@sellable/install 0.1.211 → 0.1.213

package/bin/sellable-install.mjs

@@ -72,8 +72,9 @@ const CODEX_PLUGIN_COMPAT_VERSIONS = [
   "0.1.40",
   "0.1.41",
 ];
-const INSTALL_PACKAGE_SPEC =
+const RAW_INSTALL_PACKAGE_SPEC =
   process.env.SELLABLE_INSTALL_PACKAGE_SPEC || "@sellable/install@latest";
+const INSTALL_PACKAGE_SPEC = normalizeWindowsPackageSpec(RAW_INSTALL_PACKAGE_SPEC);
 
 const useColor = Boolean(output.isTTY) && process.env.NO_COLOR === undefined;
 const C = {
@@ -89,6 +90,15 @@ const C = {
 
 let VERBOSE = false;
 
+function normalizeWindowsPackageSpec(value) {
+  if (typeof value !== "string") return value;
+  if (/^[A-Za-z]:\//.test(value)) return value.replace(/\//g, "\\");
+  if (/^\/[A-Za-z]\//.test(value)) {
+    return `${value[1]}:${value.slice(2)}`.replace(/\//g, "\\");
+  }
+  return value;
+}
+
 function logVerbose(line) {
   if (VERBOSE) console.log(line);
 }
@@ -263,7 +273,7 @@ function parseArgs(argv) {
     } else if (arg === "--api-url") {
       opts.apiUrl = next();
     } else if (arg === "--mcp-package") {
-      opts.mcpPackage = next();
+      opts.mcpPackage = normalizeWindowsPackageSpec(next());
     } else if (arg === "--local-command") {
       opts.localCommand = next();
     } else if (arg === "--hosted-url") {
@@ -320,10 +330,6 @@ function isWindowsPlatform(platform = process.platform) {
   return platform === "win32";
 }
 
-function packageRunnerCommand(platform = process.platform) {
-  return isWindowsPlatform(platform) ? "npx.cmd" : "npx";
-}
-
 function packageManagerCommand(platform = process.platform) {
   return isWindowsPlatform(platform) ? "npm.cmd" : "npm";
 }
@@ -541,6 +547,14 @@ function upsertTomlTable(content, tableName, block) {
   return `${content.trimEnd()}\n\n${normalizedBlock}\n`;
 }
 
+function readTomlTable(content, tableName) {
+  const tablePattern = new RegExp(
+    `(^|\\n)\\[${escapeRegExp(tableName)}\\]\\n([\\s\\S]*?)(?=\\n\\[[^\\n]+\\]|$)`
+  );
+  const match = content.match(tablePattern);
+  return match ? match[2] : "";
+}
+
 function upsertTomlBoolean(content, tableName, key, value) {
   const line = `${key} = ${value ? "true" : "false"}`;
   const tablePattern = new RegExp(
@@ -668,12 +682,13 @@ function codexPluginMcp(opts) {
     };
   }
 
+  const [command, args] = mcpCommand(opts);
   return {
     mcpServers: {
       sellable: {
         type: "stdio",
-        command: packageRunnerCommand(),
-        args: ["-y", opts.mcpPackage],
+        command,
+        args,
         env: {
           SELLABLE_WATCH_MODE_DRIVER: "codex",
         },
@@ -771,46 +786,54 @@ function codexSkillOpenAiYaml(displayName, description) {
 `;
 }
 
-function createCampaignHostContract(host) {
+function installedHostContract(host, commandName) {
   if (host === "codex") {
     return `## Installed Host Contract
 
-This installed skill is running in Codex. Treat Codex as the current host, use
-\`request_user_input\` for structured questions when it is exposed, use
-\`$sellable:create-campaign\` in user-facing retry instructions, and call
-\`mcp__sellable__bootstrap_create_campaign\` with \`host: "Codex"\` plus the
-current Codex model and reasoning when available.
+This installed skill is running in Codex. When the shared workflow body or
+fallback text mentions both Claude Code and Codex for internal parity, choose
+the Codex instruction for customer-facing language and host functions.
 
-Do not describe this run as Claude Code and do not recommend Claude Code-only
-commands or settings from this Codex skill.`;
-  }
+- Customer-facing command: \`$sellable:${commandName}\`
+- Structured question function: \`request_user_input\`
+- Bootstrap host label: \`host: "Codex"\`
+- Install/reload blocker label: Codex install/reload problem
+- Reload instruction: fully quit and reopen Codex Desktop, then start a new thread
 
+Do not tell Codex users to run \`/sellable:${commandName}\`, use
+\`AskUserQuestion\`, or restart Claude Code. Do not describe this run as Claude Code.`;
+  }
   if (host === "claude") {
     return `## Installed Host Contract
 
-This installed command is running in Claude Code. Treat Claude Code as the
-current host, use \`AskUserQuestion\` for structured questions, use
-\`/sellable:create-campaign\` in user-facing retry instructions, and call
-\`mcp__sellable__bootstrap_create_campaign\` with \`host: "Claude Code"\` plus
-the current Claude Code model and reasoning when available.
+This installed command is running in Claude Code. When the shared workflow body
+or fallback text mentions both Claude Code and Codex for internal parity, choose
+the Claude Code instruction for customer-facing language and host functions.
 
-Do not describe this run as Codex and do not recommend Codex-only commands or
-settings from this Claude Code command.`;
-  }
+- Customer-facing command: \`/sellable:${commandName}\`
+- Structured question function: \`AskUserQuestion\`
+- Bootstrap host label: \`host: "Claude Code"\`
+- Install/reload blocker label: Claude Code install/reload problem
+- Reload instruction: fully quit and reopen Claude Code, then start a new session
 
+Do not tell Claude Code users to run \`$sellable:${commandName}\`, use
+\`request_user_input\`, or restart Codex Desktop. Do not describe this run as Codex.`;
+  }
   return "";
 }
 
-function addCreateCampaignHostContract(markdown, host) {
-  const contract = createCampaignHostContract(host);
-  if (!contract) return markdown;
+function stampInstalledHost(markdown, host, commandName) {
+  const preamble = installedHostContract(host, commandName);
+  if (!preamble || markdown.includes("## Installed Host Contract")) {
+    return markdown;
+  }
   return String(markdown).replace(
-    "\n# Sellable Create Campaign\n",
-    `\n# Sellable Create Campaign\n\n${contract}\n`
+    /(^# .+\n\n)/m,
+    `$1${preamble}\n\n`
   );
 }
 
-function createCampaignSkillMd({ host = "shared" } = {}) {
+function createCampaignSkillMd(host = "shared") {
   // Single source of truth: ../skill-templates/create-campaign.md, which is
   // copied from the canonical mcp/sellable/skills/create-campaign/SKILL.md at
   // publish time via scripts/sync-skill-templates.mjs (prepublishOnly hook).
@@ -825,15 +848,16 @@ function createCampaignSkillMd({ host = "shared" } = {}) {
       "create-campaign.md"
     );
     if (existsSync(templatePath)) {
-      return addCreateCampaignHostContract(
+      return stampInstalledHost(
         readFileSync(templatePath, "utf8"),
-        host
+        host,
+        "create-campaign"
       );
     }
   } catch {
     // fall through to hardcoded fallback below
   }
-  return `---
+  return stampInstalledHost(`---
 name: create-campaign
 description: Create a Sellable campaign through the approval-gated workflow.
 allowed-tools:
@@ -856,17 +880,11 @@ person/company this campaign is for, then I’ll turn that into a campaign brief
 before anything is created.
 \`\`\`
 
-Exception: if \`bootstrap_create_campaign.modelQuality.status === "warn"\` and
-\`bootstrap_create_campaign.modelQuality.metadataStale !== true\`, the first
-visible campaign message must be the model-quality warning from
-\`modelQuality.message\`. Ask the user to switch to the configured minimum model
-or explicitly continue anyway before identity setup, research, lead filtering,
-message generation, or launch review. If \`metadataStale === true\`, continue
-normally and do not ask the user to switch.
-
-If \`bootstrap_create_campaign.modelQuality.metadataStale === true\`, continue
-normally. Do not ask the user to switch models; this is an accepted Codex host
-metadata mismatch.
+Exception: if \`bootstrap_create_campaign.modelQuality.status === "warn"\`, the
+first visible campaign message must be the model-quality warning from
+\`modelQuality.message\`. Only trust that warning when bootstrap received active
+turn/runtime metadata or an explicit user-confirmed model. Do not warn from
+config defaults, stale host labels, or inferred model names.
 
 If a linked/local skill file is stale or missing, silently use the installed
 \`sellable@sellable\` plugin copy. Do not tell the user about the stale link,
@@ -884,6 +902,56 @@ clear business decisions, tradeoffs, and approval gates. Use product language:
 - "I can create a draft shell for you to watch with approval gates before
   sourcing", not mutation jargon
 
+## Active Model Metadata
+
+Before calling \`bootstrap_create_campaign\`, collect the active host model data
+only from a source that can describe this turn:
+
+- Codex: if \`mcp__node_repl__js\` is available, inspect only
+  \`nodeRepl.requestMeta["x-codex-turn-metadata"].model\` and
+  \`nodeRepl.requestMeta["x-codex-turn-metadata"].reasoning_effort\`. Pass those
+  values as \`model\` and \`reasoningEffort\`, with
+  \`modelMetadataSource: "codex_turn_metadata"\`.
+- Codex fallback/cross-check: if active turn metadata is unavailable, you may
+  inspect \`~/.codex/config.toml\` for \`model\` and
+  \`model_reasoning_effort\`, but pass
+  \`modelMetadataSource: "codex_config_fallback"\` and do not treat it as a
+  reason to ask the user to switch models. Active turn metadata wins if it
+  differs from config.
+- Claude Code / Opus: use active Claude runtime metadata only if the current
+  host exposes model and effort for this same session, with
+  \`modelMetadataSource: "claude_runtime_metadata"\`. Current Claude Code MCP
+  tool calls may not include model or effort metadata; when they do not, omit
+  \`model\`, \`reasoningEffort\`, and \`modelMetadataSource\`.
+- Claude Code session-context self-report: if your current Claude session
+  context explicitly states both the exact model ID and effort/thinking level,
+  report it internally in this shape and pass it to bootstrap with
+  \`modelMetadataSource: "claude_session_context"\`:
+
+  \`\`\`text
+  - Model (name): ...
+  - Model (ID): ...
+  - Reasoning effort: ...
+  - Source: active Claude Code session context
+  \`\`\`
+
+  Use this only when the values are explicitly present in the current session
+  context. Do not infer an ID from the friendly name, do not infer effort from
+  \`alwaysThinkingEnabled\`, and do not show this self-report to the user during
+  normal campaign setup.
+- Do not run a nested \`claude -p\`, inspect \`~/.claude/settings.json\`, or read
+  Claude CLI defaults as proof of the user's active Claude Code session. Those
+  checks can validate a new child session or saved defaults, but not this
+  session's actual model and effort.
+- If the user explicitly provides active Claude \`/status\` or \`/model\` output
+  that includes both model and effort, pass it with
+  \`modelMetadataSource: "user_confirmed"\`. If it is missing either model or
+  effort, treat the metadata as unknown and continue.
+
+Never invent the model or reasoning effort. Never pass config defaults as active
+metadata. If bootstrap returns \`modelQuality.status === "unknown"\`, continue
+without asking the user to switch models.
+
 When explaining source decisions, show the concrete counts behind the
 logic: lanes searched, timeframe, raw result counts, finalist posts or preview
 rows, sampled people, sampled fits as n/N (%), estimated usable people, and the
@@ -1305,13 +1373,19 @@ updates.
    - Do not call \`mcp__sellable__get_campaigns\`.
    - Do not call \`mcp__sellable__get_campaign\` to hunt for IDs.
    - Do not call \`mcp__sellable__create_campaign({ campaignId: ... })\` unless the user supplied that id.
-5. Call \`mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId?, host?, model?, reasoningEffort? })\`.
-   Pass the current host, model, and reasoning when the host exposes them.
+5. Call \`mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId?, host?, model?, reasoningEffort?, modelMetadataSource? })\`.
+   Pass model metadata only when collected by the Active Model Metadata rules
+   above. For Codex active turn metadata, pass
+   \`modelMetadataSource: "codex_turn_metadata"\`. For explicit Claude session
+   context, pass \`modelMetadataSource: "claude_session_context"\`. For explicit
+   user-confirmed Claude \`/status\` or \`/model\` output, pass
+   \`modelMetadataSource: "user_confirmed"\` only when it includes both model and
+   effort.
 6. If \`safeToProceed !== true\`, stop and show \`blockingErrors\` + \`nextStep\`.
-7. If \`modelQuality.status === "warn"\` and \`modelQuality.metadataStale !== true\`,
-   show \`modelQuality.message\` before any setup/research and wait for the user
-   to switch or explicitly continue. If \`metadataStale === true\`, continue
-   normally and do not tell the user to switch.
+7. If \`modelQuality.status === "warn"\`, show \`modelQuality.message\` before
+   any setup/research and wait for the user to switch or explicitly continue. If
+   \`modelQuality.status === "unknown"\`, continue; do not tell the user to
+   switch models.
 
 ## Execute Workflow
 
@@ -1392,10 +1466,10 @@ updates.
 If subskill lookup fails, use
 \`mcp__sellable__search_subskill_prompts({ query: "create-campaign-v2" })\`,
 then retry \`get_subskill_prompt\`.
-`;
+`, host, "create-campaign");
 }
 
-function createAbTestSkillMd() {
+function createAbTestSkillMd(host = "shared") {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const templatePath = join(
@@ -1405,12 +1479,16 @@ function createAbTestSkillMd() {
       "create-ab-test.md"
     );
     if (existsSync(templatePath)) {
-      return readFileSync(templatePath, "utf8");
+      return stampInstalledHost(
+        readFileSync(templatePath, "utf8"),
+        host,
+        "create-ab-test"
+      );
     }
   } catch {
     // fall through to hardcoded fallback below
   }
-  return `---
+  return stampInstalledHost(`---
 name: create-ab-test
 description: Create a Sellable campaign A/B test from a clean source lead list.
 visibility: public
@@ -1426,11 +1504,11 @@ allowed-tools:
 # Sellable Create A/B Test
 
 Use \`prepare_campaign_ab_test\` to create clean A/B split lead lists and review-copy campaigns. Do not call \`export_table_csv\` from generated campaign workflow tables as lead source data, and do not call \`start_campaign\`.
-`;
+`, host, "create-ab-test");
 }
 
-function genericSellableSkillMd({ name, title, description }) {
-  return `---
+function genericSellableSkillMd({ name, title, description, host = "shared" }) {
+  return stampInstalledHost(`---
 name: ${name}
 description: ${yamlString(description)}
 allowed-tools:
@@ -1465,11 +1543,11 @@ Desktop, then start a new thread.
 ## MCP Prompt Fallback
 
 If subskill lookup fails, use \`mcp__sellable__search_subskill_prompts({ query: "${name}" })\`, then retry \`get_subskill_prompt\`.
-`;
+`, host, name);
 }
 
-function foundationSkillMd() {
-  return `---
+function foundationSkillMd(host = "shared") {
+  return stampInstalledHost(`---
 name: foundation
 description: ${yamlString(FOUNDATION_SKILL_DESCRIPTION)}
 allowed-tools:
@@ -1528,11 +1606,11 @@ Desktop, then start a new thread.
 If exact subskill lookup fails, use
 \`mcp__sellable__search_subskill_prompts({ query: "foundation", includePublic: true, includeInternal: true })\`,
 then retry \`get_subskill_prompt\`.
-`;
+`, host, "foundation");
 }
 
-function contentSkillMd() {
-  return `---
+function contentSkillMd(host = "shared") {
+  return stampInstalledHost(`---
 name: content
 description: Add transcripts and rough ideas, cluster recurring themes, ideate post seeds, and hand draft requests to create-post.
 allowed-tools:
@@ -1598,11 +1676,11 @@ Desktop, then start a new thread.
 If exact subskill lookup fails, use
 \`mcp__sellable__search_subskill_prompts({ query: "content", includePublic: true, includeInternal: true })\`,
 then retry \`get_subskill_prompt\`.
-`;
+`, host, "content");
 }
 
-function createPostSkillMd() {
-  return `---
+function createPostSkillMd(host = "shared") {
+  return stampInstalledHost(`---
 name: create-post
 description: Capture rough LinkedIn post ideas, develop a valuable premise, research current hooks and audience tension, then save validated drafts in the user's voice.
 allowed-tools:
@@ -1672,7 +1750,7 @@ Desktop, then start a new thread.
 If exact subskill lookup fails, use
 \`mcp__sellable__search_subskill_prompts({ query: "create-post", includePublic: true, includeInternal: true })\`,
 then retry \`get_subskill_prompt\`.
-`;
+`, host, "create-post");
 }
 
 function createCampaignSoulMd() {
@@ -1869,7 +1947,7 @@ function codexPluginSkills() {
       dir: "sellable-create-campaign",
       displayName: "Sellable Create Campaign",
       description: "Create a Sellable campaign with approval gates",
-      skillMd: createCampaignSkillMd({ host: "codex" }),
+      skillMd: createCampaignSkillMd("codex"),
       soulMd: createCampaignSoulMd(),
     },
     {
@@ -2093,7 +2171,7 @@ function claudeCommands() {
       filename: join("sellable", "create-campaign.md"),
       description: "Create a Sellable campaign through the approval-gated workflow.",
       argumentHint: "[campaign goal, company, or offer]",
-      skillMd: createCampaignSkillMd({ host: "claude" }),
+      skillMd: createCampaignSkillMd("claude"),
       allowedTools: ["AskUserQuestion", "Task", ...CREATE_CAMPAIGN_ALLOWED_TOOLS],
     },
     {
@@ -2313,6 +2391,7 @@ enabled = false`
       "default_mode_request_user_input",
       true
     );
+    content = upsertCodexMcpServerConfig(content, opts);
     content = upsertTomlTable(
       content,
       "agents",
@@ -2471,6 +2550,68 @@ function codexMcpAddArgs(opts) {
   ];
 }
 
+function upsertCodexMcpServerConfig(content, opts) {
+  if (opts.server === "hosted") {
+    content = upsertTomlTable(
+      content,
+      "mcp_servers.sellable",
+      `[mcp_servers.sellable]
+url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}`
+    );
+    content = removeTomlSection(content, "mcp_servers.sellable.env");
+    return content;
+  }
+
+  const [command, args] = mcpCommand(opts);
+  content = upsertTomlTable(
+    content,
+    "mcp_servers.sellable",
+    `[mcp_servers.sellable]
+command = ${quoteToml(command)}
+args = ${tomlArray(args)}`
+  );
+  content = upsertTomlTable(
+    content,
+    "mcp_servers.sellable.env",
+    `[mcp_servers.sellable.env]
+SELLABLE_WATCH_MODE_DRIVER = "codex"`
+  );
+  return content;
+}
+
+function codexMcpServerMatches(content, opts) {
+  const server = readTomlTable(content, "mcp_servers.sellable");
+  if (!server) return false;
+  if (opts.server === "hosted") {
+    return (
+      server.includes(
+        `url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}`
+      ) &&
+      !/\bcommand\s*=/.test(server) &&
+      !/\bargs\s*=/.test(server)
+    );
+  }
+
+  const [command, args] = mcpCommand(opts);
+  const env = readTomlTable(content, "mcp_servers.sellable.env");
+  return (
+    server.includes(`command = ${quoteToml(command)}`) &&
+    server.includes(`args = ${tomlArray(args)}`) &&
+    env.includes('SELLABLE_WATCH_MODE_DRIVER = "codex"')
+  );
+}
+
+function codexPluginMcpServerMatches(content, opts) {
+  if (!content) return false;
+  try {
+    const actual = JSON.parse(content)?.mcpServers?.sellable;
+    const expected = codexPluginMcp(opts).mcpServers.sellable;
+    return JSON.stringify(actual) === JSON.stringify(expected);
+  } catch {
+    return false;
+  }
+}
+
 function installClaude(opts) {
   if (!commandExists("claude")) {
     const message =
@@ -2954,6 +3095,30 @@ async function verify(opts) {
           : "Codex Desktop plugin watch mode driver missing"
       )
     );
+    const codexMcpEntriesCanonical = codexMcpServerMatches(
+      configContent,
+      opts
+    );
+    checks.push(
+      warningCheck(
+        codexMcpEntriesCanonical,
+        codexMcpEntriesCanonical
+          ? "Codex CLI Sellable MCP entry canonical"
+          : "Codex CLI Sellable MCP entry stale"
+      )
+    );
+    const codexPluginMcpEntryCanonical = codexPluginMcpServerMatches(
+      pluginMcpContent,
+      opts
+    );
+    checks.push(
+      warningCheck(
+        codexPluginMcpEntryCanonical,
+        codexPluginMcpEntryCanonical
+          ? "Codex Desktop plugin Sellable MCP entry canonical"
+          : "Codex Desktop plugin Sellable MCP entry stale"
+      )
+    );
     const hasCodexAgentRegistrations = codexCustomAgents().every((agent) =>
       configContent.includes(`[agents.${agent.name}]`)
     );

package/lib/runtime-verify.mjs

@@ -3,6 +3,8 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 
 const MAX_STDERR_LINES = 80;
 const DEFAULT_VERIFY_TIMEOUT_MS = 10_000;
+const DEFAULT_VERIFY_ATTEMPTS = 2;
+const DEFAULT_VERIFY_RETRY_DELAY_MS = 750;
 
 export const REQUIRED_SELLABLE_MCP_TOOLS = [
   "get_auth_status",
@@ -125,6 +127,15 @@ export function missingRequiredTools(tools, requiredTools) {
   return requiredTools.filter((name) => !available.has(name));
 }
 
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function numberFromEnv(name, fallback) {
+  const parsed = Number(process.env[name] || "");
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
 function textFromToolResult(result) {
   return (result?.content || [])
     .filter((part) => part?.type === "text" && typeof part.text === "string")
@@ -291,7 +302,39 @@ async function verifyCreateCampaignSmoke({
   };
 }
 
-export async function verifySellableMcpRuntime({
+function summarizeAttempt(result, attempt) {
+  return {
+    attempt,
+    ok: result.ok === true,
+    availableToolCount: result.availableTools?.length || 0,
+    missingToolCount: result.missingTools?.length || 0,
+    error: result.error || null,
+    createCampaignSmoke: result.createCampaignSmoke
+      ? {
+          ok: result.createCampaignSmoke.ok === true,
+          error: result.createCampaignSmoke.error || null,
+          missingTools: result.createCampaignSmoke.missingTools || [],
+          calls: (result.createCampaignSmoke.calls || []).map((call) => ({
+            name: call.name,
+            ok: call.ok === true,
+          })),
+        }
+      : null,
+    stderrTail: result.stderrTail || [],
+    startedAt: result.startedAt,
+    completedAt: result.completedAt,
+  };
+}
+
+function shouldRetryRuntimeVerification(result, requiredTools) {
+  if (result.ok || result.skipped) return false;
+  if (result.error) return true;
+  const availableToolCount = result.availableTools?.length || 0;
+  const missingToolCount = result.missingTools?.length || 0;
+  return availableToolCount === 0 || missingToolCount === requiredTools.length;
+}
+
+async function verifySellableMcpRuntimeOnce({
   command,
   args = [],
   cwd = process.cwd(),
@@ -389,3 +432,51 @@ export async function verifySellableMcpRuntime({
     completedAt: new Date().toISOString(),
   };
 }
+
+export async function verifySellableMcpRuntime({
+  command,
+  args = [],
+  cwd = process.cwd(),
+  env = process.env,
+  requiredTools = REQUIRED_SELLABLE_MCP_TOOLS,
+  timeoutMs = Number(process.env.SELLABLE_VERIFY_TIMEOUT_MS || "") ||
+    DEFAULT_VERIFY_TIMEOUT_MS,
+  attempts = numberFromEnv("SELLABLE_VERIFY_ATTEMPTS", DEFAULT_VERIFY_ATTEMPTS),
+  retryDelayMs = numberFromEnv(
+    "SELLABLE_VERIFY_RETRY_DELAY_MS",
+    DEFAULT_VERIFY_RETRY_DELAY_MS
+  ),
+}) {
+  const attemptSummaries = [];
+  let lastResult = null;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const result = await verifySellableMcpRuntimeOnce({
+      command,
+      args,
+      cwd,
+      env,
+      requiredTools,
+      timeoutMs,
+    });
+    lastResult = result;
+    attemptSummaries.push(summarizeAttempt(result, attempt));
+
+    if (
+      attempt >= attempts ||
+      !shouldRetryRuntimeVerification(result, requiredTools)
+    ) {
+      return {
+        ...result,
+        attempts: attemptSummaries,
+      };
+    }
+
+    await sleep(retryDelayMs);
+  }
+
+  return {
+    ...lastResult,
+    attempts: attemptSummaries,
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.211",
+  "version": "0.1.213",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {

package/skill-templates/create-campaign.md

@@ -179,17 +179,11 @@ person/company this campaign is for, then I’ll turn that into a campaign brief
 before we move into lead sourcing.
 ```
 
-Exception: if `bootstrap_create_campaign.modelQuality.status === "warn"` and
-`bootstrap_create_campaign.modelQuality.metadataStale !== true`, the first
-visible campaign message must be the model-quality warning from
-`modelQuality.message`. Ask the user to switch to the configured minimum model
-or explicitly continue anyway before identity setup, research, lead filtering,
-message generation, or launch review. If `metadataStale === true`, continue
-normally and do not ask the user to switch.
-
-If `bootstrap_create_campaign.modelQuality.metadataStale === true`, continue
-normally. Do not ask the user to switch models; this is an accepted Codex host
-metadata mismatch.
+Exception: if `bootstrap_create_campaign.modelQuality.status === "warn"`, the
+first visible campaign message must be the model-quality warning from
+`modelQuality.message`. Only trust that warning when bootstrap received active
+turn/runtime metadata or an explicit user-confirmed model. Do not warn from
+config defaults, stale host labels, or inferred model names.
 
 If a linked/local skill file is stale or missing, silently use the installed
 `sellable@sellable` plugin copy. Do not tell the user about the stale link,
@@ -207,6 +201,55 @@ clear business decisions, tradeoffs, and approval gates. Use product language:
 - "I can create a draft shell for you to watch with approval gates before
   sourcing", not mutation jargon
 
+## Active Model Metadata
+
+Before calling `bootstrap_create_campaign`, collect the active host model data
+only from a source that can describe this turn:
+
+- Codex: if `mcp__node_repl__js` is available, inspect only
+  `nodeRepl.requestMeta["x-codex-turn-metadata"].model` and
+  `nodeRepl.requestMeta["x-codex-turn-metadata"].reasoning_effort`. Pass those
+  values as `model` and `reasoningEffort`, with
+  `modelMetadataSource: "codex_turn_metadata"`.
+- Codex fallback/cross-check: if active turn metadata is unavailable, you may
+  inspect `~/.codex/config.toml` for `model` and `model_reasoning_effort`, but
+  pass `modelMetadataSource: "codex_config_fallback"` and do not treat it as a
+  reason to ask the user to switch models. Active turn metadata wins if it
+  differs from config.
+- Claude Code / Opus: use active Claude runtime metadata only if the current
+  host exposes model and effort for this same session, with
+  `modelMetadataSource: "claude_runtime_metadata"`. Current Claude Code MCP
+  tool calls may not include model or effort metadata; when they do not, omit
+  `model`, `reasoningEffort`, and `modelMetadataSource`.
+- Claude Code session-context self-report: if your current Claude session
+  context explicitly states both the exact model ID and effort/thinking level,
+  report it internally in this shape and pass it to bootstrap with
+  `modelMetadataSource: "claude_session_context"`:
+
+  ```text
+  - Model (name): ...
+  - Model (ID): ...
+  - Reasoning effort: ...
+  - Source: active Claude Code session context
+  ```
+
+  Use this only when the values are explicitly present in the current session
+  context. Do not infer an ID from the friendly name, do not infer effort from
+  `alwaysThinkingEnabled`, and do not show this self-report to the user during
+  normal campaign setup.
+- Do not run a nested `claude -p`, inspect `~/.claude/settings.json`, or read
+  Claude CLI defaults as proof of the user's active Claude Code session. Those
+  checks can validate a new child session or saved defaults, but not this
+  session's actual model and effort.
+- If the user explicitly provides active Claude `/status` or `/model` output
+  that includes both model and effort, pass it with
+  `modelMetadataSource: "user_confirmed"`. If it is missing either model or
+  effort, treat the metadata as unknown and continue.
+
+Never invent the model or reasoning effort. Never pass config defaults as active
+metadata. If bootstrap returns `modelQuality.status === "unknown"`, continue
+without asking the user to switch models.
+
 Approval and safety copy should be tasteful. State what the current approval
 covers once, in one short sentence, then move on. Do not append repeated
 "nothing starts / no leads import / no sending" disclaimers to routine progress
@@ -775,10 +818,9 @@ messages, and wait for final launch approval.
 What's your LinkedIn profile URL or handle?
 ```
 
-Codex only: do not silently ask intake or approval questions as plain chat when
-`request_user_input` is unavailable in an interactive Codex session. Claude Code
-uses `AskUserQuestion`; do not apply this Codex setup blocker in Claude Code.
-In Codex, stop and tell the user:
+Do not silently ask Codex intake or approval questions as plain chat when
+`request_user_input` is unavailable in an interactive session. Stop and tell
+the user:
 
 ```text
 I need Codex’s quick question panel to collect campaign inputs and approvals cleanly.
@@ -817,18 +859,17 @@ there.
 ## Bootstrap
 
 MCP tool access is required. First call `mcp__sellable__get_auth_status({})`
-directly. If that tool is unavailable, stop and say this is a Sellable
-install/reload problem for the current host, not a campaign problem. Tell the
-user to run `curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh` so
-the packaged MCP server and the current host integration are installed. If they
-want an agent-readable checklist, tell them:
+directly. If that tool is unavailable, stop and say this is a Codex
+install/reload problem, not a campaign problem. Tell the user to
+run `curl -fsSL "https://app.sellable.dev/api/v2/cli/install" | sh` so the
+packaged MCP server, Codex Desktop plugin, and Sellable skill bundle are
+installed. If they want an agent-readable checklist, tell them:
 `Install Sellable CLI and skills using https://app.sellable.dev/agent-install.txt`.
 For CLI verification, tell them to run
 `sellable --verify-only --host all --json --artifact "$HOME/.local/sellable/app-sellable-dev/installer/.last-verify.json"`.
-After that, they must fully quit and reopen the current host app before starting
-a new thread. In Codex, say Codex Desktop. In Claude Code, say Claude Code. Do
-not use `scripts/mcp/sellable-tool-call.mjs`, `npm run`, `node`, or any local
-harness as a fallback for this interactive skill.
+After that, they must fully quit and reopen Codex Desktop before starting a new
+thread. Do not use `scripts/mcp/sellable-tool-call.mjs`, `npm run`, `node`, or
+any local harness as a fallback for this interactive skill.
 Do not mention prompt loading, local skill files, missing linked versions,
 plugin cache paths, MCP namespaces, or runbooks in customer-facing progress
 updates.
@@ -940,15 +981,19 @@ updates.
    - Do not call `mcp__sellable__get_campaigns`.
    - Do not call `mcp__sellable__get_campaign` to hunt for IDs.
    - Do not call `mcp__sellable__create_campaign({ campaignId: ... })` unless the user supplied that id.
-6. Call `mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId?, host, model?, reasoningEffort? })`.
-   Pass the explicit current host label: `host: "Codex"` from Codex and
-   `host: "Claude Code"` from Claude Code. Also pass the current model and
-   reasoning when the host exposes them.
+6. Call `mcp__sellable__bootstrap_create_campaign({ flowVersion: "v2", campaignId?, host?, model?, reasoningEffort?, modelMetadataSource? })`.
+   Pass model metadata only when collected by the Active Model Metadata rules
+   above. For Codex active turn metadata, pass
+   `modelMetadataSource: "codex_turn_metadata"`. For explicit Claude session
+   context, pass `modelMetadataSource: "claude_session_context"`. For explicit
+   user-confirmed Claude `/status` or `/model` output, pass
+   `modelMetadataSource: "user_confirmed"` only when it includes both model and
+   effort.
 7. If `safeToProceed !== true`, stop and show `blockingErrors` + `nextStep`.
-8. If `modelQuality.status === "warn"` and `modelQuality.metadataStale !== true`,
-   show `modelQuality.message` before any setup/research and wait for the user
-   to switch or explicitly continue. If `metadataStale === true`, continue
-   normally and do not tell the user to switch.
+8. If `modelQuality.status === "warn"`, show `modelQuality.message` before any
+   setup/research and wait for the user to switch or explicitly continue. If
+   `modelQuality.status === "unknown"`, continue; do not tell the user to
+   switch models.
 
 ## Execute Workflow