@sellable/install 0.1.484 → 0.1.486-wip.phase169.20260804.2

package/lib/sellable-agent/fly-customer-model.mjs

@@ -1,161 +1,20 @@
-export const FLY_CUSTOMER_MODEL_PROVIDER = "openai-codex";
-export const FLY_CUSTOMER_MODEL_ID = "gpt-5.6-sol";
-export const FLY_CUSTOMER_MODEL_REASONING_EFFORT = "high";
+import {
+  MODEL_AUTH_DEFAULT_MODEL,
+  MODEL_AUTH_PROVIDER,
+  MODEL_AUTH_REASONING_EFFORT,
+  evaluateModelAuthReadback,
+  parseModelAuthRuntimeCredential,
+} from "./model-auth-reconciler.mjs";
 
-const MODEL_CREDENTIAL_KEYS = [
-  "OPENAI_API_KEY",
-  "auth_mode",
-  "last_refresh",
-  "tokens",
-];
-const MODEL_TOKEN_KEYS = [
-  "access_token",
-  "account_id",
-  "id_token",
-  "refresh_token",
-];
-/**
- * Credential sources that count as "resolved from this runtime's own root auth
- * store". `hermes-auth-store` is the seeded singleton under `providers`;
- * `credential_pool` is the pooled entry — which this module seeds itself (see
- * `hermesRootAuthJson` below) and which `hermes auth add` also writes when an
- * operator re-authenticates an expired Codex token. Both live in the same root
- * auth.json, so neither weakens isolation: that guarantee is carried by
- * `source_class === "root_fallback"` and `local_auth_entry_count === 0`, which
- * together prove no profile-local auth.json is shadowing the root store.
- */
-const TRUSTED_MODEL_AUTH_SOURCES = ["hermes-auth-store", "credential_pool"];
+export const FLY_CUSTOMER_MODEL_PROVIDER = MODEL_AUTH_PROVIDER;
+export const FLY_CUSTOMER_MODEL_ID = MODEL_AUTH_DEFAULT_MODEL;
+export const FLY_CUSTOMER_MODEL_REASONING_EFFORT =
+  MODEL_AUTH_REASONING_EFFORT;
 
-/**
- * Decide whether the runtime's model-auth readback proves a usable, isolated
- * Codex credential. Returns the first failed invariant so boot failures name
- * the actual cause instead of a generic rejection.
- *
- * @param {unknown} readback
- * @param {{ sourceFingerprint: string, generation: number } | null} [expected]
- */
-export function evaluateModelAuthReadback(readback, expected = null) {
-  const reject = (rejection) => ({ accepted: false, rejection });
-  if (!readback || typeof readback !== "object" || Array.isArray(readback)) {
-    return reject("readback_unparsable");
-  }
-  if (readback.provider !== FLY_CUSTOMER_MODEL_PROVIDER) {
-    return reject("provider_mismatch");
-  }
-  if (readback.source_class !== "root_fallback") {
-    return reject("source_class_not_root_fallback");
-  }
-  if (readback.local_auth_entry_count !== 0) {
-    return reject("local_auth_entry_present");
-  }
-  if (!TRUSTED_MODEL_AUTH_SOURCES.includes(readback.source)) {
-    return reject("source_not_trusted");
-  }
-  if (readback.auth_mode !== "chatgpt") {
-    return reject("auth_mode_not_chatgpt");
-  }
-  if (readback.credential_present !== true) {
-    return reject("credential_absent");
-  }
-  if (expected && readback.source_fingerprint !== expected.sourceFingerprint) {
-    return reject("source_fingerprint_mismatch");
-  }
-  if (expected && readback.credential_generation !== expected.generation) {
-    return reject("credential_generation_mismatch");
-  }
-  return { accepted: true, rejection: null };
+// Kept as the package's stable import name while the on-wire credential is
+// upgraded from a singleton full grant to the v2 access-only runtime bundle.
+export function parseFlyCustomerModelCredential(secret, options) {
+  return parseModelAuthRuntimeCredential(secret, options);
 }
 
-const exactKeys = (value, expected) =>
-  value &&
-  typeof value === "object" &&
-  !Array.isArray(value) &&
-  Object.keys(value).length === expected.length &&
-  Object.keys(value).every((key) => expected.includes(key));
-const bounded = (value, minimum, maximum) =>
-  typeof value === "string" &&
-  value.length >= minimum &&
-  value.length <= maximum &&
-  !value.includes("\0");
-
-export function parseFlyCustomerModelCredential(secret) {
-  if (
-    typeof secret !== "string" ||
-    !secret ||
-    Buffer.byteLength(secret, "utf8") > 64 * 1024
-  ) {
-    throw new Error("customer_model_credential_rejected");
-  }
-  let value;
-  try {
-    value = JSON.parse(secret);
-  } catch {
-    throw new Error("customer_model_credential_rejected");
-  }
-  if (
-    !exactKeys(value, MODEL_CREDENTIAL_KEYS) ||
-    value.auth_mode !== "chatgpt" ||
-    value.OPENAI_API_KEY !== null ||
-    !bounded(value.last_refresh, 10, 128) ||
-    Number.isNaN(Date.parse(value.last_refresh)) ||
-    !exactKeys(value.tokens, MODEL_TOKEN_KEYS) ||
-    !bounded(value.tokens.id_token, 32, 32 * 1024) ||
-    !bounded(value.tokens.access_token, 32, 32 * 1024) ||
-    !bounded(value.tokens.refresh_token, 32, 16 * 1024) ||
-    !bounded(value.tokens.account_id, 1, 512)
-  ) {
-    throw new Error("customer_model_credential_rejected");
-  }
-  const authJson = JSON.stringify({
-    auth_mode: "chatgpt",
-    OPENAI_API_KEY: null,
-    tokens: {
-      id_token: value.tokens.id_token,
-      access_token: value.tokens.access_token,
-      refresh_token: value.tokens.refresh_token,
-      account_id: value.tokens.account_id,
-    },
-    last_refresh: value.last_refresh,
-  });
-  const hermesRootAuthJson = JSON.stringify({
-    version: 1,
-    providers: {
-      "openai-codex": {
-        tokens: {
-          id_token: value.tokens.id_token,
-          access_token: value.tokens.access_token,
-          refresh_token: value.tokens.refresh_token,
-          account_id: value.tokens.account_id,
-        },
-        last_refresh: value.last_refresh,
-        auth_mode: "chatgpt",
-      },
-    },
-    credential_pool: {
-      "openai-codex": [
-        {
-          id: "sellable-control-plane",
-          label: "Sellable Codex OAuth",
-          auth_type: "oauth",
-          source: "device_code",
-          access_token: value.tokens.access_token,
-          refresh_token: value.tokens.refresh_token,
-          id_token: value.tokens.id_token,
-          account_id: value.tokens.account_id,
-          last_refresh: value.last_refresh,
-          priority: 0,
-          request_count: 0,
-        },
-      ],
-    },
-    active_provider: "openai-codex",
-  });
-  return Object.freeze({
-    provider: FLY_CUSTOMER_MODEL_PROVIDER,
-    model: FLY_CUSTOMER_MODEL_ID,
-    reasoningEffort: FLY_CUSTOMER_MODEL_REASONING_EFFORT,
-    authJson,
-    hermesRootAuthJson,
-    testAccessToken: value.tokens.access_token,
-  });
-}
+export { evaluateModelAuthReadback };

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.484";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.486-wip.phase169.20260804.2";
 const MCP_PACKAGE = "@sellable/mcp@0.1.760-wip.phase143.20260727100513";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1540,7 +1540,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.484" ||
+      pinned.installerPackage !== "@sellable/install@0.1.486-wip.phase169.20260804.2" ||
       pinned.mcpPackage !==
         "@sellable/mcp@0.1.760-wip.phase143.20260727100513" ||
       !Array.isArray(policy.toolInclude) ||