@sellable/install 0.1.802 → 0.1.804

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.802
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.804
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.802" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.804" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.957" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.802" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.802' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.804' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.802', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.804', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.802` is
+`@sellable/install@0.1.804` is
 published:
 
 ```sh

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -169,7 +169,7 @@ COPY fly-admin-image/start-admin-runtime /usr/local/lib/sellable-agent/admin-run
 COPY fly-customer-image/customer-runtime.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime.mjs
 COPY hermes-first-welcome.mjs /usr/local/lib/sellable-agent/hermes-first-welcome.mjs
 COPY fly-customer-image/hermes-runs-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs
-COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/claude-code-runs-api.mjs fly-customer-image/claude-code-mcp-session.mjs fly-customer-image/openai-runs-client.mjs fly-customer-image/runs-api-health-check.mjs /usr/local/lib/sellable-agent/fly-customer-image/
+COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/claude-code-runs-api.mjs fly-customer-image/claude-code-mcp-session.mjs fly-customer-image/openai-runs-client.mjs fly-customer-image/runs-api-health-check.mjs fly-customer-image/public-endpoint-guard.mjs fly-customer-image/workspace-connection-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/
 COPY fly-customer-image/opener-stage-execution.mjs /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs
 COPY fly-customer-image/endpoint-uat-completion-gate.mjs /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs
 COPY fly-customer-image/customer-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime-phase-telemetry.mjs
@@ -277,6 +277,8 @@ RUN set -eux; \
       /usr/local/lib/sellable-agent/fly-customer-image/runs-api-connections.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/claude-code-mcp-session.mjs \
+      /usr/local/lib/sellable-agent/fly-customer-image/public-endpoint-guard.mjs \
+      /usr/local/lib/sellable-agent/fly-customer-image/workspace-connection-client.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs \
       /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs \
       /usr/local/lib/sellable-agent/admin-native-gateway-supervisor.mjs \

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -61,9 +61,12 @@ import {
   SELLABLE_BROWSER_TOOLSET_DEFAULT_MARKER,
   sellableSlackToolsetsForMaterialization,
 } from "../fly-capabilities-bridge.mjs";
+import {
+  startConfiguredClaudeRunsApis,
+  startPublicClaudeRunsApi,
+} from "../fly-customer-image/claude-code-runs-api.mjs";
 import { createCustomerEndpointRelay } from "../fly-customer-image/customer-runtime.mjs";
 import { createHermesSessionRetention } from "../fly-customer-image/hermes-runs-client.mjs";
-import { startConfiguredClaudeRunsApis } from "../fly-customer-image/claude-code-runs-api.mjs";
 import {
   claimWithSoulObservation,
   createFlyCustomerControlClient,
@@ -3847,7 +3850,7 @@ async function runAdminProduction() {
   let customRunsServices = null;
   try {
     customRunsServices = await startConfiguredClaudeRunsApis({
-      diagnostic: value => process.stderr.write(`${JSON.stringify(value)}\n`),
+      diagnostic: (value) => process.stderr.write(`${JSON.stringify(value)}\n`),
       toolLanes: {
         turnDescriptorPath: join(MCP_TURN_CONTEXT_ROOT, "turn-context.json"),
         server: () =>
@@ -3857,7 +3860,19 @@ async function runAdminProduction() {
       },
     });
   } catch {
-    process.stderr.write(`${JSON.stringify({ ok: false, code: "custom_runs_api_start_failed" })}\n`);
+    process.stderr.write(
+      `${JSON.stringify({ ok: false, code: "custom_runs_api_start_failed" })}\n`
+    );
+  }
+  let publicRunsService = null;
+  try {
+    publicRunsService = await startPublicClaudeRunsApi({
+      diagnostic: (value) => process.stderr.write(`${JSON.stringify(value)}\n`),
+    });
+  } catch {
+    process.stderr.write(
+      `${JSON.stringify({ ok: false, code: "public_runs_api_start_failed" })}\n`
+    );
   }
   const endpointRelay = createCustomerEndpointRelay({
     getControlClient: () => client,
@@ -4496,6 +4511,7 @@ async function runAdminProduction() {
   }
   await endpointLoop;
   await customRunsServices?.stop();
+  await publicRunsService?.stop();
   await activeModelHealthReporter?.stop();
   await stopNativeGateway(activeGateway);
   await clearRuntimeSecrets();

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.802
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.804
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.202
 ARG ADMIN_MCP_INTEGRITY=sha512-ym3aye/0vQ8tfULJlKz9JFOxvIQsl1G+n3np+TTgK/tecwNblBo/j3AkTnRqH9iomKzPbZzP+n4tEQsvsU8ByA==
 ARG TUS_JS_CLIENT_VERSION=4.3.1
@@ -98,7 +98,7 @@ COPY hermes-memory-reconcile.sh /opt/sellable/share/hermes-memory-reconcile.sh
 COPY hermes-endpoint-cron.mjs /opt/sellable/bin/hermes-endpoint-cron
 COPY fly-customer-image/model-auth-store.mjs /usr/local/lib/sellable-agent/fly-customer-image/model-auth-store.mjs
 COPY fly-customer-image/hermes-runs-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs
-COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/openai-runs-client.mjs fly-customer-image/runs-api-health-check.mjs /usr/local/lib/sellable-agent/fly-customer-image/
+COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/openai-runs-client.mjs fly-customer-image/runs-api-health-check.mjs fly-customer-image/public-endpoint-guard.mjs fly-customer-image/workspace-connection-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/
 COPY fly-customer-image/opener-stage-execution.mjs /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs
 COPY fly-customer-image/endpoint-uat-completion-gate.mjs /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs
 COPY fly-customer-image/customer-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime-phase-telemetry.mjs

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.d.mts

@@ -10,7 +10,9 @@ export type ClaudeRunsRequest = {
   model: string;
   effort: string;
   sessionId: string;
-  tools: ClaudeRunsTools | null;
+  tools: ClaudeRunsTools | ClaudeRunsRemoteTools | null;
+  /** Remote tools: the run's private MCP config file, written by the service. */
+  mcpConfigPath?: string;
 };
 export type ClaudeRunsToolServer = {
   command: string;
@@ -18,6 +20,11 @@ export type ClaudeRunsToolServer = {
   env: Record<string, string>;
 };
 export type ClaudeRunsTools = { names: string[]; server: ClaudeRunsToolServer };
+/** The run's own remote MCP server and grant (public mode). */
+export type ClaudeRunsRemoteTools = {
+  names: string[];
+  remote: { url: string; authorization: string };
+};
 export type ClaudeRunsToolLanes = {
   turnDescriptorPath: string;
   server(): ClaudeRunsToolServer | null;
@@ -30,7 +37,11 @@ export type ClaudeRunsResult = {
 export type ClaudeRunsServer = Server & { stopActiveRuns(): Promise<void> };
 export type ClaudeRunsApiOptions = {
   token: string;
-  connection: RunsApiConnection;
+  /** Required in loopback mode; the public listener has none. */
+  connection?: RunsApiConnection;
+  mode?: "loopback" | "public";
+  /** The CLI and account root; defaults to the connection's localRoot. */
+  root?: string;
   execute?:
     | ((request: ClaudeRunsRequest) => {
         promise: Promise<ClaudeRunsResult>;
@@ -53,7 +64,8 @@ export type ClaudeRunsApiOptions = {
 };
 export function validateClaudeRunsRequest(
   body: unknown,
-  models: RunsApiConnection["models"]
+  /** null: the public rule (claude-* model, low/medium/high effort). */
+  models: RunsApiConnection["models"] | null
 ): ClaudeRunsRequest;
 export function endpointToolNames(options: {
   turnDescriptorPath: string;
@@ -96,6 +108,14 @@ export function startConfiguredClaudeRunsApis(options?: {
   toolLanes?: ClaudeRunsToolLanes | null;
 }): Promise<{ stop(): Promise<void> }>;
 
+export function startPublicClaudeRunsApi(options?: {
+  env?: Record<string, string | undefined>;
+  diagnostic?: (entry: Record<string, unknown>) => void;
+  root?: string;
+  createApi?: typeof createClaudeRunsApi;
+  readToken?: (path: string) => string;
+}): Promise<{ stop(): Promise<void> } | null>;
+
 export function readClaudeAuthentication(options: {
   root: string;
   configDir?: string;

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs

@@ -2,8 +2,10 @@ import { execFile, spawn } from "node:child_process";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import {
   appendFileSync,
+  chmodSync,
   existsSync,
   lstatSync,
+  mkdirSync,
   readdirSync,
   readFileSync,
   rmSync,
@@ -16,6 +18,7 @@ import {
   endpointHermesSessionId,
   endpointMcpDescriptorPath,
 } from "../mcp-context-proxy.mjs";
+import { normalizeRunsApiBaseUrl } from "./endpoint-model-selection.mjs";
 import { validateOpenerOutputContract } from "./hermes-runs-client.mjs";
 import {
   parseRunsApiConnections,
@@ -33,6 +36,42 @@ const MCP_SESSION = fileURLToPath(
 );
 const hash = (s) => createHash("sha256").update(s).digest("hex");
 const record = (v) => v && typeof v === "object" && !Array.isArray(v);
+// The public service (models null) has no model list: any Claude model, at
+// the efforts the CLI takes.
+const publicModel = (body) =>
+  typeof body.model === "string" &&
+  /^claude-[a-z0-9-]{1,100}$/.test(body.model) &&
+  ["low", "medium", "high"].includes(body.model_options.reasoning_effort);
+
+// The run's one remote MCP server, in the shape the Runs client sends it.
+function remoteTools(tools) {
+  const entry = Array.isArray(tools) && tools.length === 1 ? tools[0] : null;
+  const url = normalizeRunsApiBaseUrl(entry?.server_url);
+  const names = entry?.allowed_tools;
+  if (
+    !record(entry) ||
+    Object.keys(entry).sort().join(",") !==
+      "allowed_tools,authorization,require_approval,server_label,server_url,type" ||
+    entry.type !== "mcp" ||
+    entry.server_label !== "sellable" ||
+    entry.require_approval !== "never" ||
+    !url?.startsWith("https://") ||
+    typeof entry.authorization !== "string" ||
+    !/^srt_[A-Za-z0-9-]{1,128}_[A-Za-z0-9_-]{43}$/.test(entry.authorization) ||
+    !Array.isArray(names) ||
+    names.length < 1 ||
+    names.length > 32 ||
+    new Set(names).size !== names.length ||
+    names.some(
+      (name) => typeof name !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(name)
+    )
+  )
+    throw new Error("claude_runs_tools_rejected");
+  return {
+    names: [...names],
+    remote: { url, authorization: entry.authorization },
+  };
+}
 
 export function validateClaudeRunsRequest(body, models) {
   const allowed = [
@@ -43,6 +82,7 @@ export function validateClaudeRunsRequest(body, models) {
     "provider",
     "model",
     "model_options",
+    ...(models === null ? ["tools"] : []),
   ];
   if (
     !record(body) ||
@@ -70,12 +110,14 @@ export function validateClaudeRunsRequest(body, models) {
       (key) =>
         !["reasoning_effort", "sellable_opener_output_contract"].includes(key)
     ) ||
-    !models.some(
-      (model) =>
-        model.provider === body.provider &&
-        model.model === body.model &&
-        model.reasoningEfforts.includes(body.model_options.reasoning_effort)
-    )
+    !(models === null
+      ? publicModel(body)
+      : models.some(
+          (model) =>
+            model.provider === body.provider &&
+            model.model === body.model &&
+            model.reasoningEfforts.includes(body.model_options.reasoning_effort)
+        ))
   )
     throw new Error("claude_runs_request_rejected");
   const contract = body.model_options.sellable_opener_output_contract;
@@ -95,7 +137,7 @@ export function validateClaudeRunsRequest(body, models) {
     model: body.model,
     effort: body.model_options.reasoning_effort,
     sessionId: body.session_id,
-    tools: null,
+    tools: body.tools === undefined ? null : remoteTools(body.tools),
   };
 }
 
@@ -162,18 +204,22 @@ export function claudeInvocation(
       "dontAsk",
       "--strict-mcp-config",
       "--mcp-config",
-      // A tool lane's only MCP server is the run's own session wrapper; its
-      // allowed tools are exactly the descriptor's. Every other run has none.
+      // A tool lane's only MCP server is the run's own session wrapper, and a
+      // public run's is its own remote server, read from its private file.
+      // Either way its allowed tools are exactly the run's. Every other run
+      // has none.
       ...(request.tools
         ? [
-            JSON.stringify({
-              mcpServers: {
-                sellable: {
-                  command: process.execPath,
-                  args: [MCP_SESSION, mcpSpecPath],
-                },
-              },
-            }),
+            request.tools.remote
+              ? request.mcpConfigPath
+              : JSON.stringify({
+                  mcpServers: {
+                    sellable: {
+                      command: process.execPath,
+                      args: [MCP_SESSION, mcpSpecPath],
+                    },
+                  },
+                }),
             "--allowedTools",
             request.tools.names
               .map((name) => `mcp__sellable__${name}`)
@@ -332,6 +378,9 @@ export function claudeUsageLimit(stdout, now = Date.now()) {
   return { retryAt };
 }
 
+// A failure reason the run may report: a fixed code, never raw CLI text.
+const RUN_FAILURE_CODE = /^claude_runs_[a-z_]{1,48}$/;
+
 export function parseClaudeResult(stdout, request) {
   const result = JSON.parse(stdout);
   const models = Object.keys(result.modelUsage ?? {});
@@ -341,15 +390,19 @@ export function parseClaudeResult(stdout, request) {
     result.subtype !== "success" ||
     (request.schema
       ? !record(result.structured_output)
-      : typeof result.result !== "string") ||
-    (result.permission_denials ?? []).length ||
+      : typeof result.result !== "string")
+  )
+    throw new Error("claude_runs_output_rejected");
+  if ((result.permission_denials ?? []).length)
+    throw new Error("claude_runs_permission_denied");
+  if (
     !models.length ||
     models.some(
       (model) =>
         model !== request.model && !model.startsWith(`${request.model}-`)
     )
   )
-    throw new Error("claude_runs_output_rejected");
+    throw new Error("claude_runs_model_mismatch");
   const output = request.schema
     ? JSON.stringify(result.structured_output)
     : result.result;
@@ -379,7 +432,7 @@ export function startClaudeRun(
 ) {
   // The tool server's environment travels in a private per-run file, never
   // in argv, and is removed when the run ends.
-  const mcpSpecPath = request.tools
+  const mcpSpecPath = request.tools?.server
     ? join(root, "work", `mcp-session-${randomBytes(12).toString("hex")}.json`)
     : null;
   if (mcpSpecPath)
@@ -447,8 +500,12 @@ export function startClaudeRun(
         return reject(new Error(reason ?? "claude_runs_cli_failed"));
       try {
         resolve(parseClaudeResult(stdout, request));
-      } catch {
-        reject(new Error("claude_runs_output_rejected"));
+      } catch (error) {
+        reject(
+          error instanceof Error && RUN_FAILURE_CODE.test(error.message)
+            ? error
+            : new Error("claude_runs_output_rejected")
+        );
       }
     });
     child.stdin.on("error", () => {});
@@ -457,9 +514,38 @@ export function startClaudeRun(
   return { promise, stop };
 }
 
+// A public run's remote server and grant, in a 0600 file under a 0700
+// directory of its own: never in argv or the CLI's environment.
+function writeRemoteMcpConfig(dir, remote) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+  const stat = lstatSync(dir);
+  if (stat.isSymbolicLink() || !stat.isDirectory() || (stat.mode & 0o077) !== 0)
+    throw new Error("claude_runs_run_directory_rejected");
+  const path = join(dir, "mcp.json");
+  writeFileSync(
+    path,
+    JSON.stringify({
+      mcpServers: {
+        sellable: {
+          type: "http",
+          url: remote.url,
+          headers: { Authorization: `Bearer ${remote.authorization}` },
+        },
+      },
+    }),
+    { mode: 0o600, flag: "wx" }
+  );
+  return path;
+}
+
 export function createClaudeRunsApi({
   token,
   connection,
+  // "public": the Admin's internet-facing listener. The bearer is its only
+  // scope, and a run's tools come from its own request, never a local lane.
+  mode = "loopback",
+  root = connection?.localRoot,
   execute = null,
   audit = () => {},
   maxConcurrency = CLAUDE_RUNS_MAX_CONCURRENCY,
@@ -468,8 +554,8 @@ export function createClaudeRunsApi({
   maxToolConcurrency = CLAUDE_RUNS_MAX_CONCURRENCY,
   toolLanes = null,
   checkAuthentication = (configDir) =>
-    readClaudeAuthentication({ root: connection.localRoot, configDir }),
-  accounts = () => claudeAccountDirs(connection.localRoot),
+    readClaudeAuthentication({ root, configDir }),
+  accounts = () => claudeAccountDirs(root),
   startRun = startClaudeRun,
   now = Date.now,
 } = {}) {
@@ -522,10 +608,7 @@ export function createClaudeRunsApi({
             failure ??= "claude_runs_sign_in_required";
             continue;
           }
-          activeRun = startRun(request, {
-            root: connection.localRoot,
-            configDir,
-          });
+          activeRun = startRun(request, { root, configDir });
           try {
             return await activeRun.promise;
           } catch (error) {
@@ -650,12 +733,21 @@ export function createClaudeRunsApi({
     )
       return json(res, 401, { error: "claude_runs_auth_required" });
     if (
-      req.headers["x-sellable-workspace-id"] !== connection.workspaceId ||
-      req.headers["x-sellable-agent-id"] !== connection.agentId
+      mode !== "public" &&
+      (req.headers["x-sellable-workspace-id"] !== connection.workspaceId ||
+        req.headers["x-sellable-agent-id"] !== connection.agentId)
     )
       return json(res, 403, { error: "claude_runs_scope_rejected" });
     if (req.method === "GET" && req.url === "/health") {
       const { authentication, accounts: accountHealth } = await readHealth();
+      // Public health names no accounts, load, or scope.
+      if (mode === "public")
+        return json(res, 200, {
+          ok: authentication === "READY",
+          authentication,
+          provider: "claude-code",
+          tools: ["mcp"],
+        });
       return json(res, 200, {
         ok: authentication === "READY",
         authentication,
@@ -670,7 +762,7 @@ export function createClaudeRunsApi({
       });
     }
     if (req.method === "POST" && req.url === "/v1/runs") {
-      if (full("plain") && (!toolLanes || full("tools")))
+      if (full("plain") && ((mode !== "public" && !toolLanes) || full("tools")))
         return json(res, 429, { error: "claude_runs_busy" });
       let request;
       try {
@@ -685,8 +777,12 @@ export function createClaudeRunsApi({
           chunks.push(chunk);
         }
         const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-        request = validateClaudeRunsRequest(body, connection.models);
-        request.tools = resolveTools(request);
+        request = validateClaudeRunsRequest(
+          body,
+          mode === "public" ? null : connection.models
+        );
+        // A public run's tools are its own entry's, never a local lane's.
+        if (mode !== "public") request.tools = resolveTools(request);
       } catch (error) {
         recordAudit({
           status: "request-rejected",
@@ -709,7 +805,18 @@ export function createClaudeRunsApi({
       };
       inFlight[pool]++;
       runs.set(run.run_id, run);
+      const runDir = request.tools?.remote
+        ? join(root, "work", "runs", run.run_id)
+        : null;
+      const removeRunDir = () => {
+        if (runDir) rmSync(runDir, { recursive: true, force: true });
+      };
       try {
+        if (runDir)
+          request.mcpConfigPath = writeRemoteMcpConfig(
+            runDir,
+            request.tools.remote
+          );
         run.execution = executeRun(request);
         run.execution.promise
           .then(
@@ -728,19 +835,21 @@ export function createClaudeRunsApi({
                   ? { status: "cancelled" }
                   : {
                       status: "failed",
-                      error: [
-                        "claude_runs_sign_in_required",
-                        "claude_runs_auth_check_unavailable",
-                        "claude_runs_usage_limited",
-                      ].includes(error.message)
+                      // The reason, so a failure can be told apart later;
+                      // anything else the CLI threw stays generic.
+                      error: RUN_FAILURE_CODE.test(error?.message ?? "")
                         ? error.message
                         : "claude_runs_generation_failed",
                     }
               )
           )
-          .finally(() => inFlight[pool]--);
+          .finally(() => {
+            inFlight[pool]--;
+            removeRunDir();
+          });
       } catch {
         inFlight[pool]--;
+        removeRunDir();
         terminal(run, "run.failed", {
           status: "failed",
           error: "claude_runs_cli_unavailable",
@@ -812,13 +921,34 @@ export function createClaudeRunsApi({
   return server;
 }
 
+const readKey = (path) => readFileSync(path, "utf8").trim();
+// Every listener audits to its own root and stops its runs before closing.
+const auditTo = (root) => (entry) =>
+  appendFileSync(
+    `${root}/audit.jsonl`,
+    `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`,
+    { mode: 0o600 }
+  );
+const listen = (server, port, host) =>
+  new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, resolve);
+  });
+async function stopServer(server) {
+  await server.stopActiveRuns();
+  await new Promise((resolve) => {
+    server.close(resolve);
+    server.closeAllConnections();
+  });
+}
+
 // The Admin runtime owns these listeners for its lifetime. Image-owned startup
 // plus the persistent CLI/auth directory makes normal restarts repeatable.
 export async function startConfiguredClaudeRunsApis({
   env = process.env,
   diagnostic = () => {},
   createApi = createClaudeRunsApi,
-  readToken = (path) => readFileSync(path, "utf8").trim(),
+  readToken = readKey,
   toolLanes = null,
 } = {}) {
   const services = [];
@@ -836,21 +966,13 @@ export async function startConfiguredClaudeRunsApis({
         token,
         connection,
         toolLanes,
-        audit: (entry) =>
-          appendFileSync(
-            `${connection.localRoot}/audit.jsonl`,
-            `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`,
-            { mode: 0o600 }
-          ),
-      });
-      await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(
-          Number(new URL(connection.baseUrl).port),
-          "127.0.0.1",
-          resolve
-        );
+        audit: auditTo(connection.localRoot),
       });
+      await listen(
+        server,
+        Number(new URL(connection.baseUrl).port),
+        "127.0.0.1"
+      );
       services.push(server);
       diagnostic({
         ok: true,
@@ -863,13 +985,45 @@ export async function startConfiguredClaudeRunsApis({
   }
   return {
     async stop() {
-      for (const server of services) {
-        await server.stopActiveRuns();
-        await new Promise((resolve) => {
-          server.close(resolve);
-          server.closeAllConnections();
-        });
-      }
+      for (const server of services) await stopServer(server);
     },
   };
 }
+
+// The Admin's internet-facing listener; Fly terminates TLS at the edge. It
+// starts only on a declared port with the machine's private connection key.
+export async function startPublicClaudeRunsApi({
+  env = process.env,
+  diagnostic = () => {},
+  root = "/opt/data/private-opener",
+  createApi = createClaudeRunsApi,
+  readToken = readKey,
+} = {}) {
+  const value = env.SELLABLE_AGENT_PUBLIC_RUNS_SERVICE_PORT ?? "";
+  const port = Number(value);
+  const keyFile = `${root}/api-key`;
+  let key = null;
+  try {
+    key = lstatSync(keyFile);
+  } catch {
+    /* No key, no public listener. */
+  }
+  if (
+    !/^[0-9]{4,5}$/.test(value) ||
+    port < 1024 ||
+    port > 65535 ||
+    // lstat: a symlink is not a file.
+    !key?.isFile() ||
+    (key.mode & 0o077) !== 0
+  )
+    return null;
+  const server = createApi({
+    mode: "public",
+    token: readToken(keyFile),
+    root,
+    audit: auditTo(root),
+  });
+  await listen(server, port, "0.0.0.0");
+  diagnostic({ ok: true, code: "claude_runs_public_api_ready", port });
+  return { stop: () => stopServer(server) };
+}