@sellable/install 0.1.307 → 0.1.309

package/README.md

@@ -122,6 +122,13 @@ It creates:
 /srv/hermes/profiles/acme/.env        # only when Slack token inputs are supplied
 ```
 
+For profile paths under a gateway root such as
+`/srv/hermes/profiles/acme`, bootstrap also registers
+`/srv/hermes/profiles/acme/skills/sellable` in the gateway root
+`/srv/hermes/config.yaml` as `skills.external_dirs`. Keep this behavior:
+Hermes Desktop command autocomplete scans the gateway/root skill config, not
+only the selected profile's local skill tree.
+
 If no token is supplied, bootstrap still creates a pending
 `sellable/config.json` so the profile path is concrete from the first MCP
 launch. Finish auth with:

package/bin/sellable-install.mjs

@@ -13,7 +13,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { stdout as output } from "node:process";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
@@ -2087,9 +2087,9 @@ Desktop, then start a new thread.
 
 1. Call \`mcp__sellable__get_auth_status({})\`.
 2. Resolve the target workspace id from the user request, automation config, or install-time workspace mapping. Pass \`workspaceId\` on every scheduled or \`--yolo\` refill tool call. Missing \`workspaceId\` in scheduled or \`--yolo\` mode is a blocker; return \`WORKSPACE_REQUIRED\` instead of running against shared config state. Do not solve automation workspace uncertainty by changing the shared active workspace.
-3. Normalize invocation arguments with \`mcp__sellable__refill_sends({ yolo, executionMode, requireWorkspace, workspaceId, senders, senderIds, senderNames, horizonSendDays, targetDate, untilDate })\` when the host exposes typed MCP tools. Type shape: \`refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD" })\`.
+3. Normalize invocation arguments with \`mcp__sellable__refill_sends({ yolo, executionMode, requireWorkspace, workspaceId, senders, senderIds, senderNames, targetDate, untilDate })\` when the host exposes typed MCP tools. Type shape: \`refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD" })\`.
 4. Clover scheduled automation example: \`mcp__sellable__refill_sends({ yolo:false, executionMode:"scheduled", requireWorkspace:true, workspaceId:"cmlq1v8ms0000jx04ang4hi7e" })\`, then \`mcp__sellable__get_refill_target_plan({ intent:"plain", approvalMode:"mark_ready", workspaceId:"cmlq1v8ms0000jx04ang4hi7e" })\`.
-5. Call \`mcp__sellable__get_refill_target_plan({ workspaceId, senders, senderIds, senderNames, horizonSendDays, targetDate, untilDate })\` before any mutation. Render \`target.eligibleSenderLedger\`, \`target.senderRefillPlans[]\`, and \`target.globalActionQueue\` as the structured packet. Preserve the labels \`Need to prepare\`, \`Goal\`, \`Already sent\`, \`Scheduled\`, \`Ready and waiting to be scheduled\`, and \`Still need\`. In \`--yolo\`, \`mcp__sellable__refill_sends\` maintains a run-local \`refreshedPaidInmailSenderIds\` set, refreshes stale/missing paid InMail facts for each selected paid-InMail sender at most once, reruns \`get_refill_target_plan\`, and returns \`autoPaidInmailRefresh\` plus the post-refresh \`targetPlan\` before choosing the next prep/source-copy/bounded-approval/read-only wait action. Refill ladder: approve generated rows only through the explicit bounded approval gate, process existing same-campaign unenriched/unprepared rows before source work, then same-source copy, then provider-aligned source-more. New source/provider switches change reply-rate baseline and are manual alternates, not \`--yolo\` side effects. Do not present paid-credit refresh as the next operator action after \`refill_sends\` returns that post-refresh plan. For exact-date proof, \`mcp__sellable__get_scheduler_fill_capacity\` is read-only and tells how many cells the scheduler will try to place for a sender/action/date. When ready rows cover the target but scheduled rows do not, \`mcp__sellable__run_scheduler_sweep({ workspaceId, action:"run", targetDate })\` may request immediate placement within existing gates and returns a receipt, but it never sends or bypasses limits. If the returned target is already complete, stop with the no-op receipt. If ready rows cover the target but scheduled rows do not, keep the run open in the read-only scheduler wait/re-read loop until projected coverage fills, a concrete non-scheduler blocker appears, or Christian explicitly stops/statuses the run.
+5. Call \`mcp__sellable__get_refill_target_plan({ workspaceId, senders, senderIds, senderNames, targetDate, untilDate })\` before any mutation. Render \`target.eligibleSenderLedger\`, \`target.senderRefillPlans[]\`, and \`target.globalActionQueue\` as the structured packet. Preserve the labels \`Need to prepare\`, \`Goal\`, \`Already sent\`, \`Scheduled\`, \`Ready and waiting to be scheduled\`, and \`Still need\`. In \`--yolo\`, \`mcp__sellable__refill_sends\` maintains a run-local \`refreshedPaidInmailSenderIds\` set, refreshes stale/missing paid InMail facts for each selected paid-InMail sender at most once, reruns \`get_refill_target_plan\`, and returns \`autoPaidInmailRefresh\` plus the post-refresh \`targetPlan\` before choosing the next prep/source-copy/bounded-approval/read-only wait action. Refill ladder: approve generated rows only through the explicit bounded approval gate, process existing same-campaign unenriched/unprepared rows before source work, then same-source copy, then provider-aligned source-more. New source/provider switches change reply-rate baseline and are manual alternates, not \`--yolo\` side effects. Do not present paid-credit refresh as the next operator action after \`refill_sends\` returns that post-refresh plan. For exact-date proof, \`mcp__sellable__get_scheduler_fill_capacity\` is read-only and tells how many cells the scheduler will try to place for a sender/action/date. When ready rows cover the target but scheduled rows do not, \`mcp__sellable__run_scheduler_sweep({ workspaceId, action:"run" })\` may request immediate placement within existing gates and returns a receipt, but it never sends or bypasses limits. If the returned target is already complete, stop with the no-op receipt. If ready rows cover the target but scheduled rows do not, keep the run open in the read-only scheduler wait/re-read loop until projected coverage fills, a concrete non-scheduler blocker appears, or Christian explicitly stops/statuses the run.
 6. Load the canonical prompt and deterministic flow asset via
    \`mcp__sellable__get_subskill_prompt({ subskillName: "refill-sends" })\`,
    then load \`mcp__sellable__get_subskill_prompt({ subskillName: "refill-sends-workflow" })\`,
@@ -3663,6 +3663,19 @@ function hermesSkillsRoot(opts = {}) {
   return join(hermesHome(opts), "skills", "sellable");
 }
 
+function hermesGatewayRoot(opts = {}) {
+  const profileRoot = hermesHome(opts);
+  const profilesRoot = dirname(profileRoot);
+  if (basename(profilesRoot) !== "profiles") return null;
+  return dirname(profilesRoot);
+}
+
+function hermesGatewayConfigPath(opts = {}) {
+  const root = hermesGatewayRoot(opts);
+  if (!root) return null;
+  return join(root, "config.yaml");
+}
+
 function hermesLikelyInstalled() {
   return (
     Boolean(process.env.HERMES_HOME?.trim()) ||
@@ -3742,6 +3755,38 @@ function writeHermesMcpServer(opts) {
   return configPath;
 }
 
+function writeHermesGatewaySkillDirectory(opts) {
+  const configPath = hermesGatewayConfigPath(opts);
+  if (!configPath || configPath === hermesConfigPath(opts)) return null;
+
+  const skillDir = hermesSkillsRoot(opts);
+  const raw = existsSync(configPath) ? readFileSync(configPath, "utf8") : "";
+  const config = parseHermesConfig(raw, configPath);
+  // Hermes Desktop slash autocomplete scans the gateway/root HERMES_HOME. A
+  // profile can execute its own skills without this, but Desktop will not show
+  // /sellable-* commands until the root scanner sees the profile skill dir.
+  const skills =
+    config.skills && typeof config.skills === "object" && !Array.isArray(config.skills)
+      ? config.skills
+      : {};
+  const current = Array.isArray(skills.external_dirs)
+    ? skills.external_dirs
+    : skills.external_dirs
+      ? [skills.external_dirs]
+      : [];
+  const externalDirs = current.includes(skillDir) ? current : [...current, skillDir];
+  const nextConfig = {
+    ...config,
+    skills: {
+      ...skills,
+      external_dirs: externalDirs,
+    },
+  };
+
+  writeHermesConfig(configPath, nextConfig, opts);
+  return { configPath, skillDir };
+}
+
 function installHermesSkills(opts) {
   const root = hermesSkillsRoot(opts);
   for (const skill of hermesSkillDefinitions()) {
@@ -3762,8 +3807,15 @@ function installHermes(opts) {
   try {
     skillsRoot = installHermesSkills(opts);
     const configPath = writeHermesMcpServer(opts);
+    const gateway = writeHermesGatewaySkillDirectory(opts);
     logVerbose(`${C.grey}+ Hermes config updated: ${configPath}${C.reset}`);
-    return { installed: true, configPath, skillsRoot };
+    return {
+      installed: true,
+      configPath,
+      skillsRoot,
+      gatewayConfigPath: gateway?.configPath || null,
+      gatewayExternalSkillsDir: gateway?.skillDir || null,
+    };
   } catch (err) {
     if (skillsRoot && !opts.dryRun) {
       rmSync(skillsRoot, { recursive: true, force: true });
@@ -4001,6 +4053,7 @@ function runHermesProfileBootstrap(argv) {
         sellableConfigPath,
         sellableConfigsDir,
         skillsRoot: hermesSkillsRoot(opts),
+        gatewayConfigPath: hermesGatewayConfigPath(opts),
       },
       auth: {
         apiUrl: opts.apiUrl,
@@ -4085,6 +4138,8 @@ function runHermesProfileBootstrap(argv) {
     }
 
     const hermesConfigExisted = existsSync(hermesConfigPath(opts));
+    const gatewayConfigPath = hermesGatewayConfigPath(opts);
+    const gatewayConfigExisted = gatewayConfigPath ? existsSync(gatewayConfigPath) : false;
     const skillsExisted = existsSync(hermesSkillsRoot(opts));
     const authExisted = existsSync(sellableConfigPath);
     const configsDirExisted = existsSync(sellableConfigsDir);
@@ -4138,6 +4193,11 @@ function runHermesProfileBootstrap(argv) {
     (hermesConfigExisted ? summary.updated : summary.created).push(
       hermesConfigPath(opts)
     );
+    if (gatewayConfigPath) {
+      (gatewayConfigExisted ? summary.updated : summary.created).push(
+        gatewayConfigPath
+      );
+    }
     (skillsExisted ? summary.updated : summary.created).push(hermesSkillsRoot(opts));
     if (Object.values(slackTokens).some(Boolean)) {
       (envExisted ? summary.updated : summary.created).push(envPath);

package/lib/runtime-verify.mjs

@@ -32,6 +32,7 @@ export const REQUIRED_SELLABLE_MCP_TOOLS = [
   "get_campaign_refill_state",
   "get_refill_target_plan",
   "get_scheduler_fill_capacity",
+  "refresh_paid_inmail_credits",
   "run_scheduler_sweep",
   "refill_sends",
   "setup_evergreen_campaigns",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.307",
+  "version": "0.1.309",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {

package/skill-templates/refill-sends-v2.md

@@ -37,21 +37,16 @@ active workspace readback. Scheduled or autonomous usage must carry
 `workspaceId` on every tool call. If the workspace is missing or ambiguous, stop
 with `WORKSPACE_REQUIRED`; do not switch the shared active workspace.
 
-Date selectors are sender-local and mutually exclusive by precedence:
-`targetDate > untilDate > horizonSendDays`. Use `targetDate` for one exact sender-local date, `untilDate` for an inclusive through-date, and `horizonSendDays` for the next N sender-local send days. If none is provided, the planner uses the default scheduler-forward 48-hour behavior.
-
 For a real refill run:
 
 ```text
-refill_sends_v2({ workspaceId, intent:"auto", senderIds?, approvalMode?, targetDate?, untilDate?, horizonSendDays? })
-refill_sends_v2({ workspaceId, targetDate:"2026-07-07" })
-refill_sends_v2({ workspaceId, untilDate:"2026-07-09" })
+refill_sends_v2({ workspaceId, intent:"auto", senderIds?, approvalMode? })
 ```
 
 For read-only inspection:
 
 ```text
-refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds?, targetDate?, untilDate?, horizonSendDays? })
+refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 ```
 
 To resume an in-progress run, pass the handle back exactly:
@@ -60,11 +55,6 @@ To resume an in-progress run, pass the handle back exactly:
 refill_sends_v2({ workspaceId, runId, fence })
 ```
 
-The original run's date window is stored in the run record. On resume, the
-stored window is reused and conflicting resume input is blocked; do not add,
-change, or remove `targetDate`, `untilDate`, or `horizonSendDays` while passing
-an existing `{ runId, fence }`.
-
 If a stale handle loses the lease, the tool reports the holder status and the
 approximately 10 minute lockout window. Reinvoke with the current handle or wait
 for lease expiry; never guess a fence.
@@ -135,12 +125,9 @@ host guard, heartbeats the run lease, and may return:
 ```
 
 Reinvoke with that handle. The approximately five minute scheduler budget is at
-the run level, not one tool call. Exact-date runs request pickup with
-`run_scheduler_sweep({ workspaceId, targetDate })`; `untilDate` and
-`horizonSendDays` runs sweep each planner-selected exact target date. A
-window-closed or loaded-awaiting scheduler report must include remaining-ready
-count, exact expected pickup time, and the resume handle; never treat bare
-"awaiting scheduler" copy as a final answer.
+the run level, not one tool call. A window-closed or loaded-awaiting scheduler
+report must include remaining-ready count, exact expected pickup time, and the
+resume handle; never treat bare "awaiting scheduler" copy as a final answer.
 Scheduler-run receipt interpretation still applies to terminal progress:
 `cellsConsidered is allocation-attempt count`, not total ready supply, while
 `readyCellsFound` is ready inventory found before prefilters. Inspect

package/skill-templates/refill-sends.md

@@ -87,12 +87,6 @@ Accepted invocation flags in the same user request:
   preserves natural-language arguments better than shell-style flags.
 - `targetDate: YYYY-MM-DD`: exact-date selector alternative when the host
   preserves natural-language arguments better than shell-style flags.
-- `horizonSendDays: N`: compatibility selector for the next N sender-local send
-  days when no exact or through-date selector is present.
-
-Date selector precedence is `targetDate > untilDate > horizonSendDays`. Use
-`targetDate` for one exact sender-local date, `untilDate` for an inclusive
-through-date, and `horizonSendDays` for the next N sender-local send days.
 
 When the host can call typed MCP tools, start with:
 
@@ -278,9 +272,7 @@ same sender/action/date; it tells the MCP how many cells the product scheduler
 will try to place and does not import, approve, schedule, refresh credits, or
 mutate.
 When the refill loop has ready rows and needs scheduler pickup now, use
-`run_scheduler_sweep({ workspaceId, targetDate })` for exact-date requests. For
-`untilDate` or `horizonSendDays` requests, sweep each planner-selected
-`targetDate` with the same explicit `workspaceId`. The sweep can place cells
+`run_scheduler_sweep` with the same explicit `workspaceId`; it can place cells
 within existing scheduler gates and returns the receipt, but it never sends or
 bypasses limits.
 Scheduler-run receipt interpretation: `cellsConsidered is allocation-attempt