@sellable/install 0.1.794 → 0.1.796

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs

@@ -0,0 +1,611 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import {
+  appendFileSync,
+  lstatSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { createServer } from "node:http";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  endpointHermesSessionId,
+  endpointMcpDescriptorPath,
+} from "../mcp-context-proxy.mjs";
+import { validateOpenerOutputContract } from "./hermes-runs-client.mjs";
+import {
+  parseRunsApiConnections,
+  RUNS_API_CONNECTIONS_ENV,
+} from "./runs-api-connections.mjs";
+
+const MAX_BODY = 320 * 1024;
+const MAX_OUTPUT = 48 * 1024;
+const MAX_CLI_OUTPUT = 512 * 1024;
+const MCP_SESSION = fileURLToPath(
+  new URL("./claude-code-mcp-session.mjs", import.meta.url)
+);
+const hash = (s) => createHash("sha256").update(s).digest("hex");
+const record = (v) => v && typeof v === "object" && !Array.isArray(v);
+
+export function validateClaudeRunsRequest(body, models) {
+  const allowed = [
+    "input",
+    "instructions",
+    "conversation_history",
+    "session_id",
+    "provider",
+    "model",
+    "model_options",
+  ];
+  if (
+    !record(body) ||
+    Object.keys(body).some((k) => !allowed.includes(k)) ||
+    typeof body.input !== "string" ||
+    !body.input.length ||
+    Buffer.byteLength(body.input) > 128 * 1024 ||
+    typeof body.instructions !== "string" ||
+    !body.instructions.length ||
+    Buffer.byteLength(body.instructions) > 128 * 1024 ||
+    !Array.isArray(body.conversation_history) ||
+    body.conversation_history.length > 64 ||
+    Buffer.byteLength(JSON.stringify(body.conversation_history)) > 128 * 1024 ||
+    body.conversation_history.some(
+      (item) =>
+        !record(item) ||
+        Object.keys(item).sort().join(",") !== "content,role" ||
+        !["user", "assistant"].includes(item.role) ||
+        typeof item.content !== "string"
+    ) ||
+    !/^sellable_endpoint_[a-f0-9]{32}$/.test(body.session_id ?? "") ||
+    body.provider !== "claude-code" ||
+    !record(body.model_options) ||
+    Object.keys(body.model_options).some(
+      (key) =>
+        !["reasoning_effort", "sellable_opener_output_contract"].includes(key)
+    ) ||
+    !models.some(
+      (model) =>
+        model.provider === body.provider &&
+        model.model === body.model &&
+        model.reasoningEfforts.includes(body.model_options.reasoning_effort)
+    )
+  )
+    throw new Error("claude_runs_request_rejected");
+  const contract = body.model_options.sellable_opener_output_contract;
+  const schema =
+    contract === undefined
+      ? null
+      : validateOpenerOutputContract(contract).schema;
+  return {
+    input: body.conversation_history.length
+      ? JSON.stringify({
+          conversation_history: body.conversation_history,
+          input: body.input,
+        })
+      : body.input,
+    instructions: body.instructions,
+    schema,
+    model: body.model,
+    effort: body.model_options.reasoning_effort,
+    sessionId: body.session_id,
+    tools: null,
+  };
+}
+
+/**
+ * A tool-lane run's own allowed tools, read from the signed turn descriptor
+ * the runtime installed for its session before submitting; null when the run
+ * is not on a tool endpoint. This only narrows: the context proxy verifies the
+ * descriptor itself before it lists or calls any tool.
+ */
+export function endpointToolNames({
+  turnDescriptorPath,
+  sessionId,
+  toolEndpointIds,
+}) {
+  const path = endpointMcpDescriptorPath(turnDescriptorPath, sessionId);
+  if (!path) return null;
+  try {
+    if (!lstatSync(path).isFile())
+      throw new Error("claude_runs_tool_descriptor_rejected");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  const body = JSON.parse(readFileSync(path, "utf8"))?.body;
+  if (!toolEndpointIds.includes(body?.endpointId)) return null;
+  const names = body.allowedToolNames;
+  if (
+    endpointHermesSessionId(body) !== sessionId ||
+    !Array.isArray(names) ||
+    !names.length ||
+    names.some(
+      (name) => typeof name !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(name)
+    )
+  )
+    throw new Error("claude_runs_tool_descriptor_rejected");
+  return [...names];
+}
+
+export function claudeInvocation(request, root, mcpSpecPath = null) {
+  return {
+    command: `${root}/cli/node_modules/.bin/claude`,
+    args: [
+      "-p",
+      "--model",
+      request.model,
+      "--effort",
+      request.effort,
+      "--output-format",
+      "json",
+      ...(request.schema
+        ? ["--json-schema", JSON.stringify(request.schema)]
+        : []),
+      "--tools",
+      "",
+      "--permission-mode",
+      "dontAsk",
+      "--strict-mcp-config",
+      "--mcp-config",
+      // A tool lane's only MCP server is the run's own session wrapper; its
+      // allowed tools are exactly the descriptor's. Every other run has none.
+      ...(request.tools
+        ? [
+            JSON.stringify({
+              mcpServers: {
+                sellable: {
+                  command: process.execPath,
+                  args: [MCP_SESSION, mcpSpecPath],
+                },
+              },
+            }),
+            "--allowedTools",
+            request.tools.names
+              .map((name) => `mcp__sellable__${name}`)
+              .join(","),
+          ]
+        : ['{"mcpServers":{}}']),
+      "--setting-sources",
+      "",
+      "--settings",
+      '{"disableAllHooks":true,"autoMemoryEnabled":false}',
+      "--disable-slash-commands",
+      "--no-session-persistence",
+      "--max-turns",
+      request.tools ? "16" : "3",
+      "--system-prompt",
+      request.instructions,
+    ],
+    // Whitelist instead of inheriting the runtime's provider keys, URLs, hooks,
+    // plugin paths, NODE_OPTIONS, or workspace access credentials.
+    options: {
+      cwd: `${root}/work`,
+      detached: true,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: {
+        PATH: "/usr/local/bin:/usr/bin:/bin",
+        HOME: `${root}/claude`,
+        CLAUDE_CONFIG_DIR: `${root}/claude`,
+        LANG: "C.UTF-8",
+        CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+      },
+    },
+  };
+}
+
+export function parseClaudeResult(stdout, request) {
+  const result = JSON.parse(stdout);
+  const models = Object.keys(result.modelUsage ?? {});
+  if (
+    result.type !== "result" ||
+    result.is_error !== false ||
+    result.subtype !== "success" ||
+    (request.schema
+      ? !record(result.structured_output)
+      : typeof result.result !== "string") ||
+    (result.permission_denials ?? []).length ||
+    !models.length ||
+    models.some(
+      (model) =>
+        model !== request.model && !model.startsWith(`${request.model}-`)
+    )
+  )
+    throw new Error("claude_runs_output_rejected");
+  const output = request.schema
+    ? JSON.stringify(result.structured_output)
+    : result.result;
+  if (!output.trim()) throw new Error("claude_runs_output_empty");
+  if (Buffer.byteLength(output) > MAX_OUTPUT)
+    throw new Error("claude_runs_output_too_large");
+  return {
+    output,
+    runtime: { provider: "claude-code", model: models[0] },
+    usage: {
+      input_tokens: result.usage?.input_tokens ?? 0,
+      output_tokens: result.usage?.output_tokens ?? 0,
+      cache_read_tokens: result.usage?.cache_read_input_tokens ?? 0,
+      cache_write_tokens: result.usage?.cache_creation_input_tokens ?? 0,
+    },
+  };
+}
+
+export function startClaudeRun(
+  request,
+  { root, spawnImpl = spawn, timeoutMs = 750_000 } = {}
+) {
+  // The tool server's environment travels in a private per-run file, never
+  // in argv, and is removed when the run ends.
+  const mcpSpecPath = request.tools
+    ? join(root, "work", `mcp-session-${randomBytes(12).toString("hex")}.json`)
+    : null;
+  if (mcpSpecPath)
+    writeFileSync(
+      mcpSpecPath,
+      JSON.stringify({ sessionId: request.sessionId, ...request.tools.server }),
+      { mode: 0o600, flag: "wx" }
+    );
+  const removeSpec = () => {
+    if (mcpSpecPath) rmSync(mcpSpecPath, { force: true });
+  };
+  const invocation = claudeInvocation(request, root, mcpSpecPath);
+  let child;
+  try {
+    child = spawnImpl(invocation.command, invocation.args, invocation.options);
+  } catch (error) {
+    removeSpec();
+    throw error;
+  }
+  let reason = null;
+  let killTimer;
+  const stop = (code = "claude_runs_cancelled") => {
+    reason ??= code;
+    try {
+      process.kill(-child.pid, "SIGTERM");
+    } catch {
+      child.kill("SIGTERM");
+    }
+    killTimer ??= setTimeout(() => {
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        child.kill("SIGKILL");
+      }
+    }, 5_000);
+    killTimer.unref();
+  };
+  const promise = new Promise((resolve, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    const timer = setTimeout(() => stop("claude_runs_timeout"), timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > MAX_CLI_OUTPUT) stop("claude_runs_output_too_large");
+      else chunks.push(chunk);
+    });
+    // Drain diagnostics without logging prompts, credentials, or message bodies.
+    child.stderr.on("data", () => {});
+    child.once("error", () => {
+      clearTimeout(timer);
+      removeSpec();
+      reject(new Error("claude_runs_cli_unavailable"));
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      removeSpec();
+      if (reason || code !== 0)
+        return reject(new Error(reason ?? "claude_runs_cli_failed"));
+      try {
+        resolve(
+          parseClaudeResult(Buffer.concat(chunks).toString("utf8"), request)
+        );
+      } catch {
+        reject(new Error("claude_runs_output_rejected"));
+      }
+    });
+    child.stdin.on("error", () => {});
+    child.stdin.end(request.input);
+  });
+  return { promise, stop };
+}
+
+export function createClaudeRunsApi({
+  token,
+  connection,
+  execute = (request) =>
+    startClaudeRun(request, { root: connection.localRoot }),
+  audit = () => {},
+  maxConcurrency = 2,
+  // Tool lanes (replies, follow-ups) have their own slots so a batch of
+  // openers can never crowd them out.
+  maxToolConcurrency = 2,
+  toolLanes = null,
+} = {}) {
+  if (!/^[a-f0-9]{64}$/.test(token ?? ""))
+    throw new Error("claude_runs_key_rejected");
+  // The run's own tools and the profile's MCP server, or null for a tool-free run.
+  const resolveTools = (request) => {
+    if (!connection.toolEndpointIds || !toolLanes) return null;
+    const names = endpointToolNames({
+      turnDescriptorPath: toolLanes.turnDescriptorPath,
+      sessionId: request.sessionId,
+      toolEndpointIds: connection.toolEndpointIds,
+    });
+    if (!names) return null;
+    const server = toolLanes.server();
+    if (!server) throw new Error("claude_runs_tool_server_unavailable");
+    return {
+      names,
+      server: {
+        command: server.command,
+        args: [...server.args],
+        env: { PATH: "/usr/local/bin:/usr/bin:/bin", ...server.env },
+      },
+    };
+  };
+  const recordAudit = (entry) => {
+    try {
+      audit(entry);
+    } catch {
+      /* Logging cannot crash the Admin runtime. */
+    }
+  };
+  const runs = new Map();
+  const inFlight = { plain: 0, tools: 0 };
+  const limits = { plain: maxConcurrency, tools: maxToolConcurrency };
+  const full = (pool) => inFlight[pool] >= limits[pool] || runs.size >= 200;
+  const json = (res, status, body) => {
+    res.writeHead(status, {
+      "content-type": "application/json",
+      "cache-control": "no-store",
+      "retry-after": "2",
+    });
+    res.end(JSON.stringify(body));
+  };
+  const terminal = (run, event, fields) => {
+    Object.assign(run, fields);
+    run.event = {
+      event,
+      run_id: run.run_id,
+      timestamp: new Date().toISOString(),
+      ...(run.status === "completed"
+        ? { output: run.output, runtime: run.runtime, usage: run.usage }
+        : run.status === "failed"
+          ? { error: run.error }
+          : {}),
+    };
+    for (const res of run.listeners)
+      res.end(`data: ${JSON.stringify(run.event)}\n\n`);
+    run.listeners.clear();
+    recordAudit({
+      runId: run.run_id,
+      status: run.status,
+      toolLane: run.pool === "tools",
+      servedRuntime: run.runtime ?? null,
+      usage: run.usage ?? null,
+      durationMs: Date.now() - run.startedAt,
+      outputDigest: run.output ? hash(run.output) : null,
+    });
+    setTimeout(() => runs.delete(run.run_id), 3_600_000).unref();
+  };
+  const server = createServer(async (req, res) => {
+    const provided = Buffer.from(req.headers.authorization ?? "");
+    const expected = Buffer.from(`Bearer ${token}`);
+    if (
+      provided.length !== expected.length ||
+      !timingSafeEqual(provided, expected)
+    )
+      return json(res, 401, { error: "claude_runs_auth_required" });
+    if (
+      req.headers["x-sellable-workspace-id"] !== connection.workspaceId ||
+      req.headers["x-sellable-agent-id"] !== connection.agentId
+    )
+      return json(res, 403, { error: "claude_runs_scope_rejected" });
+    if (req.method === "GET" && req.url === "/health")
+      return json(res, 200, {
+        ok: true,
+        provider: "claude-code",
+        active: inFlight.plain + inFlight.tools,
+        toolActive: inFlight.tools,
+        scope: {
+          workspaceId: connection.workspaceId,
+          agentId: connection.agentId,
+        },
+      });
+    if (req.method === "POST" && req.url === "/v1/runs") {
+      if (full("plain") && (!connection.toolEndpointIds || full("tools")))
+        return json(res, 429, { error: "claude_runs_busy" });
+      let request;
+      try {
+        let size = 0;
+        const chunks = [];
+        for await (const chunk of req) {
+          size += chunk.length;
+          if (size > MAX_BODY) {
+            json(res, 413, { error: "claude_runs_input_too_large" });
+            return;
+          }
+          chunks.push(chunk);
+        }
+        const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        request = validateClaudeRunsRequest(body, connection.models);
+        request.tools = resolveTools(request);
+      } catch (error) {
+        recordAudit({
+          status: "request-rejected",
+          reason: /^claude_runs_[a-z_]+$/.test(error.message ?? "")
+            ? error.message
+            : "claude_runs_invalid_request",
+        });
+        return json(res, 400, { error: "claude_runs_request_rejected" });
+      }
+      // Check again after reading: concurrent uploads cannot over-admit.
+      const pool = request.tools ? "tools" : "plain";
+      if (full(pool)) return json(res, 429, { error: "claude_runs_busy" });
+      const run = {
+        run_id: `run_${randomBytes(16).toString("hex")}`,
+        status: "running",
+        startedAt: Date.now(),
+        listeners: new Set(),
+        consumed: false,
+        pool,
+      };
+      inFlight[pool]++;
+      runs.set(run.run_id, run);
+      try {
+        run.execution = execute(request);
+        run.execution.promise
+          .then(
+            (result) =>
+              terminal(run, "run.completed", {
+                status: "completed",
+                ...result,
+              }),
+            (error) =>
+              terminal(
+                run,
+                run.stopping && error.message === "claude_runs_cancelled"
+                  ? "run.cancelled"
+                  : "run.failed",
+                run.stopping && error.message === "claude_runs_cancelled"
+                  ? { status: "cancelled" }
+                  : { status: "failed", error: "claude_runs_generation_failed" }
+              )
+          )
+          .finally(() => inFlight[pool]--);
+      } catch {
+        inFlight[pool]--;
+        terminal(run, "run.failed", {
+          status: "failed",
+          error: "claude_runs_cli_unavailable",
+        });
+      }
+      return json(res, 202, { run_id: run.run_id, status: "started" });
+    }
+    const match =
+      /^\/v1\/runs\/(run_[a-f0-9]{32})(?:\/(events|stop|approval))?$/.exec(
+        req.url ?? ""
+      );
+    const run = match && runs.get(match[1]);
+    if (!run) return json(res, 404, { error: "claude_runs_run_missing" });
+    if (req.method === "GET" && !match[2])
+      return json(res, 200, {
+        run_id: run.run_id,
+        status: run.status,
+        ...(run.output
+          ? { output: run.output, runtime: run.runtime, usage: run.usage }
+          : {}),
+        ...(run.error ? { error: run.error } : {}),
+      });
+    if (req.method === "GET" && match[2] === "events") {
+      if (run.consumed)
+        return json(res, 404, { error: "claude_runs_events_consumed" });
+      run.consumed = true;
+      res.writeHead(200, {
+        "content-type": "text/event-stream",
+        "cache-control": "no-store",
+      });
+      res.flushHeaders();
+      if (run.event) return res.end(`data: ${JSON.stringify(run.event)}\n\n`);
+      run.listeners.add(res);
+      const heartbeat = setInterval(
+        () => res.write(": keep-alive\n\n"),
+        15_000
+      );
+      res.once("close", () => {
+        clearInterval(heartbeat);
+        run.listeners.delete(res);
+      });
+      return;
+    }
+    if (req.method === "POST" && match[2] === "stop") {
+      if (run.event)
+        return json(res, 200, {
+          run_id: run.run_id,
+          status: run.status,
+          ...(run.output
+            ? { output: run.output, runtime: run.runtime, usage: run.usage }
+            : {}),
+        });
+      run.stopping = true;
+      run.execution.stop();
+      return json(res, 200, { run_id: run.run_id, status: "stopping" });
+    }
+    return json(res, 405, { error: "claude_runs_method_rejected" });
+  });
+  server.stopActiveRuns = async () => {
+    const activeRuns = [...runs.values()].filter(
+      (run) => !run.event && run.execution
+    );
+    for (const run of activeRuns) {
+      run.stopping = true;
+      run.execution.stop();
+    }
+    await Promise.allSettled(activeRuns.map((run) => run.execution.promise));
+  };
+  return server;
+}
+
+// The Admin runtime owns these listeners for its lifetime. Image-owned startup
+// plus the persistent CLI/auth directory makes normal restarts repeatable.
+export async function startConfiguredClaudeRunsApis({
+  env = process.env,
+  diagnostic = () => {},
+  createApi = createClaudeRunsApi,
+  readToken = (path) => readFileSync(path, "utf8").trim(),
+  toolLanes = null,
+} = {}) {
+  const services = [];
+  for (const connection of parseRunsApiConnections(
+    env[RUNS_API_CONNECTIONS_ENV]
+  )) {
+    if (
+      !connection.localRoot ||
+      connection.runtimeId !== env.SELLABLE_RUNTIME_ID
+    )
+      continue;
+    try {
+      const token = readToken(connection.apiKeyFile);
+      const server = createApi({
+        token,
+        connection,
+        toolLanes,
+        audit: (entry) =>
+          appendFileSync(
+            `${connection.localRoot}/audit.jsonl`,
+            `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`,
+            { mode: 0o600 }
+          ),
+      });
+      await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(
+          Number(new URL(connection.baseUrl).port),
+          "127.0.0.1",
+          resolve
+        );
+      });
+      services.push(server);
+      diagnostic({
+        ok: true,
+        code: "claude_runs_api_ready",
+        baseUrl: connection.baseUrl,
+      });
+    } catch {
+      diagnostic({ ok: false, code: "claude_runs_api_unavailable" });
+    }
+  }
+  return {
+    async stop() {
+      for (const server of services) {
+        await server.stopActiveRuns();
+        await new Promise((resolve) => {
+          server.close(resolve);
+          server.closeAllConnections();
+        });
+      }
+    },
+  };
+}

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -93,12 +93,12 @@ import {
   validateEndpointUatCompletionControl,
 } from "./endpoint-uat-completion-gate.mjs";
 import {
-  createHermesRunsClient,
   createHermesSessionRetention,
   HERMES_RUNS_FIXTURE_IDENTITY,
   validateEndpointModelSelection,
   validateOpenerOutputContract,
 } from "./hermes-runs-client.mjs";
+import { createConfiguredRunsClient } from "./runs-api-connections.mjs";
 import {
   createOpenerStageExecution,
   usesOpenerDraftStrategy,
@@ -126,7 +126,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.794";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.796";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.957";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;
@@ -1605,8 +1605,7 @@ export function createCustomerEndpointRelay(options = {}) {
     runtimeGeneration,
     getApiKeyFile = ({ claim }) =>
       join(SECRET_ROOT, claim.runtime.profileId, "api-server-key"),
-    createRunsClient = ({ apiKeyFile }) =>
-      createHermesRunsClient({ apiKeyFile }),
+    createRunsClient = createConfiguredRunsClient,
     now = () => new Date(),
     sleepImpl = sleep,
     diagnostic = () => {},

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.d.mts

@@ -0,0 +1,22 @@
+export const ENDPOINT_MODEL_SELECTION_ALLOWLIST: Readonly<{
+  openrouter: readonly [
+    "anthropic/claude-opus-5.5",
+    "anthropic/claude-sonnet-5.5",
+  ];
+}>;
+export const ENDPOINT_MODEL_REASONING_EFFORTS: readonly [
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+];
+export type EndpointModelSelection = Readonly<{
+  provider: string;
+  model: string;
+  reasoningEffort: (typeof ENDPOINT_MODEL_REASONING_EFFORTS)[number];
+  runsApiBaseUrl?: string;
+}>;
+export function normalizeRunsApiBaseUrl(value: unknown): string | null;
+export function compileEndpointModelSelection(
+  value: unknown
+): EndpointModelSelection | null | "invalid";