privateer-agent 0.7.0 → 0.8.0

package/src/providers/phalaSeal.ts

@@ -0,0 +1,200 @@
+// Phala (ACI E2EE) sealed transport for the account channel — the Node port of
+// treeview's client PhalaProvider.
+//
+// Where Tinfoil seals the whole body at the transport layer (EHBP via SecureClient),
+// Phala's Attested Confidential Inference encrypts the request's *content fields*
+// (x25519-aes-256-gcm-hkdf-sha256) to the enclave's attested X25519 key, sends the
+// `X-E2EE-*` headers alongside, and decrypts the response fields. The Privateer relay
+// (`${server}/api/sealed/phala`, treeview/server/routes/sealed.js) injects PHALA_API_KEY
+// and forwards ciphertext — it can't read prompts or responses.
+//
+// Crypto is the vendored @dstack/aci-verifier (./phala/aci-verifier), pure Web Crypto
+// (X25519/HKDF/AES-GCM/Ed25519). Node ≥ 22 provides all of it on globalThis.crypto —
+// no polyfills, unlike the RN app.
+//
+// Two-layer attestation, fail-secure:
+//   (1) verifyReportBinding — the report's crypto binding (keyset digest,
+//       report_data == statement(nonce), endorsement sig). Self-attesting alone.
+//   (2) verifyHardwareQuote — the hardware root: @phala/dcap-qvl verifies the TDX quote
+//       against Intel collateral and binds the quote's report_data to (1)'s statement
+//       digest. requireQuote defaults TRUE; PRIVATEER_PHALA_REQUIRE_QUOTE=0 drops it
+//       (local testing only — removes the hardware root of trust).
+
+import type { Report } from "@phala/dcap-qvl";
+import {
+  verifyReportBinding,
+  openE2eeChannel,
+  toHex,
+  fromHex,
+  type AttestationReport,
+  type ReportVerification,
+  type E2eeChannel,
+} from "./phala/aci-verifier/index.ts";
+import { serverBaseUrl } from "../auth/privateer.ts";
+
+const DEFAULT_ACCEPTABLE_TCB = ["UpToDate"];
+
+function relayBase(): string {
+  return `${serverBaseUrl().replace(/\/+$/, "")}/api/sealed/phala`;
+}
+
+// Hardware quote check on by default (fail-secure). Only "0"/"false" disables it.
+function requireQuote(): boolean {
+  const v = process.env.PRIVATEER_PHALA_REQUIRE_QUOTE;
+  return !(v === "0" || v === "false");
+}
+function pccsUrl(): string | undefined {
+  return process.env.PRIVATEER_PHALA_PCCS_URL || undefined;
+}
+function acceptableTcb(): Set<string> {
+  const v = process.env.PRIVATEER_PHALA_TCB;
+  const list = v ? v.split(",").map((s) => s.trim()).filter(Boolean) : DEFAULT_ACCEPTABLE_TCB;
+  return new Set(list);
+}
+
+// The 64-byte report_data from a verified TDX quote report (TD1.0/1.5 layouts).
+function extractQuoteReportData(report: Report): Uint8Array {
+  const td10 = report.asTd10?.();
+  if (td10?.reportData) return new Uint8Array(td10.reportData);
+  const td15 = report.asTd15?.();
+  if (td15?.base?.reportData) return new Uint8Array(td15.base.reportData);
+  const data = report.data as { reportData?: Uint8Array } | undefined;
+  if (data?.reportData) return new Uint8Array(data.reportData);
+  throw new Error("phala: verified quote report has no reportData");
+}
+
+interface VerifiedAttestation {
+  report: AttestationReport;
+  verification: ReportVerification;
+}
+
+// Attest once, cache the verified report; drop the memo on failure so a later call
+// re-attests rather than caching the error.
+let attestationPromise: Promise<VerifiedAttestation> | null = null;
+
+function attest(): Promise<VerifiedAttestation> {
+  if (!attestationPromise) {
+    attestationPromise = establishAttestation().catch((err) => {
+      attestationPromise = null;
+      throw err as Error;
+    });
+  }
+  return attestationPromise;
+}
+
+export function resetPhala(): void {
+  attestationPromise = null;
+}
+
+async function establishAttestation(): Promise<VerifiedAttestation> {
+  const nonce = toHex(globalThis.crypto.getRandomValues(new Uint8Array(32)));
+  // The relay proxies GET /attestation?nonce=… → the gateway's
+  // GET /v1/aci/attestation?nonce=… (public; no user content).
+  const res = await fetch(`${relayBase()}/attestation?nonce=${nonce}`, { method: "GET" });
+  if (!res.ok) throw new Error(`phala attestation HTTP ${res.status}`);
+  const report = (await res.json()) as AttestationReport;
+
+  const verification = await verifyReportBinding(report, nonce);
+  if (!verification.ok) {
+    const failed = verification.checks.filter((c) => !c.ok).map((c) => c.name).join(", ");
+    throw new Error(`phala attestation binding failed: ${failed}`);
+  }
+  await verifyHardwareQuote(report);
+  return { report, verification };
+}
+
+async function verifyHardwareQuote(report: AttestationReport): Promise<void> {
+  if (!requireQuote()) return;
+
+  const attestation = report.attestation as unknown as {
+    tee_type?: string;
+    report_data?: string;
+    evidence?: { quote?: string; quote_report_data?: string };
+  };
+  const teeType = String(attestation?.tee_type || "");
+  if (teeType !== "tdx") throw new Error(`phala: unsupported/absent tee_type "${teeType}" (only tdx is wired)`);
+  const quoteHex = attestation.evidence?.quote;
+  if (typeof quoteHex !== "string" || !quoteHex) throw new Error("phala: attestation evidence has no TDX quote");
+  const reportDataHex = String(attestation.report_data || "").toLowerCase();
+  if (!reportDataHex) throw new Error("phala: report has no report_data");
+
+  // Verify the quote against fetched Intel/Phala collateral (pure-JS dcap-qvl).
+  const { getCollateralAndVerify } = await import("@phala/dcap-qvl");
+  const verified = await getCollateralAndVerify(fromHex(quoteHex), pccsUrl());
+
+  // 1) Genuine hardware + acceptable TCB status.
+  const status = String(verified.status);
+  if (!acceptableTcb().has(status)) throw new Error(`phala: TDX quote TCB status not accepted: "${status}"`);
+
+  // 2) The genuine quote committed to our attested statement digest.
+  const quoteReportData = extractQuoteReportData(verified.report);
+  if (toHex(quoteReportData.slice(0, 32)) !== reportDataHex) {
+    throw new Error("phala: TDX quote report_data does not bind the attested report_data");
+  }
+
+  // 3) Consistency: the report's declared quote_report_data matches the real quote.
+  const declared = attestation.evidence?.quote_report_data;
+  if (typeof declared === "string" && declared && toHex(quoteReportData) !== declared.toLowerCase()) {
+    throw new Error("phala: evidence.quote_report_data does not match the verified quote");
+  }
+}
+
+// Posture signal: does the attested keyset verify (crypto binding + hardware quote)?
+// A green result is a quote WE checked, bound to the E2EE key we seal to.
+export async function attestPhala(): Promise<{ ok: boolean; error?: string }> {
+  try {
+    await attest();
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: (e as Error).message };
+  }
+}
+
+export interface PhalaExchange {
+  res: Response;
+  channel: E2eeChannel;
+  streaming: boolean;
+}
+
+// Run one sealed request for Pi: attest, open a fresh per-call E2EE channel (the
+// channel's request state is single-shot → not safe to share across concurrent
+// calls), seal the request fields, and POST to the relay with the X-E2EE-* headers +
+// the cleartext X-Sealed-Model (relay billing) + Pi's account bearer. Returns the
+// upstream response and the channel so the caller can decrypt it.
+export async function phalaSealedFetch(
+  rawBody: string,
+  authHeader: string | undefined,
+  signal?: AbortSignal,
+): Promise<PhalaExchange> {
+  const { report, verification } = await attest();
+  const channel = await openE2eeChannel(report, verification);
+
+  let request: Record<string, unknown>;
+  try {
+    request = JSON.parse(rawBody) as Record<string, unknown>;
+  } catch {
+    throw new Error("phala: request body is not JSON");
+  }
+  const fullModel = typeof request.model === "string" ? request.model : "unknown";
+  const streaming = request.stream !== false;
+  // Bare model id for the enclave (the `phala/` prefix is app-side only); keep the
+  // full id on the cleartext X-Sealed-Model billing header.
+  request.model = fullModel.replace(/^phala\//, "");
+  request.stream = streaming;
+
+  const { body, headers: e2ee } = await channel.seal(request);
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    "X-Sealed-Model": fullModel,
+    ...e2ee,
+  };
+  if (authHeader) headers.Authorization = authHeader;
+
+  const res = await fetch(`${relayBase()}/v1/chat/completions`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+    signal,
+  });
+  return { res, channel, streaming };
+}

package/src/providers/sealedShim.ts

@@ -0,0 +1,295 @@
+// Sealed-mode (EHBP) transport for the account channel.
+//
+// Background: the `privateer` provider runs inference through the server at
+// `${server}/api/agent/v1`, which reads the prompt in cleartext (it assembles/
+// forwards the body). For `tinfoil/*` models that means the badge honestly reads
+// "Trusted Execution (unconfirmed)": the enclave is real, but a quote fetched
+// through the proxy can't be bound to THIS connection (see account.ts and
+// docs/tee-privateer-tinfoil-ehbp.md).
+//
+// Sealed mode closes that. Tinfoil's EHBP (Encrypted HTTP Body Protocol) is HPKE
+// applied to the HTTP body only, independent of TLS, and the enclave's attestation
+// binds the HPKE key. The Privateer server already exposes a blind relay for it
+// (`${server}/api/sealed/:provider`, treeview/server/routes/sealed.js): it forwards
+// the ciphertext body + the `Ehbp-*` headers, injects the provider key, and meters
+// on a cleartext usage header — it never sees the prompt. The treeview app already
+// speaks this (client/services/pipeline/transport/tinfoilProvider.ts).
+//
+// Pi's `openai-completions` adapter does the HTTP itself and exposes no custom-fetch
+// hook, so we can't seal from inside the provider config. Instead we run an
+// in-process loopback HTTP server (this module): Pi POSTs a plain OpenAI request to
+// it, the shim seals the body to the attested enclave via Tinfoil's `SecureClient`,
+// forwards Pi's account bearer + the cleartext `X-Sealed-Model` billing header, and
+// streams the decrypted response back. The provider points the `tinfoil/*` models'
+// per-model `baseUrl` at this shim (account.ts).
+//
+// The one SecureClient per provider is shared by the data plane (the shim) and the
+// posture check (attestSealed), so the green shield reflects the exact client that
+// carries the tokens — the invariant: attest the key we actually seal to.
+
+import http from "node:http";
+import { Readable } from "node:stream";
+import { SecureClient } from "tinfoil";
+import { serverBaseUrl } from "../auth/privateer.ts";
+import { attestPhala, phalaSealedFetch } from "./phalaSeal.ts";
+import { iterateSSE } from "./phala/sse.ts";
+
+// Providers whose enclave supports application-layer body encryption + client-verified
+// attestation, and for which we have a Node client: Tinfoil (EHBP) and Phala (ACI
+// E2EE). NEAR does NOT — it's attested TLS only, so it stays the confidential
+// (unsealed) path, not sealed. See docs/tee-verified-tinfoil-ehbp.md §12.
+export type SealedProvider = "tinfoil" | "phala";
+
+// Sealed mode is OFF until verified end-to-end against a live relay (a real EHBP
+// round-trip needs the deployed relay + TINFOIL_API_KEY; see the live checklist in
+// docs/tee-privateer-tinfoil-ehbp.md). Off = the current plaintext path + honest
+// yellow badge, untouched. Flip with PRIVATEER_SEALED=1.
+export function sealedEnabled(): boolean {
+  const v = process.env.PRIVATEER_SEALED;
+  return v === "1" || v === "true";
+}
+
+// The sealed provider a model id routes through, or null if it isn't a sealed
+// model (or its client isn't available here). Mirrors the server's prefix routing.
+export function sealedProviderFor(modelId: string): SealedProvider | null {
+  if (modelId.startsWith("tinfoil/")) return "tinfoil";
+  if (modelId.startsWith("phala/")) return "phala";
+  return null;
+}
+
+// The blind-relay base for a provider — SecureClient fetches `${base}/attestation`
+// and we POST `${base}/v1/chat/completions`.
+export function relayBase(provider: SealedProvider): string {
+  return `${serverBaseUrl().replace(/\/+$/, "")}/api/sealed/${provider}`;
+}
+
+// ── One SecureClient per provider (shared: data plane + posture) ──────────────
+
+const clients = new Map<SealedProvider, SecureClient>();
+const readyPromises = new Map<SealedProvider, Promise<void>>();
+
+function client(provider: SealedProvider): SecureClient {
+  let c = clients.get(provider);
+  if (!c) {
+    const base = relayBase(provider);
+    // attestationBundleURL == base: the SDK appends `/attestation`, which the relay
+    // proxies to Tinfoil's ATC. transport 'ehbp' = HPKE body sealing.
+    c = new SecureClient({ baseURL: base, attestationBundleURL: base, transport: "ehbp" });
+    clients.set(provider, c);
+  }
+  return c;
+}
+
+// Attest once and cache; on failure drop the memo so a later call re-attests
+// rather than caching the error (mirrors the treeview provider).
+export function ready(provider: SealedProvider): Promise<void> {
+  let p = readyPromises.get(provider);
+  if (!p) {
+    p = client(provider)
+      .ready()
+      .catch((err) => {
+        readyPromises.delete(provider);
+        throw err as Error;
+      });
+    readyPromises.set(provider, p);
+  }
+  return p;
+}
+
+export interface SealedAttestation {
+  ok: boolean;
+  enclave?: string;
+  error?: string;
+}
+
+// Drive the provider's client-side attestation (the SAME client/keyset the shim
+// seals with). A green result is a quote we verified ourselves, bound to the key we
+// encrypt to — that earns tee-verified. Tinfoil: SecureClient.ready() (HPKE-key
+// match). Phala: verifyReportBinding + TDX quote (see phalaSeal.ts).
+export async function attestSealed(provider: SealedProvider): Promise<SealedAttestation> {
+  if (provider === "phala") return attestPhala();
+  try {
+    await ready(provider);
+    return { ok: true, enclave: client(provider).getEnclaveURL() };
+  } catch (e) {
+    return { ok: false, error: (e as Error).message };
+  }
+}
+
+// ── Pure request shaping (unit-tested without an enclave) ─────────────────────
+
+export interface ForwardPlan {
+  url: string;
+  headers: Record<string, string>;
+  body: string;
+  sealedModel: string;
+}
+
+// Turn Pi's plain OpenAI request into what we seal to the relay:
+//   - strip the `${provider}/` prefix from the body model (the enclave wants the
+//     bare id; the body is encrypted so the relay can't strip it — we must),
+//   - keep the full prefixed id on the cleartext X-Sealed-Model header (the relay
+//     prices billing off it — it never reads the body),
+//   - forward Pi's account bearer verbatim (the relay authenticates the JWT; on a
+//     401 the relay's response propagates so Pi refreshes and retries).
+export function buildForward(
+  provider: SealedProvider,
+  rawBody: string,
+  authHeader: string | undefined,
+): ForwardPlan {
+  let body = rawBody;
+  let sealedModel = "unknown";
+  try {
+    const parsed = JSON.parse(rawBody);
+    if (parsed && typeof parsed.model === "string") {
+      sealedModel = parsed.model;
+      const prefix = `${provider}/`;
+      if (parsed.model.startsWith(prefix)) parsed.model = parsed.model.slice(prefix.length);
+      body = JSON.stringify(parsed);
+    }
+  } catch {
+    // Not JSON — forward unchanged (X-Sealed-Model stays "unknown"; relay logs it).
+  }
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    "X-Sealed-Model": sealedModel,
+  };
+  if (authHeader) headers.Authorization = authHeader;
+  return { url: `${relayBase(provider)}/v1/chat/completions`, headers, body, sealedModel };
+}
+
+// ── Loopback HTTP shim ────────────────────────────────────────────────────────
+
+const PATH_RE = /^\/(tinfoil|phala)\/v1\/chat\/completions$/;
+const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+
+let shimBase: string | null = null;
+let shimStarting: Promise<string> | null = null;
+
+// The shim's base URL once listening, else null. account.ts reads this to decide
+// whether a sealed model can point its baseUrl at the shim yet.
+export function sealedShimBase(): string | null {
+  return shimBase;
+}
+
+// Start the loopback shim once and return its base URL. Idempotent.
+export function ensureSealedShim(): Promise<string> {
+  if (shimBase) return Promise.resolve(shimBase);
+  if (!shimStarting) shimStarting = startShim();
+  return shimStarting;
+}
+
+function startShim(): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      void handle(req, res).catch((e) => {
+        if (!res.headersSent) res.writeHead(502, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { message: `sealed shim: ${(e as Error).message}` } }));
+      });
+    });
+    server.on("error", reject);
+    // Loopback only, ephemeral port. unref so the shim never keeps the process alive.
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (addr && typeof addr === "object") {
+        shimBase = `http://127.0.0.1:${addr.port}`;
+        resolve(shimBase);
+      } else {
+        reject(new Error("sealed shim: could not determine listen port"));
+      }
+    });
+    server.unref();
+  });
+}
+
+async function handle(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {
+  // Defense in depth: only serve loopback peers (the port is ephemeral + bound to
+  // 127.0.0.1 already, but reject anything else outright).
+  if (!LOOPBACK.has(req.socket.remoteAddress ?? "")) {
+    res.writeHead(403).end();
+    return;
+  }
+  const path = (req.url ?? "").split("?")[0];
+  const m = PATH_RE.exec(path);
+  if (req.method !== "POST" || !m) {
+    res.writeHead(404).end();
+    return;
+  }
+  const provider = m[1] as SealedProvider;
+  const raw = await readBody(req);
+  const authHeader = typeof req.headers["authorization"] === "string" ? req.headers["authorization"] : undefined;
+
+  if (provider === "phala") {
+    await handlePhala(raw.toString("utf8"), authHeader, res);
+    return;
+  }
+
+  // Tinfoil (EHBP): SecureClient.fetch seals/opens transparently, so we just pass the
+  // body through and pipe the decrypted response.
+  const plan = buildForward(provider, raw.toString("utf8"), authHeader);
+  await ready(provider);
+  const upstream = await client(provider).fetch(plan.url, {
+    method: "POST",
+    headers: plan.headers,
+    body: plan.body,
+  });
+
+  res.writeHead(upstream.status, {
+    "Content-Type": upstream.headers.get("content-type") ?? "application/json",
+  });
+  if (upstream.body) {
+    const nodeStream = Readable.fromWeb(upstream.body as Parameters<typeof Readable.fromWeb>[0]);
+    // If Pi hangs up mid-stream, stop pulling from the enclave.
+    res.on("close", () => nodeStream.destroy());
+    nodeStream.pipe(res);
+    nodeStream.on("error", () => {
+      if (!res.writableEnded) res.end();
+    });
+  } else {
+    res.end(await upstream.text());
+  }
+}
+
+// Phala (ACI E2EE): fields are encrypted individually, so unlike Tinfoil we must
+// decrypt the response with the per-call channel — chunk by chunk for SSE, or the
+// whole JSON when non-streaming — and re-emit cleartext OpenAI to Pi.
+async function handlePhala(
+  rawBody: string,
+  authHeader: string | undefined,
+  res: http.ServerResponse,
+): Promise<void> {
+  const ac = new AbortController();
+  res.on("close", () => ac.abort());
+  const { res: up, channel, streaming } = await phalaSealedFetch(rawBody, authHeader, ac.signal);
+
+  if (!up.ok) {
+    res.writeHead(up.status, { "Content-Type": up.headers.get("content-type") ?? "application/json" });
+    res.end(await up.text());
+    return;
+  }
+
+  if (streaming && up.body) {
+    res.writeHead(up.status, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache, no-transform" });
+    for await (const obj of iterateSSE(up.body as ReadableStream<Uint8Array>)) {
+      const opened = await channel.openChunk(obj as Record<string, unknown>);
+      res.write(`data: ${JSON.stringify(opened)}\n\n`);
+    }
+    res.write("data: [DONE]\n\n");
+    res.end();
+    return;
+  }
+
+  // Non-streaming: decrypt the single JSON body.
+  const opened = await channel.open((await up.json()) as Record<string, unknown>);
+  res.writeHead(up.status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(opened));
+}
+
+function readBody(req: http.IncomingMessage): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    req.on("data", (c: Buffer) => chunks.push(c));
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}

package/src/remote/liveTaskSession.ts

@@ -20,10 +20,10 @@ import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { makePermissionGate, isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
 import { makePiPrivacyExtension } from "pi-privacy";
-import { makeAccountProvider } from "../providers/account.ts";
+import { makeAccountProvider, privateerChannel } from "../providers/account.ts";
 import { RelayClient, type TaskSpec } from "./relayClient.ts";
 import { RemoteBridge } from "./remoteBridge.ts";
-import { spawnAccountCredentials, revokeAccountSession } from "../auth/privateer.ts";
+import { spawnAccountCredentials, revokeAccountSession, hasCredentials } from "../auth/privateer.ts";
 
 export interface LiveTaskHandle {
   termId: string;
@@ -138,7 +138,15 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+      extensionFactories: [
+        makePermissionGate(gate),
+        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
+        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
+        makePiPrivacyExtension({
+          privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+        }),
+        makeAccountProvider(),
+      ] as any,
     },
   });
   servicesRef = services as any;