@sellable/mcp 0.1.27 → 0.1.28

package/README.md

@@ -33,7 +33,7 @@ command.
 For Claude Code and Codex CLI:
 
 ```bash
-npx -y @sellable/install --host all --token skt_live_your_token_here --workspace-id your_workspace_id
+npx -y @sellable/install@latest --host all --token skt_live_your_token_here --workspace-id your_workspace_id
 ```
 
 Agent-readable install instructions are available at:
@@ -52,6 +52,24 @@ sh /tmp/sellable-install.sh
 Phase 112 v1 uses package stdio MCP through `@sellable/mcp`. Hosted HTTP
 MCP is a future/advanced mode until the hosted endpoint exists.
 
+Package-mode installs launch `@sellable/mcp@latest`, so each fresh host MCP
+start resolves the newest stable npm release. The MCP server also runs a cached
+startup/auth update check and tells the agent to run
+`npx -y @sellable/install@latest` when the installed runtime is behind npm.
+
+### Publishing `@sellable/mcp`
+
+Publish from the repo root with:
+
+```bash
+npm run mcp:publish
+```
+
+The script loads `.env` and `prod.env`, builds `mcp/sellable`, verifies npm auth,
+and publishes with a temporary npm config file. Prefer `NPM_TOKEN=<npm token>` in
+`prod.env`; `NODE_AUTH_TOKEN`, `SELLABLE_NPM_TOKEN`, and `NPM_PUBLISH_TOKEN` are
+also supported.
+
 ### 2. Generate API Token
 
 1. Go to https://app.sellable.dev/settings
@@ -63,7 +81,7 @@ MCP is a future/advanced mode until the hosted endpoint exists.
 Install MCP server:
 
 ```bash
-claude mcp add --transport stdio sellable -- npx -y @sellable/mcp
+claude mcp add --transport stdio sellable -- npx -y @sellable/mcp@latest
 ```
 
 Create auth config at `~/.sellable/config.json`:
@@ -83,14 +101,14 @@ The token is provided when you generate it. Use `list_workspaces` +
 For customer/package installs, use the public installer:
 
 ```bash
-npx -y @sellable/install@0.1.26 --host codex --token skt_live_your_token_here --workspace-id your_workspace_id
+npx -y @sellable/install@latest --host codex --token skt_live_your_token_here --workspace-id your_workspace_id
 ```
 
 If you already have `~/.sellable/config.json`, rerun/verify without rewriting
 auth:
 
 ```bash
-npx -y @sellable/install@0.1.26 --host codex
+npx -y @sellable/install@latest --host codex
 sellable --verify-only --host codex
 ```
 

package/dist/server.js

@@ -29,6 +29,7 @@ import { attachRecommendedSequence, attachSequence, createWorkflowTable, sequenc
 import { listTables, tableToolDefinitions } from "./tools/tables.js";
 import { handleVerifyTableRow, verifyRowToolDefinitions, } from "./tools/verify-row.js";
 import { addTeammate, createWorkspace, getActiveWorkspace, listWorkspaces, setActiveWorkspace, workspaceToolDefinitions, } from "./tools/workspaces.js";
+import { checkForUpdates, logUpdateNotice } from "./update-check.js";
 const server = new Server({
     name: "sellable-mcp",
     version: "1.0.0",
@@ -515,6 +516,11 @@ server.setRequestHandler(GetPromptRequestSchema, async (request) => {
 async function main() {
     const startTime = Date.now();
     console.error(`[sellable-mcp] pid=${process.pid} starting...`);
+    void checkForUpdates()
+        .then(logUpdateNotice)
+        .catch(() => {
+        // Update checks are advisory and must never block MCP startup.
+    });
     const transport = new StdioServerTransport();
     // Exit cleanly when parent disconnects stdin (Claude Code closed/reconnected)
     process.stdin.on("end", () => {

package/dist/tools/auth.d.ts

@@ -1,3 +1,4 @@
+import { type SellableUpdateStatus } from "../update-check.js";
 export type AuthStatus = {
     ok: boolean;
     configPath: string;
@@ -10,6 +11,7 @@ export type AuthStatus = {
     checkedAt: string;
     /** Short message the LLM MUST show the user after auth succeeds. */
     _userNotice: string | null;
+    update: SellableUpdateStatus | null;
     error: null | {
         type: "config" | "auth" | "workspace" | "api";
         status?: number;

package/dist/tools/auth.js

@@ -1,14 +1,28 @@
 import { getApi, SellableApiError } from "../api.js";
 import { getConfig, getConfigPath } from "../auth.js";
+import { checkForUpdates } from "../update-check.js";
 function maskToken(token) {
     if (token.length <= 10)
         return `${token.slice(0, 4)}...`;
     return `${token.slice(0, 8)}...${token.slice(-2)}`;
 }
+async function getUpdateStatus() {
+    try {
+        return await checkForUpdates();
+    }
+    catch {
+        return null;
+    }
+}
+function appendUpdateNotice(notice, update) {
+    if (!update?._userNotice)
+        return notice;
+    return notice ? `${notice}\n${update._userNotice}` : update._userNotice;
+}
 export const authToolDefinitions = [
     {
         name: "get_auth_status",
-        description: "Verify Sellable authentication early. Call this before any campaign work. Returns ok=false with clear guidance when the token is missing, revoked, or the active workspace is not set. IMPORTANT: When auth succeeds, ALWAYS tell the user the _userNotice message so they know which workspace is active.",
+        description: "Verify Sellable authentication early. Call this before any campaign work. Also performs a cached Sellable package update check. Returns ok=false with clear guidance when the token is missing, revoked, or the active workspace is not set. IMPORTANT: When auth succeeds, ALWAYS tell the user the _userNotice message so they know which workspace is active and whether an update is available.",
         inputSchema: {
             type: "object",
             properties: {},
@@ -20,6 +34,7 @@ export const authToolDefinitions = [
 export async function getAuthStatus() {
     const configPath = getConfigPath();
     const checkedAt = new Date().toISOString();
+    const update = await getUpdateStatus();
     const base = {
         ok: false,
         configPath,
@@ -29,7 +44,8 @@ export async function getAuthStatus() {
         activeWorkspaceName: null,
         tokenPrefix: null,
         workspacesCount: null,
-        _userNotice: null,
+        _userNotice: appendUpdateNotice(null, update),
+        update,
         checkedAt,
     };
     try {
@@ -87,7 +103,8 @@ export async function getAuthStatus() {
             activeWorkspaceName: workspaceName,
             tokenPrefix: maskToken(config.token),
             workspacesCount: workspaces.length,
-            _userNotice: notice,
+            _userNotice: appendUpdateNotice(notice, update),
+            update,
             checkedAt,
             error: null,
         };

package/dist/tools/bootstrap.d.ts

@@ -9,7 +9,7 @@ type BootstrapCreateCampaignInput = {
     refreshContext?: boolean;
 };
 type BootstrapCheck = {
-    key: "auth" | "framework" | "resume_context" | "subskill_catalog" | "create_campaign_subskill";
+    key: "auth" | "update" | "framework" | "resume_context" | "subskill_catalog" | "create_campaign_subskill";
     ok: boolean;
     blocking: boolean;
     detail: string;

package/dist/tools/bootstrap.js

@@ -10,6 +10,9 @@ function toGuidance(check, message) {
     if (check === "auth") {
         return "Run get_auth_status and fix auth/workspace setup before continuing.";
     }
+    if (check === "update") {
+        return "Run npx -y @sellable/install@latest, then restart Claude Code/Codex so Sellable reloads.";
+    }
     if (check === "framework") {
         return "Fix framework files and rerun bootstrap_create_campaign.";
     }
@@ -101,6 +104,22 @@ export async function bootstrapCreateCampaign(input = {}) {
         if (!ok) {
             pushBlockingError(blockingErrors, "auth", authCheck.status.error?.message || "Authentication check failed.");
         }
+        const update = authCheck.status.update;
+        if (update && !update.disabled) {
+            requiredChecks.push({
+                key: "update",
+                ok: !update.blocking,
+                blocking: update.blocking,
+                detail: update.updateAvailable
+                    ? update._userNotice || "A newer Sellable MCP package is available."
+                    : update.mcp.latestVersion
+                        ? `Sellable MCP is current (${update.mcp.currentVersion ?? "unknown"}).`
+                        : "Sellable MCP update check completed without latest-version data.",
+            });
+            if (update.blocking) {
+                pushBlockingError(blockingErrors, "update", update._userNotice || "Sellable MCP update required.");
+            }
+        }
     }
     catch (error) {
         const message = toErrorMessage(error);

package/dist/tools/leads.js

@@ -2205,10 +2205,18 @@ export async function confirmLeadList(input) {
         ...(shouldSetCurrentStep ? { currentStep: effectiveCurrentStep } : {}),
     });
     const campaignTableId = importResult.workflowTableId ?? importResult.campaignTableId;
-    if (campaignTableId) {
+    // Persist currentStep if the caller asked for it. Do NOT touch
+    // selectedLeadListId here: the campaign table id is already saved to
+    // CampaignOffer.workflowTableId by /api/v3/campaign-builder/import-leads,
+    // and selectedLeadListId must remain pointing at the source lead list
+    // (config.type === "lead_list") so the UI's Continue handler — which feeds
+    // selectedLeadListId back into /api/v3/campaign-builder/import-leads as
+    // sourceLeadListId — can find a valid lead list. Overwriting it with the
+    // campaign table id makes that endpoint 404 with "Lead list not found"
+    // and silently breaks the Leads → Filter Continue button.
+    if (shouldSetCurrentStep) {
         await api.put(`/api/v2/campaign-offers/${campaignOfferId}`, {
-            selectedLeadListId: campaignTableId,
-            ...(shouldSetCurrentStep ? { currentStep: effectiveCurrentStep } : {}),
+            currentStep: effectiveCurrentStep,
         });
     }
     return {

package/dist/update-check.d.ts

@@ -0,0 +1,25 @@
+export type PackageUpdateStatus = {
+    packageName: string;
+    currentVersion: string | null;
+    latestVersion: string | null;
+    outdated: boolean;
+    error?: string;
+};
+export type SellableUpdateStatus = {
+    checkedAt: string;
+    cachePath: string;
+    fromCache: boolean;
+    disabled: boolean;
+    mcp: PackageUpdateStatus;
+    installer: PackageUpdateStatus;
+    updateAvailable: boolean;
+    blocking: boolean;
+    guidance: string | null;
+    _userNotice: string | null;
+};
+export declare function checkForUpdates(options?: {
+    force?: boolean;
+    timeoutMs?: number;
+    ttlMs?: number;
+}): Promise<SellableUpdateStatus>;
+export declare function logUpdateNotice(status: SellableUpdateStatus): void;

package/dist/update-check.js

@@ -0,0 +1,210 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+const MCP_PACKAGE = "@sellable/mcp";
+const INSTALL_PACKAGE = "@sellable/install";
+const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+const DEFAULT_TIMEOUT_MS = 1500;
+function cachePath() {
+    return path.join(os.homedir(), ".sellable", "update-check.json");
+}
+function readCurrentVersion() {
+    const entrypointDir = process.argv[1]
+        ? path.dirname(path.resolve(process.argv[1]))
+        : process.cwd();
+    const candidates = [
+        path.resolve(entrypointDir, "..", "package.json"),
+        path.resolve(process.cwd(), "mcp/sellable/package.json"),
+    ];
+    for (const pkgPath of candidates) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            if (pkg.name === MCP_PACKAGE && typeof pkg.version === "string") {
+                return pkg.version;
+            }
+        }
+        catch {
+            // Keep looking; version detection is advisory only.
+        }
+    }
+    return null;
+}
+function registryPackagePath(packageName) {
+    return encodeURIComponent(packageName);
+}
+async function fetchLatestVersion(packageName, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(`https://registry.npmjs.org/${registryPackagePath(packageName)}/latest`, {
+            signal: controller.signal,
+            headers: {
+                Accept: "application/json",
+                "User-Agent": "sellable-mcp-update-check",
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`npm registry returned ${response.status}`);
+        }
+        const body = (await response.json());
+        if (typeof body.version !== "string" || !body.version) {
+            throw new Error("npm registry response did not include a version");
+        }
+        return body.version;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function parseVersion(version) {
+    if (!version)
+        return null;
+    const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/);
+    if (!match)
+        return null;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function isVersionOutdated(currentVersion, latestVersion) {
+    const current = parseVersion(currentVersion);
+    const latest = parseVersion(latestVersion);
+    if (!current || !latest)
+        return false;
+    for (let i = 0; i < 3; i += 1) {
+        if (current[i] < latest[i])
+            return true;
+        if (current[i] > latest[i])
+            return false;
+    }
+    return false;
+}
+function readCache(ttlMs) {
+    const file = cachePath();
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!raw.checkedAtMs || Date.now() - raw.checkedAtMs > ttlMs)
+            return null;
+        return {
+            ...raw,
+            cachePath: file,
+            fromCache: true,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(status) {
+    const file = cachePath();
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        const { fromCache: _fromCache, ...cacheableStatus } = status;
+        const cache = {
+            ...cacheableStatus,
+            cachePath: file,
+            checkedAtMs: Date.now(),
+        };
+        fs.writeFileSync(file, `${JSON.stringify(cache, null, 2)}\n`, {
+            mode: 0o600,
+        });
+    }
+    catch {
+        // Update checks must never break MCP startup or tool execution.
+    }
+}
+function disabledStatus(currentVersion) {
+    return {
+        checkedAt: new Date().toISOString(),
+        cachePath: cachePath(),
+        fromCache: false,
+        disabled: true,
+        mcp: {
+            packageName: MCP_PACKAGE,
+            currentVersion,
+            latestVersion: null,
+            outdated: false,
+        },
+        installer: {
+            packageName: INSTALL_PACKAGE,
+            currentVersion: null,
+            latestVersion: null,
+            outdated: false,
+        },
+        updateAvailable: false,
+        blocking: false,
+        guidance: null,
+        _userNotice: null,
+    };
+}
+function buildNotice(mcp, installer) {
+    if (!mcp.outdated)
+        return null;
+    const versions = mcp.currentVersion && mcp.latestVersion
+        ? `${mcp.currentVersion} -> ${mcp.latestVersion}`
+        : "a newer version is available";
+    const installerVersion = installer.latestVersion
+        ? ` The latest installer is ${installer.latestVersion}.`
+        : "";
+    return `Sellable update available: ${versions}. Run: npx -y @sellable/install@latest.${installerVersion}`;
+}
+export async function checkForUpdates(options) {
+    const currentVersion = readCurrentVersion();
+    const ttlMs = options?.ttlMs ??
+        (Number(process.env.SELLABLE_UPDATE_CHECK_TTL_MS || "") || DEFAULT_TTL_MS);
+    const timeoutMs = options?.timeoutMs ??
+        (Number(process.env.SELLABLE_UPDATE_CHECK_TIMEOUT_MS || "") ||
+            DEFAULT_TIMEOUT_MS);
+    if (process.env.SELLABLE_UPDATE_CHECK_DISABLED === "1") {
+        return disabledStatus(currentVersion);
+    }
+    if (!options?.force) {
+        const cached = readCache(ttlMs);
+        if (cached)
+            return cached;
+    }
+    const [mcpResult, installerResult] = await Promise.allSettled([
+        fetchLatestVersion(MCP_PACKAGE, timeoutMs),
+        fetchLatestVersion(INSTALL_PACKAGE, timeoutMs),
+    ]);
+    const mcpLatest = mcpResult.status === "fulfilled" ? mcpResult.value : null;
+    const installerLatest = installerResult.status === "fulfilled" ? installerResult.value : null;
+    const mcp = {
+        packageName: MCP_PACKAGE,
+        currentVersion,
+        latestVersion: mcpLatest,
+        outdated: isVersionOutdated(currentVersion, mcpLatest),
+        ...(mcpResult.status === "rejected"
+            ? { error: mcpResult.reason?.message || String(mcpResult.reason) }
+            : {}),
+    };
+    const installer = {
+        packageName: INSTALL_PACKAGE,
+        currentVersion: null,
+        latestVersion: installerLatest,
+        outdated: false,
+        ...(installerResult.status === "rejected"
+            ? {
+                error: installerResult.reason?.message || String(installerResult.reason),
+            }
+            : {}),
+    };
+    const notice = buildNotice(mcp, installer);
+    const status = {
+        checkedAt: new Date().toISOString(),
+        cachePath: cachePath(),
+        fromCache: false,
+        disabled: false,
+        mcp,
+        installer,
+        updateAvailable: mcp.outdated,
+        blocking: false,
+        guidance: notice ? "Run npx -y @sellable/install@latest" : null,
+        _userNotice: notice,
+    };
+    writeCache(status);
+    return status;
+}
+export function logUpdateNotice(status) {
+    if (status._userNotice) {
+        console.error(`[sellable-mcp] ${status._userNotice}`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "type": "module",
   "description": "Sellable MCP server for Claude Code and Codex campaign workflows",
   "main": "dist/index.js",

package/skills/create-campaign-v2/SKILL.md

@@ -118,6 +118,8 @@ Validated draft directory:
   loading, runbooks, local skill files, skill versions, or "Sellable token".
   "Quick question panel" is only acceptable when explaining a Codex/Claude setup
   blocker.
+- Before campaign mint, do not call `check_rubric`; Phase 84 only writes and
+  validates draft artifacts.
 - Never narrate local draft housekeeping to the user. If you create directories,
   save drafts, write artifacts, or persist intermediate state, translate it into
   the campaign benefit: consistent brief, approved lead source, reviewed message,
@@ -394,6 +396,9 @@ should test for this campaign. Those can run in parallel and usually take
 - Before the user chooses `approve`, the mutating live-campaign tools are
   forbidden: `create_campaign`, `save_rubrics`, `import_leads`,
   `confirm_lead_list`, `update_campaign`, `queue_cells`, and `start_campaign`.
+- During pre-approval validation, do not call `check_rubric`; use the
+  campaignless lead-filter artifacts and only use campaign-backed scoring after
+  the approval flow allows it.
 - Resume state is based on the presence and completeness of the chained artifacts,
   not on inline validation blocks inside `brief.md`.
 - Preserve the Phase 83 thesis. Do not rewrite product, ICP, offer, or message