feat: add TEE RA Action and Upload to Quote to Explorer proof[.]t16z[.]com

agent/src/index.ts

@@ -572,7 +572,7 @@ export async function createAgent(
                   ]
                 : []),
             ...(teeMode !== TEEMode.OFF && walletSecretSalt
-                ? [teePlugin, solanaPlugin]
+                ? [teePlugin]
                 : []),
             getSecret(character, "COINBASE_API_KEY") &&
             getSecret(character, "COINBASE_PRIVATE_KEY") &&

docs/docs/packages/plugins.md

@@ -449,6 +449,10 @@ const response = await runtime.triggerAction("INVOKE_CONTRACT", {
 
 Integrates [Dstack SDK](https://github.com/Dstack-TEE/dstack) to enable TEE (Trusted Execution Environment) functionality and deploy secure & privacy-enhanced Eliza Agents:
 
+**Actions:**
+
+- `REMOTE_ATTESTATION` - Generate a Remote Attestation Quote based on `runtime.agentId` when the agent is prompted for a remote attestation. The quote is uploaded to the [proof.t16z.com](https://proof.t16z.com) service and the agent is informed of the attestation report URL.
+
 **Providers:**
 
 - `deriveKeyProvider` - Allows for secure key derivation within a TEE environment. It supports deriving keys for both Solana (Ed25519) and Ethereum (ECDSA) chains.
@@ -526,8 +530,12 @@ docker run --rm -p 8090:8090 phalanetwork/tappd-simulator:latest
 When using the provider through the runtime environment, ensure the following settings are configured:
 
 ```env
- # Optional, for simulator purposes if testing on mac or windows. Leave empty for Linux x86 machines.
-DSTACK_SIMULATOR_ENDPOINT="http://host.docker.internal:8090"
+# TEE_MODE options:
+# - LOCAL: Uses simulator at localhost:8090 (for local development)
+# - DOCKER: Uses simulator at host.docker.internal:8090 (for docker development)
+# - PRODUCTION: No simulator, uses production endpoints
+# Defaults to OFF if not specified
+TEE_MODE=OFF # LOCAL | DOCKER | PRODUCTION
 WALLET_SECRET_SALT=your-secret-salt // Required to single agent deployments
 ```
 

packages/plugin-tee/package.json

@@ -6,7 +6,7 @@
   "types": "dist/index.d.ts",
   "dependencies": {
     "@elizaos/core": "workspace:*",
-    "@phala/dstack-sdk": "0.1.6",
+    "@phala/dstack-sdk": "0.1.7",
     "@solana/spl-token": "0.4.9",
     "@solana/web3.js": "1.95.8",
     "bignumber": "1.1.0",

packages/plugin-tee/src/actions/remoteAttestation.ts

@@ -0,0 +1,91 @@
+import type { IAgentRuntime, Memory, State, HandlerCallback } from "@elizaos/core";
+import { RemoteAttestationProvider } from "../providers/remoteAttestationProvider";
+import { fetch, type BodyInit } from "undici";
+
+function hexToUint8Array(hex: string) {
+    hex = hex.trim();
+    if (!hex) {
+      throw new Error("Invalid hex string");
+    }
+    if (hex.startsWith("0x")) {
+      hex = hex.substring(2);
+    }
+    if (hex.length % 2 !== 0) {
+      throw new Error("Invalid hex string");
+    }
+
+    const array = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+      const byte = parseInt(hex.slice(i, i + 2), 16);
+      if (isNaN(byte)) {
+        throw new Error("Invalid hex string");
+      }
+      array[i / 2] = byte;
+    }
+    return array;
+}
+
+async function uploadUint8Array(data: Uint8Array) {
+    const blob = new Blob([data], { type: "application/octet-stream" });
+    const formData = new FormData();
+    formData.append("file", blob, 'quote.bin');
+
+    return await fetch("https://proof.t16z.com/api/upload", {
+        method: "POST",
+        body: formData as BodyInit,
+      });
+}
+
+export const remoteAttestationAction = {
+    name: "REMOTE_ATTESTATION",
+    similes: ["REMOTE_ATTESTATION", "TEE_REMOTE_ATTESTATION", "TEE_ATTESTATION"],
+    description: "Generate a remote attestation to prove that the agent is running in a TEE",
+    handler: async (
+        runtime: IAgentRuntime,
+        _message: Memory,
+        _state: State,
+        _options: { [key: string]: unknown },
+        callback: HandlerCallback,
+    ) => {
+        try {
+            // Get the remote attestation of the agentId
+            const agentId = runtime.agentId;
+            const teeMode = runtime.getSetting("TEE_MODE");
+            const provider = new RemoteAttestationProvider(teeMode);
+            const attestation = await provider.generateAttestation(agentId, 'raw');
+            const attestationData = hexToUint8Array(attestation.quote);
+            const response = await uploadUint8Array(attestationData);
+            const data = await response.json();
+            callback({
+                text: `Here's my 🧾 RA Quote 🫡
+
+                https://proof.t16z.com/reports/${data.checksum}`,
+                action: "NONE",
+            });
+            return true;
+        } catch (error) {
+            console.error("Failed to fetch remote attestation: ", error);
+            return false;
+        }
+    },
+    validate: async (_runtime: IAgentRuntime) => {
+        return true;
+    },
+    examples: [
+        [
+            {
+                user: "{{user1}}",
+                content: {
+                    text: "If you are running in a TEE, generate a remote attestation",
+                },
+            },
+            {
+                user: "{{user2}}",
+                content: {
+                    text: "Of course, one second...",
+                    action: "REMOTE_ATTESTATION",
+                },
+            }
+        ],
+    ],
+};

packages/plugin-tee/src/index.ts

@@ -1,6 +1,7 @@
 import { Plugin } from "@elizaos/core";
 import { remoteAttestationProvider } from "./providers/remoteAttestationProvider";
 import { deriveKeyProvider } from "./providers/deriveKeyProvider";
+import { remoteAttestationAction } from "./actions/remoteAttestation";
 
 export { DeriveKeyProvider } from "./providers/deriveKeyProvider";
 export { RemoteAttestationProvider } from "./providers/remoteAttestationProvider";
@@ -12,6 +13,7 @@ export const teePlugin: Plugin = {
         "TEE plugin with actions to generate remote attestations and derive keys",
     actions: [
         /* custom actions */
+        remoteAttestationAction,
     ],
     evaluators: [
         /* custom evaluators */

packages/plugin-tee/src/providers/remoteAttestationProvider.ts

@@ -1,5 +1,5 @@
 import { IAgentRuntime, Memory, Provider, State } from "@elizaos/core";
-import { TdxQuoteResponse, TappdClient } from "@phala/dstack-sdk";
+import { TdxQuoteResponse, TappdClient, TdxQuoteHashAlgorithms } from "@phala/dstack-sdk";
 import { RemoteAttestationQuote, TEEMode } from "../types/tee";
 
 class RemoteAttestationProvider {
@@ -38,12 +38,13 @@ class RemoteAttestationProvider {
     }
 
     async generateAttestation(
-        reportData: string
+        reportData: string,
+        hashAlgorithm?: TdxQuoteHashAlgorithms
     ): Promise<RemoteAttestationQuote> {
         try {
             console.log("Generating attestation for: ", reportData);
             const tdxQuote: TdxQuoteResponse =
-                await this.client.tdxQuote(reportData);
+                await this.client.tdxQuote(reportData, hashAlgorithm);
             const rtmrs = tdxQuote.replayRtmrs();
             console.log(
                 `rtmr0: ${rtmrs[0]}\nrtmr1: ${rtmrs[1]}\nrtmr2: ${rtmrs[2]}\nrtmr3: ${rtmrs[3]}f`
@@ -74,7 +75,7 @@ const remoteAttestationProvider: Provider = {
 
         try {
             console.log("Generating attestation for: ", agentId);
-            const attestation = await provider.generateAttestation(agentId);
+            const attestation = await provider.generateAttestation(agentId, 'raw');
             return `Your Agent's remote attestation is: ${JSON.stringify(attestation)}`;
         } catch (error) {
             console.error("Error in remote attestation provider:", error);

packages/plugin-tee/tsup.config.ts

@@ -24,5 +24,6 @@ export default defineConfig({
         "@solana/buffer-layout",
         "stream",
         "buffer",
+        "undici",
     ],
 });