@sellable/install 0.1.361-phase111.20260720114300 → 0.1.361

package/lib/sellable-agent/runtime-helper.mjs

@@ -23,6 +23,7 @@ export const EXTERNAL_HERMES_ENTRYPOINT = `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/herm
 const EXTERNAL_RUNTIME_MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
 const ACTIONS = new Set([
   "INSTALL_MCP_CREDENTIAL",
+  "INSTALL_PROVIDER_CREDENTIAL",
   "INSTALL_RUNTIME_SERVICE_ENV",
   "SET_RUNTIME_GATES",
   "OBSERVE_RUNTIME_GATES",
@@ -50,6 +51,7 @@ const PROFILE_ENTRIES = Object.freeze([
 ]);
 const ACTION_KEYS = Object.freeze({
   INSTALL_MCP_CREDENTIAL: ["action", "profileId", "operationId", "fence", "sourceRequestFile", "generation", "fingerprint"],
+  INSTALL_PROVIDER_CREDENTIAL: ["action", "profileId", "operationId", "fence", "fingerprint"],
   INSTALL_RUNTIME_SERVICE_ENV: ["action", "profileId", "operationId", "fence", "revisionId", "profileDigest"],
   SET_RUNTIME_GATES: ["action", "profileId", "operationId", "fence", "lifecycle"],
   OBSERVE_RUNTIME_GATES: ["action", "profileId", "operationId", "fence", "lifecycle"],
@@ -109,6 +111,79 @@ function atomicCredential(pathValue, secret, uid, gid) {
   fsyncDirectory(dirname(pathValue));
 }
 
+function providerCredentialPath(profile, profileId) {
+  const runtimeStateRoot = safeRuntimeStateRoot(profile);
+  const profilesRoot = join(runtimeStateRoot, "profiles");
+  const profileRoot = join(profilesRoot, profileId);
+  const runtimeHome = join(profileRoot, "home");
+  for (const pathValue of [profilesRoot, profileRoot, runtimeHome]) {
+    const link = lstatSync(pathValue);
+    if (
+      link.isSymbolicLink() || !link.isDirectory() || (link.mode & 0o777) !== 0o700 ||
+      link.uid !== profile.runtimeUid || link.gid !== profile.runtimeGid
+    ) throw new Error("provider runtime home rejected");
+  }
+  const codexRoot = join(runtimeHome, ".codex");
+  if (!existsSync(codexRoot)) {
+    mkdirSync(codexRoot, { mode: 0o700 });
+    chownSync(codexRoot, profile.runtimeUid, profile.runtimeGid);
+  }
+  const codex = lstatSync(codexRoot);
+  if (
+    codex.isSymbolicLink() || !codex.isDirectory() || (codex.mode & 0o777) !== 0o700 ||
+    codex.uid !== profile.runtimeUid || codex.gid !== profile.runtimeGid
+  ) throw new Error("provider credential root rejected");
+  return join(codexRoot, "auth.json");
+}
+
+function installProviderCredential(profile, request, config) {
+  if (
+    !SHA256.test(request.fingerprint ?? "") ||
+    request.fingerprint !== profile.providerCredentialFingerprint ||
+    (
+      profile.providerCredentialSourcePath !== "/var/lib/sellable-agent-bootstrap/provider-auth" &&
+      config.disposableFixture !== true
+    )
+  ) throw new Error("provider credential identity rejected");
+  const sourceRoot = privateRoot(dirname(profile.providerCredentialSourcePath));
+  const source = readPrivateDirectFile(sourceRoot, profile.providerCredentialSourcePath).trim();
+  if (!source || source.length > 1024 * 1024 || sha256(source) !== request.fingerprint) {
+    throw new Error("provider credential source rejected");
+  }
+  const parsed = JSON.parse(source);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("provider credential JSON rejected");
+  }
+  const target = providerCredentialPath(profile, request.profileId);
+  atomicCredential(target, source, profile.runtimeUid, profile.runtimeGid);
+  return {
+    ok: true,
+    profileId: request.profileId,
+    fingerprint: request.fingerprint,
+    path: target,
+  };
+}
+
+function removeProviderCredential(profile, profileId) {
+  const target = providerCredentialPath(profile, profileId);
+  if (existsSync(target)) {
+    const link = lstatSync(target);
+    if (link.isSymbolicLink() || !link.isFile()) throw new Error("provider credential cleanup rejected");
+    rmSync(target, { force: true });
+    fsyncDirectory(dirname(target));
+  }
+}
+
+function observeProviderCredential(profile, profileId) {
+  const target = providerCredentialPath(profile, profileId);
+  const link = lstatSync(target);
+  if (
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 ||
+    link.uid !== profile.runtimeUid || link.gid !== profile.runtimeGid
+  ) throw new Error("provider credential readback rejected");
+  return sha256(readFileSync(target, "utf8").trim());
+}
+
 function applyRuntimeOwnership(pathValue, uid, gid) {
   const link = lstatSync(pathValue);
   if (link.isSymbolicLink()) throw new Error("profile symlink rejected");
@@ -509,7 +584,9 @@ function walkExternalRoot(root, ownerUid, ownerGid) {
     }
   };
   visit(root, "");
-  return { directories: directories.sort((left, right) => left.path.localeCompare(right.path)), files };
+  const byPath = (left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+  const byLogicalPath = (left, right) => left.logicalPath < right.logicalPath ? -1 : left.logicalPath > right.logicalPath ? 1 : 0;
+  return { directories: directories.sort(byPath), files: files.sort(byLogicalPath) };
 }
 
 export function observeExternalRuntimeClosure(input = {}) {
@@ -569,18 +646,24 @@ export function observeExternalRuntimeClosure(input = {}) {
     if (
       JSON.stringify(rootRecord.directories.map((directory) => directory?.path)) !==
         JSON.stringify(rootRecord.directories.map((directory) => directory?.path).sort()) ||
-      new Set(rootRecord.directories.map((directory) => directory?.path)).size !== rootRecord.directories.length ||
+      new Set(rootRecord.directories.map((directory) => directory?.path)).size !== rootRecord.directories.length
+    ) throw new Error("external runtime directory order rejected");
+    if (
       rootRecord.directories.some((directory) =>
         !exactKeys(directory, ["path", "mode"]) ||
-        !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(directory.path ?? "") ||
+        !/^[-A-Za-z0-9@._+]+(?:\/[-A-Za-z0-9@._+]+)*$/.test(directory.path ?? "") ||
         directory.mode !== 0o555
-      ) ||
-      JSON.stringify(walked.directories) !== JSON.stringify(rootRecord.directories) ||
+      )
+    ) throw new Error("external runtime directory schema rejected");
+    if (JSON.stringify(walked.directories) !== JSON.stringify(rootRecord.directories)) {
+      throw new Error("external runtime directory inventory rejected");
+    }
+    if (
       rootRecord.files.length === 0 ||
       JSON.stringify(rootRecord.files.map((file) => file?.path)) !==
         JSON.stringify(rootRecord.files.map((file) => file?.path).sort()) ||
       new Set(rootRecord.files.map((file) => file?.path)).size !== rootRecord.files.length
-    ) throw new Error("external runtime inventory rejected");
+    ) throw new Error("external runtime file order rejected");
     const actualPaths = walked.files.map((file) => file.logicalPath);
     if (JSON.stringify(actualPaths) !== JSON.stringify(rootRecord.files.map((file) => file.path))) {
       throw new Error("external runtime open inventory rejected");
@@ -588,7 +671,7 @@ export function observeExternalRuntimeClosure(input = {}) {
     const observedFiles = rootRecord.files.map((file, index) => {
       if (
         !exactKeys(file, ["path", "mode", "digest"]) ||
-        !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/.test(file.path ?? "") ||
+        !/^[-A-Za-z0-9@._+]+(?:\/[-A-Za-z0-9@._+]+)*$/.test(file.path ?? "") ||
         ![0o444, 0o555].includes(file.mode) || !SHA256.test(file.digest ?? "")
       ) throw new Error("external runtime file schema rejected");
       const actual = walked.files[index];
@@ -958,9 +1041,19 @@ async function observeRuntime(profile, request) {
   const profileFiles = observeRuntimeProfileFiles(target);
   const { runtimeConfig, runtimeMcp, tools, fileHashes: actualFileHashes } = profileFiles;
   const actualProfileDigest = profileFiles.profileDigest;
-  const observedProvider = environmentDrift
-    ? sha256(`environment-drift\0${runtimeConfig?.provider?.fingerprint ?? "absent"}`)
-    : runtimeConfig?.provider?.fingerprint;
+  let observedProvider;
+  try {
+    observedProvider = observeProviderCredential(profile, request.profileId);
+    if (observedProvider !== runtimeConfig?.provider?.fingerprint) {
+      throw new Error("provider credential fingerprint rejected");
+    }
+  } catch (error) {
+    if (!driftMode) throw error;
+    observedProvider = sha256(`provider-drift\0${runtimeConfig?.provider?.fingerprint ?? "absent"}`);
+  }
+  if (environmentDrift) {
+    observedProvider = sha256(`environment-drift\0${observedProvider}`);
+  }
   return {
     profileId: manifest.profileId,
     workspaceId: manifest.workspaceId,
@@ -1172,6 +1265,9 @@ export async function runRuntimeHelperRequest({ requestPath, config }) {
         generation: request.generation,
       };
     }
+    if (request.action === "INSTALL_PROVIDER_CREDENTIAL") {
+      return installProviderCredential(profile, request, config);
+    }
     if (request.action === "INSTALL_RUNTIME_SERVICE_ENV") {
       return installRuntimeServiceEnvironment(profile, request);
     }
@@ -1187,6 +1283,7 @@ export async function runRuntimeHelperRequest({ requestPath, config }) {
         rmSync(target, { recursive: true, force: true });
         fsyncDirectory(root);
       }
+      removeProviderCredential(profile, request.profileId);
       return { ok: true, profileId: request.profileId, disposition: "REMOVED" };
     }
     if (request.action === "CHOWN_PROFILE") {

