@topolo/cli 0.13.0 → 0.13.2

package/dist/index.js

@@ -5,8 +5,22 @@ import { spawnSync } from "child_process";
 import { existsSync } from "fs";
 import { dirname, resolve } from "path";
 import { fileURLToPath } from "url";
+import { homedir } from "os";
 function registerAgentPacksCommand(program2) {
   const packs = program2.command("agent-packs").description("Install and operate Topolo Agent Packs in supported local hosts").option("--store <path>", "Portable pack library (default ~/AgentPacks)");
+  packs.command("configure").description("Qualify and configure an adopted Claude roster through its live native backend").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
+    if (options.harness !== "claude") throw new Error("Native configure is currently qualified only for Claude Desktop.");
+    const { configureClaudePack } = await import("./claude-pack-backend-IDQQX3DG.js");
+    const result = await configureClaudePack({
+      store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
+      pack,
+      policy: options.policy,
+      endpoint: options.endpoint,
+      pid: Number(options.pid),
+      apply: options.apply === true
+    });
+    console.log(JSON.stringify(result, null, 2));
+  });
   const commands = [
     "add",
     "replace",
@@ -19,6 +33,7 @@ function registerAgentPacksCommand(program2) {
     "list",
     "recover",
     "doctor",
+    "policy",
     "remote-recover",
     "connect",
     "remote-context",
@@ -27,8 +42,26 @@ function registerAgentPacksCommand(program2) {
     "artifact-get"
   ];
   for (const name of commands) {
-    packs.command(name).description(name === "add" ? "Add an installed or bundled pack, group, or agent" : `Run the pack ${name} operation`).option("--harness <name>", "Local host adapter (currently codex)", "codex").option("--adapter-help", "Show every option supported by the selected adapter").argument("[arguments...]").allowUnknownOption().allowExcessArguments().addHelpText("after", name === "add" ? "\nExamples:\n  topolo agent-packs add founder\n  topolo agent-packs add founder --group specialists\n  topolo agent-packs add founder --agent strategy\n" : "\nRun topolo agent-packs <command> --adapter-help for all adapter options. Cloud commands require explicit --environment and --context-key.\n").action((args, options) => {
-      if (options.harness !== "codex") throw new Error(`The ${options.harness} pack adapter is not available. Only Codex switching has been verified.`);
+    const command = packs.command(name).description(name === "add" ? "Add an installed or bundled pack, group, or agent" : `Run the pack ${name} operation`);
+    if (name === "switch" || name === "recover") command.option("--policy <path>", "Reviewed policy for an adopted Claude roster").option("--endpoint <url>", "Explicit authorized Claude main-process inspector endpoint").option("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply a native switch; recovery is always read-only");
+    command.option("--harness <name>", "Local host adapter (codex, claude Desktop Code sessions)", "codex").option("--adapter-help", "Show every option supported by the selected adapter").argument("[arguments...]").allowUnknownOption().allowExcessArguments().addHelpText("after", name === "add" ? "\nExamples:\n  topolo agent-packs add founder\n  topolo agent-packs add founder --group specialists\n  topolo agent-packs add founder --agent strategy\n" : "\nRun topolo agent-packs <command> --adapter-help for all adapter options. Cloud commands require explicit --environment and --context-key.\n").action(async (args, options) => {
+      if (!["codex", "claude"].includes(options.harness)) throw new Error(`The ${options.harness} pack adapter is not available. Supported adapters: codex, claude.`);
+      if (options.policy || options.endpoint || options.pid || options.apply) {
+        if (options.harness !== "claude" || !options.policy || !options.endpoint || !options.pid || args.length !== 1)
+          throw new Error("Native switch/recovery requires one Claude pack, --policy, --endpoint and --pid.");
+        const { configureClaudePack } = await import("./claude-pack-backend-IDQQX3DG.js");
+        const result2 = await configureClaudePack({
+          store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
+          pack: args[0],
+          policy: options.policy,
+          endpoint: options.endpoint,
+          pid: Number(options.pid),
+          mode: name,
+          apply: options.apply === true
+        });
+        console.log(JSON.stringify(result2, null, 2));
+        return;
+      }
       const here = dirname(fileURLToPath(import.meta.url));
       const adapter = [resolve(here, "../agent-packs/topolo-agent-pack"), resolve(here, "../../agent-packs/topolo-agent-pack")].find(existsSync);
       if (!adapter) throw new Error("This CLI installation is missing its bundled Topolo Agent Pack adapter. Reinstall @topolo/cli.");
@@ -37,6 +70,7 @@ function registerAgentPacksCommand(program2) {
       const result = spawnSync("python3", [
         adapter,
         ...store ? ["--store", store] : [],
+        ...options.harness === "claude" ? ["--harness", "claude"] : [],
         name,
         ...forwarded,
         ...name === "add" && !options.adapterHelp ? ["--catalog"] : []
@@ -56,7 +90,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.17/node_modules/@topolo/sdk/dist/index.js
+// node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -3153,9 +3187,18 @@ var TopoloOAuth = class {
     if (!res.ok) {
       if (parsed && typeof parsed === "object" && "error" in parsed) {
         const err = parsed;
-        throw new TopoloAuthError(err.error_description || err.error, err.error);
+        throw new TopoloAuthError(err.error_description || err.error, err.error, {
+          status: res.status,
+          service: "auth",
+          path,
+          requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+          retryAfter: res.headers.get("retry-after") ?? void 0
+        });
       }
-      throw new TopoloHttpError("auth", path, res.status, parsed);
+      throw new TopoloHttpError("auth", path, res.status, parsed, void 0, {
+        requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+        retryAfter: res.headers.get("retry-after") ?? void 0
+      });
     }
     return parsed;
   }
@@ -3657,9 +3700,10 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.23.17/node_modules/@topolo/sdk/dist/node/credential-store.js
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
+// node_modules/@topolo/sdk/dist/node/credential-store.js
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2, rename as rename2, link } from "fs/promises";
+import { existsSync as existsSync2, lstatSync, readdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir2, platform } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 import { createHash, randomUUID } from "crypto";
@@ -3667,7 +3711,7 @@ import { join as join2 } from "path";
 import { spawnSync as spawnSync2 } from "child_process";
 import { mkdir, readFile, readdir, rename, rm, writeFile, chmod } from "fs/promises";
 import { existsSync as existsSync3 } from "fs";
-import { homedir, platform as hostPlatform } from "os";
+import { homedir as homedir3, platform as hostPlatform } from "os";
 import { dirname as dirname3, join } from "path";
 var TopoloSdkError2 = class extends Error {
   code;
@@ -4067,9 +4111,18 @@ var TopoloOAuth2 = class {
     if (!res.ok) {
       if (parsed && typeof parsed === "object" && "error" in parsed) {
         const err = parsed;
-        throw new TopoloAuthError2(err.error_description || err.error, err.error);
+        throw new TopoloAuthError2(err.error_description || err.error, err.error, {
+          status: res.status,
+          service: "auth",
+          path,
+          requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+          retryAfter: res.headers.get("retry-after") ?? void 0
+        });
       }
-      throw new TopoloHttpError2("auth", path, res.status, parsed);
+      throw new TopoloHttpError2("auth", path, res.status, parsed, void 0, {
+        requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+        retryAfter: res.headers.get("retry-after") ?? void 0
+      });
     }
     return parsed;
   }
@@ -4097,7 +4150,7 @@ var MACOS_KEYCHAIN_WRITE_SCRIPT = [
 function installationStorePath() {
   const override = process.env.TOPOLO_INSTALLATIONS_PATH?.trim();
   if (override) return override;
-  const base = process.env.XDG_CONFIG_HOME || (hostPlatform() === "win32" ? join(homedir(), "AppData", "Roaming") : join(homedir(), ".config"));
+  const base = process.env.XDG_CONFIG_HOME || (hostPlatform() === "win32" ? join(homedir3(), "AppData", "Roaming") : join(homedir3(), ".config"));
   return join(base, "topolo", "installations");
 }
 function installationPath(environment, id) {
@@ -4516,38 +4569,149 @@ async function resolveCredential(environment = selectedEnvironment()) {
 var REFRESH_SKEW_SECONDS = 60;
 var CONFIG_LOCK_RETRY_MS = 25;
 var CONFIG_LOCK_TIMEOUT_MS = 5e3;
-var CONFIG_LOCK_STALE_MS = 12e4;
+var ConfigOwnershipError = class extends TopoloSdkError2 {
+  constructor() {
+    super("state_conflict", "Credential configuration ownership cannot be verified. Retain the unresolved operation instead of starting another renewal.");
+  }
+};
 async function withConfigWriteLock(operation) {
   const lockPath = `${configPath()}.lock`;
   await mkdir2(dirname2(lockPath), { recursive: true });
-  const startedAt = Date.now();
+  const startedAt = performance.now();
   while (true) {
     try {
-      await mkdir2(lockPath);
+      await mkdir2(lockPath, { mode: 448 });
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
-      try {
-        const lock = await stat(lockPath);
-        if (Date.now() - lock.mtimeMs > CONFIG_LOCK_STALE_MS) {
-          await rm2(lockPath, { recursive: true, force: true });
-          continue;
-        }
-      } catch (inspectionError) {
-        if (inspectionError.code !== "ENOENT") throw inspectionError;
-        continue;
-      }
-      if (Date.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
-        throw new Error(`Timed out waiting for credential configuration lock at ${lockPath}.`);
+      if (performance.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
+        throw new TopoloSdkError2("state_conflict", "Credential configuration is still held or unresolved. This waiter did not dispatch a renewal.");
       }
       await new Promise((resolve4) => setTimeout(resolve4, CONFIG_LOCK_RETRY_MS));
     }
   }
+  const directory = await lstat(lockPath);
+  const identity = randomUUID2();
+  const markerName = "owner-" + identity + ".json";
+  const markerPath = join3(lockPath, markerName);
+  const marker = JSON.stringify({ version: 1, identity, pid: process.pid });
+  await writeFile2(markerPath, marker, { flag: "wx", mode: 384 });
+  const assertDirectory = async () => {
+    const current = await lstat(lockPath);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+      throw new ConfigOwnershipError();
+  };
+  const assertOwned = async () => {
+    try {
+      await assertDirectory();
+      const entries = await readdir2(lockPath);
+      if (entries.length !== 1 || entries[0] !== markerName) throw new ConfigOwnershipError();
+      const entry = await lstat(markerPath);
+      if (!entry.isFile() || entry.isSymbolicLink() || await readFile2(markerPath, "utf8") !== marker)
+        throw new ConfigOwnershipError();
+    } catch {
+      throw new ConfigOwnershipError();
+    }
+  };
+  const assertDirectorySync = () => {
+    const current = lstatSync(lockPath);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+      throw new ConfigOwnershipError();
+  };
+  const assertOwnedSync = () => {
+    assertDirectorySync();
+    const entries = readdirSync(lockPath);
+    const entry = lstatSync(markerPath);
+    if (entries.length !== 1 || entries[0] !== markerName || !entry.isFile() || entry.isSymbolicLink() || readFileSync(markerPath, "utf8") !== marker) throw new ConfigOwnershipError();
+  };
+  const persist = async (update) => {
+    const path = configPath();
+    await mkdir2(dirname2(path), { recursive: true });
+    const temporary = join3(dirname2(path), ".credential-write-" + randomUUID2());
+    let temporaryOwned = false;
+    try {
+      assertOwnedSync();
+      const entry = lstatSync(path);
+      if (!entry.isFile() || entry.isSymbolicLink()) throw new ConfigOwnershipError();
+      const before = readFileSync(path, "utf8");
+      const updated = update(JSON.parse(before));
+      const fd = openSync(temporary, "wx", 384);
+      temporaryOwned = true;
+      try {
+        writeFileSync(fd, JSON.stringify(updated, null, 2) + "\n");
+        fsyncSync(fd);
+      } finally {
+        closeSync(fd);
+      }
+      assertOwnedSync();
+      if (readFileSync(path, "utf8") !== before) throw new ConfigOwnershipError();
+      renameSync(temporary, path);
+      temporaryOwned = false;
+    } finally {
+      if (temporaryOwned) unlinkSync(temporary);
+    }
+  };
+  const release = async () => {
+    await assertOwned();
+    const quarantine = join3(dirname2(lockPath), ".credential-release-" + randomUUID2());
+    await mkdir2(quarantine, { mode: 448 });
+    const captured = join3(quarantine, markerName);
+    try {
+      await assertOwned();
+      await rename2(markerPath, captured);
+      assertDirectorySync();
+      const entry = lstatSync(captured);
+      if (!entry.isFile() || entry.isSymbolicLink() || readFileSync(captured, "utf8") !== marker || readdirSync(lockPath).length) throw new ConfigOwnershipError();
+      unlinkSync(captured);
+      rmdirSync(quarantine);
+      assertDirectorySync();
+      if (readdirSync(lockPath).length) throw new ConfigOwnershipError();
+      rmdirSync(lockPath);
+    } catch {
+      if (existsSync2(captured)) {
+        try {
+          await link(captured, markerPath);
+        } catch {
+        }
+      }
+      throw new ConfigOwnershipError();
+    }
+  };
   try {
-    return await operation();
+    await assertOwned();
+    const result = await operation(assertOwned, persist);
+    await assertOwned();
+    return result;
   } finally {
-    await rm2(lockPath, { recursive: true, force: true });
+    await release();
+  }
+}
+function renewalFailure(error) {
+  const path = "/api/developer-oauth/token";
+  if (error instanceof ConfigOwnershipError) return new ConfigOwnershipError();
+  if (error instanceof TopoloAuthError2 && error.code === "invalid_grant") {
+    return new TopoloAuthError2("The saved Topolo sign-in can no longer be renewed. Sign in again.", "invalid_grant", {
+      status: error.status,
+      service: "auth",
+      path,
+      requestId: error.requestId
+    });
+  }
+  if (error instanceof TopoloAuthError2 || error instanceof TopoloHttpError2) {
+    return new TopoloHttpError2(
+      "auth",
+      path,
+      error.status,
+      void 0,
+      "Topolo sign-in renewal failed. Retry the request; the saved sign-in has been retained.",
+      { requestId: error.requestId, retryAfter: error.retryAfter }
+    );
   }
+  const timeout = error instanceof Error && ["AbortError", "TimeoutError"].includes(error.name);
+  return new TopoloSdkError2(
+    timeout ? "request_timeout" : "network_error",
+    "Topolo sign-in renewal could not reach Auth. Retry the request; the saved sign-in has been retained."
+  );
 }
 async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
@@ -4557,16 +4721,16 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   const observedProfile = profileForEnvironment(await readConfig(), environment);
   const observed = observedProfile.credential;
   if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !observedProfile.oauthClientId || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
-  return withConfigWriteLock(async () => {
+  return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
     const profile = profileForEnvironment(config, environment);
     const cred = profile.credential;
     if (!cred || cred.kind !== "access_token") return cred ?? null;
     if (!cred.refreshToken || !profile.oauthClientId) return cred;
-    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken) {
+    const now = Math.floor(Date.now() / 1e3);
+    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken && cred.expiresAt !== void 0 && cred.expiresAt > now) {
       return cred;
     }
-    const now = Math.floor(Date.now() / 1e3);
     if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
     const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
     if (environment === "local" && !serviceUrls?.auth) {
@@ -4589,23 +4753,27 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
         ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
         expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
       };
-      const activeContext = profile.activeContext;
-      const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
-      const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
-        credential: refreshed,
-        contexts: {
-          ...profile.contexts ?? {},
-          [activeContext]: {
+      await persist((current) => {
+        const latest = profileForEnvironment(current, environment);
+        const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+        if (!same(latest.credential, cred) || latest.oauthClientId !== profile.oauthClientId || latest.activeContext !== profile.activeContext)
+          throw new ConfigOwnershipError();
