@sellable/install 0.1.252 → 0.1.254

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.252",
+  "version": "0.1.254",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {

package/skill-templates/create-evergreen-campaigns.md

@@ -310,9 +310,10 @@ acceptable only when it writes a fresh durable per-lane receipt artifact as it
 works.
 When visible Codex app thread tools are unavailable but local Codex CLI is
 available, the accepted durable streaming-worker command shape is:
-`codex -a never -s danger-full-access exec -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 The approval and sandbox flags must come before the `exec` subcommand for Codex
-CLI builds that expose `-a`/`-s` only at top level. Do not use
+CLI builds that expose `-a`/`-s` only at top level. `--skip-git-repo-check` belongs after `exec` because current customer and VPS Codex CLI builds expose it
+as an `exec` subcommand flag, not a top-level flag. Do not use
 `codex exec --ask-for-approval never ...` or `codex exec -a never ...`; those
 forms fail on current customer CLI installs. Pipe the lane packet prompt on
 stdin, require the worker to write `workerDispatch.receiptArtifactHint`, and
@@ -320,7 +321,7 @@ pass exactly one lane packet per worker.
 When launching durable Codex CLI workers from an automation parent, pass an
 explicit supported worker model instead of relying on the Codex CLI default
 model. Use the parent runtime model when known, for example:
-`codex -a never -s danger-full-access exec -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 Do not rely on the Codex CLI default model; some customer and VPS installs
 default to unavailable model aliases. If the parent cannot identify a supported
 worker model and a test `codex exec -m <worker-model>` launch is rejected, stop
@@ -336,20 +337,41 @@ Do not embed `<<'WORKER_PROMPT'` heredocs inside a single quoted or double
 quoted `/bin/bash -lc '...'` command string; nested quoting is brittle and can
 truncate the first worker before mutation. For multi-worker launchers, write one
 plain prompt file per lane under the current run directory, then start each
-worker with `codex -a never -s danger-full-access exec -m "$WORKER_MODEL" -C "$REPO" -o
+worker with `codex -a never -s danger-full-access exec --skip-git-repo-check -m "$WORKER_MODEL" -C "$REPO" -o
 "$worker_final_file" - < "$worker_prompt_file"`. Keep launcher shell variables
 double-quoted and keep the prompt heredoc only in a standalone script/prompt-file
 write step, not inside an already quoted shell argument. If the first launcher
 attempt exits with a shell parse error or before starting the first worker,
 stop with `blocked: worker_launcher_quoting_failed` and do not retry by
 loosening sender scope or mutating in the parent.
+Do not use `nohup`, detached background workers, or any launcher that returns
+before the workers finish and before receipts/final files exist. A durable
+worker must run in a foreground command session, visible Codex thread, or a shell
+that stays alive until every worker has finished. If using background jobs inside
+one shell, the same shell must stay alive, wait for every worker PID, poll only
+the expected receipt paths, and record a per-worker exit code plus final-file
+paths and stderr/log paths before returning. If workers exit with empty logs and
+no final files because the subprocess detached or was reaped, stop with
+`blocked: worker_subprocess_detached_without_output` before parent verify.
+When launching multiple local Codex CLI workers from one shell, start each
+background job in the same shell that will call `wait`. Do not capture worker
+PIDs through command substitution, a subshell, a pipeline, or a helper function
+invoked as `worker_pid=$(launch_worker ...)`; those patterns make the captured
+PID non-waitable by the parent shell. Use the same-shell PID array pattern:
+`pids=(); codex ... > "$log_file" 2>&1 & pids+=("$!")`, then
+`for pid in "${pids[@]}"; do wait "$pid" || rc=1; done`. If `wait` reports
+`pid is not a child of this shell`, stop with
+`blocked: worker_subprocess_detached_without_output`.
 Short form: run the wrapper with `/bin/bash -lc`.
 Short form: Do not rely on zsh-specific behavior.
 Short form: Do not use `status` as a shell variable; use `exit_code` or `rc`.
+Short form: Do not capture worker PIDs through command substitution or a subshell.
+Short form: Use same-shell `pids+=("$!")` before waiting on every PID.
 Short form: Receipt polling uses `find <receipt-dir> -maxdepth 1 -name 'evg_*.json' -print`.
 Short form: Do not use naked `*.json` globs under zsh; no `no matches found` diagnostics.
 Short form: Do not embed `<<'WORKER_PROMPT'` heredocs inside a quoted `/bin/bash -lc` command string.
 Short form: Multi-worker launchers write prompt files and run `codex ... - < "$worker_prompt_file"`.
+Short form: Do not use `nohup`; keep the worker process attached until receipt or blocker.
 After the auto-executable plan returns, take at most one short planning pass to
 choose the visible/durable worker runtime and build the worker launch packet.
 Do not keep reasoning, re-reading prompts, or restating the workflow instead of
@@ -394,7 +416,7 @@ launchers, write the same prompt body to `<worker-prompt-file>` and launch the
 worker with stdin redirected from that file:
 
 ```
-codex -a never -s danger-full-access exec -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
+codex -a never -s danger-full-access exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
 Use $sellable:create-evergreen-campaigns as the governing skill for this one lane worker.
 
 Workspace id: <workspaceId>
@@ -417,7 +439,7 @@ Complete only this lane, write the required durable receipt JSON, and stop.
 WORKER_PROMPT
 
 # Multi-worker launcher equivalent:
-codex -a never -s danger-full-access exec -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
+codex -a never -s danger-full-access exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
 ```
 
 If any placeholder cannot be filled from the current lane packet, do not inspect
@@ -603,7 +625,10 @@ not a parent-thread summary. The receipt must include:
 Before writing the durable receipt, run a receipt self-check. The top-level
 receipt must include top-level `planRevision`, `actionId`, `laneKey`,
 `laneType`, `workspaceId`, and `senderIds`, plus campaign/table/source ids and
-row/message/approval counts. Inside
+row/message/approval counts. It must also include top-level `receiptArtifactPath`,
+top-level `durableReceiptWritten:true`, top-level `receiptRunId`, and top-level
+`receiptWrittenAt`; do not leave `receiptArtifactPath` only under
+`createCampaignWorkflowReceipt` for the parent to patch during verify. Inside
 `createCampaignStepReceipt.messageDraftingReceipt`, `sampleMessages[]` must
 include `rowId`, `generatedMessageText`, `verdict`, and `issues`. Do not
 substitute `message` for `generatedMessageText`. Do not substitute
@@ -615,6 +640,8 @@ before writing JSON; do not leave only raw objects like
 `get_campaign_message_preparation_status`, `attachRecommendedSequenceResult`,
 `finalCampaignRead`, or `finalTableRead`.
 Self-check shorthand: top-level `planRevision`, `actionId`, `laneKey`, `laneType`, `workspaceId`, and `senderIds` must exist before worker completion.
+Self-check shorthand: top-level `receiptArtifactPath`, `durableReceiptWritten:true`, `receiptRunId`, and `receiptWrittenAt` must exist before worker completion.
+Self-check shorthand: top-level `receiptWrittenAt` must exist before worker completion.
 Self-check shorthand: `campaignBriefReceipt.briefHash`,
 `campaignBriefReceipt.deliveryFormat`, `campaignBriefReceipt.tokenRules`,
 `campaignBriefReceipt.hardAvoids`, and `campaignBriefReceipt.sourceUseRules`
@@ -933,6 +960,17 @@ Message proof for every customer-visible lane must come from the current
 campaign/table basis and include at least 3 generated review rows from the
 packaged `generate-messages` path before completion is reported.
 Parent-thread handwritten copy or setting `currentStep` is not proof.
+
+The parent must run its own sample-quality gate before final reporting, even
+when worker receipts say `verdict:"passed"`. For each shared lane, normalize the
+reviewed sample messages by removing leading greeting/name lines, first names,
+and whitespace-only differences; reject shared-lane samples when the message body is identical after removing first names or when all samples share the same
+paragraph skeleton. Also reject final shared-lane samples with `Hey <name>,`
+letter punctuation, weak relevance hedges, internal workflow vocabulary,
+self-intros, or any non-empty `issues`. If the parent finds repeated shared-lane
+sample copy, report `blocked: repeated_shared_lane_sample_copy`, revise the
+campaign brief/template through the packaged workflow, rerun Generate Message,
+and verify current-revision sample messages before final completion.
 </command_backed_workflow>
 
 <objective>