@topolo/cli 0.12.4 → 0.12.7

package/dist/index.js

@@ -3799,10 +3799,10 @@ function runOrThrow(result, operation) {
 }
 function createPlatformInstallationSecretBackend(options = {}) {
   const platform22 = options.platform ?? hostPlatform();
-  const spawn2 = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
+  const spawn3 = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
   if (platform22 === "darwin") {
-    const write = (account, value) => runOrThrow(spawn2("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
+    const write = (account, value) => runOrThrow(spawn3("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
       input: `${value}
 `,
       encoding: "utf8",
@@ -3813,7 +3813,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
       }
     }), "macOS Keychain write");
     const read = (account) => {
-      const result = spawn2("security", [
+      const result = spawn3("security", [
         "find-generic-password",
         "-a",
         account,
@@ -3825,7 +3825,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
       return runOrThrow(result, "macOS Keychain read");
     };
     const remove = (account) => {
-      const result = spawn2("security", [
+      const result = spawn3("security", [
         "delete-generic-password",
         "-a",
         account,
@@ -3875,7 +3875,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
   if (platform22 === "linux") {
     return {
       async set(account, value) {
-        runOrThrow(spawn2("secret-tool", [
+        runOrThrow(spawn3("secret-tool", [
           "store",
           "--label=Topolo external agent installation",
           "service",
@@ -3885,7 +3885,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         ], { input: value, encoding: "utf8" }), "Linux Secret Service write");
       },
       async get(account) {
-        const result = spawn2("secret-tool", [
+        const result = spawn3("secret-tool", [
           "lookup",
           "service",
           KEYCHAIN_SERVICE,
@@ -3896,7 +3896,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         return runOrThrow(result, "Linux Secret Service read");
       },
       async delete(account) {
-        const result = spawn2("secret-tool", [
+        const result = spawn3("secret-tool", [
           "clear",
           "service",
           KEYCHAIN_SERVICE,
@@ -3909,7 +3909,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
   }
   if (platform22 === "win32") {
     const secretPath = (account) => join(root, ".secrets", `${account.replace(":", "-")}.bin`);
-    const powershell = (script, path, input2) => spawn2(
+    const powershell = (script, path, input2) => spawn3(
       "powershell.exe",
       ["-NoProfile", "-NonInteractive", "-Command", script],
       { input: input2, encoding: "utf8", env: { ...process.env, TOPOLO_SECRET_PATH: path } }
@@ -4748,7 +4748,9 @@ function formatPretty(info) {
 }
 
 // src/commands/actions.ts
+import { spawn as spawn2 } from "child_process";
 import { readFileSync as readFileSync2 } from "fs";
+import { platform as platform3 } from "os";
 import { basename, extname } from "path";
 
 // src/commands/api.ts
@@ -4888,7 +4890,7 @@ function registerActionsCommand(program2) {
       fail2(err, mode);
     }
   });
-  actions.command("call <action>").description("Call a permission-scoped Topolo action").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--resource-type <type>", "App-local resource alias, such as workspace").option("--resource-id <id>", "Resource id for the selected resource type").option("--confirm", "Acknowledge a mutating action").option("--detail", "Return the complete action response instead of a bounded agent projection").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
+  actions.command("call <action>").description("Call a permission-scoped Topolo action").option("-d, --data <json-or-@file>", "JSON action input or @path to a JSON file", "{}").option("--resource-type <type>", "App-local resource alias, such as workspace").option("--resource-id <id>", "Resource id for the selected resource type").option("--confirm", "Acknowledge a mutating action").option("--no-browser", "Print an approval verification URL without opening it").option("--detail", "Return the complete action response instead of a bounded agent projection").option("--json", "Output JSON").option("--no-json", "Output human-readable text").action(async (action, opts, command) => {
     const mode = resolveOutputMode(opts.json ?? command.parent?.opts().json);
     try {
       const topolo = await buildClient();
@@ -4901,8 +4903,16 @@ function registerActionsCommand(program2) {
         confirm: opts.confirm === true,
         ...resource ? { resource } : {}
       });
-      const output = detailRequested(opts.detail, command) ? result : compactActionResult(action, result);
-      emit(output, mode, () => JSON.stringify(output, null, 2));
+      const approval = externalApprovalHandoff(action, result);
+      const detailed = detailRequested(opts.detail, command);
+      const output = detailed ? result : {
+        ...compactActionResult(action, result),
+        ...approval ? { approval } : {}
+      };
+      const opened = approval && mode === "pretty" && opts.browser !== false ? tryOpenApproval(approval.verificationUrl) : false;
+      emit(output, mode, () => approval ? `${JSON.stringify(output, null, 2)}
+
+Approval required. ${opened ? "Opening" : "Open"} ${approval.verificationUrl}` : JSON.stringify(output, null, 2));
     } catch (err) {
       fail2(err, mode);
     }
@@ -5023,6 +5033,44 @@ function registerActionsCommand(program2) {
     }
   });
 }
+function externalApprovalHandoff(action, result) {
+  if (!action.includes("agent_invocations.")) return null;
+  if (!result || typeof result !== "object" || Array.isArray(result)) return null;
+  const invocation = result.invocation;
+  if (!invocation || typeof invocation !== "object" || Array.isArray(invocation)) return null;
+  const record2 = invocation;
+  if (record2.status !== "awaiting_approval") return null;
+  const approval = record2.approval;
+  if (!approval || typeof approval !== "object" || Array.isArray(approval)) return null;
+  const handoff = approval;
+  if (typeof handoff.requestId !== "string" || typeof handoff.verificationUrl !== "string") return null;
+  try {
+    const url = new URL(handoff.verificationUrl);
+    if (url.protocol !== "https:" || !/(^|\.)topolo\.(?:app|us|dev)$/.test(url.hostname)) return null;
+  } catch {
+    return null;
+  }
+  return {
+    requestId: handoff.requestId,
+    expiresAt: typeof handoff.expiresAt === "string" ? handoff.expiresAt : null,
+    verificationUrl: handoff.verificationUrl
+  };
+}
+function tryOpenApproval(url) {
+  try {
+    const os = platform3();
+    const command = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
+    const child = spawn2(command, os === "win32" ? ["", url] : [url], {
+      detached: true,
+      stdio: "ignore",
+      ...os === "win32" ? { shell: true } : {}
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function actionExecutionContext(topolo) {
   const environment = selectedEnvironment();
   const config = await readConfig();

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.12.4",
-  "topoloPublishedVersion": "0.12.4",
+  "version": "0.12.7",
+  "topoloPublishedVersion": "0.12.7",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -28,7 +28,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.13.3",
+    "@topolo/mcp": "0.14.1",
     "@topolo/sdk": "0.21.2",
     "commander": "^12.1.0"
   },