@sellable/mcp 0.1.549 → 0.1.551

package/agents/registry.json

@@ -26,8 +26,8 @@
       "ownership": "message strategy, proof inventory, token rules, skeptical-prospect review, and selected winner only",
       "codex": {
         "description": "Message Drafting worker for campaign-backed template proposals after confirm_lead_list imports a non-empty bounded review batch.",
-        "model": "gpt-5.5",
-        "modelReasoningEffort": "xhigh",
+        "model": "gpt-5.6-sol",
+        "modelReasoningEffort": "high",
         "sandboxMode": "read-only",
         "nicknameCandidates": [
           "Message Drafting",

package/dist/api.js

@@ -3,7 +3,7 @@ import { mkdir, rename, rm, stat } from "node:fs/promises";
 import path from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { getConfig, getConfigPath } from "./auth.js";
+import { getConfig, getConfigPath, getEffectiveConfiguredWorkspaceId, resolveWorkspaceIdForRequest, } from "./auth.js";
 export class SellableApiError extends Error {
     status;
     body;
@@ -42,9 +42,12 @@ export class SellableApi {
         // Re-read config on every request so workspace switches take effect immediately
         const config = getConfig();
         const url = `${config.apiUrl}${path}`;
-        const workspaceId = options && Object.prototype.hasOwnProperty.call(options, "workspaceId")
+        const requestedWorkspaceId = options && Object.prototype.hasOwnProperty.call(options, "workspaceId")
             ? options.workspaceId
-            : config.activeWorkspaceId || config.workspaceId || null;
+            : getEffectiveConfiguredWorkspaceId(config);
+        const workspaceId = options && Object.prototype.hasOwnProperty.call(options, "workspaceId")
+            ? resolveWorkspaceIdForRequest(requestedWorkspaceId, `${method} ${path}`)
+            : requestedWorkspaceId;
         const response = await fetch(url, {
             method,
             headers: {

package/dist/auth.d.ts

@@ -40,6 +40,12 @@ export type SkillState = {
 export declare function setConfigFile(fileName: string): void;
 export declare function getResolvedConfigsDir(): string | null;
 export declare function getConfigPath(): string;
+export declare function getLockedWorkspaceId(): string | null;
+export declare function isWorkspaceLockRequired(): boolean;
+export declare function workspaceLockRequiredMessage(action?: string): string;
+export declare function assertWorkspaceLockSatisfied(action?: string): void;
+export declare function getEffectiveConfiguredWorkspaceId(config: Pick<SellableConfig, "activeWorkspaceId" | "workspaceId">): string | null;
+export declare function resolveWorkspaceIdForRequest(requestedWorkspaceId: string | null | undefined, action?: string): string | null;
 export declare function getConfig(): SellableConfig;
 export declare function updateActiveWorkspace(params: {
     workspaceId: string;

package/dist/auth.js

@@ -2,6 +2,8 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 const DEFAULT_API_URL = "https://app.sellable.dev";
+const WORKSPACE_LOCK_ENV = "SELLABLE_LOCK_WORKSPACE_ID";
+const REQUIRE_WORKSPACE_LOCK_ENV = "SELLABLE_REQUIRE_WORKSPACE_LOCK";
 // No caching — re-read config on every call so token/workspace changes
 // made by the LLM (editing sellable.json) take effect immediately
 // without requiring an MCP server restart.
@@ -85,6 +87,44 @@ function normalizeConfig(raw) {
         apiUrl: raw.apiUrl || DEFAULT_API_URL,
     };
 }
+export function getLockedWorkspaceId() {
+    const value = process.env[WORKSPACE_LOCK_ENV]?.trim();
+    return value || null;
+}
+export function isWorkspaceLockRequired() {
+    const value = process.env[REQUIRE_WORKSPACE_LOCK_ENV]?.trim().toLowerCase();
+    return value === "1" || value === "true" || value === "yes";
+}
+export function workspaceLockRequiredMessage(action = "Sellable request") {
+    return (`Workspace lock required: ${action} cannot run because ` +
+        `${REQUIRE_WORKSPACE_LOCK_ENV}=1 but ${WORKSPACE_LOCK_ENV} is missing. ` +
+        "Ask the sellable-admin profile to provision this customer profile with an approved customer workspace.");
+}
+export function assertWorkspaceLockSatisfied(action = "Sellable request") {
+    if (isWorkspaceLockRequired() && !getLockedWorkspaceId()) {
+        throw new Error(workspaceLockRequiredMessage(action));
+    }
+}
+function normalizeWorkspaceId(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+export function getEffectiveConfiguredWorkspaceId(config) {
+    assertWorkspaceLockSatisfied("workspace resolution");
+    return (getLockedWorkspaceId() ||
+        normalizeWorkspaceId(config.activeWorkspaceId) ||
+        normalizeWorkspaceId(config.workspaceId));
+}
+export function resolveWorkspaceIdForRequest(requestedWorkspaceId, action = "Sellable request") {
+    assertWorkspaceLockSatisfied(action);
+    const lockedWorkspaceId = getLockedWorkspaceId();
+    const requested = normalizeWorkspaceId(requestedWorkspaceId);
+    if (!lockedWorkspaceId)
+        return requested;
+    if (requested && requested !== lockedWorkspaceId) {
+        throw new Error(`Workspace lock violation: ${action} requested workspace ${requested}, but this profile is locked to ${lockedWorkspaceId}.`);
+    }
+    return lockedWorkspaceId;
+}
 export function getConfig() {
     // Config cache removed 2026-05-04: we always re-read from disk so
     // workspace switches (set_active_workspace) take effect immediately
@@ -139,6 +179,7 @@ export function getConfig() {
     }
 }
 export function updateActiveWorkspace(params) {
+    resolveWorkspaceIdForRequest(params.workspaceId, "set_active_workspace");
     const configPath = getConfigPath();
     const configDir = path.dirname(configPath);
     if (!fs.existsSync(configDir)) {
@@ -226,6 +267,7 @@ function writeRawConfigFile(configPath, raw) {
  * new config without an MCP server restart.
  */
 export function writeNewConfig(opts) {
+    resolveWorkspaceIdForRequest(opts.activeWorkspaceId, "write Sellable auth config");
     const configPath = getConfigWritePath();
     let raw = {};
     if (fs.existsSync(configPath)) {
@@ -283,7 +325,7 @@ function getActiveEnvConfigRef(raw) {
 }
 export function getEngageState() {
     const config = getConfig();
-    const workspaceId = config.activeWorkspaceId || config.workspaceId || null;
+    const workspaceId = getEffectiveConfiguredWorkspaceId(config);
     if (!workspaceId) {
         return { activeWorkspaceId: null, state: null };
     }
@@ -294,7 +336,7 @@ export function updateEngageState(patch) {
     const { configPath, raw } = readRawConfigFile();
     const { envConfig, set } = getActiveEnvConfigRef(raw);
     const normalized = normalizeConfig(envConfig);
-    const workspaceId = normalized.activeWorkspaceId || normalized.workspaceId || null;
+    const workspaceId = getEffectiveConfiguredWorkspaceId(normalized);
     if (!workspaceId) {
         throw new Error("No active workspace selected. Run list_workspaces then set_active_workspace.");
     }

package/dist/refill-date-window.d.ts

@@ -0,0 +1,34 @@
+export type RefillDateWindowSource = "default_scheduler_forward" | "horizon_send_days" | "until_date" | "target_date";
+export type NormalizedRefillDateSelector = {
+    source: RefillDateWindowSource;
+    targetDate: string | null;
+    untilDate: string | null;
+    horizonSendDays: number | null;
+};
+export type RefillRunDateWindow = NormalizedRefillDateSelector & {
+    version: 1;
+    selectedDates: string[];
+    senderWindows?: Array<{
+        senderId: string | null;
+        timeZone: string | null;
+        selectedDates: string[];
+    }>;
+};
+type DateSelectorInput = {
+    targetDate?: unknown;
+    untilDate?: unknown;
+    horizonSendDays?: unknown;
+};
+export declare function normalizeRefillDateSelector(input: DateSelectorInput): NormalizedRefillDateSelector;
+export declare function refillDateSelectorBody(selector: NormalizedRefillDateSelector): {
+    targetDate?: string;
+    untilDate?: string;
+    horizonSendDays?: number;
+};
+export declare function dateWindowFromSelector(selector: NormalizedRefillDateSelector): RefillRunDateWindow;
+export declare function dateWindowFromPlan(plan: Record<string, unknown>, selector: NormalizedRefillDateSelector): RefillRunDateWindow;
+export declare function dateWindowFromRunState(runState: unknown): RefillRunDateWindow | null;
+export declare function selectorFromDateWindow(window: RefillRunDateWindow): NormalizedRefillDateSelector;
+export declare function dateSelectorMatchesWindow(selector: NormalizedRefillDateSelector, window: RefillRunDateWindow): boolean;
+export declare function schedulerSweepTargetDates(window: RefillRunDateWindow): string[];
+export {};

package/dist/refill-date-window.js

@@ -0,0 +1,210 @@
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function stringValue(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+function numberValue(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function arrayValue(value) {
+    return Array.isArray(value) ? value : [];
+}
+function isValidDateKey(value) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(value))
+        return false;
+    const [year, month, day] = value.split("-").map(Number);
+    const date = new Date(Date.UTC(year, month - 1, day));
+    return (date.getUTCFullYear() === year &&
+        date.getUTCMonth() === month - 1 &&
+        date.getUTCDate() === day);
+}
+function normalizeDateKey(value, field) {
+    if (value === undefined || value === null || value === "")
+        return null;
+    if (typeof value !== "string") {
+        throw new Error(`${field} must be a string in YYYY-MM-DD format.`);
+    }
+    const trimmed = value.trim();
+    if (!isValidDateKey(trimmed)) {
+        throw new Error(`${field} must be a valid YYYY-MM-DD calendar date.`);
+    }
+    return trimmed;
+}
+function normalizeHorizonSendDays(value) {
+    if (value === undefined)
+        return null;
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < 1 ||
+        value > 7) {
+        throw new Error("horizonSendDays must be an integer between 1 and 7.");
+    }
+    return value;
+}
+export function normalizeRefillDateSelector(input) {
+    const targetDate = normalizeDateKey(input.targetDate, "targetDate");
+    const untilDate = normalizeDateKey(input.untilDate, "untilDate");
+    const horizonSendDays = normalizeHorizonSendDays(input.horizonSendDays);
+    if (targetDate) {
+        return {
+            source: "target_date",
+            targetDate,
+            untilDate: null,
+            horizonSendDays: null,
+        };
+    }
+    if (untilDate) {
+        return {
+            source: "until_date",
+            targetDate: null,
+            untilDate,
+            horizonSendDays: null,
+        };
+    }
+    if (horizonSendDays !== null) {
+        return {
+            source: "horizon_send_days",
+            targetDate: null,
+            untilDate: null,
+            horizonSendDays,
+        };
+    }
+    return {
+        source: "default_scheduler_forward",
+        targetDate: null,
+        untilDate: null,
+        horizonSendDays: null,
+    };
+}
+export function refillDateSelectorBody(selector) {
+    if (selector.source === "target_date" && selector.targetDate) {
+        return { targetDate: selector.targetDate };
+    }
+    if (selector.source === "until_date" && selector.untilDate) {
+        return { untilDate: selector.untilDate };
+    }
+    if (selector.source === "horizon_send_days" &&
+        selector.horizonSendDays !== null) {
+        return { horizonSendDays: selector.horizonSendDays };
+    }
+    return {};
+}
+export function dateWindowFromSelector(selector) {
+    return {
+        version: 1,
+        ...selector,
+        selectedDates: selector.targetDate ? [selector.targetDate] : [],
+    };
+}
+function selectedDatesFromPlan(plan) {
+    const packet = isRecord(plan.packet) ? plan.packet : {};
+    const target = isRecord(packet.target) ? packet.target : {};
+    const window = isRecord(target.window) ? target.window : {};
+    const senderWindows = arrayValue(window.senderWindows).filter(isRecord);
+    const fromWindows = senderWindows.flatMap((senderWindow) => arrayValue(senderWindow.selectedDates)
+        .map((entry) => stringValue(entry))
+        .filter((entry) => Boolean(entry)));
+    if (fromWindows.length > 0)
+        return Array.from(new Set(fromWindows)).sort();
+    const senderRefillPlans = arrayValue(target.senderRefillPlans).filter(isRecord);
+    return Array.from(new Set(senderRefillPlans.flatMap((senderPlan) => {
+        const horizon = isRecord(senderPlan.horizon) ? senderPlan.horizon : {};
+        return arrayValue(horizon.selectedDays)
+            .filter(isRecord)
+            .map((day) => stringValue(day.date))
+            .filter((entry) => Boolean(entry));
+    }))).sort();
+}
+function senderWindowsFromPlan(plan) {
+    const packet = isRecord(plan.packet) ? plan.packet : {};
+    const target = isRecord(packet.target) ? packet.target : {};
+    const window = isRecord(target.window) ? target.window : {};
+    return arrayValue(window.senderWindows)
+        .filter(isRecord)
+        .map((senderWindow) => ({
+        senderId: stringValue(senderWindow.senderId),
+        timeZone: stringValue(senderWindow.timeZone),
+        selectedDates: arrayValue(senderWindow.selectedDates)
+            .map((entry) => stringValue(entry))
+            .filter((entry) => Boolean(entry)),
+    }));
+}
+export function dateWindowFromPlan(plan, selector) {
+    const packet = isRecord(plan.packet) ? plan.packet : {};
+    const request = isRecord(packet.request) ? packet.request : {};
+    const targetDate = stringValue(request.targetDate) ?? selector.targetDate ?? null;
+    const untilDate = stringValue(request.untilDate) ?? selector.untilDate ?? null;
+    const horizonSendDays = numberValue(request.horizonSendDays) ?? selector.horizonSendDays ?? null;
+    const source = targetDate
+        ? "target_date"
+        : untilDate
+            ? "until_date"
+            : horizonSendDays !== null
+                ? "horizon_send_days"
+                : selector.source;
+    const selectedDates = selectedDatesFromPlan(plan);
+    return {
+        version: 1,
+        source,
+        targetDate: source === "target_date" ? targetDate : null,
+        untilDate: source === "until_date" ? untilDate : null,
+        horizonSendDays: source === "horizon_send_days" ? horizonSendDays : null,
+        selectedDates: selectedDates.length > 0
+            ? selectedDates
+            : targetDate
+                ? [targetDate]
+                : [],
+        senderWindows: senderWindowsFromPlan(plan),
+    };
+}
+export function dateWindowFromRunState(runState) {
+    const state = isRecord(runState) ? runState : {};
+    const raw = isRecord(state.dateWindow) ? state.dateWindow : null;
+    if (!raw || raw.version !== 1)
+        return null;
+    const source = raw.source === "target_date" ||
+        raw.source === "until_date" ||
+        raw.source === "horizon_send_days" ||
+        raw.source === "default_scheduler_forward"
+        ? raw.source
+        : null;
+    if (!source)
+        return null;
+    return {
+        version: 1,
+        source,
+        targetDate: source === "target_date" ? stringValue(raw.targetDate) : null,
+        untilDate: source === "until_date" ? stringValue(raw.untilDate) : null,
+        horizonSendDays: source === "horizon_send_days"
+            ? numberValue(raw.horizonSendDays)
+            : null,
+        selectedDates: arrayValue(raw.selectedDates)
+            .map((entry) => stringValue(entry))
+            .filter((entry) => Boolean(entry)),
+    };
+}
+export function selectorFromDateWindow(window) {
+    return {
+        source: window.source,
+        targetDate: window.targetDate,
+        untilDate: window.untilDate,
+        horizonSendDays: window.horizonSendDays,
+    };
+}
+export function dateSelectorMatchesWindow(selector, window) {
+    return (selector.source === window.source &&
+        selector.targetDate === window.targetDate &&
+        selector.untilDate === window.untilDate &&
+        selector.horizonSendDays === window.horizonSendDays);
+}
+export function schedulerSweepTargetDates(window) {
+    if (window.source === "target_date" && window.targetDate) {
+        return [window.targetDate];
+    }
+    if (window.source === "until_date" ||
+        window.source === "horizon_send_days") {
+        return window.selectedDates;
+    }
+    return [];
+}

package/dist/tools/auth.d.ts

@@ -11,6 +11,11 @@ export type AuthStatus = {
     tokenPresent: boolean;
     tokenPrefix: string | null;
     workspacesCount: number | null;
+    workspaceLock: {
+        enabled: boolean;
+        workspaceId: string | null;
+        required: boolean;
+    };
     checkedAt: string;
     /** Short message the LLM MUST show the user after auth succeeds. */
     _userNotice: string | null;

package/dist/tools/auth.js

@@ -1,6 +1,6 @@
 import * as fs from "fs";
 import { getApi, SellableApiError } from "../api.js";
-import { getConfig, getConfigPath, getResolvedConfigsDir } from "../auth.js";
+import { getConfig, getConfigPath, getEffectiveConfiguredWorkspaceId, getLockedWorkspaceId, getResolvedConfigsDir, isWorkspaceLockRequired, workspaceLockRequiredMessage, } from "../auth.js";
 import { checkForUpdates } from "../update-check.js";
 function maskToken(token) {
     if (token.length <= 10)
@@ -38,6 +38,8 @@ export async function getAuthStatus() {
     const checkedAt = new Date().toISOString();
     const update = await getUpdateStatus();
     let tokenPresent = false;
+    const workspaceLockRequired = isWorkspaceLockRequired();
+    const lockedWorkspaceId = getLockedWorkspaceId();
     const base = {
         ok: false,
         configPath,
@@ -50,27 +52,47 @@ export async function getAuthStatus() {
         tokenPresent: false,
         tokenPrefix: null,
         workspacesCount: null,
+        workspaceLock: {
+            enabled: Boolean(lockedWorkspaceId),
+            workspaceId: lockedWorkspaceId,
+            required: workspaceLockRequired,
+        },
         _userNotice: appendUpdateNotice(null, update),
         update,
         checkedAt,
     };
+    if (workspaceLockRequired && !lockedWorkspaceId) {
+        return {
+            ...base,
+            error: {
+                type: "workspace",
+                message: "Customer profile workspace lock is missing.",
+                guidance: workspaceLockRequiredMessage("get_auth_status"),
+            },
+        };
+    }
     try {
         const config = getConfig();
         tokenPresent = Boolean(config.token);
         base.activeEnvName = config.activeEnvName || null;
         const api = getApi();
         const { workspaces } = await api.get("/api/v3/workspaces");
-        const activeWorkspaceId = config.activeWorkspaceId || config.workspaceId || null;
+        const activeWorkspaceId = getEffectiveConfiguredWorkspaceId(config);
         const activeWorkspace = activeWorkspaceId
             ? workspaces.find((ws) => ws.id === activeWorkspaceId)
             : null;
+        const visibleWorkspacesCount = lockedWorkspaceId
+            ? activeWorkspace
+                ? 1
+                : 0
+            : workspaces.length;
         if (!activeWorkspaceId) {
             return {
                 ...base,
                 apiUrl: config.apiUrl || null,
                 tokenPresent,
                 tokenPrefix: maskToken(config.token),
-                workspacesCount: workspaces.length,
+                workspacesCount: visibleWorkspacesCount,
                 error: {
                     type: "workspace",
                     message: "No active workspace selected.",
@@ -87,22 +109,26 @@ export async function getAuthStatus() {
                 apiUrl: config.apiUrl || null,
                 tokenPresent,
                 tokenPrefix: maskToken(config.token),
-                workspacesCount: workspaces.length,
+                workspacesCount: visibleWorkspacesCount,
                 error: {
                     type: "workspace",
                     message: `Active workspace ${activeWorkspaceId} not found in access list.`,
-                    guidance: available
-                        ? `Available: ${available}. Run set_active_workspace with a valid ID.`
-                        : "Run list_workspaces to view available workspaces, then set_active_workspace.",
+                    guidance: lockedWorkspaceId
+                        ? "This profile is locked to a workspace that the configured Sellable token cannot access. Re-provision the customer profile from sellable-admin with the correct workspace token."
+                        : available
+                            ? `Available: ${available}. Run set_active_workspace with a valid ID.`
+                            : "Run list_workspaces to view available workspaces, then set_active_workspace.",
                 },
             };
         }
         const workspaceName = activeWorkspace.name || config.activeWorkspaceName || null;
         const envLabel = config.activeEnvName || null;
         const wsLabel = workspaceName || activeWorkspaceId;
-        const notice = envLabel
-            ? `You're in ${wsLabel} (${envLabel}).`
-            : `You're in ${wsLabel}.`;
+        const noticePrefix = lockedWorkspaceId
+            ? `You're locked to ${wsLabel}.`
+            : envLabel
+                ? `You're in ${wsLabel} (${envLabel}).`
+                : `You're in ${wsLabel}.`;
         return {
             ok: true,
             configPath,
@@ -114,8 +140,19 @@ export async function getAuthStatus() {
             activeWorkspaceName: workspaceName,
             tokenPresent,
             tokenPrefix: maskToken(config.token),
-            workspacesCount: workspaces.length,
-            _userNotice: appendUpdateNotice(notice, update),
+            workspacesCount: visibleWorkspacesCount,
+            workspaceLock: lockedWorkspaceId
+                ? {
+                    enabled: true,
+                    workspaceId: lockedWorkspaceId,
+                    required: workspaceLockRequired,
+                }
+                : {
+                    enabled: false,
+                    workspaceId: null,
+                    required: workspaceLockRequired,
+                },
+            _userNotice: appendUpdateNotice(noticePrefix, update),
             update,
             checkedAt,
             error: null,

package/dist/tools/campaigns.js

@@ -1,5 +1,5 @@
 import { getApi } from "../api.js";
-import { getConfig } from "../auth.js";
+import { getConfig, getEffectiveConfiguredWorkspaceId } from "../auth.js";
 import { assertCreateCampaignPromptLoaded, assertNetNewCreateCampaignResearchReady, } from "./flow-preflight.js";
 import { setCampaignInteractionMode, } from "./interaction-mode.js";
 import { isLinkedInProfileInput, normalizeLinkedInProfileInput, } from "./linkedin-url.js";
@@ -114,7 +114,7 @@ function normalizeLeadSourceProvider(input) {
         : null;
 }
 export function buildWatchUrl(config, path) {
-    const workspaceId = config.activeWorkspaceId || config.workspaceId;
+    const workspaceId = getEffectiveConfiguredWorkspaceId(config);
     const url = new URL(path, config.apiUrl);
     if (workspaceId && !url.searchParams.has("workspaceId")) {
         url.searchParams.set("workspaceId", workspaceId);

package/dist/tools/csv-dnc.js

@@ -3,7 +3,7 @@ import { createHash, createHmac, randomBytes } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { getApi } from "../api.js";
-import { getConfig } from "../auth.js";
+import { getConfig, getEffectiveConfiguredWorkspaceId } from "../auth.js";
 import { resolveWorkspaceRoot } from "../utils/workspace-root.js";
 import { sanitizeCsvDomainCandidate } from "./csv-domains.js";
 import { validateAndNormalizeLinkedInUrl } from "./csv-linkedin.js";
@@ -324,7 +324,7 @@ function dedupeCandidates(candidates) {
 }
 async function getVerifiedActiveWorkspace() {
     const config = getConfig();
-    const activeWorkspaceId = config.activeWorkspaceId || config.workspaceId;
+    const activeWorkspaceId = getEffectiveConfiguredWorkspaceId(config);
     if (!activeWorkspaceId) {
         throw new Error("No active workspace selected. Run list_workspaces then set_active_workspace for the exact workspace whose Sellable DNC list should be read or updated.");
     }

package/dist/tools/model-quality.js

@@ -21,28 +21,30 @@ const DEFAULT_MODEL_QUALITY_CONFIG = {
             minimumModel: "GPT 5.5",
             familyKeywords: ["gpt"],
             minimumVersion: "5.5",
-            minimumReasoningEffort: "xhigh",
+            minimumReasoningEffort: "high",
             acceptedReasoningEfforts: [
+                "high",
                 "extra high",
                 "extra-high",
                 "xhigh",
                 "extra_high",
             ],
-            recommendedReasoningEffort: "xhigh",
+            recommendedReasoningEffort: "high or better",
         },
         hermes: {
             label: "Hermes",
             minimumModel: "GPT 5.5",
             familyKeywords: ["gpt"],
             minimumVersion: "5.5",
-            minimumReasoningEffort: "xhigh",
+            minimumReasoningEffort: "high",
             acceptedReasoningEfforts: [
+                "high",
                 "extra high",
                 "extra-high",
                 "xhigh",
                 "extra_high",
             ],
-            recommendedReasoningEffort: "xhigh",
+            recommendedReasoningEffort: "high or better",
         },
     },
     warningCopy: {

package/dist/tools/prompts.js

@@ -261,8 +261,8 @@ export function getSourceScoutRegistry() {
             codex: {
                 filename: String(agent.codex?.filename || `${agent.name}.toml`),
                 description: String(agent.codex?.description || ""),
-                model: String(agent.codex?.model || "gpt-5.5"),
-                modelReasoningEffort: String(agent.codex?.modelReasoningEffort || "xhigh"),
+                model: String(agent.codex?.model || "gpt-5.6-sol"),
+                modelReasoningEffort: String(agent.codex?.modelReasoningEffort || "high"),
             },
             claude: {
                 filename: String(agent.claude?.filename || `${agent.name}.md`),
@@ -308,8 +308,8 @@ export function getPostFindLeadsScoutRegistry() {
             codex: {
                 filename: String(agent.codex?.filename || `${agent.name}.toml`),
                 description: String(agent.codex?.description || ""),
-                model: String(agent.codex?.model || "gpt-5.5"),
-                modelReasoningEffort: String(agent.codex?.modelReasoningEffort || "xhigh"),
+                model: String(agent.codex?.model || "gpt-5.6-sol"),
+                modelReasoningEffort: String(agent.codex?.modelReasoningEffort || "high"),
             },
             claude: {
                 filename: String(agent.claude?.filename || `${agent.name}.md`),
@@ -376,9 +376,9 @@ export function getPostFindLeadsScoutRegistry() {
             reusePolicy: "The first completed Message Drafting recommendation remains the default review candidate. Later Lead Fit Builder, Filter Leads, enrichment, or rubric completion may make an enriched rewrite available, but does not automatically retry or replace the initial draft unless campaign/brief/source/list/table/execution-slice identity mismatches or the initial output failed. If filters were chosen but leadScoringRubrics are not yet visible when the branch reads campaign state, Message Drafting must not wait, retry, or return blocked; missing saved rubrics are parent-owned filter setup, and the branch should return status ready with basisStatus usable_initial when campaign/list/table identity and the non-empty execution slice match. User copy feedback before approve-message is an explicit Message Drafting revision and must be routed back through the message branch with the current recommendation and basis.",
         },
         usage: {
-            codex: 'After confirm_lead_list copies source rows and the initial campaign-table execution slice exists, ask the filter-choice question immediately. Do not spawn anything before that question. After the answer, launch only Message Drafting. The filter-choice answer is the post-import user gate for this single worker; do not ask another question about starting it in step-wise or YOLO mode. The registry lookup is not a launch: after get_post_find_leads_scout_registry, immediately invoke Task/spawn_agent or the host background-agent mechanism before loading filter-leads.md, before saving rubrics, and before treating skip-filters as ready for message review. Both choices route through this kickoff; do not let filters_skipped jump straight from filter-choice to message-generation. If filters are chosen, the parent stays on Filter Rules and drafts/saves rubrics with MCP tools while Message Drafting runs in the background. If filters are skipped, move to Messages/message review only after Message Drafting has started or is ready; update_campaign(currentStep=messages) is not proof of launch. If the named Message Drafting custom agent is unavailable, spawn a generic gpt-5.5 xhigh Message Drafting background agent with the same lean campaign/table basis. When the background worker starts, persist workerDetails.messageDraftBuilder with statusSource "branch", status "branch-running", runId, startedAt, updatedAt, basisToken when known, and basis containing campaignId, selectedLeadListId, workflowTableId, filterChoice, and reviewBatchRowHash or reviewBatchRowIds; workerStatuses.messageDraftBuilder may be "running" as a simple badge only. Never put rich proof under workerStatuses and never use workerStatuses.messageDrafting. If no background-agent tool is callable, start the same full message branch inline before filter drafting or before skip-filter message review, record workerDetails.messageDraftBuilder with statusSource "parent-thread-fallback" and status "fallback-active", and require the same live context, prompt, assets, and validation gate before message review; do not wait until filters are saved and then call the registry.',
+            codex: 'After confirm_lead_list copies source rows and the initial campaign-table execution slice exists, ask the filter-choice question immediately. Do not spawn anything before that question. After the answer, launch only Message Drafting. The filter-choice answer is the post-import user gate for this single worker; do not ask another question about starting it in step-wise or YOLO mode. The registry lookup is not a launch: after get_post_find_leads_scout_registry, immediately invoke Task/spawn_agent or the host background-agent mechanism before loading filter-leads.md, before saving rubrics, and before treating skip-filters as ready for message review. Both choices route through this kickoff; do not let filters_skipped jump straight from filter-choice to message-generation. If filters are chosen, the parent stays on Filter Rules and drafts/saves rubrics with MCP tools while Message Drafting runs in the background. If filters are skipped, move to Messages/message review only after Message Drafting has started or is ready; update_campaign(currentStep=messages) is not proof of launch. If the named Message Drafting custom agent is unavailable, spawn a generic gpt-5.6-sol high Message Drafting background agent with the same lean campaign/table basis. When the background worker starts, persist workerDetails.messageDraftBuilder with statusSource "branch", status "branch-running", runId, startedAt, updatedAt, basisToken when known, and basis containing campaignId, selectedLeadListId, workflowTableId, filterChoice, and reviewBatchRowHash or reviewBatchRowIds; workerStatuses.messageDraftBuilder may be "running" as a simple badge only. Never put rich proof under workerStatuses and never use workerStatuses.messageDrafting. If no background-agent tool is callable, start the same full message branch inline before filter drafting or before skip-filter message review, record workerDetails.messageDraftBuilder with statusSource "parent-thread-fallback" and status "fallback-active", and require the same live context, prompt, assets, and validation gate before message review; do not wait until filters are saved and then call the registry.',
             claude: "After confirm_lead_list copies source rows and the initial campaign-table execution slice exists, ask the filter-choice question immediately. Do not invoke any Task/Agent before that question. After the answer, invoke only Message Drafting. If filters are chosen, parent drafts/saves rubrics with MCP tools while Message Drafting runs, asks filter approval, then joins Message Drafting. If filters are skipped, invoke only Message Drafting and move to Messages/message review.",
-            parentThreadRule: 'Named agents are optional acceleration, but message drafting is not optional. The only normal background worker is Message Drafting. The filter-choice answer is the campaign-scoped go-ahead for this single post-import worker; do not ask another question to start it in step-wise or YOLO mode. If a named agent is unavailable, use a generic gpt-5.5 xhigh Message Drafting background agent. source work and filter work stay in the parent thread with MCP tools. If post-find-leads-message-scout is available, run it as the background Message Draft Builder after the filter-choice answer. The registry lookup is not a launch: get_post_find_leads_scout_registry only identifies the worker, and Message Drafting counts as started only after Task/spawn_agent or the host background-agent tool is invoked, or after the parent begins the same full message branch inline because no background-agent tool is callable. This launch must happen before loading filter-leads.md, save_rubrics, filter approval, or skip-filter message review; currentStep=messages is not proof of launch. If post-find-leads-message-scout is absent, do not customer-surface install status. Do not silently treat message drafting as started; the main thread must either launch the background worker or execute the same message branch from CampaignOffer state, selected source state, workflowTableId, and initial campaign-table execution slice rows. For a spawned worker, record workerDetails.messageDraftBuilder with statusSource branch / status branch-running, runId, startedAt, updatedAt, and basis containing campaignId, selectedLeadListId, workflowTableId, filterChoice, and reviewBatchRowHash or reviewBatchRowIds. workerStatuses.messageDraftBuilder is optional simple badge text only ("running", "ready", "blocked", "idle"); never put runId/statusSource/basis under workerStatuses and never use workerStatuses.messageDrafting. If no background-agent tool is callable, start that same full message branch inline before filter drafting or before skip-filter message review, record workerDetails.messageDraftBuilder with statusSource parent-thread-fallback / status fallback-active then ready, and require the same live context, prompt, assets, and validation gate before message review; do not report that as a background worker failure. If neither branch nor inline fallback can run, return blocked/retry-needed; do not wait until filters are saved and then call the registry. The Message Drafting handoff must be lean. Do not paste copied row counts, brief hashes, review-batch hashes, full reviewBatchRowIds, broad row data, or local debug artifacts into the spawn prompt. Local markdown/json files are not normal-path inputs. The filter-choice question is the first post-import user gate; do not load post-lead registries or filter references before it. Message drafting starts after the filter-choice answer, must load get_subskill_prompt({ subskillName: "generate-messages" }), and must load every required message asset named by generate-messages Mode 0 through get_subskill_asset before drafting. Reference Asset Loading means loading the required pre-draft reference pack before drafting; return blocked/retry-needed if required assets cannot be loaded; load ai-tells.md because it is never optional. The branch or parent-thread fallback loads the full generate-messages prompt and every referenced asset through get_subskill_asset. After generating/revising the candidate and before returning ready, must load get_subskill_prompt({ subskillName: "create-campaign-v2-validation" }) as the final internal validation gate, must read live campaign table state through scoped MCP/product tools, and must reject mismatched selectedLeadListId/workflowTableId/campaign/workspace input. Do not block when filters were chosen but leadScoringRubrics are not yet visible in the branch read; the parent owns save_rubrics and filter approval in parallel, so Message Drafting should return status ready with basisStatus usable_initial when campaign/list/table identity and the non-empty execution slice match. Do not use any alternate, local-artifact, or examples-only message prompt. User copy feedback, message QA, or rewrite requests before approve-message must be routed back to Message Drafting with the current recommendation, lean campaign/table basis, and latest user text; the parent must not rewrite or QA the template from memory and must not call update_campaign_brief before approve-message. The worker validates internally and returns only templateRecommendation, tokenFillRules, renderedGoodSample, status, approveOrReviseRecommendation, validationStatus, outputAt, outputHash, and blocked/retry detail. Do not render renderedFallbackSample, risk notes, or a qaReceipt on the normal happy path. On the filter path, save_rubrics keeps the browser on Filter Rules after save_rubrics so the user can approve the saved criteria; after saved-filter approval, move to Filter Leads with currentStep=apply-icp-rubric whether Message Drafting is ready or still running. Wait there for message approval. Enrichment, filtering, Generate Message cells, sender setup, sequence attach, and launch wait for template approval on the Use Template path. On the skip path, move to Messages/message review after Message Drafting has started or is ready and wait for message approval before enrichment or Settings. Do not render message review from checklist or shortcut instructions; message review requires a messageDraftRecommendation whose basis proves the generate-messages prompt, required message assets, and validation gate ran for the current campaign/table execution slice. Do not automatically rerun Message Drafting after filters/enrichment finish; show the initial draft by default and offer an enriched rewrite only with explicit user opt-in. Handoff and recommendation output are Markdown with labeled fields, not raw JSON.',
+            parentThreadRule: 'Named agents are optional acceleration, but message drafting is not optional. The only normal background worker is Message Drafting. The filter-choice answer is the campaign-scoped go-ahead for this single post-import worker; do not ask another question to start it in step-wise or YOLO mode. If a named agent is unavailable, use a generic gpt-5.6-sol high Message Drafting background agent. source work and filter work stay in the parent thread with MCP tools. If post-find-leads-message-scout is available, run it as the background Message Draft Builder after the filter-choice answer. The registry lookup is not a launch: get_post_find_leads_scout_registry only identifies the worker, and Message Drafting counts as started only after Task/spawn_agent or the host background-agent tool is invoked, or after the parent begins the same full message branch inline because no background-agent tool is callable. This launch must happen before loading filter-leads.md, save_rubrics, filter approval, or skip-filter message review; currentStep=messages is not proof of launch. If post-find-leads-message-scout is absent, do not customer-surface install status. Do not silently treat message drafting as started; the main thread must either launch the background worker or execute the same message branch from CampaignOffer state, selected source state, workflowTableId, and initial campaign-table execution slice rows. For a spawned worker, record workerDetails.messageDraftBuilder with statusSource branch / status branch-running, runId, startedAt, updatedAt, and basis containing campaignId, selectedLeadListId, workflowTableId, filterChoice, and reviewBatchRowHash or reviewBatchRowIds. workerStatuses.messageDraftBuilder is optional simple badge text only ("running", "ready", "blocked", "idle"); never put runId/statusSource/basis under workerStatuses and never use workerStatuses.messageDrafting. If no background-agent tool is callable, start that same full message branch inline before filter drafting or before skip-filter message review, record workerDetails.messageDraftBuilder with statusSource parent-thread-fallback / status fallback-active then ready, and require the same live context, prompt, assets, and validation gate before message review; do not report that as a background worker failure. If neither branch nor inline fallback can run, return blocked/retry-needed; do not wait until filters are saved and then call the registry. The Message Drafting handoff must be lean. Do not paste copied row counts, brief hashes, review-batch hashes, full reviewBatchRowIds, broad row data, or local debug artifacts into the spawn prompt. Local markdown/json files are not normal-path inputs. The filter-choice question is the first post-import user gate; do not load post-lead registries or filter references before it. Message drafting starts after the filter-choice answer, must load get_subskill_prompt({ subskillName: "generate-messages" }), and must load every required message asset named by generate-messages Mode 0 through get_subskill_asset before drafting. Reference Asset Loading means loading the required pre-draft reference pack before drafting; return blocked/retry-needed if required assets cannot be loaded; load ai-tells.md because it is never optional. The branch or parent-thread fallback loads the full generate-messages prompt and every referenced asset through get_subskill_asset. After generating/revising the candidate and before returning ready, must load get_subskill_prompt({ subskillName: "create-campaign-v2-validation" }) as the final internal validation gate, must read live campaign table state through scoped MCP/product tools, and must reject mismatched selectedLeadListId/workflowTableId/campaign/workspace input. Do not block when filters were chosen but leadScoringRubrics are not yet visible in the branch read; the parent owns save_rubrics and filter approval in parallel, so Message Drafting should return status ready with basisStatus usable_initial when campaign/list/table identity and the non-empty execution slice match. Do not use any alternate, local-artifact, or examples-only message prompt. User copy feedback, message QA, or rewrite requests before approve-message must be routed back to Message Drafting with the current recommendation, lean campaign/table basis, and latest user text; the parent must not rewrite or QA the template from memory and must not call update_campaign_brief before approve-message. The worker validates internally and returns only templateRecommendation, tokenFillRules, renderedGoodSample, status, approveOrReviseRecommendation, validationStatus, outputAt, outputHash, and blocked/retry detail. Do not render renderedFallbackSample, risk notes, or a qaReceipt on the normal happy path. On the filter path, save_rubrics keeps the browser on Filter Rules after save_rubrics so the user can approve the saved criteria; after saved-filter approval, move to Filter Leads with currentStep=apply-icp-rubric whether Message Drafting is ready or still running. Wait there for message approval. Enrichment, filtering, Generate Message cells, sender setup, sequence attach, and launch wait for template approval on the Use Template path. On the skip path, move to Messages/message review after Message Drafting has started or is ready and wait for message approval before enrichment or Settings. Do not render message review from checklist or shortcut instructions; message review requires a messageDraftRecommendation whose basis proves the generate-messages prompt, required message assets, and validation gate ran for the current campaign/table execution slice. Do not automatically rerun Message Drafting after filters/enrichment finish; show the initial draft by default and offer an enriched rewrite only with explicit user opt-in. Handoff and recommendation output are Markdown with labeled fields, not raw JSON.',
             schedulerRunReceiptRule: "For refill prompt handoffs, scheduler-run receipt interpretation is mandatory: cellsConsidered is allocation-attempt count, not total ready supply, while readyCellsFound is ready inventory found before prefilters. Inspect campaignScopeSummary before assuming the selected refill campaign/table was included. Interpret prefiltered, skipped, and deferred separately. For ready closed-InMail cells with stale paid-credit prefilter/defer reasons, route to refresh_paid_inmail_credits_then_rerun once, then rerun/status. wait_for_capacity_or_window means report loaded/capped/waiting and do not source or prep more rows. no_ready_cells_continue_refill_prep means return to the refill/prep ladder. Do not treat cellsScheduled:0 alone as failure.",
             prepareMessagesRule: `Default create-campaign stays on the existing reviewBatchLimit:15 first campaign-table execution slice. For plain post-mint fill/load/refill requests, load get_subskill_prompt({ subskillName: "refill-sends-workflow" }) and get_subskill_asset({ subskillName: "refill-sends-workflow", assetPath: "core/flow.v1.json" }) to hasMore:false before operational steps, then call resolve_campaign_fill_route({ intent:"plain" }), list_senders, and get_campaign_refill_state for enough candidate campaigns to identify the campaign that most recently had scheduler-owned sends for the relevant sender set before any mutation. Route outcomes are route:"evergreen_horizon", route:"active_campaigns", and route:"ask_create"; if a plain managed-waterfall route has archived/completed skipped slots or does not cover the named sender set, immediately refetch with resolve_campaign_fill_route({ intent:"active" }) and inspect current dashboard-active ACTIVE/PAUSED campaign-backed sequence campaigns before declaring a sender blocked; stay in the same campaignOfferId/campaignId context after minting. Plain fill is not an alias for fill_campaign_horizon or campaign creation. fill_campaign_horizon is evergreen-only and is not the generic regular-campaign fill path. Campaign creation is allowed only after route:"ask_create" and explicit user selection; it is never the default response to plain fill. Treat "fill up/load sends" as capacity-fill preparation, and treat "refill senders", "fill senders", "max out senders", and "load everyone up" as sender-scoped capacity-fill preparation. For sender-scoped requests with no named senders, --yolo means all eligible healthy senders enrolled in active campaign-backed sequence campaigns in the active workspace; without --yolo, ask which eligible enrolled senders to refill before choosing campaigns or mutating. In non-yolo interactive Codex or Claude Code sessions, post the full sender/campaign/action approval packet in normal chat as Markdown first, then ask request_user_input/AskUserQuestion with exactly Accept and Decline and a compact body that refers back to the posted packet; do not duplicate the campaign table or full operator packet inside the structured question. The chat packet must show workspace, sender scope, a campaign-by-campaign table, exact ids/caps/dates, side effects, forbidden actions, and stop condition before mutation. Default --yolo target is the scheduler-forward 48-hour target window: sender-local send days whose configured sending windows overlap the rolling target window, skipping no-send-hour days. For campaign-scoped fill/refill, select the best recent-send campaign and calculate the bounded gap from healthy sender daily capacity minus projected coverage (actual sent plus future scheduler-owned scheduled sends) and ready-to-schedule rows, then prepare only that gap. For sender-scoped fill/refill, calculate the bounded gap per eligible sender across active enrolled campaigns, counting actual sent coverage, future scheduled rows, and ready-to-schedule rows across those campaigns, then choose the best same-sender campaign to fill each sender gap: prefer recent/future scheduler-owned sends for that sender, then strongest recent result evidence, then source health. Maintain a target-window saturation ledger per selected sender with selected send days, gross capacity, actual sent counts, future scheduler-owned scheduled counts, projected coverage, ready-to-schedule buffer, remaining projected gap, paid-InMail threshold feasibility, and the next MCP primitive. The structured packet lives in target.senderRefillPlans[] with target.eligibleSenderLedger, campaignRanking.options, sourcePlan, nextActions, manualAlternates, and target.globalActionQueue; preserve Need to prepare, Goal, Already sent, Scheduled, Ready and waiting to be scheduled, and Still need labels. In --yolo, execute exactly one globally ranked primitive from the post-refresh target.globalActionQueue[0], then rerun get_refill_target_plan before choosing another action. Refill action ladder: approve generated rows only when an explicit bounded approval gate exists, process all existing same-campaign unenriched/unprepared rows in bounded batches before any source work, then copy bounded net-new rows from the selected source (selectedLeadListId, provider, and source fingerprint preserved), then use provider-aligned source-more. A new source or provider switch changes the reply-rate baseline and is a manual alternate, not a --yolo side effect. The refill_sends MCP command maintains a run-local refreshedPaidInmailSenderIds set: if the first target plan contains refresh_paid_inmail_credits for stale/missing paid-InMail facts, refill_sends refreshes each selected paid-InMail sender at most once, reruns get_refill_target_plan, and returns autoPaidInmailRefresh plus the post-refresh targetPlan before the operator chooses prep/source-copy/bounded-approval/read-only wait. Freshness gate precedes scheduler wait: if any selected target.senderRefillPlans[].paidInmail.status is missing_credit_facts or stale_credit_facts, or the target plan contains refresh_paid_inmail_credits, do not enter wait_for_scheduler even when remainingReadyOrProjectedGap is 0; refresh exact sender credit facts once, reread get_refill_target_plan, then choose scheduler wait only if freshness is clean. Do not present paid-credit refresh as the next operator action after refill_sends has returned a post-refresh targetPlan. Do not stop after filling only one sender when the request was sender-scoped. In --yolo, continue through every safe selected sender/campaign action covered by the rendered packet, reread after each terminal apply/prep/source-copy/bounded-approval/read-only wait result, recompute the target-window saturation ledger, and keep going until projected coverage (sent + scheduled) fills the scheduler-forward target window or a concrete non-scheduler blocker is proven. Ready-to-schedule rows are buffer, not completion; if ready covers the projected gap but scheduled cells do not, report loaded, awaiting scheduler and run a persistent read-only scheduler wait/reread loop and keep the run open while awaiting_scheduler_after_ready_buffer is the only remaining state. Paid-InMail threshold changes and connection-campaign creation are explicit continuation options, never --yolo side effects. When no safe in-packet action remains return concrete continuation options with campaign names, exact ids, and which options require a new approval packet; do not return final completion for scheduler wait unless Christian explicitly asks for status or stops the run. Use the refill workflow to decide whether to enrich/prep more rows in that same recent-send/best-result campaign, add/import more rows to that same campaign/source path, use a different existing campaign only when the selected same-sender lane is blocked/exhausted/already loaded while the sender still has a gap, or ask what to create. Do not create warm-post-engager side campaigns. Surface sender-health blockers and paid-InMail threshold blockers separately from prepared/approved/scheduled counts. User-facing refill decisions must be campaign-name-first and sender-name-first, with ids as proof/execution targets only. Trust schedulerGate.sendable and scheduler blockers over raw unipileAccountStatus labels alone. For long-running prep use compact prep status checks, reread target plans after prep or cancel, avoid huge parallel target-plan reads when output is large, and if prepared/ready rows grow but sender-level projected coverage does not move after one bounded settle loop, pivot to compact prep status or a scheduler-proven lane instead of waiting on campaign-level ready counts. For already-running regular campaigns that need Signal Discovery source replenishment, use the guarded currentStep clear with clearCurrentStepIfMatches:"running", campaign-scoped provider prompt/search/select, and import_leads with the existing sourceLeadListId when a newly approved selected-post scrape would otherwise return reusedExistingSourceList. Before prep, inspect get_campaign_refill_state.preparationFrontier. If hasLaterPreparedIsland:true or earliestUnpreparedRow exists before later successful enrichment, use rowSelector:{type:"needsEnrichment"} with columnRole:"enrich" in table-position order or start_campaign_message_preparation adaptive defaults; do not use the UI Jump anchor or needsGeneratedMessage as the refill cursor. After confirm_lead_list copies rows into an existing table, avoid fixed maxRowsToCheck:100; if confirm_lead_list returns USER_ADDED_ROWS_LIMIT_EXCEEDED, create a bounded same-source split from selectedLeadListId with get_rows_minimal/load_csv_linkedin_leads, confirm that smaller source list into the same campaign, and inspect reviewBatch only as diagnostics unless the approved packet explicitly prioritizes the just-copied split and earlier needsEnrichment rows are exhausted, dependency-blocked, or excluded. For approval diagnostics use rowSelector:{type:"needsApproval"} after current generated messages exist; mutating Approved cells still requires approvalMode:approve and exact bounded approval. Do not interpret checkedRows as enriched rows; it is only the table cursor. Prepared, approved, and ready_to_schedule rows are intermediate states; never call them scheduled unless a re-read proves scheduler-owned scheduled cells with non-null scheduledFor contribute to projected coverage, and never call them complete unless a final re-read proves projected coverage fills the scheduler-forward target window. Before source import, prep, approval, or selected paused campaign start, require exact visible approval or --yolo packet auto-accept and a fresh get_campaign_refill_state reread; stop if freshness.stateHash or exact ids changed. For "approve X messages", use approvalMode:approve only when explicitly requested. For "schedule X sends" or "fill sender sends", approve only when explicitly requested, then re-read campaign/table scheduled counts; if projected coverage does not fill the horizon, keep polling when ready buffer covers the gap and report only interim prepared/approved/ready - awaiting scheduler status if Christian asks. Do not call start_campaign as part of fill/schedule horizon. start_campaign is allowed in refill only for exact selected PAUSED, dashboard-active, campaign-backed sequence targets named in the bounded packet, and the packet must state that starting can let the product scheduler schedule/send approved eligible sequence actions. Never start unrelated, archived, completed, draft, direct, or non-selected campaigns, never broad approve-all, and never use direct scheduler writes. campaignId is CampaignOffer.id. If the user asks to stop preparation, the target is wrong, or status shows the wrong campaign/table, use cancel_campaign_message_preparation only for the exact active job. Low-level selectors are diagnostics and recovery only for this lane.`,
         },

package/dist/tools/refill-sends-evergreen.d.ts

@@ -0,0 +1,28 @@
+type RefillSendsEvergreenInput = {
+    workspaceId?: string;
+};
+export declare const refillSendsEvergreenToolDefinitions: {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: {
+            workspaceId: {
+                type: string;
+                description: string;
+            };
+        };
+        required: string[];
+        additionalProperties: boolean;
+    };
+}[];
+export declare function refillSendsEvergreenCommand(input: RefillSendsEvergreenInput): {
+    readOnly: boolean;
+    workspaceId: string | null;
+    firstOperationalSteps: string[];
+    approvalContract: string;
+    forbiddenActions: string[];
+    fillWindow: string;
+    hostExamples: string[];
+};
+export {};

package/dist/tools/refill-sends-evergreen.js

@@ -0,0 +1,47 @@
+export const refillSendsEvergreenToolDefinitions = [
+    {
+        name: "refill_sends_evergreen",
+        description: "Read-only Phase 85 evergreen refill command contract. It performs no mutations and only tells the operator to call get_evergreen_refill_plan for a dry-run packet and journal.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                workspaceId: {
+                    type: "string",
+                    description: "Explicit request-scoped workspace id.",
+                },
+            },
+            required: ["workspaceId"],
+            additionalProperties: false,
+        },
+    },
+];
+export function refillSendsEvergreenCommand(input) {
+    return {
+        readOnly: true,
+        workspaceId: input.workspaceId ?? null,
+        firstOperationalSteps: [
+            "Call get_evergreen_refill_plan with the explicit workspaceId.",
+            "Read the returned packet, globalActionQueue, per-sender plans, and itinerary before taking any action.",
+            "Review the dry-run journal file path returned by get_evergreen_refill_plan.",
+            "Phase 85 is PLAN-ONLY; execution arrives in Phase 86.",
+        ],
+        approvalContract: "Nothing is approved or executable in Phase 85. The evergreen command is read-only; Phase 86 introduces execution approval.",
+        forbiddenActions: [
+            "Do not schedule sends.",
+            "Do not send messages.",
+            "Do not approve messages.",
+            "Do not prepare messages.",
+            "Do not start or launch campaigns.",
+            "Do not create campaigns.",
+            "Do not switch providers or source families.",
+            "Do not lower paid InMail thresholds.",
+            "Do not refresh paid InMail credits.",
+            "Do not write scheduler fields.",
+        ],
+        fillWindow: "Use only the target window and caps returned by get_evergreen_refill_plan.",
+        hostExamples: [
+            "refill_sends_evergreen({ workspaceId })",
+            "get_evergreen_refill_plan({ workspaceId })",
+        ],
+    };
+}

package/dist/tools/setup-evergreen-campaigns.js

@@ -6,7 +6,7 @@ async function postSetupEvergreenCampaigns(body, workspaceId) {
 export const setupEvergreenCampaignsToolDefinitions = [
     {
         name: "setup_evergreen_campaigns",
-        description: "Evergreen campaign setup plan/verify command. Use plan mode first to inspect exact workspace/sender/campaign/table/source state and receive immutable lane packets. `selectedSenderIds` is a legacy shorthand for both scopes; prefer `postEngagerSenderIds` for the Post Engagers sender scope and `sharedSenderIds` for the shared lane sender scope when they differ. `sharedSenderIds` must include every intended shared-lane sender, not only the named Post Engagers sender; when adding other senders to existing shared evergreen campaigns, resolve those sender ids with list_senders and pass the full shared set. If a protected existing Post Engagers campaign must stay unchanged and the operator requested only shared lane execution, pass postEngagerSenderIds:[] and sharedSenderIds; do not include the protected active Post Engagers lane as a reuse packet because it can make the yolo plan non-autoExecutable. The command plans one Post Engagers lane per post-engager sender plus shared Signal Discovery and Shared Cold Fallback lanes for the shared sender set. Non-archived PAUSED/ACTIVE/DRAFT shared campaigns/tables are the reusable targets; archived campaigns, archived tables, and archived waterfall bindings are stale inventory and must not be counted as valid evergreen slots. If an existing non-archived shared campaign is already attached to additional senders, plan reporting should count those attached senders as existing shared-lane membership rather than treating them as missing or duplicate slots. yolo is only a parent-skill auto-execution hint for safe lane packets; pass yolo only in plan mode and never include yolo on mode:\"verify\" calls. This backend command remains read-only in plan mode and verifies receipts in verify mode. Package-backed prompt authority: the installed public wrapper can be the local Codex skill entrypoint, but lane workers must use get_subskill_prompt and get_subskill_asset for nested `$sellable:create-campaign`, create-campaign-v2, generate-messages, validation, and assets; nested filesystem prompt fallback is a failed UAT. Use mcp__sellable only for workspace selection and product mutations/readbacks. Do not use mcp__sellable_admin, direct DB, Prisma, SQL, built-in web search, browser search, web.run, or any external browsing/search tool as execution or research proof; if Sellable MCP research tools are insufficient, write a blocked receipt instead of browsing externally. Worker-local replans are read-only drift checks and must preserve the exact parent sender scopes, including postEngagerSenderIds:[] when intentionally empty and the exact sharedSenderIds array; if scope, planRevision, actionId, or laneKey drifts, stop with blocked:worker_plan_scope_drift before mutation. Each lane packet includes workerDispatch with preferredRuntime, runtimeFallbackOrder, acceptedRuntimes, rejectedRuntimes, requiresVisibleThreadOrDurableReceipt, receiptArtifactHint, receiptRunId, and receiptMustBeWrittenAfter; pre-existing receipts at old deterministic paths are stale and must not be used, so stop with blocked:stale_receipt_artifact if the receipt was not freshly written for the current receiptRunId. `multi_agent_v1.spawn_agent`/opaque spawn_agent is not accepted for mutating command proof unless the parent has visible thread or durable receipt proof. In local Codex, default to `workerDispatch.preferredRuntime` (`visible-codex-app-thread`): discover Codex app thread tools if needed, then call `codex_app.list_projects` and `codex_app.create_thread` with a local project target; do not create a worktree for lane execution. If Codex app thread tools are unavailable but local Codex CLI is available, use durable streaming workers with `codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -` and include preferredRuntimeAttempt plus fallbackReason in createCampaignWorkflowReceipt; approval, sandbox, and reasoning-effort config flags must appear before `exec`, and current customer CLI installs reject `codex exec --ask-for-approval never` and `codex exec -a never`. Do not rely on default model or default reasoning effort: copy the parent model such as `gpt-5.5` into `-m` and always pass `-c model_reasoning_effort=xhigh`; a child worker that reports GPT 5.5 with high reasoning is a launcher bug to relaunch before mutation, not a user-continue path. Plan responses include approvalSummary; render approvalSummary when asking for bounded delegated approval because it explicitly lists campaignsToCreate, campaignsToUpdate, campaignsToVerifyOnly, campaignsLeftUntouched, attachedSenders, selectedActionIds, allowedSideEffects, forbiddenSideEffects, blockers, and approvalQuestion. When safe-yolo needs normal setup work, the parent skill may ask for bounded delegated approval: one approval over the current planRevision, selected action ids, caps, allowed side-effect classes, and stop conditions lets lane workers execute without per-substep approval while staying inside that packet. In exec/automation mode, do not call request_user_input; if yolo plan autoExecutable:false and no interactive approval can be received, stop with blocked:bounded_approval_unavailable_in_exec_mode before any mutation. Lane workers must explicitly load and use the installed `$sellable:create-campaign` wrapper as the nested workflow entrypoint, then load `create-campaign-v2` and `create-campaign-v2/core/flow.v2.json`; they must execute creation, source import, create-campaign workflow steps, generate-messages, sequence attachment, pause_campaign review-state transition when the current table is still DRAFT, and review readiness through that existing create-campaign workflow/subskills, then return receipts here for verification. Customer-visible verify receipts must set status:'succeeded' or status:'completed'; status:'passed', status:'pass', and status:'passed_with_warnings' are rejected as primary success statuses. Exception: a Post Engagers lane may write status:'blocked' with blocker:'post_engagers_no_sender_posts', 'post_engagers_no_recent_sender_posts', 'post_engagers_no_sender_owned_posts', or 'post_engagers_source_author_mismatch' when Sellable MCP readback proves no usable sender-authored posts/source exists; verify returns these as acceptedLaneBlockers so the parent can report the no-op instead of retrying invalid source repair. Any other blocked receipt, including model-quality/preflight or worker model availability blockers, is not a goal-complete success condition and must not let the parent report evergreen completion. Receipts must include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt; top-level-only copies of those objects are not enough and are not promoted by verify. setupPlanCall must use canonical keys: planRevision, actionId, laneKey, workspaceId, senderIds, campaignId, tableId, createIntent. Do not use laneActionId, lanePacketActionId, delegatedPlanRevision, delegatedActionId, or requestedCall text as a substitute for those canonical fields. createCampaignWorkflowReceipt must include skillCommand:'$sellable:create-campaign', skillName:'create-campaign', wrapperSkillLoaded:true, workflowPromptName:'create-campaign-v2', workflowPromptLoadedToHasMoreFalse:true, workflowAssetPath:'create-campaign-v2/core/flow.v2.json', workflowAssetLoaded:true, workerRuntime, workerThreadId or receiptArtifactPath, durableReceiptWritten when using a receipt file, and notAdHoc:true; CLI durable fallback runtimes must also include preferredRuntimeAttempt for visible-codex-app-thread and fallbackReason. messageDraftingReceipt must use exactly statusSource:'branch' or statusSource:'packaged-generate-messages-worker'; descriptive aliases such as statusSource:'package-readback-local-thread' are rejected. It must include proof that generate-messages was loaded, start_campaign_message_preparation/get_campaign_message_preparation_status ran when the packaged worker path is used, validationResult:'passed', a passed qualityReview, and at least 3 concrete sampleMessages with rowId, generatedMessageText, verdict, and issues; Do not substitute `message` for `generatedMessageText`; Do not substitute `passVerdict` for `verdict`. Before writing durable receipts, run a receipt self-check: top-level `planRevision`, `actionId`, `laneKey`, `laneType`, `workspaceId`, and `senderIds` must exist; if the self-check fails, fix the receipt before ending. Use start_campaign_message_preparation with approvalMode:\"mark_ready\" only for evergreen setup. Never call `start_campaign_message_preparation` with `approvalMode:\"approve\"`; approve exactly one semantic Approved cell through select_campaign_cells/update_cell and final proof must show approvedGeneratedMessageCount exactly 1. Shared Cold Fallback samples with a standalone name followed by 'Hey there' are rejected. This command does not launch campaigns, does not schedule sends, does not assign scheduler-owned send fields, does not raw-write campaign status, does not archive/delete cleanup targets, and does not spend paid credits.",
+        description: "Evergreen campaign setup plan/verify command. Use plan mode first to inspect exact workspace/sender/campaign/table/source state and receive immutable lane packets. `selectedSenderIds` is a legacy shorthand for both scopes; prefer `postEngagerSenderIds` for the Post Engagers sender scope and `sharedSenderIds` for the shared lane sender scope when they differ. `sharedSenderIds` must include every intended shared-lane sender, not only the named Post Engagers sender; when adding other senders to existing shared evergreen campaigns, resolve those sender ids with list_senders and pass the full shared set. If a protected existing Post Engagers campaign must stay unchanged and the operator requested only shared lane execution, pass postEngagerSenderIds:[] and sharedSenderIds; do not include the protected active Post Engagers lane as a reuse packet because it can make the yolo plan non-autoExecutable. The command plans one Post Engagers lane per post-engager sender plus shared Signal Discovery and Shared Cold Fallback lanes for the shared sender set. Non-archived PAUSED/ACTIVE/DRAFT shared campaigns/tables are the reusable targets; archived campaigns, archived tables, and archived waterfall bindings are stale inventory and must not be counted as valid evergreen slots. If an existing non-archived shared campaign is already attached to additional senders, plan reporting should count those attached senders as existing shared-lane membership rather than treating them as missing or duplicate slots. yolo is only a parent-skill auto-execution hint for safe lane packets; pass yolo only in plan mode and never include yolo on mode:\"verify\" calls. This backend command remains read-only in plan mode and verifies receipts in verify mode. Package-backed prompt authority: the installed public wrapper can be the local Codex skill entrypoint, but lane workers must use get_subskill_prompt and get_subskill_asset for nested `$sellable:create-campaign`, create-campaign-v2, generate-messages, validation, and assets; nested filesystem prompt fallback is a failed UAT. Use mcp__sellable only for workspace selection and product mutations/readbacks. Do not use mcp__sellable_admin, direct DB, Prisma, SQL, built-in web search, browser search, web.run, or any external browsing/search tool as execution or research proof; if Sellable MCP research tools are insufficient, write a blocked receipt instead of browsing externally. Worker-local replans are read-only drift checks and must preserve the exact parent sender scopes, including postEngagerSenderIds:[] when intentionally empty and the exact sharedSenderIds array; if scope, planRevision, actionId, or laneKey drifts, stop with blocked:worker_plan_scope_drift before mutation. Each lane packet includes workerDispatch with preferredRuntime, runtimeFallbackOrder, acceptedRuntimes, rejectedRuntimes, requiresVisibleThreadOrDurableReceipt, receiptArtifactHint, receiptRunId, and receiptMustBeWrittenAfter; pre-existing receipts at old deterministic paths are stale and must not be used, so stop with blocked:stale_receipt_artifact if the receipt was not freshly written for the current receiptRunId. `multi_agent_v1.spawn_agent`/opaque spawn_agent is not accepted for mutating command proof unless the parent has visible thread or durable receipt proof. In local Codex, default to `workerDispatch.preferredRuntime` (`visible-codex-app-thread`): discover Codex app thread tools if needed, then call `codex_app.list_projects` and `codex_app.create_thread` with a local project target; do not create a worktree for lane execution. If Codex app thread tools are unavailable but local Codex CLI is available, use durable streaming workers with `codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -` and include preferredRuntimeAttempt plus fallbackReason in createCampaignWorkflowReceipt; approval, sandbox, and reasoning-effort config flags must appear before `exec`, and current customer CLI installs reject `codex exec --ask-for-approval never` and `codex exec -a never`. Do not rely on default model or default reasoning effort: copy the parent model such as `gpt-5.6-sol` into `-m` and always pass `-c model_reasoning_effort=high`; a child worker that reports GPT 5.6-Sol with reasoning below high is a launcher bug to relaunch before mutation, not a user-continue path. Plan responses include approvalSummary; render approvalSummary when asking for bounded delegated approval because it explicitly lists campaignsToCreate, campaignsToUpdate, campaignsToVerifyOnly, campaignsLeftUntouched, attachedSenders, selectedActionIds, allowedSideEffects, forbiddenSideEffects, blockers, and approvalQuestion. When safe-yolo needs normal setup work, the parent skill may ask for bounded delegated approval: one approval over the current planRevision, selected action ids, caps, allowed side-effect classes, and stop conditions lets lane workers execute without per-substep approval while staying inside that packet. In exec/automation mode, do not call request_user_input; if yolo plan autoExecutable:false and no interactive approval can be received, stop with blocked:bounded_approval_unavailable_in_exec_mode before any mutation. Lane workers must explicitly load and use the installed `$sellable:create-campaign` wrapper as the nested workflow entrypoint, then load `create-campaign-v2` and `create-campaign-v2/core/flow.v2.json`; they must execute creation, source import, create-campaign workflow steps, generate-messages, sequence attachment, pause_campaign review-state transition when the current table is still DRAFT, and review readiness through that existing create-campaign workflow/subskills, then return receipts here for verification. Customer-visible verify receipts must set status:'succeeded' or status:'completed'; status:'passed', status:'pass', and status:'passed_with_warnings' are rejected as primary success statuses. Exception: a Post Engagers lane may write status:'blocked' with blocker:'post_engagers_no_sender_posts', 'post_engagers_no_recent_sender_posts', 'post_engagers_no_sender_owned_posts', or 'post_engagers_source_author_mismatch' when Sellable MCP readback proves no usable sender-authored posts/source exists; verify returns these as acceptedLaneBlockers so the parent can report the no-op instead of retrying invalid source repair. Any other blocked receipt, including model-quality/preflight or worker model availability blockers, is not a goal-complete success condition and must not let the parent report evergreen completion. Receipts must include createCampaignStepReceipt with setupPlanCall, createCampaignWorkflowReceipt, campaignBriefReceipt, sourceDecisionReceipt, filterDecisionReceipt, messageDraftingReceipt, reviewBatchReceipt, sequenceReceipt, and verifyCall nested inside createCampaignStepReceipt; top-level-only copies of those objects are not enough and are not promoted by verify. setupPlanCall must use canonical keys: planRevision, actionId, laneKey, workspaceId, senderIds, campaignId, tableId, createIntent. Do not use laneActionId, lanePacketActionId, delegatedPlanRevision, delegatedActionId, or requestedCall text as a substitute for those canonical fields. createCampaignWorkflowReceipt must include skillCommand:'$sellable:create-campaign', skillName:'create-campaign', wrapperSkillLoaded:true, workflowPromptName:'create-campaign-v2', workflowPromptLoadedToHasMoreFalse:true, workflowAssetPath:'create-campaign-v2/core/flow.v2.json', workflowAssetLoaded:true, workerRuntime, workerThreadId or receiptArtifactPath, durableReceiptWritten when using a receipt file, and notAdHoc:true; CLI durable fallback runtimes must also include preferredRuntimeAttempt for visible-codex-app-thread and fallbackReason. messageDraftingReceipt must use exactly statusSource:'branch' or statusSource:'packaged-generate-messages-worker'; descriptive aliases such as statusSource:'package-readback-local-thread' are rejected. It must include proof that generate-messages was loaded, start_campaign_message_preparation/get_campaign_message_preparation_status ran when the packaged worker path is used, validationResult:'passed', a passed qualityReview, and at least 3 concrete sampleMessages with rowId, generatedMessageText, verdict, and issues; Do not substitute `message` for `generatedMessageText`; Do not substitute `passVerdict` for `verdict`. Before writing durable receipts, run a receipt self-check: top-level `planRevision`, `actionId`, `laneKey`, `laneType`, `workspaceId`, and `senderIds` must exist; if the self-check fails, fix the receipt before ending. Use start_campaign_message_preparation with approvalMode:\"mark_ready\" only for evergreen setup. Never call `start_campaign_message_preparation` with `approvalMode:\"approve\"`; approve exactly one semantic Approved cell through select_campaign_cells/update_cell and final proof must show approvedGeneratedMessageCount exactly 1. Shared Cold Fallback samples with a standalone name followed by 'Hey there' are rejected. This command does not launch campaigns, does not schedule sends, does not assign scheduler-owned send fields, does not raw-write campaign status, does not archive/delete cleanup targets, and does not spend paid credits.",
         inputSchema: {
             type: "object",
             properties: {

