@topolo/cli 0.13.2 → 0.13.3

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/commands/agent-packs.ts
 import { spawnSync } from "child_process";
-import { existsSync } from "fs";
+import { existsSync, readFileSync } from "fs";
 import { dirname, resolve } from "path";
 import { fileURLToPath } from "url";
 import { homedir } from "os";
@@ -10,7 +10,7 @@ function registerAgentPacksCommand(program2) {
   const packs = program2.command("agent-packs").description("Install and operate Topolo Agent Packs in supported local hosts").option("--store <path>", "Portable pack library (default ~/AgentPacks)");
   packs.command("configure").description("Qualify and configure an adopted Claude roster through its live native backend").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
     if (options.harness !== "claude") throw new Error("Native configure is currently qualified only for Claude Desktop.");
-    const { configureClaudePack } = await import("./claude-pack-backend-IDQQX3DG.js");
+    const { configureClaudePack } = await import("./claude-pack-backend-5DWMIDRA.js");
     const result = await configureClaudePack({
       store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
       pack,
@@ -34,6 +34,8 @@ function registerAgentPacksCommand(program2) {
     "recover",
     "doctor",
     "policy",
+    "permissions",
+    "approvals",
     "remote-recover",
     "connect",
     "remote-context",
@@ -44,12 +46,38 @@ function registerAgentPacksCommand(program2) {
   for (const name of commands) {
     const command = packs.command(name).description(name === "add" ? "Add an installed or bundled pack, group, or agent" : `Run the pack ${name} operation`);
     if (name === "switch" || name === "recover") command.option("--policy <path>", "Reviewed policy for an adopted Claude roster").option("--endpoint <url>", "Explicit authorized Claude main-process inspector endpoint").option("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply a native switch; recovery is always read-only");
+    if (name === "approvals") command.option("--intake <id>", "Exact owning native intake identity").option("--fingerprint <hash>", "Exact pending native request fingerprint").option("--response <path>", "Recorded one-request response JSON").option("--human-decision-recorded", "Assert that the exact human decision is recorded in the intake");
     command.option("--harness <name>", "Local host adapter (codex, claude Desktop Code sessions)", "codex").option("--adapter-help", "Show every option supported by the selected adapter").argument("[arguments...]").allowUnknownOption().allowExcessArguments().addHelpText("after", name === "add" ? "\nExamples:\n  topolo agent-packs add founder\n  topolo agent-packs add founder --group specialists\n  topolo agent-packs add founder --agent strategy\n" : "\nRun topolo agent-packs <command> --adapter-help for all adapter options. Cloud commands require explicit --environment and --context-key.\n").action(async (args, options) => {
       if (!["codex", "claude"].includes(options.harness)) throw new Error(`The ${options.harness} pack adapter is not available. Supported adapters: codex, claude.`);
+      if (name === "approvals" && options.harness === "claude" && !options.adapterHelp) {
+        if (!["list", "details", "respond"].includes(args[0] ?? "") || args.length > 2)
+          throw new Error("Approvals requires list, details KEY, or respond KEY.");
+        if (args[0] !== "list" && (!args[1] || !options.intake || !options.fingerprint))
+          throw new Error("Exact request key, owning intake and fingerprint required.");
+        let decision;
+        if (args[0] === "respond") {
+          if (!options.response || !options.humanDecisionRecorded) throw new Error("Recorded human response required.");
+          const response = JSON.parse(readFileSync(options.response, "utf8"));
+          if (Object.keys(response).join(",") !== "decision" || !["once", "deny"].includes(response.decision))
+            throw new Error("Only a one-request once/deny response is supported.");
+          decision = response.decision;
+        }
+        const { operateClaudeApprovals } = await import("./claude-pack-backend-5DWMIDRA.js");
+        console.log(JSON.stringify(await operateClaudeApprovals({
+          store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
+          kind: args[0],
+          key: args[1],
+          intake: options.intake,
+          fingerprint: options.fingerprint,
+          decision,
+          humanDecisionRecorded: options.humanDecisionRecorded
+        }), null, 2));
+        return;
+      }
       if (options.policy || options.endpoint || options.pid || options.apply) {
         if (options.harness !== "claude" || !options.policy || !options.endpoint || !options.pid || args.length !== 1)
           throw new Error("Native switch/recovery requires one Claude pack, --policy, --endpoint and --pid.");
-        const { configureClaudePack } = await import("./claude-pack-backend-IDQQX3DG.js");
+        const { configureClaudePack } = await import("./claude-pack-backend-5DWMIDRA.js");
         const result2 = await configureClaudePack({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           pack: args[0],
@@ -67,6 +95,12 @@ function registerAgentPacksCommand(program2) {
       if (!adapter) throw new Error("This CLI installation is missing its bundled Topolo Agent Pack adapter. Reinstall @topolo/cli.");
       const store = packs.opts().store;
       const forwarded = (options.adapterHelp ? ["--help"] : args).map((value) => value === "--group" ? "--set" : value);
+      if (name === "approvals" && !options.adapterHelp) {
+        if (options.intake) forwarded.push("--intake", options.intake);
+        if (options.fingerprint) forwarded.push("--fingerprint", options.fingerprint);
+        if (options.response) forwarded.push("--response", options.response);
+        if (options.humanDecisionRecorded) forwarded.push("--human-decision-recorded");
+      }
       const result = spawnSync("python3", [
         adapter,
         ...store ? ["--store", store] : [],
@@ -3702,7 +3736,7 @@ async function pollUntilApproved(params) {
 
 // node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2, rename as rename2, link } from "fs/promises";
-import { existsSync as existsSync2, lstatSync, readdirSync, readFileSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync } from "fs";
+import { existsSync as existsSync2, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync } from "fs";
 import { randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir2, platform } from "os";
 import { dirname as dirname2, join as join3 } from "path";
@@ -4622,7 +4656,7 @@ async function withConfigWriteLock(operation) {
     assertDirectorySync();
     const entries = readdirSync(lockPath);
     const entry = lstatSync(markerPath);
-    if (entries.length !== 1 || entries[0] !== markerName || !entry.isFile() || entry.isSymbolicLink() || readFileSync(markerPath, "utf8") !== marker) throw new ConfigOwnershipError();
+    if (entries.length !== 1 || entries[0] !== markerName || !entry.isFile() || entry.isSymbolicLink() || readFileSync2(markerPath, "utf8") !== marker) throw new ConfigOwnershipError();
   };
   const persist = async (update) => {
     const path = configPath();
@@ -4633,7 +4667,7 @@ async function withConfigWriteLock(operation) {
       assertOwnedSync();
       const entry = lstatSync(path);
       if (!entry.isFile() || entry.isSymbolicLink()) throw new ConfigOwnershipError();
-      const before = readFileSync(path, "utf8");
+      const before = readFileSync2(path, "utf8");
       const updated = update(JSON.parse(before));
       const fd = openSync(temporary, "wx", 384);
       temporaryOwned = true;
@@ -4644,7 +4678,7 @@ async function withConfigWriteLock(operation) {
         closeSync(fd);
       }
       assertOwnedSync();
-      if (readFileSync(path, "utf8") !== before) throw new ConfigOwnershipError();
+      if (readFileSync2(path, "utf8") !== before) throw new ConfigOwnershipError();
       renameSync(temporary, path);
       temporaryOwned = false;
     } finally {
@@ -4661,7 +4695,7 @@ async function withConfigWriteLock(operation) {
       await rename2(markerPath, captured);
       assertDirectorySync();
       const entry = lstatSync(captured);
-      if (!entry.isFile() || entry.isSymbolicLink() || readFileSync(captured, "utf8") !== marker || readdirSync(lockPath).length) throw new ConfigOwnershipError();
+      if (!entry.isFile() || entry.isSymbolicLink() || readFileSync2(captured, "utf8") !== marker || readdirSync(lockPath).length) throw new ConfigOwnershipError();
       unlinkSync(captured);
       rmdirSync(quarantine);
       assertDirectorySync();
@@ -4985,7 +5019,7 @@ function normalizeError(err) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { dirname as dirname4, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function readCliVersion() {
@@ -4997,7 +5031,7 @@ function readCliVersion() {
     ];
     for (const path of candidates) {
       try {
-        const pkg = JSON.parse(readFileSync2(path, "utf8"));
+        const pkg = JSON.parse(readFileSync3(path, "utf8"));
         if (typeof pkg.version === "string" && pkg.version) return pkg.version;
       } catch {
       }
@@ -5333,19 +5367,19 @@ function formatPretty(info) {
 
 // src/commands/actions.ts
 import { spawn as spawn2 } from "child_process";
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { platform as platform3 } from "os";
 import { basename, extname } from "path";
 
 // src/json-input.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 function parseJsonInput(value) {
   let source = value;
   if (value.startsWith("@")) {
     const path = value.slice(1);
     if (!path) throw new Error("--data @file path must not be empty");
     try {
-      source = readFileSync3(path, "utf8");
+      source = readFileSync4(path, "utf8");
     } catch (err) {
       throw new Error(`Could not read --data file ${path}: ${err.message}`);
     }
@@ -5542,7 +5576,7 @@ Approval required. ${opened ? "Opening" : "Open"} ${approval.verificationUrl}` :
       const resource = parseResourceOption(opts.resourceType, opts.resourceId);
       const result = await topolo.client.uploadAction(
         action,
-        readFileSync4(opts.file),
+        readFileSync5(opts.file),
         parseJsonObject(opts.data || "{}"),
         {
           fileName: basename(opts.file),

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.2",
-  "topoloPublishedVersion": "0.13.2",
+  "version": "0.13.3",
+  "topoloPublishedVersion": "0.13.3",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -27,7 +27,7 @@
     "test:watch": "vitest",
     "coverage": "pnpm run coverage:node && pnpm run coverage:adapter",
     "coverage:node": "vitest run --coverage",
-    "coverage:adapter": "python3 -m venv node_modules/.cache/agent-pack-test && node_modules/.cache/agent-pack-test/bin/python -m pip install --disable-pip-version-check --quiet --timeout 15 --retries 0 -r agent-packs/requirements-test.txt && PYTHONPATH=agent-packs/src COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage run --branch --source=topolo_agent_pack.topolo,topolo_agent_pack.claude,topolo_agent_pack.policy -m unittest discover -s agent-packs/tests && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage report --fail-under=100"
+    "coverage:adapter": "python3 -m venv node_modules/.cache/agent-pack-test && node_modules/.cache/agent-pack-test/bin/python -m pip install --disable-pip-version-check --quiet --timeout 15 --retries 0 -r agent-packs/requirements-test.txt && PYTHONPATH=agent-packs/src:agent-packs COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage run --branch --source=topolo_agent_pack.topolo,topolo_agent_pack.claude,topolo_agent_pack.policy,topolo_agent_pack.permissions,topolo_agent_pack.approvals,topolo_agent_pack.execution,topolo_agent_pack.live,topolo_agent_pack.cli,coverage_changed -m unittest discover -s agent-packs/tests && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage report && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage report --include='*/topolo_agent_pack/topolo.py,*/topolo_agent_pack/claude.py,*/topolo_agent_pack/policy.py,*/topolo_agent_pack/permissions.py,*/topolo_agent_pack/approvals.py,*/topolo_agent_pack/execution.py,*/agent-packs/coverage_changed.py' --fail-under=100 && COVERAGE_FILE=node_modules/.cache/agent-pack-test/.coverage node_modules/.cache/agent-pack-test/bin/python -m coverage json -o node_modules/.cache/agent-pack-test/coverage.json && node_modules/.cache/agent-pack-test/bin/python agent-packs/coverage_changed.py"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",