@sellable/install 0.1.358 → 0.1.359-phase111.20260720052618

package/container/Dockerfile

@@ -1,37 +0,0 @@
-ARG HERMES_IMAGE=ghcr.io/hostinger/hvps-hermes-agent@sha256:f048663be9ba564de795df5f2a8184f32b92561a1f053c179dca3b45fa5bc8b9
-FROM ${HERMES_IMAGE}
-
-USER root
-
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.358
-ARG MCP_PACKAGE=@sellable/mcp@0.1.619
-ARG INSTALLER_INTEGRITY
-ARG MCP_INTEGRITY=sha512-ZepZ/YDN09SEyBNKfNEHz751z8s4VQZhvWFUnJmw0mc46YUN2OcJ7s3uN90v4ykNTSnlBrUzUCjhlY3B869aEQ==
-
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.358" \
-    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.619" \
-    && test -n "${INSTALLER_INTEGRITY}" \
-    && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
-    && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
-    && apt-get update \
-    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-      bubblewrap \
-      ca-certificates \
-      nftables \
-      sudo \
-    && rm -rf /var/lib/apt/lists/* \
-    && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
-    && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
-    && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.358' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.619') throw new Error('package identity rejected');" \
-    && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.358', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.619', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
-    && npm cache clean --force
-
-COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
-RUN chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint
-
-HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
-  CMD /command/s6-svstat /etc/services.d/sellable-agent-host-worker | grep -q '^up' || exit 1
-
-ENTRYPOINT ["/usr/local/bin/sellable-agent-container-entrypoint"]

package/container/README.md

@@ -1,15 +0,0 @@
-# Sellable Agent host container
-
-This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
-
-Build from this directory after `@sellable/install@0.1.358` is published:
-
-```sh
-docker build --platform linux/amd64 \
-  --build-arg INSTALLER_INTEGRITY='sha512-…' \
-  --tag sellable-agent-host:0.1.358 .
-```
-
-Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.
-
-Set `SELLABLE_AGENT_IMAGE` to the exact built image digest and start `compose.yaml`. The container bootstraps idempotently, writes `bootstrap/registration-receipt.json`, and starts the worker and isolated runtime under s6. Do not mount a Docker socket.

package/container/compose.yaml

@@ -1,22 +0,0 @@
-services:
-  sellable-agent-host:
-    image: ${SELLABLE_AGENT_IMAGE:?set exact Sellable Agent image}
-    container_name: ${SELLABLE_AGENT_CONTAINER_NAME:-sellable-agent-host-11201}
-    hostname: ${SELLABLE_AGENT_HOSTNAME:-hermes-hostinger-1807396}
-    restart: unless-stopped
-    cap_add:
-      - NET_ADMIN
-      - SYS_ADMIN
-    cgroup: host
-    pid: host
-    volumes:
-      - ./bootstrap:/var/lib/sellable-agent-bootstrap:rw
-      - sellable-agent-worker:/var/lib/sellable-agent-worker
-      - sellable-agent-runtime:/var/lib/sellable-agent-runtime
-      - sellable-agent-profiles:/var/lib/sellable-agent-profiles
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-
-volumes:
-  sellable-agent-worker:
-  sellable-agent-runtime:
-  sellable-agent-profiles:

package/container/entrypoint.sh

@@ -1,13 +0,0 @@
-#!/bin/sh
-set -eu
-
-BOOTSTRAP_CONFIG=/var/lib/sellable-agent-bootstrap/bootstrap.json
-BOOTSTRAP_BIN=/opt/sellable-agent/install-root/node_modules/.bin/sellable-agent-host-bootstrap
-
-test "$(id -u)" = "0"
-test "$(id -g)" = "0"
-test -x "${BOOTSTRAP_BIN}"
-test -f "${BOOTSTRAP_CONFIG}"
-
-"${BOOTSTRAP_BIN}" --config "${BOOTSTRAP_CONFIG}"
-exec /command/s6-svscan /etc/services.d

package/lib/sellable-agent/containment-contract.mjs

@@ -1,472 +0,0 @@
-import {
-  chmodSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readFileSync,
-  realpathSync,
-  writeFileSync,
-} from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
-import { runBoundedChildProcess } from "./provisioning-adapter.mjs";
-
-const INPUT_KEYS = new Set([
-  "profileId",
-  "workerUid",
-  "runtimeUid",
-  "credentialReferences",
-  "oauthPrivateReference",
-]);
-const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
-const FINGERPRINT = /^[a-f0-9]{64}$/;
-const EXACT_EGRESS = [
-  "https://app.sellable.dev",
-  "https://slack.com",
-  "https://api.openai.com",
-];
-
-export const PINNED_CONTAINMENT_IMAGE =
-  "public.ecr.aws/supabase/postgres@sha256:af083ef64d0408c8f098ee6f5c364a59b26f36fbc0f3a334a62c5c1d57362e9b";
-
-const CONTAINER_CHECK_KEYS = [
-  "runtimeUid",
-  "profileRead",
-  "controlDenied",
-  "credentialDenied",
-  "oauthDenied",
-  "siblingDenied",
-  "hostDenied",
-  "dockerDenied",
-  "rootReadOnly",
-  "noNewPrivileges",
-  "capabilitiesDropped",
-  "networkDisabled",
-];
-
-function validPrivateReference(value, scheme) {
-  return (
-    value &&
-    typeof value === "object" &&
-    !Array.isArray(value) &&
-    Object.keys(value).every((key) =>
-      ["reference", "fingerprint", "purpose", "target", "owner"].includes(key)
-    ) &&
-    typeof value.reference === "string" &&
-    value.reference.startsWith(`${scheme}://`) &&
-    FINGERPRINT.test(value.fingerprint)
-  );
-}
-
-export function buildContainmentContract(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) {
-    return { ok: false, code: "invalid_input" };
-  }
-  if (Object.keys(input).some((key) => !INPUT_KEYS.has(key))) {
-    return { ok: false, code: "unknown_field" };
-  }
-  if (
-    !SAFE_ID.test(input.profileId) ||
-    !Number.isSafeInteger(input.workerUid) ||
-    input.workerUid < 1 ||
-    !Number.isSafeInteger(input.runtimeUid) ||
-    input.runtimeUid < 1 ||
-    input.workerUid === input.runtimeUid ||
-    !Array.isArray(input.credentialReferences) ||
-    !input.credentialReferences.every(
-      (reference) =>
-        validPrivateReference(reference, "secret") &&
-        ["service-credential", "worker-credential"].includes(reference.purpose)
-    ) ||
-    !validPrivateReference(input.oauthPrivateReference, "oauth-private")
-  ) {
-    return { ok: false, code: "invalid_input" };
-  }
-  const profileBase = `/var/lib/sellable-agents/${input.profileId}`;
-  const manifest = {
-    profileId: input.profileId,
-    readOnlyRootFilesystem: true,
-    noNewPrivileges: true,
-    dockerSocket: false,
-    capabilities: [],
-    worker: {
-      name: `sellable-worker-${input.profileId}`,
-      uid: input.workerUid,
-    },
-    runtime: {
-      name: `sellable-runtime-${input.profileId}`,
-      uid: input.runtimeUid,
-    },
-    mounts: [
-      {
-        profileId: input.profileId,
-        source: `${profileBase}/control`,
-        target: "/control",
-        readOnly: false,
-        owner: "worker",
-      },
-      {
-        profileId: input.profileId,
-        source: `${profileBase}/profile`,
-        target: "/profile",
-        readOnly: false,
-        owner: "runtime",
-      },
-    ],
-    credentials: input.credentialReferences.map((reference) => ({
-      purpose: reference.purpose,
-      reference: reference.reference,
-      fingerprint: reference.fingerprint,
-      target: `/run/credentials/${reference.purpose}`,
-      owner: "worker",
-    })),
-    oauthPrivateReference: {
-      reference: input.oauthPrivateReference.reference,
-      fingerprint: input.oauthPrivateReference.fingerprint,
-      owner: "worker",
-    },
-    oauth: {
-      privateExchangeOwner: "worker",
-      healthStatus: "NOT_PROBED",
-      auditStatus: "REQUIRED",
-      broaderRolloutBlocked: true,
-    },
-    authority: {
-      database: false,
-      migrations: false,
-      hostControl: false,
-    },
-    resources: { pids: 128, memoryMb: 1024, cpuQuota: 1 },
-    egress: [...EXACT_EGRESS],
-  };
-  const validated = validateContainmentContract(manifest);
-  return validated.ok ? { ok: true, manifest } : validated;
-}
-
-export function validateContainmentContract(manifest) {
-  if (
-    !manifest ||
-    typeof manifest !== "object" ||
-    !SAFE_ID.test(manifest.profileId)
-  ) {
-    return { ok: false, code: "invalid_manifest" };
-  }
-  if (
-    manifest.readOnlyRootFilesystem !== true ||
-    manifest.noNewPrivileges !== true ||
-    manifest.dockerSocket !== false ||
-    !Array.isArray(manifest.capabilities) ||
-    manifest.capabilities.length !== 0
-  ) {
-    return { ok: false, code: "privilege_boundary_failed" };
-  }
-  if (
-    !Number.isSafeInteger(manifest.worker?.uid) ||
-    manifest.worker.uid < 1 ||
-    !Number.isSafeInteger(manifest.runtime?.uid) ||
-    manifest.runtime.uid < 1 ||
-    manifest.worker.uid === manifest.runtime.uid
-  ) {
-    return { ok: false, code: "identity_boundary_failed" };
-  }
-  const profileBase = `/var/lib/sellable-agents/${manifest.profileId}/`;
-  if (
-    !Array.isArray(manifest.mounts) ||
-    manifest.mounts.length !== 2 ||
-    manifest.mounts.some(
-      (mount) =>
-        mount.profileId !== manifest.profileId ||
-        typeof mount.source !== "string" ||
-        !mount.source.startsWith(profileBase) ||
-        !["/control", "/profile"].includes(mount.target) ||
-        !["worker", "runtime"].includes(mount.owner) ||
-        mount.source.includes("docker.sock")
-    ) ||
-    manifest.mounts.find((mount) => mount.target === "/control")?.owner !==
-      "worker" ||
-    manifest.mounts.find((mount) => mount.target === "/profile")?.owner !==
-      "runtime"
-  ) {
-    return { ok: false, code: "mount_boundary_failed" };
-  }
-  if (
-    !Array.isArray(manifest.credentials) ||
-    !manifest.credentials.every(
-      (reference) =>
-        validPrivateReference(reference, "secret") &&
-        typeof reference.target === "string" &&
-        reference.target.startsWith("/run/credentials/") &&
-        reference.owner === "worker"
-    ) ||
-    !validPrivateReference(manifest.oauthPrivateReference, "oauth-private") ||
-    manifest.oauthPrivateReference.owner !== "worker"
-  ) {
-    return { ok: false, code: "secret_boundary_failed" };
-  }
-  if (
-    manifest.oauth?.privateExchangeOwner !== "worker" ||
-    manifest.oauth?.healthStatus !== "NOT_PROBED" ||
-    manifest.oauth?.auditStatus !== "REQUIRED" ||
-    manifest.oauth?.broaderRolloutBlocked !== true
-  ) {
-    return { ok: false, code: "oauth_readiness_boundary_failed" };
-  }
-  if (
-    manifest.authority?.database !== false ||
-    manifest.authority?.migrations !== false ||
-    manifest.authority?.hostControl !== false
-  ) {
-    return { ok: false, code: "authority_boundary_failed" };
-  }
-  if (
-    manifest.resources?.pids !== 128 ||
-    manifest.resources?.memoryMb !== 1024 ||
-    manifest.resources?.cpuQuota !== 1 ||
-    JSON.stringify(manifest.egress) !== JSON.stringify(EXACT_EGRESS)
-  ) {
-    return { ok: false, code: "resource_or_egress_boundary_failed" };
-  }
-  if (
-    /xox[bap]-|authorizationCode|authorization_code|accessToken|refreshToken/.test(
-      JSON.stringify(manifest)
-    )
-  ) {
-    return { ok: false, code: "raw_secret_material" };
-  }
-  return { ok: true, code: "contained" };
-}
-
-export function isContainmentEgressAllowed(manifest, value) {
-  if (!validateContainmentContract(manifest).ok) return false;
-  try {
-    const url = new URL(value);
-    if (url.protocol !== "https:" || url.username || url.password) return false;
-    return manifest.egress.includes(url.origin);
-  } catch {
-    return false;
-  }
-}
-
-function containedRelative(root, target) {
-  const rel = relative(root, target);
-  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
-}
-
-export function materializeContainmentProfile(manifest, { root }) {
-  if (!validateContainmentContract(manifest).ok) {
-    return { ok: false, code: "invalid_manifest" };
-  }
-  try {
-    if (!isAbsolute(root) || !existsSync(root) || lstatSync(root).isSymbolicLink()) {
-      return { ok: false, code: "invalid_root" };
-    }
-    const realRoot = realpathSync(root);
-    const profileRoot = join(realRoot, manifest.profileId);
-    if (!containedRelative(realRoot, profileRoot)) {
-      return { ok: false, code: "path_confinement_failed" };
-    }
-    mkdirSync(join(profileRoot, "control"), { recursive: true, mode: 0o700 });
-    mkdirSync(join(profileRoot, "profile"), { recursive: true, mode: 0o750 });
-    mkdirSync(join(profileRoot, "credentials"), { recursive: true, mode: 0o700 });
-    writeFileSync(join(profileRoot, "profile", "probe.txt"), "sellable-agent-contained\n", {
-      mode: 0o444,
-    });
-    chmodSync(join(profileRoot, "profile", "probe.txt"), 0o444);
-    writeFileSync(
-      join(profileRoot, "containment.json"),
-      `${JSON.stringify(manifest, null, 2)}\n`,
-      { mode: 0o600 }
-    );
-    return { ok: true, profileRoot };
-  } catch {
-    return { ok: false, code: "materialization_failed" };
-  }
-}
-
-export function buildContainerContainmentProbeSpec(
-  manifest,
-  { root, runtimeUid, runtimeGid }
-) {
-  const validation = validateContainmentContract(manifest);
-  if (!validation.ok) return { ok: false, code: validation.code };
-  try {
-    if (
-      !Number.isSafeInteger(runtimeUid) ||
-      runtimeUid < 1 ||
-      !Number.isSafeInteger(runtimeGid) ||
-      runtimeGid < 1 ||
-      !isAbsolute(root) ||
-      String(root).includes(",") ||
-      String(root).includes("\n")
-    ) {
-      return { ok: false, code: "invalid_probe_runtime" };
-    }
-    const realRoot = realpathSync(root);
-    const materializedRoot = realpathSync(join(realRoot, manifest.profileId));
-    const profileData = realpathSync(join(materializedRoot, "profile"));
-    if (
-      !containedRelative(realRoot, materializedRoot) ||
-      !containedRelative(materializedRoot, profileData) ||
-      lstatSync(profileData).isSymbolicLink() ||
-      readFileSync(join(profileData, "probe.txt"), "utf8") !==
-        "sellable-agent-contained\n"
-    ) {
-      return { ok: false, code: "invalid_materialized_profile" };
-    }
-    const script = [
-      `test "$(id -u)" = "${runtimeUid}"`,
-      'test "$(cat /profile/probe.txt)" = "sellable-agent-contained"',
-      'test ! -r /control/probe.txt',
-      'test ! -r /run/credentials/service-credential',
-      'test ! -r /run/credentials/oauth-private',
-      'test ! -r /siblings/profile-2/probe.txt',
-      'test ! -r /host/probe.txt',
-      'test ! -S /var/run/docker.sock',
-      'if touch /sellable-root-write-probe 2>/dev/null; then exit 31; fi',
-      "grep -Eq '^NoNewPrivs:[[:space:]]+1$' /proc/self/status",
-      "grep -Eq '^CapEff:[[:space:]]+0+$' /proc/self/status",
-      "test ! -e /sys/class/net/eth0",
-      `printf '%s\\n' '${JSON.stringify({
-        ok: true,
-        checks: Object.fromEntries(CONTAINER_CHECK_KEYS.map((key) => [key, true])),
-      })}'`,
-    ].join("\n");
-    const args = [
-      "run",
-      "--rm",
-      "--label",
-      "sellable.containment.probe=1",
-      "--pull",
-      "never",
-      "--network",
-      "none",
-      "--read-only",
-      "--cap-drop",
-      "ALL",
-      "--security-opt",
-      "no-new-privileges",
-      "--pids-limit",
-      "128",
-      "--memory",
-      "1024m",
-      "--cpus",
-      "1",
-      "--user",
-      `${runtimeUid}:${runtimeGid}`,
-      "--tmpfs",
-      "/tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777",
-      "--mount",
-      `type=bind,src=${profileData},dst=/profile,readonly`,
-      PINNED_CONTAINMENT_IMAGE,
-      "sh",
-      "-ceu",
-      script,
-    ];
-    return {
-      ok: true,
-      command: "docker",
-      image: PINNED_CONTAINMENT_IMAGE,
-      args,
-      shell: false,
-      timeoutMs: 30_000,
-      maxOutputBytes: 8 * 1024,
-    };
-  } catch {
-    return { ok: false, code: "invalid_materialized_profile" };
-  }
-}
-
-export async function runContainerContainmentProbe(manifest, runtime) {
-  const spec = buildContainerContainmentProbeSpec(manifest, runtime);
-  if (!spec.ok) return { ...spec, checks: {} };
-  const output = await runBoundedChildProcess(spec);
-  if (
-    output.exitCode !== 0 ||
-    output.timedOut ||
-    output.outputLimitExceeded ||
-    output.terminated
-  ) {
-    return { ok: false, code: "container_probe_failed", checks: {} };
-  }
-  try {
-    const parsed = JSON.parse(output.stdout);
-    if (
-      !parsed ||
-      parsed.ok !== true ||
-      Object.keys(parsed).sort().join("\0") !== ["checks", "ok"].sort().join("\0") ||
-      Object.keys(parsed.checks).sort().join("\0") !==
-        [...CONTAINER_CHECK_KEYS].sort().join("\0") ||
-      CONTAINER_CHECK_KEYS.some((key) => parsed.checks[key] !== true)
-    ) {
-      throw new Error("invalid probe result");
-    }
-    return { ok: true, code: "contained", checks: parsed.checks };
-  } catch {
-    return { ok: false, code: "container_probe_failed", checks: {} };
-  }
-}
-
-function identityCanAccess(manifest, identity, target) {
-  if (identity !== "worker" && identity !== "runtime") return false;
-  if (target === "/") return false;
-  if (target === "/var/run/docker.sock") return false;
-  if (target.startsWith("/run/credentials/")) return identity === "worker";
-  const mount = manifest.mounts.find(
-    (candidate) => target === candidate.target || target.startsWith(`${candidate.target}/`)
-  );
-  return Boolean(mount && mount.owner === identity);
-}
-
-export function probeContainmentProfile(manifest, { root }) {
-  const validation = validateContainmentContract(manifest);
-  if (!validation.ok) return { ok: false, code: validation.code, checks: {} };
-  try {
-    const realRoot = realpathSync(root);
-    const profileRoot = realpathSync(join(realRoot, manifest.profileId));
-    const materializedManifest = JSON.parse(
-      readFileSync(join(profileRoot, "containment.json"), "utf8")
-    );
-    if (JSON.stringify(materializedManifest) !== JSON.stringify(manifest)) {
-      return { ok: false, code: "materialized_manifest_mismatch", checks: {} };
-    }
-    const checks = {
-      runtimeProfile: identityCanAccess(manifest, "runtime", "/profile"),
-      runtimeControlDenied: !identityCanAccess(manifest, "runtime", "/control"),
-      runtimeCredentialDenied: !identityCanAccess(
-        manifest,
-        "runtime",
-        "/run/credentials/service-credential"
-      ),
-      runtimeOauthDenied: !identityCanAccess(
-        manifest,
-        "runtime",
-        "/run/credentials/oauth-private"
-      ),
-      siblingDenied: !identityCanAccess(manifest, "runtime", "/siblings/profile-2"),
-      rootDenied: !identityCanAccess(manifest, "runtime", "/"),
-      dockerDenied: !identityCanAccess(manifest, "runtime", "/var/run/docker.sock"),
-      databaseDenied: manifest.authority.database === false,
-      migrationDenied: manifest.authority.migrations === false,
-      sellableAllowed: isContainmentEgressAllowed(
-        manifest,
-        "https://app.sellable.dev/api/v3/workspaces"
-      ),
-      slackAllowed: isContainmentEgressAllowed(
-        manifest,
-        "https://slack.com/api/auth.test"
-      ),
-      modelAllowed: isContainmentEgressAllowed(
-        manifest,
-        "https://api.openai.com/v1/responses"
-      ),
-      extraEndpointDenied: !isContainmentEgressAllowed(
-        manifest,
-        "https://evil.example/collect"
-      ),
-    };
-    return Object.values(checks).every(Boolean)
-      ? { ok: true, code: "contained", checks }
-      : { ok: false, code: "probe_failed", checks };
-  } catch {
-    return { ok: false, code: "probe_failed", checks: {} };
-  }
-}