package/dist/tools/workspace-context.d.ts

@@ -12,7 +12,7 @@ export interface WorkspaceContext {
     executionMode: WorkspaceExecutionMode;
     toolName?: string;
     runId: string;
-    workspaceResolution: "explicit";
+    workspaceResolution: "explicit" | "locked_profile";
 }
 export interface WorkspaceRequiredResult {
     ok: false;

package/dist/tools/workspace-context.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { getLockedWorkspaceId, resolveWorkspaceIdForRequest, } from "../auth.js";
 export function workspaceRequired(params) {
     const toolLabel = params.toolName ? ` for ${params.toolName}` : "";
     return {
@@ -15,11 +16,13 @@ export function normalizeExplicitWorkspaceId(value) {
     return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 export function workspaceRequestOptions(workspaceId) {
-    const normalized = normalizeExplicitWorkspaceId(workspaceId);
+    const normalized = resolveWorkspaceIdForRequest(normalizeExplicitWorkspaceId(workspaceId), "workspace request options");
     return normalized ? Object.freeze({ workspaceId: normalized }) : undefined;
 }
 export function createWorkspaceContext(input) {
-    const workspaceId = normalizeExplicitWorkspaceId(input.workspaceId);
+    const explicitWorkspaceId = normalizeExplicitWorkspaceId(input.workspaceId);
+    const lockedWorkspaceId = getLockedWorkspaceId();
+    const workspaceId = resolveWorkspaceIdForRequest(explicitWorkspaceId, input.toolName || "workspace context");
     if (!workspaceId) {
         return workspaceRequired({
             executionMode: input.executionMode,
@@ -33,7 +36,9 @@ export function createWorkspaceContext(input) {
         executionMode: input.executionMode,
         toolName: input.toolName,
         runId: input.runId?.trim() || randomUUID(),
-        workspaceResolution: "explicit",
+        workspaceResolution: lockedWorkspaceId && !explicitWorkspaceId
+            ? "locked_profile"
+            : "explicit",
     });
     return { ok: true, context };
 }

package/dist/tools/workspace-export.js

@@ -4,7 +4,7 @@ import { lstat, mkdir, readFile, rename, rm, writeFile, } from "node:fs/promises
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { getApi } from "../api.js";
-import { getConfig } from "../auth.js";
+import { getConfig, getEffectiveConfiguredWorkspaceId } from "../auth.js";
 const MAX_FILTER_IDS = 100;
 const MAX_QUERY_LENGTH = 8000;
 export const workspaceExportToolDefinitions = [
@@ -340,7 +340,7 @@ async function writeJsonAtomic(filePath, value) {
 }
 export async function exportWorkspaceCsv(input = {}) {
     const config = getConfig();
-    const workspaceId = config.activeWorkspaceId || config.workspaceId || null;
+    const workspaceId = getEffectiveConfiguredWorkspaceId(config);
     if (!workspaceId) {
         throw new Error("No active workspace selected. Run list_workspaces then set_active_workspace before export_workspace_csv.");
     }

package/dist/tools/workspaces.d.ts

@@ -140,21 +140,56 @@ export declare const workspaceToolDefinitions: ({
 })[];
 export declare function listWorkspaces(): Promise<{
     workspaces: WorkspaceSummary[];
+    workspaceLock: {
+        enabled: boolean;
+        workspaceId?: undefined;
+        hiddenWorkspaceCount?: undefined;
+    };
+} | {
+    workspaces: WorkspaceSummary[];
+    workspaceLock: {
+        enabled: boolean;
+        workspaceId: string;
+        hiddenWorkspaceCount: number;
+    };
 }>;
 export declare function getActiveWorkspace(): {
     activeWorkspaceId: string | null;
     activeWorkspaceName: string | null;
+    workspaceLock: {
+        enabled: boolean;
+        workspaceId: string;
+    } | {
+        enabled: boolean;
+        workspaceId?: undefined;
+    };
 };
 export declare function getWorkspace(workspaceId: string): Promise<{
+    ok: boolean;
+    error: string;
+    workspace?: undefined;
+} | {
     workspace: WorkspaceDetails;
+    ok?: undefined;
+    error?: undefined;
 }>;
 export declare function setActiveWorkspace(workspaceId: string, userConfirmed?: boolean): Promise<{
     ok: boolean;
+    code: string;
+    activeWorkspaceId: string;
+    requestedWorkspaceId: string;
     error: string;
     requiresConfirmation?: undefined;
-    activeWorkspaceId?: undefined;
     activeWorkspaceName?: undefined;
+    requestedWorkspaceName?: undefined;
+} | {
+    ok: boolean;
+    error: string;
+    code?: undefined;
+    activeWorkspaceId?: undefined;
     requestedWorkspaceId?: undefined;
+    requiresConfirmation?: undefined;
+    activeWorkspaceName?: undefined;
     requestedWorkspaceName?: undefined;
 } | {
     ok: boolean;
@@ -164,22 +199,33 @@ export declare function setActiveWorkspace(workspaceId: string, userConfirmed?:
     requestedWorkspaceId: string;
     requestedWorkspaceName: string;
     error: string;
+    code?: undefined;
 } | {
     ok: boolean;
     activeWorkspaceId: string;
     activeWorkspaceName: string;
+    code?: undefined;
+    requestedWorkspaceId?: undefined;
     error?: undefined;
     requiresConfirmation?: undefined;
-    requestedWorkspaceId?: undefined;
     requestedWorkspaceName?: undefined;
 }>;
 export declare function createWorkspace(name: string): Promise<{
+    ok: boolean;
+    code: string;
+    activeWorkspaceId: string;
+    error: string;
+    workspace?: undefined;
+} | {
     workspace: {
         id: string;
         name: string;
         slug: string;
     };
     activeWorkspaceId: string;
+    ok?: undefined;
+    code?: undefined;
+    error?: undefined;
 }>;
 export declare function addTeammate(input: {
     workspaceId?: string;

package/dist/tools/workspaces.js

@@ -1,5 +1,5 @@
 import { getApi, resetApi } from "../api.js";
-import { getConfig, updateActiveWorkspace } from "../auth.js";
+import { getConfig, getEffectiveConfiguredWorkspaceId, getLockedWorkspaceId, resolveWorkspaceIdForRequest, updateActiveWorkspace, } from "../auth.js";
 export const workspaceToolDefinitions = [
     {
         name: "list_workspaces",
@@ -81,21 +81,53 @@ export const workspaceToolDefinitions = [
 export async function listWorkspaces() {
     const api = getApi();
     const { workspaces } = await api.get("/api/v3/workspaces");
-    return { workspaces };
+    const lockedWorkspaceId = getLockedWorkspaceId();
+    if (!lockedWorkspaceId) {
+        return { workspaces, workspaceLock: { enabled: false } };
+    }
+    return {
+        workspaces: workspaces.filter((ws) => ws.id === lockedWorkspaceId),
+        workspaceLock: {
+            enabled: true,
+            workspaceId: lockedWorkspaceId,
+            hiddenWorkspaceCount: workspaces.filter((ws) => ws.id !== lockedWorkspaceId).length,
+        },
+    };
 }
 export function getActiveWorkspace() {
     const config = getConfig();
+    const lockedWorkspaceId = getLockedWorkspaceId();
     return {
-        activeWorkspaceId: config.activeWorkspaceId || config.workspaceId || null,
+        activeWorkspaceId: getEffectiveConfiguredWorkspaceId(config),
         activeWorkspaceName: config.activeWorkspaceName || null,
+        workspaceLock: lockedWorkspaceId
+            ? { enabled: true, workspaceId: lockedWorkspaceId }
+            : { enabled: false },
     };
 }
 export async function getWorkspace(workspaceId) {
+    const allowedWorkspaceId = resolveWorkspaceIdForRequest(workspaceId, "get_workspace");
+    if (!allowedWorkspaceId) {
+        return {
+            ok: false,
+            error: "No active workspace selected.",
+        };
+    }
     const api = getApi();
-    const { workspace } = await api.get(`/api/v3/workspaces/${encodeURIComponent(workspaceId)}`);
+    const { workspace } = await api.get(`/api/v3/workspaces/${encodeURIComponent(allowedWorkspaceId)}`);
     return { workspace };
 }
 export async function setActiveWorkspace(workspaceId, userConfirmed) {
+    const lockedWorkspaceId = getLockedWorkspaceId();
+    if (lockedWorkspaceId && workspaceId !== lockedWorkspaceId) {
+        return {
+            ok: false,
+            code: "WORKSPACE_LOCKED",
+            activeWorkspaceId: lockedWorkspaceId,
+            requestedWorkspaceId: workspaceId,
+            error: "This Hermes profile is locked to its customer workspace and cannot switch workspaces.",
+        };
+    }
     const api = getApi();
     const { workspaces } = await api.get("/api/v3/workspaces");
     const match = workspaces.find((ws) => ws.id === workspaceId);
@@ -131,6 +163,15 @@ export async function setActiveWorkspace(workspaceId, userConfirmed) {
     };
 }
 export async function createWorkspace(name) {
+    const lockedWorkspaceId = getLockedWorkspaceId();
+    if (lockedWorkspaceId) {
+        return {
+            ok: false,
+            code: "WORKSPACE_LOCKED",
+            activeWorkspaceId: lockedWorkspaceId,
+            error: "This Hermes profile is locked to its customer workspace and cannot create or switch workspaces. Use the sellable-admin profile for provisioning.",
+        };
+    }
     const api = getApi();
     const { workspace } = await api.post("/api/v3/workspaces", { name });
     updateActiveWorkspace({
@@ -146,7 +187,9 @@ export async function createWorkspace(name) {
 export async function addTeammate(input) {
     const args = input || {};
     const config = getConfig();
-    const workspaceId = args.workspaceId || config.activeWorkspaceId || config.workspaceId;
+    const workspaceId = resolveWorkspaceIdForRequest(args.workspaceId ||
+        getEffectiveConfiguredWorkspaceId(config) ||
+        undefined, "add_teammate");
     if (!workspaceId) {
         return {
             ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/mcp",
-  "version": "0.1.549",
+  "version": "0.1.551",
   "type": "module",
   "description": "Sellable MCP server for Claude Code, Codex, and Hermes campaign workflows",
   "main": "dist/index.js",

package/skills/create-campaign/SKILL.md

@@ -721,7 +721,7 @@ Treat host capabilities as concrete functions, not prose conventions:
   import and before dispatching Message Drafting only.
 - `launch_message_drafting`: Claude Code uses `Task` with `subagent_type`
   `post-find-leads-message-scout` when listed; Codex uses the returned
-  compatibility agent or a generic `gpt-5.5` / `xhigh` Message Drafting agent.
+  compatibility agent or a generic `gpt-5.6-sol` / `high` Message Drafting agent.
 
 If a required interactive question function or MCP loader is missing, stop and
 explain the Sellable install/reload problem. Source work uses product-native MCP
@@ -1082,8 +1082,8 @@ updates.
    In Codex, the filter-choice answer is the campaign-scoped go-ahead to use
    this single Message Drafting background agent in step-wise and YOLO modes.
    Do not ask a separate question to start it. If the named custom agent is not
-   available, spawn a generic background agent with `model: "gpt-5.5"` and
-   `reasoning_effort: "xhigh"` using the same lean campaign/table basis. If no
+   available, spawn a generic background agent with `model: "gpt-5.6-sol"` and
+   `reasoning_effort: "high"` using the same lean campaign/table basis. If no
    background-agent tool is callable, start the same full message branch inline
    before filter drafting or skip-filter message review and record it as
    `statusSource: "parent-thread-fallback"`.

package/skills/create-campaign-v2/SKILL.md

@@ -291,7 +291,7 @@ in the branch read means "filters still owned by parent," not `blocked`.
 
 Keep the handoff lean: `campaignId`, `workflowTableId`, concise brief/source summary, source-use rule, and 3-5 sample rows (`rowId`, name, title, company, signal). Do not paste copied row counts, hashes, full row IDs, broad row data, or local debug artifacts.
 
-Route user copy feedback before `approve-message` back to Message Drafting; parent does not rewrite. The branch loads the full `generate-messages` prompt, every required asset, then `get_subskill_prompt({ subskillName: "create-campaign-v2-validation" })`; do not render `renderedFallbackSample`, concerns, or `qaReceipt` in the happy path. Generic fallback is `gpt-5.5` / `xhigh` Message Drafting. Handoff is labeled Markdown, not raw JSON.
+Route user copy feedback before `approve-message` back to Message Drafting; parent does not rewrite. The branch loads the full `generate-messages` prompt, every required asset, then `get_subskill_prompt({ subskillName: "create-campaign-v2-validation" })`; do not render `renderedFallbackSample`, concerns, or `qaReceipt` in the happy path. Generic fallback is `gpt-5.6-sol` / `high` Message Drafting. Handoff is labeled Markdown, not raw JSON.
 
 ## Hard Gates
 

package/skills/create-evergreen-campaigns/SKILL.md

@@ -437,7 +437,7 @@ fallback only when app thread tools are unavailable; the receipt must include
 `fallbackReason`, or backend verify rejects it.
 When visible Codex app thread tools are unavailable but local Codex CLI is
 available, the accepted durable streaming-worker command shape is:
-`codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 The approval, sandbox, and reasoning-effort config flags must come before the
 `exec` subcommand for Codex CLI builds that expose `-a`/`-s`/`-c` only at top
 level. `--skip-git-repo-check` belongs after `exec` because current customer and VPS Codex CLI builds expose it
@@ -447,26 +447,26 @@ forms fail on current customer CLI installs. Pipe the lane packet prompt on
 stdin, require the worker to write `workerDispatch.receiptArtifactHint`, and
 pass exactly one lane packet per worker.
 When launching durable Codex CLI workers from an automation parent, pass an
-explicit supported worker model and explicit `xhigh` reasoning effort instead
+explicit supported worker model and explicit `high` reasoning effort instead
 of relying on the Codex CLI defaults. Use the parent runtime model when known,
 for example:
-`codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
+`codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> -`.
 In Codex CLI, the parent runtime model is visible in the run header as
 `model: <model-name>`. Copy that exact model string into child worker launches
-first. If the parent header says `model: gpt-5.5`, launch workers with
-`-m gpt-5.5` plus `-c model_reasoning_effort=xhigh`; do not invent or probe
+first. If the parent header says `model: gpt-5.6-sol`, launch workers with
+`-m gpt-5.6-sol` plus `-c model_reasoning_effort=high`; do not invent or probe
 nearby aliases such as `gpt-5.3-codex`, `gpt-5.2`, `gpt-5-codex`,
 `codex-latest`, or `codex-mini-latest` before trying the exact parent model. A
-one-line probe must include the same `-c model_reasoning_effort=xhigh` override
+one-line probe must include the same `-c model_reasoning_effort=high` override
 and count as supported only when it exits 0 and returns the requested output; a
 session header followed by a `not supported` error is rejected, not accepted.
 Do not rely on the Codex CLI default model or default reasoning effort; some
-customer and VPS installs default to unavailable model aliases or to `high`
-reasoning. `-m gpt-5.5` alone is not enough. If a child worker reports GPT 5.5
-with `high` reasoning, treat that as a launcher bug, relaunch with the explicit
-`xhigh` config before mutation, and do not ask the user to continue through the
+customer and VPS installs default to unavailable model aliases or to reasoning
+below `high`. `-m gpt-5.6-sol` alone is not enough. If a child worker reports GPT 5.6-Sol
+with reasoning below `high`, treat that as a launcher bug, relaunch with the explicit
+`high` config before mutation, and do not ask the user to continue through the
 model-quality warning. If the parent cannot identify a supported worker model
-and launch it with `xhigh` reasoning, stop with
+and launch it with `high` reasoning, stop with
 `blocked: worker_model_unavailable` before mutation.
 When wrapping multiple local Codex CLI workers in a shell launcher, run the
 wrapper with `/bin/bash -lc` or another explicitly chosen portable shell. Do not
@@ -479,7 +479,7 @@ Do not embed `<<'WORKER_PROMPT'` heredocs inside a single quoted or double
 quoted `/bin/bash -lc '...'` command string; nested quoting is brittle and can
 truncate the first worker before mutation. For multi-worker launchers, write one
 plain prompt file per lane under the current run directory, then start each
-worker with `codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m "$WORKER_MODEL" -C "$REPO" -o
+worker with `codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m "$WORKER_MODEL" -C "$REPO" -o
 "$worker_final_file" - < "$worker_prompt_file"`. Keep launcher shell variables
 double-quoted and keep the prompt heredoc only in a standalone script/prompt-file
 write step, not inside an already quoted shell argument. If the first launcher
@@ -585,7 +585,7 @@ launchers, write the same prompt body to `<worker-prompt-file>` and launch the
 worker with stdin redirected from that file:
 
 ```
-codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
+codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - <<'WORKER_PROMPT'
 Use $sellable:create-campaign as the governing campaign workflow for this one lane worker.
 Use the evergreen plan/packet below only for lane scope, source metadata,
 postconditions, side-effect caps, and durable receipt proof.
@@ -632,10 +632,10 @@ Do not launch, start, schedule, send, or use paid InMail.
 For filter proof, durable receipt status must be `filterDecisionReceipt.status:"applied"` only; never `completed`, `confirmed`, `done`, or aliases.
 For generated messages, `update_cell` is allowed only for the semantic Approved checkbox. Never use `update_cell` for generated message text/body/sample copy. Bad copy requires `revise_message_template_and_rerun` or brief/template revision plus Generate Message rerun. Any generated-message cell override is `blocked: generated_message_cell_override`.
 If `bootstrap_create_campaign.modelQuality.status === "warn"` because the child
-worker reports GPT 5.5 with `high` reasoning, that is a parent launcher
+worker reports GPT 5.6-Sol with reasoning below `high`, that is a parent launcher
 configuration bug, not an operator approval path inside the worker. Stop before
 mutation, tell the parent to relaunch this lane with
-`-c model_reasoning_effort=xhigh`, and do not mark the worker goal complete.
+`-c model_reasoning_effort=high`, and do not mark the worker goal complete.
 Complete only this lane. Do not end with narration only. Before your final
 response, run a local file-existence and JSON self-check for
 <receiptArtifactPath>. If the lane succeeded, write the canonical success
@@ -656,7 +656,7 @@ receipt, or an accepted Post Engagers no-source blocked/no-op receipt.
 WORKER_PROMPT
 
 # Multi-worker launcher equivalent:
-codex -a never -s danger-full-access -c model_reasoning_effort=xhigh exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
+codex -a never -s danger-full-access -c model_reasoning_effort=high exec --skip-git-repo-check -m <worker-model> -C <repo> -o <worker-final-file> - < <worker-prompt-file>
 ```
 
 If any placeholder cannot be filled from the current plan, matching