@sellable/install 0.1.363-phase111.20260720131434 → 0.1.363

package/lib/sellable-agent/host-bootstrap.mjs

@@ -0,0 +1,458 @@
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  randomUUID,
+} from "node:crypto";
+import {
+  chmodSync,
+  chownSync,
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildExternalRuntimeClosure } from "./external-runtime-builder.mjs";
+import { canonicalHostWorkerDigest } from "./host-worker.mjs";
+import {
+  EXTERNAL_HERMES_ENTRYPOINT,
+  EXTERNAL_MCP_ENTRYPOINT,
+  EXTERNAL_RUNTIME_CLOSURE_ROOT,
+  EXTERNAL_RUNTIME_MANIFEST_PATH,
+} from "./runtime-helper.mjs";
+import { RUNTIME_EGRESS_HOSTS } from "./runtime-boundary.mjs";
+import { RUNTIME_EGRESS_PROXY_VERSION } from "./runtime-egress-proxy.mjs";
+import { installAgentHostServices } from "./service-installer.mjs";
+
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+const VERSION = "sellable-agent-host-bootstrap/v1";
+const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.363";
+const MCP_PACKAGE = "@sellable/mcp@0.1.620";
+const HERMES_VERSION = "0.18.0";
+const SHA256 = /^[a-f0-9]{64}$/;
+const SHA256_16 = /^[a-f0-9]{16}$/;
+const SHA512_INTEGRITY = /^sha512-[A-Za-z0-9+/]+={0,2}$/;
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const SAFE_TOOL = /^[a-z][a-z0-9_]{0,63}$/;
+const SECRET = /xox[bap]-|sat_[A-Za-z0-9_-]+|asec\.v1\.|access[_-]?token|refresh[_-]?token|private[_-]?key/i;
+
+const PATHS = Object.freeze({
+  providerSource: "/var/lib/sellable-agent-bootstrap/provider-auth",
+  xappSource: "/var/lib/sellable-agent-bootstrap/slack-app",
+  hostProbe: "/var/lib/sellable-agent-bootstrap/host-probe",
+  receipt: "/var/lib/sellable-agent-bootstrap/registration-receipt.json",
+  releaseIdentity: "/opt/sellable-agent/release.json",
+  workerRoot: "/var/lib/sellable-agent-worker",
+  workerRequests: "/var/lib/sellable-agent-worker/requests",
+  helperRequests: "/var/lib/sellable-agent-worker/helper-requests",
+  workerState: "/var/lib/sellable-agent-worker/state",
+  workerSlackSecrets: "/var/lib/sellable-agent-worker/runtime-secrets",
+  workerHostSecrets: "/var/lib/sellable-agent-worker/host-secrets",
+  xappRuntime: "/var/lib/sellable-agent-worker/host-secrets/slack-app",
+  signingRoot: "/var/lib/sellable-agent-worker/enrollment",
+  signingKey: "/var/lib/sellable-agent-worker/enrollment/private-key.pem",
+  runtimeRoot: "/var/lib/sellable-agent-runtime",
+  runtimeState: "/var/lib/sellable-agent-runtime/state",
+  runtimeMcpSecrets: "/var/lib/sellable-agent-runtime/mcp-secrets",
+  profiles: "/var/lib/sellable-agent-profiles",
+});
+
+const exactKeys = (value, keys) => Boolean(
+  value && typeof value === "object" && !Array.isArray(value) &&
+  Object.keys(value).sort().join("\0") === [...keys].sort().join("\0")
+);
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]));
+  }
+  return value;
+}
+
+function targetPath(targetRoot, absolutePath) {
+  const root = realpathSync(resolve(targetRoot));
+  const value = root === "/" ? resolve(absolutePath) : join(root, absolutePath.replace(/^\/+/, ""));
+  const rel = relative(root, value);
+  if (!isAbsolute(absolutePath) || rel.startsWith("..") || isAbsolute(rel)) {
+    throw new Error("host bootstrap target rejected");
+  }
+  return value;
+}
+
+function atomicFile(pathValue, bytes, mode, { uid, gid, disposableFixture }) {
+  const temp = join(dirname(pathValue), `.${randomUUID()}.tmp`);
+  writeFileSync(temp, bytes, { flag: "wx", mode });
+  chmodSync(temp, mode);
+  if (!disposableFixture) chownSync(temp, uid, gid);
+  const descriptor = openSync(temp, "r");
+  try { fsyncSync(descriptor); } finally { closeSync(descriptor); }
+  renameSync(temp, pathValue);
+  const parent = openSync(dirname(pathValue), "r");
+  try { fsyncSync(parent); } finally { closeSync(parent); }
+}
+
+function ensureDirectory(targetRoot, absolutePath, mode, uid, gid, disposableFixture) {
+  const value = targetPath(targetRoot, absolutePath);
+  if (!existsSync(value)) mkdirSync(value, { recursive: true, mode });
+  const link = lstatSync(value);
+  if (link.isSymbolicLink() || !link.isDirectory()) throw new Error("host bootstrap directory rejected");
+  chmodSync(value, mode);
+  if (!disposableFixture) chownSync(value, uid, gid);
+  const observed = lstatSync(value);
+  if (
+    (observed.mode & 0o777) !== mode ||
+    (!disposableFixture && (observed.uid !== uid || observed.gid !== gid))
+  ) throw new Error("host bootstrap directory readback rejected");
+  return value;
+}
+
+function readPrivateSource(targetRoot, absolutePath, disposableFixture) {
+  const value = targetPath(targetRoot, absolutePath);
+  const parent = lstatSync(dirname(value));
+  const link = lstatSync(value);
+  const expectedUid = disposableFixture ? (process.getuid?.() ?? link.uid) : 0;
+  const expectedGid = disposableFixture ? (process.getgid?.() ?? link.gid) : 0;
+  if (
+    parent.isSymbolicLink() || !parent.isDirectory() || (parent.mode & 0o777) !== 0o700 ||
+    parent.uid !== expectedUid || parent.gid !== expectedGid ||
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 ||
+    link.uid !== expectedUid || link.gid !== expectedGid || realpathSync(dirname(value)) !== dirname(value)
+  ) throw new Error("host bootstrap private source rejected");
+  const descriptor = openSync(value, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const opened = fstatSync(descriptor);
+    if (!opened.isFile() || opened.dev !== link.dev || opened.ino !== link.ino) {
+      throw new Error("host bootstrap private source changed");
+    }
+    return readFileSync(descriptor, "utf8").trim();
+  } finally {
+    closeSync(descriptor);
+  }
+}
+
+function readReleaseIdentity(targetRoot, expected, disposableFixture) {
+  const value = targetPath(targetRoot, PATHS.releaseIdentity);
+  const link = lstatSync(value);
+  const expectedUid = disposableFixture ? (process.getuid?.() ?? link.uid) : 0;
+  const expectedGid = disposableFixture ? (process.getgid?.() ?? link.gid) : 0;
+  if (
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o444 ||
+    link.uid !== expectedUid || link.gid !== expectedGid
+  ) throw new Error("host bootstrap image release rejected");
+  const observed = JSON.parse(readFileSync(value, "utf8"));
+  if (!exactKeys(observed, ["installerPackage", "installerIntegrity", "mcpPackage", "mcpIntegrity"]) ||
+      JSON.stringify(stable(observed)) !== JSON.stringify(stable(expected))) {
+    throw new Error("host bootstrap image release mismatch");
+  }
+  return observed;
+}
+
+function validateConfig(config) {
+  if (!exactKeys(config, [
+    "version", "target", "host", "enrollment", "release", "controlPlaneUrl",
+    "runtimeContract", "identities",
+  ]) || config.version !== VERSION || SECRET.test(JSON.stringify(config))) {
+    throw new Error("host bootstrap config rejected");
