privateer-agent 0.7.0 → 0.8.2

package/src/providers/sealedShim.ts

@@ -0,0 +1,295 @@
+// Sealed-mode (EHBP) transport for the account channel.
+//
+// Background: the `privateer` provider runs inference through the server at
+// `${server}/api/agent/v1`, which reads the prompt in cleartext (it assembles/
+// forwards the body). For `tinfoil/*` models that means the badge honestly reads
+// "Trusted Execution (unconfirmed)": the enclave is real, but a quote fetched
+// through the proxy can't be bound to THIS connection (see account.ts and
+// docs/tee-privateer-tinfoil-ehbp.md).
+//
+// Sealed mode closes that. Tinfoil's EHBP (Encrypted HTTP Body Protocol) is HPKE
+// applied to the HTTP body only, independent of TLS, and the enclave's attestation
+// binds the HPKE key. The Privateer server already exposes a blind relay for it
+// (`${server}/api/sealed/:provider`, treeview/server/routes/sealed.js): it forwards
+// the ciphertext body + the `Ehbp-*` headers, injects the provider key, and meters
+// on a cleartext usage header — it never sees the prompt. The treeview app already
+// speaks this (client/services/pipeline/transport/tinfoilProvider.ts).
+//
+// Pi's `openai-completions` adapter does the HTTP itself and exposes no custom-fetch
+// hook, so we can't seal from inside the provider config. Instead we run an
+// in-process loopback HTTP server (this module): Pi POSTs a plain OpenAI request to
+// it, the shim seals the body to the attested enclave via Tinfoil's `SecureClient`,
+// forwards Pi's account bearer + the cleartext `X-Sealed-Model` billing header, and
+// streams the decrypted response back. The provider points the `tinfoil/*` models'
+// per-model `baseUrl` at this shim (account.ts).
+//
+// The one SecureClient per provider is shared by the data plane (the shim) and the
+// posture check (attestSealed), so the green shield reflects the exact client that
+// carries the tokens — the invariant: attest the key we actually seal to.
+
+import http from "node:http";
+import { Readable } from "node:stream";
+import { SecureClient } from "tinfoil";
+import { serverBaseUrl } from "../auth/privateer.ts";
+import { attestPhala, phalaSealedFetch } from "./phalaSeal.ts";
+import { iterateSSE } from "./phala/sse.ts";
+
+// Providers whose enclave supports application-layer body encryption + client-verified
+// attestation, and for which we have a Node client: Tinfoil (EHBP) and Phala (ACI
+// E2EE). NEAR does NOT — it's attested TLS only, so it stays the confidential
+// (unsealed) path, not sealed. See docs/tee-verified-tinfoil-ehbp.md §12.
+export type SealedProvider = "tinfoil" | "phala";
+
+// Sealed mode is OFF until verified end-to-end against a live relay (a real EHBP
+// round-trip needs the deployed relay + TINFOIL_API_KEY; see the live checklist in
+// docs/tee-privateer-tinfoil-ehbp.md). Off = the current plaintext path + honest
+// yellow badge, untouched. Flip with PRIVATEER_SEALED=1.
+export function sealedEnabled(): boolean {
+  const v = process.env.PRIVATEER_SEALED;
+  return v === "1" || v === "true";
+}
+
+// The sealed provider a model id routes through, or null if it isn't a sealed
+// model (or its client isn't available here). Mirrors the server's prefix routing.
+export function sealedProviderFor(modelId: string): SealedProvider | null {
+  if (modelId.startsWith("tinfoil/")) return "tinfoil";
+  if (modelId.startsWith("phala/")) return "phala";
+  return null;
+}
+
+// The blind-relay base for a provider — SecureClient fetches `${base}/attestation`
+// and we POST `${base}/v1/chat/completions`.
+export function relayBase(provider: SealedProvider): string {
+  return `${serverBaseUrl().replace(/\/+$/, "")}/api/sealed/${provider}`;
+}
+
+// ── One SecureClient per provider (shared: data plane + posture) ──────────────
+
+const clients = new Map<SealedProvider, SecureClient>();
+const readyPromises = new Map<SealedProvider, Promise<void>>();
+
+function client(provider: SealedProvider): SecureClient {
