@sellable/install 0.1.794 → 0.1.796

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.mjs

@@ -0,0 +1,84 @@
+// Shared by the control plane and the runtime. A custom Runs API is only a
+// requested destination here; the runtime must also match a trusted connection.
+export const ENDPOINT_MODEL_SELECTION_ALLOWLIST = Object.freeze({
+  openrouter: Object.freeze([
+    "anthropic/claude-opus-5.5",
+    "anthropic/claude-sonnet-5.5",
+  ]),
+});
+export const ENDPOINT_MODEL_REASONING_EFFORTS = Object.freeze([
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+]);
+
+export function normalizeRunsApiBaseUrl(value) {
+  if (
+    typeof value !== "string" ||
+    value.length > 1_024 ||
+    value !== value.trim()
+  )
+    return null;
+  try {
+    const url = new URL(value);
+    if (
+      url.username ||
+      url.password ||
+      url.search ||
+      url.hash ||
+      /[\\\s]/.test(value) ||
+      (url.protocol !== "https:" &&
+        !(
+          url.protocol === "http:" &&
+          ["127.0.0.1", "[::1]"].includes(url.hostname)
+        ))
+    )
+      return null;
+    return `${url.origin}${url.pathname.replace(/\/$/, "")}`;
+  } catch {
+    return null;
+  }
+}
+
+export function compileEndpointModelSelection(value) {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== "object" || Array.isArray(value)) return "invalid";
+  const custom = Object.hasOwn(value, "runsApiBaseUrl");
+  if (
+    Object.keys(value).sort().join(",") !==
+    (custom
+      ? "model,provider,reasoningEffort,runsApiBaseUrl"
+      : "model,provider,reasoningEffort")
+  )
+    return "invalid";
+  const { provider, model, reasoningEffort } = value;
+  if (
+    typeof provider !== "string" ||
+    typeof model !== "string" ||
+    !ENDPOINT_MODEL_REASONING_EFFORTS.includes(reasoningEffort)
+  )
+    return "invalid";
+  if (
+    !custom &&
+    (!Object.hasOwn(ENDPOINT_MODEL_SELECTION_ALLOWLIST, provider) ||
+      !ENDPOINT_MODEL_SELECTION_ALLOWLIST[provider].includes(model))
+  )
+    return "invalid";
+  const runsApiBaseUrl = custom
+    ? normalizeRunsApiBaseUrl(value.runsApiBaseUrl)
+    : null;
+  if (
+    custom &&
+    (!runsApiBaseUrl ||
+      !/^[a-z][a-z0-9_-]{0,63}$/.test(provider) ||
+      !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(model))
+  )
+    return "invalid";
+  return Object.freeze({
+    provider,
+    model,
+    reasoningEffort,
+    ...(custom ? { runsApiBaseUrl } : {}),
+  });
+}

package/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs

@@ -7,6 +7,11 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, isAbsolute } from "node:path";
+import {
+  compileEndpointModelSelection,
+  normalizeRunsApiBaseUrl,
+} from "./endpoint-model-selection.mjs";
+export { ENDPOINT_MODEL_SELECTION_ALLOWLIST } from "./endpoint-model-selection.mjs";
 
 const LOOPBACK_ORIGIN = "http://127.0.0.1:8642";
 const RUN_ID = /^run_[a-f0-9]{32}$/;
@@ -206,37 +211,12 @@ function canonicalHistory(value) {
   return result;
 }
 
-// The models a caller may name for one endpoint run. The server checks the
-// same list before it hands the run over; the runtime checks it again here so
-// a run can never reach Hermes with a model that was not reviewed.
-export const ENDPOINT_MODEL_SELECTION_ALLOWLIST = Object.freeze({
-  openrouter: Object.freeze([
-    "anthropic/claude-opus-5.5",
-    "anthropic/claude-sonnet-5.5",
-  ]),
-});
-const ENDPOINT_MODEL_REASONING_EFFORTS = Object.freeze([
-  "low",
-  "medium",
-  "high",
-  "xhigh",
-]);
-
 export function validateEndpointModelSelection(value) {
-  if (
-    !exactObject(value) ||
-    Object.keys(value).sort().join(",") !== "model,provider,reasoningEffort" ||
-    !Object.hasOwn(ENDPOINT_MODEL_SELECTION_ALLOWLIST, value.provider) ||
-    !ENDPOINT_MODEL_SELECTION_ALLOWLIST[value.provider].includes(value.model) ||
-    !ENDPOINT_MODEL_REASONING_EFFORTS.includes(value.reasoningEffort)
-  ) {
+  const compiled = compileEndpointModelSelection(value);
+  if (!compiled || compiled === "invalid") {
     throw new Error("hermes_runs_model_selection_rejected");
   }
-  return Object.freeze({
-    provider: value.provider,
-    model: value.model,
-    reasoningEffort: value.reasoningEffort,
-  });
+  return compiled;
 }
 
 export function validateOpenerOutputContract(value) {
@@ -606,12 +586,19 @@ function submitNotAdmitted(response, value) {
 export function createHermesRunsClient(options = {}) {
   const {
     apiKeyFile,
+    baseUrl = LOOPBACK_ORIGIN,
+    scopeHeaders = {},
     fixture,
     fetchImpl = fetch,
     timeoutMs = 20_000,
   } = options;
   assertFixture(fixture);
+  const origin = normalizeRunsApiBaseUrl(baseUrl);
   if (
+    !origin ||
+    !exactObject(scopeHeaders) ||
+    Object.keys(scopeHeaders).some(key => !["x-sellable-workspace-id", "x-sellable-agent-id"].includes(key)) ||
+    Object.values(scopeHeaders).some(value => typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)) ||
     typeof fetchImpl !== "function" ||
     !Number.isSafeInteger(timeoutMs) ||
     timeoutMs < 100 ||
@@ -624,9 +611,11 @@ export function createHermesRunsClient(options = {}) {
     if (!path.startsWith("/v1/runs")) {
       throw new Error("hermes_runs_path_rejected");
     }
-    return fetchImpl(`${LOOPBACK_ORIGIN}${path}`, {
+    return fetchImpl(`${origin}${path}`, {
       ...init,
+      redirect: "error",
       headers: {
+        ...scopeHeaders,
         authorization: `Bearer ${apiKey}`,
         ...(init.body === undefined
           ? {}

package/lib/sellable-agent/fly-customer-image/runs-api-connections.d.mts

@@ -0,0 +1,27 @@
+export const RUNS_API_CONNECTIONS_ENV: "SELLABLE_AGENT_RUNS_API_CONNECTIONS_JSON";
+export type RunsApiConnection = Readonly<{
+  runtimeId: string;
+  workspaceId: string;
+  agentId: string;
+  baseUrl: string;
+  apiKeyFile: string;
+  endpointIds: string[];
+  workKinds: Array<"STANDARD" | "OPENER" | "REPLY" | "FOLLOW_UP">;
+  models: Array<{
+    provider: string;
+    model: string;
+    reasoningEfforts: string[];
+  }>;
+  localRoot?: string;
+  toolEndpointIds?: string[];
+}>;
+export function parseRunsApiConnections(raw: unknown): RunsApiConnection[];
+export function runsApiConnectionsForRuntime(
+  raw: unknown,
+  runtime: {
+    runtimeId: string;
+    workspaceId: string;
+    agentId: string;
+  }
+): RunsApiConnection[];
+export function createConfiguredRunsClient(options: any): any;

package/lib/sellable-agent/fly-customer-image/runs-api-connections.mjs

@@ -0,0 +1,228 @@
+import { createHash } from "node:crypto";
+import {
+  compileEndpointModelSelection,
+  normalizeRunsApiBaseUrl,
+} from "./endpoint-model-selection.mjs";
+import { createHermesRunsClient } from "./hermes-runs-client.mjs";
+
+export const RUNS_API_CONNECTIONS_ENV =
+  "SELLABLE_AGENT_RUNS_API_CONNECTIONS_JSON";
+const id = (value) =>
+  typeof value === "string" && /^[A-Za-z0-9_.:-]{1,128}$/.test(value);
+const record = (value) =>
+  value && typeof value === "object" && !Array.isArray(value);
+const stable = (value) =>
+  Array.isArray(value)
+    ? `[${value.map(stable).join(",")}]`
+    : record(value)
+      ? `{${Object.keys(value)
+          .sort()
+          .map((key) => `${JSON.stringify(key)}:${stable(value[key])}`)
+          .join(",")}}`
+      : JSON.stringify(value);
+const fail = () => {
+  throw new Error("runs_api_connection_configuration_rejected");
+};
+
+// Only the control plane's machine configuration supplies this registry. It
+// contains credential file references, never credentials or request input.
+export function parseRunsApiConnections(raw) {
+  if (raw === undefined || raw === "") return [];
+  if (typeof raw !== "string" || Buffer.byteLength(raw) > 64 * 1024) fail();
+  let entries;
+  try {
+    entries = JSON.parse(raw);
+  } catch {
+    fail();
+  }
+  if (!Array.isArray(entries) || entries.length > 32) fail();
+  const seen = new Set();
+  return entries.map((entry) => {
+    if (
+      !record(entry) ||
+      Object.keys(entry).some(
+        (key) =>
+          ![
+            "runtimeId",
+            "workspaceId",
+            "agentId",
+            "baseUrl",
+            "apiKeyFile",
+            "endpointIds",
+            "workKinds",
+            "models",
+            "localRoot",
+            "toolEndpointIds",
+          ].includes(key)
+      ) ||
+      ![entry.runtimeId, entry.workspaceId, entry.agentId].every(id) ||
+      typeof entry.apiKeyFile !== "string" ||
+      !/^\/(?:opt\/data|run\/secrets)\/[A-Za-z0-9_./-]{1,250}$/.test(
+        entry.apiKeyFile
+      ) ||
+      entry.apiKeyFile
+        .split("/")
+        .some((part) => part === "." || part === "..") ||
+      !Array.isArray(entry.endpointIds) ||
+      !entry.endpointIds.length ||
+      entry.endpointIds.length > 64 ||
+      !entry.endpointIds.every(id) ||
+      !Array.isArray(entry.workKinds) ||
+      !entry.workKinds.length ||
+      !entry.workKinds.every((kind) =>
+        ["STANDARD", "OPENER", "REPLY", "FOLLOW_UP"].includes(kind)
+      ) ||
+      !Array.isArray(entry.models) ||
+      !entry.models.length ||
+      entry.models.length > 16
+    )
+      fail();
+    const baseUrl = normalizeRunsApiBaseUrl(entry.baseUrl);
+    if (!baseUrl) fail();
+    const identity = `${entry.runtimeId}:${baseUrl}`;
+    if (seen.has(identity)) fail();
+    seen.add(identity);
+    const models = entry.models.map((model) => {
+      if (
+        !record(model) ||
+        Object.keys(model).sort().join(",") !==
+          "model,provider,reasoningEfforts" ||
+        !Array.isArray(model.reasoningEfforts) ||
+        !model.reasoningEfforts.length ||
+        model.reasoningEfforts.some(
+          (reasoningEffort) =>
+            compileEndpointModelSelection({
+              provider: model.provider,
+              model: model.model,
+              reasoningEffort,
+              runsApiBaseUrl: baseUrl,
+            }) === "invalid"
+        )
+      )
+        fail();
+      return { ...model, reasoningEfforts: [...model.reasoningEfforts] };
+    });
+    if (entry.localRoot !== undefined) {
+      const url = new URL(baseUrl);
+      if (
+        typeof entry.localRoot !== "string" ||
+        !/^\/opt\/data\/[A-Za-z0-9_-]{1,80}$/.test(entry.localRoot) ||
+        entry.apiKeyFile !== `${entry.localRoot}/api-key` ||
+        url.hostname !== "127.0.0.1" ||
+        url.protocol !== "http:" ||
+        url.pathname !== "/" ||
+        !url.port ||
+        Number(url.port) < 1024 ||
+        models.some(
+          (model) =>
+            model.provider !== "claude-code" ||
+            !/^claude-[a-z0-9-]{1,100}$/.test(model.model) ||
+            model.reasoningEfforts.some(
+              (effort) => !["low", "medium", "high"].includes(effort)
+            )
+        )
+      )
+        fail();
+    }
+    // Runs on these endpoints get their own allowed tools from the image-owned
+    // service; every other run stays tool-free.
+    if (
+      entry.toolEndpointIds !== undefined &&
+      (entry.localRoot === undefined ||
+        !Array.isArray(entry.toolEndpointIds) ||
+        !entry.toolEndpointIds.length ||
+        new Set(entry.toolEndpointIds).size !== entry.toolEndpointIds.length ||
+        entry.toolEndpointIds.some(
+          (value) => !entry.endpointIds.includes(value)
+        ))
+    )
+      fail();
+    return Object.freeze({
+      ...entry,
+      baseUrl,
+      models,
+      endpointIds: [...entry.endpointIds],
+      workKinds: [...entry.workKinds],
+      ...(entry.toolEndpointIds === undefined
+        ? {}
+        : { toolEndpointIds: [...entry.toolEndpointIds] }),
+    });
+  });
+}
+
+export function runsApiConnectionsForRuntime(raw, runtime) {
+  return parseRunsApiConnections(raw).filter(
+    (connection) =>
+      connection.runtimeId === runtime.runtimeId &&
+      connection.workspaceId === runtime.workspaceId &&
+      connection.agentId === runtime.agentId
+  );
+}
+
+/** @param {any} options */
+export function createConfiguredRunsClient({
+  apiKeyFile,
+  claim,
+  env = process.env,
+  clientFactory = createHermesRunsClient,
+}) {
+  const selection = claim?.run?.modelSelection;
+  if (!selection?.runsApiBaseUrl) return clientFactory({ apiKeyFile });
+  const model = compileEndpointModelSelection(selection);
+  if (!model || model === "invalid") throw new Error("runs_api_model_rejected");
+  const connection = runsApiConnectionsForRuntime(
+    env[RUNS_API_CONNECTIONS_ENV],
+    {
+      runtimeId: claim.runtime?.runtimeId,
+      workspaceId: claim.attempt?.workspaceId,
+      agentId: claim.attempt?.agentId,
+    }
+  ).find((value) => value.baseUrl === model.runsApiBaseUrl);
+  const workKind = claim.run.productExecution?.workKind ?? "STANDARD";
+  if (
+    !connection ||
+    env.SELLABLE_RUNTIME_ID !== connection.runtimeId ||
+    !connection.endpointIds.includes(claim.attempt.endpointId) ||
+    !connection.workKinds.includes(workKind) ||
+    !connection.models.some(
+      (allowed) =>
+        allowed.provider === model.provider &&
+        allowed.model === model.model &&
+        allowed.reasoningEfforts.includes(model.reasoningEffort)
+    )
+  )
+    throw new Error("runs_api_connection_not_authorized");
+  // This client instance retains one destination and one credential for the
+  // entire attempt, including stream/status/stop, even if settings later change.
+  const client = clientFactory({
+    baseUrl: connection.baseUrl,
+    apiKeyFile: connection.apiKeyFile,
+    scopeHeaders: {
+      "x-sellable-workspace-id": connection.workspaceId,
+      "x-sellable-agent-id": connection.agentId,
+    },
+  });
+  return Object.freeze({
+    ...client,
+    submit(compiled, options) {
+      // Public semantic endpoints have a published schema but no product tuple.
+      // Preserve that existing contract when calling a custom Runs service.
+      const schema = claim.revision?.outputSchema;
+      if (compiled.outputContract || !schema?.properties?.proposal)
+        return client.submit(compiled, options);
+      return client.submit(
+        {
+          ...compiled,
+          outputContract: {
+            schemaVersion: "sellable-opener-output-contract/v1",
+            schema,
+            nativeProposalSchemaDigest: createHash("sha256")
+              .update(stable(schema.properties.proposal))
+              .digest("hex"),
+          },
+        },
+        options
+      );
+    },
+  });
+}

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.794";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.796";
 const MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1546,7 +1546,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.794" ||
+      pinned.installerPackage !== "@sellable/install@0.1.796" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.957" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -312,7 +312,7 @@ function validateDesired(desired) {
     desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.794" ||
+    desired.installerPackage !== "@sellable/install@0.1.796" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.957" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.794";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.796";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.794",
+  "version": "0.1.796",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {