@sellable/mcp 0.1.746 → 0.1.747

package/dist/agent-tool-names.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Lightweight projection of the canonical MCP registry for control-plane
+ * manifests. Keep this free of tool implementation imports so Next can bundle
+ * it; registry parity is enforced in sellable-agent-tool-policy.test.ts.
+ */
+export declare const SELLABLE_MCP_TOOL_NAMES: readonly ["add_column", "add_on_demand_leads", "add_rubric_item", "add_teammate", "add_to_comment_campaign", "add_to_connection_campaign", "add_to_inmail_campaign", "archive_campaign", "attach_recommended_sequence", "attach_sequence", "bootstrap_create_campaign", "bootstrap_engage", "bootstrap_engage_multi", "bootstrap_find_leads", "bulk_enrich_with_prospeo", "calculate_linkedin_hook_preview", "cancel_campaign_message_preparation", "cancel_find_leads", "cancel_lead_import", "capture_post_idea", "check_inbox_reply_eligibility", "check_rubric", "commit_blueprint", "complete_sender_research", "confirm_harvest_job_companies", "confirm_lead_list", "confirm_prospeo_company_accounts", "copy_sender_config", "create_campaign", "create_on_demand_campaign", "create_on_demand_table", "create_workflow_table", "create_workspace", "delete_column", "delete_rubric_item", "draft_rubrics", "duplicate_campaign", "enrich_with_prospeo", "export_table_csv", "export_workspace_csv", "fetch_company", "fetch_company_posts", "fetch_linkedin_posts", "fetch_linkedin_profile", "fetch_post_engagers", "fill_campaign_horizon", "get_active_workspace", "get_auth_status", "get_campaign", "get_campaign_context", "get_campaign_framework", "get_campaign_message_preparation_status", "get_campaign_messages_preview", "get_campaign_navigation_state", "get_campaign_refill_state", "get_campaign_table_schema", "get_campaign_waterfall", "get_campaigns", "get_column_schema", "get_company_info", "get_engage_memory", "get_engage_state", "get_engaged_posts", "get_find_leads_run", "get_inbox_thread", "get_linkedin_profile", "get_or_create_direct_campaign_table", "get_post_draft", "get_post_find_leads_scout_registry", "get_post_idea", "get_prospeo_credits", "get_provider_prompt", "get_published_post", "get_refill_plan_v2", "get_refill_target_plan", "get_rows", "get_rows_minimal", "get_runtime_identity", "get_scheduler_fill_capacity", "get_sender", "get_sender_routing", "get_source_scout_registry", "get_subskill_asset", "get_subskill_prompt", "get_table_rows", "get_user_posts", "get_workspace", "import_leads", "init_on_demand_sequence", "list_column_types", "list_dnc_entries", "list_post_draft_iterations", "list_post_drafts", "list_post_ideas", "list_published_posts", "list_senders", "list_subskill_prompts", "list_tables", "list_workspaces", "load_csv_dnc_entries", "load_csv_domains", "load_csv_linkedin_leads", "lookup_sales_nav_filter", "mark_post_published", "migrate_flat_configs", "pause_campaign", "pause_direct_campaign", "pause_on_demand_campaign", "preflight_find_leads_provider", "prepare_campaign_ab_test", "queue_campaign_cells", "queue_cells", "record_campaign_review_batch", "record_engage_proven_search", "refill_sends", "refill_sends_v2", "refresh_paid_inmail_credits", "refresh_sender_engagement", "reissue_find_leads_watch_link", "render_linkedin_post_preview", "reorder_columns", "resolve_campaign_fill_route", "revise_message_template_and_rerun", "run_scheduler_sweep", "save_domain_filters", "save_hook_research", "save_post_draft", "save_rubrics", "search_apollo", "search_engagement_posts", "search_harvest_jobs", "search_inbox_threads", "search_prospeo", "search_prospeo_companies", "search_sales_nav", "search_signals", "search_subskill_prompts", "select_campaign_cells", "select_necessary_rubrics", "select_promising_posts", "send_inbox_draft", "send_inbox_manual_reply", "set_active_workspace", "set_campaign_waterfall_order", "set_company_info", "set_engage_state", "set_engage_style_guide", "set_headline_icp_criteria", "set_sender_calendar_link", "set_sender_routing", "setup_evergreen_campaigns", "start_campaign", "start_campaign_message_preparation", "start_cli_login", "start_direct_campaign", "start_on_demand_campaign", "update_campaign", "update_campaign_brief", "update_cell", "update_column", "update_find_leads_run", "update_inbox_draft", "update_post_draft", "update_published_post_metrics", "update_rubric_item", "upsert_engage_tracked_person", "upsert_rubric", "validate_campaign1_kickoff_handoff", "verify_table_row", "wait_for_campaign_processing", "wait_for_campaign_table_ready", "wait_for_cli_login", "wait_for_find_leads_run", "wait_for_lead_list_ready", "wait_for_rubric_results"];

