@sellable/mcp 0.1.901 → 0.1.903

package/dist/tools/cli-login.d.ts

@@ -16,7 +16,7 @@ export type WaitForCliLoginInput = {
     /** Test-only: override poll interval. Not exposed in inputSchema. */
     pollIntervalMs?: number;
 };
-type CliLoginErrorType = "rate_limited" | "send_failed" | "expired" | "already_consumed" | "timeout" | "tool_timeout_guard" | "network_error" | "not_implemented";
+type CliLoginErrorType = "rate_limited" | "send_failed" | "expired" | "already_consumed" | "timeout" | "tool_timeout_guard" | "network_error" | "managed_agent_service_credential" | "not_implemented";
 type CliLoginErrorPayload = {
     ok: false;
     error: {

package/dist/tools/cli-login.js

@@ -1,4 +1,4 @@
-import { writeNewConfig } from "../auth.js";
+import { getConfiguredCredentialIntent, writeNewConfig } from "../auth.js";
 /**
  * Sellable CLI login tools.
  *
@@ -58,6 +58,13 @@ function resolveApiUrl() {
         process.env.SELLABLE_BASE_URL ??
         "https://app.sellable.dev");
 }
+function managedAgentAlreadyAuthenticated() {
+    return (process.env.SELLABLE_AGENT_RUNTIME === "1" &&
+        getConfiguredCredentialIntent() === "agent_service");
+}
+function managedAgentLoginRefusal() {
+    return errorPayload("managed_agent_service_credential", "This managed Agent is already authenticated.", "Use the connected integration directly. A browser login would replace the Agent's scoped service credential and is not allowed.");
+}
 export const startCliLoginToolDef = {
     name: "start_cli_login",
     description: "Start the CLI login handoff. Triggers a magic-link email to the supplied email address. " +
@@ -97,6 +104,9 @@ export const waitForCliLoginToolDef = {
     },
 };
 export async function handleStartCliLogin(args) {
+    if (managedAgentAlreadyAuthenticated()) {
+        return managedAgentLoginRefusal();
+    }
     const apiUrl = resolveApiUrl();
     let res;
     try {
@@ -174,6 +184,9 @@ export async function handleWaitForCliLogin(args) {
                 continue;
             }
             if (body.status === "ready") {
+                if (managedAgentAlreadyAuthenticated()) {
+                    return managedAgentLoginRefusal();
+                }
                 const { configPath } = writeNewConfig({
                     token: body.token,
                     activeWorkspaceId: body.activeWorkspaceId,

package/dist/tools/integrations.d.ts

@@ -77,6 +77,28 @@ export type IntegrationsResultEnvelope = {
     guidance: string | null;
     result: unknown;
 };
+/**
+ * A local Fly/Hermes path has no meaning inside Pipedream's cloud action runner.
+ * The live Gmail actions hand each `attachments[]` value to Nodemailer as
+ * `attachment.path`; Nodemailer accepts a data URI there, so a small PDF can cross
+ * the existing JSON call without a public bucket or a durable File Stash.
+ *
+ * Two MiB keeps the base64 body below the call route's dedicated 3 MiB ceiling.
+ * This is intentionally narrower than Gmail's own attachment limit: it is the
+ * bounded hot path for receipts and similar one-page PDFs, not a general file
+ * transfer service.
+ */
+export declare const INTEGRATION_LOCAL_PDF_MAX_BYTES: number;
+/**
+ * Materialize only the two live Gmail actions whose file-ref contract is known.
+ * Remote URLs/data URIs remain byte-identical. Endpoint-run effects are already
+ * authorized against their original argument hash, so they may not introduce a
+ * local path that would change after authorization.
+ */
+export declare function materializeIntegrationLocalPdfAttachments(toolName: string, args: Record<string, unknown>, options: {
+    allowLocal: boolean;
+    env?: NodeJS.ProcessEnv;
+}): Promise<Record<string, unknown>>;
 type IntegrationHomeWorkspacePin = {
     ok: true;
     workspaceId?: string;

package/dist/tools/integrations.js

@@ -1,3 +1,6 @@
+import { lstat, open, realpath } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import { readMcpAgentServiceContext } from "../agent-service-auth.js";
 import { getApi, SellableApiError } from "../api.js";
 import { getConfig } from "../auth.js";
@@ -92,6 +95,152 @@ const CALL_PATH = "/api/v3/sellable-agent/integrations/tools/call";
  */
 const READ_TIMEOUT_MS = 25_000;
 const CALL_TIMEOUT_MS = 45_000;
+/**
+ * A local Fly/Hermes path has no meaning inside Pipedream's cloud action runner.
+ * The live Gmail actions hand each `attachments[]` value to Nodemailer as
+ * `attachment.path`; Nodemailer accepts a data URI there, so a small PDF can cross
+ * the existing JSON call without a public bucket or a durable File Stash.
+ *
+ * Two MiB keeps the base64 body below the call route's dedicated 3 MiB ceiling.
+ * This is intentionally narrower than Gmail's own attachment limit: it is the
+ * bounded hot path for receipts and similar one-page PDFs, not a general file
+ * transfer service.
+ */
+export const INTEGRATION_LOCAL_PDF_MAX_BYTES = 2 * 1024 * 1024;
+const GMAIL_FILE_ATTACHMENT_TOOLS = new Set([
+    "gmail-create-draft",
+    "gmail-send-email",
+]);
+const PDF_MAGIC = Object.freeze([0x25, 0x50, 0x44, 0x46, 0x2d]);
+class IntegrationLocalAttachmentError extends Error {
+    constructor() {
+        super("integration_local_attachment_rejected");
+        this.name = "IntegrationLocalAttachmentError";
+    }
+}
+function localAttachmentRefusal() {
+    return envelope({
+        ok: false,
+        outcome: "refused",
+        attribution: "configuration",
+        error: "integration_local_attachment_rejected",
+        guidance: "Attach a regular PDF under the Agent's writable media directory or /tmp; local PDFs are limited to 2 MiB total.",
+    });
+}
+function withinRoot(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return (relative === "" ||
+        (relative !== ".." &&
+            !relative.startsWith(`..${path.sep}`) &&
+            !path.isAbsolute(relative)));
+}
+async function allowedLocalAttachmentRoots(env) {
+    const candidates = [env.HERMES_WRITE_SAFE_ROOT?.trim(), os.tmpdir()].filter((value) => Boolean(value && path.isAbsolute(value)));
+    const roots = await Promise.all([...new Set(candidates)].map(async (candidate) => {
+        try {
+            return await realpath(candidate);
+        }
+        catch {
+            return null;
+        }
+    }));
+    return roots.filter((value) => Boolean(value));
+}
+async function localPdfDataUri(localPath, filename, remainingBytes, env) {
+    if (!path.isAbsolute(localPath) ||
+        filename.length < 1 ||
+        filename.length > 160 ||
+        path.basename(filename) !== filename ||
+        !filename.toLowerCase().endsWith(".pdf") ||
+        /[\u0000-\u001f\u007f]/.test(filename)) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    const [entry, resolved, roots] = await Promise.all([
+        lstat(localPath),
+        realpath(localPath),
+        allowedLocalAttachmentRoots(env),
+    ]).catch(() => {
+        throw new IntegrationLocalAttachmentError();
+    });
+    if (entry.isSymbolicLink() ||
+        !roots.some((root) => withinRoot(root, resolved))) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    const handle = await open(resolved, "r").catch(() => {
+        throw new IntegrationLocalAttachmentError();
+    });
+    let bytes;
+    try {
+        const opened = await handle.stat();
+        if (!entry.isFile() ||
+            !opened.isFile() ||
+            opened.dev !== entry.dev ||
+            opened.ino !== entry.ino ||
+            opened.size < PDF_MAGIC.length ||
+            opened.size > remainingBytes) {
+            throw new IntegrationLocalAttachmentError();
+        }
+        bytes = new Uint8Array(new ArrayBuffer(opened.size));
+        let offset = 0;
+        while (offset < opened.size) {
+            const chunk = await handle.read(bytes, offset, opened.size - offset, offset);
+            if (chunk.bytesRead < 1)
+                throw new IntegrationLocalAttachmentError();
+            offset += chunk.bytesRead;
+        }
+    }
+    catch (error) {
+        if (error instanceof IntegrationLocalAttachmentError)
+            throw error;
+        throw new IntegrationLocalAttachmentError();
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+    if (!PDF_MAGIC.every((byte, index) => bytes[index] === byte)) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    return {
+        dataUri: `data:application/pdf;base64,${Buffer.from(bytes).toString("base64")}`,
+        bytes: bytes.byteLength,
+    };
+}
+/**
+ * Materialize only the two live Gmail actions whose file-ref contract is known.
+ * Remote URLs/data URIs remain byte-identical. Endpoint-run effects are already
+ * authorized against their original argument hash, so they may not introduce a
+ * local path that would change after authorization.
+ */
+export async function materializeIntegrationLocalPdfAttachments(toolName, args, options) {
+    if (!GMAIL_FILE_ATTACHMENT_TOOLS.has(toolName))
+        return args;
+    const attachments = args.attachments;
+    if (!Array.isArray(attachments) || attachments.length === 0)
+        return args;
+    const filenames = args.attachmentFilenames;
+    if (!Array.isArray(filenames) || filenames.length !== attachments.length) {
+        throw new IntegrationLocalAttachmentError();
+    }
+    let remainingBytes = INTEGRATION_LOCAL_PDF_MAX_BYTES;
+    const materialized = [];
+    for (let index = 0; index < attachments.length; index += 1) {
+        const attachment = attachments[index];
+        const filename = filenames[index];
+        if (typeof attachment !== "string" || typeof filename !== "string") {
+            throw new IntegrationLocalAttachmentError();
+        }
+        if (/^(?:https?:|data:)/i.test(attachment)) {
+            materialized.push(attachment);
+            continue;
+        }
+        if (!options.allowLocal)
+            throw new IntegrationLocalAttachmentError();
+        const converted = await localPdfDataUri(attachment, filename, remainingBytes, options.env ?? process.env);
+        materialized.push(converted.dataUri);
+        remainingBytes -= converted.bytes;
+    }
+    return { ...args, attachments: materialized };
+}
 /**
  * Mirror the home-workspace consistency invariant owned by
  * `readMcpAgentServiceContext`. Customer profiles prove home with the customer
@@ -364,6 +513,9 @@ export function toolError(action, error) {
         catch {
             // Plain-text body; fall through to the generic shape below.
         }
+        const structuredRouteRefusal = typeof forwarded.error === "string" ||
+            typeof forwarded.outcome === "string" ||
+            typeof forwarded.attribution === "string";
         return envelope({
             ok: false,
             outcome: typeof forwarded.outcome === "string" ? forwarded.outcome : "refused",
@@ -377,7 +529,9 @@ export function toolError(action, error) {
                 : `integration_${action}_failed`,
             guidance: typeof forwarded.guidance === "string"
                 ? forwarded.guidance
-                : (error.guidance ?? null),
+                : structuredRouteRefusal
+                    ? null
+                    : (error.guidance ?? null),
             result: forwarded.detail ?? null,
         });
     }
@@ -599,17 +753,20 @@ export async function integrationsCallTool(input = {}, actor, agentEffectId) {
         return home.envelope;
     try {
         const endpointContext = isEndpointIntegrationContext(actor);
+        const callArguments = args
+            ? await materializeIntegrationLocalPdfAttachments(tool.toolName, args, { allowLocal: !endpointContext })
+            : null;
         const body = endpointContext
             ? {
                 ...selector.selector,
                 toolName: tool.toolName,
-                ...(args ? { arguments: args } : {}),
+                ...(callArguments ? { arguments: callArguments } : {}),
                 ...trustedIntegrationContextBody(actor, "DISPATCH"),
             }
             : {
                 ...selector.selector,
                 toolName: tool.toolName,
-                ...(args ? { arguments: args } : {}),
+                ...(callArguments ? { arguments: callArguments } : {}),
                 ...(typeof input.approvalId === "string" && input.approvalId
                     ? { approvalId: input.approvalId }
                     : {}),
@@ -623,6 +780,9 @@ export async function integrationsCallTool(input = {}, actor, agentEffectId) {
         return normalizeRouteResult(response);
     }
     catch (error) {
+        if (error instanceof IntegrationLocalAttachmentError) {
+            return localAttachmentRefusal();
+        }
         return toolError("call_tool", error);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.901",
+  "version": "0.1.903",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",