@sellable/install 0.1.803 → 0.1.804

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -131,7 +131,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.803";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.804";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.957";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;
@@ -1979,15 +1979,44 @@ export function createCustomerEndpointRelay(options = {}) {
     const chained = chain.length > 1;
     // A one-model run is a chain of one; no selection is the Agent default.
     const steps = chain.length ? chain : [null];
-    const stepClaim = (index) =>
-      chain.length === 0
-        ? claim
-        : { ...claim, run: { ...claim.run, modelSelection: chain[index] } };
-    const runs = createRunsClient({
-      apiKeyFile,
-      claim: stepClaim(0),
-      activeRuntime,
-    });
+    // No selection is the Agent default, built here as before (the opener
+    // stages use it). A chain opens each step inside the run loop instead.
+    const runs = chain.length
+      ? null
+      : await createRunsClient({ apiKeyFile, claim, activeRuntime });
+    // A workspace connection step's key, released to this attempt only. Its
+    // literal values are scrubbed from this attempt's error code: the
+    // diagnostic patterns miss a hex key and an srt_ grant.
+    const released = [];
+    const fetchConnectionKey = async (connectionId, chainStep) => {
+      const value = await getControlClient().fetchEndpointConnectionKey({
+        ...identity,
+        schemaVersion: "sellable-agent-endpoint-connection-key/v1",
+        connectionId,
+        chainStep,
+      });
+      for (const secret of [value?.apiKey, value?.tools?.authorization])
+        if (typeof secret === "string" && secret) released.push(secret);
+      return value;
+    };
+    // A step whose client cannot be opened sent nothing for this step; it
+    // counts as a clean failure (STEP_UNAVAILABLE).
+    const openStep = async (index) => {
+      try {
+        return await createRunsClient({
+          apiKeyFile,
+          claim: {
+            ...claim,
+            run: { ...claim.run, modelSelection: chain[index] },
+          },
+          activeRuntime,
+          chainStep: index,
+          fetchConnectionKey,
+        });
+      } catch {
+        return null;
+      }
+    };
     const controller = new AbortController();
     const abortFromOuter = () => controller.abort(outerSignal.reason);
     outerSignal.addEventListener("abort", abortFromOuter, { once: true });
@@ -2460,7 +2489,7 @@ export function createCustomerEndpointRelay(options = {}) {
         (descriptorBinding.expected.allowedToolNames ?? []).length === 0;
       const history = [];
       let stepIndex = 0;
-      let stepRuns = runs;
+      let stepRuns = chain.length ? await openStep(0) : runs;
       for (;;) {
         const outcome = await runNativeStep(stepIndex, stepRuns);
         if (outcome.done) return outcome.result;
@@ -2492,16 +2521,7 @@ export function createCustomerEndpointRelay(options = {}) {
         );
         history.push(outcome.failure);
         stepIndex = decision.stepIndex;
-        try {
-          stepRuns = createRunsClient({
-            apiKeyFile,
-            claim: stepClaim(stepIndex),
-            activeRuntime,
-          });
-        } catch {
-          // Nothing was sent for this step; it counts as a clean failure.
-          stepRuns = null;
-        }
+        stepRuns = await openStep(stepIndex);
       }
     } catch (error) {
       if (heartbeatFailure) throw heartbeatFailure;
@@ -2554,10 +2574,16 @@ export function createCustomerEndpointRelay(options = {}) {
         ok: false,
         code:
           error instanceof Error
-            ? redactRuntimeDiagnostic(error.message)
+            ? redactRuntimeDiagnostic(
+                released.reduce(
+                  (text, secret) => text.replaceAll(secret, "[redacted]"),
+                  error.message
+                )
+              )
             : "customer_endpoint_relay_failed",
       };
     } finally {
+      released.length = 0;
       clearTimeout(deadlineTimer);
       outerSignal.removeEventListener("abort", abortFromOuter);
       heartbeatStopped = true;

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.d.mts

@@ -20,6 +20,7 @@ export type EndpointModelStep = Readonly<{
   model: string;
   reasoningEffort: (typeof ENDPOINT_MODEL_REASONING_EFFORTS)[number];
   runsApiBaseUrl?: string;
+  modelConnectionId?: string;
 }>;
 export type EndpointModelSelection = Readonly<
   EndpointModelStep & {

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.mjs

@@ -50,17 +50,24 @@ export function normalizeRunsApiBaseUrl(value) {
 }
 
 // One model: provider, model, effort and, for a custom Runs API, its URL.
+// A custom step may also name the workspace's own model connection
+// (modelConnectionId), which is always https. Skew: an older runtime refuses
+// that unknown key as "invalid", so Verify & save refuses a connection step
+// on a machine that cannot fetch its key per attempt.
 function compileEndpointModelStep(value, extraKeys = []) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const custom = Object.hasOwn(value, "runsApiBaseUrl");
+  const connection = Object.hasOwn(value, "modelConnectionId");
   if (
     Object.keys(value)
       .filter((key) => !extraKeys.includes(key))
       .sort()
       .join(",") !==
-    (custom
-      ? "model,provider,reasoningEffort,runsApiBaseUrl"
-      : "model,provider,reasoningEffort")
+    (connection
+      ? "model,modelConnectionId,provider,reasoningEffort,runsApiBaseUrl"
+      : custom
+        ? "model,provider,reasoningEffort,runsApiBaseUrl"
+        : "model,provider,reasoningEffort")
   )
     return null;
   const { provider, model, reasoningEffort } = value;
@@ -86,11 +93,20 @@ function compileEndpointModelStep(value, extraKeys = []) {
       !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(model))
   )
     return null;
+  const { modelConnectionId } = value;
+  if (
+    connection &&
+    (typeof modelConnectionId !== "string" ||
+      !/^[A-Za-z0-9_-]{1,128}$/.test(modelConnectionId) ||
+      !runsApiBaseUrl.startsWith("https://"))
+  )
+    return null;
   return Object.freeze({
     provider,
     model,
     reasoningEffort,
     ...(custom ? { runsApiBaseUrl } : {}),
+    ...(connection ? { modelConnectionId } : {}),
   });
 }
 
@@ -98,7 +114,8 @@ const sameStep = (left, right) =>
   left.provider === right.provider &&
   left.model === right.model &&
   left.reasoningEffort === right.reasoningEffort &&
-  left.runsApiBaseUrl === right.runsApiBaseUrl;
+  left.runsApiBaseUrl === right.runsApiBaseUrl &&
+  left.modelConnectionId === right.modelConnectionId;
 
 /**
  * The top-level fields are the endpoint's first model. An optional ordered

package/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs

@@ -244,6 +244,36 @@ export function validateOpenerOutputContract(value) {
   return JSON.parse(stableJson(value));
 }
 
+// One remote MCP server for the run, in the OpenAI Responses tool shape.
+function compileRemoteTools(value) {
+  const serverUrl = normalizeRunsApiBaseUrl(value?.serverUrl);
+  const names = value?.allowedTools;
+  if (
+    !exactObject(value) ||
+    Object.keys(value).sort().join(",") !==
+      "allowedTools,authorization,serverUrl" ||
+    !serverUrl?.startsWith("https://") ||
+    typeof value.authorization !== "string" ||
+    !/^srt_[A-Za-z0-9-]{1,128}_[A-Za-z0-9_-]{43}$/.test(value.authorization) ||
+    !Array.isArray(names) ||
+    names.length < 1 ||
+    names.length > 32 ||
+    new Set(names).size !== names.length ||
+    names.some(
+      (name) => typeof name !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(name)
+    )
+  )
+    throw new Error("hermes_runs_submit_rejected");
+  return Object.freeze({
+    type: "mcp",
+    server_label: "sellable",
+    server_url: serverUrl,
+    authorization: value.authorization,
+    allowed_tools: [...names],
+    require_approval: "never",
+  });
+}
+
 function compileCreateBody(input, openerStage = false, verification = false) {
   if (!exactObject(input)) throw new Error("hermes_runs_submit_rejected");
   const allowed = [
@@ -253,6 +283,7 @@ function compileCreateBody(input, openerStage = false, verification = false) {
     "correlation",
     "outputContract",
     ...(openerStage && !verification ? [] : ["modelSelection"]),
+    ...(openerStage ? [] : ["remoteTools"]),
   ];
   if (Object.keys(input).some((key) => !allowed.includes(key))) {
     throw new Error("hermes_runs_submit_rejected");
@@ -288,6 +319,10 @@ function compileCreateBody(input, openerStage = false, verification = false) {
     input.outputContract === undefined
       ? null
       : validateOpenerOutputContract(input.outputContract);
+  const remoteTools =
+    input.remoteTools === undefined
+      ? null
+      : compileRemoteTools(input.remoteTools);
   const modelOptions = {
     ...(modelSelection === null
       ? {}
@@ -309,6 +344,7 @@ function compileCreateBody(input, openerStage = false, verification = false) {
     ...(Object.keys(modelOptions).length === 0
       ? {}
       : { model_options: modelOptions }),
+    ...(remoteTools === null ? {} : { tools: [remoteTools] }),
   });
 }
 
