@topolo/cli 0.13.17 → 0.13.21

package/dist/index.js

@@ -36,7 +36,7 @@ function registerAgentPacksCommand(program2) {
       throw new Error("Exact closed smoke operation, role/case and UUID required.");
     const store = packs.opts().store ?? resolve(homedir(), "AgentPacks");
     if (options.harness === "claude") {
-      const { operateClaudeSmoke } = await import("./claude-pack-backend-YEVPAOID.js");
+      const { operateClaudeSmoke } = await import("./claude-pack-backend-HUTKGIDS.js");
       console.log(JSON.stringify(await operateClaudeSmoke({
         store,
         kind: "smoke-" + operation,
@@ -64,9 +64,74 @@ function registerAgentPacksCommand(program2) {
     if (result.error) throw new Error("Python 3.11 or later is required for local packs.");
     if (result.status !== 0) process.exitCode = result.status ?? 2;
   });
-  packs.command("configure").description("Qualify and configure an adopted Claude roster through its live native backend").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
+  packs.command("startup-settings").description("Apply coordinator pins, model and permissions using discovered native capabilities; separate from cloud activation").argument("<pack>").option("--policy <path>", "Reviewed policy, or new output path with --prepare").option("--allow-native-debugger-menu", "Explicit launcher-only consent for the exact owned main-debugger checkbox").option("--upgrade-control", "Upgrade only the exact idle native control; preserve coordinators, settings and task state").option("--finalize", "Finalize exact native coordinators only after independently reviewed cloud qualification").option("--startup-operation <uuid>", "Original acknowledged startup operation for finalization").option("--qualification-task <uuid>", "Completed cloud qualification task with archived native workers").option("--complete-startup", "Finish only acknowledged settings/control startup without replaying native input or pinning").option("--continue-launch <uuid>", "Continue an exact interrupted cold-launch phase without creating sessions or replaying input").option("--launch-desktop", "Launch or discover the exact owned signed-in Desktop profile before native startup").option("--desktop-profile <path>", "Existing owned Desktop user-data directory; never copied").option("--claude-config-dir <path>", "Existing owned SDK configuration/history directory; never copied").option("--continue-readiness", "Continue only the original acknowledged tool-free probes without resending existing input").option("--reconcile", "Reconcile only an interrupted tool-free coordinator bootstrap; never replay native input").option("--prepare", "Prepare exactly three coordinators and freshly verify approved organization policy before native startup").option("--endpoint <url>", "Explicit authorized loopback Claude main-process endpoint").option("--pid <pid>", "Expected Claude main-process PID").option("--previous-library <path>", "Existing private original coordinator adoption library, retired only after successor acknowledgement").option("--previous-connection <path>", "Explicit private owned Desktop task connection for a quiescent installation transfer").option("--apply", "Apply native startup settings; otherwise preflight only").action(async (pack, options) => {
+    const { configureClaudeStartup, recoverClaudeStartup, lockClaudeLibrary, completeClaudeStartup } = await import("./claude-pack-backend-HUTKGIDS.js");
+    if (options.continueLaunch) {
+      if (!options.launchDesktop || !options.apply || !options.policy || !options.endpoint || !options.pid || options.prepare || options.reconcile || options.continueReadiness || options.completeStartup || options.upgradeControl || options.finalize || options.previousConnection || options.previousLibrary || options.desktopProfile || options.claudeConfigDir || options.startupOperation || options.qualificationTask || options.allowNativeDebuggerMenu) throw Error("Cold continuation requires only exact pending operation, current PID/endpoint/policy, launch-desktop and apply.");
+      const { launchActivatedClaudePack } = await import("./claude-pack-activation-Q25MCEPU.js");
+      console.log(JSON.stringify(await launchActivatedClaudePack({ store: packs.opts().store ?? resolve(homedir(), "AgentPacks"), pack, policy: options.policy, continueLaunch: options.continueLaunch, endpoint: options.endpoint, pid: Number(options.pid) }), null, 2));
+      return;
+    }
+    if (options.upgradeControl) {
+      if (!options.apply || !options.policy || !options.endpoint || !options.pid || !options.startupOperation || options.qualificationTask || options.allowNativeDebuggerMenu || options.finalize || options.launchDesktop || options.prepare || options.reconcile || options.continueReadiness || options.completeStartup || options.previousConnection || options.previousLibrary || options.desktopProfile || options.claudeConfigDir) throw Error("Control upgrade requires only exact original startup and current endpoint/PID/policy/apply.");
+      const { upgradeClaudeControl } = await import("./claude-pack-activation-Q25MCEPU.js");
+      console.log(JSON.stringify(await upgradeClaudeControl({ store: packs.opts().store ?? resolve(homedir(), "AgentPacks"), pack, policy: options.policy, endpoint: options.endpoint, pid: Number(options.pid), startupOperation: options.startupOperation }), null, 2));
+      return;
+    }
+    if (options.finalize) {
+      if (!options.apply || !options.policy || !options.endpoint || !options.pid || !options.startupOperation || !options.qualificationTask || options.launchDesktop || options.prepare || options.reconcile || options.continueReadiness || options.completeStartup || options.previousConnection || options.previousLibrary || options.desktopProfile || options.claudeConfigDir) throw Error("Finalization requires only exact original startup/cloud qualification and current endpoint/PID/policy/apply.");
+      const { finalizeClaudePack } = await import("./claude-pack-activation-Q25MCEPU.js");
+      console.log(JSON.stringify(await finalizeClaudePack({ store: packs.opts().store ?? resolve(homedir(), "AgentPacks"), pack, policy: options.policy, endpoint: options.endpoint, pid: Number(options.pid), startupOperation: options.startupOperation, qualificationTask: options.qualificationTask, ...options.allowNativeDebuggerMenu ? { allowNativeDebuggerMenu: true } : {} }), null, 2));
+      return;
+    }
+    if (options.startupOperation || options.qualificationTask || options.allowNativeDebuggerMenu) throw Error("Startup/cloud qualification selectors apply only to finalization.");
+    if (options.launchDesktop) {
+      const root = packs.opts().store ?? resolve(homedir(), "AgentPacks");
+      if (existsSync(resolve(root, "claude/activation.json")) && options.apply) {
+        const receipt = JSON.parse(readFileSync(resolve(root, "claude/activation.json"), "utf8"));
+        if (options.desktopProfile && options.desktopProfile !== receipt.profile?.userData || options.claudeConfigDir && options.claudeConfigDir !== receipt.profile?.codeConfig) throw Error("Activated launch profile differs.");
+        if (!options.policy || options.endpoint || options.pid || options.prepare || options.reconcile || options.continueReadiness || options.completeStartup || options.previousLibrary || options.previousConnection) throw Error("Activated launch accepts only current policy and owned profile.");
+        const { launchActivatedClaudePack } = await import("./claude-pack-activation-Q25MCEPU.js");
+        console.log(JSON.stringify(await launchActivatedClaudePack({ store: root, pack, policy: options.policy }), null, 2));
+        return;
+      }
+      if (!options.policy || !options.desktopProfile || !options.claudeConfigDir || options.endpoint || options.pid || options.prepare || options.reconcile || options.continueReadiness || options.completeStartup || options.previousLibrary || options.previousConnection) throw Error("Managed launch requires only exact existing profile directories, policy and optional apply.");
+      const { launchClaudeDesktopProfile } = await import("./claude-desktop-profile-JCQKSY3K.js");
+      const release = await lockClaudeLibrary(root);
+      try {
+        console.log(JSON.stringify(launchClaudeDesktopProfile({ root, pack, policy: options.policy, userData: options.desktopProfile, codeConfig: options.claudeConfigDir, apply: options.apply === true }), null, 2));
+      } finally {
+        release();
+      }
+      return;
+    }
+    if (options.desktopProfile || options.claudeConfigDir || !options.endpoint || !options.pid) throw Error("Native startup requires exact endpoint/PID; profile paths are accepted only for managed launch.");
+    if (options.completeStartup) {
+      if (!options.apply || !options.policy || options.prepare || options.reconcile || options.continueReadiness || options.previousConnection) throw Error("Late startup completion requires only original policy/apply and existing previous-library proof.");
+      console.log(JSON.stringify(await completeClaudeStartup({ store: packs.opts().store ?? resolve(homedir(), "AgentPacks"), pack, policy: options.policy, endpoint: options.endpoint, pid: Number(options.pid), ...options.previousLibrary ? { previousLibrary: options.previousLibrary } : {} }), null, 2));
+      return;
+    }
+    if (options.reconcile) {
+      if (options.apply || options.prepare || options.policy || options.previousConnection || options.previousLibrary || options.continueReadiness) throw new Error("Startup reconciliation accepts no apply, preparation, policy or transfer effects.");
+      console.log(JSON.stringify(await recoverClaudeStartup({ store: packs.opts().store ?? resolve(homedir(), "AgentPacks"), pack, endpoint: options.endpoint, pid: Number(options.pid) }), null, 2));
+      return;
+    }
+    console.log(JSON.stringify(await configureClaudeStartup({
+      store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
+      pack,
+      policy: options.policy,
+      endpoint: options.endpoint,
+      pid: Number(options.pid),
+      apply: options.apply === true,
+      ...options.previousConnection ? { previousConnection: options.previousConnection } : {},
+      ...options.previousLibrary ? { previousLibrary: options.previousLibrary } : {},
+      ...options.prepare ? { prepare: true } : {},
+      ...options.continueReadiness ? { continueReadiness: true } : {}
+    }), null, 2));
+  });
+  packs.command("configure").description("Configure Claude coordinator startup settings through discovered native capabilities; cloud activation is separate").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
     if (options.harness !== "claude") throw new Error("Native configure is currently qualified only for Claude Desktop.");
-    const { configureClaudePack } = await import("./claude-pack-backend-YEVPAOID.js");
+    const { configureClaudePack } = await import("./claude-pack-backend-HUTKGIDS.js");
     const result = await configureClaudePack({
       store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
       pack,
@@ -90,9 +155,23 @@ function registerAgentPacksCommand(program2) {
     "recover",
     "doctor",
     "open",
+    "desktop-launcher",
     "policy",
     "permissions",
     "lane",
+    "work",
+    "work-recover",
+    "work-install",
+    "work-bind-roles",
+    "work-cloud-attach",
+    "work-cloud-migrate",
+    "work-renew-coordinators",
+    "work-recover-claude-completion",
+    "work-repair-model-ceilings",
+    "work-closed-ledger-fence",
+    "work-cloud-cutover",
+    "work-cloud-prepare-delta",
+    "work-refresh-role-refs",
     "approvals",
     "remote-recover",
     "connect",
@@ -108,13 +187,13 @@ function registerAgentPacksCommand(program2) {
     if (name === "approvals") command.option("--connection <id>", "Exact private dynamic lane control connection").option("--intake <id>", "Exact owning native intake identity").option("--fingerprint <hash>", "Exact pending native request fingerprint").option("--response <path>", "Recorded one-request response JSON").option("--human-decision-recorded", "Assert that the exact human decision is recorded in the intake");
     command.option("--harness <name>", "Local host adapter (codex, claude Desktop Code sessions)", "codex").option("--adapter-help", "Show every option supported by the selected adapter").argument("[arguments...]").allowUnknownOption().allowExcessArguments().addHelpText("after", name === "add" ? "\nExamples:\n  topolo agent-packs add founder\n  topolo agent-packs add founder --group specialists\n  topolo agent-packs add founder --agent strategy\n" : "\nRun topolo agent-packs <command> --adapter-help for all adapter options. Cloud commands require explicit --environment and --context-key.\n").action(async (args, options) => {
       if (!["codex", "claude"].includes(options.harness)) throw new Error(`The ${options.harness} pack adapter is not available. Supported adapters: codex, claude.`);
-      if (name === "lane" && options.harness === "claude" && !options.adapterHelp && !["status", "models-template", "models-install"].includes(args[0] ?? "")) {
+      if (name === "lane" && options.harness === "claude" && !options.adapterHelp && !["allocate", "status", "models-template", "models-install"].includes(args[0] ?? "")) {
         if (options.connection) {
           if (args.length !== 1 || !["read", "context-start", "context-read", "fixture-start", "fixture-read", "retire", "close"].includes(args[0]))
             throw new Error("Closed existing Claude lane control operation required.");
           const input3 = options.input ? JSON.parse(readFileSync(options.input, "utf8")) : {};
           if (!input3 || typeof input3 !== "object" || Array.isArray(input3) || Object.keys(input3).some((k) => k !== "operationId")) throw new Error("Only an exact bootstrap/fixture operation UUID may be supplied.");
-          const { operateClaudeLaneControl } = await import("./claude-pack-backend-YEVPAOID.js");
+          const { operateClaudeLaneControl } = await import("./claude-pack-backend-HUTKGIDS.js");
           console.log(JSON.stringify(await operateClaudeLaneControl({
             store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
             connection: options.connection,
@@ -126,7 +205,7 @@ function registerAgentPacksCommand(program2) {
           throw new Error("Closed Claude lane operation requires --input, --pack, --policy, --endpoint and --pid.");
         const input2 = JSON.parse(readFileSync(options.input, "utf8"));
         if (!input2 || typeof input2 !== "object" || Array.isArray(input2)) throw new Error("Closed native lane input object required.");
-        const { operateClaudeLane } = await import("./claude-pack-backend-YEVPAOID.js");
+        const { operateClaudeLane } = await import("./claude-pack-backend-HUTKGIDS.js");
         console.log(JSON.stringify(await operateClaudeLane({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           pack: options.pack,
@@ -152,7 +231,7 @@ function registerAgentPacksCommand(program2) {
           decision = response.decision;
         }
         if (options.connection) {
-          const { operateClaudeLaneControl } = await import("./claude-pack-backend-YEVPAOID.js");
+          const { operateClaudeLaneControl } = await import("./claude-pack-backend-HUTKGIDS.js");
           console.log(JSON.stringify(await operateClaudeLaneControl({
             store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
             connection: options.connection,
@@ -164,7 +243,7 @@ function registerAgentPacksCommand(program2) {
           }), null, 2));
           return;
         }
-        const { operateClaudeApprovals } = await import("./claude-pack-backend-YEVPAOID.js");
+        const { operateClaudeApprovals } = await import("./claude-pack-backend-HUTKGIDS.js");
         console.log(JSON.stringify(await operateClaudeApprovals({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           kind: args[0],
@@ -179,7 +258,7 @@ function registerAgentPacksCommand(program2) {
       if (name !== "lane" && (options.policy || options.endpoint || options.pid || options.apply)) {
         if (options.harness !== "claude" || !options.policy || !options.endpoint || !options.pid || args.length !== 1)
           throw new Error("Native switch/recovery requires one Claude pack, --policy, --endpoint and --pid.");
-        const { configureClaudePack } = await import("./claude-pack-backend-YEVPAOID.js");
+        const { configureClaudePack } = await import("./claude-pack-backend-HUTKGIDS.js");
         const result2 = await configureClaudePack({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           pack: args[0],
@@ -226,12 +305,10 @@ function registerAgentPacksCommand(program2) {
 import { Command, Help } from "commander";
 
 // src/commands/auth.ts
-import { spawn } from "child_process";
-import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.22/node_modules/@topolo/sdk/dist/index.js
+// node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -249,6 +326,56 @@ function validTopoloActionAccessPolicy(value) {
   }
   return true;
 }
+function record2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function text(value, limit = 512) {
+  return typeof value === "string" && value.trim() ? value.trim().slice(0, limit) : null;
+}
+function strings2(value) {
+  return Array.isArray(value) ? value.slice(0, 8).flatMap((item) => {
+    const result = text(item);
+    return result ? [result] : [];
+  }) : [];
+}
+function pairs(value, first, second) {
+  return Array.isArray(value) ? value.slice(0, 8).flatMap((item) => {
+    if (!record2(item)) return [];
+    const a = text(item[first], 160);
+    const b = text(item[second]);
+    return a && b ? [{ [first]: a, [second]: b }] : [];
+  }) : [];
+}
+function docs(value) {
+  const result = text(value, 2048);
+  if (!result) return null;
+  try {
+    const url = new URL(result);
+    return url.protocol === "https:" && !url.username && !url.password ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeApplicationGuide(value) {
+  if (!record2(value) || value.schemaVersion !== 1 || value.source !== "published_application_manifest") return null;
+  const purpose = text(value.purpose, 2048);
+  const gettingStarted = strings2(value.gettingStarted);
+  const docsUrl = docs(value.docsUrl);
+  return {
+    schemaVersion: 1,
+    source: "published_application_manifest",
+    publishedAt: text(value.publishedAt, 160),
+    purpose,
+    problemStatement: text(value.problemStatement, 2048),
+    solutionStatement: text(value.solutionStatement, 2048),
+    benefits: strings2(value.benefits),
+    features: pairs(value.features, "title", "description"),
+    gettingStarted,
+    worksWellWith: pairs(value.worksWellWith, "appId", "reason"),
+    docsUrl,
+    missingFields: [...!purpose ? ["purpose"] : [], ...!docsUrl ? ["docsUrl"] : [], ...!gettingStarted.length ? ["gettingStarted"] : []]
+  };
+}
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -364,9 +491,9 @@ function canonicalTopoloServiceErrorCode(value) {
 }
 function sanitizeTopoloServiceMessage(value) {
   if (typeof value !== "string") return void 0;
-  const text3 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
-  if (!text3) return void 0;
-  return text3.length > SERVICE_MESSAGE_MAX_LENGTH ? `${text3.slice(0, SERVICE_MESSAGE_MAX_LENGTH - 1).trimEnd()}\u2026` : text3;
+  const text4 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text4) return void 0;
+  return text4.length > SERVICE_MESSAGE_MAX_LENGTH ? `${text4.slice(0, SERVICE_MESSAGE_MAX_LENGTH - 1).trimEnd()}\u2026` : text4;
 }
 function canonicalTopoloRequestId(value) {
   if (typeof value !== "string") return void 0;
@@ -434,10 +561,10 @@ var TopoloPermissionError = class extends TopoloSdkError {
 };
 function extractTopoloServiceErrorCode(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
-  const record4 = body;
-  const topLevel = canonicalTopoloServiceErrorCode(record4.code);
+  const record5 = body;
+  const topLevel = canonicalTopoloServiceErrorCode(record5.code);
   if (topLevel) return topLevel;
-  const nested = record4.error;
+  const nested = record5.error;
   const nestedString = canonicalTopoloServiceErrorCode(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
@@ -449,13 +576,13 @@ function extractTopoloServiceErrorCode(body) {
 }
 function extractTopoloServiceErrorMessage(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
-  const record4 = body;
-  const nested = record4.error;
+  const record5 = body;
+  const nested = record5.error;
   const candidates = [];
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     candidates.push(nested.message);
   }
-  candidates.push(record4.message, record4.error_description);
+  candidates.push(record5.message, record5.error_description);
   if (typeof nested === "string" && !canonicalTopoloServiceErrorCode(nested)) candidates.push(nested);
   for (const candidate of candidates) {
     const message3 = sanitizeTopoloServiceMessage(candidate);
@@ -468,14 +595,14 @@ function serviceErrorCode(body, fallback) {
 }
 function extractTopoloServiceErrorDetails(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
-  const record4 = body;
-  let candidate = record4.details;
-  const nested = record4.error;
+  const record5 = body;
+  let candidate = record5.details;
+  const nested = record5.error;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const nestedRecord = nested;
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
-  if (candidate === void 0) candidate = record4;
+  if (candidate === void 0) candidate = record5;
   if (Array.isArray(candidate)) return validationIssueDetails(canonicalTopoloValidationIssues(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
@@ -534,18 +661,18 @@ function validationIssueDetails(issues) {
   return paths.length ? { paths, issues } : { issues };
 }
 function issue(path, message3) {
-  const text3 = sanitizeTopoloServiceMessage(message3);
-  if (!path && !text3) return null;
-  return { ...path ? { path } : {}, ...text3 ? { message: text3 } : {} };
+  const text4 = sanitizeTopoloServiceMessage(message3);
+  if (!path && !text4) return null;
+  return { ...path ? { path } : {}, ...text4 ? { message: text4 } : {} };
 }
 function canonicalTopoloValidationIssues(values) {
   const issues = [];
   for (const value of values) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
-    const record4 = value;
-    const path = canonicalTopoloValidationPath(record4.field) ?? canonicalTopoloValidationPath(record4.path);
+    const record5 = value;
+    const path = canonicalTopoloValidationPath(record5.field) ?? canonicalTopoloValidationPath(record5.path);
     if (!path) continue;
-    const projected = issue(path, record4.message);
+    const projected = issue(path, record5.message);
     if (projected) issues.push(projected);
     if (issues.length === SERVICE_ISSUE_LIMIT) break;
   }
@@ -699,8 +826,8 @@ function sensitive(key, value) {
   const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
   if (normalized === "capability") {
     if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
-    const text3 = value.trim();
-    return Boolean(text3) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text3);
+    const text4 = value.trim();
+    return Boolean(text4) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text4);
   }
   return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey|backupcodes?|recoverycodes?)$/.test(normalized);
 }
@@ -1269,7 +1396,7 @@ var ActorEnvelopeValidationError = class extends Error {
   }
 };
 function parseActorEnvelope(value) {
-  const envelope = record2(value, "actorEnvelope");
+  const envelope = record3(value, "actorEnvelope");
   exactKeys(envelope, [
     "schemaVersion",
     "organizationId",
@@ -1287,28 +1414,28 @@ function parseActorEnvelope(value) {
   }
   const accountableSubject = parseAccountableSubject(envelope.accountableSubject);
   const performer = parseIdentity(envelope.performer, "actorEnvelope.performer");
-  const organizationId = text(envelope.organizationId, "actorEnvelope.organizationId");
+  const organizationId = text2(envelope.organizationId, "actorEnvelope.organizationId");
   const channel = member(envelope.channel, CHANNELS, "actorEnvelope.channel");
   const issuedAt = timestamp(envelope.issuedAt, "actorEnvelope.issuedAt");
   const expiresAt = envelope.expiresAt === void 0 ? void 0 : timestamp(envelope.expiresAt, "actorEnvelope.expiresAt");
   if (expiresAt && Date.parse(expiresAt) <= Date.parse(issuedAt)) {
     fail("actorEnvelope.expiresAt", "must be later than issuedAt");
   }
-  const assuranceValue = record2(envelope.assurance, "actorEnvelope.assurance");
+  const assuranceValue = record3(envelope.assurance, "actorEnvelope.assurance");
   exactKeys(assuranceValue, ["level", "methods"], "actorEnvelope.assurance");
   const assurance = {
     level: member(assuranceValue.level, ASSURANCE_LEVELS, "actorEnvelope.assurance.level"),
     methods: textArray(assuranceValue.methods, "actorEnvelope.assurance.methods")
   };
-  const actionValue = record2(envelope.action, "actorEnvelope.action");
+  const actionValue = record3(envelope.action, "actorEnvelope.action");
   exactKeys(actionValue, ["requestId", "actionId", "resourceType", "resourceId", "inputHash"], "actorEnvelope.action");
-  const inputHash = text(actionValue.inputHash, "actorEnvelope.action.inputHash");
+  const inputHash = text2(actionValue.inputHash, "actorEnvelope.action.inputHash");
   if (!HASH_PATTERN.test(inputHash)) fail("actorEnvelope.action.inputHash", "must be a lowercase sha256 digest");
   const action = {
-    requestId: text(actionValue.requestId, "actorEnvelope.action.requestId"),
-    actionId: text(actionValue.actionId, "actorEnvelope.action.actionId"),
-    ...actionValue.resourceType === void 0 ? {} : { resourceType: text(actionValue.resourceType, "actorEnvelope.action.resourceType") },
-    ...actionValue.resourceId === void 0 ? {} : { resourceId: text(actionValue.resourceId, "actorEnvelope.action.resourceId") },
+    requestId: text2(actionValue.requestId, "actorEnvelope.action.requestId"),
+    actionId: text2(actionValue.actionId, "actorEnvelope.action.actionId"),
+    ...actionValue.resourceType === void 0 ? {} : { resourceType: text2(actionValue.resourceType, "actorEnvelope.action.resourceType") },
+    ...actionValue.resourceId === void 0 ? {} : { resourceId: text2(actionValue.resourceId, "actorEnvelope.action.resourceId") },
     inputHash
   };
   if (action.resourceType === void 0 !== (action.resourceId === void 0)) {
@@ -1370,12 +1497,12 @@ function canonicalJson(value) {
 }
 function parseAccountableSubject(value) {
   const path = "actorEnvelope.accountableSubject";
-  const subject = record2(value, path);
+  const subject = record3(value, path);
   exactKeys(subject, ["principalType", "principalId", "displayName"], path);
   return {
     principalType: member(subject.principalType, ACCOUNTABLE_SUBJECT_TYPES, `${path}.principalType`),
-    principalId: text(subject.principalId, `${path}.principalId`),
-    ...subject.displayName === void 0 ? {} : { displayName: text(subject.displayName, `${path}.displayName`) }
+    principalId: text2(subject.principalId, `${path}.principalId`),
+    ...subject.displayName === void 0 ? {} : { displayName: text2(subject.displayName, `${path}.displayName`) }
   };
 }
 async function sha256CanonicalValue(value) {
@@ -1384,7 +1511,7 @@ async function sha256CanonicalValue(value) {
   return `sha256:${Array.from(new Uint8Array(digest2), (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
 }
 function parseIdentity(value, path) {
-  const identity = record2(value, path);
+  const identity = record3(value, path);
   exactKeys(identity, [
     "principalType",
     "principalId",
@@ -1397,7 +1524,7 @@ function parseIdentity(value, path) {
   ], path);
   return {
     principalType: member(identity.principalType, PRINCIPAL_TYPES, `${path}.principalType`),
-    principalId: text(identity.principalId, `${path}.principalId`),
+    principalId: text2(identity.principalId, `${path}.principalId`),
     ...optionalTextFields(identity, path, [
       "displayName",
       "installationId",
@@ -1410,25 +1537,25 @@ function parseIdentity(value, path) {
 }
 function parseDelegation(value) {
   if (value === null) return null;
-  const delegation = record2(value, "actorEnvelope.delegation");
+  const delegation = record3(value, "actorEnvelope.delegation");
   exactKeys(delegation, ["taskId", "runId", "lineage"], "actorEnvelope.delegation");
   if (!Array.isArray(delegation.lineage) || delegation.lineage.length === 0 || delegation.lineage.length > 16) {
     fail("actorEnvelope.delegation.lineage", "must contain between 1 and 16 hops");
   }
   return {
-    taskId: text(delegation.taskId, "actorEnvelope.delegation.taskId"),
-    runId: text(delegation.runId, "actorEnvelope.delegation.runId"),
+    taskId: text2(delegation.taskId, "actorEnvelope.delegation.taskId"),
+    runId: text2(delegation.runId, "actorEnvelope.delegation.runId"),
     lineage: delegation.lineage.map((value2, index) => {
-      const hop = record2(value2, `actorEnvelope.delegation.lineage[${index}]`);
+      const hop = record3(value2, `actorEnvelope.delegation.lineage[${index}]`);
       exactKeys(hop, ["principalType", "principalId"], `actorEnvelope.delegation.lineage[${index}]`);
       return {
         principalType: member(hop.principalType, PRINCIPAL_TYPES, `actorEnvelope.delegation.lineage[${index}].principalType`),
-        principalId: text(hop.principalId, `actorEnvelope.delegation.lineage[${index}].principalId`)
+        principalId: text2(hop.principalId, `actorEnvelope.delegation.lineage[${index}].principalId`)
       };
     })
   };
 }
-function record2(value, path) {
+function record3(value, path) {
   if (!value || typeof value !== "object" || Array.isArray(value)) fail(path, "must be an object");
   return value;
 }
@@ -1436,14 +1563,14 @@ function exactKeys(value, allowed, path) {
   const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
   if (unknown.length) fail(path, `contains unknown field ${unknown[0]}`);
 }
-function text(value, path) {
+function text2(value, path) {
   if (typeof value !== "string" || value.trim() !== value || value.length === 0 || value.length > 256) {
     fail(path, "must be a non-empty trimmed string of at most 256 characters");
   }
   return value;
 }
 function timestamp(value, path) {
-  const result = text(value, path);
+  const result = text2(value, path);
   if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(result) || Number.isNaN(Date.parse(result))) {
     fail(path, "must be an RFC 3339 UTC timestamp");
   }
@@ -1455,10 +1582,10 @@ function member(value, values, path) {
 }
 function textArray(value, path) {
   if (!Array.isArray(value) || value.length === 0 || value.length > 16) fail(path, "must contain between 1 and 16 values");
-  return value.map((item, index) => text(item, `${path}[${index}]`));
+  return value.map((item, index) => text2(item, `${path}[${index}]`));
 }
 function optionalTextFields(value, path, keys) {
-  return Object.fromEntries(keys.flatMap((key) => value[key] === void 0 ? [] : [[key, text(value[key], `${path}.${key}`)]]));
+  return Object.fromEntries(keys.flatMap((key) => value[key] === void 0 ? [] : [[key, text2(value[key], `${path}.${key}`)]]));
 }
 function fail(path, message3) {
   throw new ActorEnvelopeValidationError(path, message3);
@@ -2128,6 +2255,7 @@ var TopoloClient = class _TopoloClient {
     for (const item of raw) {
       if (!isRecord4(item)) continue;
       const s = item;
+      const applicationGuide = normalizeApplicationGuide(s.applicationGuide);
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
       const permissions = Array.isArray(s.granted_permissions) ? s.granted_permissions.filter((permission) => typeof permission === "string" && permission.trim().length > 0) : [];
@@ -2141,6 +2269,7 @@ var TopoloClient = class _TopoloClient {
         slug: typeof s.app_slug === "string" ? s.app_slug : null,
         name: typeof s.name === "string" ? s.name : null,
         description: typeof s.description === "string" ? s.description : null,
+        ...applicationGuide ? { applicationGuide } : {},
         apiBaseUrl: typeof s.api_base_url === "string" ? s.api_base_url : typeof s.apiBaseUrl === "string" ? s.apiBaseUrl : null,
         launchUrl: typeof s.launch_url === "string" ? s.launch_url : typeof s.launchUrl === "string" ? s.launchUrl : null,
         status: typeof s.status === "string" ? s.status : null,
@@ -2260,14 +2389,14 @@ var TopoloClient = class _TopoloClient {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
     }
-    const record4 = raw;
-    if (record4.algorithm !== "sha256-v1" || typeof record4.digest !== "string" || !/^[a-f0-9]{64}$/.test(record4.digest) || !Number.isSafeInteger(record4.actionCount) || Number(record4.actionCount) < 0) {
+    const record5 = raw;
+    if (record5.algorithm !== "sha256-v1" || typeof record5.digest !== "string" || !/^[a-f0-9]{64}$/.test(record5.digest) || !Number.isSafeInteger(record5.actionCount) || Number(record5.actionCount) < 0) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
     }
     return {
       algorithm: "sha256-v1",
-      digest: record4.digest,
-      actionCount: Number(record4.actionCount)
+      digest: record5.digest,
+      actionCount: Number(record5.actionCount)
     };
   }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
@@ -2814,6 +2943,7 @@ function normalizeCatalogPage(value) {
 }
 function normalizeServiceCatalogEntry(item) {
   if (!isRecord4(item)) return null;
+  const applicationGuide = normalizeApplicationGuide(item.applicationGuide);
   const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
   if (!appId) return null;
   const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
@@ -2829,6 +2959,7 @@ function normalizeServiceCatalogEntry(item) {
     slug: typeof item.app_slug === "string" ? item.app_slug : null,
     name: typeof item.name === "string" ? item.name : null,
     description: typeof item.description === "string" ? item.description : null,
+    ...applicationGuide ? { applicationGuide } : {},
     apiBaseUrl: typeof item.api_base_url === "string" ? item.api_base_url : typeof item.apiBaseUrl === "string" ? item.apiBaseUrl : null,
     launchUrl: typeof item.launch_url === "string" ? item.launch_url : typeof item.launchUrl === "string" ? item.launchUrl : null,
     status: typeof item.status === "string" ? item.status : null,
@@ -2991,10 +3122,10 @@ function extractRequired(body) {
     if (Array.isArray(maybe.required)) return canonicalTopoloRequired(maybe.required);
     for (const nested of [maybe.details, maybe.error]) {
       if (!nested || typeof nested !== "object" || Array.isArray(nested)) continue;
-      const record4 = nested;
-      if (Array.isArray(record4.required)) return canonicalTopoloRequired(record4.required);
-      if (record4.details && typeof record4.details === "object" && !Array.isArray(record4.details)) {
-        const required = record4.details.required;
+      const record5 = nested;
+      if (Array.isArray(record5.required)) return canonicalTopoloRequired(record5.required);
+      if (record5.details && typeof record5.details === "object" && !Array.isArray(record5.details)) {
+        const required = record5.details.required;
         if (Array.isArray(required)) return canonicalTopoloRequired(required);
       }
     }
@@ -3071,8 +3202,8 @@ function compactResultValue(value, depth, budget) {
     return value.length > ACTION_RESULT_MAX_ITEMS ? { count: value.length, items, omittedItems: value.length - ACTION_RESULT_MAX_ITEMS } : items;
   }
   if (typeof value === "object") {
-    const record4 = value;
-    const allKeys = Object.keys(record4);
+    const record5 = value;
+    const allKeys = Object.keys(record5);
     const ranked = allKeys.sort((left, right) => resultKeyPriority(left) - resultKeyPriority(right));
     const prioritized = ranked.filter((key) => resultKeyPriority(key) < 2);
     const ordinary = ranked.filter((key) => resultKeyPriority(key) === 2);
@@ -3081,7 +3212,7 @@ function compactResultValue(value, depth, budget) {
       ...prioritized,
       ...ordinary.slice(0, ordinaryLimit)
     ].slice(0, ACTION_RESULT_MAX_KEYS);
-    const compact = Object.fromEntries(keys.map((key) => [key, compactResultValue(record4[key], depth + 1, budget)]));
+    const compact = Object.fromEntries(keys.map((key) => [key, compactResultValue(record5[key], depth + 1, budget)]));
     if (allKeys.length > keys.length) compact["_omittedKeys"] = allKeys.length - keys.length;
     return compact;
   }
@@ -3886,12 +4017,32 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.23.22/node_modules/@topolo/sdk/dist/node/credential-store.js
+// src/lib/open-browser.ts
+import { spawn } from "child_process";
+import { platform } from "os";
+function tryOpenBrowser(url) {
+  try {
+    const os = platform();
+    const cmd = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
+    const args = os === "win32" ? ["", url] : [url];
+    const child = spawn(cmd, args, {
+      detached: true,
+      stdio: "ignore",
+      ...os === "win32" ? { shell: true } : {}
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, chmod as chmod2, lstat, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync2, mkdirSync, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync, linkSync } from "fs";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import { constants, fstatSync, readSync } from "fs";
-import { homedir as homedir2, platform } from "os";
+import { homedir as homedir2, platform as platform2 } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 import { createHash, randomUUID } from "crypto";
 import { join as join2 } from "path";
@@ -3997,9 +4148,9 @@ function canonicalTopoloServiceErrorCode2(value) {
 }
 function sanitizeTopoloServiceMessage2(value) {
   if (typeof value !== "string") return void 0;
-  const text2 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
-  if (!text2) return void 0;
-  return text2.length > SERVICE_MESSAGE_MAX_LENGTH2 ? `${text2.slice(0, SERVICE_MESSAGE_MAX_LENGTH2 - 1).trimEnd()}\u2026` : text2;
+  const text3 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text3) return void 0;
+  return text3.length > SERVICE_MESSAGE_MAX_LENGTH2 ? `${text3.slice(0, SERVICE_MESSAGE_MAX_LENGTH2 - 1).trimEnd()}\u2026` : text3;
 }
 function canonicalTopoloRequestId2(value) {
   if (typeof value !== "string") return void 0;
@@ -4040,10 +4191,10 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
 };
 function extractTopoloServiceErrorCode2(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
-  const record3 = body;
-  const topLevel = canonicalTopoloServiceErrorCode2(record3.code);
+  const record4 = body;
+  const topLevel = canonicalTopoloServiceErrorCode2(record4.code);
   if (topLevel) return topLevel;
-  const nested = record3.error;
+  const nested = record4.error;
   const nestedString = canonicalTopoloServiceErrorCode2(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
@@ -4058,14 +4209,14 @@ function serviceErrorCode2(body, fallback) {
 }
 function extractTopoloServiceErrorDetails2(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
-  const record3 = body;
-  let candidate = record3.details;
-  const nested = record3.error;
+  const record4 = body;
+  let candidate = record4.details;
+  const nested = record4.error;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const nestedRecord = nested;
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
-  if (candidate === void 0) candidate = record3;
+  if (candidate === void 0) candidate = record4;
   if (Array.isArray(candidate)) return validationIssueDetails2(canonicalTopoloValidationIssues2(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
@@ -4124,18 +4275,18 @@ function validationIssueDetails2(issues) {
   return paths.length ? { paths, issues } : { issues };
 }
 function issue2(path, message3) {
-  const text2 = sanitizeTopoloServiceMessage2(message3);
-  if (!path && !text2) return null;
-  return { ...path ? { path } : {}, ...text2 ? { message: text2 } : {} };
+  const text3 = sanitizeTopoloServiceMessage2(message3);
+  if (!path && !text3) return null;
+  return { ...path ? { path } : {}, ...text3 ? { message: text3 } : {} };
 }
 function canonicalTopoloValidationIssues2(values) {
   const issues = [];
   for (const value of values) {
     if (!value || typeof value !== "object" || Array.isArray(value)) continue;
-    const record3 = value;
-    const path = canonicalTopoloValidationPath2(record3.field) ?? canonicalTopoloValidationPath2(record3.path);
+    const record4 = value;
+    const path = canonicalTopoloValidationPath2(record4.field) ?? canonicalTopoloValidationPath2(record4.path);
     if (!path) continue;
-    const projected = issue2(path, record3.message);
+    const projected = issue2(path, record4.message);
     if (projected) issues.push(projected);
     if (issues.length === SERVICE_ISSUE_LIMIT2) break;
   }
@@ -4572,18 +4723,18 @@ function createProtectedActionSecretStore(options) {
       const key = await account(reference);
       const encoded = await backend.get(key);
       if (!encoded) throw new TopoloSdkError2("action_secret_unavailable", "Protected action reference is missing or belongs to another identity or environment.");
-      let record3;
+      let record4;
       try {
-        record3 = JSON.parse(encoded);
+        record4 = JSON.parse(encoded);
       } catch {
         throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
       }
-      if (!Number.isFinite(record3?.expiresAt) || !Object.hasOwn(record3, "value")) throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
-      if (record3.expiresAt <= now()) {
+      if (!Number.isFinite(record4?.expiresAt) || !Object.hasOwn(record4, "value")) throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
+      if (record4.expiresAt <= now()) {
         await backend.delete(key);
         throw new TopoloSdkError2("action_secret_expired", "Protected action reference expired. Repeat the originating action if its contract permits.");
       }
-      return record3.value;
+      return record4.value;
     },
     async delete(reference) {
       await backend.delete(await account(reference));
@@ -4659,7 +4810,7 @@ var ENVIRONMENT_DEFAULT_SERVICE_URLS = TOPOLO_ENVIRONMENT_SERVICE_URLS;
 function configPath() {
   const override = process.env.TOPOLO_CONFIG_PATH;
   if (override) return override;
-  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join3(homedir2(), "AppData", "Roaming") : join3(homedir2(), ".config"));
+  const base = process.env.XDG_CONFIG_HOME || (platform2() === "win32" ? join3(homedir2(), "AppData", "Roaming") : join3(homedir2(), ".config"));
   return join3(base, "topolo", "config.json");
 }
 async function readConfig() {
@@ -4678,7 +4829,7 @@ async function writeConfig(config) {
   await withConfigWriteLock(async (_assertOwned, persist) => {
     await persist((current) => protectStoredGrants(config, current), { allowCreate: true });
   });
-  if (platform() !== "win32") {
+  if (platform2() !== "win32") {
     try {
       await chmod2(path, 384);
     } catch {
@@ -5524,6 +5675,27 @@ async function continueReauthorization(environment, key) {
     }
   });
 }
+async function awaitReauthorization(environment, key, options = {}) {
+  const deadline = Date.now() + (options.timeoutMs ?? 15 * 6e4);
+  let lastCode;
+  for (; ; ) {
+    const profile = profileForEnvironment(await readConfig(), environment);
+    const slotKey = key ?? profile.activeContext ?? DEFAULT_SLOT;
+    try {
+      return await continueReauthorization(environment, slotKey);
+    } catch (error) {
+      if (!(error instanceof TopoloReauthRequiredError)) throw error;
+      const prompt = error.reauthorization;
+      if (prompt.userCode !== lastCode) {
+        lastCode = prompt.userCode;
+        options.onPrompt?.(error);
+      }
+      if (prompt.state !== "awaiting_approval" || options.signal?.aborted || Date.now() >= deadline) throw error;
+      const waitMs = Math.max(1, prompt.pollIntervalSeconds ?? 5) * 1e3;
+      await new Promise((resolve22) => setTimeout(resolve22, Math.min(waitMs, Math.max(0, deadline - Date.now()))));
+    }
+  }
+}
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
@@ -5734,13 +5906,43 @@ function normalizeError(err) {
       retryAfter: err.retryAfter,
       // SDK HTTP errors already carry sanitized details; projecting them again
       // would drop form-level issues that have no field path.
-      details: err instanceof TopoloHttpError || err instanceof TopoloAuthError || err instanceof TopoloPermissionError ? err.details : extractTopoloServiceErrorDetails(suppliedDetails === void 0 ? body : { details: suppliedDetails }),
-      hint: topoloErrorHint({ code, body }) ?? (code ? fallbackHintMap[code] : void 0),
+      details: reauthorizationDetails(err) ?? (err instanceof TopoloHttpError || err instanceof TopoloAuthError || err instanceof TopoloPermissionError ? err.details : extractTopoloServiceErrorDetails(suppliedDetails === void 0 ? body : { details: suppliedDetails })),
+      hint: reauthorizationHint(err) ?? topoloErrorHint({ code, body }) ?? (code ? fallbackHintMap[code] : void 0),
       exitCode: status === 401 || code === "auth_error" || code === "confirmation_required" ? 2 : status === 403 || code === "permission_denied" ? 3 : code === "immutable_drift" ? 4 : 1
     };
   }
   return { message: String(err), exitCode: 1 };
 }
+function reauthorizationOf(err) {
+  const prompt = err?.reauthorization;
+  return prompt && typeof prompt === "object" ? prompt : void 0;
+}
+var REAUTHORIZATION_FIELDS = [
+  "environment",
+  "context",
+  "reason",
+  "state",
+  "verificationUri",
+  "verificationUriComplete",
+  "userCode",
+  "expiresAt",
+  "pollIntervalSeconds",
+  "loginCommand"
+];
+function reauthorizationDetails(err) {
+  const prompt = reauthorizationOf(err);
+  if (!prompt) return void 0;
+  const safe = {};
+  for (const field of REAUTHORIZATION_FIELDS) if (prompt[field] !== void 0) safe[field] = prompt[field];
+  return { reauthorization: safe };
+}
+function reauthorizationHint(err) {
+  const prompt = reauthorizationOf(err);
+  if (!prompt) return void 0;
+  const url = prompt.verificationUriComplete ?? prompt.verificationUri;
+  const approve = url ? `Approve at ${url}${prompt.userCode ? ` (code ${prompt.userCode})` : ""}` : "No approval could be started";
+  return `${approve}; or run: ${prompt.loginCommand ?? "topolo auth login"}. The saved sign-in will not be retried.`;
+}
 
 // src/version.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -6028,22 +6230,6 @@ async function resolveLoginContext(credential, serviceUrls, clientId, environmen
   }
   return { identity, context: { contextType: "personal", credential, oauthClientId: clientId } };
 }
-function tryOpenBrowser(url) {
-  try {
-    const os = platform2();
-    const cmd = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
-    const args = os === "win32" ? ["", url] : [url];
-    const child = spawn(cmd, args, {
-      detached: true,
-      stdio: "ignore",
-      ...os === "win32" ? { shell: true } : {}
-    });
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
-}
 function startSpinner() {
   if (!process.stderr.isTTY) return null;
   const frames = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -6060,12 +6246,66 @@ function startSpinner() {
   };
 }
 
+// src/lib/reauthorization.ts
+function isReauthRequired(error) {
+  const candidate = error;
+  return error instanceof Error && candidate?.code === "reauth_required" && typeof candidate.reauthorization === "object" && candidate.reauthorization !== null;
+}
+function reauthorizationIsInteractive(env = process.env) {
+  return Boolean(process.stderr.isTTY && process.stdin.isTTY) && !env.CI && env.TOPOLO_NO_REAUTH_PROMPT !== "1";
+}
+function describe(error) {
+  const prompt = error.reauthorization;
+  const url = prompt.verificationUriComplete ?? prompt.verificationUri;
+  const expires = prompt.expiresAt ? ` (expires ${prompt.expiresAt})` : "";
+  return `  ${url}
+
+` + (prompt.userCode ? `  Confirm the page shows this code:
+
+      ${prompt.userCode}
+
+` : "") + `  Waiting for approval${expires}
+`;
+}
+async function credentialWithReauthorization(load, environment, context) {
+  try {
+    return await load();
+  } catch (error) {
+    if (!isReauthRequired(error)) throw error;
+    const prompt = error.reauthorization;
+    const url = prompt.verificationUriComplete ?? prompt.verificationUri;
+    if (!reauthorizationIsInteractive() || prompt.state !== "awaiting_approval" || !url) throw error;
+    const opened = tryOpenBrowser(url);
+    process.stderr.write(
+      `
+  Your saved Topolo sign-in for ${prompt.context} (${prompt.environment}) has ended.
+  ${opened ? "Opening your browser to approve it again:" : "Open this link in your browser to approve it again:"}
+` + describe(error)
+    );
+    const remaining = prompt.expiresAt ? Date.parse(prompt.expiresAt) - Date.now() : Number.NaN;
+    const timeoutMs = Number.isFinite(remaining) ? Math.max(1e3, Math.min(remaining, 15 * 6e4)) : 10 * 6e4;
+    const credential = await awaitReauthorization(environment, context, {
+      timeoutMs,
+      onPrompt: (next) => process.stderr.write(`
+  A new approval was started:
+${describe(next)}`)
+    });
+    if (!credential) throw error;
+    process.stderr.write("  Approved. Continuing.\n");
+    return credential;
+  }
+}
+
 // src/client.ts
 async function buildClient(options) {
   const environment = options?.environment ?? selectedEnvironment();
   const config = await readConfig();
   const context = commandContextKey(config, environment, options?.context?.trim() || process.env.TOPOLO_CONTEXT);
-  const credential = context ? await refreshContextCredentialIfNeeded(environment, context) : await refreshCredentialIfNeeded(environment);
+  const credential = await credentialWithReauthorization(
+    () => context ? refreshContextCredentialIfNeeded(environment, context) : refreshCredentialIfNeeded(environment),
+    environment,
+    context
+  );
   if (!credential) return null;
   const profile = resolvedProfileConfig(config, environment);
   const topolo = createTopolo({
@@ -6081,7 +6321,11 @@ async function buildClient(options) {
     serviceUrls: profile.serviceUrls,
     requireConfirmForWrites: options?.requireConfirmForWrites,
     ...credential.kind === "access_token" && credential.refreshToken ? {
-      refreshCredential: () => context ? refreshContextCredentialIfNeeded(environment, context, { force: true }) : refreshCredentialIfNeeded(environment, { force: true })
+      refreshCredential: () => credentialWithReauthorization(
+        () => context ? refreshContextCredentialIfNeeded(environment, context, { force: true }) : refreshCredentialIfNeeded(environment, { force: true }),
+        environment,
+        context
+      )
     } : {},
     ...isDebugEnabled() ? { debug: stderrDebugLogger } : {}
   });
@@ -6263,10 +6507,10 @@ function resolveConfiguredServiceUrl2(service, serviceUrls) {
   }
   return void 0;
 }
-function parseQueryPairs(pairs) {
-  if (!pairs || pairs.length === 0) return void 0;
+function parseQueryPairs(pairs2) {
+  if (!pairs2 || pairs2.length === 0) return void 0;
   const out = {};
-  for (const pair of pairs) {
+  for (const pair of pairs2) {
     const eq = pair.indexOf("=");
     if (eq <= 0) {
       throw new Error(`Invalid --query entry "${pair}". Expected key=value.`);
@@ -6474,9 +6718,9 @@ function externalApprovalHandoff(action, result) {
   if (!result || typeof result !== "object" || Array.isArray(result)) return null;
   const invocation = result.invocation;
   if (!invocation || typeof invocation !== "object" || Array.isArray(invocation)) return null;
-  const record3 = invocation;
-  if (record3.status !== "awaiting_approval") return null;
-  const approval = record3.approval;
+  const record4 = invocation;
+  if (record4.status !== "awaiting_approval") return null;
+  const approval = record4.approval;
   if (!approval || typeof approval !== "object" || Array.isArray(approval)) return null;
   const handoff = approval;
   if (typeof handoff.requestId !== "string" || typeof handoff.verificationUrl !== "string") return null;
@@ -6752,9 +6996,9 @@ async function writeCredentialCustody(request, deps) {
   }
 }
 function requiredText(value, flag) {
-  const text2 = value?.trim();
-  if (!text2) throw new CustodyError("custody_invalid_input", `${flag} is required.`);
-  return text2;
+  const text3 = value?.trim();
+  if (!text3) throw new CustodyError("custody_invalid_input", `${flag} is required.`);
+  return text3;
 }
 function currentUid() {
   return typeof process.getuid === "function" ? process.getuid() : null;
@@ -6923,9 +7167,9 @@ async function writeCustodyFiles(directory, files) {
 }
 function withheldIfSecretLeaks(error, secret) {
   const variants = [secret, encodeURIComponent(secret)];
-  const record3 = error;
-  const parts = [String(error), String(record3?.message), String(record3?.stack)];
-  for (const value of [record3?.body, record3?.details]) {
+  const record4 = error;
+  const parts = [String(error), String(record4?.message), String(record4?.stack)];
+  for (const value of [record4?.body, record4?.details]) {
     try {
       parts.push(String(value), JSON.stringify(value ?? null));
     } catch {
@@ -7276,8 +7520,8 @@ async function authFetchJson(path, init = {}) {
   }
   headers.set("Authorization", `Bearer ${credential.accessToken}`);
   const response = await fetch(`${authBaseUrl}${path}`, { ...init, headers });
-  const text2 = await response.text();
-  const payload = text2 ? JSON.parse(text2) : {};
+  const text3 = await response.text();
+  const payload = text3 ? JSON.parse(text3) : {};
   if (!response.ok || payload.success === false) {
     const err = new Error(payload.message || payload.error_description || payload.error || "Topolo Auth request failed");
     err.code = payload.code || payload.error;
@@ -7786,9 +8030,9 @@ async function readTomlRegistrations(path, agent) {
   return [...registrations.values()].filter((registration) => registration.command || registration.url);
 }
 async function readGooseRegistrations(path) {
-  const text2 = await readFile4(path, "utf8");
+  const text3 = await readFile4(path, "utf8");
   const registrations = [];
-  const lines = text2.split(/\r?\n/);
+  const lines = text3.split(/\r?\n/);
   let inExtensions = false;
   let inTopolo = false;
   let current;
@@ -8030,10 +8274,10 @@ async function registerAgentHttpConfig(agent, homeDir, registration, codexHome)
     return;
   }
   const before = await fileSnapshot(config.path);
-  const text2 = withoutMcpServerSections(before.contents ?? "", registration.name);
+  const text3 = withoutMcpServerSections(before.contents ?? "", registration.name);
   const headers = Object.entries(registration.headers).map(([key, value]) => JSON.stringify(key) + " = " + JSON.stringify(value)).join(", ");
   const block = "\n\n[mcp_servers." + registration.name + "]\nurl = " + JSON.stringify(registration.url) + "\nhttp_headers = { " + headers + " }\n";
-  await atomicWrite(config.path, text2 + block, before);
+  await atomicWrite(config.path, text3 + block, before);
 }
 async function unregisterAgentConfig(agent, homeDir, name, projectDir, codexHome) {
   for (const config of agentConfigPaths(agent, homeDir, projectDir, codexHome)) {
@@ -8041,8 +8285,8 @@ async function unregisterAgentConfig(agent, homeDir, name, projectDir, codexHome
     if (config.format === "json") {
       await unregisterJson(config, agent, name);
     } else if (config.format === "toml") {
-      const text2 = withoutMcpServerSections(await readFile5(config.path, "utf8"), name);
-      await atomicWrite(config.path, text2 ? text2 + "\n" : "");
+      const text3 = withoutMcpServerSections(await readFile5(config.path, "utf8"), name);
+      await atomicWrite(config.path, text3 ? text3 + "\n" : "");
     } else {
       await unregisterGoose(config.path, name);
     }
@@ -8132,12 +8376,12 @@ async function unregisterJson(config, agent, name) {
 async function registerToml(path, agent, mcp, registration) {
   const before = await fileSnapshot(path);
   const existing = before.contents ?? "";
-  const text2 = withoutMcpServerSections(existing, registration.name);
+  const text3 = withoutMcpServerSections(existing, registration.name);
   const args = mcp.args.length ? "\nargs = [" + mcp.args.map((item) => JSON.stringify(item)).join(", ") + "]" : "";
   const environment = registrationEnvironment(agent, registration);
   const environmentText = Object.entries(environment).map(([key, value]) => JSON.stringify(key) + " = " + JSON.stringify(value)).join(", ");
   const block = agent === "grok" ? "\n\n[mcp_servers." + registration.name + "]\ncommand = " + JSON.stringify(mcp.command) + args + "\nenv = { " + environmentText + " }\n" : "\n\n[mcp_servers." + registration.name + "]\ncommand = " + JSON.stringify(mcp.command) + args + "\n\n[mcp_servers." + registration.name + ".env]\n" + Object.entries(environment).map(([key, value]) => key + " = " + JSON.stringify(value)).join("\n") + "\n";
-  await atomicWrite(path, text2 + block, before);
+  await atomicWrite(path, text3 + block, before);
 }
 async function registerGoose(path, mcp, registration) {
   const existing = existsSync5(path) ? await readFile5(path, "utf8") : "";
@@ -8160,8 +8404,8 @@ async function unregisterGoose(path, name) {
   const existing = await readFile5(path, "utf8");
   await atomicWrite(path, removeGooseExtension(existing, name));
 }
-function removeGooseExtension(text2, name) {
-  const lines = text2.split(/\r?\n/);
+function removeGooseExtension(text3, name) {
+  const lines = text3.split(/\r?\n/);
   const kept = [];
   let inExtensions = false;
   let skipping = false;
@@ -8181,11 +8425,11 @@ function removeGooseExtension(text2, name) {
   }
   return kept.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd();
 }
-function insertGooseExtension(text2, block) {
-  if (!text2.trim()) return "extensions:\n" + block + "\n";
-  const lines = text2.split(/\r?\n/);
+function insertGooseExtension(text3, block) {
+  if (!text3.trim()) return "extensions:\n" + block + "\n";
+  const lines = text3.split(/\r?\n/);
   const extensionIndex = lines.findIndex((line) => /^extensions:\s*$/.test(line));
-  if (extensionIndex < 0) return text2.trimEnd() + "\n\nextensions:\n" + block + "\n";
+  if (extensionIndex < 0) return text3.trimEnd() + "\n\nextensions:\n" + block + "\n";
   let end = lines.length;
   for (let index = extensionIndex + 1; index < lines.length; index += 1) {
     if (/^\S/.test(lines[index]) && lines[index].trim()) {
@@ -8284,11 +8528,11 @@ async function atomicWrite(path, contents, before) {
     }
   }
 }
-function withoutMcpServerSections(text2, name) {
+function withoutMcpServerSections(text3, name) {
   const section = "[mcp_servers." + name + "]";
   const subsectionPrefix = "[mcp_servers." + name + ".";
   let skipping = false;
-  return text2.split(/\r?\n/).filter((line) => {
+  return text3.split(/\r?\n/).filter((line) => {
     const trimmed = line.trim();
     if (trimmed === section || trimmed.startsWith(subsectionPrefix) && trimmed.endsWith("]")) {
       skipping = true;
@@ -8334,18 +8578,18 @@ function validateMcpHubIdentity(value, where = "identity") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`MCP hub ${where} must be an object.`);
   }
-  const record3 = value;
-  const unknown = Object.keys(record3).filter((key) => !["name", "env", "context"].includes(key));
+  const record4 = value;
+  const unknown = Object.keys(record4).filter((key) => !["name", "env", "context"].includes(key));
   if (unknown.length) throw new Error(`MCP hub ${where} has unsupported field(s): ${unknown.join(", ")}.`);
-  const name = record3.name;
+  const name = record4.name;
   if (typeof name !== "string" || !NAME_PATTERN.test(name) || name === RESERVED_NAME) {
     throw new Error(`MCP hub ${where} name must be topolo or topolo-<name> (and not reserved).`);
   }
-  const environment = record3.env;
+  const environment = record4.env;
   if (typeof environment !== "string" || !MCP_HUB_ENVIRONMENTS.includes(environment)) {
     throw new Error(`MCP hub identity ${name} env must be one of ${MCP_HUB_ENVIRONMENTS.join(", ")}.`);
   }
-  const context = record3.context;
+  const context = record4.context;
   if (context === void 0) {
     throw new Error(`MCP hub identity ${name} must pin a context (a key from \`topolo context ls\`).`);
   }
@@ -8354,27 +8598,27 @@ function validateMcpHubIdentity(value, where = "identity") {
   }
   return { name, environment, context: context.trim() };
 }
-function parseMcpHubConfig(text2, source) {
+function parseMcpHubConfig(text3, source) {
   let parsed;
   try {
-    parsed = JSON.parse(text2);
+    parsed = JSON.parse(text3);
   } catch (error) {
     throw new Error(`Cannot read malformed MCP hub configuration at ${source}: ${error.message}`);
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`MCP hub configuration at ${source} must be a JSON object.`);
   }
-  const record3 = parsed;
-  const unknown = Object.keys(record3).filter((key) => !["version", "port", "identities"].includes(key));
+  const record4 = parsed;
+  const unknown = Object.keys(record4).filter((key) => !["version", "port", "identities"].includes(key));
   if (unknown.length) {
     throw new Error(`MCP hub configuration at ${source} has unsupported field(s): ${unknown.join(", ")}.`);
   }
-  if (record3.version !== 1) throw new Error(`MCP hub configuration at ${source} must declare "version": 1.`);
-  const port = record3.port === void 0 ? MCP_HUB_DEFAULT_PORT : validateMcpHubPort(record3.port);
-  if (record3.identities !== void 0 && !Array.isArray(record3.identities)) {
+  if (record4.version !== 1) throw new Error(`MCP hub configuration at ${source} must declare "version": 1.`);
+  const port = record4.port === void 0 ? MCP_HUB_DEFAULT_PORT : validateMcpHubPort(record4.port);
+  if (record4.identities !== void 0 && !Array.isArray(record4.identities)) {
     throw new Error(`MCP hub configuration at ${source} identities must be an array.`);
   }
-  const identities = (record3.identities ?? []).map((entry, index) => validateMcpHubIdentity(entry, `identity #${index + 1}`));
+  const identities = (record4.identities ?? []).map((entry, index) => validateMcpHubIdentity(entry, `identity #${index + 1}`));
   const seen = /* @__PURE__ */ new Set();
   for (const identity of identities) {
     if (seen.has(identity.name)) {
@@ -8396,14 +8640,14 @@ function serializeMcpHubConfig(config) {
   }, null, 2) + "\n";
 }
 async function readMcpHubConfig(path) {
-  let text2;
+  let text3;
   try {
-    text2 = await readFile6(path, "utf8");
+    text3 = await readFile6(path, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return emptyMcpHubConfig();
     throw error;
   }
-  return parseMcpHubConfig(text2, path);
+  return parseMcpHubConfig(text3, path);
 }
 function upsertMcpHubIdentity(config, identity) {
   const identities = config.identities.filter((entry) => entry.name !== identity.name);
@@ -9725,16 +9969,16 @@ var REVOKE_CREDENTIAL = "app_topolo_auth.principal_credentials.revoke";
 var INSTALLATION_BOOTSTRAP_GRANT = "app_topolo_auth:identity";
 function actionData(value) {
   if (!value || typeof value !== "object") throw new Error("Topolo returned an invalid action response.");
-  const record3 = value;
-  const data = record3.data;
-  return data && typeof data === "object" ? data : record3;
+  const record4 = value;
+  const data = record4.data;
+  return data && typeof data === "object" ? data : record4;
 }
 function requiredRecord(value, name) {
   if (!value || typeof value !== "object") throw new Error(`Topolo did not return ${name}.`);
   return value;
 }
-function requiredString(record3, key) {
-  const value = record3[key];
+function requiredString(record4, key) {
+  const value = record4[key];
   if (typeof value !== "string" || !value.trim()) throw new Error(`Topolo did not return ${key}.`);
   return value;
 }