@sellable/install 0.1.803 → 0.1.805

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -61,9 +61,12 @@ import {
   SELLABLE_BROWSER_TOOLSET_DEFAULT_MARKER,
   sellableSlackToolsetsForMaterialization,
 } from "../fly-capabilities-bridge.mjs";
+import {
+  startConfiguredClaudeRunsApis,
+  startPublicClaudeRunsApi,
+} from "../fly-customer-image/claude-code-runs-api.mjs";
 import { createCustomerEndpointRelay } from "../fly-customer-image/customer-runtime.mjs";
 import { createHermesSessionRetention } from "../fly-customer-image/hermes-runs-client.mjs";
-import { startConfiguredClaudeRunsApis } from "../fly-customer-image/claude-code-runs-api.mjs";
 import {
   claimWithSoulObservation,
   createFlyCustomerControlClient,
@@ -3847,7 +3850,7 @@ async function runAdminProduction() {
   let customRunsServices = null;
   try {
     customRunsServices = await startConfiguredClaudeRunsApis({
-      diagnostic: value => process.stderr.write(`${JSON.stringify(value)}\n`),
+      diagnostic: (value) => process.stderr.write(`${JSON.stringify(value)}\n`),
       toolLanes: {
         turnDescriptorPath: join(MCP_TURN_CONTEXT_ROOT, "turn-context.json"),
         server: () =>
@@ -3857,7 +3860,19 @@ async function runAdminProduction() {
       },
     });
   } catch {
-    process.stderr.write(`${JSON.stringify({ ok: false, code: "custom_runs_api_start_failed" })}\n`);
+    process.stderr.write(
+      `${JSON.stringify({ ok: false, code: "custom_runs_api_start_failed" })}\n`
+    );
+  }
+  let publicRunsService = null;
+  try {
+    publicRunsService = await startPublicClaudeRunsApi({
+      diagnostic: (value) => process.stderr.write(`${JSON.stringify(value)}\n`),
+    });
+  } catch {
+    process.stderr.write(
+      `${JSON.stringify({ ok: false, code: "public_runs_api_start_failed" })}\n`
+    );
   }
   const endpointRelay = createCustomerEndpointRelay({
     getControlClient: () => client,
@@ -4496,6 +4511,7 @@ async function runAdminProduction() {
   }
   await endpointLoop;
   await customRunsServices?.stop();
+  await publicRunsService?.stop();
   await activeModelHealthReporter?.stop();
   await stopNativeGateway(activeGateway);
   await clearRuntimeSecrets();

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.803
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.805
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.202
 ARG ADMIN_MCP_INTEGRITY=sha512-ym3aye/0vQ8tfULJlKz9JFOxvIQsl1G+n3np+TTgK/tecwNblBo/j3AkTnRqH9iomKzPbZzP+n4tEQsvsU8ByA==
 ARG TUS_JS_CLIENT_VERSION=4.3.1
@@ -22,7 +22,7 @@ ARG PLAYWRIGHT_BROWSER_REVISION=1243
 ARG TIRITH_ARCHIVE_SHA256=6cdbe35e8f9ccf42e70ad95b501c93cd218ac18201c3df958d54f6ba0d995ce2
 ARG DEFAULT_PROFILE_BUNDLE_FIXTURE_VERSION=1
 ARG DEFAULT_PROFILE_BUNDLE_VERSION=4
-ARG DEFAULT_PROFILE_BUNDLE_DIGEST=7687c64bf378e5b317374669780b61227d09c4adef9530a86b94f65a11e4fb2f
+ARG DEFAULT_PROFILE_BUNDLE_DIGEST=fe00b8da3617af34c4edef6b0f40b4f48b45a1da11332137fad400deefd92352
 
 RUN --mount=type=secret,id=mcp_trust_root,required=true \
     test -s /run/secrets/mcp_trust_root \
@@ -98,7 +98,7 @@ COPY hermes-memory-reconcile.sh /opt/sellable/share/hermes-memory-reconcile.sh
 COPY hermes-endpoint-cron.mjs /opt/sellable/bin/hermes-endpoint-cron
 COPY fly-customer-image/model-auth-store.mjs /usr/local/lib/sellable-agent/fly-customer-image/model-auth-store.mjs
 COPY fly-customer-image/hermes-runs-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs
-COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/openai-runs-client.mjs fly-customer-image/runs-api-health-check.mjs /usr/local/lib/sellable-agent/fly-customer-image/
+COPY fly-customer-image/endpoint-model-selection.mjs fly-customer-image/runs-api-connections.mjs fly-customer-image/openai-runs-client.mjs fly-customer-image/runs-api-health-check.mjs fly-customer-image/public-endpoint-guard.mjs fly-customer-image/workspace-connection-client.mjs /usr/local/lib/sellable-agent/fly-customer-image/
 COPY fly-customer-image/opener-stage-execution.mjs /usr/local/lib/sellable-agent/fly-customer-image/opener-stage-execution.mjs
 COPY fly-customer-image/endpoint-uat-completion-gate.mjs /usr/local/lib/sellable-agent/fly-customer-image/endpoint-uat-completion-gate.mjs
 COPY fly-customer-image/customer-runtime-phase-telemetry.mjs /usr/local/lib/sellable-agent/fly-customer-image/customer-runtime-phase-telemetry.mjs

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.d.mts

@@ -10,7 +10,9 @@ export type ClaudeRunsRequest = {
   model: string;
   effort: string;
   sessionId: string;
-  tools: ClaudeRunsTools | null;
+  tools: ClaudeRunsTools | ClaudeRunsRemoteTools | null;
+  /** Remote tools: the run's private MCP config file, written by the service. */
+  mcpConfigPath?: string;
 };
 export type ClaudeRunsToolServer = {
   command: string;
@@ -18,6 +20,11 @@ export type ClaudeRunsToolServer = {
   env: Record<string, string>;
 };
 export type ClaudeRunsTools = { names: string[]; server: ClaudeRunsToolServer };
+/** The run's own remote MCP server and grant (public mode). */
+export type ClaudeRunsRemoteTools = {
+  names: string[];
+  remote: { url: string; authorization: string };
+};
 export type ClaudeRunsToolLanes = {
   turnDescriptorPath: string;
   server(): ClaudeRunsToolServer | null;
@@ -30,7 +37,11 @@ export type ClaudeRunsResult = {
 export type ClaudeRunsServer = Server & { stopActiveRuns(): Promise<void> };
 export type ClaudeRunsApiOptions = {
   token: string;
-  connection: RunsApiConnection;
+  /** Required in loopback mode; the public listener has none. */
+  connection?: RunsApiConnection;
+  mode?: "loopback" | "public";
+  /** The CLI and account root; defaults to the connection's localRoot. */
+  root?: string;
   execute?:
     | ((request: ClaudeRunsRequest) => {
         promise: Promise<ClaudeRunsResult>;
@@ -53,7 +64,8 @@ export type ClaudeRunsApiOptions = {
 };
 export function validateClaudeRunsRequest(
   body: unknown,
-  models: RunsApiConnection["models"]
+  /** null: the public rule (claude-* model, low/medium/high effort). */
+  models: RunsApiConnection["models"] | null
 ): ClaudeRunsRequest;
 export function endpointToolNames(options: {
   turnDescriptorPath: string;
@@ -96,6 +108,14 @@ export function startConfiguredClaudeRunsApis(options?: {
   toolLanes?: ClaudeRunsToolLanes | null;
 }): Promise<{ stop(): Promise<void> }>;
 
+export function startPublicClaudeRunsApi(options?: {
+  env?: Record<string, string | undefined>;
+  diagnostic?: (entry: Record<string, unknown>) => void;
+  root?: string;
+  createApi?: typeof createClaudeRunsApi;
+  readToken?: (path: string) => string;
+}): Promise<{ stop(): Promise<void> } | null>;
+
 export function readClaudeAuthentication(options: {
   root: string;
   configDir?: string;

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs

@@ -2,8 +2,10 @@ import { execFile, spawn } from "node:child_process";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import {
   appendFileSync,
+  chmodSync,
   existsSync,
   lstatSync,
+  mkdirSync,
   readdirSync,
   readFileSync,
   rmSync,
@@ -16,6 +18,7 @@ import {
   endpointHermesSessionId,
   endpointMcpDescriptorPath,
 } from "../mcp-context-proxy.mjs";
+import { normalizeRunsApiBaseUrl } from "./endpoint-model-selection.mjs";
 import { validateOpenerOutputContract } from "./hermes-runs-client.mjs";
 import {
   parseRunsApiConnections,
@@ -33,6 +36,42 @@ const MCP_SESSION = fileURLToPath(
 );
 const hash = (s) => createHash("sha256").update(s).digest("hex");
 const record = (v) => v && typeof v === "object" && !Array.isArray(v);
+// The public service (models null) has no model list: any Claude model, at
+// the efforts the CLI takes.
+const publicModel = (body) =>
+  typeof body.model === "string" &&
+  /^claude-[a-z0-9-]{1,100}$/.test(body.model) &&
+  ["low", "medium", "high"].includes(body.model_options.reasoning_effort);
+
+// The run's one remote MCP server, in the shape the Runs client sends it.
+function remoteTools(tools) {
+  const entry = Array.isArray(tools) && tools.length === 1 ? tools[0] : null;
+  const url = normalizeRunsApiBaseUrl(entry?.server_url);
+  const names = entry?.allowed_tools;
+  if (
+    !record(entry) ||
+    Object.keys(entry).sort().join(",") !==
+      "allowed_tools,authorization,require_approval,server_label,server_url,type" ||
+    entry.type !== "mcp" ||
+    entry.server_label !== "sellable" ||
+    entry.require_approval !== "never" ||
+    !url?.startsWith("https://") ||
+    typeof entry.authorization !== "string" ||
+    !/^srt_[A-Za-z0-9-]{1,128}_[A-Za-z0-9_-]{43}$/.test(entry.authorization) ||
+    !Array.isArray(names) ||
+    names.length < 1 ||
+    names.length > 32 ||
+    new Set(names).size !== names.length ||
+    names.some(
+      (name) => typeof name !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(name)
+    )
+  )
+    throw new Error("claude_runs_tools_rejected");
+  return {
+    names: [...names],
+    remote: { url, authorization: entry.authorization },
+  };
+}
 
 export function validateClaudeRunsRequest(body, models) {
   const allowed = [
@@ -43,6 +82,7 @@ export function validateClaudeRunsRequest(body, models) {
     "provider",
     "model",
     "model_options",
+    ...(models === null ? ["tools"] : []),
   ];
   if (
     !record(body) ||
@@ -70,12 +110,14 @@ export function validateClaudeRunsRequest(body, models) {
       (key) =>
         !["reasoning_effort", "sellable_opener_output_contract"].includes(key)
     ) ||
-    !models.some(
-      (model) =>
-        model.provider === body.provider &&
-        model.model === body.model &&
-        model.reasoningEfforts.includes(body.model_options.reasoning_effort)
-    )
+    !(models === null
+      ? publicModel(body)
+      : models.some(
+          (model) =>
+            model.provider === body.provider &&
+            model.model === body.model &&
+            model.reasoningEfforts.includes(body.model_options.reasoning_effort)
+        ))
   )
     throw new Error("claude_runs_request_rejected");
   const contract = body.model_options.sellable_opener_output_contract;
@@ -95,7 +137,7 @@ export function validateClaudeRunsRequest(body, models) {
     model: body.model,
     effort: body.model_options.reasoning_effort,
     sessionId: body.session_id,
-    tools: null,
+    tools: body.tools === undefined ? null : remoteTools(body.tools),
   };
 }
 
@@ -162,18 +204,22 @@ export function claudeInvocation(
       "dontAsk",
       "--strict-mcp-config",
       "--mcp-config",
-      // A tool lane's only MCP server is the run's own session wrapper; its
-      // allowed tools are exactly the descriptor's. Every other run has none.
+      // A tool lane's only MCP server is the run's own session wrapper, and a
+      // public run's is its own remote server, read from its private file.
+      // Either way its allowed tools are exactly the run's. Every other run
+      // has none.
       ...(request.tools
         ? [
-            JSON.stringify({
-              mcpServers: {
-                sellable: {
-                  command: process.execPath,
-                  args: [MCP_SESSION, mcpSpecPath],
-                },
-              },
-            }),
+            request.tools.remote
+              ? request.mcpConfigPath
+              : JSON.stringify({
+                  mcpServers: {
+                    sellable: {
+                      command: process.execPath,
+                      args: [MCP_SESSION, mcpSpecPath],
+                    },
+                  },
+                }),
             "--allowedTools",
             request.tools.names
               .map((name) => `mcp__sellable__${name}`)
@@ -386,7 +432,7 @@ export function startClaudeRun(
 ) {
   // The tool server's environment travels in a private per-run file, never
   // in argv, and is removed when the run ends.
-  const mcpSpecPath = request.tools
+  const mcpSpecPath = request.tools?.server
     ? join(root, "work", `mcp-session-${randomBytes(12).toString("hex")}.json`)
     : null;
   if (mcpSpecPath)
@@ -468,9 +514,38 @@ export function startClaudeRun(
   return { promise, stop };
 }
 
+// A public run's remote server and grant, in a 0600 file under a 0700
+// directory of its own: never in argv or the CLI's environment.
+function writeRemoteMcpConfig(dir, remote) {
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+  const stat = lstatSync(dir);
+  if (stat.isSymbolicLink() || !stat.isDirectory() || (stat.mode & 0o077) !== 0)
+    throw new Error("claude_runs_run_directory_rejected");
+  const path = join(dir, "mcp.json");
+  writeFileSync(
+    path,
+    JSON.stringify({
+      mcpServers: {
+        sellable: {
+          type: "http",
+          url: remote.url,
+          headers: { Authorization: `Bearer ${remote.authorization}` },
+        },
+      },
+    }),
+    { mode: 0o600, flag: "wx" }
+  );
+  return path;
+}
+
 export function createClaudeRunsApi({
   token,
   connection,
+  // "public": the Admin's internet-facing listener. The bearer is its only
+  // scope, and a run's tools come from its own request, never a local lane.
+  mode = "loopback",
+  root = connection?.localRoot,
   execute = null,
   audit = () => {},
   maxConcurrency = CLAUDE_RUNS_MAX_CONCURRENCY,
@@ -479,8 +554,8 @@ export function createClaudeRunsApi({
   maxToolConcurrency = CLAUDE_RUNS_MAX_CONCURRENCY,
   toolLanes = null,
   checkAuthentication = (configDir) =>
-    readClaudeAuthentication({ root: connection.localRoot, configDir }),
-  accounts = () => claudeAccountDirs(connection.localRoot),
+    readClaudeAuthentication({ root, configDir }),
+  accounts = () => claudeAccountDirs(root),
   startRun = startClaudeRun,
   now = Date.now,
 } = {}) {
@@ -533,10 +608,7 @@ export function createClaudeRunsApi({
             failure ??= "claude_runs_sign_in_required";
             continue;
           }
-          activeRun = startRun(request, {
-            root: connection.localRoot,
-            configDir,
-          });
+          activeRun = startRun(request, { root, configDir });
           try {
             return await activeRun.promise;
           } catch (error) {
@@ -661,12 +733,21 @@ export function createClaudeRunsApi({
     )
       return json(res, 401, { error: "claude_runs_auth_required" });
     if (
-      req.headers["x-sellable-workspace-id"] !== connection.workspaceId ||
-      req.headers["x-sellable-agent-id"] !== connection.agentId
+      mode !== "public" &&
+      (req.headers["x-sellable-workspace-id"] !== connection.workspaceId ||
+        req.headers["x-sellable-agent-id"] !== connection.agentId)
     )
       return json(res, 403, { error: "claude_runs_scope_rejected" });
     if (req.method === "GET" && req.url === "/health") {
       const { authentication, accounts: accountHealth } = await readHealth();
+      // Public health names no accounts, load, or scope.
+      if (mode === "public")
+        return json(res, 200, {
+          ok: authentication === "READY",
+          authentication,
+          provider: "claude-code",
+          tools: ["mcp"],
+        });
       return json(res, 200, {
         ok: authentication === "READY",
         authentication,
@@ -681,7 +762,7 @@ export function createClaudeRunsApi({
       });
     }
     if (req.method === "POST" && req.url === "/v1/runs") {
-      if (full("plain") && (!toolLanes || full("tools")))
+      if (full("plain") && ((mode !== "public" && !toolLanes) || full("tools")))
         return json(res, 429, { error: "claude_runs_busy" });
       let request;
       try {
@@ -696,8 +777,12 @@ export function createClaudeRunsApi({
           chunks.push(chunk);
         }
         const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-        request = validateClaudeRunsRequest(body, connection.models);
-        request.tools = resolveTools(request);
+        request = validateClaudeRunsRequest(
+          body,
+          mode === "public" ? null : connection.models
+        );
+        // A public run's tools are its own entry's, never a local lane's.
+        if (mode !== "public") request.tools = resolveTools(request);
       } catch (error) {
         recordAudit({
           status: "request-rejected",
@@ -720,7 +805,18 @@ export function createClaudeRunsApi({
       };
       inFlight[pool]++;
       runs.set(run.run_id, run);
+      const runDir = request.tools?.remote
+        ? join(root, "work", "runs", run.run_id)
+        : null;
+      const removeRunDir = () => {
+        if (runDir) rmSync(runDir, { recursive: true, force: true });
+      };
       try {
+        if (runDir)
+          request.mcpConfigPath = writeRemoteMcpConfig(
+            runDir,
+            request.tools.remote
+          );
         run.execution = executeRun(request);
         run.execution.promise
           .then(
@@ -747,9 +843,13 @@ export function createClaudeRunsApi({
                     }
               )
           )
-          .finally(() => inFlight[pool]--);
+          .finally(() => {
+            inFlight[pool]--;
+            removeRunDir();
+          });
       } catch {
         inFlight[pool]--;
+        removeRunDir();
         terminal(run, "run.failed", {
           status: "failed",
           error: "claude_runs_cli_unavailable",
@@ -821,13 +921,34 @@ export function createClaudeRunsApi({
   return server;
 }
 
+const readKey = (path) => readFileSync(path, "utf8").trim();
+// Every listener audits to its own root and stops its runs before closing.
+const auditTo = (root) => (entry) =>
+  appendFileSync(
+    `${root}/audit.jsonl`,
+    `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`,
+    { mode: 0o600 }
+  );
+const listen = (server, port, host) =>
+  new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, resolve);
+  });
+async function stopServer(server) {
+  await server.stopActiveRuns();
+  await new Promise((resolve) => {
+    server.close(resolve);
+    server.closeAllConnections();
+  });
+}
+
 // The Admin runtime owns these listeners for its lifetime. Image-owned startup
 // plus the persistent CLI/auth directory makes normal restarts repeatable.
 export async function startConfiguredClaudeRunsApis({
   env = process.env,
   diagnostic = () => {},
   createApi = createClaudeRunsApi,
-  readToken = (path) => readFileSync(path, "utf8").trim(),
+  readToken = readKey,
   toolLanes = null,
 } = {}) {
   const services = [];
@@ -845,21 +966,13 @@ export async function startConfiguredClaudeRunsApis({
         token,
         connection,
         toolLanes,
-        audit: (entry) =>
-          appendFileSync(
-            `${connection.localRoot}/audit.jsonl`,
-            `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`,
-            { mode: 0o600 }
-          ),
-      });
-      await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(
-          Number(new URL(connection.baseUrl).port),
-          "127.0.0.1",
-          resolve
-        );
+        audit: auditTo(connection.localRoot),
       });
+      await listen(
+        server,
+        Number(new URL(connection.baseUrl).port),
+        "127.0.0.1"
+      );
       services.push(server);
       diagnostic({
         ok: true,
@@ -872,13 +985,45 @@ export async function startConfiguredClaudeRunsApis({
   }
   return {
     async stop() {
-      for (const server of services) {
-        await server.stopActiveRuns();
-        await new Promise((resolve) => {
-          server.close(resolve);
-          server.closeAllConnections();
-        });
-      }
+      for (const server of services) await stopServer(server);
     },
   };
 }
+
+// The Admin's internet-facing listener; Fly terminates TLS at the edge. It
+// starts only on a declared port with the machine's private connection key.
+export async function startPublicClaudeRunsApi({
+  env = process.env,
+  diagnostic = () => {},
+  root = "/opt/data/private-opener",
+  createApi = createClaudeRunsApi,
+  readToken = readKey,
+} = {}) {
+  const value = env.SELLABLE_AGENT_PUBLIC_RUNS_SERVICE_PORT ?? "";
+  const port = Number(value);
+  const keyFile = `${root}/api-key`;
+  let key = null;
+  try {
+    key = lstatSync(keyFile);
+  } catch {
+    /* No key, no public listener. */
+  }
+  if (
+    !/^[0-9]{4,5}$/.test(value) ||
+    port < 1024 ||
+    port > 65535 ||
+    // lstat: a symlink is not a file.
+    !key?.isFile() ||
+    (key.mode & 0o077) !== 0
+  )
+    return null;
+  const server = createApi({
+    mode: "public",
+    token: readToken(keyFile),
+    root,
+    audit: auditTo(root),
+  });
+  await listen(server, port, "0.0.0.0");
+  diagnostic({ ok: true, code: "claude_runs_public_api_ready", port });
+  return { stop: () => stopServer(server) };
+}

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -131,7 +131,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.803";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.805";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.957";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;
@@ -1979,15 +1979,44 @@ export function createCustomerEndpointRelay(options = {}) {
     const chained = chain.length > 1;
     // A one-model run is a chain of one; no selection is the Agent default.
     const steps = chain.length ? chain : [null];
-    const stepClaim = (index) =>
-      chain.length === 0
-        ? claim
-        : { ...claim, run: { ...claim.run, modelSelection: chain[index] } };
-    const runs = createRunsClient({
-      apiKeyFile,
-      claim: stepClaim(0),
-      activeRuntime,
-    });
+    // No selection is the Agent default, built here as before (the opener
+    // stages use it). A chain opens each step inside the run loop instead.
+    const runs = chain.length
+      ? null
+      : await createRunsClient({ apiKeyFile, claim, activeRuntime });
+    // A workspace connection step's key, released to this attempt only. Its
+    // literal values are scrubbed from this attempt's error code: the
+    // diagnostic patterns miss a hex key and an srt_ grant.
+    const released = [];
+    const fetchConnectionKey = async (connectionId, chainStep) => {
+      const value = await getControlClient().fetchEndpointConnectionKey({
+        ...identity,
+        schemaVersion: "sellable-agent-endpoint-connection-key/v1",
+        connectionId,
+        chainStep,
+      });
+      for (const secret of [value?.apiKey, value?.tools?.authorization])
+        if (typeof secret === "string" && secret) released.push(secret);
+      return value;
+    };
+    // A step whose client cannot be opened sent nothing for this step; it
+    // counts as a clean failure (STEP_UNAVAILABLE).
+    const openStep = async (index) => {
+      try {
+        return await createRunsClient({
+          apiKeyFile,
+          claim: {
+            ...claim,
+            run: { ...claim.run, modelSelection: chain[index] },
+          },
+          activeRuntime,
+          chainStep: index,
+          fetchConnectionKey,
+        });
+      } catch {
+        return null;
+      }
+    };
     const controller = new AbortController();
     const abortFromOuter = () => controller.abort(outerSignal.reason);
     outerSignal.addEventListener("abort", abortFromOuter, { once: true });
@@ -2460,7 +2489,7 @@ export function createCustomerEndpointRelay(options = {}) {
         (descriptorBinding.expected.allowedToolNames ?? []).length === 0;
       const history = [];
       let stepIndex = 0;
-      let stepRuns = runs;
+      let stepRuns = chain.length ? await openStep(0) : runs;
       for (;;) {
         const outcome = await runNativeStep(stepIndex, stepRuns);
         if (outcome.done) return outcome.result;
@@ -2492,16 +2521,7 @@ export function createCustomerEndpointRelay(options = {}) {
         );
         history.push(outcome.failure);
         stepIndex = decision.stepIndex;
-        try {
-          stepRuns = createRunsClient({
-            apiKeyFile,
-            claim: stepClaim(stepIndex),
-            activeRuntime,
-          });
-        } catch {
-          // Nothing was sent for this step; it counts as a clean failure.
-          stepRuns = null;
-        }
+        stepRuns = await openStep(stepIndex);
       }
     } catch (error) {
       if (heartbeatFailure) throw heartbeatFailure;
@@ -2554,10 +2574,16 @@ export function createCustomerEndpointRelay(options = {}) {
         ok: false,
         code:
           error instanceof Error
-            ? redactRuntimeDiagnostic(error.message)
+            ? redactRuntimeDiagnostic(
+                released.reduce(
+                  (text, secret) => text.replaceAll(secret, "[redacted]"),
+                  error.message
+                )
+              )
             : "customer_endpoint_relay_failed",
       };
     } finally {
+      released.length = 0;
       clearTimeout(deadlineTimer);
       outerSignal.removeEventListener("abort", abortFromOuter);
       heartbeatStopped = true;

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.d.mts

@@ -20,6 +20,7 @@ export type EndpointModelStep = Readonly<{
   model: string;
   reasoningEffort: (typeof ENDPOINT_MODEL_REASONING_EFFORTS)[number];
   runsApiBaseUrl?: string;
+  modelConnectionId?: string;
 }>;
 export type EndpointModelSelection = Readonly<
   EndpointModelStep & {