@sellable/install 0.1.327 → 0.1.329

package/lib/codex-plugin-selection.mjs

@@ -0,0 +1,442 @@
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readlinkSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
+
+export const CODEX_PLUGIN_SELECTION_SCHEMA_VERSION = 1;
+export const MAX_CODEX_CANARY_WINDOW_MS = 90 * 60 * 1000;
+
+export function resolveCodexPluginSelectionPaths({
+  home = "",
+  marketplaceRoot = join(home, ".sellable", "codex-marketplace"),
+  cacheRoot = join(home, ".codex", "plugins", "cache", "sellable", "sellable"),
+} = {}) {
+  if (!home) throw new Error("codex_selection_home_required");
+  return {
+    home: resolve(home),
+    configPath: join(home, ".codex", "config.toml"),
+    marketplaceRoot: resolve(marketplaceRoot),
+    marketplacePath: join(marketplaceRoot, ".agents", "plugins", "marketplace.json"),
+    pluginRoot: join(marketplaceRoot, "plugins", "sellable"),
+    cacheRoot: resolve(cacheRoot),
+  };
+}
+
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, canonicalize(value[key])])
+    );
+  }
+  return value;
+}
+
+function digest(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function canonicalDigest(value) {
+  return digest(JSON.stringify(canonicalize(value)));
+}
+
+function treeRecords(root) {
+  if (!existsSync(root)) return [{ path: ".", type: "missing" }];
+  const records = [];
+  const visit = (path) => {
+    const stat = lstatSync(path);
+    const rel = relative(root, path) || ".";
+    if (stat.isSymbolicLink()) {
+      records.push({ path: rel, type: "symlink", target: readlinkSync(path) });
+      return;
+    }
+    if (stat.isDirectory()) {
+      records.push({ path: rel, type: "directory", mode: stat.mode & 0o777 });
+      for (const name of readdirSync(path).sort()) visit(join(path, name));
+      return;
+    }
+    records.push({
+      path: rel,
+      type: "file",
+      mode: stat.mode & 0o777,
+      sha256: digest(readFileSync(path)),
+    });
+  };
+  visit(root);
+  return records;
+}
+
+function treeHash(root) {
+  return canonicalDigest(treeRecords(root));
+}
+
+function quoteToml(value) {
+  return JSON.stringify(String(value));
+}
+
+function removeTomlTable(content, header) {
+  const lines = content.split("\n");
+  const target = `[${header}]`;
+  const kept = [];
+  let skipping = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (/^\[[^\]]+\]$/.test(trimmed)) {
+      skipping = trimmed === target;
+      if (skipping) continue;
+    }
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n");
+}
+
+function candidateCodexConfig(content, candidatePath) {
+  const mcpPath = join(candidatePath, ".mcp.json");
+  if (!existsSync(mcpPath)) throw new Error("codex_candidate_mcp_manifest_missing");
+  const manifest = JSON.parse(readFileSync(mcpPath, "utf8"));
+  const server = manifest?.mcpServers?.sellable;
+  if (
+    server?.type !== "stdio" ||
+    typeof server.command !== "string" ||
+    !Array.isArray(server.args) ||
+    server.args.some((value) => typeof value !== "string") ||
+    !server.env ||
+    typeof server.env !== "object" ||
+    Object.values(server.env).some((value) => typeof value !== "string")
+  ) {
+    throw new Error("codex_candidate_mcp_manifest_invalid");
+  }
+  let next = removeTomlTable(content, "mcp_servers.sellable.env");
+  next = removeTomlTable(next, "mcp_servers.sellable").trimEnd();
+  const args = `[${server.args.map(quoteToml).join(", ")}]`;
+  const env = Object.entries(server.env)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([key, value]) => `${key} = ${quoteToml(value)}`)
+    .join("\n");
+  return `${next}\n\n[mcp_servers.sellable]\ncommand = ${quoteToml(
+    server.command
+  )}\nargs = ${args}\n\n[mcp_servers.sellable.env]\n${env}\n`;
+}
+
+function pluginVersion(pluginRoot) {
+  const manifestPath = join(pluginRoot, ".codex-plugin", "plugin.json");
+  if (!existsSync(manifestPath)) throw new Error("codex_selection_plugin_manifest_missing");
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  if (manifest.name !== "sellable" || typeof manifest.version !== "string") {
+    throw new Error("codex_selection_plugin_manifest_invalid");
+  }
+  return manifest.version;
+}
+
+function ensureInside(parent, child, code) {
+  const root = resolve(parent);
+  const target = resolve(child);
+  if (!(target === root || target.startsWith(`${root}/`))) throw new Error(code);
+}
+
+function copyExact(source, target) {
+  rmSync(target, { recursive: true, force: true });
+  mkdirSync(dirname(target), { recursive: true });
+  cpSync(source, target, {
+    recursive: true,
+    dereference: false,
+    preserveTimestamps: true,
+  });
+  syncExactModes(source, target);
+}
+
+function syncExactModes(source, target) {
+  const stat = lstatSync(source);
+  if (stat.isSymbolicLink()) return;
+  chmodSync(target, stat.mode & 0o777);
+  if (!stat.isDirectory()) return;
+  for (const name of readdirSync(source)) {
+    syncExactModes(join(source, name), join(target, name));
+  }
+}
+
+function readCanonicalManifest(manifestPath, expectedSnapshotHash) {
+  const raw = readFileSync(manifestPath, "utf8");
+  const manifest = JSON.parse(raw);
+  if (raw !== `${JSON.stringify(manifest, null, 2)}\n`) {
+    throw new Error("codex_selection_snapshot_manifest_not_canonical");
+  }
+  const { snapshotHash, ...unsigned } = manifest;
+  if (snapshotHash !== canonicalDigest(unsigned) || snapshotHash !== expectedSnapshotHash) {
+    throw new Error("codex_selection_snapshot_hash_mismatch");
+  }
+  for (const item of manifest.items ?? []) {
+    if (treeHash(item.backupPath) !== item.hash) {
+      throw new Error(`codex_selection_snapshot_backup_mismatch:${item.name}`);
+    }
+  }
+  return manifest;
+}
+
+function stateItems(paths, stableVersion) {
+  return [
+    { name: "config", sourcePath: paths.configPath },
+    { name: "marketplace", sourcePath: paths.marketplacePath },
+    { name: "pluginRoot", sourcePath: paths.pluginRoot },
+    { name: "stableCache", sourcePath: join(paths.cacheRoot, stableVersion) },
+  ];
+}
+
+function stateHash(paths, stableVersion) {
+  return canonicalDigest(
+    stateItems(paths, stableVersion).map((item) => ({
+      name: item.name,
+      sourcePath: item.sourcePath,
+      hash: treeHash(item.sourcePath),
+    }))
+  );
+}
+
+export function snapshotCodexPluginSelection({ paths, snapshotRoot }) {
+  if (!paths || !snapshotRoot) throw new Error("codex_selection_snapshot_arguments_required");
+  if (existsSync(snapshotRoot)) throw new Error("codex_selection_snapshot_root_exists");
+  const version = pluginVersion(paths.pluginRoot);
+  const items = stateItems(paths, version).map((item) => {
+    if (!existsSync(item.sourcePath)) {
+      throw new Error(`codex_selection_snapshot_source_missing:${item.name}`);
+    }
+    const backupPath = join(snapshotRoot, "data", item.name);
+    copyExact(item.sourcePath, backupPath);
+    return { ...item, backupPath, hash: treeHash(item.sourcePath) };
+  });
+  const unsigned = {
+    schemaVersion: CODEX_PLUGIN_SELECTION_SCHEMA_VERSION,
+    createdAt: new Date().toISOString(),
+    pluginVersion: version,
+    stateHash: stateHash(paths, version),
+    paths,
+    items,
+  };
+  const manifest = { ...unsigned, snapshotHash: canonicalDigest(unsigned) };
+  const manifestPath = join(snapshotRoot, "snapshot.json");
+  mkdirSync(dirname(manifestPath), { recursive: true });
+  writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+  return { manifestPath, snapshotHash: manifest.snapshotHash, pluginVersion: version };
+}
+
+export function installCodexCandidateCache({ paths, sourcePluginRoot, version }) {
+  if (!paths || !sourcePluginRoot || !version) throw new Error("codex_candidate_cache_arguments_required");
+  if (pluginVersion(sourcePluginRoot) !== version) throw new Error("codex_candidate_version_mismatch");
+  const target = join(paths.cacheRoot, version);
+  ensureInside(paths.cacheRoot, target, "codex_candidate_cache_path_escape");
+  const sourceHash = treeHash(sourcePluginRoot);
+  if (existsSync(target)) {
+    if (treeHash(target) !== sourceHash) throw new Error("codex_candidate_cache_collision");
+  } else {
+    mkdirSync(paths.cacheRoot, { recursive: true });
+    const staging = join(paths.cacheRoot, `.phase98-${version}-${process.pid}`);
+    copyExact(sourcePluginRoot, staging);
+    if (treeHash(staging) !== sourceHash) throw new Error("codex_candidate_cache_copy_mismatch");
+    renameSync(staging, target);
+  }
+  return { version, cachePath: target, cacheHash: sourceHash };
+}
+
+function withSelectionLock(paths, fn) {
+  mkdirSync(paths.cacheRoot, { recursive: true });
+  const lockPath = join(paths.cacheRoot, ".phase98-selection.lock");
+  let handle;
+  try {
+    handle = openSync(lockPath, "wx", 0o600);
+  } catch {
+    throw new Error("codex_selection_concurrent_operation");
+  }
+  try {
+    return fn();
+  } finally {
+    closeSync(handle);
+    rmSync(lockPath, { force: true });
+  }
+}
+
+function atomicReplaceTree(source, target) {
+  const parent = dirname(target);
+  mkdirSync(parent, { recursive: true });
+  const staging = join(parent, `.${basename(target)}.phase98-next-${process.pid}`);
+  const previous = join(parent, `.${basename(target)}.phase98-prev-${process.pid}`);
+  copyExact(source, staging);
+  if (existsSync(target)) renameSync(target, previous);
+  try {
+    renameSync(staging, target);
+    rmSync(previous, { recursive: true, force: true });
+  } catch (error) {
+    rmSync(target, { recursive: true, force: true });
+    if (existsSync(previous)) renameSync(previous, target);
+    rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function atomicReplaceFile(content, target) {
+  const parent = dirname(target);
+  mkdirSync(parent, { recursive: true });
+  const staging = join(parent, `.${basename(target)}.phase98-next-${process.pid}`);
+  const mode = existsSync(target) ? lstatSync(target).mode & 0o777 : 0o600;
+  writeFileSync(staging, content, { mode });
+  try {
+    renameSync(staging, target);
+  } catch (error) {
+    rmSync(staging, { force: true });
+    throw error;
+  }
+}
+
+export function activateCodexCandidateSelection(input) {
+  const {
+    paths,
+    snapshotManifestPath,
+    expectedSnapshotHash,
+    candidateVersion,
+    expectedCandidateHash,
+    approvalId,
+    approvedAt,
+    restoreBy,
+    now,
+  } = input;
+  if (!approvalId) throw new Error("codex_selection_approval_required");
+  const approvedMs = Date.parse(approvedAt);
+  const restoreMs = Date.parse(restoreBy);
+  const nowMs = Date.parse(now);
+  if (![approvedMs, restoreMs, nowMs].every(Number.isFinite)) {
+    throw new Error("codex_selection_window_invalid");
+  }
+  if (nowMs < approvedMs || nowMs >= restoreMs || restoreMs - approvedMs > MAX_CODEX_CANARY_WINDOW_MS) {
+    throw new Error("codex_selection_window_exceeds_limit");
+  }
+  return withSelectionLock(paths, () => {
+    const snapshot = readCanonicalManifest(snapshotManifestPath, expectedSnapshotHash);
+    if (stateHash(paths, snapshot.pluginVersion) !== snapshot.stateHash) {
+      throw new Error("codex_selection_current_state_drift");
+    }
+    const candidatePath = join(paths.cacheRoot, candidateVersion);
+    if (!existsSync(candidatePath) || treeHash(candidatePath) !== expectedCandidateHash) {
+      throw new Error("codex_selection_candidate_cache_mismatch");
+    }
+    const candidateConfig = candidateCodexConfig(
+      readFileSync(paths.configPath, "utf8"),
+      candidatePath
+    );
+    const configBackup = snapshot.items.find((item) => item.name === "config");
+    const pluginBackup = snapshot.items.find((item) => item.name === "pluginRoot");
+    if (!configBackup || !pluginBackup) {
+      throw new Error("codex_selection_snapshot_restore_items_missing");
+    }
+    try {
+      atomicReplaceFile(candidateConfig, paths.configPath);
+      atomicReplaceTree(candidatePath, paths.pluginRoot);
+      if (
+        pluginVersion(paths.pluginRoot) !== candidateVersion ||
+        treeHash(paths.pluginRoot) !== expectedCandidateHash
+      ) {
+        throw new Error("codex_selection_candidate_activation_mismatch");
+      }
+    } catch (error) {
+      copyExact(configBackup.backupPath, configBackup.sourcePath);
+      copyExact(pluginBackup.backupPath, pluginBackup.sourcePath);
+      throw error;
+    }
+    const candidateConfigHash = treeHash(paths.configPath);
+    const activation = {
+      schemaVersion: CODEX_PLUGIN_SELECTION_SCHEMA_VERSION,
+      approvalId,
+      approvedAt,
+      activatedAt: now,
+      restoreBy,
+      snapshotHash: expectedSnapshotHash,
+      stableVersion: snapshot.pluginVersion,
+      candidateVersion,
+      candidateHash: expectedCandidateHash,
+      candidateConfigHash,
+      changedPaths: [paths.pluginRoot, paths.configPath],
+    };
+    const activationPath = join(dirname(snapshotManifestPath), "activation.json");
+    writeFileSync(activationPath, `${JSON.stringify(activation, null, 2)}\n`, { mode: 0o600 });
+    return { ...activation, activationPath };
+  });
+}
+
+export function restoreCodexPluginSelection(input) {
+  const {
+    paths,
+    snapshotManifestPath,
+    expectedSnapshotHash,
+    activationPath,
+    now,
+    taskEvidence,
+    recoveryReason,
+  } = input;
+  return withSelectionLock(paths, () => {
+    const snapshot = readCanonicalManifest(snapshotManifestPath, expectedSnapshotHash);
+    const activation = JSON.parse(readFileSync(activationPath, "utf8"));
+    if (
+      activation.snapshotHash !== expectedSnapshotHash ||
+      activation.candidateHash !== treeHash(paths.pluginRoot)
+    ) throw new Error("codex_selection_active_candidate_drift");
+    if (
+      !activation.candidateConfigHash ||
+      activation.candidateConfigHash !== treeHash(paths.configPath)
+    ) {
+      throw new Error("codex_selection_active_config_drift");
+    }
+    if (!recoveryReason) {
+      if (!taskEvidence?.taskId || taskEvidence.resolvedCandidateHash !== activation.candidateHash) {
+        throw new Error("codex_selection_task_identity_mismatch");
+      }
+    }
+    for (const item of snapshot.items) copyExact(item.backupPath, item.sourcePath);
+    if (stateHash(paths, snapshot.pluginVersion) !== snapshot.stateHash) {
+      throw new Error("codex_selection_restore_hash_mismatch");
+    }
+    const deadlineExceeded = Date.parse(now) > Date.parse(activation.restoreBy);
+    const restoration = {
+      restored: true,
+      restoredAt: now,
+      deadlineExceeded,
+      recoveryReason: recoveryReason || null,
+      snapshotHash: expectedSnapshotHash,
+      stableVersion: snapshot.pluginVersion,
+      candidateVersion: activation.candidateVersion,
+    };
+    writeFileSync(
+      join(dirname(snapshotManifestPath), "restoration.json"),
+      `${JSON.stringify(restoration, null, 2)}\n`,
+      { mode: 0o600 }
+    );
+    return restoration;
+  });
+}
+
+export function readCodexPluginSelection({ paths, stableVersion } = {}) {
+  if (!paths) throw new Error("codex_selection_paths_required");
+  const version = pluginVersion(paths.pluginRoot);
+  const stable = stableVersion || version;
+  return {
+    pluginVersion: version,
+    pluginHash: treeHash(paths.pluginRoot),
+    configHash: treeHash(paths.configPath),
+    marketplaceHash: treeHash(paths.marketplacePath),
+    stableCacheHash: treeHash(join(paths.cacheRoot, stable)),
+    selectionHash: stateHash(paths, stable),
+  };
+}

package/lib/runtime-verify.mjs

@@ -11,25 +11,13 @@ export const REQUIRED_SELLABLE_MCP_TOOLS = [
   "start_cli_login",
   "wait_for_cli_login",
   "bootstrap_create_campaign",
-  "bootstrap_find_leads",
-  "get_find_leads_run",
-  "update_find_leads_run",
-  "wait_for_find_leads_run",
-  "cancel_find_leads",
-  "reissue_find_leads_watch_link",
-  "preflight_find_leads_provider",
   "get_subskill_prompt",
   "get_subskill_asset",
   "search_subskill_prompts",
   "create_campaign",
   "import_leads",
-  "search_sales_nav",
-  "search_prospeo",
-  "search_signals",
-  "select_promising_posts",
   "confirm_lead_list",
   "wait_for_lead_list_ready",
-  "export_table_csv",
   "wait_for_campaign_table_ready",
   "update_campaign",
   "update_campaign_brief",
@@ -88,14 +76,6 @@ export const CREATE_CAMPAIGN_SMOKE_CALLS = [
       limit: 1200,
     },
   },
-  {
-    name: "get_subskill_prompt",
-    arguments: {
-      subskillName: "find-leads-v2",
-      offset: 0,
-      limit: 1200,
-    },
-  },
   {
     name: "get_subskill_prompt",
     arguments: {
@@ -137,15 +117,6 @@ export const CREATE_CAMPAIGN_SMOKE_CALLS = [
       limit: 1200,
     },
   },
-  {
-    name: "get_subskill_asset",
-    arguments: {
-      subskillName: "find-leads-v2",
-      assetPath: "core/flow.v1.json",
-      offset: 0,
-      limit: 1200,
-    },
-  },
 ];
 
 function collectStderrLines(stream) {
@@ -372,7 +343,7 @@ async function verifyCreateCampaignSmoke({
       ok: false,
       missingTools,
       calls,
-      error: `Missing or stale Sellable MCP tool(s): ${missingTools.join(", ")}. Reinstall @sellable/install and @sellable/mcp, restart or reload the host, then retry Find Leads.`,
+      error: `Missing smoke tool(s): ${missingTools.join(", ")}`,
       startedAt,
       completedAt: new Date().toISOString(),
     };
@@ -691,7 +662,7 @@ async function verifySellableMcpRuntimeOnce({
         ),
         calls: [],
         error:
-          "Sellable MCP is missing required tools. Reinstall @sellable/install and @sellable/mcp, restart or reload the host, then retry Find Leads.",
+          "Skipping create-campaign smoke because required MCP tools are missing.",
         startedAt: new Date().toISOString(),
         completedAt: new Date().toISOString(),
       };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.327",
+  "version": "0.1.329",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {
@@ -15,7 +15,8 @@
     "lib",
     "agents",
     "skill-templates",
-    "README.md"
+    "README.md",
+    "HERMES-SLACK-PROFILE-SCOPING.md"
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.25.2",

package/skill-templates/create-campaign.md

@@ -721,7 +721,7 @@ Treat host capabilities as concrete functions, not prose conventions:
   import and before dispatching Message Drafting only.
 - `launch_message_drafting`: Claude Code uses `Task` with `subagent_type`
   `post-find-leads-message-scout` when listed; Codex uses the returned
-  compatibility agent or a generic `gpt-5.5` / `xhigh` Message Drafting agent.
+  compatibility agent or a generic `gpt-5.6-sol` / `high` Message Drafting agent.
 
 If a required interactive question function or MCP loader is missing, stop and
 explain the Sellable install/reload problem. Source work uses product-native MCP
@@ -1082,8 +1082,8 @@ updates.
    In Codex, the filter-choice answer is the campaign-scoped go-ahead to use
    this single Message Drafting background agent in step-wise and YOLO modes.
    Do not ask a separate question to start it. If the named custom agent is not
-   available, spawn a generic background agent with `model: "gpt-5.5"` and
-   `reasoning_effort: "xhigh"` using the same lean campaign/table basis. If no
+   available, spawn a generic background agent with `model: "gpt-5.6-sol"` and
+   `reasoning_effort: "high"` using the same lean campaign/table basis. If no
    background-agent tool is callable, start the same full message branch inline
    before filter drafting or skip-filter message review and record it as
    `statusSource: "parent-thread-fallback"`.

package/skill-templates/create-evergreen-campaigns.md

@@ -437,7 +437,7 @@ fallback only when app thread tools are unavailable; the receipt must include
 `fallbackReason`, or backend verify rejects it.
 When visible Codex app thread tools are unavailable but local Codex CLI is
 available, the accepted durable streaming-worker command shape is:
-`codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 The approval, sandbox, and reasoning-effort config flags must come before the
 `exec` subcommand for Codex CLI builds that expose `-a`/`-s`/`-c` only at top
 level. `--skip-git-repo-check` belongs after `exec` because current customer and VPS Codex CLI builds expose it
@@ -447,26 +447,26 @@ forms fail on current customer CLI installs. Pipe the lane packet prompt on
 stdin, require the worker to write `workerDispatch.receiptArtifactHint`, and
 pass exactly one lane packet per worker.
 When launching durable Codex CLI workers from an automation parent, pass an
-explicit supported worker model and explicit `xhigh` reasoning effort instead
+explicit supported worker model and explicit `high` reasoning effort instead
 of relying on the Codex CLI defaults. Use the parent runtime model when known,
 for example:
-`codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 In Codex CLI, the parent runtime model is visible in the run header as
 `model: <model-name>`. Copy that exact model string into child worker launches
-first. If the parent header says `model: gpt-5.5`, launch workers with
-`-m gpt-5.5` plus `-c model_reasoning_effort=xhigh`; do not invent or probe
+first. If the parent header says `model: gpt-5.6-sol`, launch workers with
+`-m gpt-5.6-sol` plus `-c model_reasoning_effort=high`; do not invent or probe
 nearby aliases such as `gpt-5.3-codex`, `gpt-5.2`, `gpt-5-codex`,
 `codex-latest`, or `codex-mini-latest` before trying the exact parent model. A
-one-line probe must include the same `-c model_reasoning_effort=xhigh` override
+one-line probe must include the same `-c model_reasoning_effort=high` override
 and count as supported only when it exits 0 and returns the requested output; a
 session header followed by a `not supported` error is rejected, not accepted.
 Do not rely on the Codex CLI default model or default reasoning effort; some
-customer and VPS installs default to unavailable model aliases or to `high`
-reasoning. `-m gpt-5.5` alone is not enough. If a child worker reports GPT 5.5
-with `high` reasoning, treat that as a launcher bug, relaunch with the explicit
-`xhigh` config before mutation, and do not ask the user to continue through the
+customer and VPS installs default to unavailable model aliases or to reasoning
+below `high`. `-m gpt-5.6-sol` alone is not enough. If a child worker reports GPT 5.6-Sol
+with reasoning below `high`, treat that as a launcher bug, relaunch with the explicit
+`high` config before mutation, and do not ask the user to continue through the
 model-quality warning. If the parent cannot identify a supported worker model
-and launch it with `xhigh` reasoning, stop with
+and launch it with `high` reasoning, stop with
 `blocked: worker_model_unavailable` before mutation.
 When wrapping multiple local Codex CLI workers in a shell launcher, run the
 wrapper with `/bin/bash -lc` or another explicitly chosen portable shell. Do not
@@ -479,7 +479,7 @@ Do not embed `<<'WORKER_PROMPT'` heredocs inside a single quoted or double
 quoted `/bin/bash -lc '...'` command string; nested quoting is brittle and can
 truncate the first worker before mutation. For multi-worker launchers, write one
 plain prompt file per lane under the current run directory, then start each
-worker with `codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m "$WORKER_MODEL" -C "$REPO" -o
+worker with `codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m "$WORKER_MODEL" -C "$REPO" -o
 "$worker_final_file" - < "$worker_prompt_file"`. Keep launcher shell variables
 double-quoted and keep the prompt heredoc only in a standalone script/prompt-file
 write step, not inside an already quoted shell argument. If the first launcher
@@ -585,7 +585,7 @@ launchers, write the same prompt body to `<worker-prompt-file>` and launch the
 worker with stdin redirected from that file:
 
 ```
-codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
+codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
 Use $sellable:create-campaign as the governing campaign workflow for this one lane worker.
 Use the evergreen plan/packet below only for lane scope, source metadata,
 postconditions, side-effect caps, and durable receipt proof.
@@ -632,10 +632,10 @@ Do not launch, start, schedule, send, or use paid InMail.
 For filter proof, durable receipt status must be `filterDecisionReceipt.status:"applied"` only; never `completed`, `confirmed`, `done`, or aliases.
 For generated messages, `update_cell` is allowed only for the semantic Approved checkbox. Never use `update_cell` for generated message text/body/sample copy. Bad copy requires `revise_message_template_and_rerun` or brief/template revision plus Generate Message rerun. Any generated-message cell override is `blocked: generated_message_cell_override`.
 If `bootstrap_create_campaign.modelQuality.status === "warn"` because the child
-worker reports GPT 5.5 with `high` reasoning, that is a parent launcher
+worker reports GPT 5.6-Sol with reasoning below `high`, that is a parent launcher
 configuration bug, not an operator approval path inside the worker. Stop before
 mutation, tell the parent to relaunch this lane with
-`-c model_reasoning_effort=xhigh`, and do not mark the worker goal complete.
+`-c model_reasoning_effort=high`, and do not mark the worker goal complete.
 Complete only this lane. Do not end with narration only. Before your final
 response, run a local file-existence and JSON self-check for
 <receiptArtifactPath>. If the lane succeeded, write the canonical success
@@ -656,7 +656,7 @@ receipt, or an accepted Post Engagers no-source blocked/no-op receipt.
 WORKER_PROMPT
 
 # Multi-worker launcher equivalent:
-codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
+codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
 ```
 
