@sellable/install 0.1.639-wip.agent-browser.20260813.2 → 0.1.641

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/container/Dockerfile +7 -7
  2. package/container/README.md +1 -1
  3. package/lib/sellable-agent/external-runtime-builder.mjs +1 -1
  4. package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs +12 -4
  5. package/lib/sellable-agent/fly-customer-image/Dockerfile +3 -3
  6. package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs +2 -2
  7. package/lib/sellable-agent/hermes-memory-snapshot.mjs +9 -1
  8. package/lib/sellable-agent/host-bootstrap.mjs +2 -2
  9. package/lib/sellable-agent/host-worker.mjs +2 -2
  10. package/lib/sellable-agent/profile-materializer.mjs +2 -2
  11. package/lib/sellable-agent/provisioning-adapter.mjs +2 -2
  12. package/package.json +1 -1
package/container/Dockerfile CHANGED
@@ -3,13 +3,13 @@ FROM ${HERMES_IMAGE}
3
3
 
4
4
  USER root
5
5
 
6
- ARG INSTALLER_PACKAGE=@sellable/install@0.1.639-wip.agent-browser.20260813.2
7
- ARG MCP_PACKAGE=@sellable/mcp@0.1.867
6
+ ARG INSTALLER_PACKAGE=@sellable/install@0.1.641
7
+ ARG MCP_PACKAGE=@sellable/mcp@0.1.879
8
8
  ARG INSTALLER_INTEGRITY
9
- ARG MCP_INTEGRITY=sha512-8acJ5MfqgXiu9ylK65LlQ7LUBN5GN5fEXOwDTArxYAN7nBvVLhdz0nTGMERc6qCFNBbILTKvo4IErJOnAcJTDA==
9
+ ARG MCP_INTEGRITY=sha512-dmrjCHuxLqR35HYvwXBQZoNMfCpT/wIWcvkT47cbYcWjL3pvxmxJWJBHFIZetgfQWM0pCAa+zKKAWyuxtAtz+w==
10
10
 
11
- RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.639-wip.agent-browser.20260813.2" \
12
- && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.867" \
11
+ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.641" \
12
+ && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.879" \
13
13
  && test -n "${INSTALLER_INTEGRITY}" \
14
14
  && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
15
15
  && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.639-wip.agent-browser.2
23
23
  && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
24
24
  && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
25
25
  && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
26
- && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.639-wip.agent-browser.20260813.2' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.867') throw new Error('package identity rejected');" \
26
+ && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.641' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.879') throw new Error('package identity rejected');" \
27
27
  && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
28
- && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.639-wip.agent-browser.20260813.2', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.867', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
28
+ && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.641', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.879', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
29
29
  && npm cache clean --force
30
30
 
31
31
  COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
package/container/README.md CHANGED
@@ -3,7 +3,7 @@
3
3
  This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
4
4
 
5
5
  Build from this directory after
6
- `@sellable/install@0.1.639-wip.agent-browser.20260813.2` is
6
+ `@sellable/install@0.1.641` is
7
7
  published:
8
8
 
9
9
  ```sh
package/lib/sellable-agent/external-runtime-builder.mjs CHANGED
@@ -28,7 +28,7 @@ import {
28
28
 
29
29
  const MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
30
30
  const MCP_PACKAGE = "@sellable/mcp";
31
- const MCP_VERSION = "0.1.867";
31
+ const MCP_VERSION = "0.1.879";
32
32
  const SAFE_COMPONENT = /^[A-Za-z0-9@._+-]+$/;
33
33
  const HERMES_EXCLUDES = new Set([".git", ".playwright", "node_modules"]);
34
34
 
package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs CHANGED
@@ -1838,6 +1838,7 @@ function clearRuntimeSecrets() {
1838
1838
 
1839
1839
  function adminAgentServiceEnvironment(claim) {
1840
1840
  const operation = claim?.operation;
1841
+ const adminGeneration = claim?.adminRuntimeGeneration;
1841
1842
  const service = claim?.runtimeContract?.service;
1842
1843
  const bindings = claim?.runtimeContract?.slack?.selectedBindings;
1843
1844
  const toolInclude = service?.toolInclude;
@@ -1846,9 +1847,11 @@ function adminAgentServiceEnvironment(claim) {
1846
1847
  // operation.adminRuntimeGenerationId and binds it to this workspace/agent.
1847
1848
  if (
1848
1849
  claim?.agentKind !== "ADMIN" ||
1849
- claim?.adminRuntimeGeneration?.agentKind !== "ADMIN" ||
1850
- claim.adminRuntimeGeneration.workspaceId !== operation?.workspaceId ||
1851
- claim.adminRuntimeGeneration.agentId !== operation?.agentId ||
1850
+ adminGeneration?.agentKind !== "ADMIN" ||
1851
+ adminGeneration.workspaceId !== operation?.workspaceId ||
1852
+ adminGeneration.agentId !== operation?.agentId ||
1853
+ !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(adminGeneration.id ?? "") ||
1854
+ !/^[1-9][0-9]{0,19}$/.test(String(adminGeneration.fence ?? "")) ||
1852
1855
  !operation ||
1853
1856
  !service ||
1854
1857
  !/^[A-Za-z0-9_-]{1,128}$/.test(service.principalId ?? "") ||
@@ -1883,6 +1886,10 @@ function adminAgentServiceEnvironment(claim) {
1883
1886
  // customer profile while the signed Agent service context remains the home
1884
1887
  // workspace authority.
1885
1888
  SELLABLE_AGENT_SERVER_AUTHENTICATED_KIND: "ADMIN",
1889
+ SELLABLE_AGENT_ADMIN_GENERATION_ID: claim.adminRuntimeGeneration.id,
1890
+ SELLABLE_AGENT_ADMIN_GENERATION_FENCE: String(
1891
+ claim.adminRuntimeGeneration.fence
1892
+ ),
1886
1893
  });
1887
1894
  }
1888
1895
 
@@ -2866,10 +2873,11 @@ export async function runAdminCanary() {
2866
2873
  const canaryClaim = {
2867
2874
  agentKind: "ADMIN",
2868
2875
  adminRuntimeGeneration: {
2876
+ id: "admin-generation-phase158-canary",
2869
2877
  agentKind: "ADMIN",
2870
2878
  workspaceId: fixtureWorkspaceId,
2871
2879
  agentId: fixtureAgentId,
2872
- fence: "phase158-canary-generation-fence-a",
2880
+ fence: "7",
2873
2881
  },
2874
2882
  operation: {
2875
2883
  workspaceId: fixtureWorkspaceId,
package/lib/sellable-agent/fly-customer-image/Dockerfile CHANGED
@@ -6,9 +6,9 @@ USER root
6
6
 
7
7
  ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
8
8
 
9
- ARG MCP_PACKAGE=@sellable/mcp@0.1.867
10
- ARG MCP_INTEGRITY=sha512-8acJ5MfqgXiu9ylK65LlQ7LUBN5GN5fEXOwDTArxYAN7nBvVLhdz0nTGMERc6qCFNBbILTKvo4IErJOnAcJTDA==
11
- ARG INSTALLER_PACKAGE=@sellable/install@0.1.639-wip.agent-browser.20260813.2
9
+ ARG MCP_PACKAGE=@sellable/mcp@0.1.879
10
+ ARG MCP_INTEGRITY=sha512-dmrjCHuxLqR35HYvwXBQZoNMfCpT/wIWcvkT47cbYcWjL3pvxmxJWJBHFIZetgfQWM0pCAa+zKKAWyuxtAtz+w==
11
+ ARG INSTALLER_PACKAGE=@sellable/install@0.1.641
12
12
  ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.186-wip.phase158.20260802034727
13
13
  ARG ADMIN_MCP_INTEGRITY=sha512-qYNew5wd2IfgVcp1UYOG9QvpF/8Mx19YJ5HQtMKzvSfUf3evePjtaKsoXLf2C/GUJ5QlLlHJo84VWOI3V01+9A==
14
14
  ARG TUS_JS_CLIENT_VERSION=4.3.1
package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs CHANGED
@@ -99,9 +99,9 @@ const BOOT_SESSION_ID = randomUUID();
99
99
  const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.20.0";
100
100
  const INSTALLER_PACKAGE =
101
101
  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ??
102
- "@sellable/install@0.1.639-wip.agent-browser.20260813.2";
102
+ "@sellable/install@0.1.641";
103
103
  const MCP_PACKAGE =
104
- process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.867";
104
+ process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.879";
105
105
 
106
106
  const sha256 = (value) => createHash("sha256").update(value).digest("hex");
107
107
  const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
package/lib/sellable-agent/hermes-memory-snapshot.mjs CHANGED
@@ -91,7 +91,15 @@ const MAX_BYTES = 128 * 1024 * 1024;
91
91
  // Slack gateway for a full ten minutes.
92
92
  const NATIVE_COMMAND_TIMEOUT_MS = 120_000;
93
93
  const TRANSIENT_PROFILE_ROOTS = new Set([".artifact-venv", ".cache"]);
94
- const TRANSIENT_PROFILE_PATHS = new Set([".sellable-admin/.venvs"]);
94
+ const TRANSIENT_PROFILE_PATHS = new Set([
95
+ ".sellable-admin/.venvs",
96
+ // PulseAudio records its per-boot server socket as a link into /tmp. It is
97
+ // process-local runtime state, not portable Hermes memory; carrying it into
98
+ // a replacement Machine would both be stale and violate the closed symlink
99
+ // fence. Skip only Pulse's bounded config subtree while every other profile
100
+ // symlink remains rejected below.
101
+ ".config/pulse",
102
+ ]);
95
103
  // The encrypted Fly volume remains the authoritative full profile. The
96
104
  // portable disaster-recovery archive also carries state.db and sessions so a
97
105
  // replacement volume retains chat history and Slack thread routing. Caches,
package/lib/sellable-agent/host-bootstrap.mjs CHANGED
@@ -38,8 +38,8 @@ import { installAgentHostServices } from "./service-installer.mjs";
38
38
  const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
39
39
  const VERSION = "sellable-agent-host-bootstrap/v1";
40
40
  const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
41
- const INSTALLER_PACKAGE = "@sellable/install@0.1.639-wip.agent-browser.20260813.2";
42
- const MCP_PACKAGE = "@sellable/mcp@0.1.867";
41
+ const INSTALLER_PACKAGE = "@sellable/install@0.1.641";
42
+ const MCP_PACKAGE = "@sellable/mcp@0.1.879";
43
43
  const HERMES_VERSION = "0.18.0";
44
44
  const SHA256 = /^[a-f0-9]{64}$/;
45
45
  const SHA256_16 = /^[a-f0-9]{16}$/;
package/lib/sellable-agent/host-worker.mjs CHANGED
@@ -1547,8 +1547,8 @@ export function compileClaimToProfileDesired(activeClaim, config) {
1547
1547
  pinned.hermesCli !== "hermes" ||
1548
1548
  pinned.hermesVersion !== "0.18.0" ||
1549
1549
  pinned.installerPackage !==
1550
- "@sellable/install@0.1.639-wip.agent-browser.20260813.2" ||
1551
- pinned.mcpPackage !== "@sellable/mcp@0.1.867" ||
1550
+ "@sellable/install@0.1.641" ||
1551
+ pinned.mcpPackage !== "@sellable/mcp@0.1.879" ||
1552
1552
  !Array.isArray(policy.toolInclude) ||
1553
1553
  policy.toolInclude.length === 0 ||
1554
1554
  !Number.isSafeInteger(slack.generation) ||
package/lib/sellable-agent/profile-materializer.mjs CHANGED
@@ -283,8 +283,8 @@ function validateDesired(desired) {
283
283
  desired.hermesCli !== "hermes" ||
284
284
  desired.hermesVersion !== "0.18.0" ||
285
285
  desired.installerPackage !==
286
- "@sellable/install@0.1.639-wip.agent-browser.20260813.2" ||
287
- desired.mcpPackage !== "@sellable/mcp@0.1.867" ||
286
+ "@sellable/install@0.1.641" ||
287
+ desired.mcpPackage !== "@sellable/mcp@0.1.879" ||
288
288
  !Array.isArray(desired.toolInclude) ||
289
289
  desired.toolInclude.length === 0 ||
290
290
  desired.toolInclude.some((tool) => !/^[a-z][a-z0-9_]{0,127}$/.test(tool)) ||
package/lib/sellable-agent/provisioning-adapter.mjs CHANGED
@@ -26,8 +26,8 @@ import { deriveContainedProfileId } from "./profile-materializer.mjs";
26
26
 
27
27
  export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
28
28
  export const PINNED_INSTALL_PACKAGE =
29
- "@sellable/install@0.1.639-wip.agent-browser.20260813.2";
30
- export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.867";
29
+ "@sellable/install@0.1.641";
30
+ export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.879";
31
31
  const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
32
32
  PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1
33
33
  );
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sellable/install",
3
- "version": "0.1.639-wip.agent-browser.20260813.2",
3
+ "version": "0.1.641",
4
4
  "type": "module",
5
5
  "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
6
6
  "bin": {