@sellable/install 0.1.795-wip.runs-api.20261004.1 → 0.1.796

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.795-wip.runs-api.20261004.1
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.796
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.795-wip.runs-api.20261004.1" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.796" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.957" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.795-wip.runs-api.202610
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.795-wip.runs-api.20261004.1' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.796' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.795-wip.runs-api.20261004.1', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.796', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.795-wip.runs-api.20261004.1` is
+`@sellable/install@0.1.796` is
 published:
 
 ```sh

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -169,7 +169,7 @@ COPY fly-admin-image/start-admin-runtime /usr/local/lib/sellable-agent/admin-run
 COPY fly-customer-image/customer-runtime.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime.mjs
 COPY hermes-first-welcome.mjs /usr/local/lib/sellable-agent/hermes-first-welcome.mjs
 COPY fly-customer-image/hermes-runs-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs
-COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/claude-code-runs-api.mjs /usr/local/lib/sellable-agent/fly-customer-image/
+COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/claude-code-runs-api.mjs fly-customer-image/claude-code-mcp-session.mjs /usr/local/lib/sellable-agent/fly-customer-image/
 COPY fly-customer-image/opener-stage-execution.mjs /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs
 COPY fly-customer-image/endpoint-uat-completion-gate.mjs /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs
 COPY fly-customer-image/customer-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime-phase-telemetry.mjs
@@ -276,6 +276,7 @@ RUN set -eux; \
       /usr/local/lib/sellable-agent/fly-customer-image/endpoint-model-selection.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/runs-api-connections.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs \
+      /usr/local/lib/sellable-agent/fly-customer-image/claude-code-mcp-session.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs \
       /usr/local/lib/sellable-agent/admin-native-gateway-supervisor.mjs \

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -901,6 +901,32 @@ function installAdminMcpRuntimeBinding(
   );
 }
 
+// The profile's `sellable` MCP server exactly as Hermes runs it, so a Claude
+// Code tool-lane run sees the same tools, through the same context proxy.
+function profileSellableMcpServer(profileRoot) {
+  const path = join(profileRoot, "config.yaml");
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || !stat.isFile()) return null;
+  const document = parseDocument(readFileSync(path, "utf8"));
+  if (document.errors.length > 0) return null;
+  const server = document.toJS().mcp_servers?.sellable;
+  if (
+    server?.command !== NODE ||
+    JSON.stringify(server.args) !== JSON.stringify([MCP_CONTEXT_PROXY]) ||
+    !server.env ||
+    typeof server.env !== "object"
+  ) {
+    return null;
+  }
+  return {
+    command: NODE,
+    args: [MCP_CONTEXT_PROXY],
+    env: Object.fromEntries(
+      Object.entries(server.env).map(([key, value]) => [key, String(value)])
+    ),
+  };
+}
+
 function installAdminModelConfig(profileRoot, modelConfig) {
   const path = join(profileRoot, "config.yaml");
   const stat = lstatSync(path);
@@ -3822,6 +3848,13 @@ async function runAdminProduction() {
   try {
     customRunsServices = await startConfiguredClaudeRunsApis({
       diagnostic: value => process.stderr.write(`${JSON.stringify(value)}\n`),
+      toolLanes: {
+        turnDescriptorPath: join(MCP_TURN_CONTEXT_ROOT, "turn-context.json"),
+        server: () =>
+          activeLaunch
+            ? profileSellableMcpServer(activeLaunch.profile.profileHome)
+            : null,
+      },
     });
   } catch {
     process.stderr.write(`${JSON.stringify({ ok: false, code: "custom_runs_api_start_failed" })}\n`);

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.795-wip.runs-api.20261004.1
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.796
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.202
 ARG ADMIN_MCP_INTEGRITY=sha512-ym3aye/0vQ8tfULJlKz9JFOxvIQsl1G+n3np+TTgK/tecwNblBo/j3AkTnRqH9iomKzPbZzP+n4tEQsvsU8ByA==
 ARG TUS_JS_CLIENT_VERSION=4.3.1

package/lib/sellable-agent/fly-customer-image/claude-code-mcp-session.d.mts

@@ -0,0 +1 @@
+export function tagEndpointSession(line: string, sessionId: string): string;

package/lib/sellable-agent/fly-customer-image/claude-code-mcp-session.mjs

@@ -0,0 +1,53 @@
+// Claude Code's only MCP server for a tool-lane run. It starts the profile's
+// own `sellable` server (the context proxy, with exactly its configured
+// environment) and adds this run's endpoint session to every tools/list and
+// tools/call. The proxy then loads the run's signed turn descriptor, lists
+// only the run's allowed tools and stamps the run identity on each call; the
+// backend checks it again. Nothing in this file grants anything.
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+
+export function tagEndpointSession(line, sessionId) {
+  let message;
+  try {
+    message = JSON.parse(line);
+  } catch {
+    return line;
+  }
+  if (
+    !message ||
+    typeof message !== "object" ||
+    !["tools/list", "tools/call"].includes(message.method)
+  )
+    return line;
+  const params =
+    message.params && typeof message.params === "object" ? message.params : {};
+  // The proxy accepts exactly this shape and nothing else in _meta.
+  return JSON.stringify({
+    ...message,
+    params: { ...params, _meta: { sellableEndpoint: { sessionId } } },
+  });
+}
+
+function main(specPath) {
+  const spec = JSON.parse(readFileSync(specPath, "utf8"));
+  if (!/^sellable_endpoint_[a-f0-9]{32}$/.test(spec.sessionId ?? ""))
+    throw new Error("claude_runs_mcp_session_rejected");
+  const child = spawn(spec.command, spec.args, {
+    stdio: ["pipe", "inherit", "ignore"],
+    env: spec.env,
+  });
+  child.once("exit", (code) => process.exit(code ?? 1));
+  child.stdin.on("error", () => {});
+  const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  lines.on("line", (line) =>
+    child.stdin.write(`${tagEndpointSession(line, spec.sessionId)}\n`)
+  );
+  lines.on("close", () => child.stdin.end());
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  main(process.argv[2]);
+}

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.d.mts

@@ -8,6 +8,18 @@ export type ClaudeRunsRequest = {
   schema: Record<string, unknown> | null;
   model: string;
   effort: string;
+  sessionId: string;
+  tools: ClaudeRunsTools | null;
+};
+export type ClaudeRunsToolServer = {
+  command: string;
+  args: string[];
+  env: Record<string, string>;
+};
+export type ClaudeRunsTools = { names: string[]; server: ClaudeRunsToolServer };
+export type ClaudeRunsToolLanes = {
+  turnDescriptorPath: string;
+  server(): ClaudeRunsToolServer | null;
 };
 export type ClaudeRunsResult = {
   output: string;
@@ -24,19 +36,35 @@ export type ClaudeRunsApiOptions = {
   };
   audit?: (entry: Record<string, unknown>) => void;
   maxConcurrency?: number;
+  maxToolConcurrency?: number;
+  toolLanes?: ClaudeRunsToolLanes | null;
 };
 export function validateClaudeRunsRequest(
   body: unknown,
   models: RunsApiConnection["models"]
 ): ClaudeRunsRequest;
+export function endpointToolNames(options: {
+  turnDescriptorPath: string;
+  sessionId: string;
+  toolEndpointIds: string[];
+}): string[] | null;
 export function claudeInvocation(
   request: ClaudeRunsRequest,
-  root: string
+  root: string,
+  mcpSpecPath?: string | null
 ): { command: string; args: string[]; options: SpawnOptions };
 export function parseClaudeResult(
   stdout: string,
   request: ClaudeRunsRequest
 ): ClaudeRunsResult;
+export function startClaudeRun(
+  request: ClaudeRunsRequest,
+  options: {
+    root: string;
+    spawnImpl?: (...args: any[]) => any;
+    timeoutMs?: number;
+  }
+): { promise: Promise<ClaudeRunsResult>; stop(code?: string): void };
 export function createClaudeRunsApi(
   options: ClaudeRunsApiOptions
 ): ClaudeRunsServer;
@@ -45,4 +73,5 @@ export function startConfiguredClaudeRunsApis(options?: {
   diagnostic?: (entry: Record<string, unknown>) => void;
   createApi?: typeof createClaudeRunsApi;
   readToken?: (path: string) => string;
+  toolLanes?: ClaudeRunsToolLanes | null;
 }): Promise<{ stop(): Promise<void> }>;

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs

@@ -1,7 +1,19 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { appendFileSync, readFileSync } from "node:fs";
+import {
+  appendFileSync,
+  lstatSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { createServer } from "node:http";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  endpointHermesSessionId,
+  endpointMcpDescriptorPath,
+} from "../mcp-context-proxy.mjs";
 import { validateOpenerOutputContract } from "./hermes-runs-client.mjs";
 import {
   parseRunsApiConnections,
@@ -11,6 +23,9 @@ import {
 const MAX_BODY = 320 * 1024;
 const MAX_OUTPUT = 48 * 1024;
 const MAX_CLI_OUTPUT = 512 * 1024;
+const MCP_SESSION = fileURLToPath(
+  new URL("./claude-code-mcp-session.mjs", import.meta.url)
+);
 const hash = (s) => createHash("sha256").update(s).digest("hex");
 const record = (v) => v && typeof v === "object" && !Array.isArray(v);
 
@@ -74,10 +89,47 @@ export function validateClaudeRunsRequest(body, models) {
     schema,
     model: body.model,
     effort: body.model_options.reasoning_effort,
+    sessionId: body.session_id,
+    tools: null,
   };
 }
 
-export function claudeInvocation(request, root) {
+/**
+ * A tool-lane run's own allowed tools, read from the signed turn descriptor
+ * the runtime installed for its session before submitting; null when the run
+ * is not on a tool endpoint. This only narrows: the context proxy verifies the
+ * descriptor itself before it lists or calls any tool.
+ */
+export function endpointToolNames({
+  turnDescriptorPath,
+  sessionId,
+  toolEndpointIds,
+}) {
+  const path = endpointMcpDescriptorPath(turnDescriptorPath, sessionId);
+  if (!path) return null;
+  try {
+    if (!lstatSync(path).isFile())
+      throw new Error("claude_runs_tool_descriptor_rejected");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  const body = JSON.parse(readFileSync(path, "utf8"))?.body;
+  if (!toolEndpointIds.includes(body?.endpointId)) return null;
+  const names = body.allowedToolNames;
+  if (
+    endpointHermesSessionId(body) !== sessionId ||
+    !Array.isArray(names) ||
+    !names.length ||
+    names.some(
+      (name) => typeof name !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(name)
+    )
+  )
+    throw new Error("claude_runs_tool_descriptor_rejected");
+  return [...names];
+}
+
+export function claudeInvocation(request, root, mcpSpecPath = null) {
   return {
     command: `${root}/cli/node_modules/.bin/claude`,
     args: [
@@ -97,7 +149,24 @@ export function claudeInvocation(request, root) {
       "dontAsk",
       "--strict-mcp-config",
       "--mcp-config",
-      '{"mcpServers":{}}',
+      // A tool lane's only MCP server is the run's own session wrapper; its
+      // allowed tools are exactly the descriptor's. Every other run has none.
+      ...(request.tools
+        ? [
+            JSON.stringify({
+              mcpServers: {
+                sellable: {
+                  command: process.execPath,
+                  args: [MCP_SESSION, mcpSpecPath],
+                },
+              },
+            }),
+            "--allowedTools",
+            request.tools.names
+              .map((name) => `mcp__sellable__${name}`)
+              .join(","),
+          ]
+        : ['{"mcpServers":{}}']),
       "--setting-sources",
       "",
       "--settings",
@@ -105,7 +174,7 @@ export function claudeInvocation(request, root) {
       "--disable-slash-commands",
       "--no-session-persistence",
       "--max-turns",
-      "3",
+      request.tools ? "16" : "3",
       "--system-prompt",
       request.instructions,
     ],
@@ -166,12 +235,28 @@ export function startClaudeRun(
   request,
   { root, spawnImpl = spawn, timeoutMs = 750_000 } = {}
 ) {
-  const invocation = claudeInvocation(request, root);
-  const child = spawnImpl(
-    invocation.command,
-    invocation.args,
-    invocation.options
-  );
+  // The tool server's environment travels in a private per-run file, never
+  // in argv, and is removed when the run ends.
+  const mcpSpecPath = request.tools
+    ? join(root, "work", `mcp-session-${randomBytes(12).toString("hex")}.json`)
+    : null;
+  if (mcpSpecPath)
+    writeFileSync(
+      mcpSpecPath,
+      JSON.stringify({ sessionId: request.sessionId, ...request.tools.server }),
+      { mode: 0o600, flag: "wx" }
+    );
+  const removeSpec = () => {
+    if (mcpSpecPath) rmSync(mcpSpecPath, { force: true });
+  };
+  const invocation = claudeInvocation(request, root, mcpSpecPath);
+  let child;
+  try {
+    child = spawnImpl(invocation.command, invocation.args, invocation.options);
+  } catch (error) {
+    removeSpec();
+    throw error;
+  }
   let reason = null;
   let killTimer;
   const stop = (code = "claude_runs_cancelled") => {
@@ -203,11 +288,13 @@ export function startClaudeRun(
     child.stderr.on("data", () => {});
     child.once("error", () => {
       clearTimeout(timer);
+      removeSpec();
       reject(new Error("claude_runs_cli_unavailable"));
     });
     child.once("close", (code) => {
       clearTimeout(timer);
       clearTimeout(killTimer);
+      removeSpec();
       if (reason || code !== 0)
         return reject(new Error(reason ?? "claude_runs_cli_failed"));
       try {
@@ -231,9 +318,33 @@ export function createClaudeRunsApi({
     startClaudeRun(request, { root: connection.localRoot }),
   audit = () => {},
   maxConcurrency = 2,
+  // Tool lanes (replies, follow-ups) have their own slots so a batch of
+  // openers can never crowd them out.
+  maxToolConcurrency = 2,
+  toolLanes = null,
 } = {}) {
   if (!/^[a-f0-9]{64}$/.test(token ?? ""))
     throw new Error("claude_runs_key_rejected");
+  // The run's own tools and the profile's MCP server, or null for a tool-free run.
+  const resolveTools = (request) => {
+    if (!connection.toolEndpointIds || !toolLanes) return null;
+    const names = endpointToolNames({
+      turnDescriptorPath: toolLanes.turnDescriptorPath,
+      sessionId: request.sessionId,
+      toolEndpointIds: connection.toolEndpointIds,
+    });
+    if (!names) return null;
+    const server = toolLanes.server();
+    if (!server) throw new Error("claude_runs_tool_server_unavailable");
+    return {
+      names,
+      server: {
+        command: server.command,
+        args: [...server.args],
+        env: { PATH: "/usr/local/bin:/usr/bin:/bin", ...server.env },
+      },
+    };
+  };
   const recordAudit = (entry) => {
     try {
       audit(entry);
@@ -242,7 +353,9 @@ export function createClaudeRunsApi({
     }
   };
   const runs = new Map();
-  let active = 0;
+  const inFlight = { plain: 0, tools: 0 };
+  const limits = { plain: maxConcurrency, tools: maxToolConcurrency };
+  const full = (pool) => inFlight[pool] >= limits[pool] || runs.size >= 200;
   const json = (res, status, body) => {
     res.writeHead(status, {
       "content-type": "application/json",
@@ -269,6 +382,7 @@ export function createClaudeRunsApi({
     recordAudit({
       runId: run.run_id,
       status: run.status,
+      toolLane: run.pool === "tools",
       servedRuntime: run.runtime ?? null,
       usage: run.usage ?? null,
       durationMs: Date.now() - run.startedAt,
@@ -293,14 +407,15 @@ export function createClaudeRunsApi({
       return json(res, 200, {
         ok: true,
         provider: "claude-code",
-        active,
+        active: inFlight.plain + inFlight.tools,
+        toolActive: inFlight.tools,
         scope: {
           workspaceId: connection.workspaceId,
           agentId: connection.agentId,
         },
       });
     if (req.method === "POST" && req.url === "/v1/runs") {
-      if (active >= maxConcurrency || runs.size >= 200)
+      if (full("plain") && (!connection.toolEndpointIds || full("tools")))
         return json(res, 429, { error: "claude_runs_busy" });
       let request;
       try {
@@ -316,6 +431,7 @@ export function createClaudeRunsApi({
         }
         const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
         request = validateClaudeRunsRequest(body, connection.models);
+        request.tools = resolveTools(request);
       } catch (error) {
         recordAudit({
           status: "request-rejected",
@@ -326,16 +442,17 @@ export function createClaudeRunsApi({
         return json(res, 400, { error: "claude_runs_request_rejected" });
       }
       // Check again after reading: concurrent uploads cannot over-admit.
-      if (active >= maxConcurrency || runs.size >= 200)
-        return json(res, 429, { error: "claude_runs_busy" });
+      const pool = request.tools ? "tools" : "plain";
+      if (full(pool)) return json(res, 429, { error: "claude_runs_busy" });
       const run = {
         run_id: `run_${randomBytes(16).toString("hex")}`,
         status: "running",
         startedAt: Date.now(),
         listeners: new Set(),
         consumed: false,
+        pool,
       };
-      active++;
+      inFlight[pool]++;
       runs.set(run.run_id, run);
       try {
         run.execution = execute(request);
@@ -357,9 +474,9 @@ export function createClaudeRunsApi({
                   : { status: "failed", error: "claude_runs_generation_failed" }
               )
           )
-          .finally(() => active--);
+          .finally(() => inFlight[pool]--);
       } catch {
-        active--;
+        inFlight[pool]--;
         terminal(run, "run.failed", {
           status: "failed",
           error: "claude_runs_cli_unavailable",
@@ -438,6 +555,7 @@ export async function startConfiguredClaudeRunsApis({
   diagnostic = () => {},
   createApi = createClaudeRunsApi,
   readToken = (path) => readFileSync(path, "utf8").trim(),
+  toolLanes = null,
 } = {}) {
   const services = [];
   for (const connection of parseRunsApiConnections(
@@ -453,6 +571,7 @@ export async function startConfiguredClaudeRunsApis({
       const server = createApi({
         token,
         connection,
+        toolLanes,
         audit: (entry) =>
           appendFileSync(
             `${connection.localRoot}/audit.jsonl`,

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -126,7 +126,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.795-wip.runs-api.20261004.1";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.796";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.957";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;

package/lib/sellable-agent/fly-customer-image/runs-api-connections.d.mts

@@ -13,6 +13,7 @@ export type RunsApiConnection = Readonly<{
     reasoningEfforts: string[];
   }>;
   localRoot?: string;
+  toolEndpointIds?: string[];
 }>;
 export function parseRunsApiConnections(raw: unknown): RunsApiConnection[];
 export function runsApiConnectionsForRuntime(

package/lib/sellable-agent/fly-customer-image/runs-api-connections.mjs

@@ -52,6 +52,7 @@ export function parseRunsApiConnections(raw) {
             "workKinds",
             "models",
             "localRoot",
+            "toolEndpointIds",
           ].includes(key)
       ) ||
       ![entry.runtimeId, entry.workspaceId, entry.agentId].every(id) ||
@@ -123,12 +124,28 @@ export function parseRunsApiConnections(raw) {
       )
         fail();
     }
+    // Runs on these endpoints get their own allowed tools from the image-owned
+    // service; every other run stays tool-free.
+    if (
+      entry.toolEndpointIds !== undefined &&
+      (entry.localRoot === undefined ||
+        !Array.isArray(entry.toolEndpointIds) ||
+        !entry.toolEndpointIds.length ||
+        new Set(entry.toolEndpointIds).size !== entry.toolEndpointIds.length ||
+        entry.toolEndpointIds.some(
+          (value) => !entry.endpointIds.includes(value)
+        ))
+    )
+      fail();
     return Object.freeze({
       ...entry,
       baseUrl,
       models,
       endpointIds: [...entry.endpointIds],
       workKinds: [...entry.workKinds],
+      ...(entry.toolEndpointIds === undefined
+        ? {}
+        : { toolEndpointIds: [...entry.toolEndpointIds] }),
     });
   });
 }

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.795-wip.runs-api.20261004.1";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.796";
 const MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1546,7 +1546,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.795-wip.runs-api.20261004.1" ||
+      pinned.installerPackage !== "@sellable/install@0.1.796" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.957" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -312,7 +312,7 @@ function validateDesired(desired) {
     desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.795-wip.runs-api.20261004.1" ||
+    desired.installerPackage !== "@sellable/install@0.1.796" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.957" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.795-wip.runs-api.20261004.1";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.796";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.795-wip.runs-api.20261004.1",
+  "version": "0.1.796",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {