@sellable/install 0.1.794 → 0.1.796

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.794
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.796
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.794" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.796" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.957" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.794" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.794' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.796' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.794', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.796', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.794` is
+`@sellable/install@0.1.796` is
 published:
 
 ```sh

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -169,6 +169,7 @@ COPY fly-admin-image/start-admin-runtime /usr/local/lib/sellable-agent/admin-run
 COPY fly-customer-image/customer-runtime.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime.mjs
 COPY hermes-first-welcome.mjs /usr/local/lib/sellable-agent/hermes-first-welcome.mjs
 COPY fly-customer-image/hermes-runs-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs
+COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/claude-code-runs-api.mjs fly-customer-image/claude-code-mcp-session.mjs /usr/local/lib/sellable-agent/fly-customer-image/
 COPY fly-customer-image/opener-stage-execution.mjs /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs
 COPY fly-customer-image/endpoint-uat-completion-gate.mjs /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs
 COPY fly-customer-image/customer-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime-phase-telemetry.mjs
@@ -272,6 +273,10 @@ RUN set -eux; \
       /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime-phase-telemetry.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs \
+      /usr/local/lib/sellable-agent/fly-customer-image/endpoint-model-selection.mjs \
+      /usr/local/lib/sellable-agent/fly-customer-image/runs-api-connections.mjs \
+      /usr/local/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs \
+      /usr/local/lib/sellable-agent/fly-customer-image/claude-code-mcp-session.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs \
       /usr/local/lib/sellable-agent/admin-native-gateway-supervisor.mjs \

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -63,6 +63,7 @@ import {
 } from "../fly-capabilities-bridge.mjs";
 import { createCustomerEndpointRelay } from "../fly-customer-image/customer-runtime.mjs";
 import { createHermesSessionRetention } from "../fly-customer-image/hermes-runs-client.mjs";
+import { startConfiguredClaudeRunsApis } from "../fly-customer-image/claude-code-runs-api.mjs";
 import {
   claimWithSoulObservation,
   createFlyCustomerControlClient,
@@ -900,6 +901,32 @@ function installAdminMcpRuntimeBinding(
   );
 }
 
+// The profile's `sellable` MCP server exactly as Hermes runs it, so a Claude
+// Code tool-lane run sees the same tools, through the same context proxy.
+function profileSellableMcpServer(profileRoot) {
+  const path = join(profileRoot, "config.yaml");
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isFile()) return null;
+  const document = parseDocument(readFileSync(path, "utf8"));
+  if (document.errors.length > 0) return null;
+  const server = document.toJS().mcp_servers?.sellable;
+  if (
+    server?.command !== NODE ||
+    JSON.stringify(server.args) !== JSON.stringify([MCP_CONTEXT_PROXY]) ||
+    !server.env ||
+    typeof server.env !== "object"
+  ) {
+    return null;
+  }
+  return {
+    command: NODE,
+    args: [MCP_CONTEXT_PROXY],
+    env: Object.fromEntries(
+      Object.entries(server.env).map(([key, value]) => [key, String(value)])
+    ),
+  };
+}
+
 function installAdminModelConfig(profileRoot, modelConfig) {
   const path = join(profileRoot, "config.yaml");
   const stat = lstatSync(path);
@@ -3817,6 +3844,21 @@ async function runAdminProduction() {
   let activeLaunch = null;
   let activeModelHealthReporter = null;
   let shutdownMemorySnapshot = null;
+  let customRunsServices = null;
+  try {
+    customRunsServices = await startConfiguredClaudeRunsApis({
+      diagnostic: value => process.stderr.write(`${JSON.stringify(value)}\n`),
+      toolLanes: {
+        turnDescriptorPath: join(MCP_TURN_CONTEXT_ROOT, "turn-context.json"),
+        server: () =>
+          activeLaunch
+            ? profileSellableMcpServer(activeLaunch.profile.profileHome)
+            : null,
+      },
+    });
+  } catch {
+    process.stderr.write(`${JSON.stringify({ ok: false, code: "custom_runs_api_start_failed" })}\n`);
+  }
   const endpointRelay = createCustomerEndpointRelay({
     getControlClient: () => client,
     getActiveRuntime: () =>
@@ -4453,6 +4495,7 @@ async function runAdminProduction() {
     );
   }
   await endpointLoop;
+  await customRunsServices?.stop();
   await activeModelHealthReporter?.stop();
   await stopNativeGateway(activeGateway);
   await clearRuntimeSecrets();

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.794
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.796
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.202
 ARG ADMIN_MCP_INTEGRITY=sha512-ym3aye/0vQ8tfULJlKz9JFOxvIQsl1G+n3np+TTgK/tecwNblBo/j3AkTnRqH9iomKzPbZzP+n4tEQsvsU8ByA==
 ARG TUS_JS_CLIENT_VERSION=4.3.1
@@ -98,6 +98,7 @@ COPY hermes-memory-reconcile.sh /opt/sellable/share/hermes-memory-reconcile.sh
 COPY hermes-endpoint-cron.mjs /opt/sellable/bin/hermes-endpoint-cron
 COPY fly-customer-image/model-auth-store.mjs /usr/local/lib/sellable-agent/fly-customer-image/model-auth-store.mjs
 COPY fly-customer-image/hermes-runs-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs
+COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs /usr/local/lib/sellable-agent/fly-customer-image/
 COPY fly-customer-image/opener-stage-execution.mjs /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs
 COPY fly-customer-image/endpoint-uat-completion-gate.mjs /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs
 COPY fly-customer-image/customer-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime-phase-telemetry.mjs

package/lib/sellable-agent/fly-customer-image/claude-code-mcp-session.d.mts

@@ -0,0 +1 @@
+export function tagEndpointSession(line: string, sessionId: string): string;

package/lib/sellable-agent/fly-customer-image/claude-code-mcp-session.mjs

@@ -0,0 +1,53 @@
+// Claude Code's only MCP server for a tool-lane run. It starts the profile's
+// own `sellable` server (the context proxy, with exactly its configured
+// environment) and adds this run's endpoint session to every tools/list and
+// tools/call. The proxy then loads the run's signed turn descriptor, lists
+// only the run's allowed tools and stamps the run identity on each call; the
+// backend checks it again. Nothing in this file grants anything.
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+
+export function tagEndpointSession(line, sessionId) {
+  let message;
+  try {
+    message = JSON.parse(line);
+  } catch {
+    return line;
+  }
+  if (
+    !message ||
+    typeof message !== "object" ||
+    !["tools/list", "tools/call"].includes(message.method)
+  )
+    return line;
+  const params =
+    message.params && typeof message.params === "object" ? message.params : {};
+  // The proxy accepts exactly this shape and nothing else in _meta.
+  return JSON.stringify({
+    ...message,
+    params: { ...params, _meta: { sellableEndpoint: { sessionId } } },
+  });
+}
+
+function main(specPath) {
+  const spec = JSON.parse(readFileSync(specPath, "utf8"));
+  if (!/^sellable_endpoint_[a-f0-9]{32}$/.test(spec.sessionId ?? ""))
+    throw new Error("claude_runs_mcp_session_rejected");
+  const child = spawn(spec.command, spec.args, {
+    stdio: ["pipe", "inherit", "ignore"],
+    env: spec.env,
+  });
+  child.once("exit", (code) => process.exit(code ?? 1));
+  child.stdin.on("error", () => {});
+  const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  lines.on("line", (line) =>
+    child.stdin.write(`${tagEndpointSession(line, spec.sessionId)}\n`)
+  );
+  lines.on("close", () => child.stdin.end());
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  main(process.argv[2]);
+}

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.d.mts

@@ -0,0 +1,77 @@
+import type { SpawnOptions } from "node:child_process";
+import type { Server } from "node:http";
+import type { RunsApiConnection } from "./runs-api-connections.mjs";
+
+export type ClaudeRunsRequest = {
+  input: string;
+  instructions: string;
+  schema: Record<string, unknown> | null;
+  model: string;
+  effort: string;
+  sessionId: string;
+  tools: ClaudeRunsTools | null;
+};
+export type ClaudeRunsToolServer = {
+  command: string;
+  args: string[];
+  env: Record<string, string>;
+};
+export type ClaudeRunsTools = { names: string[]; server: ClaudeRunsToolServer };
+export type ClaudeRunsToolLanes = {
+  turnDescriptorPath: string;
+  server(): ClaudeRunsToolServer | null;
+};
+export type ClaudeRunsResult = {
+  output: string;
+  runtime: { provider: string; model: string };
+  usage: Record<string, number>;
+};
+export type ClaudeRunsServer = Server & { stopActiveRuns(): Promise<void> };
+export type ClaudeRunsApiOptions = {
+  token: string;
+  connection: RunsApiConnection;
+  execute?: (request: ClaudeRunsRequest) => {
+    promise: Promise<ClaudeRunsResult>;
+    stop(): void;
+  };
+  audit?: (entry: Record<string, unknown>) => void;
+  maxConcurrency?: number;
+  maxToolConcurrency?: number;
+  toolLanes?: ClaudeRunsToolLanes | null;
+};
+export function validateClaudeRunsRequest(
+  body: unknown,
+  models: RunsApiConnection["models"]
+): ClaudeRunsRequest;
+export function endpointToolNames(options: {
+  turnDescriptorPath: string;
+  sessionId: string;
+  toolEndpointIds: string[];
+}): string[] | null;
+export function claudeInvocation(
+  request: ClaudeRunsRequest,
+  root: string,
+  mcpSpecPath?: string | null
+): { command: string; args: string[]; options: SpawnOptions };
+export function parseClaudeResult(
+  stdout: string,
+  request: ClaudeRunsRequest
+): ClaudeRunsResult;
+export function startClaudeRun(
+  request: ClaudeRunsRequest,
+  options: {
+    root: string;
+    spawnImpl?: (...args: any[]) => any;
+    timeoutMs?: number;
+  }
+): { promise: Promise<ClaudeRunsResult>; stop(code?: string): void };
+export function createClaudeRunsApi(
+  options: ClaudeRunsApiOptions
+): ClaudeRunsServer;
+export function startConfiguredClaudeRunsApis(options?: {
+  env?: Record<string, string | undefined>;
+  diagnostic?: (entry: Record<string, unknown>) => void;
+  createApi?: typeof createClaudeRunsApi;
+  readToken?: (path: string) => string;
+  toolLanes?: ClaudeRunsToolLanes | null;
+}): Promise<{ stop(): Promise<void> }>;