account-only,
+  // so attribution can only live inside the sealed blob (where hostnames are allowed;
+  // the server never sees it). `id` is this install's stable relay id; `label` is the
+  // hostname-based device name. Cached — it never changes for the process lifetime.
+  private originCache?: { id: string; label: string };
+  private machineOrigin(): { id: string; label: string } {
+    if (!this.originCache) this.originCache = { id: routineRelayId(), label: defaultDeviceLabel() };
+    return this.originCache;
+  }
+
   private async postOutbox(name: string, at: string, status: "ok" | "error", content: string, kind: "routine" | "task" = "routine"): Promise<boolean> {
     const pub = await this.ensureOutboxPub();
     if (!pub) return false;
     const body = content.length > MAX_CLOUD_PLAINTEXT ? content.slice(0, MAX_CLOUD_PLAINTEXT) + "\n…truncated" : content;
-    const sealed = sealJson(pub, { v: 1, kind, name, status, at, content: body });
+    const sealed = sealJson(pub, { v: 1, kind, name, status, at, content: body, origin: this.machineOrigin() });
     try {
       const res = await apiRequest("/api/outbox", {
         method: "POST",
@@ -727,7 +744,18 @@ export class Harbor {
         cwd: spec.cwd,
         agentDir: agentDir(),
         resourceLoaderOptions: {
-          extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider(), mcpAdapter] as any,
+          extensionFactories: [
+            makePermissionGate(gate),
+            // Per-model verified-TEE capability for pi-privacy's /models picker: show
+            // Privateer's TEE-channel models (near/tinfoil/phala) as "◆ Verifiable TEE"
+            // when logged in; ZDR-channel models stay at their honest floor. The live
+            // verdict still comes from accountPosture on select — this only lifts the label.
+            makePiPrivacyExtension({
+              privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+            }),
+            makeAccountProvider(),
+            mcpAdapter,
+          ] as any,
         },
       });
       servicesRef = services as any;
@@ -1034,7 +1062,6 @@ export class Harbor {
 // Entry point for `privateer harbor`. Caller must have imported ./boot.ts first.
 export function runHarbor(): void {
   const harbor = new Harbor();
-  harbor.start();
   const shutdown = () => {
     log("shutting down");
     harbor.stop();
@@ -1042,4 +1069,14 @@ export function runHarbor(): void {
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
+  harbor.start().catch((err) => {
+    if (err instanceof HarborAlreadyRunningError) {
+      // A resident harbor already owns this machine — leave it in charge. Exit 0 so a
+      // manual `privateer harbor run` beside the installed login service isn't an error.
+      process.stderr.write("A Harbor is already running on this machine — leaving the existing one in charge.\n");
+      process.exit(0);
+    }
+    process.stderr.write(`Harbor failed to start: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+  });
 }

package/src/harbor/ipc.ts

@@ -33,44 +33,82 @@ export interface IpcResponse {
 
 export type IpcHandler = (req: IpcRequest) => Promise<IpcResponse> | IpcResponse;
 
-// Start the harbor-side socket server. Returns the Server so the caller can close it.
-export function startIpcServer(handler: IpcHandler): Server {
+// Probe whether a LIVE process is listening on the socket at `path`. Used as the
+// single-instance test: a successful connect (or a slow-to-answer one) means a real
+// harbor holds the lock; ECONNREFUSED/ENOENT means the socket file is stale (no
+// listener behind it) and is safe to reclaim. Conservative — any ambiguous error
+// resolves `true` so we never steal a path that might still be owned.
+function probeExistingListener(path: string, timeoutMs = 1000): Promise<boolean> {
+  return new Promise((resolve) => {
+    const sock = createConnection(path);
+    const done = (live: boolean) => {
+      clearTimeout(timer);
+      try { sock.destroy(); } catch { /* already gone */ }
+      resolve(live);
+    };
+    const timer = setTimeout(() => done(true), timeoutMs); // slow to answer ⇒ assume live
+    sock.on("connect", () => done(true));
+    sock.on("error", (err: NodeJS.ErrnoException) => {
+      done(!(err.code === "ECONNREFUSED" || err.code === "ENOENT"));
+    });
+  });
+}
+
+// Start the harbor-side socket server. Resolves with the Server (so the caller can
+// close it), or REJECTS with HarborAlreadyRunningError if a live harbor already owns
+// the socket — the bind is the machine's single-instance lock. Two harbors under one
+// ~/.privateer share a single routineRelayId(), so a second instance would collide on
+// the relay and double-fire routines; refusing to start is the fix. A stale socket
+// file (crash with no live listener) is detected and reclaimed, so recovery still works.
+export function startIpcServer(handler: IpcHandler): Promise<Server> {
   const path = harborSocketPath();
-  // A stale socket file from a previous crash would block bind; remove it first.
-  if (existsSync(path)) {
-    try {
-      unlinkSync(path);
-    } catch {
-      /* ignore — bind will surface a clearer error */
-    }
-  }
-  const server = createServer((sock: Socket) => {
-    let buf = "";
-    sock.on("data", (chunk) => {
-      buf += chunk.toString("utf8");
-      const nl = buf.indexOf("\n");
-      if (nl < 0) return; // wait for the full line
-      const line = buf.slice(0, nl);
-      void (async () => {
-        let res: IpcResponse;
+  const build = (): Server =>
+    createServer((sock: Socket) => {
+      let buf = "";
+      sock.on("data", (chunk) => {
+        buf += chunk.toString("utf8");
+        const nl = buf.indexOf("\n");
+        if (nl < 0) return; // wait for the full line
+        const line = buf.slice(0, nl);
+        void (async () => {
+          let res: IpcResponse;
+          try {
+            res = await handler(JSON.parse(line) as IpcRequest);
+          } catch (err) {
+            res = { ok: false, message: err instanceof Error ? err.message : String(err) };
+          }
+          sock.end(JSON.stringify(res) + "\n");
+        })();
+      });
+      sock.on("error", () => sock.destroy());
+    });
+
+  return new Promise<Server>((resolve, reject) => {
+    // `reclaimed` guards a single stale-socket reclaim so a persistent bind failure
+    // can't loop. On EADDRINUSE we probe for a live listener rather than unlinking
+    // blindly (the old behavior, which let a second harbor silently steal the path).
+    const attempt = (reclaimed: boolean) => {
+      const server = build();
+      server.once("error", (err: NodeJS.ErrnoException) => {
+        if (err.code !== "EADDRINUSE") { reject(err); return; }
+        void probeExistingListener(path).then((live) => {
+          if (live) { reject(new HarborAlreadyRunningError()); return; }
+          if (reclaimed) { reject(err); return; } // already reclaimed once — give up
+          try { unlinkSync(path); } catch { /* ignore — retry surfaces a clearer error */ }
+          attempt(true);
+        });
+      });
+      server.listen(path, () => {
         try {
-          res = await handler(JSON.parse(line) as IpcRequest);
-        } catch (err) {
-          res = { ok: false, message: err instanceof Error ? err.message : String(err) };
+          chmodSync(path, 0o600); // owner-only IPC endpoint
+        } catch {
+          /* non-POSIX — best effort */
         }
-        sock.end(JSON.stringify(res) + "\n");
-      })();
-    });
-    sock.on("error", () => sock.destroy());
-  });
-  server.listen(path, () => {
-    try {
-      chmodSync(path, 0o600); // owner-only IPC endpoint
-    } catch {
-      /* non-POSIX — best effort */
-    }
+        resolve(server);
+      });
+    };
+    attempt(false);
   });
-  return server;
 }
 
 // Client side: send one request, resolve with the response. Rejects if the harbor
@@ -116,6 +154,16 @@ export class HarborNotRunningError extends Error {
   }
 }
 
+// Thrown by startIpcServer when a live harbor already holds this machine's socket —
+// i.e. a second instance is trying to start under the same ~/.privateer. The caller
+// (runHarbor) treats this as a clean no-op exit, not a crash.
+export class HarborAlreadyRunningError extends Error {
+  constructor() {
+    super("A Harbor is already running on this machine.");
+    this.name = "HarborAlreadyRunningError";
+  }
+}
+
 // Convenience: is the harbor reachable right now?
 export async function harborIsRunning(): Promise<boolean> {
   try {

package/src/mcp/catalog.ts

@@ -130,6 +130,112 @@ export const MCP_CATALOG: CatalogEntry[] = [
     args: ["-y", "@modelcontextprotocol/server-memory"],
     needs: "none",
   },
+
+  // ── Remote, browser-authorized (OAuth) ──────────────────────────────────────
+  {
+    id: "sentry",
+    name: "sentry",
+    label: "Sentry",
+    blurb: "Errors, issues, and releases. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.sentry.dev/mcp",
+    oauth: true,
+    needs: "oauth",
+  },
+  {
+    id: "atlassian",
+    name: "atlassian",
+    label: "Jira & Confluence",
+    blurb: "Atlassian issues and pages. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.atlassian.com/v1/sse",
+    oauth: true,
+    needs: "oauth",
+  },
+  {
+    id: "stripe",
+    name: "stripe",
+    label: "Stripe",
+    blurb: "Payments, customers, and invoices. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.stripe.com",
+    oauth: true,
+    needs: "oauth",
+  },
+  {
+    id: "asana",
+    name: "asana",
+    label: "Asana",
+    blurb: "Tasks and projects. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.asana.com/sse",
+    oauth: true,
+    needs: "oauth",
+  },
+
+  // ── Local, token-authorized ─────────────────────────────────────────────────
+  {
+    id: "brave-search",
+    name: "brave-search",
+    label: "Brave Search",
+    blurb: "Web and local search results.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-brave-search"],
+    env: { BRAVE_API_KEY: "" },
+    needs: "token",
+    fill: "BRAVE_API_KEY",
+    credUrl: "https://brave.com/search/api/",
+  },
+  {
+    id: "google-maps",
+    name: "google-maps",
+    label: "Google Maps",
+    blurb: "Places, directions, and geocoding.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-google-maps"],
+    env: { GOOGLE_MAPS_API_KEY: "" },
+    needs: "token",
+    fill: "GOOGLE_MAPS_API_KEY",
+    credUrl: "https://console.cloud.google.com/google/maps-apis/credentials",
+  },
+  {
+    id: "supabase",
+    name: "supabase",
+    label: "Supabase",
+    blurb: "Query and manage your Supabase project.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@supabase/mcp-server-supabase@latest"],
+    env: { SUPABASE_ACCESS_TOKEN: "" },
+    needs: "token",
+    fill: "SUPABASE_ACCESS_TOKEN",
+    credUrl: "https://supabase.com/dashboard/account/tokens",
+  },
+  {
+    id: "figma",
+    name: "figma",
+    label: "Figma",
+    blurb: "Read designs, frames, and components.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "figma-developer-mcp", "--stdio"],
+    env: { FIGMA_API_KEY: "" },
+    needs: "token",
+    fill: "FIGMA_API_KEY",
+    credUrl: "https://www.figma.com/developers/api#access-tokens",
+  },
+  {
+    id: "sequential-thinking",
+    name: "sequential-thinking",
+    label: "Sequential Thinking",
+    blurb: "A step-by-step reasoning scratchpad.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-sequential-thinking"],
+    needs: "none",
+  },
 ];
 
 export function catalogEntry(id: string): CatalogEntry | undefined {

package/src/providers/account.ts

@@ -22,6 +22,13 @@ import {
 } from "../auth/privateer.ts";
 import { interpretReport, teePosture, tierFromTeePosture, type PrivacyTier } from "pi-privacy";
 import { ACCOUNT_DEFAULT_MODEL_ID, ACCOUNT_NEAR_MODEL_ID, ensurePiDefaultModel } from "./defaultModel.ts";
+import {
+  sealedEnabled,
+  sealedProviderFor,
+  sealedShimBase,
+  ensureSealedShim,
+  attestSealed,
+} from "./sealedShim.ts";
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
@@ -73,7 +80,9 @@ const VALID_TIERS = new Set<PrivacyTier>([
 // upgrades it to tee-verified live via attestation (accountPosture). Everything
 // else with no server signal is "standard": we don't assert ZDR we can't back.
 function tierFromPrefix(modelId: string): PrivacyTier {
-  return modelId.startsWith("near/") || modelId.startsWith("tinfoil/") ? "tee-unverified" : "standard";
+  return modelId.startsWith("near/") || modelId.startsWith("tinfoil/") || modelId.startsWith("phala/")
+    ? "tee-unverified"
+    : "standard";
 }
 
 function normalizeTier(tier: string | undefined, modelId: string): PrivacyTier {
@@ -248,13 +257,26 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
   if (privateerChannel(modelId) === "zdr") {
     return { tier: "zdr-policy" };
   }
-  // Honest labelling for the non-NEAR enclaves. Tinfoil and Phala publish real
-  // attestations, but the server proxies the inference, so from here we cannot bind a
-  // quote to the connection actually carrying our tokens — only the account's word
-  // that it did. That's `tee-unverified` (yellow "confidential compute, unconfirmed"),
-  // never the green tee-verified we reserve for a quote we checked ourselves. A user
-  // who wants the verified shield sets TINFOIL_API_KEY and runs `tinfoil/*` direct,
-  // where pi-privacy attests the enclave client-side.
+  // Sealed (EHBP) path. When sealed mode is on and the model has a Node sealed
+  // client (tinfoil/*), inference goes through the blind relay with the body
+  // HPKE-sealed to the enclave, and we attest that enclave client-side with the SAME
+  // SecureClient that carries the tokens. A green ready() is a quote WE checked,
+  // bound to the HPKE key we seal to — so it earns tee-verified. A failure stays
+  // tee-unverified with the reason surfaced (never a silent green). See
+  // docs/tee-privateer-tinfoil-ehbp.md.
+  const sealedProvider = sealedEnabled() ? sealedProviderFor(modelId) : null;
+  if (sealedProvider) {
+    const att = await attestSealed(sealedProvider);
+    return att.ok ? { tier: "tee-verified" } : { tier: "tee-unverified", error: att.error };
+  }
+  // Honest labelling for the non-NEAR enclaves without sealed mode. Tinfoil and Phala
+  // publish real attestations, but the server proxies the inference in cleartext, so
+  // from here we cannot bind a quote to the connection actually carrying our tokens —
+  // only the account's word that it did. That's `tee-unverified` (yellow "confidential
+  // compute, unconfirmed"), never the green tee-verified we reserve for a quote we
+  // checked ourselves. Turn on sealed mode (PRIVATEER_SEALED=1) for the verified
+  // shield, or set TINFOIL_API_KEY and run `tinfoil/*` direct (pi-privacy attests
+  // client-side over the TLS binding).
   if (!modelId.startsWith("near/")) {
     return { tier: "tee-unverified" };
   }
@@ -299,15 +321,40 @@ export function makeAccountProvider() {
     on?: (event: string, handler: (e: unknown, ctx: unknown) => void) => void;
   }): void => {
     if (typeof pi.registerProvider !== "function") return;
-    const register = (ids: string[]): void =>
+    // A model entry, with a per-model baseUrl override for sealed models once the
+    // EHBP shim is listening: `tinfoil/*` then route through the loopback shim (which
+    // seals to the blind relay) instead of the cleartext `/api/agent/v1` proxy.
+    // Everything else keeps the provider baseUrl below. Until the shim is up (or when
+    // sealed mode is off) sealed models fall back to the cleartext path — and the
+    // badge stays honestly `tee-unverified` (see accountPosture).
+    const modelEntry = (id: string) => {
+      const base = seedModel(id);
+      const provider = sealedEnabled() ? sealedProviderFor(id) : null;
+      const shim = sealedShimBase();
+      return provider && shim ? { ...base, baseUrl: `${shim}/${provider}/v1` } : base;
+    };
+    let lastIds: string[] = DEFAULT_MODELS;
+    const register = (ids: string[]): void => {
+      lastIds = ids;
       pi.registerProvider!("privateer", {
         name: "Privateer account",
         baseUrl: `${serverBaseUrl()}/api/agent/v1`,
         api: "openai-completions",
         oauth: privateerOAuthProvider,
-        models: ids.map(seedModel),
+        models: ids.map(modelEntry),
       });
+    };
     register(DEFAULT_MODELS); // immediate: provider exists this tick
+    // Bring up the sealed shim, then re-register so sealed models pick up their shim
+    // baseUrl. Registration re-runs anyway after the catalog fetch; this just makes
+    // sure the switch lands even if the fetch is slow or fails.
+    if (sealedEnabled()) {
+      void ensureSealedShim()
+        .then(() => register(lastIds))
+        .catch(() => {
+          /* shim failed to start → sealed models stay on the cleartext path */
+        });
+    }
     // Refine to the live catalog. fetchAccountCatalog also populates accountTierMap
     // as a side effect, so the /models picker can shield each row without re-fetching.
     void fetchAccountCatalog()

package/src/providers/catalog.ts

@@ -2,9 +2,9 @@
 // becomes reachable under Pi. Written after verifying (2026-07-07) that:
 //   - pi-ai ships STATIC model catalogs for its 14 built-in providers, so they're
 //     selectable once a key is present — privateer emits NO models.json entry for them;
-//   - the `pi-privacy` extension registers the 6 privacy providers (tinfoil, nearai,
-//     venice, ollama, custom, privateer-api) at load — privateer emits NO entry for
-//     them either;
+//   - the `pi-privacy` extension registers the privacy providers (tinfoil, nearai,
+//     venice, ollama, and — since pi-privacy 0.7 — `privateer`, its posture-aware
+//     public dev-key surface) at load — privateer emits NO entry for them either;
 //   - so the ONLY provider this generator must emit is `qwen` (config-only,
 //     non-privacy, no built-in catalog), and `privateer` (the account OAuth channel)
 //     is handled in code, not config (Phase 4).
@@ -66,9 +66,11 @@ export const PROVIDERS: ProviderEntry[] = [
   { id: "tinfoil", source: "pi-privacy" },
   { id: "venice", source: "pi-privacy" },
   { id: "custom", source: "pi-privacy" },
-  // Public developer-API surface (sk-priv-… key). Registered by the pi-privacy
-  // extension like the others; distinct from the in-app `privateer` account channel.
-  { id: "privateer-api", source: "pi-privacy" },
+  // The in-app account OAuth channel. NOTE: since pi-privacy 0.7 the extension ALSO
+  // registers a `privateer` provider (its posture-aware public sk-priv- dev-key surface,
+  // floored to zdr-policy) — but makeAccountProvider runs AFTER pi-privacy in the
+  // extension list and re-registers the same id, so the account channel wins. There is
+  // no longer a separate `privateer-api` id (renamed to `privateer` upstream).
   { id: "privateer", source: "account" },
 ];
 

package/src/providers/phala/aci-verifier/VENDORED.md

@@ -0,0 +1,23 @@
+# Vendored: `@dstack/aci-verifier`
+
+Faithful copy of the zero-dependency TypeScript ACI verifier from
+[Dstack-TEE/private-ai-gateway](https://github.com/Dstack-TEE/private-ai-gateway)
+(`clients/verifier-ts/src`), Apache-2.0. It is `private: true` upstream (not on
+npm), so it is vendored here rather than installed.
+
+Provides the pieces `PhalaProvider` needs:
+- **`verifyReportBinding`** (`report.ts`) — §10.1 checks 2–6 (crypto binding of the
+  attestation report to the attested keyset for a supplied nonce). NOT the hardware
+  TDX quote (check 1) — that is layered on with `@phala/dcap-qvl` in the provider.
+- **`openE2eeChannel`** (`e2ee-channel.ts`) — the ACI E2EE channel:
+  `x25519-aes-256-gcm-hkdf-sha256`, per-field seal/open, `X-E2EE-*` headers.
+
+## Local adaptation (the only change from upstream)
+- Relative import specifiers had their `.js` extension stripped (`'./jcs.js'` →
+  `'./jcs'`) so Metro + TS (`moduleResolution: bundler`) resolve to the `.ts` files.
+
+Everything else is byte-for-byte upstream. The crypto runs on `globalThis.crypto`
+(Web Crypto: X25519, HKDF, AES-GCM, Ed25519, `getRandomValues`). In privateer-agent
+(Node ≥ 22) these are all native — **no polyfills needed** (unlike the treeview RN app,
+which bridges them via `react-native-quick-crypto`). Re-pull from upstream to update;
+re-apply only the `.js`-extension strip.