@topolo/cli 0.13.6 → 0.13.8

package/agent-packs/src/topolo_agent_pack/cli.py

@@ -327,6 +327,9 @@ def parser():
     q.add_argument('operation',choices=['list','details','respond']);q.add_argument('key',nargs='?')
     q.add_argument('--intake');q.add_argument('--fingerprint');q.add_argument('--response')
     q.add_argument('--human-decision-recorded',action='store_true')
+    q=sub.add_parser('smoke',help='Start or read one closed, bound native acceptance case; never arbitrary prompts')
+    q.add_argument('operation',choices=['start','read']);q.add_argument('identity')
+    q.add_argument('--case',choices=sorted(live.SMOKE_CASES));q.add_argument('--operation-id')
     for command in ['connect','remote-context','remember','artifact','artifact-get','remote-recover']:
         q=sub.add_parser(command,help='Use public Topolo Agent continuity and Bytes artifact contracts')
         q.add_argument('name');q.add_argument('--environment',choices=['development','staging','production'],required=True)
@@ -380,7 +383,17 @@ def main(argv=None):
             emit(result)
             return 0
         with lib.lock():
-            if args.command=='approvals':
+            if args.command=='smoke':
+                if args.operation=='start':
+                    if not args.case or not args.operation_id:
+                        raise PackError('Exact smoke case and operation ID required')
+                    params={'key':args.identity,'caseId':args.case,'operationId':live.OwnedSmoke.operation_id(args.operation_id)}
+                else:
+                    if args.case or args.operation_id:
+                        raise PackError('Smoke read accepts only its existing operation ID')
+                    params={'operationId':live.OwnedSmoke.operation_id(args.identity)}
+                result=live.request(lib,'smoke-'+args.operation,params)
+            elif args.command=='approvals':
                 if args.operation!='list' and (not args.key or not args.intake or not args.fingerprint):
                     raise PackError('Exact request key, --intake and --fingerprint required')
                 params={'key':args.key,'intakeThreadId':args.intake,'fingerprint':args.fingerprint}

package/agent-packs/src/topolo_agent_pack/live.py

@@ -23,11 +23,240 @@ import time
 import urllib.request
 import urllib.parse
 import uuid
+import datetime
 
 from .storage import Library,PackError,atomic_json,canonical,read_json
 from .execution import ExecutionGate, load_gate, prepare_runtime, qualify_protocol
 from .approvals import ApprovalRouter
 
+SMOKE_PLAN = '6504d4e44c2456ae3e761de6c2e57b086b0e49229a7ee6a1ac782684ad4e40c6'
+SMOKE_CASES = {'stg-context-memory-bytes': ('staging', 6), 'stg-peer-ack': ('staging', 6),
+               'prod-role-context-ack': ('production', 140)}
+
+class OwnedSmoke:
+    """One finite native verification operation. No caller text, paths or RPC.
+
+    Both native hosts use this store. A durable exclusive reservation covers
+    budget checks and dispatch; an uncertain send retains it across restart.
+    Binding/fixture references are supplied by the effect owner, never invented.
+    """
+    def __init__(self, lib, harness):
+        if harness not in {'codex', 'claude'}:
+            raise PackError('Unknown smoke harness')
+        self.lib=lib;self.harness=harness;self.root=lib.root/'smoke-operations'
+        self.root.mkdir(mode=0o700,exist_ok=True)
+        self.owned(self.root,directory=True)
+
+    @staticmethod
+    def owned(path,directory=False):
+        stat=path.lstat()
+        if path.is_symlink() or stat.st_uid!=os.getuid() or stat.st_mode&0o022 or (not directory and not path.is_file()):
+            raise PackError('Unowned smoke record')
+
+    @staticmethod
+    def operation_id(value):
+        try: valid=isinstance(value,str) and str(uuid.UUID(value))==value
+        except ValueError: valid=False
+        if not valid:
+            raise PackError('Exact smoke UUID required')
+        return value
+
+    def path(self,operation):
+        return self.root/(self.operation_id(operation)+'.json')
+
+    def read(self,operation):
+        path=self.path(operation);self.owned(path)
+        if path.stat().st_size>1048576:
+            raise PackError('Smoke record exceeds bounded transport')
+        record=read_json(path)
+        if record.get('operationId')!=operation or record.get('harness')!=self.harness or record.get('planSHA256')!=SMOKE_PLAN:
+            raise PackError('Smoke operation custody differs')
+        return record
+
+    def binding(self,key,case):
+        if case not in SMOKE_CASES or not isinstance(key,str) or not re.fullmatch(r'[a-z0-9-]+/[a-z0-9-]+/[a-z0-9-]+',key):
+            raise PackError('Finite owned smoke case and role required')
+        path=self.lib.root/'smoke-bindings'/(self.harness+'.json');self.owned(path.parent,directory=True);self.owned(path)
+        if path.stat().st_size>131072:
+            raise PackError('Smoke binding exceeds bounded inventory')
+        binding=read_json(path);now=time.time()
+        if (set(binding)!={'format','planSHA256','planId','issuedAt','expiresAt','roles'} or
+            binding['format']!='topolo-owned-native-smoke-v1' or binding['planSHA256']!=SMOKE_PLAN or
+            not isinstance(binding['issuedAt'],(int,float)) or not isinstance(binding['expiresAt'],(int,float)) or
+            not binding['issuedAt']<=now<binding['expiresAt']<=binding['issuedAt']+900):
+            raise PackError('Current bounded smoke binding required')
+        self.operation_id(binding['planId'])
+        rows=binding['roles']
+        if (not isinstance(rows,list) or not 1<=len(rows)<=70 or
+            len({r['key'] for r in rows})!=len(rows) or len({r['nativeId'] for r in rows})!=len(rows)):
+            raise PackError('Unique complete smoke roster required')
+        matches=[r for r in rows if r['key']==key]
+        if len(matches)!=1:
+            raise PackError('Smoke role is outside the owned binding')
+        row=matches[0]
+        fields={'key','nativeId','cwd','title','environment','contextKey','principalId','organizationId','instanceId',
+                'logicalId','agentId','agentVersionId','agentWorkspaceId','bytesWorkspaceId',
+                'contextMarkerId','contextMarkerHash','artifactMemoryId','artifactHash','fixtureExpiresAt'}
+        if set(row)!=fields or row['environment']!=SMOKE_CASES[case][0]:
+            raise PackError('Exact smoke descriptor or environment differs')
+        for field in fields-{'key','cwd','title','environment','contextMarkerHash','artifactHash','fixtureExpiresAt'}:
+            if not isinstance(row[field],str) or not re.fullmatch(r'[A-Za-z0-9_:/.-]{1,160}',row[field]):
+                raise PackError('Invalid smoke identity reference')
+        if (not pathlib.Path(row['cwd']).is_absolute() or not isinstance(row['title'],str) or not 1<=len(row['title'])<=200 or
+            any(not re.fullmatch(r'[a-f0-9]{64}',row[f]) for f in ['contextMarkerHash','artifactHash']) or
+            row['logicalId']!='/'.join(key.split('/')[1:]) or row['contextKey']!='org:'+row['organizationId']):
+            raise PackError('Smoke role/context references differ')
+        if case.startswith('stg-') and not now<row['fixtureExpiresAt']<=binding['expiresAt']:
+            raise PackError('Bounded staging fixture expiry required')
+        from . import topolo
+        pack=key.split('/')[0]
+        connection=read_json(topolo.binding_path(self.lib,pack,row['environment'],row['contextKey']))
+        role=[r for r in connection['input']['roles'] if r['logicalId']==row['logicalId']]
+        expected={'instanceId':row['instanceId'],'bytesWorkspaceId':row['bytesWorkspaceId']}
+        if (connection['identity']!={'userId':row['principalId'],'organizationId':row['organizationId']} or
+            connection['agentWorkspaceId']!=row['agentWorkspaceId'] or
+            any(connection['input'].get(k)!=v for k,v in expected.items()) or len(role)!=1 or
+            any(role[0].get(k)!=row[k] for k in ['agentId','agentVersionId'])):
+            raise PackError('Smoke hosted connection differs')
+        local=pathlib.Path(row['cwd'])/'topolo-connection.json';self.owned(local)
+        descriptor=read_json(local)
+        if any(descriptor.get(k)!=row[k] for k in ['environment','contextKey','instanceId','agentWorkspaceId','bytesWorkspaceId']):
+            raise PackError('Current native hosted descriptor differs')
+        return binding,row,hashlib.sha256(canonical(binding)).hexdigest()
+
+    def prepare(self,key,case,operation,native_identity):
+        path=self.path(operation)
+        if path.exists():
+            raise PackError('Smoke operation already exists; read without replay')
+        lock=self.root/'.reservation'
+        try:fd=os.open(lock,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
+        except FileExistsError: raise PackError('Native smoke reservation remains; reconcile without replay')
+        with os.fdopen(fd,'wb') as stream:stream.write(canonical({'operationId':operation,'harness':self.harness}));stream.flush();os.fsync(stream.fileno())
+        try:
+            binding,row,digest=self.binding(key,case)
+            history=[]
+            for previous in self.root.glob('*.json'):
+                self.owned(previous);history.append(read_json(previous))
+            active=[r for r in history if r.get('state') not in {'completed','preflight-refused','native-refused'}]
+            if active:
+                raise PackError('Unsettled native smoke operation remains; no replay')
+            used=[r for r in history if r.get('planSHA256')==SMOKE_PLAN and r.get('caseId')==case and r.get('state')!='preflight-refused']
+            same_role=lambda r:r.get('harness')==self.harness and (r.get('key')==key or
+                (case.startswith('stg-') and r.get('key','').split('/')[1:2]==key.split('/')[1:2]))
+            if len(used)>=SMOKE_CASES[case][1] or any(same_role(r) for r in used):
+                raise PackError('Finite smoke case budget or role already consumed')
+            authority=self.authority(key,row)
+            if self.binding(key,case)[2]!=digest:
+                raise PackError('Smoke binding changed during qualification')
+            record={'operationId':operation,'harness':self.harness,'planSHA256':SMOKE_PLAN,'planId':binding['planId'],
+                    'caseId':case,'key':key,'nativeIdentity':native_identity,'bindingHash':digest,'row':row,
+                    'bindingExpiresAt':binding['expiresAt'],'authority':authority,
+                    'dispatchExpiresAt':min(binding['expiresAt'],row['fixtureExpiresAt']) if case.startswith('stg-') else binding['expiresAt'],
+                    'state':'prepared','atUTC':datetime.datetime.now(datetime.timezone.utc).isoformat(),
+                    'nativeId':None,'hostedUsageVerified':False,'operationEffectVerified':False}
+            context={};prefix={}
+            for member in binding['roles']:
+                charter=pathlib.Path(member['cwd'])/('AGENTS.md' if self.harness=='codex' else 'CLAUDE.md');self.owned(charter)
+                for file in pathlib.Path(member['cwd']).rglob('*.md'):
+                    self.owned(file);context[str(file)]=hashlib.sha256(file.read_bytes()).hexdigest()
+            if self.harness=='codex':
+                runtime=pathlib.Path(self.lib.active()['runtime'])
+                files=[p for folder in ['sessions','archived_sessions'] for p in (runtime/'home'/folder).rglob('*.jsonl')]
+            else:
+                state=read_json(self.lib.root/'claude/state.json')
+                ids={r['nativeId'] for r in binding['roles']}
+                files=[pathlib.Path(a['transcript']) for a in state['agents'] if a.get('desktopSessionId') in ids]
+            for file in files:
+                self.owned(file);raw=file.read_bytes();prefix[str(file)]={'bytes':len(raw),'sha256':hashlib.sha256(raw).hexdigest()}
+            record.update(contextFiles=context,contextRoots=[r['cwd'] for r in binding['roles']],transcriptPrefixes=prefix)
+            atomic_json(path,record)
+            refs={k:row[k] for k in ['principalId','organizationId','instanceId','logicalId','agentId','agentVersionId',
+                'agentWorkspaceId','bytesWorkspaceId','contextMarkerId','contextMarkerHash','artifactMemoryId','artifactHash','fixtureExpiresAt']}
+            task=('Perform the explicit expiring STG test-memory/Bytes roundtrip only; test provenance is this operation marker. '
+                  if case=='stg-context-memory-bytes' else 'Read and acknowledge only the bound peer test-memory/Bytes references. '
+                  if case=='stg-peer-ack' else 'Read only your hosted role/context and the bound verification memory/Bytes artifact. ')
+            text=('Topolo finite native acceptance case '+case+'. Operation '+operation+'. '+task+
+                  'Use the published Topolo Agent and Bytes tools in '+row['environment']+' / '+row['contextKey']+
+                  ', for exactly '+key+'. Retrieve actual hosted context and the referenced Bytes content; local or CLI-proxy evidence is insufficient. '+
+                  'Exact references: '+canonical(refs).decode()+'. No business work, spawn, additional messages, permission changes or unrelated writes. '+
+                  'If any reference/tool is unavailable report the exact blocker. Return one concise JSON ACK with operationId, logicalId, agentVersionId, '+
+                  'contextMarkerHash, artifactHash and status; target at most 256 output tokens.')
+            return {'record':record,'text':text,'roster':[{k:r[k] for k in ['key','nativeId','cwd','title']} for r in binding['roles']]}
+        except BaseException:
+            lock.unlink();raise
+
+    def authority(self,key,row):
+        """Fresh public authority, with local consent re-read after blocking I/O."""
+        from . import topolo,permissions
+        pack=key.split('/')[0]
+        manifest,_=self.lib.load(pack);consent=permissions.load(self.lib,pack,manifest['agents'])
+        if not consent or consent.get('profile')!='full-access' or consent.get('contextKey')!=row['contextKey']:
+            raise PackError('Smoke needs the existing exact full-access consent')
+        original=canonical([manifest,consent])
+        client=topolo.Client(row['environment'],row['contextKey'])
+        if topolo.identity(client)!={'userId':row['principalId'],'organizationId':row['organizationId']}:
+            raise PackError('Fresh smoke principal differs')
+        ceiling,proof=topolo.organization_execution_policy(client,consent,manifest['agents'],row['agentWorkspaceId'])
+        permissions.authorize_native_scope(proof)
+        current,_=self.lib.load(pack)
+        if canonical([current,permissions.load(self.lib,pack,current['agents'])])!=original:
+            raise PackError('Smoke consent or manifest changed during authority qualification')
+        return {'localHash':hashlib.sha256(original).hexdigest(),'policyHash':hashlib.sha256(canonical([ceiling,proof])).hexdigest()}
+
+    def arm(self,operation,native_identity):
+        """Admit only the original prepared operation; never reset its budget."""
+        record=self.read(operation)
+        lock=self.root/'.reservation';self.owned(lock)
+        if (record['state']!='prepared' or record['nativeIdentity']!=native_identity or
+            read_json(lock)!={'operationId':operation,'harness':self.harness}):
+            raise PackError('Original prepared smoke reservation required; no replay')
+        binding,row,digest=self.binding(record['key'],record['caseId'])
+        if digest!=record['bindingHash'] or row!=record['row']:
+            raise PackError('Original smoke binding changed before dispatch')
+        if self.authority(record['key'],row)!=record['authority']:
+            raise PackError('Original smoke authority changed before dispatch')
+        # The public qualification can block. Re-read local binding/expiry,
+        # descriptors and original context after it, before the durable arm.
+        if self.binding(record['key'],record['caseId'])[2]!=record['bindingHash']:
+            raise PackError('Original smoke binding changed during final qualification')
+        self.verify(operation)
+        self.mark(operation,'start-may-have-effects')
+        return {'operationId':operation,'nativeIdentity':native_identity,'bindingHash':digest,
+                'expiresAt':record['dispatchExpiresAt'],'state':'start-may-have-effects'}
+
+    def mark(self,operation,state,**evidence):
+        record=self.read(operation)
+        allowed={'prepared':{'prepared','resume-may-have-effects','start-may-have-effects','preflight-refused'},
+                 'resume-may-have-effects':{'start-may-have-effects','uncertain'},
+                 'start-may-have-effects':{'native-delivered','native-refused','uncertain'},
+                 'native-delivered':{'completed','uncertain'}}
+        if state not in allowed.get(record['state'],set()):
+            raise PackError('Smoke phase cannot replay or regress')
+        if set(evidence)-{'nativeId','nativeStatus','ack','historyPreserved','historyCount','historyHash'} or len(canonical(evidence))>8192:
+            raise PackError('Bounded native smoke evidence required')
+        record.update(state=state,**evidence);atomic_json(self.path(operation),record)
+        if state in {'native-delivered','native-refused','preflight-refused'}:
+            lock=self.root/'.reservation';self.owned(lock)
+            if read_json(lock).get('operationId')!=operation:
+                raise PackError('Native smoke reservation custody differs')
+            lock.unlink()
+        return record
+
+    def verify(self,operation):
+        record=self.read(operation)
+        if {str(p) for root in record['contextRoots'] for p in pathlib.Path(root).rglob('*.md')}!=set(record['contextFiles']):
+            raise PackError('Native smoke context inventory changed')
+        for filename,digest in record['contextFiles'].items():
+            path=pathlib.Path(filename);self.owned(path)
+            if hashlib.sha256(path.read_bytes()).hexdigest()!=digest:
+                raise PackError('Native smoke context changed')
+        for filename,before in record['transcriptPrefixes'].items():
+            path=pathlib.Path(filename);self.owned(path)
+            with path.open('rb') as stream: prefix=stream.read(before['bytes'])
+            if hashlib.sha256(prefix).hexdigest()!=before['sha256']:
+                raise PackError('Native smoke original transcript prefix changed')
+        return {'contextPreserved':True,'originalTranscriptPrefixesPreserved':True}
+
 def permission_settings(agent, current, consent):
     from .policy import settings
     wanted=settings(agent,'codex',consent)['nativeSettings']
@@ -46,7 +275,7 @@ def request(lib,operation,params=None):
     record=read_json(lib.root/'live-bridge.json',{})
     if not record: raise PackError('This desktop profile has no live bridge. Open it through topolo-agent-pack first.')
     with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as connection:
-        connection.settimeout(3 if operation=='status' else 60 if operation in {'permissions-configure','owned-roster-read'} else 20)
+        connection.settimeout(3 if operation=='status' else 60 if operation in {'permissions-configure','owned-roster-read','smoke-start'} else 20)
         try: connection.connect(record['socket'])
         except OSError as exc: raise PackError('Managed live bridge is unavailable: '+str(exc)) from exc
         connection.sendall(canonical({'token':record['token'],'operation':operation,**({'params':params} if params is not None else {})})+b'\n')
@@ -85,6 +314,7 @@ class BackendProxy:
         self.permission_configuration=False
         self.permission_batch=None
         self._permission_configuration_inputs=None
+        self.smoke_busy=False
 
     async def start_child(self):
         active=self.lib.active()
@@ -152,6 +382,9 @@ class BackendProxy:
         if self.output_task: await self.output_task
 
     async def forward(self,value):
+        if self.smoke_busy and value.get('method') in {'thread/resume','turn/start'}:
+            sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,
+                'message':'Owned native smoke dispatch is being qualified'}})+b'\n');sys.stdout.buffer.flush();return
         if self.permission_configuration and value.get('method') in {'thread/resume','turn/start'}:
             sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,'message':'Owned permission configuration in progress'}})+b'\n')
             sys.stdout.buffer.flush();return
@@ -183,7 +416,7 @@ class BackendProxy:
             'params':{'includeHidden':True,**({'cursor':cursor} if cursor else {})}})+b'\n')
         await self.child.stdin.drain()
 
-    async def call_native(self,method,params):
+    async def call_native(self,method,params,before_dispatch=None):
         identity='topolo-relay-'+uuid.uuid4().hex
         request={'id':identity,'method':method,'params':params}
         if method in {'thread/resume','turn/start'}:
@@ -196,6 +429,7 @@ class BackendProxy:
                     raise PackError('No owned permission configuration snapshot; native settings were not sent')
                 self.configuration_current(*self._permission_configuration_inputs)
             request=self.execution.prepare(request)
+        if before_dispatch is not None: before_dispatch()
         future=asyncio.get_running_loop().create_future();self.native_calls[identity]=future;self.pending.add(identity)
         try:
             self.child.stdin.write(canonical(request)+b'\n');await self.child.stdin.drain()
@@ -207,6 +441,111 @@ class BackendProxy:
             raise PackError('Native intake relay refused; original request remains pending')
         return reply['result']
 
+    def smoke_current(self,roles,resuming=None):
+        if (not self.execution or self.permission_configuration or self.quiesced or not self.initialized or self.closed or
+            not self.child or self.child.returncode is not None or self.active_turns or self.pending or self.notifications or
+            (self.approvals and self.approvals.pending)):
+            raise PackError('Smoke requires an idle current configured native connection')
+        current=self.existing_runtime_intent()['roles']
+        effective=[{k:r.get(k) for k in original} for original in current for r in [self.execution.roles.get(original['threadId'],{})]]
+        if canonical(current)!=canonical(roles) or canonical(current)!=canonical(effective):
+            raise PackError('Smoke execution/source roster changed')
+        verified=set(self.execution.roles)
+        if resuming is not None:
+            if list(self.execution.pending.values())!=[resuming]:
+                raise PackError('Owned smoke resume custody differs')
+            verified.discard(resuming)
+        if self.execution.verified!=verified:
+            raise PackError('Smoke requires all owned native permission/settings ACKs on this connection')
+        for role in roles:
+            spec=role['settings']
+            if (spec['sandbox_mode']!='danger-full-access' or spec['approval_policy']!='never' or
+                not role.get('installationConsent') or spec['model_reasoning_effort'] not in self.execution.catalog.get(spec['model'],set())):
+                raise PackError('Smoke native full-access policy or catalog is not qualified')
+
+    async def owned_smoke(self,operation,params):
+        wanted={'operationId'} if operation=='smoke-read' else {'operationId','key','caseId'}
+        if operation not in {'smoke-start','smoke-read'} or set(params)!=wanted:
+            raise PackError('Only closed smoke start/read fields are supported')
+        store=OwnedSmoke(self.lib,'codex');op=store.operation_id(params['operationId'])
+        if operation=='smoke-read':
+            record=store.read(op)
+            if record['state']!='native-delivered': return self.smoke_result(record)
+            if self.smoke_busy or not self.execution or not self.child or self.quiesced:
+                raise PackError('Existing native smoke connection unavailable; no replay')
+            identity=hashlib.sha256(canonical([self.runtime,self.child.pid,self.protocol])).hexdigest()
+            if record['nativeIdentity']!=identity: return {**self.smoke_result(record),'connectionCurrent':False}
+            row=record['row'];role=self.execution.roles.get(row['nativeId'])
+            if not role or role['key']!=record['key'] or role['cwd']!=row['cwd']:
+                raise PackError('Native smoke read ownership differs')
+            native=await self.call_native('thread/read',{'threadId':row['nativeId'],'includeTurns':True})
+            thread=native['thread'];turns=thread.get('turns',[])
+            matches=[t for t in turns if t.get('id')==record['nativeId']]
+            if thread['id']!=row['nativeId'] or thread['cwd']!=row['cwd'] or len(matches)!=1:
+                raise PackError('Exact native smoke turn is unavailable')
+            turn=matches[0]
+            if turn.get('status') not in {'completed','failed','interrupted'}: return self.smoke_result(record)
+            prefix=turns[:record['historyCount']]
+            preserved=hashlib.sha256(canonical(prefix)).hexdigest()==record['historyHash']
+            texts=[i.get('text','') for i in turn.get('items',[]) if i.get('type')=='agentMessage']
+            ack=None
+            if texts and len(texts[-1])<=2048:
+                try: ack=json.loads(texts[-1])
+                except ValueError: pass
+            expected={'operationId':op,'logicalId':row['logicalId'],'agentVersionId':row['agentVersionId'],
+                'contextMarkerHash':row['contextMarkerHash'],'artifactHash':row['artifactHash']}
+            valid=(preserved and isinstance(ack,dict) and set(ack)==set(expected)|{'status'} and
+                all(ack[k]==v for k,v in expected.items()) and ack['status'] in {'ok','blocked'} and turn.get('status')=='completed')
+            store.verify(op)
+            if not valid:
+                record=store.mark(op,'uncertain',nativeStatus=turn.get('status'),historyPreserved=preserved)
+            else: record=store.mark(op,'completed',nativeStatus=turn.get('status'),ack=ack,historyPreserved=True)
+            return self.smoke_result(record)
+        if self.smoke_busy:
+            raise PackError('Native smoke dispatch already reserved')
+        self.smoke_busy=True;prepared=False
+        try:
+            roles=self.existing_runtime_intent()['roles'];self.smoke_current(roles)
+            self.execution.set_catalog(await self.read_catalog());self.smoke_current(roles)
+            binding,row,_=store.binding(params['key'],params['caseId'])
+            if {(r['key'],r['nativeId'],r['cwd']) for r in binding['roles']}!={(r['key'],r['threadId'],r['cwd']) for r in roles}:
+                raise PackError('Smoke binding must cover the complete existing roster')
+            identity=hashlib.sha256(canonical([self.runtime,self.child.pid,self.protocol])).hexdigest()
+            plan=await asyncio.to_thread(store.prepare,params['key'],params['caseId'],op,identity);prepared=True
+            self.smoke_current(roles)
+            native=await self.call_native('thread/read',{'threadId':row['nativeId'],'includeTurns':True})
+            thread=native['thread'];history=thread.get('turns',[])
+            if (thread.get('id')!=row['nativeId'] or thread.get('cwd')!=row['cwd'] or thread.get('name')!=row['title'] or
+                thread.get('status',{}).get('type') not in {'idle','notLoaded'} or not isinstance(history,list)):
+                raise PackError('Native smoke descriptor is not the exact idle role')
+            record=store.read(op);record.update(historyCount=len(history),historyHash=hashlib.sha256(canonical(history)).hexdigest())
+            atomic_json(store.path(op),record)
+            def guard(resuming=None):
+                self.smoke_current(roles,resuming)
+                store.verify(op)
+                if store.binding(params['key'],params['caseId'])[2]!=record['bindingHash']:
+                    raise PackError('Smoke binding changed before native dispatch')
+            guard();store.mark(op,'resume-may-have-effects')
+            await self.call_native('thread/resume',{'threadId':row['nativeId']},before_dispatch=lambda:guard(row['nativeId']))
+            guard();store.mark(op,'start-may-have-effects')
+            result=await self.call_native('turn/start',{'threadId':row['nativeId'],
+                'input':[{'type':'text','text':plan['text'],'text_elements':[]}]},before_dispatch=guard)
+            turn=result.get('turn',{})
+            if not isinstance(turn.get('id'),str) or not turn['id']:
+                raise PackError('Native smoke turn identity missing')
+            return self.smoke_result(store.mark(op,'native-delivered',nativeId=turn['id']))
+        except BaseException:
+            if prepared:
+                phase=store.read(op)['state']
+                store.mark(op,'preflight-refused' if phase=='prepared' else 'uncertain')
+            raise
+        finally:self.smoke_busy=False
+
+    @staticmethod
+    def smoke_result(record):
+        return {k:record[k] for k in ['operationId','harness','caseId','key','state','nativeId',
+            'hostedUsageVerified','operationEffectVerified', 'nativeStatus','historyPreserved','ack'] if k in record}
+
     async def qualify_organization(self,thread_id):
         role=self.execution.roles.get(thread_id) if self.execution else None
         if role and not self.permission_configuration and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
@@ -473,6 +812,8 @@ class BackendProxy:
                 if self.quiesced: raise PackError('Use the desktop reconnect action to resume a quiesced bridge')
             elif op=='owned-roster-read':
                 result=await self.owned_roster_read(message.get('params') or {})
+            elif op in {'smoke-start','smoke-read'}:
+                result=await self.owned_smoke(op,message.get('params') or {})
             elif op=='permissions-configure':
                 result=await self.configure_permissions((message.get('params') or {})['pack'])
             elif op in {'approval-list','approval-details','approval-respond'}:
@@ -498,7 +839,7 @@ class BackendProxy:
                         self.child.stdin.write(canonical(reply)+b'\n');await self.child.stdin.drain();self.approvals.settled(reply)
                         result={'state':'native-response-forwarded','operationEffectVerified':False}
             elif op!='status': raise PackError('Unknown live bridge operation')
-            if op not in {'approval-list','approval-details','approval-respond','permissions-configure','owned-roster-read'}:result=self.status()
+            if op not in {'approval-list','approval-details','approval-respond','permissions-configure','owned-roster-read','smoke-start','smoke-read'}:result=self.status()
         except Exception as exc: result={'error':str(exc)}
         writer.write(canonical(result)+b'\n');await writer.drain();writer.close();await writer.wait_closed()
 

package/dist/{claude-pack-backend-AWCWJJA5.js → claude-pack-backend-3YJNKMYD.js}

@@ -270,7 +270,8 @@ async function nativeClaudeApprovalControl(manager, descriptor, token, net, fs,
         if (Object.keys(request).sort().join(",") !== "identity,operation,pid,token" || request.token !== token || request.pid !== descriptor.pid || request.identity !== descriptor.identity)
           throw new Error("Native approval control authentication or process identity differs.");
         const op = request.operation;
-        if (!op || !["list", "details", "respond"].includes(op.kind) || Object.keys(op).some((k) => !["kind", "key", "intake", "fingerprint", "decision", "humanDecisionRecorded"].includes(k)))
+        const fields = op?.kind === "smoke-start" ? ["kind", "key", "caseId", "operationId"] : op?.kind === "smoke-read" ? ["kind", "operationId"] : ["kind", "key", "intake", "fingerprint", "decision", "humanDecisionRecorded"];
+        if (!op || !["list", "details", "respond", "smoke-start", "smoke-read"].includes(op.kind) || Object.keys(op).some((k) => !fields.includes(k)))
           throw new Error("Unsupported native control operation.");
         const result = await invoke(op);
         const reply = JSON.stringify({ result }) + "\n";
@@ -315,6 +316,136 @@ async function nativeClaudeApprovalControl(manager, descriptor, token, net, fs,
   manager[key] = control;
   return { state: "native-approval-control-installed", ...descriptor };
 }
+async function nativeClaudeOwnedSmokeOperation(manager, members, operation, helper, fingerprint, nativeIdentity, qualifyNative = () => {
+}) {
+  const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+  const fields = operation?.kind === "smoke-start" ? ["kind", "key", "caseId", "operationId"] : ["kind", "operationId"];
+  if (!operation || !["smoke-start", "smoke-read"].includes(operation.kind) || Object.keys(operation).sort().join() !== fields.sort().join() || !uuid.test(operation.operationId) || operation.kind === "smoke-start" && (!/^[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+$/.test(operation.key) || !["stg-context-memory-bytes", "stg-peer-ack", "prod-role-context-ack"].includes(operation.caseId)))
+    throw new Error("Exact closed native smoke operation required.");
+  if (!members.length || members.length > 70 || new Set(members.map((m) => m.key)).size !== members.length || new Set(members.map((m) => m.sessionId)).size !== members.length) throw new Error("Unique native smoke roster required.");
+  const owner = /* @__PURE__ */ Symbol.for("topolo.agent-pack.owned-smoke.v1");
+  const rosterIdentity = fingerprint(members);
+  const summary = (record) => Object.fromEntries([
+    "operationId",
+    "harness",
+    "caseId",
+    "key",
+    "state",
+    "nativeId",
+    "hostedUsageVerified",
+    "operationEffectVerified",
+    "nativeStatus",
+    "historyPreserved",
+    "ack"
+  ].filter((k) => k in record).map((k) => [k, record[k]]));
+  const check = (member2, session) => {
+    if (!session || session.sessionId !== member2.sessionId || session.cwd !== member2.cwd || session.title !== member2.title || session.isArchived || session.backend?.kind !== "local" || session.backend.remoteTarget || session.worktreePath || session.worktreeLazy || session.spawnedFrom || session.isRunning || session.starting || session.pendingToolPermissions?.length || manager.hasLosableWork(member2.sessionId) || session.model !== member2.model || session.effort !== member2.effort || session.permissionMode !== member2.permissionMode || member2.permissionMode !== "bypassPermissions" || !member2.permissionConsent || !manager.getAvailableCodeModels().includes(member2.model)) throw new Error("Exact idle native smoke ownership/settings unavailable.");
+  };
+  const current = () => {
+    qualifyNative();
+    if (manager[/* @__PURE__ */ Symbol.for("topolo.agent-pack.native-operation.v1")] || fingerprint(members) !== rosterIdentity)
+      throw new Error("Unresolved native configuration or changed smoke roster remains.");
+    for (const member2 of members) check(member2, manager.getSession(member2.sessionId));
+  };
+  const ready = async () => {
+    current();
+    for (const member2 of members) {
+      const descriptor = await manager.getSessionWhenLoaded(member2.sessionId, "topolo-owned-smoke", { warnOnMiss: false });
+      check(member2, descriptor);
+      check(member2, manager.getSession(member2.sessionId));
+    }
+    current();
+  };
+  if (operation.kind === "smoke-read") {
+    const record = await helper("read", { operation: operation.operationId });
+    if (record.state !== "native-delivered") return summary(record);
+    if (record.nativeIdentity !== nativeIdentity) return { ...summary(record), connectionCurrent: false };
+    const member2 = members.find((m) => m.key === record.key && m.sessionId === record.row.nativeId && m.cwd === record.row.cwd);
+    if (!member2) throw new Error("Native smoke read custody differs.");
+    const session = await manager.getSession(member2.sessionId);
+    if (session?.isRunning || session?.starting || manager[owner]) return summary(record);
+    check(member2, session);
+    const history = await manager.getTranscript(member2.sessionId);
+    if (!Array.isArray(history)) throw new Error("Qualified native smoke transcript API unavailable.");
+    const same = fingerprint(history.slice(0, record.historyCount)) === record.historyHash;
+    const markers = history.map((m, index) => m.uuid === record.operationId ? index : -1).filter((i) => i >= 0);
+    const marker = markers[0] ?? -1;
+    const user = markers.length === 1 && marker === record.historyCount && history[marker]?.type === "user" ? marker : -1;
+    const nextUser = history.findIndex((m, index) => index > user && m.type === "user");
+    const assistants = user < 0 ? [] : history.slice(user + 1, nextUser < 0 ? history.length : nextUser).filter((m) => m.type === "assistant");
+    const text = assistants.at(-1)?.message?.content?.filter((b) => b.type === "text").map((b) => b.text).join("");
+    let ack;
+    if (typeof text === "string" && text.length <= 2048) {
+      try {
+        ack = JSON.parse(text);
+      } catch {
+      }
+    }
+    const expected = {
+      operationId: record.operationId,
+      logicalId: record.row.logicalId,
+      agentVersionId: record.row.agentVersionId,
+      contextMarkerHash: record.row.contextMarkerHash,
+      artifactHash: record.row.artifactHash
+    };
+    const valid = same && Number.isSafeInteger(record.historyCount) && record.historyCount >= 0 && ack && typeof ack === "object" && !Array.isArray(ack) && Object.keys(ack).sort().join() === [...Object.keys(expected), "status"].sort().join() && Object.entries(expected).every(([k, v]) => ack[k] === v) && ["ok", "blocked"].includes(ack.status);
+    await helper("verify", { operation: operation.operationId });
+    return summary(await helper("mark", {
+      operation: operation.operationId,
+      state: "uncertain",
+      nativeStatus: "terminal-evidence-unavailable",
+      historyPreserved: same,
+      ...valid ? { ack } : {}
+    }));
+  }
+  if (manager[owner]) throw new Error("Native smoke dispatch already reserved.");
+  const member = members.find((m) => m.key === operation.key);
+  if (!member) throw new Error("Smoke role is not natively owned.");
+  manager[owner] = operation.operationId;
+  let prepared = false;
+  try {
+    await ready();
+    const plan = await helper("prepare", {
+      key: operation.key,
+      case: operation.caseId,
+      operation: operation.operationId,
+      native_identity: nativeIdentity
+    });
+    prepared = true;
+    const actual = plan.roster.map((r) => [r.key, r.nativeId, r.cwd, r.title]).sort();
+    const wanted = members.map((m) => [m.key, m.sessionId, m.cwd, m.title]).sort();
+    if (JSON.stringify(actual) !== JSON.stringify(wanted)) throw new Error("Smoke binding must match the complete owned native roster.");
+    await ready();
+    await helper("verify", { operation: operation.operationId });
+    const history = await manager.getTranscript(member.sessionId);
+    if (!Array.isArray(history)) throw new Error("Qualified native smoke transcript API unavailable.");
+    await helper("mark", { operation: operation.operationId, state: "prepared", historyCount: history.length, historyHash: fingerprint(history) });
+    await ready();
+    const admission = await helper("arm", { operation: operation.operationId, native_identity: nativeIdentity });
+    current();
+    if (admission.operationId !== operation.operationId || admission.nativeIdentity !== nativeIdentity || admission.state !== "start-may-have-effects" || admission.bindingHash !== plan.record.bindingHash || !/^[a-f0-9]{64}$/.test(admission.bindingHash) || !Number.isFinite(admission.expiresAt) || admission.expiresAt !== plan.record.dispatchExpiresAt || Date.now() >= admission.expiresAt * 1e3)
+      throw new Error("Original smoke final dispatch admission expired or differs.");
+    const ack = await manager.sendMessage(
+      member.sessionId,
+      plan.text,
+      void 0,
+      { messageUuid: operation.operationId, initiator: "agent", origin: { kind: "task-notification" } }
+    );
+    return summary(await helper("mark", {
+      operation: operation.operationId,
+      state: ack?.delivered === true ? "native-delivered" : ack?.delivered === false ? "native-refused" : "uncertain",
+      nativeId: operation.operationId
+    }));
+  } catch (error) {
+    if (prepared) {
+      const record = await helper("read", { operation: operation.operationId });
+      await helper("mark", { operation: operation.operationId, state: record.state === "prepared" ? "preflight-refused" : "uncertain" });
+    }
+    throw error;
+  } finally {
+    delete manager[owner];
+  }
+}
 async function nativeClaudeApprovalOperation(manager, routes, operation, fingerprint, checkpoint, history = []) {
   const symbol = /* @__PURE__ */ Symbol.for("topolo.agent-pack.approvals.v1");
   if (!routes.length || routes.length > 100 || new Set(routes.map((r) => r.sessionId)).size !== routes.length || new Set(routes.map((r) => r.key)).size !== routes.length) throw new Error("Unique owned approval roster required.");
@@ -496,13 +627,13 @@ async function nativeClaudeApprovalOperation(manager, routes, operation, fingerp
 
 // src/lib/claude-pack-backend.ts
 var CLAUDE_NATIVE_QUALIFIER = {
-  version: "2.31226.1",
-  manager: "index.chunk-BCHP6ll9.js",
-  sidebar: "index.chunk-4-bSRKfE.js",
+  version: "2.37337.1",
+  manager: "index.chunk-BolytlRP.js",
+  sidebar: "index.chunk-BoQoqlAs.js",
   hashes: {
-    "index.chunk-BCHP6ll9.js": "ec7c7cda3dd597a3cce034cc6eaea52e6e2b10d1b24f0eb9aee3964638afadf2",
-    "index.chunk-4-bSRKfE.js": "594213a92b61bb64a3d61695d2370b624981af91f359c18832debb42a7814d86",
-    "index.chunk-Cyt2WTko.js": "29738ec09f4bf44d511caae628b0f786e35956848e6a18c3159c9928d6ac1ad9"
+    "index.chunk-BolytlRP.js": "e387edfb06a34a59d99b54c04365f6e32d0108e8710124b4d1a628eea726d030",
+    "index.chunk-BoQoqlAs.js": "5c07a7e836d98dcd6afcfc2a62619e71d173a136ecb9af847716ea377b58b1df",
+    "index.chunk-BWk6pVUt.js": "f7d74e113f34761a675816fe2abf65b3ddc190327ee7623d9c822f7b59cceaca"
   }
 };
 function validateInspectorEndpoint(endpoint) {
@@ -615,6 +746,7 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
     contextInventories,
     approvalRoutes,
     installationConsent: policy.installationConsent,
+    libraryRoot: root,
     sourceRevision: policy.sourceRevision,
     mode,
     activeBefore: active
@@ -630,6 +762,9 @@ function qualifyPermissionConsent(policy, key, records, full) {
 function nativePackExpression(pid, plan, journal, apply) {
   if (!Number.isSafeInteger(pid) || pid < 1) throw new Error("Explicit Claude main-process PID required.");
   const qualifier = CLAUDE_NATIVE_QUALIFIER;
+  const here = dirname(fileURLToPath(import.meta.url));
+  const smokeSource = [resolve(here, "../../agent-packs/src"), resolve(here, "../agent-packs/src")].find(existsSync);
+  if (!smokeSource) throw new Error("Bundled owned smoke source unavailable.");
   return `(async () => {
     const expected = ${JSON.stringify({ pid, qualifier, journal, apply })};
     if (process.pid !== expected.pid || typeof process.getBuiltinModule !== 'function') throw new Error('Claude process identity or Node runtime differs.');
@@ -659,14 +794,24 @@ function nativePackExpression(pid, plan, journal, apply) {
           throw new Error('Context or transcript changed during configuration: ' + file);
     };
     const result = await (${nativeClaudePackOperation.toString()})(manager,
-      value => transport.U(value, transport.V),
+      value => transport.P(value, transport.M),
       { members: ${JSON.stringify(plan.members)}, outgoing: ${JSON.stringify(plan.outgoing)},
         operationId: ${JSON.stringify(plan.operationId)}, mode: ${JSON.stringify(plan.recovery ? "recover" : plan.mode)},
         noEffects: ${JSON.stringify(plan.noEffects)},
         deadline: Date.now() + 45000 }, expected.apply, checkpoint, verifyContext);
     ${plan.approvalRoutes.length ? `const routes = ${JSON.stringify(plan.approvalRoutes)};
       const fingerprint = value => crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex');
-      const invoke = op => (${nativeClaudeApprovalOperation.toString()})(manager, routes, op, fingerprint,
+        const qualifyNative = () => {
+          if (process.pid !== expected.pid || load('electron').app.getVersion() !== expected.qualifier.version) throw new Error('Native process changed.');
+          for (const [file, hash] of Object.entries(expected.qualifier.hashes))
+            if (crypto.createHash('sha256').update(fs.readFileSync(base + file)).digest('hex') !== hash) throw new Error('Native module changed.');
+        };
+       const smokeIdentity = fingerprint({pid: expected.pid, qualifier: expected.qualifier, routes});
+       const invoke = op => ['smoke-start', 'smoke-read'].includes(op.kind) ?
+         (${nativeClaudeOwnedSmokeOperation.toString()})(manager, ${JSON.stringify(plan.members)}, op,
+           (action, payload) => (${runClaudeSmokeHelper.toString()})(${JSON.stringify(plan.libraryRoot)}, action, payload,
+             ${JSON.stringify(realpathSync(smokeSource))}, load('node:child_process').spawn), fingerprint, smokeIdentity, qualifyNative) :
+         (${nativeClaudeApprovalOperation.toString()})(manager, routes, op, fingerprint,
         row => checkpoint({kind: 'approval', ...row}),
         fs.readFileSync(expected.journal, 'utf8').split('\\n').filter(Boolean).map(line => JSON.parse(line)));
       if (expected.apply) {
@@ -676,11 +821,6 @@ function nativePackExpression(pid, plan, journal, apply) {
         const stat = fs.lstatSync(control.secretPath);
         if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 63)) throw new Error('Unowned native control secret.');
         const secret = JSON.parse(fs.readFileSync(control.secretPath, 'utf8'));
-        const qualifyNative = () => {
-          if (process.pid !== expected.pid || load('electron').app.getVersion() !== expected.qualifier.version) throw new Error('Native process changed.');
-          for (const [file, hash] of Object.entries(expected.qualifier.hashes))
-            if (crypto.createHash('sha256').update(fs.readFileSync(base + file)).digest('hex') !== hash) throw new Error('Native module changed.');
-        };
         result.approvalRouting.control = await (${nativeClaudeApprovalControl.toString()})(manager,
           {socket: control.socket, pid: expected.pid, identity: fingerprint(routes)}, secret.token,
           load('node:net'), fs, invoke, qualifyNative, checkpoint);
@@ -935,6 +1075,47 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
     await release();
   }
 }
+function runClaudeSmokeHelper(root, action, payload, source, launch = spawn) {
+  if (!["prepare", "arm", "mark", "read", "verify"].includes(action) || typeof root !== "string" || typeof source !== "string")
+    return Promise.reject(new Error("Closed owned smoke helper required."));
+  const script = 'import sys,json\nsys.path.insert(0,sys.argv[3])\nfrom topolo_agent_pack.storage import Library\nfrom topolo_agent_pack.live import OwnedSmoke\ns=OwnedSmoke(Library(sys.argv[1]),"claude")\np=json.loads(sys.stdin.read(16384))\na=sys.argv[2]\nr=s.prepare(**p) if a=="prepare" else s.arm(**p) if a=="arm" else s.mark(**p) if a=="mark" else s.verify(p["operation"]) if a=="verify" else s.read(p["operation"])\nprint(json.dumps(r))';
+  return new Promise((done, fail) => {
+    const child = launch("python3", ["-I", "-B", "-c", script, root, action, source], { stdio: ["pipe", "pipe", "pipe"] });
+    let output = "";
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      error ? fail(error) : done(value);
+    };
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      finish(new Error("Owned smoke helper timed out; reconcile without replay."));
+    }, 6e4);
+    child.stdout.setEncoding("utf8");
+    child.stderr.resume();
+    child.stdout.on("data", (data) => {
+      output += data;
+      if (Buffer.byteLength(output) > 1048576) {
+        child.kill("SIGTERM");
+        finish(new Error("Owned smoke evidence exceeds bounded transport."));
+      }
+    });
+    child.on("error", () => finish(new Error("Bundled owned smoke helper unavailable.")));
+    child.on("close", (code) => {
+      if (settled) return;
+      if (code !== 0) return finish(new Error("Owned smoke qualification refused; preserve its journal."));
+      try {
+        finish(void 0, JSON.parse(output));
+      } catch {
+        finish(new Error("Invalid owned smoke helper result."));
+      }
+    });
+    child.stdin.on("error", () => finish(new Error("Owned smoke helper input failed; reconcile without replay.")));
+    child.stdin.end(JSON.stringify(payload));
+  });
+}
 function requestClaudeApprovalControl(connection, operation, token, connect = createConnection) {
   const parent = lstatSync(dirname(connection.socket));
   const socket = lstatSync(connection.socket);
@@ -951,7 +1132,7 @@ function requestClaudeApprovalControl(connection, operation, token, connect = cr
       error ? fail(error) : done(result);
     };
     client.setEncoding("utf8");
-    client.setTimeout(1e4, () => finish(new Error("Native approval response timed out; reconcile without replay.")));
+    client.setTimeout(operation.kind === "smoke-start" ? 6e4 : 1e4, () => finish(new Error("Native approval response timed out; reconcile without replay.")));
     client.on("connect", () => client.write(JSON.stringify({ token, pid: connection.pid, identity: connection.identity, operation }) + "\n"));
     client.on("data", (chunk) => {
       reply += chunk;
@@ -985,6 +1166,15 @@ async function operateClaudeApprovals(options, request = requestClaudeApprovalCo
   if (!secretPath.startsWith(realpathSync(privateDirectory) + sep) || !stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63) throw new Error("Unowned native control secret.");
   const secret = JSON.parse(readFileSync(secretPath, "utf8"));
   if (!/^[a-f0-9]{64}$/.test(secret.token) || !/^[a-f0-9]{64}$/.test(connection.identity)) throw new Error("Native control identity is invalid.");
+  if (options.kind === "smoke-start" || options.kind === "smoke-read") return request(
+    connection,
+    {
+      kind: options.kind,
+      operationId: options.operationId,
+      ...options.kind === "smoke-start" ? { key: options.key, caseId: options.caseId } : {}
+    },
+    secret.token
+  );
   return request(connection, {
     kind: options.kind,
     key: options.key,
@@ -994,6 +1184,12 @@ async function operateClaudeApprovals(options, request = requestClaudeApprovalCo
     humanDecisionRecorded: options.humanDecisionRecorded
   }, secret.token);
 }
+async function operateClaudeSmoke(options, request = requestClaudeApprovalControl) {
+  const fields = options.kind === "smoke-start" ? ["store", "kind", "operationId", "key", "caseId"] : ["store", "kind", "operationId"];
+  if (!["smoke-start", "smoke-read"].includes(options.kind) || Object.keys(options).some((k) => !fields.includes(k)) || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(options.operationId) || options.kind === "smoke-start" && (!/^[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+$/.test(options.key ?? "") || !["stg-context-memory-bytes", "stg-peer-ack", "prod-role-context-ack"].includes(options.caseId ?? "")))
+    throw new Error("Exact closed native smoke fields required.");
+  return operateClaudeApprovals(options, request);
+}
 export {
   CLAUDE_NATIVE_QUALIFIER,
   configureClaudePack,
@@ -1001,8 +1197,10 @@ export {
   lockClaudeLibrary,
   nativePackExpression,
   operateClaudeApprovals,
+  operateClaudeSmoke,
   prepareClaudeNativePlan,
   requestClaudeApprovalControl,
+  runClaudeSmokeHelper,
   snapshotClaudeMarkdown,
   validateInspectorEndpoint,
   verifyClaudeOrganizationPolicy

package/dist/index.js

@@ -8,9 +8,43 @@ import { fileURLToPath } from "url";
 import { homedir } from "os";
 function registerAgentPacksCommand(program2) {
   const packs = program2.command("agent-packs").description("Install and operate Topolo Agent Packs in supported local hosts").option("--store <path>", "Portable pack library (default ~/AgentPacks)");
+  packs.command("smoke").description("Start or read one closed, bound native acceptance case").argument("<operation>", "start or read").argument("<identity>", "Owned role key for start, existing operation UUID for read").option("--case <id>", "Finite compiled acceptance case").option("--operation-id <id>", "Unique native operation UUID for start").option("--harness <name>", "codex or claude", "codex").allowExcessArguments(false).action(async (operation, identity, options) => {
+    const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+    if (!["start", "read"].includes(operation) || !["codex", "claude"].includes(options.harness) || (operation === "start" ? !/^[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+$/.test(identity) || !["stg-context-memory-bytes", "stg-peer-ack", "prod-role-context-ack"].includes(options.case ?? "") || !uuid.test(options.operationId ?? "") : !uuid.test(identity) || options.case !== void 0 || options.operationId !== void 0))
+      throw new Error("Exact closed smoke operation, role/case and UUID required.");
+    const store = packs.opts().store ?? resolve(homedir(), "AgentPacks");
+    if (options.harness === "claude") {
+      const { operateClaudeSmoke } = await import("./claude-pack-backend-3YJNKMYD.js");
+      console.log(JSON.stringify(await operateClaudeSmoke({
+        store,
+        kind: "smoke-" + operation,
+        operationId: operation === "start" ? options.operationId : identity,
+        ...operation === "start" ? { key: identity, caseId: options.case } : {}
+      }), null, 2));
+      return;
+    }
+    const here = dirname(fileURLToPath(import.meta.url));
+    const adapter = [resolve(here, "../agent-packs/topolo-agent-pack"), resolve(here, "../../agent-packs/topolo-agent-pack")].find(existsSync);
+    if (!adapter) throw new Error("Installed bundled pack adapter unavailable.");
+    const result = spawnSync(
+      "python3",
+      [
+        adapter,
+        "--store",
+        store,
+        "smoke",
+        operation,
+        identity,
+        ...operation === "start" ? ["--case", options.case, "--operation-id", options.operationId] : []
+      ],
+      { stdio: "inherit", env: { ...process.env, PYTHONDONTWRITEBYTECODE: "1", TOPOLO_AGENT_PACK_PUBLIC_CLI: "1" } }
+    );
+    if (result.error) throw new Error("Python 3.11 or later is required for local packs.");
+    if (result.status !== 0) process.exitCode = result.status ?? 2;
+  });
   packs.command("configure").description("Qualify and configure an adopted Claude roster through its live native backend").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
     if (options.harness !== "claude") throw new Error("Native configure is currently qualified only for Claude Desktop.");
-    const { configureClaudePack } = await import("./claude-pack-backend-AWCWJJA5.js");
+    const { configureClaudePack } = await import("./claude-pack-backend-3YJNKMYD.js");
     const result = await configureClaudePack({
       store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
       pack,
@@ -62,7 +96,7 @@ function registerAgentPacksCommand(program2) {
             throw new Error("Only a one-request once/deny response is supported.");
           decision = response.decision;
         }
-        const { operateClaudeApprovals } = await import("./claude-pack-backend-AWCWJJA5.js");
+        const { operateClaudeApprovals } = await import("./claude-pack-backend-3YJNKMYD.js");
         console.log(JSON.stringify(await operateClaudeApprovals({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           kind: args[0],
@@ -77,7 +111,7 @@ function registerAgentPacksCommand(program2) {
       if (options.policy || options.endpoint || options.pid || options.apply) {
         if (options.harness !== "claude" || !options.policy || !options.endpoint || !options.pid || args.length !== 1)
           throw new Error("Native switch/recovery requires one Claude pack, --policy, --endpoint and --pid.");
-        const { configureClaudePack } = await import("./claude-pack-backend-AWCWJJA5.js");
+        const { configureClaudePack } = await import("./claude-pack-backend-3YJNKMYD.js");
         const result2 = await configureClaudePack({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           pack: args[0],
@@ -124,7 +158,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.23.19/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.23.20/node_modules/@topolo/sdk/dist/index.js
 function record(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -3734,10 +3768,11 @@ async function pollUntilApproved(params) {
   throw new Error("Device code expired. Run `topolo auth login` again.");
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.23.19/node_modules/@topolo/sdk/dist/node/credential-store.js
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2, rename as rename2, link } from "fs/promises";
+// node_modules/.pnpm/@topolo+sdk@0.23.20/node_modules/@topolo/sdk/dist/node/credential-store.js
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, lstat, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync2, mkdirSync, lstatSync, readdirSync, readFileSync as readFileSync2, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync, rmdirSync, linkSync } from "fs";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { constants, fstatSync, readSync } from "fs";
 import { homedir as homedir2, platform } from "os";
 import { dirname as dirname2, join as join3 } from "path";
 import { createHash, randomUUID } from "crypto";
@@ -4603,6 +4638,7 @@ async function resolveCredential(environment = selectedEnvironment()) {
 var REFRESH_SKEW_SECONDS = 60;
 var CONFIG_LOCK_RETRY_MS = 25;
 var CONFIG_LOCK_TIMEOUT_MS = 5e3;
+var CONFIG_LOCK_DEAD_OWNER_MIN_AGE_MS = 2e3;
 var ConfigOwnershipError = class extends TopoloSdkError2 {
   constructor() {
     super("state_conflict", "Credential configuration ownership cannot be verified. Retain the unresolved operation instead of starting another renewal.");
@@ -4617,32 +4653,145 @@ function lockEntryExists(path) {
     throw new ConfigOwnershipError();
   }
 }
+function lockIdentity(entry) {
+  return [entry.dev, entry.ino, entry.uid, entry.mode, entry.nlink, entry.size, entry.mtimeMs, entry.ctimeMs];
+}
+function privateLockDirectory(path) {
+  const entry = lstatSync(path);
+  if (typeof process.getuid !== "function" || !entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== process.getuid() || (entry.mode & 511) !== 448) throw new ConfigOwnershipError();
+  return entry;
+}
+function readPrivateLockMarker(path) {
+  const before = lstatSync(path);
+  if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size > 512 || before.uid !== process.getuid?.() || (before.mode & 511) !== 384) throw new ConfigOwnershipError();
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    if (JSON.stringify(lockIdentity(fstatSync(fd))) !== JSON.stringify(lockIdentity(before))) throw new ConfigOwnershipError();
+    const bytes = Buffer.alloc(513);
+    const count = readSync(fd, bytes, 0, bytes.length, 0);
+    if (count !== before.size || count > 512 || JSON.stringify(lockIdentity(fstatSync(fd))) !== JSON.stringify(lockIdentity(before)) || JSON.stringify(lockIdentity(lstatSync(path))) !== JSON.stringify(lockIdentity(before))) throw new ConfigOwnershipError();
+    return bytes.subarray(0, count).toString("utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+var OWNER_MARKER_NAME = /^owner-[a-f0-9-]{36}\.json$/;
+function readOwnerMarker(lockPath, name) {
+  const bytes = readPrivateLockMarker(join3(lockPath, name));
+  const owner = JSON.parse(bytes);
+  if (owner.version !== 1 || Object.keys(owner).sort().join(",") !== "identity,pid,version" || name !== "owner-" + owner.identity + ".json" || !Number.isSafeInteger(owner.pid) || owner.pid <= 0) throw new ConfigOwnershipError();
+  return { bytes, pid: owner.pid };
+}
+function writePrivateLockRecord(path, bytes) {
+  const fd = openSync(path, "wx", 384);
+  try {
+    writeFileSync(fd, bytes);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function deadOwnerMarker(lockPath, ignoreOwnFence = false) {
+  try {
+    if (!ignoreOwnFence && lockEntryExists(lockPath + ".reconcile")) return null;
+    const directory = privateLockDirectory(lockPath);
+    const entries = readdirSync(lockPath);
+    if (entries.length !== 1 || !OWNER_MARKER_NAME.test(entries[0])) return null;
+    const name = entries[0];
+    const { bytes, pid } = readOwnerMarker(lockPath, name);
+    if (Date.now() - lstatSync(join3(lockPath, name)).mtimeMs < CONFIG_LOCK_DEAD_OWNER_MIN_AGE_MS) return null;
+    try {
+      process.kill(pid, 0);
+      return null;
+    } catch (error) {
+      if (error.code !== "ESRCH") return null;
+    }
+    return { directory, name, bytes, pid };
+  } catch {
+    return null;
+  }
+}
+function reclaimDeadOwnerLock(lockPath, markerName, marker) {
+  const observed = deadOwnerMarker(lockPath);
+  if (!observed) return false;
+  const fence = lockPath + ".reconcile";
+  try {
+    mkdirSync(fence, { mode: 448 });
+  } catch {
+    return false;
+  }
+  const fenceMarker = join3(fence, markerName);
+  const quarantine = join3(dirname2(lockPath), ".credential-reclaim-" + randomUUID2());
+  let captured;
+  let reclaimed = false;
+  try {
+    writePrivateLockRecord(fenceMarker, marker);
+    const current = deadOwnerMarker(lockPath, true);
+    if (!current || current.name !== observed.name || current.bytes !== observed.bytes || current.directory.dev !== observed.directory.dev || current.directory.ino !== observed.directory.ino) return false;
+    mkdirSync(quarantine, { mode: 448 });
+    writePrivateLockRecord(join3(quarantine, "receipt.json"), JSON.stringify({
+      schemaVersion: 1,
+      disposition: "DEAD_OWNER_RECLAIMED",
+      lockPath,
+      deadOwnerMarker: current.name,
+      deadOwnerPid: current.pid,
+      deadOwnerEvidence: "ESRCH",
+      reclaimedByPid: process.pid,
+      reclaimedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      configCredentialOrOAuthEffectsByThisReclaim: "none"
+    }, null, 2));
+    captured = join3(quarantine, current.name);
+    renameSync(join3(lockPath, current.name), captured);
+    const directory = privateLockDirectory(lockPath);
+    if (directory.dev !== observed.directory.dev || directory.ino !== observed.directory.ino || readdirSync(lockPath).length) throw new ConfigOwnershipError();
+    writePrivateLockRecord(join3(lockPath, markerName), marker);
+    reclaimed = true;
+  } catch {
+    if (captured && !reclaimed) {
+      try {
+        linkSync(captured, join3(lockPath, observed.name));
+      } catch {
+      }
+    }
+  } finally {
+    try {
+      if (readPrivateLockMarker(fenceMarker) !== marker || readdirSync(fence).length !== 1) throw new ConfigOwnershipError();
+      unlinkSync(fenceMarker);
+      rmdirSync(fence);
+    } catch {
+      reclaimed = false;
+    }
+  }
+  return reclaimed;
+}
+var RELEASE_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 async function withConfigWriteLock(operation) {
   const lockPath = `${configPath()}.lock`;
   await mkdir2(dirname2(lockPath), { recursive: true });
   const startedAt = performance.now();
+  const identity = randomUUID2();
+  const markerName = "owner-" + identity + ".json";
+  const markerPath = join3(lockPath, markerName);
+  const marker = JSON.stringify({ version: 1, identity, pid: process.pid });
   while (true) {
     try {
       if (lockEntryExists(lockPath + ".reconcile")) throw Object.assign(new Error(), { code: "EEXIST" });
-      await mkdir2(lockPath, { mode: 448 });
+      mkdirSync(lockPath, { mode: 448 });
       if (lockEntryExists(lockPath + ".reconcile")) {
         throw new ConfigOwnershipError();
       }
+      writeFileSync(markerPath, marker, { flag: "wx", mode: 384 });
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
+      if (reclaimDeadOwnerLock(lockPath, markerName, marker)) break;
       if (performance.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) {
         throw new TopoloSdkError2("state_conflict", "Credential configuration is still held or unresolved. This waiter did not dispatch a renewal.");
       }
       await new Promise((resolve22) => setTimeout(resolve22, CONFIG_LOCK_RETRY_MS));
     }
   }
-  const directory = await lstat(lockPath);
-  const identity = randomUUID2();
-  const markerName = "owner-" + identity + ".json";
-  const markerPath = join3(lockPath, markerName);
-  const marker = JSON.stringify({ version: 1, identity, pid: process.pid });
-  await writeFile2(markerPath, marker, { flag: "wx", mode: 384 });
+  const directory = lstatSync(lockPath);
   const assertDirectory = async () => {
     const current = await lstat(lockPath);
     if (lockEntryExists(lockPath + ".reconcile") || !current.isDirectory() || current.isSymbolicLink() || current.dev !== directory.dev || current.ino !== directory.ino)
@@ -4666,10 +4815,14 @@ async function withConfigWriteLock(operation) {
       throw new ConfigOwnershipError();
   };
   const assertOwnedSync = () => {
-    assertDirectorySync();
-    const entries = readdirSync(lockPath);
-    const entry = lstatSync(markerPath);
-    if (entries.length !== 1 || entries[0] !== markerName || !entry.isFile() || entry.isSymbolicLink() || readFileSync2(markerPath, "utf8") !== marker) throw new ConfigOwnershipError();
+    try {
+      assertDirectorySync();
+      const entries = readdirSync(lockPath);
+      const entry = lstatSync(markerPath);
+      if (entries.length !== 1 || entries[0] !== markerName || !entry.isFile() || entry.isSymbolicLink() || readFileSync2(markerPath, "utf8") !== marker) throw new ConfigOwnershipError();
+    } catch {
+      throw new ConfigOwnershipError();
+    }
   };
   const persist = async (update) => {
     const path = configPath();
@@ -4698,14 +4851,14 @@ async function withConfigWriteLock(operation) {
       if (temporaryOwned) unlinkSync(temporary);
     }
   };
-  const release = async () => {
-    await assertOwned();
+  const release = () => {
+    assertOwnedSync();
     const quarantine = join3(dirname2(lockPath), ".credential-release-" + randomUUID2());
-    await mkdir2(quarantine, { mode: 448 });
+    mkdirSync(quarantine, { mode: 448 });
     const captured = join3(quarantine, markerName);
     try {
-      await assertOwned();
-      await rename2(markerPath, captured);
+      assertOwnedSync();
+      renameSync(markerPath, captured);
       assertDirectorySync();
       const entry = lstatSync(captured);
       if (!entry.isFile() || entry.isSymbolicLink() || readFileSync2(captured, "utf8") !== marker || readdirSync(lockPath).length) throw new ConfigOwnershipError();
@@ -4717,20 +4870,40 @@ async function withConfigWriteLock(operation) {
     } catch {
       if (existsSync2(captured)) {
         try {
-          await link(captured, markerPath);
+          linkSync(captured, markerPath);
         } catch {
         }
       }
       throw new ConfigOwnershipError();
     }
   };
+  let held = true;
+  const releaseOnce = () => {
+    if (!held) return;
+    held = false;
+    process.off("exit", onExit);
+    for (const signal of RELEASE_SIGNALS) process.off(signal, onSignal);
+    release();
+  };
+  const onExit = () => {
+    try {
+      releaseOnce();
+    } catch {
+    }
+  };
+  const onSignal = (signal) => {
+    onExit();
+    if (process.listenerCount(signal) === 0) process.kill(process.pid, signal);
+  };
+  process.on("exit", onExit);
+  for (const signal of RELEASE_SIGNALS) process.on(signal, onSignal);
   try {
     await assertOwned();
     const result = await operation(assertOwned, persist);
     await assertOwned();
     return result;
   } finally {
-    await release();
+    releaseOnce();
   }
 }
 function renewalFailure(error) {
@@ -6623,6 +6796,7 @@ async function readGooseRegistrations(path) {
       continue;
     }
     if (inExtensions && /^\S/.test(rawLine) && rawLine.trim()) {
+      if (current?.command) registrations.push(current);
       inExtensions = false;
       inTopolo = false;
       current = void 0;
@@ -6630,6 +6804,7 @@ async function readGooseRegistrations(path) {
     if (!inExtensions) continue;
     const extension = rawLine.match(/^  ([A-Za-z0-9_-]+):\s*$/);
     if (extension) {
+      if (current?.command) registrations.push(current);
       inTopolo = true;
       current = isPublicRegistrationName(extension[1]) ? { name: extension[1], command: "", args: [], env: {} } : void 0;
       continue;
@@ -6807,7 +6982,7 @@ function message(error) {
 
 // src/commands/agent-config.ts
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir3, readFile as readFile5, rename as rename3, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir3, readFile as readFile5, rename as rename2, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname5 } from "path";
 async function installAgentSkill(agent, source, homeDir, projectDir) {
   const path = agentSkillPath(agent, homeDir, projectDir);
@@ -6843,6 +7018,7 @@ async function unregisterAgentConfig(agent, homeDir, name, projectDir) {
 function registrationEnvironment(agent, registration) {
   return {
     TOPOLO_AGENT_NAME: AGENT_NAME_FOR[agent],
+    ...registration.configPath ? { TOPOLO_CONFIG_PATH: registration.configPath } : {},
     ...registration.installationId ? { TOPOLO_AGENT_INSTALLATION_ID: registration.installationId } : {},
     ...registration.context ? { TOPOLO_CONTEXT: registration.context, TOPOLO_ENV: registration.environment } : {}
   };
@@ -6974,7 +7150,7 @@ async function atomicWrite(path, contents) {
   await mkdir3(dirname5(path), { recursive: true });
   const temporaryPath = path + ".topolo-" + process.pid + ".tmp";
   await writeFile3(temporaryPath, contents, { encoding: "utf8", mode: 384 });
-  await rename3(temporaryPath, path);
+  await rename2(temporaryPath, path);
 }
 function withoutMcpServerSections(text2, name) {
   const section = "[mcp_servers." + name + "]";
@@ -7038,7 +7214,14 @@ function resolveMcpRegistration(options) {
   if (installationId && /[\r\n]/.test(installationId)) {
     throw new Error("Installation id must be a single-line identifier.");
   }
-  return { name, ...context ? { context } : {}, environment, ...installationId ? { installationId } : {} };
+  const configPath2 = process.env.TOPOLO_CONFIG_PATH;
+  return {
+    name,
+    ...context ? { context } : {},
+    environment,
+    ...installationId ? { installationId } : {},
+    ...configPath2 ? { configPath: configPath2 } : {}
+  };
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
   const source = await readFile6(join7(sourceDir, "topolo", "SKILL.md"), "utf8");

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.6",
-  "topoloPublishedVersion": "0.13.6",
+  "version": "0.13.8",
+  "topoloPublishedVersion": "0.13.8",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -31,8 +31,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.14.24",
-    "@topolo/sdk": "0.23.19",
+    "@topolo/mcp": "0.14.25",
+    "@topolo/sdk": "0.23.20",
     "commander": "^12.1.0",
     "undici": "6.29.0"
   },