@sellable/install 0.1.205 → 0.1.208

package/README.md

@@ -3,19 +3,27 @@
 Installs Sellable MCP for Claude Code and Codex.
 
 ```bash
-npx -y @sellable/install@latest --host all
+curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh
 ```
 
-Paste that command in your terminal, not inside the Codex chat. Mac/Linux
-users can use Terminal. Windows users can use PowerShell or Windows Terminal;
-if PowerShell blocks `npx`, run:
+Paste that command in your terminal, not inside the Codex chat. It downloads a
+reviewable bootstrapper that installs or reuses Node >=20, runs
+`@sellable/install`, and verifies the Sellable MCP runtime.
+
+Windows users can use PowerShell or Windows Terminal:
 
 ```powershell
-npx.cmd -y @sellable/install@latest --host all
+iwr "https://app.sellable.dev/api/v2/cli/install.ps1" | iex
 ```
 
 After install, restart Codex Desktop so the Sellable skill appears.
 
+Verify the runtime tools with:
+
+```bash
+sellable --verify-only --host all --json --artifact "$HOME/.local/sellable/app-sellable-dev/installer/.last-verify.json"
+```
+
 After install, `sellable create` is a terminal helper that prints the correct
 agent command for launching a campaign:
 
@@ -33,7 +41,7 @@ Sellable sign-in on the first campaign run with a magic-link handoff.
 The installer uses package stdio MCP by default:
 
 ```bash
-npx -y @sellable/mcp@latest
+npm exec --yes --package @sellable/mcp@latest -- sellable-mcp
 ```
 
 That keeps new Claude Code/Codex MCP starts on the latest stable package. The
@@ -41,6 +49,21 @@ MCP server also checks npm at startup and during `get_auth_status`, caching the
 result at `~/.sellable/update-check.json` so users are prompted to rerun the
 latest installer only when an update is actually available.
 
+Agents should use the agent-readable handoff instead of guessing commands:
+
+```text
+Install Sellable CLI and skills using https://app.sellable.dev/agent-install.txt
+```
+
+The direct npm installer is only a package-level troubleshooting fallback for
+maintainers. Public installs should keep using the curl endpoint above because
+it bootstraps Node, repairs legacy state, installs skills, and runs runtime
+verification in one path:
+
+```bash
+curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh
+```
+
 For CI/scripted installs, get a Sellable API token from:
 
 ```text

package/bin/sellable-install.mjs

@@ -14,6 +14,10 @@ import { homedir } from "node:os";
 import { dirname, join, relative } from "node:path";
 import { stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
+import {
+  REQUIRED_SELLABLE_MCP_TOOLS,
+  verifySellableMcpRuntime,
+} from "../lib/runtime-verify.mjs";
 
 const DEFAULT_API_URL = "https://app.sellable.dev";
 const DEFAULT_SERVER_PACKAGE =
@@ -153,6 +157,8 @@ Options:
   --verbose                 Print every file write and shell command.
   --dry-run                 Print actions without writing or running host commands.
   --verify-only             Verify installed host config where possible.
+  --json                    Print machine-readable verification JSON.
+  --artifact <path>         Write verification JSON to a file.
   --help                    Show help.
 
 Auth:
@@ -201,7 +207,9 @@ function printCreateCommandHint() {
   console.log(`    ${C.grey}If those commands are missing, run:${C.reset}`);
   console.log("");
   console.log(`      ${C.cyan}sellable --host all${C.reset}`);
-  console.log(`      ${C.cyan}sellable --verify-only --host all${C.reset}`);
+  console.log(
+    `      ${C.cyan}sellable --verify-only --host all --json${C.reset}`
+  );
   console.log("");
 }
 
@@ -217,6 +225,8 @@ function parseArgs(argv) {
     hostedUrl: process.env.SELLABLE_MCP_HOSTED_URL || "",
     dryRun: false,
     verifyOnly: false,
+    json: false,
+    artifactPath: process.env.SELLABLE_VERIFY_ARTIFACT || "",
     verbose: false,
   };
 
@@ -253,6 +263,10 @@ function parseArgs(argv) {
       opts.dryRun = true;
     } else if (arg === "--verify-only") {
       opts.verifyOnly = true;
+    } else if (arg === "--json") {
+      opts.json = true;
+    } else if (arg === "--artifact") {
+      opts.artifactPath = next();
     } else if (arg === "--verbose") {
       opts.verbose = true;
     } else {
@@ -310,7 +324,7 @@ function commandExists(command, platform = process.platform) {
     ? spawnSync("where.exe", [command], {
         encoding: "utf8",
       })
-    : spawnSync("sh", ["-lc", `command -v ${command}`], {
+    : spawnSync("sh", ["-c", `command -v ${command}`], {
         encoding: "utf8",
       });
   return result.status === 0;
@@ -321,7 +335,7 @@ function commandExistsDetails(command, platform = process.platform) {
     ? spawnSync("where.exe", [command], {
         encoding: "utf8",
       })
-    : spawnSync("sh", ["-lc", `command -v ${command}`], {
+    : spawnSync("sh", ["-c", `command -v ${command}`], {
         encoding: "utf8",
       });
   return {
@@ -331,6 +345,10 @@ function commandExistsDetails(command, platform = process.platform) {
   };
 }
 
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
 function getMcpVersion() {
   try {
     const r = spawnSync(
@@ -710,6 +728,12 @@ person/company this campaign is for, then I’ll turn that into a campaign brief
 before anything is created.
 \`\`\`
 
+Exception: if \`bootstrap_create_campaign.modelQuality.status === "warn"\`,
+the first visible campaign message must be the model-quality warning from
+\`modelQuality.message\`. Ask the user to switch to the configured minimum model
+or explicitly continue anyway before identity setup, research, lead filtering,
+message generation, or launch review.
+
 If a linked/local skill file is stale or missing, silently use the installed
 \`sellable@sellable\` plugin copy. Do not tell the user about the stale link,
 the old version, or the replacement path.
@@ -1127,12 +1151,15 @@ there.
 MCP tool access is required. First call \`mcp__sellable__get_auth_status({})\`
 directly. If that tool is unavailable, stop and say this is a Codex
 install/reload problem, not a campaign problem. Tell the user to
-run \`npx -y ${INSTALL_PACKAGE_SPEC} --host all\` so the packaged MCP server,
-Codex Desktop plugin, and Sellable skill bundle are installed. If they want a
-CLI verification, tell them to run \`sellable --verify-only --host all\`. After
-that, they must fully quit and reopen Codex Desktop before starting a new
-thread. Do not use \`scripts/mcp/sellable-tool-call.mjs\`, \`npm run\`,
-\`node\`, or any local harness as a fallback for this interactive skill.
+run \`curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh\` so the
+packaged MCP server, Codex Desktop plugin, and Sellable skill bundle are
+installed. If they want an agent-readable checklist, tell them:
+\`Install Sellable CLI and skills using https://app.sellable.dev/agent-install.txt\`.
+For CLI verification, tell them to run
+\`sellable --verify-only --host all --json --artifact "$HOME/.local/sellable/app-sellable-dev/installer/.last-verify.json"\`.
+After that, they must fully quit and reopen Codex Desktop before starting a new
+thread. Do not use \`scripts/mcp/sellable-tool-call.mjs\`, \`npm run\`, \`node\`,
+or any local harness as a fallback for this interactive skill.
 Do not mention prompt loading, local skill files, missing linked versions,
 plugin cache paths, MCP namespaces, or runbooks in customer-facing progress
 updates.
@@ -1144,8 +1171,11 @@ updates.
    - Do not call \`mcp__sellable__get_campaigns\`.
    - Do not call \`mcp__sellable__get_campaign\` to hunt for IDs.
    - Do not call \`mcp__sellable__create_campaign({ campaignId: ... })\` unless the user supplied that id.
-5. Call \`mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId? })\`.
+5. Call \`mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId?, host?, model?, reasoningEffort? })\`.
+   Pass the current host, model, and reasoning when the host exposes them.
 6. If \`safeToProceed !== true\`, stop and show \`blockingErrors\` + \`nextStep\`.
+7. If \`modelQuality.status === "warn"\`, show \`modelQuality.message\` before any
+   setup/research and wait for the user to switch or explicitly continue.
 
 ## Execute Workflow
 
@@ -1285,7 +1315,7 @@ local harness scripts, or read local prompt files to emulate this workflow.
 
 If the Sellable MCP tool is unavailable, stop and say this is a Codex
 install/reload problem. Tell the user to run
-\`npx -y ${INSTALL_PACKAGE_SPEC} --host all\`, fully quit and reopen Codex
+\`curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh\`, fully quit and reopen Codex
 Desktop, then start a new thread.
 
 1. Call \`mcp__sellable__get_auth_status({})\`.
@@ -1333,7 +1363,7 @@ emulate this workflow.
 
 If the Sellable MCP prompt tools are unavailable, stop and say this is a Codex
 install/reload problem. Tell the user to run
-\`npx -y ${INSTALL_PACKAGE_SPEC} --host all\`, fully quit and reopen Codex
+\`curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh\`, fully quit and reopen Codex
 Desktop, then start a new thread.
 
 ## Execute Workflow
@@ -1410,7 +1440,7 @@ emulate this workflow.
 
 If the Sellable MCP prompt tools are unavailable, stop and say this is a Codex
 install/reload problem. Tell the user to run
-\`npx -y ${INSTALL_PACKAGE_SPEC} --host all\`, fully quit and reopen Codex
+\`curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh\`, fully quit and reopen Codex
 Desktop, then start a new thread.
 
 ## Execute Workflow
@@ -1482,7 +1512,7 @@ emulate this workflow.
 
 If the Sellable MCP prompt tools are unavailable, stop and say this is a Codex
 install/reload problem. Tell the user to run
-\`npx -y ${INSTALL_PACKAGE_SPEC} --host all\`, fully quit and reopen Codex
+\`curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh\`, fully quit and reopen Codex
 Desktop, then start a new thread.
 
 ## Execute Workflow
@@ -2141,11 +2171,33 @@ function writeAuth(opts) {
 }
 
 function installSelfShim(opts) {
-  const binPath = join(homedir(), ".local", "bin", "sellable");
+  const installDir =
+    process.env.SELLABLE_INSTALL_DIR || join(homedir(), ".local", "bin");
+  const binPath = join(installDir, "sellable");
+  const npmCommand =
+    process.env.SELLABLE_INSTALL_NPM_COMMAND || packageManagerCommand();
+  const nodeBin = process.env.SELLABLE_INSTALL_NODE_BIN || "";
+  const pathPrefix = nodeBin
+    ? `PATH=${shellQuote(nodeBin)}:$PATH\nexport PATH\n`
+    : "";
   const shim = `#!/usr/bin/env sh
-exec npx -y ${INSTALL_PACKAGE_SPEC} "$@"
+${pathPrefix}
+exec ${shellQuote(npmCommand)} exec --yes --package ${shellQuote(INSTALL_PACKAGE_SPEC)} -- sellable "$@"
 `;
   writeFile(binPath, shim, opts, 0o755);
+
+  const shouldWriteCmdShim =
+    isWindowsPlatform() || process.env.SELLABLE_INSTALL_WRITE_CMD_SHIM === "1";
+  if (shouldWriteCmdShim) {
+    const cmdPath = `${binPath}.cmd`;
+    const npmCmdCommand =
+      process.env.SELLABLE_INSTALL_NPM_CMD_COMMAND ||
+      process.env.SELLABLE_INSTALL_NPM_COMMAND ||
+      packageManagerCommand("win32");
+    const cmdPathPrefix = nodeBin ? `set "PATH=${nodeBin};%PATH%"\r\n` : "";
+    const cmdShim = `@echo off\r\n${cmdPathPrefix}"${npmCmdCommand}" exec --yes --package ${INSTALL_PACKAGE_SPEC} -- sellable %*\r\n`;
+    writeFile(cmdPath, cmdShim, opts, 0o755);
+  }
 }
 
 const WATCH_MODE_DRIVER_ENV = {
@@ -2171,7 +2223,10 @@ function withHostedWatchModeDriver(rawUrl, driver) {
 
 function mcpCommand(opts) {
   if (opts.server === "package") {
-    return [packageRunnerCommand(), ["-y", opts.mcpPackage]];
+    return [
+      packageManagerCommand(),
+      ["exec", "--yes", "--package", opts.mcpPackage, "--", "sellable-mcp"],
+    ];
   }
   if (opts.server === "local") {
     if (!opts.localCommand) {
@@ -2350,7 +2405,16 @@ function installCodex(opts) {
   return { installed: true, ...info };
 }
 
-function verify(opts) {
+function requiredCheck(ok, label) {
+  return { ok, label, required: true };
+}
+
+function warningCheck(ok, label) {
+  return { ok, label, required: false };
+}
+
+async function verify(opts) {
+  const startedAt = new Date().toISOString();
   const stored = readStoredAuth();
   const checks = [];
   const hasWatchModeDriverMarker = (content, driver) =>
@@ -2359,45 +2423,52 @@ function verify(opts) {
     ) || new RegExp(`[?&]driver=${driver}(?:\\b|&)`).test(content);
 
   if (stored?.token && stored?.workspaceId) {
-    checks.push({ ok: true, label: `Auth config: ${authPath()}` });
+    checks.push(warningCheck(true, `Auth config: ${authPath()}`));
   } else {
-    checks.push({
-      ok: true,
-      label: `Auth: not yet signed in — sign in on first run of /sellable:create-campaign`,
-    });
+    checks.push(
+      warningCheck(
+        true,
+        `Auth: not yet signed in — sign in on first run of /sellable:create-campaign`
+      )
+    );
   }
 
   if (opts.host === "claude" || opts.host === "all") {
-    checks.push({
-      ok: commandExists("claude"),
-      label: commandExists("claude")
-        ? "Claude CLI present"
-        : "Claude CLI missing",
-    });
+    const hasClaudeCli = commandExists("claude");
+    checks.push(
+      warningCheck(
+        hasClaudeCli,
+        hasClaudeCli ? "Claude CLI present" : "Claude CLI missing"
+      )
+    );
     const claudeAgentPaths = claudeCustomAgents().map((agent) =>
       join(claudeHome(), "agents", agent.filename)
     );
     const hasClaudeScouts = claudeAgentPaths.every((agentPath) =>
       existsSync(agentPath)
     );
-    checks.push({
-      ok: hasClaudeScouts,
-      label: hasClaudeScouts
-        ? "Claude custom agents present"
-        : "Claude custom agents missing",
-    });
+    checks.push(
+      warningCheck(
+        hasClaudeScouts,
+        hasClaudeScouts
+          ? "Claude custom agents present"
+          : "Claude custom agents missing"
+      )
+    );
     const claudeAgentsHaveTools = claudeCustomAgents().every((agent) => {
       const agentPath = join(claudeHome(), "agents", agent.filename);
       if (!existsSync(agentPath)) return false;
       const content = readFileSync(agentPath, "utf8");
       return agent.tools.every((tool) => content.includes(tool));
     });
-    checks.push({
-      ok: claudeAgentsHaveTools,
-      label: claudeAgentsHaveTools
-        ? "Claude custom agent MCP tool allowlists present"
-        : "Claude custom agent MCP tool allowlists missing",
-    });
+    checks.push(
+      warningCheck(
+        claudeAgentsHaveTools,
+        claudeAgentsHaveTools
+          ? "Claude custom agent MCP tool allowlists present"
+          : "Claude custom agent MCP tool allowlists missing"
+      )
+    );
     const legacyClaudePaths = [
       ...legacyClaudeCustomAgents().map((agent) =>
         join(claudeHome(), "agents", agent.filename)
@@ -2409,12 +2480,14 @@ function verify(opts) {
     const hasNoLegacyClaudeArtifacts = legacyClaudePaths.every(
       (artifactPath) => !existsSync(artifactPath)
     );
-    checks.push({
-      ok: hasNoLegacyClaudeArtifacts,
-      label: hasNoLegacyClaudeArtifacts
-        ? "Legacy Claude Sellable host artifacts cleaned"
-        : "Legacy Claude Sellable host artifacts still present",
-    });
+    checks.push(
+      warningCheck(
+        hasNoLegacyClaudeArtifacts,
+        hasNoLegacyClaudeArtifacts
+          ? "Legacy Claude Sellable host artifacts cleaned"
+          : "Legacy Claude Sellable host artifacts still present"
+      )
+    );
     const claudeJsonPath = join(homedir(), ".claude.json");
     const claudeConfigContent = existsSync(claudeJsonPath)
       ? readFileSync(claudeJsonPath, "utf8")
@@ -2423,18 +2496,23 @@ function verify(opts) {
       claudeConfigContent,
       "claude"
     );
-    checks.push({
-      ok: hasClaudeWatchModeDriver,
-      label: hasClaudeWatchModeDriver
-        ? "Claude watch mode driver pinned to claude"
-        : "Claude watch mode driver missing",
-    });
+    checks.push(
+      warningCheck(
+        hasClaudeWatchModeDriver,
+        hasClaudeWatchModeDriver
+          ? "Claude watch mode driver pinned to claude"
+          : "Claude watch mode driver missing"
+      )
+    );
   }
   if (opts.host === "codex" || opts.host === "all") {
-    checks.push({
-      ok: commandExists("codex"),
-      label: commandExists("codex") ? "Codex CLI present" : "Codex CLI missing",
-    });
+    const hasCodexCli = commandExists("codex");
+    checks.push(
+      warningCheck(
+        hasCodexCli,
+        hasCodexCli ? "Codex CLI present" : "Codex CLI missing"
+      )
+    );
     const pluginPath = join(
       codexHome(),
       "plugins",
@@ -2461,30 +2539,36 @@ function verify(opts) {
     const hasSkillBundles = skillPaths.every((skillPath) =>
       existsSync(skillPath)
     );
-    checks.push({
-      ok: existsSync(pluginPath),
-      label: existsSync(pluginPath)
-        ? "Codex Desktop plugin present"
-        : "Codex Desktop plugin missing",
-    });
-    checks.push({
-      ok: hasSkillBundles,
-      label: hasSkillBundles
-        ? "Codex skill bundles present"
-        : "Codex skill bundles missing",
-    });
+    checks.push(
+      warningCheck(
+        existsSync(pluginPath),
+        existsSync(pluginPath)
+          ? "Codex Desktop plugin present"
+          : "Codex Desktop plugin missing"
+      )
+    );
+    checks.push(
+      warningCheck(
+        hasSkillBundles,
+        hasSkillBundles
+          ? "Codex skill bundles present"
+          : "Codex skill bundles missing"
+      )
+    );
     const codexAgentPaths = codexCustomAgents().map((agent) =>
       join(codexHome(), "agents", agent.filename)
     );
     const hasCodexScouts = codexAgentPaths.every((agentPath) =>
       existsSync(agentPath)
     );
-    checks.push({
-      ok: hasCodexScouts,
-      label: hasCodexScouts
-        ? "Codex custom agents present"
-        : "Codex custom agents missing",
-    });
+    checks.push(
+      warningCheck(
+        hasCodexScouts,
+        hasCodexScouts
+          ? "Codex custom agents present"
+          : "Codex custom agents missing"
+      )
+    );
     const configPath = join(codexHome(), "config.toml");
     const configContent = existsSync(configPath)
       ? readFileSync(configPath, "utf8")
@@ -2506,27 +2590,33 @@ function verify(opts) {
       pluginMcpContent,
       "codex"
     );
-    checks.push({
-      ok: hasCodexMcpDriver,
-      label: hasCodexMcpDriver
-        ? "Codex CLI watch mode driver pinned to codex"
-        : "Codex CLI watch mode driver missing",
-    });
-    checks.push({
-      ok: hasCodexPluginDriver,
-      label: hasCodexPluginDriver
-        ? "Codex Desktop plugin watch mode driver pinned to codex"
-        : "Codex Desktop plugin watch mode driver missing",
-    });
+    checks.push(
+      warningCheck(
+        hasCodexMcpDriver,
+        hasCodexMcpDriver
+          ? "Codex CLI watch mode driver pinned to codex"
+          : "Codex CLI watch mode driver missing"
+      )
+    );
+    checks.push(
+      warningCheck(
+        hasCodexPluginDriver,
+        hasCodexPluginDriver
+          ? "Codex Desktop plugin watch mode driver pinned to codex"
+          : "Codex Desktop plugin watch mode driver missing"
+      )
+    );
     const hasCodexAgentRegistrations = codexCustomAgents().every((agent) =>
       configContent.includes(`[agents.${agent.name}]`)
     );
-    checks.push({
-      ok: hasCodexAgentRegistrations,
-      label: hasCodexAgentRegistrations
-        ? "Codex custom agents registered"
-        : "Codex custom agents unregistered",
-    });
+    checks.push(
+      warningCheck(
+        hasCodexAgentRegistrations,
+        hasCodexAgentRegistrations
+          ? "Codex custom agents registered"
+          : "Codex custom agents unregistered"
+      )
+    );
     const hasNoLegacyCodexAgents = legacyCodexCustomAgents().every((agent) => {
       const agentPath = join(codexHome(), "agents", agent.filename);
       return (
@@ -2534,27 +2624,126 @@ function verify(opts) {
         !configContent.includes(`[agents.${agent.name}]`)
       );
     });
-    checks.push({
-      ok: hasNoLegacyCodexAgents,
-      label: hasNoLegacyCodexAgents
-        ? "Legacy Codex custom agents cleaned"
-        : "Legacy Codex custom agents still present",
-    });
+    checks.push(
+      warningCheck(
+        hasNoLegacyCodexAgents,
+        hasNoLegacyCodexAgents
+          ? "Legacy Codex custom agents cleaned"
+          : "Legacy Codex custom agents still present"
+      )
+    );
     const hasFlag = configContent.includes(
       "default_mode_request_user_input = true"
     );
-    checks.push({
-      ok: hasFlag,
-      label: hasFlag
-        ? "Codex Default-mode request_user_input enabled"
-        : "Codex Default-mode request_user_input missing",
+    checks.push(
+      warningCheck(
+        hasFlag,
+        hasFlag
+          ? "Codex Default-mode request_user_input enabled"
+          : "Codex Default-mode request_user_input missing"
+      )
+    );
+  }
+
+  let runtimeMcp;
+  try {
+    const [command, args] = mcpCommand(opts);
+    runtimeMcp = await verifySellableMcpRuntime({
+      command,
+      args,
+      cwd: process.cwd(),
+      env: {
+        ...process.env,
+        SELLABLE_API_URL: opts.apiUrl,
+        SELLABLE_TOKEN: opts.token || process.env.SELLABLE_TOKEN || "",
+        SELLABLE_WORKSPACE_ID:
+          opts.workspaceId || process.env.SELLABLE_WORKSPACE_ID || "",
+      },
+      requiredTools: REQUIRED_SELLABLE_MCP_TOOLS,
     });
+  } catch (err) {
+    runtimeMcp = {
+      ok: false,
+      skipped: false,
+      command: null,
+      args: [],
+      requiredTools: REQUIRED_SELLABLE_MCP_TOOLS,
+      availableTools: [],
+      missingTools: REQUIRED_SELLABLE_MCP_TOOLS,
+      stderrTail: [],
+      error: err instanceof Error ? err.message : String(err),
+      startedAt,
+      completedAt: new Date().toISOString(),
+    };
+  }
+
+  const runtimeRequired = opts.server !== "hosted";
+  if (runtimeMcp.skipped) {
+    checks.push(
+      warningCheck(
+        false,
+        `MCP runtime verification skipped: ${runtimeMcp.reason || "not available"}`
+      )
+    );
+  } else {
+    checks.push(
+      (runtimeRequired ? requiredCheck : warningCheck)(
+        runtimeMcp.ok,
+        runtimeMcp.ok
+          ? `MCP runtime exposes required campaign tools (${runtimeMcp.availableTools.length} total) and create-campaign smoke passed`
+          : `MCP runtime verification failed: ${runtimeMcp.missingTools.join(", ") || runtimeMcp.createCampaignSmoke?.error || runtimeMcp.error || "unknown failure"}`
+      )
+    );
   }
 
-  for (const c of checks) {
-    if (c.ok) logMilestone(c.label);
-    else logWarn(c.label);
+  const requiredFailures = checks.filter(
+    (check) => check.required && !check.ok
+  );
+  const summary = {
+    ok: requiredFailures.length === 0,
+    version: getInstallVersion(),
+    host: opts.host,
+    server: opts.server,
+    apiUrl: opts.apiUrl,
+    packages: {
+      install: INSTALL_PACKAGE_SPEC,
+      mcp: opts.mcpPackage,
+    },
+    checks,
+    runtimeMcp,
+    threadExposureNotice:
+      "If this verification passes but an already-open Codex or Claude session cannot see Sellable tools, restart that agent session so it reloads MCP/plugin surfaces.",
+    startedAt,
+    completedAt: new Date().toISOString(),
+  };
+
+  if (opts.artifactPath) {
+    writeFile(
+      opts.artifactPath,
+      `${JSON.stringify(summary, null, 2)}\n`,
+      { ...opts, dryRun: false },
+      0o600
+    );
   }
+
+  if (opts.json) {
+    console.log(JSON.stringify(summary, null, 2));
+  } else {
+    for (const c of checks) {
+      if (c.ok) logMilestone(c.label);
+      else logWarn(c.label);
+    }
+  }
+
+  if (requiredFailures.length > 0) {
+    throw new Error(
+      `Sellable verification failed: ${requiredFailures
+        .map((check) => check.label)
+        .join("; ")}`
+    );
+  }
+
+  return summary;
 }
 
 function visibleLen(s) {
@@ -2619,7 +2808,9 @@ function printInstallAgentBox(title, installCmd, docsUrl) {
   console.log(line(` ${C.bold}STEP 2${C.reset}   Then re-run Sellable:`));
   console.log(blank());
   console.log(
-    line(`           ${C.cyan}npx -y @sellable/install@latest${C.reset}`)
+    line(
+      `           ${C.cyan}curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh${C.reset}`
+    )
   );
   console.log(blank());
   console.log(line(` ${C.grey}Docs: ${docsUrl}${C.reset}`));
@@ -2938,7 +3129,9 @@ function runUninstall() {
   console.log(`  ${C.bold}Uninstalled.${C.reset}`);
   console.log("");
   console.log(`  Reinstall anytime:`);
-  console.log(`     ${C.cyan}npx -y @sellable/install@latest${C.reset}`);
+  console.log(
+    `     ${C.cyan}curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh${C.reset}`
+  );
   console.log("");
 }
 
@@ -3029,7 +3222,7 @@ async function main() {
         `  ${C.bold}Connecting Sellable to Claude Code and Codex…${C.reset}`
       );
       console.log("");
-    } else {
+    } else if (!opts.json) {
       printBanner();
       console.log(`  ${C.bold}Verifying Sellable install…${C.reset}`);
       console.log("");
@@ -3068,7 +3261,7 @@ async function main() {
       console.log("");
       logStep("Dry run complete; no files were written.");
     } else if (opts.verifyOnly) {
-      verify(opts);
+      await verify(opts);
     }
 
     if (!opts.verifyOnly) {

package/lib/runtime-verify.mjs

@@ -0,0 +1,391 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+
+const MAX_STDERR_LINES = 80;
+const DEFAULT_VERIFY_TIMEOUT_MS = 10_000;
+
+export const REQUIRED_SELLABLE_MCP_TOOLS = [
+  "get_auth_status",
+  "start_cli_login",
+  "wait_for_cli_login",
+  "bootstrap_create_campaign",
+  "get_subskill_prompt",
+  "get_subskill_asset",
+  "search_subskill_prompts",
+  "create_campaign",
+  "import_leads",
+  "confirm_lead_list",
+  "wait_for_lead_list_ready",
+  "wait_for_campaign_table_ready",
+  "update_campaign",
+  "update_campaign_brief",
+  "get_campaign",
+  "get_campaign_context",
+  "get_campaign_framework",
+  "get_campaign_navigation_state",
+  "get_campaign_messages_preview",
+  "attach_sequence",
+  "attach_recommended_sequence",
+  "start_campaign_message_preparation",
+  "get_campaign_message_preparation_status",
+  "cancel_campaign_message_preparation",
+  "start_campaign",
+];
+
+export const CREATE_CAMPAIGN_SMOKE_CALLS = [
+  {
+    name: "get_auth_status",
+    arguments: {},
+  },
+  {
+    name: "bootstrap_create_campaign",
+    arguments: {
+      flowVersion: "v2",
+      includeTableCheck: false,
+      host: "sellable-install-verify",
+      model: "installer-smoke",
+      reasoningEffort: "none",
+    },
+  },
+  {
+    name: "get_subskill_prompt",
+    arguments: {
+      subskillName: "create-campaign-v2",
+      offset: 0,
+      limit: 1200,
+    },
+  },
+  {
+    name: "get_subskill_asset",
+    arguments: {
+      subskillName: "create-campaign-v2",
+      assetPath: "core/flow.v2.json",
+      offset: 0,
+      limit: 1200,
+    },
+  },
+];
+
+function collectStderrLines(stream) {
+  const lines = [];
+  if (!stream) return lines;
+
+  let buffer = "";
+  stream.on("data", (chunk) => {
+    buffer += chunk.toString("utf8");
+    const parts = buffer.split(/\r?\n/);
+    buffer = parts.pop() ?? "";
+    for (const line of parts) {
+      if (!line) continue;
+      lines.push(redact(line));
+      if (lines.length > MAX_STDERR_LINES) lines.shift();
+    }
+  });
+  stream.on("end", () => {
+    if (!buffer) return;
+    lines.push(redact(buffer));
+    if (lines.length > MAX_STDERR_LINES) lines.shift();
+  });
+
+  return lines;
+}
+
+function redact(value) {
+  let out = String(value ?? "");
+  const secretValues = [
+    process.env.SELLABLE_TOKEN,
+    process.env.SUPABASE_SERVICE_ROLE_KEY,
+    process.env.OPENAI_API_KEY,
+    process.env.ANTHROPIC_API_KEY,
+  ].filter(Boolean);
+
+  for (const secret of secretValues) {
+    out = out.split(secret).join("[redacted]");
+  }
+
+  out = out.replace(
+    /(https?:\/\/[^:\s/]+:)([^@\s/]+)(@)/g,
+    "$1[redacted]$3"
+  );
+  out = out.replace(/skt_(?:live|test|dev)_[A-Za-z0-9_-]+/g, "[redacted-token]");
+  out = out.replace(/Bearer\s+[A-Za-z0-9._-]+/g, "Bearer [redacted]");
+  return out;
+}
+
+function makeEnv(env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env || process.env)) {
+    if (typeof value === "string") out[key] = value;
+  }
+  return out;
+}
+
+export function missingRequiredTools(tools, requiredTools) {
+  const available = new Set((tools || []).map((tool) => tool.name));
+  return requiredTools.filter((name) => !available.has(name));
+}
+
+function textFromToolResult(result) {
+  return (result?.content || [])
+    .filter((part) => part?.type === "text" && typeof part.text === "string")
+    .map((part) => part.text)
+    .join("\n");
+}
+
+function parseJsonText(text) {
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+function summarizeToolResult(name, result) {
+  const text = redact(textFromToolResult(result));
+  const parsed = parseJsonText(text);
+  const summary = {
+    isError: result?.isError === true,
+    textChars: text.length,
+  };
+
+  if (name === "get_auth_status" && parsed) {
+    return {
+      ...summary,
+      authOk: parsed.ok === true,
+      errorType: parsed.error?.type || null,
+      activeWorkspaceId: parsed.activeWorkspaceId || null,
+      activeWorkspaceName: parsed.activeWorkspaceName || null,
+    };
+  }
+
+  if (name === "bootstrap_create_campaign" && parsed) {
+    return {
+      ...summary,
+      safeToProceed: parsed.safeToProceed === true,
+      flowVersion: parsed.flowVersion || null,
+      blockingChecks: Array.isArray(parsed.blockingErrors)
+        ? parsed.blockingErrors.map((entry) => entry?.check).filter(Boolean)
+        : [],
+      requiredChecks: Array.isArray(parsed.requiredChecks)
+        ? parsed.requiredChecks.map((entry) => ({
+            key: entry?.key || null,
+            ok: entry?.ok === true,
+            blocking: entry?.blocking === true,
+          }))
+        : [],
+      nextStepChars:
+        typeof parsed.nextStep === "string" ? parsed.nextStep.length : 0,
+    };
+  }
+
+  if (name === "get_subskill_prompt" && parsed) {
+    return {
+      ...summary,
+      subskillName: parsed.name || null,
+      promptChars: typeof parsed.prompt === "string" ? parsed.prompt.length : 0,
+      hasMore: parsed.hasMore === true,
+      nextOffset:
+        typeof parsed.nextOffset === "number" ? parsed.nextOffset : null,
+    };
+  }
+
+  if (name === "get_subskill_asset" && parsed) {
+    return {
+      ...summary,
+      subskillName: parsed.subskillName || null,
+      assetPath: parsed.assetPath || null,
+      assetChars: typeof parsed.content === "string" ? parsed.content.length : 0,
+      hasMore: parsed.hasMore === true,
+      nextOffset:
+        typeof parsed.nextOffset === "number" ? parsed.nextOffset : null,
+    };
+  }
+
+  return summary;
+}
+
+async function verifyCreateCampaignSmoke({
+  client,
+  availableTools,
+  timeoutMs,
+  smokeCalls = CREATE_CAMPAIGN_SMOKE_CALLS,
+}) {
+  const startedAt = new Date().toISOString();
+  const available = new Set(availableTools || []);
+  const missingTools = smokeCalls
+    .map((call) => call.name)
+    .filter((name) => !available.has(name));
+  const calls = [];
+
+  if (missingTools.length > 0) {
+    return {
+      ok: false,
+      missingTools,
+      calls,
+      error: `Missing smoke tool(s): ${missingTools.join(", ")}`,
+      startedAt,
+      completedAt: new Date().toISOString(),
+    };
+  }
+
+  for (const call of smokeCalls) {
+    const callStartedAt = new Date().toISOString();
+    try {
+      const result = await client.callTool(
+        { name: call.name, arguments: call.arguments },
+        undefined,
+        {
+          timeout: timeoutMs,
+          maxTotalTimeout: timeoutMs,
+        }
+      );
+      const summary = summarizeToolResult(call.name, result);
+      calls.push({
+        name: call.name,
+        arguments: call.arguments,
+        ok: summary.isError !== true,
+        summary,
+        startedAt: callStartedAt,
+        completedAt: new Date().toISOString(),
+      });
+      if (summary.isError === true) {
+        return {
+          ok: false,
+          missingTools: [],
+          calls,
+          error: `${call.name} returned an MCP tool error`,
+          startedAt,
+          completedAt: new Date().toISOString(),
+        };
+      }
+    } catch (err) {
+      const error = err instanceof Error ? err.message : String(err);
+      calls.push({
+        name: call.name,
+        arguments: call.arguments,
+        ok: false,
+        summary: null,
+        error: redact(error),
+        startedAt: callStartedAt,
+        completedAt: new Date().toISOString(),
+      });
+      return {
+        ok: false,
+        missingTools: [],
+        calls,
+        error: redact(error),
+        startedAt,
+        completedAt: new Date().toISOString(),
+      };
+    }
+  }
+
+  return {
+    ok: true,
+    missingTools: [],
+    calls,
+    error: null,
+    startedAt,
+    completedAt: new Date().toISOString(),
+  };
+}
+
+export async function verifySellableMcpRuntime({
+  command,
+  args = [],
+  cwd = process.cwd(),
+  env = process.env,
+  requiredTools = REQUIRED_SELLABLE_MCP_TOOLS,
+  timeoutMs = Number(process.env.SELLABLE_VERIFY_TIMEOUT_MS || "") ||
+    DEFAULT_VERIFY_TIMEOUT_MS,
+}) {
+  const startedAt = new Date().toISOString();
+
+  if (command === "hosted") {
+    return {
+      ok: false,
+      skipped: true,
+      reason:
+        "Hosted MCP verification is not available through stdio tools/list.",
+      command,
+      args,
+      requiredTools,
+      availableTools: [],
+      missingTools: requiredTools,
+      stderrTail: [],
+      startedAt,
+      completedAt: new Date().toISOString(),
+    };
+  }
+
+  const transport = new StdioClientTransport({
+    command,
+    args,
+    cwd,
+    env: makeEnv(env),
+    stderr: "pipe",
+  });
+  const stderrLines = collectStderrLines(transport.stderr);
+  const client = new Client(
+    { name: "sellable-install-verify", version: "1.0.0" },
+    { capabilities: {} }
+  );
+
+  let availableTools = [];
+  let missingTools = [...requiredTools];
+  let createCampaignSmoke = null;
+  let error = null;
+
+  try {
+    await client.connect(transport);
+    const toolList = await client.listTools(undefined, {
+      timeout: timeoutMs,
+      maxTotalTimeout: timeoutMs,
+    });
+    availableTools = toolList.tools.map((tool) => tool.name).sort();
+    missingTools = missingRequiredTools(toolList.tools, requiredTools);
+    if (missingTools.length === 0) {
+      createCampaignSmoke = await verifyCreateCampaignSmoke({
+        client,
+        availableTools,
+        timeoutMs,
+      });
+    } else {
+      createCampaignSmoke = {
+        ok: false,
+        missingTools: CREATE_CAMPAIGN_SMOKE_CALLS.map((call) => call.name).filter(
+          (name) => !availableTools.includes(name)
+        ),
+        calls: [],
+        error:
+          "Skipping create-campaign smoke because required MCP tools are missing.",
+        startedAt: new Date().toISOString(),
+        completedAt: new Date().toISOString(),
+      };
+    }
+  } catch (err) {
+    error = err instanceof Error ? err.message : String(err);
+  } finally {
+    try {
+      await client.close();
+    } catch {
+      // Preserve the verification result even if the child exits noisily.
+    }
+  }
+
+  return {
+    ok: !error && missingTools.length === 0 && createCampaignSmoke?.ok === true,
+    skipped: false,
+    command,
+    args,
+    requiredTools,
+    availableTools,
+    missingTools,
+    createCampaignSmoke,
+    stderrTail: stderrLines,
+    error: error ? redact(error) : null,
+    startedAt,
+    completedAt: new Date().toISOString(),
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.205",
+  "version": "0.1.208",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {
@@ -12,10 +12,14 @@
   },
   "files": [
     "bin",
+    "lib",
     "agents",
     "skill-templates",
     "README.md"
   ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.25.2"
+  },
   "keywords": [
     "sellable",
     "mcp",

package/skill-templates/create-campaign.md

@@ -100,20 +100,31 @@ The default path stays the existing first campaign-table execution slice:
 review the normal `reviewBatchLimit:15`, approve reviewed draft rows, then move
 to Settings/sequence/final greenlight. Only call
 `start_campaign_message_preparation` when the user explicitly asks for more
-prepared messages or a send count. If the user says "prepare/generate X
+prepared messages, a send count, or language like "fill up/load sends for these
+senders." Treat those requests as capacity-fill preparation: calculate the
+bounded target from sender capacity when needed, then let the preparation job
+queue pending `Enrich Prospect` cells, wait for ICP/rubric and Generate Message
+cells to cascade, and mark ready or approve only the target cohort. Do not
+count `checkedRows` as enriched rows; it is only the table cursor. Use
+`progress.enrichedRows`, `progress.needsEnrichRows`, `activeCellCount`,
+`preparedMessages`, `approvedRows`, target, estimated row budget remaining, and
+`stopReason` to explain progress. If the user says "prepare/generate X
 messages", set `targetPreparedMessages:X`, omit `maxRowsToCheck`, and keep
-`approvalMode:"mark_ready"`. The backend calibrates on at least 100 rows,
-estimates the row budget from observed rubric/pass yield, caps
+`approvalMode:"mark_ready"`. The backend calibrates on at least 100 actually
+enriched rows, estimates the row budget from observed rubric/pass yield, caps
 `maxRowsToCheck` at 2500, then adapts later batches up to 250 rows while
-recalculating yield. Poll
-`get_campaign_message_preparation_status` for preparation-job status: checked
-rows, passed/prepared/approved count, target, estimated row budget remaining,
-and stop reason. If the user says "approve X messages", use
+recalculating yield. If the user says "approve X messages", use
 `approvalMode:"approve"` but still do not launch. If the user says "schedule X
-sends", use `approvalMode:"approve"` to approve exactly the bounded X-message
-cohort during preparation, then continue through sender, sequence, and final
-launch greenlight; the launch path must verify that bounded cohort and must not
-broad approve-all.
+sends" or asks to fill sender sends, use `approvalMode:"approve"` to approve
+exactly the bounded X-message cohort during preparation, then continue through
+sender, sequence, and final launch greenlight; the launch path must verify that
+bounded cohort and must not broad approve-all.
+When approving reviewed draft rows in the campaign table, resolve the actual
+visible `Approved` cells with `select_campaign_cells({ columnRole: "approved",
+rowSelector: { type: "rowIds", rowIds } })` and `update_cell` those returned
+cell IDs. Do not rely on `approveCellId` from `get_rows` unless it matches the
+semantic selector result; it may be a row-level helper and leave the UI checkbox
+unchecked.
 Treat `campaignId` as `CampaignOffer.id`. Low level selector/queue tools are
 diagnostics and recovery only for this lane. If the user asks to stop
 preparation, the target is wrong, or status shows the wrong campaign/table, call
@@ -168,6 +179,12 @@ person/company this campaign is for, then I’ll turn that into a campaign brief
 before we move into lead sourcing.
 ```
 
+Exception: if `bootstrap_create_campaign.modelQuality.status === "warn"`,
+the first visible campaign message must be the model-quality warning from
+`modelQuality.message`. Ask the user to switch to the configured minimum model
+or explicitly continue anyway before identity setup, research, lead filtering,
+message generation, or launch review.
+
 If a linked/local skill file is stale or missing, silently use the installed
 `sellable@sellable` plugin copy. Do not tell the user about the stale link,
 the old version, or the replacement path.
@@ -795,12 +812,15 @@ there.
 MCP tool access is required. First call `mcp__sellable__get_auth_status({})`
 directly. If that tool is unavailable, stop and say this is a Codex
 install/reload problem, not a campaign problem. Tell the user to
-run `npx -y @sellable/install@latest --host all` so the packaged MCP server,
-Codex Desktop plugin, and Sellable skill bundle are installed. If they want a
-CLI verification, tell them to run `sellable --verify-only --host all`. After
-that, they must fully quit and reopen Codex Desktop before starting a new
-thread. Do not use `scripts/mcp/sellable-tool-call.mjs`, `npm run`,
-`node`, or any local harness as a fallback for this interactive skill.
+run `curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh` so the
+packaged MCP server, Codex Desktop plugin, and Sellable skill bundle are
+installed. If they want an agent-readable checklist, tell them:
+`Install Sellable CLI and skills using https://app.sellable.dev/agent-install.txt`.
+For CLI verification, tell them to run
+`sellable --verify-only --host all --json --artifact "$HOME/.local/sellable/app-sellable-dev/installer/.last-verify.json"`.
+After that, they must fully quit and reopen Codex Desktop before starting a new
+thread. Do not use `scripts/mcp/sellable-tool-call.mjs`, `npm run`, `node`, or
+any local harness as a fallback for this interactive skill.
 Do not mention prompt loading, local skill files, missing linked versions,
 plugin cache paths, MCP namespaces, or runbooks in customer-facing progress
 updates.
@@ -912,8 +932,11 @@ updates.
    - Do not call `mcp__sellable__get_campaigns`.
    - Do not call `mcp__sellable__get_campaign` to hunt for IDs.
    - Do not call `mcp__sellable__create_campaign({ campaignId: ... })` unless the user supplied that id.
-6. Call `mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId? })`.
+6. Call `mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId?, host?, model?, reasoningEffort? })`.
+   Pass the current host, model, and reasoning when the host exposes them.
 7. If `safeToProceed !== true`, stop and show `blockingErrors` + `nextStep`.
+8. If `modelQuality.status === "warn"`, show `modelQuality.message` before any
+   setup/research and wait for the user to switch or explicitly continue.
 
 ## Execute Workflow