@sellable/install 0.1.471 → 0.1.472

package/lib/sellable-agent/fly-admin-image/admin-runtime.mjs

@@ -53,8 +53,10 @@ import {
   exchangeFlyAdminIdentity,
   flyRuntimeDigest,
   handoffFlyOidcSocket,
+  isFlyCustomerEnrollmentRenewalError,
   loadOrCreateFlyRuntimeIdentity,
   obtainFlyOidcToken,
+  renewFlyAdminControlSession,
   signedWorkerAuthorization,
 } from "../fly-runtime-identity.mjs";
 import {
@@ -2263,7 +2265,7 @@ async function runAdminProduction() {
     identityRoot: join(RUNTIME_ROOT, "identity"),
     persistent: true,
   });
-  const exchange = await exchangeFlyAdminIdentity({
+  let exchange = await exchangeFlyAdminIdentity({
     origin: ORIGIN,
     runtimeId: RUNTIME_ID,
     audience: AUDIENCE,
@@ -2280,7 +2282,7 @@ async function runAdminProduction() {
   }
   const deliveryKey = loadOrCreateDeliveryKey();
   await enrollDeliveryKey({ identity, exchange, deliveryKey });
-  const client = createFlyCustomerControlClient({
+  let client = createFlyCustomerControlClient({
     origin: ORIGIN,
     identity,
     exchange,
@@ -2321,7 +2323,35 @@ async function runAdminProduction() {
   let failures = 0;
   while (!controller.signal.aborted) {
     try {
-      const claim = await client.claim(60);
+      let claim;
+      try {
+        claim = await client.claim(60);
+      } catch (error) {
+        if (!isFlyCustomerEnrollmentRenewalError(error)) throw error;
+        const renewed = await renewFlyAdminControlSession({
+          origin: ORIGIN,
+          runtimeId: RUNTIME_ID,
+          audience: AUDIENCE,
+          identity,
+          bootSessionId: BOOT_SESSION_ID,
+          runtimeGeneration: RUNTIME_GENERATION,
+          adminRuntimeGenerationId:
+            exchange.adminDeliveryTarget.adminRuntimeGenerationId,
+          adminRuntimeGenerationFence:
+            exchange.adminDeliveryTarget.adminRuntimeGenerationFence,
+        });
+        exchange = renewed.exchange;
+        client = renewed.client;
+        failures = 0;
+        process.stderr.write(
+          `${JSON.stringify({
+            ok: true,
+            code: "admin_enrollment_renewed",
+            keyGeneration: exchange.keyGeneration,
+          })}\n`
+        );
+        continue;
+      }
       if (controller.signal.aborted) break;
       if (!claim) {
         if (activeLaunch) {

package/lib/sellable-agent/fly-runtime-identity.mjs

@@ -998,3 +998,65 @@ export async function renewFlyCustomerControlSession({
   });
   return Object.freeze({ exchange, client });
 }
+
+export async function renewFlyAdminControlSession({
+  origin,
+  runtimeId,
+  audience,
+  identity,
+  bootSessionId,
+  runtimeGeneration,
+  adminRuntimeGenerationId,
+  adminRuntimeGenerationFence,
+  obtainOidcTokenImpl = obtainFlyOidcToken,
+  exchangeFlyAdminIdentityImpl = exchangeFlyAdminIdentity,
+  createFlyCustomerControlClientImpl = createFlyCustomerControlClient,
+}) {
+  if (
+    !Number.isSafeInteger(runtimeGeneration) ||
+    runtimeGeneration < 1 ||
+    !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(
+      bootSessionId ?? ""
+    ) ||
+    !SAFE_ID.test(adminRuntimeGenerationId ?? "") ||
+    !/^[1-9][0-9]{0,19}$/.test(adminRuntimeGenerationFence ?? "") ||
+    typeof obtainOidcTokenImpl !== "function" ||
+    typeof exchangeFlyAdminIdentityImpl !== "function" ||
+    typeof createFlyCustomerControlClientImpl !== "function"
+  ) {
+    throw new Error("admin_runtime_generation_rejected");
+  }
+  let oidcToken = await obtainOidcTokenImpl({ audience });
+  let exchange;
+  try {
+    exchange = await exchangeFlyAdminIdentityImpl({
+      origin,
+      runtimeId,
+      audience,
+      identity,
+      bootSessionId,
+      oidcToken,
+    });
+  } finally {
+    oidcToken = null;
+  }
+  if (
+    exchange?.kind !== "ADMIN" ||
+    exchange.runtimeId !== runtimeId ||
+    exchange.publicKeyHash !== identity?.publicKeyHash ||
+    exchange.keyGeneration !== runtimeGeneration ||
+    exchange.adminDeliveryTarget?.runtimeGeneration !== runtimeGeneration ||
+    exchange.adminDeliveryTarget.adminRuntimeGenerationId !==
+      adminRuntimeGenerationId ||
+    exchange.adminDeliveryTarget.adminRuntimeGenerationFence !==
+      adminRuntimeGenerationFence
+  ) {
+    throw new Error("admin_runtime_generation_rejected");
+  }
+  const client = createFlyCustomerControlClientImpl({
+    origin,
+    identity,
+    exchange,
+  });
+  return Object.freeze({ exchange, client });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.471",
+  "version": "0.1.472",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {

package/skill-templates/refill-sends.md

@@ -18,6 +18,7 @@ allowed-tools:
   - mcp__sellable__search_subskill_prompts
   - mcp__sellable__list_senders
   - mcp__sellable__select_campaign_cells
+  - mcp__sellable__wait_for_campaign_processing
 ---
 
 # Refill Sends
@@ -591,8 +592,16 @@ asset is the contract to load — load the prompt and that asset, verify the `v3
 compatible range, and report the version before the first call. Call
 `refill_v3_advance` with `{workspaceId, scope}` — plus `yolo: true` only when the
 operator asked for `--yolo` — and call it again after each `advanced` or
-`campaign_attention_required` result until it answers `awaiting_external_change`,
-`complete`, or `blocked`.
+`campaign_attention_required` result. An `awaiting_external_change` result with
+`deferral.code:"campaign_work_in_flight"` and a campaign id is a bounded
+read-only continuation, not permission to walk the next campaign: call
+`wait_for_campaign_processing({ workspaceId, campaignId, requireIdle:true })`,
+then call `refill_v3_advance` again with the identical scope and yolo grant.
+This reuses Create Campaign's campaign-table waiter and guarantees the same
+campaign is freshly replanned after its cohort settles. If the bounded wait
+returns a partial timeout, surface that checkpoint and make the fresh advance;
+if it reports the same live campaign, repeat the bounded wait. Stop on every
+other `awaiting_external_change`, `complete`, or `blocked` result.
 
 Resolve the workspace BEFORE the first call, exactly as the V1 route already
 requires. `workspaceId` must be an exact id on every automation call: when the