@sellable/install 0.1.462 → 0.1.464

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.462
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.464
 ARG MCP_PACKAGE=@sellable/mcp@0.1.760-wip.phase143.20260727100513
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-muNXHuRnLTfsnW+MQUvK+p0VBZETDKeevr70iRliXyqE3/SLrZQJLL1laJzMo+qiUs9jMXMHdKOQfQqLiwJvtg==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.462" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.464" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.760-wip.phase143.20260727100513" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.462" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.462' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.760-wip.phase143.20260727100513') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.464' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.760-wip.phase143.20260727100513') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.462', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.760-wip.phase143.20260727100513', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.464', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.760-wip.phase143.20260727100513', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,13 +3,13 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.462` is
+`@sellable/install@0.1.464` is
 published:
 
 ```sh
 docker build --platform linux/amd64 \
   --build-arg INSTALLER_INTEGRITY='sha512-…' \
-  --tag sellable-agent-host:0.1.462 .
+  --tag sellable-agent-host:0.1.464 .
 ```
 
 Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -15,6 +15,7 @@ ARG ADMIN_LOCKED_TREE_DIGEST
 ARG ADMIN_ARTIFACT_DIGEST
 ARG ADMIN_PACKAGE_LOCK_B64
 ARG ADMIN_PROFILE_CONTRACT_TEMPLATE_B64
+ARG TUS_JS_CLIENT_VERSION=4.3.1
 
 RUN set -eux; \
     test -n "${ADMIN_PACKAGE_LOCK_B64}"; \
@@ -40,6 +41,14 @@ RUN set -eux; \
       --omit=dev \
       --no-audit \
       --no-fund; \
+    npm install \
+      --prefix /usr/local/lib/sellable-agent \
+      --omit=dev \
+      --ignore-scripts \
+      --no-audit \
+      --no-fund \
+      "tus-js-client@${TUS_JS_CLIENT_VERSION}"; \
+    test "$(node -p "require('/usr/local/lib/sellable-agent/node_modules/tus-js-client/package.json').version")" = "${TUS_JS_CLIENT_VERSION}"; \
     test -f /usr/local/lib/sellable-agent/admin-artifact/node_modules/@sellable/install/lib/sellable-agent/admin-runtime-reconciler.mjs; \
     test -f /usr/local/lib/sellable-agent/admin-artifact/node_modules/@sellable/admin-mcp/dist/index.js; \
     node -e 'const p=require("/usr/local/lib/sellable-agent/admin-artifact/node_modules/@sellable/admin-mcp/package.json"); if(p.main!=="dist/index.js" || p.bin?.["sellable-admin-mcp"]!=="dist/index.js") process.exit(1);'; \
@@ -60,7 +69,9 @@ COPY hermes-memory-dirty.mjs /opt/sellable/bin/hermes-memory-dirty
 COPY hermes-memory-reconcile.sh /opt/sellable/share/hermes-memory-reconcile.sh
 COPY fly-admin-image/rootfs/ /
 
-RUN chmod 0755 /etc \
+RUN node --input-type=module -e \
+      'await import("/usr/local/lib/sellable-agent/fly-runtime-identity.mjs");' \
+    && chmod 0755 /etc \
     && chmod 0555 \
       /usr/local/lib/sellable-agent/admin-runtime/admin-runtime.mjs \
       /usr/local/lib/sellable-agent/admin-runtime/start-admin-runtime \

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import {
   createHash,
   createPrivateKey,
@@ -11,6 +11,7 @@ import {
 import {
   chmodSync,
   closeSync,
+  cpSync,
   existsSync,
   lstatSync,
   mkdirSync,
@@ -37,7 +38,10 @@ import {
   stageAdminProfile,
 } from "../admin-artifact/node_modules/@sellable/admin-install/lib/hermes-admin-profile-factory.mjs";
 import { parseFlyCustomerModelCredential } from "../admin-artifact/node_modules/@sellable/install/lib/sellable-agent/fly-customer-model.mjs";
-import { buildNativeHermesLaunch } from "../admin-artifact/node_modules/@sellable/install/lib/sellable-agent/fly-customer-worker.mjs";
+import {
+  buildAgentServiceEnvironment,
+  buildNativeHermesLaunch,
+} from "../admin-artifact/node_modules/@sellable/install/lib/sellable-agent/fly-customer-worker.mjs";
 import sodium from "../admin-artifact/node_modules/libsodium-wrappers/dist/modules-esm/libsodium-wrappers.mjs";
 import {
   createFlyCustomerControlClient,
@@ -79,6 +83,51 @@ const RUNTIME_ROOT = join(DATA_ROOT, ".sellable-agent", "admin-runtime");
 const DELIVERY_ROOT = join(RUNTIME_ROOT, "delivery");
 const SECRET_ROOT = "/run/sellable-agent/admin-runtime";
 const HERMES = "/opt/hermes/.venv/bin/hermes";
+const NODE = "/usr/local/bin/node";
+const ADMIN_INSTALL_PACKAGE_ROOT = join(
+  ARTIFACT_ROOT,
+  "node_modules",
+  "@sellable",
+  "admin-install"
+);
+const ADMIN_INSTALL_ASSET_ROOT = join(ADMIN_INSTALL_PACKAGE_ROOT, "runtime");
+const ADMIN_INSTALL_CLI = join(
+  ADMIN_INSTALL_PACKAGE_ROOT,
+  "bin",
+  "sellable-admin-install.mjs"
+);
+// The installer materializes these four dependencies next to the runtime tree
+// in `--source package` mode; the sealed image already carries the exact
+// locked copies, so the runtime reuses them instead of reaching the registry.
+const ADMIN_INSTALL_DEPENDENCIES = Object.freeze([
+  "libsodium",
+  "libsodium-wrappers",
+  "playwright-core",
+  "yaml",
+]);
+const ADMIN_SETTINGS_FILES = Object.freeze([
+  ".env",
+  "settings.json",
+  "config-state.json",
+]);
+const ADMIN_HOME_BINARIES = Object.freeze([
+  "grain",
+  "grain-lightfield-sync",
+  "lightfield",
+  "notion-browser",
+  "notion-profile-sync",
+  "notion-publish",
+  "sellable-admin-install",
+  "slack-pp-cli",
+  "with-sellable-admin-env",
+]);
+// Codex shims and the Lightfield SDK virtualenv are the installer's only
+// symlink-bearing outputs. They live outside the profile home because
+// mergeHermesState refuses to merge a profile that contains any symlink.
+const ADMIN_CODEX_ROOT = join(RUNTIME_ROOT, "codex");
+const ADMIN_LIGHTFIELD_VENV = join(RUNTIME_ROOT, "venvs", "lightfield");
+const SYSTEM_PATH =
+  "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 const RECEIPT_PATH =
   process.env.SELLABLE_AGENT_ADMIN_CANARY_RECEIPT_PATH ??
   "/run/sellable-agent/admin-canary/receipt.json";
@@ -151,6 +200,198 @@ function installAdminHermesMemoryHook(profileRoot) {
   );
 }
 
+// The installed Admin layout is the exact shape `sellable-admin-install`
+// produces for a Hermes profile: `<profileHome>/.sellable-admin` holds the
+// generated CLI wrappers, the runtime tree, and the working copies of the
+// delivered settings generation.
+export function adminHomeLayout(profileHome) {
+  const adminHome = join(profileHome, ".sellable-admin");
+  const adminRoot = join(adminHome, "runtime", "sellable-admin");
+  const binRoot = join(adminHome, "bin");
+  return {
+    profileHome,
+    adminHome,
+    adminRoot,
+    binRoot,
+    configPath: join(adminHome, "settings.json"),
+    statePath: join(adminHome, "config-state.json"),
+    envPath: join(adminHome, ".env"),
+    lightfieldBin: join(binRoot, "lightfield"),
+    path: [
+      join(profileHome, ".local", "bin"),
+      binRoot,
+      join(profileHome, ".slack", "bin"),
+      join(profileHome, ".venvs", "browser-use", "bin"),
+      "/opt/hermes/bin",
+      "/opt/hermes/.venv/bin",
+      SYSTEM_PATH,
+    ].join(":"),
+  };
+}
+
+function adminToolEnv(layout) {
+  return {
+    PATH: layout.path,
+    SELLABLE_ADMIN_HOME: layout.adminHome,
+    SELLABLE_ADMIN_CONFIG_PATH: layout.configPath,
+    SELLABLE_ADMIN_STATE_PATH: layout.statePath,
+    SELLABLE_ADMIN_ROOT: layout.adminRoot,
+    SELLABLE_ADMIN_LIGHTFIELD_BIN: layout.lightfieldBin,
+    SELLABLE_ADMIN_LIGHTFIELD_VENV: ADMIN_LIGHTFIELD_VENV,
+  };
+}
+
+// The delivered generation directory stays the immutable proof subject; the
+// Admin home keeps working copies exactly like an installer-managed host.
+function deliverAdminSettings(settingsRoot, layout) {
+  const delivered = ADMIN_SETTINGS_FILES.map((name) => {
+    const path = join(settingsRoot, name);
+    if (
+      !existsSync(path) ||
+      lstatSync(path).isSymbolicLink() ||
+      !lstatSync(path).isFile()
+    ) {
+      throw new Error("admin_runtime_settings_generation_rejected");
+    }
+    return { name, bytes: readFileSync(path) };
+  });
+  privateDirectory(layout.adminHome);
+  for (const { name, bytes } of delivered) {
+    atomicPrivateFile(join(layout.adminHome, name), bytes);
+  }
+}
+
+function assertNoSymlinks(root, code) {
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) throw new Error(code);
+    if (entry.isDirectory()) assertNoSymlinks(join(root, entry.name), code);
+  }
+}
+
+// Staged so the promotion rename publishes the runtime tree atomically with
+// the rest of the profile.
+function stageAdminRuntimeTree(stageRoot) {
+  const stagedRoot = join(
+    stageRoot,
+    ".sellable-admin",
+    "runtime",
+    "sellable-admin"
+  );
+  rmSync(stagedRoot, { recursive: true, force: true });
+  mkdirSync(dirname(stagedRoot), { recursive: true, mode: 0o700 });
+  cpSync(ADMIN_INSTALL_ASSET_ROOT, stagedRoot, { recursive: true });
+  for (const name of ADMIN_INSTALL_DEPENDENCIES) {
+    const target = join(stagedRoot, "node_modules", name);
+    rmSync(target, { recursive: true, force: true });
+    mkdirSync(dirname(target), { recursive: true });
+    cpSync(join(ARTIFACT_ROOT, "node_modules", name), target, {
+      recursive: true,
+    });
+  }
+  assertNoSymlinks(stagedRoot, "admin_runtime_admin_tree_symlink_rejected");
+  return stagedRoot;
+}
+
+// The published `bin/sellable-admin-install` shim resolves the installer from
+// the registry at call time, which a sealed runtime must never do. The image
+// already carries the exact locked installer, so the shim executes that copy.
+function writeAdminInstallShim(layout) {
+  mkdirSync(layout.binRoot, { recursive: true });
+  const path = join(layout.binRoot, "sellable-admin-install");
+  writeFileSync(
+    path,
+    `#!/usr/bin/env sh\nexec ${NODE} ${ADMIN_INSTALL_CLI} "$@"\n`,
+    { mode: 0o755 }
+  );
+  chmodSync(path, 0o755);
+  return path;
+}
+
+function installAdminHome({ settingsRoot, layout }) {
+  deliverAdminSettings(settingsRoot, layout);
+  if (!existsSync(join(layout.adminRoot, "scripts", "install-local-mcp.mjs"))) {
+    throw new Error("admin_runtime_admin_tree_missing");
+  }
+  privateDirectory(ADMIN_CODEX_ROOT);
+  writeAdminInstallShim(layout);
+  // `SELLABLE_ADMIN_CLI_WRAPPERS_ONLY` is the installer's own Hermes path: it
+  // writes bin/ plus install.json from local bytes and performs no network,
+  // registry, pip, or npm work.
+  const generated = spawnSync(
+    NODE,
+    [join(layout.adminRoot, "scripts", "install-local-mcp.mjs")],
+    {
+      cwd: layout.adminRoot,
+      env: {
+        ...adminToolEnv(layout),
+        HOME: layout.profileHome,
+        CODEX_HOME: ADMIN_CODEX_ROOT,
+        SELLABLE_ADMIN_INSTALL_HOST: "hermes",
+        SELLABLE_ADMIN_CLI_WRAPPERS_ONLY: "1",
+        SELLABLE_ADMIN_EMPLOYEE_INSTALL: "1",
+        SELLABLE_ADMIN_MCP_MODE: "package",
+        SELLABLE_ADMIN_MCP_PACKAGE_SPEC:
+          process.env.SELLABLE_AGENT_ADMIN_MCP_PACKAGE ?? "",
+        SELLABLE_ADMIN_INSTALL_PACKAGE_SPEC:
+          process.env.SELLABLE_AGENT_ADMIN_INSTALL_PACKAGE ?? "",
+        NO_COLOR: "1",
+      },
+      encoding: "utf8",
+      timeout: TIMEOUT_MS,
+    }
+  );
+  let summary;
+  try {
+    summary = JSON.parse(generated.stdout);
+  } catch {
+    throw new Error("admin_runtime_admin_home_wrappers_rejected");
+  }
+  // The installer reports a non-zero status whenever any wrapper is unready,
+  // and `slack-pp` resolves a pinned external binary this sealed runtime does
+  // not carry. Every wrapper it generates from local bytes must still be ready.
+  if (
+    generated.error ||
+    summary?.adminHome !== layout.adminHome ||
+    !Array.isArray(summary.wrappers) ||
+    summary.wrappers.length < 1 ||
+    summary.wrappers.some(
+      (wrapper) =>
+        wrapper?.kind !== "external-binary" && wrapper?.ready !== true
+    )
+  ) {
+    throw new Error("admin_runtime_admin_home_wrappers_rejected");
+  }
+  for (const name of ADMIN_HOME_BINARIES) {
+    const stat = lstatSync(join(layout.binRoot, name));
+    if (stat.isSymbolicLink() || !stat.isFile() || (stat.mode & 0o111) === 0) {
+      throw new Error("admin_runtime_admin_home_binary_rejected");
+    }
+  }
+  const install = JSON.parse(
+    readFileSync(join(layout.adminHome, "install.json"), "utf8")
+  );
+  if (
+    install.adminHome !== layout.adminHome ||
+    install.adminRoot !== layout.adminRoot
+  ) {
+    throw new Error("admin_runtime_admin_home_install_rejected");
+  }
+  for (const name of ADMIN_SETTINGS_FILES) {
+    const stat = lstatSync(join(layout.adminHome, name));
+    if (stat.isSymbolicLink() || !stat.isFile() || (stat.mode & 0o077) !== 0) {
+      throw new Error("admin_runtime_admin_home_settings_rejected");
+    }
+  }
+  return {
+    home: layout.adminHome,
+    root: layout.adminRoot,
+    binaries: [...ADMIN_HOME_BINARIES],
+    settings: [...ADMIN_SETTINGS_FILES],
+    marketplaceRoot: install.marketplaceRoot,
+    pluginCacheRoot: install.pluginCacheRoot,
+  };
+}
+
 async function installedPackage(packageName) {
   const path = `${ARTIFACT_ROOT}/node_modules/${packageName}/package.json`;
   const value = JSON.parse(await readFile(path, "utf8"));
@@ -294,7 +535,13 @@ function exactSoul(claim) {
   return { bytes: soul, sha256: sha256(soul), byteLength: soul.byteLength };
 }
 
-function profilePackageReceipt(profileContract, alias, role) {
+function profilePackageReceipt(
+  profileContract,
+  alias,
+  role,
+  layout,
+  agentServiceEnv = {}
+) {
   const entry = profileContract.packages[alias][role];
   const packageName = entry.name;
   const entrypoint =
@@ -305,6 +552,13 @@ function profilePackageReceipt(profileContract, alias, role) {
     ...entry,
     command: "/usr/local/bin/node",
     args: [entrypoint],
+    // The Admin MCP resolves its packaged gateway scripts through
+    // SELLABLE_ADMIN_ROOT and its CLI shell-outs through PATH, so the server
+    // entry carries them instead of relying on gateway inheritance.
+    ...(alias === "sellable-admin" ? { env: adminToolEnv(layout) } : {}),
+    ...(alias === "sellable" && Object.keys(agentServiceEnv).length > 0
+      ? { env: agentServiceEnv }
+      : {}),
   };
 }
 
@@ -315,6 +569,7 @@ async function materializeAdminProfile({
   productConfigPath,
   soul,
   slack = null,
+  agentServiceEnv = {},
 }) {
   const profileHome = profileContract.profileHome;
   const profile = basename(profileHome);
@@ -324,6 +579,10 @@ async function materializeAdminProfile({
   const stageRoot = join(PROFILES_ROOT, ".staging", profile);
   const backupRoot = join(PROFILES_ROOT, ".backup", profile);
   privateDirectory(PROFILES_ROOT);
+  const layout = adminHomeLayout(profileHome);
+  // stageAdminProfile canonicalizes these two paths before staging, so the
+  // Admin home working copies must exist before the factory runs.
+  deliverAdminSettings(settingsRoot, layout);
   const serverProofs = {};
   const stage = await stageAdminProfile({
     mode: slack ? "direct_soul_native_slack" : "direct_soul",
@@ -335,8 +594,8 @@ async function materializeAdminProfile({
     stageRoot,
     finalProfileRoot: profileHome,
     rootAuthPath,
-    canonicalAdminConfigPath: join(settingsRoot, "settings.json"),
-    canonicalAdminStatePath: join(settingsRoot, "config-state.json"),
+    canonicalAdminConfigPath: layout.configPath,
+    canonicalAdminStatePath: layout.statePath,
     productConfigPath,
     model: "gpt-5.6-sol",
     reasoningEffort: "high",
@@ -351,18 +610,19 @@ async function materializeAdminProfile({
           slackApp: slack.slackApp,
         }
       : {}),
-    skillsRoot: `${ARTIFACT_ROOT}/node_modules/@sellable/admin-install/runtime/mcp/skills`,
-    installRoot: join(
-      profileHome,
-      ".sellable-admin",
-      "runtime",
-      "sellable-admin"
-    ),
-    adminHome: settingsRoot,
+    skillsRoot: join(ADMIN_INSTALL_ASSET_ROOT, "mcp", "skills"),
+    installRoot: layout.adminRoot,
+    adminHome: layout.adminHome,
     installAdmin: async () =>
-      profilePackageReceipt(profileContract, "sellable-admin", "mcp"),
+      profilePackageReceipt(profileContract, "sellable-admin", "mcp", layout),
     installProduct: async () =>
-      profilePackageReceipt(profileContract, "sellable", "mcp"),
+      profilePackageReceipt(
+        profileContract,
+        "sellable",
+        "mcp",
+        layout,
+        agentServiceEnv
+      ),
     verifyMcp: async ({ kind, profileRoot, config }) => {
       const alias = kind === "admin" ? "sellable-admin" : "sellable";
       const server = config.mcp_servers[alias];
@@ -373,9 +633,8 @@ async function materializeAdminProfile({
         env: {
           HOME: profileRoot,
           HERMES_HOME: profileRoot,
-          SELLABLE_ADMIN_HOME: settingsRoot,
-          SELLABLE_ADMIN_CONFIG_PATH: join(settingsRoot, "settings.json"),
-          SELLABLE_ADMIN_STATE_PATH: join(settingsRoot, "config-state.json"),
+          ...adminToolEnv(layout),
+          ...agentServiceEnv,
           SELLABLE_CONFIG_PATH: productConfigPath,
           ...(server.env ?? {}),
         },
@@ -393,12 +652,16 @@ async function materializeAdminProfile({
   });
   mergeHermesState(profileHome, stageRoot);
   installAdminHermesMemoryHook(stageRoot);
+  stageAdminRuntimeTree(stageRoot);
   const promotion = await promoteAdminProfileAtomically({
     profile,
     currentRoot: profileHome,
     stagedRoot: stageRoot,
     backupRoot,
   });
+  // The installer bakes absolute paths into every generated wrapper, so the
+  // bin/ tree is generated once the promoted Admin home is at its final path.
+  const adminHome = installAdminHome({ settingsRoot, layout });
   const memoryCron = await ensureHermesSnapshotCron({
     profileId: profile,
     profileRoot: profileHome,
@@ -411,6 +674,7 @@ async function materializeAdminProfile({
     promotion,
     profile,
     profileHome,
+    adminHome,
     servers: [serverProofs.sellable, serverProofs["sellable-admin"]].map(
       ({ tools: _tools, ...proof }) => proof
     ),
@@ -675,6 +939,41 @@ function clearRuntimeSecrets() {
   }
 }
 
+function adminAgentServiceEnvironment(claim) {
+  const operation = claim?.operation;
+  const service = claim?.runtimeContract?.service;
+  const bindings = claim?.runtimeContract?.slack?.selectedBindings;
+  const toolInclude = service?.toolInclude;
+  if (
+    !operation ||
+    !service ||
+    !/^[A-Za-z0-9_-]{1,128}$/.test(service.principalId ?? "") ||
+    !Array.isArray(toolInclude) ||
+    toolInclude.length < 1 ||
+    JSON.stringify(toolInclude) !==
+      JSON.stringify([...new Set(toolInclude)].sort()) ||
+    !Array.isArray(bindings) ||
+    bindings.length < 1 ||
+    bindings.some(
+      (binding) =>
+        !binding ||
+        typeof binding.channelId !== "string" ||
+        !/^[A-Za-z0-9_-]{1,128}$/.test(binding.channelId)
+    )
+  ) {
+    throw new Error("admin_runtime_agent_service_environment_rejected");
+  }
+  return buildAgentServiceEnvironment({
+    workspaceId: operation.workspaceId,
+    agentId: operation.agentId,
+    serviceCredentialGeneration: service.credentialGeneration,
+    policyHash: service.policyHash,
+    selectedChannelIds: [
+      ...new Set(bindings.map((binding) => binding.channelId)),
+    ].sort(),
+  });
+}
+
 function nativeSlackProfileInput(claim, installed) {
   const slack = claim.runtimeContract?.slack;
   const bindings = slack?.selectedBindings;
@@ -1286,19 +1585,25 @@ function desiredLifecycleForClaim(claim) {
   }
 }
 
-async function startNativeGateway({ profile, claim, settingsRoot }) {
+async function startNativeGateway({ profile, claim }) {
+  // buildNativeHermesLaunch replaces the environment instead of merging it, so
+  // the Admin gateway carries its own PATH for the generated bin/ wrappers.
+  // The escrowed .env is deliberately not sourced here: it carries
+  // SLACK_BOT_TOKEN, which the shared native-gateway policy rejects and which
+  // this runtime passes only through inherited file descriptors 8 and 9. Tool
+  // credentials stay in 0600 files and are loaded per invocation by
+  // bin/with-sellable-admin-env and by the generated CLI wrappers.
   const launch = buildNativeHermesLaunch({
     profileRoot: profile.profileHome,
     secretsRoot: SECRET_ROOT,
     profileId: profile.profile,
     env: {
+      ...adminToolEnv(adminHomeLayout(profile.profileHome)),
+      ...adminAgentServiceEnvironment(claim),
       HOME: SECRET_ROOT,
       HERMES_HOME: DATA_ROOT,
       SELLABLE_HERMES_PROFILE_ID: profile.profile,
       CODEX_HOME: SECRET_ROOT,
-      SELLABLE_ADMIN_HOME: settingsRoot,
-      SELLABLE_ADMIN_CONFIG_PATH: join(settingsRoot, "settings.json"),
-      SELLABLE_ADMIN_STATE_PATH: join(settingsRoot, "config-state.json"),
       NO_COLOR: "1",
     },
   });
@@ -1634,6 +1939,7 @@ export async function runAdminCanary() {
     profileDigest: profileContract.digest,
     servers: profile.servers,
     settings: observedSettings,
+    adminHome: profile.adminHome,
     transition,
     permissions: {
       profileMode: (profileStat.mode & 0o777).toString(8).padStart(4, "0"),
@@ -1921,6 +2227,7 @@ async function runAdminProduction() {
         productConfigPath: installed.productConfigPath,
         soul: exactSoul(claim),
         slack: nativeSlackProfileInput(claim, installed),
+        agentServiceEnv: adminAgentServiceEnvironment(claim),
       });
       const memorySnapshot = await flushHermesSnapshot({
         client,
@@ -1960,13 +2267,7 @@ async function runAdminProduction() {
       });
       operationHeartbeat.assertHealthy();
       const candidateLaunch =
-        desiredLifecycle === "ON"
-          ? {
-              profile,
-              claim,
-              settingsRoot: imported.receipt.generationRoot,
-            }
-          : null;
+        desiredLifecycle === "ON" ? { profile, claim } : null;
       let candidateGateway = null;
       try {
         if (candidateLaunch) {

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -5,7 +5,7 @@ USER root
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.789-wip.phase159.20260729223403
 ARG MCP_INTEGRITY=sha512-KoheQcAQe/c8xzhF3R1ls6nQd11bcQqM3ykOUlzzNX5kykO7rO8RR2KsOvomwMv2Nn5VzvZZx6rGrle/6woKfw==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.462
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.464
 ARG TUS_JS_CLIENT_VERSION=4.3.1
 ARG HERMES_VERSION=0.19.0
 ARG MCP_TRUST_ROOT_B64

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -69,7 +69,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.19.0";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.462";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.464";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ??
   "@sellable/mcp@0.1.789-wip.phase159.20260729223403";

package/lib/sellable-agent/fly-customer-worker.mjs

@@ -32,6 +32,40 @@ function stableJson(value) {
   return JSON.stringify(value);
 }
 
+export function buildAgentServiceEnvironment({
+  workspaceId,
+  agentId,
+  serviceCredentialGeneration,
+  policyHash,
+  selectedChannelIds,
+}) {
+  const canonicalChannels = Array.isArray(selectedChannelIds)
+    ? [...new Set(selectedChannelIds)].sort()
+    : [];
+  if (
+    !SAFE_ID.test(workspaceId ?? "") ||
+    !SAFE_ID.test(agentId ?? "") ||
+    !Number.isSafeInteger(serviceCredentialGeneration) ||
+    serviceCredentialGeneration < 1 ||
+    !SHA256.test(policyHash ?? "") ||
+    canonicalChannels.length < 1 ||
+    canonicalChannels.length > 100 ||
+    canonicalChannels.some((channelId) => !SAFE_ID.test(channelId ?? "")) ||
+    JSON.stringify(selectedChannelIds) !== JSON.stringify(canonicalChannels)
+  ) {
+    throw new Error("agent_service_environment_rejected");
+  }
+  return Object.freeze({
+    SELLABLE_AGENT_WORKSPACE_ID: workspaceId,
+    SELLABLE_AGENT_ID: agentId,
+    SELLABLE_AGENT_CREDENTIAL_GENERATION: String(serviceCredentialGeneration),
+    SELLABLE_AGENT_POLICY_HASH: policyHash,
+    SELLABLE_AGENT_SELECTED_CHANNEL_IDS: JSON.stringify(canonicalChannels),
+    SELLABLE_LOCK_WORKSPACE_ID: workspaceId,
+    SELLABLE_REQUIRE_WORKSPACE_LOCK: "1",
+  });
+}
+
 function exactKeys(value, keys) {
   return Boolean(
     value &&

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.462";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.464";
 const MCP_PACKAGE = "@sellable/mcp@0.1.760-wip.phase143.20260727100513";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1540,7 +1540,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.462" ||
+      pinned.installerPackage !== "@sellable/install@0.1.464" ||
       pinned.mcpPackage !==
         "@sellable/mcp@0.1.760-wip.phase143.20260727100513" ||
       !Array.isArray(policy.toolInclude) ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -197,7 +197,7 @@ function validateDesired(desired) {
     desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.462" ||
+    desired.installerPackage !== "@sellable/install@0.1.464" ||
     desired.mcpPackage !==
       "@sellable/mcp@0.1.760-wip.phase143.20260727100513" ||
     !Array.isArray(desired.toolInclude) ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.462";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.464";
 export const PINNED_MCP_PACKAGE =
   "@sellable/mcp@0.1.760-wip.phase143.20260727100513";
 
@@ -612,7 +612,7 @@ function inspectProvisionedProfile({
       !matchesReadback(manifest, request) ||
       manifest.serviceCredentialReference !== serviceCredentialReference ||
       manifest.installerPackage !== PINNED_INSTALL_PACKAGE ||
-      manifest.installerVersion !== "0.1.462" ||
+      manifest.installerVersion !== "0.1.464" ||
       manifest.mcpPackage !== PINNED_MCP_PACKAGE ||
       manifest.credentialKeyVersion !== credentialKeyVersion ||
       !/^[a-f0-9]{16}$/.test(manifest.credentialFingerprint) ||
@@ -826,7 +826,7 @@ function successReceipt({
     subject: `agent-profile:${observed.profileId}`,
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.462",
+      installVersion: "0.1.464",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },
@@ -874,7 +874,7 @@ function failure(code, stages, extra = {}, request = null) {
       : "agent-profile:unbound",
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.462",
+      installVersion: "0.1.464",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.462",
+  "version": "0.1.464",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {