@sellable/install 0.1.793 → 0.1.794

package/container/Dockerfile

@@ -3,12 +3,12 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.793
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.794
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG INSTALLER_INTEGRITY
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.793" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.794" \
     && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.957" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
@@ -23,9 +23,9 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.793" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.793' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.794' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.957') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.793', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.794', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.957', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint

package/container/README.md

@@ -3,7 +3,7 @@
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
 Build from this directory after
-`@sellable/install@0.1.793` is
+`@sellable/install@0.1.794` is
 published:
 
 ```sh

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -8,7 +8,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 
 ARG MCP_PACKAGE=@sellable/mcp@0.1.957
 ARG MCP_INTEGRITY=sha512-tIZuO5IEanT/afamDIWdorUNMdqZA6xnjL9jGAmGqYIlIqkXdHB9slWiwfLfmM44iEp7OT98IBHJlvbpMThk6A==
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.793
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.794
 ARG ADMIN_MCP_PACKAGE=@sellable/admin-mcp@0.1.202
 ARG ADMIN_MCP_INTEGRITY=sha512-ym3aye/0vQ8tfULJlKz9JFOxvIQsl1G+n3np+TTgK/tecwNblBo/j3AkTnRqH9iomKzPbZzP+n4tEQsvsU8ByA==
 ARG TUS_JS_CLIENT_VERSION=4.3.1

package/lib/sellable-agent/fly-customer-image/customer-runtime.mjs

@@ -126,7 +126,7 @@ const RUNTIME_GENERATION = Number(
 const BOOT_SESSION_ID = randomUUID();
 const HERMES_VERSION = process.env.SELLABLE_AGENT_HERMES_VERSION ?? "0.21.5";
 const INSTALLER_PACKAGE =
-  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.793";
+  process.env.SELLABLE_AGENT_INSTALLER_PACKAGE ?? "@sellable/install@0.1.794";
 const MCP_PACKAGE =
   process.env.SELLABLE_AGENT_MCP_PACKAGE ?? "@sellable/mcp@0.1.957";
 export const ENDPOINT_MAX_CONCURRENT_RUNS = 10;
@@ -1396,6 +1396,25 @@ export function endpointProductProjection(productExecution, output) {
 
 export function endpointOpenerOutputContract(claim) {
   if (!usesOpenerDraftStrategy(claim)) return undefined;
+  return openerOutputContractFor(claim);
+}
+
+// A single-run opener on a caller-named model (Opus on OpenRouter) is held to
+// the same strict schema, which the bridge sends as the provider's json_schema
+// so the model cannot return malformed JSON. The machine's default model has
+// no strict transport, so it gets no contract.
+export function endpointStrictOutputContract(claim, modelSelection) {
+  if (
+    !modelSelection ||
+    usesOpenerDraftStrategy(claim) ||
+    claim?.run?.productExecution?.workKind !== "OPENER" ||
+    !claim.run.productExecution.providerOutputSchema
+  )
+    return undefined;
+  return openerOutputContractFor(claim);
+}
+
+function openerOutputContractFor(claim) {
   const execution = claim.run.productExecution;
   if (
     execution.nativeProposalSchemaVersion !==
@@ -2155,6 +2174,12 @@ export function createCustomerEndpointRelay(options = {}) {
         correlation: `${claim.attempt.conversationId}:${claim.attempt.runId}:${claim.attempt.id}`,
         ...(modelSelection ? { modelSelection } : {}),
       };
+      const strictOutputContract = endpointStrictOutputContract(
+        claim,
+        modelSelection
+      );
+      if (strictOutputContract)
+        submitRequest.outputContract = strictOutputContract;
       while (!submitted) {
         try {
           submitted = await runs.submit(submitRequest, {

package/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs

@@ -271,7 +271,8 @@ function compileCreateBody(input, openerStage = false) {
     "input",
     "instructions",
     "correlation",
-    ...(openerStage ? ["outputContract"] : ["modelSelection"]),
+    "outputContract",
+    ...(openerStage ? [] : ["modelSelection"]),
   ];
   if (Object.keys(input).some((key) => !allowed.includes(key))) {
     throw new Error("hermes_runs_submit_rejected");
@@ -297,6 +298,24 @@ function compileCreateBody(input, openerStage = false) {
     input.modelSelection === undefined
       ? null
       : validateEndpointModelSelection(input.modelSelection);
+  // A per-run model's opener is held to the strict output contract by its
+  // provider (the bridge sends it as OpenRouter json_schema). Outside opener
+  // stages the contract only travels with an allowlisted model selection.
+  if (!openerStage && input.outputContract !== undefined && !modelSelection) {
+    throw new Error("hermes_runs_submit_rejected");
+  }
+  const outputContract =
+    input.outputContract === undefined
+      ? null
+      : validateOpenerOutputContract(input.outputContract);
+  const modelOptions = {
+    ...(modelSelection === null
+      ? {}
+      : { reasoning_effort: modelSelection.reasoningEffort }),
+    ...(outputContract === null
+      ? {}
+      : { sellable_opener_output_contract: outputContract }),
+  };
   return Object.freeze({
     input: compiledInput,
     instructions,
@@ -306,20 +325,10 @@ function compileCreateBody(input, openerStage = false) {
     // resolves the provider's credential from the machine's own pool.
     ...(modelSelection === null
       ? {}
-      : {
-          provider: modelSelection.provider,
-          model: modelSelection.model,
-          model_options: { reasoning_effort: modelSelection.reasoningEffort },
-        }),
-    ...(input.outputContract === undefined
+      : { provider: modelSelection.provider, model: modelSelection.model }),
+    ...(Object.keys(modelOptions).length === 0
       ? {}
-      : {
-          model_options: {
-            sellable_opener_output_contract: validateOpenerOutputContract(
-              input.outputContract
-            ),
-          },
-        }),
+      : { model_options: modelOptions }),
   });
 }
 
@@ -910,6 +919,29 @@ const SESSION_PAGE_SIZE = 200;
 const SESSION_RETENTION_MAX_DELETES = 1_000;
 const SESSION_RETENTION_INTERVAL_MS = 24 * 60 * 60 * 1000;
 const SESSION_RETENTION_RETRY_MS = 60 * 60 * 1000;
+// A runtime that just started is still bringing its gateway up; the first pass
+// waits so it does not fail against an API that is not serving yet.
+const SESSION_RETENTION_START_DELAY_MS = 10 * 60 * 1000;
+
+// A bounded reason for the operator log; never a raw error message.
+function sessionRetentionFailureReason(error) {
+  const message = String(error?.message ?? "");
+  const http =
+    /^hermes_session_retention_(list|delete)_http_([1-5][0-9]{2})$/.exec(
+      message
+    );
+  if (http) return `${http[1]}_http_${http[2]}`;
+  if (
+    message === "hermes_runs_api_key_file_rejected" ||
+    error?.code === "ENOENT"
+  ) {
+    return "key_rejected";
+  }
+  if (error?.name === "TimeoutError" || error?.name === "AbortError") {
+    return "timeout";
+  }
+  return "request_failed";
+}
 
 function sessionLastActiveSeconds(session) {
   return Math.max(
@@ -949,7 +981,11 @@ export async function pruneHermesAutomationSessions({
         "GET",
         `/api/sessions?source=${source}&limit=${SESSION_PAGE_SIZE}&offset=${offset}`
       );
-      if (!response.ok) throw new Error("hermes_session_retention_list_failed");
+      if (!response.ok) {
+        throw new Error(
+          `hermes_session_retention_list_http_${response.status}`
+        );
+      }
       const page = await response.json();
       const rows = Array.isArray(page?.data) ? page.data : [];
       for (const session of rows) {
@@ -973,7 +1009,9 @@ export async function pruneHermesAutomationSessions({
     );
     if (response.ok) deleted += 1;
     else if (response.status !== 404) {
-      throw new Error("hermes_session_retention_delete_failed");
+      throw new Error(
+        `hermes_session_retention_delete_http_${response.status}`
+      );
     }
   }
   return {
@@ -1011,12 +1049,15 @@ export function createHermesSessionRetention({
   fetchImpl = fetch,
   now = () => Date.now(),
   maxDeletes = SESSION_RETENTION_MAX_DELETES,
+  startDelayMs = SESSION_RETENTION_START_DELAY_MS,
   log = (entry) => process.stderr.write(`${JSON.stringify(entry)}\n`),
 } = {}) {
   let running = null;
+  const startedAt = now();
   return {
     tick({ apiKeyFile, statePath }) {
       if (running) return running;
+      if (now() < startedAt + startDelayMs) return null;
       if (now() < readRetentionNextRunAt(statePath)) return null;
       running = (async () => {
         let nextRunAt;
@@ -1038,8 +1079,12 @@ export function createHermesSessionRetention({
             (result.remaining > 0
               ? SESSION_RETENTION_RETRY_MS
               : SESSION_RETENTION_INTERVAL_MS);
-        } catch {
-          log({ ok: false, code: "hermes_session_retention_failed" });
+        } catch (error) {
+          log({
+            ok: false,
+            code: "hermes_session_retention_failed",
+            reason: sessionRetentionFailureReason(error),
+          });
           nextRunAt = now() + SESSION_RETENTION_RETRY_MS;
         }
         try {

package/lib/sellable-agent/hermes-bridge.mjs

@@ -1244,13 +1244,16 @@ def _sellable_opener_output_format(model_options):
         reject()
     return {"type": "json_schema", "name": "sellable_opener_proposal", "strict": True, "schema": schema}
 
+def _sellable_opener_json_schema(output_format):
+    # Chat-completions spelling of the same strict format (OpenRouter response_format).
+    return {"type": "json_schema", "json_schema": {"name": output_format["name"], "strict": True, "schema": output_format["schema"]}}
+
 def _sellable_opener_stage_kwargs(session_id, agent_kwargs, model_options=None):
     import os
     import re
-    stage = (
-        os.getenv("SELLABLE_AGENT_RUNTIME", "") == "1"
-        and re.fullmatch(r"sellable_opener_stage_[a-f0-9]{32}", str(session_id or "")) is not None
-    )
+    runtime = os.getenv("SELLABLE_AGENT_RUNTIME", "") == "1"
+    stage = runtime and re.fullmatch(r"sellable_opener_stage_[a-f0-9]{32}", str(session_id or "")) is not None
+    endpoint = runtime and re.fullmatch(r"sellable_endpoint_[a-f0-9]{32}", str(session_id or "")) is not None
     if stage:
         agent_kwargs.update(
             enabled_toolsets=[], skip_memory=True, skip_background_review=True,
@@ -1265,6 +1268,17 @@ def _sellable_opener_stage_kwargs(session_id, agent_kwargs, model_options=None):
             extra_body["text"] = {"format": output_format}
             overrides["extra_body"] = extra_body
             agent_kwargs.update(request_overrides=overrides, fallback_model=None)
+    elif endpoint and _sellable_opener_output_format(model_options) is not None:
+        # A per-run model's endpoint session keeps its tools; only its output
+        # is held to the strict schema, routed to providers that enforce it.
+        output_format = _sellable_opener_output_format(model_options)
+        overrides = dict(agent_kwargs.get("request_overrides") or {})
+        extra_body = dict(overrides.get("extra_body") or {})
+        if "text" in overrides or "text" in extra_body or "response_format" in overrides or "response_format" in extra_body:
+            raise RuntimeError("sellable_opener_output_format_conflict")
+        extra_body["response_format"] = _sellable_opener_json_schema(output_format)
+        overrides["extra_body"] = extra_body
+        agent_kwargs.update(request_overrides=overrides, fallback_model=None, provider_require_parameters=True)
     elif isinstance(model_options, dict) and "sellable_opener_output_contract" in model_options:
         raise RuntimeError("sellable_opener_output_contract_session_rejected")
     return stage
@@ -1272,20 +1286,27 @@ def _sellable_opener_stage_kwargs(session_id, agent_kwargs, model_options=None):
 def _sellable_assert_opener_stage_tools(stage, agent, model_options=None):
     if stage and (agent.tools or agent.valid_tool_names):
         raise RuntimeError("sellable_opener_stage_tools_not_empty")
-    output_format = _sellable_opener_output_format(model_options) if stage else None
+    output_format = _sellable_opener_output_format(model_options)
     if output_format is None:
         return
-    if agent.api_mode != "codex_responses" or agent.provider != "openai-codex" or agent._fallback_chain:
-        raise RuntimeError("sellable_opener_output_format_unsupported")
     import copy
-    expected_format = copy.deepcopy(output_format)
+    if stage:
+        if agent.api_mode != "codex_responses" or agent.provider != "openai-codex" or agent._fallback_chain:
+            raise RuntimeError("sellable_opener_output_format_unsupported")
+        expected_key, expected_value = "text", {"format": copy.deepcopy(output_format)}
+    else:
+        if agent.api_mode != "chat_completions" or agent.provider != "openrouter" or agent._fallback_chain:
+            raise RuntimeError("sellable_opener_output_format_unsupported")
+        expected_key, expected_value = "response_format", _sellable_opener_json_schema(copy.deepcopy(output_format))
     selected = (agent.model, agent.provider, agent.api_mode)
     build_api_kwargs = agent._build_api_kwargs
     def strict_build_api_kwargs(*args, **kwargs):
         built = build_api_kwargs(*args, **kwargs)
+        extra_body = built.get("extra_body") or {}
         if (
             (agent.model, agent.provider, agent.api_mode) != selected or agent._fallback_chain
-            or (built.get("extra_body") or {}).get("text") != {"format": expected_format}
+            or extra_body.get(expected_key) != expected_value
+            or (not stage and (extra_body.get("provider") or {}).get("require_parameters") is not True)
         ):
             raise RuntimeError("sellable_opener_output_format_not_enforced")
         return built
@@ -2033,11 +2054,11 @@ def getenv(name, default=""):
           "    prerun_script = None",
           '    script_path = job.get("script")',
           "    if (",
-          "        str(job.get(\"name\") or \"\") in _SELLABLE_MANAGED_CUSTOMER_PROGRAM_JOBS",
+          '        str(job.get("name") or "") in _SELLABLE_MANAGED_CUSTOMER_PROGRAM_JOBS',
           "        and not script_path",
           "    ):",
           "        return _sellable_agent_managed_gate_block(",
-          "            job_id, job_name, \"managed wake gate script is missing\"",
+          '            job_id, job_name, "managed wake gate script is missing"',
           "        )",
           "    if script_path:",
         ].join("\n"),
@@ -2065,9 +2086,9 @@ def getenv(name, default=""):
             "                cancel_event=cancel_event,",
             "            )",
             "        except Exception as _managed_launch_exc:",
-            "            if str(job.get(\"name\") or \"\") in _SELLABLE_MANAGED_CUSTOMER_PROGRAM_JOBS:",
+            '            if str(job.get("name") or "") in _SELLABLE_MANAGED_CUSTOMER_PROGRAM_JOBS:',
             "                return _sellable_agent_managed_gate_block(",
-            "                    job_id, job_name, f\"managed wake gate could not start: {_managed_launch_exc}\"",
+            '                    job_id, job_name, f"managed wake gate could not start: {_managed_launch_exc}"',
             "                )",
             "            raise",
           ].join("\n"),
@@ -2082,9 +2103,9 @@ def getenv(name, default=""):
             "        try:",
             "            prerun_script = _run_job_script_with_claim_heartbeat(job, script_path, cancel_event=cancel_event)",
             "        except Exception as _managed_launch_exc:",
-            "            if str(job.get(\"name\") or \"\") in _SELLABLE_MANAGED_CUSTOMER_PROGRAM_JOBS:",
+            '            if str(job.get("name") or "") in _SELLABLE_MANAGED_CUSTOMER_PROGRAM_JOBS:',
             "                return _sellable_agent_managed_gate_block(",
-            "                    job_id, job_name, f\"managed wake gate could not start: {_managed_launch_exc}\"",
+            '                    job_id, job_name, f"managed wake gate could not start: {_managed_launch_exc}"',
             "                )",
             "            raise",
           ].join("\n"),
@@ -2542,231 +2563,298 @@ export const HERMES_AGENT_BRIDGE_DEDICATED_V020_CONTRACT = normalizeContract({
 });
 
 export const HERMES_AGENT_BRIDGE_DEDICATED_V021_CONTRACT = normalizeContract({
-  "bridgeId": "sellable-agent-hermes-bridge/v1",
-  "hermesVersion": "0.21.1",
-  "versionFile": {
-    "path": "hermes_cli/__init__.py",
-    "sha256": "efae023ac37622277aac298ac15c646b855e870132c38970feeda9552f1ecc27"
+  bridgeId: "sellable-agent-hermes-bridge/v1",
+  hermesVersion: "0.21.1",
+  versionFile: {
+    path: "hermes_cli/__init__.py",
+    sha256: "efae023ac37622277aac298ac15c646b855e870132c38970feeda9552f1ecc27",
   },
-  "files": [
+  files: [
     {
-      "path": "gateway/platforms/api_server.py",
-      "patchKind": "api-opener-stage-v021",
-      "sourceSha256": "221589ae8c45349736bb291b4679b86e9e12cb22f5a33220ae3d22929fea8297",
-      "patchedSha256": "7f5d1093b1f384d98d61d59a6c217c363f9f81f7c1c594f8537b1566c3365596"
+      path: "gateway/platforms/api_server.py",
+      patchKind: "api-opener-stage-v021",
+      sourceSha256:
+        "221589ae8c45349736bb291b4679b86e9e12cb22f5a33220ae3d22929fea8297",
+      patchedSha256:
+        "b029a26050aa777a520ab136c203f3755b178e04af11ca6e9f810046a9eae6d4",
     },
     {
-      "path": "gateway/config_env.py",
-      "patchKind": "gateway-config-dedicated-v021",
-      "sourceSha256": "984ae7b68befecd52fc17b6d38e763f40c7040a2ba69ed4a2c39f1a88ae6734a",
-      "patchedSha256": "0180fbcb1df6e5a7651f172c492a8e317f7455c8ed0e955c7a4f0488fa23b6c2"
+      path: "gateway/config_env.py",
+      patchKind: "gateway-config-dedicated-v021",
+      sourceSha256:
+        "984ae7b68befecd52fc17b6d38e763f40c7040a2ba69ed4a2c39f1a88ae6734a",
+      patchedSha256:
+        "0180fbcb1df6e5a7651f172c492a8e317f7455c8ed0e955c7a4f0488fa23b6c2",
     },
     {
-      "path": "plugins/platforms/slack/adapter.py",
-      "patchKind": "slack-adapter-dedicated-v021",
-      "sourceSha256": "23048a107304993686250af044256199be2f73171bb5b4cca6a900ea272a6064",
-      "patchedSha256": "bc05fd5f227e42f733ee78c80ffab6c7c53840975fc5bc9755aa2ef8f2c8ff47"
+      path: "plugins/platforms/slack/adapter.py",
+      patchKind: "slack-adapter-dedicated-v021",
+      sourceSha256:
+        "23048a107304993686250af044256199be2f73171bb5b4cca6a900ea272a6064",
+      patchedSha256:
+        "bc05fd5f227e42f733ee78c80ffab6c7c53840975fc5bc9755aa2ef8f2c8ff47",
     },
     {
-      "path": "tools/mcp_tool_handlers.py",
-      "patchKind": "mcp-tool-endpoint-v021",
-      "sourceSha256": "e6af250f0fbfeb12a936c340a46f40f8d40332ed8bbc4eb63fded66e37aaa7bf",
-      "patchedSha256": "6c4765aad3074b6f8ad6951299edafa36cf536c9a9f0b57a48bdd541e3209790"
+      path: "tools/mcp_tool_handlers.py",
+      patchKind: "mcp-tool-endpoint-v021",
+      sourceSha256:
+        "e6af250f0fbfeb12a936c340a46f40f8d40332ed8bbc4eb63fded66e37aaa7bf",
+      patchedSha256:
+        "6c4765aad3074b6f8ad6951299edafa36cf536c9a9f0b57a48bdd541e3209790",
     },
     {
-      "path": "gateway/run.py",
-      "patchKind": "gateway-session-v021",
-      "sourceSha256": "3b1f670243d4932ac1f2a2a68bee61a8c7f9bcdac7bd48d43289db90f17bab67",
-      "patchedSha256": "2e25d50add6c49748b2cdd4c2bd115039e72c0b4eeb9c882eb1cd07a2a25c304"
+      path: "gateway/run.py",
+      patchKind: "gateway-session-v021",
+      sourceSha256:
+        "3b1f670243d4932ac1f2a2a68bee61a8c7f9bcdac7bd48d43289db90f17bab67",
+      patchedSha256:
+        "2e25d50add6c49748b2cdd4c2bd115039e72c0b4eeb9c882eb1cd07a2a25c304",
     },
     {
-      "path": "gateway/run_turn_runner.py",
-      "patchKind": "gateway-provider-preflight-v021",
-      "sourceSha256": "8ebd74318db2259ac52c35dbf9568b98dbb19c1d2e30289f4efc76a12ac8ceeb",
-      "patchedSha256": "26a13f167835036c37ff92da3c1d036267544cf8a6529f5d40c3ee0ae58fa1cb"
+      path: "gateway/run_turn_runner.py",
+      patchKind: "gateway-provider-preflight-v021",
+      sourceSha256:
+        "8ebd74318db2259ac52c35dbf9568b98dbb19c1d2e30289f4efc76a12ac8ceeb",
+      patchedSha256:
+        "26a13f167835036c37ff92da3c1d036267544cf8a6529f5d40c3ee0ae58fa1cb",
     },
     {
-      "path": "agent/turn_context.py",
-      "patchKind": "turn-context-v021",
-      "sourceSha256": "d1a84a24c5b50a7a866268fde453694c6b98790e31d7d4310d8756027149863a",
-      "patchedSha256": "13517e034866224c072a860dbd9fbb7eb25c9d3cb86a1f59ae3a2e5ec1cef7ad"
+      path: "agent/turn_context.py",
+      patchKind: "turn-context-v021",
+      sourceSha256:
+        "d1a84a24c5b50a7a866268fde453694c6b98790e31d7d4310d8756027149863a",
+      patchedSha256:
+        "13517e034866224c072a860dbd9fbb7eb25c9d3cb86a1f59ae3a2e5ec1cef7ad",
     },
     {
-      "path": "cron/scheduler.py",
-      "patchKind": "cron-scheduler-v020",
-      "sourceSha256": "f1891e94697ccf5f7b66ae7788345368b452af447fbc43356ae5376a3c753518",
-      "patchedSha256": "03d0848e584b7cbc5b126e0fae989dbd5d3d83ccee3ad989c08ffc8f8ef423b9"
+      path: "cron/scheduler.py",
+      patchKind: "cron-scheduler-v020",
+      sourceSha256:
+        "f1891e94697ccf5f7b66ae7788345368b452af447fbc43356ae5376a3c753518",
+      patchedSha256:
+        "03d0848e584b7cbc5b126e0fae989dbd5d3d83ccee3ad989c08ffc8f8ef423b9",
     },
     {
-      "path": "tools/skills_tool.py",
-      "patchKind": "skills-cache-freshness-v021",
-      "sourceSha256": "0f205b8c2d9266d272d8c6cae3d189b86a5aebce98f03b61605d266b65f9497c",
-      "patchedSha256": "8696b37ef58c0cc570c437abac730ac0e670e44365ddeae452ad40a501f13a1b"
+      path: "tools/skills_tool.py",
+      patchKind: "skills-cache-freshness-v021",
+      sourceSha256:
+        "0f205b8c2d9266d272d8c6cae3d189b86a5aebce98f03b61605d266b65f9497c",
+      patchedSha256:
+        "8696b37ef58c0cc570c437abac730ac0e670e44365ddeae452ad40a501f13a1b",
     },
     {
-      "path": "agent/prompt_builder.py",
-      "patchKind": "skills-prompt-freshness-v021",
-      "sourceSha256": "83160fab72772012bc308bc730a0085e7acb126f1bea49d62f990505f00ce677",
-      "patchedSha256": "6ab2aa30e06b124333d28ed73fc7b56394fbc71f040f3387f6fbc835d799f266"
-    }
+      path: "agent/prompt_builder.py",
+      patchKind: "skills-prompt-freshness-v021",
+      sourceSha256:
+        "83160fab72772012bc308bc730a0085e7acb126f1bea49d62f990505f00ce677",
+      patchedSha256:
+        "6ab2aa30e06b124333d28ed73fc7b56394fbc71f040f3387f6fbc835d799f266",
+    },
   ],
-  "contractDigest": "a8520b6decd64b43de1074005c8eda2d9be4a451f0f9a43b1777659acd5a86b6"
+  contractDigest:
+    "a8520b6decd64b43de1074005c8eda2d9be4a451f0f9a43b1777659acd5a86b6",
 });
 
 export const HERMES_AGENT_BRIDGE_DEDICATED_V0213_CONTRACT = normalizeContract({
-  "bridgeId": "sellable-agent-hermes-bridge/v1",
-  "hermesVersion": "0.21.3",
-  "versionFile": {
-    "path": "hermes_cli/__init__.py",
-    "sha256": "0d78a58a9f27f32adfdac959e89767cecde93a424bcfbd39d64fb95f6cf13e6c"
+  bridgeId: "sellable-agent-hermes-bridge/v1",
+  hermesVersion: "0.21.3",
+  versionFile: {
+    path: "hermes_cli/__init__.py",
+    sha256: "0d78a58a9f27f32adfdac959e89767cecde93a424bcfbd39d64fb95f6cf13e6c",
   },
-  "files": [
+  files: [
     {
-      "path": "gateway/config_env.py",
-      "patchKind": "gateway-config-dedicated-v021",
-      "sourceSha256": "40bb1029e482ebe423a5a6ddc9175ef96f821f89e9e040b5cf62cdd7ec903e4c",
-      "patchedSha256": "c189faaa2ab7c0ea603b44eb3e6b37dcf847a83b12f603ca185f37ba0ca582fc"
+      path: "gateway/config_env.py",
+      patchKind: "gateway-config-dedicated-v021",
+      sourceSha256:
+        "40bb1029e482ebe423a5a6ddc9175ef96f821f89e9e040b5cf62cdd7ec903e4c",
+      patchedSha256:
+        "c189faaa2ab7c0ea603b44eb3e6b37dcf847a83b12f603ca185f37ba0ca582fc",
     },
     {
-      "path": "plugins/platforms/slack/adapter.py",
-      "patchKind": "slack-adapter-dedicated-v0213",
-      "sourceSha256": "12bb80dffde14eca299f6f0fa57907fbe1636519402c08dc07d96d1c144e5f83",
-      "patchedSha256": "da13c90b8a81c32b57909e5d82f9e3500d14b290cf9a38ffd6dd53e77785e038"
+      path: "plugins/platforms/slack/adapter.py",
+      patchKind: "slack-adapter-dedicated-v0213",
+      sourceSha256:
+        "12bb80dffde14eca299f6f0fa57907fbe1636519402c08dc07d96d1c144e5f83",
+      patchedSha256:
+        "da13c90b8a81c32b57909e5d82f9e3500d14b290cf9a38ffd6dd53e77785e038",
     },
     {
-      "path": "tools/mcp_tool_handlers.py",
-      "patchKind": "mcp-tool-endpoint-v021",
-      "sourceSha256": "c4713aa289c7ca17b53c0ae53ceb6a276321f6d36e259084974e8b5738b6a4dd",
-      "patchedSha256": "1bd801ebf1c6e17a0d81899b2ee0401f038ae4d1a493552f021a1b66fccf0e98"
+      path: "tools/mcp_tool_handlers.py",
+      patchKind: "mcp-tool-endpoint-v021",
+      sourceSha256:
+        "c4713aa289c7ca17b53c0ae53ceb6a276321f6d36e259084974e8b5738b6a4dd",
+      patchedSha256:
+        "1bd801ebf1c6e17a0d81899b2ee0401f038ae4d1a493552f021a1b66fccf0e98",
     },
     {
-      "path": "gateway/run.py",
-      "patchKind": "gateway-session-v021",
-      "sourceSha256": "ab619aa0dc193c6d8741f3cabc9a028c2fb7459c22262c69597b0e872091bde5",
-      "patchedSha256": "50fc00c3fa236c201d4f4e0831ec728d87ee7ad16b0865c69242304a5de65a23"
+      path: "gateway/run.py",
+      patchKind: "gateway-session-v021",
+      sourceSha256:
+        "ab619aa0dc193c6d8741f3cabc9a028c2fb7459c22262c69597b0e872091bde5",
+      patchedSha256:
+        "50fc00c3fa236c201d4f4e0831ec728d87ee7ad16b0865c69242304a5de65a23",
     },
     {
-      "path": "gateway/run_turn.py",
-      "patchKind": "gateway-first-contact-v0213",
-      "sourceSha256": "56e6fb62b60e954ef0d258c7c44ed3fca99c4aa6d2c502d8f80a1c516569f537",
-      "patchedSha256": "d66e2aecd00ebb1c6f30a1ecc522b1f408d4a8ff1413b63516752e17ea0e55a1"
+      path: "gateway/run_turn.py",
+      patchKind: "gateway-first-contact-v0213",
+      sourceSha256:
+        "56e6fb62b60e954ef0d258c7c44ed3fca99c4aa6d2c502d8f80a1c516569f537",
+      patchedSha256:
+        "d66e2aecd00ebb1c6f30a1ecc522b1f408d4a8ff1413b63516752e17ea0e55a1",
     },
     {
-      "path": "gateway/run_turn_runner.py",
-      "patchKind": "gateway-provider-preflight-v021",
-      "sourceSha256": "b87d6072f2cc13634398d380eb0857d550f75502a8ace137138cf16e00d9a763",
-      "patchedSha256": "0113b3df868e73c7f06bacf0c5cec916077e21973e3c1b03b6778c3b91e92b8b"
+      path: "gateway/run_turn_runner.py",
+      patchKind: "gateway-provider-preflight-v021",
+      sourceSha256:
+        "b87d6072f2cc13634398d380eb0857d550f75502a8ace137138cf16e00d9a763",
+      patchedSha256:
+        "0113b3df868e73c7f06bacf0c5cec916077e21973e3c1b03b6778c3b91e92b8b",
     },
     {
-      "path": "agent/turn_context.py",
-      "patchKind": "turn-context-v021",
-      "sourceSha256": "46ed030ee35a13f75994bf8e28cde3633db14969d1fb5c859fc0ff6964cbb0bd",
-      "patchedSha256": "facc6ff45a479766b0c0fe719d96fd6867ee25c40e638d5e82499cc97bd72e04"
+      path: "agent/turn_context.py",
+      patchKind: "turn-context-v021",
+      sourceSha256:
+        "46ed030ee35a13f75994bf8e28cde3633db14969d1fb5c859fc0ff6964cbb0bd",
+      patchedSha256:
+        "facc6ff45a479766b0c0fe719d96fd6867ee25c40e638d5e82499cc97bd72e04",
     },
     {
-      "path": "cron/scheduler.py",
-      "patchKind": "cron-scheduler-v020",
-      "sourceSha256": "df7b82c50485cece408264f3cd44dc910b6b2a7d319b6d138bd42e2cf7ba2e86",
-      "patchedSha256": "ea8b4df9d12dbd82c59044d401de5e99ed466657ac873f018ac5d8d741893b2c"
+      path: "cron/scheduler.py",
+      patchKind: "cron-scheduler-v020",
+      sourceSha256:
+        "df7b82c50485cece408264f3cd44dc910b6b2a7d319b6d138bd42e2cf7ba2e86",
+      patchedSha256:
+        "ea8b4df9d12dbd82c59044d401de5e99ed466657ac873f018ac5d8d741893b2c",
     },
     {
-      "path": "tools/skills_tool.py",
-      "patchKind": "skills-cache-freshness-v021",
-      "sourceSha256": "1bec6a244ac61603b1adeb5599149a4097b68263458f63eafe55836415e5f3a0",
-      "patchedSha256": "168bad88d45af80328c38296be3f1c9b3509f680a7939735836feac94328843e"
+      path: "tools/skills_tool.py",
+      patchKind: "skills-cache-freshness-v021",
+      sourceSha256:
+        "1bec6a244ac61603b1adeb5599149a4097b68263458f63eafe55836415e5f3a0",
+      patchedSha256:
+        "168bad88d45af80328c38296be3f1c9b3509f680a7939735836feac94328843e",
     },
     {
-      "path": "agent/prompt_builder.py",
-      "patchKind": "skills-prompt-freshness-v021",
-      "sourceSha256": "586ea363fa1e70bb0fdd5426af40758976a16c54f07efeb7a1b4f3fe0ad99309",
-      "patchedSha256": "769a0662a396bcb0ffb82e14cacd03b2b864526e68c1cde601f68ccea61e2836"
+      path: "agent/prompt_builder.py",
+      patchKind: "skills-prompt-freshness-v021",
+      sourceSha256:
+        "586ea363fa1e70bb0fdd5426af40758976a16c54f07efeb7a1b4f3fe0ad99309",
+      patchedSha256:
+        "769a0662a396bcb0ffb82e14cacd03b2b864526e68c1cde601f68ccea61e2836",
     },
     {
-      "path": "gateway/platforms/api_server.py",
-      "patchKind": "api-opener-stage-v021",
-      "sourceSha256": "7ec405dc2a59789582ad9f61a189a41079e621f14642d3c9dc754e312616a868",
-      "patchedSha256": "a92e9fd87a69fe7761f8473acd7233a27c1613a163abc7fbfac288a8002f47cb"
-    }
+      path: "gateway/platforms/api_server.py",
+      patchKind: "api-opener-stage-v021",
+      sourceSha256:
+        "7ec405dc2a59789582ad9f61a189a41079e621f14642d3c9dc754e312616a868",
+      patchedSha256:
+        "1423ea98ec142e9b0dc5ba423dadfe9cf192c39c0565cf58cafc374805725052",
+    },
   ],
-  "contractDigest": "75b5d16081dd2fdc5795d3b86d341f2ff341bf3c599e4c57de5ec14b3dd63ce0"
+  contractDigest:
+    "75b5d16081dd2fdc5795d3b86d341f2ff341bf3c599e4c57de5ec14b3dd63ce0",
 });
 
 export const HERMES_AGENT_BRIDGE_DEDICATED_V0215_CONTRACT = normalizeContract({
-  "bridgeId": "sellable-agent-hermes-bridge/v1",
-  "hermesVersion": "0.21.5",
-  "versionFile": {
-    "path": "hermes_cli/__init__.py",
-    "sha256": "d05c98cd44e22781497a20cd968af0d9b8962406b909f1889168c624545b229e"
+  bridgeId: "sellable-agent-hermes-bridge/v1",
+  hermesVersion: "0.21.5",
+  versionFile: {
+    path: "hermes_cli/__init__.py",
+    sha256: "d05c98cd44e22781497a20cd968af0d9b8962406b909f1889168c624545b229e",
   },
-  "files": [
+  files: [
     {
-      "path": "gateway/config_env.py",
-      "patchKind": "gateway-config-dedicated-v021",
-      "sourceSha256": "5661d9cfb7d798d6c995b03727bdd4018669ae12c96d1e7a8f3c99a3ea85acc7",
-      "patchedSha256": "cd8efa414e0313bca77d0d8093acc505d9f345b8fb48d734821e66027545bf57"
+      path: "gateway/config_env.py",
+      patchKind: "gateway-config-dedicated-v021",
+      sourceSha256:
+        "5661d9cfb7d798d6c995b03727bdd4018669ae12c96d1e7a8f3c99a3ea85acc7",
+      patchedSha256:
+        "cd8efa414e0313bca77d0d8093acc505d9f345b8fb48d734821e66027545bf57",
     },
     {
-      "path": "plugins/platforms/slack/adapter.py",
-      "patchKind": "slack-adapter-dedicated-v0213",
-      "sourceSha256": "3f2ec0cef97964bf4cb1e9791c0917a03cd1e73bb0bc3293768680cd6302f613",
-      "patchedSha256": "26cedfad352e8dadae82bebcedf8813ef948622a350b392ce99097a8ede2f056"
+      path: "plugins/platforms/slack/adapter.py",
+      patchKind: "slack-adapter-dedicated-v0213",
+      sourceSha256:
+        "3f2ec0cef97964bf4cb1e9791c0917a03cd1e73bb0bc3293768680cd6302f613",
+      patchedSha256:
+        "26cedfad352e8dadae82bebcedf8813ef948622a350b392ce99097a8ede2f056",
     },
     {
-      "path": "tools/mcp_tool_handlers.py",
-      "patchKind": "mcp-tool-endpoint-v021",
-      "sourceSha256": "d1b4463309a2de351aaf6c7cd8f7a2a1e83f5e26dbe058371c9eeb9d0c567903",
-      "patchedSha256": "61ceab8c24aef50e88d6c1dad1bbf80daed66f8950b05fb642525a62a0bb789c"
+      path: "tools/mcp_tool_handlers.py",
+      patchKind: "mcp-tool-endpoint-v021",
+      sourceSha256:
+        "d1b4463309a2de351aaf6c7cd8f7a2a1e83f5e26dbe058371c9eeb9d0c567903",
+      patchedSha256:
+        "61ceab8c24aef50e88d6c1dad1bbf80daed66f8950b05fb642525a62a0bb789c",
     },
     {
-      "path": "gateway/run.py",
-      "patchKind": "gateway-session-v021",
-      "sourceSha256": "324f7095223816b865dd68a75dc83bfd1c3d101ac8c1c38dba69026dab2b6af1",
-      "patchedSha256": "4b398b8c033e5aaba90b6ba312baf01e7d88d46a91843e64949ade0b65f2ade8"
+      path: "gateway/run.py",
+      patchKind: "gateway-session-v021",
+      sourceSha256:
+        "324f7095223816b865dd68a75dc83bfd1c3d101ac8c1c38dba69026dab2b6af1",
+      patchedSha256:
+        "4b398b8c033e5aaba90b6ba312baf01e7d88d46a91843e64949ade0b65f2ade8",
     },
     {
-      "path": "gateway/run_turn.py",
-      "patchKind": "gateway-first-contact-v0213",
-      "sourceSha256": "5bdee5c82c00e02f664516f9da0af99674e23493ec2a30eff06cb03afc6718a0",
-      "patchedSha256": "0729145f27559df970c16d5be11e01ebce657874e4be1d9e151562042f5208c0"
+      path: "gateway/run_turn.py",
+      patchKind: "gateway-first-contact-v0213",
+      sourceSha256:
+        "5bdee5c82c00e02f664516f9da0af99674e23493ec2a30eff06cb03afc6718a0",
+      patchedSha256:
+        "0729145f27559df970c16d5be11e01ebce657874e4be1d9e151562042f5208c0",
     },
     {
-      "path": "gateway/run_turn_runner.py",
-      "patchKind": "gateway-provider-preflight-v021",
-      "sourceSha256": "216bdca083b7d2bfae481d07bd0791a76834674b3614fd4ee0aafac5c58f30db",
-      "patchedSha256": "7b6beabeed7b78781d142dcdb0eff4c0110263ee173f7696737c4c965e1c72ab"
+      path: "gateway/run_turn_runner.py",
+      patchKind: "gateway-provider-preflight-v021",
+      sourceSha256:
+        "216bdca083b7d2bfae481d07bd0791a76834674b3614fd4ee0aafac5c58f30db",
+      patchedSha256:
+        "7b6beabeed7b78781d142dcdb0eff4c0110263ee173f7696737c4c965e1c72ab",
     },
     {
-      "path": "agent/turn_context.py",
-      "patchKind": "turn-context-v021",
-      "sourceSha256": "85f857dc3c317366d918516bc8b37a022f1020b34da0c3966a31bd289b2942e1",
-      "patchedSha256": "a6487c43bc2d21f40e3a86fe31a9a0c2e4e603fff813f7c8429bbf5c22591648"
+      path: "agent/turn_context.py",
+      patchKind: "turn-context-v021",
+      sourceSha256:
+        "85f857dc3c317366d918516bc8b37a022f1020b34da0c3966a31bd289b2942e1",
+      patchedSha256:
+        "a6487c43bc2d21f40e3a86fe31a9a0c2e4e603fff813f7c8429bbf5c22591648",
     },
     {
-      "path": "cron/scheduler.py",
-      "patchKind": "cron-scheduler-v020",
-      "sourceSha256": "dcf0e6794a220e478584a21f786b8451b915fc7397d38eda357af1363249fa2a",
-      "patchedSha256": "e98d197ce3d0b414184e3c746fe3814c213407da68ce0a46a8b4dd63a9054a11"
+      path: "cron/scheduler.py",
+      patchKind: "cron-scheduler-v020",
+      sourceSha256:
+        "dcf0e6794a220e478584a21f786b8451b915fc7397d38eda357af1363249fa2a",
+      patchedSha256:
+        "e98d197ce3d0b414184e3c746fe3814c213407da68ce0a46a8b4dd63a9054a11",
     },
     {
-      "path": "tools/skills_tool.py",
-      "patchKind": "skills-cache-freshness-v021",
-      "sourceSha256": "0d47bda41ed9d1ec84856df3d336a42bb94161e89bd9a8b857e76ec76be9f7b7",
-      "patchedSha256": "1bdc17603f3bb9fb34c5d04099dee2ca7d631eedc58b523bcd74d6e946dc9eb7"
+      path: "tools/skills_tool.py",
+      patchKind: "skills-cache-freshness-v021",
+      sourceSha256:
+        "0d47bda41ed9d1ec84856df3d336a42bb94161e89bd9a8b857e76ec76be9f7b7",
+      patchedSha256:
+        "1bdc17603f3bb9fb34c5d04099dee2ca7d631eedc58b523bcd74d6e946dc9eb7",
     },
     {
-      "path": "agent/prompt_builder.py",
-      "patchKind": "skills-prompt-freshness-v0215",
-      "sourceSha256": "64bc77a26641754b8c5ca76fc876687d3c9e81aad7816c2e76ce251a41121526",
-      "patchedSha256": "56edefd92c50f38a3fed8d56b6fc02352f8e5892b43553ab277e3113606d25fb"
+      path: "agent/prompt_builder.py",
+      patchKind: "skills-prompt-freshness-v0215",
+      sourceSha256:
+        "64bc77a26641754b8c5ca76fc876687d3c9e81aad7816c2e76ce251a41121526",
+      patchedSha256:
+        "56edefd92c50f38a3fed8d56b6fc02352f8e5892b43553ab277e3113606d25fb",
     },
     {
-      "path": "gateway/platforms/api_server.py",
-      "patchKind": "api-opener-stage-v021",
-      "sourceSha256": "fa83a20bd4f9f3a90a3ac010db0a68f548259587946ea80b81b2f3253bafd5ec",
-      "patchedSha256": "5289cc21e1804d0aaa49b117f32ea1a506375fa76459cdac8f5013f0566d05e1"
-    }
+      path: "gateway/platforms/api_server.py",
+      patchKind: "api-opener-stage-v021",
+      sourceSha256:
+        "fa83a20bd4f9f3a90a3ac010db0a68f548259587946ea80b81b2f3253bafd5ec",
+      patchedSha256:
+        "dbe6e400c7c7a9d3b377b7f9f08e05f2e9f6b622f9019f873e4fdb0cd828b19f",
+    },
   ],
-  "contractDigest": "d8b2ee47591435091a81a3e9913ba5acace2f9c1418cf75c0e23b4d0632e4024"
+  contractDigest:
+    "d8b2ee47591435091a81a3e9913ba5acace2f9c1418cf75c0e23b4d0632e4024",
 });
 
 function assertRelativeContractPath(path) {

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,7 +38,7 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.793";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.794";
 const MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -1546,7 +1546,7 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       pinned.hermesCli !== "hermes" ||
       pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.793" ||
+      pinned.installerPackage !== "@sellable/install@0.1.794" ||
       pinned.mcpPackage !== "@sellable/mcp@0.1.957" ||
       !Array.isArray(policy.toolInclude) ||
       policy.toolInclude.length === 0 ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -312,7 +312,7 @@ function validateDesired(desired) {
     desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" ||
     desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.793" ||
+    desired.installerPackage !== "@sellable/install@0.1.794" ||
     desired.mcpPackage !== "@sellable/mcp@0.1.957" ||
     !Array.isArray(desired.toolInclude) ||
     desired.toolInclude.length === 0 ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.793";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.794";
 export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.957";
 const PINNED_INSTALL_VERSION = PINNED_INSTALL_PACKAGE.slice(
   PINNED_INSTALL_PACKAGE.lastIndexOf("@") + 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.793",
+  "version": "0.1.794",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {