@topolo/cli 0.13.1 → 0.13.3

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/commands/agent-packs.ts
 import { spawnSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync, readFileSync } from "fs";
 import { dirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { homedir } from "os";
@@ -10,7 +10,7 @@ function registerAgentPacksCommand(program2) {
   const packs = program2.command("agent-packs").description("Install and operate Topolo Agent Packs in supported local hosts").option("--store <path>", "Portable pack library (default ~/AgentPacks)");
   packs.command("configure").description("Qualify and configure an adopted Claude roster through its live native backend").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
     if (options.harness !== "claude") throw new Error("Native configure is currently qualified only for Claude Desktop.");
-    const { configureClaudePack } = await import("./claude-pack-backend-IDQQX3DG.js");
+    const { configureClaudePack } = await import("./claude-pack-backend-5DWMIDRA.js");
     const result = await configureClaudePack({
       store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
       pack,
@@ -34,6 +34,8 @@ function registerAgentPacksCommand(program2) {
     "recover",
     "doctor",
     "policy",
+    "permissions",
+    "approvals",
     "remote-recover",
     "connect",
     "remote-context",
@@ -44,12 +46,38 @@ function registerAgentPacksCommand(program2) {
   for (const name of commands) {
     const command = packs.command(name).description(name === "add" ? "Add an installed or bundled pack, group, or agent" : `Run the pack ${name} operation`);
     if (name === "switch" || name === "recover") command.option("--policy <path>", "Reviewed policy for an adopted Claude roster").option("--endpoint <url>", "Explicit authorized Claude main-process inspector endpoint").option("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply a native switch; recovery is always read-only");
+    if (name === "approvals") command.option("--intake <id>", "Exact owning native intake identity").option("--fingerprint <hash>", "Exact pending native request fingerprint").option("--response <path>", "Recorded one-request response JSON").option("--human-decision-recorded", "Assert that the exact human decision is recorded in the intake");
     command.option("--harness <name>", "Local host adapter (codex, claude Desktop Code sessions)", "codex").option("--adapter-help", "Show every option supported by the selected adapter").argument("[arguments...]").allowUnknownOption().allowExcessArguments().addHelpText("after", name === "add" ? "\nExamples:\n  topolo agent-packs add founder\n  topolo agent-packs add founder --group specialists\n  topolo agent-packs add founder --agent strategy\n" : "\nRun topolo agent-packs <command> --adapter-help for all adapter options. Cloud commands require explicit --environment and --context-key.\n").action(async (args, options) => {
       if (!["codex", "claude"].includes(options.harness)) throw new Error(`The ${options.harness} pack adapter is not available. Supported adapters: codex, claude.`);
+      if (name === "approvals" && options.harness === "claude" && !options.adapterHelp) {
+        if (!["list", "details", "respond"].includes(args[0] ?? "") || args.length > 2)
+          throw new Error("Approvals requires list, details KEY, or respond KEY.");
+        if (args[0] !== "list" && (!args[1] || !options.intake || !options.fingerprint))
+          throw new Error("Exact request key, owning intake and fingerprint required.");
+        let decision;
+        if (args[0] === "respond") {
+          if (!options.response || !options.humanDecisionRecorded) throw new Error("Recorded human response required.");
+          const response = JSON.parse(readFileSync(options.response, "utf8"));
+          if (Object.keys(response).join(",") !== "decision" || !["once", "deny"].includes(response.decision))
+            throw new Error("Only a one-request once/deny response is supported.");
+          decision = response.decision;
+        }
+        const { operateClaudeApprovals } = await import("./claude-pack-backend-5DWMIDRA.js");
+        console.log(JSON.stringify(await operateClaudeApprovals({
+          store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
+          kind: args[0],
+          key: args[1],
+          intake: options.intake,
+          fingerprint: options.fingerprint,
+          decision,
+          humanDecisionRecorded: options.humanDecisionRecorded
+        }), null, 2));
+        return;
+      }
       if (options.policy || options.endpoint || options.pid || options.apply) {
         if (options.harness !== "claude" || !options.policy || !options.endpoint || !options.pid || args.length !== 1)
           throw new Error("Native switch/recovery requires one Claude pack, --policy, --endpoint and --pid.");
-        const { configureClaudePack } = await import("./claude-pack-backend-IDQQX3DG.js");
+        const { configureClaudePack } = await import("./claude-pack-backend-5DWMIDRA.js");
         const result2 = await configureClaudePack({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           pack: args[0],
@@ -67,6 +95,12 @@ function registerAgentPacksCommand(program2) {
       if (!adapter) throw new Error("This CLI installation is missing its bundled Topolo Agent Pack adapter. Reinstall @topolo/cli.");
       const store = packs.opts().store;
       const forwarded = (options.adapterHelp ? ["--help"] : args).map((value) => value === "--group" ? "--set" : value);
+      if (name === "approvals" && !options.adapterHelp) {
+        if (options.intake) forwarded.push("--intake", options.intake);
+        if (options.fingerprint) forwarded.push("--fingerprint", options.fingerprint);
+        if (options.response) forwarded.push("--response", options.response);
+        if (options.humanDecisionRecorded) forwarded.push("--human-decision-recorded");
+      }
       const result = spawnSync("python3", [
         adapter,
         ...store ? ["--store", store] : [],
@@ -90,7 +124,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.17/node_modules/@topolo/sdk/dist/index.js
+// node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -3187,9 +3221,18 @@ var TopoloOAuth = class {
     if (!res.ok) {
       if (parsed && typeof parsed === "object" && "error" in parsed) {
         const err = parsed;
-        throw new TopoloAuthError(err.error_description || err.error, err.error);
+        throw new TopoloAuthError(err.error_description || err.error, err.error, {
+          status: res.status,
+          service: "auth",
+          path,
+          requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+          retryAfter: res.headers.get("retry-after") ?? void 0
+        });
       }
-      throw new TopoloHttpError("auth", path, res.status, parsed);
+      throw new TopoloHttpError("auth", path, res.status, parsed, void 0, {
+        requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+        retryAfter: res.headers.get("retry-after") ?? void 0
+      });
     }
     return parsed;
   }
@@ -3691,9 +3734,10 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.23.17/node_modules/@topolo/sdk/dist/node/credential-store.js
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
+// node_modules/@topolo/sdk/dist/node/credential-store.js
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2, rename as rename2, link } from "fs/promises";
+import { existsSync as existsSync2, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir2, platform } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 import { createHash, randomUUID } from "crypto";
@@ -4101,9 +4145,18 @@ var TopoloOAuth2 = class {
     if (!res.ok) {
       if (parsed && typeof parsed === "object" && "error" in parsed) {
         const err = parsed;
-        throw new TopoloAuthError2(err.error_description || err.error, err.error);
+        throw new TopoloAuthError2(err.error_description || err.error, err.error, {
+          status: res.status,
+          service: "auth",
+          path,
+          requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+          retryAfter: res.headers.get("retry-after") ?? void 0
+        });
       }
-      throw new TopoloHttpError2("auth", path, res.status, parsed);
+      throw new TopoloHttpError2("auth", path, res.status, parsed, void 0, {
+        requestId: res.headers.get("x-topolo-request-id") ?? res.headers.get("x-request-id") ?? void 0,
+        retryAfter: res.headers.get("retry-after") ?? void 0
+      });
     }
     return parsed;
   }
@@ -4550,39 +4603,150 @@ async function resolveCredential(environment = selectedEnvironment()) {
 var REFRESH_SKEW_SECONDS = 60;
 var CONFIG_LOCK_RETRY_MS = 25;
 var CONFIG_LOCK_TIMEOUT_MS = 5e3;
-var CONFIG_LOCK_STALE_MS = 12e4;
+var ConfigOwnershipError = class extends TopoloSdkError2 {
+  constructor() {
+    super("state_conflict", "Credential configuration ownership cannot be verified. Retain the unresolved operation instead of starting another renewal.");
+  }
+};
 async function withConfigWriteLock(operation) {
   const lockPath = `${configPath()}.lock`;
   await mkdir2(dirname2(lockPath), { recursive: true });
-  const startedAt = Date.now();
+  const startedAt = performance.now();
   while (true) {
     try {
-      await mkdir2(lockPath);
+      await mkdir2(lockPath, { mode: 448 });
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
-      try {
-        const lock = await stat(lockPath);
-        if (Date.now() - lock.mtimeMs > CONFIG_LOCK_STALE_MS) {
-          await rm2(lockPath, { recursive: true, force: true });
-          continue;
-        }
-      } catch (inspectionError) {
-        if (inspectionError.code !== "ENOENT") throw inspectionError;
-        continue;
-      }
-      if (Date.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
-        throw new Error(`Timed out waiting for credential configuration lock at ${lockPath}.`);
+      if (performance.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
+        throw new TopoloSdkError2("state_conflict", "Credential configuration is still held or unresolved. This waiter did not dispatch a renewal.");
       }
       await new Promise((resolve4) => setTimeout(resolve4, CONFIG_LOCK_RETRY_MS));
     }
   }
+  const directory = await lstat(lockPath);
+  const identity = randomUUID2();
+  const markerName = "owner-" + identity + ".json";
+  const markerPath = join3(lockPath, markerName);
+  const marker = JSON.stringify({ version: 1, identity, pid: process.pid });
+  await writeFile2(markerPath, marker, { flag: "wx", mode: 384 });
+  const assertDirectory = async () => {
+    const current = await lstat(lockPath);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+      throw new ConfigOwnershipError();
+  };
+  const assertOwned = async () => {
+    try {
+      await assertDirectory();
+      const entries = await readdir2(lockPath);
+      if (entries.length !== 1 || entries[0] !== markerName) throw new ConfigOwnershipError();
+      const entry = await lstat(markerPath);
+      if (!entry.isFile() || entry.isSymbolicLink() || await readFile2(markerPath, "utf8") !== marker)
+        throw new ConfigOwnershipError();
+    } catch {
+      throw new ConfigOwnershipError();
+    }
+  };
+  const assertDirectorySync = () => {
+    const current = lstatSync(lockPath);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+      throw new ConfigOwnershipError();
+  };
+  const assertOwnedSync = () => {
+    assertDirectorySync();
+    const entries = readdirSync(lockPath);
+    const entry = lstatSync(markerPath);
+    if (entries.length !== 1 || entries[0] !== markerName || !entry.isFile() || entry.isSymbolicLink() || readFileSync2(markerPath, "utf8") !== marker) throw new ConfigOwnershipError();
+  };
+  const persist = async (update) => {
+    const path = configPath();
+    await mkdir2(dirname2(path), { recursive: true });
+    const temporary = join3(dirname2(path), ".credential-write-" + randomUUID2());
+    let temporaryOwned = false;
+    try {
+      assertOwnedSync();
+      const entry = lstatSync(path);
+      if (!entry.isFile() || entry.isSymbolicLink()) throw new ConfigOwnershipError();
+      const before = readFileSync2(path, "utf8");
+      const updated = update(JSON.parse(before));
+      const fd = openSync(temporary, "wx", 384);
+      temporaryOwned = true;
+      try {
+        writeFileSync(fd, JSON.stringify(updated, null, 2) + "\n");
+        fsyncSync(fd);
+      } finally {
+        closeSync(fd);
+      }
+      assertOwnedSync();
+      if (readFileSync2(path, "utf8") !== before) throw new ConfigOwnershipError();
+      renameSync(temporary, path);
+      temporaryOwned = false;
+    } finally {
+      if (temporaryOwned) unlinkSync(temporary);
+    }
+  };
+  const release = async () => {
+    await assertOwned();
+    const quarantine = join3(dirname2(lockPath), ".credential-release-" + randomUUID2());
+    await mkdir2(quarantine, { mode: 448 });
+    const captured = join3(quarantine, markerName);
+    try {
+      await assertOwned();
+      await rename2(markerPath, captured);
+      assertDirectorySync();
+      const entry = lstatSync(captured);
+      if (!entry.isFile() || entry.isSymbolicLink() || readFileSync2(captured, "utf8") !== marker || readdirSync(lockPath).length) throw new ConfigOwnershipError();
+      unlinkSync(captured);
+      rmdirSync(quarantine);
+      assertDirectorySync();
+      if (readdirSync(lockPath).length) throw new ConfigOwnershipError();
+      rmdirSync(lockPath);
+    } catch {
+      if (existsSync2(captured)) {
+        try {
+          await link(captured, markerPath);
+        } catch {
+        }
+      }
+      throw new ConfigOwnershipError();
+    }
+  };
   try {
-    return await operation();
+    await assertOwned();
+    const result = await operation(assertOwned, persist);
+    await assertOwned();
+    return result;
   } finally {
-    await rm2(lockPath, { recursive: true, force: true });
+    await release();
   }
 }
+function renewalFailure(error) {
+  const path = "/api/developer-oauth/token";
+  if (error instanceof ConfigOwnershipError) return new ConfigOwnershipError();
+  if (error instanceof TopoloAuthError2 && error.code === "invalid_grant") {
+    return new TopoloAuthError2("The saved Topolo sign-in can no longer be renewed. Sign in again.", "invalid_grant", {
+      status: error.status,
+      service: "auth",
+      path,
+      requestId: error.requestId
+    });
+  }
+  if (error instanceof TopoloAuthError2 || error instanceof TopoloHttpError2) {
+    return new TopoloHttpError2(
+      "auth",
+      path,
+      error.status,
+      void 0,
+      "Topolo sign-in renewal failed. Retry the request; the saved sign-in has been retained.",
+      { requestId: error.requestId, retryAfter: error.retryAfter }
+    );
+  }
+  const timeout = error instanceof Error && ["AbortError", "TimeoutError"].includes(error.name);
+  return new TopoloSdkError2(
+    timeout ? "request_timeout" : "network_error",
+    "Topolo sign-in renewal could not reach Auth. Retry the request; the saved sign-in has been retained."
+  );
+}
 async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
   const prefix = envVarPrefix(environment);
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
@@ -4591,16 +4755,16 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   const observedProfile = profileForEnvironment(await readConfig(), environment);
   const observed = observedProfile.credential;
   if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !observedProfile.oauthClientId || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
-  return withConfigWriteLock(async () => {
+  return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
     const profile = profileForEnvironment(config, environment);
     const cred = profile.credential;
     if (!cred || cred.kind !== "access_token") return cred ?? null;
     if (!cred.refreshToken || !profile.oauthClientId) return cred;
-    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken) {
+    const now = Math.floor(Date.now() / 1e3);
+    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken && cred.expiresAt !== void 0 && cred.expiresAt > now) {
       return cred;
     }
-    const now = Math.floor(Date.now() / 1e3);
     if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
     const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
     if (environment === "local" && !serviceUrls?.auth) {
@@ -4623,23 +4787,27 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
         ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
         expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
       };
-      const activeContext = profile.activeContext;
-      const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
-      const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
-        credential: refreshed,
-        contexts: {
-          ...profile.contexts ?? {},
-          [activeContext]: {
+      await persist((current) => {
+        const latest = profileForEnvironment(current, environment);
+        const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+        if (!same(latest.credential, cred) || latest.oauthClientId !== profile.oauthClientId || latest.activeContext !== profile.activeContext)
+          throw new ConfigOwnershipError();
+        const activeContext = latest.activeContext;
+        const activeEntry = activeContext ? latest.contexts?.[activeContext] : void 0;
+        const previousEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+        if (!same(activeEntry?.credential, previousEntry?.credential)) throw new ConfigOwnershipError();
+        return activeContext && activeEntry ? writeProfileConfig(current, environment, {
+          credential: refreshed,
+          contexts: { ...latest.contexts, [activeContext]: {
             ...activeEntry,
             credential: refreshed,
-            oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
-          }
-        }
-      }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
-      await writeConfig(updated);
+            oauthClientId: activeEntry.oauthClientId ?? latest.oauthClientId
+          } }
+        }) : environment === "production" && !current.profiles?.production ? { ...current, credential: refreshed } : writeProfileConfig(current, environment, { credential: refreshed });
+      });
       return refreshed;
-    } catch {
-      return cred;
+    } catch (error) {
+      throw renewalFailure(error);
     }
   });
 }
@@ -4648,7 +4816,7 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
   const observedContext = observedProfile.contexts?.[key];
   const observed = observedContext?.credential;
   if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !(observedContext.oauthClientId ?? observedProfile.oauthClientId) || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
-  return withConfigWriteLock(async () => {
+  return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
     const profile = profileForEnvironment(config, environment);
     const context = profile.contexts?.[key];
@@ -4657,6 +4825,7 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
     const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
     if (!credential.refreshToken || !oauthClientId) return credential;
     const now = Math.floor(Date.now() / 1e3);
+    if (options.force && observed.accessToken !== credential.accessToken && credential.expiresAt !== void 0 && credential.expiresAt > now) return credential;
     if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
     const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
     if (environment === "local" && !serviceUrls?.auth) {
@@ -4677,16 +4846,21 @@ async function refreshContextCredentialIfNeeded(environment, key, options = {})
         ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
         expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
       };
-      await writeConfig(writeProfileConfig(config, environment, {
-        ...profile.activeContext === key ? { credential: refreshed } : {},
-        contexts: {
-          ...profile.contexts ?? {},
-          [key]: { ...context, credential: refreshed, oauthClientId }
-        }
-      }));
+      await persist((current) => {
+        const latest = profileForEnvironment(current, environment);
+        const latestContext = latest.contexts?.[key];
+        if (!latestContext || JSON.stringify(latestContext.credential) !== JSON.stringify(credential) || (latestContext.oauthClientId ?? latest.oauthClientId) !== oauthClientId || latestContext.contextType !== context.contextType || latestContext.organizationId !== context.organizationId)
+          throw new ConfigOwnershipError();
+        if (latest.activeContext === key && JSON.stringify(latest.credential) !== JSON.stringify(profile.activeContext === key ? profile.credential : credential))
+          throw new ConfigOwnershipError();
+        return writeProfileConfig(current, environment, {
+          ...latest.activeContext === key ? { credential: refreshed } : {},
+          contexts: { ...latest.contexts, [key]: { ...latestContext, credential: refreshed, oauthClientId } }
+        });
+      });
       return refreshed;
-    } catch {
-      return credential;
+    } catch (error) {
+      throw renewalFailure(error);
     }
   });
 }
@@ -4845,7 +5019,7 @@ function normalizeError(err) {
 }
 
 // src/version.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function readCliVersion() {
@@ -4857,7 +5031,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync(path, "utf8"));
+        const pkg = JSON.parse(readFileSync3(path, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -5193,19 +5367,19 @@ function formatPretty(info) {
 
 // src/commands/actions.ts
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { platform as platform3 } from "os";
 import { basename, extname } from "path";
 
 // src/json-input.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 function parseJsonInput(value) {
   let source = value;
   if (value.startsWith("@")) {
     const path = value.slice(1);
     if (!path) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync2(path, "utf8");
+      source = readFileSync4(path, "utf8");
     } catch (err) {
       throw new Error(`Could not read --data file ${path}: ${err.message}`);
     }
@@ -5402,7 +5576,7 @@ Approval required. ${opened ? "Opening" : "Open"} ${approval.verificationUrl}` :
       const resource = parseResourceOption(opts.resourceType, opts.resourceId);
       const result = await topolo.client.uploadAction(
         action,
-        readFileSync3(opts.file),
+        readFileSync5(opts.file),
         parseJsonObject(opts.data || "{}"),
         {
           fileName: basename(opts.file),
@@ -5974,7 +6148,7 @@ function normalizeList(values, fallback = []) {
 }
 
 // src/commands/integrations.ts
-import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "fs/promises";
+import { readdir as readdir3, readFile as readFile3, stat } from "fs/promises";
 import { join as join5, relative } from "path";
 function registerIntegrationsCommand(program2) {
   const integrations = program2.command("integrations").description("Generate and validate Topolo integration handoffs.");
@@ -6128,7 +6302,7 @@ async function collectFiles(repoRoot) {
   const root = repoRoot;
   async function walk(dir) {
     if (result.length > 2e3) return;
-    const entries = await readdir2(dir, { withFileTypes: true });
+    const entries = await readdir3(dir, { withFileTypes: true });
     for (const entry of entries) {
