@sellable/install 0.1.79 → 0.1.81

package/bin/sellable-install.mjs

@@ -611,6 +611,45 @@ Never mention MCP namespaces, prompt chunking, plugin cache paths, missing
 linked skill versions, runbooks, or local skill files in normal customer-facing
 copy.
 
+## Codex Watch Browser Handoff
+
+When a campaign tool returns \`watchUrl\`, treat it as an active browser handoff,
+not only a URL to print. A valid handoff link must be a signed
+\`/auth/continue?token=...&redirect=/campaign-builder/{campaignId}?mode=claude\`
+URL. \`create_campaign.watchUrl\`, \`create_campaign({ campaignId }).watchUrl\`,
+and \`get_campaign.watchUrl\` are all acceptable only when they return that signed
+shape.
+
+In Codex Desktop, when in-app browser control is available, open the returned watch link on the user's behalf. After opening it, inspect the browser-visible campaign state, then explain what the user is seeing before continuing with more campaign tools. Use customer language such as:
+
+\`\`\`text
+I’ll open the campaign view and keep it in sync as I build.
+\`\`\`
+
+If browser control is unavailable, say so briefly and provide the watch link.
+In VPS or other off-desktop Codex runs, this fallback is the expected handoff for
+the local headed watch observer: make the signed link easy to copy/open, then
+continue with explicit chat progress and \`get_campaign_navigation_state\`
+orientation checks.
+Use this fallback shape:
+
+\`\`\`text
+I can’t inspect the campaign browser from this Codex session, so I’ll keep the
+chat steps explicit here. Watch link: {watchUrl}
+\`\`\`
+
+If opening the watch link lands on an auth, 404, permission, blank, or visible
+error state, report only what is visible, recover a fresh signed watch link once
+with \`create_campaign({ campaignId })\` or \`get_campaign\`, and try that link.
+Do not claim the browser was opened, inspected, or synchronized unless the
+visible browser state was actually observed. Do not claim the browser was opened
+unless it was opened and observed.
+
+After every \`update_campaign({ campaignId, currentStep })\`, use
+\`get_campaign_navigation_state\` when available as a compact orientation check:
+match the browser-visible step to the saved campaign state, explain the current
+state in one sentence, and only then continue. Sender selection belongs at Settings after message approval and 10-row validation. Do not attach a sequence, start the campaign, or trigger a live send unless the user explicitly confirms that launch action outside UAT.
+
 ## Names To Use
 
 Use these exact public names so Claude Code and Codex do not drift:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.79",
+  "version": "0.1.81",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code and Codex",
   "bin": {

package/skill-templates/create-campaign.md

@@ -158,6 +158,45 @@ Never mention MCP namespaces, prompt chunking, plugin cache paths, missing
 linked skill versions, runbooks, or local skill files in normal customer-facing
 copy.
 
+## Codex Watch Browser Handoff
+
+When a campaign tool returns `watchUrl`, treat it as an active browser handoff,
+not only a URL to print. A valid handoff link must be a signed
+`/auth/continue?token=...&redirect=/campaign-builder/{campaignId}?mode=claude`
+URL. `create_campaign.watchUrl`, `create_campaign({ campaignId }).watchUrl`,
+and `get_campaign.watchUrl` are all acceptable only when they return that signed
+shape.
+
+In Codex Desktop, when in-app browser control is available, open the returned watch link on the user's behalf. After opening it, inspect the browser-visible campaign state, then explain what the user is seeing before continuing with more campaign tools. Use customer language such as:
+
+```text
+I’ll open the campaign view and keep it in sync as I build.
+```
+
+If browser control is unavailable, say so briefly and provide the watch link.
+In VPS or other off-desktop Codex runs, this fallback is the expected handoff for
+the local headed watch observer: make the signed link easy to copy/open, then
+continue with explicit chat progress and `get_campaign_navigation_state`
+orientation checks.
+Use this fallback shape:
+
+```text
+I can’t inspect the campaign browser from this Codex session, so I’ll keep the
+chat steps explicit here. Watch link: {watchUrl}
+```
+
+If opening the watch link lands on an auth, 404, permission, blank, or visible
+error state, report only what is visible, recover a fresh signed watch link once
+with `create_campaign({ campaignId })` or `get_campaign`, and try that link. Do
+not claim the browser was opened, inspected, or synchronized unless the visible
+browser state was actually observed. Do not claim the browser was opened unless
+it was opened and observed.
+
+After every `update_campaign({ campaignId, currentStep })`, use
+`get_campaign_navigation_state` when available as a compact orientation check:
+match the browser-visible step to the saved campaign state, explain the current
+state in one sentence, and only then continue. Sender selection belongs at Settings after message approval and 10-row validation. Do not attach a sequence, start the campaign, or trigger a live send unless the user explicitly confirms that launch action outside UAT.
+
 ## Names To Use
 
 Use these exact public names so Claude Code and Codex do not drift: