@sellable/install 0.1.321 → 0.1.323

package/lib/codex-plugin-selection.mjs

@@ -0,0 +1,353 @@
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readlinkSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
+
+export const CODEX_PLUGIN_SELECTION_SCHEMA_VERSION = 1;
+export const MAX_CODEX_CANARY_WINDOW_MS = 90 * 60 * 1000;
+
+export function resolveCodexPluginSelectionPaths({
+  home = "",
+  marketplaceRoot = join(home, ".sellable", "codex-marketplace"),
+  cacheRoot = join(home, ".codex", "plugins", "cache", "sellable", "sellable"),
+} = {}) {
+  if (!home) throw new Error("codex_selection_home_required");
+  return {
+    home: resolve(home),
+    configPath: join(home, ".codex", "config.toml"),
+    marketplaceRoot: resolve(marketplaceRoot),
+    marketplacePath: join(marketplaceRoot, ".agents", "plugins", "marketplace.json"),
+    pluginRoot: join(marketplaceRoot, "plugins", "sellable"),
+    cacheRoot: resolve(cacheRoot),
+  };
+}
+
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, canonicalize(value[key])])
+    );
+  }
+  return value;
+}
+
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function canonicalDigest(value) {
+  return digest(JSON.stringify(canonicalize(value)));
+}
+
+function treeRecords(root) {
+  if (!existsSync(root)) return [{ path: ".", type: "missing" }];
+  const records = [];
+  const visit = (path) => {
+    const stat = lstatSync(path);
+    const rel = relative(root, path) || ".";
+    if (stat.isSymbolicLink()) {
+      records.push({ path: rel, type: "symlink", target: readlinkSync(path) });
+      return;
+    }
+    if (stat.isDirectory()) {
+      records.push({ path: rel, type: "directory", mode: stat.mode & 0o777 });
+      for (const name of readdirSync(path).sort()) visit(join(path, name));
+      return;
+    }
+    records.push({
+      path: rel,
+      type: "file",
+      mode: stat.mode & 0o777,
+      sha256: digest(readFileSync(path)),
+    });
+  };
+  visit(root);
+  return records;
+}
+
+function treeHash(root) {
+  return canonicalDigest(treeRecords(root));
+}
+
+function pluginVersion(pluginRoot) {
+  const manifestPath = join(pluginRoot, ".codex-plugin", "plugin.json");
+  if (!existsSync(manifestPath)) throw new Error("codex_selection_plugin_manifest_missing");
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  if (manifest.name !== "sellable" || typeof manifest.version !== "string") {
+    throw new Error("codex_selection_plugin_manifest_invalid");
+  }
+  return manifest.version;
+}
+
+function ensureInside(parent, child, code) {
+  const root = resolve(parent);
+  const target = resolve(child);
+  if (!(target === root || target.startsWith(`${root}/`))) throw new Error(code);
+}
+
+function copyExact(source, target) {
+  rmSync(target, { recursive: true, force: true });
+  mkdirSync(dirname(target), { recursive: true });
+  cpSync(source, target, {
+    recursive: true,
+    dereference: false,
+    preserveTimestamps: true,
+  });
+  syncExactModes(source, target);
+}
+
+function syncExactModes(source, target) {
+  const stat = lstatSync(source);
+  if (stat.isSymbolicLink()) return;
+  chmodSync(target, stat.mode & 0o777);
+  if (!stat.isDirectory()) return;
+  for (const name of readdirSync(source)) {
+    syncExactModes(join(source, name), join(target, name));
+  }
+}
+
+function readCanonicalManifest(manifestPath, expectedSnapshotHash) {
+  const raw = readFileSync(manifestPath, "utf8");
+  const manifest = JSON.parse(raw);
+  if (raw !== `${JSON.stringify(manifest, null, 2)}\n`) {
+    throw new Error("codex_selection_snapshot_manifest_not_canonical");
+  }
+  const { snapshotHash, ...unsigned } = manifest;
+  if (snapshotHash !== canonicalDigest(unsigned) || snapshotHash !== expectedSnapshotHash) {
+    throw new Error("codex_selection_snapshot_hash_mismatch");
+  }
+  for (const item of manifest.items ?? []) {
+    if (treeHash(item.backupPath) !== item.hash) {
+      throw new Error(`codex_selection_snapshot_backup_mismatch:${item.name}`);
+    }
+  }
+  return manifest;
+}
+
+function stateItems(paths, stableVersion) {
+  return [
+    { name: "config", sourcePath: paths.configPath },
+    { name: "marketplace", sourcePath: paths.marketplacePath },
+    { name: "pluginRoot", sourcePath: paths.pluginRoot },
+    { name: "stableCache", sourcePath: join(paths.cacheRoot, stableVersion) },
+  ];
+}
+
+function stateHash(paths, stableVersion) {
+  return canonicalDigest(
+    stateItems(paths, stableVersion).map((item) => ({
+      name: item.name,
+      sourcePath: item.sourcePath,
+      hash: treeHash(item.sourcePath),
+    }))
+  );
+}
+
+export function snapshotCodexPluginSelection({ paths, snapshotRoot }) {
+  if (!paths || !snapshotRoot) throw new Error("codex_selection_snapshot_arguments_required");
+  if (existsSync(snapshotRoot)) throw new Error("codex_selection_snapshot_root_exists");
+  const version = pluginVersion(paths.pluginRoot);
+  const items = stateItems(paths, version).map((item) => {
+    if (!existsSync(item.sourcePath)) {
+      throw new Error(`codex_selection_snapshot_source_missing:${item.name}`);
+    }
+    const backupPath = join(snapshotRoot, "data", item.name);
+    copyExact(item.sourcePath, backupPath);
+    return { ...item, backupPath, hash: treeHash(item.sourcePath) };
+  });
+  const unsigned = {
+    schemaVersion: CODEX_PLUGIN_SELECTION_SCHEMA_VERSION,
+    createdAt: new Date().toISOString(),
+    pluginVersion: version,
+    stateHash: stateHash(paths, version),
+    paths,
+    items,
+  };
+  const manifest = { ...unsigned, snapshotHash: canonicalDigest(unsigned) };
+  const manifestPath = join(snapshotRoot, "snapshot.json");
+  mkdirSync(dirname(manifestPath), { recursive: true });
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+  return { manifestPath, snapshotHash: manifest.snapshotHash, pluginVersion: version };
+}
+
+export function installCodexCandidateCache({ paths, sourcePluginRoot, version }) {
+  if (!paths || !sourcePluginRoot || !version) throw new Error("codex_candidate_cache_arguments_required");
+  if (pluginVersion(sourcePluginRoot) !== version) throw new Error("codex_candidate_version_mismatch");
+  const target = join(paths.cacheRoot, version);
+  ensureInside(paths.cacheRoot, target, "codex_candidate_cache_path_escape");
+  const sourceHash = treeHash(sourcePluginRoot);
+  if (existsSync(target)) {
+    if (treeHash(target) !== sourceHash) throw new Error("codex_candidate_cache_collision");
+  } else {
+    mkdirSync(paths.cacheRoot, { recursive: true });
+    const staging = join(paths.cacheRoot, `.phase98-${version}-${process.pid}`);
+    copyExact(sourcePluginRoot, staging);
+    if (treeHash(staging) !== sourceHash) throw new Error("codex_candidate_cache_copy_mismatch");
+    renameSync(staging, target);
+  }
+  return { version, cachePath: target, cacheHash: sourceHash };
+}
+
+function withSelectionLock(paths, fn) {
+  mkdirSync(paths.cacheRoot, { recursive: true });
+  const lockPath = join(paths.cacheRoot, ".phase98-selection.lock");
+  let handle;
+  try {
+    handle = openSync(lockPath, "wx", 0o600);
+  } catch {
+    throw new Error("codex_selection_concurrent_operation");
+  }
+  try {
+    return fn();
+  } finally {
+    closeSync(handle);
+    rmSync(lockPath, { force: true });
+  }
+}
+
+function atomicReplaceTree(source, target) {
+  const parent = dirname(target);
+  mkdirSync(parent, { recursive: true });
+  const staging = join(parent, `.${basename(target)}.phase98-next-${process.pid}`);
+  const previous = join(parent, `.${basename(target)}.phase98-prev-${process.pid}`);
+  copyExact(source, staging);
+  if (existsSync(target)) renameSync(target, previous);
+  try {
+    renameSync(staging, target);
+    rmSync(previous, { recursive: true, force: true });
+  } catch (error) {
+    rmSync(target, { recursive: true, force: true });
+    if (existsSync(previous)) renameSync(previous, target);
+    rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+export function activateCodexCandidateSelection(input) {
+  const {
+    paths,
+    snapshotManifestPath,
+    expectedSnapshotHash,
+    candidateVersion,
+    expectedCandidateHash,
+    approvalId,
+    approvedAt,
+    restoreBy,
+    now,
+  } = input;
+  if (!approvalId) throw new Error("codex_selection_approval_required");
+  const approvedMs = Date.parse(approvedAt);
+  const restoreMs = Date.parse(restoreBy);
+  const nowMs = Date.parse(now);
+  if (![approvedMs, restoreMs, nowMs].every(Number.isFinite)) {
+    throw new Error("codex_selection_window_invalid");
+  }
+  if (nowMs < approvedMs || nowMs >= restoreMs || restoreMs - approvedMs > MAX_CODEX_CANARY_WINDOW_MS) {
+    throw new Error("codex_selection_window_exceeds_limit");
+  }
+  return withSelectionLock(paths, () => {
+    const snapshot = readCanonicalManifest(snapshotManifestPath, expectedSnapshotHash);
+    if (stateHash(paths, snapshot.pluginVersion) !== snapshot.stateHash) {
+      throw new Error("codex_selection_current_state_drift");
+    }
+    const candidatePath = join(paths.cacheRoot, candidateVersion);
+    if (!existsSync(candidatePath) || treeHash(candidatePath) !== expectedCandidateHash) {
+      throw new Error("codex_selection_candidate_cache_mismatch");
+    }
+    atomicReplaceTree(candidatePath, paths.pluginRoot);
+    if (pluginVersion(paths.pluginRoot) !== candidateVersion || treeHash(paths.pluginRoot) !== expectedCandidateHash) {
+      throw new Error("codex_selection_candidate_activation_mismatch");
+    }
+    const activation = {
+      schemaVersion: CODEX_PLUGIN_SELECTION_SCHEMA_VERSION,
+      approvalId,
+      approvedAt,
+      activatedAt: now,
+      restoreBy,
+      snapshotHash: expectedSnapshotHash,
+      stableVersion: snapshot.pluginVersion,
+      candidateVersion,
+      candidateHash: expectedCandidateHash,
+      changedPaths: [paths.pluginRoot],
+    };
+    const activationPath = join(dirname(snapshotManifestPath), "activation.json");
+    writeFileSync(activationPath, `${JSON.stringify(activation, null, 2)}\n`, { mode: 0o600 });
+    return { ...activation, activationPath };
+  });
+}
+
+export function restoreCodexPluginSelection(input) {
+  const {
+    paths,
+    snapshotManifestPath,
+    expectedSnapshotHash,
+    activationPath,
+    now,
+    taskEvidence,
+    recoveryReason,
+  } = input;
+  return withSelectionLock(paths, () => {
+    const snapshot = readCanonicalManifest(snapshotManifestPath, expectedSnapshotHash);
+    const activation = JSON.parse(readFileSync(activationPath, "utf8"));
+    if (
+      activation.snapshotHash !== expectedSnapshotHash ||
+      activation.candidateHash !== treeHash(paths.pluginRoot)
+    ) throw new Error("codex_selection_active_candidate_drift");
+    if (!recoveryReason) {
+      if (!taskEvidence?.taskId || taskEvidence.resolvedCandidateHash !== activation.candidateHash) {
+        throw new Error("codex_selection_task_identity_mismatch");
+      }
+    }
+    for (const item of snapshot.items) copyExact(item.backupPath, item.sourcePath);
+    if (stateHash(paths, snapshot.pluginVersion) !== snapshot.stateHash) {
+      throw new Error("codex_selection_restore_hash_mismatch");
+    }
+    const deadlineExceeded = Date.parse(now) > Date.parse(activation.restoreBy);
+    const restoration = {
+      restored: true,
+      restoredAt: now,
+      deadlineExceeded,
+      recoveryReason: recoveryReason || null,
+      snapshotHash: expectedSnapshotHash,
+      stableVersion: snapshot.pluginVersion,
+      candidateVersion: activation.candidateVersion,
+    };
+    writeFileSync(
+      join(dirname(snapshotManifestPath), "restoration.json"),
+      `${JSON.stringify(restoration, null, 2)}\n`,
+      { mode: 0o600 }
+    );
+    return restoration;
+  });
+}
+
+export function readCodexPluginSelection({ paths, stableVersion } = {}) {
+  if (!paths) throw new Error("codex_selection_paths_required");
+  const version = pluginVersion(paths.pluginRoot);
+  const stable = stableVersion || version;
+  return {
+    pluginVersion: version,
+    pluginHash: treeHash(paths.pluginRoot),
+    configHash: treeHash(paths.configPath),
+    marketplaceHash: treeHash(paths.marketplacePath),
+    stableCacheHash: treeHash(join(paths.cacheRoot, stable)),
+    selectionHash: stateHash(paths, stable),
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.321",
+  "version": "0.1.323",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {

package/skill-templates/refill-sends-v2.md

@@ -1,9 +1,9 @@
 ---
 name: refill-sends-v2
 description: Execute refill sends v2 through the fenced evergreen refill loop, with dry-run and resume support.
-visibility: public
+visibility: internal
 allowed-tools:
-  - mcp__sellable__refill_sends_v2
+  - mcp__sellable__refill_sends
   - mcp__sellable__get_refill_plan_v2
   - mcp__sellable__get_subskill_prompt
   - mcp__sellable__get_subskill_asset
@@ -24,7 +24,7 @@ Host command names:
 - Claude Code: `/sellable:refill-sends-v2`
 - Codex: `$sellable:refill-sends-v2`
 
-`refill_sends_v2` is the execution surface. In real-run mode it starts or
+`refill_sends` is the execution surface. In real-run mode it starts or
 resumes a fenced refill run, reads a fresh packet, executes only the packet's
 named bounded work, verifies the result, and returns either a terminal report, a
 blocked report, or an in-progress resume handle. In dry-run mode it stays
@@ -40,19 +40,19 @@ with `WORKSPACE_REQUIRED`; do not switch the shared active workspace.
 For a real refill run:
 
 ```text
-refill_sends_v2({ workspaceId, intent:"auto", senderIds?, approvalMode? })
+refill_sends({ workspaceId, intent:"auto", senderIds?, approvalMode? })
 ```
 
 For read-only inspection:
 
 ```text
-refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
+refill_sends({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 ```
 
 To resume an in-progress run, pass the handle back exactly:
 
 ```text
-refill_sends_v2({ workspaceId, runId, fence })
+refill_sends({ workspaceId, runId, fence })
 ```
 
 If a stale handle loses the lease, the tool reports the holder status and the