+        const activeContext = latest.activeContext;
+        const activeEntry = activeContext ? latest.contexts?.[activeContext] : void 0;
+        const previousEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+        if (!same(activeEntry?.credential, previousEntry?.credential)) throw new ConfigOwnershipError();
+        return activeContext && activeEntry ? writeProfileConfig(current, environment, {
+          credential: refreshed,
+          contexts: { ...latest.contexts, [activeContext]: {
             ...activeEntry,
             credential: refreshed,
-            oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
-          }
-        }
-      }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
-      await writeConfig(updated);
+            oauthClientId: activeEntry.oauthClientId ?? latest.oauthClientId
+          } }
+        }) : environment === "production" && !current.profiles?.production ? { ...current, credential: refreshed } : writeProfileConfig(current, environment, { credential: refreshed });
+      });
       return refreshed;
-    } catch {
-      return cred;
+    } catch (error) {
+      throw renewalFailure(error);
     }
   });
 }
@@ -4614,7 +4782,7 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
   const observedContext = observedProfile.contexts?.[key];
   const observed = observedContext?.credential;
   if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !(observedContext.oauthClientId ?? observedProfile.oauthClientId) || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
-  return withConfigWriteLock(async () => {
+  return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
     const profile = profileForEnvironment(config, environment);
     const context = profile.contexts?.[key];
@@ -4623,6 +4791,7 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
     const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
     if (!credential.refreshToken || !oauthClientId) return credential;
     const now = Math.floor(Date.now() / 1e3);
+    if (options.force && observed.accessToken !== credential.accessToken && credential.expiresAt !== void 0 && credential.expiresAt > now) return credential;
     if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
     const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
     if (environment === "local" && !serviceUrls?.auth) {
@@ -4643,16 +4812,21 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
         ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
         expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
       };
-      await writeConfig(writeProfileConfig(config, environment, {
-        ...profile.activeContext === key ? { credential: refreshed } : {},
-        contexts: {
-          ...profile.contexts ?? {},
-          [key]: { ...context, credential: refreshed, oauthClientId }
-        }
-      }));
+      await persist((current) => {
+        const latest = profileForEnvironment(current, environment);
+        const latestContext = latest.contexts?.[key];
+        if (!latestContext || JSON.stringify(latestContext.credential) !== JSON.stringify(credential) || (latestContext.oauthClientId ?? latest.oauthClientId) !== oauthClientId || latestContext.contextType !== context.contextType || latestContext.organizationId !== context.organizationId)
+          throw new ConfigOwnershipError();
+        if (latest.activeContext === key && JSON.stringify(latest.credential) !== JSON.stringify(profile.activeContext === key ? profile.credential : credential))
+          throw new ConfigOwnershipError();
+        return writeProfileConfig(current, environment, {
+          ...latest.activeContext === key ? { credential: refreshed } : {},
+          contexts: { ...latest.contexts, [key]: { ...latestContext, credential: refreshed, oauthClientId } }
+        });
+      });
       return refreshed;
-    } catch {
-      return credential;
+    } catch (error) {
+      throw renewalFailure(error);
     }
   });
 }
@@ -4811,7 +4985,7 @@ function normalizeError(err) {
 }
 
 // src/version.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function readCliVersion() {
@@ -4823,7 +4997,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path, "utf8"));
+        const pkg = JSON.parse(readFileSync2(path, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -5159,19 +5333,19 @@ function formatPretty(info) {
 
 // src/commands/actions.ts
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { platform as platform3 } from "os";
 import { basename, extname } from "path";
 
 // src/json-input.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 function parseJsonInput(value) {
   let source = value;
   if (value.startsWith("@")) {
     const path = value.slice(1);
     if (!path) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path, "utf8");
+      source = readFileSync3(path, "utf8");
     } catch (err) {
       throw new Error(`Could not read --data file ${path}: ${err.message}`);
     }
@@ -5368,7 +5542,7 @@ Approval required. ${opened ? "Opening" : "Open"} ${approval.verificationUrl}` :
       const resource = parseResourceOption(opts.resourceType, opts.resourceId);
       const result = await topolo.client.uploadAction(
         action,
-        readFileSync3(opts.file),
+        readFileSync4(opts.file),
         parseJsonObject(opts.data || "{}"),
         {
           fileName: basename(opts.file),
@@ -5940,7 +6114,7 @@ function normalizeList(values, fallback = []) {
 }
 
 // src/commands/integrations.ts
-import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "fs/promises";
+import { readdir as readdir3, readFile as readFile3, stat } from "fs/promises";
 import { join as join5, relative } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
@@ -6094,7 +6268,7 @@ async function collectFiles(repoRoot) {
   const root = repoRoot;
   async function walk(dir) {
     if (result.length > 2e3) return;
-    const entries = await readdir2(dir, { withFileTypes: true });
+    const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
       const fullPath = join5(dir, entry.name);
       if (entry.isDirectory()) {
@@ -6103,7 +6277,7 @@ async function collectFiles(repoRoot) {
         continue;
       }
       if (!entry.isFile() || !isInspectable(entry.name)) continue;
-      const info = await stat2(fullPath);
+      const info = await stat(fullPath);
       if (info.size > 25e4) continue;
       result.push({
         path: relative(root, fullPath),
@@ -6125,8 +6299,8 @@ function formatCheckResult(result) {
 // src/commands/skills.ts
 import { spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync6 } from "fs";
-import { readFile as readFile6, rm as rm3 } from "fs/promises";
-import { homedir as homedir4 } from "os";
+import { readFile as readFile6, rm as rm2 } from "fs/promises";
+import { homedir as homedir5 } from "os";
 import { dirname as dirname6, join as join7, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { createRequire } from "module";
@@ -6135,7 +6309,7 @@ import { createRequire } from "module";
 import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync4 } from "fs";
 import { readFile as readFile4 } from "fs/promises";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { isAbsolute, join as join6 } from "path";
 var SUPPORTED_AGENT_IDS = [
   "claude",
@@ -6191,7 +6365,7 @@ function stableNodeCommand() {
   });
   return selectStableNodeCommand(probe.status === 0 ? probe.stdout : void 0);
 }
-function agentSkillPath(agent, homeDir = homedir3(), projectDir) {
+function agentSkillPath(agent, homeDir = homedir4(), projectDir) {
   switch (agent) {
     case "claude":
       return projectDir ? join6(projectDir, ".claude", "skills", "topolo", "SKILL.md") : join6(homeDir, ".claude", "skills", "topolo", "SKILL.md");
@@ -6216,7 +6390,7 @@ function agentSkillPath(agent, homeDir = homedir3(), projectDir) {
       return void 0;
   }
 }
-function agentConfigPaths(agent, homeDir = homedir3(), projectDir) {
+function agentConfigPaths(agent, homeDir = homedir4(), projectDir) {
   switch (agent) {
     case "claude":
       return [{ path: join6(homeDir, ".claude.json"), format: "json", rootKey: "mcpServers" }];
@@ -6308,7 +6482,7 @@ function agentCliNames(agent) {
       return ["qchat", "q"];
   }
 }
-function agentConfigExists(agent, homeDir = homedir3(), projectDir) {
+function agentConfigExists(agent, homeDir = homedir4(), projectDir) {
   return agentConfigPaths(agent, homeDir, projectDir).some((config) => existsSync4(config.path));
 }
 function claudeDesktopConfigPath(homeDir) {
@@ -6321,7 +6495,7 @@ function vscodeUserConfigPath(homeDir) {
   if (process.platform === "win32") return join6(process.env.APPDATA ?? join6(homeDir, "AppData", "Roaming"), "Code", "User", "mcp.json");
   return join6(process.env.XDG_CONFIG_HOME ?? join6(homeDir, ".config"), "Code", "User", "mcp.json");
 }
-async function readAgentRegistrations(agent, homeDir = homedir3(), projectDir) {
+async function readAgentRegistrations(agent, homeDir = homedir4(), projectDir) {
   const registrations = [];
   for (const config of agentConfigPaths(agent, homeDir, projectDir)) {
     if (!existsSync4(config.path)) continue;
@@ -6586,7 +6760,7 @@ function message(error) {
 
 // src/commands/agent-config.ts
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir3, readFile as readFile5, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir3, readFile as readFile5, rename as rename3, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname5 } from "path";
 async function installAgentSkill(agent, source, homeDir, projectDir) {
   const path = agentSkillPath(agent, homeDir, projectDir);
@@ -6753,7 +6927,7 @@ async function atomicWrite(path, contents) {
   await mkdir3(dirname5(path), { recursive: true });
   const temporaryPath = path + ".topolo-" + process.pid + ".tmp";
   await writeFile3(temporaryPath, contents, { encoding: "utf8", mode: 384 });
-  await rename2(temporaryPath, path);
+  await rename3(temporaryPath, path);
 }
 function withoutMcpServerSections(text2, name) {
   const section = "[mcp_servers." + name + "]";
@@ -6859,8 +7033,8 @@ function resolveTargets(opts) {
     }))];
   }
   if (opts.all) return [...SUPPORTED_AGENT_IDS];
-  const homeDir = opts.homeDir ?? homedir4();
-  const detectBinaries = homeDir === homedir4();
+  const homeDir = opts.homeDir ?? homedir5();
+  const detectBinaries = homeDir === homedir5();
   const detected = SUPPORTED_AGENT_IDS.filter((agent) => agentConfigExists(agent, homeDir, opts.project) || detectBinaries && agentBinaryExists(agent));
   return [.../* @__PURE__ */ new Set(["claude", "codex", ...detected])];
 }
@@ -6921,7 +7095,7 @@ async function installAgentSurfaces(opts) {
   }
   const mcp = resolveMcpCommand();
   const registration = resolveMcpRegistration(opts);
-  const homeDir = opts.homeDir ?? homedir4();
+  const homeDir = opts.homeDir ?? homedir5();
   const results = [];
   for (const agent of resolveTargets({ ...opts, homeDir, project: opts.project })) {
     results.push(await installForAgent(agent, sourceDir, mcp, {
@@ -6956,7 +7130,7 @@ function assertAgentSetupSucceeded(results) {
   }
 }
 async function agentSurfaceStatus(options = {}) {
-  const homeDir = options.homeDir ?? homedir4();
+  const homeDir = options.homeDir ?? homedir5();
   const sourceSkill = await readFile6(join7(skillsSourceDir(), "topolo", "SKILL.md"), "utf8");
   const agents = resolveTargets({
     agent: options.agent,
@@ -6980,7 +7154,7 @@ async function agentSurfaceStatus(options = {}) {
   }));
 }
 async function uninstallAgentSurfaces(options) {
-  const homeDir = options.homeDir ?? homedir4();
+  const homeDir = options.homeDir ?? homedir5();
   const name = options.name?.trim() || "topolo";
   resolveMcpRegistration({ name, ...name === "topolo" ? {} : { context: "uninstall-validation" } });
   const removed = [];
@@ -6991,7 +7165,7 @@ async function uninstallAgentSurfaces(options) {
     const remaining = await readAgentRegistrations(agent, homeDir, options.project);
     const skillPath = agentSkillPath(agent, homeDir, options.project);
     const skillRemoved = remaining.length === 0 && Boolean(skillPath && existsSync6(skillPath));
-    if (skillRemoved && skillPath) await rm3(dirname6(skillPath), { recursive: true, force: true });
+    if (skillRemoved && skillPath) await rm2(dirname6(skillPath), { recursive: true, force: true });
     removed.push({ agent, name, registrationRemoved, skillRemoved });
   }
   return removed;
@@ -7021,7 +7195,7 @@ function formatStatus(rows) {
 
 // src/commands/doctor.ts
 import { access } from "fs/promises";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 import { resolve as resolve3 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -7084,7 +7258,7 @@ async function verifyMcpProtocol(command, args, env = definedEnvironment(process
 }
 async function resolveInstalledDoctorTarget(options) {
   const name = options.name?.trim() || "topolo";
-  const homeDir = options.agentHome ? resolve3(options.agentHome) : homedir5();
+  const homeDir = options.agentHome ? resolve3(options.agentHome) : homedir6();
   const expected = resolveMcpCommand();
   const requestedAgents = resolveTargets({
     ...options,