@sellable/mcp 0.1.619-wip.121.2 → 0.1.619

package/dist/agent-tool-policy.js

@@ -0,0 +1,358 @@
+export const DEFAULT_AGENT_TOOL_CATALOGUE = [
+    {
+        tool: "get_company_info",
+        version: "v1",
+        decision: "AUTO",
+        method: "GET",
+        route: "/api/v3/reply-management/company-info",
+        handler: "getCompanyInfoMarkdown",
+        workspaceBinding: "workspaceId",
+    },
+    {
+        tool: "set_company_info",
+        version: "v1",
+        decision: "REQUESTER_CONFIRM",
+        method: "PUT",
+        route: "/api/v3/reply-management/company-info",
+        handler: "saveCompanyInfoMarkdown",
+        workspaceBinding: "workspaceId",
+    },
+];
+export function compileAgentToolPolicy(entries = DEFAULT_AGENT_TOOL_CATALOGUE) {
+    const compiledEntries = [...entries]
+        .map((entry) => ({ ...entry }))
+        .sort((left, right) => left.tool.localeCompare(right.tool));
+    const toolNames = new Set(compiledEntries.map((entry) => entry.tool));
+    if (toolNames.size !== compiledEntries.length) {
+        throw new Error("Agent tool policy contains duplicate tool names");
+    }
+    return {
+        policyHash: portableSha256(JSON.stringify(canonicalize(compiledEntries))),
+        entries: Object.freeze(compiledEntries.map((entry) => Object.freeze(entry))),
+    };
+}
+export function decideAgentTool(compiled, tool) {
+    const entry = compiled.entries.find((candidate) => candidate.tool === tool);
+    if (entry)
+        return { ...entry, allowed: entry.decision !== "DENY" };
+    return {
+        tool,
+        version: "unknown",
+        decision: "DENY",
+        method: "GET",
+        route: "",
+        handler: "",
+        workspaceBinding: "",
+        allowed: false,
+    };
+}
+export function listToolsForAgent(compiled, definitions) {
+    const allowed = new Set(compiled.entries
+        .filter((entry) => entry.decision !== "DENY")
+        .map((entry) => entry.tool));
+    return definitions.filter((definition) => allowed.has(definition.name));
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => [key, canonicalize(item)]));
+    }
+    return value;
+}
+const SHA256_CONSTANTS = [
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b,
+    0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01,
+    0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7,
+    0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+    0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152,
+    0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc,
+    0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819,
+    0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08,
+    0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f,
+    0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+];
+function rotateRight(value, bits) {
+    return (value >>> bits) | (value << (32 - bits));
+}
+export function portableSha256(value) {
+    const bytes = new TextEncoder().encode(value);
+    const bitLength = bytes.length * 8;
+    const paddedLength = Math.ceil((bytes.length + 9) / 64) * 64;
+    const padded = new Uint8Array(paddedLength);
+    padded.set(bytes);
+    padded[bytes.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x100000000));
+    view.setUint32(paddedLength - 4, bitLength >>> 0);
+    const hash = [
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f,
+        0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ];
+    const words = new Uint32Array(64);
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let index = 0; index < 16; index += 1) {
+            words[index] = view.getUint32(offset + index * 4);
+        }
+        for (let index = 16; index < 64; index += 1) {
+            const left = words[index - 15];
+            const right = words[index - 2];
+            const sigma0 = rotateRight(left, 7) ^ rotateRight(left, 18) ^ (left >>> 3);
+            const sigma1 = rotateRight(right, 17) ^ rotateRight(right, 19) ^ (right >>> 10);
+            words[index] =
+                (words[index - 16] + sigma0 + words[index - 7] + sigma1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, h] = hash;
+        for (let index = 0; index < 64; index += 1) {
+            const sum1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
+            const choice = (e & f) ^ (~e & g);
+            const temp1 = (h + sum1 + choice + SHA256_CONSTANTS[index] + words[index]) >>> 0;
+            const sum0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);
+            const majority = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (sum0 + majority) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        hash[0] = (hash[0] + a) >>> 0;
+        hash[1] = (hash[1] + b) >>> 0;
+        hash[2] = (hash[2] + c) >>> 0;
+        hash[3] = (hash[3] + d) >>> 0;
+        hash[4] = (hash[4] + e) >>> 0;
+        hash[5] = (hash[5] + f) >>> 0;
+        hash[6] = (hash[6] + g) >>> 0;
+        hash[7] = (hash[7] + h) >>> 0;
+    }
+    return hash.map((word) => word.toString(16).padStart(8, "0")).join("");
+}
+export function hashApprovalArguments(args) {
+    return portableSha256(JSON.stringify(canonicalize(args)));
+}
+export function canonicalAgentToolArguments(tool, args) {
+    if (tool !== "set_company_info" || !args || typeof args !== "object") {
+        return args;
+    }
+    const input = args;
+    const markdown = typeof input.companyInfoMarkdown === "string"
+        ? input.companyInfoMarkdown.trim()
+            ? input.companyInfoMarkdown
+            : null
+        : input.companyInfoMarkdown === null
+            ? null
+            : null;
+    return input.forceOverwrite === true
+        ? { companyInfoMarkdown: markdown, forceOverwrite: true }
+        : {
+            companyInfoMarkdown: markdown,
+            expectedUpdatedAt: typeof input.expectedUpdatedAt === "string" ||
+                input.expectedUpdatedAt === null
+                ? input.expectedUpdatedAt
+                : null,
+        };
+}
+export function hashAgentToolArguments(tool, args) {
+    return hashApprovalArguments(canonicalAgentToolArguments(tool, args));
+}
+export function deriveAgentApprovalRequestId(input) {
+    return `saa_${hashApprovalArguments({
+        workspaceId: input.workspaceId,
+        agentId: input.agentId,
+        requesterId: input.requesterId,
+        channelId: input.channelId,
+        providerRequestId: input.providerRequestId,
+        tool: input.tool,
+        toolVersion: input.toolVersion,
+        argumentHash: hashAgentToolArguments(input.tool, input.arguments),
+        policyHash: input.policyHash,
+        credentialGeneration: input.credentialGeneration,
+        decision: input.decision,
+    })}`;
+}
+export function validateApprovalBinding(input) {
+    const { approval, expected } = input;
+    if (!approval)
+        return { ok: false, code: "approval_required" };
+    if (approval.consumedAt)
+        return { ok: false, code: "approval_consumed" };
+    if (approval.revokedAt)
+        return { ok: false, code: "approval_revoked" };
+    if (approval.expiresAt.getTime() <= (input.now ?? new Date()).getTime()) {
+        return { ok: false, code: "approval_expired" };
+    }
+    for (const key of Object.keys(expected)) {
+        if (approval[key] !== expected[key]) {
+            return { ok: false, code: `approval_${String(key)}_mismatch` };
+        }
+    }
+    return { ok: true, code: "approved" };
+}
+export function createAgentMcpAuthorizationHandlers(input) {
+    const policy = input.policy ?? compileAgentToolPolicy();
+    return {
+        listTools(context) {
+            if (!context.principal)
+                return input.allTools;
+            if (context.principal.policyHash !== policy.policyHash ||
+                !Number.isSafeInteger(context.principal.generation) ||
+                context.principal.generation < 1) {
+                return [];
+            }
+            return listToolsForAgent(policy, input.allTools);
+        },
+        async authorizeCall(call) {
+            const principal = call.context.principal;
+            if (!principal) {
+                return { allowed: false, decision: "DENY", code: "agent_principal_required" };
+            }
+            if (principal.policyHash !== policy.policyHash) {
+                return { allowed: false, decision: "DENY", code: "policy_hash_mismatch" };
+            }
+            if (!Number.isSafeInteger(principal.generation) || principal.generation < 1) {
+                return { allowed: false, decision: "DENY", code: "credential_generation_invalid" };
+            }
+            const decision = decideAgentTool(policy, call.name);
+            if (!decision.allowed) {
+                return { allowed: false, decision: "DENY", code: "tool_denied" };
+            }
+            const policyEntry = {
+                tool: decision.tool,
+                version: decision.version,
+                decision: decision.decision,
+                method: decision.method,
+                route: decision.route,
+                handler: decision.handler,
+                workspaceBinding: decision.workspaceBinding,
+            };
+            if (decision.decision === "AUTO") {
+                return { allowed: true, decision: "AUTO", policy: policyEntry };
+            }
+            if (decision.decision !== "REQUESTER_CONFIRM" &&
+                decision.decision !== "WORKSPACE_APPROVER") {
+                return { allowed: false, decision: "DENY", code: "tool_denied" };
+            }
+            const approvalDecision = decision.decision;
+            if (!input.approvalPort) {
+                return {
+                    allowed: false,
+                    decision: approvalDecision,
+                    code: "approval_port_unavailable",
+                };
+            }
+            const requesterId = call.context.requesterId?.trim();
+            const channelId = call.context.channelId?.trim();
+            const providerRequestId = call.context.providerRequestId?.trim();
+            const approvalId = call.context.approvalId?.trim();
+            if (!requesterId || !channelId || !providerRequestId) {
+                return {
+                    allowed: false,
+                    decision: approvalDecision,
+                    code: "approval_context_required",
+                };
+            }
+            const expectedApprovalId = deriveAgentApprovalRequestId({
+                workspaceId: principal.workspaceId,
+                agentId: principal.agentId,
+                requesterId,
+                channelId,
+                providerRequestId,
+                tool: decision.tool,
+                toolVersion: decision.version,
+                arguments: call.args,
+                policyHash: principal.policyHash,
+                credentialGeneration: principal.generation,
+                decision: approvalDecision,
+            });
+            if (!approvalId) {
+                if (!input.approvalPort.requestApproval) {
+                    return {
+                        allowed: false,
+                        decision: approvalDecision,
+                        code: "approval_port_unavailable",
+                    };
+                }
+                const approval = await input.approvalPort.requestApproval({
+                    requesterId,
+                    channelId,
+                    providerRequestId,
+                    tool: decision.tool,
+                    arguments: call.args,
+                });
+                if (approval.approvalId !== expectedApprovalId ||
+                    approval.workspaceId !== principal.workspaceId ||
+                    approval.agentId !== principal.agentId ||
+                    approval.requesterId !== requesterId ||
+                    approval.channelId !== channelId ||
+                    approval.providerRequestId !== providerRequestId ||
+                    approval.tool !== decision.tool ||
+                    approval.toolVersion !== decision.version ||
+                    approval.decision !== approvalDecision) {
+                    return {
+                        allowed: false,
+                        decision: approvalDecision,
+                        code: "approval_mismatch",
+                    };
+                }
+                return {
+                    allowed: false,
+                    decision: approvalDecision,
+                    code: "approval_required",
+                    approval,
+                };
+            }
+            if (approvalId !== expectedApprovalId) {
+                return {
+                    allowed: false,
+                    decision: approvalDecision,
+                    code: "approval_mismatch",
+                };
+            }
+            const consumed = await input.approvalPort.consumeApprovalAndStartEffect({
+                approvalId,
+                requesterId,
+                channelId,
+                providerRequestId,
+                argumentHash: hashAgentToolArguments(decision.tool, call.args),
+                workspaceId: principal.workspaceId,
+                agentId: principal.agentId,
+                tool: decision.tool,
+                toolVersion: decision.version,
+                policyHash: principal.policyHash,
+                credentialGeneration: principal.generation,
+                decision: approvalDecision,
+                now: input.now?.() ?? new Date(),
+                arguments: call.args,
+            });
+            if (consumed.status === "AUTHORIZED") {
+                return {
+                    allowed: true,
+                    decision: approvalDecision,
+                    policy: policyEntry,
+                    effectId: consumed.effectId,
+                };
+            }
+            const codeByStatus = {
+                MISSING: "approval_required",
+                MISMATCH: "approval_mismatch",
+                EXPIRED: "approval_expired",
+                REVOKED: "approval_revoked",
+                CONSUMED: "approval_consumed",
+            };
+            return {
+                allowed: false,
+                decision: approvalDecision,
+                code: codeByStatus[consumed.status],
+            };
+        },
+        policy,
+    };
+}

package/dist/api.d.ts

@@ -10,6 +10,7 @@ export interface DownloadToFileResult {
 }
 export interface ApiRequestOptions {
     workspaceId?: string | null;
+    agentEffectId?: string;
 }
 export declare class SellableApiError extends Error {
     status: number;

package/dist/api.js

@@ -54,6 +54,9 @@ export class SellableApi {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${config.token}`,
                 ...(workspaceId ? { "x-workspaceid": workspaceId } : {}),
+                ...(options?.agentEffectId
+                    ? { "x-sellable-agent-effect-id": options.agentEffectId }
+                    : {}),
             },
             ...(body && { body: JSON.stringify(body) }),
         });

package/dist/auth.d.ts

@@ -14,6 +14,8 @@ export interface SellableMultiEnvConfig {
 export type SellableConfig = SellableEnvConfig & {
     /** Name of the active environment (e.g. "local", "prod"). */
     activeEnvName?: string;
+    /** Credential class controls MCP discovery/invocation and API semantics. */
+    credentialKind?: "human" | "agent_service";
 };
 export type EngageWorkspaceState = {
     lastSenderId?: string;
@@ -47,6 +49,8 @@ export declare function assertWorkspaceLockSatisfied(action?: string): void;
 export declare function getEffectiveConfiguredWorkspaceId(config: Pick<SellableConfig, "activeWorkspaceId" | "workspaceId">): string | null;
 export declare function resolveWorkspaceIdForRequest(requestedWorkspaceId: string | null | undefined, action?: string): string | null;
 export declare function getConfig(): SellableConfig;
+/** Reads only the credential class; never returns or validates credential bytes. */
+export declare function getConfiguredCredentialIntent(): "unconfigured" | "human" | "agent_service" | "invalid";
 export declare function updateActiveWorkspace(params: {
     workspaceId: string;
     workspaceName?: string | null;

package/dist/auth.js

@@ -1,9 +1,14 @@
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+import { createHash } from "node:crypto";
+import { readMcpAgentServiceContext } from "./agent-service-auth.js";
 const DEFAULT_API_URL = "https://app.sellable.dev";
 const WORKSPACE_LOCK_ENV = "SELLABLE_LOCK_WORKSPACE_ID";
 const REQUIRE_WORKSPACE_LOCK_ENV = "SELLABLE_REQUIRE_WORKSPACE_LOCK";
+const AGENT_SERVICE_CREDENTIAL_FILE_ENV = "SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE";
+const AGENT_RUNTIME_SECRET_ROOT_ENV = "SELLABLE_AGENT_RUNTIME_SECRET_ROOT";
+const AGENT_PROFILE_ID_ENV = "SELLABLE_AGENT_PROFILE_ID";
 // No caching — re-read config on every call so token/workspace changes
 // made by the LLM (editing sellable.json) take effect immediately
 // without requiring an MCP server restart.
@@ -87,6 +92,64 @@ function normalizeConfig(raw) {
         apiUrl: raw.apiUrl || DEFAULT_API_URL,
     };
 }
+function readConfinedAgentServiceCredential(raw, env = process.env) {
+    const credentialPathValue = env[AGENT_SERVICE_CREDENTIAL_FILE_ENV]?.trim();
+    if (!credentialPathValue)
+        return null;
+    const runtimeRootValue = env[AGENT_RUNTIME_SECRET_ROOT_ENV]?.trim();
+    const profileId = env[AGENT_PROFILE_ID_ENV]?.trim();
+    if (!runtimeRootValue ||
+        !path.isAbsolute(runtimeRootValue) ||
+        !path.isAbsolute(credentialPathValue) ||
+        !profileId ||
+        !/^[A-Za-z0-9_-]{1,128}$/.test(profileId)) {
+        throw new Error("Invalid Agent service credential file binding");
+    }
+    const rootLink = fs.lstatSync(runtimeRootValue);
+    if (rootLink.isSymbolicLink() ||
+        !rootLink.isDirectory() ||
+        (rootLink.mode & 0o077) !== 0) {
+        throw new Error("Invalid Agent runtime secret root");
+    }
+    const lexicalExpectedPath = path.join(path.resolve(runtimeRootValue), profileId, "service-credential");
+    if (path.resolve(credentialPathValue) !== lexicalExpectedPath) {
+        throw new Error("Invalid Agent service credential file binding");
+    }
+    const runtimeRoot = fs.realpathSync(runtimeRootValue);
+    const expectedPath = path.join(runtimeRoot, profileId, "service-credential");
+    const parent = path.dirname(expectedPath);
+    const parentLink = fs.lstatSync(parent);
+    const credentialLink = fs.lstatSync(expectedPath);
+    const currentUid = process.getuid?.();
+    if (parentLink.isSymbolicLink() ||
+        !parentLink.isDirectory() ||
+        (parentLink.mode & 0o077) !== 0 ||
+        credentialLink.isSymbolicLink() ||
+        !credentialLink.isFile() ||
+        (credentialLink.mode & 0o777) !== 0o600 ||
+        credentialLink.size < 8 ||
+        credentialLink.size > 4096 ||
+        (currentUid !== undefined && credentialLink.uid !== currentUid)) {
+        throw new Error("Invalid Agent service credential file");
+    }
+    if (fs.realpathSync(parent) !== parent || fs.realpathSync(expectedPath) !== expectedPath) {
+        throw new Error("Invalid Agent service credential file confinement");
+    }
+    const token = fs.readFileSync(expectedPath, "utf8").trim();
+    const descriptor = raw.serviceCredential;
+    const generation = Number(env.SELLABLE_AGENT_CREDENTIAL_GENERATION ?? "");
+    const fingerprint = createHash("sha256").update(token).digest("hex").slice(0, 16);
+    if (!/^sat_[^_\s]+_\S+$/.test(token) ||
+        typeof raw.token === "string" ||
+        !descriptor ||
+        descriptor.fingerprint !== fingerprint ||
+        descriptor.generation !== generation ||
+        typeof descriptor.reference !== "string" ||
+        !/^secret:\/\/agent\/service\/g[1-9][0-9]*$/.test(descriptor.reference)) {
+        throw new Error("Invalid Agent service credential descriptor");
+    }
+    return token;
+}
 export function getLockedWorkspaceId() {
     const value = process.env[WORKSPACE_LOCK_ENV]?.trim();
     return value || null;
@@ -147,6 +210,7 @@ export function getConfig() {
         const raw = JSON.parse(content);
         // Resolve config: support multi-env format or legacy flat format
         let config;
+        let selectedRaw;
         if (raw.activeEnv && raw.environments) {
             const envName = raw.activeEnv;
             const envConfig = raw.environments[envName];
@@ -154,6 +218,7 @@ export function getConfig() {
                 const available = Object.keys(raw.environments).join(", ");
                 throw new Error(`Unknown environment '${envName}' in ${configFileName}. Available: ${available}`);
             }
+            selectedRaw = envConfig;
             config = {
                 ...normalizeConfig(envConfig),
                 activeEnvName: envName,
@@ -161,13 +226,35 @@ export function getConfig() {
         }
         else {
             // Legacy flat format: { token, workspaceId?, apiUrl? }
+            selectedRaw = raw;
             config = normalizeConfig(raw);
         }
-        if (!config.token) {
+        const confinedAgentCredential = readConfinedAgentServiceCredential(selectedRaw);
+        if (confinedAgentCredential) {
+            config.token = confinedAgentCredential;
+            config.credentialKind = "agent_service";
+        }
+        else if (!config.token) {
             throw new Error(`Missing 'token' in ${configFileName}`);
         }
-        if (!config.token.startsWith("skt_")) {
-            throw new Error("Invalid token format - must start with 'skt_'");
+        if (config.token.startsWith("skt_")) {
+            config.credentialKind = "human";
+        }
+        else if (config.token.startsWith("sat_")) {
+            const agent = readMcpAgentServiceContext(process.env, config.token);
+            if (!agent)
+                throw new Error("Invalid Agent service context");
+            const configuredWorkspace = normalizeWorkspaceId(config.activeWorkspaceId) ||
+                normalizeWorkspaceId(config.workspaceId);
+            if (configuredWorkspace && configuredWorkspace !== agent.workspaceId) {
+                throw new Error("Agent service credential workspace binding mismatch");
+            }
+            config.activeWorkspaceId = agent.workspaceId;
+            config.workspaceId = agent.workspaceId;
+            config.credentialKind = "agent_service";
+        }
+        else {
+            throw new Error("Invalid token format - expected a Sellable credential");
         }
         return config;
     }
@@ -178,7 +265,38 @@ export function getConfig() {
         throw error;
     }
 }
+/** Reads only the credential class; never returns or validates credential bytes. */
+export function getConfiguredCredentialIntent() {
+    const configPath = getConfigPath();
+    if (!fs.existsSync(configPath))
+        return "unconfigured";
+    try {
+        const raw = JSON.parse(fs.readFileSync(configPath, "utf8"));
+        const selected = raw?.activeEnv && raw?.environments
+            ? raw.environments[raw.activeEnv]
+            : raw;
+        const token = selected?.token;
+        if (process.env[AGENT_SERVICE_CREDENTIAL_FILE_ENV]?.trim()) {
+            return token == null && selected?.serviceCredential
+                ? "agent_service"
+                : "invalid";
+        }
+        if (typeof token !== "string")
+            return "invalid";
+        if (token.startsWith("sat_"))
+            return "agent_service";
+        if (token.startsWith("skt_"))
+            return "human";
+        return "invalid";
+    }
+    catch {
+        return "invalid";
+    }
+}
 export function updateActiveWorkspace(params) {
+    if (getConfig().credentialKind === "agent_service") {
+        throw new Error("Agent service profiles cannot switch workspaces");
+    }
     resolveWorkspaceIdForRequest(params.workspaceId, "set_active_workspace");
     const configPath = getConfigPath();
     const configDir = path.dirname(configPath);