@sellable/install 0.1.38 → 0.1.39

package/bin/sellable-install.mjs

@@ -20,7 +20,9 @@ const DEFAULT_SERVER_PACKAGE =
 function getInstallVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
-    const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+    const pkg = JSON.parse(
+      readFileSync(join(here, "..", "package.json"), "utf8")
+    );
     return pkg.version || "unknown";
   } catch {
     return "unknown";
@@ -1454,6 +1456,48 @@ function printNextSteps(installedHosts) {
 
 async function main() {
   try {
+    // Phase 116: auth set <token> subcommand — manual-paste fallback when CLI poll fails.
+    // MUST be parsed BEFORE parseArgs() since parseArgs throws on non-flag args like "auth".
+    const rawArgs = process.argv.slice(2);
+    if (rawArgs[0] === "auth") {
+      if (rawArgs[1] !== "set") {
+        console.error(
+          `Unknown auth subcommand: ${rawArgs[1] ?? "(none)"}\nKnown: set <token>`
+        );
+        process.exit(2);
+      }
+      const token = rawArgs[2];
+      if (!token) {
+        console.error(
+          "Usage: sellable auth set <token>\n" +
+            "Get the token from the Sellable browser confirm page (after clicking the magic link)."
+        );
+        process.exit(2);
+      }
+      // Verification iter 1 broadening: accept skt_(live|test|dev)_ prefixes so
+      // non-prod tokens (existing in some environments) are not rejected.
+      if (!/^skt_(live|test|dev)_[A-Za-z0-9_-]{20,}$/.test(token)) {
+        console.error(
+          `That doesn't look like a Sellable token (expected skt_live_, skt_test_, or skt_dev_ prefix). Got: ${token.slice(0, 16)}…`
+        );
+        process.exit(2);
+      }
+      // Bypass writeAuth() — its workspaceId guard early-returns on missing
+      // workspaceId, but on the auth-set path we don't have one yet (next MCP
+      // call hydrates it). Write the same shape directly.
+      // Skip installSelfShim() — by definition the user has the shim already
+      // (they invoked `sellable auth set` from it).
+      const apiUrl = process.env.SELLABLE_API_URL || DEFAULT_API_URL;
+      writeJson(
+        authPath(),
+        { token, activeWorkspaceId: null, apiUrl },
+        { dryRun: false }
+      );
+      console.log(`✓ Token saved to ${authPath()}`);
+      console.log(`  apiUrl: ${apiUrl}`);
+      console.log(`  Run /sellable:create-campaign in your agent to continue.`);
+      process.exit(0);
+    }
     const opts = parseArgs(process.argv.slice(2));
     if (opts.help) {
       console.log(usage());
@@ -1510,9 +1554,7 @@ async function main() {
       }
 
       if (installedHosts.length > 0) {
-        logMilestone(
-          `MCP servers registered (${installedHosts.join(" + ")})`
-        );
+        logMilestone(`MCP servers registered (${installedHosts.join(" + ")})`);
         if (installedHosts.includes("Codex")) {
           logMilestone("Codex Desktop plugin installed");
           logMilestone("Skills installed");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {