@topolo/cli 0.12.10 → 0.12.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +568 -285
- package/package.json +4 -4
- package/skills/topolo/SKILL.md +20 -0
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@topolo/cli",
|
|
3
3
|
"packageManager": "pnpm@10.17.1",
|
|
4
|
-
"version": "0.12.
|
|
5
|
-
"topoloPublishedVersion": "0.12.
|
|
4
|
+
"version": "0.12.12",
|
|
5
|
+
"topoloPublishedVersion": "0.12.12",
|
|
6
6
|
"description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
|
|
7
7
|
"license": "UNLICENSED",
|
|
8
8
|
"author": "Topolo",
|
|
@@ -28,8 +28,8 @@
|
|
|
28
28
|
},
|
|
29
29
|
"dependencies": {
|
|
30
30
|
"@modelcontextprotocol/sdk": "^1.0.0",
|
|
31
|
-
"@topolo/mcp": "0.14.
|
|
32
|
-
"@topolo/sdk": "0.
|
|
31
|
+
"@topolo/mcp": "0.14.5",
|
|
32
|
+
"@topolo/sdk": "0.22.0",
|
|
33
33
|
"commander": "^12.1.0"
|
|
34
34
|
},
|
|
35
35
|
"devDependencies": {
|
package/skills/topolo/SKILL.md
CHANGED
|
@@ -252,6 +252,24 @@ If verification fails:
|
|
|
252
252
|
|
|
253
253
|
Never improvise a rollback.
|
|
254
254
|
|
|
255
|
+
## Protected action credential handoff
|
|
256
|
+
|
|
257
|
+
Local CLI and stdio MCP replace returned action credentials with opaque
|
|
258
|
+
`topolo-secret:<id>` references backed by the OS protected credential store.
|
|
259
|
+
Pass the reference unchanged into the next published action input; the SDK
|
|
260
|
+
resolves nonempty string credentials internally before validation and execution;
|
|
261
|
+
non-string or empty credentials fail closed. Never extract the
|
|
262
|
+
underlying token or put it in a file, terminal command, message, or log.
|
|
263
|
+
|
|
264
|
+
References are bound to the verified principal, organization, API key identity
|
|
265
|
+
when present, and environment. They expire after 30 minutes; access to an
|
|
266
|
+
expired reference deletes its local entry. Delete references once the workflow
|
|
267
|
+
finishes using `topolo actions release-secret <reference> --confirm --json`,
|
|
268
|
+
or `topolo_release_action_secret` with `confirm: true` in stdio MCP.
|
|
269
|
+
Local deletion does not revoke the upstream credential; use its published
|
|
270
|
+
revocation action separately when required. Other SDK/remote hosts keep
|
|
271
|
+
redaction unless they explicitly provide a protected store.
|
|
272
|
+
|
|
255
273
|
## Generic public API escape hatch
|
|
256
274
|
|
|
257
275
|
Only when public docs provide a complete contract:
|
|
@@ -271,6 +289,8 @@ In JSON mode, branch on `error.code`, not message text:
|
|
|
271
289
|
- exit 3 / permission denied: surface the missing permission or target denial; do not retry or widen access.
|
|
272
290
|
- `invalid_action_input`: correct only the reported schema paths.
|
|
273
291
|
- `confirmation_required`: plan, obtain approval, then retry once with confirmation.
|
|
292
|
+
- a service-published refusal code (for example `outreach_requires_mailbox_sender`): apply that action's published recovery for the code; `error.message` is the service's sanitized explanation and `error.details.issues` lists field-level problems.
|
|
293
|
+
- `http_error`: the service returned no structured code; use `status` and `requestId`.
|
|
274
294
|
- unknown action/service: repeat bounded discovery; never substitute a guessed identifier.
|
|
275
295
|
- missing docs/schema/examples/verification/recovery: stop the affected operation and report the missing publication contract.
|
|
276
296
|
|