@sellable/install 0.1.357 → 0.1.358

package/bin/sellable-agent-host-bootstrap.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+import { lstatSync, readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { bootstrapAgentHost } from "../lib/sellable-agent/host-bootstrap.mjs";
+
+function configPath(argv) {
+  if (argv.length !== 2 || argv[0] !== "--config" || !isAbsolute(argv[1])) {
+    throw new Error("usage: --config /absolute/path");
+  }
+  const link = lstatSync(argv[1]);
+  if (link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 || link.uid !== 0 || link.gid !== 0) {
+    throw new Error("host bootstrap config rejected");
+  }
+  return argv[1];
+}
+
+try {
+  if (process.getuid?.() !== 0 || process.getgid?.() !== 0) throw new Error("host bootstrap requires root");
+  const pathValue = configPath(process.argv.slice(2));
+  const result = bootstrapAgentHost({ config: JSON.parse(readFileSync(pathValue, "utf8")) });
+  process.stdout.write(`${JSON.stringify(result.receipt)}\n`);
+} catch {
+  process.stderr.write("sellable-agent host bootstrap failed closed\n");
+  process.exitCode = 1;
+}

package/container/Dockerfile

@@ -0,0 +1,37 @@
+ARG HERMES_IMAGE=ghcr.io/hostinger/hvps-hermes-agent@sha256:f048663be9ba564de795df5f2a8184f32b92561a1f053c179dca3b45fa5bc8b9
+FROM ${HERMES_IMAGE}
+
+USER root
+
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.358
+ARG MCP_PACKAGE=@sellable/mcp@0.1.619
+ARG INSTALLER_INTEGRITY
+ARG MCP_INTEGRITY=sha512-ZepZ/YDN09SEyBNKfNEHz751z8s4VQZhvWFUnJmw0mc46YUN2OcJ7s3uN90v4ykNTSnlBrUzUCjhlY3B869aEQ==
+
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.358" \
+    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.619" \
+    && test -n "${INSTALLER_INTEGRITY}" \
+    && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
+    && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
+    && apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      bubblewrap \
+      ca-certificates \
+      nftables \
+      sudo \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
+    && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
+    && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.358' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.619') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.358', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.619', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && npm cache clean --force
+
+COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
+RUN chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD /command/s6-svstat /etc/services.d/sellable-agent-host-worker | grep -q '^up' || exit 1
+
+ENTRYPOINT ["/usr/local/bin/sellable-agent-container-entrypoint"]

package/container/README.md

@@ -0,0 +1,15 @@
+# Sellable Agent host container
+
+This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
+
+Build from this directory after `@sellable/install@0.1.358` is published:
+
+```sh
+docker build --platform linux/amd64 \
+  --build-arg INSTALLER_INTEGRITY='sha512-…' \
+  --tag sellable-agent-host:0.1.358 .
+```
+
+Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.
+
+Set `SELLABLE_AGENT_IMAGE` to the exact built image digest and start `compose.yaml`. The container bootstraps idempotently, writes `bootstrap/registration-receipt.json`, and starts the worker and isolated runtime under s6. Do not mount a Docker socket.

package/container/compose.yaml

@@ -0,0 +1,22 @@
+services:
+  sellable-agent-host:
+    image: ${SELLABLE_AGENT_IMAGE:?set exact Sellable Agent image}
+    container_name: ${SELLABLE_AGENT_CONTAINER_NAME:-sellable-agent-host-11201}
+    hostname: ${SELLABLE_AGENT_HOSTNAME:-hermes-hostinger-1807396}
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+    cgroup: host
+    pid: host
+    volumes:
+      - ./bootstrap:/var/lib/sellable-agent-bootstrap:rw
+      - sellable-agent-worker:/var/lib/sellable-agent-worker
+      - sellable-agent-runtime:/var/lib/sellable-agent-runtime
+      - sellable-agent-profiles:/var/lib/sellable-agent-profiles
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+
+volumes:
+  sellable-agent-worker:
+  sellable-agent-runtime:
+  sellable-agent-profiles:

package/container/entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+BOOTSTRAP_CONFIG=/var/lib/sellable-agent-bootstrap/bootstrap.json
+BOOTSTRAP_BIN=/opt/sellable-agent/install-root/node_modules/.bin/sellable-agent-host-bootstrap
+
+test "$(id -u)" = "0"
+test "$(id -g)" = "0"
+test -x "${BOOTSTRAP_BIN}"
+test -f "${BOOTSTRAP_CONFIG}"
+
+"${BOOTSTRAP_BIN}" --config "${BOOTSTRAP_CONFIG}"
+exec /command/s6-svscan /etc/services.d

package/lib/sellable-agent/external-runtime-builder.mjs

@@ -0,0 +1,272 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  chownSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import {
+  HERMES_AGENT_BRIDGE_CONTRACT,
+  installHermesAgentBridge,
+  verifyHermesAgentBridge,
+} from "./hermes-bridge.mjs";
+import {
+  EXTERNAL_HERMES_ENTRYPOINT,
+  EXTERNAL_MCP_ENTRYPOINT,
+  EXTERNAL_RUNTIME_CLOSURE_ROOT,
+  EXTERNAL_RUNTIME_MANIFEST_PATH,
+  observeExternalRuntimeClosure,
+} from "./runtime-helper.mjs";
+
+const MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
+const MCP_PACKAGE = "@sellable/mcp";
+const MCP_VERSION = "0.1.619";
+const SAFE_COMPONENT = /^[A-Za-z0-9@._+-]+$/;
+const HERMES_EXCLUDES = new Set([".git", ".playwright", "node_modules"]);
+
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+
+function mapped(pathRoot, absolutePath) {
+  const root = realpathSync(resolve(pathRoot));
+  const target = root === "/"
+    ? resolve(absolutePath)
+    : join(root, absolutePath.replace(/^\/+/, ""));
+  const confined = relative(root, target);
+  if (!isAbsolute(absolutePath) || confined.startsWith("..") || isAbsolute(confined)) {
+    throw new Error("external runtime build target rejected");
+  }
+  return target;
+}
+
+function trustedDirectory(pathValue) {
+  const resolved = realpathSync(resolve(pathValue));
+  const link = lstatSync(resolved);
+  if (
+    link.isSymbolicLink() || !link.isDirectory() || (link.mode & 0o022) !== 0
+  ) throw new Error("external runtime source rejected");
+  return resolved;
+}
+
+function copyFile(source, target, transform = (bytes) => bytes) {
+  const link = lstatSync(source);
+  if (!link.isFile() || link.isSymbolicLink()) throw new Error("external runtime source file rejected");
+  const bytes = transform(readFileSync(source));
+  const mode = (link.mode & 0o111) === 0 ? 0o644 : 0o755;
+  writeFileSync(target, bytes, { flag: "wx", mode });
+  chmodSync(target, mode);
+}
+
+function hermesScript(bytes) {
+  const source = bytes.toString("utf8");
+  const newline = source.indexOf("\n");
+  const first = newline < 0 ? source : source.slice(0, newline);
+  if (!first.startsWith("#!/opt/hermes/.venv/bin/python")) return bytes;
+  const rest = newline < 0 ? "" : source.slice(newline);
+  return Buffer.from(`#!${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes/venv/bin/python3${rest}`);
+}
+
+function copyTree({ sourceRoot, targetRoot, kind, logicalRoot = "" }) {
+  for (const name of readdirSync(sourceRoot).sort()) {
+    if (!SAFE_COMPONENT.test(name)) throw new Error("external runtime source name rejected");
+    if (kind === "hermes" && HERMES_EXCLUDES.has(name)) continue;
+    if (kind === "mcp-dependencies" && [".bin", ".package-lock.json"].includes(name)) continue;
+    if (kind === "mcp-dependencies" && logicalRoot === "" && name === "@sellable") {
+      const scopedSource = join(sourceRoot, name);
+      const scopedTarget = join(targetRoot, name);
+      mkdirSync(scopedTarget, { mode: 0o755 });
+      for (const scopedName of readdirSync(scopedSource).sort()) {
+        if (scopedName === "mcp" || scopedName === "install") continue;
+        if (!SAFE_COMPONENT.test(scopedName)) throw new Error("external runtime source name rejected");
+        const nestedSource = join(scopedSource, scopedName);
+        const nestedTarget = join(scopedTarget, scopedName);
+        const nested = lstatSync(nestedSource);
+        if (!nested.isDirectory() || nested.isSymbolicLink()) {
+          throw new Error("external runtime dependency rejected");
+        }
+        mkdirSync(nestedTarget, { mode: 0o755 });
+        copyTree({
+          sourceRoot: nestedSource,
+          targetRoot: nestedTarget,
+          kind,
+          logicalRoot: `${name}/${scopedName}`,
+        });
+      }
+      if (readdirSync(scopedTarget).length === 0) rmSync(scopedTarget, { recursive: true });
+      continue;
+    }
+    const outputName = kind === "hermes" && logicalRoot === "" && name === ".venv"
+      ? "venv"
+      : name;
+    const source = join(sourceRoot, name);
+    const target = join(targetRoot, outputName);
+    const logicalPath = logicalRoot ? `${logicalRoot}/${outputName}` : outputName;
+    const link = lstatSync(source);
+    if (link.isSymbolicLink()) {
+      if (kind !== "hermes") throw new Error("external runtime dependency symlink rejected");
+      if (logicalPath === "venv/lib64") continue;
+      if (!["venv/bin/python", "venv/bin/python3", "venv/bin/python3.13"].includes(logicalPath)) {
+        throw new Error("external Hermes symlink rejected");
+      }
+      copyFile(realpathSync(source), target);
+      continue;
+    }
+    if (link.isDirectory()) {
+      mkdirSync(target, { mode: 0o755 });
+      copyTree({ sourceRoot: source, targetRoot: target, kind, logicalRoot: logicalPath });
+      continue;
+    }
+    if (!link.isFile()) throw new Error("external runtime special source rejected");
+    copyFile(source, target, kind === "hermes" && logicalPath.startsWith("venv/bin/")
+      ? hermesScript
+      : undefined);
+  }
+}
+
+function normalizeTree(root, ownerUid, ownerGid) {
+  const directories = [];
+  const files = [];
+  const visit = (directory, logicalDirectory) => {
+    for (const name of readdirSync(directory).sort()) {
+      const pathValue = join(directory, name);
+      const logicalPath = logicalDirectory ? `${logicalDirectory}/${name}` : name;
+      const link = lstatSync(pathValue);
+      if (link.isSymbolicLink()) throw new Error("external runtime output symlink rejected");
+      if (link.isDirectory()) {
+        visit(pathValue, logicalPath);
+        chmodSync(pathValue, 0o555);
+        chownSync(pathValue, ownerUid, ownerGid);
+        directories.push({ path: logicalPath, mode: 0o555 });
+      } else if (link.isFile()) {
+        const mode = (link.mode & 0o111) === 0 ? 0o444 : 0o555;
+        chmodSync(pathValue, mode);
+        chownSync(pathValue, ownerUid, ownerGid);
+        files.push({ path: logicalPath, mode, digest: sha256(readFileSync(pathValue)) });
+      } else {
+        throw new Error("external runtime output special file rejected");
+      }
+    }
+  };
+  visit(root, "");
+  chmodSync(root, 0o555);
+  chownSync(root, ownerUid, ownerGid);
+  return {
+    directories: directories.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0),
+    files: files.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0),
+  };
+}
+
+function packageIdentity(root) {
+  const parsed = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+  if (parsed?.name !== MCP_PACKAGE || parsed.version !== MCP_VERSION) {
+    throw new Error("external MCP package identity rejected");
+  }
+}
+
+function bridgeContract(input) {
+  return input.disposableFixture === true && input.hermesBridgeContract
+    ? input.hermesBridgeContract
+    : HERMES_AGENT_BRIDGE_CONTRACT;
+}
+
+function currentClosure(input, pathRoot, ownerUid, ownerGid) {
+  const observed = observeExternalRuntimeClosure({
+    pathRoot,
+    manifestPath: EXTERNAL_RUNTIME_MANIFEST_PATH,
+    expectedClosureRoot: EXTERNAL_RUNTIME_CLOSURE_ROOT,
+    trustRoot: dirname(EXTERNAL_RUNTIME_CLOSURE_ROOT),
+    ownerUid,
+    ownerGid,
+    expectedEntrypoints: { mcp: EXTERNAL_MCP_ENTRYPOINT, hermes: EXTERNAL_HERMES_ENTRYPOINT },
+  });
+  const root = mapped(pathRoot, EXTERNAL_RUNTIME_CLOSURE_ROOT);
+  packageIdentity(join(root, "mcp"));
+  verifyHermesAgentBridge({
+    sourceRoot: join(root, "hermes"),
+    contract: bridgeContract(input),
+  });
+  return { ...observed, reused: true };
+}
+
+export function buildExternalRuntimeClosure(input = {}) {
+  const pathRoot = resolve(input.pathRoot ?? "/");
+  if (!isAbsolute(pathRoot) || !existsSync(pathRoot)) throw new Error("external runtime path root rejected");
+  if (pathRoot !== "/" && input.disposableFixture !== true) {
+    throw new Error("external runtime live root rejected");
+  }
+  const ownerUid = input.ownerUid ?? process.getuid?.() ?? 0;
+  const ownerGid = input.ownerGid ?? process.getgid?.() ?? 0;
+  if (!Number.isSafeInteger(ownerUid) || ownerUid < 0 || !Number.isSafeInteger(ownerGid) || ownerGid < 0) {
+    throw new Error("external runtime owner rejected");
+  }
+  const mcpPackageRoot = trustedDirectory(input.mcpPackageRoot);
+  const mcpNodeModulesRoot = trustedDirectory(input.mcpNodeModulesRoot);
+  const hermesSourceRoot = trustedDirectory(input.hermesSourceRoot);
+  packageIdentity(mcpPackageRoot);
+  const target = mapped(pathRoot, EXTERNAL_RUNTIME_CLOSURE_ROOT);
+  if (existsSync(target)) return currentClosure(input, pathRoot, ownerUid, ownerGid);
+
+  const trustRoot = dirname(target);
+  if (!existsSync(trustRoot)) mkdirSync(trustRoot, { recursive: true, mode: 0o755 });
+  const staging = join(trustRoot, `.external-runtime-${randomUUID()}`);
+  mkdirSync(staging, { mode: 0o755 });
+  try {
+    const mcpRoot = join(staging, "mcp");
+    const dependencyRoot = join(mcpRoot, "node_modules");
+    const hermesRoot = join(staging, "hermes");
+    mkdirSync(mcpRoot, { mode: 0o755 });
+    mkdirSync(dependencyRoot, { mode: 0o755 });
+    mkdirSync(hermesRoot, { mode: 0o755 });
+    copyTree({ sourceRoot: mcpPackageRoot, targetRoot: mcpRoot, kind: "mcp" });
+    copyTree({ sourceRoot: mcpNodeModulesRoot, targetRoot: dependencyRoot, kind: "mcp-dependencies" });
+    mkdirSync(join(mcpRoot, "bin"), { mode: 0o755 });
+    writeFileSync(
+      join(mcpRoot, "bin", "sellable-mcp"),
+      `#!/bin/sh\nexec /usr/bin/node '${EXTERNAL_RUNTIME_CLOSURE_ROOT}/mcp/dist/index.js' "$@"\n`,
+      { mode: 0o755, flag: "wx" },
+    );
+    copyTree({ sourceRoot: hermesSourceRoot, targetRoot: hermesRoot, kind: "hermes" });
+    installHermesAgentBridge({ sourceRoot: hermesRoot, contract: bridgeContract(input) });
+
+    const mcp = normalizeTree(mcpRoot, ownerUid, ownerGid);
+    const hermes = normalizeTree(hermesRoot, ownerUid, ownerGid);
+    const manifest = {
+      version: MANIFEST_VERSION,
+      closureRoot: EXTERNAL_RUNTIME_CLOSURE_ROOT,
+      roots: [
+        { kind: "mcp", entrypoint: "bin/sellable-mcp", rootMode: 0o555, ...mcp },
+        { kind: "hermes", entrypoint: "venv/bin/hermes", rootMode: 0o555, ...hermes },
+      ],
+    };
+    writeFileSync(join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, {
+      mode: 0o444,
+      flag: "wx",
+    });
+    chmodSync(join(staging, "manifest.json"), 0o444);
+    chownSync(join(staging, "manifest.json"), ownerUid, ownerGid);
+    chownSync(staging, ownerUid, ownerGid);
+    renameSync(staging, target);
+    chmodSync(target, 0o555);
+    return { ...currentClosure(input, pathRoot, ownerUid, ownerGid), reused: false };
+  } catch (error) {
+    if (existsSync(staging)) {
+      const makeWritable = (pathValue) => {
+        const link = lstatSync(pathValue);
+        if (link.isDirectory()) {
+          chmodSync(pathValue, 0o755);
+          for (const name of readdirSync(pathValue)) makeWritable(join(pathValue, name));
+        } else if (link.isFile()) chmodSync(pathValue, 0o644);
+      };
+      makeWritable(staging);
+      rmSync(staging, { recursive: true });
+    }
+    throw error;
+  }
+}

package/lib/sellable-agent/hermes-bridge.mjs

@@ -285,14 +285,14 @@ export const HERMES_AGENT_BRIDGE_CONTRACT = normalizeContract({
     {
       path: "plugins/platforms/slack/adapter.py",
       patchKind: "slack-adapter",
-      sourceSha256: "a84f1f15368d8d93341a1c2449c45ca13ebe92938049e92d80ce5cab0e1a6294",
-      patchedSha256: "4ba3b1f5b443abf970b8888de3c1b21ab7f043645aba6304432453c1dc643f55",
+      sourceSha256: "20b12d9bbff0f5b280e0be8e795c7327f4089c3fa8b04d7a6d346dabae591f2a",
+      patchedSha256: "548ab70f515e22830cbcbf6b0691768272dd708fd0118f7c601e1e1232bb016b",
     },
     {
       path: "tools/mcp_tool.py",
       patchKind: "mcp-tool",
-      sourceSha256: "ee453ede1c72c90b28155e292a352bfba96eb1793c47eb8667d16fe79beb181e",
-      patchedSha256: "c0923d8c88d507a766121dab9f0f36e99963f85a9124cbef2908ee7176d56e07",
+      sourceSha256: "1bcceccaeb8ec8894c83819d389a64258517f4b48db1c8fea5c486633e56fe8b",
+      patchedSha256: "44bf5dfeca47bf91fc5e68ecd6455c33f41afd2b04fa16d213f59115ddb38f21",
     },
   ],
 });

package/lib/sellable-agent/host-bootstrap.mjs

@@ -0,0 +1,458 @@
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  randomUUID,
+} from "node:crypto";
+import {
+  chmodSync,
+  chownSync,
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildExternalRuntimeClosure } from "./external-runtime-builder.mjs";
+import { canonicalHostWorkerDigest } from "./host-worker.mjs";
+import {
+  EXTERNAL_HERMES_ENTRYPOINT,
+  EXTERNAL_MCP_ENTRYPOINT,
+  EXTERNAL_RUNTIME_CLOSURE_ROOT,
+  EXTERNAL_RUNTIME_MANIFEST_PATH,
+} from "./runtime-helper.mjs";
+import { RUNTIME_EGRESS_HOSTS } from "./runtime-boundary.mjs";
+import { RUNTIME_EGRESS_PROXY_VERSION } from "./runtime-egress-proxy.mjs";
+import { installAgentHostServices } from "./service-installer.mjs";
+
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+const VERSION = "sellable-agent-host-bootstrap/v1";
+const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.358";
+const MCP_PACKAGE = "@sellable/mcp@0.1.619";
+const HERMES_VERSION = "0.18.0";
+const SHA256 = /^[a-f0-9]{64}$/;
+const SHA256_16 = /^[a-f0-9]{16}$/;
+const SHA512_INTEGRITY = /^sha512-[A-Za-z0-9+/]+={0,2}$/;
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const SAFE_TOOL = /^[a-z][a-z0-9_]{0,63}$/;
+const SECRET = /xox[bap]-|sat_[A-Za-z0-9_-]+|asec\.v1\.|access[_-]?token|refresh[_-]?token|private[_-]?key/i;
+
+const PATHS = Object.freeze({
+  providerSource: "/var/lib/sellable-agent-bootstrap/provider-auth",
+  xappSource: "/var/lib/sellable-agent-bootstrap/slack-app",
+  hostProbe: "/var/lib/sellable-agent-bootstrap/host-probe",
+  receipt: "/var/lib/sellable-agent-bootstrap/registration-receipt.json",
+  releaseIdentity: "/opt/sellable-agent/release.json",
+  workerRoot: "/var/lib/sellable-agent-worker",
+  workerRequests: "/var/lib/sellable-agent-worker/requests",
+  helperRequests: "/var/lib/sellable-agent-worker/helper-requests",
+  workerState: "/var/lib/sellable-agent-worker/state",
+  workerSlackSecrets: "/var/lib/sellable-agent-worker/runtime-secrets",
+  workerHostSecrets: "/var/lib/sellable-agent-worker/host-secrets",
+  xappRuntime: "/var/lib/sellable-agent-worker/host-secrets/slack-app",
+  signingRoot: "/var/lib/sellable-agent-worker/enrollment",
+  signingKey: "/var/lib/sellable-agent-worker/enrollment/private-key.pem",
+  runtimeRoot: "/var/lib/sellable-agent-runtime",
+  runtimeState: "/var/lib/sellable-agent-runtime/state",
+  runtimeMcpSecrets: "/var/lib/sellable-agent-runtime/mcp-secrets",
+  profiles: "/var/lib/sellable-agent-profiles",
+});
+
+const exactKeys = (value, keys) => Boolean(
+  value && typeof value === "object" && !Array.isArray(value) &&
+  Object.keys(value).sort().join("\0") === [...keys].sort().join("\0")
+);
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]));
+  }
+  return value;
+}
+
+function targetPath(targetRoot, absolutePath) {
+  const root = realpathSync(resolve(targetRoot));
+  const value = root === "/" ? resolve(absolutePath) : join(root, absolutePath.replace(/^\/+/, ""));
+  const rel = relative(root, value);
+  if (!isAbsolute(absolutePath) || rel.startsWith("..") || isAbsolute(rel)) {
+    throw new Error("host bootstrap target rejected");
+  }
+  return value;
+}
+
+function atomicFile(pathValue, bytes, mode, { uid, gid, disposableFixture }) {
+  const temp = join(dirname(pathValue), `.${randomUUID()}.tmp`);
+  writeFileSync(temp, bytes, { flag: "wx", mode });
+  chmodSync(temp, mode);
+  if (!disposableFixture) chownSync(temp, uid, gid);
+  const descriptor = openSync(temp, "r");
+  try { fsyncSync(descriptor); } finally { closeSync(descriptor); }
+  renameSync(temp, pathValue);
+  const parent = openSync(dirname(pathValue), "r");
+  try { fsyncSync(parent); } finally { closeSync(parent); }
+}
+
+function ensureDirectory(targetRoot, absolutePath, mode, uid, gid, disposableFixture) {
+  const value = targetPath(targetRoot, absolutePath);
+  if (!existsSync(value)) mkdirSync(value, { recursive: true, mode });
+  const link = lstatSync(value);
+  if (link.isSymbolicLink() || !link.isDirectory()) throw new Error("host bootstrap directory rejected");
+  chmodSync(value, mode);
+  if (!disposableFixture) chownSync(value, uid, gid);
+  const observed = lstatSync(value);
+  if (
+    (observed.mode & 0o777) !== mode ||
+    (!disposableFixture && (observed.uid !== uid || observed.gid !== gid))
+  ) throw new Error("host bootstrap directory readback rejected");
+  return value;
+}
+
+function readPrivateSource(targetRoot, absolutePath, disposableFixture) {
+  const value = targetPath(targetRoot, absolutePath);
+  const parent = lstatSync(dirname(value));
+  const link = lstatSync(value);
+  const expectedUid = disposableFixture ? (process.getuid?.() ?? link.uid) : 0;
+  const expectedGid = disposableFixture ? (process.getgid?.() ?? link.gid) : 0;
+  if (
+    parent.isSymbolicLink() || !parent.isDirectory() || (parent.mode & 0o777) !== 0o700 ||
+    parent.uid !== expectedUid || parent.gid !== expectedGid ||
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 ||
+    link.uid !== expectedUid || link.gid !== expectedGid || realpathSync(dirname(value)) !== dirname(value)
+  ) throw new Error("host bootstrap private source rejected");
+  const descriptor = openSync(value, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const opened = fstatSync(descriptor);
+    if (!opened.isFile() || opened.dev !== link.dev || opened.ino !== link.ino) {
+      throw new Error("host bootstrap private source changed");
+    }
+    return readFileSync(descriptor, "utf8").trim();
+  } finally {
+    closeSync(descriptor);
+  }
+}
+
+function readReleaseIdentity(targetRoot, expected, disposableFixture) {
+  const value = targetPath(targetRoot, PATHS.releaseIdentity);
+  const link = lstatSync(value);
+  const expectedUid = disposableFixture ? (process.getuid?.() ?? link.uid) : 0;
+  const expectedGid = disposableFixture ? (process.getgid?.() ?? link.gid) : 0;
+  if (
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o444 ||
+    link.uid !== expectedUid || link.gid !== expectedGid
+  ) throw new Error("host bootstrap image release rejected");
+  const observed = JSON.parse(readFileSync(value, "utf8"));
+  if (!exactKeys(observed, ["installerPackage", "installerIntegrity", "mcpPackage", "mcpIntegrity"]) ||
+      JSON.stringify(stable(observed)) !== JSON.stringify(stable(expected))) {
+    throw new Error("host bootstrap image release mismatch");
+  }
+  return observed;
+}
+
+function validateConfig(config) {
+  if (!exactKeys(config, [
+    "version", "target", "host", "enrollment", "release", "controlPlaneUrl",
+    "runtimeContract", "identities",
+  ]) || config.version !== VERSION || SECRET.test(JSON.stringify(config))) {
+    throw new Error("host bootstrap config rejected");
+  }
+  if (
+    !exactKeys(config.target, ["vpsId", "hostname", "containerName"]) ||
+    Object.values(config.target).some((value) => !SAFE_ID.test(value ?? "")) ||
+    !exactKeys(config.host, ["id", "stableKey", "compatibilityHash", "capacity"]) ||
+    !SAFE_ID.test(config.host.id ?? "") || !SAFE_ID.test(config.host.stableKey ?? "") ||
+    !SHA256.test(config.host.compatibilityHash ?? "") ||
+    !Number.isSafeInteger(config.host.capacity) || config.host.capacity < 1 || config.host.capacity > 100 ||
+    !exactKeys(config.enrollment, ["id", "workerId", "keyGeneration", "expiresAt"]) ||
+    !SAFE_ID.test(config.enrollment.id ?? "") || !SAFE_ID.test(config.enrollment.workerId ?? "") ||
+    !Number.isSafeInteger(config.enrollment.keyGeneration) || config.enrollment.keyGeneration < 1 ||
+    !Number.isFinite(Date.parse(config.enrollment.expiresAt ?? "")) ||
+    Date.parse(config.enrollment.expiresAt) <= Date.now() ||
+    !exactKeys(config.release, ["installerPackage", "installerIntegrity", "mcpPackage", "mcpIntegrity"]) ||
+    config.release.installerPackage !== INSTALLER_PACKAGE ||
+    config.release.mcpPackage !== MCP_PACKAGE ||
+    !SHA512_INTEGRITY.test(config.release.installerIntegrity ?? "") ||
+    !SHA512_INTEGRITY.test(config.release.mcpIntegrity ?? "") ||
+    !/^https:\/\/[A-Za-z0-9.-]+(?::[0-9]+)?$/.test(config.controlPlaneUrl ?? "")
+  ) throw new Error("host bootstrap identity rejected");
+  const runtime = config.runtimeContract;
+  if (
+    !exactKeys(runtime, [
+      "profileId", "providerReference", "providerFingerprint", "xappReference",
+      "xappFingerprint", "policyHash", "toolInclude",
+    ]) || !SAFE_ID.test(runtime.profileId ?? "") ||
+    typeof runtime.providerReference !== "string" || !runtime.providerReference || runtime.providerReference.length > 256 ||
+    !SHA256.test(runtime.providerFingerprint ?? "") ||
+    typeof runtime.xappReference !== "string" || !runtime.xappReference || runtime.xappReference.length > 256 ||
+    !SHA256_16.test(runtime.xappFingerprint ?? "") ||
+    !SHA256.test(runtime.policyHash ?? "") || !Array.isArray(runtime.toolInclude) ||
+    runtime.toolInclude.length < 1 || runtime.toolInclude.length > 64 ||
+    runtime.toolInclude.some((tool) => !SAFE_TOOL.test(tool)) ||
+    JSON.stringify(runtime.toolInclude) !== JSON.stringify([...new Set(runtime.toolInclude)].sort())
+  ) throw new Error("host bootstrap runtime contract rejected");
+  const identities = config.identities;
+  if (
+    !exactKeys(identities, ["workerUid", "workerGid", "proxyUid", "proxyGid", "runtimeUid", "runtimeGid", "siblingUid", "siblingGid", "adminUid", "adminGid"]) ||
+    Object.values(identities).some((value) => !Number.isSafeInteger(value) || value < 1) ||
+    new Set([identities.workerUid, identities.proxyUid, identities.runtimeUid, identities.siblingUid, identities.adminUid]).size !== 5
+  ) throw new Error("host bootstrap runtime identities rejected");
+  return config;
+}
+
+function signingIdentity(targetRoot, config, disposableFixture) {
+  const keyPath = targetPath(targetRoot, PATHS.signingKey);
+  if (!existsSync(keyPath)) {
+    const { privateKey } = generateKeyPairSync("ed25519");
+    atomicFile(
+      keyPath,
+      privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+      0o600,
+      { uid: config.identities.workerUid, gid: config.identities.workerGid, disposableFixture },
+    );
+  }
+  const link = lstatSync(keyPath);
+  if (
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 ||
+    (!disposableFixture && (link.uid !== config.identities.workerUid || link.gid !== config.identities.workerGid))
+  ) throw new Error("host bootstrap signing key rejected");
+  const privateKey = createPrivateKey(readFileSync(keyPath, "utf8"));
+  if (privateKey.asymmetricKeyType !== "ed25519") throw new Error("host bootstrap signing key type rejected");
+  const publicKeyPem = createPublicKey(privateKey).export({ type: "spki", format: "pem" }).toString();
+  const publicKeyHash = sha256(publicKeyPem);
+  const enrollmentFingerprint = canonicalHostWorkerDigest({
+    audience: "sellable-agent-worker/v1",
+    enrollmentId: config.enrollment.id,
+    hostId: config.host.id,
+    keyGeneration: config.enrollment.keyGeneration,
+    publicKeyHash,
+    workerId: config.enrollment.workerId,
+  });
+  return { publicKeyHash, enrollmentFingerprint };
+}
+
+function prepareLayout(targetRoot, config, disposableFixture) {
+  const ids = config.identities;
+  for (const pathValue of [
+    PATHS.workerRoot, PATHS.workerRequests, PATHS.helperRequests, PATHS.workerState,
+    PATHS.workerSlackSecrets, PATHS.workerHostSecrets, PATHS.signingRoot,
+  ]) ensureDirectory(targetRoot, pathValue, 0o700, ids.workerUid, ids.workerGid, disposableFixture);
+  for (const pathValue of [PATHS.runtimeRoot, PATHS.runtimeState, PATHS.runtimeMcpSecrets]) {
+    ensureDirectory(targetRoot, pathValue, 0o700, ids.runtimeUid, ids.runtimeGid, disposableFixture);
+  }
+  ensureDirectory(targetRoot, PATHS.profiles, 0o711, ids.workerUid, ids.workerGid, disposableFixture);
+  const probePath = targetPath(targetRoot, PATHS.hostProbe);
+  if (!existsSync(probePath)) {
+    atomicFile(probePath, "host-only\n", 0o600, { uid: 0, gid: 0, disposableFixture });
+  }
+}
+
+function installHostAppSecret(targetRoot, config, disposableFixture) {
+  const source = readPrivateSource(targetRoot, PATHS.xappSource, disposableFixture);
+  if (!source || source.length > 4096 || sha256(source).slice(0, 16) !== config.runtimeContract.xappFingerprint) {
+    throw new Error("host bootstrap Slack app source rejected");
+  }
+  const target = targetPath(targetRoot, PATHS.xappRuntime);
+  atomicFile(target, `${source}\n`, 0o600, {
+    uid: config.identities.workerUid,
+    gid: config.identities.workerGid,
+    disposableFixture,
+  });
+  return target;
+}
+
+function configs(config, signing, ownerUid, ownerGid) {
+  const ids = config.identities;
+  const workerConfig = {
+    enrollmentId: config.enrollment.id,
+    hostId: config.host.id,
+    workerId: config.enrollment.workerId,
+    signerGeneration: config.enrollment.keyGeneration,
+    enrollmentFingerprint: signing.enrollmentFingerprint,
+    publicKeyHash: signing.publicKeyHash,
+    privateKeyPath: PATHS.signingKey,
+    controlPlaneUrl: config.controlPlaneUrl,
+    requestRoot: PATHS.workerRequests,
+    helperRequestRoot: PATHS.helperRequests,
+    stateRoot: PATHS.workerState,
+    profilesRoot: PATHS.profiles,
+    runtimeSecretsRoot: PATHS.workerSlackSecrets,
+    runtimeMcpSecretsRoot: PATHS.runtimeMcpSecrets,
+    workerUid: ids.workerUid,
+    workerGid: ids.workerGid,
+    runtimeUid: ids.runtimeUid,
+    runtimeGid: ids.runtimeGid,
+    leaseSeconds: 30,
+    poll: { minDelayMs: 1_000, maxDelayMs: 30_000, jitterRatio: 0.2 },
+    profileRuntimeContract: {
+      hermesCli: "hermes",
+      hermesVersion: HERMES_VERSION,
+      installerPackage: INSTALLER_PACKAGE,
+      mcpPackage: MCP_PACKAGE,
+      providerReference: config.runtimeContract.providerReference,
+      providerFingerprint: config.runtimeContract.providerFingerprint,
+      xappReference: config.runtimeContract.xappReference,
+      xappFingerprint: config.runtimeContract.xappFingerprint,
+      xappSecretFile: PATHS.xappRuntime,
+      policies: {
+        [config.runtimeContract.policyHash]: { toolInclude: config.runtimeContract.toolInclude },
+      },
+    },
+  };
+  const helperProfile = {
+    workerUid: ids.workerUid,
+    workerGid: ids.workerGid,
+    runtimeUid: ids.runtimeUid,
+    runtimeGid: ids.runtimeGid,
+    siblingUid: ids.siblingUid,
+    siblingGid: ids.siblingGid,
+    adminUid: ids.adminUid,
+    adminGid: ids.adminGid,
+    proxyUid: ids.proxyUid,
+    proxyGid: ids.proxyGid,
+    profilesRoot: PATHS.profiles,
+    workerRuntimeSecretRoot: PATHS.workerSlackSecrets,
+    mcpCredentialRoot: PATHS.runtimeMcpSecrets,
+    runtimeStateRoot: PATHS.runtimeState,
+    proxyExecutablePath: "/usr/local/lib/sellable-agent/package/bin/sellable-agent-egress-proxy.mjs",
+    installedPackageManifestPath: "/usr/local/lib/sellable-agent/package/manifest.json",
+    externalRuntimeManifestPath: EXTERNAL_RUNTIME_MANIFEST_PATH,
+    externalRuntimeClosureRoot: EXTERNAL_RUNTIME_CLOSURE_ROOT,
+    externalRuntimeTrustRoot: "/usr/local/lib/sellable-agent",
+    externalRuntimePathRoot: "/",
+    externalRuntimeOwnerUid: ownerUid,
+    externalRuntimeOwnerGid: ownerGid,
+    mcpCommand: EXTERNAL_MCP_ENTRYPOINT,
+    hermesExecutablePath: EXTERNAL_HERMES_ENTRYPOINT,
+    hermesSourceRoot: `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes`,
+    proxyConfigPath: "/etc/sellable-agent/egress-proxy.json",
+    runtimeBoundaryConfigPath: "/etc/sellable-agent/runtime-boundary.json",
+    providerCredentialSourcePath: PATHS.providerSource,
+    providerCredentialFingerprint: config.runtimeContract.providerFingerprint,
+    runtimeServicePath: "/etc/services.d/sellable-agent-runtime",
+    runtimeServiceEnvRoot: "/etc/services.d/sellable-agent-runtime/env",
+    runtimeProbePath: "/usr/local/bin/sellable-agent-runtime-probe",
+    proxyPidPath: "/etc/services.d/sellable-agent-egress-proxy/supervise/pid",
+    proxyPort: 19081,
+    procRoot: "/proc",
+    bootIdPath: "/proc/sys/kernel/random/boot_id",
+    bubblewrapPath: "/usr/bin/bwrap",
+    setprivPath: "/usr/bin/setpriv",
+    nftPath: "/usr/sbin/nft",
+    cgroupRoot: "/sys/fs/cgroup/sellable-agent",
+    hostProbePath: PATHS.hostProbe,
+    dockerSocketPath: "/var/run/docker.sock",
+  };
+  const helperConfig = {
+    helperRequestRoot: PATHS.helperRequests,
+    workerRequestRoot: PATHS.workerRequests,
+    s6SvcPath: "/command/s6-svc",
+    profiles: { [config.runtimeContract.profileId]: helperProfile },
+  };
+  const egressProxyConfig = {
+    version: RUNTIME_EGRESS_PROXY_VERSION,
+    listenHost: "127.0.0.1",
+    listenPort: 19081,
+    uid: ids.proxyUid,
+    gid: ids.proxyGid,
+    allowedHosts: [...RUNTIME_EGRESS_HOSTS],
+  };
+  return { workerConfig, helperConfig, egressProxyConfig };
+}
+
+export function bootstrapAgentHost(input) {
+  const config = validateConfig(input.config);
+  const targetRoot = resolve(input.targetRoot ?? "/");
+  const disposableFixture = input.disposableFixture === true;
+  if (!isAbsolute(targetRoot) || !existsSync(targetRoot) || (targetRoot !== "/" && !disposableFixture)) {
+    throw new Error("host bootstrap root rejected");
+  }
+  if (targetRoot === "/" && (process.getuid?.() !== 0 || process.getgid?.() !== 0)) {
+    throw new Error("host bootstrap requires root");
+  }
+  readReleaseIdentity(targetRoot, config.release, disposableFixture);
+  const provider = readPrivateSource(targetRoot, PATHS.providerSource, disposableFixture);
+  if (!provider || provider.length > 1024 * 1024 || sha256(provider) !== config.runtimeContract.providerFingerprint) {
+    throw new Error("host bootstrap provider source rejected");
+  }
+  const providerJson = JSON.parse(provider);
+  if (!providerJson || typeof providerJson !== "object" || Array.isArray(providerJson)) {
+    throw new Error("host bootstrap provider JSON rejected");
+  }
+  prepareLayout(targetRoot, config, disposableFixture);
+  installHostAppSecret(targetRoot, config, disposableFixture);
+  const signing = signingIdentity(targetRoot, config, disposableFixture);
+  const sourceRoots = disposableFixture ? input.sourceRoots : {
+    mcpPackageRoot: "/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp",
+    mcpNodeModulesRoot: "/opt/sellable-agent/mcp-root/node_modules",
+    hermesSourceRoot: "/opt/hermes",
+  };
+  const externalRuntime = buildExternalRuntimeClosure({
+    pathRoot: targetRoot,
+    ownerUid: disposableFixture ? (process.getuid?.() ?? 0) : 0,
+    ownerGid: disposableFixture ? (process.getgid?.() ?? 0) : 0,
+    disposableFixture,
+    ...(sourceRoots ?? {}),
+    ...(disposableFixture && input.hermesBridgeContract ? { hermesBridgeContract: input.hermesBridgeContract } : {}),
+  });
+  const ownerUid = disposableFixture ? (process.getuid?.() ?? 0) : 0;
+  const ownerGid = disposableFixture ? (process.getgid?.() ?? 0) : 0;
+  const generated = configs(config, signing, ownerUid, ownerGid);
+  const installed = installAgentHostServices({
+    targetRoot,
+    packageRoot: input.packageRoot ?? PACKAGE_ROOT,
+    ownerUid,
+    ownerGid,
+    disposableFixture,
+    ...(disposableFixture && input.accountProvisioner ? { accountProvisioner: input.accountProvisioner } : {}),
+    ...generated,
+  });
+  if (!installed.ok) throw new Error(installed.code);
+  const configurationDigest = sha256(JSON.stringify(stable(generated)));
+  const receipt = {
+    version: RECEIPT_VERSION,
+    producer: "sellable-agent-host-bootstrap",
+    target: config.target,
+    host: config.host,
+    enrollment: {
+      id: config.enrollment.id,
+      workerId: config.enrollment.workerId,
+      audience: "sellable-agent-worker/v1",
+      keyGeneration: config.enrollment.keyGeneration,
+      publicKeyHash: signing.publicKeyHash,
+      enrollmentFingerprint: signing.enrollmentFingerprint,
+      capabilities: ["claim", "heartbeat", "secret-consume", "complete"],
+      expiresAt: new Date(config.enrollment.expiresAt).toISOString(),
+    },
+    release: {
+      ...config.release,
+      serviceManifestDigest: installed.manifestDigest,
+      externalRuntimeClosureDigest: externalRuntime.closureDigest,
+      configurationDigest,
+    },
+    secretScan: { unexpectedMatches: 0 },
+    observedAt: (input.now ?? new Date()).toISOString(),
+  };
+  if (SECRET.test(JSON.stringify(receipt))) throw new Error("host bootstrap receipt rejected");
+  atomicFile(
+    targetPath(targetRoot, PATHS.receipt),
+    `${JSON.stringify(receipt, null, 2)}\n`,
+    0o600,
+    { uid: 0, gid: 0, disposableFixture },
+  );
+  return { ok: true, receipt, workerConfig: generated.workerConfig, helperConfig: generated.helperConfig };
+}
+
+export const SELLABLE_AGENT_HOST_BOOTSTRAP_VERSION = VERSION;
+export const SELLABLE_AGENT_HOST_BOOTSTRAP_PATHS = PATHS;

package/lib/sellable-agent/host-worker.mjs

@@ -957,7 +957,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       !exactObject(runtimeService, ["principalId", "policyHash", "credentialGeneration", "credentialFingerprint"]) ||
       pinned.hermesCli !== "hermes" || pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.357" ||
+      pinned.installerPackage !== "@sellable/install@0.1.358" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.619" ||
       !Array.isArray(policy.toolInclude) || policy.toolInclude.length === 0 ||
       !Number.isSafeInteger(slack.generation) || slack.generation < 1 ||
@@ -1423,6 +1423,11 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
             revisionId: request.evidence.revisionId,
             profileDigest: request.evidence.profileDigest,
           });
+          await helper({
+            action: "INSTALL_PROVIDER_CREDENTIAL",
+            ...helperIdentity(),
+            fingerprint: context.desired.providerFingerprint,
+          });
           await helper({ action: "INSTALL_HERMES_BRIDGE", ...helperIdentity() });
           await controlRuntime("UP");
         },
@@ -1491,17 +1496,6 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     lifecycle: {},
   };
   const restart = () => controlRuntime("RESTART");
-  const reload = async (path) => {
-    const base = new URL(config.runtimeControlUrl);
-    if (base.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(base.hostname)) {
-      throw new Error("runtime control endpoint rejected");
-    }
-    const response = await (dependencies.fetchImpl ?? fetch)(
-      new URL(path, base),
-      { method: "POST", signal: AbortSignal.timeout(10_000) },
-    );
-    if (!response.ok) throw new Error("runtime reload rejected");
-  };
   const rawRuntimeObservation = async ({ drift = false } = {}) => {
     const observed = (await helper({
       action: drift ? "OBSERVE_RUNTIME_DRIFT" : "OBSERVE_RUNTIME",
@@ -1564,6 +1558,11 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
       revisionId: result.receipt.revisionId,
       profileDigest: result.receipt.profileDigest,
     });
+    await helper({
+      action: "INSTALL_PROVIDER_CREDENTIAL",
+      ...helperIdentity(),
+      fingerprint: context.desired.providerFingerprint,
+    });
     await helper({ action: "INSTALL_HERMES_BRIDGE", ...helperIdentity() });
   };
   const refreshThen = (effect) => async (input) => {
@@ -1571,8 +1570,8 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     return effect(input);
   };
   Object.assign(ports.refresh, {
-    reloadMcp: refreshThen(() => reload("/reload-mcp")),
-    reloadSkills: refreshThen(() => reload("/reload-skills")),
+    reloadMcp: refreshThen(restart),
+    reloadSkills: refreshThen(restart),
     reloadEnvironmentOrRestart: refreshThen(restart),
     restartGateway: refreshThen(restart),
     restartProfileSession: refreshThen(restart),
@@ -1675,11 +1674,8 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     async fenceDispatch() { await setRuntimeLifecycle("OFF"); },
     async fenceRouteOutput() { await setRuntimeLifecycle("ARCHIVED"); },
     async drain() {
-      const base = new URL(config.runtimeControlUrl);
-      const response = await fetch(new URL("/drain", base), { method: "POST", signal: AbortSignal.timeout(15_000) });
-      if (!response.ok) throw new Error("drain rejected");
-      const observed = await response.json();
-      if (!observed?.drained || observed.remaining !== 0) throw new Error("drain readback rejected");
+      await controlRuntime("DOWN");
+      const observed = { drained: true, remaining: 0 };
       atomicPrivateJson(join(realpathSync(config.stateRoot), `drain-${context.activeClaim.operation.id}.json`), {
         operationId: context.activeClaim.operation.id,
         fence: context.activeClaim.operation.fence,

