@sellable/install/lib/sellable-agent/managed-auth-client.mjs

One-command installer for Sellable MCP in Claude Code, Codex, and Hermes

import { createConnection } from "node:net";

export const MANAGED_AUTH_ROOT = "/run/sellable-managed-auth";

export function managedAuthPath(profileId) {
  if (!/^[A-Za-z0-9_-]{1,128}$/.test(profileId ?? "")) {
    throw new Error("managed_auth_profile_rejected");
  }
  return `${MANAGED_AUTH_ROOT}/${profileId}/identity.json`;
}

function requestSupervisor(request) {
  return new Promise((resolve, reject) => {
    const connection = createConnection(`${MANAGED_AUTH_ROOT}/control.sock`);
    let response = "";
    const fail = (code) => {
      connection.destroy();
      reject(new Error(code));
    };
    connection.setTimeout(5_000, () => fail("managed_auth_supervisor_timeout"));
    connection.once("error", () => fail("managed_auth_supervisor_unavailable"));
    connection.once("connect", () => connection.write(`${JSON.stringify(request)}\n`));
    connection.on("data", (chunk) => {
      response += chunk.toString("utf8");
      if (response.length > 4096) return fail("managed_auth_response_rejected");
      if (!response.endsWith("\n")) return;
      let value;
      try {
        value = JSON.parse(response);
      } catch {
        return fail("managed_auth_response_rejected");
      }
      connection.end();
      if (value?.ok !== true) {
        return fail(/^managed_auth_[a-z_]+$/.test(value?.code ?? "")
          ? value.code : "managed_auth_response_rejected");
      }
      resolve(value);
    });
    connection.once("end", () => {
      if (!response.endsWith("\n")) fail("managed_auth_response_incomplete");
    });
  });
}

/** Called in the runtime manager process, never through an agent tool. */
export async function publishManagedAuth(binding) {
  const result = await requestSupervisor({ action: "publish", binding });
  const path = managedAuthPath(binding.profileId);
  if (result.path !== path || result.generation !== binding.agent.generation) {
    throw new Error("managed_auth_publish_readback_rejected");
  }
  return path;
}

export async function clearManagedAuth(profileId) {
  await requestSupervisor({ action: "clear", profileId });
}