@sellable/install/lib/sellable-agent/model-auth-canary-reseed.mjs

One-command installer for Sellable MCP in Claude Code, Codex, and Hermes

#!/usr/bin/env node

import { createHash } from "node:crypto";
import {
  chownSync,
  existsSync,
  lstatSync,
  readFileSync,
  statSync,
} from "node:fs";
import { resolve } from "node:path";
import { fileURLToPath } from "node:url";

import {
  evaluateModelAuthReadback,
  parseModelAuthRuntimeCredential,
  readModelAuthMaterialization,
  reconcileHermesModelAuth,
} from "./model-auth-reconciler.mjs";

export const CANARY_RESEED_RUNTIME_SCHEMA =
  "sellable-model-auth-canary-reseed-runtime/v1";

const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{2,255}$/;
const KIND = /^(?:CUSTOMER|ADMIN)$/;
const MAX_STDIN_BYTES = 64 * 1024;

function sha256(bytes) {
  return createHash("sha256").update(bytes).digest("hex");
}

function parseArgs(argv) {
  const parsed = { runtimeId: null, activationId: null, runtimeKind: null };
  const options = new Map([
    ["--runtime-id", "runtimeId"],
    ["--activation-id", "activationId"],
    ["--runtime-kind", "runtimeKind"],
  ]);
  for (let index = 0; index < argv.length; index += 1) {
    const key = options.get(argv[index]);
    const value = argv[index + 1];
    if (!key || !value || value.startsWith("--")) {
      throw new Error("canary_reseed_argument_invalid");
    }
    if (parsed[key] !== null) throw new Error("canary_reseed_argument_invalid");
    parsed[key] = value;
    index += 1;
  }
  if (
    !SAFE_ID.test(parsed.runtimeId ?? "") ||
    !SAFE_ID.test(parsed.activationId ?? "") ||
    !KIND.test(parsed.runtimeKind ?? "")
  ) {
    throw new Error("canary_reseed_argument_invalid");
  }
  return parsed;
}

function regularPrivateFile(path) {
  if (!existsSync(path)) throw new Error("canary_reseed_store_missing");
  const entry = lstatSync(path);
  if (entry.isSymbolicLink() || !entry.isFile() || (entry.mode & 0o077) !== 0) {
    throw new Error("canary_reseed_store_rejected");
  }
  return entry;
}

export function reseedCanaryStore(input) {
  const authStorePath = input.authStorePath ?? "/opt/data/auth.json";
  const markerPath =
    input.markerPath ??
    (input.runtimeKind === "ADMIN"
      ? "/opt/data/.sellable-agent/admin-runtime/model-auth-source.json"
      : "/opt/data/.sellable-agent/model-auth-source.json");
  if (
    !SAFE_ID.test(input.runtimeId ?? "") ||
    !SAFE_ID.test(input.activationId ?? "") ||
    !KIND.test(input.runtimeKind ?? "") ||
    typeof input.bundleRaw !== "string" ||
    Buffer.byteLength(input.bundleRaw, "utf8") > MAX_STDIN_BYTES
  ) {
    throw new Error("canary_reseed_input_invalid");
  }
  const prior = regularPrivateFile(authStorePath);
  const beforeSha256 = sha256(readFileSync(authStorePath));
  const credential = parseModelAuthRuntimeCredential(input.bundleRaw);
  if (credential.activationId !== input.activationId) {
    throw new Error("canary_reseed_activation_mismatch");
  }
  const reconciled = reconcileHermesModelAuth({
    authStorePath,
    markerPath,
    credential,
    lifecycle: "ON",
  });
  chownSync(authStorePath, prior.uid, prior.gid);
  const readback = readModelAuthMaterialization({ authStorePath, markerPath });
  const verdict = evaluateModelAuthReadback(readback, {
    activationId: credential.activationId,
    bundleGeneration: credential.bundleGeneration,
    policyHash: credential.policyHash,
  });
  if (!verdict.accepted) {
    throw new Error(`canary_reseed_readback_rejected:${verdict.rejection}`);
  }
  const after = statSync(authStorePath);
  return Object.freeze({
    schema: CANARY_RESEED_RUNTIME_SCHEMA,
    status: "materialized_current",
    runtimeId: input.runtimeId,
    runtimeKind: input.runtimeKind,
    activationId: credential.activationId,
    bundleGeneration: credential.bundleGeneration,
    policyHash: credential.policyHash,
    reseeded: reconciled.reseeded,
    storeChanged: beforeSha256 !== sha256(readFileSync(authStorePath)),
    storeMode: (after.mode & 0o777).toString(8).padStart(3, "0"),
    ownerPreserved: after.uid === prior.uid && after.gid === prior.gid,
    materializedStatus: readback.materializedStatus,
    slots: readback.slots,
    openrouter: readback.openrouter,
    activeProvider: readback.activeProvider,
    fallbackDepth: readback.fallbackDepth,
  });
}

export function main(argv = process.argv.slice(2)) {
  if (typeof process.getuid === "function" && process.getuid() !== 0) {
    throw new Error("canary_reseed_root_required");
  }
  const args = parseArgs(argv);
  const bundleRaw = readFileSync(0, { encoding: "utf8" });
  const result = reseedCanaryStore({ ...args, bundleRaw });
  process.stdout.write(`${JSON.stringify(result)}\n`);
  return result;
}

if (
  process.argv[1] &&
  resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))
) {
  try {
    main();
  } catch (error) {
    process.stderr.write(
      `${JSON.stringify({
        ok: false,
        code:
          error instanceof Error
            ? error.message.split(":", 1)[0]
            : "canary_reseed_failed",
      })}\n`
    );
    process.exitCode = 1;
  }
}