package/lib/sellable-agent/profile-materializer.mjs

@@ -131,7 +131,7 @@ function validateDesired(desired) {
     !Number.isSafeInteger(desired.slackGeneration) || desired.slackGeneration < 1 ||
     !Number.isSafeInteger(desired.serviceCredentialGeneration) || desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" || desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.357" ||
+    desired.installerPackage !== "@sellable/install@0.1.358" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.619" ||
     !Array.isArray(desired.toolInclude) || desired.toolInclude.length === 0 ||
     desired.toolInclude.some((tool) => !/^[a-z][a-z0-9_]{0,127}$/.test(tool)) ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -19,7 +19,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.357";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.358";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.619";
 
 export function deriveAgentProfileId(workspaceId, agentId, hostId) {
@@ -576,7 +576,7 @@ function inspectProvisionedProfile({
       !matchesReadback(manifest, request) ||
       manifest.serviceCredentialReference !== serviceCredentialReference ||
       manifest.installerPackage !== PINNED_INSTALL_PACKAGE ||
-      manifest.installerVersion !== "0.1.357" ||
+      manifest.installerVersion !== "0.1.358" ||
       manifest.mcpPackage !== PINNED_MCP_PACKAGE ||
       manifest.credentialKeyVersion !== credentialKeyVersion ||
       !/^[a-f0-9]{16}$/.test(manifest.credentialFingerprint) ||
@@ -781,7 +781,7 @@ function successReceipt({
     subject: `agent-profile:${observed.profileId}`,
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.357",
+      installVersion: "0.1.358",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },
@@ -821,7 +821,7 @@ function failure(code, stages, extra = {}, request = null) {
     subject: safeIdentity ? `agent-profile:${safeIdentity}` : "agent-profile:unbound",
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.357",
+      installVersion: "0.1.358",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },

package/lib/sellable-agent/runtime-helper.mjs

@@ -23,6 +23,7 @@ export const EXTERNAL_HERMES_ENTRYPOINT = `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/herm
 const EXTERNAL_RUNTIME_MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
 const ACTIONS = new Set([
   "INSTALL_MCP_CREDENTIAL",
+  "INSTALL_PROVIDER_CREDENTIAL",
   "INSTALL_RUNTIME_SERVICE_ENV",
   "SET_RUNTIME_GATES",
   "OBSERVE_RUNTIME_GATES",
@@ -50,6 +51,7 @@ const PROFILE_ENTRIES = Object.freeze([
 ]);
 const ACTION_KEYS = Object.freeze({
   INSTALL_MCP_CREDENTIAL: ["action", "profileId", "operationId", "fence", "sourceRequestFile", "generation", "fingerprint"],
+  INSTALL_PROVIDER_CREDENTIAL: ["action", "profileId", "operationId", "fence", "fingerprint"],
   INSTALL_RUNTIME_SERVICE_ENV: ["action", "profileId", "operationId", "fence", "revisionId", "profileDigest"],
   SET_RUNTIME_GATES: ["action", "profileId", "operationId", "fence", "lifecycle"],
   OBSERVE_RUNTIME_GATES: ["action", "profileId", "operationId", "fence", "lifecycle"],
@@ -109,6 +111,79 @@ function atomicCredential(pathValue, secret, uid, gid) {
   fsyncDirectory(dirname(pathValue));
 }
 
+function providerCredentialPath(profile, profileId) {
+  const runtimeStateRoot = safeRuntimeStateRoot(profile);
+  const profilesRoot = join(runtimeStateRoot, "profiles");
+  const profileRoot = join(profilesRoot, profileId);
+  const runtimeHome = join(profileRoot, "home");
+  for (const pathValue of [profilesRoot, profileRoot, runtimeHome]) {
+    const link = lstatSync(pathValue);
+    if (
+      link.isSymbolicLink() || !link.isDirectory() || (link.mode & 0o777) !== 0o700 ||
+      link.uid !== profile.runtimeUid || link.gid !== profile.runtimeGid
+    ) throw new Error("provider runtime home rejected");
+  }
+  const codexRoot = join(runtimeHome, ".codex");
+  if (!existsSync(codexRoot)) {
+    mkdirSync(codexRoot, { mode: 0o700 });
+    chownSync(codexRoot, profile.runtimeUid, profile.runtimeGid);
+  }
+  const codex = lstatSync(codexRoot);
+  if (
+    codex.isSymbolicLink() || !codex.isDirectory() || (codex.mode & 0o777) !== 0o700 ||
+    codex.uid !== profile.runtimeUid || codex.gid !== profile.runtimeGid
+  ) throw new Error("provider credential root rejected");
+  return join(codexRoot, "auth.json");
+}
+
+function installProviderCredential(profile, request, config) {
+  if (
+    !SHA256.test(request.fingerprint ?? "") ||
+    request.fingerprint !== profile.providerCredentialFingerprint ||
+    (
+      profile.providerCredentialSourcePath !== "/var/lib/sellable-agent-bootstrap/provider-auth" &&
+      config.disposableFixture !== true
+    )
+  ) throw new Error("provider credential identity rejected");
+  const sourceRoot = privateRoot(dirname(profile.providerCredentialSourcePath));
+  const source = readPrivateDirectFile(sourceRoot, profile.providerCredentialSourcePath).trim();
+  if (!source || source.length > 1024 * 1024 || sha256(source) !== request.fingerprint) {
+    throw new Error("provider credential source rejected");
+  }
+  const parsed = JSON.parse(source);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("provider credential JSON rejected");
+  }
+  const target = providerCredentialPath(profile, request.profileId);
+  atomicCredential(target, source, profile.runtimeUid, profile.runtimeGid);
+  return {
+    ok: true,
+    profileId: request.profileId,
+    fingerprint: request.fingerprint,
+    path: target,
+  };
+}
+
+function removeProviderCredential(profile, profileId) {
+  const target = providerCredentialPath(profile, profileId);
+  if (existsSync(target)) {
+    const link = lstatSync(target);
+    if (link.isSymbolicLink() || !link.isFile()) throw new Error("provider credential cleanup rejected");
+    rmSync(target, { force: true });
+    fsyncDirectory(dirname(target));
+  }
+}
+
+function observeProviderCredential(profile, profileId) {
+  const target = providerCredentialPath(profile, profileId);
+  const link = lstatSync(target);
+  if (
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 ||
+    link.uid !== profile.runtimeUid || link.gid !== profile.runtimeGid
+  ) throw new Error("provider credential readback rejected");
+  return sha256(readFileSync(target, "utf8").trim());
+}
+
 function applyRuntimeOwnership(pathValue, uid, gid) {
   const link = lstatSync(pathValue);
   if (link.isSymbolicLink()) throw new Error("profile symlink rejected");
@@ -509,7 +584,9 @@ function walkExternalRoot(root, ownerUid, ownerGid) {
     }
   };
   visit(root, "");
-  return { directories: directories.sort((left, right) => left.path.localeCompare(right.path)), files };
+  const byPath = (left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+  const byLogicalPath = (left, right) => left.logicalPath < right.logicalPath ? -1 : left.logicalPath > right.logicalPath ? 1 : 0;
+  return { directories: directories.sort(byPath), files: files.sort(byLogicalPath) };
 }
 
 export function observeExternalRuntimeClosure(input = {}) {
@@ -569,18 +646,24 @@ export function observeExternalRuntimeClosure(input = {}) {
     if (
       JSON.stringify(rootRecord.directories.map((directory) => directory?.path)) !==
         JSON.stringify(rootRecord.directories.map((directory) => directory?.path).sort()) ||
-      new Set(rootRecord.directories.map((directory) => directory?.path)).size !== rootRecord.directories.length ||
+      new Set(rootRecord.directories.map((directory) => directory?.path)).size !== rootRecord.directories.length
+    ) throw new Error("external runtime directory order rejected");
+    if (
       rootRecord.directories.some((directory) =>
         !exactKeys(directory, ["path", "mode"]) ||
-        !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(directory.path ?? "") ||
+        !/^[-A-Za-z0-9@._+]+(?:\/[-A-Za-z0-9@._+]+)*$/.test(directory.path ?? "") ||
         directory.mode !== 0o555
-      ) ||
-      JSON.stringify(walked.directories) !== JSON.stringify(rootRecord.directories) ||
+      )
+    ) throw new Error("external runtime directory schema rejected");
+    if (JSON.stringify(walked.directories) !== JSON.stringify(rootRecord.directories)) {
+      throw new Error("external runtime directory inventory rejected");
+    }
+    if (
       rootRecord.files.length === 0 ||
       JSON.stringify(rootRecord.files.map((file) => file?.path)) !==
         JSON.stringify(rootRecord.files.map((file) => file?.path).sort()) ||
       new Set(rootRecord.files.map((file) => file?.path)).size !== rootRecord.files.length
-    ) throw new Error("external runtime inventory rejected");
+    ) throw new Error("external runtime file order rejected");
     const actualPaths = walked.files.map((file) => file.logicalPath);
     if (JSON.stringify(actualPaths) !== JSON.stringify(rootRecord.files.map((file) => file.path))) {
       throw new Error("external runtime open inventory rejected");
@@ -588,7 +671,7 @@ export function observeExternalRuntimeClosure(input = {}) {
     const observedFiles = rootRecord.files.map((file, index) => {
       if (
         !exactKeys(file, ["path", "mode", "digest"]) ||
-        !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(file.path ?? "") ||
+        !/^[-A-Za-z0-9@._+]+(?:\/[-A-Za-z0-9@._+]+)*$/.test(file.path ?? "") ||
         ![0o444, 0o555].includes(file.mode) || !SHA256.test(file.digest ?? "")
       ) throw new Error("external runtime file schema rejected");
       const actual = walked.files[index];
@@ -958,9 +1041,19 @@ async function observeRuntime(profile, request) {
   const profileFiles = observeRuntimeProfileFiles(target);
   const { runtimeConfig, runtimeMcp, tools, fileHashes: actualFileHashes } = profileFiles;
   const actualProfileDigest = profileFiles.profileDigest;
-  const observedProvider = environmentDrift
-    ? sha256(`environment-drift\0${runtimeConfig?.provider?.fingerprint ?? "absent"}`)
-    : runtimeConfig?.provider?.fingerprint;
+  let observedProvider;
+  try {
+    observedProvider = observeProviderCredential(profile, request.profileId);
+    if (observedProvider !== runtimeConfig?.provider?.fingerprint) {
+      throw new Error("provider credential fingerprint rejected");
+    }
+  } catch (error) {
+    if (!driftMode) throw error;
+    observedProvider = sha256(`provider-drift\0${runtimeConfig?.provider?.fingerprint ?? "absent"}`);
+  }
+  if (environmentDrift) {
+    observedProvider = sha256(`environment-drift\0${observedProvider}`);
+  }
   return {
     profileId: manifest.profileId,
     workspaceId: manifest.workspaceId,
@@ -1172,6 +1265,9 @@ export async function runRuntimeHelperRequest({ requestPath, config }) {
         generation: request.generation,
       };
     }
+    if (request.action === "INSTALL_PROVIDER_CREDENTIAL") {
+      return installProviderCredential(profile, request, config);
+    }
     if (request.action === "INSTALL_RUNTIME_SERVICE_ENV") {
       return installRuntimeServiceEnvironment(profile, request);
     }
@@ -1187,6 +1283,7 @@ export async function runRuntimeHelperRequest({ requestPath, config }) {
         rmSync(target, { recursive: true, force: true });
         fsyncDirectory(root);
       }
+      removeProviderCredential(profile, request.profileId);
       return { ok: true, profileId: request.profileId, disposition: "REMOVED" };
     }
     if (request.action === "CHOWN_PROFILE") {

package/lib/sellable-agent/service-installer.mjs

@@ -247,6 +247,8 @@ function validateInstallInput(input) {
     profile.hermesSourceRoot !== `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes` ||
     profile.proxyConfigPath !== "/etc/sellable-agent/egress-proxy.json" ||
     profile.runtimeBoundaryConfigPath !== "/etc/sellable-agent/runtime-boundary.json" ||
+    profile.providerCredentialSourcePath !== "/var/lib/sellable-agent-bootstrap/provider-auth" ||
+    !SHA256.test(profile.providerCredentialFingerprint ?? "") ||
     profile.runtimeServicePath !== "/etc/services.d/sellable-agent-runtime" ||
     profile.runtimeServiceEnvRoot !== "/etc/services.d/sellable-agent-runtime/env" ||
     new Set([profile.runtimeUid, profile.proxyUid, profile.workerUid]).size !== 3

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.357",
+  "version": "0.1.358",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {
     "sellable": "bin/sellable-install.mjs",
+    "sellable-agent-host-bootstrap": "bin/sellable-agent-host-bootstrap.mjs",
     "sellable-agent-egress-proxy": "bin/sellable-agent-egress-proxy.mjs",
     "sellable-agent-host-worker": "bin/sellable-agent-host-worker.mjs",
     "sellable-agent-runtime-helper": "bin/sellable-agent-runtime-helper.mjs",
@@ -20,6 +21,7 @@
     "bin",
     "lib",
     "services",
+    "container",
     "agents",
     "skill-templates",
     "README.md",