@sellable/install 0.1.359-phase111.20260720052618 → 0.1.359

package/lib/sellable-agent/service-installer.mjs

@@ -0,0 +1,441 @@
+import { createHash, randomUUID } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import {
+  chmodSync, chownSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync,
+  openSync, readFileSync, realpathSync, renameSync, writeFileSync,
+} from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { validateRuntimeEgressProxyConfig } from "./runtime-egress-proxy.mjs";
+import {
+  EXTERNAL_HERMES_ENTRYPOINT,
+  EXTERNAL_MCP_ENTRYPOINT,
+  EXTERNAL_RUNTIME_CLOSURE_ROOT,
+  EXTERNAL_RUNTIME_MANIFEST_PATH,
+  observeExternalRuntimeClosure,
+} from "./runtime-helper.mjs";
+
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+const IMMUTABLE_PACKAGE_ROOT = "/usr/local/lib/sellable-agent/package";
+const IMMUTABLE_MANIFEST_PATH = `${IMMUTABLE_PACKAGE_ROOT}/manifest.json`;
+const IMMUTABLE_MANIFEST_VERSION = "sellable-agent-installed-closure/v1";
+const AGENT_BIN_FILES = Object.freeze([
+  "sellable-agent-egress-proxy.mjs",
+  "sellable-agent-host-worker.mjs",
+  "sellable-agent-runtime-helper.mjs",
+  "sellable-agent-runtime-launcher.mjs",
+  "sellable-agent-runtime-probe.mjs",
+  "sellable-agent-sandbox-init.mjs",
+]);
+const AGENT_LIB_FILES = Object.freeze([
+  "containment-contract.mjs",
+  "hermes-bridge.mjs",
+  "host-worker.mjs",
+  "profile-materializer.mjs",
+  "provisioning-adapter.mjs",
+  "runtime-boundary.mjs",
+  "runtime-egress-proxy.mjs",
+  "runtime-helper.mjs",
+  "runtime-reconciler.mjs",
+  "service-installer.mjs",
+]);
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const SHA256 = /^[a-f0-9]{64}$/;
+const SECRET = /xox[bap]-|sat_[A-Za-z0-9_-]+|asec\.v1\.|access[_-]?token|refresh[_-]?token/i;
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function inside(root, target) {
+  const value = relative(root, target);
+  return value === "" || (!value.startsWith("..") && !isAbsolute(value));
+}
+
+function ensureTrustedParents(root, pathValue, uid, gid) {
+  const parent = dirname(pathValue);
+  if (!inside(root, parent)) throw new Error("service parent confinement failed");
+  const relativeParent = relative(root, parent);
+  let current = root;
+  for (const component of relativeParent.split(/[/\\]+/).filter(Boolean)) {
+    current = join(current, component);
+    if (!existsSync(current)) mkdirSync(current, { mode: 0o755 });
+    const link = lstatSync(current);
+    if (
+      link.isSymbolicLink() || !link.isDirectory() || link.uid !== uid || link.gid !== gid ||
+      (link.mode & 0o022) !== 0 || realpathSync(current) !== current
+    ) throw new Error("service parent rejected");
+  }
+  if (existsSync(pathValue) && lstatSync(pathValue).isSymbolicLink()) {
+    throw new Error("service target symlink rejected");
+  }
+}
+
+function atomicOwnedFile(root, pathValue, bytes, mode, uid, gid) {
+  ensureTrustedParents(root, pathValue, uid, gid);
+  const temp = join(dirname(pathValue), `.${randomUUID()}.tmp`);
+  writeFileSync(temp, bytes, { flag: "wx", mode });
+  chmodSync(temp, mode);
+  if (lstatSync(temp).uid !== uid || lstatSync(temp).gid !== gid) chownSync(temp, uid, gid);
+  const descriptor = openSync(temp, "r");
+  try { fsyncSync(descriptor); } finally { closeSync(descriptor); }
+  renameSync(temp, pathValue);
+  const parent = openSync(dirname(pathValue), "r");
+  try { fsyncSync(parent); } finally { closeSync(parent); }
+}
+
+function accountDatabaseState(targetRoot, expected, ownerUid, ownerGid) {
+  const passwdPath = target(targetRoot, "/etc/passwd");
+  const groupPath = target(targetRoot, "/etc/group");
+  const passwdInfo = lstatSync(passwdPath);
+  const groupInfo = lstatSync(groupPath);
+  if (
+    passwdInfo.isSymbolicLink() || !passwdInfo.isFile() || (passwdInfo.mode & 0o022) !== 0 ||
+    passwdInfo.uid !== ownerUid || passwdInfo.gid !== ownerGid ||
+    groupInfo.isSymbolicLink() || !groupInfo.isFile() || (groupInfo.mode & 0o022) !== 0 ||
+    groupInfo.uid !== ownerUid || groupInfo.gid !== ownerGid
+  ) throw new Error("service account database rejected");
+  const passwd = readFileSync(passwdPath, "utf8").split(/\r?\n/).filter(Boolean).map((line) => line.split(":"));
+  const groups = readFileSync(groupPath, "utf8").split(/\r?\n/).filter(Boolean).map((line) => line.split(":"));
+  const state = expected.map((account) => {
+    const users = passwd.filter((fields) => fields[0] === account.name);
+    const groupRows = groups.filter((fields) => fields[0] === account.name);
+    const uidRows = passwd.filter((fields) => Number(fields[2]) === account.uid);
+    const gidRows = groups.filter((fields) => Number(fields[2]) === account.gid);
+    const userPresent = users.length === 1 && users[0].length >= 7 &&
+      Number(users[0][2]) === account.uid && Number(users[0][3]) === account.gid &&
+      users[0][5] === account.home && users[0][6] === "/usr/sbin/nologin" &&
+      uidRows.length === 1 && uidRows[0] === users[0];
+    const groupPresent = groupRows.length === 1 && groupRows[0].length >= 4 &&
+      Number(groupRows[0][2]) === account.gid && gidRows.length === 1 && gidRows[0] === groupRows[0];
+    if ((!userPresent && (users.length > 0 || uidRows.length > 0)) ||
+        (!groupPresent && (groupRows.length > 0 || gidRows.length > 0))) {
+      throw new Error("service account identity collision");
+    }
+    return { ...account, userPresent, groupPresent };
+  });
+  return state;
+}
+
+function readAccountDatabase(targetRoot, expected, ownerUid, ownerGid) {
+  const state = accountDatabaseState(targetRoot, expected, ownerUid, ownerGid);
+  if (state.some((account) => !account.userPresent || !account.groupPresent)) {
+    throw new Error("service account identity rejected");
+  }
+  return state.map(({ name, uid, gid }) => ({ name, uid, gid }));
+}
+
+function runAccountCommand(command, args) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error || result.status !== 0 || result.signal || result.stderr?.trim()) {
+    throw new Error("service account provisioning failed");
+  }
+}
+
+export function buildServiceAccountProvisioningCommands(accounts) {
+  if (!Array.isArray(accounts) || accounts.some((account) =>
+    !SAFE_ID.test(account?.name ?? "") || !Number.isSafeInteger(account?.uid) || account.uid < 1 ||
+    !Number.isSafeInteger(account?.gid) || account.gid < 1 ||
+    !["/var/lib/sellable-agent-worker", "/var/lib/sellable-agent-runtime", "/var/empty"].includes(account?.home) ||
+    typeof account.createUser !== "boolean" || typeof account.createGroup !== "boolean"
+  )) throw new Error("service account command input rejected");
+  return [
+    ...accounts.filter((account) => account.createGroup).map((account) => ({
+      command: "/usr/sbin/groupadd",
+      args: ["--gid", String(account.gid), account.name],
+    })),
+    ...accounts.filter((account) => account.createUser).map((account) => ({
+      command: "/usr/sbin/useradd",
+      args: [
+        "--uid", String(account.uid), "--gid", account.name,
+        "--home-dir", account.home, "--shell", "/usr/sbin/nologin", "--no-create-home", account.name,
+      ],
+    })),
+  ];
+}
+
+function provisionServiceAccounts(input, checked) {
+  const initial = accountDatabaseState(
+    checked.targetRoot, checked.expectedAccounts, checked.uid, checked.gid,
+  );
+  const missing = initial.filter((account) => !account.userPresent || !account.groupPresent);
+  if (missing.length === 0) {
+    return readAccountDatabase(checked.targetRoot, checked.expectedAccounts, checked.uid, checked.gid);
+  }
+  if (checked.targetRoot !== "/") {
+    if (input.disposableFixture !== true || typeof input.accountProvisioner !== "function") {
+      throw new Error("fixture service account provisioner missing");
+    }
+    input.accountProvisioner({
+      targetRoot: checked.targetRoot,
+      accounts: missing.map(({ name, uid, gid, userPresent, groupPresent, home }) => ({
+        name, uid, gid, home, createUser: !userPresent, createGroup: !groupPresent,
+      })),
+    });
+  } else {
+    const commands = buildServiceAccountProvisioningCommands(missing.map((account) => ({
+      name: account.name,
+      uid: account.uid,
+      gid: account.gid,
+      home: account.home,
+      createUser: !account.userPresent,
+      createGroup: !account.groupPresent,
+    })));
+    for (const command of commands) {
+      runAccountCommand(command.command, command.args);
+    }
+  }
+  return readAccountDatabase(checked.targetRoot, checked.expectedAccounts, checked.uid, checked.gid);
+}
+
+function validateInstallInput(input) {
+  const targetRoot = resolve(input.targetRoot ?? "/");
+  if (!isAbsolute(targetRoot) || !existsSync(targetRoot) || lstatSync(targetRoot).isSymbolicLink()) {
+    throw new Error("service install root rejected");
+  }
+  if (targetRoot !== "/" && input.disposableFixture !== true) throw new Error("non-host install root rejected");
+  const packageRoot = realpathSync(input.packageRoot ?? PACKAGE_ROOT);
+  if (
+    packageRoot !== realpathSync(PACKAGE_ROOT) &&
+    !(input.disposableFixture === true && targetRoot !== "/")
+  ) throw new Error("service package root pin rejected");
+  const uid = input.ownerUid ?? process.getuid?.();
+  const gid = input.ownerGid ?? process.getgid?.();
+  if (!Number.isSafeInteger(uid) || uid < 0 || !Number.isSafeInteger(gid) || gid < 0) {
+    throw new Error("service install owner rejected");
+  }
+  if (targetRoot === "/" && (uid !== 0 || gid !== 0 || process.getuid?.() !== 0)) {
+    throw new Error("live service install requires root");
+  }
+  const targetRootInfo = lstatSync(targetRoot);
+  if (
+    !targetRootInfo.isDirectory() || targetRootInfo.uid !== uid || targetRootInfo.gid !== gid ||
+    (targetRootInfo.mode & 0o022) !== 0
+  ) throw new Error("service install root ownership rejected");
+  const proxy = validateRuntimeEgressProxyConfig(input.egressProxyConfig);
+  if (!input.workerConfig || !input.helperConfig || !proxy.ok || SECRET.test(JSON.stringify({
+    workerConfig: input.workerConfig,
+    helperConfig: input.helperConfig,
+    egressProxyConfig: input.egressProxyConfig,
+  }))) throw new Error("service config rejected");
+  if (
+    !SAFE_ID.test(input.workerConfig.workerId ?? "") || !SAFE_ID.test(input.workerConfig.hostId ?? "") ||
+    !Number.isSafeInteger(input.workerConfig.workerUid) || input.workerConfig.workerUid < 1 ||
+    !Number.isSafeInteger(input.workerConfig.workerGid) || input.workerConfig.workerGid < 1
+  ) {
+    throw new Error("worker config identity rejected");
+  }
+  const profiles = Object.entries(input.helperConfig.profiles ?? {});
+  if (profiles.length !== 1 || profiles.some(([profileId, profile]) =>
+    !SAFE_ID.test(profileId) || !Number.isSafeInteger(profile.runtimeUid) || profile.runtimeUid < 1 ||
+    !Number.isSafeInteger(profile.runtimeGid) || profile.runtimeGid < 1 ||
+    profile.workerUid !== input.workerConfig.workerUid || profile.workerGid !== input.workerConfig.workerGid ||
+    profile.proxyUid !== proxy.config.uid || profile.proxyGid !== proxy.config.gid ||
+    profile.proxyExecutablePath !== "/usr/local/lib/sellable-agent/package/bin/sellable-agent-egress-proxy.mjs" ||
+    profile.installedPackageManifestPath !== IMMUTABLE_MANIFEST_PATH ||
+    profile.externalRuntimeManifestPath !== EXTERNAL_RUNTIME_MANIFEST_PATH ||
+    profile.externalRuntimeClosureRoot !== EXTERNAL_RUNTIME_CLOSURE_ROOT ||
+    profile.externalRuntimeTrustRoot !== dirname(EXTERNAL_RUNTIME_CLOSURE_ROOT) ||
+    profile.externalRuntimeOwnerUid !== uid || profile.externalRuntimeOwnerGid !== gid ||
+    profile.mcpCommand !== EXTERNAL_MCP_ENTRYPOINT ||
+    profile.hermesExecutablePath !== EXTERNAL_HERMES_ENTRYPOINT ||
+    profile.hermesSourceRoot !== `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes` ||
+    profile.proxyConfigPath !== "/etc/sellable-agent/egress-proxy.json" ||
+    profile.runtimeBoundaryConfigPath !== "/etc/sellable-agent/runtime-boundary.json" ||
+    profile.providerCredentialSourcePath !== "/var/lib/sellable-agent-bootstrap/provider-auth" ||
+    !SHA256.test(profile.providerCredentialFingerprint ?? "") ||
+    profile.runtimeServicePath !== "/etc/services.d/sellable-agent-runtime" ||
+    profile.runtimeServiceEnvRoot !== "/etc/services.d/sellable-agent-runtime/env" ||
+    new Set([profile.runtimeUid, profile.proxyUid, profile.workerUid]).size !== 3
+  )) throw new Error("helper profile map rejected");
+  const profile = profiles[0][1];
+  const externalRuntime = observeExternalRuntimeClosure({
+    manifestPath: profile.externalRuntimeManifestPath,
+    pathRoot: targetRoot,
+    trustRoot: profile.externalRuntimeTrustRoot,
+    expectedClosureRoot: profile.externalRuntimeClosureRoot,
+    ownerUid: uid,
+    ownerGid: gid,
+    expectedEntrypoints: { mcp: profile.mcpCommand, hermes: profile.hermesExecutablePath },
+  });
+  const expectedAccounts = [
+    {
+      name: "sellable-agent-worker", uid: input.workerConfig.workerUid,
+      gid: input.workerConfig.workerGid, home: "/var/lib/sellable-agent-worker",
+    },
+    {
+      name: "sellable-agent-runtime", uid: profile.runtimeUid,
+      gid: profile.runtimeGid, home: "/var/lib/sellable-agent-runtime",
+    },
+    {
+      name: "sellable-agent-egress-proxy", uid: proxy.config.uid,
+      gid: proxy.config.gid, home: "/var/empty",
+    },
+  ];
+  return {
+    targetRoot: realpathSync(targetRoot), packageRoot, uid, gid, proxyConfig: proxy.config,
+    expectedAccounts, externalRuntime,
+  };
+}
+
+function target(root, absolutePath) {
+  const value = join(root, absolutePath.replace(/^\/+/, ""));
+  if (!inside(root, value)) throw new Error("service target confinement failed");
+  return value;
+}
+
+function installedRuntimeLauncher(name) {
+  return `#!/bin/sh\nexec /usr/bin/node '${IMMUTABLE_PACKAGE_ROOT}/bin/${name}.mjs' "$@"\n`;
+}
+
+function configurationFiles(input, checked) {
+  const helperRequestRoot = input.workerConfig.helperRequestRoot;
+  if (!isAbsolute(helperRequestRoot) || /[\s,*?\[\]{}]/.test(helperRequestRoot)) {
+    throw new Error("helper request sudoers path rejected");
+  }
+  const sudoers = [
+    "Defaults:sellable-agent-worker !setenv,secure_path=/usr/local/bin:/usr/bin:/bin",
+    `sellable-agent-worker ALL=(root) NOPASSWD: /usr/local/bin/sellable-agent-runtime-helper --request ${helperRequestRoot}/*`,
+    "",
+  ].join("\n");
+  return [
+    ["/etc/sellable-agent/egress-proxy.json", `${JSON.stringify(checked.proxyConfig, null, 2)}\n`, 0o444],
+    ["/etc/sellable-agent/worker.json", `${JSON.stringify(input.workerConfig, null, 2)}\n`, 0o600],
+    ["/etc/sellable-agent/runtime-helper.json", `${JSON.stringify(input.helperConfig, null, 2)}\n`, 0o600],
+    ["/etc/sudoers.d/sellable-agent-runtime-helper", sudoers, 0o440],
+  ].map(([logicalPath, bytes, mode]) => ({ logicalPath, bytes, mode }));
+}
+
+function installationFiles(input, checked) {
+  return [
+    ...AGENT_BIN_FILES.map((name) => [
+      `${IMMUTABLE_PACKAGE_ROOT}/bin/${name}`, readFileSync(join(checked.packageRoot, "bin", name)), 0o555,
+    ]),
+    ...AGENT_LIB_FILES.map((name) => [
+      `${IMMUTABLE_PACKAGE_ROOT}/lib/sellable-agent/${name}`,
+      readFileSync(join(checked.packageRoot, "lib/sellable-agent", name)), 0o555,
+    ]),
+    [`${IMMUTABLE_PACKAGE_ROOT}/package.json`, readFileSync(join(checked.packageRoot, "package.json")), 0o444],
+    ["/usr/local/bin/sellable-agent-egress-proxy", installedRuntimeLauncher("sellable-agent-egress-proxy"), 0o555],
+    ["/usr/local/bin/sellable-agent-host-worker", installedRuntimeLauncher("sellable-agent-host-worker"), 0o555],
+    ["/usr/local/bin/sellable-agent-runtime-helper", installedRuntimeLauncher("sellable-agent-runtime-helper"), 0o555],
+    ["/usr/local/bin/sellable-agent-runtime-launcher", installedRuntimeLauncher("sellable-agent-runtime-launcher"), 0o555],
+    ["/usr/local/bin/sellable-agent-runtime-probe", installedRuntimeLauncher("sellable-agent-runtime-probe"), 0o555],
+    ["/usr/local/bin/sellable-agent-sandbox-init", installedRuntimeLauncher("sellable-agent-sandbox-init"), 0o555],
+    ...configurationFiles(input, checked).map((file) => [file.logicalPath, file.bytes, file.mode]),
+    ["/etc/services.d/sellable-agent-runtime/down", "", 0o444],
+    ["/etc/services.d/sellable-agent-egress-proxy/run", readFileSync(join(checked.packageRoot, "services/s6/sellable-agent-egress-proxy/run")), 0o555],
+    ["/etc/services.d/sellable-agent-runtime/run", readFileSync(join(checked.packageRoot, "services/s6/sellable-agent-runtime/run")), 0o555],
+    ["/etc/services.d/sellable-agent-host-worker/run", readFileSync(join(checked.packageRoot, "services/s6/sellable-agent-host-worker/run")), 0o555],
+  ].map(([logicalPath, bytes, mode]) => ({ logicalPath, bytes, mode }));
+}
+
+function manifestFile(files) {
+  const manifest = {
+    version: IMMUTABLE_MANIFEST_VERSION,
+    files: files.map((file) => ({
+      path: file.logicalPath,
+      mode: file.mode,
+      digest: sha256(Buffer.from(file.bytes)),
+    })),
+  };
+  return {
+    logicalPath: IMMUTABLE_MANIFEST_PATH,
+    bytes: `${JSON.stringify(manifest, null, 2)}\n`,
+    mode: 0o444,
+  };
+}
+
+function readInstalledManifest(checked) {
+  const pathValue = target(checked.targetRoot, IMMUTABLE_MANIFEST_PATH);
+  const link = lstatSync(pathValue);
+  const expectedPaths = [
+    ...AGENT_BIN_FILES.map((name) => `${IMMUTABLE_PACKAGE_ROOT}/bin/${name}`),
+    ...AGENT_LIB_FILES.map((name) => `${IMMUTABLE_PACKAGE_ROOT}/lib/sellable-agent/${name}`),
+    `${IMMUTABLE_PACKAGE_ROOT}/package.json`,
+    ...AGENT_BIN_FILES.map((name) => `/usr/local/bin/${name.replace(/\.mjs$/, "")}`),
+    "/etc/sellable-agent/egress-proxy.json",
+    "/etc/sellable-agent/worker.json",
+    "/etc/sellable-agent/runtime-helper.json",
+    "/etc/sudoers.d/sellable-agent-runtime-helper",
+    "/etc/services.d/sellable-agent-runtime/down",
+    "/etc/services.d/sellable-agent-egress-proxy/run",
+    "/etc/services.d/sellable-agent-runtime/run",
+    "/etc/services.d/sellable-agent-host-worker/run",
+  ].sort();
+  if (
+    link.isSymbolicLink() || !link.isFile() || link.uid !== checked.uid || link.gid !== checked.gid ||
+    (link.mode & 0o777) !== 0o444
+  ) throw new Error("installed manifest rejected");
+  const bytes = readFileSync(pathValue);
+  const parsed = JSON.parse(bytes.toString("utf8"));
+  if (
+    parsed?.version !== IMMUTABLE_MANIFEST_VERSION || !Array.isArray(parsed.files) ||
+    parsed.files.some((file) =>
+      typeof file?.path !== "string" || !file.path.startsWith("/") ||
+      !Number.isSafeInteger(file.mode) || !SHA256.test(file.digest ?? "")
+    ) || new Set(parsed.files.map((file) => file.path)).size !== parsed.files.length ||
+    JSON.stringify(parsed.files.map((file) => file.path).sort()) !== JSON.stringify(expectedPaths)
+  ) throw new Error("installed manifest schema rejected");
+  return { bytes, files: parsed.files };
+}
+
+export function observeAgentHostServices(input) {
+  try {
+    const checked = validateInstallInput(input);
+    const accounts = readAccountDatabase(
+      checked.targetRoot, checked.expectedAccounts, checked.uid, checked.gid,
+    );
+    const installedManifest = readInstalledManifest(checked);
+    const files = installedManifest.files.map((file) => {
+      const pathValue = target(checked.targetRoot, file.path);
+      const link = lstatSync(pathValue);
+      const bytes = readFileSync(pathValue);
+      if (
+        link.isSymbolicLink() || !link.isFile() || link.uid !== checked.uid || link.gid !== checked.gid ||
+        (link.mode & 0o777) !== file.mode || sha256(bytes) !== file.digest
+      ) throw new Error("installed service readback rejected");
+      return { path: file.path, mode: file.mode, uid: link.uid, gid: link.gid, digest: sha256(bytes) };
+    });
+    const configuration = configurationFiles(input, checked);
+    for (const file of configuration) {
+      const bytes = readFileSync(target(checked.targetRoot, file.logicalPath));
+      if (!bytes.equals(Buffer.from(file.bytes))) throw new Error("installed configuration drift rejected");
+    }
+    return {
+      ok: true,
+      producer: "sellable-agent-service-installer",
+      accounts,
+      manifestDigest: sha256(installedManifest.bytes),
+      externalRuntimeClosureDigest: checked.externalRuntime.closureDigest,
+      files: [
+        { path: IMMUTABLE_MANIFEST_PATH, mode: 0o444, uid: checked.uid, gid: checked.gid, digest: sha256(installedManifest.bytes) },
+        ...files,
+      ],
+    };
+  } catch {
+    return { ok: false, code: "service_readback_rejected" };
+  }
+}
+
+export function installAgentHostServices(input) {
+  try {
+    const checked = validateInstallInput(input);
+    provisionServiceAccounts(input, checked);
+    const files = installationFiles(input, checked);
+    for (const file of [...files, manifestFile(files)]) {
+      atomicOwnedFile(
+        checked.targetRoot, target(checked.targetRoot, file.logicalPath),
+        file.bytes, file.mode, checked.uid, checked.gid,
+      );
+    }
+    return observeAgentHostServices(input);
+  } catch {
+    return { ok: false, code: "service_install_rejected" };
+  }
+}

