@sellable/install 0.1.800 → 0.1.802

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.d.mts

@@ -5,6 +5,7 @@ export const ENDPOINT_MODEL_SELECTION_ALLOWLIST: Readonly<{
     "openai/gpt-6-luna",
     "anthropic/claude-sonnet-5.5",
   ];
+  "openai-codex": readonly ["gpt-6.1-sol"];
 }>;
 export const ENDPOINT_MODEL_REASONING_EFFORTS: readonly [
   "none",
@@ -13,14 +14,60 @@ export const ENDPOINT_MODEL_REASONING_EFFORTS: readonly [
   "high",
   "xhigh",
 ];
-export type EndpointModelSelection = Readonly<{
+export const ENDPOINT_MODEL_MAX_FALLBACKS: 2;
+export type EndpointModelStep = Readonly<{
   provider: string;
   model: string;
   reasoningEffort: (typeof ENDPOINT_MODEL_REASONING_EFFORTS)[number];
   runsApiBaseUrl?: string;
-  fallbackPolicy?: "STOP" | "PRODUCT_DEFAULT";
 }>;
+export type EndpointModelSelection = Readonly<
+  EndpointModelStep & {
+    fallbackPolicy?: "STOP" | "PRODUCT_DEFAULT";
+    fallbacks?: readonly EndpointModelStep[];
+  }
+>;
+export type EndpointChainFailure =
+  | "NATIVE_FAILED"
+  | "OUTPUT_CONTRACT_FAILED"
+  | "NOT_ADMITTED"
+  | "STEP_UNAVAILABLE";
+export type EndpointChainDecision =
+  | Readonly<{
+      advance: true;
+      stepIndex: number;
+      selection: EndpointModelStep;
+    }>
+  | Readonly<{
+      advance: false;
+      reason:
+        | "INVALID"
+        | "NOT_ADVANCEABLE"
+        | "CHAIN_EXHAUSTED"
+        | "NO_TIME_LEFT";
+    }>;
 export function normalizeRunsApiBaseUrl(value: unknown): string | null;
 export function compileEndpointModelSelection(
   value: unknown
 ): EndpointModelSelection | null | "invalid";
+export function endpointModelSelectionChain(
+  selection: unknown
+): EndpointModelStep[];
+export function endpointModelSelectionSource(
+  selection: { provider: string; runsApiBaseUrl?: string } | null | undefined
+): "default" | "openrouter" | "codex" | "custom";
+export const ENDPOINT_CHAIN_STEP_ADMISSION_MS: number;
+export const ENDPOINT_CHAIN_MIN_STEP_MS: number;
+export const ENDPOINT_CHAIN_ADVANCE_FAILURES: readonly EndpointChainFailure[];
+export function nextEndpointChainStep(
+  chain: readonly EndpointModelStep[],
+  history: readonly string[],
+  failure: string,
+  remainingMs?: number
+): EndpointChainDecision;
+export function endpointChainStepAdmissionDeadline(input: {
+  startedAtMs: number;
+  deadlineMs: number;
+  stepIndex: number;
+  stepCount: number;
+}): number;

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.mjs

@@ -8,6 +8,9 @@ export const ENDPOINT_MODEL_SELECTION_ALLOWLIST = Object.freeze({
     "openai/gpt-6-luna",
     "anthropic/claude-sonnet-5.5",
   ]),
+  // The Agent's own Codex model (model-auth-reconciler.mjs), served by Hermes
+  // per run from the machine's Codex subscription pool.
+  "openai-codex": Object.freeze(["gpt-6.1-sol"]),
 });
 export const ENDPOINT_MODEL_REASONING_EFFORTS = Object.freeze([
   "none",
@@ -16,6 +19,7 @@ export const ENDPOINT_MODEL_REASONING_EFFORTS = Object.freeze([
   "high",
   "xhigh",
 ]);
+export const ENDPOINT_MODEL_MAX_FALLBACKS = 2;
 
 export function normalizeRunsApiBaseUrl(value) {
   if (
@@ -45,39 +49,33 @@ export function normalizeRunsApiBaseUrl(value) {
   }
 }
 
