@topolo/cli 0.13.10 → 0.13.12

package/agent-packs/src/topolo_agent_pack/topolo.py

@@ -5,22 +5,60 @@ from .storage import PackError,atomic_json,canonical,read_json,safe_id
 class ConnectionSourceRefused(PackError):
     pass
 
+def managed_runtime_selection(path):
+    """Configuration custody only, never a health or native permission ACK."""
+    from . import live
+    before,raw=live.adoption_snapshot(path)
+    live.adoption_require(before['mode']==0o600 and len(raw)<=2*1024*1024,'private runtime descriptor required')
+    value=json.loads(raw)
+    live.adoption_keys(value,['schemaVersion','library','ownerGeneration','profile','runtime','preserve'])
+    live.adoption_require(value['schemaVersion']==1 and type(value['schemaVersion']) is int and
+                          pathlib.Path(path).parent==pathlib.Path(value['library'])/'launchers','owned runtime descriptor location required')
+    live.adoption_read_inputs(value)
+    live.adoption_pin(value['ownerGeneration'],value['profile'])
+    env=live.adoption_runtime(value['runtime'],value['profile'])
+    for pin in value['preserve']:live.adoption_pin(pin,value['profile'])
+    live.adoption_require(live.adoption_snapshot(path,profile=value['profile'])[0]==before,'runtime descriptor changed')
+    return value,env
+
+
+def managed_mcp_main(path,args=()):
+    from .live import adoption_require
+    adoption_require(len(args)<=1 and all(isinstance(v,str) and re.fullmatch(r'[A-Za-z0-9_-]+',v) for v in args),'closed MCP agent name required')
+    value,env=managed_runtime_selection(path)
+    if args:env['TOPOLO_AGENT_NAME']=args[0]
+    runtime=value['runtime']
+    # Only a later owner-admitted ordinary native startup invokes this wrapper.
+    # Credential resolution/refresh/identity are real private effects, not preflight.
+    # Replace this wrapper, retaining the native host's PID/stdin/cancellation
+    # custody instead of leaving an intermediate parent that can orphan MCP.
+    return os.execve(runtime['node']['path'],[runtime['node']['path'],runtime['mcp']['path']],env)
+
+
 class Client:
-    def __init__(self,environment,context,binary=None):
+    def __init__(self,environment,context,binary=None,env=None,node=None):
         if environment not in {'development','staging','production'}:
             raise PackError('Explicit Topolo environment required')
         if not context or any(c in context for c in '\n\r'):
             raise PackError('Explicit Topolo context required')
-        if any(os.environ.get(k) for k in ['TOPOLO_API_KEY','TOPOLO_ACCESS_TOKEN','TOPOLO_'+environment.upper()+'_API_KEY','TOPOLO_'+environment.upper()+'_ACCESS_TOKEN']):
+        selected=os.environ if env is None else env
+        descriptor=selected.get('TOPOLO_AGENT_PACK_RUNTIME')
+        if descriptor:
+            value,selected=managed_runtime_selection(descriptor)
+            if (environment!=value['profile']['environment'] or context!=value['profile']['contextKey'] or binary is not None or node is not None):
+                raise ConnectionSourceRefused('Managed private runtime tuple or explicit override differs')
+            binary=value['runtime']['cli']['path'];node=value['runtime']['node']['path']
+        if any(selected.get(k) for k in ['TOPOLO_API_KEY','TOPOLO_ACCESS_TOKEN','TOPOLO_'+environment.upper()+'_API_KEY','TOPOLO_'+environment.upper()+'_ACCESS_TOKEN']):
             raise PackError('Pinned connections require the CLI protected account context, not injected credentials')
         self.environment=environment;self.context=context
         self.binary=binary or shutil.which('topolo')
         if not self.binary:
             raise PackError('Install the public @topolo/cli and authenticate before connecting')
-        self.env={**os.environ,'TOPOLO_CONTEXT':context}
-        self.env['PATH']=str(pathlib.Path(self.binary).parent)+os.pathsep+self.env.get('PATH','')
+        self.env={**selected,'TOPOLO_CONTEXT':context}
+        self.command=[node,self.binary] if node else [self.binary]
+        self.env['PATH']=(str(pathlib.Path(node).parent)+os.pathsep+'/usr/bin:/bin') if node else str(pathlib.Path(self.binary).parent)+os.pathsep+self.env.get('PATH','')
     def run(self,args):
-        p=subprocess.run([self.binary,'--env',self.environment,*args,'--json'],env=self.env,capture_output=True,text=True,timeout=90)
+        p=subprocess.run([*self.command,'--env',self.environment,*args,'--json'],env=self.env,capture_output=True,text=True,timeout=90)
         if p.returncode:
             raise PackError('Topolo command failed (exit '+str(p.returncode)+'); inspect the published action, account permissions and environment. No fallback was used.')
         try:value=json.loads(p.stdout)
@@ -599,6 +637,8 @@ def connection_lock(lib,args):
         yield
 
 def dispatch(lib,args):
+    if args.command=='remote-context' and getattr(args,'continuity_input',None):
+        return native_cli_continuity_read(lib,args)
     client=Client(args.environment,args.context_key)
     if args.command=='connect':return connect(lib,args,client)
     if args.command=='remote-context':return remote_context(lib,args,client)[1]
@@ -610,3 +650,124 @@ def dispatch(lib,args):
         reference=read_json(args.reference)
         return read_artifact(client,binding,reference['key'],reference,args.destination)
     raise PackError('Unsupported Topolo command')
+
+
+
+def native_cli_response(stdout,stderr,service):
+    """Preserve only canonical public response metadata; never echo raw stderr."""
+    from . import lanes
+    if len(stdout.encode())>262144 or len(stderr.encode())>65536:
+        raise PackError('native_cli_request_metadata_unavailable: bounded public response required')
+    try:
+        body=json.loads(stdout)
+    except ValueError as error:
+        raise PackError('native_cli_request_metadata_unavailable: invalid public JSON') from error
+    if not isinstance(body,dict) or body.get('error'):
+        raise PackError('native_cli_request_metadata_unavailable: unsuccessful public response')
+    events=[];seen=set()
+    pattern=r'^\[topolo\] ← (\d{3}) (GET|POST) (auth|agent) (/[^\s?#\\]+) \([0-9.]+ms, req=([A-Za-z0-9][A-Za-z0-9._:-]{0,127})\)$'
+    for line in stderr.splitlines():
+        match=re.fullmatch(pattern,line)
+        if not match:
+            continue
+        status,method,target,path,request_id=match.groups()
+        if request_id=='unavailable' or request_id in seen or not 200<=int(status)<300:
+            raise PackError('native_cli_request_metadata_unavailable: ambiguous or unsuccessful response request IDs')
+        seen.add(request_id);events.append({'requestId':request_id,'method':method,'service':target,'path':path,'status':int(status)})
+    if not 1<=len(events)<=8 or service not in {event['service'] for event in events}:
+        raise PackError('native_cli_request_metadata_unavailable: actual canonical server response IDs required')
+    return body.get('data',body),events
+
+
+def native_cli_command_response(client,args,service):
+    env={**client.env,'TOPOLO_DEBUG':'1'}
+    result=subprocess.run([*client.command,'--env',client.environment,*args,'--json'],env=env,
+        capture_output=True,text=True,timeout=90)
+    if result.returncode:
+        raise PackError('native_cli_request_metadata_unavailable: public command refused; no fallback or retry')
+    return native_cli_response(result.stdout,result.stderr,service)
+
+
+def native_cli_selected_environment(value,binding,host_env):
+    from . import lanes
+    from types import SimpleNamespace
+    context=value['context'];profile=binding.get('privateCredentialProfile')
+    lanes.native_cli_closed(profile,{'format','schemaVersion','configPath','environment','contextKey','identity'},'private profile reference')
+    if (profile['format']!='topolo-private-credential-profile' or profile['schemaVersion']!=1 or
+            profile['environment']!=context['environment'] or profile['contextKey']!=context['contextKey'] or
+            profile['identity']!={'userId':context['principalId'],'organizationId':context['organizationId']}):
+        raise PackError('Exact native-cli approved profile/principal/context reference required')
+    selected=SimpleNamespace(env={'TOPOLO_CONFIG_PATH':profile['configPath']},environment=context['environment'],context=context['contextKey'])
+    args=SimpleNamespace(private_profile=True,environment=context['environment'],context_key=context['contextKey'])
+    private_profile_reference(selected,args)
+    for path,sha in [(value['cli']['nodeExecutable'],value['cli']['nodeDigest']),(value['cli']['entry'],value['cli']['entryDigest'])]:
+        p=pathlib.Path(path);info=p.lstat()
+        if (p.resolve()!=p or not stat.S_ISREG(info.st_mode) or info.st_uid not in {0,os.getuid()} or info.st_mode&0o022 or
+                not info.st_mode&0o111 or hashlib.sha256(p.read_bytes()).hexdigest()!=sha):
+            raise PackError('Native-cli executable source/provenance changed')
+    allowed={'HOME','USER','LOGNAME','PATH','LANG','LC_ALL','TMPDIR'}
+    env={k:v for k,v in host_env.items() if k in allowed and isinstance(v,str)}
+    env['PATH']=str(pathlib.Path(value['cli']['nodeExecutable']).parent)+os.pathsep+'/usr/bin:/bin'
+    env.update(TOPOLO_CONFIG_PATH=profile['configPath'],TOPOLO_ENV=context['environment'],TOPOLO_CONTEXT=context['contextKey'])
+    return env
+
+
+def native_cli_continuity_read(lib,args,*,_admit=None,_client_factory=None,_response=None):
+    """Native command producer. No current runtime authority producer exists.
+
+    Injected callbacks are internal hermetic seams, never CLI/JSON options.
+    Receipt output is public response evidence, not native-query attribution.
+    """
+    from . import lanes
+    path=pathlib.Path(args.continuity_input);info=path.lstat()
+    if (path.is_symlink() or not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1 or
+            info.st_mode&0o077 or info.st_size>65536):
+        raise PackError('Exact owned bounded native-cli input required')
+    value=lanes.native_cli_input(read_json(path))
+    (lanes.native_cli_admission if _admit is None else _admit)(value)
+    context=value['context']
+    if (args.environment!=context['environment'] or args.context_key!=context['contextKey'] or args.role!=context['logicalId'] or
+            value['sourceRoleKey']!=args.name+'/'+args.role):
+        raise PackError('Native-cli command differs from the exact source/operation')
+    file=binding_path(lib,args.name,args.environment,args.context_key);info=file.lstat()
+    if (file.is_symlink() or not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1 or
+            hashlib.sha256(file.read_bytes()).hexdigest()!=value['source']['bindingDigest']):
+        raise PackError('Native-cli current owned binding source differs')
+    binding=read_json(file);roles=[r for r in binding['input']['roles'] if r['logicalId']==args.role]
+    if (len(roles)!=1 or binding['identity']!={'userId':context['principalId'],'organizationId':context['organizationId']} or
+            binding['packRevision']!=value['source']['packRevision'] or binding['input']['instanceId']!=context['installationId'] or
+            binding['agentWorkspaceId']!=context['agentWorkspaceId'] or binding['input']['bytesWorkspaceId']!=context['bytesWorkspaceId'] or
+            binding['input']['bytesScope']!=context['bytesScope'] or roles[0]['agentId']!=context['agentId'] or roles[0]['agentVersionId']!=context['agentVersionId']):
+        raise PackError('Native-cli source principal/Agent/Bytes binding differs')
+    env=native_cli_selected_environment(value,binding,os.environ)
+    client=(Client if _client_factory is None else _client_factory)(args.environment,args.context_key,
+        binary=value['cli']['entry'],env=env,node=value['cli']['nodeExecutable'])
+    call=native_cli_command_response if _response is None else _response
+    identity,identity_events=call(client,['whoami'],'auth')
+    if (identity.get('user',{}).get('id')!=context['principalId'] or (identity.get('organization')or{}).get('id')!=context['organizationId']):
+        raise PackError('Actual native-cli public identity differs')
+    with tempfile.TemporaryDirectory(prefix='topolo-native-cli-context-') as directory:
+        input_file=pathlib.Path(directory)/'input.json';atomic_json(input_file,{'instanceId':context['installationId'],'logicalId':context['logicalId']})
+        envelope,context_events=call(client,['actions','call','app_topolo_agent.agent_packs.context','--detail','--data','@'+str(input_file),
+            '--resource-type','workspace','--resource-id',context['agentWorkspaceId']],'agent')
+    result=envelope.get('data',envelope)
+    actual=result.get('context',{})
+    expected={'organizationId':context['organizationId'],'workspaceId':context['agentWorkspaceId'],'instanceId':context['installationId'],
+        'logicalId':context['logicalId'],'agentId':context['agentId'],'agentVersionId':context['agentVersionId'],
+        'artifacts':{'appId':'app_topolo_bytes','resourceType':'workspace','resourceId':context['bytesWorkspaceId'],'scope':context['bytesScope']}}
+    if envelope.get('success') is False or any(actual.get(k)!=v for k,v in expected.items()):
+        raise PackError('Actual native-cli public Agent/Bytes context differs')
+    # Recheck mutable public binding, binary and stat-only profile after awaited reads.
+    if hashlib.sha256(file.read_bytes()).hexdigest()!=value['source']['bindingDigest']:
+        raise PackError('Native-cli binding changed during response; no receipt ACK')
+    native_cli_selected_environment(value,binding,os.environ)
+    (lanes.native_cli_admission if _admit is None else _admit)(value)
+    responses={}
+    for kind,body,events in [('identity',{'userId':context['principalId'],'organizationId':context['organizationId']},identity_events),
+                             ('context',expected,context_events)]:
+        responses[kind]={'requestEvents':events,'bodyProjectionDigest':lanes.digest(body),'actionId':None if kind=='identity' else 'app_topolo_agent.agent_packs.context',
+            'resourceType':None if kind=='identity' else 'workspace','resourceId':None if kind=='identity' else context['agentWorkspaceId']}
+    receipt={k:value[k] for k in lanes.NATIVE_CLI_RECEIPT_FIELDS-{'format','schemaVersion','responses','claim'}}
+    receipt.update(format='topolo-native-cli-continuity-receipt',schemaVersion=1,responses=responses,
+        claim='PUBLIC_IDENTITY_CONTEXT_RESPONSE_ONLY_NATIVE_ATTRIBUTION_REQUIRED')
+    return lanes.native_cli_receipt(value,receipt)

package/dist/{claude-pack-backend-RMSOPHVQ.js → claude-pack-backend-YEVPAOID.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/lib/claude-pack-backend.ts
-import { createHash, randomBytes, randomUUID } from "crypto";
+import { createHash as createHash2, randomBytes, randomUUID } from "crypto";
 import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import * as filesystem from "fs";
 import * as cryptography from "crypto";
@@ -13,6 +13,7 @@ import { createConnection } from "net";
 import { WebSocket } from "undici";
 
 // src/lib/claude-native-pack.ts
+import { createHash } from "crypto";
 async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoint, verifyContext = () => {
 }) {
   const fenceKey = /* @__PURE__ */ Symbol.for("topolo.agent-pack.native-operation.v1");
@@ -849,7 +850,7 @@ async function nativeClaudeApprovalOperation(manager, routes, operation, fingerp
     const session = await manager.getSession(route.sessionId);
     if (!session || session.sessionId !== route.sessionId || session.cwd !== route.cwd || session.title !== route.title || session.isArchived)
       throw new Error("Native approval session identity differs: " + route.key);
-    if (!descriptor || descriptor.sessionId !== route.sessionId || descriptor.cwd !== route.cwd || descriptor.title !== route.title || descriptor.isArchived || descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || (route.dynamic ? descriptor.spawnedFrom?.sessionId !== route.dynamic.nativeParentId || descriptor.spawnedFrom?.sideSession !== true || route.dynamic.nativeParentId !== route.intakeSessionId || !/^[a-f0-9]{64}$/.test(route.dynamic.planDigest) : descriptor.spawnedFrom))
+    if (!descriptor || descriptor.sessionId !== route.sessionId || descriptor.cwd !== route.cwd || descriptor.title !== route.title || descriptor.isArchived || descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || (route.dynamic ? (route.dynamic.continuityTransport === "native-cli" ? Boolean(descriptor.spawnedFrom) || route.dynamic.nativeParentId !== null : descriptor.spawnedFrom?.sessionId !== route.dynamic.nativeParentId || descriptor.spawnedFrom?.sideSession !== true || route.dynamic.nativeParentId !== route.intakeSessionId) || !/^[a-f0-9]{64}$/.test(route.dynamic.planDigest) : descriptor.spawnedFrom))
       throw new Error("Native approval session descriptor identity differs: " + route.key);
     return session;
   };
@@ -993,11 +994,30 @@ async function nativeClaudeApprovalOperation(manager, routes, operation, fingerp
   if (operation.kind === "list") return { requests: [...state.entries.values()].map((e) => ({ ...e.record })) };
   const entry = state.entries.get(operation.key);
   if (!entry || entry.record.state !== "pending" || entry.record.intakeSessionId !== operation.intake || entry.record.fingerprint !== operation.fingerprint) throw new Error("Exact pending request and owning intake required.");
-  if (operation.kind === "respond" && operation.decision === "once" && byId.get(entry.record.sourceSessionId)?.dynamic)
-    throw Object.assign(
+  let cliFinalGuard;
+  if (operation.kind === "respond" && operation.decision === "once" && byId.get(entry.record.sourceSessionId)?.dynamic) {
+    const route = byId.get(entry.record.sourceSessionId);
+    if (route.dynamic?.continuityTransport === "native-cli") {
+      const producer = state.dynamicLifecycle?.get(entry.record.sourceSessionId)?.authorizeNativeCLI;
+      if (typeof producer !== "function") throw Object.assign(new Error("native_cli_startup_unqualified: actual native CLI admission producer unavailable."), { code: "native_cli_startup_unqualified" });
+      const admission = await producer(entry.record, entry.request, operation);
+      if (!admission || !["bootstrap", "work"].includes(admission.phase) || admission.nativeId !== entry.record.sourceSessionId || admission.intakeNativeId !== entry.record.intakeSessionId || admission.fingerprint !== entry.record.fingerprint || admission.generation !== route.dynamic.generation || typeof route.dynamic.generation !== "string" || !route.dynamic.generation || !admission.query || typeof admission.verifyCurrent !== "function" || typeof admission.model !== "string" || !admission.model || typeof admission.effort !== "string" || !admission.effort)
+        throw new Error("Exact current native CLI query/intake admission differs.");
+      const raw = await manager.getSessionWhenLoaded(entry.record.sourceSessionId, "topolo-native-cli-permission", { warnOnMiss: false });
+      if (raw?.query !== admission.query || typeof manager.readRunningModel !== "function" || typeof manager.getEffort !== "function" || await manager.readRunningModel(raw, raw.query) !== admission.model || await manager.getEffort(raw.sessionId) !== admission.effort)
+        throw new Error("Actual same-query native model/effort acknowledgement differs.");
+      cliFinalGuard = () => {
+        if (state.dynamicLifecycle?.get(entry.record.sourceSessionId)?.authorizeNativeCLI !== producer || raw.query !== admission.query || admission.verifyCurrent() !== void 0) throw new Error("Current native CLI admission changed before dispatch.");
+      };
+      if (admission.phase === "bootstrap") {
+        if (entry.request.toolName !== "Bash" || entry.request.input?.command !== admission.command || admission.commandDigest !== fingerprint(admission.command))
+          throw new Error("Only the exact native CLI bootstrap command may precede context acknowledgement.");
+      } else if (!/^[a-f0-9]{64}$/.test(admission.contextReceiptDigest ?? "")) throw new Error("Native CLI work requires verified same-query context receipt.");
+    } else throw Object.assign(
       new Error("native_private_query_prestart_contract_unqualified: dynamic private query authorization remains closed."),
       { code: "native_private_query_prestart_contract_unqualified" }
     );
+  }
   const pending = await current(entry);
   if (manager[symbol] !== state || state.entries.get(operation.key) !== entry || entry.record.state !== "pending" || state.auditFailed)
     throw new Error("Exact pending request changed during native identity validation; reconcile without replay.");
@@ -1005,6 +1025,7 @@ async function nativeClaudeApprovalOperation(manager, routes, operation, fingerp
   if (operation.kind !== "respond" || operation.humanDecisionRecorded !== true || !["once", "deny"].includes(operation.decision ?? ""))
     throw new Error("Recorded human one-request decision required; never auto-approve.");
   if (operation.decision !== "deny" && entry.record.cardOnly) throw new Error("Claude requires the original card; intake cannot impersonate its origin.");
+  cliFinalGuard?.();
   entry.record.state = "response-may-have-effects";
   checkpoint({ ...entry.record });
   await manager.respondToToolPermission(pending.requestId, operation.decision, void 0, "elsewhere");
@@ -1019,17 +1040,26 @@ async function nativeClaudeApprovalOperation(manager, routes, operation, fingerp
 }
 async function nativeClaudeAppendDynamicRoute(manager, route, verify, checkpoint, lifecycle) {
   const state = manager[/* @__PURE__ */ Symbol.for("topolo.agent-pack.approvals.v1")];
-  if (!state || state.auditFailed || !state.byId || !state.byKey || !route.dynamic || !/^[a-f0-9]{64}$/.test(route.dynamic.planDigest) || route.dynamic.nativeParentId !== route.intakeSessionId)
+  if (!state || state.auditFailed || !state.byId || !state.byKey || !route.dynamic || !/^[a-f0-9]{64}$/.test(route.dynamic.planDigest) || (route.dynamic.continuityTransport === "native-cli" ? route.dynamic.nativeParentId !== null : route.dynamic.nativeParentId !== route.intakeSessionId))
     throw new Error("Current qualified original approval listener required.");
+  let cliAdmission;
+  if (route.dynamic.continuityTransport === "native-cli") {
+    if (typeof lifecycle?.authorizeNativeCLI !== "function") throw Object.assign(new Error("native_cli_startup_unqualified: actual native CLI admission producer unavailable."), { code: "native_cli_startup_unqualified" });
+    cliAdmission = await lifecycle.authorizeNativeCLI(null, null, { kind: "route-append" });
+  }
   const intake = state.byId.get(route.intakeSessionId);
   if (!intake || intake.key !== route.intakeKey || intake.contextKey !== route.contextKey || !intake.key.includes("/intakes/"))
     throw new Error("Dynamic approval route has no exact same-context original intake.");
   await verify();
   const raw = await manager.getSessionWhenLoaded(route.sessionId, "topolo-dynamic-route", { warnOnMiss: false });
   const dto = await manager.getSession(route.sessionId);
-  if (!raw || !dto || raw.sessionId !== route.sessionId || raw.cwd !== route.cwd || raw.title !== route.title || dto.sessionId !== route.sessionId || dto.cwd !== route.cwd || dto.title !== route.title || raw.isArchived || dto.isArchived || raw.backend?.kind !== "local" || raw.backend.remoteTarget || raw.worktreePath || raw.worktreeLazy || raw.spawnedFrom?.sessionId !== route.intakeSessionId || raw.spawnedFrom?.sideSession !== true)
+  if (!raw || !dto || raw.sessionId !== route.sessionId || raw.cwd !== route.cwd || raw.title !== route.title || dto.sessionId !== route.sessionId || dto.cwd !== route.cwd || dto.title !== route.title || raw.isArchived || dto.isArchived || raw.backend?.kind !== "local" || raw.backend.remoteTarget || raw.worktreePath || raw.worktreeLazy || (route.dynamic.continuityTransport === "native-cli" ? Boolean(raw.spawnedFrom) : raw.spawnedFrom?.sessionId !== route.intakeSessionId || raw.spawnedFrom?.sideSession !== true))
     throw new Error("Actual dynamic child descriptor differs before route append.");
+  if (route.dynamic.continuityTransport === "native-cli" && (!cliAdmission?.query || raw.query !== cliAdmission.query || cliAdmission.nativeId !== route.sessionId || cliAdmission.intakeNativeId !== route.intakeSessionId || cliAdmission.generation !== route.dynamic.generation || typeof route.dynamic.generation !== "string" || !route.dynamic.generation || typeof cliAdmission.verifyCurrent !== "function" || typeof cliAdmission.model !== "string" || !cliAdmission.model || typeof cliAdmission.effort !== "string" || !cliAdmission.effort || typeof manager.readRunningModel !== "function" || typeof manager.getEffort !== "function" || await manager.readRunningModel(raw, raw.query) !== cliAdmission.model || await manager.getEffort(raw.sessionId) !== cliAdmission.effort))
+    throw new Error("Actual native CLI route query/model/effort admission differs.");
   await verify();
+  if (route.dynamic.continuityTransport === "native-cli" && (raw.query !== cliAdmission.query || cliAdmission.verifyCurrent() !== void 0))
+    throw new Error("Current native CLI route admission changed before append.");
   if (manager[/* @__PURE__ */ Symbol.for("topolo.agent-pack.approvals.v1")] !== state || state.auditFailed)
     throw new Error("Original native permission connection changed.");
   const old = state.byId.get(route.sessionId);
@@ -1188,8 +1218,8 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
     captureMarkdown(cwd);
     const charter = resolve(cwd, "CLAUDE.md");
     const transcript = realpathSync(record.transcript);
-    context[charter] = createHash("sha256").update(readFileSync(charter)).digest("hex");
-    context[transcript] = createHash("sha256").update(readFileSync(transcript)).digest("hex");
+    context[charter] = createHash2("sha256").update(readFileSync(charter)).digest("hex");
+    context[transcript] = createHash2("sha256").update(readFileSync(transcript)).digest("hex");
     roleContextFiles[record.desktopSessionId] = [charter, transcript];
     members.push({
       key: record.key,
@@ -1207,7 +1237,7 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
     });
   }
   for (const file of [resolve(root, "claude/state.json"), realpathSync(policyPath)])
-    context[file] = createHash("sha256").update(readFileSync(file)).digest("hex");
+    context[file] = createHash2("sha256").update(readFileSync(file)).digest("hex");
   const activePath = resolve(root, "claude/active.json");
   const active = existsSync(activePath) ? JSON.parse(readFileSync(activePath, "utf8")) : null;
   const target = new Set(members.map((m) => m.key));
@@ -1224,7 +1254,7 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
       if (!cwd.startsWith(resolve(root, "claude/workspaces", record.pack) + sep)) throw new Error("Outgoing workspace is outside the owned pack.");
       captureMarkdown(cwd);
       for (const file of [resolve(cwd, "CLAUDE.md"), realpathSync(record.transcript)])
-        context[file] = createHash("sha256").update(readFileSync(file)).digest("hex");
+        context[file] = createHash2("sha256").update(readFileSync(file)).digest("hex");
       outgoing.push({ key, sessionId: record.desktopSessionId, cwd, title: record.title });
     }
   } else if (mode === "switch") throw new Error("Configure and verify an initial active roster before switching.");
@@ -1528,7 +1558,7 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
       if (!journal.startsWith(realpathSync(directory) + sep)) throw new Error("Recovery journal is outside the owned library.");
       const lines = readFileSync(journal, "utf8").split("\n").filter(Boolean);
       const line = lines[0];
-      if (createHash("sha256").update(line).digest("hex") !== marker.planHash) throw new Error("Recovery plan identity changed.");
+      if (createHash2("sha256").update(line).digest("hex") !== marker.planHash) throw new Error("Recovery plan identity changed.");
       const record = JSON.parse(line);
       if (record.pack !== options.pack || record.operationId !== marker.operationId || !record.apply) throw new Error("Recovery pack or operation identity differs.");
       plan = { ...record, approvalRoutes: record.approvalRoutes ?? [], recovery: true, noEffects: marker.format === 2 && marker.dispatchState === "not-dispatched" && !lines.map((line2) => JSON.parse(line2)).some((r) => r.kind === "attempt") };
@@ -1542,7 +1572,7 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
             throw new Error("Unowned native approval connection.");
           const connection = JSON.parse(readFileSync(connectionPath, "utf8"));
           if (connection.pid === options.pid && connection.pack === options.pack && JSON.stringify(connection.routes) === JSON.stringify(plan.approvalRoutes) && JSON.stringify(connection.installationConsent) === JSON.stringify(plan.installationConsent)) {
-            if (typeof connection.secretPath !== "string" || typeof connection.socket !== "string" || !resolve(connection.secretPath).startsWith(realpathSync(resolve(root, "claude/private")) + sep) || realpathSync(connection.secretPath) !== resolve(connection.secretPath) || dirname(resolve(connection.socket)) !== resolve("/tmp", "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16)))
+            if (typeof connection.secretPath !== "string" || typeof connection.socket !== "string" || !resolve(connection.secretPath).startsWith(realpathSync(resolve(root, "claude/private")) + sep) || realpathSync(connection.secretPath) !== resolve(connection.secretPath) || dirname(resolve(connection.socket)) !== resolve("/tmp", "topolo-claude-pack-" + createHash2("sha256").update(root).digest("hex").slice(0, 16)))
               throw new Error("Native approval connection is outside owned control paths.");
             const secret = lstatSync(connection.secretPath);
             if (!secret.isFile() || secret.isSymbolicLink() || typeof process.getuid !== "function" || secret.uid !== process.getuid() || secret.mode & 63)
@@ -1553,7 +1583,7 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
         if (!plan.control) {
           const directory2 = resolve(root, "claude/private");
           mkdirSync(directory2, { recursive: true, mode: 448 });
-          const socketDirectory = resolve("/tmp", "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16));
+          const socketDirectory = resolve("/tmp", "topolo-claude-pack-" + createHash2("sha256").update(root).digest("hex").slice(0, 16));
           mkdirSync(socketDirectory, { recursive: true, mode: 448 });
           for (const path of [directory2, socketDirectory]) {
             const stat = lstatSync(path);
@@ -1568,7 +1598,7 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
       journal = resolve(directory, operationId + ".jsonl");
       const record = { kind: "plan", pack: options.pack, ...plan, apply: options.apply };
       durableRecord(journal, record, "wx");
-      marker = { format: 2, dispatchState: "not-dispatched", operationId, journal, planHash: createHash("sha256").update(JSON.stringify(record)).digest("hex") };
+      marker = { format: 2, dispatchState: "not-dispatched", operationId, journal, planHash: createHash2("sha256").update(JSON.stringify(record)).digest("hex") };
       if (options.apply) durableRecord(markerPath, marker, "wx");
       syncDirectory(directory);
       syncDirectory(resolve(root, "claude"));
@@ -1837,8 +1867,9 @@ function prepareClaudeDynamicLane(store, pack, policyPath, laneId) {
   if (lstatSync(file).size > 131072) throw new Error("Dynamic lane record exceeds its schema bound.");
   const record = JSON.parse(readFileSync(file, "utf8"));
   const canonical = (value) => JSON.stringify(value, (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]])) : item);
-  const digest = (value) => createHash("sha256").update(canonical(value)).digest("hex");
-  if (record.format !== "topolo-dynamic-lane" || record.schemaVersion !== 1 || record.harness !== "claude" || record.laneId !== laneId || record.planDigest !== digest(record.plan) || record.creationReceiptDigest !== digest(record.creationReceipt) || typeof record.nativeTitle !== "string" || !record.nativeTitle || record.nativeTitle.length > 256 || record.plan.role.packId !== pack || record.plan.nativeParentId !== record.plan.intake.nativeId)
+  const digest = (value) => createHash2("sha256").update(canonical(value)).digest("hex");
+  const nativeCLI = record.schemaVersion === 2 && record.plan?.schemaVersion === 2 && record.plan.continuityTransport === "native-cli";
+  if (record.format !== "topolo-dynamic-lane" || !(record.schemaVersion === 1 || nativeCLI) || record.harness !== "claude" || record.laneId !== laneId || record.planDigest !== digest(record.plan) || record.creationReceiptDigest !== digest(record.creationReceipt) || typeof record.nativeTitle !== "string" || !record.nativeTitle || record.nativeTitle.length > 256 || record.plan.role.packId !== pack || (nativeCLI ? record.plan.nativeParentId !== null : record.plan.nativeParentId !== record.plan.intake.nativeId))
     throw new Error("Durable dynamic child identity or plan digest differs.");
   const stateFile = owned(resolve(root, "claude/state.json"));
   const state = JSON.parse(readFileSync(stateFile, "utf8"));
@@ -1847,8 +1878,8 @@ function prepareClaudeDynamicLane(store, pack, policyPath, laneId) {
   if (state.harness !== "claude" || policy.format !== "topolo-agent-execution-policy" || policy.pack !== pack || policy.sourceRevision !== record.plan.role.packRevision || !policy.installationConsent)
     throw new Error("Dynamic child source policy or organization-bound installation is stale.");
   const context = {
-    [stateFile]: createHash("sha256").update(readFileSync(stateFile)).digest("hex"),
-    [policyFile]: createHash("sha256").update(readFileSync(policyFile)).digest("hex")
+    [stateFile]: createHash2("sha256").update(readFileSync(stateFile)).digest("hex"),
+    [policyFile]: createHash2("sha256").update(readFileSync(policyFile)).digest("hex")
   };
   const inventories = {};
   const fixed = (descriptor) => {
@@ -1861,7 +1892,7 @@ function prepareClaudeDynamicLane(store, pack, policyPath, laneId) {
       throw new Error("Dynamic source workspace or current fixed settings differ.");
     const files = [resolve(cwd, "CLAUDE.md"), resolve(cwd, "topolo-connection.json"), resolve(cwd, ".mcp.json")];
     const hashes = {};
-    for (const f of files) hashes[owned(f)] = createHash("sha256").update(readFileSync(f)).digest("hex");
+    for (const f of files) hashes[owned(f)] = createHash2("sha256").update(readFileSync(f)).digest("hex");
     const connection = JSON.parse(readFileSync(files[1], "utf8"));
     const expected = {
       environment: descriptor.environment,
@@ -1898,6 +1929,7 @@ function prepareClaudeDynamicLane(store, pack, policyPath, laneId) {
       planDigest: record.planDigest,
       nativeId: record.nativeId,
       cwd: record.creationReceipt.cwd,
+      ...nativeCLI ? { continuityTransport: "native-cli", continuity: record.plan.continuity } : {},
       title: record.nativeTitle,
       source,
       intake,
@@ -1981,7 +2013,7 @@ function prepareClaudePrivateHelperConnection(store, pack, policyPath, sourceRol
   const policyBytes = readFileSync(policyFile), policy = JSON.parse(policyBytes.toString("utf8")), consent = policy.installationConsent;
   if (!consent || !["development", "staging", "production"].includes(consent.environment) || typeof consent.contextKey !== "string")
     throw new Error("Existing approved per-environment private connection required.");
-  const bindingFile = resolve(root, "connections", pack, consent.environment, createHash("sha256").update(consent.contextKey).digest("hex") + ".json");
+  const bindingFile = resolve(root, "connections", pack, consent.environment, createHash2("sha256").update(consent.contextKey).digest("hex") + ".json");
   const bindingBytes = readFileSync(bindingFile), binding = JSON.parse(bindingBytes.toString("utf8"));
   const connection = {
     format: "topolo-private-helper-connection",
@@ -1991,9 +2023,9 @@ function prepareClaudePrivateHelperConnection(store, pack, policyPath, sourceRol
     sourceRoleKey,
     policyFile,
     bindingFile,
-    policyDigest: createHash("sha256").update(policyBytes).digest("hex"),
-    bindingDigest: createHash("sha256").update(bindingBytes).digest("hex"),
-    stateDigest: createHash("sha256").update(readFileSync(resolve(root, "claude/state.json"))).digest("hex"),
+    policyDigest: createHash2("sha256").update(policyBytes).digest("hex"),
+    bindingDigest: createHash2("sha256").update(bindingBytes).digest("hex"),
+    stateDigest: createHash2("sha256").update(readFileSync(resolve(root, "claude/state.json"))).digest("hex"),
     profile: binding.privateCredentialProfile
   };
   privateClaudeHelperEnvironment(connection, filesystem, cryptography, paths, process.env);
@@ -2025,6 +2057,11 @@ function runClaudeLaneHelper(root, pack, policyPath, action, payload, source, co
     return Promise.reject(new Error("Closed typed native lifecycle helper required."));
   const encoded = JSON.stringify(payload);
   if (Buffer.byteLength(encoded) > 2097152) return Promise.reject(new Error("Own-child native transcript exceeds bounded transport; no broad history read."));
+  try {
+    requireClaudePrivateQueryEffectQualified("helper", payload);
+  } catch (error) {
+    return Promise.reject(error);
+  }
   const selectedRole = payload.sourceRoleKey ?? payload.request?.sourceRoleKey ?? payload.plan?.role?.key ?? payload.operation?.record?.plan?.role?.key;
   if (!connection || root !== connection.root || pack !== connection.pack || policyPath !== connection.policyFile || selectedRole !== void 0 && selectedRole !== connection.sourceRoleKey)
     return Promise.reject(new Error("Private helper arguments differ from the exact bound source connection."));
@@ -2072,7 +2109,14 @@ function runClaudeLaneHelper(root, pack, policyPath, action, payload, source, co
     child.stdin.end(encoded);
   });
 }
-function requireClaudePrivateQueryEffectQualified(operation) {
+function requireClaudePrivateQueryEffectQualified(operation, input) {
+  const candidates = [input, input?.request, input?.plan, input?.record?.plan, input?.operation?.record?.plan];
+  const transports = candidates.map((value) => value?.continuityTransport).filter((value) => value !== void 0);
+  if (transports.some((value) => !["native-cli", "private-mcp"].includes(value)) || new Set(transports).size > 1)
+    throw new Error("Closed explicit continuity transport required; no fallback.");
+  const transport = transports[0];
+  if (transport === "native-cli" || candidates.some((value) => value?.schemaVersion === 2))
+    throw Object.assign(new Error("native_cli_startup_unqualified: current startup, profile refresh authority and native result producers are unavailable."), { code: "native_cli_startup_unqualified" });
   if (["create", "configure", "context-start", "fixture-start", "retire", "approval-once"].includes(operation))
     throw Object.assign(
       new Error("native_private_query_prestart_contract_unqualified: private native query startup, exclusion and owned lifecycle are not qualified."),
@@ -2082,12 +2126,12 @@ function requireClaudePrivateQueryEffectQualified(operation) {
 function claudeLaneExpression(options, source, journal, prepared) {
   if (!Number.isSafeInteger(options.pid) || options.pid < 1 || !["plan", "create", "create-read", "adopt", "read", "configure", "context-start", "context-read", "fixture-start", "fixture-read", "retire"].includes(options.operation))
     throw new Error("Closed typed Claude lane operation required.");
-  requireClaudePrivateQueryEffectQualified(options.operation);
+  requireClaudePrivateQueryEffectQualified(options.operation, options.input);
   if (!options.privateConnection) throw new Error("Explicit approved private helper connection required before native access.");
   return `(async()=>{
     const expected=${JSON.stringify({ ...options, qualifier: CLAUDE_NATIVE_QUALIFIER, source, journal })};
     const requireClaudePrivateQueryEffectQualified=(${requireClaudePrivateQueryEffectQualified.toString()});
-    requireClaudePrivateQueryEffectQualified(expected.operation);
+    requireClaudePrivateQueryEffectQualified(expected.operation,expected.input);
     if(process.pid!==expected.pid || typeof process.getBuiltinModule!=='function')throw new Error('Native process identity changed.');
     const load=process.getBuiltinModule('module').createRequire(process.resourcesPath+'/app.asar/package.json');
     const fs=load('node:fs'),crypto=load('node:crypto'),path=load('node:path');
@@ -2203,7 +2247,7 @@ function claudeLaneExpression(options, source, journal, prepared) {
       if(!secretInfo.isFile()||secretInfo.isSymbolicLink()||secretInfo.uid!==process.getuid()||secretInfo.mode&63)throw new Error('Unowned private native control secret.');
       const secret=JSON.parse(fs.readFileSync(control.secretPath,'utf8'));
       const ownedOperation=async op=>{
-        requireClaudePrivateQueryEffectQualified(op.kind==='approval-respond'&&op.decision==='once'?'approval-once':op.kind);
+        requireClaudePrivateQueryEffectQualified(op.kind==='approval-respond'&&op.decision==='once'?'approval-once':op.kind,{continuityTransport:nativePlan.continuityTransport});
         qualify();const current=await helper('read',{laneId:nativePlan.laneId});
         const scopedPlan={...nativePlan,lifecycleState:current.state,deadline:Date.now()+200000};
         if(op.kind.startsWith('approval-')){
@@ -2270,7 +2314,7 @@ function claudeLaneExpression(options, source, journal, prepared) {
   })()`;
 }
 async function operateClaudeLane(options, evaluate = evaluateClaudeMain) {
-  requireClaudePrivateQueryEffectQualified(options.operation);
+  requireClaudePrivateQueryEffectQualified(options.operation, options.input);
   validateInspectorEndpoint(options.endpoint);
   const root = realpathSync(options.store);
   const policy = realpathSync(options.policy);
@@ -2285,6 +2329,7 @@ async function operateClaudeLane(options, evaluate = evaluateClaudeMain) {
     const journal = resolve(directory, randomUUID() + ".jsonl");
     durableRecord(journal, { operation: options.operation, pid: options.pid, at: Date.now() }, "wx");
     const prepared = ["plan", "create", "create-read", "adopt"].includes(options.operation) ? void 0 : prepareClaudeDynamicLane(root, options.pack, policy, options.input.laneId);
+    if (prepared?.record.plan.continuityTransport === "native-cli") requireClaudePrivateQueryEffectQualified(options.operation, prepared.record.plan);
     let sourceRoleKey = prepared?.record.plan.role.key ?? (options.operation === "plan" ? options.input.request?.sourceRoleKey : options.input.plan?.role?.key);
     if (["create", "create-read"].includes(options.operation)) {
       if (typeof options.input.laneId !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(options.input.laneId)) throw new Error("Exact existing creation lane required.");
@@ -2307,8 +2352,8 @@ async function operateClaudeLane(options, evaluate = evaluateClaudeMain) {
       mkdirSync(directory2, { mode: 448 });
       const secretPath = resolve(directory2, "secret.json");
       durableRecord(secretPath, { token: randomBytes(32).toString("hex") }, "wx");
-      const identity = createHash("sha256").update(JSON.stringify({ pid: options.pid, laneId, planDigest: prepared.record.planDigest, qualifier: CLAUDE_NATIVE_QUALIFIER })).digest("hex");
-      const socketDirectory = resolve("/tmp", "topolo-claude-" + process.getuid?.() + "-" + createHash("sha256").update(root + "\0" + laneId).digest("hex").slice(0, 24));
+      const identity = createHash2("sha256").update(JSON.stringify({ pid: options.pid, laneId, planDigest: prepared.record.planDigest, qualifier: CLAUDE_NATIVE_QUALIFIER })).digest("hex");
+      const socketDirectory = resolve("/tmp", "topolo-claude-" + process.getuid?.() + "-" + createHash2("sha256").update(root + "\0" + laneId).digest("hex").slice(0, 24));
       mkdirSync(socketDirectory, { mode: 448 });
       const socket = resolve(socketDirectory, "control.sock");
       control = { socket, secretPath, identity };
@@ -2335,7 +2380,7 @@ async function operateClaudeLane(options, evaluate = evaluateClaudeMain) {
   }
 }
 function operateClaudeLaneControl(options, request = requestClaudeApprovalControl) {
-  requireClaudePrivateQueryEffectQualified(options.operation.kind === "approval-respond" && options.operation.decision === "once" ? "approval-once" : options.operation.kind);
+  requireClaudePrivateQueryEffectQualified(options.operation.kind === "approval-respond" && options.operation.decision === "once" ? "approval-once" : options.operation.kind, options.operation);
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.connection)) throw new Error("Exact owned native lane connection ID required.");
   const root = realpathSync(options.store);
   const directory = resolve(root, "claude/dynamic-controls", options.connection);