@sellable/mcp 0.1.901 → 0.1.902

package/dist/tools/cli-login.d.ts

@@ -16,7 +16,7 @@ export type WaitForCliLoginInput = {
     /** Test-only: override poll interval. Not exposed in inputSchema. */
     pollIntervalMs?: number;
 };
-type CliLoginErrorType = "rate_limited" | "send_failed" | "expired" | "already_consumed" | "timeout" | "tool_timeout_guard" | "network_error" | "not_implemented";
+type CliLoginErrorType = "rate_limited" | "send_failed" | "expired" | "already_consumed" | "timeout" | "tool_timeout_guard" | "network_error" | "managed_agent_service_credential" | "not_implemented";
 type CliLoginErrorPayload = {
     ok: false;
     error: {

package/dist/tools/cli-login.js

@@ -1,4 +1,4 @@
-import { writeNewConfig } from "../auth.js";
+import { getConfiguredCredentialIntent, writeNewConfig } from "../auth.js";
 /**
  * Sellable CLI login tools.
  *
@@ -58,6 +58,13 @@ function resolveApiUrl() {
         process.env.SELLABLE_BASE_URL ??
         "https://app.sellable.dev");
 }
+function managedAgentAlreadyAuthenticated() {
+    return (process.env.SELLABLE_AGENT_RUNTIME === "1" &&
+        getConfiguredCredentialIntent() === "agent_service");
+}
+function managedAgentLoginRefusal() {
+    return errorPayload("managed_agent_service_credential", "This managed Agent is already authenticated.", "Use the connected integration directly. A browser login would replace the Agent's scoped service credential and is not allowed.");
+}
 export const startCliLoginToolDef = {
     name: "start_cli_login",
     description: "Start the CLI login handoff. Triggers a magic-link email to the supplied email address. " +
@@ -97,6 +104,9 @@ export const waitForCliLoginToolDef = {
     },
 };
 export async function handleStartCliLogin(args) {
+    if (managedAgentAlreadyAuthenticated()) {
+        return managedAgentLoginRefusal();
+    }
     const apiUrl = resolveApiUrl();
     let res;
     try {
@@ -174,6 +184,9 @@ export async function handleWaitForCliLogin(args) {
                 continue;
             }
             if (body.status === "ready") {
+                if (managedAgentAlreadyAuthenticated()) {
+                    return managedAgentLoginRefusal();
+                }
                 const { configPath } = writeNewConfig({
                     token: body.token,
                     activeWorkspaceId: body.activeWorkspaceId,

package/dist/tools/integrations.js

@@ -364,6 +364,9 @@ export function toolError(action, error) {
         catch {
             // Plain-text body; fall through to the generic shape below.
         }
+        const structuredRouteRefusal = typeof forwarded.error === "string" ||
+            typeof forwarded.outcome === "string" ||
+            typeof forwarded.attribution === "string";
         return envelope({
             ok: false,
             outcome: typeof forwarded.outcome === "string" ? forwarded.outcome : "refused",
@@ -377,7 +380,9 @@ export function toolError(action, error) {
                 : `integration_${action}_failed`,
             guidance: typeof forwarded.guidance === "string"
                 ? forwarded.guidance
-                : (error.guidance ?? null),
+                : structuredRouteRefusal
+                    ? null
+                    : (error.guidance ?? null),
             result: forwarded.detail ?? null,
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.901",
+  "version": "0.1.902",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",