package/lib/sellable-agent/service-installer.mjs

@@ -247,6 +247,8 @@ function validateInstallInput(input) {
     profile.hermesSourceRoot !== `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes` ||
     profile.proxyConfigPath !== "/etc/sellable-agent/egress-proxy.json" ||
     profile.runtimeBoundaryConfigPath !== "/etc/sellable-agent/runtime-boundary.json" ||
+    profile.providerCredentialSourcePath !== "/var/lib/sellable-agent-bootstrap/provider-auth" ||
+    !SHA256.test(profile.providerCredentialFingerprint ?? "") ||
     profile.runtimeServicePath !== "/etc/services.d/sellable-agent-runtime" ||
     profile.runtimeServiceEnvRoot !== "/etc/services.d/sellable-agent-runtime/env" ||
     new Set([profile.runtimeUid, profile.proxyUid, profile.workerUid]).size !== 3

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.361-phase111.20260720114300",
+  "version": "0.1.361",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {
     "sellable": "bin/sellable-install.mjs",
+    "sellable-agent-host-bootstrap": "bin/sellable-agent-host-bootstrap.mjs",
     "sellable-agent-egress-proxy": "bin/sellable-agent-egress-proxy.mjs",
     "sellable-agent-host-worker": "bin/sellable-agent-host-worker.mjs",
     "sellable-agent-runtime-helper": "bin/sellable-agent-runtime-helper.mjs",
@@ -20,6 +21,7 @@
     "bin",
     "lib",
     "services",
+    "container",
     "agents",
     "skill-templates",
     "README.md",

package/skill-templates/refill-sends-evergreen.md

@@ -17,8 +17,3 @@ Use `refill-sends-v2` instead:
 ```text
 get_subskill_prompt({ subskillName: "refill-sends-v2" })
 ```
-
-The alias must not strip exact `targetConfig`, server `runHandle`,
-`reportingContext`, canonical `refill_reporting.v2`, or an explicit
-`messageTemplateRevision`. It never infers revision authority from
-`forceRerun`.

package/skill-templates/refill-sends-v2.md

@@ -52,24 +52,9 @@ refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 To resume an in-progress run, pass the handle back exactly:
 
 ```text
-refill_sends_v2({ workspaceId, runHandle:{runId,fence}, targetConfig, reportingContext, messageTemplateRevision? })
+refill_sends_v2({ workspaceId, runId, fence })
 ```
 
-`targetConfig` and the server-issued `runHandle` are separate authorities. Keep
-both byte-for-byte through every continuation and takeover; never fold the
-rotating fence into target configuration.
-
-An approved copy change is reachable only through an explicit
-`messageTemplateRevision` object with `version:1`, `source:"user_approved"`,
-the approved `templateMarkdown`, `messageTemplateRevision` identity,
-`priorTemplateAuthorityDigest`, `nextTemplateAuthorityDigest`, 1–500 exact
-`cohortRowIds`, and `requestId`, `effectId`, and `revisionOperationId`. Pass it
-with the exact `targetConfig` and `reportingContext`; the command obtains or
-resumes the server run handle and lets the planner name
-`revise_message_template_and_rerun`. Missing or partial input means no revision.
-`forceRerun:true` on a queue operation never authorizes or implies a template
-change.
-
 If a stale handle loses the lease, the tool reports the holder status and the
 approximately 10 minute lockout window. Reinvoke with the current handle or wait
 for lease expiry; never guess a fence.
@@ -100,8 +85,6 @@ The run may execute only packet-named bounded work:
   when the campaign is in the packet's pinned lane chain;
 - refresh paid InMail credit facts during bootstrap and once per scheduler-wait
   entry when the packet requires it.
-- apply `revise_message_template_and_rerun` only when the packet contains the
-  complete explicit user-approved revision envelope and exact fenced target.
 
 The loop records planned -> did -> outcome before and after every foreign
 mutation. It refuses stale packets by fingerprint and validates packet
@@ -185,10 +168,5 @@ reason or resume handle, lane source, lane chain, chosen label with token
 secondary, plan revision, journal path, blocked continuation packets, and
 firstFailing checklist when present.
 
-Preserve `refill_reporting.v2` exactly in progress, continuation, replay, and
-terminal results. Do not recompute its semantic counts or drop live-preparation
-epoch, snapshot sequence, reset reason, watermark, blockers, compatibility, or
-terminal fields. Never surface raw prospect or message-copy fields.
-
 Real-run journals live under `~/.sellable/refill/runs` by default and append an
 index line. Dry runs include the dry marker and do not create run records.

package/skill-templates/refill-sends.md

@@ -93,7 +93,7 @@ Accepted invocation flags in the same user request:
 When the host can call typed MCP tools, start with:
 
 ```text
-refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runHandle?: RefillRunHandleV1, targetConfig?: RefillTargetConfigV1, reportingContext?: RefillReportingContextV2, messageTemplateRevision?: MessageTemplateRevisionV1 })
+refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runId?: string, fence?: number })
 ```
 
 That command helper normalizes arguments and returns the execution contract. In
@@ -104,23 +104,6 @@ host must immediately call `refill_sends` again with the original full scope
 plus the exact returned `runId` and `fence`. Do this automatically inside the
 same user command until terminal projected coverage or a concrete blocker; do
 not ask the user to type `continue` and do not start a second run.
-
-`targetConfig` and the server-issued `runHandle` are separate values and must
-survive each continuation unchanged except for a server-issued takeover fence.
-Only a literal `messageTemplateRevision` with `source:"user_approved"`, the
-approved `templateMarkdown`, prior/new authority digests, 1–500 exact cohort
-row IDs, and request/effect/revision-operation IDs can authorize
-`revise_message_template_and_rerun`. No envelope means no revision. A
-`forceRerun:true` queue call cannot infer or authorize template mutation.
-When the user supplied a complete revision except for the current prior digest,
-acquire the exact run first and reread with its unchanged `targetConfig` and
-`runHandle`. Use only `reportingContext.source.templateAuthorityDigest` from
-that fenced reread as `priorTemplateAuthorityDigest`, then immediately continue
-the same run with the complete literal revision—even when the ordinary refill
-queue is empty or the sender is otherwise ineligible. An empty ordinary queue
-must not suppress an explicit revision. If the fenced reread returns no digest,
-stop with `template_authority_missing` or the returned
-`templateAuthorityBlocker`; never guess the digest.
 Safe primitives are paid-credit refresh,
 existing-row message preparation, generated-message approval, receipt-proven
 same-source row copy, one bounded Signal Discovery search derived only from
@@ -584,11 +567,6 @@ scheduler wait loop. Do not finish the refill goal, mark it complete, or mark it
 blocked only because it is still `awaiting_scheduler_after_ready_buffer`; keep
 waiting unless Christian stops the run or the host cannot continue.
 
-Carry the canonical `refill_reporting.v2` DTO through progress, continuation,
-replay, and terminal reporting without recomputing counts or losing live epoch,
-snapshot sequence, reset reason, watermark, blockers, compatibility, or
-terminal outcome. Redact raw copy and prospect fields.
-
 Future scheduled coverage and already sent actions are distinct; only
 scheduler-owned future scheduled actions count as scheduled coverage. For
 multiple target dates, finish D1 execution and the full D1 reread before