@sellable/mcp 0.1.922 → 0.1.923-wip.managedauth.20260911.1

package/dist/agent-service-auth.d.ts

@@ -57,7 +57,7 @@ export type McpCredentialResolution = {
 } | {
     mode: "invalid";
     principal: null;
-    code: "invalid_agent_service_context";
+    code: "invalid_agent_service_context" | "managed_agent_auth_unavailable";
 };
 export declare function resolveMcpCredentialIntent(input: {
     env?: McpAgentEnvironment;
@@ -104,7 +104,7 @@ export declare function createMcpCredentialBoundary<T extends {
         authorization: {
             allowed: boolean;
             decision: string;
-            code: "invalid_agent_service_context";
+            code: "invalid_agent_service_context" | "managed_agent_auth_unavailable";
         };
         context?: undefined;
     } | {

package/dist/agent-service-auth.js

@@ -182,11 +182,12 @@ export function resolveMcpCredentialIntent(input) {
                 code: "invalid_agent_service_context",
             };
     }
-    catch {
+    catch (error) {
         return {
             mode: "invalid",
             principal: null,
-            code: "invalid_agent_service_context",
+            code: error instanceof Error && "code" in error && error.code === "managed_agent_auth_unavailable"
+                ? "managed_agent_auth_unavailable" : "invalid_agent_service_context",
         };
     }
 }

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+export { ManagedAgentAuthenticationError } from "./managed-agent-auth.js";
 export interface SellableEnvConfig {
     token: string;
     activeWorkspaceId?: string;
@@ -35,6 +36,8 @@ export type SkillState = {
     engage?: EngageSkillState;
 };
 export declare const DEFAULT_API_URL = "https://app.sellable.dev";
+/** Runtime identity must not depend on the mutable file it is protecting. */
+export declare function isManagedAgentRuntime(): boolean;
 /**
  * Set which config file to use. Call before getConfig().
  * - "sellable.json" (default) - production

package/dist/auth.js

@@ -4,12 +4,21 @@ import * as os from "os";
 import * as path from "path";
 import { readMcpAgentServiceContext } from "./agent-service-auth.js";
 import { getAgentScope } from "./agent-scope.js";
+import { ManagedAgentAuthenticationError, readProtectedManagedAuth } from "./managed-agent-auth.js";
+export { ManagedAgentAuthenticationError } from "./managed-agent-auth.js";
 export const DEFAULT_API_URL = "https://app.sellable.dev";
 const WORKSPACE_LOCK_ENV = "SELLABLE_LOCK_WORKSPACE_ID";
 const REQUIRE_WORKSPACE_LOCK_ENV = "SELLABLE_REQUIRE_WORKSPACE_LOCK";
 const AGENT_SERVICE_CREDENTIAL_FILE_ENV = "SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE";
 const AGENT_RUNTIME_SECRET_ROOT_ENV = "SELLABLE_AGENT_RUNTIME_SECRET_ROOT";
 const AGENT_PROFILE_ID_ENV = "SELLABLE_AGENT_PROFILE_ID";
+/** Runtime identity must not depend on the mutable file it is protecting. */
+export function isManagedAgentRuntime() {
+    return (process.env.SELLABLE_AGENT_RUNTIME === "1" ||
+        ["ADMIN", "CUSTOMER"].includes(process.env.SELLABLE_AGENT_SERVER_AUTHENTICATED_KIND ?? "") ||
+        Boolean(process.env[AGENT_SERVICE_CREDENTIAL_FILE_ENV]?.trim()) ||
+        Boolean(process.env.SELLABLE_AGENT_MANAGED_AUTH_PATH?.trim()));
+}
 // No caching — re-read config on every call so token/workspace changes
 // made by the LLM (editing sellable.json) take effect immediately
 // without requiring an MCP server restart.
@@ -201,6 +210,36 @@ export function resolveWorkspaceIdForRequest(requestedWorkspaceId, action = "Sel
     return lockedWorkspaceId;
 }
 export function getConfig() {
+    const managed = readProtectedManagedAuth();
+    if (managed) {
+        // Mutable config contains preferences only. A stale copy, missing file, or
+        // invalid JSON must not replace the service token, API origin, or identity.
+        let preferences = {};
+        try {
+            const raw = JSON.parse(fs.readFileSync(getConfigPath(), "utf8"));
+            const selected = raw?.activeEnv && raw?.environments
+                ? raw.environments[raw.activeEnv] : raw;
+            if (selected && typeof selected === "object")
+                preferences = selected;
+        }
+        catch {
+            // The supervisor binding is sufficient to keep the home workspace usable.
+        }
+        const crossWorkspace = getAgentScope() === "CROSS_WORKSPACE";
+        return {
+            token: managed.token,
+            apiUrl: managed.apiUrl,
+            workspaceId: managed.agent.workspaceId,
+            activeWorkspaceId: crossWorkspace
+                ? normalizeWorkspaceId(typeof preferences.activeWorkspaceId === "string" ? preferences.activeWorkspaceId : null) || managed.agent.workspaceId
+                : managed.agent.workspaceId,
+            ...(crossWorkspace && typeof preferences.activeWorkspaceName === "string"
+                ? { activeWorkspaceName: preferences.activeWorkspaceName } : {}),
+            ...(preferences.skillState && typeof preferences.skillState === "object"
+                ? { skillState: preferences.skillState } : {}),
+            credentialKind: "agent_service",
+        };
+    }
     // Config cache removed 2026-05-04: we always re-read from disk so
     // workspace switches (set_active_workspace) take effect immediately
     // for ALL downstream tools (list_senders, fetch_*, etc.) without
@@ -209,6 +248,8 @@ export function getConfig() {
     const configPathCandidates = getConfigPathCandidates();
     const configPath = getConfigPath();
     if (!fs.existsSync(configPath)) {
+        if (isManagedAgentRuntime())
+            throw new ManagedAgentAuthenticationError();
         throw new Error("Sellable not configured.\n\n" +
             "Run a Sellable workflow to start first-run login, for example /sellable:create-campaign in Claude Code or $sellable:create-campaign in Codex.\n\n" +
             "If the browser login page shows a manual fallback command, paste it in your terminal:\n" +
@@ -250,6 +291,10 @@ export function getConfig() {
             throw new Error(`Missing 'token' in ${configFileName}`);
         }
         if (config.token.startsWith("skt_")) {
+            // The 2026-09-11 sales cron overwrote Admin's config with a legacy
+            // personal token using cp, bypassing writeNewConfig's login guard.
+            if (isManagedAgentRuntime())
+                throw new ManagedAgentAuthenticationError();
             config.credentialKind = "human";
         }
         else if (config.token.startsWith("sat_")) {
@@ -280,6 +325,8 @@ export function getConfig() {
     }
     catch (error) {
         if (error instanceof SyntaxError) {
+            if (isManagedAgentRuntime())
+                throw new ManagedAgentAuthenticationError();
             throw new Error(`Invalid JSON in ${configPath}: ${error.message}`);
         }
         throw error;
@@ -287,6 +334,8 @@ export function getConfig() {
 }
 /** Reads only the credential class; never returns or validates credential bytes. */
 export function getConfiguredCredentialIntent() {
+    if (isManagedAgentRuntime())
+        return "agent_service";
     const configPath = getConfigPath();
     if (!fs.existsSync(configPath))
         return "unconfigured";
@@ -404,9 +453,7 @@ function writeRawConfigFile(configPath, raw) {
  * new config without an MCP server restart.
  */
 export function writeNewConfig(opts) {
-    if (process.env.SELLABLE_AGENT_RUNTIME === "1" &&
-        (process.env[AGENT_SERVICE_CREDENTIAL_FILE_ENV]?.trim() ||
-            getConfiguredCredentialIntent() === "agent_service")) {
+    if (isManagedAgentRuntime()) {
         throw new Error("Managed Agent service credentials cannot be replaced by human login");
     }
     resolveWorkspaceIdForRequest(opts.activeWorkspaceId, "write Sellable auth config");

package/dist/managed-agent-auth.d.ts

@@ -0,0 +1,20 @@
+import { type McpAgentServiceContext } from "./agent-service-auth.js";
+export interface ProtectedManagedAuth {
+    schemaVersion: "sellable-managed-auth/v1";
+    profileId: string;
+    runtimeId: string;
+    runtimeGeneration: number;
+    agentKind: "ADMIN" | "CUSTOMER";
+    apiUrl: string;
+    token: string;
+    agent: Omit<McpAgentServiceContext, "kind" | "credentialId">;
+}
+export declare class ManagedAgentAuthenticationError extends Error {
+    readonly code = "managed_agent_auth_unavailable";
+    constructor();
+}
+/**
+ * The root supervisor owns this binding and every ancestor below /run.
+ * Profile config is deliberately not an input to credential or origin selection.
+ */
+export declare function readProtectedManagedAuth(env?: NodeJS.ProcessEnv): ProtectedManagedAuth | null;

package/dist/managed-agent-auth.js

@@ -0,0 +1,72 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync } from "node:fs";
+import { readMcpAgentServiceContext } from "./agent-service-auth.js";
+const AUTH_ROOT = "/run/sellable-managed-auth";
+const MAX_BINDING_BYTES = 32768;
+export class ManagedAgentAuthenticationError extends Error {
+    code = "managed_agent_auth_unavailable";
+    constructor() {
+        super("managed_agent_auth_unavailable: The runtime supervisor must restore " +
+            "managed authentication. Do not copy a personal config or start browser login.");
+        this.name = "ManagedAgentAuthenticationError";
+    }
+}
+/**
+ * The root supervisor owns this binding and every ancestor below /run.
+ * Profile config is deliberately not an input to credential or origin selection.
+ */
+export function readProtectedManagedAuth(env = process.env) {
+    const path = env.SELLABLE_AGENT_MANAGED_AUTH_PATH?.trim();
+    if (!path)
+        return null;
+    let fd;
+    try {
+        const match = path.match(/^\/run\/sellable-managed-auth\/([A-Za-z0-9_-]{1,128})\/identity\.json$/);
+        if (!match)
+            throw new ManagedAgentAuthenticationError();
+        for (const directory of ["/run", AUTH_ROOT, `${AUTH_ROOT}/${match[1]}`]) {
+            const entry = lstatSync(directory);
+            if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== 0 || (entry.mode & 0o022) !== 0) {
+                throw new ManagedAgentAuthenticationError();
+            }
+        }
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const entry = fstatSync(fd);
+        if (!entry.isFile() || entry.uid !== 0 || (entry.mode & 0o777) !== 0o440
+            || entry.size < 1 || entry.size > MAX_BINDING_BYTES) {
+            throw new ManagedAgentAuthenticationError();
+        }
+        const value = JSON.parse(readFileSync(fd, "utf8"));
+        if (value?.schemaVersion !== "sellable-managed-auth/v1" || value.profileId !== match[1]
+            || !/^fly-runtime_[a-f0-9]{32}$/.test(value.runtimeId)
+            || !Number.isSafeInteger(value.runtimeGeneration) || value.runtimeGeneration < 1
+            || !["ADMIN", "CUSTOMER"].includes(value.agentKind)
+            || typeof value.token !== "string" || !value.token.startsWith("sat_")) {
+            throw new ManagedAgentAuthenticationError();
+        }
+        const url = new URL(value.apiUrl);
+        const testHttp = env.SELLABLE_AGENT_ALLOW_TEST_OIDC === "1" && url.protocol === "http:"
+            && ["127.0.0.1", "localhost", "host.docker.internal"].includes(url.hostname);
+        if ((url.protocol !== "https:" && !testHttp) || url.origin !== value.apiUrl || url.username || url.password) {
+            throw new ManagedAgentAuthenticationError();
+        }
+        const context = readMcpAgentServiceContext(env, value.token);
+        if (!context || !value.agent || value.agent.workspaceId !== context.workspaceId
+            || value.agent.agentId !== context.agentId || value.agent.generation !== context.generation
+            || value.agent.policyHash !== context.policyHash || !Array.isArray(value.agent.selectedChannelIds)
+            || JSON.stringify([...value.agent.selectedChannelIds].sort()) !== JSON.stringify(context.selectedChannelIds)
+            || String(value.runtimeGeneration) !== env.SELLABLE_AGENT_RUNTIME_GENERATION
+            || (env.SELLABLE_RUNTIME_ID && value.runtimeId !== env.SELLABLE_RUNTIME_ID)
+            || (env.SELLABLE_AGENT_SERVER_AUTHENTICATED_KIND && value.agentKind !== env.SELLABLE_AGENT_SERVER_AUTHENTICATED_KIND)) {
+            throw new ManagedAgentAuthenticationError();
+        }
+        return value;
+    }
+    catch {
+        // Never include JSON bytes, credentials, or attacker-controlled parse errors.
+        throw new ManagedAgentAuthenticationError();
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}

package/dist/server.js

@@ -196,8 +196,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                         type: "text",
                         text: JSON.stringify({
                             ok: false,
-                            error: "invalid_agent_service_context",
+                            error: boundary.authorization.code,
                             decision: "DENY",
+                            ...(boundary.authorization.code === "managed_agent_auth_unavailable"
+                                ? { message: "Managed authentication is unavailable. The runtime supervisor must restore it; do not copy personal credentials, start browser login, or retry a Calendar mutation automatically." }
+                                : {}),
                         }),
                     },
                 ],

package/dist/tools/cli-login.js

@@ -1,4 +1,4 @@
-import { getConfiguredCredentialIntent, writeNewConfig } from "../auth.js";
+import { isManagedAgentRuntime, writeNewConfig } from "../auth.js";
 /**
  * Sellable CLI login tools.
  *
@@ -59,9 +59,7 @@ function resolveApiUrl() {
         "https://app.sellable.dev");
 }
 function managedAgentAlreadyAuthenticated() {
-    return (process.env.SELLABLE_AGENT_RUNTIME === "1" &&
-        (Boolean(process.env.SELLABLE_AGENT_SERVICE_CREDENTIAL_FILE?.trim()) ||
-            getConfiguredCredentialIntent() === "agent_service"));
+    return isManagedAgentRuntime();
 }
 function managedAgentLoginRefusal() {
     return errorPayload("managed_agent_service_credential", "This managed Agent is already authenticated.", "Use the connected integration directly. A browser login would replace the Agent's scoped service credential and is not allowed.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.922",
+  "version": "0.1.923-wip.managedauth.20260911.1",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",