package/dist/agent-tool-names.js

@@ -0,0 +1,182 @@
+/**
+ * Lightweight projection of the canonical MCP registry for control-plane
+ * manifests. Keep this free of tool implementation imports so Next can bundle
+ * it; registry parity is enforced in sellable-agent-tool-policy.test.ts.
+ */
+export const SELLABLE_MCP_TOOL_NAMES = [
+    "add_column",
+    "add_on_demand_leads",
+    "add_rubric_item",
+    "add_teammate",
+    "add_to_comment_campaign",
+    "add_to_connection_campaign",
+    "add_to_inmail_campaign",
+    "archive_campaign",
+    "attach_recommended_sequence",
+    "attach_sequence",
+    "bootstrap_create_campaign",
+    "bootstrap_engage",
+    "bootstrap_engage_multi",
+    "bootstrap_find_leads",
+    "bulk_enrich_with_prospeo",
+    "calculate_linkedin_hook_preview",
+    "cancel_campaign_message_preparation",
+    "cancel_find_leads",
+    "cancel_lead_import",
+    "capture_post_idea",
+    "check_inbox_reply_eligibility",
+    "check_rubric",
+    "commit_blueprint",
+    "complete_sender_research",
+    "confirm_harvest_job_companies",
+    "confirm_lead_list",
+    "confirm_prospeo_company_accounts",
+    "copy_sender_config",
+    "create_campaign",
+    "create_on_demand_campaign",
+    "create_on_demand_table",
+    "create_workflow_table",
+    "create_workspace",
+    "delete_column",
+    "delete_rubric_item",
+    "draft_rubrics",
+    "duplicate_campaign",
+    "enrich_with_prospeo",
+    "export_table_csv",
+    "export_workspace_csv",
+    "fetch_company",
+    "fetch_company_posts",
+    "fetch_linkedin_posts",
+    "fetch_linkedin_profile",
+    "fetch_post_engagers",
+    "fill_campaign_horizon",
+    "get_active_workspace",
+    "get_auth_status",
+    "get_campaign",
+    "get_campaign_context",
+    "get_campaign_framework",
+    "get_campaign_message_preparation_status",
+    "get_campaign_messages_preview",
+    "get_campaign_navigation_state",
+    "get_campaign_refill_state",
+    "get_campaign_table_schema",
+    "get_campaign_waterfall",
+    "get_campaigns",
+    "get_column_schema",
+    "get_company_info",
+    "get_engage_memory",
+    "get_engage_state",
+    "get_engaged_posts",
+    "get_find_leads_run",
+    "get_inbox_thread",
+    "get_linkedin_profile",
+    "get_or_create_direct_campaign_table",
+    "get_post_draft",
+    "get_post_find_leads_scout_registry",
+    "get_post_idea",
+    "get_prospeo_credits",
+    "get_provider_prompt",
+    "get_published_post",
+    "get_refill_plan_v2",
+    "get_refill_target_plan",
+    "get_rows",
+    "get_rows_minimal",
+    "get_runtime_identity",
+    "get_scheduler_fill_capacity",
+    "get_sender",
+    "get_sender_routing",
+    "get_source_scout_registry",
+    "get_subskill_asset",
+    "get_subskill_prompt",
+    "get_table_rows",
+    "get_user_posts",
+    "get_workspace",
+    "import_leads",
+    "init_on_demand_sequence",
+    "list_column_types",
+    "list_dnc_entries",
+    "list_post_draft_iterations",
+    "list_post_drafts",
+    "list_post_ideas",
+    "list_published_posts",
+    "list_senders",
+    "list_subskill_prompts",
+    "list_tables",
+    "list_workspaces",
+    "load_csv_dnc_entries",
+    "load_csv_domains",
+    "load_csv_linkedin_leads",
+    "lookup_sales_nav_filter",
+    "mark_post_published",
+    "migrate_flat_configs",
+    "pause_campaign",
+    "pause_direct_campaign",
+    "pause_on_demand_campaign",
+    "preflight_find_leads_provider",
+    "prepare_campaign_ab_test",
+    "queue_campaign_cells",
+    "queue_cells",
+    "record_campaign_review_batch",
+    "record_engage_proven_search",
+    "refill_sends",
+    "refill_sends_v2",
+    "refresh_paid_inmail_credits",
+    "refresh_sender_engagement",
+    "reissue_find_leads_watch_link",
+    "render_linkedin_post_preview",
+    "reorder_columns",
+    "resolve_campaign_fill_route",
+    "revise_message_template_and_rerun",
+    "run_scheduler_sweep",
+    "save_domain_filters",
+    "save_hook_research",
+    "save_post_draft",
+    "save_rubrics",
+    "search_apollo",
+    "search_engagement_posts",
+    "search_harvest_jobs",
+    "search_inbox_threads",
+    "search_prospeo",
+    "search_prospeo_companies",
+    "search_sales_nav",
+    "search_signals",
+    "search_subskill_prompts",
+    "select_campaign_cells",
+    "select_necessary_rubrics",
+    "select_promising_posts",
+    "send_inbox_draft",
+    "send_inbox_manual_reply",
+    "set_active_workspace",
+    "set_campaign_waterfall_order",
+    "set_company_info",
+    "set_engage_state",
+    "set_engage_style_guide",
+    "set_headline_icp_criteria",
+    "set_sender_calendar_link",
+    "set_sender_routing",
+    "setup_evergreen_campaigns",
+    "start_campaign",
+    "start_campaign_message_preparation",
+    "start_cli_login",
+    "start_direct_campaign",
+    "start_on_demand_campaign",
+    "update_campaign",
+    "update_campaign_brief",
+    "update_cell",
+    "update_column",
+    "update_find_leads_run",
+    "update_inbox_draft",
+    "update_post_draft",
+    "update_published_post_metrics",
+    "update_rubric_item",
+    "upsert_engage_tracked_person",
+    "upsert_rubric",
+    "validate_campaign1_kickoff_handoff",
+    "verify_table_row",
+    "wait_for_campaign_processing",
+    "wait_for_campaign_table_ready",
+    "wait_for_cli_login",
+    "wait_for_find_leads_run",
+    "wait_for_lead_list_ready",
+    "wait_for_rubric_results",
+];

package/dist/agent-tool-policy.js

@@ -47,10 +47,28 @@ export function decideAgentTool(compiled, tool) {
     };
 }
 export function listToolsForAgent(compiled, definitions) {
-    const allowed = new Set(compiled.entries
-        .filter((entry) => entry.decision !== "DENY")
+    const denied = new Set(compiled.entries
+        .filter((entry) => entry.decision === "DENY")
         .map((entry) => entry.tool));
-    return definitions.filter((definition) => allowed.has(definition.name));
+    return definitions.filter((definition) => !denied.has(definition.name));
+}
+function decideRegisteredAgentTool(compiled, definitions, tool) {
+    const explicit = decideAgentTool(compiled, tool);
+    if (explicit.version !== "unknown")
+        return explicit;
+    if (!definitions.some((definition) => definition.name === tool)) {
+        return explicit;
+    }
+    return {
+        tool,
+        version: "registry-v1",
+        decision: "AUTO",
+        method: "POST",
+        route: `mcp://sellable/${tool}`,
+        handler: tool,
+        workspaceBinding: "workspaceId",
+        allowed: true,
+    };
 }
 function canonicalize(value) {
     if (Array.isArray(value))
@@ -63,18 +81,16 @@ function canonicalize(value) {
     return value;
 }
 const SHA256_CONSTANTS = [
-    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b,
-    0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01,
-    0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7,
-    0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
-    0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152,
-    0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
-    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc,
-    0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819,
-    0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08,
-    0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f,
-    0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1,
+    0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+    0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+    0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
     0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
 ];
 function rotateRight(value, bits) {
@@ -91,8 +107,8 @@ export function portableSha256(value) {
     view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x100000000));
     view.setUint32(paddedLength - 4, bitLength >>> 0);
     const hash = [
-        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f,
-        0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c,
+        0x1f83d9ab, 0x5be0cd19,
     ];
     const words = new Uint32Array(64);
     for (let offset = 0; offset < paddedLength; offset += 64) {
@@ -212,15 +228,28 @@ export function createAgentMcpAuthorizationHandlers(input) {
         async authorizeCall(call) {
             const principal = call.context.principal;
             if (!principal) {
-                return { allowed: false, decision: "DENY", code: "agent_principal_required" };
+                return {
+                    allowed: false,
+                    decision: "DENY",
+                    code: "agent_principal_required",
+                };
             }
             if (principal.policyHash !== policy.policyHash) {
-                return { allowed: false, decision: "DENY", code: "policy_hash_mismatch" };
+                return {
+                    allowed: false,
+                    decision: "DENY",
+                    code: "policy_hash_mismatch",
+                };
             }
-            if (!Number.isSafeInteger(principal.generation) || principal.generation < 1) {
-                return { allowed: false, decision: "DENY", code: "credential_generation_invalid" };
+            if (!Number.isSafeInteger(principal.generation) ||
+                principal.generation < 1) {
+                return {
+                    allowed: false,
+                    decision: "DENY",
+                    code: "credential_generation_invalid",
+                };
             }
-            const decision = decideAgentTool(policy, call.name);
+            const decision = decideRegisteredAgentTool(policy, input.allTools, call.name);
             if (!decision.allowed) {
                 return { allowed: false, decision: "DENY", code: "tool_denied" };
             }

package/dist/tools/refill-executors.d.ts

@@ -214,6 +214,8 @@ export type SchedulerChangedCounts = {
     }>;
 };
 export declare function normalizeSchedulerChangedCounts(value: unknown): SchedulerChangedCounts | null;
+export declare function setSweepSettlePollDelayMsForTests(ms: number): void;
+export declare function resetSweepSettlePollDelayMsForTests(): void;
 export declare function schedulerEnvelopeIsTerminal(schedulerStatus: string, receipt?: Record<string, unknown> | null): boolean;
 export declare function normalizeSchedulerPrimitiveResult(value: unknown, expected?: {
     expectedTargets: SchedulerExpectedTargetInput[];

package/dist/tools/refill-executors.js

@@ -294,6 +294,34 @@ function hasTerminalSchedulerReceipt(receipt) {
     const status = receipt ? stringValue(receipt.status) : null;
     return Boolean(status && SCHEDULER_TERMINAL_RECEIPT_STATUSES.has(status));
 }
+// fix(112ap): poll ONLY a genuinely in-flight attach. `!terminal` is the wrong
+// test — it is also true for `backoff` and `failed`, and re-polling those would
+// both waste the budget and misrepresent a refused dispatch as a pending one.
+// In-flight means an attaching envelope (accepted|attached) that has NOT yet
+// yielded a terminal receipt, matching the 112ao-2b contract exactly.
+function schedulerDispatchIsStillRunning(value) {
+    const response = recordValue(value);
+    if (!response)
+        return false;
+    const status = stringValue(response.status) ?? "";
+    if (!SCHEDULER_ATTACHING_ENVELOPE_STATUSES.has(status))
+        return false;
+    return !hasTerminalSchedulerReceipt(recordValue(response.receipt));
+}
+// fix(112ap): bounded self-settle for a dispatched sweep. 4 x 8s = 32s, just past
+// the scheduler's own ~28s observed pass duration and its 30s retryAfterMs hint,
+// while staying well inside the coordinator's per-call budget.
+const SWEEP_SETTLE_POLL_ATTEMPTS = 4;
+const SWEEP_SETTLE_POLL_DEFAULT_DELAY_MS = 8_000;
+// Injectable so pins can exercise the settle loop without real wall-clock waits.
+// Production never calls the setter; the default is what ships.
+let sweepSettlePollDelayMs = SWEEP_SETTLE_POLL_DEFAULT_DELAY_MS;
+export function setSweepSettlePollDelayMsForTests(ms) {
+    sweepSettlePollDelayMs = ms;
+}
+export function resetSweepSettlePollDelayMsForTests() {
+    sweepSettlePollDelayMs = SWEEP_SETTLE_POLL_DEFAULT_DELAY_MS;
+}
 export function schedulerEnvelopeIsTerminal(schedulerStatus, receipt = null) {
     if (SCHEDULER_TERMINAL_ENVELOPE_STATUSES.has(schedulerStatus))
         return true;
@@ -3052,7 +3080,7 @@ export async function executeOneYoloPrimitive(action, workspaceId) {
                     },
                 };
             }
-            const result = await runSchedulerSweep({
+            let result = await runSchedulerSweep({
                 workspaceId,
                 action: "run",
                 targetDate,
@@ -3062,6 +3090,56 @@ export async function executeOneYoloPrimitive(action, workspaceId) {
                 expectedTargetsHash,
                 maxPlacements,
             });
+            // fix(112ap): settle our OWN dispatch before returning.
+            //
+            // The route holds a sweep for SCHEDULER_RUN_RESPONSE_BUDGET_MS (1s,
+            // route.ts:20) and then returns `attached` with the real pass still running
+            // in the background. We used to return that immediately, so the coordinator
+            // replanned; concurrent approve/prepare churned readyCounts, which churns
+            // stateRevision, which is hashed into actionKey/requestKey — so the NEXT
+            // iteration minted a BRAND NEW key and polled a run that had never been
+            // dispatched. scopeMatches was correctly false, and it dispatched again.
+            //
+            // Dotwork 2026-07-29 receipts: 12 DISTINCT run_scheduler_sweep keys, each
+            // dispatched exactly once, every one returning exact_action_complete with
+            // `lanesTouched: []`, coverage frozen at {sent:0, scheduled:0, ready:20}.
+            // approve_messages/prepare_messages in the same runs DID report lanesTouched.
+            // Meanwhile the scheduler itself was healthy — its own on-demand receipt
+            // placed 12 ready / 12 considered / 12 scheduled with zero skips, zero
+            // defers, zero prefilters. The sweeps simply never became scheduler runs.
+            //
+            // The key we just dispatched is in scope RIGHT HERE, so poll it here instead
+            // of trying to remember it across a replan. That matters: per-fence runState
+            // does NOT survive next_exact_target (it reset 112e's cohort guard, 112aj's
+            // counter and 112an's stall bound), so a cross-fence memory would have needed
+            // the WORKSPACE_ATTEMPT_LEDGER_KEYS allowlist. Polling in-scope needs none of
+            // that. Bounded so a slow pass still degrades to the existing in-flight
+            // handling rather than holding the tool call open.
+            for (let attempt = 0; attempt < SWEEP_SETTLE_POLL_ATTEMPTS &&
+                schedulerDispatchIsStillRunning(result); attempt += 1) {
+                await sleep(sweepSettlePollDelayMs);
+                const settled = await runSchedulerSweep({
+                    workspaceId,
+                    action: "status",
+                    targetDate,
+                    requestKey,
+                    targetShapeRevision,
+                    expectedTargetsHash,
+                    maxPlacements,
+                });
+                // Adopt the polled response ONLY when it actually settled. A status
+                // probe returns a DIFFERENT shape ({scopeMatches, running}) than a
+                // dispatch envelope ({status, receipt}); overwriting unconditionally
+                // destroyed the in-flight envelope and with it
+                // matching_scheduler_active / bounded_reread_wait / retryAfterMs, which
+                // is the handling the coordinator relies on when a run is still going.
+                // Keep the dispatch envelope until a terminal receipt exists.
+                const settledRecord = recordValue(settled);
+                if (settledRecord &&
+                    hasTerminalSchedulerReceipt(recordValue(settledRecord.receipt))) {
+                    result = settled;
+                }
+            }
             return {
                 status: "executed_and_reread",
                 result: normalizeSchedulerPrimitiveResult(result, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.746",
+  "version": "0.1.747",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",