pi-provider-phala-cloud

Phala Cloud Confidential AI for Pi, powered by private-ai-gateway.

A thin, Phala Cloud-branded distribution of the vendor-neutral @phala/pi-provider-aci: standard chat plus attested TLS (SPKI) pinning — the prompt and reply are readable only by the attested workload. Every response receipt is verified before Pi can finish the model turn or continue its tool loop.

Install

pi install npm:pi-provider-phala-cloud

Start Pi, complete the native device login, wait for the verified connection, then save a default model from the native model picker:

/login phala
# choose Phala Cloud account or Phala Cloud API key
# complete login and wait for the footer to show aci-verified
/model
# search for phala/, select a model, and press Ctrl+S

The account flow issues a Confidential AI API key; the manual method accepts an existing key. Both return the same native API-key credential to Pi. Pi stores it in ~/.pi/agent/auth.json, the refreshed catalog in ~/.pi/agent/models-store.json, and the saved default in ~/.pi/agent/settings.json. These values survive a restart and the cached catalog remains available offline. As an alternative for one process, set PHALA_AI_API_KEY; Pi does not copy environment variables into its credential store.

Config: /phala-settings · Attestation status: /phala-attestation · Receipt history: /phala-receipts · Receipt audit: /phala-receipt · Session inspection: /phala-session

Attestation and every response receipt are verified automatically. The commands only display the evidence or rerun an audit. The local wire-digest history keeps the latest 32 receipt-bearing requests by default and is cleared when Pi exits; gateway receipt and session artifacts have their own server-side retention.

Interchangeable with pi-provider-redpill — both share the same protocol core and pin the same attested workload. If you operate your own private-ai-gateway, use the neutral @phala/pi-provider-aci instead.