@topolo/cli 0.13.8 → 0.13.9

package/dist/{claude-pack-backend-3YJNKMYD.js → claude-pack-backend-4F4VHMI5.js}

@@ -24,7 +24,8 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
   if (plan.noEffects && (plan.mode !== "recover" || previous?.effectAttempted)) throw new Error("No-effect recovery is not qualified.");
   if (apply) manager[fenceKey] = { operationId, running: true, effectAttempted: false };
   try {
-    verifyContext();
+    const incremental = (plan.mode ?? "configure") === "configure";
+    verifyContext(incremental ? [] : void 0);
     const checkDeadline = () => {
       if (Date.now() >= plan.deadline) throw new Error("Native operation deadline expired; reconcile journal before retry.");
     };
@@ -64,18 +65,28 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
       const result = [];
       for (const member of members) {
         checkDeadline();
-        const session = await manager.getSession(member.sessionId);
+        let session = await manager.getSession(member.sessionId);
         if (!session || session.sessionId !== member.sessionId || session.cwd !== member.cwd || session.title !== member.title || session.isArchived && !["switch", "recover"].includes(plan.mode ?? "configure"))
           throw new Error("Owned session identity or active membership changed: " + member.key);
-        if (manager.hasLosableWork(member.sessionId) || session.isRunning || session.starting || session.pendingToolPermissions?.length)
+        let descriptor;
+        if (!incremental && (manager.hasLosableWork(member.sessionId) || session.isRunning || session.starting || session.pendingToolPermissions?.length))
           throw new Error("Session has live or pending work; no changes permitted: " + member.key);
         if (!plan.noEffects) {
-          const descriptor = await nativeDescriptor(member);
-          if (manager.hasLosableWork(member.sessionId) || descriptor.isRunning || descriptor.starting || descriptor.pendingToolPermissions?.length)
+          descriptor = await nativeDescriptor(member);
+          session = await manager.getSession(member.sessionId);
+          checkDeadline();
+          if (!session || session.sessionId !== member.sessionId || session.cwd !== member.cwd || session.title !== member.title || (session.isArchived || descriptor.isArchived) && incremental) throw new Error("Owned session identity or active membership changed: " + member.key);
+          if (!incremental && (manager.hasLosableWork(member.sessionId) || session.isRunning || session.starting || session.pendingToolPermissions?.length || descriptor.isRunning || descriptor.starting || descriptor.pendingToolPermissions?.length))
             throw new Error("Session has live or pending work; no changes permitted: " + member.key);
           if (descriptor.backend?.kind !== "local" || descriptor.backend.remoteTarget || descriptor.worktreePath || descriptor.worktreeLazy || descriptor.spawnedFrom)
             throw new Error("Incoming session is not a qualified local role.");
         }
+        const busyReasons = [
+          ...manager.hasLosableWork(member.sessionId) ? ["losable"] : [],
+          ...session.isRunning || descriptor?.isRunning ? ["running"] : [],
+          ...session.starting || descriptor?.starting ? ["starting"] : [],
+          ...session.pendingToolPermissions?.length || descriptor?.pendingToolPermissions?.length ? ["pending-permissions"] : []
+        ];
         result.push({
           key: member.key,
           sessionId: session.sessionId,
@@ -86,7 +97,8 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
           model: session.model ?? null,
           effort: session.effort ?? null,
           permissionMode: session.permissionMode ?? null,
-          archived: session.isArchived === true
+          archived: session.isArchived === true,
+          ...incremental ? { busy: busyReasons.length > 0, busyReasons } : {}
         });
       }
       return result;
@@ -118,6 +130,124 @@ async function nativeClaudePackOperation(manager, sidebar, plan, apply, checkpoi
     const outgoingBefore = await outgoingSnapshot();
     const sections = await command({ kind: "list_sections" });
     checkpoint({ kind: "baseline", before, outgoingBefore, sections: sections.sections, at: Date.now() });
+    if (incremental) {
+      const settings = ["group", "pinned", "model", "effort", "permissionMode"];
+      const idleBefore = plan.members.filter((_, i) => !before[i].busy);
+      verifyContext([]);
+      if (!apply) return {
+        state: "preflight",
+        before,
+        outgoingBefore,
+        sections: sections.sections,
+        availableModels: models,
+        applied: false,
+        contextVerifiedSessionIds: idleBefore.map((m) => m.sessionId)
+      };
+      const appliedFields = [];
+      const deferredReasons = /* @__PURE__ */ new Map();
+      const differences = (member, row) => settings.filter((field) => member[field] !== row[field]);
+      for (const member of plan.members) {
+        const initial = (await snapshot([member]))[0];
+        if (initial.busy) {
+          deferredReasons.set(member.sessionId, initial.busyReasons);
+          continue;
+        }
+        for (const setting of differences(member, initial)) {
+          let row = (await snapshot([member]))[0];
+          if (row.busy) {
+            deferredReasons.set(member.sessionId, row.busyReasons);
+            break;
+          }
+          if (row[setting] === member[setting]) continue;
+          verifyContext([member]);
+          if (setting === "group" && member.group !== null) {
+            let matching = manager.listCustomGroups()?.filter((g) => g.name === member.group);
+            if (!matching || matching.length > 1) throw new Error("Ambiguous native sidebar group: " + member.group);
+            if (!matching.length) {
+              row = (await snapshot([member]))[0];
+              if (row.busy) {
+                deferredReasons.set(member.sessionId, row.busyReasons);
+                break;
+              }
+              verifyContext([member]);
+              checkDeadline();
+              checkpoint({ kind: "attempt", operation: "create_group", key: member.key, name: member.group, at: Date.now() });
+              manager[fenceKey].effectAttempted = true;
+              const created = await command({ kind: "create_group", name: member.group });
+              checkpoint({ kind: "acknowledged", operation: "create_group", key: member.key, name: member.group, at: Date.now() });
+              matching = manager.listCustomGroups()?.filter((g) => g.name === member.group);
+              if (!created.groupId) throw new Error("Native create_group did not return an identity.");
+              if (matching?.length !== 1 || matching[0].id !== created.groupId)
+                throw new Error("Native group read-back mismatch.");
+              verifyContext([member]);
+              appliedFields.push({ key: member.key, operation: "create_group", name: member.group });
+            }
+          }
+          row = (await snapshot([member]))[0];
+          if (row.busy) {
+            deferredReasons.set(member.sessionId, row.busyReasons);
+            break;
+          }
+          if (row[setting] === member[setting]) continue;
+          verifyContext([member]);
+          checkDeadline();
+          if (setting === "model" && !manager.getAvailableCodeModels().includes(member.model))
+            throw new Error("Requested model is absent from the native account catalog: " + member.model);
+          const operation = setting === "group" ? "move_sessions" : setting === "pinned" ? "set_pinned" : setting === "model" ? "set_model" : setting === "effort" ? "set_effort" : "set_permission_mode";
+          checkpoint({ kind: "attempt", operation, setting, key: member.key, sessionId: member.sessionId, at: Date.now() });
+          manager[fenceKey].effectAttempted = true;
+          if (setting === "group") {
+            const matching = member.group === null ? [] : manager.listCustomGroups()?.filter((g) => g.name === member.group);
+            if (!matching || member.group !== null && matching.length !== 1) throw new Error("Native group identity changed.");
+            await command({
+              kind: "move_sessions",
+              sessionIds: [member.sessionId],
+              ...member.group === null ? {} : { groupId: matching[0].id }
+            });
+          } else if (setting === "pinned") await command({ kind: "set_pinned", sessionId: member.sessionId, pinned: member.pinned });
+          else if (setting === "model") await manager.setModel(member.sessionId, member.model);
+          else if (setting === "effort") await manager.setEffort(member.sessionId, member.effort);
+          else if (!await manager.setPermissionMode(member.sessionId, member.permissionMode, "picker"))
+            throw new Error("Native permission mode was refused: " + member.key);
+          checkpoint({ kind: "acknowledged", operation, setting, key: member.key, sessionId: member.sessionId, at: Date.now() });
+          const actual = (await snapshot([member]))[0];
+          if (actual[setting] !== member[setting]) throw new Error("Native read-back mismatch: " + member.key + " / " + setting);
+          verifyContext([member]);
+          appliedFields.push({ key: member.key, sessionId: member.sessionId, setting, value: member[setting] });
+          checkpoint({ kind: "verified-field", operation, setting, key: member.key, sessionId: member.sessionId, at: Date.now() });
+        }
+      }
+      const after2 = await snapshot();
+      const idleAfter = plan.members.filter((member, i) => !after2[i].busy && !deferredReasons.has(member.sessionId));
+      verifyContext(idleAfter);
+      const deferred = plan.members.flatMap((member, i) => {
+        const row = after2[i], fields = differences(member, row);
+        if (!fields.length) return [];
+        const reasons = deferredReasons.get(member.sessionId) ?? row.busyReasons;
+        if (!reasons?.length) throw new Error("Native read-back mismatch: " + member.key + " / " + fields.join(","));
+        return [{ key: member.key, sessionId: member.sessionId, fields, reasons }];
+      });
+      const attestedBusyKeys = after2.filter((row) => row.busy && !deferred.some((d) => d.sessionId === row.sessionId)).map((row) => row.key);
+      checkpoint({ kind: deferred.length ? "partial-verified" : "verified", after: after2, appliedFields, deferred, attestedBusyKeys, at: Date.now() });
+      delete manager[fenceKey];
+      return {
+        state: deferred.length ? "native-settings-partial" : "native-settings-verified",
+        before,
+        after: after2,
+        outgoingAfter: [],
+        verifiedAgents: after2.length - deferred.length,
+        complete: deferred.length === 0,
+        applied: appliedFields.length > 0,
+        appliedFields,
+        deferred,
+        attestedBusyKeys,
+        contextVerifiedSessionIds: idleAfter.map((m) => m.sessionId),
+        busyObservations: [...deferredReasons].map(([sessionId, reasons]) => ({ key: plan.members.find((m) => m.sessionId === sessionId).key, sessionId, reasons })),
+        modelInferenceVerified: false,
+        readOnlyConfinementVerified: false,
+        fullPackSwitchSupported: false
+      };
+    }
     if (plan.mode === "recover") {
       if (plan.noEffects) {
         verifyContext();
@@ -672,6 +802,7 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
   if (!records.length || records.length !== policy.agents.length) throw new Error("Reviewed policy must cover the complete installed roster.");
   const members = [];
   const context = {};
+  const roleContextFiles = {};
   const contextInventories = {};
   const captureMarkdown = (cwd) => {
     contextInventories[cwd] = snapshotClaudeMarkdown(cwd, filesystem, cryptography, paths);
@@ -690,6 +821,7 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
     const transcript = realpathSync(record.transcript);
     context[charter] = createHash("sha256").update(readFileSync(charter)).digest("hex");
     context[transcript] = createHash("sha256").update(readFileSync(transcript)).digest("hex");
+    roleContextFiles[record.desktopSessionId] = [charter, transcript];
     members.push({
       key: record.key,
       sessionId: record.desktopSessionId,
@@ -744,6 +876,8 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
     outgoing,
     context,
     contextInventories,
+    roleContextFiles,
+    globalContextFiles: [resolve(root, "claude/state.json"), realpathSync(policyPath)],
     approvalRoutes,
     installationConsent: policy.installationConsent,
     libraryRoot: root,
@@ -752,6 +886,27 @@ function prepareClaudeNativePlan(store, pack, policyPath, mode = "configure") {
     activeBefore: active
   };
 }
+function verifyClaudePlanContext(plan, members, fs, crypto, path, snapshotMarkdown) {
+  if (!plan.contextInventories || !Object.keys(plan.contextInventories).length) throw new Error("Complete context inventory proof is unavailable.");
+  if (members && (!plan.roleContextFiles || !plan.globalContextFiles?.length)) throw new Error("Scoped role context proof is unavailable.");
+  const selected = members ?? plan.members;
+  if (new Set(selected.map((m) => m.sessionId)).size !== selected.length || selected.some((m) => !plan.members.some((p) => p.sessionId === m.sessionId && p.key === m.key && p.cwd === m.cwd && p.title === m.title)))
+    throw new Error("Scoped context identity differs from the complete roster.");
+  const roots = members ? selected.map((m) => m.cwd) : Object.keys(plan.contextInventories);
+  for (const root of roots) {
+    const inventory = plan.contextInventories[root];
+    if (!inventory || JSON.stringify(snapshotMarkdown(root, fs, crypto, path)) !== JSON.stringify(inventory))
+      throw new Error("Context or transcript changed during configuration: Markdown inventory " + root);
+  }
+  const files = members ? [...plan.globalContextFiles, ...selected.flatMap((m) => {
+    const files2 = plan.roleContextFiles[m.sessionId];
+    if (!files2?.length) throw new Error("Scoped role context proof is unavailable.");
+    return files2;
+  })] : Object.keys(plan.context);
+  for (const file of files)
+    if (!plan.context[file] || crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") !== plan.context[file])
+      throw new Error("Context or transcript changed during configuration: " + file);
+}
 function qualifyPermissionConsent(policy, key, records, full) {
   const consent = policy.installationConsent;
   const intakeKey = consent?.intakeRoutes?.[key];
@@ -784,15 +939,9 @@ function nativePackExpression(pid, plan, journal, apply) {
     const context = ${JSON.stringify(plan.context)};
     const inventories = ${JSON.stringify(plan.contextInventories)};
     const snapshotMarkdown = (${snapshotClaudeMarkdown.toString()});
-    const verifyContext = () => {
-      if (!inventories || !Object.keys(inventories).length) throw new Error('Complete context inventory proof is unavailable.');
-      for (const [root, inventory] of Object.entries(inventories))
-        if (JSON.stringify(snapshotMarkdown(root, fs, crypto, path)) !== JSON.stringify(inventory))
-          throw new Error('Context or transcript changed during configuration: Markdown inventory ' + root);
-      for (const [file, hash] of Object.entries(context))
-        if (crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex') !== hash)
-          throw new Error('Context or transcript changed during configuration: ' + file);
-    };
+    const contextPlan = {context, contextInventories: inventories, members: ${JSON.stringify(plan.members)},
+      roleContextFiles: ${JSON.stringify(plan.roleContextFiles)}, globalContextFiles: ${JSON.stringify(plan.globalContextFiles)}};
+    const verifyContext = members => (${verifyClaudePlanContext.toString()})(contextPlan, members, fs, crypto, path, snapshotMarkdown);
     const result = await (${nativeClaudePackOperation.toString()})(manager,
       value => transport.P(value, transport.M),
       { members: ${JSON.stringify(plan.members)}, outgoing: ${JSON.stringify(plan.outgoing)},
@@ -815,15 +964,61 @@ function nativePackExpression(pid, plan, journal, apply) {
         row => checkpoint({kind: 'approval', ...row}),
         fs.readFileSync(expected.journal, 'utf8').split('\\n').filter(Boolean).map(line => JSON.parse(line)));
       if (expected.apply) {
-        result.approvalRouting = await invoke({kind: 'install'});
         const control = ${JSON.stringify(plan.control)};
         if (!control) throw new Error('Owned native control setup is unavailable.');
-        const stat = fs.lstatSync(control.secretPath);
-        if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 63)) throw new Error('Unowned native control secret.');
-        const secret = JSON.parse(fs.readFileSync(control.secretPath, 'utf8'));
-        result.approvalRouting.control = await (${nativeClaudeApprovalControl.toString()})(manager,
-          {socket: control.socket, pid: expected.pid, identity: fingerprint(routes)}, secret.token,
-          load('node:net'), fs, invoke, qualifyNative, checkpoint);
+        const identity = fingerprint(routes);
+        const current = manager[Symbol.for('topolo.agent-pack.approval-control.v1')];
+        const listener = manager[Symbol.for('topolo.agent-pack.approvals.v1')];
+        const incremental = ${JSON.stringify(plan.mode === "configure" && !plan.recovery)};
+        const unchanged = listener?.identity === identity && listener.listener && !listener.auditFailed &&
+          current?.descriptor.pid === expected.pid && current.descriptor.identity === identity &&
+          current.descriptor.socket === control.socket && current.server?.listening === true && !current.failure;
+        if (!incremental) {
+          result.approvalRouting = await invoke({kind: 'install'});
+          const stat = fs.lstatSync(control.secretPath);
+          if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 63)) throw new Error('Unowned native control secret.');
+          const secret = JSON.parse(fs.readFileSync(control.secretPath, 'utf8'));
+          result.approvalRouting.control = await (${nativeClaudeApprovalControl.toString()})(manager,
+            {socket: control.socket, pid: expected.pid, identity}, secret.token,
+            load('node:net'), fs, invoke, qualifyNative, checkpoint);
+        } else if (unchanged) {
+          // Re-attest the owned listener/control; do not replace matching hooks
+          // or interrupt an in-flight request merely to configure idle settings.
+          result.approvalRouting = {state: 'native-approval-listener-installed', roles: routes.length,
+            identity, control: current.descriptor, unchanged: true};
+        } else {
+          qualifyNative();
+          const deferred = [];
+          for (const route of routes) {
+            const descriptor = await manager.getSessionWhenLoaded(route.sessionId, 'topolo-agent-pack-approval', {warnOnMiss: false});
+            const session = await manager.getSession(route.sessionId);
+            if (!descriptor || descriptor.sessionId !== route.sessionId || descriptor.cwd !== route.cwd || descriptor.title !== route.title ||
+                descriptor.isArchived || descriptor.backend?.kind !== 'local' || descriptor.backend.remoteTarget || descriptor.worktreePath ||
+                descriptor.worktreeLazy || descriptor.spawnedFrom || !session || session.sessionId !== route.sessionId ||
+                session.cwd !== route.cwd || session.title !== route.title || session.isArchived)
+              throw new Error('Native approval route ownership changed.');
+            if (session.pendingToolPermissions?.length || descriptor.pendingToolPermissions?.length)
+              deferred.push({key: route.key, fields: ['intakeHooks'], reason: 'pending-permissions'});
+          }
+          if (current?.active || current?.failure || listener?.auditFailed ||
+              (listener && listener.identity !== identity) ||
+              (current && (current.descriptor.pid !== expected.pid || current.descriptor.identity !== identity)))
+            for (const route of routes) deferred.push({key: route.key, fields: ['intakeHooks'], reason: 'existing-control-custody'});
+          if (deferred.length) {
+            result.routingDeferred = deferred;
+            result.state = 'native-settings-partial';result.complete = false;
+            checkpoint({kind: 'routing-deferred', deferred, at: Date.now()});
+          } else {
+            verifyContext(result.after.filter(row => !row.busy).map(row => contextPlan.members.find(m => m.sessionId === row.sessionId)));
+            result.approvalRouting = await invoke({kind: 'install'});
+            const stat = fs.lstatSync(control.secretPath);
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== process.getuid() || (stat.mode & 63)) throw new Error('Unowned native control secret.');
+            const secret = JSON.parse(fs.readFileSync(control.secretPath, 'utf8'));
+            result.approvalRouting.control = await (${nativeClaudeApprovalControl.toString()})(manager,
+              {socket: control.socket, pid: expected.pid, identity}, secret.token,
+              load('node:net'), fs, invoke, qualifyNative, checkpoint);
+          }
+        }
       } else if (${JSON.stringify(plan.recovery === true && !plan.noEffects)}) {
         const current = manager[Symbol.for('topolo.agent-pack.approval-control.v1')];
         if (!current || current.descriptor.pid !== expected.pid || current.descriptor.identity !== fingerprint(routes))
@@ -920,13 +1115,8 @@ function syncDirectory(path) {
     closeSync(fd);
   }
 }
-function verifyPlanContext(plan) {
-  if (!plan.contextInventories || !Object.keys(plan.contextInventories).length) throw new Error("Complete context inventory proof is unavailable.");
-  for (const [root, inventory] of Object.entries(plan.contextInventories))
-    if (JSON.stringify(snapshotClaudeMarkdown(root, filesystem, cryptography, paths)) !== JSON.stringify(inventory))
-      throw new Error("Context or transcript changed during configuration: Markdown inventory " + root);
-  for (const [file, hash] of Object.entries(plan.context))
-    if (createHash("sha256").update(readFileSync(file)).digest("hex") !== hash) throw new Error("Context or transcript changed during configuration: " + file);
+function verifyPlanContext(plan, members) {
+  verifyClaudePlanContext(plan, members, filesystem, cryptography, paths, snapshotClaudeMarkdown);
 }
 function verifyClaudeOrganizationPolicy(root, pack, consent, run = spawnSync, locate = existsSync) {
   const here = dirname(fileURLToPath(import.meta.url));
@@ -976,18 +1166,35 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
     } else {
       plan = { ...prepareClaudeNativePlan(root, options.pack, options.policy, options.mode === "switch" ? "switch" : "configure"), operationId };
       if (options.apply && plan.approvalRoutes.length) {
-        const directory2 = resolve(root, "claude/private");
-        mkdirSync(directory2, { recursive: true, mode: 448 });
-        const socketDirectory = resolve("/tmp", "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16));
-        mkdirSync(socketDirectory, { recursive: true, mode: 448 });
-        for (const path of [directory2, socketDirectory]) {
-          const stat = lstatSync(path);
-          if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63)
-            throw new Error("Native control directory must be owned and private.");
+        const connectionPath = resolve(root, "claude/approval-connection.json");
+        if (plan.mode === "configure" && existsSync(connectionPath)) {
+          const entry = lstatSync(connectionPath);
+          if (!entry.isFile() || entry.isSymbolicLink() || typeof process.getuid !== "function" || entry.uid !== process.getuid() || entry.mode & 63)
+            throw new Error("Unowned native approval connection.");
+          const connection = JSON.parse(readFileSync(connectionPath, "utf8"));
+          if (connection.pid === options.pid && connection.pack === options.pack && JSON.stringify(connection.routes) === JSON.stringify(plan.approvalRoutes) && JSON.stringify(connection.installationConsent) === JSON.stringify(plan.installationConsent)) {
+            if (typeof connection.secretPath !== "string" || typeof connection.socket !== "string" || !resolve(connection.secretPath).startsWith(realpathSync(resolve(root, "claude/private")) + sep) || realpathSync(connection.secretPath) !== resolve(connection.secretPath) || dirname(resolve(connection.socket)) !== resolve("/tmp", "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16)))
+              throw new Error("Native approval connection is outside owned control paths.");
+            const secret = lstatSync(connection.secretPath);
+            if (!secret.isFile() || secret.isSymbolicLink() || typeof process.getuid !== "function" || secret.uid !== process.getuid() || secret.mode & 63)
+              throw new Error("Unowned native control secret.");
+            plan.control = { socket: connection.socket, secretPath: connection.secretPath };
+          }
+        }
+        if (!plan.control) {
+          const directory2 = resolve(root, "claude/private");
+          mkdirSync(directory2, { recursive: true, mode: 448 });
+          const socketDirectory = resolve("/tmp", "topolo-claude-pack-" + createHash("sha256").update(root).digest("hex").slice(0, 16));
+          mkdirSync(socketDirectory, { recursive: true, mode: 448 });
+          for (const path of [directory2, socketDirectory]) {
+            const stat = lstatSync(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 63)
+              throw new Error("Native control directory must be owned and private.");
+          }
+          plan.control = { socket: resolve(socketDirectory, operationId + ".sock"), secretPath: resolve(directory2, operationId + ".json") };
+          durableRecord(plan.control.secretPath, { token: randomBytes(32).toString("hex") }, "wx");
+          syncDirectory(directory2);
         }
-        plan.control = { socket: resolve(socketDirectory, operationId + ".sock"), secretPath: resolve(directory2, operationId + ".json") };
-        durableRecord(plan.control.secretPath, { token: randomBytes(32).toString("hex") }, "wx");
-        syncDirectory(directory2);
       }
       journal = resolve(directory, operationId + ".jsonl");
       const record = { kind: "plan", pack: options.pack, ...plan, apply: options.apply };
@@ -998,7 +1205,8 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
       syncDirectory(resolve(root, "claude"));
     }
     try {
-      verifyPlanContext(plan);
+      const incremental = !recovering && plan.mode === "configure";
+      verifyPlanContext(plan, incremental ? [] : void 0);
       const organizationPolicy = options.apply && plan.approvalRoutes.length ? qualify(root, options.pack, plan.installationConsent) : null;
       if (options.apply) {
         const dispatched = { ...marker, dispatchState: "may-have-effects" };
@@ -1009,7 +1217,18 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
         marker = dispatched;
       }
       const result = await evaluate(options.endpoint, nativePackExpression(options.pid, plan, journal, options.apply));
-      verifyPlanContext(plan);
+      if (incremental && result.contextVerifiedSessionIds !== void 0) {
+        if (!Array.isArray(result.contextVerifiedSessionIds) || new Set(result.contextVerifiedSessionIds).size !== result.contextVerifiedSessionIds.length || result.contextVerifiedSessionIds.some((id) => !plan.members.some((m) => m.sessionId === id)))
+          throw new Error("Native scoped context identities differ.");
+        const observations = result.busyObservations ?? [];
+        if (!Array.isArray(observations) || observations.some((row) => !plan.members.some((m) => m.key === row.key && m.sessionId === row.sessionId) || !Array.isArray(row.reasons) || !row.reasons.length || row.reasons.some((reason) => !["running", "starting", "losable", "pending-permissions"].includes(reason))))
+          throw new Error("Native busy context attestation differs.");
+        for (let i = 0; i < plan.members.length; i++)
+          if (!result.contextVerifiedSessionIds.includes(plan.members[i].sessionId) && result.after?.[i]?.busy !== true && !observations.some((row) => row.sessionId === plan.members[i].sessionId))
+            throw new Error("Native result omits idle context qualification.");
+      }
+      const contextMembers = incremental && Array.isArray(result.after) ? plan.members.filter((m, i) => result.after[i]?.busy !== true && (result.contextVerifiedSessionIds === void 0 || result.contextVerifiedSessionIds.includes(m.sessionId))) : void 0;
+      verifyPlanContext(plan, contextMembers);
       if (options.apply || recovering) {
         if (plan.noEffects) {
           if (result.state !== "native-reconciled-no-effects" || result.nativeEffectsReplayed !== false || result.after?.length !== plan.members.length || result.after.some((actual, i) => ["key", "sessionId", "cwd", "title"].some((key) => actual[key] !== plan.members[i][key])))
@@ -1023,6 +1242,46 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
           syncDirectory(resolve(root, "claude"));
           return { ...result, journal, contextPreserved: true };
         }
+        if (incremental && result.state === "native-settings-partial") {
+          const settings = ["group", "pinned", "model", "effort", "permissionMode"];
+          if (result.after?.length !== plan.members.length || !Array.isArray(result.deferred) || !result.deferred.length && !result.routingDeferred?.length) throw new Error("Native partial result has no qualified complete roster.");
+          if (new Set(result.deferred.map((d) => d.sessionId)).size !== result.deferred.length || result.deferred.some((d) => !plan.members.some((m) => m.key === d.key && m.sessionId === d.sessionId) || !Array.isArray(d.fields) || !d.fields.length || new Set(d.fields).size !== d.fields.length || d.fields.some((field) => !settings.includes(field)) || !Array.isArray(d.reasons) || !d.reasons.length || d.reasons.some((reason) => !["running", "starting", "losable", "pending-permissions"].includes(reason))))
+            throw new Error("Native deferred identity or fields differ.");
+          if (result.routingDeferred !== void 0 && (!Array.isArray(result.routingDeferred) || result.routingDeferred.some((d) => !plan.approvalRoutes.some((r) => r.key === d.key) || JSON.stringify(d.fields) !== JSON.stringify(["intakeHooks"]) || !["pending-permissions", "existing-control-custody"].includes(d.reason))))
+            throw new Error("Native deferred routing ownership differs.");
+          for (let i = 0; i < plan.members.length; i++) {
+            const wanted = plan.members[i], actual = result.after[i];
+            if (actual.archived !== false || ["key", "sessionId", "cwd", "title"].some((key) => actual[key] !== wanted[key]))
+              throw new Error("Native partial roster identity differs.");
+            const mismatch = settings.filter((key) => actual[key] !== wanted[key]);
+            const deferred = result.deferred.find((d) => d.sessionId === wanted.sessionId);
+            if (JSON.stringify(mismatch.slice().sort()) !== JSON.stringify((deferred?.fields ?? []).slice().sort()))
+              throw new Error("Native partial result hides an undeferred mismatch.");
+          }
+          const activePath2 = resolve(root, "claude/active.json");
+          const active2 = existsSync(activePath2) ? JSON.parse(readFileSync(activePath2, "utf8")) : null;
+          if (JSON.stringify(active2) !== JSON.stringify(plan.activeBefore)) throw new Error("Active roster changed during partial configuration.");
+          durableRecord(journal, {
+            kind: "partial-verified",
+            after: result.after,
+            deferred: result.deferred,
+            routingDeferred: result.routingDeferred ?? [],
+            appliedFields: result.appliedFields ?? [],
+            activeUnchanged: true
+          });
+          if (JSON.stringify(JSON.parse(readFileSync(markerPath, "utf8"))) !== JSON.stringify(marker)) throw new Error("Recovery marker identity changed.");
+          unlinkSync(markerPath);
+          syncDirectory(resolve(root, "claude"));
+          return {
+            ...result,
+            complete: false,
+            journal,
+            contextPreserved: contextMembers?.length === plan.members.length,
+            idleContextsVerified: contextMembers?.map((m) => m.key),
+            activeRosterUnchanged: true,
+            resume: "explicit-configure-only"
+          };
+        }
         if (result.state !== (recovering ? "native-reconciled" : "native-settings-verified") || result.after?.length !== plan.members.length) throw new Error("Native result has no complete verified roster.");
         for (let i = 0; i < plan.members.length; i++) {
           const wanted = plan.members[i];
@@ -1066,7 +1325,12 @@ async function configureClaudePack(options, evaluate = evaluateClaudeMain, quali
         unlinkSync(markerPath);
         syncDirectory(resolve(root, "claude"));
       } else durableRecord(journal, { kind: "context-verified", context: plan.context });
-      return { ...result, journal, contextPreserved: true };
+      return {
+        ...result,
+        journal,
+        contextPreserved: !incremental || contextMembers?.length === plan.members.length,
+        ...incremental ? { idleContextsVerified: contextMembers?.map((m) => m.key) } : {}
+      };
     } catch (error) {
       durableRecord(journal, { kind: "recovery-required" });
       throw new Error(`Claude configuration is incomplete. Reconcile ${journal}. ${error instanceof Error ? error.message : String(error)}`);
@@ -1203,5 +1467,6 @@ export {
   runClaudeSmokeHelper,
   snapshotClaudeMarkdown,
   validateInspectorEndpoint,
-  verifyClaudeOrganizationPolicy
+  verifyClaudeOrganizationPolicy,
+  verifyClaudePlanContext
 };

package/dist/index.js

@@ -14,7 +14,7 @@ function registerAgentPacksCommand(program2) {
       throw new Error("Exact closed smoke operation, role/case and UUID required.");
     const store = packs.opts().store ?? resolve(homedir(), "AgentPacks");
     if (options.harness === "claude") {
-      const { operateClaudeSmoke } = await import("./claude-pack-backend-3YJNKMYD.js");
+      const { operateClaudeSmoke } = await import("./claude-pack-backend-4F4VHMI5.js");
       console.log(JSON.stringify(await operateClaudeSmoke({
         store,
         kind: "smoke-" + operation,
@@ -44,7 +44,7 @@ function registerAgentPacksCommand(program2) {
   });
   packs.command("configure").description("Qualify and configure an adopted Claude roster through its live native backend").argument("<pack>").option("--harness <name>", "Host adapter", "claude").requiredOption("--policy <path>", "Reviewed execution policy JSON").requiredOption("--endpoint <url>", "Explicit loopback main-process inspector endpoint, enabled separately with authorization").requiredOption("--pid <pid>", "Expected Claude main-process PID").option("--apply", "Apply native groups, pins, models, effort and permission modes; otherwise preflight only").action(async (pack, options) => {
     if (options.harness !== "claude") throw new Error("Native configure is currently qualified only for Claude Desktop.");
-    const { configureClaudePack } = await import("./claude-pack-backend-3YJNKMYD.js");
+    const { configureClaudePack } = await import("./claude-pack-backend-4F4VHMI5.js");
     const result = await configureClaudePack({
       store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
       pack,
@@ -96,7 +96,7 @@ function registerAgentPacksCommand(program2) {
             throw new Error("Only a one-request once/deny response is supported.");
           decision = response.decision;
         }
-        const { operateClaudeApprovals } = await import("./claude-pack-backend-3YJNKMYD.js");
+        const { operateClaudeApprovals } = await import("./claude-pack-backend-4F4VHMI5.js");
         console.log(JSON.stringify(await operateClaudeApprovals({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           kind: args[0],
@@ -111,7 +111,7 @@ function registerAgentPacksCommand(program2) {
       if (options.policy || options.endpoint || options.pid || options.apply) {
         if (options.harness !== "claude" || !options.policy || !options.endpoint || !options.pid || args.length !== 1)
           throw new Error("Native switch/recovery requires one Claude pack, --policy, --endpoint and --pid.");
-        const { configureClaudePack } = await import("./claude-pack-backend-3YJNKMYD.js");
+        const { configureClaudePack } = await import("./claude-pack-backend-4F4VHMI5.js");
         const result2 = await configureClaudePack({
           store: packs.opts().store ?? resolve(homedir(), "AgentPacks"),
           pack: args[0],
@@ -1741,7 +1741,7 @@ var TopoloClient = class _TopoloClient {
         } catch (error) {
           const transportFailure = !(error instanceof TopoloSdkError) && !opts.signal?.aborted;
           if (!transportFailure || attempt === maxAttempts) throw error;
-          await new Promise((resolve4) => setTimeout(resolve4, 250));
+          await new Promise((resolve5) => setTimeout(resolve5, 250));
         }
       }
       throw new TopoloSdkError("network_error", "Topolo read retry loop exhausted.");
@@ -3740,7 +3740,7 @@ function createTopolo(options) {
 async function pollUntilApproved(params) {
   let interval = Math.max(params.intervalSeconds ?? 5, 1);
   while (Date.now() < params.expiresAtMs) {
-    await new Promise((resolve4) => setTimeout(resolve4, Math.min(interval * 1e3, params.expiresAtMs - Date.now())));
+    await new Promise((resolve5) => setTimeout(resolve5, Math.min(interval * 1e3, params.expiresAtMs - Date.now())));
     if (Date.now() >= params.expiresAtMs) break;
     try {
       return await params.oauth.pollDeviceToken({
@@ -6521,7 +6521,7 @@ import { spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync6 } from "fs";
 import { readFile as readFile6, rm as rm2 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { dirname as dirname6, join as join7, resolve as resolve2 } from "path";
+import { dirname as dirname6, join as join7, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { createRequire } from "module";
 
@@ -6530,7 +6530,7 @@ import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync4 } from "fs";
 import { readFile as readFile4 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { isAbsolute, join as join6 } from "path";
+import { isAbsolute, join as join6, resolve as resolve2 } from "path";
 var SUPPORTED_AGENT_IDS = [
   "claude",
   "claude-desktop",
@@ -6570,6 +6570,18 @@ var AGENT_NAME_FOR = {
   goose: "goose",
   "amazon-q": "amazon-q"
 };
+function resolveAgentHostTarget(options) {
+  const homeDir = resolve2(options.homeDir ?? homedir4());
+  const codexHome = options.codexHome ?? (options.homeDir === void 0 ? process.env.CODEX_HOME || void 0 : void 0);
+  if (codexHome !== void 0 && (!codexHome.trim() || !isAbsolute(codexHome))) {
+    throw new Error("Codex home must be an absolute nonempty directory.");
+  }
+  return Object.freeze({
+    homeDir,
+    ...options.projectDir ? { projectDir: resolve2(options.projectDir) } : {},
+    codexHome: codexHome ?? join6(homeDir, ".codex")
+  });
+}
 var RESERVED_OPERATOR_REGISTRATION = ["topolo", "platform"].join("-");
 function isPublicRegistrationName(name) {
   return name === "topolo" || name.startsWith("topolo-") && name !== RESERVED_OPERATOR_REGISTRATION;
@@ -6585,14 +6597,14 @@ function stableNodeCommand() {
   });
   return selectStableNodeCommand(probe.status === 0 ? probe.stdout : void 0);
 }
-function agentSkillPath(agent, homeDir = homedir4(), projectDir) {
+function agentSkillPath(agent, homeDir = homedir4(), projectDir, codexHome) {
   switch (agent) {
     case "claude":
       return projectDir ? join6(projectDir, ".claude", "skills", "topolo", "SKILL.md") : join6(homeDir, ".claude", "skills", "topolo", "SKILL.md");
     case "claude-desktop":
       return join6(homeDir, ".claude", "skills", "topolo", "SKILL.md");
     case "codex":
-      return join6(homeDir, ".codex", "skills", "topolo", "SKILL.md");
+      return join6(codexHome ?? join6(homeDir, ".codex"), "skills", "topolo", "SKILL.md");
     case "cursor":
       return join6(projectDir ?? homeDir, ".cursor", "rules", "topolo.mdc");
     case "grok":
@@ -6610,10 +6622,10 @@ function agentSkillPath(agent, homeDir = homedir4(), projectDir) {
       return void 0;
   }
 }
-function agentConfigPaths(agent, homeDir = homedir4(), projectDir) {
+function agentConfigPaths(agent, homeDir = homedir4(), projectDir, codexHome) {
   switch (agent) {
     case "claude":
-      return [{ path: join6(homeDir, ".claude.json"), format: "json", rootKey: "mcpServers" }];
+      return [{ path: projectDir ? join6(projectDir, ".mcp.json") : join6(homeDir, ".claude.json"), format: "json", rootKey: "mcpServers" }];
     case "claude-desktop":
       return [{
         path: claudeDesktopConfigPath(homeDir),
@@ -6621,7 +6633,7 @@ function agentConfigPaths(agent, homeDir = homedir4(), projectDir) {
         rootKey: "mcpServers"
       }];
     case "codex":
-      return [{ path: join6(homeDir, ".codex", "config.toml"), format: "toml" }];
+      return [{ path: join6(codexHome ?? join6(homeDir, ".codex"), "config.toml"), format: "toml" }];
     case "cursor":
       return [{
         path: projectDir ? join6(projectDir, ".cursor", "mcp.json") : join6(homeDir, ".cursor", "mcp.json"),
@@ -6702,8 +6714,36 @@ function agentCliNames(agent) {
       return ["qchat", "q"];
   }
 }
-function agentConfigExists(agent, homeDir = homedir4(), projectDir) {
-  return agentConfigPaths(agent, homeDir, projectDir).some((config) => existsSync4(config.path));
+function agentConfigExists(agent, homeDir = homedir4(), projectDir, codexHome) {
+  return agentConfigPaths(agent, homeDir, projectDir, codexHome).some((config) => existsSync4(config.path));
+}
+async function assertClaudeProjectScope(homeDir, projectDir, name) {
+  const path = join6(homeDir, ".claude.json");
+  let contents;
+  try {
+    contents = await readFile4(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  let config;
+  try {
+    config = JSON.parse(contents);
+    if (!config || typeof config !== "object" || Array.isArray(config)) throw new Error();
+  } catch {
+    throw new Error("Cannot verify malformed Claude scope configuration at " + path + ".");
+  }
+  const object = (value) => {
+    if (value === void 0) return void 0;
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error("Cannot verify malformed Claude scope configuration at " + path + ".");
+    }
+    return value;
+  };
+  const local = object(object(config.projects)?.[resolve2(projectDir)]);
+  if (Object.hasOwn(object(config.mcpServers) ?? {}, name) || Object.hasOwn(object(local?.mcpServers) ?? {}, name)) {
+    throw new Error("Claude MCP scope conflict for " + name + ": a user or local definition can override the project registration. Resolve that scope before setup.");
+  }
 }
 function claudeDesktopConfigPath(homeDir) {
   if (process.platform === "darwin") return join6(homeDir, "Library", "Application Support", "Claude", "claude_desktop_config.json");
@@ -6715,9 +6755,9 @@ function vscodeUserConfigPath(homeDir) {
   if (process.platform === "win32") return join6(process.env.APPDATA ?? join6(homeDir, "AppData", "Roaming"), "Code", "User", "mcp.json");
   return join6(process.env.XDG_CONFIG_HOME ?? join6(homeDir, ".config"), "Code", "User", "mcp.json");
 }
-async function readAgentRegistrations(agent, homeDir = homedir4(), projectDir) {
+async function readAgentRegistrations(agent, homeDir = homedir4(), projectDir, codexHome) {
   const registrations = [];
-  for (const config of agentConfigPaths(agent, homeDir, projectDir)) {
+  for (const config of agentConfigPaths(agent, homeDir, projectDir, codexHome)) {
     if (!existsSync4(config.path)) continue;