 If any placeholder cannot be filled from the current plan, matching

package/skill-templates/refill-sends-v2.md

@@ -1,9 +1,9 @@
 ---
 name: refill-sends-v2
 description: Execute refill sends v2 through the fenced evergreen refill loop, with dry-run and resume support.
-visibility: public
+visibility: internal
 allowed-tools:
-  - mcp__sellable__refill_sends_v2
+  - mcp__sellable__refill_sends
   - mcp__sellable__get_refill_plan_v2
   - mcp__sellable__get_subskill_prompt
   - mcp__sellable__get_subskill_asset
@@ -24,7 +24,7 @@ Host command names:
 - Claude Code: `/sellable:refill-sends-v2`
 - Codex: `$sellable:refill-sends-v2`
 
-`refill_sends_v2` is the execution surface. In real-run mode it starts or
+`refill_sends` is the execution surface. In real-run mode it starts or
 resumes a fenced refill run, reads a fresh packet, executes only the packet's
 named bounded work, verifies the result, and returns either a terminal report, a
 blocked report, or an in-progress resume handle. In dry-run mode it stays
@@ -40,19 +40,19 @@ with `WORKSPACE_REQUIRED`; do not switch the shared active workspace.
 For a real refill run:
 
 ```text
-refill_sends_v2({ workspaceId, intent:"auto", senderIds?, approvalMode? })
+refill_sends({ workspaceId, intent:"auto", senderIds?, approvalMode? })
 ```
 
 For read-only inspection:
 
 ```text
-refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
+refill_sends({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 ```
 
 To resume an in-progress run, pass the handle back exactly:
 
 ```text
-refill_sends_v2({ workspaceId, runId, fence })
+refill_sends({ workspaceId, runId, fence })
 ```
 
 If a stale handle loses the lease, the tool reports the holder status and the