       const fullPath = join5(dir, entry.name);
       if (entry.isDirectory()) {
@@ -6137,7 +6311,7 @@ async function collectFiles(repoRoot) {
         continue;
       }
       if (!entry.isFile() || !isInspectable(entry.name)) continue;
-      const info = await stat2(fullPath);
+      const info = await stat(fullPath);
       if (info.size > 25e4) continue;
       result.push({
         path: relative(root, fullPath),
@@ -6159,7 +6333,7 @@ function formatCheckResult(result) {
 // src/commands/skills.ts
 import { spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync6 } from "fs";
-import { readFile as readFile6, rm as rm3 } from "fs/promises";
+import { readFile as readFile6, rm as rm2 } from "fs/promises";
 import { homedir as homedir5 } from "os";
 import { dirname as dirname6, join as join7, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
@@ -6620,7 +6794,7 @@ function message(error) {
 
 // src/commands/agent-config.ts
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir3, readFile as readFile5, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir3, readFile as readFile5, rename as rename3, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname5 } from "path";
 async function installAgentSkill(agent, source, homeDir, projectDir) {
   const path = agentSkillPath(agent, homeDir, projectDir);
@@ -6787,7 +6961,7 @@ async function atomicWrite(path, contents) {
   await mkdir3(dirname5(path), { recursive: true });
   const temporaryPath = path + ".topolo-" + process.pid + ".tmp";
   await writeFile3(temporaryPath, contents, { encoding: "utf8", mode: 384 });
-  await rename2(temporaryPath, path);
+  await rename3(temporaryPath, path);
 }
 function withoutMcpServerSections(text2, name) {
   const section = "[mcp_servers." + name + "]";
@@ -7025,7 +7199,7 @@ async function uninstallAgentSurfaces(options) {
     const remaining = await readAgentRegistrations(agent, homeDir, options.project);
     const skillPath = agentSkillPath(agent, homeDir, options.project);
     const skillRemoved = remaining.length === 0 && Boolean(skillPath && existsSync6(skillPath));
-    if (skillRemoved && skillPath) await rm3(dirname6(skillPath), { recursive: true, force: true });
+    if (skillRemoved && skillPath) await rm2(dirname6(skillPath), { recursive: true, force: true });
     removed.push({ agent, name, registrationRemoved, skillRemoved });
   }
   return removed;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.1",
-  "topoloPublishedVersion": "0.13.1",
+  "version": "0.13.3",
+  "topoloPublishedVersion": "0.13.3",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -27,12 +27,12 @@
     "test:watch": "vitest",
     "coverage": "pnpm run coverage:node && pnpm run coverage:adapter",
     "coverage:node": "vitest run --coverage",
-    "coverage:adapter": "python3 -m venv node_modules/.cache/agent-pack-test && node_modules/.cache/agent-pack-test/bin/python -m pip install --disable-pip-version-check --quiet --timeout 15 --retries 0 -r agent-packs/requirements-test.txt && PYTHONPATH=agent-packs/src COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage run --branch --source=topolo_agent_pack.topolo,topolo_agent_pack.claude,topolo_agent_pack.policy -m unittest discover -s agent-packs/tests && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage report --fail-under=100"
+    "coverage:adapter": "python3 -m venv node_modules/.cache/agent-pack-test && node_modules/.cache/agent-pack-test/bin/python -m pip install --disable-pip-version-check --quiet --timeout 15 --retries 0 -r agent-packs/requirements-test.txt && PYTHONPATH=agent-packs/src:agent-packs COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage run --branch --source=topolo_agent_pack.topolo,topolo_agent_pack.claude,topolo_agent_pack.policy,topolo_agent_pack.permissions,topolo_agent_pack.approvals,topolo_agent_pack.execution,topolo_agent_pack.live,topolo_agent_pack.cli,coverage_changed -m unittest discover -s agent-packs/tests && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage report && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage report --include='*/topolo_agent_pack/topolo.py,*/topolo_agent_pack/claude.py,*/topolo_agent_pack/policy.py,*/topolo_agent_pack/permissions.py,*/topolo_agent_pack/approvals.py,*/topolo_agent_pack/execution.py,*/agent-packs/coverage_changed.py' --fail-under=100 && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage json -o node_modules/.cache/agent-pack-test/coverage.json && node_modules/.cache/agent-pack-test/bin/python agent-packs/coverage_changed.py"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.14.22",
-    "@topolo/sdk": "0.23.17",
+    "@topolo/mcp": "0.14.23",
+    "@topolo/sdk": "0.23.18",
     "commander": "^12.1.0",
     "undici": "6.29.0"
   },