@topolo/cli 0.3.0 → 0.4.1

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// ../topolo-sdk/dist/index.js
+// ../../../topolo-platform/packages/topolo-sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -3453,7 +3453,7 @@ function createTopolo(options) {
   };
 }
 
-// ../topolo-sdk/dist/node/credential-store.js
+// ../../../topolo-platform/packages/topolo-sdk/dist/node/credential-store.js
 import { mkdir, readFile, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir, platform } from "os";
@@ -3819,46 +3819,6 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
     return cred;
   }
 }
-async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
-  const config = await readConfig();
-  const profile = profileForEnvironment(config, environment);
-  const context = profile.contexts?.[key];
-  const credential = context?.credential;
-  if (!credential || credential.kind !== "access_token") return credential ?? null;
-  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
-  if (!credential.refreshToken || !credential.expiresAt || !oauthClientId) return credential;
-  const now = Math.floor(Date.now() / 1e3);
-  if (!options.force && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
-  try {
-    const oauth = new TopoloOAuth2({
-      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
-    });
-    const tokens = await oauth.refreshToken({
-      clientId: oauthClientId,
-      refreshToken: credential.refreshToken
-    });
-    const refreshed = {
-      kind: "access_token",
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
-    };
-    await writeConfig(writeProfileConfig(config, environment, {
-      ...profile.activeContext === key ? { credential: refreshed } : {},
-      contexts: {
-        ...profile.contexts ?? {},
-        [key]: {
-          ...context,
-          credential: refreshed,
-          oauthClientId
-        }
-      }
-    }));
-    return refreshed;
-  } catch {
-    return credential;
-  }
-}
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
@@ -11268,7 +11228,6 @@ function registerContextCommand(program2) {
       }
       const wantPersonal = /^(personal|me)$/i.test(target.trim());
       let resolved;
-      let exchangeCredential = cred;
       const needle = target.trim().toLowerCase();
       const storedEntry = Object.entries(profile.contexts ?? {}).find(([, candidate]) => {
         if (wantPersonal) return candidate.contextType === "personal";
@@ -11276,7 +11235,6 @@ function registerContextCommand(program2) {
       });
       const storedContext = storedEntry?.[1];
       if (storedEntry && storedContext?.credential) {
-        exchangeCredential = await refreshContextCredentialIfNeeded(environment, storedEntry[0]) ?? storedContext.credential;
         resolved = {
           contextType: storedContext.contextType,
           organizationId: storedContext.organizationId,
@@ -11305,7 +11263,7 @@ function registerContextCommand(program2) {
       }
       const key = contextKey(resolved.contextType, resolved.organizationId);
       const existing = profile.contexts?.[key];
-      const newCredential = await exchangeForContext(exchangeCredential, serviceUrls, {
+      const newCredential = await exchangeForContext(cred, serviceUrls, {
         type: resolved.contextType,
         id: resolved.organizationId
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {

package/skills/topolo/SKILL.md

@@ -48,6 +48,15 @@ topolo context use <organization-name|personal> --json
 topolo whoami --json
 ```
 
+For concurrent agents or multiple MCP connections, never coordinate by changing
+one shared active context. Register one named `topolo-mcp` process per context
+with both `TOPOLO_ENV` and `TOPOLO_CONTEXT`. The context selector accepts an
+exact key returned by `topolo context ls --json` (such as `personal` or
+`org:<orgId>`) or a unique stored organization id, slug, or name. Each process
+reads and refreshes only its pinned credential without changing the CLI or web
+session. Do not set `TOPOLO_CONTEXT` alongside an injected API key or access
+token because that credential already carries its immutable context.
+
 ## Mandatory clean-room workflow
 
 For every Topolo task, follow this sequence.
@@ -114,6 +123,10 @@ topolo actions call <read-action-id> \
 
 Provide `--resource-type` and `--resource-id` together. MCP read actions use `topolo_read_action` with the same separate resource fields.
 
+For API-key creation or updates, do not use the application's general resource list as the authorization decision. Discover and call Auth's `api_keys.options` action with the selected application and active organization. Its response is the complete caller-specific contract for that key operation: organization-wide scopes, deduplicated resource types, authorized resources, each resource's access level and allowed scopes, and whether key creation is allowed.
+
+Choose resource bindings before scopes. With no bindings, use only `organizationWideScopes`. With one or more bindings, use only the intersection of `allowedScopes` across every selected resource. Then validate and plan `api_keys.create` or `api_keys.update` with that exact selection. Never widen, merge, or infer eligibility from application metadata, organization ownership alone, or a resource returned in another organization context.
+
 ### 4. Validate locally
 
 Before every call, validate exact input against the published JSON Schema: