@topolo/cli 0.13.2 → 0.13.4

package/agent-packs/src/topolo_agent_pack/policy.py

@@ -46,7 +46,7 @@ def role_profile(agent):
     return 'operator'
 
 
-def settings(agent, harness):
+def settings(agent, harness, consent=None):
     if harness not in MODELS:
         raise PackError('Execution settings adapter is not qualified: ' + harness)
     profile = role_profile(agent)
@@ -62,22 +62,27 @@ def settings(agent, harness):
     else:
         native = {'model': model, 'effortLevel': spec['effort'],
                   'permissions': {'defaultMode': 'acceptEdits' if profile == 'build' else 'default'}}
+    from .permissions import apply_settings
+    native = apply_settings(agent, harness, native, consent)
+    full = native.get('sandbox_mode') == 'danger-full-access' or native.get('permissions', {}).get('defaultMode') == 'bypassPermissions'
     return {'profile': profile, 'nativeSettings': native,
-            'localAccessIntent': spec['localAccess'], 'applied': False,
+            'localAccessIntent': 'full-access' if full else native.get('sandbox_mode', spec['localAccess']), 'applied': False,
             # Claude Manual is an approval mode, not a read-only filesystem sandbox.
-            'requiresAdditionalLocalConfinement': harness == 'claude' and spec['localAccess'] == 'read-only'}
+            'requiresAdditionalLocalConfinement': harness == 'claude' and not full and spec['localAccess'] == 'read-only'}
 
 
-def render(manifest, revision, agents, harnesses=('codex', 'claude')):
+def render(manifest, revision, agents, harnesses=('codex', 'claude'), consent=None):
     rows = []
     for agent in agents:
         rows.append({'key': component_key(agent), 'title': agent['title'],
                      'sidebar': {'group': GROUPS.get(agent['set'], agent['set']),
                                  'pinned': agent.get('pinned', False)},
-                     'harnesses': {h: settings(agent, h) for h in harnesses}})
+                     'intake': consent['intakeRoutes'][component_key(agent)] if consent else None,
+                     'harnesses': {h: settings(agent, h, consent) for h in harnesses}})
     return {'format': 'topolo-agent-execution-policy', 'schemaVersion': 1,
             'pack': manifest['packId'], 'sourceRevision': revision, 'agents': rows,
-            'applied': False,
+            'applied': False, 'installationConsent': copy.deepcopy(consent),
+            'organizationManagedPolicyVerified': False,
             'contextPolicy': {'load': ['role charter', 'current task', 'relevant retrieved memory'],
                               'sharedMemory': 'retrieve by task and user or organization scope',
                               'history': 'preserve, do not copy between roles',

package/agent-packs/src/topolo_agent_pack/topolo.py

@@ -2,6 +2,9 @@
 import re,contextlib,fcntl,base64,hashlib,json,os,pathlib,shutil,subprocess,tempfile,uuid
 from .storage import PackError,atomic_json,canonical,read_json,safe_id
 
+class ConnectionSourceRefused(PackError):
+    pass
+
 class Client:
     def __init__(self,environment,context,binary=None):
         if environment not in {'development','staging','production'}:
@@ -35,6 +38,8 @@ class Client:
                 plan=self.run(['actions','plan',*common,'--confirm'])
                 if not plan.get('executable'):
                     raise PackError('Topolo plan is not executable')
+            if action=='app_topolo_agent.agent_packs.connect' and getattr(self,'_pack_connect_scope',None) is not None:
+                qualify_connection_scope(self._pack_connect_scope)
             if upload:
                 result=self.run(['actions','upload',*common,'--file',str(upload),'--content-type',input.get('type','application/octet-stream'),'--confirm'])
             else:result=self.run(['actions','call',*common,'--detail',*(['--confirm'] if write else [])])
@@ -49,6 +54,18 @@ def identity(client):
         raise PackError('Verified user and organization context are required by the Agent contract')
     return {'userId':user['id'],'organizationId':org['id']}
 
+def organization_execution_policy(client, consent, agents, workspace):
+    """Fresh authenticated organization ceiling, distinct from native acknowledgement."""
+    from .permissions import organization_policy, authorize_profile
+    actor=identity(client)
+    if actor['userId']!=consent['principalId'] or client.context!=consent['contextKey']:
+        raise PackError('Current installation principal/context differs')
+    if not workspace:
+        raise PackError('Explicit verified Agent workspace required for policy retrieval')
+    envelope=client.action('app_topolo_agent.organization_execution_policy.get',{},workspace)
+    policy=organization_policy(envelope,client.context,actor['organizationId'])
+    return policy,authorize_profile(consent,agents,policy)
+
 def binding_path(lib,name,environment,context):
     safe_id(name)
     return lib.root/'connections'/name/environment/(hashlib.sha256(context.encode()).hexdigest()+'.json')
@@ -111,9 +128,194 @@ def attach_runtime(lib,runtime):
         with os.fdopen(fd,'w') as f:f.write(text);f.flush();os.fsync(f.fileno())
         os.chmod(temp,0o600);os.replace(temp,guide)
 
+def context_file(path,root,optional=False):
+    """Only regular owned files within a qualified local context root."""
+    path=pathlib.Path(path);root=pathlib.Path(root).resolve()
+    if not path.is_absolute() or not path.is_relative_to(root):
+        raise PackError('Context file is outside its owned root')
+    parent=path.parent
+    while parent.is_relative_to(root):
+        if parent.is_symlink() or not parent.is_dir() or parent.stat().st_uid!=os.getuid():
+            raise PackError('Context parent is not an owned regular directory')
+        if parent==root:break
+        parent=parent.parent
+    if path.is_symlink():
+        raise PackError('Context file must not be a symlink')
+    if not path.exists() and optional:return None
+    if not path.is_file() or path.stat().st_uid!=os.getuid() or path.stat().st_nlink!=1:
+        raise PackError('Context file must be an owned regular file')
+    return path.read_bytes()
+
+def claude_context_plan(lib,name,manifest,revision):
+    from .claude import project_directory
+    safe_id(name);root=lib.root/'claude';state_path=root/'state.json'
+    state_bytes=context_file(state_path,lib.root);state=json.loads(state_bytes)
+    if state.get('schemaVersion')!=1 or state.get('harness')!='claude' or not isinstance(state.get('agents'),list):
+        raise PackError('Existing Claude roster required')
+    expected={name+'/'+a['set']+'/'+a['id']:a for a in manifest['agents']}
+    records=[r for r in state['agents'] if r.get('pack')==name]
+    if len(records)!=len(expected) or {r.get('key') for r in records}!=set(expected):
+        raise PackError('Complete existing Claude pack must match the captured roster')
+    ids=set();workspaces=set();rows=[];preserved={str(state_path):hashlib.sha256(state_bytes).hexdigest()}
+    config=pathlib.Path(os.environ.get('CLAUDE_CONFIG_DIR',str(pathlib.Path.home()/'.claude'))).expanduser().resolve()
+    for record in records:
+        key=record['key'];agent=expected[key];safe_id(agent['set']);safe_id(agent['id'])
+        workspace=root/'workspaces'/name/agent['set']/agent['id']
+        session=record.get('cliSessionId','')
+        try:session_ok=str(uuid.UUID(session))==session
+        except (ValueError,AttributeError,TypeError):session_ok=False
+        fields={'key':key,'pack':name,'set':agent['set'],'agent':agent['id'],'sourceRevision':revision,
+            'sourceCodexThreadId':agent['threadId'],'workspace':str(workspace),'cliSessionId':session,'desktopSessionId':'local_'+session,
+            'transcript':str(project_directory(config,workspace)/(session+'.jsonl'))}
+        if not session_ok or any(record.get(k)!=v for k,v in fields.items()) or session in ids or str(workspace) in workspaces:
+            raise PackError('Claude native identity, revision or workspace differs')
+        ids.add(session);workspaces.add(str(workspace))
+        identity_path=root/'identities'/(hashlib.sha256(key.encode()).hexdigest()+'.json')
+        identity_bytes=context_file(identity_path,lib.root);identity_record=json.loads(identity_bytes)
+        if any(identity_record.get(k)!=v for k,v in fields.items()):
+            raise PackError('Claude durable identity differs from its roster')
+        preserved[str(identity_path)]=hashlib.sha256(identity_bytes).hexdigest()
+        guide=workspace/'CLAUDE.md';body=context_file(guide,lib.root)
+        descriptor=workspace/'topolo-connection.json';old_descriptor=context_file(descriptor,lib.root,optional=True)
+        for file in workspace.rglob('*.md'):
+            if file!=guide:preserved[str(file)]=hashlib.sha256(context_file(file,lib.root)).hexdigest()
+        transcript=pathlib.Path(fields['transcript'])
+        preserved[str(transcript)]=hashlib.sha256(context_file(transcript,config/'projects')).hexdigest()
+        rows.append({'key':key,'logicalId':agent['set']+'/'+agent['id'],'nativeThreadId':record['desktopSessionId'],
+            'guide':str(guide),'descriptor':str(descriptor),'beforeGuide':hashlib.sha256(body).hexdigest(),
+            'beforeDescriptor':hashlib.sha256(old_descriptor).hexdigest() if old_descriptor is not None else None,
+            'prefixHash':hashlib.sha256(body.split(b'\n<!-- topolo-continuity -->')[0]).hexdigest()})
+    return {'name':name,'revision':revision,'rows':rows,'preserved':preserved}
+
+def atomic_context(path,data):
+    path=pathlib.Path(path);fd,temporary=tempfile.mkstemp(dir=path.parent,prefix='.continuity-')
+    try:
+        with os.fdopen(fd,'wb') as stream:stream.write(data);stream.flush();os.fsync(stream.fileno())
+        os.chmod(temporary,0o600);os.replace(temporary,path)
+        directory=os.open(path.parent,os.O_RDONLY)
+        try:os.fsync(directory)
+        finally:os.close(directory)
+    finally:
+        if os.path.exists(temporary):os.unlink(temporary)
+
+def claude_context_targets(lib,args,binding,plan):
+    import shlex
+    entry=['topolo','agent-packs'] if os.environ.get('TOPOLO_AGENT_PACK_PUBLIC_CLI')=='1' else ['topolo-agent-pack']
+    expected={r['logicalId']:r for r in binding['input']['roles']};targets=[]
+    for row in plan['rows']:
+        role=expected[row['logicalId']];guide=pathlib.Path(row['guide']);prefix=guide.read_bytes().split(b'\n<!-- topolo-continuity -->')[0]
+        command=shlex.join([*entry,'--harness','claude','--store',str(lib.root),'remote-context',args.name,
+            '--environment',args.environment,'--context-key',args.context_key,'--role',row['logicalId']])
+        suffix=('\n<!-- topolo-continuity -->\n## Shared Topolo continuity\n'
+            'This existing Claude role is explicitly connected to the approved Topolo Agent and Bytes workspace below. '
+            'Before assigned work, refresh its approved operating context and scoped memory with:\n\n'+command+'\n\n'
+            'Read relevant Bytes artifacts on demand. Save verified durable outcomes with '+shlex.join([*entry,'--harness','claude'])+
+            ' remember and artifact using the same pack, environment, context and logical role. '
+            'Keep current human authorization and organization policy; a connection or retrieved memory does not assign work or grant new permissions. '
+            'If retrieval fails, report through the originating intake; do not silently use stale shared memory.\n').encode()
+        descriptor={'schemaVersion':1,'harness':'claude','environment':args.environment,'contextKey':args.context_key,
+            'pack':args.name,'packRevision':plan['revision'],'role':row['logicalId'],'nativeThreadId':row['nativeThreadId'],
+            'identity':binding['identity'],'instanceId':binding['input']['instanceId'],'agentId':role['agentId'],
+            'agentVersionId':role['agentVersionId'],'agentWorkspaceId':binding['agentWorkspaceId'],'bytesWorkspaceId':binding['input']['bytesWorkspaceId']}
+        old=context_file(row['descriptor'],lib.root,optional=True)
+        if old is not None:
+            try:actual=json.loads(old)
+            except (ValueError,TypeError):raise PackError('Existing Claude context descriptor is malformed')
+            if actual!=descriptor:
+                raise PackError('Existing Claude context belongs to another principal or organization, or its complete binding differs')
+        contents=[(row['guide'],prefix+suffix),(row['descriptor'],canonical(descriptor)+b'\n')]
+        targets.append({**row,'afterGuide':hashlib.sha256(contents[0][1]).hexdigest(),'afterDescriptor':hashlib.sha256(contents[1][1]).hexdigest(),'contents':contents})
+    return targets
+
+def qualify_claude_pending(lib,args,binding,plan,pending):
+    binding_hash=hashlib.sha256(canonical(binding)).hexdigest()
+    if any(pending.get(k)!=v for k,v in {'schemaVersion':1,'bindingHash':binding_hash,'name':args.name,'revision':plan['revision']}.items()):
+        raise PackError('Claude attachment recovery binding differs; no new effects')
+    if pending.get('preserved')!=plan['preserved']:
+        raise PackError('Claude preserved context changed; no new effects')
+    targets=claude_context_targets(lib,args,binding,plan);old_targets=pending.get('targets')
+    if not isinstance(old_targets,list) or len(old_targets)!=len(targets) or any(any(old.get(k)!=new[k] for k in ['key','logicalId','nativeThreadId','guide','descriptor','prefixHash','afterGuide','afterDescriptor']) for old,new in zip(old_targets,targets)):
+        raise PackError('Claude attachment target identity differs; no new effects')
+    verified=pending.get('verifiedKeys');keys=[row['key'] for row in targets]
+    if not isinstance(verified,list) or verified!=keys[:len(verified)]:
+        raise PackError('Claude partial verification progress differs')
+    for old,current in zip(old_targets,targets):
+        if current['beforeGuide'] not in [old.get('beforeGuide'),old['afterGuide']] or current['beforeDescriptor'] not in [old.get('beforeDescriptor'),old['afterDescriptor']] or (current['key'] in verified and (current['beforeGuide']!=old['afterGuide'] or current['beforeDescriptor']!=old['afterDescriptor'])):
+            raise PackError('Claude partial target progress differs; no new effects')
+    return targets
+
+def attach_claude(lib,args,binding,plan):
+    import shlex
+    path=binding_path(lib,args.name,args.environment,args.context_key)
+    journal=path.with_suffix('.claude-context.pending.json');receipt=path.with_suffix('.claude-context.verified.json')
+    binding_hash=hashlib.sha256(canonical(binding)).hexdigest()
+    pending=read_json(journal,{})
+    if pending and not getattr(args,'reconcile_local_context',False):
+        raise PackError('Partial Claude context attachment requires explicit --reconcile-local-context; no replay')
+    current_manifest,current_revision=lib.load(args.name)
+    current=claude_context_plan(lib,args.name,current_manifest,current_revision)
+    if current!=plan:
+        raise PackError('Claude context changed during connection qualification')
+    targets=claude_context_targets(lib,args,binding,plan)
+    stable={'schemaVersion':1,'bindingHash':binding_hash,'name':args.name,'revision':plan['revision'],'preserved':plan['preserved'],
+        'targets':[{k:v for k,v in row.items() if k!='contents'} for row in targets]}
+    result={'state':'local-context-verified','harness':'claude','verifiedAgents':len(targets),'historyChanged':False,
+        'nativeSettingsVerified':False,'nativeIdleVerified':False,'modelTurnsStarted':False,'bindingHash':binding_hash}
+    if not pending and all(row['beforeGuide']==row['afterGuide'] and row['beforeDescriptor']==row['afterDescriptor'] for row in targets):
+        if claude_context_plan(lib,args.name,*lib.load(args.name))!=plan:
+            raise PackError('Claude context changed before unchanged attachment receipt')
+        atomic_json(receipt,{**stable,**result,'verifiedKeys':[row['key'] for row in targets]})
+        return result
+    if pending:
+        if any(pending.get(k)!=stable[k] for k in ['schemaVersion','bindingHash','name','revision','preserved']):
+            raise PackError('Claude attachment recovery binding or preserved context differs')
+        old_targets=pending['targets']
+        if len(old_targets)!=len(targets) or any(any(old.get(k)!=new[k] for k in ['key','logicalId','nativeThreadId','guide','descriptor','prefixHash','afterGuide','afterDescriptor']) for old,new in zip(old_targets,targets)):
+            raise PackError('Claude attachment target identity differs')
+        stable['targets']=old_targets
+    else:atomic_json(journal,{**stable,'state':'prepared','verifiedKeys':[]})
+    verified=[]
+    for row,baseline in zip(targets,stable['targets']):
+        manifest,revision=lib.load(args.name);fresh=claude_context_plan(lib,args.name,manifest,revision)
+        if revision!=stable['revision'] or fresh['preserved']!=stable['preserved'] or [r['key'] for r in fresh['rows']]!=[r['key'] for r in plan['rows']]:
+            raise PackError('Claude source, identities, context or transcript changed during attachment')
+        for file,data in row['contents']:
+            old=context_file(file,lib.root,optional=file==row['descriptor']);digest=hashlib.sha256(old).hexdigest() if old is not None else None
+            before=baseline['beforeGuide'] if file==row['guide'] else baseline['beforeDescriptor']
+            after=baseline['afterGuide'] if file==row['guide'] else baseline['afterDescriptor']
+            if digest not in [before,after]:
+                raise PackError('Claude target changed; partial attachment retained for explicit reconciliation')
+            if digest!=after:atomic_context(file,data)
+            if hashlib.sha256(context_file(file,lib.root)).hexdigest()!=after:
+                raise PackError('Claude attachment read-back differs; retain partial journal')
+        verified.append(row['key']);atomic_json(journal,{**stable,'state':'partial','verifiedKeys':verified})
+    final=claude_context_plan(lib,args.name,*lib.load(args.name))
+    if final['preserved']!=stable['preserved']:
+        raise PackError('Claude preserved context or history changed before final receipt')
+    for row in stable['targets']:
+        if any(hashlib.sha256(context_file(row[file],lib.root)).hexdigest()!=row[after] for file,after in [('guide','afterGuide'),('descriptor','afterDescriptor')]):
+            raise PackError('Claude final attachment differs; retain partial journal')
+    atomic_json(receipt,{**stable,**result,'verifiedKeys':verified});journal.unlink()
+    return result
+
+def qualify_connection_scope(scope):
+    lib,args,options,manifest_bytes,revision,roles_bytes,roles,claude_plan=scope
+    try:
+        current_manifest,current_revision=lib.load(args.name)
+        if vars(args)!=options or current_revision!=revision or canonical(current_manifest)!=manifest_bytes or pathlib.Path(args.roles).read_bytes()!=roles_bytes:
+            raise PackError('Pack source or request inputs changed')
+        # Manifest equality and Library.object's content hash bind instructions.
+        # Re-read each actual immutable object; missing/corrupt content refuses.
+        for agent in current_manifest['agents']:role_guide(lib,current_manifest,agent)
+        if claude_plan is not None and claude_context_plan(lib,args.name,current_manifest,current_revision)!=claude_plan:
+            raise PackError('Claude source, identities, context or history changed')
+    except (PackError,OSError,ValueError,TypeError) as error:
+        raise ConnectionSourceRefused('Pack source or native context changed before cloud dispatch; no mutating call') from error
+
 def connect(lib,args,client):
     manifest,revision=lib.load(args.name)
-    selected=read_json(args.roles)
+    claude_plan=claude_context_plan(lib,args.name,manifest,revision) if getattr(args,'harness','codex')=='claude' else None
+    roles_bytes=pathlib.Path(args.roles).read_bytes();selected=json.loads(roles_bytes)
     expected={a['set']+'/'+a['id']:a for a in manifest['agents']}
     if not isinstance(selected,dict) or set(selected)!=set(expected):
         raise PackError('Roles file must map every logical set/agent exactly once')
@@ -124,6 +326,16 @@ def connect(lib,args,client):
             raise PackError('Each role requires only agentId and agentVersionId')
         roles.append({'logicalId':key,**remote,'instructions':role_guide(lib,manifest,a)})
     path=binding_path(lib,args.name,args.environment,args.context_key)
+    local_pending={}
+    if claude_plan is not None:
+        local_journals=list((lib.root/'connections'/args.name).rglob('*.claude-context.pending.json'))
+        expected_journal=path.with_suffix('.claude-context.pending.json')
+        if local_journals:
+            if len(local_journals)!=1 or local_journals[0]!=expected_journal:
+                raise PackError('Unresolved Claude attachment belongs to another environment or context; no new effects')
+            local_pending=json.loads(context_file(expected_journal,lib.root))
+            if not getattr(args,'reconcile_local_context',False):
+                raise PackError('Partial Claude context attachment requires explicit --reconcile-local-context; no replay')
     old=read_json(path,{})
     journal=path.with_suffix('.pending.json')
     pending=read_json(journal,{})
@@ -131,24 +343,60 @@ def connect(lib,args,client):
     payload={'instanceId':instance,'packId':manifest.get('startingContext',{}).get('templateId',manifest['packId']),
       'packVersion':manifest.get('startingContext',{}).get('templateVersion','1.0.0'),
       'ownershipScope':args.ownership,'bytesWorkspaceId':args.bytes_workspace,'bytesScope':args.bytes_scope,'roles':roles}
+    scope=(lib,args,dict(vars(args)),canonical(manifest),revision,roles_bytes,roles,claude_plan)
     owner=identity(client)
+    qualify_connection_scope(scope)
     journal=path.with_suffix('.pending.json')
     if journal.exists():
         pending=read_json(journal)
         if pending['input']!=payload or pending['identity']!=owner or pending.get('agentWorkspaceId')!=args.agent_workspace:
             raise PackError('Unresolved connection receipt; reconcile before changing the request')
-    atomic_json(journal,{'input':payload,'identity':owner,'revision':revision,'agentWorkspaceId':args.agent_workspace})
-    result=client.action('app_topolo_agent.agent_packs.connect',payload,args.agent_workspace,write=True)
-    remote=result['connection'];readback=client.action('app_topolo_agent.agent_packs.get',{'instanceId':instance},args.agent_workspace)['connection']
+    if claude_plan is not None and pending:
+        raise PackError('Unresolved cloud connection requires remote-recover before Claude attachment; no cloud replay')
+    if old and old.get('identity')!=owner:
+        raise PackError('Existing connection principal differs')
+    reuse=bool(old and old.get('input')==payload and old.get('agentWorkspaceId')==args.agent_workspace and old.get('packRevision')==revision)
+    proposed={'schemaVersion':1,'environment':args.environment,'contextKey':args.context_key,'identity':owner,
+      'agentWorkspaceId':args.agent_workspace,'input':payload,'packRevision':revision}
+    if claude_plan is not None:
+        claude_context_targets(lib,args,proposed,claude_plan)
+        if local_pending:
+            if not reuse or any(old.get(k)!=v for k,v in proposed.items()):
+                raise PackError('Claude attachment recovery binding differs; no new connection or binding replacement')
+            qualify_claude_pending(lib,args,old,claude_plan,local_pending)
+    if reuse:
+        remote=client.action('app_topolo_agent.agent_packs.get',{'instanceId':instance},args.agent_workspace)['connection'];readback=remote
+    else:
+        prepared={'input':payload,'identity':owner,'revision':revision,'agentWorkspaceId':args.agent_workspace}
+        if getattr(client,'_pack_connect_scope',None) is not None:
+            raise PackError('A trusted connection dispatch scope is already active')
+        atomic_json(journal,prepared)
+        client._pack_connect_scope=scope
+        try:
+            qualify_connection_scope(scope)
+            result=client.action('app_topolo_agent.agent_packs.connect',payload,args.agent_workspace,write=True)
+        except ConnectionSourceRefused:
+            if not pending and read_json(journal)==prepared:journal.unlink()
+            raise
+        finally:client._pack_connect_scope=None
+        remote=result['connection'];readback=client.action('app_topolo_agent.agent_packs.get',{'instanceId':instance},args.agent_workspace)['connection']
     if remote!=readback or any(readback.get(k)!=v for k,v in payload.items()) or readback.get('organizationId')!=owner['organizationId'] or readback.get('workspaceId')!=args.agent_workspace:
         raise PackError('Pack connection read-back mismatch; preserve pending receipt')
     binding={'schemaVersion':1,'environment':args.environment,'contextKey':args.context_key,'identity':owner,
       'agentWorkspaceId':args.agent_workspace,'input':payload,'connection':readback,'packRevision':revision}
-    atomic_json(path,binding);journal.unlink()
-    atomic_json(path.parent.parent/'active.json',{'environment':args.environment,'contextKey':args.context_key})
+    if local_pending:
+        if binding!=old:
+            raise PackError('Claude attachment verified remote binding changed; no local replay')
+    else:
+        atomic_json(path,binding)
+        if journal.exists():journal.unlink()
+        atomic_json(path.parent.parent/'active.json',{'environment':args.environment,'contextKey':args.context_key})
     active=lib.active()
-    if active.get('runtime'):attach_runtime(lib,active['runtime'])
-    return {'state':'connected','binding':str(path),'instanceId':instance,'roles':len(roles),'environment':args.environment}
+    if claude_plan is not None:attachment=attach_claude(lib,args,binding,claude_plan)
+    else:
+        if active.get('runtime'):attach_runtime(lib,active['runtime'])
+        attachment=None
+    return {'state':'connected','binding':str(path),'instanceId':instance,'roles':len(roles),'environment':args.environment,'localAttachment':attachment}
 
 def remote_context(lib,args,client):
     _,binding=open_binding(lib,args,client)
@@ -254,10 +502,13 @@ def recover_connection(lib,args,client):
     """Read/reconcile receipts. Never replay a memory create with an unknown outcome."""
     path=binding_path(lib,args.name,args.environment,args.context_key)
     pending_path=path.with_suffix('.pending.json')
-    if not path.exists() and pending_path.exists():
+    if pending_path.exists():
         pending=read_json(pending_path)
         if identity(client)!=pending['identity']:
             raise PackError('Pending connection principal/context mismatch')
+        older=read_json(path,{})
+        if older and (older.get('schemaVersion')!=1 or older.get('environment')!=args.environment or older.get('contextKey')!=args.context_key or older.get('identity')!=pending['identity'] or older.get('agentWorkspaceId')!=pending['agentWorkspaceId'] or older.get('input',{}).get('instanceId')!=pending['input']['instanceId']):
+            raise PackError('Existing connection custody differs from the pending original request')
         remote=client.action('app_topolo_agent.agent_packs.get',{'instanceId':pending['input']['instanceId']},pending['agentWorkspaceId'])['connection']
         if any(remote.get(k)!=v for k,v in pending['input'].items()) or remote.get('organizationId')!=pending['identity']['organizationId'] or remote.get('workspaceId')!=pending['agentWorkspaceId']:
             raise PackError('Pending connection read-back mismatch; retain receipt')
@@ -266,7 +517,7 @@ def recover_connection(lib,args,client):
         pending_path.unlink()
         atomic_json(path.parent.parent/'active.json',{'environment':args.environment,'contextKey':args.context_key})
         active=lib.active()
-        if active.get('runtime'):attach_runtime(lib,active['runtime'])
+        if active.get('runtime') and getattr(args,'harness','codex')!='claude':attach_runtime(lib,active['runtime'])
     path,binding=open_binding(lib,args,client);reports=[]
     memory=path.with_suffix('.memory-pending.json')
     journals=([memory] if memory.exists() else [])+list(path.with_suffix('').glob('artifact-*.json'))
@@ -293,8 +544,9 @@ def recover_connection(lib,args,client):
                     state='artifact-and-memory-verified';atomic_json(journal,{'state':state,'artifact':receipt['artifact'],'memoryId':matches[0]['id'],'recovered':True})
             else:state='unresolved-memory-outcome'
         reports.append({'receipt':str(journal),'state':state})
-    return {'state':'reconciled' if not path.with_suffix('.pending.json').exists() and all(r['state'] in ['memory-verified','artifact-and-memory-verified'] for r in reports) else 'recovery-required',
-      'receipts':reports,'connectionPending':path.with_suffix('.pending.json').exists()}
+    return {'state':'reconciled' if not path.with_suffix('.pending.json').exists() and not path.with_suffix('.claude-context.pending.json').exists() and all(r['state'] in ['memory-verified','artifact-and-memory-verified'] for r in reports) else 'recovery-required',
+      'receipts':reports,'connectionPending':path.with_suffix('.pending.json').exists(),
+      'localContextRecoveryRequired':path.with_suffix('.claude-context.pending.json').exists(),'localContextReplayed':False}
 
 @contextlib.contextmanager
 def connection_lock(lib,args):