@sellable/install 0.1.262 → 0.1.264

package/bin/sellable-install.mjs

@@ -1944,7 +1944,8 @@ ${allowedToolsYaml(REFILL_SENDS_ALLOWED_TOOLS)}
 
 Use this as the customer-facing entrypoint for the Sellable \`refill-sends\`
 workflow. It supports \`--yolo\` and optional repeated \`--sender <name-or-id>\`
-selectors.
+selectors. It also supports \`--until YYYY-MM-DD\` to fill through a specific
+sender-local date instead of the default two send-day horizon.
 
 ## Bootstrap
 
@@ -1960,7 +1961,7 @@ Desktop, then start a new thread.
 ## Execute Workflow
 
 1. Call \`mcp__sellable__get_auth_status({})\`.
-2. Normalize invocation arguments with \`mcp__sellable__refill_sends({ yolo, senders, senderIds, senderNames })\` when the host exposes typed MCP tools.
+2. Normalize invocation arguments with \`mcp__sellable__refill_sends({ yolo, senders, senderIds, senderNames, untilDate })\` when the host exposes typed MCP tools.
 3. Load the canonical prompt via
    \`mcp__sellable__get_subskill_prompt({ subskillName: "refill-sends" })\`,
    then load \`mcp__sellable__get_subskill_prompt({ subskillName: "refill-sends-workflow" })\`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.262",
+  "version": "0.1.264",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {

package/skill-templates/create-evergreen-campaigns.md

@@ -234,7 +234,15 @@ blocker and would make the whole yolo plan non-autoExecutable even though the
 operator asked to leave it untouched. Inventory and waterfall proof may mention
 the protected lane, but selectedActionIds and lane workers must cover only the
 shared lane packets.
+If the operator says to preserve existing active/live campaigns, preserve an
+ACTIVE Post Engagers lane the same way: treat it as protected inventory, exclude
+it from `postEngagerSenderIds` for the execution plan, and select only the
+remaining missing/reusable shared-lane actionIds. Do not let a protected active
+Post Engagers reuse packet block shared-lane verification or repair. Report the
+protected active lane in inventory/final notes, but do not dispatch a worker for
+it and do not include it in `selectedActionIds`.
 Short form: Do not include the protected active Post Engagers lane as a reuse packet when the operator requested only shared lane execution.
+Short form: "preserve existing active/live campaigns" means exclude ACTIVE Post Engagers from yolo execution, not block all shared-lane work.
 
 When senders are ambiguous, ask which sender ids belong in the Post Engagers
 sender scope and which belong in the shared lane sender scope before planning.
@@ -346,6 +354,14 @@ When launching durable Codex CLI workers from an automation parent, pass an
 explicit supported worker model instead of relying on the Codex CLI default
 model. Use the parent runtime model when known, for example:
 `codex -a never -s danger-full-access exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+In Codex CLI, the parent runtime model is visible in the run header as
+`model: <model-name>`. Copy that exact model string into child worker launches
+first. If the parent header says `model: gpt-5.5`, launch workers with
+`-m gpt-5.5`; do not invent or probe nearby aliases such as `gpt-5.3-codex`,
+`gpt-5.2`, `gpt-5-codex`, `codex-latest`, or `codex-mini-latest` before trying
+the exact parent model. A one-line probe must count as supported only when it
+exits 0 and returns the requested output; a session header followed by a
+`not supported` error is rejected, not accepted.
 Do not rely on the Codex CLI default model; some customer and VPS installs
 default to unavailable model aliases. If the parent cannot identify a supported
 worker model and a test `codex exec -m <worker-model>` launch is rejected, stop
@@ -1033,6 +1049,13 @@ canonical lane receipt. Repair workers must stage successful repaired receipts
 under `repair-staged/` first; only after fresh MCP readbacks, improved current
 samples, exactly one approved generated route-proof row, and a local JSON
 self-check pass may the worker atomically replace the canonical lane receipt.
+Repair workers must not call `setup_evergreen_campaigns({ mode:"verify" })`
+or `setup_evergreen_campaigns({ mode:"plan" })`; parent verification and
+idempotency are parent responsibilities after all selected lane receipts are
+ready. A stale-plan/action response from any accidental repair-worker verify
+call is not a product-state blocker and must not prevent a repaired receipt from
+replacing the canonical receipt when fresh product readbacks and local
+sample/receipt checks pass.
 After the repair worker completes the final product readbacks
 (`get_campaign_messages_preview`, `get_campaign`, navigation/table readback),
 it must stage and then rewrite the durable receipt immediately before any
@@ -1049,6 +1072,8 @@ Short form: repair prompts use compact repair packets, not full receipt JSON.
 Short form: Do not include existing receipt JSON in repair prompts.
 Short form: repair workers stage repaired receipts before replacing canonical receipts.
 Short form: repair blockers never overwrite canonical success receipts.
+Short form: repair workers do not call setup_evergreen_campaigns verify or plan.
+Short form: parent owns setup_evergreen_campaigns verify and idempotency.
 Short form: repair workers write the durable receipt immediately after final readbacks.
 Short form: missing repair receipt rewrite is `blocked: repair_receipt_write_timeout`.
 

package/skill-templates/refill-sends.md

@@ -66,14 +66,18 @@ Accepted invocation flags in the same user request:
   fresh state reread.
 - `--sender <name-or-id>`: scope to a specific sender; repeat for multiple
   senders.
+- `--until <YYYY-MM-DD>`: fill through that sender-local date, inclusive,
+  instead of the default two send-day horizon.
 - `senderIds: <id>, <id>` or `senderNames: <name>, <name>`: explicit selector
   alternatives when the host preserves natural-language arguments better than
   shell-style flags.
+- `untilDate: YYYY-MM-DD`: explicit date selector alternative when the host
+  preserves natural-language arguments better than shell-style flags.
 
 When the host can call typed MCP tools, start with:
 
 ```text
-refill_sends({ yolo?: boolean, senders?: string[], senderIds?: string[], senderNames?: string[], horizonSendDays?: number })
+refill_sends({ yolo?: boolean, senders?: string[], senderIds?: string[], senderNames?: string[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD" })
 ```
 
 That command helper only normalizes arguments and returns the execution
@@ -132,13 +136,16 @@ reassignment, or campaigns outside those selected for the eligible sender set.
 Stop and re-plan if the route, sender set, ids, caps, blockers, or side-effect
 class drift before mutation.
 
-In `--yolo`, the default two-day fill horizon is two send days. For each target
-sender, compute the bounded gap from that sender's healthy daily capacity,
-existing future scheduler-owned scheduled sends, and rows already ready to
-schedule across active campaigns enrolled with that sender. Then pick the best
-same-sender campaign to fill the gap: prefer recent/future scheduler-owned sends
-for that sender, then strongest recent result evidence, then source health. Do
-not stop after filling only one sender when the request was sender-scoped. If a
+In `--yolo`, the default two-day fill horizon is two send days unless
+`--until`/`untilDate` is provided. If an until date is provided, compute bounded
+gaps through that sender-local date inclusive, skipping no-send days and never
+extending beyond that date without a new packet. For each target sender, compute
+the bounded gap from that sender's healthy daily capacity, existing future
+scheduler-owned scheduled sends, and rows already ready to schedule across
+active campaigns enrolled with that sender. Then pick the best same-sender
+campaign to fill the gap: prefer recent/future scheduler-owned sends for that
+sender, then strongest recent result evidence, then source health. Do not stop
+after filling only one sender when the request was sender-scoped. If a
 same-source copy hits the campaign-table row cap, split the current source into
 a bounded LinkedIn profile source list, confirm only that smaller list into the
 same campaign, and operate on the copied review batch. Do not fall back to