@topolo/cli 0.13.4 → 0.13.6

package/dist/{claude-pack-backend-5DWMIDRA.js → claude-pack-backend-AWCWJJA5.js}

@@ -10,7 +10,6 @@ import { spawn, spawnSync } from "child_process";
 import { dirname, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { createConnection } from "net";
-import { tmpdir } from "os";
 import { WebSocket } from "undici";
 
 // src/lib/claude-native-pack.ts
@@ -53,6 +52,14 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
       if (!plan.noEffects && member.group !== null && groups.filter((g) => g.name === member.group).length > 1)
         throw new Error("Ambiguous native sidebar group: " + member.group);
     }
+    const nativeDescriptor = async (member) => {
+      if (typeof manager.getSessionWhenLoaded !== "function") throw new Error("Qualified native session descriptor API is unavailable.");
+      const descriptor = await manager.getSessionWhenLoaded(member.sessionId, "topolo-agent-pack", { warnOnMiss: false });
+      checkDeadline();
+      if (!descriptor || descriptor.sessionId !== member.sessionId || descriptor.cwd !== member.cwd || descriptor.title !== member.title)
+        throw new Error("Owned native session descriptor identity changed: " + member.key);
+      return descriptor;
+    };
     const snapshot = async (members = plan.members) => {
       const result = [];
       for (const member of members) {
@@ -62,8 +69,13 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
           throw new Error("Owned session identity or active membership changed: " + member.key);
         if (manager.hasLosableWork(member.sessionId) || session.isRunning || session.starting || session.pendingToolPermissions?.length)
           throw new Error("Session has live or pending work; no changes permitted: " + member.key);
-        if (!plan.noEffects && (session.backend?.kind !== "local" || session.backend.remoteTarget || session.worktreePath || session.worktreeLazy || session.spawnedFrom))
-          throw new Error("Incoming session is not a qualified local role.");
+        if (!plan.noEffects) {
+          const descriptor = await nativeDescriptor(member);
+          if (manager.hasLosableWork(member.sessionId) || descriptor.isRunning || descriptor.starting || descriptor.pendingToolPermissions?.length)
+            throw new Error("Session has live or pending work; no changes permitted: " + member.key);
+          if (descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom)
+            throw new Error("Incoming session is not a qualified local role.");
+        }
         result.push({
           key: member.key,
           sessionId: session.sessionId,
@@ -92,8 +104,13 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
           throw new Error("Outgoing native identity differs.");
         if (manager.hasLosableWork(member.sessionId) || session.isRunning || session.starting || session.pendingToolPermissions?.length)
           throw new Error("Outgoing session has live or pending work.");
-        if (!plan.noEffects && (session.backend?.kind !== "local" || session.backend.remoteTarget || session.worktreePath || session.worktreeLazy || session.spawnedFrom || !manager.archiveCascadeClosureOf || manager.archiveCascadeClosureOf(session).length))
-          throw new Error("Outgoing native archive closure is not qualified.");
+        if (!plan.noEffects) {
+          const descriptor = await nativeDescriptor(member);
+          if (manager.hasLosableWork(member.sessionId) || descriptor.isRunning || descriptor.starting || descriptor.pendingToolPermissions?.length)
+            throw new Error("Outgoing session has live or pending work.");
+          if (descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom || !manager.archiveCascadeClosureOf || manager.archiveCascadeClosureOf(descriptor).length)
+            throw new Error("Outgoing native archive closure is not qualified.");
+        }
         result.push({ key: member.key, sessionId: member.sessionId, cwd: session.cwd, title: session.title, archived: session.isArchived === true });
       }
       return result;
@@ -145,7 +162,8 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
       for (const member of plan.members) {
         const session = await manager.getSession(member.sessionId);
         if (session.isArchived) {
-          if (session.backend?.kind !== "local" || session.backend.remoteTarget || session.worktreePath || session.worktreeLazy || session.spawnedFrom)
+          const descriptor = await nativeDescriptor(member);
+          if (descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom)
             throw new Error("Incoming session is not a qualified local role.");
           await effect({ operation: "unarchive", sessionId: member.sessionId }, async () => {
             await manager.unarchiveSession(member.sessionId);
@@ -311,9 +329,13 @@ async function nativeClaudeApprovalOperation(manager, routes, operation, fingerp
   let state = manager[symbol];
   if (state?.auditFailed) throw new Error("Native approval audit unavailable; use the original native interaction.");
   const owned = async (route) => {
+    if (typeof manager.getSessionWhenLoaded !== "function") throw new Error("Qualified native session descriptor API is unavailable.");
+    const descriptor = await manager.getSessionWhenLoaded(route.sessionId, "topolo-agent-pack-approval", { warnOnMiss: false });
     const session = await manager.getSession(route.sessionId);
-    if (!session || session.sessionId !== route.sessionId || session.cwd !== route.cwd || session.title !== route.title || session.isArchived || session.backend?.kind !== "local" || session.backend.remoteTarget || session.worktreePath || session.worktreeLazy || session.spawnedFrom)
+    if (!session || session.sessionId !== route.sessionId || session.cwd !== route.cwd || session.title !== route.title || session.isArchived)
       throw new Error("Native approval session identity differs: " + route.key);
+    if (!descriptor || descriptor.sessionId !== route.sessionId || descriptor.cwd !== route.cwd || descriptor.title !== route.title || descriptor.isArchived || descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom)
+      throw new Error("Native approval session descriptor identity differs: " + route.key);
     return session;
   };
   if (state && state.identity !== identity) {
@@ -816,7 +838,7 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
       if (options.apply && plan.approvalRoutes.length) {
         const directory2 = resolve(root, "claude/private");
         mkdirSync(directory2, { recursive: true, mode: 448 });
-        const socketDirectory = resolve(tmpdir(), "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16));
+        const socketDirectory = resolve("/tmp", "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16));
         mkdirSync(socketDirectory, { recursive: true, mode: 448 });
         for (const path of [directory2, socketDirectory]) {
           const stat = lstatSync(path);

package/dist/index.js

@@ -10,7 +10,7 @@ function registerAgentPacksCommand(program2) {
   const packs = program2.command("agent-packs").description("Install and operate Topolo Agent Packs in supported local hosts").option("--store <path>", "Portable pack library (default ~/AgentPacks)");
   packs.command("configure").description("Qualify and configure an adopted Claude roster through its live native backend").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
     if (options.harness !== "claude") throw new Error("Native configure is currently qualified only for Claude Desktop.");
-    const { configureClaudePack } = await import("./claude-pack-backend-5DWMIDRA.js");
+    const { configureClaudePack } = await import("./claude-pack-backend-AWCWJJA5.js");
     const result = await configureClaudePack({
       store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
       pack,
@@ -62,7 +62,7 @@ function registerAgentPacksCommand(program2) {
             throw new Error("Only a one-request once/deny response is supported.");
           decision = response.decision;
         }
-        const { operateClaudeApprovals } = await import("./claude-pack-backend-5DWMIDRA.js");
+        const { operateClaudeApprovals } = await import("./claude-pack-backend-AWCWJJA5.js");
         console.log(JSON.stringify(await operateClaudeApprovals({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           kind: args[0],
@@ -77,7 +77,7 @@ function registerAgentPacksCommand(program2) {
       if (options.policy || options.endpoint || options.pid || options.apply) {
         if (options.harness !== "claude" || !options.policy || !options.endpoint || !options.pid || args.length !== 1)
           throw new Error("Native switch/recovery requires one Claude pack, --policy, --endpoint and --pid.");
-        const { configureClaudePack } = await import("./claude-pack-backend-5DWMIDRA.js");
+        const { configureClaudePack } = await import("./claude-pack-backend-AWCWJJA5.js");
         const result2 = await configureClaudePack({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           pack: args[0],
@@ -124,7 +124,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.23.19/node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -3734,10 +3734,10 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 
-// node_modules/@topolo/sdk/dist/node/credential-store.js
+// node_modules/.pnpm/@topolo+sdk@0.23.19/node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2, rename as rename2, link } from "fs/promises";
-import { existsSync as existsSync2, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync } from "fs";
-import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync2, mkdirSync, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync, linkSync } from "fs";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import { homedir as homedir2, platform } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 import { createHash, randomUUID } from "crypto";
@@ -4608,20 +4608,33 @@ var ConfigOwnershipError = class extends TopoloSdkError2 {
     super("state_conflict", "Credential configuration ownership cannot be verified. Retain the unresolved operation instead of starting another renewal.");
   }
 };
+function lockEntryExists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw new ConfigOwnershipError();
+  }
+}
 async function withConfigWriteLock(operation) {
   const lockPath = `${configPath()}.lock`;
   await mkdir2(dirname2(lockPath), { recursive: true });
   const startedAt = performance.now();
   while (true) {
     try {
+      if (lockEntryExists(lockPath + ".reconcile")) throw Object.assign(new Error(), { code: "EEXIST" });
       await mkdir2(lockPath, { mode: 448 });
+      if (lockEntryExists(lockPath + ".reconcile")) {
+        throw new ConfigOwnershipError();
+      }
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       if (performance.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
         throw new TopoloSdkError2("state_conflict", "Credential configuration is still held or unresolved. This waiter did not dispatch a renewal.");
       }
-      await new Promise((resolve4) => setTimeout(resolve4, CONFIG_LOCK_RETRY_MS));
+      await new Promise((resolve22) => setTimeout(resolve22, CONFIG_LOCK_RETRY_MS));
     }
   }
   const directory = await lstat(lockPath);
@@ -4632,7 +4645,7 @@ async function withConfigWriteLock(operation) {
   await writeFile2(markerPath, marker, { flag: "wx", mode: 384 });
   const assertDirectory = async () => {
     const current = await lstat(lockPath);
-    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+    if (lockEntryExists(lockPath + ".reconcile") || !current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
       throw new ConfigOwnershipError();
   };
   const assertOwned = async () => {
@@ -4649,7 +4662,7 @@ async function withConfigWriteLock(operation) {
   };
   const assertDirectorySync = () => {
     const current = lstatSync(lockPath);
-    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
+    if (lockEntryExists(lockPath + ".reconcile") || !current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
       throw new ConfigOwnershipError();
   };
   const assertOwnedSync = () => {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.4",
-  "topoloPublishedVersion": "0.13.4",
+  "version": "0.13.6",
+  "topoloPublishedVersion": "0.13.6",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -31,8 +31,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.14.23",
-    "@topolo/sdk": "0.23.18",
+    "@topolo/mcp": "0.14.24",
+    "@topolo/sdk": "0.23.19",
     "commander": "^12.1.0",
     "undici": "6.29.0"
   },