@topolo/cli 0.12.8 → 0.12.10

package/dist/index.js

@@ -4662,7 +4662,8 @@ function sleep(ms) {
 // src/client.ts
 async function buildClient(options) {
   const environment = options?.environment ?? selectedEnvironment();
-  const credential = options?.context ? await refreshContextCredentialIfNeeded(environment, options.context) : await refreshCredentialIfNeeded(environment);
+  const context = options?.context ?? process.env.TOPOLO_CONTEXT?.trim();
+  const credential = context ? await refreshContextCredentialIfNeeded(environment, context) : await refreshCredentialIfNeeded(environment);
   if (!credential) return null;
   const config = await readConfig();
   const profile = resolvedProfileConfig(config, environment);
@@ -4678,7 +4679,7 @@ async function buildClient(options) {
     serviceUrls: profile.serviceUrls,
     requireConfirmForWrites: options?.requireConfirmForWrites,
     ...credential.kind === "access_token" && credential.refreshToken ? {
-      refreshCredential: () => options?.context ? refreshContextCredentialIfNeeded(environment, options.context, { force: true }) : refreshCredentialIfNeeded(environment, { force: true })
+      refreshCredential: () => context ? refreshContextCredentialIfNeeded(environment, context, { force: true }) : refreshCredentialIfNeeded(environment, { force: true })
     } : {},
     ...isDebugEnabled() ? { debug: stderrDebugLogger } : {}
   });
@@ -5078,7 +5079,7 @@ async function actionExecutionContext(topolo) {
   const source = credentialSourceFromConfig(config, environment);
   return createTopoloAgentExecutionContext({
     environment,
-    contextKey: source.startsWith("env:") ? null : profile.activeContext ?? null,
+    contextKey: source.startsWith("env:") ? null : process.env.TOPOLO_CONTEXT?.trim() || profile.activeContext || null,
     identity: await topolo.identity.whoami(),
     serviceUrls: resolvedProfileConfig(config, environment).serviceUrls
   });

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.12.8",
-  "topoloPublishedVersion": "0.12.8",
+  "version": "0.12.10",
+  "topoloPublishedVersion": "0.12.10",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",

package/skills/topolo/SKILL.md

@@ -60,6 +60,16 @@ topolo context use <organization-name|personal> --json
 topolo whoami --json
 ```
 
+For CLI automation, pin each process to an exact key returned by context discovery:
+
+```bash
+TOPOLO_CONTEXT=org:org_acme topolo --env production whoami --json
+TOPOLO_CONTEXT=org:org_acme topolo --env production actions --service brand --json
+```
+
+The CLI keeps this pin through credential refresh and never changes the shared
+active context. A missing pinned credential does not select another context.
+
 For concurrent agents or multiple MCP connections, never coordinate by changing
 one shared active context. Register each pinned context through the CLI so it
 uses the exact bundled MCP instead of a global binary:
@@ -76,6 +86,22 @@ reads and refreshes only its pinned credential without changing the CLI or web
 session. Do not set `TOPOLO_CONTEXT` alongside an injected API key or access
 token because that credential already carries its immutable context.
 
+## Agent invocation approvals
+
+When `topolo_run_agent` returns `state: "awaiting_approval"`, show the human the
+published approval URL, then immediately call `topolo_run_agent` again with the
+exact same invocation, resource context, correlation id, and idempotency key.
+Set `waitForApproval: true` and `waitSeconds: 120` on that continuation call.
+Do not create a second invocation or wait for the human to ask you to resume.
+
+If the continuation call is still awaiting approval after its bounded wait,
+repeat that same continuation call until the invocation becomes terminal or
+the user explicitly stops the work. Approval acknowledgement is not action
+completion: report success only when the invocation itself returns
+`state: "completed"`, and surface terminal failure or cancellation as such.
+The invocation's pinned credential context remains authoritative regardless of
+which organization is open in the human's browser.
+
 ## Mandatory clean-room workflow
 
 For every Topolo task, follow this sequence.