+  let c = clients.get(provider);
+  if (!c) {
+    const base = relayBase(provider);
+    // attestationBundleURL == base: the SDK appends `/attestation`, which the relay
+    // proxies to Tinfoil's ATC. transport 'ehbp' = HPKE body sealing.
+    c = new SecureClient({ baseURL: base, attestationBundleURL: base, transport: "ehbp" });
+    clients.set(provider, c);
+  }
+  return c;
+}
+
+// Attest once and cache; on failure drop the memo so a later call re-attests
+// rather than caching the error (mirrors the treeview provider).
+export function ready(provider: SealedProvider): Promise<void> {
+  let p = readyPromises.get(provider);
+  if (!p) {
+    p = client(provider)
+      .ready()
+      .catch((err) => {
+        readyPromises.delete(provider);
+        throw err as Error;
+      });
+    readyPromises.set(provider, p);
+  }
+  return p;
+}
+
+export interface SealedAttestation {
+  ok: boolean;
+  enclave?: string;
+  error?: string;
+}
+
+// Drive the provider's client-side attestation (the SAME client/keyset the shim
+// seals with). A green result is a quote we verified ourselves, bound to the key we
+// encrypt to — that earns tee-verified. Tinfoil: SecureClient.ready() (HPKE-key
+// match). Phala: verifyReportBinding + TDX quote (see phalaSeal.ts).
+export async function attestSealed(provider: SealedProvider): Promise<SealedAttestation> {
+  if (provider === "phala") return attestPhala();
+  try {
+    await ready(provider);
+    return { ok: true, enclave: client(provider).getEnclaveURL() };
+  } catch (e) {
+    return { ok: false, error: (e as Error).message };
+  }
+}
+
+// ── Pure request shaping (unit-tested without an enclave) ─────────────────────
+
+export interface ForwardPlan {
+  url: string;
+  headers: Record<string, string>;
+  body: string;
+  sealedModel: string;
+}
+
+// Turn Pi's plain OpenAI request into what we seal to the relay:
+//   - strip the `${provider}/` prefix from the body model (the enclave wants the
+//     bare id; the body is encrypted so the relay can't strip it — we must),
+//   - keep the full prefixed id on the cleartext X-Sealed-Model header (the relay
+//     prices billing off it — it never reads the body),
+//   - forward Pi's account bearer verbatim (the relay authenticates the JWT; on a
+//     401 the relay's response propagates so Pi refreshes and retries).
+export function buildForward(
+  provider: SealedProvider,
+  rawBody: string,
+  authHeader: string | undefined,
+): ForwardPlan {
+  let body = rawBody;
+  let sealedModel = "unknown";
+  try {
+    const parsed = JSON.parse(rawBody);
+    if (parsed && typeof parsed.model === "string") {
+      sealedModel = parsed.model;
+      const prefix = `${provider}/`;
+      if (parsed.model.startsWith(prefix)) parsed.model = parsed.model.slice(prefix.length);
+      body = JSON.stringify(parsed);
+    }
+  } catch {
+    // Not JSON — forward unchanged (X-Sealed-Model stays "unknown"; relay logs it).
+  }
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+    "X-Sealed-Model": sealedModel,
+  };
+  if (authHeader) headers.Authorization = authHeader;
+  return { url: `${relayBase(provider)}/v1/chat/completions`, headers, body, sealedModel };
+}
+
+// ── Loopback HTTP shim ────────────────────────────────────────────────────────
+
+const PATH_RE = /^\/(tinfoil|phala)\/v1\/chat\/completions$/;
+const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+
+let shimBase: string | null = null;
+let shimStarting: Promise<string> | null = null;
+
+// The shim's base URL once listening, else null. account.ts reads this to decide
+// whether a sealed model can point its baseUrl at the shim yet.
+export function sealedShimBase(): string | null {
+  return shimBase;
+}
+
+// Start the loopback shim once and return its base URL. Idempotent.
+export function ensureSealedShim(): Promise<string> {
+  if (shimBase) return Promise.resolve(shimBase);
+  if (!shimStarting) shimStarting = startShim();
+  return shimStarting;
+}
+
+function startShim(): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      void handle(req, res).catch((e) => {
+        if (!res.headersSent) res.writeHead(502, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { message: `sealed shim: ${(e as Error).message}` } }));
+      });
+    });
+    server.on("error", reject);
+    // Loopback only, ephemeral port. unref so the shim never keeps the process alive.
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (addr && typeof addr === "object") {
+        shimBase = `http://127.0.0.1:${addr.port}`;
+        resolve(shimBase);
+      } else {
+        reject(new Error("sealed shim: could not determine listen port"));
+      }
+    });
+    server.unref();
+  });
+}
+
+async function handle(req: http.IncomingMessage, res: http.ServerResponse): Promise<void> {
+  // Defense in depth: only serve loopback peers (the port is ephemeral + bound to
+  // 127.0.0.1 already, but reject anything else outright).
+  if (!LOOPBACK.has(req.socket.remoteAddress ?? "")) {
+    res.writeHead(403).end();
+    return;
+  }
+  const path = (req.url ?? "").split("?")[0];
+  const m = PATH_RE.exec(path);
+  if (req.method !== "POST" || !m) {
+    res.writeHead(404).end();
+    return;
+  }
+  const provider = m[1] as SealedProvider;
+  const raw = await readBody(req);
+  const authHeader = typeof req.headers["authorization"] === "string" ? req.headers["authorization"] : undefined;
+
+  if (provider === "phala") {
+    await handlePhala(raw.toString("utf8"), authHeader, res);
+    return;
+  }
+
+  // Tinfoil (EHBP): SecureClient.fetch seals/opens transparently, so we just pass the
+  // body through and pipe the decrypted response.
+  const plan = buildForward(provider, raw.toString("utf8"), authHeader);
+  await ready(provider);
+  const upstream = await client(provider).fetch(plan.url, {
+    method: "POST",
+    headers: plan.headers,
+    body: plan.body,
+  });
+
+  res.writeHead(upstream.status, {
+    "Content-Type": upstream.headers.get("content-type") ?? "application/json",
+  });
+  if (upstream.body) {
+    const nodeStream = Readable.fromWeb(upstream.body as Parameters<typeof Readable.fromWeb>[0]);
+    // If Pi hangs up mid-stream, stop pulling from the enclave.
+    res.on("close", () => nodeStream.destroy());
+    nodeStream.pipe(res);
+    nodeStream.on("error", () => {
+      if (!res.writableEnded) res.end();
+    });
+  } else {
+    res.end(await upstream.text());
+  }
+}
+
+// Phala (ACI E2EE): fields are encrypted individually, so unlike Tinfoil we must
+// decrypt the response with the per-call channel — chunk by chunk for SSE, or the
+// whole JSON when non-streaming — and re-emit cleartext OpenAI to Pi.
+async function handlePhala(
+  rawBody: string,
+  authHeader: string | undefined,
+  res: http.ServerResponse,
+): Promise<void> {
+  const ac = new AbortController();
+  res.on("close", () => ac.abort());
+  const { res: up, channel, streaming } = await phalaSealedFetch(rawBody, authHeader, ac.signal);
+
+  if (!up.ok) {
+    res.writeHead(up.status, { "Content-Type": up.headers.get("content-type") ?? "application/json" });
+    res.end(await up.text());
+    return;
+  }
+
+  if (streaming && up.body) {
+    res.writeHead(up.status, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache, no-transform" });
+    for await (const obj of iterateSSE(up.body as ReadableStream<Uint8Array>)) {
+      const opened = await channel.openChunk(obj as Record<string, unknown>);
+      res.write(`data: ${JSON.stringify(opened)}\n\n`);
+    }
+    res.write("data: [DONE]\n\n");
+    res.end();
+    return;
+  }
+
+  // Non-streaming: decrypt the single JSON body.
+  const opened = await channel.open((await up.json()) as Record<string, unknown>);
+  res.writeHead(up.status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(opened));
+}
+
+function readBody(req: http.IncomingMessage): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    req.on("data", (c: Buffer) => chunks.push(c));
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}

package/src/remote/liveTaskSession.ts

@@ -20,10 +20,10 @@ import { agentVersion } from "../config/version.ts";
 import { createEngineEventAdapter } from "../bridge/engineAdapter.ts";
 import { makePermissionGate, isRemoteUnsafeTool, type GateController } from "../ext/permissionGate.ts";
 import { makePiPrivacyExtension } from "pi-privacy";
-import { makeAccountProvider } from "../providers/account.ts";
+import { makeAccountProvider, privateerChannel } from "../providers/account.ts";
 import { RelayClient, type TaskSpec } from "./relayClient.ts";
 import { RemoteBridge } from "./remoteBridge.ts";
-import { spawnAccountCredentials, revokeAccountSession } from "../auth/privateer.ts";
+import { spawnAccountCredentials, revokeAccountSession, hasCredentials } from "../auth/privateer.ts";
 
 export interface LiveTaskHandle {
   termId: string;
@@ -43,6 +43,10 @@ export interface LiveTaskDeps {
 // abandoned spawn can't run the account meter or hold resources forever).
 const ATTACH_GRACE_MS = 180_000; // 3 min to attach after spawn
 const MAX_LIFETIME_MS = 30 * 60_000; // 30 min absolute cap
+// How long to wait for the spawned terminal to actually register on the relay before we give
+// up and report the spawn as failed. `start()` resolves before the socket opens, so without
+// this confirmation the harbor would announce a terminal the app can never attach to.
+const REGISTER_TIMEOUT_MS = 20_000;
 
 export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps): Promise<LiveTaskHandle> {
   const cwd = spec.cwd && spec.cwd.trim() ? spec.cwd : process.cwd();
@@ -138,7 +142,15 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     cwd,
     agentDir: agentDir(),
     resourceLoaderOptions: {
-      extensionFactories: [makePermissionGate(gate), makePiPrivacyExtension(), makeAccountProvider()] as any,
+      extensionFactories: [
+        makePermissionGate(gate),
+        // Per-model verified-TEE label for the /models picker (see harbor/index.ts):
+        // TEE-channel Privateer models verify on select when logged in; ZDR stays floored.
+        makePiPrivacyExtension({
+          privateerVerifiedTee: (m) => hasCredentials() && privateerChannel(m.id ?? "") === "tee",
+        }),
+        makeAccountProvider(),
+      ] as any,
     },
   });
   servicesRef = services as any;
@@ -205,6 +217,11 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   relay = new RelayClient(bridge.callbacks, { termId, label });
   bridge.attachRelay(relay);
   await relay.start();
+  // start() resolves before the socket registers; confirm the terminal is actually live on
+  // the relay BEFORE returning (→ the harbor announces task_spawned). Rejects on a hard
+  // failure (e.g. the concurrency cap) or timeout → the catch below tears down and propagates,
+  // so the harbor reports task_spawn_error instead of pointing the app at a dead terminal.
+  await relay.awaitRegistered(REGISTER_TIMEOUT_MS);
 
   // Reap if nobody ever attaches, and cap the absolute lifetime regardless.
   attachTimer = setTimeout(() => { if (!attached) void stop(); }, ATTACH_GRACE_MS);

package/src/remote/relayClient.ts

@@ -295,6 +295,14 @@ export class RelayClient {
   // random one each time).
   private readonly termId: string;
   private readonly label: string;
+  // First-registration signal (opt-in via awaitRegistered): `start()` resolves before the
+  // socket actually opens, so a caller that must not act until the terminal is truly live on
+  // the relay — e.g. a live-task spawn that announces `task_spawned` — waits on this instead.
+  // Settled once: resolved on the first ws `open`, rejected on a hard (4xx) ticket-mint
+  // failure. Reconnect blips after a successful first open do NOT re-settle it.
+  private firstConnectSettled = false;
+  private firstConnectError: Error | null = null;
+  private firstConnectWaiters: Array<{ resolve: () => void; reject: (e: Error) => void }> = [];
   // In-progress file transfers from the app, keyed by the controller's attachment
   // id. Reassembled from attach_begin/chunk/end frames, then handed to onAttachment.
   private readonly incoming = new Map<
@@ -322,8 +330,43 @@ export class RelayClient {
     await this.connect();
   }
 
+  // Resolve once this terminal has actually registered on the relay (ws `open`), reject on a
+  // hard registration failure (e.g. a 403 concurrency-cap denial) or after `timeoutMs`.
+  // `start()` resolves before the socket opens, so a live-task spawn calls this to confirm the
+  // app can attach BEFORE it announces the terminal — otherwise the app is told to drive a
+  // terminal that never came up and hangs. Idempotent; settling stores its result so a caller
+  // that awaits after the fact still gets it (no dangling/unhandled rejection).
+  awaitRegistered(timeoutMs: number): Promise<void> {
+    if (this.firstConnectSettled) {
+      return this.firstConnectError ? Promise.reject(this.firstConnectError) : Promise.resolve();
+    }
+    return new Promise<void>((resolve, reject) => {
+      const waiter = {
+        resolve: () => { clearTimeout(timer); resolve(); },
+        reject: (e: Error) => { clearTimeout(timer); reject(e); },
+      };
+      const timer = setTimeout(() => {
+        this.firstConnectWaiters = this.firstConnectWaiters.filter((w) => w !== waiter);
+        reject(new Error(`relay registration timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+      this.firstConnectWaiters.push(waiter);
+    });
+  }
+
+  private settleFirstConnect(err?: Error): void {
+    if (this.firstConnectSettled) return;
+    this.firstConnectSettled = true;
+    this.firstConnectError = err ?? null;
+    const waiters = this.firstConnectWaiters;
+    this.firstConnectWaiters = [];
+    for (const w of waiters) err ? w.reject(err) : w.resolve();
+  }
+
   stop(): void {
     this.closed = true;
+    // Fail any awaitRegistered() waiter promptly instead of leaving it to time out — a
+    // terminal stopped before it ever registered is never coming up.
+    this.settleFirstConnect(new Error("relay stopped before registering"));
     if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = undefined; }
     if (this.flushTimer) { clearTimeout(this.flushTimer); this.flushTimer = undefined; }
     this.bufKind = null;
@@ -344,7 +387,11 @@ export class RelayClient {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ role: "agent", termId: this.termId, label: this.label }),
       });
-      if (!res.ok) throw new Error(`relay ticket HTTP ${res.status}`);
+      if (!res.ok) {
+        const e: Error & { status?: number } = new Error(`relay ticket HTTP ${res.status}`);
+        e.status = res.status;
+        throw e;
+      }
       const { ticket } = (await res.json()) as { ticket: string };
 
       const wsUrl =
@@ -357,6 +404,7 @@ export class RelayClient {
 
       ws.on("open", () => {
         opened = true;
+        this.settleFirstConnect(); // terminal is live on the relay — awaitRegistered() resolves
         this.cb.onStatus?.("Remote access connected — drive this terminal from the Privateer app.");
       });
       ws.on("message", (data) => this.handle(data));
@@ -381,6 +429,13 @@ export class RelayClient {
       // Ticket mint failed (auth/network/route) — surface it; a silent failure
       // looks identical to "connected but ignoring me".
       const msg = err instanceof Error ? err.message : String(err);
+      // A 4xx (e.g. 403 concurrency cap) won't self-heal by retrying the same request —
+      // fail-fast any awaitRegistered() caller (a live-task spawn) so it stops hanging.
+      // The management terminal ignores this signal, so its reconnect behavior is unchanged.
+      const status = (err as { status?: number })?.status;
+      if (typeof status === "number" && status >= 400 && status < 500) {
+        this.settleFirstConnect(err instanceof Error ? err : new Error(msg));
+      }
       this.cb.onStatus?.(`Remote access couldn't reach the relay (${msg}) — retrying…`);
       this.scheduleReconnect();
     } finally {
@@ -691,6 +746,13 @@ export class RelayClient {
     this.rawSend({ type: "task_spawned", termId, label });
   }
 
+  // Tell the app a live task spawn FAILED (reply to task_spawn), with a short reason, so the
+  // spawn screen can stop waiting and show it — a live spawn otherwise has no failure signal
+  // and the app would spin until its own timeout. Fire-and-forget over the management relay.
+  sendTaskSpawnError(reason: string): void {
+    this.rawSend({ type: "task_spawn_error", reason: safe(reason, 300) });
+  }
+
   sendEvent(ev: EngineEvent): void {
     if (ev.type === "text") return this.bufferDelta("text", ev.text);
     if (ev.type === "reasoning") return this.bufferDelta("reasoning", ev.text);

package/src/ui/palette.ts

@@ -38,6 +38,7 @@ export type Palette = {
   DIM: string; // secondary / muted prose
   GREEN: string; // success (connected, verified, context loaded)
   YELLOW: string; // warning (not-signed-in, unconfirmed, update available)
+  RED: string; // alarm (the moat lowered — no-quarter)
 };
 
 // Last-resort palette for when no theme is reachable (headless surfaces have no banner,
@@ -52,6 +53,7 @@ export const FALLBACK: Palette = {
   DIM: `${ESC}90m`,
   GREEN: `${ESC}32m`,
   YELLOW: `${ESC}33m`,
+  RED: `${ESC}31m`,
 };
 
 // Build a Palette from a Pi Theme. getFgAnsi(name) returns the raw SGR foreground escape
@@ -76,6 +78,7 @@ export function paletteFor(theme: any): Palette {
     DIM: g("dim", FALLBACK.DIM),
     GREEN: g("success", FALLBACK.GREEN),
     YELLOW: g("warning", FALLBACK.YELLOW),
+    RED: g("error", FALLBACK.RED),
   };
 }