@topolo/cli 0.13.1 → 0.13.2

package/dist/index.js

@@ -90,7 +90,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.17/node_modules/@topolo/sdk/dist/index.js
+// node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -3187,9 +3187,18 @@ var TopoloOAuth = class {
     if (!res.ok) {
       if (parsed && typeof parsed === "object" && "error" in parsed) {
         const err = parsed;
-        throw new TopoloAuthError(err.error_description || err.error, err.error);
+        throw new TopoloAuthError(err.error_description || err.error, err.error, {
+          status: res.status,
+          service: "auth",
+          path,
+          requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+          retryAfter: res.headers.get("retry-after") ?? void 0
+        });
       }
-      throw new TopoloHttpError("auth", path, res.status, parsed);
+      throw new TopoloHttpError("auth", path, res.status, parsed, void 0, {
+        requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+        retryAfter: res.headers.get("retry-after") ?? void 0
+      });
     }
     return parsed;
   }
@@ -3691,9 +3700,10 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.23.17/node_modules/@topolo/sdk/dist/node/credential-store.js
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
+// node_modules/@topolo/sdk/dist/node/credential-store.js
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2, rename as rename2, link } from "fs/promises";
+import { existsSync as existsSync2, lstatSync, readdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir2, platform } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 import { createHash, randomUUID } from "crypto";
@@ -4101,9 +4111,18 @@ var TopoloOAuth2 = class {
     if (!res.ok) {
       if (parsed && typeof parsed === "object" && "error" in parsed) {
         const err = parsed;
-        throw new TopoloAuthError2(err.error_description || err.error, err.error);
+        throw new TopoloAuthError2(err.error_description || err.error, err.error, {
+          status: res.status,
+          service: "auth",
+          path,
+          requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+          retryAfter: res.headers.get("retry-after") ?? void 0
+        });
       }
-      throw new TopoloHttpError2("auth", path, res.status, parsed);
+      throw new TopoloHttpError2("auth", path, res.status, parsed, void 0, {
+        requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+        retryAfter: res.headers.get("retry-after") ?? void 0
+      });
     }
     return parsed;
   }
@@ -4550,38 +4569,149 @@ async function resolveCredential(environment = selectedEnvironment()) {
 var REFRESH_SKEW_SECONDS = 60;
 var CONFIG_LOCK_RETRY_MS = 25;
 var CONFIG_LOCK_TIMEOUT_MS = 5e3;
-var CONFIG_LOCK_STALE_MS = 12e4;
+var ConfigOwnershipError = class extends TopoloSdkError2 {
+  constructor() {
+    super("state_conflict", "Credential configuration ownership cannot be verified. Retain the unresolved operation instead of starting another renewal.");
+  }
+};
 async function withConfigWriteLock(operation) {
   const lockPath = `${configPath()}.lock`;
   await mkdir2(dirname2(lockPath), { recursive: true });
-  const startedAt = Date.now();
+  const startedAt = performance.now();
   while (true) {
     try {
-      await mkdir2(lockPath);
+      await mkdir2(lockPath, { mode: 448 });
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
-      try {
-        const lock = await stat(lockPath);
-        if (Date.now() - lock.mtimeMs > CONFIG_LOCK_STALE_MS) {
-          await rm2(lockPath, { recursive: true, force: true });
-          continue;
-        }
-      } catch (inspectionError) {
-        if (inspectionError.code !== "ENOENT") throw inspectionError;
-        continue;
-      }
-      if (Date.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
-        throw new Error(`Timed out waiting for credential configuration lock at ${lockPath}.`);
+      if (performance.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
+        throw new TopoloSdkError2("state_conflict", "Credential configuration is still held or unresolved. This waiter did not dispatch a renewal.");
       }
       await new Promise((resolve4) => setTimeout(resolve4, CONFIG_LOCK_RETRY_MS));
     }
   }
+  const directory = await lstat(lockPath);
+  const identity = randomUUID2();
+  const markerName = "owner-" + identity + ".json";
+  const markerPath = join3(lockPath, markerName);
+  const marker = JSON.stringify({ version: 1, identity, pid: process.pid });
+  await writeFile2(markerPath, marker, { flag: "wx", mode: 384 });
+  const assertDirectory = async () => {
+    const current = await lstat(lockPath);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+      throw new ConfigOwnershipError();
+  };
+  const assertOwned = async () => {
+    try {
+      await assertDirectory();
+      const entries = await readdir2(lockPath);
+      if (entries.length !== 1 || entries[0] !== markerName) throw new ConfigOwnershipError();
+      const entry = await lstat(markerPath);
+      if (!entry.isFile() || entry.isSymbolicLink() || await readFile2(markerPath, "utf8") !== marker)
+        throw new ConfigOwnershipError();
+    } catch {
+      throw new ConfigOwnershipError();
+    }
+  };
+  const assertDirectorySync = () => {
+    const current = lstatSync(lockPath);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+      throw new ConfigOwnershipError();
+  };
+  const assertOwnedSync = () => {
+    assertDirectorySync();
+    const entries = readdirSync(lockPath);
+    const entry = lstatSync(markerPath);
+    if (entries.length !== 1 || entries[0] !== markerName || !entry.isFile() || entry.isSymbolicLink() || readFileSync(markerPath, "utf8") !== marker) throw new ConfigOwnershipError();
+  };
+  const persist = async (update) => {
+    const path = configPath();
+    await mkdir2(dirname2(path), { recursive: true });
+    const temporary = join3(dirname2(path), ".credential-write-" + randomUUID2());
+    let temporaryOwned = false;
+    try {
+      assertOwnedSync();
+      const entry = lstatSync(path);
+      if (!entry.isFile() || entry.isSymbolicLink()) throw new ConfigOwnershipError();
+      const before = readFileSync(path, "utf8");
+      const updated = update(JSON.parse(before));
+      const fd = openSync(temporary, "wx", 384);
+      temporaryOwned = true;
+      try {
+        writeFileSync(fd, JSON.stringify(updated, null, 2) + "\n");
+        fsyncSync(fd);
+      } finally {
+        closeSync(fd);
+      }
+      assertOwnedSync();
+      if (readFileSync(path, "utf8") !== before) throw new ConfigOwnershipError();
+      renameSync(temporary, path);
+      temporaryOwned = false;
+    } finally {
+      if (temporaryOwned) unlinkSync(temporary);
+    }
+  };
+  const release = async () => {
+    await assertOwned();
+    const quarantine = join3(dirname2(lockPath), ".credential-release-" + randomUUID2());
+    await mkdir2(quarantine, { mode: 448 });
+    const captured = join3(quarantine, markerName);
+    try {
+      await assertOwned();
+      await rename2(markerPath, captured);
+      assertDirectorySync();
+      const entry = lstatSync(captured);
+      if (!entry.isFile() || entry.isSymbolicLink() || readFileSync(captured, "utf8") !== marker || readdirSync(lockPath).length) throw new ConfigOwnershipError();
+      unlinkSync(captured);
+      rmdirSync(quarantine);
+      assertDirectorySync();
+      if (readdirSync(lockPath).length) throw new ConfigOwnershipError();
+      rmdirSync(lockPath);
+    } catch {
+      if (existsSync2(captured)) {
+        try {
+          await link(captured, markerPath);
+        } catch {
+        }
+      }
+      throw new ConfigOwnershipError();
+    }
+  };
   try {
-    return await operation();
+    await assertOwned();
+    const result = await operation(assertOwned, persist);
+    await assertOwned();
+    return result;
   } finally {
-    await rm2(lockPath, { recursive: true, force: true });
+    await release();
+  }
+}
+function renewalFailure(error) {
+  const path = "/api/developer-oauth/token";
+  if (error instanceof ConfigOwnershipError) return new ConfigOwnershipError();
+  if (error instanceof TopoloAuthError2 && error.code === "invalid_grant") {
+    return new TopoloAuthError2("The saved Topolo sign-in can no longer be renewed. Sign in again.", "invalid_grant", {
+      status: error.status,
+      service: "auth",
+      path,
+      requestId: error.requestId
+    });
+  }
+  if (error instanceof TopoloAuthError2 || error instanceof TopoloHttpError2) {
+    return new TopoloHttpError2(
+      "auth",
+      path,
+      error.status,
+      void 0,
+      "Topolo sign-in renewal failed. Retry the request; the saved sign-in has been retained.",
+      { requestId: error.requestId, retryAfter: error.retryAfter }
+    );
   }
+  const timeout = error instanceof Error && ["AbortError", "TimeoutError"].includes(error.name);
+  return new TopoloSdkError2(
+    timeout ? "request_timeout" : "network_error",
+    "Topolo sign-in renewal could not reach Auth. Retry the request; the saved sign-in has been retained."
+  );
 }
 async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
@@ -4591,16 +4721,16 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   const observedProfile = profileForEnvironment(await readConfig(), environment);
   const observed = observedProfile.credential;
   if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !observedProfile.oauthClientId || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
-  return withConfigWriteLock(async () => {
+  return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
     const profile = profileForEnvironment(config, environment);
     const cred = profile.credential;
     if (!cred || cred.kind !== "access_token") return cred ?? null;
     if (!cred.refreshToken || !profile.oauthClientId) return cred;
-    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken) {
+    const now = Math.floor(Date.now() / 1e3);
+    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken && cred.expiresAt !== void 0 && cred.expiresAt > now) {
       return cred;
     }
-    const now = Math.floor(Date.now() / 1e3);
     if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
     const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
     if (environment === "local" && !serviceUrls?.auth) {
@@ -4623,23 +4753,27 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
         ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
         expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
       };
-      const activeContext = profile.activeContext;
-      const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
-      const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
-        credential: refreshed,
-        contexts: {
-          ...profile.contexts ?? {},
-          [activeContext]: {
+      await persist((current) => {
+        const latest = profileForEnvironment(current, environment);
+        const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+        if (!same(latest.credential, cred) || latest.oauthClientId !== profile.oauthClientId || latest.activeContext !== profile.activeContext)
+          throw new ConfigOwnershipError();
+        const activeContext = latest.activeContext;
+        const activeEntry = activeContext ? latest.contexts?.[activeContext] : void 0;
+        const previousEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+        if (!same(activeEntry?.credential, previousEntry?.credential)) throw new ConfigOwnershipError();
+        return activeContext && activeEntry ? writeProfileConfig(current, environment, {
+          credential: refreshed,
+          contexts: { ...latest.contexts, [activeContext]: {
             ...activeEntry,
             credential: refreshed,
-            oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
-          }
-        }
-      }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
-      await writeConfig(updated);
+            oauthClientId: activeEntry.oauthClientId ?? latest.oauthClientId
+          } }
+        }) : environment === "production" && !current.profiles?.production ? { ...current, credential: refreshed } : writeProfileConfig(current, environment, { credential: refreshed });
+      });
       return refreshed;
-    } catch {
-      return cred;
+    } catch (error) {
+      throw renewalFailure(error);
     }
   });
 }
@@ -4648,7 +4782,7 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
   const observedContext = observedProfile.contexts?.[key];
   const observed = observedContext?.credential;
   if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !(observedContext.oauthClientId ?? observedProfile.oauthClientId) || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
-  return withConfigWriteLock(async () => {
+  return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
     const profile = profileForEnvironment(config, environment);
     const context = profile.contexts?.[key];
@@ -4657,6 +4791,7 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
     const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
     if (!credential.refreshToken || !oauthClientId) return credential;
     const now = Math.floor(Date.now() / 1e3);
+    if (options.force && observed.accessToken !== credential.accessToken && credential.expiresAt !== void 0 && credential.expiresAt > now) return credential;
     if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
     const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
     if (environment === "local" && !serviceUrls?.auth) {
@@ -4677,16 +4812,21 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
         ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
         expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
       };
-      await writeConfig(writeProfileConfig(config, environment, {
-        ...profile.activeContext === key ? { credential: refreshed } : {},
-        contexts: {
-          ...profile.contexts ?? {},
-          [key]: { ...context, credential: refreshed, oauthClientId }
-        }
-      }));
+      await persist((current) => {
+        const latest = profileForEnvironment(current, environment);
+        const latestContext = latest.contexts?.[key];
+        if (!latestContext || JSON.stringify(latestContext.credential) !== JSON.stringify(credential) || (latestContext.oauthClientId ?? latest.oauthClientId) !== oauthClientId || latestContext.contextType !== context.contextType || latestContext.organizationId !== context.organizationId)
+          throw new ConfigOwnershipError();
+        if (latest.activeContext === key && JSON.stringify(latest.credential) !== JSON.stringify(profile.activeContext === key ? profile.credential : credential))
+          throw new ConfigOwnershipError();
+        return writeProfileConfig(current, environment, {
+          ...latest.activeContext === key ? { credential: refreshed } : {},
+          contexts: { ...latest.contexts, [key]: { ...latestContext, credential: refreshed, oauthClientId } }
+        });
+      });
       return refreshed;
-    } catch {
-      return credential;
+    } catch (error) {
+      throw renewalFailure(error);
     }
   });
 }
@@ -4845,7 +4985,7 @@ function normalizeError(err) {
 }
 
 // src/version.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function readCliVersion() {
@@ -4857,7 +4997,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path, "utf8"));
+        const pkg = JSON.parse(readFileSync2(path, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -5193,19 +5333,19 @@ function formatPretty(info) {
 
 // src/commands/actions.ts
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { platform as platform3 } from "os";
 import { basename, extname } from "path";
 
 // src/json-input.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 function parseJsonInput(value) {
   let source = value;
   if (value.startsWith("@")) {
     const path = value.slice(1);
     if (!path) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path, "utf8");
+      source = readFileSync3(path, "utf8");
     } catch (err) {
       throw new Error(`Could not read --data file ${path}: ${err.message}`);
     }
@@ -5402,7 +5542,7 @@ Approval required. ${opened ? "Opening" : "Open"} ${approval.verificationUrl}` :
       const resource = parseResourceOption(opts.resourceType, opts.resourceId);
       const result = await topolo.client.uploadAction(
         action,
-        readFileSync3(opts.file),
+        readFileSync4(opts.file),
         parseJsonObject(opts.data || "{}"),
         {
           fileName: basename(opts.file),
@@ -5974,7 +6114,7 @@ function normalizeList(values, fallback = []) {
 }
 
 // src/commands/integrations.ts
-import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "fs/promises";
+import { readdir as readdir3, readFile as readFile3, stat } from "fs/promises";
 import { join as join5, relative } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
@@ -6128,7 +6268,7 @@ async function collectFiles(repoRoot) {
   const root = repoRoot;
   async function walk(dir) {
     if (result.length > 2e3) return;
-    const entries = await readdir2(dir, { withFileTypes: true });
+    const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
       const fullPath = join5(dir, entry.name);
       if (entry.isDirectory()) {
@@ -6137,7 +6277,7 @@ async function collectFiles(repoRoot) {
         continue;
       }
       if (!entry.isFile() || !isInspectable(entry.name)) continue;
-      const info = await stat2(fullPath);
+      const info = await stat(fullPath);
       if (info.size > 25e4) continue;
       result.push({
         path: relative(root, fullPath),
@@ -6159,7 +6299,7 @@ function formatCheckResult(result) {
 // src/commands/skills.ts
 import { spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync6 } from "fs";
-import { readFile as readFile6, rm as rm3 } from "fs/promises";
+import { readFile as readFile6, rm as rm2 } from "fs/promises";
 import { homedir as homedir5 } from "os";
 import { dirname as dirname6, join as join7, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -6620,7 +6760,7 @@ function message(error) {
 
 // src/commands/agent-config.ts
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir3, readFile as readFile5, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir3, readFile as readFile5, rename as rename3, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname5 } from "path";
 async function installAgentSkill(agent, source, homeDir, projectDir) {
   const path = agentSkillPath(agent, homeDir, projectDir);
@@ -6787,7 +6927,7 @@ async function atomicWrite(path, contents) {
   await mkdir3(dirname5(path), { recursive: true });
   const temporaryPath = path + ".topolo-" + process.pid + ".tmp";
   await writeFile3(temporaryPath, contents, { encoding: "utf8", mode: 384 });
-  await rename2(temporaryPath, path);
+  await rename3(temporaryPath, path);
 }
 function withoutMcpServerSections(text2, name) {
   const section = "[mcp_servers." + name + "]";
@@ -7025,7 +7165,7 @@ async function uninstallAgentSurfaces(options) {
     const remaining = await readAgentRegistrations(agent, homeDir, options.project);
     const skillPath = agentSkillPath(agent, homeDir, options.project);
     const skillRemoved = remaining.length === 0 && Boolean(skillPath && existsSync6(skillPath));
-    if (skillRemoved && skillPath) await rm3(dirname6(skillPath), { recursive: true, force: true });
+    if (skillRemoved && skillPath) await rm2(dirname6(skillPath), { recursive: true, force: true });
     removed.push({ agent, name, registrationRemoved, skillRemoved });
   }
   return removed;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.1",
-  "topoloPublishedVersion": "0.13.1",
+  "version": "0.13.2",
+  "topoloPublishedVersion": "0.13.2",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -31,8 +31,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.14.22",
-    "@topolo/sdk": "0.23.17",
+    "@topolo/mcp": "0.14.23",
+    "@topolo/sdk": "0.23.18",
     "commander": "^12.1.0",
     "undici": "6.29.0"
   },