@sellable/install 0.1.810 → 0.1.813

package/lib/sellable-agent/fly-customer-image/claude-code-runs-api.mjs

@@ -13,17 +13,8 @@ import {
 } from "node:fs";
 import { createServer } from "node:http";
 import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import {
-  endpointHermesSessionId,
-  endpointMcpDescriptorPath,
-} from "../mcp-context-proxy.mjs";
 import { normalizeRunsApiBaseUrl } from "./endpoint-model-selection.mjs";
 import { validateOpenerOutputContract } from "./hermes-runs-client.mjs";
-import {
-  parseRunsApiConnections,
-  RUNS_API_CONNECTIONS_ENV,
-} from "./runs-api-connections.mjs";
 
 // Each pool runs as many generations at once as one Hermes endpoint may
 // (ENDPOINT_USER_MAX_CONCURRENCY); the runtime still caps the machine at 10.
@@ -31,13 +22,12 @@ export const CLAUDE_RUNS_MAX_CONCURRENCY = 8;
 const MAX_BODY = 320 * 1024;
 const MAX_OUTPUT = 48 * 1024;
 const MAX_CLI_OUTPUT = 512 * 1024;
-const MCP_SESSION = fileURLToPath(
-  new URL("./claude-code-mcp-session.mjs", import.meta.url)
-);
+// The CLI, its sign-ins and the audit log live here on the Admin machine.
+const SERVICE_ROOT = "/opt/data/private-opener";
 const hash = (s) => createHash("sha256").update(s).digest("hex");
 const record = (v) => v && typeof v === "object" && !Array.isArray(v);
-// The public service (models null) has no model list: any Claude model, at
-// the efforts the CLI takes.
+// The service has no model list: any Claude model, at the efforts the CLI
+// takes.
 const publicModel = (body) =>
   typeof body.model === "string" &&
   /^claude-[a-z0-9-]{1,100}$/.test(body.model) &&
@@ -73,7 +63,7 @@ function remoteTools(tools) {
   };
 }
 
-export function validateClaudeRunsRequest(body, models) {
+export function validateClaudeRunsRequest(body) {
   const allowed = [
     "input",
     "instructions",
@@ -82,7 +72,7 @@ export function validateClaudeRunsRequest(body, models) {
     "provider",
     "model",
     "model_options",
-    ...(models === null ? ["tools"] : []),
+    "tools",
   ];
   if (
     !record(body) ||
@@ -110,14 +100,7 @@ export function validateClaudeRunsRequest(body, models) {
       (key) =>
         !["reasoning_effort", "sellable_opener_output_contract"].includes(key)
     ) ||
-    !(models === null
-      ? publicModel(body)
-      : models.some(
-          (model) =>
-            model.provider === body.provider &&
-            model.model === body.model &&
-            model.reasoningEfforts.includes(body.model_options.reasoning_effort)
-        ))
+    !publicModel(body)
   )
     throw new Error("claude_runs_request_rejected");
   const contract = body.model_options.sellable_opener_output_contract;
@@ -141,50 +124,7 @@ export function validateClaudeRunsRequest(body, models) {
   };
 }
 
-/**
- * A run's own allowed tools, read from the signed turn descriptor the runtime
- * installed for its session before submitting. With a tool list, only runs on
- * those endpoints get tools (and must have some); without one, every run gets
- * exactly the tools its descriptor allows, and a run allowed none is tool-free
- * (null). This only narrows: the context proxy verifies the descriptor itself
- * before it lists or calls any tool.
- */
-export function endpointToolNames({
-  turnDescriptorPath,
-  sessionId,
-  toolEndpointIds = undefined,
-}) {
-  const path = endpointMcpDescriptorPath(turnDescriptorPath, sessionId);
-  if (!path) return null;
-  try {
-    if (!lstatSync(path).isFile())
-      throw new Error("claude_runs_tool_descriptor_rejected");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-  const body = JSON.parse(readFileSync(path, "utf8"))?.body;
-  if (toolEndpointIds && !toolEndpointIds.includes(body?.endpointId))
-    return null;
-  const names = body?.allowedToolNames;
-  if (
-    endpointHermesSessionId(body) !== sessionId ||
-    !Array.isArray(names) ||
-    (toolEndpointIds && !names.length) ||
-    names.some(
-      (name) => typeof name !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(name)
-    )
-  )
-    throw new Error("claude_runs_tool_descriptor_rejected");
-  return names.length ? [...names] : null;
-}
-
-export function claudeInvocation(
-  request,
-  root,
-  mcpSpecPath = null,
-  configDir = `${root}/claude`
-) {
+export function claudeInvocation(request, root, configDir = `${root}/claude`) {
   return {
     command: `${root}/cli/node_modules/.bin/claude`,
     args: [
@@ -204,22 +144,12 @@ export function claudeInvocation(
       "dontAsk",
       "--strict-mcp-config",
       "--mcp-config",
-      // A tool lane's only MCP server is the run's own session wrapper, and a
-      // public run's is its own remote server, read from its private file.
-      // Either way its allowed tools are exactly the run's. Every other run
-      // has none.
+      // A run's only MCP server is its own remote server, read from its
+      // private file, and its allowed tools are exactly the run's. Every other
+      // run has none.
       ...(request.tools
         ? [
-            request.tools.remote
-              ? request.mcpConfigPath
-              : JSON.stringify({
-                  mcpServers: {
-                    sellable: {
-                      command: process.execPath,
-                      args: [MCP_SESSION, mcpSpecPath],
-                    },
-                  },
-                }),
+            request.mcpConfigPath,
             "--allowedTools",
             request.tools.names
               .map((name) => `mcp__sellable__${name}`)
@@ -265,7 +195,6 @@ export function readClaudeAuthentication({
   const invocation = claudeInvocation(
     { instructions: "", input: "", model: "claude-opus", effort: "high" },
     root,
-    null,
     configDir
   );
   return new Promise((resolve) => {
@@ -378,6 +307,31 @@ export function claudeUsageLimit(stdout, now = Date.now()) {
   return { retryAt };
 }
 
+// Why a CLI run failed, for the audit only: sanitized facts from its JSON
+// result, never its text, result or stderr.
+export function claudeFailureFacts(stdout, exitCode) {
+  let value = null;
+  try {
+    value = JSON.parse(stdout);
+  } catch {
+    /* No JSON result. */
+  }
+  const fact = (item, pattern) =>
+    typeof item === "string" && pattern.test(item) ? item : null;
+  const status = record(value) ? value.api_error_status : null;
+  return {
+    exitCode: Number.isInteger(exitCode) ? exitCode : null,
+    apiErrorStatus:
+      Number.isInteger(status) && status >= 100 && status <= 599
+        ? status
+        : null,
+    terminalReason: record(value)
+      ? fact(value.terminal_reason, /^[a-z_]{1,32}$/)
+      : null,
+    subtype: record(value) ? fact(value.subtype, /^[a-z_]{1,48}$/) : null,
+  };
+}
+
 // A failure reason the run may report: a fixed code, never raw CLI text.
 const RUN_FAILURE_CODE = /^claude_runs_[a-z_]{1,48}$/;
 
@@ -430,28 +384,12 @@ export function startClaudeRun(
     timeoutMs = 750_000,
   } = {}
 ) {
-  // The tool server's environment travels in a private per-run file, never
-  // in argv, and is removed when the run ends.
-  const mcpSpecPath = request.tools?.server
-    ? join(root, "work", `mcp-session-${randomBytes(12).toString("hex")}.json`)
-    : null;
-  if (mcpSpecPath)
-    writeFileSync(
-      mcpSpecPath,
-      JSON.stringify({ sessionId: request.sessionId, ...request.tools.server }),
-      { mode: 0o600, flag: "wx" }
-    );
-  const removeSpec = () => {
-    if (mcpSpecPath) rmSync(mcpSpecPath, { force: true });
-  };
-  const invocation = claudeInvocation(request, root, mcpSpecPath, configDir);
-  let child;
-  try {
-    child = spawnImpl(invocation.command, invocation.args, invocation.options);
-  } catch (error) {
-    removeSpec();
-    throw error;
-  }
+  const invocation = claudeInvocation(request, root, configDir);
+  const child = spawnImpl(
+    invocation.command,
+    invocation.args,
+    invocation.options
+  );
   let reason = null;
   let killTimer;
   const stop = (code = "claude_runs_cancelled") => {
@@ -483,28 +421,32 @@ export function startClaudeRun(
     child.stderr.on("data", () => {});
     child.once("error", () => {
       clearTimeout(timer);
-      removeSpec();
       reject(new Error("claude_runs_cli_unavailable"));
     });
     child.once("close", (code) => {
       clearTimeout(timer);
       clearTimeout(killTimer);
-      removeSpec();
       const stdout = Buffer.concat(chunks).toString("utf8");
       const limit = reason ? null : claudeUsageLimit(stdout);
       if (limit)
         return reject(
           Object.assign(new Error("claude_runs_usage_limited"), limit)
         );
-      if (reason || code !== 0)
-        return reject(new Error(reason ?? "claude_runs_cli_failed"));
+      const failed = (message) =>
+        Object.assign(new Error(message), {
+          failure: claudeFailureFacts(stdout, code),
+        });
+      if (reason) return reject(new Error(reason));
+      if (code !== 0) return reject(failed("claude_runs_cli_failed"));
       try {
         resolve(parseClaudeResult(stdout, request));
       } catch (error) {
-        reject(
+        const message =
           error instanceof Error && RUN_FAILURE_CODE.test(error.message)
-            ? error
-            : new Error("claude_runs_output_rejected")
+            ? error.message
+            : "claude_runs_output_rejected";
+        reject(
+          message === "claude_runs_output_rejected" ? failed(message) : error
         );
       }
     });
@@ -539,20 +481,17 @@ function writeRemoteMcpConfig(dir, remote) {
   return path;
 }
 
+// The Admin's internet-facing service. The bearer is its only scope, and a
+// run's tools come from its own request.
 export function createClaudeRunsApi({
   token,
-  connection,
-  // "public": the Admin's internet-facing listener. The bearer is its only
-  // scope, and a run's tools come from its own request, never a local lane.
-  mode = "loopback",
-  root = connection?.localRoot,
+  root = SERVICE_ROOT,
   execute = null,
   audit = () => {},
   maxConcurrency = CLAUDE_RUNS_MAX_CONCURRENCY,
-  // Tool lanes (replies, follow-ups) have their own slots so a batch of
+  // Runs with tools (replies, follow-ups) have their own slots so a batch of
   // openers can never crowd them out.
   maxToolConcurrency = CLAUDE_RUNS_MAX_CONCURRENCY,
-  toolLanes = null,
   checkAuthentication = (configDir) =>
     readClaudeAuthentication({ root, configDir }),
   accounts = () => claudeAccountDirs(root),
@@ -629,55 +568,21 @@ export function createClaudeRunsApi({
     };
   };
   const executeRun = execute ?? runOnAccounts;
-  const readHealth = async () => {
+  const readAuthentication = async () => {
     const dirs = accounts();
     let ready = 0;
     let signedOut = 0;
-    const retryAts = [];
     for (const configDir of dirs) {
-      if (resting(configDir)) {
-        retryAts.push(usageLimitedUntil.get(configDir));
-        continue;
-      }
+      if (resting(configDir)) continue;
       const state = await signInState(configDir);
       if (state === "READY") ready++;
       if (state === "SIGN_IN_REQUIRED") signedOut++;
     }
-    return {
-      authentication: ready
-        ? "READY"
-        : signedOut === dirs.length
-          ? "SIGN_IN_REQUIRED"
-          : "UNAVAILABLE",
-      accounts: {
-        total: dirs.length,
-        ready,
-        usageLimited: retryAts.length,
-        retryAt: retryAts.length
-          ? new Date(Math.min(...retryAts)).toISOString()
-          : null,
-      },
-    };
-  };
-  // The run's own tools and the profile's MCP server, or null for a tool-free run.
-  const resolveTools = (request) => {
-    if (!toolLanes) return null;
-    const names = endpointToolNames({
-      turnDescriptorPath: toolLanes.turnDescriptorPath,
-      sessionId: request.sessionId,
-      toolEndpointIds: connection.toolEndpointIds,
-    });
-    if (!names) return null;
-    const server = toolLanes.server();
-    if (!server) throw new Error("claude_runs_tool_server_unavailable");
-    return {
-      names,
-      server: {
-        command: server.command,
-        args: [...server.args],
-        env: { PATH: "/usr/local/bin:/usr/bin:/bin", ...server.env },
-      },
-    };
+    return ready
+      ? "READY"
+      : signedOut === dirs.length
+        ? "SIGN_IN_REQUIRED"
+        : "UNAVAILABLE";
   };
   const recordAudit = (entry) => {
     try {
@@ -721,6 +626,7 @@ export function createClaudeRunsApi({
       usage: run.usage ?? null,
       durationMs: Date.now() - run.startedAt,
       outputDigest: run.output ? hash(run.output) : null,
+      ...(run.status === "failed" ? { failure: run.failure ?? null } : {}),
     });
     setTimeout(() => runs.delete(run.run_id), 3_600_000).unref();
   };
@@ -732,37 +638,18 @@ export function createClaudeRunsApi({
       !timingSafeEqual(provided, expected)
     )
       return json(res, 401, { error: "claude_runs_auth_required" });
-    if (
-      mode !== "public" &&
-      (req.headers["x-sellable-workspace-id"] !== connection.workspaceId ||
-        req.headers["x-sellable-agent-id"] !== connection.agentId)
-    )
-      return json(res, 403, { error: "claude_runs_scope_rejected" });
     if (req.method === "GET" && req.url === "/health") {
-      const { authentication, accounts: accountHealth } = await readHealth();
-      // Public health names no accounts, load, or scope.
-      if (mode === "public")
-        return json(res, 200, {
-          ok: authentication === "READY",
-          authentication,
-          provider: "claude-code",
-          tools: ["mcp"],
-        });
+      const authentication = await readAuthentication();
+      // Health names no accounts, load, or scope.
       return json(res, 200, {
         ok: authentication === "READY",
         authentication,
-        accounts: accountHealth,
         provider: "claude-code",
-        active: inFlight.plain + inFlight.tools,
-        toolActive: inFlight.tools,
-        scope: {
-          workspaceId: connection.workspaceId,
-          agentId: connection.agentId,
-        },
+        tools: ["mcp"],
       });
     }
     if (req.method === "POST" && req.url === "/v1/runs") {
-      if (full("plain") && ((mode !== "public" && !toolLanes) || full("tools")))
+      if (full("plain") && full("tools"))
         return json(res, 429, { error: "claude_runs_busy" });
       let request;
       try {
@@ -777,12 +664,7 @@ export function createClaudeRunsApi({
           chunks.push(chunk);
         }
         const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-        request = validateClaudeRunsRequest(
-          body,
-          mode === "public" ? null : connection.models
-        );
-        // A public run's tools are its own entry's, never a local lane's.
-        if (mode !== "public") request.tools = resolveTools(request);
+        request = validateClaudeRunsRequest(body);
       } catch (error) {
         recordAudit({
           status: "request-rejected",
@@ -805,7 +687,7 @@ export function createClaudeRunsApi({
       };
       inFlight[pool]++;
       runs.set(run.run_id, run);
-      const runDir = request.tools?.remote
+      const runDir = request.tools
         ? join(root, "work", "runs", run.run_id)
         : null;
       const removeRunDir = () => {
@@ -840,6 +722,8 @@ export function createClaudeRunsApi({
                       error: RUN_FAILURE_CODE.test(error?.message ?? "")
                         ? error.message
                         : "claude_runs_generation_failed",
+                      // Why the CLI failed, for the audit only.
+                      failure: error?.failure ?? null,
                     }
               )
           )
@@ -942,60 +826,12 @@ async function stopServer(server) {
   });
 }
 
-// The Admin runtime owns these listeners for its lifetime. Image-owned startup
-// plus the persistent CLI/auth directory makes normal restarts repeatable.
-export async function startConfiguredClaudeRunsApis({
-  env = process.env,
-  diagnostic = () => {},
-  createApi = createClaudeRunsApi,
-  readToken = readKey,
-  toolLanes = null,
-} = {}) {
-  const services = [];
-  for (const connection of parseRunsApiConnections(
-    env[RUNS_API_CONNECTIONS_ENV]
-  )) {
-    if (
-      !connection.localRoot ||
-      connection.runtimeId !== env.SELLABLE_RUNTIME_ID
-    )
-      continue;
-    try {
-      const token = readToken(connection.apiKeyFile);
-      const server = createApi({
-        token,
-        connection,
-        toolLanes,
-        audit: auditTo(connection.localRoot),
-      });
-      await listen(
-        server,
-        Number(new URL(connection.baseUrl).port),
-        "127.0.0.1"
-      );
-      services.push(server);
-      diagnostic({
-        ok: true,
-        code: "claude_runs_api_ready",
-        baseUrl: connection.baseUrl,
-      });
-    } catch {
-      diagnostic({ ok: false, code: "claude_runs_api_unavailable" });
-    }
-  }
-  return {
-    async stop() {
-      for (const server of services) await stopServer(server);
-    },
-  };
-}
-
 // The Admin's internet-facing listener; Fly terminates TLS at the edge. It
 // starts only on a declared port with the machine's private connection key.
 export async function startPublicClaudeRunsApi({
   env = process.env,
   diagnostic = () => {},
-  root = "/opt/data/private-opener",
+  root = SERVICE_ROOT,
   createApi = createClaudeRunsApi,
   readToken = readKey,
 } = {}) {
@@ -1018,7 +854,6 @@ export async function startPublicClaudeRunsApi({
   )
     return null;
   const server = createApi({
-    mode: "public",
     token: readToken(keyFile),
     root,
     audit: auditTo(root),

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -44,6 +44,7 @@ import {
   obtainFlyOidcToken,
   renewFlyCustomerControlSession,
   signedWorkerAuthorization,
+  WorkerControlResponseError,
 } from "../fly-runtime-identity.mjs";
 import {
   executeExternalSoulBridgeOperation,
@@ -131,9 +132,9 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.810";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.813";
 const MCP_PACKAGE =
-  process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.958";
+  process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.959";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;
 const DEFAULT_PROFILE_BUNDLE_ROOT =
   "/usr/local/share/sellable-agent/default-profile-bundle";
@@ -1181,6 +1182,29 @@ function endpointCompletionBody({
   };
 }
 
+// Completion refusals the server returns before it records anything.
+const ENDPOINT_COMPLETION_REFUSALS = new Map([
+  ["product_completion_contract_invalid", "server_contract_invalid"],
+  ["completion_output_invalid", "server_contract_invalid"],
+  ["endpoint_worker_secret_material", "server_secret_material"],
+]);
+
+/**
+ * Why the server refused a product draft's answer, or null when the outcome is
+ * unknown (lease, fence, 5xx, network). Matched on the code: a stale fence is
+ * also a 409.
+ */
+function endpointCompletionRefusal(claim, error) {
+  if (
+    claim?.run?.productExecution == null ||
+    !(error instanceof WorkerControlResponseError) ||
+    error.retryable !== false ||
+    ![409, 413, 422].includes(error.status)
+  )
+    return null;
+  return ENDPOINT_COMPLETION_REFUSALS.get(error.message) ?? null;
+}
+
 /**
  * Why endpointProductProjection refused an answer, as one short code for the
  * run's events: the answer is never stored, so this is all that explains it.
@@ -2363,33 +2387,42 @@ export function createCustomerEndpointRelay(options = {}) {
           // a second completion or expose the late output as canonical.
           return done({ ok: true, code: "LATE_NOTICE_ONLY" });
         }
+        // The output was never used, so another model may still write.
+        const refused = (reason) => ({
+          failure: "OUTPUT_CONTRACT_FAILED",
+          reason,
+          finish: async () => {
+            await complete(claim, identity, {
+              attemptStatus: "SUCCEEDED",
+              status: "OUTPUT_CONTRACT_FAILED",
+            });
+            return { ok: false, code: "OUTPUT_CONTRACT_FAILED" };
+          },
+        });
         const productProjection = endpointProductProjection(
           claim.run.productExecution,
           terminalEvent.output
         );
         if (!productProjection.ok) {
-          // The output was never used, so another model may still write.
-          return {
-            failure: "OUTPUT_CONTRACT_FAILED",
-            reason: endpointProductProjectionReason(
+          return refused(
+            endpointProductProjectionReason(
               claim.run.productExecution,
               terminalEvent.output
-            ),
-            finish: async () => {
-              await complete(claim, identity, {
-                attemptStatus: "SUCCEEDED",
-                status: "OUTPUT_CONTRACT_FAILED",
-              });
-              return { ok: false, code: "OUTPUT_CONTRACT_FAILED" };
-            },
-          };
+            )
+          );
+        }
+        try {
+          await complete(claim, identity, {
+            attemptStatus: "SUCCEEDED",
+            status: "SUCCEEDED",
+            output: terminalEvent.output,
+            ...productProjection.completion,
+          });
+        } catch (error) {
+          const reason = endpointCompletionRefusal(claim, error);
+          if (!reason) throw error;
+          return refused(reason);
         }
-        await complete(claim, identity, {
-          attemptStatus: "SUCCEEDED",
-          status: "SUCCEEDED",
-          output: terminalEvent.output,
-          ...productProjection.completion,
-        });
         return done({ ok: true, code: "SUCCEEDED" });
       }
       if (
@@ -2556,7 +2589,22 @@ export function createCustomerEndpointRelay(options = {}) {
                 outcome.failure,
                 deadlineMs - now().getTime()
               );
-        if (!decision.advance) return await outcome.finish();
+        if (!decision.advance) {
+          // A refused answer that ends the run says why, once.
+          if (outcome.reason)
+            await append(
+              claim,
+              identity,
+              {
+                kind: "OUTPUT_REFUSED",
+                classification: outcome.failure,
+                chainStep: stepIndex,
+                reason: outcome.reason,
+              },
+              ordinal++
+            );
+          return await outcome.finish();
+        }
         await append(
           claim,
           identity,

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.d.mts

@@ -19,6 +19,7 @@ export type EndpointModelStep = Readonly<{
   provider: string;
   model: string;
   reasoningEffort: (typeof ENDPOINT_MODEL_REASONING_EFFORTS)[number];
+  /** Both or neither: a custom Runs URL is served by a workspace connection. */
   runsApiBaseUrl?: string;
   modelConnectionId?: string;
 }>;