-export function compileEndpointModelSelection(value) {
-  if (value === undefined || value === null) return null;
-  if (typeof value !== "object" || Array.isArray(value)) return "invalid";
+// One model: provider, model, effort and, for a custom Runs API, its URL.
+function compileEndpointModelStep(value, extraKeys = []) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const custom = Object.hasOwn(value, "runsApiBaseUrl");
-  const hasFallbackPolicy = Object.hasOwn(value, "fallbackPolicy");
   if (
     Object.keys(value)
-      .filter((key) => key !== "fallbackPolicy")
+      .filter((key) => !extraKeys.includes(key))
       .sort()
       .join(",") !==
     (custom
       ? "model,provider,reasoningEffort,runsApiBaseUrl"
       : "model,provider,reasoningEffort")
   )
-    return "invalid";
-  if (
-    hasFallbackPolicy &&
-    !["STOP", "PRODUCT_DEFAULT"].includes(value.fallbackPolicy)
-  )
-    return "invalid";
+    return null;
   const { provider, model, reasoningEffort } = value;
   if (
     typeof provider !== "string" ||
     typeof model !== "string" ||
     !ENDPOINT_MODEL_REASONING_EFFORTS.includes(reasoningEffort)
   )
-    return "invalid";
+    return null;
   if (
     !custom &&
     (!Object.hasOwn(ENDPOINT_MODEL_SELECTION_ALLOWLIST, provider) ||
       !ENDPOINT_MODEL_SELECTION_ALLOWLIST[provider].includes(model))
   )
-    return "invalid";
+    return null;
   const runsApiBaseUrl = custom
     ? normalizeRunsApiBaseUrl(value.runsApiBaseUrl)
     : null;
@@ -87,12 +85,150 @@ export function compileEndpointModelSelection(value) {
       !/^[a-z][a-z0-9_-]{0,63}$/.test(provider) ||
       !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(model))
   )
-    return "invalid";
+    return null;
   return Object.freeze({
     provider,
     model,
     reasoningEffort,
     ...(custom ? { runsApiBaseUrl } : {}),
+  });
+}
+
+const sameStep = (left, right) =>
+  left.provider === right.provider &&
+  left.model === right.model &&
+  left.reasoningEffort === right.reasoningEffort &&
+  left.runsApiBaseUrl === right.runsApiBaseUrl;
+
+/**
+ * The top-level fields are the endpoint's first model. An optional ordered
+ * `fallbacks` list holds up to two more, each a full model choice of its own;
+ * `fallbackPolicy` applies only after every model in the chain has failed.
+ */
+export function compileEndpointModelSelection(value) {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== "object" || Array.isArray(value)) return "invalid";
+  const primary = compileEndpointModelStep(value, [
+    "fallbackPolicy",
+    "fallbacks",
+  ]);
+  if (!primary) return "invalid";
+  const hasFallbackPolicy = Object.hasOwn(value, "fallbackPolicy");
+  if (
+    hasFallbackPolicy &&
+    !["STOP", "PRODUCT_DEFAULT"].includes(value.fallbackPolicy)
+  )
+    return "invalid";
+  let fallbacks = null;
+  if (Object.hasOwn(value, "fallbacks")) {
+    if (
+      !Array.isArray(value.fallbacks) ||
+      value.fallbacks.length < 1 ||
+      value.fallbacks.length > ENDPOINT_MODEL_MAX_FALLBACKS
+    )
+      return "invalid";
+    fallbacks = value.fallbacks.map((step) => compileEndpointModelStep(step));
+    if (
+      fallbacks.some(
+        (step, index) =>
+          !step ||
+          [primary, ...fallbacks.slice(0, index)].some((earlier) =>
+            sameStep(earlier, step)
+          )
+      )
+    )
+      return "invalid";
+  }
+  return Object.freeze({
+    ...primary,
     ...(hasFallbackPolicy ? { fallbackPolicy: value.fallbackPolicy } : {}),
+    ...(fallbacks ? { fallbacks: Object.freeze(fallbacks) } : {}),
   });
 }
+
+/** The models a run tries, in order; empty means the Agent's own default. */
+export function endpointModelSelectionChain(selection) {
+  const compiled = compileEndpointModelSelection(selection);
+  if (!compiled || compiled === "invalid") return [];
+  const { fallbacks = [], fallbackPolicy: _policy, ...primary } = compiled;
+  return [Object.freeze(primary), ...fallbacks];
+}
+
+/** The settings source a model belongs to: Agent default, OpenRouter, Codex or a custom Runs API. */
+export function endpointModelSelectionSource(selection) {
+  if (!selection) return "default";
+  if (selection.runsApiBaseUrl) return "custom";
+  return selection.provider === "openai-codex" ? "codex" : "openrouter";
+}
+
+// A step that cannot be admitted waits this long at most before the next
+// model takes the run. Claude Code runs take 9-15 s, so a busy slot normally
+// frees well inside it.
+export const ENDPOINT_CHAIN_STEP_ADMISSION_MS = 30_000;
+// Starting another model with less time than this left cannot finish it.
+export const ENDPOINT_CHAIN_MIN_STEP_MS = 5_000;
+// A step that failed in one of these ways produced no output, so another
+// model can write without risking a second draft or send.
+export const ENDPOINT_CHAIN_ADVANCE_FAILURES = Object.freeze([
+  "NATIVE_FAILED", // the run failed with no output (incl. Claude Code usage limit or sign-in refusals)
+  "OUTPUT_CONTRACT_FAILED", // its output failed the product contract and was not used
+  "NOT_ADMITTED", // the service stayed busy (429/503) for the step's admission budget
+  "STEP_UNAVAILABLE", // this machine could not open the step's connection; nothing was sent
+]);
+
+/**
+ * Decide whether a run moves to the next model of its chain. `history` holds
+ * the failure classes of the steps already left behind; `failure` is how the
+ * current step ended. Anything not listed in ENDPOINT_CHAIN_ADVANCE_FAILURES
+ * (an ambiguous submit, a lost stream, a stop or cancel, a late completion,
+ * success including a SUPPRESS decision, a timeout) ends the run.
+ */
+export function nextEndpointChainStep(
+  chain,
+  history,
+  failure,
+  remainingMs = Number.POSITIVE_INFINITY
+) {
+  if (
+    !Array.isArray(chain) ||
+    chain.length < 1 ||
+    chain.length > ENDPOINT_MODEL_MAX_FALLBACKS + 1 ||
+    !Array.isArray(history) ||
+    history.length >= chain.length ||
+    history.some((item) => !ENDPOINT_CHAIN_ADVANCE_FAILURES.includes(item))
+  )
+    return Object.freeze({ advance: false, reason: "INVALID" });
+  if (!ENDPOINT_CHAIN_ADVANCE_FAILURES.includes(failure))
+    return Object.freeze({ advance: false, reason: "NOT_ADVANCEABLE" });
+  const stepIndex = history.length + 1;
+  if (stepIndex >= chain.length)
+    return Object.freeze({ advance: false, reason: "CHAIN_EXHAUSTED" });
+  if (!(remainingMs >= ENDPOINT_CHAIN_MIN_STEP_MS))
+    return Object.freeze({ advance: false, reason: "NO_TIME_LEFT" });
+  return Object.freeze({
+    advance: true,
+    stepIndex,
+    selection: chain[stepIndex],
+  });
+}
+
+/**
+ * When a busy step stops waiting for admission. Every step but the last gets
+ * an equal share of the time left, at most ENDPOINT_CHAIN_STEP_ADMISSION_MS;
+ * the last step, like a single model, waits until the attempt deadline.
+ */
+export function endpointChainStepAdmissionDeadline({
+  startedAtMs,
+  deadlineMs,
+  stepIndex,
+  stepCount,
+}) {
+  if (stepIndex >= stepCount - 1) return deadlineMs;
+  const share = Math.floor(
+    (deadlineMs - startedAtMs) / (stepCount - stepIndex)
+  );
+  return Math.min(
+    deadlineMs,
+    startedAtMs + Math.max(0, Math.min(ENDPOINT_CHAIN_STEP_ADMISSION_MS, share))
+  );
+}

