@sellable/install 0.1.263 → 0.1.265

package/bin/sellable-install.mjs

@@ -1944,7 +1944,8 @@ ${allowedToolsYaml(REFILL_SENDS_ALLOWED_TOOLS)}
 
 Use this as the customer-facing entrypoint for the Sellable \`refill-sends\`
 workflow. It supports \`--yolo\` and optional repeated \`--sender <name-or-id>\`
-selectors.
+selectors. It also supports \`--until YYYY-MM-DD\` to fill through a specific
+sender-local date instead of the default two send-day horizon.
 
 ## Bootstrap
 
@@ -1960,7 +1961,7 @@ Desktop, then start a new thread.
 ## Execute Workflow
 
 1. Call \`mcp__sellable__get_auth_status({})\`.
-2. Normalize invocation arguments with \`mcp__sellable__refill_sends({ yolo, senders, senderIds, senderNames })\` when the host exposes typed MCP tools.
+2. Normalize invocation arguments with \`mcp__sellable__refill_sends({ yolo, senders, senderIds, senderNames, untilDate })\` when the host exposes typed MCP tools.
 3. Load the canonical prompt via
    \`mcp__sellable__get_subskill_prompt({ subskillName: "refill-sends" })\`,
    then load \`mcp__sellable__get_subskill_prompt({ subskillName: "refill-sends-workflow" })\`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.263",
+  "version": "0.1.265",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {

package/skill-templates/create-evergreen-campaigns.md

@@ -234,7 +234,15 @@ blocker and would make the whole yolo plan non-autoExecutable even though the
 operator asked to leave it untouched. Inventory and waterfall proof may mention
 the protected lane, but selectedActionIds and lane workers must cover only the
 shared lane packets.
+If the operator says to preserve existing active/live campaigns, preserve an
+ACTIVE Post Engagers lane the same way: treat it as protected inventory, exclude
+it from `postEngagerSenderIds` for the execution plan, and select only the
+remaining missing/reusable shared-lane actionIds. Do not let a protected active
+Post Engagers reuse packet block shared-lane verification or repair. Report the
+protected active lane in inventory/final notes, but do not dispatch a worker for
+it and do not include it in `selectedActionIds`.
 Short form: Do not include the protected active Post Engagers lane as a reuse packet when the operator requested only shared lane execution.
+Short form: "preserve existing active/live campaigns" means exclude ACTIVE Post Engagers from yolo execution, not block all shared-lane work.
 
 When senders are ambiguous, ask which sender ids belong in the Post Engagers
 sender scope and which belong in the shared lane sender scope before planning.
@@ -261,11 +269,23 @@ sender scopes, explicit bindings, or an interactive session.
 
 When safe-yolo is blocked only because the plan needs normal setup work, ask
 for a **bounded delegated approval** over the rendered current plan instead of
-asking for each substep. The approval packet must name the workspace id, sender
-ids, lane keys, campaign/table ids or create intents, source/import caps,
-generate-message caps, route-proof approval policy, selectedActionIds,
-planRevision, allowed side-effect classes, and stop conditions. After that one
-approval covers the current planRevision, the parent may act on behalf of the
+asking for each substep. The approval request must be rendered from the plan's
+`approvalSummary`, not handwritten from raw lane packets alone. Show:
+
+- `workspaceId`, `planRevision`, and `selectedActionIds`.
+- Sender scopes with display names and ids: Post Engagers senders and shared-lane senders.
+- `campaignsToCreate`: each campaign/lane name, action id, create intent, attached senders, and allowed side effects.
+- `campaignsToUpdate`: each existing campaign/table id, current status/step, attached senders, and exact repairs or setup side effects.
+- `campaignsToVerifyOnly`: existing campaigns that will only be verified/read.
+- `campaignsLeftUntouched`: existing campaigns attached to selected senders but excluded from the current selected lane scope, with the reason.
+- Source/import caps, generate-message caps, route-proof approval policy, allowed side-effect classes, forbidden side effects, blockers, and stop conditions.
+
+If `approvalSummary.approvalQuestion` is present, use it as the short approval
+question and put the detailed buckets underneath. Do not ask a vague yes/no
+question that only says "run evergreen setup" or "approve this plan" without
+naming the campaigns to create, existing campaigns to update/verify, campaigns
+left untouched, and attached senders. After that one approval covers the current
+planRevision and selectedActionIds, the parent may act on behalf of the
 operator and execute the selectedActionIds end to end. Do not ask again for
 substep approvals for source import, create-campaign choices, Message Drafting,
 sequence attach/precheck, or exactly one route-proof approval when those actions
@@ -275,6 +295,7 @@ workspace id, sender ids, source/list id, campaign/table id, new campaign/table
 id, planRevision, actionId, selectedActionIds, allowed side effects, caps,
 status, or blocker set outside the approved packet.
 The short rule: one approval covers the current planRevision and selectedActionIds.
+The approval clarity rule: the operator approves named campaign create/update/verify/untouched buckets and attached senders, not a generic evergreen run.
 The execution rule: act on behalf of the operator; do not ask again for substep approvals while work stays within the lane packet, approved caps, approved side-effect classes, and route-proof approval policy.
 The drift rule: stop and re-plan when ids, caps, blockers, side-effect classes, or any new campaign/table id leave the approved packet.
 
@@ -346,6 +367,14 @@ When launching durable Codex CLI workers from an automation parent, pass an
 explicit supported worker model instead of relying on the Codex CLI default
 model. Use the parent runtime model when known, for example:
 `codex -a never -s danger-full-access exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+In Codex CLI, the parent runtime model is visible in the run header as
+`model: <model-name>`. Copy that exact model string into child worker launches
+first. If the parent header says `model: gpt-5.5`, launch workers with
+`-m gpt-5.5`; do not invent or probe nearby aliases such as `gpt-5.3-codex`,
+`gpt-5.2`, `gpt-5-codex`, `codex-latest`, or `codex-mini-latest` before trying
+the exact parent model. A one-line probe must count as supported only when it
+exits 0 and returns the requested output; a session header followed by a
+`not supported` error is rejected, not accepted.
 Do not rely on the Codex CLI default model; some customer and VPS installs
 default to unavailable model aliases. If the parent cannot identify a supported
 worker model and a test `codex exec -m <worker-model>` launch is rejected, stop

package/skill-templates/refill-sends.md

@@ -66,14 +66,18 @@ Accepted invocation flags in the same user request:
   fresh state reread.
 - `--sender <name-or-id>`: scope to a specific sender; repeat for multiple
   senders.
+- `--until <YYYY-MM-DD>`: fill through that sender-local date, inclusive,
+  instead of the default two send-day horizon.
 - `senderIds: <id>, <id>` or `senderNames: <name>, <name>`: explicit selector
   alternatives when the host preserves natural-language arguments better than
   shell-style flags.
+- `untilDate: YYYY-MM-DD`: explicit date selector alternative when the host
+  preserves natural-language arguments better than shell-style flags.
 
 When the host can call typed MCP tools, start with:
 
 ```text
-refill_sends({ yolo?: boolean, senders?: string[], senderIds?: string[], senderNames?: string[], horizonSendDays?: number })
+refill_sends({ yolo?: boolean, senders?: string[], senderIds?: string[], senderNames?: string[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD" })
 ```
 
 That command helper only normalizes arguments and returns the execution
@@ -132,13 +136,16 @@ reassignment, or campaigns outside those selected for the eligible sender set.
 Stop and re-plan if the route, sender set, ids, caps, blockers, or side-effect
 class drift before mutation.
 
-In `--yolo`, the default two-day fill horizon is two send days. For each target
-sender, compute the bounded gap from that sender's healthy daily capacity,
-existing future scheduler-owned scheduled sends, and rows already ready to
-schedule across active campaigns enrolled with that sender. Then pick the best
-same-sender campaign to fill the gap: prefer recent/future scheduler-owned sends
-for that sender, then strongest recent result evidence, then source health. Do
-not stop after filling only one sender when the request was sender-scoped. If a
+In `--yolo`, the default two-day fill horizon is two send days unless
+`--until`/`untilDate` is provided. If an until date is provided, compute bounded
+gaps through that sender-local date inclusive, skipping no-send days and never
+extending beyond that date without a new packet. For each target sender, compute
+the bounded gap from that sender's healthy daily capacity, existing future
+scheduler-owned scheduled sends, and rows already ready to schedule across
+active campaigns enrolled with that sender. Then pick the best same-sender
+campaign to fill the gap: prefer recent/future scheduler-owned sends for that
+sender, then strongest recent result evidence, then source health. Do not stop
+after filling only one sender when the request was sender-scoped. If a
 same-source copy hits the campaign-table row cap, split the current source into
 a bounded LinkedIn profile source list, confirm only that smaller list into the
 same campaign, and operate on the copied review batch. Do not fall back to