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.359-phase111.20260720052618",
+  "version": "0.1.359",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {
-    "sellable": "bin/sellable-install.mjs"
+    "sellable": "bin/sellable-install.mjs",
+    "sellable-agent-host-bootstrap": "bin/sellable-agent-host-bootstrap.mjs",
+    "sellable-agent-egress-proxy": "bin/sellable-agent-egress-proxy.mjs",
+    "sellable-agent-host-worker": "bin/sellable-agent-host-worker.mjs",
+    "sellable-agent-runtime-helper": "bin/sellable-agent-runtime-helper.mjs",
+    "sellable-agent-runtime-launcher": "bin/sellable-agent-runtime-launcher.mjs",
+    "sellable-agent-sandbox-init": "bin/sellable-agent-sandbox-init.mjs",
+    "sellable-agent-runtime-probe": "bin/sellable-agent-runtime-probe.mjs"
   },
   "scripts": {
     "sync-skills": "node scripts/sync-skill-templates.mjs",
@@ -13,6 +20,8 @@
   "files": [
     "bin",
     "lib",
+    "services",
+    "container",
     "agents",
     "skill-templates",
     "README.md",

package/services/s6/sellable-agent-egress-proxy/run

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -eu
+
+exec /usr/bin/setpriv \
+  --reuid sellable-agent-egress-proxy \
+  --regid sellable-agent-egress-proxy \
+  --clear-groups \
+  --no-new-privs \
+  --bounding-set=-all \
+  --inh-caps=-all \
+  --ambient-caps=-all \
+  /usr/bin/env -i \
+  PATH=/usr/local/bin:/usr/bin:/bin \
+  NODE_ENV=production \
+  /usr/bin/node /usr/local/lib/sellable-agent/package/bin/sellable-agent-egress-proxy.mjs

package/services/s6/sellable-agent-host-worker/run

@@ -0,0 +1,4 @@
+#!/command/execlineb -P
+with-contenv
+s6-setuidgid sellable-agent-worker
+/usr/bin/env -i PATH=/usr/local/bin:/usr/bin:/bin HOME=/var/lib/sellable-agent-worker NODE_ENV=production /usr/local/bin/sellable-agent-host-worker --config /etc/sellable-agent/worker.json

package/services/s6/sellable-agent-runtime/run

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -eu
+
+if [ "${SELLABLE_AGENT_RUNTIME_ENV_LOADED:-}" != "1" ]; then
+  exec /command/s6-envdir /etc/services.d/sellable-agent-runtime/env "$0"
+fi
+
+: "${SELLABLE_AGENT_PROFILE_ID:?profile id required}"
+: "${SELLABLE_AGENT_WORKER_SLACK_SECRET_ROOT:?worker Slack secret root required}"
+
+SELLABLE_AGENT_SLACK_SECRET_ROOT="${SELLABLE_AGENT_WORKER_SLACK_SECRET_ROOT}/${SELLABLE_AGENT_PROFILE_ID}"
+
+exec 8<"${SELLABLE_AGENT_SLACK_SECRET_ROOT}/slack-app"
+exec 9<"${SELLABLE_AGENT_SLACK_SECRET_ROOT}/slack-bot"
+
+exec /usr/bin/env -i \
+  PATH=/usr/local/bin:/usr/bin:/bin \
+  NODE_ENV=production \
+  /usr/local/bin/sellable-agent-runtime-launcher

package/skill-templates/refill-sends-evergreen.md

@@ -17,8 +17,3 @@ Use `refill-sends-v2` instead:
 ```text
 get_subskill_prompt({ subskillName: "refill-sends-v2" })
 ```
-
-The alias must not strip exact `targetConfig`, server `runHandle`,
-`reportingContext`, canonical `refill_reporting.v2`, or an explicit
-`messageTemplateRevision`. It never infers revision authority from
-`forceRerun`.

package/skill-templates/refill-sends-v2.md

@@ -52,24 +52,9 @@ refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 To resume an in-progress run, pass the handle back exactly:
 
 ```text
-refill_sends_v2({ workspaceId, runHandle:{runId,fence}, targetConfig, reportingContext, messageTemplateRevision? })
+refill_sends_v2({ workspaceId, runId, fence })
 ```
 
-`targetConfig` and the server-issued `runHandle` are separate authorities. Keep
-both byte-for-byte through every continuation and takeover; never fold the
-rotating fence into target configuration.
-
-An approved copy change is reachable only through an explicit
-`messageTemplateRevision` object with `version:1`, `source:"user_approved"`,
-the approved `templateMarkdown`, `messageTemplateRevision` identity,
-`priorTemplateAuthorityDigest`, `nextTemplateAuthorityDigest`, 1–500 exact
-`cohortRowIds`, and `requestId`, `effectId`, and `revisionOperationId`. Pass it
-with the exact `targetConfig` and `reportingContext`; the command obtains or
-resumes the server run handle and lets the planner name
-`revise_message_template_and_rerun`. Missing or partial input means no revision.
-`forceRerun:true` on a queue operation never authorizes or implies a template
-change.
-
 If a stale handle loses the lease, the tool reports the holder status and the
 approximately 10 minute lockout window. Reinvoke with the current handle or wait
 for lease expiry; never guess a fence.
@@ -100,8 +85,6 @@ The run may execute only packet-named bounded work:
   when the campaign is in the packet's pinned lane chain;
 - refresh paid InMail credit facts during bootstrap and once per scheduler-wait
   entry when the packet requires it.
-- apply `revise_message_template_and_rerun` only when the packet contains the
-  complete explicit user-approved revision envelope and exact fenced target.
 
 The loop records planned -> did -> outcome before and after every foreign
 mutation. It refuses stale packets by fingerprint and validates packet
@@ -185,10 +168,5 @@ reason or resume handle, lane source, lane chain, chosen label with token
 secondary, plan revision, journal path, blocked continuation packets, and
 firstFailing checklist when present.
 
-Preserve `refill_reporting.v2` exactly in progress, continuation, replay, and
-terminal results. Do not recompute its semantic counts or drop live-preparation
-epoch, snapshot sequence, reset reason, watermark, blockers, compatibility, or
-terminal fields. Never surface raw prospect or message-copy fields.
-
 Real-run journals live under `~/.sellable/refill/runs` by default and append an
 index line. Dry runs include the dry marker and do not create run records.

package/skill-templates/refill-sends.md

@@ -93,7 +93,7 @@ Accepted invocation flags in the same user request:
 When the host can call typed MCP tools, start with:
 
 ```text
-refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runHandle?: RefillRunHandleV1, targetConfig?: RefillTargetConfigV1, reportingContext?: RefillReportingContextV2, messageTemplateRevision?: MessageTemplateRevisionV1 })
+refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runId?: string, fence?: number })
 ```
 
 That command helper normalizes arguments and returns the execution contract. In
@@ -104,14 +104,6 @@ host must immediately call `refill_sends` again with the original full scope
 plus the exact returned `runId` and `fence`. Do this automatically inside the
 same user command until terminal projected coverage or a concrete blocker; do
 not ask the user to type `continue` and do not start a second run.
-
-`targetConfig` and the server-issued `runHandle` are separate values and must
-survive each continuation unchanged except for a server-issued takeover fence.
-Only a literal `messageTemplateRevision` with `source:"user_approved"`, the
-approved `templateMarkdown`, prior/new authority digests, 1–500 exact cohort
-row IDs, and request/effect/revision-operation IDs can authorize
-`revise_message_template_and_rerun`. No envelope means no revision. A
-`forceRerun:true` queue call cannot infer or authorize template mutation.
 Safe primitives are paid-credit refresh,
 existing-row message preparation, generated-message approval, receipt-proven
 same-source row copy, one bounded Signal Discovery search derived only from
@@ -575,11 +567,6 @@ scheduler wait loop. Do not finish the refill goal, mark it complete, or mark it
 blocked only because it is still `awaiting_scheduler_after_ready_buffer`; keep
 waiting unless Christian stops the run or the host cannot continue.
 
-Carry the canonical `refill_reporting.v2` DTO through progress, continuation,
-replay, and terminal reporting without recomputing counts or losing live epoch,
-snapshot sequence, reset reason, watermark, blockers, compatibility, or
-terminal outcome. Redact raw copy and prospect fields.
-
 Future scheduled coverage and already sent actions are distinct; only
 scheduler-owned future scheduled actions count as scheduled coverage. For
 multiple target dates, finish D1 execution and the full D1 reread before