@sellable/install 0.1.803 → 0.1.804

package/lib/sellable-agent/fly-customer-image/runs-api-connections.mjs

@@ -5,6 +5,8 @@ import {
 } from "./endpoint-model-selection.mjs";
 import { createHermesRunsClient } from "./hermes-runs-client.mjs";
 import { createOpenAiRunsClient } from "./openai-runs-client.mjs";
+import { createPinnedFetch } from "./public-endpoint-guard.mjs";
+import { createWorkspaceConnectionRunsClient } from "./workspace-connection-client.mjs";
 
 export const RUNS_API_CONNECTIONS_ENV =
   "SELLABLE_AGENT_RUNS_API_CONNECTIONS_JSON";
@@ -202,14 +204,107 @@ export function runsApiConnectionsForRuntime(raw, runtime) {
   );
 }
 
+// Exactly the members the endpoint-connection-key verb returns. The key follows
+// the saved key's rule (16-1024 characters), never the key-file rule; the
+// remote tool's values are checked where the create body is built.
+const connectionRelease = (value) =>
+  record(value) &&
+  Object.keys(value).sort().join(",") ===
+    "apiKey,keyGeneration,protocol,structuredOutputs,tools" &&
+  typeof value.apiKey === "string" &&
+  value.apiKey.length >= 16 &&
+  value.apiKey.length <= 1024 &&
+  !/[\s\x00-\x1f\x7f]/.test(value.apiKey) &&
+  Number.isSafeInteger(value.keyGeneration) &&
+  ["runs-api", "openai-chat", "openai-responses"].includes(value.protocol) &&
+  typeof value.structuredOutputs === "boolean" &&
+  (value.tools === null ||
+    (value.protocol === "runs-api" &&
+      record(value.tools) &&
+      Object.keys(value.tools).sort().join(",") ===
+        "allowedTools,authorization,expiresAt,serverUrl" &&
+      typeof value.tools.serverUrl === "string" &&
+      typeof value.tools.authorization === "string" &&
+      Array.isArray(value.tools.allowedTools) &&
+      typeof value.tools.expiresAt === "string"));
+
+// Adds the opener output contract (and a granted remote tool) to every submit.
+function customRunsClient(client, claim, remoteTools) {
+  return Object.freeze({
+    ...client,
+    submit(compiled, options) {
+      const request = remoteTools ? { ...compiled, remoteTools } : compiled;
+      // Public semantic endpoints have a published schema but no product tuple.
+      // Preserve that existing contract when calling a custom Runs service.
+      const schema = claim.revision?.outputSchema;
+      if (compiled.outputContract || !schema?.properties?.proposal)
+        return client.submit(request, options);
+      return client.submit(
+        {
+          ...request,
+          outputContract: {
+            schemaVersion: "sellable-opener-output-contract/v1",
+            schema,
+            nativeProposalSchemaDigest: createHash("sha256")
+              .update(stable(schema.properties.proposal))
+              .digest("hex"),
+          },
+        },
+        options
+      );
+    },
+  });
+}
+
 /** @param {any} options */
-export function createConfiguredRunsClient({
+export async function createConfiguredRunsClient({
   apiKeyFile,
   claim,
   env = process.env,
   clientFactory = createHermesRunsClient,
+  fetchConnectionKey,
+  chainStep = 0,
+  createFetch = createPinnedFetch,
 }) {
   const selection = claim?.run?.modelSelection;
+  // A workspace connection never uses the registry, even on a matching URL:
+  // its key is fetched for this attempt and lives only in these closures, and
+  // every request goes through the address guard. URL and model come from
+  // the signed claim, never from the key response.
+  if (selection?.modelConnectionId) {
+    const step = compileEndpointModelSelection(selection);
+    if (!step || step === "invalid") throw new Error("runs_api_model_rejected");
+    let release = null;
+    try {
+      release = await fetchConnectionKey(step.modelConnectionId, chainStep);
+    } catch {
+      // Every refusal is one fixed code: no server reason, no response field.
+    }
+    if (!connectionRelease(release))
+      throw new Error("runs_api_connection_unavailable");
+    const { apiKey, protocol, structuredOutputs, tools } = release;
+    const client = createWorkspaceConnectionRunsClient({
+      connection: { baseUrl: step.runsApiBaseUrl, protocol, structuredOutputs },
+      apiKey,
+      // An OpenAI-protocol provider sends its headers only when it is done, so
+      // the adapter's 750 s run signal bounds that call, not the guard.
+      fetchImpl:
+        protocol === "runs-api"
+          ? createFetch()
+          : createFetch({ deadlineMs: 760_000 }),
+      modelSelection: step,
+      responseSchema: claim.revision?.outputSchema,
+    });
+    return customRunsClient(
+      client,
+      claim,
+      tools && {
+        serverUrl: tools.serverUrl,
+        authorization: tools.authorization,
+        allowedTools: tools.allowedTools,
+      }
+    );
+  }
   if (!selection?.runsApiBaseUrl) return clientFactory({ apiKeyFile });
   const model = compileEndpointModelSelection(selection);
   if (!model || model === "invalid") throw new Error("runs_api_model_rejected");
@@ -251,27 +346,5 @@ export function createConfiguredRunsClient({
           "x-sellable-agent-id": connection.agentId,
         },
       });
-  return Object.freeze({
-    ...client,
-    submit(compiled, options) {
-      // Public semantic endpoints have a published schema but no product tuple.
-      // Preserve that existing contract when calling a custom Runs service.
-      const schema = claim.revision?.outputSchema;
-      if (compiled.outputContract || !schema?.properties?.proposal)
-        return client.submit(compiled, options);
-      return client.submit(
-        {
-          ...compiled,
-          outputContract: {
-            schemaVersion: "sellable-opener-output-contract/v1",
-            schema,
-            nativeProposalSchemaDigest: createHash("sha256")
-              .update(stable(schema.properties.proposal))
-              .digest("hex"),
-          },
-        },
-        options
-      );
-    },
-  });
+  return customRunsClient(client, claim);
 }

package/lib/sellable-agent/fly-customer-image/runs-api-health-check.mjs

@@ -1,4 +1,3 @@
-import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import {
@@ -14,6 +13,7 @@ import {
   runsApiConnectionServesEndpoint,
   runsApiConnectionsForRuntime,
 } from "./runs-api-connections.mjs";
+import { probeRunsClient } from "./workspace-connection-client.mjs";
 
 // Fixed read-only machine command. Callers supply identities, never a URL,
 // credential path, shell command, or prompt. The installed registry authorizes
@@ -142,6 +142,10 @@ export async function verifyRunsApiSelection(
   // the primary step's check the whole chain, so a machine whose compiler
   // cannot run a chain refuses it here and no chain is saved for it.
   const selection = endpointModelSelectionChain(compiled)[0] ?? null;
+  // A workspace connection's key is fetched per attempt by the run, so the
+  // machine holds none to probe with. This is a shape check only; the server
+  // performs the connectivity probe (228-05).
+  if (selection?.modelConnectionId) return result("REACHABLE");
   let verificationWorkKind = "STANDARD";
   if (selection?.runsApiBaseUrl) {
     const connection = runsApiConnectionsForRuntime(
@@ -171,10 +175,9 @@ export async function verifyRunsApiSelection(
       ? "/run/sellable-agent/admin-runtime/api-server-key"
       : `/run/sellable-agent/${request.profileId}/api-server-key`;
   let client;
-  let run;
   try {
     client = selection?.runsApiBaseUrl
-      ? makeConfiguredClient({
+      ? await makeConfiguredClient({
           apiKeyFile,
           env,
           claim: {
@@ -191,48 +194,14 @@ export async function verifyRunsApiSelection(
           },
         })
       : makeDefaultClient({ apiKeyFile });
-    // A fresh token per check. Claude Opus 5.5 answers one fixed string
-    // ("SELLABLE_CONNECTION_OK") with nothing, so Claude Code fell back to
-    // another model and every Claude Code verification failed.
-    const token = `ready-${randomUUID().replaceAll("-", "").slice(0, 8)}`;
-    const compiled = {
-      input: `Connection verification. Reply with ${token}.`,
-      instructions: `This is a connection check. Do not use tools or take actions. Return exactly ${token} and nothing else.`,
-      conversationHistory: [],
-      correlation: `connection-check-${randomUUID()}`,
-      ...(selection ? { modelSelection: selection } : {}),
-    };
-    const signal = AbortSignal.timeout(70_000);
-    // Default Hermes gets the tool-free verification prefix. A Runs service
-    // owns its own tool policy; the Claude and OpenAI adapters are tool-free.
-    run = await (
-      selection?.runsApiBaseUrl ? client.submit : client.submitVerification
-    )(compiled, { signal });
-    await client.streamEvents(run.runId, { signal, onEvent: async () => {} });
-    const status = await client.status(run.runId, { signal });
-    const served = status.servedRuntime;
-    if (
-      status.status !== "completed" ||
-      typeof status.output !== "string" ||
-      status.output.trim() !== token ||
-      !served
-    )
-      return result("UNAVAILABLE");
-    if (
-      selection &&
-      (served.provider !== selection.provider ||
-        (served.model !== selection.model &&
-          !served.model.startsWith(`${selection.model}-`)))
-    )
-      return result("UNAVAILABLE");
-    return result("READY", served);
   } catch {
-    if (client && run)
-      await client
-        .stop(run.runId, { signal: AbortSignal.timeout(3_000) })
-        .catch(() => {});
     return result("UNAVAILABLE");
   }
+  const probe = await probeRunsClient(client, selection, {
+    signal: AbortSignal.timeout(70_000),
+    submitVerification: !selection?.runsApiBaseUrl,
+  });
+  return result(probe.state, probe.servedRuntime);
 }
 
 if (

package/lib/sellable-agent/fly-customer-image/workspace-connection-client.d.mts

@@ -0,0 +1,22 @@
+import type { EndpointModelStep } from "./endpoint-model-selection.mjs";
+export type WorkspaceConnection = Readonly<{
+  baseUrl: string;
+  protocol: "runs-api" | "openai-chat" | "openai-responses";
+  structuredOutputs?: boolean;
+}>;
+/** Every request goes through `fetchImpl`; the key is held in memory only. */
+export function createWorkspaceConnectionRunsClient(options: {
+  connection: WorkspaceConnection;
+  apiKey: string;
+  fetchImpl: typeof fetch;
+  modelSelection: EndpointModelStep;
+  responseSchema?: unknown;
+}): any;
+export function probeRunsClient(
+  client: any,
+  selection: EndpointModelStep | null,
+  options?: { signal?: AbortSignal; submitVerification?: boolean }
+): Promise<
+  | { state: "READY"; servedRuntime: { provider: string; model: string } }
+  | { state: "UNAVAILABLE" }
+>;

package/lib/sellable-agent/fly-customer-image/workspace-connection-client.mjs

@@ -0,0 +1,98 @@
+// Builds the Runs client for a workspace's own model connection. The Next
+// server and the agent runtime both import only this module for workspace
+// connections, so it has no top-level code beyond imports and declarations.
+import { randomUUID } from "node:crypto";
+import { createHermesRunsClient } from "./hermes-runs-client.mjs";
+import { createOpenAiRunsClient } from "./openai-runs-client.mjs";
+
+/** @param {any} options */
+export function createWorkspaceConnectionRunsClient({
+  connection,
+  apiKey,
+  fetchImpl,
+  modelSelection,
+  responseSchema,
+}) {
+  // The caller's fetchImpl is the address guard (createPinnedFetch). Without it
+  // both clients would fall back to the global fetch and dial unguarded.
+  if (typeof fetchImpl !== "function")
+    throw new Error("workspace_connection_fetch_required");
+  const { baseUrl, protocol, structuredOutputs } = connection;
+  // No registry entry and no scope headers: the key belongs to the workspace's
+  // connection, and every request goes through the caller's fetchImpl.
+  if (protocol === "runs-api")
+    return createHermesRunsClient({
+      baseUrl,
+      apiKey,
+      fetchImpl,
+      scopeHeaders: {},
+    });
+  if (protocol !== "openai-chat" && protocol !== "openai-responses")
+    throw new Error("workspace_connection_protocol_rejected");
+  const { provider, model, reasoningEffort } = modelSelection;
+  return createOpenAiRunsClient({
+    connection: {
+      baseUrl,
+      protocol,
+      structuredOutputs,
+      models: [{ provider, model, reasoningEfforts: [reasoningEffort] }],
+    },
+    apiKey,
+    fetchImpl,
+    modelSelection,
+    responseSchema,
+  });
+}
+
+// One ready-token probe for the machine verify and the server's connection
+// check. It never reads a key: the caller hands it a built client.
+/** @param {any} client @param {any} selection @param {any} [options] */
+export async function probeRunsClient(
+  client,
+  selection,
+  { signal, submitVerification = false } = {}
+) {
+  let run;
+  try {
+    // A fresh token per check. Claude Opus 5.5 answers one fixed string
+    // ("SELLABLE_CONNECTION_OK") with nothing, so Claude Code fell back to
+    // another model and every Claude Code verification failed.
+    const token = `ready-${randomUUID().replaceAll("-", "").slice(0, 8)}`;
+    const compiled = {
+      input: `Connection verification. Reply with ${token}.`,
+      instructions: `This is a connection check. Do not use tools or take actions. Return exactly ${token} and nothing else.`,
+      conversationHistory: [],
+      correlation: `connection-check-${randomUUID()}`,
+      ...(selection ? { modelSelection: selection } : {}),
+    };
+    // Default Hermes gets the tool-free verification prefix. A Runs service
+    // owns its own tool policy; the Claude and OpenAI adapters are tool-free.
+    run = await (
+      submitVerification ? client.submitVerification : client.submit
+    )(compiled, { signal });
+    await client.streamEvents(run.runId, { signal, onEvent: async () => {} });
+    const status = await client.status(run.runId, { signal });
+    const served = status.servedRuntime;
+    if (
+      status.status !== "completed" ||
+      typeof status.output !== "string" ||
+      status.output.trim() !== token ||
+      !served
+    )
+      return { state: "UNAVAILABLE" };
+    if (
+      selection &&
+      (served.provider !== selection.provider ||
+        (served.model !== selection.model &&
+          !served.model.startsWith(`${selection.model}-`)))
+    )
+      return { state: "UNAVAILABLE" };
+    return { state: "READY", servedRuntime: served };
+  } catch {
+    if (run)
+      await client
+        .stop(run.runId, { signal: AbortSignal.timeout(3_000) })
+        .catch(() => {});
+    return { state: "UNAVAILABLE" };
+  }
+}

package/lib/sellable-agent/fly-runtime-identity.mjs

@@ -1305,6 +1305,14 @@ export function createFlyCustomerControlClient({
         { replaySafe: true }
       );
     },
+    async fetchEndpointConnectionKey(identityBody) {
+      return post(
+        "endpoint-connection-key",
+        "/api/v3/sellable-agent/worker/endpoint-connection-key",
+        identityBody,
+        { replaySafe: true }
+      );
+    },
     async consumeSecret(identityBody) {
       // The broker makes only this verb replay-safe for the exact claim ID.
       return post(

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.803";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.804";
 const MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1546,7 +1546,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.803" ||
+      pinned.installerPackage !== "@sellable/install@0.1.804" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.957" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -312,7 +312,7 @@ function validateDesired(desired) {
     desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.803" ||
+    desired.installerPackage !== "@sellable/install@0.1.804" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.957" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.803";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.804";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.803",
+  "version": "0.1.804",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {