@sellable/install 0.1.360-phase111.20260720061815 → 0.1.360

package/bin/sellable-agent-egress-proxy.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+
+import { lstatSync, readFileSync } from "node:fs";
+import {
+  createRuntimeEgressProxy,
+  validateRuntimeEgressProxyConfig,
+} from "../lib/sellable-agent/runtime-egress-proxy.mjs";
+
+const CONFIG_PATH = "/etc/sellable-agent/egress-proxy.json";
+
+try {
+  if (process.argv.length !== 2) throw new Error("arguments rejected");
+  const link = lstatSync(CONFIG_PATH);
+  if (link.isSymbolicLink() || !link.isFile() || link.uid !== 0 || (link.mode & 0o777) !== 0o444) {
+    throw new Error("proxy config ownership rejected");
+  }
+  const parsed = validateRuntimeEgressProxyConfig(JSON.parse(readFileSync(CONFIG_PATH, "utf8")));
+  if (!parsed.ok || process.getuid?.() !== parsed.config.uid || process.getgid?.() !== parsed.config.gid) {
+    throw new Error("proxy identity rejected");
+  }
+  const proxy = createRuntimeEgressProxy(parsed.config);
+  await proxy.listen();
+  const stop = async () => {
+    try { await proxy.close(); } finally { process.exit(0); }
+  };
+  process.once("SIGTERM", stop);
+  process.once("SIGINT", stop);
+} catch {
+  process.stderr.write("sellable-agent egress proxy failed closed\n");
+  process.exitCode = 1;
+}

package/bin/sellable-agent-host-bootstrap.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+import { lstatSync, readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { bootstrapAgentHost } from "../lib/sellable-agent/host-bootstrap.mjs";
+
+function configPath(argv) {
+  if (argv.length !== 2 || argv[0] !== "--config" || !isAbsolute(argv[1])) {
+    throw new Error("usage: --config /absolute/path");
+  }
+  const link = lstatSync(argv[1]);
+  if (link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 || link.uid !== 0 || link.gid !== 0) {
+    throw new Error("host bootstrap config rejected");
+  }
+  return argv[1];
+}
+
+try {
+  if (process.getuid?.() !== 0 || process.getgid?.() !== 0) throw new Error("host bootstrap requires root");
+  const pathValue = configPath(process.argv.slice(2));
+  const result = bootstrapAgentHost({ config: JSON.parse(readFileSync(pathValue, "utf8")) });
+  process.stdout.write(`${JSON.stringify(result.receipt)}\n`);
+} catch {
+  process.stderr.write("sellable-agent host bootstrap failed closed\n");
+  process.exitCode = 1;
+}

package/bin/sellable-agent-host-worker.mjs

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+
+import { runHostWorkerMain } from "../lib/sellable-agent/host-worker.mjs";
+
+const result = await runHostWorkerMain({ argv: process.argv.slice(2) });
+if (!result.ok) {
+  process.stderr.write(`${result.code}\n`);
+  process.exitCode = 1;
+}

package/bin/sellable-agent-runtime-helper.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
+import { runRuntimeHelperRequest } from "../lib/sellable-agent/runtime-helper.mjs";
+
+const requestIndex = process.argv.indexOf("--request");
+const requestPath = requestIndex >= 0 ? process.argv[requestIndex + 1] : null;
+if (!requestPath || process.argv.length !== 4) {
+  process.stderr.write("usage: sellable-agent-runtime-helper --request /absolute/path\n");
+  process.exitCode = 64;
+} else {
+  try {
+    const configPath = "/etc/sellable-agent/runtime-helper.json";
+    const before = lstatSync(configPath);
+    if (before.isSymbolicLink() || !before.isFile() || before.uid !== 0 || (before.mode & 0o022) !== 0) {
+      throw new Error("runtime helper config rejected");
+    }
+    const descriptor = openSync(configPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    let bytes;
+    try {
+      const after = fstatSync(descriptor);
+      if (!after.isFile() || after.uid !== 0 || after.dev !== before.dev || after.ino !== before.ino || (after.mode & 0o022) !== 0) {
+        throw new Error("runtime helper config changed during open");
+      }
+      bytes = readFileSync(descriptor, "utf8");
+    } finally {
+      closeSync(descriptor);
+    }
+    const config = JSON.parse(bytes);
+    const result = await runRuntimeHelperRequest({ requestPath, config });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (!result.ok) process.exitCode = 1;
+  } catch {
+    process.stdout.write(`${JSON.stringify({ ok: false, code: "runtime_helper_config_rejected" })}\n`);
+    process.exitCode = 1;
+  }
+}

package/bin/sellable-agent-runtime-launcher.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+
+import { spawn, spawnSync } from "node:child_process";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import {
+  buildRuntimeBoundaryContract,
+  buildRuntimeBoundaryLaunchSpec,
+  buildRuntimeBoundaryNftProgram,
+  expectedRuntimeCgroup,
+  inspectRuntimeBoundaryInputs,
+  runtimeBoundaryNftRulesMatch,
+} from "../lib/sellable-agent/runtime-boundary.mjs";
+
+const CONFIG_PATH = "/etc/sellable-agent/runtime-boundary.json";
+const SECRET = /xox[bap]-|sat_[A-Za-z0-9_-]+|asec\.v1\.|access[_-]?token|refresh[_-]?token/i;
+
+function fixedRootConfig() {
+  const link = lstatSync(CONFIG_PATH);
+  if (link.isSymbolicLink() || !link.isFile() || link.uid !== 0 || link.gid !== 0 || (link.mode & 0o777) !== 0o400) {
+    throw new Error("runtime boundary config rejected");
+  }
+  const bytes = readFileSync(CONFIG_PATH, "utf8");
+  if (bytes.length > 64 * 1024 || SECRET.test(bytes)) throw new Error("runtime boundary config rejected");
+  const built = buildRuntimeBoundaryContract(JSON.parse(bytes));
+  if (!built.ok) throw new Error("runtime boundary contract rejected");
+  return built.contract;
+}
+
+function provisionCgroup(contract) {
+  const parent = contract.paths.cgroupRoot;
+  const systemRoot = "/sys/fs/cgroup";
+  const rootInfo = lstatSync(systemRoot);
+  if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) throw new Error("cgroup v2 root rejected");
+  const controllers = readFileSync(join(systemRoot, "cgroup.controllers"), "utf8").trim().split(/\s+/);
+  if (!["cpu", "memory", "pids"].every((name) => controllers.includes(name))) {
+    throw new Error("required cgroup controllers unavailable");
+  }
+  const requiredControllers = ["cpu", "memory", "pids"];
+  const enableControllers = (path) => {
+    const controlPath = join(path, "cgroup.subtree_control");
+    const enabled = new Set(readFileSync(controlPath, "utf8").trim().split(/\s+/).filter(Boolean));
+    const missing = requiredControllers.filter((name) => !enabled.has(name));
+    if (missing.length) writeFileSync(controlPath, `${missing.map((name) => `+${name}`).join(" ")}\n`);
+    const observed = new Set(readFileSync(controlPath, "utf8").trim().split(/\s+/).filter(Boolean));
+    if (requiredControllers.some((name) => !observed.has(name))) throw new Error("cgroup controller enablement failed");
+  };
+  enableControllers(systemRoot);
+  if (!existsSync(parent)) mkdirSync(parent, { mode: 0o755 });
+  const parentInfo = lstatSync(parent);
+  if (parentInfo.isSymbolicLink() || !parentInfo.isDirectory() || parentInfo.uid !== 0 || (parentInfo.mode & 0o022) !== 0) {
+    throw new Error("runtime cgroup parent rejected");
+  }
+  enableControllers(parent);
+  const expected = expectedRuntimeCgroup(contract);
+  if (!existsSync(expected.path)) mkdirSync(expected.path, { mode: 0o755 });
+  const groupInfo = lstatSync(expected.path);
+  if (groupInfo.isSymbolicLink() || !groupInfo.isDirectory() || groupInfo.uid !== 0 || (groupInfo.mode & 0o022) !== 0) {
+    throw new Error("runtime cgroup rejected");
+  }
+  if (readFileSync(join(expected.path, "cgroup.procs"), "utf8").trim()) {
+    throw new Error("runtime cgroup still has processes");
+  }
+  for (const [name, value] of Object.entries(expected.files)) {
