@sellable/install 0.1.359 → 0.1.360-phase111.20260720061815

package/bin/sellable-install.mjs

@@ -401,8 +401,6 @@ function parseArgs(argv) {
   if (opts.sellableConfigPath && !opts.sellableConfigsDir) {
     opts.sellableConfigsDir = join(dirname(opts.sellableConfigPath), "configs");
   }
-  opts.lockWorkspaceId = opts.workspaceId;
-  opts.requireWorkspaceLock = Boolean(opts.workspaceId);
 
   return opts;
 }

package/package.json

@@ -1,17 +1,10 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.359",
+  "version": "0.1.360-phase111.20260720061815",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {
-    "sellable": "bin/sellable-install.mjs",
-    "sellable-agent-host-bootstrap": "bin/sellable-agent-host-bootstrap.mjs",
-    "sellable-agent-egress-proxy": "bin/sellable-agent-egress-proxy.mjs",
-    "sellable-agent-host-worker": "bin/sellable-agent-host-worker.mjs",
-    "sellable-agent-runtime-helper": "bin/sellable-agent-runtime-helper.mjs",
-    "sellable-agent-runtime-launcher": "bin/sellable-agent-runtime-launcher.mjs",
-    "sellable-agent-sandbox-init": "bin/sellable-agent-sandbox-init.mjs",
-    "sellable-agent-runtime-probe": "bin/sellable-agent-runtime-probe.mjs"
+    "sellable": "bin/sellable-install.mjs"
   },
   "scripts": {
     "sync-skills": "node scripts/sync-skill-templates.mjs",
@@ -20,8 +13,6 @@
   "files": [
     "bin",
     "lib",
-    "services",
-    "container",
     "agents",
     "skill-templates",
     "README.md",

package/skill-templates/refill-sends-evergreen.md

@@ -17,3 +17,8 @@ Use `refill-sends-v2` instead:
 ```text
 get_subskill_prompt({ subskillName: "refill-sends-v2" })
 ```
+
+The alias must not strip exact `targetConfig`, server `runHandle`,
+`reportingContext`, canonical `refill_reporting.v2`, or an explicit
+`messageTemplateRevision`. It never infers revision authority from
+`forceRerun`.

package/skill-templates/refill-sends-v2.md

@@ -52,9 +52,24 @@ refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 To resume an in-progress run, pass the handle back exactly:
 
 ```text
-refill_sends_v2({ workspaceId, runId, fence })
+refill_sends_v2({ workspaceId, runHandle:{runId,fence}, targetConfig, reportingContext, messageTemplateRevision? })
 ```
 
+`targetConfig` and the server-issued `runHandle` are separate authorities. Keep
+both byte-for-byte through every continuation and takeover; never fold the
+rotating fence into target configuration.
+
+An approved copy change is reachable only through an explicit
+`messageTemplateRevision` object with `version:1`, `source:"user_approved"`,
+the approved `templateMarkdown`, `messageTemplateRevision` identity,
+`priorTemplateAuthorityDigest`, `nextTemplateAuthorityDigest`, 1–500 exact
+`cohortRowIds`, and `requestId`, `effectId`, and `revisionOperationId`. Pass it
+with the exact `targetConfig` and `reportingContext`; the command obtains or
+resumes the server run handle and lets the planner name
+`revise_message_template_and_rerun`. Missing or partial input means no revision.
+`forceRerun:true` on a queue operation never authorizes or implies a template
+change.
+
 If a stale handle loses the lease, the tool reports the holder status and the
 approximately 10 minute lockout window. Reinvoke with the current handle or wait
 for lease expiry; never guess a fence.
@@ -85,6 +100,8 @@ The run may execute only packet-named bounded work:
   when the campaign is in the packet's pinned lane chain;
 - refresh paid InMail credit facts during bootstrap and once per scheduler-wait
   entry when the packet requires it.
+- apply `revise_message_template_and_rerun` only when the packet contains the
+  complete explicit user-approved revision envelope and exact fenced target.
 
 The loop records planned -> did -> outcome before and after every foreign
 mutation. It refuses stale packets by fingerprint and validates packet
@@ -168,5 +185,10 @@ reason or resume handle, lane source, lane chain, chosen label with token
 secondary, plan revision, journal path, blocked continuation packets, and
 firstFailing checklist when present.
 
+Preserve `refill_reporting.v2` exactly in progress, continuation, replay, and
+terminal results. Do not recompute its semantic counts or drop live-preparation
+epoch, snapshot sequence, reset reason, watermark, blockers, compatibility, or
+terminal fields. Never surface raw prospect or message-copy fields.
+
 Real-run journals live under `~/.sellable/refill/runs` by default and append an
 index line. Dry runs include the dry marker and do not create run records.

package/skill-templates/refill-sends.md

@@ -93,7 +93,7 @@ Accepted invocation flags in the same user request:
 When the host can call typed MCP tools, start with:
 
 ```text
-refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runId?: string, fence?: number })
+refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runHandle?: RefillRunHandleV1, targetConfig?: RefillTargetConfigV1, reportingContext?: RefillReportingContextV2, messageTemplateRevision?: MessageTemplateRevisionV1 })
 ```
 
 That command helper normalizes arguments and returns the execution contract. In
@@ -104,6 +104,23 @@ host must immediately call `refill_sends` again with the original full scope
 plus the exact returned `runId` and `fence`. Do this automatically inside the
 same user command until terminal projected coverage or a concrete blocker; do
 not ask the user to type `continue` and do not start a second run.
+
+`targetConfig` and the server-issued `runHandle` are separate values and must
+survive each continuation unchanged except for a server-issued takeover fence.
+Only a literal `messageTemplateRevision` with `source:"user_approved"`, the
+approved `templateMarkdown`, prior/new authority digests, 1–500 exact cohort
+row IDs, and request/effect/revision-operation IDs can authorize
+`revise_message_template_and_rerun`. No envelope means no revision. A
+`forceRerun:true` queue call cannot infer or authorize template mutation.
+When the user supplied a complete revision except for the current prior digest,
+acquire the exact run first and reread with its unchanged `targetConfig` and
+`runHandle`. Use only `reportingContext.source.templateAuthorityDigest` from
+that fenced reread as `priorTemplateAuthorityDigest`, then immediately continue
+the same run with the complete literal revision—even when the ordinary refill
+queue is empty or the sender is otherwise ineligible. An empty ordinary queue
+must not suppress an explicit revision. If the fenced reread returns no digest,
+stop with `template_authority_missing` or the returned
+`templateAuthorityBlocker`; never guess the digest.
 Safe primitives are paid-credit refresh,
 existing-row message preparation, generated-message approval, receipt-proven
 same-source row copy, one bounded Signal Discovery search derived only from
@@ -567,6 +584,11 @@ scheduler wait loop. Do not finish the refill goal, mark it complete, or mark it
 blocked only because it is still `awaiting_scheduler_after_ready_buffer`; keep
 waiting unless Christian stops the run or the host cannot continue.
 
+Carry the canonical `refill_reporting.v2` DTO through progress, continuation,
+replay, and terminal reporting without recomputing counts or losing live epoch,
+snapshot sequence, reset reason, watermark, blockers, compatibility, or
+terminal outcome. Redact raw copy and prospect fields.
+
 Future scheduled coverage and already sent actions are distinct; only
 scheduler-owned future scheduled actions count as scheduled coverage. For
 multiple target dates, finish D1 execution and the full D1 reread before

package/bin/sellable-agent-egress-proxy.mjs

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-
-import { lstatSync, readFileSync } from "node:fs";
-import {
-  createRuntimeEgressProxy,
-  validateRuntimeEgressProxyConfig,
-} from "../lib/sellable-agent/runtime-egress-proxy.mjs";
-
-const CONFIG_PATH = "/etc/sellable-agent/egress-proxy.json";
-
-try {
-  if (process.argv.length !== 2) throw new Error("arguments rejected");
-  const link = lstatSync(CONFIG_PATH);
-  if (link.isSymbolicLink() || !link.isFile() || link.uid !== 0 || (link.mode & 0o777) !== 0o444) {
-    throw new Error("proxy config ownership rejected");
-  }
-  const parsed = validateRuntimeEgressProxyConfig(JSON.parse(readFileSync(CONFIG_PATH, "utf8")));
-  if (!parsed.ok || process.getuid?.() !== parsed.config.uid || process.getgid?.() !== parsed.config.gid) {
-    throw new Error("proxy identity rejected");
-  }
-  const proxy = createRuntimeEgressProxy(parsed.config);
-  await proxy.listen();
-  const stop = async () => {
-    try { await proxy.close(); } finally { process.exit(0); }
-  };
-  process.once("SIGTERM", stop);
-  process.once("SIGINT", stop);
-} catch {
-  process.stderr.write("sellable-agent egress proxy failed closed\n");
-  process.exitCode = 1;
-}

package/bin/sellable-agent-host-bootstrap.mjs

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-
-import { lstatSync, readFileSync } from "node:fs";
-import { isAbsolute } from "node:path";
-import { bootstrapAgentHost } from "../lib/sellable-agent/host-bootstrap.mjs";
-
-function configPath(argv) {
-  if (argv.length !== 2 || argv[0] !== "--config" || !isAbsolute(argv[1])) {
-    throw new Error("usage: --config /absolute/path");
-  }
-  const link = lstatSync(argv[1]);
-  if (link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 || link.uid !== 0 || link.gid !== 0) {
-    throw new Error("host bootstrap config rejected");
-  }
-  return argv[1];
-}
-
-try {
-  if (process.getuid?.() !== 0 || process.getgid?.() !== 0) throw new Error("host bootstrap requires root");
-  const pathValue = configPath(process.argv.slice(2));
-  const result = bootstrapAgentHost({ config: JSON.parse(readFileSync(pathValue, "utf8")) });
-  process.stdout.write(`${JSON.stringify(result.receipt)}\n`);
-} catch {
-  process.stderr.write("sellable-agent host bootstrap failed closed\n");
-  process.exitCode = 1;
-}

package/bin/sellable-agent-host-worker.mjs

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-
-import { runHostWorkerMain } from "../lib/sellable-agent/host-worker.mjs";
-
-const result = await runHostWorkerMain({ argv: process.argv.slice(2) });
-if (!result.ok) {
-  process.stderr.write(`${result.code}\n`);
-  process.exitCode = 1;
-}

package/bin/sellable-agent-runtime-helper.mjs

@@ -1,37 +0,0 @@
-#!/usr/bin/env node
-
-import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
-import { runRuntimeHelperRequest } from "../lib/sellable-agent/runtime-helper.mjs";
-
-const requestIndex = process.argv.indexOf("--request");
-const requestPath = requestIndex >= 0 ? process.argv[requestIndex + 1] : null;
-if (!requestPath || process.argv.length !== 4) {
-  process.stderr.write("usage: sellable-agent-runtime-helper --request /absolute/path\n");
-  process.exitCode = 64;
-} else {
-  try {
-    const configPath = "/etc/sellable-agent/runtime-helper.json";
-    const before = lstatSync(configPath);
-    if (before.isSymbolicLink() || !before.isFile() || before.uid !== 0 || (before.mode & 0o022) !== 0) {
-      throw new Error("runtime helper config rejected");
-    }
-    const descriptor = openSync(configPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    let bytes;
-    try {
-      const after = fstatSync(descriptor);
-      if (!after.isFile() || after.uid !== 0 || after.dev !== before.dev || after.ino !== before.ino || (after.mode & 0o022) !== 0) {
-        throw new Error("runtime helper config changed during open");
-      }
-      bytes = readFileSync(descriptor, "utf8");
-    } finally {
-      closeSync(descriptor);
-    }
-    const config = JSON.parse(bytes);
-    const result = await runRuntimeHelperRequest({ requestPath, config });
-    process.stdout.write(`${JSON.stringify(result)}\n`);
-    if (!result.ok) process.exitCode = 1;
-  } catch {
-    process.stdout.write(`${JSON.stringify({ ok: false, code: "runtime_helper_config_rejected" })}\n`);
-    process.exitCode = 1;
-  }
-}

package/bin/sellable-agent-runtime-launcher.mjs

@@ -1,151 +0,0 @@
-#!/usr/bin/env node
-
-import { spawn, spawnSync } from "node:child_process";
-import {
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  readFileSync,
-  writeFileSync,
-} from "node:fs";
-import { join } from "node:path";
-import {
-  buildRuntimeBoundaryContract,
-  buildRuntimeBoundaryLaunchSpec,
-  buildRuntimeBoundaryNftProgram,
-  expectedRuntimeCgroup,
-  inspectRuntimeBoundaryInputs,
-  runtimeBoundaryNftRulesMatch,
-} from "../lib/sellable-agent/runtime-boundary.mjs";
-
-const CONFIG_PATH = "/etc/sellable-agent/runtime-boundary.json";
-const SECRET = /xox[bap]-|sat_[A-Za-z0-9_-]+|asec\.v1\.|access[_-]?token|refresh[_-]?token/i;
-
-function fixedRootConfig() {
-  const link = lstatSync(CONFIG_PATH);
-  if (link.isSymbolicLink() || !link.isFile() || link.uid !== 0 || link.gid !== 0 || (link.mode & 0o777) !== 0o400) {
-    throw new Error("runtime boundary config rejected");
-  }
-  const bytes = readFileSync(CONFIG_PATH, "utf8");
-  if (bytes.length > 64 * 1024 || SECRET.test(bytes)) throw new Error("runtime boundary config rejected");
-  const built = buildRuntimeBoundaryContract(JSON.parse(bytes));
-  if (!built.ok) throw new Error("runtime boundary contract rejected");
-  return built.contract;
-}
-
-function provisionCgroup(contract) {
-  const parent = contract.paths.cgroupRoot;
-  const systemRoot = "/sys/fs/cgroup";
-  const rootInfo = lstatSync(systemRoot);
-  if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw new Error("cgroup v2 root rejected");
-  const controllers = readFileSync(join(systemRoot, "cgroup.controllers"), "utf8").trim().split(/\s+/);
-  if (!["cpu", "memory", "pids"].every((name) => controllers.includes(name))) {
-    throw new Error("required cgroup controllers unavailable");
-  }
-  const requiredControllers = ["cpu", "memory", "pids"];
-  const enableControllers = (path) => {
-    const controlPath = join(path, "cgroup.subtree_control");
-    const enabled = new Set(readFileSync(controlPath, "utf8").trim().split(/\s+/).filter(Boolean));
-    const missing = requiredControllers.filter((name) => !enabled.has(name));
-    if (missing.length) writeFileSync(controlPath, `${missing.map((name) => `+${name}`).join(" ")}\n`);
-    const observed = new Set(readFileSync(controlPath, "utf8").trim().split(/\s+/).filter(Boolean));
-    if (requiredControllers.some((name) => !observed.has(name))) throw new Error("cgroup controller enablement failed");
-  };
-  enableControllers(systemRoot);
-  if (!existsSync(parent)) mkdirSync(parent, { mode: 0o755 });
-  const parentInfo = lstatSync(parent);
-  if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory() || parentInfo.uid !== 0 || (parentInfo.mode & 0o022) !== 0) {
-    throw new Error("runtime cgroup parent rejected");
-  }
-  enableControllers(parent);
-  const expected = expectedRuntimeCgroup(contract);
-  if (!existsSync(expected.path)) mkdirSync(expected.path, { mode: 0o755 });
-  const groupInfo = lstatSync(expected.path);
-  if (groupInfo.isSymbolicLink() || !groupInfo.isDirectory() || groupInfo.uid !== 0 || (groupInfo.mode & 0o022) !== 0) {
-    throw new Error("runtime cgroup rejected");
-  }
-  if (readFileSync(join(expected.path, "cgroup.procs"), "utf8").trim()) {
-    throw new Error("runtime cgroup still has processes");
-  }
-  for (const [name, value] of Object.entries(expected.files)) {
-    writeFileSync(join(expected.path, name), `${value}\n`);
-    if (readFileSync(join(expected.path, name), "utf8").trim() !== value) throw new Error("runtime cgroup limit drift");
-  }
-  writeFileSync(join(expected.path, "cgroup.procs"), `${process.pid}\n`);
-}
-
-function provisionFirewall(contract) {
-  const policy = buildRuntimeBoundaryNftProgram(contract);
-  if (!policy.ok) throw new Error("runtime firewall contract rejected");
-  const listed = spawnSync(contract.paths.nftPath, ["-j", "list", "tables"], {
-    encoding: "utf8",
-    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
-    timeout: 10_000,
-  });
-  if (listed.status !== 0) throw new Error("runtime firewall inventory failed");
-  let inventory;
-  try { inventory = JSON.parse(listed.stdout); } catch { throw new Error("runtime firewall inventory rejected"); }
-  const exists = Array.isArray(inventory?.nftables) && inventory.nftables.some((entry) =>
-    entry?.table?.family === "inet" && entry.table.name === policy.table);
-  const program = `${exists ? `delete table inet ${policy.table}\n` : ""}${policy.program}`;
-  const applied = spawnSync(contract.paths.nftPath, policy.applyArgs, {
-    input: program,
-    encoding: "utf8",
-    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
-    timeout: 10_000,
-    maxBuffer: 64 * 1024,
-  });
-  if (applied.status !== 0 || SECRET.test(`${applied.stdout}${applied.stderr}`)) {
-    throw new Error("runtime firewall apply failed");
-  }
-  const observed = spawnSync(contract.paths.nftPath, ["list", "table", "inet", policy.table], {
-    encoding: "utf8",
-    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
-    timeout: 10_000,
-  });
-  if (observed.status !== 0 || !runtimeBoundaryNftRulesMatch(contract, observed.stdout)) {
-    throw new Error("runtime firewall readback failed");
-  }
-}
-
-async function run() {
-  if (process.argv.length !== 2 || process.getuid?.() !== 0 || process.getgid?.() !== 0) {
-    throw new Error("runtime launcher identity rejected");
-  }
-  for (const fd of [8, 9]) {
-    const link = lstatSync(`/proc/self/fd/${fd}`);
-    if (!link.isSymbolicLink()) throw new Error("runtime Slack descriptor rejected");
-  }
-  const contract = fixedRootConfig();
-  if (!inspectRuntimeBoundaryInputs(contract).ok) throw new Error("runtime boundary inputs rejected");
-  provisionCgroup(contract);
-  provisionFirewall(contract);
-  const spec = buildRuntimeBoundaryLaunchSpec(contract);
-  if (!spec.ok) throw new Error("runtime launch spec rejected");
-  const stdio = Array(10).fill("ignore");
-  stdio[1] = "inherit";
-  stdio[2] = "inherit";
-  stdio[8] = 8;
-  stdio[9] = 9;
-  const child = spawn(spec.command, spec.args, {
-    env: spec.env,
-    shell: false,
-    stdio,
-  });
-  const forwardTerm = () => { if (!child.killed) child.kill("SIGTERM"); };
-  const forwardInt = () => { if (!child.killed) child.kill("SIGINT"); };
-  process.on("SIGTERM", forwardTerm);
-  process.on("SIGINT", forwardInt);
-  const exitCode = await new Promise((resolveExit, rejectExit) => {
-    child.once("error", rejectExit);
-    child.once("exit", (code, signal) => resolveExit(code ?? (signal ? 1 : 0)));
-  });
-  process.exitCode = exitCode;
-}
-
-try {
-  await run();
-} catch {
-  process.stderr.write("sellable-agent runtime boundary failed closed\n");
-  process.exitCode = 1;
-}

package/bin/sellable-agent-runtime-probe.mjs

@@ -1,163 +0,0 @@
-#!/usr/bin/env node
-
-import { spawn } from "node:child_process";
-import { lstatSync, readFileSync } from "node:fs";
-import { createInterface } from "node:readline";
-
-const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
-const profileIndex = process.argv.indexOf("--profile-id");
-const profileId = profileIndex >= 0 ? process.argv[profileIndex + 1] : null;
-
-function requiredEnv(name) {
-  const value = process.env[name]?.trim();
-  if (!value) throw new Error(`missing ${name}`);
-  return value;
-}
-
-async function withClient(lockWorkspaceId, run) {
-  const command = requiredEnv("SELLABLE_AGENT_MCP_COMMAND");
-  if (command !== "/usr/local/lib/sellable-agent/external-runtime/mcp/bin/sellable-mcp") {
-    throw new Error("MCP command pin rejected");
-  }
-  const env = {
-    PATH: "/usr/local/bin:/usr/bin:/bin",
-    HOME: requiredEnv("HOME"),
-    NODE_ENV: "production",
-    SELLABLE_CONFIG_PATH: requiredEnv("SELLABLE_CONFIG_PATH"),
-    SELLABLE_AGENT_RUNTIME_SECRET_ROOT: requiredEnv("SELLABLE_AGENT_RUNTIME_SECRET_ROOT"),
-    SELLABLE_AGENT_PROFILE_ID: profileId,
-    SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE: requiredEnv("SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE"),
-    SELLABLE_AGENT_WORKSPACE_ID: requiredEnv("SELLABLE_AGENT_WORKSPACE_ID"),
-    SELLABLE_AGENT_ID: requiredEnv("SELLABLE_AGENT_ID"),
-    SELLABLE_AGENT_CREDENTIAL_GENERATION: requiredEnv("SELLABLE_AGENT_CREDENTIAL_GENERATION"),
-    SELLABLE_AGENT_POLICY_HASH: requiredEnv("SELLABLE_AGENT_POLICY_HASH"),
-    SELLABLE_AGENT_SELECTED_CHANNEL_IDS: requiredEnv("SELLABLE_AGENT_SELECTED_CHANNEL_IDS"),
-    SELLABLE_LOCK_WORKSPACE_ID: lockWorkspaceId,
-    SELLABLE_REQUIRE_WORKSPACE_LOCK: "1",
-  };
-  const child = spawn(command, [], { env, shell: false, stdio: ["pipe", "pipe", "ignore"] });
-  const pending = new Map();
-  let nextId = 1;
-  let failed = null;
-  const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
-  const failAll = (error) => {
-    failed = error;
-    for (const waiter of pending.values()) waiter.reject(error);
-    pending.clear();
-  };
-  lines.on("line", (line) => {
-    try {
-      const message = JSON.parse(line);
-      if (!Number.isSafeInteger(message.id) || !pending.has(message.id)) return;
-      const waiter = pending.get(message.id);
-      pending.delete(message.id);
-      if (message.error) waiter.reject(new Error("MCP request rejected"));
-      else waiter.resolve(message.result);
-    } catch {
-      failAll(new Error("MCP response rejected"));
-    }
-  });
-  child.once("error", failAll);
-  child.once("exit", () => failAll(new Error("MCP process exited")));
-  const request = (method, params = {}) => new Promise((resolveRequest, rejectRequest) => {
-    if (failed) return rejectRequest(failed);
-    const id = nextId++;
-    const timer = setTimeout(() => {
-      pending.delete(id);
-      rejectRequest(new Error("MCP request timed out"));
-    }, 10_000);
-    pending.set(id, {
-      resolve(value) { clearTimeout(timer); resolveRequest(value); },
-      reject(error) { clearTimeout(timer); rejectRequest(error); },
-    });
-    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
-  });
-  const notify = (method, params = {}) => {
-    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
-  };
-  const initialized = await request("initialize", {
-    protocolVersion: "2025-06-18",
-    capabilities: {},
-    clientInfo: { name: "sellable-agent-runtime-probe", version: "1.0.0" },
-  });
-  if (!initialized?.serverInfo) throw new Error("MCP initialization rejected");
-  notify("notifications/initialized");
-  const client = {
-    listTools: () => request("tools/list", {}),
-    callTool: (params) => request("tools/call", params),
-  };
-  try {
-    return await run(client);
-  } finally {
-    lines.close();
-    child.stdin.end();
-    child.kill("SIGTERM");
-  }
-}
-
-async function toolDenied(client, name, channelId, requesterId, providerRequestId) {
-  try {
-    const result = await client.callTool({
-      name,
-      arguments: {},
-      _meta: { sellableAgent: { channelId, requesterId, providerRequestId } },
-    }, undefined, { timeout: 10_000, maxTotalTimeout: 10_000 });
-    return result?.isError === true;
-  } catch {
-    return true;
-  }
-}
-
-try {
-  if (!SAFE_ID.test(profileId ?? "") || process.argv.length !== 4) throw new Error("probe arguments rejected");
-  const configPath = requiredEnv("SELLABLE_CONFIG_PATH");
-  const link = lstatSync(configPath);
-  if (link.isSymbolicLink() || !link.isFile() || (link.mode & 0o077) !== 0) throw new Error("profile config rejected");
-  const config = JSON.parse(readFileSync(configPath, "utf8"));
-  const workspaceId = requiredEnv("SELLABLE_AGENT_WORKSPACE_ID");
-  const channelIds = config.requestChannelPolicy?.selectedChannelIds;
-  const requesterIds = config.requestChannelPolicy?.memberAllowlist;
-  const tools = config.tools?.include;
-  if (
-    config.workspaceLockId !== workspaceId || !Array.isArray(channelIds) || channelIds.length === 0 ||
-    !Array.isArray(requesterIds) || requesterIds.length === 0 || !Array.isArray(tools) ||
-    !tools.includes("get_company_info")
-  ) throw new Error("profile MCP contract rejected");
-  const channelId = channelIds[0];
-  const requesterId = requesterIds[0];
-  const providerRequestId = `runtime-probe-${profileId}`;
-  const main = await withClient(workspaceId, async (client) => {
-    const listed = (await client.listTools(undefined, { timeout: 10_000, maxTotalTimeout: 10_000 })).tools
-      .map((tool) => tool.name).sort();
-    const safe = await client.callTool({
-      name: "get_company_info",
-      arguments: {},
-      _meta: { sellableAgent: { channelId, requesterId, providerRequestId } },
-    }, undefined, { timeout: 10_000, maxTotalTimeout: 10_000 });
-    return {
-      tools: listed,
-      safeRead: safe?.isError !== true,
-      unexpectedToolDenied: await toolDenied(client, "__sellable_unapproved_probe__", channelId, requesterId, providerRequestId),
-      wrongChannelDenied: await toolDenied(client, "get_company_info", "C0000000000", requesterId, providerRequestId),
-    };
-  });
-  const wrongWorkspaceDenied = await withClient(`wrong-${workspaceId}`, (client) =>
-    toolDenied(client, "get_company_info", channelId, requesterId, providerRequestId));
-  const ok =
-    main.safeRead && main.unexpectedToolDenied && main.wrongChannelDenied && wrongWorkspaceDenied &&
-    JSON.stringify(main.tools) === JSON.stringify([...tools].sort());
-  process.stdout.write(`${JSON.stringify({
-    ok,
-    profileId,
-    workspaceId,
-    tools: main.tools,
-    safeRead: main.safeRead,
-    unexpectedToolDenied: main.unexpectedToolDenied,
-    wrongChannelDenied: main.wrongChannelDenied,
-    wrongWorkspaceDenied,
-  })}\n`);
-  if (!ok) process.exitCode = 1;
-} catch {
-  process.stdout.write(`${JSON.stringify({ ok: false, code: "runtime_probe_rejected" })}\n`);
-  process.exitCode = 1;
-}

package/bin/sellable-agent-sandbox-init.mjs

@@ -1,93 +0,0 @@
-#!/usr/bin/env node
-
-import { spawn } from "node:child_process";
-import { closeSync, constants, fstatSync, openSync, unlinkSync } from "node:fs";
-
-const APP_PATH = "/run/bootstrap/slack-app";
-const BOT_PATH = "/run/bootstrap/slack-bot";
-const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
-
-function required(name) {
-  const value = process.env[name];
-  if (typeof value !== "string" || !value) throw new Error(`missing ${name}`);
-  return value;
-}
-
-function identity(name) {
-  const value = required(name);
-  if (!/^[1-9][0-9]{0,9}$/.test(value)) throw new Error("runtime identity rejected");
-  return value;
-}
-
-function inheritedSecret(path) {
-  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-  const info = fstatSync(fd);
-  if (!info.isFile() || info.uid !== 0 || info.gid !== 0 || (info.mode & 0o777) !== 0o600 || info.size < 6 || info.size > 4096) {
-    closeSync(fd);
-    throw new Error("runtime Slack descriptor source rejected");
-  }
-  unlinkSync(path);
-  return fd;
-}
-
-async function run() {
-  if (process.argv.length !== 2 || process.getuid?.() !== 0 || process.getgid?.() !== 0) {
-    throw new Error("sandbox init identity rejected");
-  }
-  const uid = identity("SELLABLE_AGENT_RUNTIME_UID");
-  const gid = identity("SELLABLE_AGENT_RUNTIME_GID");
-  const profileId = required("SELLABLE_AGENT_PROFILE_ID");
-  if (!SAFE_ID.test(profileId)) throw new Error("sandbox profile rejected");
-  const hermes = required("SELLABLE_AGENT_HERMES_EXECUTABLE");
-  const setpriv = required("SELLABLE_AGENT_SETPRIV_EXECUTABLE");
-  if (!hermes.startsWith("/") || !setpriv.startsWith("/") || setpriv !== "/usr/bin/setpriv") {
-    throw new Error("sandbox executable rejected");
-  }
-  const appFd = inheritedSecret(APP_PATH);
-  const botFd = inheritedSecret(BOT_PATH);
-  try {
-    const args = [
-      "--reuid", uid,
-      "--regid", gid,
-      "--clear-groups",
-      "--no-new-privs",
-      "--bounding-set=-all",
-      "--inh-caps=-all",
-      "--ambient-caps=-all",
-      hermes,
-      "--profile", profileId,
-      "gateway", "run",
-    ];
-    const stdio = Array(10).fill("ignore");
-    stdio[1] = "inherit";
-    stdio[2] = "inherit";
-    stdio[8] = appFd;
-    stdio[9] = botFd;
-    const child = spawn(setpriv, args, {
-      env: process.env,
-      shell: false,
-      stdio,
-    });
-    closeSync(appFd);
-    closeSync(botFd);
-    const forwardTerm = () => { if (!child.killed) child.kill("SIGTERM"); };
-    const forwardInt = () => { if (!child.killed) child.kill("SIGINT"); };
-    process.once("SIGTERM", forwardTerm);
-    process.once("SIGINT", forwardInt);
-    process.exitCode = await new Promise((resolveExit, rejectExit) => {
-      child.once("error", rejectExit);
-      child.once("exit", (code, signal) => resolveExit(code ?? (signal ? 1 : 0)));
-    });
-  } catch (error) {
-    try { closeSync(appFd); } catch {}
-    try { closeSync(botFd); } catch {}
-    throw error;
-  }
-}
-
-try {
-  await run();
-} catch {
-  process.stderr.write("sellable-agent sandbox init failed closed\n");
-  process.exitCode = 1;
-}