package/lib/sellable-agent/fly-customer-image/runs-api-health-check.mjs

@@ -1,7 +1,11 @@
 import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
-import { compileEndpointModelSelection } from "./endpoint-model-selection.mjs";
+import {
+  compileEndpointModelSelection,
+  endpointModelSelectionChain,
+  endpointModelSelectionSource,
+} from "./endpoint-model-selection.mjs";
 import { createHermesRunsClient } from "./hermes-runs-client.mjs";
 import {
   createConfiguredRunsClient,
@@ -132,8 +136,12 @@ export async function verifyRunsApiSelection(
     !/^[A-Za-z0-9_-]{1,128}$/.test(request.profileId ?? "")
   )
     return result("NOT_CONFIGURED");
-  const selection = compileEndpointModelSelection(request.modelSelection);
-  if (selection === "invalid") return result("NOT_CONFIGURED");
+  const compiled = compileEndpointModelSelection(request.modelSelection);
+  if (compiled === "invalid") return result("NOT_CONFIGURED");
+  // A fallback chain is verified one step per call. The control plane sends
+  // the primary step's check the whole chain, so a machine whose compiler
+  // cannot run a chain refuses it here and no chain is saved for it.
+  const selection = endpointModelSelectionChain(compiled)[0] ?? null;
   let verificationWorkKind = "STANDARD";
   if (selection?.runsApiBaseUrl) {
     const connection = runsApiConnectionsForRuntime(
@@ -156,7 +164,7 @@ export async function verifyRunsApiSelection(
       const readiness = await health(request, { env });
       if (readiness.state !== "READY") return readiness;
     }
-  } else if (request.connectionId !== (selection ? "openrouter" : "default"))
+  } else if (request.connectionId !== endpointModelSelectionSource(selection))
     return result("NOT_CONFIGURED");
   const apiKeyFile =
     env.SELLABLE_AGENT_SERVER_AUTHENTICATED_KIND === "ADMIN"
@@ -183,10 +191,13 @@ export async function verifyRunsApiSelection(
           },
         })
       : makeDefaultClient({ apiKeyFile });
+    // A fresh token per check. Claude Opus 5.5 answers one fixed string
+    // ("SELLABLE_CONNECTION_OK") with nothing, so Claude Code fell back to
+    // another model and every Claude Code verification failed.
+    const token = `ready-${randomUUID().replaceAll("-", "").slice(0, 8)}`;
     const compiled = {
-      input: "Connection verification. Reply with SELLABLE_CONNECTION_OK.",
-      instructions:
-        "This is a connection check. Do not use tools or take actions. Return exactly SELLABLE_CONNECTION_OK and nothing else.",
+      input: `Connection verification. Reply with ${token}.`,
+      instructions: `This is a connection check. Do not use tools or take actions. Return exactly ${token} and nothing else.`,
       conversationHistory: [],
       correlation: `connection-check-${randomUUID()}`,
       ...(selection ? { modelSelection: selection } : {}),
@@ -203,7 +214,7 @@ export async function verifyRunsApiSelection(
     if (
       status.status !== "completed" ||
       typeof status.output !== "string" ||
-      status.output.trim() !== "SELLABLE_CONNECTION_OK" ||
+      status.output.trim() !== token ||
       !served
     )
       return result("UNAVAILABLE");