+  }
+  if (
+    !exactKeys(config.target, ["vpsId", "hostname", "containerName"]) ||
+    Object.values(config.target).some((value) => !SAFE_ID.test(value ?? "")) ||
+    !exactKeys(config.host, ["id", "stableKey", "compatibilityHash", "capacity"]) ||
+    !SAFE_ID.test(config.host.id ?? "") || !SAFE_ID.test(config.host.stableKey ?? "") ||
+    !SHA256.test(config.host.compatibilityHash ?? "") ||
+    !Number.isSafeInteger(config.host.capacity) || config.host.capacity < 1 || config.host.capacity > 100 ||
+    !exactKeys(config.enrollment, ["id", "workerId", "keyGeneration", "expiresAt"]) ||
+    !SAFE_ID.test(config.enrollment.id ?? "") || !SAFE_ID.test(config.enrollment.workerId ?? "") ||
+    !Number.isSafeInteger(config.enrollment.keyGeneration) || config.enrollment.keyGeneration < 1 ||
+    !Number.isFinite(Date.parse(config.enrollment.expiresAt ?? "")) ||
+    Date.parse(config.enrollment.expiresAt) <= Date.now() ||
+    !exactKeys(config.release, ["installerPackage", "installerIntegrity", "mcpPackage", "mcpIntegrity"]) ||
+    config.release.installerPackage !== INSTALLER_PACKAGE ||
+    config.release.mcpPackage !== MCP_PACKAGE ||
+    !SHA512_INTEGRITY.test(config.release.installerIntegrity ?? "") ||
+    !SHA512_INTEGRITY.test(config.release.mcpIntegrity ?? "") ||
+    !/^https:\/\/[A-Za-z0-9.-]+(?::[0-9]+)?$/.test(config.controlPlaneUrl ?? "")
+  ) throw new Error("host bootstrap identity rejected");
+  const runtime = config.runtimeContract;
+  if (
+    !exactKeys(runtime, [
+      "profileId", "providerReference", "providerFingerprint", "xappReference",
+      "xappFingerprint", "policyHash", "toolInclude",
+    ]) || !SAFE_ID.test(runtime.profileId ?? "") ||
+    typeof runtime.providerReference !== "string" || !runtime.providerReference || runtime.providerReference.length > 256 ||
+    !SHA256.test(runtime.providerFingerprint ?? "") ||
+    typeof runtime.xappReference !== "string" || !runtime.xappReference || runtime.xappReference.length > 256 ||
+    !SHA256_16.test(runtime.xappFingerprint ?? "") ||
+    !SHA256.test(runtime.policyHash ?? "") || !Array.isArray(runtime.toolInclude) ||
+    runtime.toolInclude.length < 1 || runtime.toolInclude.length > 64 ||
+    runtime.toolInclude.some((tool) => !SAFE_TOOL.test(tool)) ||
+    JSON.stringify(runtime.toolInclude) !== JSON.stringify([...new Set(runtime.toolInclude)].sort())
+  ) throw new Error("host bootstrap runtime contract rejected");
+  const identities = config.identities;
+  if (
+    !exactKeys(identities, ["workerUid", "workerGid", "proxyUid", "proxyGid", "runtimeUid", "runtimeGid", "siblingUid", "siblingGid", "adminUid", "adminGid"]) ||
+    Object.values(identities).some((value) => !Number.isSafeInteger(value) || value < 1) ||
+    new Set([identities.workerUid, identities.proxyUid, identities.runtimeUid, identities.siblingUid, identities.adminUid]).size !== 5
+  ) throw new Error("host bootstrap runtime identities rejected");
+  return config;
+}
+
+function signingIdentity(targetRoot, config, disposableFixture) {
+  const keyPath = targetPath(targetRoot, PATHS.signingKey);
+  if (!existsSync(keyPath)) {
+    const { privateKey } = generateKeyPairSync("ed25519");
+    atomicFile(
+      keyPath,
+      privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+      0o600,
+      { uid: config.identities.workerUid, gid: config.identities.workerGid, disposableFixture },
+    );
+  }
+  const link = lstatSync(keyPath);
+  if (
+    link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 ||
+    (!disposableFixture && (link.uid !== config.identities.workerUid || link.gid !== config.identities.workerGid))
+  ) throw new Error("host bootstrap signing key rejected");
+  const privateKey = createPrivateKey(readFileSync(keyPath, "utf8"));
+  if (privateKey.asymmetricKeyType !== "ed25519") throw new Error("host bootstrap signing key type rejected");
+  const publicKeyPem = createPublicKey(privateKey).export({ type: "spki", format: "pem" }).toString();
+  const publicKeyHash = sha256(publicKeyPem);
+  const enrollmentFingerprint = canonicalHostWorkerDigest({
+    audience: "sellable-agent-worker/v1",
+    enrollmentId: config.enrollment.id,
+    hostId: config.host.id,
+    keyGeneration: config.enrollment.keyGeneration,
+    publicKeyHash,
+    workerId: config.enrollment.workerId,
+  });
+  return { publicKeyHash, enrollmentFingerprint };
+}
+
+function prepareLayout(targetRoot, config, disposableFixture) {
+  const ids = config.identities;
+  for (const pathValue of [
+    PATHS.workerRoot, PATHS.workerRequests, PATHS.helperRequests, PATHS.workerState,
+    PATHS.workerSlackSecrets, PATHS.workerHostSecrets, PATHS.signingRoot,
+  ]) ensureDirectory(targetRoot, pathValue, 0o700, ids.workerUid, ids.workerGid, disposableFixture);
+  for (const pathValue of [PATHS.runtimeRoot, PATHS.runtimeState, PATHS.runtimeMcpSecrets]) {
+    ensureDirectory(targetRoot, pathValue, 0o700, ids.runtimeUid, ids.runtimeGid, disposableFixture);
+  }
+  ensureDirectory(targetRoot, PATHS.profiles, 0o711, ids.workerUid, ids.workerGid, disposableFixture);
+  const probePath = targetPath(targetRoot, PATHS.hostProbe);
+  if (!existsSync(probePath)) {
+    atomicFile(probePath, "host-only\n", 0o600, { uid: 0, gid: 0, disposableFixture });
+  }
+}
+
+function installHostAppSecret(targetRoot, config, disposableFixture) {
+  const source = readPrivateSource(targetRoot, PATHS.xappSource, disposableFixture);
+  if (!source || source.length > 4096 || sha256(source).slice(0, 16) !== config.runtimeContract.xappFingerprint) {
+    throw new Error("host bootstrap Slack app source rejected");
+  }
+  const target = targetPath(targetRoot, PATHS.xappRuntime);
+  atomicFile(target, `${source}\n`, 0o600, {
+    uid: config.identities.workerUid,
+    gid: config.identities.workerGid,
+    disposableFixture,
+  });
+  return target;
+}
+
+function configs(config, signing, ownerUid, ownerGid) {
+  const ids = config.identities;
+  const workerConfig = {
+    enrollmentId: config.enrollment.id,
+    hostId: config.host.id,
+    workerId: config.enrollment.workerId,
+    signerGeneration: config.enrollment.keyGeneration,
+    enrollmentFingerprint: signing.enrollmentFingerprint,
+    publicKeyHash: signing.publicKeyHash,
+    privateKeyPath: PATHS.signingKey,
+    controlPlaneUrl: config.controlPlaneUrl,
+    requestRoot: PATHS.workerRequests,
+    helperRequestRoot: PATHS.helperRequests,
+    stateRoot: PATHS.workerState,
+    profilesRoot: PATHS.profiles,
+    runtimeSecretsRoot: PATHS.workerSlackSecrets,
+    runtimeMcpSecretsRoot: PATHS.runtimeMcpSecrets,
+    workerUid: ids.workerUid,
+    workerGid: ids.workerGid,
+    runtimeUid: ids.runtimeUid,
+    runtimeGid: ids.runtimeGid,
+    leaseSeconds: 30,
+    poll: { minDelayMs: 1_000, maxDelayMs: 30_000, jitterRatio: 0.2 },
+    profileRuntimeContract: {
+      hermesCli: "hermes",
+      hermesVersion: HERMES_VERSION,
+      installerPackage: INSTALLER_PACKAGE,
+      mcpPackage: MCP_PACKAGE,
+      providerReference: config.runtimeContract.providerReference,
+      providerFingerprint: config.runtimeContract.providerFingerprint,
+      xappReference: config.runtimeContract.xappReference,
+      xappFingerprint: config.runtimeContract.xappFingerprint,
+      xappSecretFile: PATHS.xappRuntime,
+      policies: {
+        [config.runtimeContract.policyHash]: { toolInclude: config.runtimeContract.toolInclude },
+      },
+    },
+  };
+  const helperProfile = {
+    workerUid: ids.workerUid,
+    workerGid: ids.workerGid,
+    runtimeUid: ids.runtimeUid,
+    runtimeGid: ids.runtimeGid,
+    siblingUid: ids.siblingUid,
+    siblingGid: ids.siblingGid,
+    adminUid: ids.adminUid,
+    adminGid: ids.adminGid,
+    proxyUid: ids.proxyUid,
+    proxyGid: ids.proxyGid,
+    profilesRoot: PATHS.profiles,
+    workerRuntimeSecretRoot: PATHS.workerSlackSecrets,
+    mcpCredentialRoot: PATHS.runtimeMcpSecrets,
+    runtimeStateRoot: PATHS.runtimeState,
+    proxyExecutablePath: "/usr/local/lib/sellable-agent/package/bin/sellable-agent-egress-proxy.mjs",
+    installedPackageManifestPath: "/usr/local/lib/sellable-agent/package/manifest.json",
+    externalRuntimeManifestPath: EXTERNAL_RUNTIME_MANIFEST_PATH,
+    externalRuntimeClosureRoot: EXTERNAL_RUNTIME_CLOSURE_ROOT,
+    externalRuntimeTrustRoot: "/usr/local/lib/sellable-agent",
+    externalRuntimePathRoot: "/",
+    externalRuntimeOwnerUid: ownerUid,
+    externalRuntimeOwnerGid: ownerGid,
+    mcpCommand: EXTERNAL_MCP_ENTRYPOINT,
+    hermesExecutablePath: EXTERNAL_HERMES_ENTRYPOINT,
+    hermesSourceRoot: `${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes`,
+    proxyConfigPath: "/etc/sellable-agent/egress-proxy.json",
+    runtimeBoundaryConfigPath: "/etc/sellable-agent/runtime-boundary.json",
+    providerCredentialSourcePath: PATHS.providerSource,
+    providerCredentialFingerprint: config.runtimeContract.providerFingerprint,
+    runtimeServicePath: "/etc/services.d/sellable-agent-runtime",
+    runtimeServiceEnvRoot: "/etc/services.d/sellable-agent-runtime/env",
+    runtimeProbePath: "/usr/local/bin/sellable-agent-runtime-probe",
+    proxyPidPath: "/etc/services.d/sellable-agent-egress-proxy/supervise/pid",
+    proxyPort: 19081,
+    procRoot: "/proc",
+    bootIdPath: "/proc/sys/kernel/random/boot_id",
+    bubblewrapPath: "/usr/bin/bwrap",
+    setprivPath: "/usr/bin/setpriv",
+    nftPath: "/usr/sbin/nft",
+    cgroupRoot: "/sys/fs/cgroup/sellable-agent",
+    hostProbePath: PATHS.hostProbe,
+    dockerSocketPath: "/var/run/docker.sock",
+  };
+  const helperConfig = {
+    helperRequestRoot: PATHS.helperRequests,
+    workerRequestRoot: PATHS.workerRequests,
+    s6SvcPath: "/command/s6-svc",
+    profiles: { [config.runtimeContract.profileId]: helperProfile },
+  };
+  const egressProxyConfig = {
+    version: RUNTIME_EGRESS_PROXY_VERSION,
+    listenHost: "127.0.0.1",
+    listenPort: 19081,
+    uid: ids.proxyUid,
+    gid: ids.proxyGid,
+    allowedHosts: [...RUNTIME_EGRESS_HOSTS],
+  };
+  return { workerConfig, helperConfig, egressProxyConfig };
+}
+
+export function bootstrapAgentHost(input) {
+  const config = validateConfig(input.config);
+  const targetRoot = resolve(input.targetRoot ?? "/");
+  const disposableFixture = input.disposableFixture === true;
+  if (!isAbsolute(targetRoot) || !existsSync(targetRoot) || (targetRoot !== "/" && !disposableFixture)) {
+    throw new Error("host bootstrap root rejected");
+  }
+  if (targetRoot === "/" && (process.getuid?.() !== 0 || process.getgid?.() !== 0)) {
+    throw new Error("host bootstrap requires root");
+  }
+  readReleaseIdentity(targetRoot, config.release, disposableFixture);
+  const provider = readPrivateSource(targetRoot, PATHS.providerSource, disposableFixture);
+  if (!provider || provider.length > 1024 * 1024 || sha256(provider) !== config.runtimeContract.providerFingerprint) {
+    throw new Error("host bootstrap provider source rejected");
+  }
+  const providerJson = JSON.parse(provider);
+  if (!providerJson || typeof providerJson !== "object" || Array.isArray(providerJson)) {
+    throw new Error("host bootstrap provider JSON rejected");
+  }
+  prepareLayout(targetRoot, config, disposableFixture);
+  installHostAppSecret(targetRoot, config, disposableFixture);
+  const signing = signingIdentity(targetRoot, config, disposableFixture);
+  const sourceRoots = disposableFixture ? input.sourceRoots : {
+    mcpPackageRoot: "/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp",
+    mcpNodeModulesRoot: "/opt/sellable-agent/mcp-root/node_modules",
+    hermesSourceRoot: "/opt/hermes",
+  };
+  const externalRuntime = buildExternalRuntimeClosure({
+    pathRoot: targetRoot,
+    ownerUid: disposableFixture ? (process.getuid?.() ?? 0) : 0,
+    ownerGid: disposableFixture ? (process.getgid?.() ?? 0) : 0,
+    disposableFixture,
+    ...(sourceRoots ?? {}),
+    ...(disposableFixture && input.hermesBridgeContract ? { hermesBridgeContract: input.hermesBridgeContract } : {}),
+  });
+  const ownerUid = disposableFixture ? (process.getuid?.() ?? 0) : 0;
+  const ownerGid = disposableFixture ? (process.getgid?.() ?? 0) : 0;
+  const generated = configs(config, signing, ownerUid, ownerGid);
+  const installed = installAgentHostServices({
+    targetRoot,
+    packageRoot: input.packageRoot ?? PACKAGE_ROOT,
+    ownerUid,
+    ownerGid,
+    disposableFixture,
+    ...(disposableFixture && input.accountProvisioner ? { accountProvisioner: input.accountProvisioner } : {}),
+    ...generated,
+  });
+  if (!installed.ok) throw new Error(installed.code);
+  const configurationDigest = sha256(JSON.stringify(stable(generated)));
+  const receipt = {
+    version: RECEIPT_VERSION,
+    producer: "sellable-agent-host-bootstrap",
+    target: config.target,
+    host: config.host,
+    enrollment: {
+      id: config.enrollment.id,
+      workerId: config.enrollment.workerId,
+      audience: "sellable-agent-worker/v1",
+      keyGeneration: config.enrollment.keyGeneration,
+      publicKeyHash: signing.publicKeyHash,
+      enrollmentFingerprint: signing.enrollmentFingerprint,
+      capabilities: ["claim", "heartbeat", "secret-consume", "complete"],
+      expiresAt: new Date(config.enrollment.expiresAt).toISOString(),
+    },
+    release: {
+      ...config.release,
+      serviceManifestDigest: installed.manifestDigest,
+      externalRuntimeClosureDigest: externalRuntime.closureDigest,
+      configurationDigest,
+    },
+    secretScan: { unexpectedMatches: 0 },
+    observedAt: (input.now ?? new Date()).toISOString(),
+  };
+  if (SECRET.test(JSON.stringify(receipt))) throw new Error("host bootstrap receipt rejected");
+  atomicFile(
+    targetPath(targetRoot, PATHS.receipt),
+    `${JSON.stringify(receipt, null, 2)}\n`,
+    0o600,
+    { uid: 0, gid: 0, disposableFixture },
+  );
+  return { ok: true, receipt, workerConfig: generated.workerConfig, helperConfig: generated.helperConfig };
+}
+
+export const SELLABLE_AGENT_HOST_BOOTSTRAP_VERSION = VERSION;
+export const SELLABLE_AGENT_HOST_BOOTSTRAP_PATHS = PATHS;

package/lib/sellable-agent/host-worker.mjs

@@ -957,8 +957,8 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       !exactObject(runtimeService, ["principalId", "policyHash", "credentialGeneration", "credentialFingerprint"]) ||
       pinned.hermesCli !== "hermes" || pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.357" ||
-      pinned.mcpPackage !== "@sellable/mcp@0.1.619" ||
+      pinned.installerPackage !== "@sellable/install@0.1.363" ||
+      pinned.mcpPackage !== "@sellable/mcp@0.1.620" ||
       !Array.isArray(policy.toolInclude) || policy.toolInclude.length === 0 ||
       !Number.isSafeInteger(slack.generation) || slack.generation < 1 ||
       !/^A[A-Z0-9]{8,20}$/.test(slack.appId ?? "") ||
@@ -1423,6 +1423,11 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
             revisionId: request.evidence.revisionId,
             profileDigest: request.evidence.profileDigest,
           });
+          await helper({
+            action: "INSTALL_PROVIDER_CREDENTIAL",
+            ...helperIdentity(),
+            fingerprint: context.desired.providerFingerprint,
+          });
           await helper({ action: "INSTALL_HERMES_BRIDGE", ...helperIdentity() });
           await controlRuntime("UP");
         },
@@ -1491,17 +1496,6 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     lifecycle: {},
   };
   const restart = () => controlRuntime("RESTART");
-  const reload = async (path) => {
-    const base = new URL(config.runtimeControlUrl);
-    if (base.protocol !== "http:" || !["127.0.0.1", "localhost", "::1"].includes(base.hostname)) {
-      throw new Error("runtime control endpoint rejected");
-    }
-    const response = await (dependencies.fetchImpl ?? fetch)(
-      new URL(path, base),
-      { method: "POST", signal: AbortSignal.timeout(10_000) },
-    );
-    if (!response.ok) throw new Error("runtime reload rejected");
-  };
   const rawRuntimeObservation = async ({ drift = false } = {}) => {
     const observed = (await helper({
       action: drift ? "OBSERVE_RUNTIME_DRIFT" : "OBSERVE_RUNTIME",
@@ -1564,6 +1558,11 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
       revisionId: result.receipt.revisionId,
       profileDigest: result.receipt.profileDigest,
     });
+    await helper({
+      action: "INSTALL_PROVIDER_CREDENTIAL",
+      ...helperIdentity(),
+      fingerprint: context.desired.providerFingerprint,
+    });
     await helper({ action: "INSTALL_HERMES_BRIDGE", ...helperIdentity() });
   };
   const refreshThen = (effect) => async (input) => {
@@ -1571,8 +1570,8 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     return effect(input);
   };
   Object.assign(ports.refresh, {
-    reloadMcp: refreshThen(() => reload("/reload-mcp")),
-    reloadSkills: refreshThen(() => reload("/reload-skills")),
+    reloadMcp: refreshThen(restart),
+    reloadSkills: refreshThen(restart),
     reloadEnvironmentOrRestart: refreshThen(restart),
     restartGateway: refreshThen(restart),
     restartProfileSession: refreshThen(restart),
@@ -1675,11 +1674,8 @@ export function createLocalPinnedActionPorts(config, dependencies = {}) {
     async fenceDispatch() { await setRuntimeLifecycle("OFF"); },
     async fenceRouteOutput() { await setRuntimeLifecycle("ARCHIVED"); },
     async drain() {
-      const base = new URL(config.runtimeControlUrl);
-      const response = await fetch(new URL("/drain", base), { method: "POST", signal: AbortSignal.timeout(15_000) });
-      if (!response.ok) throw new Error("drain rejected");
-      const observed = await response.json();
-      if (!observed?.drained || observed.remaining !== 0) throw new Error("drain readback rejected");
+      await controlRuntime("DOWN");
+      const observed = { drained: true, remaining: 0 };
       atomicPrivateJson(join(realpathSync(config.stateRoot), `drain-${context.activeClaim.operation.id}.json`), {
         operationId: context.activeClaim.operation.id,
         fence: context.activeClaim.operation.fence,

package/lib/sellable-agent/profile-materializer.mjs

@@ -131,8 +131,8 @@ function validateDesired(desired) {
     !Number.isSafeInteger(desired.slackGeneration) || desired.slackGeneration < 1 ||
     !Number.isSafeInteger(desired.serviceCredentialGeneration) || desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" || desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.357" ||
-    desired.mcpPackage !== "@sellable/mcp@0.1.619" ||
+    desired.installerPackage !== "@sellable/install@0.1.363" ||
+    desired.mcpPackage !== "@sellable/mcp@0.1.620" ||
     !Array.isArray(desired.toolInclude) || desired.toolInclude.length === 0 ||
     desired.toolInclude.some((tool) => !/^[a-z][a-z0-9_]{0,127}$/.test(tool)) ||
     new Set(desired.toolInclude).size !== desired.toolInclude.length ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -19,8 +19,8 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.357";
-export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.619";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.363";
+export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.620";
 
 export function deriveAgentProfileId(workspaceId, agentId, hostId) {
   return deriveContainedProfileId(workspaceId, agentId, hostId);
@@ -576,7 +576,7 @@ function inspectProvisionedProfile({
       !matchesReadback(manifest, request) ||
       manifest.serviceCredentialReference !== serviceCredentialReference ||
       manifest.installerPackage !== PINNED_INSTALL_PACKAGE ||
-      manifest.installerVersion !== "0.1.357" ||
+      manifest.installerVersion !== "0.1.363" ||
       manifest.mcpPackage !== PINNED_MCP_PACKAGE ||
       manifest.credentialKeyVersion !== credentialKeyVersion ||
       !/^[a-f0-9]{16}$/.test(manifest.credentialFingerprint) ||
@@ -781,7 +781,7 @@ function successReceipt({
     subject: `agent-profile:${observed.profileId}`,
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.357",
+      installVersion: "0.1.363",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },
@@ -821,7 +821,7 @@ function failure(code, stages, extra = {}, request = null) {
     subject: safeIdentity ? `agent-profile:${safeIdentity}` : "agent-profile:unbound",
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.357",
+      installVersion: "0.1.363",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },