@topolo/cli 0.13.8 → 0.13.10

package/dist/claude-pack-backend-3YJNKMYD.js

@@ -1,1207 +0,0 @@
-#!/usr/bin/env node
-
-// src/lib/claude-pack-backend.ts
-import { createHash, randomBytes, randomUUID } from "crypto";
-import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "fs";
-import * as filesystem from "fs";
-import * as cryptography from "crypto";
-import * as paths from "path";
-import { spawn, spawnSync } from "child_process";
-import { dirname, resolve, sep } from "path";
-import { fileURLToPath } from "url";
-import { createConnection } from "net";
-import { WebSocket } from "undici";
-
-// src/lib/claude-native-pack.ts
-async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoint, verifyContext = () => {
-}) {
-  const fenceKey = /* @__PURE__ */ Symbol.for("topolo.agent-pack.native-operation.v1");
-  const previous = manager[fenceKey];
-  const operationId = plan.operationId ?? "legacy-configuration";
-  if (apply && previous) throw new Error("Native operation is unresolved; reconcile its journal before another mutation.");
-  if (plan.mode === "recover" && previous && (previous.operationId !== operationId || previous.running))
-    throw new Error("Native recovery identity differs or the operation is still running.");
-  if (plan.noEffects && (plan.mode !== "recover" || previous?.effectAttempted)) throw new Error("No-effect recovery is not qualified.");
-  if (apply) manager[fenceKey] = { operationId, running: true, effectAttempted: false };
-  try {
-    verifyContext();
-    const checkDeadline = () => {
-      if (Date.now() >= plan.deadline) throw new Error("Native operation deadline expired; reconcile journal before retry.");
-    };
-    const command = async (value) => {
-      checkDeadline();
-      const result = await sidebar(value);
-      if (!result.ok) throw new Error(result.error || "Native sidebar acknowledgement refused.");
-      return result;
-    };
-    if (!["configure", "switch", "recover"].includes(plan.mode ?? "configure") || plan.mode === "recover" && apply || plan.outgoing?.length && !["switch", "recover"].includes(plan.mode ?? "configure"))
-      throw new Error("Unqualified native operation mode.");
-    if (plan.mode === "switch" || plan.mode === "recover") {
-      if (typeof manager.ensureArchivedSessionsLoaded !== "function") throw new Error("Archived ownership inventory is unavailable.");
-      await manager.ensureArchivedSessionsLoaded("ownership");
-    }
-    if (!plan.members.length || plan.members.length > 100 || (plan.outgoing?.length ?? 0) > 100 || new Set(plan.members.map((m) => m.sessionId)).size !== plan.members.length || new Set(plan.members.map((m) => m.key)).size !== plan.members.length)
-      throw new Error("A unique owned roster of 1\u2013100 sessions is required.");
-    const models = manager.getAvailableCodeModels();
-    const groups = manager.listCustomGroups();
-    if (!groups) throw new Error("Native sidebar groups have not been reported by the running window.");
-    for (const member of plan.members) {
-      if (!/^local_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(member.sessionId) || !plan.noEffects && (!["claude-opus-5-5", "claude-sonnet-5-5"].includes(member.model) || !["medium", "high"].includes(member.effort) || !["default", "acceptEdits", "bypassPermissions"].includes(member.permissionMode) || member.permissionMode === "bypassPermissions" && (!member.permissionConsent?.contextKey.startsWith("org:") || !member.permissionConsent.intakeKey)))
-        throw new Error("Unqualified session settings in plan.");
-      if (!plan.noEffects && !models.includes(member.model)) throw new Error("Requested model is absent from the native account catalog: " + member.model);
-      if (!plan.noEffects && member.group !== null && groups.filter((g) => g.name === member.group).length > 1)
-        throw new Error("Ambiguous native sidebar group: " + member.group);
-    }
-    const nativeDescriptor = async (member) => {
-      if (typeof manager.getSessionWhenLoaded !== "function") throw new Error("Qualified native session descriptor API is unavailable.");
-      const descriptor = await manager.getSessionWhenLoaded(member.sessionId, "topolo-agent-pack", { warnOnMiss: false });
-      checkDeadline();
-      if (!descriptor || descriptor.sessionId !== member.sessionId || descriptor.cwd !== member.cwd || descriptor.title !== member.title)
-        throw new Error("Owned native session descriptor identity changed: " + member.key);
-      return descriptor;
-    };
-    const snapshot = async (members = plan.members) => {
-      const result = [];
-      for (const member of members) {
-        checkDeadline();
-        const session = await manager.getSession(member.sessionId);
-        if (!session || session.sessionId !== member.sessionId || session.cwd !== member.cwd || session.title !== member.title || session.isArchived && !["switch", "recover"].includes(plan.mode ?? "configure"))
-          throw new Error("Owned session identity or active membership changed: " + member.key);
-        if (manager.hasLosableWork(member.sessionId) || session.isRunning || session.starting || session.pendingToolPermissions?.length)
-          throw new Error("Session has live or pending work; no changes permitted: " + member.key);
-        if (!plan.noEffects) {
-          const descriptor = await nativeDescriptor(member);
-          if (manager.hasLosableWork(member.sessionId) || descriptor.isRunning || descriptor.starting || descriptor.pendingToolPermissions?.length)
-            throw new Error("Session has live or pending work; no changes permitted: " + member.key);
-          if (descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom)
-            throw new Error("Incoming session is not a qualified local role.");
-        }
-        result.push({
-          key: member.key,
-          sessionId: session.sessionId,
-          cwd: session.cwd,
-          title: session.title,
-          group: manager.getSessionCustomGroup(member.sessionId)?.name ?? null,
-          pinned: session.isStarred === true,
-          model: session.model ?? null,
-          effort: session.effort ?? null,
-          permissionMode: session.permissionMode ?? null,
-          archived: session.isArchived === true
-        });
-      }
-      return result;
-    };
-    const before = await snapshot();
-    const outgoing = plan.outgoing ?? [];
-    const identities = [...plan.members, ...outgoing].map((m) => m.sessionId);
-    if (new Set(identities).size !== identities.length) throw new Error("Incoming and outgoing native identities overlap.");
-    const outgoingSnapshot = async (members = outgoing) => {
-      const result = [];
-      for (const member of members) {
-        checkDeadline();
-        const session = await manager.getSession(member.sessionId);
-        if (!/^local_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(member.sessionId) || !session || session.sessionId !== member.sessionId || session.cwd !== member.cwd || session.title !== member.title)
-          throw new Error("Outgoing native identity differs.");
-        if (manager.hasLosableWork(member.sessionId) || session.isRunning || session.starting || session.pendingToolPermissions?.length)
-          throw new Error("Outgoing session has live or pending work.");
-        if (!plan.noEffects) {
-          const descriptor = await nativeDescriptor(member);
-          if (manager.hasLosableWork(member.sessionId) || descriptor.isRunning || descriptor.starting || descriptor.pendingToolPermissions?.length)
-            throw new Error("Outgoing session has live or pending work.");
-          if (descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom || !manager.archiveCascadeClosureOf || manager.archiveCascadeClosureOf(descriptor).length)
-            throw new Error("Outgoing native archive closure is not qualified.");
-        }
-        result.push({ key: member.key, sessionId: member.sessionId, cwd: session.cwd, title: session.title, archived: session.isArchived === true });
-      }
-      return result;
-    };
-    const outgoingBefore = await outgoingSnapshot();
-    const sections = await command({ kind: "list_sections" });
-    checkpoint({ kind: "baseline", before, outgoingBefore, sections: sections.sections, at: Date.now() });
-    if (plan.mode === "recover") {
-      if (plan.noEffects) {
-        verifyContext();
-        checkpoint({ kind: "reconciled-no-effects", after: before, at: Date.now() });
-        delete manager[fenceKey];
-        return { state: "native-reconciled-no-effects", after: before, applied: false, nativeEffectsReplayed: false };
-      }
-      for (let i = 0; i < plan.members.length; i++) {
-        const wanted = plan.members[i];
-        const actual = before[i];
-        for (const setting of ["group", "pinned", "model", "effort", "permissionMode"])
-          if (actual[setting] !== wanted[setting]) throw new Error("Recovery read-back is incomplete; no native effects replayed.");
-        if (actual.archived) throw new Error("Recovery incoming session is still archived.");
-      }
-      if (outgoingBefore.some((s) => !s.archived)) throw new Error("Recovery outgoing roster is incomplete.");
-      verifyContext();
-      checkpoint({ kind: "reconciled", after: before, outgoingAfter: outgoingBefore, at: Date.now() });
-      delete manager[fenceKey];
-      return { state: "native-reconciled", after: before, outgoingAfter: outgoingBefore, applied: false, nativeEffectsReplayed: false };
-    }
-    if (!apply) return { state: "preflight", before, outgoingBefore, sections: sections.sections, availableModels: models, applied: false };
-    const effect = async (description, run) => {
-      checkDeadline();
-      verifyContext();
-      const affected = description.sessionIds ?? (description.sessionId ? [description.sessionId] : null);
-      await snapshot(affected ? plan.members.filter((m) => affected.includes(m.sessionId)) : plan.members);
-      await outgoingSnapshot(affected ? outgoing.filter((m) => affected.includes(m.sessionId)) : outgoing);
-      checkpoint({ kind: "attempt", ...description, at: Date.now() });
-      manager[fenceKey].effectAttempted = true;
-      await run();
-      checkpoint({ kind: "acknowledged", ...description, at: Date.now() });
-    };
-    const groupIds = new Map(groups.map((g) => [g.name, g.id]));
-    if (plan.mode === "switch") {
-      for (const member of outgoing) {
-        if (!(await manager.getSession(member.sessionId)).isArchived)
-          await effect({ operation: "archive", sessionId: member.sessionId }, () => manager.archiveSession(
-            member.sessionId,
-            { cleanupWorktree: false, forceWorktreeCleanup: false, discardUntracked: false, isAutomatic: true }
-          ));
-      }
-      for (const member of plan.members) {
-        const session = await manager.getSession(member.sessionId);
-        if (session.isArchived) {
-          const descriptor = await nativeDescriptor(member);
-          if (descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom)
-            throw new Error("Incoming session is not a qualified local role.");
-          await effect({ operation: "unarchive", sessionId: member.sessionId }, async () => {
-            await manager.unarchiveSession(member.sessionId);
-          });
-        }
-      }
-    }
-    for (const name of new Set(plan.members.map((m) => m.group).filter((g) => g !== null))) {
-      if (!groupIds.has(name)) await effect({ operation: "create_group", name }, async () => {
-        const result = await command({ kind: "create_group", name });
-        if (!result.groupId) throw new Error("Native create_group did not return an identity.");
-        groupIds.set(name, result.groupId);
-      });
-    }
-    await effect({ operation: "set_view" }, () => command({
-      kind: "set_view",
-      view: { groupBy: "custom", status: "active", sortBy: "recency", lastActivityDays: 0 }
-    }));
-    for (const group of new Set(plan.members.map((m) => m.group))) {
-      const sessionIds = plan.members.filter((m) => m.group === group).map((m) => m.sessionId);
-      await effect({ operation: "move_sessions", group, sessionIds }, () => command({
-        kind: "move_sessions",
-        sessionIds,
-        ...group === null ? {} : { groupId: groupIds.get(group) }
-      }));
-    }
-    for (const member of plan.members) {
-      await effect({ operation: "set_pinned", sessionId: member.sessionId }, () => command({ kind: "set_pinned", sessionId: member.sessionId, pinned: member.pinned }));
-      await effect({ operation: "set_model", sessionId: member.sessionId }, () => manager.setModel(member.sessionId, member.model));
-      await effect({ operation: "set_effort", sessionId: member.sessionId }, () => manager.setEffort(member.sessionId, member.effort));
-      await effect({ operation: "set_permission_mode", sessionId: member.sessionId }, async () => {
-        if (!await manager.setPermissionMode(member.sessionId, member.permissionMode, "picker"))
-          throw new Error("Native permission mode was refused: " + member.key);
-      });
-    }
-    const after = await snapshot();
-    const outgoingAfter = await outgoingSnapshot();
-    if (after.some((s) => s.archived) || outgoingAfter.some((s) => !s.archived)) throw new Error("Native archive membership read-back mismatch.");
-    for (let i = 0; i < plan.members.length; i++) {
-      const wanted = plan.members[i];
-      const actual = after[i];
-      for (const setting of ["group", "pinned", "model", "effort", "permissionMode"])
-        if (actual[setting] !== wanted[setting]) throw new Error("Native read-back mismatch: " + wanted.key + " / " + setting);
-    }
-    verifyContext();
-    checkpoint({ kind: "verified", after, outgoingAfter, at: Date.now() });
-    delete manager[fenceKey];
-    return {
-      state: "native-settings-verified",
-      before,
-      after,
-      outgoingAfter,
-      verifiedAgents: after.length,
-      applied: true,
-      modelInferenceVerified: false,
-      readOnlyConfinementVerified: false,
-      fullPackSwitchSupported: plan.mode === "switch"
-    };
-  } catch (error) {
-    if (apply) manager[fenceKey] = {
-      operationId,
-      running: false,
-      recoveryRequired: true,
-      effectAttempted: manager[fenceKey]?.effectAttempted === true
-    };
-    throw error;
-  }
-}
-
-// src/lib/claude-pack-approvals.ts
-async function nativeClaudeApprovalControl(manager, descriptor, token, net, fs, invoke, qualify, checkpoint) {
-  const key = /* @__PURE__ */ Symbol.for("topolo.agent-pack.approval-control.v1");
-  qualify();
-  if (!Number.isSafeInteger(descriptor.pid) || descriptor.pid < 1 || !/^[a-f0-9]{64}$/.test(token) || !/^[a-f0-9]{64}$/.test(descriptor.identity)) throw new Error("Unqualified native control identity.");
-  const previous = manager[key];
-  if (fs.existsSync(descriptor.socket)) throw new Error("Native control socket path already exists; no unowned takeover.");
-  if (previous) {
-    if (previous.active) throw new Error("Native approval control requests are still in flight.");
-    await new Promise((done, fail) => previous.server.close((error) => error ? fail(error) : done()));
-    delete manager[key];
-  }
-  const control = { active: 0, server: null, descriptor };
-  const server = net.createServer((connection) => {
-    let buffer = "";
-    let dispatched = false;
-    connection.setEncoding("utf8");
-    connection.setTimeout(5e3, () => connection.destroy());
-    connection.on("error", () => connection.destroy());
-    connection.on("data", async (chunk) => {
-      if (dispatched) return;
-      buffer += chunk;
-      if (Buffer.byteLength(buffer) > 65536) {
-        dispatched = true;
-        connection.destroy();
-        return;
-      }
-      if (!buffer.includes("\n")) return;
-      dispatched = true;
-      control.active++;
-      try {
-        if (control.failure) throw new Error(control.failure);
-        qualify();
-        const request = JSON.parse(buffer);
-        if (Object.keys(request).sort().join(",") !== "identity,operation,pid,token" || request.token !== token || request.pid !== descriptor.pid || request.identity !== descriptor.identity)
-          throw new Error("Native approval control authentication or process identity differs.");
-        const op = request.operation;
-        const fields = op?.kind === "smoke-start" ? ["kind", "key", "caseId", "operationId"] : op?.kind === "smoke-read" ? ["kind", "operationId"] : ["kind", "key", "intake", "fingerprint", "decision", "humanDecisionRecorded"];
-        if (!op || !["list", "details", "respond", "smoke-start", "smoke-read"].includes(op.kind) || Object.keys(op).some((k) => !fields.includes(k)))
-          throw new Error("Unsupported native control operation.");
-        const result = await invoke(op);
-        const reply = JSON.stringify({ result }) + "\n";
-        if (Buffer.byteLength(reply) > 262144) throw new Error("Native approval details exceed bounded transport; use the original native interaction.");
-        connection.end(reply);
-      } catch (error) {
-        try {
-          checkpoint({ kind: "approval-control-refused" });
-        } catch {
-          control.failure = "Native approval audit unavailable; reconcile through the original interaction.";
-        }
-        connection.end(JSON.stringify({ error: control.failure || (error instanceof Error ? error.message : "Native approval control refused.") }) + "\n");
-      } finally {
-        control.active--;
-      }
-    });
-  });
-  control.server = server;
-  await new Promise((done, fail) => {
-    const failed = (error) => fail(error);
-    server.once("error", failed);
-    server.listen(descriptor.socket, () => {
-      server.off("error", failed);
-      done();
-    });
-  });
-  try {
-    fs.chmodSync(descriptor.socket, 384);
-    checkpoint({ kind: "approval-control-installed", ...descriptor });
-  } catch (error) {
-    await new Promise((done) => server.close(() => done()));
-    throw error;
-  }
-  server.on("error", () => {
-    control.failure = "Native approval control failed; reconcile through the original interaction.";
-    try {
-      checkpoint({ kind: "approval-control-error" });
-    } catch {
-      control.failure = "Native approval audit unavailable; reconcile through the original interaction.";
-    }
-  });
-  manager[key] = control;
-  return { state: "native-approval-control-installed", ...descriptor };
-}
-async function nativeClaudeOwnedSmokeOperation(manager, members, operation, helper, fingerprint, nativeIdentity, qualifyNative = () => {
-}) {
-  const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
-  const fields = operation?.kind === "smoke-start" ? ["kind", "key", "caseId", "operationId"] : ["kind", "operationId"];
-  if (!operation || !["smoke-start", "smoke-read"].includes(operation.kind) || Object.keys(operation).sort().join() !== fields.sort().join() || !uuid.test(operation.operationId) || operation.kind === "smoke-start" && (!/^[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+$/.test(operation.key) || !["stg-context-memory-bytes", "stg-peer-ack", "prod-role-context-ack"].includes(operation.caseId)))
-    throw new Error("Exact closed native smoke operation required.");
-  if (!members.length || members.length > 70 || new Set(members.map((m) => m.key)).size !== members.length || new Set(members.map((m) => m.sessionId)).size !== members.length) throw new Error("Unique native smoke roster required.");
-  const owner = /* @__PURE__ */ Symbol.for("topolo.agent-pack.owned-smoke.v1");
-  const rosterIdentity = fingerprint(members);
-  const summary = (record) => Object.fromEntries([
-    "operationId",
-    "harness",
-    "caseId",
-    "key",
-    "state",
-    "nativeId",
-    "hostedUsageVerified",
-    "operationEffectVerified",
-    "nativeStatus",
-    "historyPreserved",
-    "ack"
-  ].filter((k) => k in record).map((k) => [k, record[k]]));
-  const check = (member2, session) => {
-    if (!session || session.sessionId !== member2.sessionId || session.cwd !== member2.cwd || session.title !== member2.title || session.isArchived || session.backend?.kind !== "local" || session.backend.remoteTarget || session.worktreePath || session.worktreeLazy || session.spawnedFrom || session.isRunning || session.starting || session.pendingToolPermissions?.length || manager.hasLosableWork(member2.sessionId) || session.model !== member2.model || session.effort !== member2.effort || session.permissionMode !== member2.permissionMode || member2.permissionMode !== "bypassPermissions" || !member2.permissionConsent || !manager.getAvailableCodeModels().includes(member2.model)) throw new Error("Exact idle native smoke ownership/settings unavailable.");
-  };
-  const current = () => {
-    qualifyNative();
-    if (manager[/* @__PURE__ */ Symbol.for("topolo.agent-pack.native-operation.v1")] || fingerprint(members) !== rosterIdentity)
-      throw new Error("Unresolved native configuration or changed smoke roster remains.");
-    for (const member2 of members) check(member2, manager.getSession(member2.sessionId));
-  };
-  const ready = async () => {
-    current();
-    for (const member2 of members) {
-      const descriptor = await manager.getSessionWhenLoaded(member2.sessionId, "topolo-owned-smoke", { warnOnMiss: false });
-      check(member2, descriptor);
-      check(member2, manager.getSession(member2.sessionId));
-    }
-    current();
-  };
-  if (operation.kind === "smoke-read") {
-    const record = await helper("read", { operation: operation.operationId });
-    if (record.state !== "native-delivered") return summary(record);
-    if (record.nativeIdentity !== nativeIdentity) return { ...summary(record), connectionCurrent: false };
-    const member2 = members.find((m) => m.key === record.key && m.sessionId === record.row.nativeId && m.cwd === record.row.cwd);
-    if (!member2) throw new Error("Native smoke read custody differs.");
-    const session = await manager.getSession(member2.sessionId);
-    if (session?.isRunning || session?.starting || manager[owner]) return summary(record);
-    check(member2, session);
-    const history = await manager.getTranscript(member2.sessionId);
-    if (!Array.isArray(history)) throw new Error("Qualified native smoke transcript API unavailable.");
-    const same = fingerprint(history.slice(0, record.historyCount)) === record.historyHash;
-    const markers = history.map((m, index) => m.uuid === record.operationId ? index : -1).filter((i) => i >= 0);
-    const marker = markers[0] ?? -1;
-    const user = markers.length === 1 && marker === record.historyCount && history[marker]?.type === "user" ? marker : -1;
-    const nextUser = history.findIndex((m, index) => index > user && m.type === "user");
-    const assistants = user < 0 ? [] : history.slice(user + 1, nextUser < 0 ? history.length : nextUser).filter((m) => m.type === "assistant");
-    const text = assistants.at(-1)?.message?.content?.filter((b) => b.type === "text").map((b) => b.text).join("");
-    let ack;
-    if (typeof text === "string" && text.length <= 2048) {
-      try {
-        ack = JSON.parse(text);
-      } catch {
-      }
-    }
-    const expected = {
-      operationId: record.operationId,
-      logicalId: record.row.logicalId,
-      agentVersionId: record.row.agentVersionId,
-      contextMarkerHash: record.row.contextMarkerHash,
-      artifactHash: record.row.artifactHash
-    };
-    const valid = same && Number.isSafeInteger(record.historyCount) && record.historyCount >= 0 && ack && typeof ack === "object" && !Array.isArray(ack) && Object.keys(ack).sort().join() === [...Object.keys(expected), "status"].sort().join() && Object.entries(expected).every(([k, v]) => ack[k] === v) && ["ok", "blocked"].includes(ack.status);
-    await helper("verify", { operation: operation.operationId });
-    return summary(await helper("mark", {
-      operation: operation.operationId,
-      state: "uncertain",
-      nativeStatus: "terminal-evidence-unavailable",
-      historyPreserved: same,
-      ...valid ? { ack } : {}
-    }));
-  }
-  if (manager[owner]) throw new Error("Native smoke dispatch already reserved.");
-  const member = members.find((m) => m.key === operation.key);
-  if (!member) throw new Error("Smoke role is not natively owned.");
-  manager[owner] = operation.operationId;
-  let prepared = false;
-  try {
-    await ready();
-    const plan = await helper("prepare", {
-      key: operation.key,
-      case: operation.caseId,
-      operation: operation.operationId,
-      native_identity: nativeIdentity
-    });
-    prepared = true;
-    const actual = plan.roster.map((r) => [r.key, r.nativeId, r.cwd, r.title]).sort();
-    const wanted = members.map((m) => [m.key, m.sessionId, m.cwd, m.title]).sort();
-    if (JSON.stringify(actual) !== JSON.stringify(wanted)) throw new Error("Smoke binding must match the complete owned native roster.");
-    await ready();
-    await helper("verify", { operation: operation.operationId });
-    const history = await manager.getTranscript(member.sessionId);
-    if (!Array.isArray(history)) throw new Error("Qualified native smoke transcript API unavailable.");
-    await helper("mark", { operation: operation.operationId, state: "prepared", historyCount: history.length, historyHash: fingerprint(history) });
-    await ready();
-    const admission = await helper("arm", { operation: operation.operationId, native_identity: nativeIdentity });
-    current();
-    if (admission.operationId !== operation.operationId || admission.nativeIdentity !== nativeIdentity || admission.state !== "start-may-have-effects" || admission.bindingHash !== plan.record.bindingHash || !/^[a-f0-9]{64}$/.test(admission.bindingHash) || !Number.isFinite(admission.expiresAt) || admission.expiresAt !== plan.record.dispatchExpiresAt || Date.now() >= admission.expiresAt * 1e3)
-      throw new Error("Original smoke final dispatch admission expired or differs.");
-    const ack = await manager.sendMessage(
-      member.sessionId,
-      plan.text,
-      void 0,
-      { messageUuid: operation.operationId, initiator: "agent", origin: { kind: "task-notification" } }
-    );
-    return summary(await helper("mark", {
-      operation: operation.operationId,
-      state: ack?.delivered === true ? "native-delivered" : ack?.delivered === false ? "native-refused" : "uncertain",
-      nativeId: operation.operationId
-    }));
-  } catch (error) {
-    if (prepared) {
-      const record = await helper("read", { operation: operation.operationId });
-      await helper("mark", { operation: operation.operationId, state: record.state === "prepared" ? "preflight-refused" : "uncertain" });
-    }
-    throw error;
-  } finally {
-    delete manager[owner];
-  }
-}
-async function nativeClaudeApprovalOperation(manager, routes, operation, fingerprint, checkpoint, history = []) {
-  const symbol = /* @__PURE__ */ Symbol.for("topolo.agent-pack.approvals.v1");
-  if (!routes.length || routes.length > 100 || new Set(routes.map((r) => r.sessionId)).size !== routes.length || new Set(routes.map((r) => r.key)).size !== routes.length) throw new Error("Unique owned approval roster required.");
-  const byId = new Map(routes.map((r) => [r.sessionId, r]));
-  const byKey = new Map(routes.map((r) => [r.key, r]));
-  for (const r of routes) {
-    const intake = byKey.get(r.intakeKey);
-    if (!/^org:.+$/.test(r.contextKey) || !intake || !intake.key.includes("/intakes/") || intake.contextKey !== r.contextKey || intake.sessionId !== r.intakeSessionId)
-      throw new Error("Approval route has no same-context owned intake.");
-  }
-  const identity = fingerprint(routes);
-  let state = manager[symbol];
-  if (state?.auditFailed) throw new Error("Native approval audit unavailable; use the original native interaction.");
-  const owned = async (route) => {
-    if (typeof manager.getSessionWhenLoaded !== "function") throw new Error("Qualified native session descriptor API is unavailable.");
-    const descriptor = await manager.getSessionWhenLoaded(route.sessionId, "topolo-agent-pack-approval", { warnOnMiss: false });
-    const session = await manager.getSession(route.sessionId);
-    if (!session || session.sessionId !== route.sessionId || session.cwd !== route.cwd || session.title !== route.title || session.isArchived)
-      throw new Error("Native approval session identity differs: " + route.key);
-    if (!descriptor || descriptor.sessionId !== route.sessionId || descriptor.cwd !== route.cwd || descriptor.title !== route.title || descriptor.isArchived || descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom)
-      throw new Error("Native approval session descriptor identity differs: " + route.key);
-    return session;
-  };
-  if (state && state.identity !== identity) {
-    if (operation.kind !== "install" || state.notifications.size || [...state.entries.values()].some((e) => ["pending", "response-may-have-effects"].includes(e.record.state)))
-      throw new Error("An existing native approval owner has a different roster.");
-    for (const r of routes) await owned(r);
-    for (const route of state.routes) {
-      const session = await manager.getSession(route.sessionId);
-      if (!session || session.cwd !== route.cwd || session.title !== route.title || session.isRunning || session.starting || session.pendingToolPermissions?.length || manager.hasLosableWork(route.sessionId))
-        throw new Error("Outgoing approval owner is not safely idle.");
-    }
-    if (typeof manager.off !== "function") throw new Error("Native approval listener ownership cannot be released.");
-    manager.off("event", state.listener);
-    delete manager[symbol];
-    state = void 0;
-  }
-  const current = async (entry2) => {
-    const source2 = await owned(byId.get(entry2.record.sourceSessionId));
-    const matches = (source2.pendingToolPermissions ?? []).filter((r) => r.requestId === entry2.request.requestId);
-    if (matches.length !== 1 || fingerprint(matches[0]) !== entry2.record.fingerprint)
-      throw new Error("Exact native request is no longer pending; no replay.");
-    return matches[0];
-  };
-  if (operation.kind === "install") {
-    for (const r of routes) await owned(r);
-    if (!state) {
-      if (typeof manager.on !== "function" || typeof manager.sendMessage !== "function" || typeof manager.respondToToolPermission !== "function") throw new Error("Native approval transport unavailable.");
-      state = { identity, routes, entries: /* @__PURE__ */ new Map(), notifications: /* @__PURE__ */ new Set(), deliveryAttempts: 0 };
-      manager[symbol] = state;
-      const save = (entry2) => checkpoint({ ...entry2.record });
-      const deliver = async (entry2) => {
-        const record = entry2.record;
-        if (state.notifications.has(record.key) || !["not-delivered", "awaiting-idle-intake"].includes(record.notificationState)) return;
-        if (record.sourceSessionId === record.intakeSessionId) {
-          record.notificationState = "native-intake";
-          save(entry2);
-          return;
-        }
-        state.notifications.add(record.key);
-        try {
-          await current(entry2);
-          const intake = await owned(byId.get(record.intakeSessionId));
-          if (manager.hasLosableWork(record.intakeSessionId) || intake.isRunning || intake.starting || intake.pendingToolPermissions?.length) {
-            record.notificationState = "awaiting-idle-intake";
-            save(entry2);
-            return;
-          }
-          const text = "Permission relay (generated by the Topolo pack adapter). " + record.sourceKey + " awaits a native decision. Request " + record.key + ", fingerprint " + record.fingerprint + ". Read exact live details using topolo agent-packs approvals details " + record.key + " --harness claude --intake " + record.intakeSessionId + " --fingerprint " + record.fingerprint + ". Present this to the human in this intake and relay only the recorded answer. This notification grants no approval." + (record.cardOnly ? " Claude requires approval on the original native card; report this limitation here." : "");
-          record.notificationState = "may-have-effects";
-          save(entry2);
-          state.deliveryAttempts++;
-          const ack = await manager.sendMessage(
-            record.intakeSessionId,
-            text,
-            void 0,
-            { initiator: "agent", origin: { kind: "task-notification" } }
-          );
-          record.notificationState = ack?.delivered === true ? "delivered" : "delivery-refused";
-          save(entry2);
-        } catch {
-          record.notificationState = record.notificationState === "may-have-effects" ? "delivery-uncertain" : "delivery-failed";
-          save(entry2);
-        } finally {
-          state.notifications.delete(record.key);
-        }
-      };
-      const capture = async (sessionId, request) => {
-        const route = byId.get(sessionId);
-        if (!route || !request || typeof request.requestId !== "string") return;
-        const source2 = await owned(route);
-        const matches = (source2.pendingToolPermissions ?? []).filter((r) => r.requestId === request.requestId);
-        if (matches.length !== 1) throw new Error("Native event is not in the owned pending inventory.");
-        const pending2 = matches[0];
-        const key = fingerprint([identity, pending2.requestId]);
-        const hash = fingerprint(pending2);
-        let entry2 = state.entries.get(key);
-        if (entry2 && entry2.record.fingerprint !== hash) throw new Error("Native request identity was reused.");
-        if (!entry2) {
-          const old = history.filter((row) => row.key === key).at(-1);
-          if (old && (old.fingerprint !== hash || old.sourceSessionId !== sessionId || old.intakeSessionId !== route.intakeSessionId || old.contextKey !== route.contextKey))
-            throw new Error("Durable approval identity differs; no replay.");
-          entry2 = { request: pending2, record: {
-            key,
-            fingerprint: hash,
-            sourceKey: route.key,
-            sourceSessionId: sessionId,
-            intakeKey: route.intakeKey,
-            intakeSessionId: route.intakeSessionId,
-            contextKey: route.contextKey,
-            state: "pending",
-            notificationState: "not-delivered",
-            cardOnly: pending2.onlyOnCard === true || pending2.noAllowOnNotification === true,
-            nativeApproved: false,
-            ...old ? { state: old.state, notificationState: old.notificationState } : {}
-          } };
-          state.entries.set(key, entry2);
-          save(entry2);
-        }
-        if (entry2.record.state === "pending") await deliver(entry2);
-      };
-      state.listener = async (event) => {
-        try {
-          if (event?.type === "tool_permission_request") await capture(event.sessionId, event.request);
-          else if (event?.type === "session_updated") {
-            const source2 = byId.get(event.sessionId);
-            if (source2) {
-              const session = await owned(source2);
-              for (const entry2 of state.entries.values())
-                if (entry2.record.state === "pending" && entry2.record.sourceSessionId === event.sessionId && !(session.pendingToolPermissions ?? []).some((r) => r.requestId === entry2.request.requestId)) {
-                  entry2.record.state = "native-request-no-longer-pending";
-                  delete entry2.request;
-                  save(entry2);
-                }
-            }
-            for (const entry2 of state.entries.values())
-              if (entry2.record.state === "pending" && entry2.record.intakeSessionId === event.sessionId) await deliver(entry2);
-          }
-        } catch {
-          try {
-            checkpoint({ kind: "approval-routing-refused", sessionId: event?.sessionId });
-          } catch {
-            state.auditFailed = true;
-          }
-        }
-      };
-      manager.on("event", state.listener);
-      checkpoint({ kind: "approval-listener-installed", identity, roles: routes.length });
-      for (const r of routes) for (const request of (await owned(r)).pendingToolPermissions ?? []) await capture(r.sessionId, request);
-    }
-    return {
-      state: "native-approval-listener-installed",
-      identity,
-      roles: routes.length,
-      modelTurnsMayHaveStartedByInstallation: state.deliveryAttempts > 0
-    };
-  }
-  if (!state) throw new Error("Native approval listener is not installed.");
-  if (operation.kind === "list") return { requests: [...state.entries.values()].map((e) => ({ ...e.record })) };
-  const entry = state.entries.get(operation.key);
-  if (!entry || entry.record.state !== "pending" || entry.record.intakeSessionId !== operation.intake || entry.record.fingerprint !== operation.fingerprint) throw new Error("Exact pending request and owning intake required.");
-  const pending = await current(entry);
-  if (manager[symbol] !== state || state.entries.get(operation.key) !== entry || entry.record.state !== "pending" || state.auditFailed)
-    throw new Error("Exact pending request changed during native identity validation; reconcile without replay.");
-  if (operation.kind === "details") return { record: { ...entry.record }, request: pending };
-  if (operation.kind !== "respond" || operation.humanDecisionRecorded !== true || !["once", "deny"].includes(operation.decision ?? ""))
-    throw new Error("Recorded human one-request decision required; never auto-approve.");
-  if (operation.decision !== "deny" && entry.record.cardOnly) throw new Error("Claude requires the original card; intake cannot impersonate its origin.");
-  entry.record.state = "response-may-have-effects";
-  checkpoint({ ...entry.record });
-  await manager.respondToToolPermission(pending.requestId, operation.decision, void 0, "elsewhere");
-  const source = await owned(byId.get(entry.record.sourceSessionId));
-  if (source.pendingToolPermissions?.some((r) => r.requestId === pending.requestId))
-    throw new Error("Native decision did not settle; reconcile without replay.");
-  entry.record.state = "native-request-settled";
-  checkpoint({ ...entry.record });
-  return { state: entry.record.state, nativeApproved: false, operationEffectVerified: false };
-}
-
-// src/lib/claude-pack-backend.ts
-var CLAUDE_NATIVE_QUALIFIER = {
-  version: "2.37337.1",
-  manager: "index.chunk-BolytlRP.js",
-  sidebar: "index.chunk-BoQoqlAs.js",
-  hashes: {
-    "index.chunk-BolytlRP.js": "e387edfb06a34a59d99b54c04365f6e32d0108e8710124b4d1a628eea726d030",
-    "index.chunk-BoQoqlAs.js": "5c07a7e836d98dcd6afcfc2a62619e71d173a136ecb9af847716ea377b58b1df",
-    "index.chunk-BWk6pVUt.js": "f7d74e113f34761a675816fe2abf65b3ddc190327ee7623d9c822f7b59cceaca"
-  }
-};
-function validateInspectorEndpoint(endpoint) {
-  const url = new URL(endpoint);
-  if (url.protocol !== "ws:" || url.hostname !== "127.0.0.1" || !url.port || url.username || url.password || url.search || url.hash || !/^\/[0-9a-f-]{36}$/.test(url.pathname))
-    throw new Error("An explicit ws://127.0.0.1:<port>/<inspector UUID> endpoint is required.");
-  return url.href;
-}
-function snapshotClaudeMarkdown(root, fs, crypto, path) {
-  const inventory = {};
-  const visit = (directory) => {
-    const stat = fs.lstatSync(directory);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("Owned context directory is not regular: " + directory);
-    for (const name of fs.readdirSync(directory).sort()) {
-      const file = path.resolve(directory, name);
-      const entry = fs.lstatSync(file);
-      if (entry.isSymbolicLink()) throw new Error("Owned context must not follow symlinks: " + file);
-      if (entry.isDirectory()) visit(file);
-      else if (/\.md$/i.test(name)) {
-        if (!entry.isFile()) throw new Error("Owned Markdown context is not a regular file: " + file);
-        inventory[file] = crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
-      }
-    }
-  };
-  visit(root);
-  return inventory;
-}
-function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(pack)) throw new Error("Invalid pack name.");
-  const root = realpathSync(store);
-  const state = JSON.parse(readFileSync(resolve(root, "claude/state.json"), "utf8"));
-  const policy = JSON.parse(readFileSync(policyPath, "utf8"));
-  if (state.harness !== "claude" || policy.format !== "topolo-agent-execution-policy" || policy.pack !== pack)
-    throw new Error("Claude state and reviewed policy must name the same pack.");
-  const records = state.agents.filter((a) => a.pack === pack);
-  if (!records.length || records.length !== policy.agents.length) throw new Error("Reviewed policy must cover the complete installed roster.");
-  const members = [];
-  const context = {};
-  const contextInventories = {};
-  const captureMarkdown = (cwd) => {
-    contextInventories[cwd] = snapshotClaudeMarkdown(cwd, filesystem, cryptography, paths);
-    Object.assign(context, contextInventories[cwd]);
-  };
-  for (const record of records) {
-    const matches = policy.agents.filter((a) => a.key === record.key && a.title === record.title);
-    if (matches.length !== 1 || record.sourceRevision !== policy.sourceRevision || record.importState !== "desktop-adopted")
-      throw new Error("Reviewed policy does not match adopted role: " + record.key);
-    const role = matches[0];
-    const settings = role.harnesses.claude.nativeSettings;
-    const cwd = realpathSync(record.workspace);
-    if (!cwd.startsWith(resolve(root, "claude/workspaces", pack) + sep)) throw new Error("Role workspace is outside the owned pack.");
-    captureMarkdown(cwd);
-    const charter = resolve(cwd, "CLAUDE.md");
-    const transcript = realpathSync(record.transcript);
-    context[charter] = createHash("sha256").update(readFileSync(charter)).digest("hex");
-    context[transcript] = createHash("sha256").update(readFileSync(transcript)).digest("hex");
-    members.push({
-      key: record.key,
-      sessionId: record.desktopSessionId,
-      cwd,
-      title: record.title,
-      group: record.pinnedRequested ? null : role.sidebar.group,
-      pinned: record.pinnedRequested === true,
-      model: settings.model,
-      effort: settings.effortLevel,
-      permissionMode: settings.permissions.defaultMode,
-      ...policy.installationConsent || settings.permissions.defaultMode === "bypassPermissions" ? {
-        permissionConsent: qualifyPermissionConsent(policy, record.key, records, settings.permissions.defaultMode === "bypassPermissions")
-      } : {}
-    });
-  }
-  for (const file of [resolve(root, "claude/state.json"), realpathSync(policyPath)])
-    context[file] = createHash("sha256").update(readFileSync(file)).digest("hex");
-  const activePath = resolve(root, "claude/active.json");
-  const active = existsSync(activePath) ? JSON.parse(readFileSync(activePath, "utf8")) : null;
-  const target = new Set(members.map((m) => m.key));
-  const outgoing = [];
-  if (active) {
-    if (!Array.isArray(active.keys) || new Set(active.keys).size !== active.keys.length) throw new Error("Invalid verified active roster.");
-    for (const key of active.keys.filter((key2) => !target.has(key2))) {
-      if (mode !== "switch") throw new Error("Use a native switch to replace the verified active roster.");
-      const candidates = state.agents.filter((a) => a.key === key && a.importState === "desktop-adopted");
-      if (candidates.length !== 1) throw new Error("Outgoing role has no unique owned adoption record.");
-      const record = candidates[0];
-      const cwd = realpathSync(record.workspace);
-      if (!/^[a-z0-9][a-z0-9-]*$/.test(record.pack)) throw new Error("Invalid outgoing pack name.");
-      if (!cwd.startsWith(resolve(root, "claude/workspaces", record.pack) + sep)) throw new Error("Outgoing workspace is outside the owned pack.");
-      captureMarkdown(cwd);
-      for (const file of [resolve(cwd, "CLAUDE.md"), realpathSync(record.transcript)])
-        context[file] = createHash("sha256").update(readFileSync(file)).digest("hex");
-      outgoing.push({ key, sessionId: record.desktopSessionId, cwd, title: record.title });
-    }
-  } else if (mode === "switch") throw new Error("Configure and verify an initial active roster before switching.");
-  const approvalRoutes = members.filter((m) => m.permissionConsent).map((m) => {
-    const intake = members.find((i) => i.key === m.permissionConsent.intakeKey);
-    if (!intake) throw new Error("Owning intake is not in the native roster.");
-    return {
-      key: m.key,
-      sessionId: m.sessionId,
-      cwd: m.cwd,
-      title: m.title,
-      ...m.permissionConsent,
-      intakeSessionId: intake.sessionId
-    };
-  });
-  return {
-    members,
-    outgoing,
-    context,
-    contextInventories,
-    approvalRoutes,
-    installationConsent: policy.installationConsent,
-    libraryRoot: root,
-    sourceRevision: policy.sourceRevision,
-    mode,
-    activeBefore: active
-  };
-}
-function qualifyPermissionConsent(policy, key, records, full) {
-  const consent = policy.installationConsent;
-  const intakeKey = consent?.intakeRoutes?.[key];
-  if (consent?.format !== "topolo-pack-installation-consent" || consent.schemaVersion !== 1 || consent.authority !== "local-installation-consent" || consent.approved !== true || consent.pack !== policy.pack || typeof consent.contextKey !== "string" || !/^org:.+$/.test(consent.contextKey) || !consent.principalId || !["manual", "role-default", "full-access"].includes(consent.profile) || full && (consent.overrides?.[key] ?? consent.profile) !== "full-access" || !records.some((record) => record.key === intakeKey && record.key.includes("/intakes/")))
-    throw new Error("Explicit organization-bound full access and owned intake consent required.");
-  return { contextKey: consent.contextKey, intakeKey };
-}
-function nativePackExpression(pid, plan, journal, apply) {
-  if (!Number.isSafeInteger(pid) || pid < 1) throw new Error("Explicit Claude main-process PID required.");
-  const qualifier = CLAUDE_NATIVE_QUALIFIER;
-  const here = dirname(fileURLToPath(import.meta.url));
-  const smokeSource = [resolve(here, "../../agent-packs/src"), resolve(here, "../agent-packs/src")].find(existsSync);
-  if (!smokeSource) throw new Error("Bundled owned smoke source unavailable.");
-  return `(async () => {
-    const expected = ${JSON.stringify({ pid, qualifier, journal, apply })};
-    if (process.pid !== expected.pid || typeof process.getBuiltinModule !== 'function') throw new Error('Claude process identity or Node runtime differs.');
-    const load = process.getBuiltinModule('module').createRequire(process.resourcesPath + '/app.asar/package.json');
-    if (load('electron').app.getVersion() !== expected.qualifier.version) throw new Error('Unqualified Claude Desktop version.');
-    const fs = load('node:fs'), crypto = load('node:crypto'), path = load('node:path');
-    const base = process.resourcesPath + '/app.asar/.vite/build/';
-    for (const [file, hash] of Object.entries(expected.qualifier.hashes)) {
-      if (crypto.createHash('sha256').update(fs.readFileSync(base + file)).digest('hex') !== hash) throw new Error('Claude native module hash changed: ' + file);
-    }
-    const manager = load(base + expected.qualifier.manager).claudeCodeSessionManager;
-    const transport = load(base + expected.qualifier.sidebar);
-    const checkpoint = value => {
-      const fd = fs.openSync(expected.journal, 'a');
-      try { fs.writeSync(fd, JSON.stringify(value) + '\\n'); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-    };
-    const context = ${JSON.stringify(plan.context)};
-    const inventories = ${JSON.stringify(plan.contextInventories)};
-    const snapshotMarkdown = (${snapshotClaudeMarkdown.toString()});
-    const verifyContext = () => {
-      if (!inventories || !Object.keys(inventories).length) throw new Error('Complete context inventory proof is unavailable.');
-      for (const [root, inventory] of Object.entries(inventories))
-        if (JSON.stringify(snapshotMarkdown(root, fs, crypto, path)) !== JSON.stringify(inventory))
-          throw new Error('Context or transcript changed during configuration: Markdown inventory ' + root);
-      for (const [file, hash] of Object.entries(context))
-        if (crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== hash)
-          throw new Error('Context or transcript changed during configuration: ' + file);
-    };
-    const result = await (${nativeClaudePackOperation.toString()})(manager,
-      value => transport.P(value, transport.M),
-      { members: ${JSON.stringify(plan.members)}, outgoing: ${JSON.stringify(plan.outgoing)},
-        operationId: ${JSON.stringify(plan.operationId)}, mode: ${JSON.stringify(plan.recovery ? "recover" : plan.mode)},
-        noEffects: ${JSON.stringify(plan.noEffects)},
-        deadline: Date.now() + 45000 }, expected.apply, checkpoint, verifyContext);
-    ${plan.approvalRoutes.length ? `const routes = ${JSON.stringify(plan.approvalRoutes)};
-      const fingerprint = value => crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex');
-        const qualifyNative = () => {
-          if (process.pid !== expected.pid || load('electron').app.getVersion() !== expected.qualifier.version) throw new Error('Native process changed.');
-          for (const [file, hash] of Object.entries(expected.qualifier.hashes))
-            if (crypto.createHash('sha256').update(fs.readFileSync(base + file)).digest('hex') !== hash) throw new Error('Native module changed.');
-        };
-       const smokeIdentity = fingerprint({pid: expected.pid, qualifier: expected.qualifier, routes});
-       const invoke = op => ['smoke-start', 'smoke-read'].includes(op.kind) ?
-         (${nativeClaudeOwnedSmokeOperation.toString()})(manager, ${JSON.stringify(plan.members)}, op,
-           (action, payload) => (${runClaudeSmokeHelper.toString()})(${JSON.stringify(plan.libraryRoot)}, action, payload,
-             ${JSON.stringify(realpathSync(smokeSource))}, load('node:child_process').spawn), fingerprint, smokeIdentity, qualifyNative) :
-         (${nativeClaudeApprovalOperation.toString()})(manager, routes, op, fingerprint,
-        row => checkpoint({kind: 'approval', ...row}),
-        fs.readFileSync(expected.journal, 'utf8').split('\\n').filter(Boolean).map(line => JSON.parse(line)));
-      if (expected.apply) {
-        result.approvalRouting = await invoke({kind: 'install'});
-        const control = ${JSON.stringify(plan.control)};
-        if (!control) throw new Error('Owned native control setup is unavailable.');
-        const stat = fs.lstatSync(control.secretPath);
-        if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 63)) throw new Error('Unowned native control secret.');
-        const secret = JSON.parse(fs.readFileSync(control.secretPath, 'utf8'));
-        result.approvalRouting.control = await (${nativeClaudeApprovalControl.toString()})(manager,
-          {socket: control.socket, pid: expected.pid, identity: fingerprint(routes)}, secret.token,
-          load('node:net'), fs, invoke, qualifyNative, checkpoint);
-      } else if (${JSON.stringify(plan.recovery === true && !plan.noEffects)}) {
-        const current = manager[Symbol.for('topolo.agent-pack.approval-control.v1')];
-        if (!current || current.descriptor.pid !== expected.pid || current.descriptor.identity !== fingerprint(routes))
-          throw new Error('Native intake control is not reconciled.');
-        result.approvalRouting = {state: 'native-approval-listener-installed', roles: routes.length, control: current.descriptor};
-      }` : ""}
-    return result;
-  })()`;
-}
-function evaluateClaudeMain(endpoint, expression, socketFactory = (url) => new WebSocket(url)) {
-  const url = validateInspectorEndpoint(endpoint);
-  return new Promise((resolveResult, reject) => {
-    const socket = socketFactory(url);
-    let finished = false;
-    const finish = (error, result) => {
-      if (finished) return;
-      finished = true;
-      clearTimeout(timer);
-      socket.close();
-      if (error) reject(error);
-      else resolveResult(result);
-    };
-    const timer = setTimeout(() => finish(new Error("Claude backend timed out; reconcile the journal before retry.")), 55e3);
-    socket.addEventListener("open", () => socket.send(JSON.stringify({
-      id: 1,
-      method: "Runtime.evaluate",
-      params: { expression, awaitPromise: true, returnByValue: true }
-    })));
-    socket.addEventListener("message", (event) => {
-      try {
-        const reply = JSON.parse(String(event.data));
-        if (reply.id !== 1) return;
-        if (reply.error || reply.result?.exceptionDetails)
-          finish(new Error(reply.error?.message || reply.result.exceptionDetails.exception?.description || "Native operation failed; reconcile the journal."));
-        else finish(void 0, reply.result.result.value);
-      } catch {
-        finish(new Error("Invalid Claude backend reply; reconcile the journal."));
-      }
-    });
-    socket.addEventListener("error", () => finish(new Error("Claude backend connection failed.")));
-    socket.addEventListener("close", () => finish(new Error("Claude backend disconnected; reconcile the journal.")));
-  });
-}
-async function lockClaudeLibrary(root) {
-  const script = 'import os,sys,fcntl\nf=os.open(sys.argv[1],os.O_RDWR|os.O_CREAT|os.O_NOFOLLOW,0o600)\nfcntl.flock(f,fcntl.LOCK_EX|fcntl.LOCK_NB)\nprint("locked",flush=True)\nsys.stdin.buffer.read()\nos.close(f)';
-  const child = spawn("python3", ["-c", script, resolve(root, ".lock")], { stdio: ["pipe", "pipe", "pipe"] });
-  await new Promise((done, fail) => {
-    let ready = false;
-    const timer = setTimeout(() => {
-      child.kill();
-      fail(new Error("Pack library lock timed out."));
-    }, 5e3);
-    child.once("error", (error) => {
-      clearTimeout(timer);
-      fail(error);
-    });
-    child.stdout.once("data", (data) => {
-      if (String(data).trim() === "locked") {
-        ready = true;
-        clearTimeout(timer);
-        done();
-      }
-    });
-    child.once("exit", () => {
-      clearTimeout(timer);
-      if (!ready) fail(new Error("Another operation owns the pack library, or its lock is unavailable."));
-    });
-    child.stderr.resume();
-  });
-  return async () => {
-    await new Promise((done) => {
-      if (child.exitCode !== null || child.signalCode !== null) done();
-      else {
-        child.once("exit", () => done());
-        child.stdin.end();
-      }
-    });
-  };
-}
-function durableRecord(path, value, flag = "a") {
-  const fd = openSync(path, flag, 384);
-  try {
-    writeFileSync(fd, JSON.stringify(value) + "\n");
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-}
-function syncDirectory(path) {
-  const fd = openSync(path, "r");
-  try {
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-}
-function verifyPlanContext(plan) {
-  if (!plan.contextInventories || !Object.keys(plan.contextInventories).length) throw new Error("Complete context inventory proof is unavailable.");
-  for (const [root, inventory] of Object.entries(plan.contextInventories))
-    if (JSON.stringify(snapshotClaudeMarkdown(root, filesystem, cryptography, paths)) !== JSON.stringify(inventory))
-      throw new Error("Context or transcript changed during configuration: Markdown inventory " + root);
-  for (const [file, hash] of Object.entries(plan.context))
-    if (createHash("sha256").update(readFileSync(file)).digest("hex") !== hash) throw new Error("Context or transcript changed during configuration: " + file);
-}
-function verifyClaudeOrganizationPolicy(root, pack, consent, run = spawnSync, locate = existsSync) {
-  const here = dirname(fileURLToPath(import.meta.url));
-  const bundled = [resolve(here, "../../agent-packs/src"), resolve(here, "../agent-packs/src")].find(locate);
-  if (!bundled) throw new Error("Bundled organization policy loader unavailable.");
-  const source = realpathSync(bundled);
-  const script = 'import json,sys\nsys.path.insert(0,sys.argv[4])\nfrom topolo_agent_pack import permissions,topolo\nfrom topolo_agent_pack.storage import Library\nlib=Library(sys.argv[1]);manifest,_=lib.load(sys.argv[2]);c=permissions.load(lib,sys.argv[2],manifest["agents"])\nif c!=json.loads(sys.argv[3]):raise RuntimeError("Installation consent changed")\np,proof=topolo.organization_execution_policy(topolo.Client(c["environment"],c["contextKey"]),c,manifest["agents"],c.get("agentWorkspaceId"))\npermissions.authorize_native_scope(proof)\nprint(json.dumps(proof))';
-  const result = run(
-    "python3",
-    ["-I", "-B", "-c", script, root, pack, JSON.stringify(consent), source],
-    { encoding: "utf8", timeout: 2e5, cwd: source, env: { ...process.env } }
-  );
-  if (result.error || result.status !== 0) throw new Error("Fresh authenticated organization policy qualification failed; no native permission widening.");
-  const proof = JSON.parse(result.stdout);
-  if (proof.profileCeilingVerified !== true || proof.contextKey !== consent.contextKey || proof.scopePolicyMode !== "unrestricted" || proof.toolActionRestrictionRequested !== false)
-    throw new Error("Organization profile ceiling proof differs.");
-  return proof;
-}
-async function configureClaudePack(options, evaluate = evaluateClaudeMain, qualify = verifyClaudeOrganizationPolicy) {
-  validateInspectorEndpoint(options.endpoint);
-  const root = realpathSync(options.store);
-  if (lstatSync(resolve(root, "claude")).isSymbolicLink()) throw new Error("Claude library must not be a symlink.");
-  const release = await lockClaudeLibrary(root);
-  try {
-    const markerPath = resolve(root, "claude/native-operation.json");
-    const recovering = options.mode === "recover";
-    if (recovering && options.apply) throw new Error("Recovery is read-only; --apply is not permitted.");
-    if (!recovering && existsSync(markerPath)) throw new Error("An unresolved Claude operation requires read-only recovery before another operation.");
-    const directory = resolve(root, "claude/journals");
-    mkdirSync(directory, { recursive: true, mode: 448 });
-    if (lstatSync(directory).isSymbolicLink()) throw new Error("Claude journal directory must not be a symlink.");
-    const operationId = randomUUID();
-    let plan;
-    let journal;
-    let marker;
-    if (recovering) {
-      if (!existsSync(markerPath) || lstatSync(markerPath).isSymbolicLink()) throw new Error("No owned unresolved Claude operation is available.");
-      marker = JSON.parse(readFileSync(markerPath, "utf8"));
-      journal = realpathSync(marker.journal);
-      if (!journal.startsWith(realpathSync(directory) + sep)) throw new Error("Recovery journal is outside the owned library.");
-      const lines = readFileSync(journal, "utf8").split("\n").filter(Boolean);
-      const line = lines[0];
-      if (createHash("sha256").update(line).digest("hex") !== marker.planHash) throw new Error("Recovery plan identity changed.");
-      const record = JSON.parse(line);
-      if (record.pack !== options.pack || record.operationId !== marker.operationId || !record.apply) throw new Error("Recovery pack or operation identity differs.");
-      plan = { ...record, approvalRoutes: record.approvalRoutes ?? [], recovery: true, noEffects: marker.format === 2 && marker.dispatchState === "not-dispatched" && !lines.map((line2) => JSON.parse(line2)).some((r) => r.kind === "attempt") };
-    } else {
-      plan = { ...prepareClaudeNativePlan(root, options.pack, options.policy, options.mode === "switch" ? "switch" : "configure"), operationId };
-      if (options.apply && plan.approvalRoutes.length) {
-        const directory2 = resolve(root, "claude/private");
-        mkdirSync(directory2, { recursive: true, mode: 448 });
-        const socketDirectory = resolve("/tmp", "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16));
-        mkdirSync(socketDirectory, { recursive: true, mode: 448 });
-        for (const path of [directory2, socketDirectory]) {
-          const stat = lstatSync(path);
-          if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63)
-            throw new Error("Native control directory must be owned and private.");
-        }
-        plan.control = { socket: resolve(socketDirectory, operationId + ".sock"), secretPath: resolve(directory2, operationId + ".json") };
-        durableRecord(plan.control.secretPath, { token: randomBytes(32).toString("hex") }, "wx");
-        syncDirectory(directory2);
-      }
-      journal = resolve(directory, operationId + ".jsonl");
-      const record = { kind: "plan", pack: options.pack, ...plan, apply: options.apply };
-      durableRecord(journal, record, "wx");
-      marker = { format: 2, dispatchState: "not-dispatched", operationId, journal, planHash: createHash("sha256").update(JSON.stringify(record)).digest("hex") };
-      if (options.apply) durableRecord(markerPath, marker, "wx");
-      syncDirectory(directory);
-      syncDirectory(resolve(root, "claude"));
-    }
-    try {
-      verifyPlanContext(plan);
-      const organizationPolicy = options.apply && plan.approvalRoutes.length ? qualify(root, options.pack, plan.installationConsent) : null;
-      if (options.apply) {
-        const dispatched = { ...marker, dispatchState: "may-have-effects" };
-        const temporaryMarker = resolve(root, "claude/native-dispatch-" + operationId + ".json");
-        durableRecord(temporaryMarker, dispatched, "wx");
-        renameSync(temporaryMarker, markerPath);
-        syncDirectory(resolve(root, "claude"));
-        marker = dispatched;
-      }
-      const result = await evaluate(options.endpoint, nativePackExpression(options.pid, plan, journal, options.apply));
-      verifyPlanContext(plan);
-      if (options.apply || recovering) {
-        if (plan.noEffects) {
-          if (result.state !== "native-reconciled-no-effects" || result.nativeEffectsReplayed !== false || result.after?.length !== plan.members.length || result.after.some((actual, i) => ["key", "sessionId", "cwd", "title"].some((key) => actual[key] !== plan.members[i][key])))
-            throw new Error("No-effect recovery has no qualified native acknowledgement.");
-          const activePath2 = resolve(root, "claude/active.json");
-          const current2 = existsSync(activePath2) ? JSON.parse(readFileSync(activePath2, "utf8")) : null;
-          if (JSON.stringify(current2) !== JSON.stringify(plan.activeBefore)) throw new Error("Active roster changed during no-effect recovery.");
-          durableRecord(journal, { kind: "context-verified", context: plan.context, nativeEffects: "none-attempted" });
-          if (JSON.stringify(JSON.parse(readFileSync(markerPath, "utf8"))) !== JSON.stringify(marker)) throw new Error("Recovery marker identity changed.");
-          unlinkSync(markerPath);
-          syncDirectory(resolve(root, "claude"));
-          return { ...result, journal, contextPreserved: true };
-        }
-        if (result.state !== (recovering ? "native-reconciled" : "native-settings-verified") || result.after?.length !== plan.members.length) throw new Error("Native result has no complete verified roster.");
-        for (let i = 0; i < plan.members.length; i++) {
-          const wanted = plan.members[i];
-          const actual = result.after[i];
-          if (actual.archived !== false || ["key", "sessionId", "cwd", "title", "group", "pinned", "model", "effort", "permissionMode"].some((key) => actual[key] !== wanted[key])) throw new Error("Native result settings do not match the reviewed roster.");
-        }
-        if (plan.outgoing.length && (result.outgoingAfter?.length !== plan.outgoing.length || result.outgoingAfter.some((actual, i) => actual.archived !== true || ["key", "sessionId", "cwd", "title"].some((key) => actual[key] !== plan.outgoing[i][key]))))
-          throw new Error("Native outgoing archive result does not match the reviewed roster.");
-        if (plan.approvalRoutes.length && (options.apply || recovering) && (result.approvalRouting?.state !== "native-approval-listener-installed" || result.approvalRouting.roles !== plan.members.length || result.approvalRouting.control?.pid !== options.pid || result.approvalRouting.control?.socket !== plan.control?.socket))
-          throw new Error("Complete native intake routing acknowledgement is unavailable.");
-        const activePath = resolve(root, "claude/active.json");
-        const current = existsSync(activePath) ? JSON.parse(readFileSync(activePath, "utf8")) : null;
-        const active = { operationId: plan.operationId, pack: options.pack, keys: plan.members.map((m) => m.key), sourceRevision: plan.sourceRevision };
-        if (JSON.stringify(current) !== JSON.stringify(plan.activeBefore) && JSON.stringify(current) !== JSON.stringify(active))
-          throw new Error("Verified active roster changed outside this operation.");
-        const temporary = resolve(root, "claude/active-" + plan.operationId + ".json");
-        if (existsSync(temporary)) {
-          if (lstatSync(temporary).isSymbolicLink() || readFileSync(temporary, "utf8") !== JSON.stringify(active) + "\n") throw new Error("Active commit identity changed.");
-        } else durableRecord(temporary, active, "wx");
-        renameSync(temporary, activePath);
-        syncDirectory(resolve(root, "claude"));
-        durableRecord(journal, { kind: "context-verified", context: plan.context, active });
-        if ((options.apply || recovering) && plan.approvalRoutes.length) {
-          const target = resolve(root, "claude/approval-connection.json");
-          const temporaryConnection = resolve(root, "claude/approval-connection-" + plan.operationId + ".json");
-          durableRecord(temporaryConnection, {
-            pid: options.pid,
-            socket: plan.control.socket,
-            secretPath: plan.control.secretPath,
-            identity: result.approvalRouting.control.identity,
-            pack: options.pack,
-            installationConsent: plan.installationConsent,
-            routes: plan.approvalRoutes,
-            journal,
-            organizationPolicy
-          }, "wx");
-          renameSync(temporaryConnection, target);
-          syncDirectory(resolve(root, "claude"));
-        }
-        if (JSON.stringify(JSON.parse(readFileSync(markerPath, "utf8"))) !== JSON.stringify(marker)) throw new Error("Recovery marker identity changed.");
-        unlinkSync(markerPath);
-        syncDirectory(resolve(root, "claude"));
-      } else durableRecord(journal, { kind: "context-verified", context: plan.context });
-      return { ...result, journal, contextPreserved: true };
-    } catch (error) {
-      durableRecord(journal, { kind: "recovery-required" });
-      throw new Error(`Claude configuration is incomplete. Reconcile ${journal}. ${error instanceof Error ? error.message : String(error)}`);
-    }
-  } finally {
-    await release();
-  }
-}
-function runClaudeSmokeHelper(root, action, payload, source, launch = spawn) {
-  if (!["prepare", "arm", "mark", "read", "verify"].includes(action) || typeof root !== "string" || typeof source !== "string")
-    return Promise.reject(new Error("Closed owned smoke helper required."));
-  const script = 'import sys,json\nsys.path.insert(0,sys.argv[3])\nfrom topolo_agent_pack.storage import Library\nfrom topolo_agent_pack.live import OwnedSmoke\ns=OwnedSmoke(Library(sys.argv[1]),"claude")\np=json.loads(sys.stdin.read(16384))\na=sys.argv[2]\nr=s.prepare(**p) if a=="prepare" else s.arm(**p) if a=="arm" else s.mark(**p) if a=="mark" else s.verify(p["operation"]) if a=="verify" else s.read(p["operation"])\nprint(json.dumps(r))';
-  return new Promise((done, fail) => {
-    const child = launch("python3", ["-I", "-B", "-c", script, root, action, source], { stdio: ["pipe", "pipe", "pipe"] });
-    let output = "";
-    let settled = false;
-    const finish = (error, value) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      error ? fail(error) : done(value);
-    };
-    const timer = setTimeout(() => {
-      child.kill("SIGTERM");
-      finish(new Error("Owned smoke helper timed out; reconcile without replay."));
-    }, 6e4);
-    child.stdout.setEncoding("utf8");
-    child.stderr.resume();
-    child.stdout.on("data", (data) => {
-      output += data;
-      if (Buffer.byteLength(output) > 1048576) {
-        child.kill("SIGTERM");
-        finish(new Error("Owned smoke evidence exceeds bounded transport."));
-      }
-    });
-    child.on("error", () => finish(new Error("Bundled owned smoke helper unavailable.")));
-    child.on("close", (code) => {
-      if (settled) return;
-      if (code !== 0) return finish(new Error("Owned smoke qualification refused; preserve its journal."));
-      try {
-        finish(void 0, JSON.parse(output));
-      } catch {
-        finish(new Error("Invalid owned smoke helper result."));
-      }
-    });
-    child.stdin.on("error", () => finish(new Error("Owned smoke helper input failed; reconcile without replay.")));
-    child.stdin.end(JSON.stringify(payload));
-  });
-}
-function requestClaudeApprovalControl(connection, operation, token, connect = createConnection) {
-  const parent = lstatSync(dirname(connection.socket));
-  const socket = lstatSync(connection.socket);
-  if (!parent.isDirectory() || parent.isSymbolicLink() || parent.uid !== process.getuid?.() || parent.mode & 63 || !socket.isSocket() || socket.uid !== process.getuid?.() || socket.mode & 63)
-    throw new Error("Unowned native control socket.");
-  return new Promise((done, fail) => {
-    const client = connect({ path: connection.socket });
-    let reply = "";
-    let finished = false;
-    const finish = (error, result) => {
-      if (finished) return;
-      finished = true;
-      client.destroy();
-      error ? fail(error) : done(result);
-    };
-    client.setEncoding("utf8");
-    client.setTimeout(operation.kind === "smoke-start" ? 6e4 : 1e4, () => finish(new Error("Native approval response timed out; reconcile without replay.")));
-    client.on("connect", () => client.write(JSON.stringify({ token, pid: connection.pid, identity: connection.identity, operation }) + "\n"));
-    client.on("data", (chunk) => {
-      reply += chunk;
-      if (Buffer.byteLength(reply) > 262144) return finish(new Error("Native approval response exceeds bounded transport."));
-      if (!reply.includes("\n")) return;
-      try {
-        const result = JSON.parse(reply);
-        finish(result.error ? new Error(result.error) : void 0, result.result);
-      } catch {
-        finish(new Error("Invalid native approval response."));
-      }
-    });
-    client.on("error", () => finish(new Error("Existing native approval control is unavailable.")));
-    client.on("close", () => finish(new Error("Native approval response was lost; reconcile without replay.")));
-  });
-}
-async function operateClaudeApprovals(options, request = requestClaudeApprovalControl, qualify = verifyClaudeOrganizationPolicy) {
-  const root = realpathSync(options.store);
-  const file = resolve(root, "claude/approval-connection.json");
-  if (lstatSync(file).isSymbolicLink()) throw new Error("Unowned approval connection.");
-  const connection = JSON.parse(readFileSync(file, "utf8"));
-  if (!Number.isSafeInteger(connection.pid) || connection.pid < 1 || !Array.isArray(connection.routes))
-    throw new Error("Unqualified native approval connection.");
-  if (options.kind === "respond" && options.decision === "once")
-    qualify(root, connection.pack, connection.installationConsent);
-  const journal = realpathSync(connection.journal);
-  if (!journal.startsWith(realpathSync(resolve(root, "claude/journals")) + sep)) throw new Error("Unowned approval journal.");
-  const privateDirectory = resolve(root, "claude/private");
-  const secretPath = realpathSync(connection.secretPath);
-  const stat = lstatSync(connection.secretPath);
-  if (!secretPath.startsWith(realpathSync(privateDirectory) + sep) || !stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63) throw new Error("Unowned native control secret.");
-  const secret = JSON.parse(readFileSync(secretPath, "utf8"));
-  if (!/^[a-f0-9]{64}$/.test(secret.token) || !/^[a-f0-9]{64}$/.test(connection.identity)) throw new Error("Native control identity is invalid.");
-  if (options.kind === "smoke-start" || options.kind === "smoke-read") return request(
-    connection,
-    {
-      kind: options.kind,
-      operationId: options.operationId,
-      ...options.kind === "smoke-start" ? { key: options.key, caseId: options.caseId } : {}
-    },
-    secret.token
-  );
-  return request(connection, {
-    kind: options.kind,
-    key: options.key,
-    intake: options.intake,
-    fingerprint: options.fingerprint,
-    decision: options.decision,
-    humanDecisionRecorded: options.humanDecisionRecorded
-  }, secret.token);
-}
-async function operateClaudeSmoke(options, request = requestClaudeApprovalControl) {
-  const fields = options.kind === "smoke-start" ? ["store", "kind", "operationId", "key", "caseId"] : ["store", "kind", "operationId"];
-  if (!["smoke-start", "smoke-read"].includes(options.kind) || Object.keys(options).some((k) => !fields.includes(k)) || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(options.operationId) || options.kind === "smoke-start" && (!/^[a-z0-9-]+\/[a-z0-9-]+\/[a-z0-9-]+$/.test(options.key ?? "") || !["stg-context-memory-bytes", "stg-peer-ack", "prod-role-context-ack"].includes(options.caseId ?? "")))
-    throw new Error("Exact closed native smoke fields required.");
-  return operateClaudeApprovals(options, request);
-}
-export {
-  CLAUDE_NATIVE_QUALIFIER,
-  configureClaudePack,
-  evaluateClaudeMain,
-  lockClaudeLibrary,
-  nativePackExpression,
-  operateClaudeApprovals,
-  operateClaudeSmoke,
-  prepareClaudeNativePlan,
-  requestClaudeApprovalControl,
-  runClaudeSmokeHelper,
-  snapshotClaudeMarkdown,
-  validateInspectorEndpoint,
-  verifyClaudeOrganizationPolicy
-};