+    writeFileSync(join(expected.path, name), `${value}\n`);
+    if (readFileSync(join(expected.path, name), "utf8").trim() !== value) throw new Error("runtime cgroup limit drift");
+  }
+  writeFileSync(join(expected.path, "cgroup.procs"), `${process.pid}\n`);
+}
+
+function provisionFirewall(contract) {
+  const policy = buildRuntimeBoundaryNftProgram(contract);
+  if (!policy.ok) throw new Error("runtime firewall contract rejected");
+  const listed = spawnSync(contract.paths.nftPath, ["-j", "list", "tables"], {
+    encoding: "utf8",
+    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
+    timeout: 10_000,
+  });
+  if (listed.status !== 0) throw new Error("runtime firewall inventory failed");
+  let inventory;
+  try { inventory = JSON.parse(listed.stdout); } catch { throw new Error("runtime firewall inventory rejected"); }
+  const exists = Array.isArray(inventory?.nftables) && inventory.nftables.some((entry) =>
+    entry?.table?.family === "inet" && entry.table.name === policy.table);
+  const program = `${exists ? `delete table inet ${policy.table}\n` : ""}${policy.program}`;
+  const applied = spawnSync(contract.paths.nftPath, policy.applyArgs, {
+    input: program,
+    encoding: "utf8",
+    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
+    timeout: 10_000,
+    maxBuffer: 64 * 1024,
+  });
+  if (applied.status !== 0 || SECRET.test(`${applied.stdout}${applied.stderr}`)) {
+    throw new Error("runtime firewall apply failed");
+  }
+  const observed = spawnSync(contract.paths.nftPath, ["list", "table", "inet", policy.table], {
+    encoding: "utf8",
+    env: { PATH: "/usr/sbin:/usr/bin:/sbin:/bin" },
+    timeout: 10_000,
+  });
+  if (observed.status !== 0 || !runtimeBoundaryNftRulesMatch(contract, observed.stdout)) {
+    throw new Error("runtime firewall readback failed");
+  }
+}
+
+async function run() {
+  if (process.argv.length !== 2 || process.getuid?.() !== 0 || process.getgid?.() !== 0) {
+    throw new Error("runtime launcher identity rejected");
+  }
+  for (const fd of [8, 9]) {
+    const link = lstatSync(`/proc/self/fd/${fd}`);
+    if (!link.isSymbolicLink()) throw new Error("runtime Slack descriptor rejected");
+  }
+  const contract = fixedRootConfig();
+  if (!inspectRuntimeBoundaryInputs(contract).ok) throw new Error("runtime boundary inputs rejected");
+  provisionCgroup(contract);
+  provisionFirewall(contract);
+  const spec = buildRuntimeBoundaryLaunchSpec(contract);
+  if (!spec.ok) throw new Error("runtime launch spec rejected");
+  const stdio = Array(10).fill("ignore");
+  stdio[1] = "inherit";
+  stdio[2] = "inherit";
+  stdio[8] = 8;
+  stdio[9] = 9;
+  const child = spawn(spec.command, spec.args, {
+    env: spec.env,
+    shell: false,
+    stdio,
+  });
+  const forwardTerm = () => { if (!child.killed) child.kill("SIGTERM"); };
+  const forwardInt = () => { if (!child.killed) child.kill("SIGINT"); };
+  process.on("SIGTERM", forwardTerm);
+  process.on("SIGINT", forwardInt);
+  const exitCode = await new Promise((resolveExit, rejectExit) => {
+    child.once("error", rejectExit);
+    child.once("exit", (code, signal) => resolveExit(code ?? (signal ? 1 : 0)));
+  });
+  process.exitCode = exitCode;
+}
+
+try {
+  await run();
+} catch {
+  process.stderr.write("sellable-agent runtime boundary failed closed\n");
+  process.exitCode = 1;
+}

package/bin/sellable-agent-runtime-probe.mjs

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+
+import { spawn } from "node:child_process";
+import { lstatSync, readFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const profileIndex = process.argv.indexOf("--profile-id");
+const profileId = profileIndex >= 0 ? process.argv[profileIndex + 1] : null;
+
+function requiredEnv(name) {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(`missing ${name}`);
+  return value;
+}
+
+async function withClient(lockWorkspaceId, run) {
+  const command = requiredEnv("SELLABLE_AGENT_MCP_COMMAND");
+  if (command !== "/usr/local/lib/sellable-agent/external-runtime/mcp/bin/sellable-mcp") {
+    throw new Error("MCP command pin rejected");
+  }
+  const env = {
+    PATH: "/usr/local/bin:/usr/bin:/bin",
+    HOME: requiredEnv("HOME"),
+    NODE_ENV: "production",
+    SELLABLE_CONFIG_PATH: requiredEnv("SELLABLE_CONFIG_PATH"),
+    SELLABLE_AGENT_RUNTIME_SECRET_ROOT: requiredEnv("SELLABLE_AGENT_RUNTIME_SECRET_ROOT"),
+    SELLABLE_AGENT_PROFILE_ID: profileId,
+    SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE: requiredEnv("SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE"),
+    SELLABLE_AGENT_WORKSPACE_ID: requiredEnv("SELLABLE_AGENT_WORKSPACE_ID"),
+    SELLABLE_AGENT_ID: requiredEnv("SELLABLE_AGENT_ID"),
+    SELLABLE_AGENT_CREDENTIAL_GENERATION: requiredEnv("SELLABLE_AGENT_CREDENTIAL_GENERATION"),
+    SELLABLE_AGENT_POLICY_HASH: requiredEnv("SELLABLE_AGENT_POLICY_HASH"),
+    SELLABLE_AGENT_SELECTED_CHANNEL_IDS: requiredEnv("SELLABLE_AGENT_SELECTED_CHANNEL_IDS"),
+    SELLABLE_LOCK_WORKSPACE_ID: lockWorkspaceId,
+    SELLABLE_REQUIRE_WORKSPACE_LOCK: "1",
+  };
+  const child = spawn(command, [], { env, shell: false, stdio: ["pipe", "pipe", "ignore"] });
+  const pending = new Map();
+  let nextId = 1;
+  let failed = null;
+  const lines = createInterface({ input: child.stdout, crlfDelay: Infinity });
+  const failAll = (error) => {
+    failed = error;
+    for (const waiter of pending.values()) waiter.reject(error);
+    pending.clear();
+  };
+  lines.on("line", (line) => {
+    try {
+      const message = JSON.parse(line);
+      if (!Number.isSafeInteger(message.id) || !pending.has(message.id)) return;
+      const waiter = pending.get(message.id);
+      pending.delete(message.id);
+      if (message.error) waiter.reject(new Error("MCP request rejected"));
+      else waiter.resolve(message.result);
+    } catch {
+      failAll(new Error("MCP response rejected"));
+    }
+  });
+  child.once("error", failAll);
+  child.once("exit", () => failAll(new Error("MCP process exited")));
+  const request = (method, params = {}) => new Promise((resolveRequest, rejectRequest) => {
+    if (failed) return rejectRequest(failed);
+    const id = nextId++;
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      rejectRequest(new Error("MCP request timed out"));
+    }, 10_000);
+    pending.set(id, {
+      resolve(value) { clearTimeout(timer); resolveRequest(value); },
+      reject(error) { clearTimeout(timer); rejectRequest(error); },
+    });
+    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
+  });
+  const notify = (method, params = {}) => {
+    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
+  };
+  const initialized = await request("initialize", {
+    protocolVersion: "2025-06-18",
+    capabilities: {},
+    clientInfo: { name: "sellable-agent-runtime-probe", version: "1.0.0" },
+  });
+  if (!initialized?.serverInfo) throw new Error("MCP initialization rejected");
+  notify("notifications/initialized");
+  const client = {
+    listTools: () => request("tools/list", {}),
+    callTool: (params) => request("tools/call", params),
+  };
+  try {
+    return await run(client);
+  } finally {
+    lines.close();
+    child.stdin.end();
+    child.kill("SIGTERM");
+  }
+}
+
+async function toolDenied(client, name, channelId, requesterId, providerRequestId) {
+  try {
+    const result = await client.callTool({
+      name,
+      arguments: {},
+      _meta: { sellableAgent: { channelId, requesterId, providerRequestId } },
+    }, undefined, { timeout: 10_000, maxTotalTimeout: 10_000 });
+    return result?.isError === true;
+  } catch {
+    return true;
+  }
+}
+
+try {
+  if (!SAFE_ID.test(profileId ?? "") || process.argv.length !== 4) throw new Error("probe arguments rejected");
+  const configPath = requiredEnv("SELLABLE_CONFIG_PATH");
+  const link = lstatSync(configPath);
+  if (link.isSymbolicLink() || !link.isFile() || (link.mode & 0o077) !== 0) throw new Error("profile config rejected");
+  const config = JSON.parse(readFileSync(configPath, "utf8"));
+  const workspaceId = requiredEnv("SELLABLE_AGENT_WORKSPACE_ID");
+  const channelIds = config.requestChannelPolicy?.selectedChannelIds;
+  const requesterIds = config.requestChannelPolicy?.memberAllowlist;
+  const tools = config.tools?.include;
+  if (
+    config.workspaceLockId !== workspaceId || !Array.isArray(channelIds) || channelIds.length === 0 ||
+    !Array.isArray(requesterIds) || requesterIds.length === 0 || !Array.isArray(tools) ||
+    !tools.includes("get_company_info")
+  ) throw new Error("profile MCP contract rejected");
+  const channelId = channelIds[0];
+  const requesterId = requesterIds[0];
+  const providerRequestId = `runtime-probe-${profileId}`;
+  const main = await withClient(workspaceId, async (client) => {
+    const listed = (await client.listTools(undefined, { timeout: 10_000, maxTotalTimeout: 10_000 })).tools
+      .map((tool) => tool.name).sort();
+    const safe = await client.callTool({
+      name: "get_company_info",
+      arguments: {},
+      _meta: { sellableAgent: { channelId, requesterId, providerRequestId } },
+    }, undefined, { timeout: 10_000, maxTotalTimeout: 10_000 });
+    return {
+      tools: listed,
+      safeRead: safe?.isError !== true,
+      unexpectedToolDenied: await toolDenied(client, "__sellable_unapproved_probe__", channelId, requesterId, providerRequestId),
+      wrongChannelDenied: await toolDenied(client, "get_company_info", "C0000000000", requesterId, providerRequestId),
+    };
+  });
+  const wrongWorkspaceDenied = await withClient(`wrong-${workspaceId}`, (client) =>
+    toolDenied(client, "get_company_info", channelId, requesterId, providerRequestId));
+  const ok =
+    main.safeRead && main.unexpectedToolDenied && main.wrongChannelDenied && wrongWorkspaceDenied &&
+    JSON.stringify(main.tools) === JSON.stringify([...tools].sort());
+  process.stdout.write(`${JSON.stringify({
+    ok,
+    profileId,
+    workspaceId,
+    tools: main.tools,
+    safeRead: main.safeRead,
+    unexpectedToolDenied: main.unexpectedToolDenied,
+    wrongChannelDenied: main.wrongChannelDenied,
+    wrongWorkspaceDenied,
+  })}\n`);
+  if (!ok) process.exitCode = 1;
+} catch {
+  process.stdout.write(`${JSON.stringify({ ok: false, code: "runtime_probe_rejected" })}\n`);
+  process.exitCode = 1;
+}

package/bin/sellable-agent-sandbox-init.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+
+import { spawn } from "node:child_process";
+import { closeSync, constants, fstatSync, openSync, unlinkSync } from "node:fs";
+
+const APP_PATH = "/run/bootstrap/slack-app";
+const BOT_PATH = "/run/bootstrap/slack-bot";
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+
+function required(name) {
+  const value = process.env[name];
+  if (typeof value !== "string" || !value) throw new Error(`missing ${name}`);
+  return value;
+}
+
+function identity(name) {
+  const value = required(name);
+  if (!/^[1-9][0-9]{0,9}$/.test(value)) throw new Error("runtime identity rejected");
+  return value;
+}
+
+function inheritedSecret(path) {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  const info = fstatSync(fd);
+  if (!info.isFile() || info.uid !== 0 || info.gid !== 0 || (info.mode & 0o777) !== 0o600 || info.size < 6 || info.size > 4096) {
+    closeSync(fd);
+    throw new Error("runtime Slack descriptor source rejected");
+  }
+  unlinkSync(path);
+  return fd;
+}
+
+async function run() {
+  if (process.argv.length !== 2 || process.getuid?.() !== 0 || process.getgid?.() !== 0) {
+    throw new Error("sandbox init identity rejected");
+  }
+  const uid = identity("SELLABLE_AGENT_RUNTIME_UID");
+  const gid = identity("SELLABLE_AGENT_RUNTIME_GID");
+  const profileId = required("SELLABLE_AGENT_PROFILE_ID");
+  if (!SAFE_ID.test(profileId)) throw new Error("sandbox profile rejected");
+  const hermes = required("SELLABLE_AGENT_HERMES_EXECUTABLE");
+  const setpriv = required("SELLABLE_AGENT_SETPRIV_EXECUTABLE");
+  if (!hermes.startsWith("/") || !setpriv.startsWith("/") || setpriv !== "/usr/bin/setpriv") {
+    throw new Error("sandbox executable rejected");
+  }
+  const appFd = inheritedSecret(APP_PATH);
+  const botFd = inheritedSecret(BOT_PATH);
+  try {
+    const args = [
+      "--reuid", uid,
+      "--regid", gid,
+      "--clear-groups",
+      "--no-new-privs",
+      "--bounding-set=-all",
+      "--inh-caps=-all",
+      "--ambient-caps=-all",
+      hermes,
+      "--profile", profileId,
+      "gateway", "run",
+    ];
+    const stdio = Array(10).fill("ignore");
+    stdio[1] = "inherit";
+    stdio[2] = "inherit";
+    stdio[8] = appFd;
+    stdio[9] = botFd;
+    const child = spawn(setpriv, args, {
+      env: process.env,
+      shell: false,
+      stdio,
+    });
+    closeSync(appFd);
+    closeSync(botFd);
+    const forwardTerm = () => { if (!child.killed) child.kill("SIGTERM"); };
+    const forwardInt = () => { if (!child.killed) child.kill("SIGINT"); };
+    process.once("SIGTERM", forwardTerm);
+    process.once("SIGINT", forwardInt);
+    process.exitCode = await new Promise((resolveExit, rejectExit) => {
+      child.once("error", rejectExit);
+      child.once("exit", (code, signal) => resolveExit(code ?? (signal ? 1 : 0)));
+    });
+  } catch (error) {
+    try { closeSync(appFd); } catch {}
+    try { closeSync(botFd); } catch {}
+    throw error;
+  }
+}
+
+try {
+  await run();
+} catch {
+  process.stderr.write("sellable-agent sandbox init failed closed\n");
+  process.exitCode = 1;
+}

package/bin/sellable-install.mjs

@@ -401,6 +401,8 @@ function parseArgs(argv) {
   if (opts.sellableConfigPath && !opts.sellableConfigsDir) {
     opts.sellableConfigsDir = join(dirname(opts.sellableConfigPath), "configs");
   }
+  opts.lockWorkspaceId = opts.workspaceId;
+  opts.requireWorkspaceLock = Boolean(opts.workspaceId);
 
   return opts;
 }

package/container/Dockerfile

@@ -0,0 +1,41 @@
+ARG HERMES_IMAGE=ghcr.io/hostinger/hvps-hermes-agent@sha256:f048663be9ba564de795df5f2a8184f32b92561a1f053c179dca3b45fa5bc8b9
+FROM ${HERMES_IMAGE}
+
+USER root
+
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.360
+ARG MCP_PACKAGE=@sellable/mcp@0.1.620
+ARG INSTALLER_INTEGRITY
+ARG MCP_INTEGRITY=sha512-N+2clnLHWAlvoXCjX10HaeEUMPLqZQHIX+x/2e1CSJbqb56CU1SAtVdwmhXyha7+MQT0DZF7pm2+WnoZKFEzOw==
+
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.360" \
+    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.620" \
+    && test -n "${INSTALLER_INTEGRITY}" \
+    && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
+    && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
+    && apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      bubblewrap \
+      ca-certificates \
+      nftables \
+      sudo \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
+    && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
+    && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.360' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.620') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.360', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.620', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && npm cache clean --force
+
+COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
+RUN test -x /usr/local/bin/node \
+    && test ! -e /usr/bin/node \
+    && ln -s /usr/local/bin/node /usr/bin/node \
+    && test "$(readlink -f /usr/bin/node)" = "/usr/local/bin/node" \
+    && chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD /command/s6-svstat /etc/services.d/sellable-agent-host-worker | grep -q '^up' || exit 1
+
+ENTRYPOINT ["/usr/local/bin/sellable-agent-container-entrypoint"]

package/container/README.md

@@ -0,0 +1,15 @@
+# Sellable Agent host container
+
+This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
+
+Build from this directory after `@sellable/install@0.1.360` is published:
+
+```sh
+docker build --platform linux/amd64 \
+  --build-arg INSTALLER_INTEGRITY='sha512-…' \
+  --tag sellable-agent-host:0.1.360 .
+```
+
+Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.
+
+Set `SELLABLE_AGENT_IMAGE` to the exact built image digest and start `compose.yaml`. The container bootstraps idempotently, writes `bootstrap/registration-receipt.json`, and starts the worker and isolated runtime under s6. Do not mount a Docker socket.

package/container/compose.yaml

@@ -0,0 +1,22 @@
+services:
+  sellable-agent-host:
+    image: ${SELLABLE_AGENT_IMAGE:?set exact Sellable Agent image}
+    container_name: ${SELLABLE_AGENT_CONTAINER_NAME:-sellable-agent-host-11201}
+    hostname: ${SELLABLE_AGENT_HOSTNAME:-hermes-hostinger-1807396}
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+    cgroup: host
+    pid: host
+    volumes:
+      - ./bootstrap:/var/lib/sellable-agent-bootstrap:rw
+      - sellable-agent-worker:/var/lib/sellable-agent-worker
+      - sellable-agent-runtime:/var/lib/sellable-agent-runtime
+      - sellable-agent-profiles:/var/lib/sellable-agent-profiles
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+
+volumes:
+  sellable-agent-worker:
+  sellable-agent-runtime:
+  sellable-agent-profiles:

package/container/entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+PATH="/command:${PATH}"
+export PATH
+
+BOOTSTRAP_CONFIG=/var/lib/sellable-agent-bootstrap/bootstrap.json
+BOOTSTRAP_BIN=/opt/sellable-agent/install-root/node_modules/.bin/sellable-agent-host-bootstrap
+
+test "$(id -u)" = "0"
+test "$(id -g)" = "0"
+test -x "${BOOTSTRAP_BIN}"
+test -f "${BOOTSTRAP_CONFIG}"
+
+"${BOOTSTRAP_BIN}" --config "${BOOTSTRAP_CONFIG}"
+exec /command/s6-svscan /etc/services.d