@topolo/cli 0.13.11 → 0.13.12

package/dist/index.js

@@ -8,6 +8,28 @@ import { fileURLToPath } from "url";
 import { homedir } from "os";
 function registerAgentPacksCommand(program2) {
   const packs = program2.command("agent-packs").description("Install and operate Topolo Agent Packs in supported local hosts").option("--store <path>", "Portable pack library (default ~/AgentPacks)");
+  packs.command("runtime-adoption").description("Plan or apply an owned private runtime configuration; never starts or authenticates a consumer").argument("<operation>", "plan or apply").requiredOption("--manifest <path>", "Closed owner-scoped manifest").option("--plan-digest <sha256>", "Exact reviewed plan digest required for apply").option("--confirm", "Confirm the configuration-only apply").allowExcessArguments(false).action((operation, options) => {
+    if (!["plan", "apply"].includes(operation) || !options.manifest.startsWith("/") || (operation === "apply" ? !/^[a-f0-9]{64}$/.test(options.planDigest ?? "") || !options.confirm : options.planDigest !== void 0 || options.confirm)) throw new Error("Exact runtime-adoption plan or confirmed apply required.");
+    const here = dirname(fileURLToPath(import.meta.url));
+    const adapter = [resolve(here, "../agent-packs/topolo-agent-pack"), resolve(here, "../../agent-packs/topolo-agent-pack")].find(existsSync);
+    if (!adapter) throw new Error("Installed bundled pack adapter unavailable.");
+    const result = spawnSync(
+      "python3",
+      [
+        adapter,
+        "--store",
+        packs.opts().store ?? resolve(homedir(), "AgentPacks"),
+        "runtime-adoption",
+        operation,
+        "--manifest",
+        options.manifest,
+        ...operation === "apply" ? ["--plan-digest", options.planDigest, "--confirm"] : []
+      ],
+      { stdio: "inherit", env: { PATH: process.env.PATH, HOME: homedir(), PYTHONDONTWRITEBYTECODE: "1" } }
+    );
+    if (result.error) throw new Error("Python 3.11 or later is required for runtime adoption.");
+    if (result.status !== 0) process.exitCode = result.status ?? 2;
+  });
   packs.command("smoke").description("Start or read one closed, bound native acceptance case").argument("<operation>", "start or read").argument("<identity>", "Owned role key for start, existing operation UUID for read").option("--case <id>", "Finite compiled acceptance case").option("--operation-id <id>", "Unique native operation UUID for start").option("--harness <name>", "codex or claude", "codex").allowExcessArguments(false).action(async (operation, identity, options) => {
     const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
     if (!["start", "read"].includes(operation) || !["codex", "claude"].includes(options.harness) || (operation === "start" ? !/^[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+$/.test(identity) || !["stg-context-memory-bytes", "stg-peer-ack", "prod-role-context-ack"].includes(options.case ?? "") || !uuid.test(options.operationId ?? "") : !uuid.test(identity) || options.case !== void 0 || options.operationId !== void 0))
@@ -209,7 +231,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.21/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.23.22/node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -288,6 +310,7 @@ var PUBLIC_ERROR_CODES = /* @__PURE__ */ new Set([
   "organization_enrollment_required",
   "permission_denied",
   "rate_limited",
+  "reauth_required",
   "request_failed",
   "request_timeout",
   "service_catalog_unavailable",
@@ -649,6 +672,22 @@ var TopoloHttpError = class extends TopoloSdkError {
     );
   }
 };
+function topoloRetryAfterSeconds(value, now = Date.now()) {
+  if (!value) return void 0;
+  if (/^\d{1,10}$/.test(value)) return Number(value);
+  const at = Date.parse(value);
+  return Number.isNaN(at) ? void 0 : Math.max(0, Math.ceil((at - now) / 1e3));
+}
+var TopoloRateLimitError = class extends TopoloHttpError {
+  retryable = true;
+  retryAfterSeconds;
+  constructor(service, path, body, message2, options = {}) {
+    super(service, path, 429, body, message2, options);
+    this.name = "TopoloRateLimitError";
+    if (this.code === "http_error") this.code = "rate_limited";
+    this.retryAfterSeconds = topoloRetryAfterSeconds(this.retryAfter);
+  }
+};
 var ACTION_SECRET_PREFIX = "topolo-secret:";
 function isActionSecretReference(value) {
   return typeof value === "string" && value.startsWith(ACTION_SECRET_PREFIX);
@@ -1619,6 +1658,10 @@ function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var IDEMPOTENT_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+var RATE_LIMIT_READ_RETRIES = 2;
+var RATE_LIMIT_READ_RETRY_MAX_DELAY_MS = 1e4;
+var RATE_LIMIT_READ_DEFAULT_DELAY_MS = 1e3;
 var TOPOLO_ACTION_ID_HEADER = "X-Topolo-Action-Id";
 var TOPOLO_ACTION_NAME_HEADER = "X-Topolo-Action-Name";
 var TOPOLO_RESOURCE_TYPE_HEADER = "X-Topolo-Resource-Type";
@@ -1815,6 +1858,15 @@ var TopoloClient = class _TopoloClient {
           res = await fetchWithReadRetry();
         }
       }
+      for (let retry = 0; res.status === 429 && IDEMPOTENT_READ_METHODS.has(method) && retry < RATE_LIMIT_READ_RETRIES; retry += 1) {
+        const header = canonicalTopoloRetryAfter(res.headers.get("Retry-After"));
+        const seconds = topoloRetryAfterSeconds(header);
+        const delayMs = header === void 0 ? RATE_LIMIT_READ_DEFAULT_DELAY_MS * (retry + 1) : (seconds ?? Infinity) * 1e3;
+        if (delayMs > RATE_LIMIT_READ_RETRY_MAX_DELAY_MS || opts.signal?.aborted) break;
+        await res.body?.cancel().catch(() => void 0);
+        await new Promise((resolve5) => setTimeout(resolve5, delayMs));
+        res = await fetchWithReadRetry();
+      }
     } catch (err) {
       this.emit({
         phase: "error",
@@ -1880,6 +1932,15 @@ var TopoloClient = class _TopoloClient {
           { ...errorContext, code: extractTopoloServiceErrorCode(parsed) ?? "permission_denied" }
         );
       }
+      if (res.status === 429) {
+        throw new TopoloRateLimitError(
+          resolvedService.serviceKey,
+          opts.path,
+          parsed,
+          message2,
+          errorContext
+        );
+      }
       throw new TopoloHttpError(
         resolvedService.serviceKey,
         opts.path,
@@ -3825,8 +3886,8 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.23.21/node_modules/@topolo/sdk/dist/node/credential-store.js
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2 } from "fs/promises";
+// node_modules/.pnpm/@topolo+sdk@0.23.22/node_modules/@topolo/sdk/dist/node/credential-store.js
+import { mkdir as mkdir2, readFile as readFile2, chmod as chmod2, lstat, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync2, mkdirSync, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync, linkSync } from "fs";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import { constants, fstatSync, readSync } from "fs";
@@ -3882,6 +3943,7 @@ var PUBLIC_ERROR_CODES2 = /* @__PURE__ */ new Set([
   "organization_enrollment_required",
   "permission_denied",
   "rate_limited",
+  "reauth_required",
   "request_failed",
   "request_timeout",
   "service_catalog_unavailable",
@@ -4141,6 +4203,30 @@ var TopoloHttpError2 = class extends TopoloSdkError2 {
     );
   }
 };
+function topoloRetryAfterSeconds2(value, now = Date.now()) {
+  if (!value) return void 0;
+  if (/^\d{1,10}$/.test(value)) return Number(value);
+  const at = Date.parse(value);
+  return Number.isNaN(at) ? void 0 : Math.max(0, Math.ceil((at - now) / 1e3));
+}
+var TopoloRateLimitError2 = class extends TopoloHttpError2 {
+  retryable = true;
+  retryAfterSeconds;
+  constructor(service, path, body, message2, options = {}) {
+    super(service, path, 429, body, message2, options);
+    this.name = "TopoloRateLimitError";
+    if (this.code === "http_error") this.code = "rate_limited";
+    this.retryAfterSeconds = topoloRetryAfterSeconds2(this.retryAfter);
+  }
+};
+var TopoloReauthRequiredError = class extends TopoloAuthError2 {
+  reauthorization;
+  constructor(message2, reauthorization, options = {}) {
+    super(message2, "reauth_required", { status: 401, service: "auth", path: "/api/developer-oauth/token", ...options });
+    this.name = "TopoloReauthRequiredError";
+    this.reauthorization = Object.freeze({ ...reauthorization });
+  }
+};
 var APP_API_URLS2 = {
   auth: "https://auth.topolo.app",
   developers: "https://developers.topolo.app"
@@ -4589,7 +4675,9 @@ async function readConfig() {
 async function writeConfig(config) {
   const path = configPath();
   await mkdir2(dirname2(path), { recursive: true });
-  await writeFile2(path, JSON.stringify(config, null, 2) + "\n", "utf8");
+  await withConfigWriteLock(async (_assertOwned, persist) => {
+    await persist((current) => protectStoredGrants(config, current), { allowCreate: true });
+  });
   if (platform() !== "win32") {
     try {
       await chmod2(path, 384);
@@ -4597,6 +4685,142 @@ async function writeConfig(config) {
     }
   }
 }
+var DEFAULT_SLOT = "@default";
+var RETIRED_MAX_ENTRIES = 512;
+var RETIRED_RETENTION_SECONDS = 30 * 24 * 3600;
+var TERMINAL_RENEWAL_CODES = /* @__PURE__ */ new Set(["invalid_grant", "expired_token"]);
+function refreshTokenFingerprint(refreshToken) {
+  return createHash2("sha256").update("topolo-refresh-token:v1:" + refreshToken).digest("hex").slice(0, 32);
+}
+function clone(value) {
+  return value === void 0 ? value : JSON.parse(JSON.stringify(value));
+}
+function nowSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function retiredEntry(config, refreshToken) {
+  if (!refreshToken) return void 0;
+  const entry = config.retiredRefreshTokens?.[refreshTokenFingerprint(refreshToken)];
+  return entry && typeof entry === "object" ? entry : void 0;
+}
+function retire(config, refreshToken, reason) {
+  const now = nowSeconds();
+  const entries = Object.entries({ ...config.retiredRefreshTokens ?? {}, [refreshTokenFingerprint(refreshToken)]: { reason, at: now } }).filter(([key, value]) => /^[a-f0-9]{32}$/.test(key) && value && Number.isFinite(value.at) && value.at > now - RETIRED_RETENTION_SECONDS).sort(([, a], [, b]) => b.at - a.at).slice(0, RETIRED_MAX_ENTRIES);
+  config.retiredRefreshTokens = Object.fromEntries(entries);
+}
+function environmentSlots(config, environment) {
+  const slots = [];
+  const profile = config.profiles?.[environment];
+  if (environment === "production" && (config.credential || !profile)) {
+    slots.push({ holder: config, key: profile?.activeContext ?? DEFAULT_SLOT, path: "credential" });
+  }
+  if (profile) {
+    slots.push({ holder: profile, key: profile.activeContext ?? DEFAULT_SLOT, path: `profiles.${environment}.credential` });
+    for (const [key, context] of Object.entries(profile.contexts ?? {})) {
+      if (context) slots.push({ holder: context, key, path: `profiles.${environment}.contexts.${key}.credential` });
+    }
+  }
+  return slots;
+}
+function allSlots(config) {
+  const environments = /* @__PURE__ */ new Set(["production", ...Object.keys(config.profiles ?? {})]);
+  return [...environments].flatMap((environment) => environmentSlots(config, environment));
+}
+function slotRefreshToken(slot) {
+  const credential = slot.holder.credential;
+  return credential?.kind === "access_token" ? credential.refreshToken : void 0;
+}
+function replaceGrant(config, environment, refreshToken, replacement) {
+  const touched = /* @__PURE__ */ new Set();
+  for (const slot of environmentSlots(config, environment)) {
+    if (slotRefreshToken(slot) !== refreshToken) continue;
+    if (replacement) slot.holder.credential = clone(replacement);
+    else delete slot.holder.credential;
+    touched.add(slot.key);
+  }
+  return touched;
+}
+function usableCredential(config, credential) {
+  if (!credential) return false;
+  if (credential.kind !== "access_token" || !credential.refreshToken) return true;
+  return !retiredEntry(config, credential.refreshToken);
+}
+function slotCredential(profile, key) {
+  if (key === DEFAULT_SLOT) return profile.credential;
+  return profile.contexts?.[key]?.credential ?? (profile.activeContext === key ? profile.credential : void 0);
+}
+function protectStoredGrants(next, current) {
+  const result = clone(next) ?? {};
+  const retired = current.retiredRefreshTokens;
+  const currentSlots = new Map(allSlots(current).map((slot) => [slot.path, slot.holder.credential]));
+  for (const slot of allSlots(result)) {
+    const token = slotRefreshToken(slot);
+    if (!token || !retired?.[refreshTokenFingerprint(token)]) continue;
+    const stored = currentSlots.get(slot.path);
+    if (stored) slot.holder.credential = clone(stored);
+    else delete slot.holder.credential;
+  }
+  if (retired) result.retiredRefreshTokens = clone(retired);
+  else delete result.retiredRefreshTokens;
+  for (const environment of /* @__PURE__ */ new Set([...Object.keys(result.profiles ?? {}), ...Object.keys(current.profiles ?? {})])) {
+    const stored = current.profiles?.[environment]?.reauthorization;
+    const profile = result.profiles?.[environment];
+    if (!profile) continue;
+    const kept = Object.fromEntries(Object.entries(stored ?? {}).filter(([key]) => !usableCredential(result, slotCredential(profile, key))));
+    if (Object.keys(kept).length) profile.reauthorization = clone(kept);
+    else delete profile.reauthorization;
+  }
+  return result;
+}
+function setReauthorization(config, environment, key, update) {
+  const profiles = config.profiles ??= {};
+  const profile = profiles[environment] ??= {};
+  const map = { ...profile.reauthorization ?? {} };
+  const value = update(map[key]);
+  if (value) map[key] = value;
+  else delete map[key];
+  if (Object.keys(map).length) profile.reauthorization = map;
+  else delete profile.reauthorization;
+}
+function loginCommand(environment, key) {
+  const base = environment === "production" ? "topolo auth login" : `topolo --env ${environment} auth login`;
+  if (!key.startsWith("org:")) return base;
+  const use = environment === "production" ? "topolo context use" : `topolo --env ${environment} context use`;
+  return `${base} && ${use} ${key.slice(4)}`;
+}
+function contextLabel(key) {
+  return key === DEFAULT_SLOT ? "default" : key;
+}
+function reauthRequired(environment, key, entry, state) {
+  const pending = entry?.pending;
+  const command = loginCommand(environment, key);
+  const reason = entry?.reason ?? "invalid_grant";
+  const head = `The saved Topolo sign-in for ${environment} context ${contextLabel(key)} has ended (${reason}) and is not renewed again.`;
+  let action;
+  if (state === "awaiting_approval" && pending) {
+    action = ` Approve the new sign-in: open ${pending.verificationUriComplete ?? pending.verificationUri} and confirm code ${pending.userCode} (expires ${new Date(pending.expiresAt * 1e3).toISOString()}). The next call resumes once approved.`;
+  } else if (state === "organization_mismatch") {
+    action = ` The last approval was for ${entry?.mismatch?.approvedContext ?? "another context"}, not ${contextLabel(key)}; approve again with that organization selected.`;
+  } else if (state === "denied") {
+    action = " The last approval was denied.";
+  } else {
+    action = "";
+  }
+  return new TopoloReauthRequiredError(`${head}${action} Or sign in again: ${command} (context ${contextLabel(key)}).`, {
+    environment,
+    context: contextLabel(key),
+    reason,
+    state,
+    ...state === "awaiting_approval" && pending ? {
+      verificationUri: pending.verificationUri,
+      ...pending.verificationUriComplete ? { verificationUriComplete: pending.verificationUriComplete } : {},
+      userCode: pending.userCode,
+      expiresAt: new Date(pending.expiresAt * 1e3).toISOString(),
+      pollIntervalSeconds: pending.interval
+    } : {},
+    loginCommand: command
+  });
+}
 function normalizeEnvironment(value) {
   const normalized = (value ?? "production").trim().toLowerCase();
   if (normalized === "" || normalized === "production" || normalized === "prod") {
@@ -4694,7 +4918,19 @@ async function resolveCredential(environment = selectedEnvironment()) {
 }
 var REFRESH_SKEW_SECONDS = 60;
 var CONFIG_LOCK_RETRY_MS = 25;
-var CONFIG_LOCK_TIMEOUT_MS = 5e3;
+var CONFIG_LOCK_DEFAULT_TIMEOUT_MS = 15e3;
+var AUTH_EXCHANGE_TIMEOUT_MS = 1e4;
+function configLockTimeoutMs() {
+  const value = Number(process.env.TOPOLO_CONFIG_LOCK_TIMEOUT_MS);
+  return Number.isFinite(value) && value >= 1e3 && value <= 12e4 ? value : CONFIG_LOCK_DEFAULT_TIMEOUT_MS;
+}
+function boundedOAuth(serviceUrls) {
+  const fetchImpl = (input2, init) => globalThis.fetch(input2, {
+    ...init,
+    signal: init?.signal ?? AbortSignal.timeout(AUTH_EXCHANGE_TIMEOUT_MS)
+  });
+  return new TopoloOAuth2({ serviceUrls, fetch: fetchImpl });
+}
 var CONFIG_LOCK_DEAD_OWNER_MIN_AGE_MS = 2e3;
 var ConfigOwnershipError = class extends TopoloSdkError2 {
   constructor() {
@@ -4822,6 +5058,7 @@ function reclaimDeadOwnerLock(lockPath, markerName, marker) {
   return reclaimed;
 }
 var RELEASE_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var PERSIST_ATTEMPTS = 3;
 async function withConfigWriteLock(operation) {
   const lockPath = `${configPath()}.lock`;
   await mkdir2(dirname2(lockPath), { recursive: true });
@@ -4842,7 +5079,7 @@ async function withConfigWriteLock(operation) {
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       if (reclaimDeadOwnerLock(lockPath, markerName, marker)) break;
-      if (performance.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
+      if (performance.now() - startedAt >= configLockTimeoutMs()) {
         throw new TopoloSdkError2("state_conflict", "Credential configuration is still held or unresolved. This waiter did not dispatch a renewal.");
       }
       await new Promise((resolve22) => setTimeout(resolve22, CONFIG_LOCK_RETRY_MS));
@@ -4881,31 +5118,54 @@ async function withConfigWriteLock(operation) {
       throw new ConfigOwnershipError();
     }
   };
-  const persist = async (update) => {
+  const persist = async (update, options = {}) => {
     const path = configPath();
     await mkdir2(dirname2(path), { recursive: true });
-    const temporary = join3(dirname2(path), ".credential-write-" + randomUUID2());
-    let temporaryOwned = false;
-    try {
-      assertOwnedSync();
-      const entry = lstatSync(path);
+    const snapshot = () => {
+      let entry;
+      try {
+        entry = lstatSync(path);
+      } catch (error) {
+        if (options.allowCreate && error.code === "ENOENT") return null;
+        throw new ConfigOwnershipError();
+      }
       if (!entry.isFile() || entry.isSymbolicLink()) throw new ConfigOwnershipError();
-      const before = readFileSync2(path, "utf8");
-      const updated = update(JSON.parse(before));
-      const fd = openSync(temporary, "wx", 384);
-      temporaryOwned = true;
+      return readFileSync2(path, "utf8");
+    };
+    for (let attempt = 1; ; attempt += 1) {
+      const temporary = join3(dirname2(path), ".credential-write-" + randomUUID2());
+      let temporaryOwned = false;
       try {
-        writeFileSync(fd, JSON.stringify(updated, null, 2) + "\n");
-        fsyncSync(fd);
+        assertOwnedSync();
+        const before = snapshot();
+        let current = {};
+        if (before !== null) {
+          try {
+            current = JSON.parse(before);
+          } catch (error) {
+            if (!options.allowCreate) throw error;
+          }
+        }
+        const updated = update(current);
+        const fd = openSync(temporary, "wx", 384);
+        temporaryOwned = true;
+        try {
+          writeFileSync(fd, JSON.stringify(updated, null, 2) + "\n");
+          fsyncSync(fd);
+        } finally {
+          closeSync(fd);
+        }
+        assertOwnedSync();
+        if (snapshot() !== before) {
+          if (attempt < PERSIST_ATTEMPTS) continue;
+          throw new ConfigOwnershipError();
+        }
+        renameSync(temporary, path);
+        temporaryOwned = false;
+        return;
       } finally {
-        closeSync(fd);
+        if (temporaryOwned) unlinkSync(temporary);
       }
-      assertOwnedSync();
-      if (readFileSync2(path, "utf8") !== before) throw new ConfigOwnershipError();
-      renameSync(temporary, path);
-      temporaryOwned = false;
-    } finally {
-      if (temporaryOwned) unlinkSync(temporary);
     }
   };
   const release = () => {
@@ -4966,6 +5226,17 @@ async function withConfigWriteLock(operation) {
 function renewalFailure(error) {
   const path = "/api/developer-oauth/token";
   if (error instanceof ConfigOwnershipError) return new ConfigOwnershipError();
+  if (error instanceof TopoloReauthRequiredError) return error;
+  if ((error instanceof TopoloAuthError2 || error instanceof TopoloHttpError2) && error.status === 429) {
+    const message2 = "Topolo sign-in renewal is temporarily rate limited by Auth. Retry after the Retry-After interval; the saved sign-in has been retained.";
+    return new TopoloRateLimitError2(
+      "auth",
+      path,
+      { code: "rate_limited", retryable: true, message: message2 },
+      message2,
+      { requestId: error.requestId, retryAfter: error.retryAfter }
+    );
+  }
   if (error instanceof TopoloAuthError2 && error.code === "invalid_grant") {
     return new TopoloAuthError2("The saved Topolo sign-in can no longer be renewed. Sign in again.", "invalid_grant", {
       status: error.status,
@@ -4990,120 +5261,266 @@ function renewalFailure(error) {
     "Topolo sign-in renewal could not reach Auth. Retry the request; the saved sign-in has been retained."
   );
 }
-async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
+function isTerminalRefusal(error) {
+  return error instanceof TopoloAuthError2 && TERMINAL_RENEWAL_CODES.has(error.code) && (error.status === 400 || error.status === 401);
+}
+function resolveTarget(profile, target) {
+  if (target.kind === "active") {
+    return {
+      key: profile.activeContext ?? DEFAULT_SLOT,
+      credential: profile.credential,
+      oauthClientId: profile.oauthClientId,
+      context: profile.activeContext ? profile.contexts?.[profile.activeContext] : void 0
+    };
+  }
+  const context = profile.contexts?.[target.key];
+  return {
+    key: target.key,
+    credential: context?.credential,
+    oauthClientId: context?.oauthClientId ?? profile.oauthClientId,
+    context
+  };
+}
+function envCredentialConfigured(environment) {
   const prefix = envVarPrefix(environment);
-  if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
-    return resolveCredential(environment);
+  return Boolean(process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN);
+}
+function authServiceUrls(profile, environment, purpose) {
+  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+  if (environment === "local" && !serviceUrls?.auth) {
+    throw new TopoloSdkError2("environment_service_url_required", `Local Topolo ${purpose} requires an explicit local Auth service origin.`);
   }
+  return serviceUrls;
+}
+var renewalsInFlight = /* @__PURE__ */ new Map();
+function singleFlight(key, run) {
+  const existing = renewalsInFlight.get(key);
+  if (existing) return existing;
+  const started = run().finally(() => {
+    renewalsInFlight.delete(key);
+  });
+  renewalsInFlight.set(key, started);
+  return started;
+}
+async function renewTarget(environment, target, options) {
   const observedProfile = profileForEnvironment(await readConfig(), environment);
-  const observed = observedProfile.credential;
-  if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !observedProfile.oauthClientId || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
-  return withConfigWriteLock(async (_assertOwned, persist) => {
-    const config = await readConfig();
-    const profile = profileForEnvironment(config, environment);
-    const cred = profile.credential;
-    if (!cred || cred.kind !== "access_token") return cred ?? null;
-    if (!cred.refreshToken || !profile.oauthClientId) return cred;
-    const now = Math.floor(Date.now() / 1e3);
-    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken && cred.expiresAt !== void 0 && cred.expiresAt > now) {
-      return cred;
-    }
-    if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
-    const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
-    if (environment === "local" && !serviceUrls?.auth) {
-      throw new TopoloSdkError2(
-        "environment_service_url_required",
-        "Local Topolo credential refresh requires an explicit local Auth service origin."
-      );
-    }
-    try {
-      const oauth = new TopoloOAuth2({
-        serviceUrls
-      });
-      const tokens = await oauth.refreshToken({
-        clientId: profile.oauthClientId,
-        refreshToken: cred.refreshToken
-      });
+  const observedTarget = resolveTarget(observedProfile, target);
+  const observed = observedTarget.credential;
+  if (!observed) {
+    return observedProfile.reauthorization?.[observedTarget.key] ? continueReauthorization(environment, observedTarget.key) : null;
+  }
+  if (observed.kind !== "access_token" || !observed.refreshToken || !observedTarget.oauthClientId || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > nowSeconds()) return observed;
+  const flightKey = JSON.stringify([environment, target.kind === "active" ? "@active" : target.key]);
+  const run = async () => {
+    const outcome = await withConfigWriteLock(async (_assertOwned, persist) => {
+      const config = await readConfig();
+      const profile = profileForEnvironment(config, environment);
+      const resolved = resolveTarget(profile, target);
+      const credential = resolved.credential;
+      if (!credential) return profile.reauthorization?.[resolved.key] ? { reauthorize: resolved.key } : { credential: null };
+      if (credential.kind !== "access_token" || !credential.refreshToken || !resolved.oauthClientId) return { credential };
+      const now = nowSeconds();
+      if (options.force && observed.kind === "access_token" && observed.accessToken !== credential.accessToken && credential.expiresAt !== void 0 && credential.expiresAt > now) return { credential };
+      if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return { credential };
+      const sent = credential.refreshToken;
+      const endGrant = async (reason) => {
+        await persist((current) => {
+          const next = clone(current);
+          const touched = replaceGrant(next, environment, sent, null);
+          touched.add(resolved.key);
+          retire(next, sent, reason);
+          for (const key of touched) {
+            setReauthorization(next, environment, key, (existing) => ({ ...existing, reason, since: existing?.since ?? nowSeconds() }));
+          }
+          return next;
+        });
+        return { reauthorize: resolved.key };
+      };
+      const retired = retiredEntry(config, sent);
+      if (retired) {
+        return endGrant(retired.reason === "rotated" ? "rotated_grant_lost" : retired.reason);
+      }
+      const serviceUrls = authServiceUrls(profile, environment, target.kind === "active" ? "credential refresh" : "context refresh");
+      let tokens;
+      try {
+        tokens = await boundedOAuth(serviceUrls).refreshToken({ clientId: resolved.oauthClientId, refreshToken: sent });
+      } catch (error) {
+        if (isTerminalRefusal(error)) return endGrant(error.code);
+        throw renewalFailure(error);
+      }
       const refreshed = {
         kind: "access_token",
         accessToken: tokens.access_token,
-        ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
-        expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+        refreshToken: tokens.refresh_token ?? sent,
+        expiresAt: nowSeconds() + tokens.expires_in
       };
-      await persist((current) => {
-        const latest = profileForEnvironment(current, environment);
-        const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-        if (!same(latest.credential, cred) || latest.oauthClientId !== profile.oauthClientId || latest.activeContext !== profile.activeContext)
-          throw new ConfigOwnershipError();
-        const activeContext = latest.activeContext;
-        const activeEntry = activeContext ? latest.contexts?.[activeContext] : void 0;
-        const previousEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
-        if (!same(activeEntry?.credential, previousEntry?.credential)) throw new ConfigOwnershipError();
-        return activeContext && activeEntry ? writeProfileConfig(current, environment, {
-          credential: refreshed,
-          contexts: { ...latest.contexts, [activeContext]: {
-            ...activeEntry,
-            credential: refreshed,
-            oauthClientId: activeEntry.oauthClientId ?? latest.oauthClientId
-          } }
-        }) : environment === "production" && !current.profiles?.production ? { ...current, credential: refreshed } : writeProfileConfig(current, environment, { credential: refreshed });
-      });
-      return refreshed;
-    } catch (error) {
-      throw renewalFailure(error);
-    }
-  });
+      try {
+        await persist((current) => {
+          const next = clone(current);
+          replaceGrant(next, environment, sent, refreshed);
+          if (tokens.refresh_token && tokens.refresh_token !== sent) retire(next, sent, "rotated");
+          return next;
+        });
+      } catch (error) {
+        throw renewalFailure(error);
+      }
+      return { credential: refreshed };
+    });
+    if ("reauthorize" in outcome) return continueReauthorization(environment, outcome.reauthorize);
+    return outcome.credential;
+  };
+  return options.force ? run() : singleFlight(flightKey, run);
+}
+async function refreshCredentialIfNeeded(environment = selectedEnvironment(), options = {}) {
+  if (envCredentialConfigured(environment)) return resolveCredential(environment);
+  return renewTarget(environment, { kind: "active" }, options);
 }
 async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
-  const observedProfile = profileForEnvironment(await readConfig(), environment);
-  const observedContext = observedProfile.contexts?.[key];
-  const observed = observedContext?.credential;
-  if (!observed || observed.kind !== "access_token" || !observed.refreshToken || !(observedContext.oauthClientId ?? observedProfile.oauthClientId) || !options.force && observed.expiresAt && observed.expiresAt - REFRESH_SKEW_SECONDS > Math.floor(Date.now() / 1e3)) return observed ?? null;
+  return renewTarget(environment, { kind: "context", key }, options);
+}
+function decodeTokenOrganization(accessToken) {
+  try {
+    const payload = accessToken.split(".")[1];
+    if (!payload) return { known: false, organizationId: null };
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    const org = claims.orgId ?? claims.organizationId ?? claims.org_id ?? null;
+    return { known: true, organizationId: typeof org === "string" && org ? org : null };
+  } catch {
+    return { known: false, organizationId: null };
+  }
+}
+async function continueReauthorization(environment, key) {
   return withConfigWriteLock(async (_assertOwned, persist) => {
     const config = await readConfig();
     const profile = profileForEnvironment(config, environment);
-    const context = profile.contexts?.[key];
-    const credential = context?.credential;
-    if (!credential || credential.kind !== "access_token") return credential ?? null;
-    const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
-    if (!credential.refreshToken || !oauthClientId) return credential;
-    const now = Math.floor(Date.now() / 1e3);
-    if (options.force && observed.accessToken !== credential.accessToken && credential.expiresAt !== void 0 && credential.expiresAt > now) return credential;
-    if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
-    const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
-    if (environment === "local" && !serviceUrls?.auth) {
-      throw new TopoloSdkError2(
-        "environment_service_url_required",
-        "Local Topolo context refresh requires an explicit local Auth service origin."
-      );
+    const credential = slotCredential(profile, key);
+    if (credential && usableCredential(config, credential)) return credential;
+    const entry = profile.reauthorization?.[key];
+    if (!entry) return credential ?? null;
+    const clientId = (key === DEFAULT_SLOT ? void 0 : profile.contexts?.[key]?.oauthClientId) ?? profile.oauthClientId;
+    if (!clientId) throw reauthRequired(environment, key, entry, "unavailable");
+    const serviceUrls = authServiceUrls(profile, environment, "sign-in renewal");
+    const oauth = boundedOAuth(serviceUrls);
+    const now = nowSeconds();
+    let state = clone(entry);
+    const save = async (update) => {
+      await persist((current) => {
+        const next = clone(current);
+        setReauthorization(next, environment, key, update);
+        return next;
+      });
+    };
+    let pending = state.pending && state.pending.clientId === clientId && state.pending.expiresAt > now ? state.pending : void 0;
+    if (pending && !pending.denied && pending.nextPollAt <= now) {
+      let tokens;
+      try {
+        tokens = await oauth.pollDeviceToken({ clientId, deviceCode: pending.deviceCode });
+      } catch (error) {
+        const code = error instanceof TopoloAuthError2 ? error.code : void 0;
+        if (code === "authorization_pending") {
+          pending = { ...pending, nextPollAt: now + pending.interval };
+        } else if (code === "slow_down") {
+          const interval = pending.interval + 5;
+          const retryAfter = Number(error.retryAfter);
+          pending = { ...pending, interval, nextPollAt: now + Math.max(interval, Number.isFinite(retryAfter) ? retryAfter : 0) };
+        } else if (code === "access_denied") {
+          pending = { ...pending, denied: true };
+        } else if (code === "expired_token" || code === "invalid_grant") {
+          pending = void 0;
+        } else {
+          const retryAfter = Number(error.retryAfter);
+          pending = { ...pending, nextPollAt: now + Math.max(pending.interval * 2, Number.isFinite(retryAfter) ? retryAfter : 0) };
+        }
+        state = { ...state, pending };
+        if (!pending) delete state.pending;
+        await save(() => state);
+        if (pending) throw reauthRequired(environment, key, state, pending.denied ? "denied" : "awaiting_approval");
+      }
+      if (tokens) {
+        const approved = {
+          kind: "access_token",
+          accessToken: tokens.access_token,
+          ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {},
+          expiresAt: nowSeconds() + tokens.expires_in
+        };
+        const organization = decodeTokenOrganization(tokens.access_token);
+        const approvedKey = organization.known ? organization.organizationId ? `org:${organization.organizationId}` : "personal" : null;
+        const matches = key === DEFAULT_SLOT || approvedKey === key;
+        await persist((current) => {
+          const next = clone(current);
+          const nextProfile = (next.profiles ??= {})[environment] ??= {};
+          const legacyProduction = environment === "production" && !current.profiles?.[environment]?.contexts && key === DEFAULT_SLOT && Boolean(current.credential);
+          if (matches) {
+            if (key === DEFAULT_SLOT) {
+              if (legacyProduction) next.credential = approved;
+              else nextProfile.credential = approved;
+            } else {
+              const existing = nextProfile.contexts?.[key];
+              nextProfile.contexts = { ...nextProfile.contexts ?? {}, [key]: {
+                ...existing ?? (key.startsWith("org:") ? { contextType: "organization", organizationId: key.slice(4) } : { contextType: "personal" }),
+                credential: approved,
+                oauthClientId: clientId
+              } };
+              if (nextProfile.activeContext === key) nextProfile.credential = approved;
+            }
+            setReauthorization(next, environment, key, () => void 0);
+          } else {
+            if (approvedKey && !(approvedKey in (nextProfile.reauthorization ?? {}))) {
+              const existing = nextProfile.contexts?.[approvedKey];
+              nextProfile.contexts = { ...nextProfile.contexts ?? {}, [approvedKey]: {
+                ...existing ?? (approvedKey.startsWith("org:") ? { contextType: "organization", organizationId: approvedKey.slice(4) } : { contextType: "personal" }),
+                credential: approved,
+                oauthClientId: clientId
+              } };
+              if (nextProfile.activeContext === approvedKey) nextProfile.credential = approved;
+            }
+            setReauthorization(next, environment, key, (existing) => {
+              const updated = {
+                ...existing ?? state,
+                mismatch: { approvedContext: approvedKey ?? "an unverifiable context", at: nowSeconds() }
+              };
+              delete updated.pending;
+              return updated;
+            });
+          }
+          return next;
+        });
+        if (matches) return approved;
+        const latest = profileForEnvironment(await readConfig(), environment).reauthorization?.[key];
+        throw reauthRequired(environment, key, latest ?? state, "organization_mismatch");
+      }
+    }
+    if (pending) {
+      throw reauthRequired(environment, key, state, pending.denied ? "denied" : "awaiting_approval");
+    }
+    if (state.startRetryAt && state.startRetryAt > now) {
+      throw reauthRequired(environment, key, state, state.mismatch ? "organization_mismatch" : "unavailable");
     }
     try {
-      const oauth = new TopoloOAuth2({ serviceUrls });
-      const tokens = await oauth.refreshToken({
-        clientId: oauthClientId,
-        refreshToken: credential.refreshToken
-      });
-      const refreshed = {
-        kind: "access_token",
-        accessToken: tokens.access_token,
-        ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
-        expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      const started = await oauth.requestDeviceCode({ clientId });
+      const interval = Math.max(1, Math.floor(Number(started.interval) || 5));
+      const startedPending = {
+        clientId,
+        deviceCode: started.device_code,
+        userCode: started.user_code,
+        verificationUri: started.verification_uri,
+        ...started.verification_uri_complete ? { verificationUriComplete: started.verification_uri_complete } : {},
+        startedAt: now,
+        expiresAt: now + Math.max(1, Math.floor(Number(started.expires_in) || 600)),
+        interval,
+        nextPollAt: now + interval
       };
-      await persist((current) => {
-        const latest = profileForEnvironment(current, environment);
-        const latestContext = latest.contexts?.[key];
-        if (!latestContext || JSON.stringify(latestContext.credential) !== JSON.stringify(credential) || (latestContext.oauthClientId ?? latest.oauthClientId) !== oauthClientId || latestContext.contextType !== context.contextType || latestContext.organizationId !== context.organizationId)
-          throw new ConfigOwnershipError();
-        if (latest.activeContext === key && JSON.stringify(latest.credential) !== JSON.stringify(profile.activeContext === key ? profile.credential : credential))
-          throw new ConfigOwnershipError();
-        return writeProfileConfig(current, environment, {
-          ...latest.activeContext === key ? { credential: refreshed } : {},
-          contexts: { ...latest.contexts, [key]: { ...latestContext, credential: refreshed, oauthClientId } }
-        });
-      });
-      return refreshed;
+      state = { ...state, pending: startedPending };
+      delete state.startRetryAt;
+      await save(() => state);
+      throw reauthRequired(environment, key, state, "awaiting_approval");
     } catch (error) {
-      throw renewalFailure(error);
+      if (error instanceof TopoloReauthRequiredError || error instanceof ConfigOwnershipError) throw error;
+      const retryAfter = Number(error.retryAfter);
+      state = { ...state, startRetryAt: now + Math.max(30, Number.isFinite(retryAfter) ? retryAfter : 0) };
+      delete state.pending;
+      await save(() => state);
+      throw reauthRequired(environment, key, state, "unavailable");
     }
   });
 }
@@ -7079,7 +7496,7 @@ function message(error) {
 
 // src/commands/agent-config.ts
 import { existsSync as existsSync5 } from "fs";
-import { lstat as lstat2, mkdir as mkdir3, open, readFile as readFile5, rename as rename2, unlink, writeFile as writeFile3 } from "fs/promises";
+import { lstat as lstat2, mkdir as mkdir3, open, readFile as readFile5, rename as rename2, unlink, writeFile as writeFile2 } from "fs/promises";
 import { randomUUID as randomUUID3 } from "crypto";
 import { dirname as dirname5 } from "path";
 async function installAgentSkill(agent, source, homeDir, projectDir, codexHome) {
@@ -7315,7 +7732,7 @@ async function atomicWrite(path, contents, before) {
     const created = await handle.stat();
     temporaryIdentity = [created.dev, created.ino].join(":");
     await assertSnapshot(path, destination);
-    await writeFile3(handle, contents, { encoding: "utf8" });
+    await writeFile2(handle, contents, { encoding: "utf8" });
     await handle.close();
     handleClosed = true;
     await assertSnapshot(path, destination);