@sellable/install 0.1.578 → 0.1.581

package/container/Dockerfile

@@ -3,13 +3,13 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.577
-ARG MCP_PACKAGE=@sellable/mcp@0.1.858
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.581
+ARG MCP_PACKAGE=@sellable/mcp@0.1.859
 ARG INSTALLER_INTEGRITY
-ARG MCP_INTEGRITY=sha512-8yiUhwMbBk/KxZAXGXTsEHiN8XeB/qCqNgfApew0rhViJqiLlDN8oS67pZW5iB5gdmeuv4du0jx9Lhq/blr9hQ==
+ARG MCP_INTEGRITY=sha512-U5uVeDThuUW/CdWghTXQqTAA58mPDly3XHGmfX6WVjczGQHRcDB+Q49vbrA1MOkGRCnzmjGZN1fIVfFtBlwMPw==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.577" \
-    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.858" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.581" \
+    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.859" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.577" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.577' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.858') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.581' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.859') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.577', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.858', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.581', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.859', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,13 +3,13 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.577` is
+`@sellable/install@0.1.581` is
 published:
 
 ```sh
 docker build --platform linux/amd64 \
   --build-arg INSTALLER_INTEGRITY='sha512-…' \
-  --tag sellable-agent-host:0.1.577 .
+  --tag sellable-agent-host:0.1.581 .
 ```
 
 Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.

package/lib/sellable-agent/external-runtime-builder.mjs

@@ -28,7 +28,7 @@ import {
 
 const MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
 const MCP_PACKAGE = "@sellable/mcp";
-const MCP_VERSION = "0.1.858";
+const MCP_VERSION = "0.1.859";
 const SAFE_COMPONENT = /^[A-Za-z0-9@._+-]+$/;
 const HERMES_EXCLUDES = new Set([".git", ".playwright", "node_modules"]);
 

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -86,6 +86,8 @@ COPY hermes-bridge.mjs /usr/local/lib/sellable-agent/hermes-bridge.mjs
 COPY hermes-memory-snapshot.mjs /usr/local/lib/sellable-agent/hermes-memory-snapshot.mjs
 COPY fly-soul-bridge.mjs /usr/local/lib/sellable-agent/fly-soul-bridge.mjs
 COPY fly-soul-bridge-exec.mjs /usr/local/lib/sellable-agent/fly-soul-bridge-exec.mjs
+COPY fly-skills-bridge.mjs /usr/local/lib/sellable-agent/fly-skills-bridge.mjs
+COPY fly-skills-bridge-exec.mjs /usr/local/lib/sellable-agent/fly-skills-bridge-exec.mjs
 COPY soul-artifact-validator.mjs /usr/local/lib/sellable-agent/soul-artifact-validator.mjs
 COPY hermes-memory-dirty.mjs /opt/sellable/bin/hermes-memory-dirty
 COPY hermes-memory-reconcile.sh /opt/sellable/share/hermes-memory-reconcile.sh
@@ -107,9 +109,18 @@ RUN node --input-type=module -e \
       'import("file:///usr/local/lib/sellable-agent/fly-soul-bridge-exec.mjs").then(({ runFlySoulBridgeExecCli }) => runFlySoulBridgeExecCli());' \
       > /usr/local/bin/sellable-soul-bridge-exec \
     && chmod 0555 /usr/local/bin/sellable-soul-bridge-exec \
+    && printf '%s\n' \
+      '#!/usr/bin/env node' \
+      'import("file:///usr/local/lib/sellable-agent/fly-skills-bridge-exec.mjs").then(({ runFlySkillsBridgeExecCli }) => runFlySkillsBridgeExecCli());' \
+      > /usr/local/bin/sellable-skills-bridge-exec \
+    && chmod 0555 /usr/local/bin/sellable-skills-bridge-exec \
     && sha256sum /usr/local/lib/sellable-agent/fly-soul-bridge.mjs \
       > /usr/local/share/sellable-agent/soul-bridge-source.sha256 \
+    && sha256sum /usr/local/lib/sellable-agent/fly-skills-bridge.mjs \
+      /usr/local/lib/sellable-agent/fly-skills-bridge-exec.mjs \
+      > /usr/local/share/sellable-agent/skills-bridge-source.sha256 \
     && chmod 0444 /usr/local/share/sellable-agent/soul-bridge-source.sha256 \
+      /usr/local/share/sellable-agent/skills-bridge-source.sha256 \
     && chmod 0755 /etc \
     && chmod 0555 \
       /usr/local/lib/sellable-agent/admin-runtime/admin-runtime.mjs \
@@ -122,6 +133,8 @@ RUN node --input-type=module -e \
       /usr/local/lib/sellable-agent/hermes-memory-snapshot.mjs \
       /usr/local/lib/sellable-agent/fly-soul-bridge.mjs \
       /usr/local/lib/sellable-agent/fly-soul-bridge-exec.mjs \
+      /usr/local/lib/sellable-agent/fly-skills-bridge.mjs \
+      /usr/local/lib/sellable-agent/fly-skills-bridge-exec.mjs \
       /usr/local/lib/sellable-agent/soul-artifact-validator.mjs \
       /opt/sellable/bin/hermes-memory-dirty \
       /opt/sellable/bin/hermes-endpoint-cron \

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -606,6 +606,21 @@ function installAdminModelConfig(profileRoot, modelConfig) {
     modelConfig.credential_pool_strategies
   );
   document.set("fallback_providers", modelConfig.fallback_providers);
+  if (document.get("provider_routing") === undefined) {
+    // OpenRouter provider selection defaults to highest throughput; an
+    // explicit admin config value wins.
+    document.set("provider_routing", { sort: "throughput" });
+  }
+  const currentAuxiliary = document.toJS().auxiliary ?? {};
+  if (!currentAuxiliary.vision) {
+    // Non-vision main models need a working vision auxiliary; the Nous
+    // portal has no credentials on these machines, so image input would
+    // silently fail without this default.
+    document.set("auxiliary", {
+      ...currentAuxiliary,
+      vision: { provider: "openrouter", model: "google/gemini-3.5-flash" },
+    });
+  }
   atomicPrivateFile(path, document.toString());
   const readback = parseDocument(readFileSync(path, "utf8")).toJS();
   if (
@@ -622,6 +637,78 @@ function installAdminModelConfig(profileRoot, modelConfig) {
   }
 }
 
+const ADMIN_LIVE_SKILLS_CONFIG_KEYS = Object.freeze([
+  "disabled",
+  "platform_disabled",
+]);
+
+function adminPreservedSkillsIdentity(profileRoot) {
+  if (!existsSync(profileRoot)) return null;
+  const entries = [];
+  const skillsRoot = join(profileRoot, "skills");
+  const walk = (directory, relativePath = "") => {
+    for (const name of readdirSync(directory).sort()) {
+      const nextRelative = relativePath ? `${relativePath}/${name}` : name;
+      if (nextRelative === "sellable") continue;
+      const path = join(directory, name);
+      const stat = lstatSync(path);
+      if (stat.isSymbolicLink()) {
+        throw new Error("admin_runtime_live_skills_symlink_rejected");
+      }
+      if (stat.isDirectory()) walk(path, nextRelative);
+      else if (stat.isFile()) {
+        entries.push({
+          path: nextRelative,
+          sha256: sha256(readFileSync(path)),
+        });
+      } else throw new Error("admin_runtime_live_skills_entry_rejected");
+    }
+  };
+  if (existsSync(skillsRoot)) walk(skillsRoot);
+  const configPath = join(profileRoot, "config.yaml");
+  let disabled = {};
+  if (existsSync(configPath)) {
+    const document = parseDocument(readFileSync(configPath, "utf8"));
+    if (document.errors.length > 0) {
+      throw new Error("admin_runtime_live_skills_config_rejected");
+    }
+    const skills = document.toJS()?.skills;
+    if (skills && typeof skills === "object" && !Array.isArray(skills)) {
+      disabled = Object.fromEntries(
+        ADMIN_LIVE_SKILLS_CONFIG_KEYS.filter((key) =>
+          Object.prototype.hasOwnProperty.call(skills, key)
+        ).map((key) => [key, skills[key]])
+      );
+    }
+  }
+  return sha256(canonicalJson({ disabled, entries }));
+}
+
+function mergeAdminLiveSkillsConfig(sourceRoot, targetRoot) {
+  const sourcePath = join(sourceRoot, "config.yaml");
+  const targetPath = join(targetRoot, "config.yaml");
+  if (!existsSync(sourcePath) || !existsSync(targetPath)) return;
+  const sourceDocument = parseDocument(readFileSync(sourcePath, "utf8"));
+  const targetDocument = parseDocument(readFileSync(targetPath, "utf8"));
+  if (sourceDocument.errors.length > 0 || targetDocument.errors.length > 0) {
+    throw new Error("admin_runtime_live_skills_config_rejected");
+  }
+  const sourceSkills = sourceDocument.toJS()?.skills;
+  if (
+    !sourceSkills ||
+    typeof sourceSkills !== "object" ||
+    Array.isArray(sourceSkills)
+  ) {
+    return;
+  }
+  for (const key of ADMIN_LIVE_SKILLS_CONFIG_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(sourceSkills, key)) {
+      targetDocument.setIn(["skills", key], structuredClone(sourceSkills[key]));
+    }
+  }
+  atomicPrivateFile(targetPath, targetDocument.toString());
+}
+
 async function materializeAdminProfile({
   profileContract,
   settingsRoot,
@@ -727,7 +814,6 @@ async function materializeAdminProfile({
       },
     });
     installAdminModelConfig(stageRoot, modelConfig);
-    mergeHermesState(profileHome, stageRoot);
     installAdminHermesMemoryHook(stageRoot);
     stageAdminRuntimeTree(stageRoot);
     return stage;
@@ -751,6 +837,16 @@ async function materializeAdminProfile({
           rmSync(stageRoot, { recursive: true, force: true });
           return { status: "RESTAGE", stagedAuthority: finalAuthority };
         }
+        const liveSkillsIdentity = adminPreservedSkillsIdentity(profileHome);
+        mergeHermesState(profileHome, stageRoot);
+        mergeAdminLiveSkillsConfig(profileHome, stageRoot);
+        if (
+          liveSkillsIdentity !== null &&
+          adminPreservedSkillsIdentity(stageRoot) !== liveSkillsIdentity
+        ) {
+          rmSync(stageRoot, { recursive: true, force: true });
+          return { status: "RESTAGE", stagedAuthority: finalAuthority };
+        }
         const stagedSoulPath = join(stageRoot, "SOUL.md");
         const stagedSoul = lstatSync(stagedSoulPath);
         const stagedSoulBytes = readFileSync(stagedSoulPath);

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -4,9 +4,9 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG MCP_PACKAGE=@sellable/mcp@0.1.858
-ARG MCP_INTEGRITY=sha512-8yiUhwMbBk/KxZAXGXTsEHiN8XeB/qCqNgfApew0rhViJqiLlDN8oS67pZW5iB5gdmeuv4du0jx9Lhq/blr9hQ==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.577
+ARG MCP_PACKAGE=@sellable/mcp@0.1.859
+ARG MCP_INTEGRITY=sha512-U5uVeDThuUW/CdWghTXQqTAA58mPDly3XHGmfX6WVjczGQHRcDB+Q49vbrA1MOkGRCnzmjGZN1fIVfFtBlwMPw==
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.581
 ARG TUS_JS_CLIENT_VERSION=4.3.1
 ARG HERMES_VERSION=0.20.0
 ARG TIRITH_VERSION=0.3.3
@@ -59,7 +59,7 @@ RUN --mount=type=secret,id=mcp_trust_root,required=true \
              /etc/cont-init.d/02-reconcile-profiles \
     && npm cache clean --force
 
-COPY mcp-context-proxy.mjs mcp-runtime-binding.mjs fly-customer-model.mjs fly-customer-worker.mjs profile-materializer.mjs hermes-bridge.mjs hermes-memory-snapshot.mjs fly-runtime-identity.mjs fly-soul-bridge.mjs fly-soul-bridge-exec.mjs soul-artifact-validator.mjs model-auth-reconciler.mjs model-auth-canary-reseed.mjs model-health-reporter.mjs \
+COPY mcp-context-proxy.mjs mcp-runtime-binding.mjs fly-customer-model.mjs fly-customer-worker.mjs profile-materializer.mjs hermes-bridge.mjs hermes-memory-snapshot.mjs fly-runtime-identity.mjs fly-soul-bridge.mjs fly-soul-bridge-exec.mjs fly-skills-bridge.mjs fly-skills-bridge-exec.mjs soul-artifact-validator.mjs model-auth-reconciler.mjs model-auth-canary-reseed.mjs model-health-reporter.mjs \
   /usr/local/lib/sellable-agent/
 COPY hermes-memory-dirty.mjs /opt/sellable/bin/hermes-memory-dirty
 COPY hermes-memory-reconcile.sh /opt/sellable/share/hermes-memory-reconcile.sh
@@ -86,9 +86,18 @@ RUN node --input-type=module -e \
       'import("file:///usr/local/lib/sellable-agent/fly-soul-bridge-exec.mjs").then(({ runFlySoulBridgeExecCli }) => runFlySoulBridgeExecCli());' \
       > /usr/local/bin/sellable-soul-bridge-exec \
     && chmod 0555 /usr/local/bin/sellable-soul-bridge-exec \
+    && printf '%s\n' \
+      '#!/usr/bin/env node' \
+      'import("file:///usr/local/lib/sellable-agent/fly-skills-bridge-exec.mjs").then(({ runFlySkillsBridgeExecCli }) => runFlySkillsBridgeExecCli());' \
+      > /usr/local/bin/sellable-skills-bridge-exec \
+    && chmod 0555 /usr/local/bin/sellable-skills-bridge-exec \
     && sha256sum /usr/local/lib/sellable-agent/fly-soul-bridge.mjs \
       > /usr/local/share/sellable-agent/soul-bridge-source.sha256 \
+    && sha256sum /usr/local/lib/sellable-agent/fly-skills-bridge.mjs \
+      /usr/local/lib/sellable-agent/fly-skills-bridge-exec.mjs \
+      > /usr/local/share/sellable-agent/skills-bridge-source.sha256 \
     && chmod 0444 /usr/local/share/sellable-agent/soul-bridge-source.sha256 \
+      /usr/local/share/sellable-agent/skills-bridge-source.sha256 \
     && chmod 0755 /etc \
     && chmod 0555 /usr/local/lib/sellable-agent/*.mjs \
     && chmod 0555 /opt/sellable/bin/hermes-memory-dirty /opt/sellable/bin/hermes-endpoint-cron \

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -93,11 +93,9 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.20.0";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ??
-  "@sellable/install@0.1.577";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.581";
 const MCP_PACKAGE =
-  process.env.SELLABLE_AGENT_MCP_PACKAGE ??
-  "@sellable/mcp@0.1.858";
+  process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.859";
 
 const sha256 = (value) => createHash("sha256").update(value).digest("hex");
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -1639,6 +1637,16 @@ function writeRuntimeHermesConfig({
   );
   const sellable = baseConfig.mcp_servers?.sellable;
   if (!sellable?.env) throw new Error("customer_mcp_config_rejected");
+  const adminServer = baseConfig.mcp_servers?.["sellable-admin"];
+  if (adminServer?.command && existsSync(adminServer.command)) {
+    // The admin MCP installer has shipped this wrapper without an execute
+    // bit; repair it here so a config refresh never revives a dead admin
+    // server entry.
+    const wrapperMode = lstatSync(adminServer.command).mode;
+    if ((wrapperMode & 0o100) === 0) {
+      chmodSync(adminServer.command, wrapperMode | 0o100);
+    }
+  }
   // The named-profile materializer owns the one canonical SOUL file and seeds
   // it only when absent. Runtime config refreshes must never rewrite live SOUL
   // or create a root-level second copy.
@@ -1699,6 +1707,23 @@ function writeRuntimeHermesConfig({
       : {
           ...modelConfig,
         }),
+    provider_routing: {
+      // OpenRouter provider selection defaults to highest throughput; an
+      // explicit profile value always wins.
+      sort: "throughput",
+      ...(baseConfig.provider_routing ?? {}),
+    },
+    auxiliary: {
+      ...(baseConfig.auxiliary ?? {}),
+      vision: {
+        // Non-vision main models (e.g. deepseek) need a working vision
+        // auxiliary; the Nous portal has no credentials on customer
+        // machines, so image input silently fails without this default.
+        provider: "openrouter",
+        model: "google/gemini-3.5-flash",
+        ...(baseConfig.auxiliary?.vision ?? {}),
+      },
+    },
     mcp_servers: {
       ...baseConfig.mcp_servers,
       sellable: {

package/lib/sellable-agent/fly-skills-bridge-exec.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  FlySkillsBridgeError,
+  SKILLS_REQUEST_MAX_BYTES,
+  executeExternalSkillsBridgeOperation,
+} from "./fly-skills-bridge.mjs";
+
+export async function runFlySkillsBridgeExecCli() {
+  try {
+    if (process.argv.length !== 2)
+      throw new FlySkillsBridgeError("skills_request_rejected");
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of process.stdin) {
+      total += chunk.length;
+      if (total > SKILLS_REQUEST_MAX_BYTES)
+        throw new FlySkillsBridgeError("skills_request_too_large");
+      chunks.push(chunk);
+    }
+    let request;
+    try {
+      request = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    } catch {
+      throw new FlySkillsBridgeError("skills_request_rejected");
+    }
+    const result = executeExternalSkillsBridgeOperation(request);
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    process.exitCode = result.ok ? 0 : 2;
+  } catch (error) {
+    process.stdout.write(
+      `${JSON.stringify({ ok: false, code: error instanceof FlySkillsBridgeError ? error.code : "skills_bridge_failed" })}\n`
+    );
+    process.exitCode = 2;
+  }
+}
+
+if (
+  resolve(process.argv[1] ?? "") === resolve(fileURLToPath(import.meta.url))
+) {
+  await runFlySkillsBridgeExecCli();
+}