     if (config.format === "json") {
       registrations.push(...await readJsonRegistrations(config.path, config.rootKey ?? "mcpServers", agent));
@@ -6982,17 +7022,19 @@ function message(error) {
 
 // src/commands/agent-config.ts
 import { existsSync as existsSync5 } from "fs";
-import { mkdir as mkdir3, readFile as readFile5, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { lstat as lstat2, mkdir as mkdir3, open, readFile as readFile5, rename as rename2, unlink, writeFile as writeFile3 } from "fs/promises";
+import { randomUUID as randomUUID3 } from "crypto";
 import { dirname as dirname5 } from "path";
-async function installAgentSkill(agent, source, homeDir, projectDir) {
-  const path = agentSkillPath(agent, homeDir, projectDir);
+async function installAgentSkill(agent, source, homeDir, projectDir, codexHome) {
+  const path = agentSkillPath(agent, homeDir, projectDir, codexHome);
   if (!path) return { installed: false };
   const contents = formatSkillForAgent(agent, source);
   await atomicWrite(path, contents);
   return { path, installed: true };
 }
-async function registerAgentConfig(agent, mcp, homeDir, registration, projectDir) {
-  for (const config of agentConfigPaths(agent, homeDir, projectDir)) {
+async function registerAgentConfig(agent, mcp, homeDir, registration, projectDir, codexHome) {
+  if (agent === "claude" && projectDir) await assertClaudeProjectScope(homeDir, projectDir, registration.name);
+  for (const config of agentConfigPaths(agent, homeDir, projectDir, codexHome)) {
     if (config.format === "json") {
       await registerJson(config, agent, mcp, registration);
     } else if (config.format === "toml") {
@@ -7002,8 +7044,8 @@ async function registerAgentConfig(agent, mcp, homeDir, registration, projectDir
     }
   }
 }
-async function unregisterAgentConfig(agent, homeDir, name, projectDir) {
-  for (const config of agentConfigPaths(agent, homeDir, projectDir)) {
+async function unregisterAgentConfig(agent, homeDir, name, projectDir, codexHome) {
+  for (const config of agentConfigPaths(agent, homeDir, projectDir, codexHome)) {
     if (!existsSync5(config.path)) continue;
     if (config.format === "json") {
       await unregisterJson(config, agent, name);
@@ -7016,18 +7058,39 @@ async function unregisterAgentConfig(agent, homeDir, name, projectDir) {
   }
 }
 function registrationEnvironment(agent, registration) {
+  let privateAliases = {};
+  if (registration.configPath) {
+    const prefixes = {
+      production: "TOPOLO_PRODUCTION",
+      staging: "TOPOLO_STAGING",
+      development: "TOPOLO_DEVELOPMENT",
+      local: "TOPOLO_LOCAL"
+    };
+    const prefix = prefixes[registration.environment];
+    if (!prefix) throw new Error("Cannot isolate a private profile for an unknown environment.");
+    privateAliases = {
+      TOPOLO_API_KEY: "",
+      TOPOLO_ACCESS_TOKEN: "",
+      [prefix + "_API_KEY"]: "",
+      [prefix + "_ACCESS_TOKEN"]: "",
+      TOPOLO_ENV: registration.environment
+    };
+  }
   return {
     TOPOLO_AGENT_NAME: AGENT_NAME_FOR[agent],
     ...registration.configPath ? { TOPOLO_CONFIG_PATH: registration.configPath } : {},
     ...registration.installationId ? { TOPOLO_AGENT_INSTALLATION_ID: registration.installationId } : {},
-    ...registration.context ? { TOPOLO_CONTEXT: registration.context, TOPOLO_ENV: registration.environment } : {}
+    ...registration.context ? { TOPOLO_CONTEXT: registration.context, TOPOLO_ENV: registration.environment } : {},
+    ...privateAliases
   };
 }
 async function registerJson(config, agent, mcp, registration) {
+  const before = await fileSnapshot(config.path);
   let parsed = {};
-  if (existsSync5(config.path)) {
+  if (before.contents !== void 0) {
     try {
-      parsed = JSON.parse(await readFile5(config.path, "utf8"));
+      parsed = JSON.parse(before.contents);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Expected an object.");
     } catch (error) {
       throw new Error(
         "Cannot update malformed " + (agent === "claude" ? "Claude" : AGENT_LABELS[agent]) + " configuration at " + config.path + ": " + (error instanceof Error ? error.message : String(error))
@@ -7048,7 +7111,7 @@ async function registerJson(config, agent, mcp, registration) {
   if (agent === "claude" || agent === "claude-desktop" || rootKey === "servers") entry.type = "stdio";
   servers[registration.name] = entry;
   parsed[rootKey] = servers;
-  await atomicWrite(config.path, JSON.stringify(parsed, null, 2) + "\n");
+  await atomicWrite(config.path, JSON.stringify(parsed, null, 2) + "\n", before);
 }
 async function unregisterJson(config, agent, name) {
   let parsed;
@@ -7070,13 +7133,14 @@ async function unregisterJson(config, agent, name) {
   await atomicWrite(config.path, JSON.stringify(parsed, null, 2) + "\n");
 }
 async function registerToml(path, agent, mcp, registration) {
-  const existing = existsSync5(path) ? await readFile5(path, "utf8") : "";
+  const before = await fileSnapshot(path);
+  const existing = before.contents ?? "";
   const text2 = withoutMcpServerSections(existing, registration.name);
   const args = mcp.args.length ? "\nargs = [" + mcp.args.map((item) => JSON.stringify(item)).join(", ") + "]" : "";
   const environment = registrationEnvironment(agent, registration);
   const environmentText = Object.entries(environment).map(([key, value]) => JSON.stringify(key) + " = " + JSON.stringify(value)).join(", ");
   const block = agent === "grok" ? "\n\n[mcp_servers." + registration.name + "]\ncommand = " + JSON.stringify(mcp.command) + args + "\nenv = { " + environmentText + " }\n" : "\n\n[mcp_servers." + registration.name + "]\ncommand = " + JSON.stringify(mcp.command) + args + "\n\n[mcp_servers." + registration.name + ".env]\n" + Object.entries(environment).map(([key, value]) => key + " = " + JSON.stringify(value)).join("\n") + "\n";
-  await atomicWrite(path, text2 + block);
+  await atomicWrite(path, text2 + block, before);
 }
 async function registerGoose(path, mcp, registration) {
   const existing = existsSync5(path) ? await readFile5(path, "utf8") : "";
@@ -7146,11 +7210,82 @@ function formatSkillForAgent(agent, source) {
   }
   return "---\ntrigger: model_decision\ndescription: Use Topolo MCP for Topolo platform operations.\n---\n\n" + body;
 }
-async function atomicWrite(path, contents) {
+function fileIdentity(stat2) {
+  return [stat2.dev, stat2.ino, stat2.size, stat2.mtimeMs, stat2.ctimeMs, stat2.mode, stat2.nlink].join(":");
+}
+async function fileSnapshot(path) {
+  const parents = [];
+  for (let parent = dirname5(path); ; parent = dirname5(parent)) {
+    try {
+      const stat2 = await lstat2(parent);
+      if (!stat2.isDirectory() || stat2.isSymbolicLink()) throw new Error("Host destination contains a symbolic link or non-directory at " + parent + ".");
+      parents.push({ path: parent, identity: [stat2.dev, stat2.ino].join(":") });
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (dirname5(parent) === parent) break;
+  }
+  try {
+    const stat2 = await lstat2(path);
+    if (!stat2.isFile() || stat2.isSymbolicLink() || stat2.nlink !== 1) throw new Error("Host configuration must be a single regular file at " + path + ".");
+    const contents = await readFile5(path, "utf8");
+    if (fileIdentity(await lstat2(path)) !== fileIdentity(stat2)) throw new Error("Host configuration changed while reading at " + path + ".");
+    return { contents, identity: fileIdentity(stat2), parents };
+  } catch (error) {
+    if (error.code === "ENOENT") return { parents };
+    throw error;
+  }
+}
+async function assertSnapshot(path, before) {
+  const current = await fileSnapshot(path);
+  if (current.contents !== before.contents || current.identity !== before.identity || before.parents.some((parent) => !current.parents.some((candidate) => candidate.path === parent.path && candidate.identity === parent.identity))) {
+    throw new Error("Host destination changed before write at " + path + ".");
+  }
+}
+async function atomicWrite(path, contents, before) {
+  before ??= await fileSnapshot(path);
+  await assertSnapshot(path, before);
+  if (before.contents === contents) return;
   await mkdir3(dirname5(path), { recursive: true });
-  const temporaryPath = path + ".topolo-" + process.pid + ".tmp";
-  await writeFile3(temporaryPath, contents, { encoding: "utf8", mode: 384 });
-  await rename2(temporaryPath, path);
+  const destination = await fileSnapshot(path);
+  await assertSnapshot(path, before);
+  const temporaryPath = path + ".topolo-" + randomUUID3() + ".tmp";
+  const handle = await open(temporaryPath, "wx", 384);
+  let temporaryIdentity;
+  let handleClosed = false;
+  let temporaryPending = true;
+  try {
+    const created = await handle.stat();
+    temporaryIdentity = [created.dev, created.ino].join(":");
+    await assertSnapshot(path, destination);
+    await writeFile3(handle, contents, { encoding: "utf8" });
+    await handle.close();
+    handleClosed = true;
+    await assertSnapshot(path, destination);
+    const temporary = await lstat2(temporaryPath);
+    if (!temporary.isFile() || temporary.isSymbolicLink() || temporary.nlink !== 1 || [temporary.dev, temporary.ino].join(":") !== temporaryIdentity) {
+      throw new Error("Host temporary file custody changed before rename at " + path + ".");
+    }
+    await rename2(temporaryPath, path);
+    temporaryPending = false;
+    const installed = await fileSnapshot(path);
+    if (installed.contents !== contents) throw new Error("Host configuration read-back failed at " + path + ".");
+  } finally {
+    if (!handleClosed) await handle.close();
+    if (temporaryPending && temporaryIdentity) {
+      let cleanupOwned = false;
+      try {
+        const parentsOwned = await Promise.all(destination.parents.map(async (parent) => {
+          const current2 = await lstat2(parent.path);
+          return current2.isDirectory() && !current2.isSymbolicLink() && [current2.dev, current2.ino].join(":") === parent.identity;
+        }));
+        const current = await lstat2(temporaryPath);
+        cleanupOwned = parentsOwned.every(Boolean) && current.isFile() && !current.isSymbolicLink() && current.nlink === 1 && [current.dev, current.ino].join(":") === temporaryIdentity;
+      } catch {
+      }
+      if (cleanupOwned) await unlink(temporaryPath);
+    }
+  }
 }
 function withoutMcpServerSections(text2, name) {
   const section = "[mcp_servers." + name + "]";
@@ -7171,8 +7306,8 @@ function withoutMcpServerSections(text2, name) {
 var AGENT_LABELS2 = AGENT_LABELS;
 function skillsSourceDir() {
   const here = dirname6(fileURLToPath3(import.meta.url));
-  const distCandidate = resolve2(here, "../skills");
-  const srcCandidate = resolve2(here, "../../skills");
+  const distCandidate = resolve3(here, "../skills");
+  const srcCandidate = resolve3(here, "../../skills");
   for (const candidate of [distCandidate, srcCandidate]) {
     if (existsSync6(join7(candidate, "topolo", "SKILL.md"))) return candidate;
   }
@@ -7224,14 +7359,22 @@ function resolveMcpRegistration(options) {
   };
 }
 async function installForAgent(agent, sourceDir, mcp, opts) {
+  const { homeDir, projectDir, codexHome } = opts.target;
+  if (opts.withMcp && agent === "claude" && projectDir) {
+    try {
+      await assertClaudeProjectScope(homeDir, projectDir, opts.registration.name);
+    } catch (err) {
+      return { agent, skillInstalled: false, mcp: "failed", detail: err instanceof Error ? err.message : String(err) };
+    }
+  }
   const source = await readFile6(join7(sourceDir, "topolo", "SKILL.md"), "utf8");
-  const skill = await installAgentSkill(agent, source, opts.homeDir, opts.projectDir);
+  const skill = await installAgentSkill(agent, source, homeDir, projectDir, codexHome);
   if (!opts.withMcp) {
     return { agent, skillPath: skill.path, skillInstalled: skill.installed, mcp: "skipped" };
   }
   try {
-    await registerAgentConfig(agent, mcp, opts.homeDir, opts.registration, opts.projectDir);
-    const installed = (await readAgentRegistrations(agent, opts.homeDir, opts.projectDir)).find((registration) => registration.name === opts.registration.name);
+    await registerAgentConfig(agent, mcp, homeDir, opts.registration, projectDir, codexHome);
+    const installed = (await readAgentRegistrations(agent, homeDir, projectDir, codexHome)).find((registration) => registration.name === opts.registration.name);
     const expectedEnvironment = registrationEnvironment(agent, opts.registration);
     if (!installed || installed.command !== mcp.command || JSON.stringify(installed.args) !== JSON.stringify(mcp.args) || Object.entries(expectedEnvironment).some(([key, value]) => installed.env[key] !== value)) {
       throw new Error(`Host configuration did not retain the ${opts.registration.name} MCP registration.`);
@@ -7265,12 +7408,12 @@ function resolveTargets(opts) {
   if (opts.all) return [...SUPPORTED_AGENT_IDS];
   const homeDir = opts.homeDir ?? homedir5();
   const detectBinaries = homeDir === homedir5();
-  const detected = SUPPORTED_AGENT_IDS.filter((agent) => agentConfigExists(agent, homeDir, opts.project) || detectBinaries && agentBinaryExists(agent));
+  const detected = SUPPORTED_AGENT_IDS.filter((agent) => agentConfigExists(agent, homeDir, opts.project, opts.codexHome) || detectBinaries && agentBinaryExists(agent));
   return [.../* @__PURE__ */ new Set(["claude", "codex", ...detected])];
 }
 function registerSkillsCommand(program2) {
   const skills = program2.command("skills").description("Install the Topolo agent skill + MCP server into supported agent hosts");
-  skills.command("install").description("Copy the skill file and register the topolo MCP server (credential-free)").option("--claude", "Target Claude Code only").option("--codex", "Target Codex only").option("--agent <host...>", "Target one or more hosts by id (for example cursor gemini)").option("--all", "Configure every supported local host").option("--project <dir>", "Write project-scoped host files under <dir> where supported").option("--agent-home <dir>", "Target an alternate agent home (managed installs and clean-room verification)").option("--name <name>", "Register a named pinned MCP, such as topolo-acme").option("--context <context>", "Pin the named MCP to an exact context returned by topolo context ls").option("--installation <id>", "Bind the MCP runtime to a registered external-agent installation").option("--no-mcp", "Copy the skill file but do not register the MCP server").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
+  skills.command("install").description("Copy the skill file and register the topolo MCP server (credential-free)").option("--claude", "Target Claude Code only").option("--codex", "Target Codex only").option("--agent <host...>", "Target one or more hosts by id (for example cursor gemini)").option("--all", "Configure every supported local host").option("--project <dir>", "Write project-scoped host files under <dir> where supported").option("--codex-home <dir>", "Use an explicit native Codex home instead of <agent-home>/.codex").option("--agent-home <dir>", "Target an alternate agent home (managed installs and clean-room verification)").option("--name <name>", "Register a named pinned MCP, such as topolo-acme").option("--context <context>", "Pin the named MCP to an exact context returned by topolo context ls").option("--installation <id>", "Bind the MCP runtime to a registered external-agent installation").option("--no-mcp", "Copy the skill file but do not register the MCP server").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(
     async (opts) => {
       const mode = resolveOutputMode(opts.json);
       try {
@@ -7286,11 +7429,12 @@ function registerSkillsCommand(program2) {
       }
     }
   );
-  skills.command("status").description("List public Topolo skill and MCP registrations for each agent").option("--agent <host...>", "Inspect one or more hosts by id").option("--all", "Inspect every supported host").option("--project <dir>", "Inspect project-scoped host files under <dir>").option("--agent-home <dir>", "Inspect an alternate agent home").option("--name <name>", "Inspect one registration name").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
+  skills.command("status").description("List public Topolo skill and MCP registrations for each agent").option("--agent <host...>", "Inspect one or more hosts by id").option("--all", "Inspect every supported host").option("--project <dir>", "Inspect project-scoped host files under <dir>").option("--codex-home <dir>", "Use an explicit native Codex home instead of <agent-home>/.codex").option("--agent-home <dir>", "Inspect an alternate agent home").option("--name <name>", "Inspect one registration name").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const rows = await agentSurfaceStatus({
-        homeDir: opts.agentHome ? resolve2(opts.agentHome) : void 0,
+        homeDir: opts.agentHome ? resolve3(opts.agentHome) : void 0,
+        codexHome: opts.codexHome,
         name: opts.name,
         agent: opts.agent,
         all: opts.all,
@@ -7301,12 +7445,12 @@ function registerSkillsCommand(program2) {
       fail2(err, mode);
     }
   });
-  skills.command("uninstall").description("Remove the skill file and MCP registration for each agent").option("--claude", "Target Claude Code only").option("--codex", "Target Codex only").option("--agent <host...>", "Target one or more hosts by id").option("--all", "Remove from every supported host").option("--project <dir>", "Remove project-scoped host files under <dir>").option("--agent-home <dir>", "Target an alternate agent home (managed installs and clean-room verification)").option("--name <name>", "Remove one registration (defaults to topolo)").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
+  skills.command("uninstall").description("Remove the skill file and MCP registration for each agent").option("--claude", "Target Claude Code only").option("--codex", "Target Codex only").option("--agent <host...>", "Target one or more hosts by id").option("--all", "Remove from every supported host").option("--project <dir>", "Remove project-scoped host files under <dir>").option("--codex-home <dir>", "Use an explicit native Codex home instead of <agent-home>/.codex").option("--agent-home <dir>", "Target an alternate agent home (managed installs and clean-room verification)").option("--name <name>", "Remove one registration (defaults to topolo)").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const removed = await uninstallAgentSurfaces({
         ...opts,
-        homeDir: opts.agentHome ? resolve2(opts.agentHome) : void 0
+        homeDir: opts.agentHome ? resolve3(opts.agentHome) : void 0
       });
       emit(
         { removed },
@@ -7325,20 +7469,20 @@ async function installAgentSurfaces(opts) {
   }
   const mcp = resolveMcpCommand();
   const registration = resolveMcpRegistration(opts);
-  const homeDir = opts.homeDir ?? homedir5();
+  const target = resolveAgentHostTarget({ homeDir: opts.homeDir, projectDir: opts.project, codexHome: opts.codexHome });
+  const { homeDir, projectDir, codexHome } = target;
   const results = [];
-  for (const agent of resolveTargets({ ...opts, homeDir, project: opts.project })) {
+  for (const agent of resolveTargets({ ...opts, homeDir, project: projectDir, codexHome })) {
     results.push(await installForAgent(agent, sourceDir, mcp, {
       withMcp: opts.mcp !== false,
-      projectDir: opts.project,
-      homeDir,
+      target,
       registration
     }));
   }
   return { results, mcp };
 }
 function registerSetupCommand(program2) {
-  program2.command("setup").description("Install the Topolo skill and deterministic local MCP server for supported agent hosts").option("--claude", "Target Claude Code only").option("--codex", "Target Codex only").option("--agent <host...>", "Target one or more hosts by id").option("--all", "Configure every supported local host").option("--project <dir>", "Write project-scoped host files under <dir> where supported").option("--agent-home <dir>", "Target an alternate agent home (managed installs and clean-room verification)").option("--name <name>", "Register a named pinned MCP, such as topolo-acme").option("--context <context>", "Pin the named MCP to an exact context returned by topolo context ls").option("--installation <id>", "Bind the MCP runtime to a registered external-agent installation").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
+  program2.command("setup").description("Install the Topolo skill and deterministic local MCP server for supported agent hosts").option("--claude", "Target Claude Code only").option("--codex", "Target Codex only").option("--agent <host...>", "Target one or more hosts by id").option("--all", "Configure every supported local host").option("--project <dir>", "Write project-scoped host files under <dir> where supported").option("--codex-home <dir>", "Use an explicit native Codex home instead of <agent-home>/.codex").option("--agent-home <dir>", "Target an alternate agent home (managed installs and clean-room verification)").option("--name <name>", "Register a named pinned MCP, such as topolo-acme").option("--context <context>", "Pin the named MCP to an exact context returned by topolo context ls").option("--installation <id>", "Bind the MCP runtime to a registered external-agent installation").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
     const mode = resolveOutputMode(opts.json);
     try {
       const { results, mcp } = await installAgentSurfaces({
@@ -7360,18 +7504,20 @@ function assertAgentSetupSucceeded(results) {
   }
 }
 async function agentSurfaceStatus(options = {}) {
-  const homeDir = options.homeDir ?? homedir5();
+  const target = resolveAgentHostTarget({ homeDir: options.homeDir, projectDir: options.project, codexHome: options.codexHome });
+  const { homeDir, projectDir, codexHome } = target;
   const sourceSkill = await readFile6(join7(skillsSourceDir(), "topolo", "SKILL.md"), "utf8");
   const agents = resolveTargets({
     agent: options.agent,
     all: options.all,
     homeDir,
-    project: options.project
+    project: projectDir,
+    codexHome
   });
   return Promise.all(agents.map(async (agent) => {
-    const skillPath = agentSkillPath(agent, homeDir, options.project);
+    const skillPath = agentSkillPath(agent, homeDir, projectDir, codexHome);
     const installedSkill = skillPath && existsSync6(skillPath) ? await readFile6(skillPath, "utf8") : void 0;
-    const registrations = (await readAgentRegistrations(agent, homeDir, options.project)).filter((registration) => !options.name || registration.name === options.name);
+    const registrations = (await readAgentRegistrations(agent, homeDir, projectDir, codexHome)).filter((registration) => !options.name || registration.name === options.name);
     return {
       agent,
       skillInstalled: installedSkill !== void 0,
@@ -7384,16 +7530,17 @@ async function agentSurfaceStatus(options = {}) {
   }));
 }
 async function uninstallAgentSurfaces(options) {
-  const homeDir = options.homeDir ?? homedir5();
+  const target = resolveAgentHostTarget({ homeDir: options.homeDir, projectDir: options.project, codexHome: options.codexHome });
+  const { homeDir, projectDir, codexHome } = target;
   const name = options.name?.trim() || "topolo";
   resolveMcpRegistration({ name, ...name === "topolo" ? {} : { context: "uninstall-validation" } });
   const removed = [];
-  for (const agent of resolveTargets({ ...options, homeDir, project: options.project })) {
-    const before = await readAgentRegistrations(agent, homeDir, options.project);
+  for (const agent of resolveTargets({ ...options, homeDir, project: projectDir, codexHome })) {
+    const before = await readAgentRegistrations(agent, homeDir, projectDir, codexHome);
     const registrationRemoved = before.some((entry) => entry.name === name);
-    await unregisterAgentConfig(agent, homeDir, name, options.project);
-    const remaining = await readAgentRegistrations(agent, homeDir, options.project);
-    const skillPath = agentSkillPath(agent, homeDir, options.project);
+    await unregisterAgentConfig(agent, homeDir, name, projectDir, codexHome);
+    const remaining = await readAgentRegistrations(agent, homeDir, projectDir, codexHome);
+    const skillPath = agentSkillPath(agent, homeDir, projectDir, codexHome);
     const skillRemoved = remaining.length === 0 && Boolean(skillPath && existsSync6(skillPath));
     if (skillRemoved && skillPath) await rm2(dirname6(skillPath), { recursive: true, force: true });
     removed.push({ agent, name, registrationRemoved, skillRemoved });
@@ -7426,7 +7573,7 @@ function formatStatus(rows) {
 // src/commands/doctor.ts
 import { access } from "fs/promises";
 import { homedir as homedir6 } from "os";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 var defaultDependencies = {
@@ -7488,7 +7635,7 @@ async function verifyMcpProtocol(command, args, env = definedEnvironment(process
 }
 async function resolveInstalledDoctorTarget(options) {
   const name = options.name?.trim() || "topolo";
-  const homeDir = options.agentHome ? resolve3(options.agentHome) : homedir6();
+  const homeDir = options.agentHome ? resolve4(options.agentHome) : homedir6();
   const expected = resolveMcpCommand();
   const requestedAgents = resolveTargets({
     ...options,

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.8",
-  "topoloPublishedVersion": "0.13.8",
+  "version": "0.13.9",
+  "topoloPublishedVersion": "0.13.9",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",