@sellable/install 0.1.695 → 0.1.696

package/lib/sellable-agent/mcp-context-proxy.mjs

@@ -651,6 +651,10 @@ export function mcpEndpointSessionActivated(session) {
   return endpointSessions.get(session)?.activated === true;
 }
 
+function endpointSessionBody(session) {
+  return endpointSessions.get(session)?.body ?? null;
+}
+
 function endpointSessionBodyMatches(left, right) {
   return ENDPOINT_EXPECTED_KEYS.every(
     (key) => stableJson(left[key]) === stableJson(right[key])
@@ -943,6 +947,22 @@ function isHermesSlackToolCall(request) {
   );
 }
 
+function endpointHermesSessionId(body) {
+  if (body?.schemaVersion !== "sellable-agent-mcp-endpoint-run/v1") return null;
+  return `sellable_endpoint_${sha256(
+    `${body.conversationId}:${body.runId}:${body.attemptId}`
+  ).slice(0, 32)}`;
+}
+
+function isExactEndpointHermesSessionToolCall(request, body) {
+  if (!isHermesSlackToolCall(request)) return false;
+  const expectedSessionId = endpointHermesSessionId(body);
+  return Boolean(
+    expectedSessionId &&
+      request.params._meta.sellableAgent.sessionId === expectedSessionId
+  );
+}
+
 function messageIdKey(id) {
   return id === undefined ? null : stableJson(id);
 }
@@ -1064,25 +1084,39 @@ export async function runMcpContextProxyStdio({
   for await (const line of inputLines) {
     const request = parseJsonRpcLine(line);
     if (!request) throw new Error("mcp_upstream_protocol_rejected");
-    // The patched Hermes bridge adds this exact request-scoped shape from its
-    // live Slack session ContextVar; the model controls only `arguments` and
-    // cannot author MCP `_meta`. Route that call directly even when this shared
-    // stdio transport previously served an endpoint run. The downstream
-    // credential boundary still verifies the Slack actor against the runtime's
-    // service principal and workspace identity. Endpoint calls carry no such
-    // metadata and remain descriptor-authorized below. Any metadata that does
-    // reach endpoint authorization is overwritten by the signed descriptor.
-    if (isHermesSlackToolCall(request)) {
-      await writeJsonLine(child.stdin, request);
-      continue;
-    }
     const candidate = existsSync(descriptorPath)
       ? descriptorCandidate(descriptorPath, descriptorRoot)
       : null;
+    const activeBody = endpointSessionBody(endpointSession);
+    const endpointBody =
+      candidate?.body?.schemaVersion === "sellable-agent-mcp-endpoint-run/v1"
+        ? candidate.body
+        : activeBody?.schemaVersion === "sellable-agent-mcp-endpoint-run/v1"
+          ? activeBody
+          : null;
     const endpointMode = Boolean(
-      mcpEndpointSessionActivated(endpointSession) ||
-        candidate?.body?.schemaVersion === "sellable-agent-mcp-endpoint-run/v1"
+      mcpEndpointSessionActivated(endpointSession) || endpointBody
     );
+    // The patched Hermes bridge adds this exact request-scoped shape from its
+    // live Slack session ContextVar; the model controls only `arguments` and
+    // cannot author MCP `_meta`. Route genuine Slack calls directly even when
+    // this shared stdio transport previously served an endpoint run. Hermes
+    // also reuses its Slack-shaped ContextVar for endpoint calls, but gives
+    // those calls the exact deterministic endpoint session id. Recover that
+    // reserved shape through the signed endpoint authorization below so stale
+    // Slack context cannot bypass the endpoint receipt path. Any unverified
+    // descriptor can only select that fail-closed path; it is still validated
+    // before its metadata reaches the downstream process.
+    if (
+      isHermesSlackToolCall(request) &&
+      !(
+        endpointMode &&
+        isExactEndpointHermesSessionToolCall(request, endpointBody)
+      )
+    ) {
+      await writeJsonLine(child.stdin, request);
+      continue;
+    }
     if (request.method === "tools/list" && endpointMode) {
       const expected = existsSync(descriptorPath)
         ? deriveExpectedMcpTurnBinding({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.695",
+  "version": "0.1.696",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {