privateer-agent 0.9.3 → 0.11.0

package/src/providers/phalaSeal.ts

@@ -13,7 +13,7 @@
 // no polyfills, unlike the RN app.
 //
 // Two-layer attestation, fail-secure:
-//   (1) verifyReportBinding — the report's crypto binding (keyset digest,
+//   (1) verifyAciReportBinding — the report's crypto binding (keyset digest,
 //       report_data == statement(nonce), endorsement sig). Self-attesting alone.
 //   (2) verifyHardwareQuote — the hardware root: @phala/dcap-qvl verifies the TDX quote
 //       against Intel collateral and binds the quote's report_data to (1)'s statement
@@ -22,7 +22,6 @@
 
 import type { Report } from "@phala/dcap-qvl";
 import {
-  verifyReportBinding,
   openE2eeChannel,
   toHex,
   fromHex,
@@ -30,6 +29,11 @@ import {
   type ReportVerification,
   type E2eeChannel,
 } from "./phala/aci-verifier/index.ts";
+// Not the vendored verifyReportBinding directly: the deployed gateway signs its
+// keyset endorsement with ecdsa-secp256k1, which upstream's Web-Crypto-only verifier
+// refuses. This wrapper delegates ed25519 to it unchanged and adds the secp256k1 arm
+// the spec allows (§4.3), leaving aci-verifier/ pristine for re-pulls.
+import { verifyAciReportBinding } from "./phala/reportBinding.ts";
 import { serverBaseUrl } from "../auth/privateer.ts";
 
 const DEFAULT_ACCEPTABLE_TCB = ["UpToDate"];
@@ -94,7 +98,7 @@ async function establishAttestation(): Promise<VerifiedAttestation> {
   if (!res.ok) throw new Error(`phala attestation HTTP ${res.status}`);
   const report = (await res.json()) as AttestationReport;
 
-  const verification = await verifyReportBinding(report, nonce);
+  const verification = await verifyAciReportBinding(report, nonce);
   if (!verification.ok) {
     const failed = verification.checks.filter((c) => !c.ok).map((c) => c.name).join(", ");
     throw new Error(`phala attestation binding failed: ${failed}`);

package/src/providers/sealedShim.ts

@@ -40,13 +40,22 @@ import { iterateSSE } from "./phala/sse.ts";
 // (unsealed) path, not sealed. See docs/tee-verified-tinfoil-ehbp.md §12.
 export type SealedProvider = "tinfoil" | "phala";
 
-// Sealed mode is OFF until verified end-to-end against a live relay (a real EHBP
-// round-trip needs the deployed relay + TINFOIL_API_KEY; see the live checklist in
-// docs/tee-privateer-tinfoil-ehbp.md). Off = the current plaintext path + honest
-// yellow badge, untouched. Flip with PRIVATEER_SEALED=1.
+// Sealed mode is ON by default as of 2026-07-31, when the live checklist in
+// docs/tee-verified-tinfoil-ehbp.md passed end to end against the deployed relay:
+// both enclaves attest client-side (Tinfoil HPKE-key match; Phala report binding +
+// TDX quote), a sealed turn round-trips and streams incrementally, a bogus enclave is
+// refused rather than silently greened, and the server bills the turn.
+//
+// What it buys: the prompt is sealed to the enclave the client itself attested, so the
+// badge is a quote WE checked rather than the account's word — green instead of
+// "Trusted Execution (unconfirmed)".
+//
+// PRIVATEER_SEALED=0 (or =false) drops back to the cleartext `/api/agent/v1` path and
+// the honest yellow badge. Note that is a real downgrade for `phala/*`, which is
+// sealed-only and simply disappears from the catalog (see isServableAccountModel).
 export function sealedEnabled(): boolean {
   const v = process.env.PRIVATEER_SEALED;
-  return v === "1" || v === "true";
+  return !(v === "0" || v === "false");
 }
 
 // The sealed provider a model id routes through, or null if it isn't a sealed
@@ -151,7 +160,12 @@ export function buildForward(
     // Not JSON — forward unchanged (X-Sealed-Model stays "unknown"; relay logs it).
   }
   const headers: Record<string, string> = {
-    "Content-Type": "application/json",
+    // MUST carry the charset. EHBP seals the body but headers travel in cleartext
+    // (tinfoil/dist/encrypted-body-fetch.js: "EHBP only seals the body"), so this
+    // Content-Type is what the enclave's router actually validates — and it rejects a
+    // bare `application/json` with "Unsupported Media Type: Only 'application/json' is
+    // allowed" (verified live 2026-07-31: bare → 400, any `charset=` variant → 200).
+    "Content-Type": "application/json; charset=utf-8",
     "X-Sealed-Model": sealedModel,
   };
   if (authHeader) headers.Authorization = authHeader;
@@ -165,6 +179,7 @@ const LOOPBACK = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
 
 let shimBase: string | null = null;
 let shimStarting: Promise<string> | null = null;
+let shimServer: http.Server | null = null;
 
 // The shim's base URL once listening, else null. account.ts reads this to decide
 // whether a sealed model can point its baseUrl at the shim yet.
@@ -179,6 +194,19 @@ export function ensureSealedShim(): Promise<string> {
   return shimStarting;
 }
 
+// Close the shim and forget it, so a later ensureSealedShim() starts a fresh one.
+// The listener is `unref`'d and never blocks exit, so this is not needed for
+// shutdown — it exists so a caller that stops sealing (or a test) can drop the
+// socket deterministically rather than leaving a port open for the process lifetime.
+export function stopSealedShim(): Promise<void> {
+  const server = shimServer;
+  shimServer = null;
+  shimBase = null;
+  shimStarting = null;
+  if (!server) return Promise.resolve();
+  return new Promise((resolve) => server.close(() => resolve()));
+}
+
 function startShim(): Promise<string> {
   return new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
@@ -192,6 +220,7 @@ function startShim(): Promise<string> {
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
       if (addr && typeof addr === "object") {
+        shimServer = server;
         shimBase = `http://127.0.0.1:${addr.port}`;
         resolve(shimBase);
       } else {

package/src/remote/channelsControl.ts

@@ -23,24 +23,18 @@
  */
 import { readFileSync, writeFileSync } from "node:fs";
 import { configPath } from "../config/paths.ts";
+// The platform roster, per-platform secret field names, and the "is this block
+// startable" predicate all live in ONE place, shared with the channels runtime —
+// see channels/platforms.ts. Re-exported here so existing importers of
+// CHANNEL_PLATFORMS/ChannelPlatform from this module keep working unchanged.
+import { CHANNEL_PLATFORMS, SECRET_FIELDS, isChannelPlatform, type ChannelPlatform } from "../channels/platforms.ts";
 
-// The platforms channels/run.ts knows how to start. Order is the app's display
-// order. Keep in sync with the `startChannel` calls in run.ts.
-export const CHANNEL_PLATFORMS = ["telegram", "slack", "discord", "whatsapp"] as const;
-export type ChannelPlatform = (typeof CHANNEL_PLATFORMS)[number];
+export { CHANNEL_PLATFORMS };
+export type { ChannelPlatform };
 
 const POSTURES = ["readonly", "approve", "auto"] as const;
 export type ChannelPosture = (typeof POSTURES)[number];
 
-// The secret (never-echoed) fields per platform — the union of the token blocks
-// run.ts requires to START each platform. `secretsSet` reports presence of these.
-const SECRET_FIELDS: Record<ChannelPlatform, string[]> = {
-  telegram: ["botToken"],
-  slack: ["appToken", "botToken"],
-  discord: ["botToken"],
-  whatsapp: ["phoneNumberId", "accessToken", "verifyToken", "appSecret"],
-};
-
 // Non-secret projection of one platform's config, sent to the app. No token
 // values, ever — only which secret fields are already present (`secretsSet`).
 export interface RemoteChannel {
@@ -79,9 +73,7 @@ export interface ChannelsControl {
   remove(platform: ChannelPlatform): { ok: boolean; message?: string };
 }
 
-function isPlatform(v: unknown): v is ChannelPlatform {
-  return typeof v === "string" && (CHANNEL_PLATFORMS as readonly string[]).includes(v);
-}
+const isPlatform = isChannelPlatform;
 
 function normalizePosture(v: unknown): ChannelPosture | undefined {
   return typeof v === "string" && (POSTURES as readonly string[]).includes(v) ? (v as ChannelPosture) : undefined;

package/src/remote/extensionsControl.ts

@@ -61,6 +61,8 @@ const RESERVED = new Set([
   "pi-web-access",
   "rpiv-web-tools",
   "@juicesharp/rpiv-web-tools",
+  "rpiv-ask-user-question",
+  "@juicesharp/rpiv-ask-user-question",
   "pi-mcp-adapter",
   "pi-hypa",
   "@hypabolic/pi-hypa",

package/src/remote/liveTaskSession.ts

@@ -31,6 +31,8 @@ import { RemoteBridge } from "./remoteBridge.ts";
 import { makeRelayFileTools } from "../tools/relayFileTools.ts";
 import { AttachmentStore, type StoredAttachment } from "../util/attachmentStore.ts";
 import { spawnAccountCredentials, revokeAccountSession, hasCredentials } from "../auth/privateer.ts";
+import { createUIContext } from "../ext/headlessUi.ts";
+import { noQuarterActive } from "../permissions/noQuarter.ts";
 
 export interface LiveTaskHandle {
   termId: string;
@@ -161,7 +163,11 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
       attached = true;
       if (attachTimer) { clearTimeout(attachTimer); attachTimer = undefined; }
       relay?.sendSnapshot([]);
-      relay?.sendContext({ model: modelSpec, version: agentVersion() });
+      // cwd rides along here (and nowhere else — see RelayClient.sendContext): this
+      // session's working directory was either named by the driver in the spawn form
+      // or defaulted to the harbor's own, and they have no other way to see which.
+      // Every file this agent touches is under it.
+      relay?.sendContext({ model: modelSpec, cwd, version: agentVersion() });
       relay?.sendCommands([]);
       // Deliver the spawn's initial prompt exactly once, THROUGH the bridge's own prompt
       // path so it counts as a driven turn (remote=true → tools relay to the app).
@@ -189,6 +195,13 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     },
     getRemote: bridge.getRemote,
     getNoQuarter: bridge.getNoQuarter,
+    // Session-wide TOTAL bypass when the harbor itself was launched `--no-quarter`
+    // (env PRIVATEER_NO_QUARTER): every action auto-approves with no prompt, here as
+    // in the TUI. Without this the flag meant nothing on a spawn — the app's own
+    // no-quarter toggle (getNoQuarter above) was the only switch that reached this
+    // gate, so an operator who had lowered the moat harbor-wide still got prompted
+    // for everything. Off unless the flag is set, which launchd/systemd never does.
+    getSkipAllPermissions: noQuarterActive,
     remoteAsk: bridge.remoteAsk,
     blockedWhenRemote: isRemoteUnsafeTool,
     onRemoteBlocked: (toolName) => bridge.sendNotice(`${toolName} is disabled while driving remotely — its prompts can't reach the app.`),
@@ -248,7 +261,7 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
   // Relay the extension mid-turn UI (select/confirm/input) to the app when driven, so an
   // extension asking a question doesn't silently cancel. Mirrors cli/chat.ts's uiContext.
   const driven = (): boolean => bridge.getRemote() && bridge.isConnected();
-  const uiContext = {
+  const uiContext = createUIContext({
     async select(t: string, options: string[], opts?: { signal?: AbortSignal }): Promise<string | undefined> {
       if (!options.length) return undefined;
       if (!driven()) return undefined;
@@ -268,7 +281,7 @@ export async function createLiveTaskSession(spec: TaskSpec, deps: LiveTaskDeps):
     notify(message: string): void {
       if (driven()) bridge.sendNotice(message);
     },
-  };
+  });
   await (session as any).bindExtensions({ uiContext });
 
   const adapter = createEngineEventAdapter();

package/src/remote/relayClient.ts

@@ -17,6 +17,7 @@
  */
 import WebSocket from "ws";
 import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
 import { apiRequest, serverBaseUrl } from "../auth/privateer.ts";
 import type { EngineEvent } from "../engine/events.ts";
 import type { PermissionRequest } from "../permissions/gate.ts";
@@ -227,6 +228,15 @@ export interface RelayCallbacks {
 }
 
 const RECONNECT_MS = 3000;
+// Ceiling for the reconnect backoff below. A blip should be invisible (first retry at
+// RECONNECT_MS), but a relay that is genuinely down must not be hammered every 3s for
+// hours by every harbor on the fleet — and when it comes back, they must not all
+// stampede it in the same 3s window. So: grow the delay on consecutive failures, cap it
+// here, jitter it, and reset the moment a socket opens.
+const RECONNECT_MAX_MS = 30_000;
+const RECONNECT_GROWTH = 1.7;
+// Fraction of the delay to randomize (±), so restarts don't resynchronize the fleet.
+const RECONNECT_JITTER = 0.25;
 // Retry cadence after the relay REFUSES us (4xx — in practice the plan's live-agent
 // cap). Slow, because only an account change can clear it, but not never: the harbor
 // should come up on its own once a slot frees. Kept well under the server's denial
@@ -241,12 +251,27 @@ const REFUSED_RECONNECT_MS = 60_000;
 // the server prunes the terminal from its presence registry after ~60s, so the app
 // shows the harbor as offline while the harbor's own log says "connected", forever.
 //
-// So don't wait to be told. The server pings every 25s, so an alive socket sees
-// inbound traffic at least that often; we ping on our own timer too (the peer's pong
-// counts as inbound). If nothing arrives for LIVENESS_TIMEOUT_MS — three missed
-// server pings — the socket is dead: terminate it and take the normal reconnect path.
+// So don't wait to be told. The server pings every 25s, so an alive socket sees inbound
+// traffic at least that often; we ping on our own timer too and a healthy peer pongs
+// immediately, so in practice inbound arrives every ~20s. If nothing arrives for
+// LIVENESS_TIMEOUT_MS the socket is dead: terminate it and take the normal reconnect path.
+//
+// The timeout is sized against the SERVER's presence TTL, not against comfort. The server
+// refreshes a 60s presence key on its own 25s heartbeat tick (server.js relayHeartbeat →
+// relayHub.markOnline, PRESENCE_TTL_SECS = 60), and the app's agent list reads exactly
+// that key. So the budget to detect a dead socket AND finish reconnecting is 60s from the
+// last tick that reached us — otherwise the key lapses and the harbor blinks out of the
+// app even though recovery is already under way. At the old 75s this was guaranteed: a
+// silent death always cost ~20-40s of visible "offline". 50s of silence is already
+// conclusive (two-plus missed exchanges) and leaves ~10s for the reconnect to re-register.
+//
+// Detection granularity is its own timer: polling silence on the 20s PING cadence added
+// up to a whole extra ping interval of latency, and after a laptop wake (timers frozen
+// while asleep — the common cause of this whole failure mode) it decided how long the
+// harbor stayed dark. Checking every 5s costs nothing and bounds that.
 const HEARTBEAT_MS = 20_000;
-const LIVENESS_TIMEOUT_MS = 75_000;
+const LIVENESS_CHECK_MS = 5_000;
+const LIVENESS_TIMEOUT_MS = 50_000;
 // Cap the opening handshake too. Without this a black-holed connect leaves `this.ws`
 // set with no open/close/error ever firing, and connect()'s `if (this.ws) return`
 // guard then blocks every future attempt — the same permanent silence by another route.
@@ -267,6 +292,20 @@ function clip(s: string, max: number): string {
   return s.slice(0, max) + `\n… (${s.length - max} more chars)`;
 }
 
+// Rewrite a path under the home directory as `~/…` — the CLI's own display form.
+// Used on the cwd we report in a context frame: the driver still sees which folder
+// the agent is working in, without the account name in the absolute path crossing
+// the relay. Only an exact home prefix is collapsed (`/Users/pat2` is left alone);
+// a path outside home is returned unchanged.
+function homeCollapsed(p: string): string {
+  let home = "";
+  try { home = homedir(); } catch { /* no home → nothing to collapse */ }
+  if (!home || !p.startsWith(home)) return p;
+  const rest = p.slice(home.length);
+  if (rest === "") return "~";
+  return rest.startsWith("/") || rest.startsWith("\\") ? `~${rest}` : p;
+}
+
 function asText(output: unknown): string {
   return typeof output === "string" ? output : JSON.stringify(output);
 }
@@ -314,6 +353,8 @@ export class RelayClient {
   private heartbeatTimer: ReturnType<typeof setInterval> | undefined;
   private lastInboundAt = 0;
   private connectedAt = 0;
+  // Current backoff delay for the next unqualified scheduleReconnect(); reset on 'open'.
+  private reconnectDelay = RECONNECT_MS;
   // Last refusal reason reported, so a 4xx is logged once instead of on every retry.
   private refusal: string | null = null;
   // Ordered delta buffer (text/reasoning) coalesced into one frame per flush.
@@ -402,6 +443,7 @@ export class RelayClient {
     if (this.flushTimer) { clearTimeout(this.flushTimer); this.flushTimer = undefined; }
     this.stopHeartbeat();
     this.connectedAt = 0;
+    this.reconnectDelay = RECONNECT_MS; // a restarted client shouldn't inherit old backoff
     this.bufKind = null;
     this.buf = "";
     this.incoming.clear();
@@ -450,6 +492,7 @@ export class RelayClient {
       ws.on("open", () => {
         opened = true;
         this.refusal = null; // a later refusal is news again
+        this.reconnectDelay = RECONNECT_MS; // reachable again — next blip retries fast
         this.connectedAt = Date.now();
         this.startHeartbeat(ws);
         this.settleFirstConnect(); // terminal is live on the relay — awaitRegistered() resolves
@@ -525,11 +568,13 @@ export class RelayClient {
   private startHeartbeat(ws: WebSocket): void {
     this.stopHeartbeat();
     this.lastInboundAt = Date.now();
+    let lastPingAt = Date.now();
     this.heartbeatTimer = setInterval(() => {
       // A socket we've since replaced or dropped isn't ours to police anymore.
       if (this.ws !== ws) { this.stopHeartbeat(); return; }
       if (ws.readyState !== WebSocket.OPEN) return; // closing — 'close' will clean up
-      const quietMs = Date.now() - this.lastInboundAt;
+      const now = Date.now();
+      const quietMs = now - this.lastInboundAt;
       if (quietMs > LIVENESS_TIMEOUT_MS) {
         this.cb.onStatus?.(
           `Remote access went silent for ${Math.round(quietMs / 1000)}s (the connection died without closing) — dropping it and reconnecting…`,
@@ -538,8 +583,13 @@ export class RelayClient {
         try { ws.terminate(); } catch (_) { /* already gone — 'close' still fires */ }
         return;
       }
-      try { ws.ping(); } catch (_) { /* socket dying — the next tick or 'close' handles it */ }
-    }, HEARTBEAT_MS);
+      // The check runs on LIVENESS_CHECK_MS; the ping stays on its own slower cadence so
+      // tightening detection doesn't multiply the traffic we put on the wire.
+      if (now - lastPingAt >= HEARTBEAT_MS) {
+        lastPingAt = now;
+        try { ws.ping(); } catch (_) { /* socket dying — the next tick or 'close' handles it */ }
+      }
+    }, LIVENESS_CHECK_MS);
     // Never hold the process open for a heartbeat alone.
     this.heartbeatTimer.unref?.();
   }
@@ -548,12 +598,28 @@ export class RelayClient {
     if (this.heartbeatTimer) { clearInterval(this.heartbeatTimer); this.heartbeatTimer = undefined; }
   }
 
-  private scheduleReconnect(delayMs: number = RECONNECT_MS): void {
+  // Schedule the next connect attempt. With no explicit delay this walks the backoff
+  // ladder (reset to RECONNECT_MS by a successful 'open'), so the first retry after a
+  // blip is still ~3s and only a genuinely unreachable relay backs off. An explicit
+  // delay — the REFUSED_RECONNECT_MS path — is a deliberate cadence for a decision that
+  // won't change on its own, so it bypasses the ladder rather than compounding with it.
+  private scheduleReconnect(delayMs?: number): void {
     if (this.closed || this.reconnectTimer) return;
+    let wait: number;
+    if (typeof delayMs === "number") {
+      wait = delayMs;
+    } else {
+      wait = this.reconnectDelay;
+      this.reconnectDelay = Math.min(Math.round(this.reconnectDelay * RECONNECT_GROWTH), RECONNECT_MAX_MS);
+    }
+    // Jitter every wait (including the fixed ones): the point is to break up fleet-wide
+    // synchronization after a server restart, which is exactly when many clients are
+    // sitting on the same timer.
+    const jittered = Math.max(250, Math.round(wait * (1 + (Math.random() * 2 - 1) * RECONNECT_JITTER)));
     this.reconnectTimer = setTimeout(() => {
       this.reconnectTimer = undefined;
       void this.connect();
-    }, delayMs);
+    }, jittered);
   }
 
   private handle(data: WebSocket.RawData): void {
@@ -926,13 +992,23 @@ export class RelayClient {
   // Push this terminal's live context (selected model, agent version) to a
   // controller so the app's session banner reflects reality instead of a stub.
   // Sent on controller attach — like the snapshot/no_quarter resync. NON-PII ONLY
-  // by design: deliberately NO cwd / hostname / username, matching terminalLabel's
+  // by design: deliberately NO hostname / username, matching terminalLabel's
   // stance (the server/controller learns as little as possible about the machine).
   // Empty/absent fields are omitted so the app renders less rather than blank.
-  sendContext(ctx: { model?: string; version?: string; terminalPub?: string }): void {
+  //
+  // `cwd` is the one scoped exception, sent by BOTH session kinds: it is where
+  // everything the agent reads, writes and `@`-mentions lives, so a driver who can't
+  // see it is guessing at the blast radius of every prompt they send. (It used to be
+  // harbor-spawned sessions only — on the theory that a human sits in an interactive
+  // terminal and already knows the folder. They don't when they're driving it from a
+  // phone, which is the entire point of this transport.) It is home-collapsed (`~/…`)
+  // on the way out, so the banner reads like the CLI's own and the OS username still
+  // never crosses the relay.
+  sendContext(ctx: { model?: string; version?: string; cwd?: string; terminalPub?: string }): void {
     const frame: Record<string, unknown> = { type: "context" };
     if (typeof ctx.model === "string" && ctx.model) frame.model = ctx.model;
     if (typeof ctx.version === "string" && ctx.version) frame.version = ctx.version;
+    if (typeof ctx.cwd === "string" && ctx.cwd) frame.cwd = clip(homeCollapsed(ctx.cwd), 300);
     // The terminal's identity public key (base64). NOT PII — it's a public key, and
     // the app uses it to confirm this terminal is the one it PINNED at link time
     // before sealing any secret to it (channel tokens). A malicious relay can swap