@sellable/install 0.1.326 → 0.1.328

package/bin/sellable-install.mjs

@@ -48,7 +48,7 @@ function getInstallVersion() {
   }
 }
 
-const CODEX_PLUGIN_VERSION = "0.1.56";
+const CODEX_PLUGIN_VERSION = "0.1.58";
 const CODEX_PLUGIN_COMPAT_VERSIONS = [
   "0.1.8",
   "0.1.9",
@@ -2064,7 +2064,41 @@ installPackageVersion: ${getInstallVersion()}
 codexPluginVersion: ${CODEX_PLUGIN_VERSION}
 <!-- REFILL_CONTRACT_GENERATED:END -->`;
 
-function refillSendsSkillMd(host = "shared") {
+function refillReleaseIdentityBlock(host, opts = {}) {
+  const match = /^@sellable\/mcp@(.+)$/.exec(opts.mcpPackage || "");
+  const mcpVersion = match?.[1] || String(opts.mcpPackage || "unknown");
+  const pluginVersion = host === "codex" ? CODEX_PLUGIN_VERSION : "not-applicable";
+  const cacheIdentity =
+    host === "codex"
+      ? `codex-plugin:${pluginVersion}|mcp:${mcpVersion}`
+      : `${host}-host|mcp:${mcpVersion}`;
+  return `## Installed release identity
+
+expectedMcpPackageVersion: ${mcpVersion}
+expectedInstallPackageVersion: ${getInstallVersion()}
+expectedCodexPluginVersion: ${pluginVersion}
+expectedPluginCacheIdentity: ${cacheIdentity}
+
+Immediately after \`get_auth_status\`, require
+\`update.mcp.currentVersion\` to equal \`${mcpVersion}\`. If it is missing or
+different, stop with \`installed_mcp_identity_mismatch\` before any product mutation.
+Do not call \`get_refill_target_plan\`, \`refill_sends\`, or another mutating
+workflow tool. Explain that Codex is still using a stale Sellable MCP runtime,
+then fully quit and reopen Codex Desktop and start a new thread.`;
+}
+
+function stampRefillReleaseIdentity(markdown, host, opts) {
+  const marker = markdown.includes("## Bootstrap and execute")
+    ? "## Bootstrap and execute"
+    : "## Bootstrap";
+  if (!markdown.includes(marker)) return markdown;
+  return markdown.replace(
+    marker,
+    `${refillReleaseIdentityBlock(host, opts)}\n\n${marker}`
+  );
+}
+
+function refillSendsSkillMd(host = "shared", opts = {}) {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     const templatePath = join(
@@ -2078,9 +2112,13 @@ function refillSendsSkillMd(host = "shared") {
       existsSync(templatePath)
     ) {
       return stampInstalledHost(
-        addOrReplaceAllowedTools(
-          readFileSync(templatePath, "utf8"),
-          REFILL_SENDS_ALLOWED_TOOLS
+        stampRefillReleaseIdentity(
+          addOrReplaceAllowedTools(
+            readFileSync(templatePath, "utf8"),
+            REFILL_SENDS_ALLOWED_TOOLS
+          ),
+          host,
+          opts
         ),
         host,
         "refill-sends"
@@ -2089,7 +2127,7 @@ function refillSendsSkillMd(host = "shared") {
   } catch {
     // fall through to hardcoded fallback below
   }
-  return stampInstalledHost(`---
+  return stampInstalledHost(stampRefillReleaseIdentity(`---
 name: refill-sends
 description: Refill Sellable sender sends through the approval-gated refill workflow.
 visibility: public
@@ -2156,7 +2194,7 @@ Desktop, then start a new thread.
 If exact subskill lookup fails, use
 \`mcp__sellable__search_subskill_prompts({ query: "refill-sends", includePublic: true, includeInternal: true })\`,
 then retry \`get_subskill_prompt\`.
-`, host, "refill-sends");
+`, host, opts), host, "refill-sends");
 }
 
 function refreshSenderEngagementSkillMd(host = "shared") {
@@ -2668,7 +2706,7 @@ will change or after they approve the settings update.
 `;
 }
 
-function codexPluginSkills() {
+function codexPluginSkills(opts = {}) {
   return [
     {
       dir: "sellable-create-campaign",
@@ -2717,7 +2755,7 @@ function codexPluginSkills() {
       dir: "sellable-refill-sends",
       displayName: "Sellable Refill Sends",
       description: "Refill sender sends with approval-gated campaign selection",
-      skillMd: refillSendsSkillMd("codex"),
+      skillMd: refillSendsSkillMd("codex", opts),
     },
   ];
 }
@@ -2908,7 +2946,7 @@ then retry \`get_subskill_prompt\`.
   );
 }
 
-function hermesSkillDefinitions() {
+function hermesSkillDefinitions(opts = {}) {
   return [
     {
       commandName: "create-campaign",
@@ -2965,7 +3003,7 @@ function hermesSkillDefinitions() {
       commandName: "refill-sends",
       dir: hermesCommandName("refill-sends"),
       skillMd: normalizeHermesSkillMarkdown(
-        refillSendsSkillMd("hermes"),
+        refillSendsSkillMd("hermes", opts),
         "refill-sends"
       ),
     },
@@ -3158,7 +3196,7 @@ ${stripFrontmatter(command.skillMd)}
 `;
 }
 
-function claudeCommands() {
+function claudeCommands(opts = {}) {
   return [
     {
       name: "create-campaign",
@@ -3214,7 +3252,7 @@ function claudeCommands() {
       description:
         "Refill Sellable sender sends through the approval-gated refill workflow.",
       argumentHint: "[--yolo] [--sender name-or-id ...]",
-      skillMd: refillSendsSkillMd("claude"),
+      skillMd: refillSendsSkillMd("claude", opts),
       allowedTools: ["AskUserQuestion", ...REFILL_SENDS_ALLOWED_TOOLS],
     },
     {
@@ -3239,7 +3277,7 @@ function claudeCommands() {
 }
 
 function writeCodexPluginSkills(pluginRoot, opts) {
-  const skills = codexPluginSkills();
+  const skills = codexPluginSkills(opts);
   const currentSkillDirs = new Set(skills.map((skill) => skill.dir));
   const skillsRoot = join(pluginRoot, "skills");
 
@@ -3303,7 +3341,7 @@ function writeClaudeCustomAgents(opts) {
 
 function writeClaudeCommands(opts) {
   const home = claudeHome();
-  for (const command of claudeCommands()) {
+  for (const command of claudeCommands(opts)) {
     writeFile(join(home, "commands", command.filename), command.content, opts);
   }
 }
@@ -3815,7 +3853,7 @@ function writeHermesMcpServer(opts) {
 
 function installHermesSkills(opts) {
   const root = hermesSkillsRoot(opts);
-  for (const skill of hermesSkillDefinitions()) {
+  for (const skill of hermesSkillDefinitions(opts)) {
     const skillRoot = join(root, skill.dir);
     writeFile(join(skillRoot, "SKILL.md"), skill.skillMd, opts);
     if (skill.soulMd) {

package/lib/codex-plugin-selection.mjs

@@ -86,6 +86,54 @@ function treeHash(root) {
   return canonicalDigest(treeRecords(root));
 }
 
+function quoteToml(value) {
+  return JSON.stringify(String(value));
+}
+
+function removeTomlTable(content, header) {
+  const lines = content.split("\n");
+  const target = `[${header}]`;
+  const kept = [];
+  let skipping = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (/^\[[^\]]+\]$/.test(trimmed)) {
+      skipping = trimmed === target;
+      if (skipping) continue;
+    }
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n");
+}
+
+function candidateCodexConfig(content, candidatePath) {
+  const mcpPath = join(candidatePath, ".mcp.json");
+  if (!existsSync(mcpPath)) throw new Error("codex_candidate_mcp_manifest_missing");
+  const manifest = JSON.parse(readFileSync(mcpPath, "utf8"));
+  const server = manifest?.mcpServers?.sellable;
+  if (
+    server?.type !== "stdio" ||
+    typeof server.command !== "string" ||
+    !Array.isArray(server.args) ||
+    server.args.some((value) => typeof value !== "string") ||
+    !server.env ||
+    typeof server.env !== "object" ||
+    Object.values(server.env).some((value) => typeof value !== "string")
+  ) {
+    throw new Error("codex_candidate_mcp_manifest_invalid");
+  }
+  let next = removeTomlTable(content, "mcp_servers.sellable.env");
+  next = removeTomlTable(next, "mcp_servers.sellable").trimEnd();
+  const args = `[${server.args.map(quoteToml).join(", ")}]`;
+  const env = Object.entries(server.env)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key} = ${quoteToml(value)}`)
+    .join("\n");
+  return `${next}\n\n[mcp_servers.sellable]\ncommand = ${quoteToml(
+    server.command
+  )}\nargs = ${args}\n\n[mcp_servers.sellable.env]\n${env}\n`;
+}
+
 function pluginVersion(pluginRoot) {
   const manifestPath = join(pluginRoot, ".codex-plugin", "plugin.json");
   if (!existsSync(manifestPath)) throw new Error("codex_selection_plugin_manifest_missing");
@@ -240,6 +288,20 @@ function atomicReplaceTree(source, target) {
   }
 }
 
+function atomicReplaceFile(content, target) {
+  const parent = dirname(target);
+  mkdirSync(parent, { recursive: true });
+  const staging = join(parent, `.${basename(target)}.phase98-next-${process.pid}`);
+  const mode = existsSync(target) ? lstatSync(target).mode & 0o777 : 0o600;
+  writeFileSync(staging, content, { mode });
+  try {
+    renameSync(staging, target);
+  } catch (error) {
+    rmSync(staging, { force: true });
+    throw error;
+  }
+}
+
 export function activateCodexCandidateSelection(input) {
   const {
     paths,
@@ -271,10 +333,30 @@ export function activateCodexCandidateSelection(input) {
     if (!existsSync(candidatePath) || treeHash(candidatePath) !== expectedCandidateHash) {
       throw new Error("codex_selection_candidate_cache_mismatch");
     }
-    atomicReplaceTree(candidatePath, paths.pluginRoot);
-    if (pluginVersion(paths.pluginRoot) !== candidateVersion || treeHash(paths.pluginRoot) !== expectedCandidateHash) {
-      throw new Error("codex_selection_candidate_activation_mismatch");
+    const candidateConfig = candidateCodexConfig(
+      readFileSync(paths.configPath, "utf8"),
+      candidatePath
+    );
+    const configBackup = snapshot.items.find((item) => item.name === "config");
+    const pluginBackup = snapshot.items.find((item) => item.name === "pluginRoot");
+    if (!configBackup || !pluginBackup) {
+      throw new Error("codex_selection_snapshot_restore_items_missing");
+    }
+    try {
+      atomicReplaceFile(candidateConfig, paths.configPath);
+      atomicReplaceTree(candidatePath, paths.pluginRoot);
+      if (
+        pluginVersion(paths.pluginRoot) !== candidateVersion ||
+        treeHash(paths.pluginRoot) !== expectedCandidateHash
+      ) {
+        throw new Error("codex_selection_candidate_activation_mismatch");
+      }
+    } catch (error) {
+      copyExact(configBackup.backupPath, configBackup.sourcePath);
+      copyExact(pluginBackup.backupPath, pluginBackup.sourcePath);
+      throw error;
     }
+    const candidateConfigHash = treeHash(paths.configPath);
     const activation = {
       schemaVersion: CODEX_PLUGIN_SELECTION_SCHEMA_VERSION,
       approvalId,
@@ -285,7 +367,8 @@ export function activateCodexCandidateSelection(input) {
       stableVersion: snapshot.pluginVersion,
       candidateVersion,
       candidateHash: expectedCandidateHash,
-      changedPaths: [paths.pluginRoot],
+      candidateConfigHash,
+      changedPaths: [paths.pluginRoot, paths.configPath],
     };
     const activationPath = join(dirname(snapshotManifestPath), "activation.json");
     writeFileSync(activationPath, `${JSON.stringify(activation, null, 2)}\n`, { mode: 0o600 });
@@ -310,6 +393,12 @@ export function restoreCodexPluginSelection(input) {
       activation.snapshotHash !== expectedSnapshotHash ||
       activation.candidateHash !== treeHash(paths.pluginRoot)
     ) throw new Error("codex_selection_active_candidate_drift");
+    if (
+      !activation.candidateConfigHash ||
+      activation.candidateConfigHash !== treeHash(paths.configPath)
+    ) {
+      throw new Error("codex_selection_active_config_drift");
+    }
     if (!recoveryReason) {
       if (!taskEvidence?.taskId || taskEvidence.resolvedCandidateHash !== activation.candidateHash) {
         throw new Error("codex_selection_task_identity_mismatch");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.326",
+  "version": "0.1.328",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {