@topolo/cli 0.13.2 → 0.13.3

package/dist/{claude-pack-backend-IDQQX3DG.js → claude-pack-backend-5DWMIDRA.js}

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 
 // src/lib/claude-pack-backend.ts
-import { createHash, randomUUID } from "crypto";
+import { createHash, randomBytes, randomUUID } from "crypto";
 import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "fs";
 import * as filesystem from "fs";
 import * as cryptography from "crypto";
 import * as paths from "path";
-import { spawn } from "child_process";
-import { resolve, sep } from "path";
+import { spawn, spawnSync } from "child_process";
+import { dirname, resolve, sep } from "path";
+import { fileURLToPath } from "url";
+import { createConnection } from "net";
+import { tmpdir } from "os";
 import { WebSocket } from "undici";
 
 // src/lib/claude-native-pack.ts
@@ -44,7 +47,7 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
     const groups = manager.listCustomGroups();
     if (!groups) throw new Error("Native sidebar groups have not been reported by the running window.");
     for (const member of plan.members) {
-      if (!/^local_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(member.sessionId) || !plan.noEffects && (!["claude-opus-5-5", "claude-sonnet-5-5"].includes(member.model) || !["medium", "high"].includes(member.effort) || !["default", "acceptEdits"].includes(member.permissionMode)))
+      if (!/^local_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(member.sessionId) || !plan.noEffects && (!["claude-opus-5-5", "claude-sonnet-5-5"].includes(member.model) || !["medium", "high"].includes(member.effort) || !["default", "acceptEdits", "bypassPermissions"].includes(member.permissionMode) || member.permissionMode === "bypassPermissions" && (!member.permissionConsent?.contextKey.startsWith("org:") || !member.permissionConsent.intakeKey)))
         throw new Error("Unqualified session settings in plan.");
       if (!plan.noEffects && !models.includes(member.model)) throw new Error("Requested model is absent from the native account catalog: " + member.model);
       if (!plan.noEffects && member.group !== null && groups.filter((g) => g.name === member.group).length > 1)
@@ -212,6 +215,263 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
   }
 }
 
+// src/lib/claude-pack-approvals.ts
+async function nativeClaudeApprovalControl(manager, descriptor, token, net, fs, invoke, qualify, checkpoint) {
+  const key = /* @__PURE__ */ Symbol.for("topolo.agent-pack.approval-control.v1");
+  qualify();
+  if (!Number.isSafeInteger(descriptor.pid) || descriptor.pid < 1 || !/^[a-f0-9]{64}$/.test(token) || !/^[a-f0-9]{64}$/.test(descriptor.identity)) throw new Error("Unqualified native control identity.");
+  const previous = manager[key];
+  if (fs.existsSync(descriptor.socket)) throw new Error("Native control socket path already exists; no unowned takeover.");
+  if (previous) {
+    if (previous.active) throw new Error("Native approval control requests are still in flight.");
+    await new Promise((done, fail) => previous.server.close((error) => error ? fail(error) : done()));
+    delete manager[key];
+  }
+  const control = { active: 0, server: null, descriptor };
+  const server = net.createServer((connection) => {
+    let buffer = "";
+    let dispatched = false;
+    connection.setEncoding("utf8");
+    connection.setTimeout(5e3, () => connection.destroy());
+    connection.on("error", () => connection.destroy());
+    connection.on("data", async (chunk) => {
+      if (dispatched) return;
+      buffer += chunk;
+      if (Buffer.byteLength(buffer) > 65536) {
+        dispatched = true;
+        connection.destroy();
+        return;
+      }
+      if (!buffer.includes("\n")) return;
+      dispatched = true;
+      control.active++;
+      try {
+        if (control.failure) throw new Error(control.failure);
+        qualify();
+        const request = JSON.parse(buffer);
+        if (Object.keys(request).sort().join(",") !== "identity,operation,pid,token" || request.token !== token || request.pid !== descriptor.pid || request.identity !== descriptor.identity)
+          throw new Error("Native approval control authentication or process identity differs.");
+        const op = request.operation;
+        if (!op || !["list", "details", "respond"].includes(op.kind) || Object.keys(op).some((k) => !["kind", "key", "intake", "fingerprint", "decision", "humanDecisionRecorded"].includes(k)))
+          throw new Error("Unsupported native control operation.");
+        const result = await invoke(op);
+        const reply = JSON.stringify({ result }) + "\n";
+        if (Buffer.byteLength(reply) > 262144) throw new Error("Native approval details exceed bounded transport; use the original native interaction.");
+        connection.end(reply);
+      } catch (error) {
+        try {
+          checkpoint({ kind: "approval-control-refused" });
+        } catch {
+          control.failure = "Native approval audit unavailable; reconcile through the original interaction.";
+        }
+        connection.end(JSON.stringify({ error: control.failure || (error instanceof Error ? error.message : "Native approval control refused.") }) + "\n");
+      } finally {
+        control.active--;
+      }
+    });
+  });
+  control.server = server;
+  await new Promise((done, fail) => {
+    const failed = (error) => fail(error);
+    server.once("error", failed);
+    server.listen(descriptor.socket, () => {
+      server.off("error", failed);
+      done();
+    });
+  });
+  try {
+    fs.chmodSync(descriptor.socket, 384);
+    checkpoint({ kind: "approval-control-installed", ...descriptor });
+  } catch (error) {
+    await new Promise((done) => server.close(() => done()));
+    throw error;
+  }
+  server.on("error", () => {
+    control.failure = "Native approval control failed; reconcile through the original interaction.";
+    try {
+      checkpoint({ kind: "approval-control-error" });
+    } catch {
+      control.failure = "Native approval audit unavailable; reconcile through the original interaction.";
+    }
+  });
+  manager[key] = control;
+  return { state: "native-approval-control-installed", ...descriptor };
+}
+async function nativeClaudeApprovalOperation(manager, routes, operation, fingerprint, checkpoint, history = []) {
+  const symbol = /* @__PURE__ */ Symbol.for("topolo.agent-pack.approvals.v1");
+  if (!routes.length || routes.length > 100 || new Set(routes.map((r) => r.sessionId)).size !== routes.length || new Set(routes.map((r) => r.key)).size !== routes.length) throw new Error("Unique owned approval roster required.");
+  const byId = new Map(routes.map((r) => [r.sessionId, r]));
+  const byKey = new Map(routes.map((r) => [r.key, r]));
+  for (const r of routes) {
+    const intake = byKey.get(r.intakeKey);
+    if (!/^org:.+$/.test(r.contextKey) || !intake || !intake.key.includes("/intakes/") || intake.contextKey !== r.contextKey || intake.sessionId !== r.intakeSessionId)
+      throw new Error("Approval route has no same-context owned intake.");
+  }
+  const identity = fingerprint(routes);
+  let state = manager[symbol];
+  if (state?.auditFailed) throw new Error("Native approval audit unavailable; use the original native interaction.");
+  const owned = async (route) => {
+    const session = await manager.getSession(route.sessionId);
+    if (!session || session.sessionId !== route.sessionId || session.cwd !== route.cwd || session.title !== route.title || session.isArchived || session.backend?.kind !== "local" || session.backend.remoteTarget || session.worktreePath || session.worktreeLazy || session.spawnedFrom)
+      throw new Error("Native approval session identity differs: " + route.key);
+    return session;
+  };
+  if (state && state.identity !== identity) {
+    if (operation.kind !== "install" || state.notifications.size || [...state.entries.values()].some((e) => ["pending", "response-may-have-effects"].includes(e.record.state)))
+      throw new Error("An existing native approval owner has a different roster.");
+    for (const r of routes) await owned(r);
+    for (const route of state.routes) {
+      const session = await manager.getSession(route.sessionId);
+      if (!session || session.cwd !== route.cwd || session.title !== route.title || session.isRunning || session.starting || session.pendingToolPermissions?.length || manager.hasLosableWork(route.sessionId))
+        throw new Error("Outgoing approval owner is not safely idle.");
+    }
+    if (typeof manager.off !== "function") throw new Error("Native approval listener ownership cannot be released.");
+    manager.off("event", state.listener);
+    delete manager[symbol];
+    state = void 0;
+  }
+  const current = async (entry2) => {
+    const source2 = await owned(byId.get(entry2.record.sourceSessionId));
+    const matches = (source2.pendingToolPermissions ?? []).filter((r) => r.requestId === entry2.request.requestId);
+    if (matches.length !== 1 || fingerprint(matches[0]) !== entry2.record.fingerprint)
+      throw new Error("Exact native request is no longer pending; no replay.");
+    return matches[0];
+  };
+  if (operation.kind === "install") {
+    for (const r of routes) await owned(r);
+    if (!state) {
+      if (typeof manager.on !== "function" || typeof manager.sendMessage !== "function" || typeof manager.respondToToolPermission !== "function") throw new Error("Native approval transport unavailable.");
+      state = { identity, routes, entries: /* @__PURE__ */ new Map(), notifications: /* @__PURE__ */ new Set(), deliveryAttempts: 0 };
+      manager[symbol] = state;
+      const save = (entry2) => checkpoint({ ...entry2.record });
+      const deliver = async (entry2) => {
+        const record = entry2.record;
+        if (state.notifications.has(record.key) || !["not-delivered", "awaiting-idle-intake"].includes(record.notificationState)) return;
+        if (record.sourceSessionId === record.intakeSessionId) {
+          record.notificationState = "native-intake";
+          save(entry2);
+          return;
+        }
+        state.notifications.add(record.key);
+        try {
+          await current(entry2);
+          const intake = await owned(byId.get(record.intakeSessionId));
+          if (manager.hasLosableWork(record.intakeSessionId) || intake.isRunning || intake.starting || intake.pendingToolPermissions?.length) {
+            record.notificationState = "awaiting-idle-intake";
+            save(entry2);
+            return;
+          }
+          const text = "Permission relay (generated by the Topolo pack adapter). " + record.sourceKey + " awaits a native decision. Request " + record.key + ", fingerprint " + record.fingerprint + ". Read exact live details using topolo agent-packs approvals details " + record.key + " --harness claude --intake " + record.intakeSessionId + " --fingerprint " + record.fingerprint + ". Present this to the human in this intake and relay only the recorded answer. This notification grants no approval." + (record.cardOnly ? " Claude requires approval on the original native card; report this limitation here." : "");
+          record.notificationState = "may-have-effects";
+          save(entry2);
+          state.deliveryAttempts++;
+          const ack = await manager.sendMessage(
+            record.intakeSessionId,
+            text,
+            void 0,
+            { initiator: "agent", origin: { kind: "task-notification" } }
+          );
+          record.notificationState = ack?.delivered === true ? "delivered" : "delivery-refused";
+          save(entry2);
+        } catch {
+          record.notificationState = record.notificationState === "may-have-effects" ? "delivery-uncertain" : "delivery-failed";
+          save(entry2);
+        } finally {
+          state.notifications.delete(record.key);
+        }
+      };
+      const capture = async (sessionId, request) => {
+        const route = byId.get(sessionId);
+        if (!route || !request || typeof request.requestId !== "string") return;
+        const source2 = await owned(route);
+        const matches = (source2.pendingToolPermissions ?? []).filter((r) => r.requestId === request.requestId);
+        if (matches.length !== 1) throw new Error("Native event is not in the owned pending inventory.");
+        const pending2 = matches[0];
+        const key = fingerprint([identity, pending2.requestId]);
+        const hash = fingerprint(pending2);
+        let entry2 = state.entries.get(key);
+        if (entry2 && entry2.record.fingerprint !== hash) throw new Error("Native request identity was reused.");
+        if (!entry2) {
+          const old = history.filter((row) => row.key === key).at(-1);
+          if (old && (old.fingerprint !== hash || old.sourceSessionId !== sessionId || old.intakeSessionId !== route.intakeSessionId || old.contextKey !== route.contextKey))
+            throw new Error("Durable approval identity differs; no replay.");
+          entry2 = { request: pending2, record: {
+            key,
+            fingerprint: hash,
+            sourceKey: route.key,
+            sourceSessionId: sessionId,
+            intakeKey: route.intakeKey,
+            intakeSessionId: route.intakeSessionId,
+            contextKey: route.contextKey,
+            state: "pending",
+            notificationState: "not-delivered",
+            cardOnly: pending2.onlyOnCard === true || pending2.noAllowOnNotification === true,
+            nativeApproved: false,
+            ...old ? { state: old.state, notificationState: old.notificationState } : {}
+          } };
+          state.entries.set(key, entry2);
+          save(entry2);
+        }
+        if (entry2.record.state === "pending") await deliver(entry2);
+      };
+      state.listener = async (event) => {
+        try {
+          if (event?.type === "tool_permission_request") await capture(event.sessionId, event.request);
+          else if (event?.type === "session_updated") {
+            const source2 = byId.get(event.sessionId);
+            if (source2) {
+              const session = await owned(source2);
+              for (const entry2 of state.entries.values())
+                if (entry2.record.state === "pending" && entry2.record.sourceSessionId === event.sessionId && !(session.pendingToolPermissions ?? []).some((r) => r.requestId === entry2.request.requestId)) {
+                  entry2.record.state = "native-request-no-longer-pending";
+                  delete entry2.request;
+                  save(entry2);
+                }
+            }
+            for (const entry2 of state.entries.values())
+              if (entry2.record.state === "pending" && entry2.record.intakeSessionId === event.sessionId) await deliver(entry2);
+          }
+        } catch {
+          try {
+            checkpoint({ kind: "approval-routing-refused", sessionId: event?.sessionId });
+          } catch {
+            state.auditFailed = true;
+          }
+        }
+      };
+      manager.on("event", state.listener);
+      checkpoint({ kind: "approval-listener-installed", identity, roles: routes.length });
+      for (const r of routes) for (const request of (await owned(r)).pendingToolPermissions ?? []) await capture(r.sessionId, request);
+    }
+    return {
+      state: "native-approval-listener-installed",
+      identity,
+      roles: routes.length,
+      modelTurnsMayHaveStartedByInstallation: state.deliveryAttempts > 0
+    };
+  }
+  if (!state) throw new Error("Native approval listener is not installed.");
+  if (operation.kind === "list") return { requests: [...state.entries.values()].map((e) => ({ ...e.record })) };
+  const entry = state.entries.get(operation.key);
+  if (!entry || entry.record.state !== "pending" || entry.record.intakeSessionId !== operation.intake || entry.record.fingerprint !== operation.fingerprint) throw new Error("Exact pending request and owning intake required.");
+  const pending = await current(entry);
+  if (manager[symbol] !== state || state.entries.get(operation.key) !== entry || entry.record.state !== "pending" || state.auditFailed)
+    throw new Error("Exact pending request changed during native identity validation; reconcile without replay.");
+  if (operation.kind === "details") return { record: { ...entry.record }, request: pending };
+  if (operation.kind !== "respond" || operation.humanDecisionRecorded !== true || !["once", "deny"].includes(operation.decision ?? ""))
+    throw new Error("Recorded human one-request decision required; never auto-approve.");
+  if (operation.decision !== "deny" && entry.record.cardOnly) throw new Error("Claude requires the original card; intake cannot impersonate its origin.");
+  entry.record.state = "response-may-have-effects";
+  checkpoint({ ...entry.record });
+  await manager.respondToToolPermission(pending.requestId, operation.decision, void 0, "elsewhere");
+  const source = await owned(byId.get(entry.record.sourceSessionId));
+  if (source.pendingToolPermissions?.some((r) => r.requestId === pending.requestId))
+    throw new Error("Native decision did not settle; reconcile without replay.");
+  entry.record.state = "native-request-settled";
+  checkpoint({ ...entry.record });
+  return { state: entry.record.state, nativeApproved: false, operationEffectVerified: false };
+}
+
 // src/lib/claude-pack-backend.ts
 var CLAUDE_NATIVE_QUALIFIER = {
   version: "2.31226.1",
@@ -286,7 +546,10 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
       pinned: record.pinnedRequested === true,
       model: settings.model,
       effort: settings.effortLevel,
-      permissionMode: settings.permissions.defaultMode
+      permissionMode: settings.permissions.defaultMode,
+      ...policy.installationConsent || settings.permissions.defaultMode === "bypassPermissions" ? {
+        permissionConsent: qualifyPermissionConsent(policy, record.key, records, settings.permissions.defaultMode === "bypassPermissions")
+      } : {}
     });
   }
   for (const file of [resolve(root, "claude/state.json"), realpathSync(policyPath)])
@@ -311,7 +574,36 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
       outgoing.push({ key, sessionId: record.desktopSessionId, cwd, title: record.title });
     }
   } else if (mode === "switch") throw new Error("Configure and verify an initial active roster before switching.");
-  return { members, outgoing, context, contextInventories, sourceRevision: policy.sourceRevision, mode, activeBefore: active };
+  const approvalRoutes = members.filter((m) => m.permissionConsent).map((m) => {
+    const intake = members.find((i) => i.key === m.permissionConsent.intakeKey);
+    if (!intake) throw new Error("Owning intake is not in the native roster.");
+    return {
+      key: m.key,
+      sessionId: m.sessionId,
+      cwd: m.cwd,
+      title: m.title,
+      ...m.permissionConsent,
+      intakeSessionId: intake.sessionId
+    };
+  });
+  return {
+    members,
+    outgoing,
+    context,
+    contextInventories,
+    approvalRoutes,
+    installationConsent: policy.installationConsent,
+    sourceRevision: policy.sourceRevision,
+    mode,
+    activeBefore: active
+  };
+}
+function qualifyPermissionConsent(policy, key, records, full) {
+  const consent = policy.installationConsent;
+  const intakeKey = consent?.intakeRoutes?.[key];
+  if (consent?.format !== "topolo-pack-installation-consent" || consent.schemaVersion !== 1 || consent.authority !== "local-installation-consent" || consent.approved !== true || consent.pack !== policy.pack || typeof consent.contextKey !== "string" || !/^org:.+$/.test(consent.contextKey) || !consent.principalId || !["manual", "role-default", "full-access"].includes(consent.profile) || full && (consent.overrides?.[key] ?? consent.profile) !== "full-access" || !records.some((record) => record.key === intakeKey && record.key.includes("/intakes/")))
+    throw new Error("Explicit organization-bound full access and owned intake consent required.");
+  return { contextKey: consent.contextKey, intakeKey };
 }
 function nativePackExpression(pid, plan, journal, apply) {
   if (!Number.isSafeInteger(pid) || pid < 1) throw new Error("Explicit Claude main-process PID required.");
@@ -344,12 +636,39 @@ function nativePackExpression(pid, plan, journal, apply) {
         if (crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== hash)
           throw new Error('Context or transcript changed during configuration: ' + file);
     };
-    return await (${nativeClaudePackOperation.toString()})(manager,
+    const result = await (${nativeClaudePackOperation.toString()})(manager,
       value => transport.U(value, transport.V),
       { members: ${JSON.stringify(plan.members)}, outgoing: ${JSON.stringify(plan.outgoing)},
         operationId: ${JSON.stringify(plan.operationId)}, mode: ${JSON.stringify(plan.recovery ? "recover" : plan.mode)},
         noEffects: ${JSON.stringify(plan.noEffects)},
         deadline: Date.now() + 45000 }, expected.apply, checkpoint, verifyContext);
+    ${plan.approvalRoutes.length ? `const routes = ${JSON.stringify(plan.approvalRoutes)};
+      const fingerprint = value => crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex');
+      const invoke = op => (${nativeClaudeApprovalOperation.toString()})(manager, routes, op, fingerprint,
+        row => checkpoint({kind: 'approval', ...row}),
+        fs.readFileSync(expected.journal, 'utf8').split('\\n').filter(Boolean).map(line => JSON.parse(line)));
+      if (expected.apply) {
+        result.approvalRouting = await invoke({kind: 'install'});
+        const control = ${JSON.stringify(plan.control)};
+        if (!control) throw new Error('Owned native control setup is unavailable.');
+        const stat = fs.lstatSync(control.secretPath);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 63)) throw new Error('Unowned native control secret.');
+        const secret = JSON.parse(fs.readFileSync(control.secretPath, 'utf8'));
+        const qualifyNative = () => {
+          if (process.pid !== expected.pid || load('electron').app.getVersion() !== expected.qualifier.version) throw new Error('Native process changed.');
+          for (const [file, hash] of Object.entries(expected.qualifier.hashes))
+            if (crypto.createHash('sha256').update(fs.readFileSync(base + file)).digest('hex') !== hash) throw new Error('Native module changed.');
+        };
+        result.approvalRouting.control = await (${nativeClaudeApprovalControl.toString()})(manager,
+          {socket: control.socket, pid: expected.pid, identity: fingerprint(routes)}, secret.token,
+          load('node:net'), fs, invoke, qualifyNative, checkpoint);
+      } else if (${JSON.stringify(plan.recovery === true && !plan.noEffects)}) {
+        const current = manager[Symbol.for('topolo.agent-pack.approval-control.v1')];
+        if (!current || current.descriptor.pid !== expected.pid || current.descriptor.identity !== fingerprint(routes))
+          throw new Error('Native intake control is not reconciled.');
+        result.approvalRouting = {state: 'native-approval-listener-installed', roles: routes.length, control: current.descriptor};
+      }` : ""}
+    return result;
   })()`;
 }
 function evaluateClaudeMain(endpoint, expression, socketFactory = (url) => new WebSocket(url)) {
@@ -447,7 +766,24 @@ function verifyPlanContext(plan) {
   for (const [file, hash] of Object.entries(plan.context))
     if (createHash("sha256").update(readFileSync(file)).digest("hex") !== hash) throw new Error("Context or transcript changed during configuration: " + file);
 }
-async function configureClaudePack(options, evaluate = evaluateClaudeMain) {
+function verifyClaudeOrganizationPolicy(root, pack, consent, run = spawnSync, locate = existsSync) {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const bundled = [resolve(here, "../../agent-packs/src"), resolve(here, "../agent-packs/src")].find(locate);
+  if (!bundled) throw new Error("Bundled organization policy loader unavailable.");
+  const source = realpathSync(bundled);
+  const script = 'import json,sys\nsys.path.insert(0,sys.argv[4])\nfrom topolo_agent_pack import permissions,topolo\nfrom topolo_agent_pack.storage import Library\nlib=Library(sys.argv[1]);manifest,_=lib.load(sys.argv[2]);c=permissions.load(lib,sys.argv[2],manifest["agents"])\nif c!=json.loads(sys.argv[3]):raise RuntimeError("Installation consent changed")\np,proof=topolo.organization_execution_policy(topolo.Client(c["environment"],c["contextKey"]),c,manifest["agents"],c.get("agentWorkspaceId"))\npermissions.authorize_native_scope(proof)\nprint(json.dumps(proof))';
+  const result = run(
+    "python3",
+    ["-I", "-B", "-c", script, root, pack, JSON.stringify(consent), source],
+    { encoding: "utf8", timeout: 2e5, cwd: source, env: { ...process.env } }
+  );
+  if (result.error || result.status !== 0) throw new Error("Fresh authenticated organization policy qualification failed; no native permission widening.");
+  const proof = JSON.parse(result.stdout);
+  if (proof.profileCeilingVerified !== true || proof.contextKey !== consent.contextKey || proof.scopePolicyMode !== "unrestricted" || proof.toolActionRestrictionRequested !== false)
+    throw new Error("Organization profile ceiling proof differs.");
+  return proof;
+}
+async function configureClaudePack(options, evaluate = evaluateClaudeMain, qualify = verifyClaudeOrganizationPolicy) {
   validateInspectorEndpoint(options.endpoint);
   const root = realpathSync(options.store);
   if (lstatSync(resolve(root, "claude")).isSymbolicLink()) throw new Error("Claude library must not be a symlink.");
@@ -474,9 +810,23 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain) {
       if (createHash("sha256").update(line).digest("hex") !== marker.planHash) throw new Error("Recovery plan identity changed.");
       const record = JSON.parse(line);
       if (record.pack !== options.pack || record.operationId !== marker.operationId || !record.apply) throw new Error("Recovery pack or operation identity differs.");
-      plan = { ...record, recovery: true, noEffects: marker.format === 2 && marker.dispatchState === "not-dispatched" && !lines.map((line2) => JSON.parse(line2)).some((r) => r.kind === "attempt") };
+      plan = { ...record, approvalRoutes: record.approvalRoutes ?? [], recovery: true, noEffects: marker.format === 2 && marker.dispatchState === "not-dispatched" && !lines.map((line2) => JSON.parse(line2)).some((r) => r.kind === "attempt") };
     } else {
       plan = { ...prepareClaudeNativePlan(root, options.pack, options.policy, options.mode === "switch" ? "switch" : "configure"), operationId };
+      if (options.apply && plan.approvalRoutes.length) {
+        const directory2 = resolve(root, "claude/private");
+        mkdirSync(directory2, { recursive: true, mode: 448 });
+        const socketDirectory = resolve(tmpdir(), "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16));
+        mkdirSync(socketDirectory, { recursive: true, mode: 448 });
+        for (const path of [directory2, socketDirectory]) {
+          const stat = lstatSync(path);
+          if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63)
+            throw new Error("Native control directory must be owned and private.");
+        }
+        plan.control = { socket: resolve(socketDirectory, operationId + ".sock"), secretPath: resolve(directory2, operationId + ".json") };
+        durableRecord(plan.control.secretPath, { token: randomBytes(32).toString("hex") }, "wx");
+        syncDirectory(directory2);
+      }
       journal = resolve(directory, operationId + ".jsonl");
       const record = { kind: "plan", pack: options.pack, ...plan, apply: options.apply };
       durableRecord(journal, record, "wx");
@@ -487,6 +837,7 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain) {
     }
     try {
       verifyPlanContext(plan);
+      const organizationPolicy = options.apply && plan.approvalRoutes.length ? qualify(root, options.pack, plan.installationConsent) : null;
       if (options.apply) {
         const dispatched = { ...marker, dispatchState: "may-have-effects" };
         const temporaryMarker = resolve(root, "claude/native-dispatch-" + operationId + ".json");
@@ -518,6 +869,8 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain) {
         }
         if (plan.outgoing.length && (result.outgoingAfter?.length !== plan.outgoing.length || result.outgoingAfter.some((actual, i) => actual.archived !== true || ["key", "sessionId", "cwd", "title"].some((key) => actual[key] !== plan.outgoing[i][key]))))
           throw new Error("Native outgoing archive result does not match the reviewed roster.");
+        if (plan.approvalRoutes.length && (options.apply || recovering) && (result.approvalRouting?.state !== "native-approval-listener-installed" || result.approvalRouting.roles !== plan.members.length || result.approvalRouting.control?.pid !== options.pid || result.approvalRouting.control?.socket !== plan.control?.socket))
+          throw new Error("Complete native intake routing acknowledgement is unavailable.");
         const activePath = resolve(root, "claude/active.json");
         const current = existsSync(activePath) ? JSON.parse(readFileSync(activePath, "utf8")) : null;
         const active = { operationId: plan.operationId, pack: options.pack, keys: plan.members.map((m) => m.key), sourceRevision: plan.sourceRevision };
@@ -530,6 +883,23 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain) {
         renameSync(temporary, activePath);
         syncDirectory(resolve(root, "claude"));
         durableRecord(journal, { kind: "context-verified", context: plan.context, active });
+        if ((options.apply || recovering) && plan.approvalRoutes.length) {
+          const target = resolve(root, "claude/approval-connection.json");
+          const temporaryConnection = resolve(root, "claude/approval-connection-" + plan.operationId + ".json");
+          durableRecord(temporaryConnection, {
+            pid: options.pid,
+            socket: plan.control.socket,
+            secretPath: plan.control.secretPath,
+            identity: result.approvalRouting.control.identity,
+            pack: options.pack,
+            installationConsent: plan.installationConsent,
+            routes: plan.approvalRoutes,
+            journal,
+            organizationPolicy
+          }, "wx");
+          renameSync(temporaryConnection, target);
+          syncDirectory(resolve(root, "claude"));
+        }
         if (JSON.stringify(JSON.parse(readFileSync(markerPath, "utf8"))) !== JSON.stringify(marker)) throw new Error("Recovery marker identity changed.");
         unlinkSync(markerPath);
         syncDirectory(resolve(root, "claude"));
@@ -543,13 +913,75 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain) {
     await release();
   }
 }
+function requestClaudeApprovalControl(connection, operation, token, connect = createConnection) {
+  const parent = lstatSync(dirname(connection.socket));
+  const socket = lstatSync(connection.socket);
+  if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid?.() || parent.mode & 63 || !socket.isSocket() || socket.uid !== process.getuid?.() || socket.mode & 63)
+    throw new Error("Unowned native control socket.");
+  return new Promise((done, fail) => {
+    const client = connect({ path: connection.socket });
+    let reply = "";
+    let finished = false;
+    const finish = (error, result) => {
+      if (finished) return;
+      finished = true;
+      client.destroy();
+      error ? fail(error) : done(result);
+    };
+    client.setEncoding("utf8");
+    client.setTimeout(1e4, () => finish(new Error("Native approval response timed out; reconcile without replay.")));
+    client.on("connect", () => client.write(JSON.stringify({ token, pid: connection.pid, identity: connection.identity, operation }) + "\n"));
+    client.on("data", (chunk) => {
+      reply += chunk;
+      if (Buffer.byteLength(reply) > 262144) return finish(new Error("Native approval response exceeds bounded transport."));
+      if (!reply.includes("\n")) return;
+      try {
+        const result = JSON.parse(reply);
+        finish(result.error ? new Error(result.error) : void 0, result.result);
+      } catch {
+        finish(new Error("Invalid native approval response."));
+      }
+    });
+    client.on("error", () => finish(new Error("Existing native approval control is unavailable.")));
+    client.on("close", () => finish(new Error("Native approval response was lost; reconcile without replay.")));
+  });
+}
+async function operateClaudeApprovals(options, request = requestClaudeApprovalControl, qualify = verifyClaudeOrganizationPolicy) {
+  const root = realpathSync(options.store);
+  const file = resolve(root, "claude/approval-connection.json");
+  if (lstatSync(file).isSymbolicLink()) throw new Error("Unowned approval connection.");
+  const connection = JSON.parse(readFileSync(file, "utf8"));
+  if (!Number.isSafeInteger(connection.pid) || connection.pid < 1 || !Array.isArray(connection.routes))
+    throw new Error("Unqualified native approval connection.");
+  if (options.kind === "respond" && options.decision === "once")
+    qualify(root, connection.pack, connection.installationConsent);
+  const journal = realpathSync(connection.journal);
+  if (!journal.startsWith(realpathSync(resolve(root, "claude/journals")) + sep)) throw new Error("Unowned approval journal.");
+  const privateDirectory = resolve(root, "claude/private");
+  const secretPath = realpathSync(connection.secretPath);
+  const stat = lstatSync(connection.secretPath);
+  if (!secretPath.startsWith(realpathSync(privateDirectory) + sep) || !stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63) throw new Error("Unowned native control secret.");
+  const secret = JSON.parse(readFileSync(secretPath, "utf8"));
+  if (!/^[a-f0-9]{64}$/.test(secret.token) || !/^[a-f0-9]{64}$/.test(connection.identity)) throw new Error("Native control identity is invalid.");
+  return request(connection, {
+    kind: options.kind,
+    key: options.key,
+    intake: options.intake,
+    fingerprint: options.fingerprint,
+    decision: options.decision,
+    humanDecisionRecorded: options.humanDecisionRecorded
+  }, secret.token);
+}
 export {
   CLAUDE_NATIVE_QUALIFIER,
   configureClaudePack,
   evaluateClaudeMain,
   lockClaudeLibrary,
   nativePackExpression,
+  operateClaudeApprovals,
   prepareClaudeNativePlan,
+  requestClaudeApprovalControl,
   snapshotClaudeMarkdown,
-  validateInspectorEndpoint
+  validateInspectorEndpoint,
+  verifyClaudeOrganizationPolicy
 };