@@ -585,6 +621,7 @@ function submitNotAdmitted(response, value) {
 /** @param {any} options */
 export function createHermesRunsClient(options = {}) {
   const {
+    apiKey: inMemoryKey,
     apiKeyFile,
     baseUrl = LOOPBACK_ORIGIN,
     scopeHeaders = {},
@@ -596,9 +633,22 @@ export function createHermesRunsClient(options = {}) {
   const origin = normalizeRunsApiBaseUrl(baseUrl);
   if (
     !origin ||
+    // Exactly one key source. An in-memory key (a workspace model connection)
+    // follows that key's own rule, never readApiKey's key-file rule.
+    (inMemoryKey === undefined) === (apiKeyFile === undefined) ||
+    (inMemoryKey !== undefined &&
+      (typeof inMemoryKey !== "string" ||
+        inMemoryKey.length < 16 ||
+        inMemoryKey.length > 1024 ||
+        /[\s\x00-\x1f\x7f]/.test(inMemoryKey))) ||
     !exactObject(scopeHeaders) ||
-    Object.keys(scopeHeaders).some(key => !["x-sellable-workspace-id", "x-sellable-agent-id"].includes(key)) ||
-    Object.values(scopeHeaders).some(value => typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)) ||
+    Object.keys(scopeHeaders).some(
+      (key) => !["x-sellable-workspace-id", "x-sellable-agent-id"].includes(key)
+    ) ||
+    Object.values(scopeHeaders).some(
+      (value) =>
+        typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)
+    ) ||
     typeof fetchImpl !== "function" ||
     !Number.isSafeInteger(timeoutMs) ||
     timeoutMs < 100 ||
@@ -606,7 +656,7 @@ export function createHermesRunsClient(options = {}) {
   ) {
     throw new Error("hermes_runs_client_rejected");
   }
-  const apiKey = readApiKey(apiKeyFile);
+  const apiKey = inMemoryKey ?? readApiKey(apiKeyFile);
   const request = async (path, init = {}) => {
     if (!path.startsWith("/v1/runs")) {
       throw new Error("hermes_runs_path_rejected");
@@ -624,7 +674,12 @@ export function createHermesRunsClient(options = {}) {
       signal: init.signal ?? AbortSignal.timeout(timeoutMs),
     });
   };
-  const submit = async (compiled, { signal } = {}, openerStage = false, verification = false) => {
+  const submit = async (
+    compiled,
+    { signal } = {},
+    openerStage = false,
+    verification = false
+  ) => {
     const body = compileCreateBody(compiled, openerStage, verification);
     let response;
     try {
@@ -668,7 +723,8 @@ export function createHermesRunsClient(options = {}) {
     fixtureIdentity: HERMES_RUNS_FIXTURE_IDENTITY,
     submit: (compiled, options) => submit(compiled, options),
     // Fixed operator verification uses the existing tool-free session policy.
-    submitVerification: (compiled, options) => submit(compiled, options, true, true),
+    submitVerification: (compiled, options) =>
+      submit(compiled, options, true, true),
     // Only this reserved session prefix receives the pinned tool-free bridge policy.
     submitOpenerStage: (compiled, options) => submit(compiled, options, true),
     async status(runId, { signal } = {}) {

package/lib/sellable-agent/fly-customer-image/openai-runs-client.d.mts

@@ -1,6 +1,8 @@
 import type { RunsApiConnection } from "./runs-api-connections.mjs";
 export function createOpenAiRunsClient(options: {
-  connection: RunsApiConnection;
+  connection: Omit<RunsApiConnection, "apiKeyFile"> & { apiKeyFile?: string };
+  /** Used instead of `connection.apiKeyFile` when present. */
+  apiKey?: string;
   responseSchema?: unknown;
   modelSelection?: { provider: string; model: string; reasoningEffort: string };
   fetchImpl?: typeof fetch;

package/lib/sellable-agent/fly-customer-image/openai-runs-client.mjs

@@ -30,6 +30,7 @@ export function createOpenAiRunsClient({
   connection,
   responseSchema,
   modelSelection,
+  apiKey,
   fetchImpl = fetch,
 }) {
   const runs = new Map();
@@ -265,7 +266,9 @@ export function createOpenAiRunsClient({
   };
   return createHermesRunsClient({
     baseUrl: connection.baseUrl,
-    apiKeyFile: connection.apiKeyFile,
+    ...(apiKey === undefined
+      ? { apiKeyFile: connection.apiKeyFile }
+      : { apiKey }),
     fetchImpl: bridge,
   });
 }

package/lib/sellable-agent/fly-customer-image/public-endpoint-guard.d.mts

@@ -0,0 +1,28 @@
+export type PublicEndpointGuardCode =
+  | "URL_REJECTED"
+  | "IP_LITERAL"
+  | "BLOCKED_NAME"
+  | "NON_PUBLIC_ADDRESS"
+  | "REDIRECT_REFUSED"
+  | "RESPONSE_TOO_LARGE"
+  | "DEADLINE_EXCEEDED";
+export type PublicEndpointGuardError = Error & {
+  code: PublicEndpointGuardCode;
+};
+export type PublicAddress = { address: string; family: number };
+export type PublicTarget = {
+  url: URL;
+  host: string;
+  addresses: PublicAddress[];
+};
+export function isPublicAddress(ip: string): boolean;
+export function resolvePublicTarget(
+  rawUrl: string,
+  options?: { lookup?: (host: string) => Promise<readonly PublicAddress[]> }
+): Promise<PublicTarget>;
+export function createPinnedFetch(options?: {
+  maxResponseBytes?: number;
+  deadlineMs?: number;
+  resolve?: (rawUrl: string) => Promise<PublicTarget>;
+  request?: typeof import("node:https").request;
+}): typeof fetch;

package/lib/sellable-agent/fly-customer-image/public-endpoint-guard.mjs

@@ -0,0 +1,209 @@
+// SSRF control for user-supplied endpoint URLs, shared by the Next server and
+// the agent machine. Node built-ins only.
+import { promises as dns } from "node:dns";
+import https from "node:https";
+import net from "node:net";
+import { Readable } from "node:stream";
+
+// IANA special-purpose registries (2025-10-09) plus metadata and CGNAT. There
+// is deliberately no ::ffff:0:0/96 row: a BlockList checks IPv4 addresses
+// against v4-mapped IPv6 rules, so that row would block every IPv4 answer.
+// v4-mapped answers are unwrapped and checked against the IPv4 rows instead.
+const V4 = [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4],
+];
+const V6 = [
+  ["::", 96],
+  ["64:ff9b::", 96],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001::", 23],
+  ["2001:db8::", 32],
+  ["2002::", 16],
+  ["3fff::", 20],
+  ["5f00::", 16],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8],
+];
+const blocked = new net.BlockList();
+for (const [address, prefix] of V4) blocked.addSubnet(address, prefix, "ipv4");
+for (const [address, prefix] of V6) blocked.addSubnet(address, prefix, "ipv6");
+
+// The IPv4 address an IPv4-mapped answer carries (::ffff:a.b.c.d in any
+// spelling), so its check never rests on BlockList's v4-in-v6 matching.
+function mappedIPv4(ip) {
+  let hostname;
+  try {
+    hostname = new URL(`http://[${ip}]`).hostname;
+  } catch {
+    return null;
+  }
+  const mapped = /^\[::ffff:([\da-f]{1,4}):([\da-f]{1,4})\]$/.exec(hostname);
+  if (!mapped) return null;
+  const [high, low] = [parseInt(mapped[1], 16), parseInt(mapped[2], 16)];
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+
+export function isPublicAddress(ip) {
+  const family = net.isIP(ip);
+  if (family === 0) return false;
+  const v4 = family === 4 ? ip : mappedIPv4(ip);
+  return v4 ? !blocked.check(v4, "ipv4") : !blocked.check(ip, "ipv6");
+}
+
+// Errors carry only the fixed code: never the URL, its credentials or headers.
+const refuse = (code) => Object.assign(new Error(code), { code });
+
+export async function resolvePublicTarget(
+  rawUrl,
+  { lookup = (host) => dns.lookup(host, { all: true, verbatim: true }) } = {}
+) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw refuse("URL_REJECTED");
+  }
+  // url.port is "" for the default (443) port, however it was written.
+  if (
+    url.protocol !== "https:" ||
+    url.port ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  ) {
+    throw refuse("URL_REJECTED");
+  }
+  const host = url.hostname.replace(/\.$/, "").toLowerCase();
+  if (net.isIP(host.replace(/^\[|\]$/g, ""))) throw refuse("IP_LITERAL");
+  if (/(^|\.)(localhost|local|internal|flycast|home\.arpa)$/.test(host)) {
+    throw refuse("BLOCKED_NAME");
+  }
+  const answers = await lookup(host);
+  if (!answers.length || answers.some((a) => !isPublicAddress(a.address))) {
+    throw refuse("NON_PUBLIC_ADDRESS");
+  }
+  return {
+    url,
+    host,
+    addresses: answers.map(({ address, family }) => ({ address, family })),
+  };
+}
+
+// A fetch that resolves and checks the target on every request, dials only
+// the vetted addresses (TLS SNI and certificate checks stay on the hostname)
+// and refuses every redirect. `request` is a test seam only.
+export function createPinnedFetch({
+  maxResponseBytes = 8 << 20,
+  deadlineMs = 120_000,
+  resolve = resolvePublicTarget,
+  request = https.request,
+} = {}) {
+  return async (input, init = {}) => {
+    // deadlineMs bounds DNS, connect and response headers only. Once headers
+    // arrive, only init.signal and the byte cap bound the body, so a long SSE
+    // stream or provider call is never cut here. A plain setTimeout (not
+    // AbortSignal.timeout) so it can be cleared.
+    const deadline = new AbortController();
+    const expired = new Promise((_, reject) => {
+      deadline.signal.addEventListener("abort", () =>
+        reject(deadline.signal.reason)
+      );
+    });
+    const timer = setTimeout(
+      () => deadline.abort(refuse("DEADLINE_EXCEEDED")),
+      deadlineMs
+    );
+    try {
+      const target = await Promise.race([resolve(String(input)), expired]);
+      // Both lookup shapes (Pitfall 2): net asks for { all: true } under
+      // autoSelectFamily; refuse any hostname other than the vetted one.
+      const lookup = (hostname, options, callback) => {
+        if (hostname !== target.host) return callback(refuse("ENOTFOUND"));
+        if (options?.all) return callback(null, target.addresses);
+        const [first] = target.addresses;
+        callback(null, first.address, first.family);
+      };
+      const method = (init.method ?? "GET").toUpperCase();
+      const headers =
+        init.headers instanceof Headers
+          ? Object.fromEntries(init.headers)
+          : init.headers;
+      const dial = new Promise((resolveResponse, reject) => {
+        const req = request(
+          {
+            hostname: target.host,
+            servername: target.host,
+            port: target.url.port || 443,
+            path: target.url.pathname + target.url.search,
+            method,
+            headers,
+            lookup,
+            agent: false,
+            signal: init.signal
+              ? AbortSignal.any([init.signal, deadline.signal])
+              : deadline.signal,
+          },
+          (res) => {
+            if (res.statusCode >= 300 && res.statusCode < 400) {
+              res.destroy();
+              return reject(refuse("REDIRECT_REFUSED"));
+            }
+            let seen = 0;
+            res.on("data", (chunk) => {
+              if ((seen += chunk.length) > maxResponseBytes) {
+                res.destroy(refuse("RESPONSE_TOO_LARGE"));
+              }
+            });
+            // An untrusted server can send what Response refuses (status 999):
+            // reject, never throw out of this callback (that kills the process).
+            try {
+              const responseHeaders = new Headers();
+              for (const [name, value] of Object.entries(res.headers)) {
+                for (const item of [].concat(value)) {
+                  responseHeaders.append(name, item);
+                }
+              }
+              const nullBody =
+                [204, 205].includes(res.statusCode) || method === "HEAD";
+              resolveResponse(
+                new Response(nullBody ? null : Readable.toWeb(res), {
+                  status: res.statusCode,
+                  statusText: res.statusMessage,
+                  headers: responseHeaders,
+                })
+              );
+            } catch (error) {
+              res.destroy();
+              reject(error);
+            }
+          }
+        );
+        req.on("error", reject);
+        if (init.body != null) req.write(init.body);
+        req.end();
+      });
+      return await Promise.race([dial, expired]);
+    } finally {
+      // Settles at response headers (or on any error): the deadline ends here.
+      clearTimeout(timer);
+    }
+  };
+}

package/lib/sellable-agent/fly-customer-image/runs-api-connections.d.mts

@@ -33,4 +33,4 @@ export function runsApiConnectionsForRuntime(
     agentId: string;
   }
 ): RunsApiConnection[];
-export function createConfiguredRunsClient(options: any): any;
+export function createConfiguredRunsClient(options: any): Promise<any>;