@sellable/install 0.1.363 → 0.1.365-phase111.20260720162325

package/bin/sellable-install.mjs

@@ -3712,8 +3712,7 @@ function upsertCodexMcpServerConfig(content, opts) {
       content,
       "mcp_servers.sellable",
       `[mcp_servers.sellable]
-url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}
-default_tools_approval_mode = "approve"`
+url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}`
     );
     content = removeTomlSection(content, "mcp_servers.sellable.env");
     return content;
@@ -3725,8 +3724,7 @@ default_tools_approval_mode = "approve"`
     "mcp_servers.sellable",
     `[mcp_servers.sellable]
 command = ${quoteToml(command)}
-args = ${tomlArray(args)}
-default_tools_approval_mode = "approve"`
+args = ${tomlArray(args)}`
   );
   content = upsertTomlTable(
     content,
@@ -3740,9 +3738,6 @@ ${tomlEnvTable("codex", opts)}`
 function codexMcpServerMatches(content, opts) {
   const server = readTomlTable(content, "mcp_servers.sellable");
   if (!server) return false;
-  if (!server.includes('default_tools_approval_mode = "approve"')) {
-    return false;
-  }
   if (opts.server === "hosted") {
     return (
       server.includes(

package/container/Dockerfile

@@ -3,13 +3,13 @@ FROM ${HERMES_IMAGE}
 
 USER root
 
-ARG INSTALLER_PACKAGE=@sellable/install@0.1.363
-ARG MCP_PACKAGE=@sellable/mcp@0.1.620
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.365-phase111.20260720162325
+ARG MCP_PACKAGE=@sellable/mcp@0.1.626-phase111.20260720143315
 ARG INSTALLER_INTEGRITY
-ARG MCP_INTEGRITY=sha512-N+2clnLHWAlvoXCjX10HaeEUMPLqZQHIX+x/2e1CSJbqb56CU1SAtVdwmhXyha7+MQT0DZF7pm2+WnoZKFEzOw==
+ARG MCP_INTEGRITY=sha512-pP5LMKh67n9YUXJV8WPSY++130BTXSmnYvHvtXam502ihtWM+ziUGfWqsydFB1nSSTb9GBbFNJQrfEeh+ANyKA==
 
-RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.363" \
-    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.620" \
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.365-phase111.20260720162325" \
+    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.626-phase111.20260720143315" \
     && test -n "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
     && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
@@ -23,17 +23,13 @@ RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.363" \
     && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
     && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
     && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
-    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.363' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.620') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.365-phase111.20260720162325' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.626-phase111.20260720143315') throw new Error('package identity rejected');" \
     && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
-    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.363', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.620', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.365-phase111.20260720162325', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.626-phase111.20260720143315', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
     && npm cache clean --force
 
 COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
-RUN test -x /usr/local/bin/node \
-    && test ! -e /usr/bin/node \
-    && ln -s /usr/local/bin/node /usr/bin/node \
-    && test "$(readlink -f /usr/bin/node)" = "/usr/local/bin/node" \
-    && chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint
+RUN chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
   CMD /command/s6-svstat /etc/services.d/sellable-agent-host-worker | grep -q '^up' || exit 1

package/container/README.md

@@ -2,12 +2,12 @@
 
 This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
 
-Build from this directory after `@sellable/install@0.1.363` is published:
+Build from this directory after `@sellable/install@0.1.365-phase111.20260720162325` is published:
 
 ```sh
 docker build --platform linux/amd64 \
   --build-arg INSTALLER_INTEGRITY='sha512-…' \
-  --tag sellable-agent-host:0.1.363 .
+  --tag sellable-agent-host:0.1.365-phase111.20260720162325 .
 ```
 
 Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.

package/container/entrypoint.sh

@@ -1,15 +1,11 @@
 #!/bin/sh
 set -eu
 
-PATH="/command:${PATH}"
-export PATH
-
 BOOTSTRAP_CONFIG=/var/lib/sellable-agent-bootstrap/bootstrap.json
 BOOTSTRAP_BIN=/opt/sellable-agent/install-root/node_modules/.bin/sellable-agent-host-bootstrap
 
 test "$(id -u)" = "0"
 test "$(id -g)" = "0"
-install -d -m 0755 -o root -g root /run/s6/container_environment
 test -x "${BOOTSTRAP_BIN}"
 test -f "${BOOTSTRAP_CONFIG}"
 

package/lib/sellable-agent/external-runtime-builder.mjs

@@ -28,7 +28,7 @@ import {
 
 const MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
 const MCP_PACKAGE = "@sellable/mcp";
-const MCP_VERSION = "0.1.620";
+const MCP_VERSION = "0.1.626-phase111.20260720143315";
 const SAFE_COMPONENT = /^[A-Za-z0-9@._+-]+$/;
 const HERMES_EXCLUDES = new Set([".git", ".playwright", "node_modules"]);
 

package/lib/sellable-agent/host-bootstrap.mjs

@@ -38,8 +38,8 @@ import { installAgentHostServices } from "./service-installer.mjs";
 const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const VERSION = "sellable-agent-host-bootstrap/v1";
 const RECEIPT_VERSION = "sellable-agent-host-registration/v1";
-const INSTALLER_PACKAGE = "@sellable/install@0.1.363";
-const MCP_PACKAGE = "@sellable/mcp@0.1.620";
+const INSTALLER_PACKAGE = "@sellable/install@0.1.365-phase111.20260720162325";
+const MCP_PACKAGE = "@sellable/mcp@0.1.626-phase111.20260720143315";
 const HERMES_VERSION = "0.18.0";
 const SHA256 = /^[a-f0-9]{64}$/;
 const SHA256_16 = /^[a-f0-9]{16}$/;

package/lib/sellable-agent/host-worker.mjs

@@ -957,8 +957,8 @@ export function compileClaimToProfileDesired(activeClaim, config) {
       ]) ||
       !exactObject(runtimeService, ["principalId", "policyHash", "credentialGeneration", "credentialFingerprint"]) ||
       pinned.hermesCli !== "hermes" || pinned.hermesVersion !== "0.18.0" ||
-      pinned.installerPackage !== "@sellable/install@0.1.363" ||
-      pinned.mcpPackage !== "@sellable/mcp@0.1.620" ||
+      pinned.installerPackage !== "@sellable/install@0.1.365-phase111.20260720162325" ||
+      pinned.mcpPackage !== "@sellable/mcp@0.1.626-phase111.20260720143315" ||
       !Array.isArray(policy.toolInclude) || policy.toolInclude.length === 0 ||
       !Number.isSafeInteger(slack.generation) || slack.generation < 1 ||
       !/^A[A-Z0-9]{8,20}$/.test(slack.appId ?? "") ||

package/lib/sellable-agent/profile-materializer.mjs

@@ -131,8 +131,8 @@ function validateDesired(desired) {
     !Number.isSafeInteger(desired.slackGeneration) || desired.slackGeneration < 1 ||
     !Number.isSafeInteger(desired.serviceCredentialGeneration) || desired.serviceCredentialGeneration < 1 ||
     desired.hermesCli !== "hermes" || desired.hermesVersion !== "0.18.0" ||
-    desired.installerPackage !== "@sellable/install@0.1.363" ||
-    desired.mcpPackage !== "@sellable/mcp@0.1.620" ||
+    desired.installerPackage !== "@sellable/install@0.1.365-phase111.20260720162325" ||
+    desired.mcpPackage !== "@sellable/mcp@0.1.626-phase111.20260720143315" ||
     !Array.isArray(desired.toolInclude) || desired.toolInclude.length === 0 ||
     desired.toolInclude.some((tool) => !/^[a-z][a-z0-9_]{0,127}$/.test(tool)) ||
     new Set(desired.toolInclude).size !== desired.toolInclude.length ||

package/lib/sellable-agent/provisioning-adapter.mjs

@@ -19,8 +19,8 @@ import { fileURLToPath } from "node:url";
 import { deriveContainedProfileId } from "./profile-materializer.mjs";
 
 export const PROVISIONING_ACTION = "PROVISION_HERMES_PROFILE";
-export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.363";
-export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.620";
+export const PINNED_INSTALL_PACKAGE = "@sellable/install@0.1.365-phase111.20260720162325";
+export const PINNED_MCP_PACKAGE = "@sellable/mcp@0.1.626-phase111.20260720143315";
 
 export function deriveAgentProfileId(workspaceId, agentId, hostId) {
   return deriveContainedProfileId(workspaceId, agentId, hostId);
@@ -576,7 +576,7 @@ function inspectProvisionedProfile({
       !matchesReadback(manifest, request) ||
       manifest.serviceCredentialReference !== serviceCredentialReference ||
       manifest.installerPackage !== PINNED_INSTALL_PACKAGE ||
-      manifest.installerVersion !== "0.1.363" ||
+      manifest.installerVersion !== "0.1.365-phase111.20260720162325" ||
       manifest.mcpPackage !== PINNED_MCP_PACKAGE ||
       manifest.credentialKeyVersion !== credentialKeyVersion ||
       !/^[a-f0-9]{16}$/.test(manifest.credentialFingerprint) ||
@@ -781,7 +781,7 @@ function successReceipt({
     subject: `agent-profile:${observed.profileId}`,
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.363",
+      installVersion: "0.1.365-phase111.20260720162325",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },
@@ -821,7 +821,7 @@ function failure(code, stages, extra = {}, request = null) {
     subject: safeIdentity ? `agent-profile:${safeIdentity}` : "agent-profile:unbound",
     cli: {
       installPackage: PINNED_INSTALL_PACKAGE,
-      installVersion: "0.1.363",
+      installVersion: "0.1.365-phase111.20260720162325",
       mcpPackage: PINNED_MCP_PACKAGE,
       command: "hermes profile bootstrap",
     },

package/lib/sellable-agent/service-installer.mjs

@@ -305,7 +305,7 @@ function configurationFiles(input, checked) {
   ].join("\n");
   return [
     ["/etc/sellable-agent/egress-proxy.json", `${JSON.stringify(checked.proxyConfig, null, 2)}\n`, 0o444],
-    ["/etc/sellable-agent/worker.json", `${JSON.stringify(input.workerConfig, null, 2)}\n`, 0o444],
+    ["/etc/sellable-agent/worker.json", `${JSON.stringify(input.workerConfig, null, 2)}\n`, 0o600],
     ["/etc/sellable-agent/runtime-helper.json", `${JSON.stringify(input.helperConfig, null, 2)}\n`, 0o600],
     ["/etc/sudoers.d/sellable-agent-runtime-helper", sudoers, 0o440],
   ].map(([logicalPath, bytes, mode]) => ({ logicalPath, bytes, mode }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.363",
+  "version": "0.1.365-phase111.20260720162325",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {

package/skill-templates/refill-sends-evergreen.md

@@ -17,3 +17,8 @@ Use `refill-sends-v2` instead:
 ```text
 get_subskill_prompt({ subskillName: "refill-sends-v2" })
 ```
+
+The alias must not strip exact `targetConfig`, server `runHandle`,
+`reportingContext`, canonical `refill_reporting.v2`, or an explicit
+`messageTemplateRevision`. It never infers revision authority from
+`forceRerun`.

package/skill-templates/refill-sends-v2.md

@@ -52,9 +52,35 @@ refill_sends_v2({ workspaceId, dryRun:true, intent:"auto", senderIds? })
 To resume an in-progress run, pass the handle back exactly:
 
 ```text
-refill_sends_v2({ workspaceId, runId, fence })
+refill_sends_v2({ workspaceId, runHandle:{runId,fence}, targetConfig, reportingContext, messageTemplateRevision? })
 ```
 
+`targetConfig` and the server-issued `runHandle` are separate authorities. Keep
+both byte-for-byte through every continuation and takeover; never fold the
+rotating fence into target configuration.
+
+An approved copy change is reachable only through an explicit
+`messageTemplateRevision` object with `version:1`, `source:"user_approved"`,
+the approved `templateMarkdown`, `messageTemplateRevision` identity,
+`priorTemplateAuthorityDigest`, `nextTemplateAuthorityDigest`, 1–500 exact
+`cohortRowIds`, and `requestId`, `effectId`, and `revisionOperationId`. Pass it
+with the exact `targetConfig` and `reportingContext`; the command obtains or
+resumes the server run handle and lets the planner name
+`revise_message_template_and_rerun`. Missing or partial input means no revision.
+`forceRerun:true` on a queue operation never authorizes or implies a template
+change.
+
+After a committed and dispatched revision receipt, continue only with the
+planner-provided revision-derived `approve_messages` action. It must preserve
+the exact revision cohort as `rowSelector:{type:"rowIds",rowIds:[...]}` plus
+`approvalMode:"approve"`, the compiled readiness identity, and the canonical
+`reportingContext`, even when the ordinary sender lane is ineligible. Do not
+replace it with `queue_campaign_cells` on Approved cells; that path cannot mint
+the authoritative approval/lane-scope receipt. Require `laneScope` in the
+bounded preparation receipt before the lane is considered approved. A
+disconnected or zero-capacity sender still blocks scheduling and does not
+authorize reconnecting, campaign start, or direct send.
+
 If a stale handle loses the lease, the tool reports the holder status and the
 approximately 10 minute lockout window. Reinvoke with the current handle or wait
 for lease expiry; never guess a fence.
@@ -85,6 +111,10 @@ The run may execute only packet-named bounded work:
   when the campaign is in the packet's pinned lane chain;
 - refresh paid InMail credit facts during bootstrap and once per scheduler-wait
   entry when the packet requires it.
+- apply `revise_message_template_and_rerun` only when the packet contains the
+  complete explicit user-approved revision envelope and exact fenced target.
+- after that revision commits, apply only its exact-row, readiness-bound
+  `approve_messages` continuation and require the returned lane-scope receipt.
 
 The loop records planned -> did -> outcome before and after every foreign
 mutation. It refuses stale packets by fingerprint and validates packet
@@ -168,5 +198,10 @@ reason or resume handle, lane source, lane chain, chosen label with token
 secondary, plan revision, journal path, blocked continuation packets, and
 firstFailing checklist when present.
 
+Preserve `refill_reporting.v2` exactly in progress, continuation, replay, and
+terminal results. Do not recompute its semantic counts or drop live-preparation
+epoch, snapshot sequence, reset reason, watermark, blockers, compatibility, or
+terminal fields. Never surface raw prospect or message-copy fields.
+
 Real-run journals live under `~/.sellable/refill/runs` by default and append an
 index line. Dry runs include the dry marker and do not create run records.

package/skill-templates/refill-sends.md

@@ -93,7 +93,7 @@ Accepted invocation flags in the same user request:
 When the host can call typed MCP tools, start with:
 
 ```text
-refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runId?: string, fence?: number })
+refill_sends({ yolo?: boolean, executionMode?: "manual" | "scheduled" | "yolo", requireWorkspace?: boolean, workspaceId?: string, senders?: string[], senderIds?: string[], senderNames?: string[], actionTypes?: ("send_invite" | "send_inmail_closed")[], horizonSendDays?: number, untilDate?: "YYYY-MM-DD", targetDate?: "YYYY-MM-DD", runHandle?: RefillRunHandleV1, targetConfig?: RefillTargetConfigV1, reportingContext?: RefillReportingContextV2, messageTemplateRevision?: MessageTemplateRevisionV1 })
 ```
 
 That command helper normalizes arguments and returns the execution contract. In
@@ -104,6 +104,49 @@ host must immediately call `refill_sends` again with the original full scope
 plus the exact returned `runId` and `fence`. Do this automatically inside the
 same user command until terminal projected coverage or a concrete blocker; do
 not ask the user to type `continue` and do not start a second run.
+
+`targetConfig` and the server-issued `runHandle` are separate values and must
+survive each continuation unchanged except for a server-issued takeover fence.
+Only a literal `messageTemplateRevision` with `source:"user_approved"`, the
+approved `templateMarkdown`, prior/new authority digests, 1–500 exact cohort
+row IDs, and request/effect/revision-operation IDs can authorize
+`revise_message_template_and_rerun`. No envelope means no revision. A
+`forceRerun:true` queue call cannot infer or authorize template mutation.
+When the user supplied a complete revision except for the current prior digest,
+acquire the exact run first and reread with its unchanged `targetConfig` and
+`runHandle`. Use only `reportingContext.source.templateAuthorityDigest` from
+that fenced reread as `priorTemplateAuthorityDigest`, then immediately continue
+the same run with the complete literal revision—even when the ordinary refill
+queue is empty or the sender is otherwise ineligible. An empty ordinary queue
+must not suppress an explicit revision. If the fenced reread returns no digest,
+stop with `template_authority_missing` or the returned
+`templateAuthorityBlocker`; never guess the digest.
+After the revision receipt is committed and dispatched, the next mutation must
+be the planner-provided revision-derived `approve_messages` action. Preserve
+its exact `rowSelector:{type:"rowIds",rowIds:[...]}` cohort,
+`approvalMode:"approve"`, compiled readiness authority, and
+`reportingContext`, even if the ordinary sender lane is ineligible. Never use
+`queue_campaign_cells` to flip Approved cells: that path cannot produce the
+authoritative approval/lane-scope receipt. Require the bounded preparation
+receipt's `laneScope` before considering the selected first-touch lane
+approved. Zero sender capacity remains a scheduler blocker and never authorizes
+reconnection, campaign start, or direct send.
+
+Before that approval mutation, perform an exact authoritative copy audit with
+`select_campaign_cells({ columnRole:"generateMessage",
+rowSelector:{type:"rowIds",rowIds:[...]},
+includeGeneratedMessageReview:true })` over the complete revision cohort in
+batches of at most 20. Require every
+`authoritativeGeneratedMessageReview.complete:true`, every row status to be
+completed-like, the exact user-approved rendered subject/body, the expected
+`templateAuthorityDigest`, and `matchesCurrentTemplateAuthority:true`. This
+projection is the only MCP copy-review source of truth. Never use formula
+Message/Subject columns, campaign message previews, table previews, or CSV
+exports to validate revised Generate Message results. If any row is missing,
+non-current, or text/digest mismatched, stop before approval and report
+`regenerated_copy_integrity_failed`; never regenerate again implicitly or
+approve the cohort on counts/revision hashes alone.
+
 Safe primitives are paid-credit refresh,
 existing-row message preparation, generated-message approval, receipt-proven
 same-source row copy, one bounded Signal Discovery search derived only from
@@ -567,6 +610,11 @@ scheduler wait loop. Do not finish the refill goal, mark it complete, or mark it
 blocked only because it is still `awaiting_scheduler_after_ready_buffer`; keep
 waiting unless Christian stops the run or the host cannot continue.
 
+Carry the canonical `refill_reporting.v2` DTO through progress, continuation,
+replay, and terminal reporting without recomputing counts or losing live epoch,
+snapshot sequence, reset reason, watermark, blockers, compatibility, or
+terminal outcome. Redact raw copy and prospect fields.
+
 Future scheduled coverage and already sent actions are distinct; only
 scheduler-owned future scheduled actions count as scheduled coverage. For
 multiple target dates, finish D1 execution and the full D1 reread before