@topolo/mcp 0.14.1 → 0.14.3

package/README.md

@@ -55,6 +55,19 @@ entry point resolved from the installed CLI dependency graph. Advanced hosts
 may execute the exported `@topolo/mcp/stdio` entry directly, but customer setup
 must not use an `npx` launcher because that makes startup network-dependent.
 
+## Protected action handoff
+
+Local stdio action results return `topolo-secret:<id>` references instead of
+bearer credentials. Pass these references unchanged to subsequent published
+actions; SDK 0.21.3 resolves them internally using the OS protected store and
+masks them in plans and diagnostics. Entries are bound to the verified
+principal, organization, API key identity when present, and environment.
+References expire after 30 minutes; accessing an expired entry deletes it.
+Release finished workflow references with `topolo_release_action_secret`
+and `confirm: true`. This deletes local storage only, not the upstream grant.
+HTTP/Worker hosts remain redacted unless they explicitly configure a protected
+SDK store; local references cannot be transferred to a different host.
+
 ## Supported env vars
 
 | Var                          | Purpose                                               |

package/dist/dispatch.js

@@ -63,6 +63,28 @@ function publicMcpErrorMessage(error, fallback) {
   return error instanceof TopoloMcpPublicError ? error.message : fallback;
 }
 
+// src/action-secret-tools.ts
+var actionSecretTools = [{
+  name: "topolo_release_action_secret",
+  title: "Release a protected action reference",
+  description: "Deletes only a local protected handoff reference for the verified identity and environment. Does not revoke the upstream credential. Requires confirm:true.",
+  requiredScopes: [],
+  destructive: true,
+  inputSchema: {
+    type: "object",
+    properties: { reference: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+    required: ["reference", "confirm"],
+    additionalProperties: false
+  },
+  handler: async (topolo, args) => {
+    const reference = typeof args.reference === "string" ? args.reference.trim() : "";
+    if (!reference) throw new TopoloMcpPublicError("reference is required.");
+    if (args.confirm !== true) throw new TopoloMcpPublicError("Releasing a protected action reference requires confirm:true.");
+    await topolo.client.releaseActionSecret(reference);
+    return { released: true };
+  }
+}];
+
 // src/tools.ts
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var AGENT_INVOCATIONS_CREATE = "app_topolo_agent.agent_invocations.create";
@@ -125,6 +147,11 @@ function agentRunResult(invocation) {
       state: "approval_required",
       invocationId: invocation["invocationId"],
       verificationUrl: approval["verificationUrl"],
+      continuation: {
+        tool: "topolo_run_agent",
+        reuseSameInvocation: true,
+        arguments: { waitForApproval: true, waitSeconds: 120 }
+      },
       approval,
       invocation
     };
@@ -136,6 +163,7 @@ function agentRunResult(invocation) {
   };
 }
 var TOOLS = [
+  ...actionSecretTools,
   {
     name: "topolo_whoami",
     title: "Describe the current Topolo credential",
@@ -385,7 +413,7 @@ var TOOLS = [
   {
     name: "topolo_run_agent",
     title: "Run a Topolo agent to a durable checkpoint",
-    description: "Creates or replays one idempotent Topolo Agent invocation, polls its published status, and returns either the terminal result or an approval_required handoff with the exact Topolo verification URL. Reusing the same idempotencyKey never starts a duplicate invocation.",
+    description: "Creates or replays one idempotent Topolo Agent invocation, polls its published status, and returns either the terminal result or an approval_required handoff with the exact Topolo verification URL. Reusing the same idempotencyKey never starts a duplicate invocation. After showing the verification URL, immediately call this tool again with the same invocation and waitForApproval=true so the terminal result returns here.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -404,6 +432,11 @@ var TOOLS = [
           maximum: 120,
           default: 30,
           description: "Maximum time to poll. Returns state=running when the bounded wait elapses."
+        },
+        waitForApproval: {
+          type: "boolean",
+          default: false,
+          description: "Set only when resuming an approval_required handoff already shown to the human. Keeps polling the same idempotent invocation while approval is pending."
         }
       },
       required: ["invocation"],
@@ -417,6 +450,7 @@ var TOOLS = [
       }
       const resource = optionalResourceContext(args);
       const waitSeconds = typeof args["waitSeconds"] === "number" ? Math.max(0, Math.min(120, Math.floor(args["waitSeconds"]))) : 30;
+      const waitForApproval = args["waitForApproval"] === true;
       const createResult = await topolo.client.callAction(
         AGENT_INVOCATIONS_CREATE,
         invocationInput,
@@ -424,7 +458,7 @@ var TOOLS = [
       );
       let invocation = invocationFrom(createResult);
       const deadline = Date.now() + waitSeconds * 1e3;
-      while (invocation["terminal"] !== true && invocation["status"] !== "awaiting_approval" && Date.now() < deadline) {
+      while (invocation["terminal"] !== true && (invocation["status"] !== "awaiting_approval" || waitForApproval) && Date.now() < deadline) {
         const recommended = typeof invocation["recommendedPollAfterSeconds"] === "number" ? invocation["recommendedPollAfterSeconds"] : 2;
         const delayMs = Math.min(
           Math.max(250, recommended * 1e3),

package/dist/http.js

@@ -17790,6 +17790,28 @@ function splitService(servicePart) {
   return [servicePart.slice(0, idx), servicePart.slice(idx + 1)];
 }
 
+// src/action-secret-tools.ts
+var actionSecretTools = [{
+  name: "topolo_release_action_secret",
+  title: "Release a protected action reference",
+  description: "Deletes only a local protected handoff reference for the verified identity and environment. Does not revoke the upstream credential. Requires confirm:true.",
+  requiredScopes: [],
+  destructive: true,
+  inputSchema: {
+    type: "object",
+    properties: { reference: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+    required: ["reference", "confirm"],
+    additionalProperties: false
+  },
+  handler: async (topolo, args) => {
+    const reference = typeof args.reference === "string" ? args.reference.trim() : "";
+    if (!reference) throw new TopoloMcpPublicError("reference is required.");
+    if (args.confirm !== true) throw new TopoloMcpPublicError("Releasing a protected action reference requires confirm:true.");
+    await topolo.client.releaseActionSecret(reference);
+    return { released: true };
+  }
+}];
+
 // src/tools.ts
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var AGENT_INVOCATIONS_CREATE = "app_topolo_agent.agent_invocations.create";
@@ -17852,6 +17874,11 @@ function agentRunResult(invocation) {
       state: "approval_required",
       invocationId: invocation["invocationId"],
       verificationUrl: approval["verificationUrl"],
+      continuation: {
+        tool: "topolo_run_agent",
+        reuseSameInvocation: true,
+        arguments: { waitForApproval: true, waitSeconds: 120 }
+      },
       approval,
       invocation
     };
@@ -17863,6 +17890,7 @@ function agentRunResult(invocation) {
   };
 }
 var TOOLS = [
+  ...actionSecretTools,
   {
     name: "topolo_whoami",
     title: "Describe the current Topolo credential",
@@ -18112,7 +18140,7 @@ var TOOLS = [
   {
     name: "topolo_run_agent",
     title: "Run a Topolo agent to a durable checkpoint",
-    description: "Creates or replays one idempotent Topolo Agent invocation, polls its published status, and returns either the terminal result or an approval_required handoff with the exact Topolo verification URL. Reusing the same idempotencyKey never starts a duplicate invocation.",
+    description: "Creates or replays one idempotent Topolo Agent invocation, polls its published status, and returns either the terminal result or an approval_required handoff with the exact Topolo verification URL. Reusing the same idempotencyKey never starts a duplicate invocation. After showing the verification URL, immediately call this tool again with the same invocation and waitForApproval=true so the terminal result returns here.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -18131,6 +18159,11 @@ var TOOLS = [
           maximum: 120,
           default: 30,
           description: "Maximum time to poll. Returns state=running when the bounded wait elapses."
+        },
+        waitForApproval: {
+          type: "boolean",
+          default: false,
+          description: "Set only when resuming an approval_required handoff already shown to the human. Keeps polling the same idempotent invocation while approval is pending."
         }
       },
       required: ["invocation"],
@@ -18144,6 +18177,7 @@ var TOOLS = [
       }
       const resource = optionalResourceContext(args);
       const waitSeconds = typeof args["waitSeconds"] === "number" ? Math.max(0, Math.min(120, Math.floor(args["waitSeconds"]))) : 30;
+      const waitForApproval = args["waitForApproval"] === true;
       const createResult = await topolo.client.callAction(
         AGENT_INVOCATIONS_CREATE,
         invocationInput,
@@ -18151,7 +18185,7 @@ var TOOLS = [
       );
       let invocation = invocationFrom(createResult);
       const deadline = Date.now() + waitSeconds * 1e3;
-      while (invocation["terminal"] !== true && invocation["status"] !== "awaiting_approval" && Date.now() < deadline) {
+      while (invocation["terminal"] !== true && (invocation["status"] !== "awaiting_approval" || waitForApproval) && Date.now() < deadline) {
         const recommended = typeof invocation["recommendedPollAfterSeconds"] === "number" ? invocation["recommendedPollAfterSeconds"] : 2;
         const delayMs = Math.min(
           Math.max(250, recommended * 1e3),

package/dist/index.js

@@ -3,7 +3,7 @@
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
-// node_modules/.pnpm/@topolo+sdk@0.21.2/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.21.3/node_modules/@topolo/sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -22,54 +22,6 @@ function generateRequestId() {
   }
   return `req_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 10)}`;
 }
-var encoder = new TextEncoder();
-function encodeBase64Url(value) {
-  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function encodeJson(value) {
-  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
-}
-async function sha256Base64Url(value) {
-  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
-}
-function publicJwk(privateJwk) {
-  const { crv, kty, x, y } = privateJwk;
-  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
-    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
-  }
-  return { crv, kty, x, y };
-}
-function canonicalTargetUrl(value) {
-  const url = new URL(value);
-  return `${url.origin}${url.pathname}`;
-}
-async function createDpopProof(input) {
-  const jwk = publicJwk(input.privateJwk);
-  const key = await crypto.subtle.importKey(
-    "jwk",
-    input.privateJwk,
-    { name: "ECDSA", namedCurve: "P-256" },
-    false,
-    ["sign"]
-  );
-  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
-  const claims = encodeJson({
-    jti: crypto.randomUUID(),
-    iat: Math.floor(Date.now() / 1e3),
-    htm: input.method.toUpperCase(),
-    htu: canonicalTargetUrl(input.targetUrl),
-    ath: await sha256Base64Url(input.accessToken)
-  });
-  const signature = await crypto.subtle.sign(
-    { name: "ECDSA", hash: "SHA-256" },
-    key,
-    encoder.encode(`${header}.${claims}`)
-  );
-  return `${header}.${claims}.${encodeBase64Url(signature)}`;
-}
 var TopoloSdkError = class extends Error {
   code;
   constructor(code, message) {
@@ -391,6 +343,131 @@ var TopoloHttpError = class extends TopoloSdkError {
     );
   }
 };
+var ACTION_SECRET_PREFIX = "topolo-secret:";
+function isActionSecretReference(value) {
+  return typeof value === "string" && value.startsWith(ACTION_SECRET_PREFIX);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sensitive(key, value) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (normalized === "capability") {
+    if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
+    const text2 = value.trim();
+    return Boolean(text2) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text2);
+  }
+  return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
+}
+function maskActionSecrets(value, secrets) {
+  let masked = value;
+  for (const [secret, reference] of secrets) {
+    const encoded = encodeURIComponent(secret);
+    const variants = [.../* @__PURE__ */ new Set([secret, encoded])].map((item) => item.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    masked = masked.replace(new RegExp(variants.join("|"), "g"), (match) => match === secret ? reference : encodeURIComponent(reference));
+  }
+  return masked;
+}
+async function resolveActionSecrets(value, store, secrets) {
+  if (isActionSecretReference(value)) {
+    if (!store) throw new TopoloSdkError("action_secret_store_required", "Protected action references require a secret store.");
+    const resolved = await store.load(value);
+    if (typeof resolved === "string" && resolved) secrets.set(resolved, value);
+    return resolved;
+  }
+  if (Array.isArray(value)) return Promise.all(value.map((item) => resolveActionSecrets(item, store, secrets)));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, item]) => [key, await resolveActionSecrets(item, store, secrets)])));
+}
+async function protectActionResult(value, store) {
+  const secrets = /* @__PURE__ */ new Map();
+  async function protect(item, key = "") {
+    if (isActionSecretReference(item)) return item;
+    if (sensitive(key, item)) {
+      const reference = store ? await store.save(item) : "[REDACTED]";
+      if (typeof item === "string" && item) secrets.set(item, reference);
+      return reference;
+    }
+    if (Array.isArray(item)) return Promise.all(item.map((child) => protect(child)));
+    if (!isRecord(item)) return item;
+    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([name, child]) => [name, await protect(child, name)])));
+  }
+  const protectedValue = await protect(value);
+  async function protectEmbedded(item) {
+    if (typeof item === "string" && !isActionSecretReference(item) && maskActionSecrets(item, secrets) !== item) {
+      return store ? store.save(item) : maskActionSecrets(item, secrets);
+    }
+    if (Array.isArray(item)) return Promise.all(item.map(protectEmbedded));
+    if (!isRecord(item)) return item;
+    return Object.fromEntries(await Promise.all(Object.entries(item).map(async ([key, child]) => [key, await protectEmbedded(child)])));
+  }
+  return protectEmbedded(protectedValue);
+}
+function maskActionSecretValue(value, secrets) {
+  if (value instanceof Error) return maskActionSecretError(value, secrets);
+  if (typeof value === "string") return maskActionSecrets(value, secrets);
+  if (Array.isArray(value)) return value.map((item) => maskActionSecretValue(item, secrets));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, maskActionSecretValue(item, secrets)]));
+}
+function maskActionSecretError(error, secrets) {
+  if (!(error instanceof Error)) return maskActionSecretValue(error, secrets);
+  const masked = Object.create(Object.getPrototypeOf(error));
+  for (const key of Object.getOwnPropertyNames(error)) {
+    const descriptor = Object.getOwnPropertyDescriptor(error, key);
+    if ("value" in descriptor) descriptor.value = maskActionSecretValue(descriptor.value, secrets);
+    Object.defineProperty(masked, key, descriptor);
+  }
+  return masked;
+}
+var encoder = new TextEncoder();
+function encodeBase64Url(value) {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeJson(value) {
+  return encodeBase64Url(encoder.encode(JSON.stringify(value)));
+}
+async function sha256Base64Url(value) {
+  return encodeBase64Url(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+}
+function publicJwk(privateJwk) {
+  const { crv, kty, x, y } = privateJwk;
+  if (kty !== "EC" || crv !== "P-256" || !x || !y || !privateJwk.d) {
+    throw new TypeError("A private P-256 JSON Web Key is required for DPoP signing.");
+  }
+  return { crv, kty, x, y };
+}
+function canonicalTargetUrl(value) {
+  const url = new URL(value);
+  return `${url.origin}${url.pathname}`;
+}
+async function createDpopProof(input) {
+  const jwk = publicJwk(input.privateJwk);
+  const key = await crypto.subtle.importKey(
+    "jwk",
+    input.privateJwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  const header = encodeJson({ alg: "ES256", typ: "dpop+jwt", jwk });
+  const claims = encodeJson({
+    jti: crypto.randomUUID(),
+    iat: Math.floor(Date.now() / 1e3),
+    htm: input.method.toUpperCase(),
+    htu: canonicalTargetUrl(input.targetUrl),
+    ath: await sha256Base64Url(input.accessToken)
+  });
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    key,
+    encoder.encode(`${header}.${claims}`)
+  );
+  return `${header}.${claims}.${encodeBase64Url(signature)}`;
+}
 function hostnameHasSuffix(hostname, suffix) {
   return hostname === suffix || hostname.endsWith(`.${suffix}`);
 }
@@ -564,9 +641,9 @@ function inspectSchema(schema, path, root, depth) {
     return { path, code: "unsupported_schema_ref", message: `Cannot resolve schema reference ${schema.$ref}.` };
   }
   const children = [];
-  if (isRecord(schema.properties)) children.push(...Object.entries(schema.properties));
-  if (isRecord(schema.$defs)) children.push(...Object.entries(schema.$defs));
-  if (isRecord(schema.definitions)) children.push(...Object.entries(schema.definitions));
+  if (isRecord2(schema.properties)) children.push(...Object.entries(schema.properties));
+  if (isRecord2(schema.$defs)) children.push(...Object.entries(schema.$defs));
+  if (isRecord2(schema.definitions)) children.push(...Object.entries(schema.definitions));
   children.push(
     ["additionalProperties", schema.additionalProperties],
     ["propertyNames", schema.propertyNames],
@@ -576,7 +653,7 @@ function inspectSchema(schema, path, root, depth) {
     ...arraySchemaEntries("oneOf", schema.oneOf)
   );
   for (const [key, child] of children) {
-    if (!isRecord(child)) continue;
+    if (!isRecord2(child)) continue;
     const issue = inspectSchema(child, `${path}.${key}`, root, depth + 1);
     if (issue) return issue;
   }
@@ -600,7 +677,7 @@ function validateNode(schema, value, path, root, errors, depth) {
   }
   if (Array.isArray(schema.allOf)) {
     for (const candidate of schema.allOf) {
-      if (isRecord(candidate)) validateNode(candidate, value, path, root, errors, depth + 1);
+      if (isRecord2(candidate)) validateNode(candidate, value, path, root, errors, depth + 1);
     }
   }
   if (Array.isArray(schema.anyOf) && !schema.anyOf.some((candidate) => candidateMatches(candidate, value, root, depth))) {
@@ -630,7 +707,7 @@ function validateNode(schema, value, path, root, errors, depth) {
   if (typeof value === "string") validateString(schema, value, path, errors);
   if (typeof value === "number") validateNumber(schema, value, path, errors);
   if (Array.isArray(value)) validateArray(schema, value, path, root, errors, depth);
-  if (isRecord(value)) validateObject(schema, value, path, root, errors, depth);
+  if (isRecord2(value)) validateObject(schema, value, path, root, errors, depth);
 }
 function validateObject(schema, value, path, root, errors, depth) {
   if (typeof schema.minProperties === "number" && Object.keys(value).length < schema.minProperties) {
@@ -639,25 +716,25 @@ function validateObject(schema, value, path, root, errors, depth) {
   if (typeof schema.maxProperties === "number" && Object.keys(value).length > schema.maxProperties) {
     errors.push({ path, code: "max_properties", message: `Expected at most ${schema.maxProperties} properties.` });
   }
-  const properties = isRecord(schema.properties) ? schema.properties : {};
+  const properties = isRecord2(schema.properties) ? schema.properties : {};
   const required = Array.isArray(schema.required) ? schema.required.map(String) : [];
   for (const key of required) {
     if (!Object.prototype.hasOwnProperty.call(value, key)) {
       errors.push({ path: `${path}.${key}`, code: "required", message: "Required property is missing." });
     }
   }
-  if (isRecord(schema.propertyNames)) {
+  if (isRecord2(schema.propertyNames)) {
     for (const key of Object.keys(value)) {
       validateNode(schema.propertyNames, key, `${path}.${key}`, root, errors, depth + 1);
     }
   }
   for (const [key, child] of Object.entries(value)) {
     const childSchema = properties[key];
-    if (isRecord(childSchema)) {
+    if (isRecord2(childSchema)) {
       validateNode(childSchema, child, `${path}.${key}`, root, errors, depth + 1);
     } else if (schema.additionalProperties === false) {
       errors.push({ path: `${path}.${key}`, code: "additional_property", message: "Property is not declared by the action schema." });
-    } else if (isRecord(schema.additionalProperties)) {
+    } else if (isRecord2(schema.additionalProperties)) {
       validateNode(schema.additionalProperties, child, `${path}.${key}`, root, errors, depth + 1);
     }
   }
@@ -673,7 +750,7 @@ function validateArray(schema, value, path, root, errors, depth) {
     const unique = new Set(value.map((item) => JSON.stringify(item)));
     if (unique.size !== value.length) errors.push({ path, code: "unique_items", message: "Expected every item to be unique." });
   }
-  if (isRecord(schema.items)) {
+  if (isRecord2(schema.items)) {
     value.forEach((item, index) => validateNode(schema.items, item, `${path}[${index}]`, root, errors, depth + 1));
   }
 }
@@ -711,7 +788,7 @@ function validateNumber(schema, value, path, errors) {
   }
 }
 function candidateMatches(candidate, value, root, depth) {
-  if (!isRecord(candidate)) return false;
+  if (!isRecord2(candidate)) return false;
   const issues = [];
   validateNode(candidate, value, "$", root, issues, depth + 1);
   return issues.length === 0;
@@ -725,24 +802,24 @@ function resolveLocalReference(root, reference) {
       current = current[Number(token)];
       continue;
     }
-    if (!isRecord(current) || !Object.prototype.hasOwnProperty.call(current, token)) return null;
+    if (!isRecord2(current) || !Object.prototype.hasOwnProperty.call(current, token)) return null;
     current = current[token];
   }
-  return isRecord(current) ? current : null;
+  return isRecord2(current) ? current : null;
 }
 function matchesType(type, value) {
   if (type === void 0) return true;
   if (Array.isArray(type)) return type.some((candidate) => matchesType(candidate, value));
   if (type === "null") return value === null;
   if (type === "array") return Array.isArray(value);
-  if (type === "object") return isRecord(value);
+  if (type === "object") return isRecord2(value);
   if (type === "integer") return typeof value === "number" && Number.isInteger(value);
   return typeof value === type;
 }
 function sameJsonValue(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function isUrl(value) {
@@ -977,7 +1054,7 @@ function fail(path, message) {
   throw new ActorEnvelopeValidationError(path, message);
 }
 function parseTopoloActionUploadContract(value) {
-  if (!isRecord2(value) || value.profile !== "inline-base64" && value.profile !== "url-session") {
+  if (!isRecord3(value) || value.profile !== "inline-base64" && value.profile !== "url-session") {
     throw new TopoloSdkError("upload_contract_unavailable", "This action does not publish a supported upload contract.");
   }
   const contentTypeField = requiredField(value.contentTypeField, "contentTypeField");
@@ -1056,17 +1133,17 @@ function prepareTopoloUrlSessionUploadInput(contractValue, byteLength, input, op
   };
 }
 function topoloUploadResponseValue(response, path) {
-  return path.split(".").reduce((value, segment) => isRecord2(value) ? value[segment] : void 0, response);
+  return path.split(".").reduce((value, segment) => isRecord3(value) ? value[segment] : void 0, response);
 }
 function redactTopoloUrlSessionResult(response, uploadUrlPath) {
   const redacted = cloneUploadValue(response);
   let target = redacted;
   const segments = uploadUrlPath.split(".");
   for (const segment of segments.slice(0, -1)) {
-    target = isRecord2(target) ? target[segment] : void 0;
+    target = isRecord3(target) ? target[segment] : void 0;
   }
   const finalSegment = segments.at(-1);
-  if (finalSegment && isRecord2(target) && finalSegment in target) target[finalSegment] = "[REDACTED]";
+  if (finalSegment && isRecord3(target) && finalSegment in target) target[finalSegment] = "[REDACTED]";
   redactUploadHeaders(redacted);
   return redacted;
 }
@@ -1090,7 +1167,7 @@ function mapUploadInput(contract, contentBase64, input, options) {
 }
 function cloneUploadValue(value) {
   if (Array.isArray(value)) return value.map(cloneUploadValue);
-  if (!isRecord2(value)) return value;
+  if (!isRecord3(value)) return value;
   return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, cloneUploadValue(item)]));
 }
 function redactUploadHeaders(value) {
@@ -1098,9 +1175,9 @@ function redactUploadHeaders(value) {
     value.forEach(redactUploadHeaders);
     return;
   }
-  if (!isRecord2(value)) return;
+  if (!isRecord3(value)) return;
   for (const [key, item] of Object.entries(value)) {
-    if (key.toLowerCase() === "headers" && isRecord2(item)) {
+    if (key.toLowerCase() === "headers" && isRecord3(item)) {
       for (const header of Object.keys(item)) {
         if (["authorization", "cookie", "set-cookie", "proxy-authorization", "x-api-key"].includes(header.toLowerCase())) {
           item[header] = "[REDACTED]";
@@ -1129,7 +1206,7 @@ function decodedBase64Size(contentBase64) {
   return contentBase64.length / 4 * 3 - padding;
 }
 function parseCompleteContract(value) {
-  if (!isRecord2(value)) throw new TopoloSdkError("invalid_upload_contract", "The action upload completion contract is invalid.");
+  if (!isRecord3(value)) throw new TopoloSdkError("invalid_upload_contract", "The action upload completion contract is invalid.");
   return {
     actionId: requiredPath(value.actionId, "complete.actionId"),
     inputField: requiredField(value.inputField, "complete.inputField"),
@@ -1167,7 +1244,7 @@ function encodeTopoloActionBase64(bytes) {
   }
   return btoa(binary);
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
@@ -1178,6 +1255,8 @@ var TOPOLO_RESOURCE_ID_HEADER = "X-Topolo-Resource-ID";
 var POSITIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
 var NEGATIVE_CACHE_TTL_MS = 60 * 1e3;
 var TopoloClient = class _TopoloClient {
+  actionSecretStore;
+  actionSecrets = /* @__PURE__ */ new Map();
   credential;
   agent;
   actorContext;
@@ -1207,6 +1286,7 @@ var TopoloClient = class _TopoloClient {
     _TopoloClient.appIdCache.clear();
   }
   constructor(options) {
+    this.actionSecretStore = options.actionSecretStore;
     if (!options.credential) throw new TopoloAuthError("credential is required");
     if (!options.agent?.clientName) throw new TopoloAuthError("agent.clientName is required");
     this.credential = options.credential;
@@ -1228,6 +1308,7 @@ var TopoloClient = class _TopoloClient {
   }
   emit(event) {
     if (!this.debug) return;
+    event = maskActionSecretValue(event, this.actionSecrets);
     try {
       this.debug(event);
     } catch {
@@ -1613,7 +1694,7 @@ var TopoloClient = class _TopoloClient {
     }
     const entries = [];
     for (const item of raw) {
-      if (!isRecord3(item)) continue;
+      if (!isRecord4(item)) continue;
       const s = item;
       const appId = typeof s.app_id === "string" ? s.app_id : typeof s.id === "string" ? s.id : null;
       if (!appId) continue;
@@ -1688,8 +1769,8 @@ var TopoloClient = class _TopoloClient {
       "app_topolo_auth.service_api_key_resources.list",
       { appId: service.appId }
     );
-    const payload = isRecord3(response) && isRecord3(response.data) ? response.data : response;
-    if (!isRecord3(payload) || !Array.isArray(payload.resources)) {
+    const payload = isRecord4(response) && isRecord4(response.data) ? response.data : response;
+    if (!isRecord4(payload) || !Array.isArray(payload.resources)) {
       throw new TopoloSdkError("resource_catalog_unavailable", "TopoloAuth did not return bindable resources.");
     }
     return {
@@ -1870,17 +1951,20 @@ var TopoloClient = class _TopoloClient {
   }
   async validateActionInput(action, input = {}) {
     const entry = await this.getAction(action);
-    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, input) };
+    const resolved = await resolveActionSecrets(input, this.actionSecretStore, this.actionSecrets);
+    return { action: entry, validation: validateTopoloActionInput(entry.inputSchema, resolved) };
   }
   async planAction(action, input = {}, options = {}) {
     const entry = await this.getAction(action);
-    return this.planResolvedAction(entry, input, options);
+    const resolved = await resolveActionSecrets(input, this.actionSecretStore, this.actionSecrets);
+    return this.planResolvedAction(entry, resolved, options);
   }
   async prepareAction(action, input, options = {}) {
     const entry = await this.getAction(action);
     const example = (entry.agentContract?.examples ?? []).find((candidate) => Boolean(candidate?.input) && typeof candidate.input === "object" && !Array.isArray(candidate.input) && validateTopoloActionInput(entry.inputSchema, candidate.input).valid) ?? null;
     const selectedInput = input ?? example?.input ?? {};
-    const plan = this.planResolvedAction(entry, selectedInput, options);
+    const resolved = await resolveActionSecrets(selectedInput, this.actionSecretStore, this.actionSecrets);
+    const plan = this.planResolvedAction(entry, resolved, options);
     return {
       action: entry,
       example,
@@ -1917,7 +2001,7 @@ var TopoloClient = class _TopoloClient {
       confirmationRequired,
       confirmationProvided: options.confirm === true,
       executable: validation.valid && agentAccess !== "off" && (!confirmationRequired || options.confirm === true),
-      request,
+      request: maskActionSecretValue(request, this.actionSecrets),
       verification: stringArray(entry.agentContract?.verify),
       rollbackActionId: pickActionString(entry.agentContract?.rollbackActionId),
       nextActionIds: stringArray(entry.agentContract?.nextActionIds)
@@ -1947,6 +2031,7 @@ var TopoloClient = class _TopoloClient {
         `Topolo action "${entry.actionId}" requires { confirm: true } before invocation.`
       );
     }
+    input = await resolveActionSecrets(input, this.actionSecretStore, this.actionSecrets);
     const validation = validateTopoloActionInput(entry.inputSchema, input);
     if (!validation.valid) {
       throw new TopoloSdkError(
@@ -1977,22 +2062,31 @@ var TopoloClient = class _TopoloClient {
       }
     }
     const service = entry.appSlug || entry.appId;
-    const result = await this.request({
-      service,
-      ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
-      method: entry.method,
-      path: mapped.path,
-      ...mapped.query ? { query: mapped.query } : {},
-      ...mapped.body !== void 0 ? { body: mapped.body } : {},
-      ...options.resource ? { resource: options.resource } : {},
-      ...resolvedActorEnvelope ? { actorEnvelope: resolvedActorEnvelope } : {},
-      headers: {
-        [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
-        [TOPOLO_ACTION_NAME_HEADER]: entry.name
-      },
-      confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
-    });
-    return preserveSensitiveResult ? result : redactActionResult(result);
+    let result;
+    try {
+      result = await this.request({
+        service,
+        ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
+        method: entry.method,
+        path: mapped.path,
+        ...mapped.query ? { query: mapped.query } : {},
+        ...mapped.body !== void 0 ? { body: mapped.body } : {},
+        ...options.resource ? { resource: options.resource } : {},
+        ...resolvedActorEnvelope ? { actorEnvelope: resolvedActorEnvelope } : {},
+        headers: {
+          [TOPOLO_ACTION_ID_HEADER]: entry.actionId,
+          [TOPOLO_ACTION_NAME_HEADER]: entry.name
+        },
+        confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
+      });
+    } catch (error) {
+      throw maskActionSecretError(error, this.actionSecrets);
+    }
+    return preserveSensitiveResult ? result : await protectActionResult(result, this.actionSecretStore);
+  }
+  async releaseActionSecret(reference) {
+    if (!this.actionSecretStore) throw new TopoloSdkError("action_secret_store_required", "Protected action references require a secret store.");
+    await this.actionSecretStore.delete(reference);
   }
   async buildVerifiedAgentActorEnvelope(actionId, input, resource) {
     if (!this.actorContext) return void 0;
@@ -2139,7 +2233,7 @@ function resolveConfiguredAppId(slug, appIds) {
   return null;
 }
 function normalizeApiKeyResourceMetadata(input) {
-  if (!isRecord3(input)) return null;
+  if (!isRecord4(input)) return null;
   const resourceType = readString(input.resourceType ?? input.resource_type);
   const label = readString(input.label);
   const emptyLabel = readString(input.emptyLabel ?? input.empty_label);
@@ -2173,7 +2267,7 @@ function normalizeApiKeyResourceMetadataList(input) {
   return resources;
 }
 function normalizeBindableResource(input) {
-  if (!isRecord3(input)) return null;
+  if (!isRecord4(input)) return null;
   const resourceType = readString(input.resourceType ?? input.resource_type);
   const resourceId = readString(input.resourceId ?? input.resource_id);
   if (!resourceType || !resourceId) return null;
@@ -2184,13 +2278,13 @@ function normalizeBindableResource(input) {
     slug: readOptionalString(input.slug),
     status: readOptionalString(input.status),
     organizationId: readOptionalString(input.organizationId ?? input.organization_id),
-    metadata: isRecord3(input.metadata) ? input.metadata : {}
+    metadata: isRecord4(input.metadata) ? input.metadata : {}
   };
 }
 function normalizeResourceBindings(input) {
   if (!Array.isArray(input)) return [];
   return input.flatMap((binding) => {
-    if (!isRecord3(binding)) return [];
+    if (!isRecord4(binding)) return [];
     const resourceType = readString(binding.resourceType ?? binding.resource_type);
     const resourceId = readString(binding.resourceId ?? binding.resource_id);
     return resourceType && resourceId ? [{ resourceType, resourceId }] : [];
@@ -2203,30 +2297,9 @@ function readOptionalString(value) {
   const normalized = readString(value);
   return normalized || null;
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function redactActionResult(value) {
-  if (Array.isArray(value)) return value.map(redactActionResult);
-  if (!isRecord3(value)) return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    isSensitiveActionResultKey(key, item) ? "[REDACTED]" : redactActionResult(item)
-  ]));
-}
-function isSensitiveActionResultKey(key, value) {
-  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
-  if (normalized === "capability") return isCredentialShaped(value);
-  return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
-}
-var PLAIN_ENUM_VALUE = /^[a-z][a-z0-9_-]{0,31}$/;
-function isCredentialShaped(value) {
-  if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
-  const trimmed = value.trim();
-  if (!trimmed) return false;
-  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) return true;
-  return !PLAIN_ENUM_VALUE.test(trimmed);
-}
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = serviceUrls?.[serviceKey];
@@ -2296,14 +2369,14 @@ function catalogSearchQuery(options) {
   return query;
 }
 function normalizeCatalogPage(value) {
-  if (!isRecord3(value)) return { nextCursor: null, hasMore: false };
+  if (!isRecord4(value)) return { nextCursor: null, hasMore: false };
   return {
     nextCursor: typeof value.nextCursor === "string" && value.nextCursor ? value.nextCursor : null,
     hasMore: value.hasMore === true
   };
 }
 function normalizeServiceCatalogEntry(item) {
-  if (!isRecord3(item)) return null;
+  if (!isRecord4(item)) return null;
   const appId = typeof item.app_id === "string" ? item.app_id : typeof item.id === "string" ? item.id : null;
   if (!appId) return null;
   const permissions = Array.isArray(item.granted_permissions) ? item.granted_permissions.filter(
@@ -3254,11 +3327,13 @@ function createTopolo(options) {
   };
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.21.2/node_modules/@topolo/sdk/dist/node/credential-store.js
+// node_modules/.pnpm/@topolo+sdk@0.21.3/node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
+import { createHash, randomUUID } from "crypto";
+import { join as join2 } from "path";
 import { spawnSync } from "child_process";
 import { mkdir, readFile, readdir, rename, rm, writeFile, chmod } from "fs/promises";
 import { existsSync } from "fs";
@@ -3610,66 +3685,7 @@ var TopoloOAuth = class {
     return parsed;
   }
 };
-var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
-  production: {
-    auth: "https://auth.topolo.app",
-    developers: "https://developers.topolo.app"
-  },
-  staging: {
-    auth: "https://auth.stg.topolo.us",
-    developers: "https://developers.stg.topolo.us"
-  },
-  development: {
-    auth: "https://auth.topolo.dev",
-    developers: "https://developers.topolo.dev"
-  },
-  local: {}
-};
-function hostnameHasSuffix2(hostname, suffix) {
-  return hostname === suffix || hostname.endsWith(`.${suffix}`);
-}
-function workersDevAccountMatches2(hostname, account) {
-  if (!hostname.endsWith(".workers.dev")) return false;
-  const labels = hostname.slice(0, -".workers.dev".length).split(".");
-  return labels.length >= 2 && labels.at(-1) === account;
-}
-function originMatchesEnvironment2(url, environment) {
-  const hostname = url.hostname.toLowerCase();
-  if (environment === "local") {
-    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
-  }
-  if (url.protocol !== "https:") return false;
-  if (environment === "production") {
-    return hostnameHasSuffix2(hostname, "topolo.app") || hostnameHasSuffix2(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches2(hostname, "topolo");
-  }
-  if (environment === "staging") {
-    return hostnameHasSuffix2(hostname, "stg.topolo.us") || workersDevAccountMatches2(hostname, "topolo-staging");
-  }
-  return hostnameHasSuffix2(hostname, "topolo.dev") || workersDevAccountMatches2(hostname, "topolo-development");
-}
-function assertTopoloServiceUrlEnvironment2(service, value, environment) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new TopoloSdkError2("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment2(url, environment)) {
-    throw new TopoloSdkError2(
-      "environment_mismatch",
-      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
-    );
-  }
-  return url.origin;
-}
-function topoloServiceOrigins2(serviceUrls, environment) {
-  return Object.fromEntries(
-    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
-      service,
-      assertTopoloServiceUrlEnvironment2(service, value, environment)
-    ])
-  );
-}
+var ACTION_SECRET_PREFIX2 = "topolo-secret:";
 var KEYCHAIN_SERVICE = "topolo-external-agent-installation";
 var MACOS_KEYCHAIN_CHUNK_SIZE = 96;
 var MACOS_KEYCHAIN_CHUNK_PREFIX = "topolo-keychain-chunks:v1:";
@@ -3712,6 +3728,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
   const platform2 = options.platform ?? hostPlatform();
   const spawn = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
+  const service = options.service ?? KEYCHAIN_SERVICE;
   if (platform2 === "darwin") {
     const write = (account, value) => runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
       input: `${value}
@@ -3720,7 +3737,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
       env: {
         ...process.env,
         TOPOLO_KEYCHAIN_ACCOUNT: account,
-        TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
+        TOPOLO_KEYCHAIN_SERVICE: service
       }
     }), "macOS Keychain write");
     const read = (account) => {
@@ -3729,7 +3746,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         "-a",
         account,
         "-s",
-        KEYCHAIN_SERVICE,
+        service,
         "-w"
       ], { encoding: "utf8" });
       if (result.status === 44) return null;
@@ -3741,7 +3758,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         "-a",
         account,
         "-s",
-        KEYCHAIN_SERVICE
+        service
       ], { encoding: "utf8" });
       if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
     };
@@ -3788,9 +3805,9 @@ function createPlatformInstallationSecretBackend(options = {}) {
       async set(account, value) {
         runOrThrow(spawn("secret-tool", [
           "store",
-          "--label=Topolo external agent installation",
+          "--label=Topolo protected credential",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { input: value, encoding: "utf8" }), "Linux Secret Service write");
@@ -3799,7 +3816,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn("secret-tool", [
           "lookup",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -3810,7 +3827,7 @@ function createPlatformInstallationSecretBackend(options = {}) {
         const result = spawn("secret-tool", [
           "clear",
           "service",
-          KEYCHAIN_SERVICE,
+          service,
           "account",
           account
         ], { encoding: "utf8" });
@@ -3853,12 +3870,119 @@ async function readExternalAgentInstallation(environment, id, backend = createPl
   if (!encodedSecret) throw new Error(`Protected secret is missing for installation ${id}.`);
   return { installation, secret: JSON.parse(encodedSecret) };
 }
+function createProtectedActionSecretStore(options) {
+  const backend = options.backend ?? createPlatformInstallationSecretBackend({
+    service: "topolo-action-handoff",
+    root: join2(installationStorePath(), "action-handoff")
+  });
+  const now = options.now ?? Date.now;
+  async function account(reference) {
+    if (!/^topolo-secret:[0-9a-f-]{36}$/.test(reference)) throw new TopoloSdkError2("invalid_action_secret_reference", "Invalid protected action reference.");
+    const identity = await options.identity();
+    if (!identity.user.id) throw new TopoloSdkError2("action_secret_identity_required", "A verified identity is required for protected action handoff.");
+    if (identity.kind === "api_key" && !identity.apiKey?.id) throw new TopoloSdkError2("action_secret_identity_required", "A verified API key identity is required for protected action handoff.");
+    const scope = createHash("sha256").update(JSON.stringify([
+      options.environment,
+      identity.user.principalId ?? identity.user.id,
+      identity.organization?.id ?? null,
+      identity.apiKey?.id ?? null
+    ])).digest("hex");
+    return `${scope}-${reference.slice(ACTION_SECRET_PREFIX2.length)}`;
+  }
+  return {
+    async save(value) {
+      const reference = `${ACTION_SECRET_PREFIX2}${randomUUID()}`;
+      await backend.set(await account(reference), JSON.stringify({ value, expiresAt: now() + 30 * 60 * 1e3 }));
+      return reference;
+    },
+    async load(reference) {
+      const key = await account(reference);
+      const encoded = await backend.get(key);
+      if (!encoded) throw new TopoloSdkError2("action_secret_unavailable", "Protected action reference is missing or belongs to another identity or environment.");
+      let record2;
+      try {
+        record2 = JSON.parse(encoded);
+      } catch {
+        throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
+      }
+      if (!Number.isFinite(record2?.expiresAt) || !Object.hasOwn(record2, "value")) throw new TopoloSdkError2("action_secret_invalid", "Protected action reference is corrupt.");
+      if (record2.expiresAt <= now()) {
+        await backend.delete(key);
+        throw new TopoloSdkError2("action_secret_expired", "Protected action reference expired. Repeat the originating action if its contract permits.");
+      }
+      return record2.value;
+    },
+    async delete(reference) {
+      await backend.delete(await account(reference));
+    }
+  };
+}
+var TOPOLO_ENVIRONMENT_SERVICE_URLS = {
+  production: {
+    auth: "https://auth.topolo.app",
+    developers: "https://developers.topolo.app"
+  },
+  staging: {
+    auth: "https://auth.stg.topolo.us",
+    developers: "https://developers.stg.topolo.us"
+  },
+  development: {
+    auth: "https://auth.topolo.dev",
+    developers: "https://developers.topolo.dev"
+  },
+  local: {}
+};
+function hostnameHasSuffix2(hostname, suffix) {
+  return hostname === suffix || hostname.endsWith(`.${suffix}`);
+}
+function workersDevAccountMatches2(hostname, account) {
+  if (!hostname.endsWith(".workers.dev")) return false;
+  const labels = hostname.slice(0, -".workers.dev".length).split(".");
+  return labels.length >= 2 && labels.at(-1) === account;
+}
+function originMatchesEnvironment2(url, environment) {
+  const hostname = url.hostname.toLowerCase();
+  if (environment === "local") {
+    return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "127.0.0.1" || hostname === "[::1]";
+  }
+  if (url.protocol !== "https:") return false;
+  if (environment === "production") {
+    return hostnameHasSuffix2(hostname, "topolo.app") || hostnameHasSuffix2(hostname, "topolo.io") || hostname === "api.ol0.me" || workersDevAccountMatches2(hostname, "topolo");
+  }
+  if (environment === "staging") {
+    return hostnameHasSuffix2(hostname, "stg.topolo.us") || workersDevAccountMatches2(hostname, "topolo-staging");
+  }
+  return hostnameHasSuffix2(hostname, "topolo.dev") || workersDevAccountMatches2(hostname, "topolo-development");
+}
+function assertTopoloServiceUrlEnvironment2(service, value, environment) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new TopoloSdkError2("invalid_service_url", `Invalid URL configured for Topolo service "${service}".`);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password || !originMatchesEnvironment2(url, environment)) {
+    throw new TopoloSdkError2(
+      "environment_mismatch",
+      `Refusing Topolo service "${service}": ${url.origin} does not belong to ${environment}.`
+    );
+  }
+  return url.origin;
+}
+function topoloServiceOrigins2(serviceUrls, environment) {
+  return Object.fromEntries(
+    Object.entries(serviceUrls ?? {}).sort(([left], [right]) => left.localeCompare(right)).map(([service, value]) => [
+      service,
+      assertTopoloServiceUrlEnvironment2(service, value, environment)
+    ])
+  );
+}
 var ENVIRONMENT_DEFAULT_SERVICE_URLS = TOPOLO_ENVIRONMENT_SERVICE_URLS;
 function configPath() {
   const override = process.env.TOPOLO_CONFIG_PATH;
   if (override) return override;
-  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join2(homedir2(), "AppData", "Roaming") : join2(homedir2(), ".config"));
-  return join2(base, "topolo", "config.json");
+  const base = process.env.XDG_CONFIG_HOME || (platform() === "win32" ? join3(homedir2(), "AppData", "Roaming") : join3(homedir2(), ".config"));
+  return join3(base, "topolo", "config.json");
 }
 async function readConfig() {
   const path = configPath();
@@ -4152,6 +4276,28 @@ function publicMcpErrorMessage(error, fallback) {
   return error instanceof TopoloMcpPublicError ? error.message : fallback;
 }
 
+// src/action-secret-tools.ts
+var actionSecretTools = [{
+  name: "topolo_release_action_secret",
+  title: "Release a protected action reference",
+  description: "Deletes only a local protected handoff reference for the verified identity and environment. Does not revoke the upstream credential. Requires confirm:true.",
+  requiredScopes: [],
+  destructive: true,
+  inputSchema: {
+    type: "object",
+    properties: { reference: { type: "string", minLength: 1 }, confirm: { type: "boolean" } },
+    required: ["reference", "confirm"],
+    additionalProperties: false
+  },
+  handler: async (topolo, args) => {
+    const reference = typeof args.reference === "string" ? args.reference.trim() : "";
+    if (!reference) throw new TopoloMcpPublicError("reference is required.");
+    if (args.confirm !== true) throw new TopoloMcpPublicError("Releasing a protected action reference requires confirm:true.");
+    await topolo.client.releaseActionSecret(reference);
+    return { released: true };
+  }
+}];
+
 // src/tools.ts
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 var AGENT_INVOCATIONS_CREATE = "app_topolo_agent.agent_invocations.create";
@@ -4214,6 +4360,11 @@ function agentRunResult(invocation) {
       state: "approval_required",
       invocationId: invocation["invocationId"],
       verificationUrl: approval["verificationUrl"],
+      continuation: {
+        tool: "topolo_run_agent",
+        reuseSameInvocation: true,
+        arguments: { waitForApproval: true, waitSeconds: 120 }
+      },
       approval,
       invocation
     };
@@ -4225,6 +4376,7 @@ function agentRunResult(invocation) {
   };
 }
 var TOOLS = [
+  ...actionSecretTools,
   {
     name: "topolo_whoami",
     title: "Describe the current Topolo credential",
@@ -4474,7 +4626,7 @@ var TOOLS = [
   {
     name: "topolo_run_agent",
     title: "Run a Topolo agent to a durable checkpoint",
-    description: "Creates or replays one idempotent Topolo Agent invocation, polls its published status, and returns either the terminal result or an approval_required handoff with the exact Topolo verification URL. Reusing the same idempotencyKey never starts a duplicate invocation.",
+    description: "Creates or replays one idempotent Topolo Agent invocation, polls its published status, and returns either the terminal result or an approval_required handoff with the exact Topolo verification URL. Reusing the same idempotencyKey never starts a duplicate invocation. After showing the verification URL, immediately call this tool again with the same invocation and waitForApproval=true so the terminal result returns here.",
     requiredScopes: [],
     destructive: true,
     inputSchema: {
@@ -4493,6 +4645,11 @@ var TOOLS = [
           maximum: 120,
           default: 30,
           description: "Maximum time to poll. Returns state=running when the bounded wait elapses."
+        },
+        waitForApproval: {
+          type: "boolean",
+          default: false,
+          description: "Set only when resuming an approval_required handoff already shown to the human. Keeps polling the same idempotent invocation while approval is pending."
         }
       },
       required: ["invocation"],
@@ -4506,6 +4663,7 @@ var TOOLS = [
       }
       const resource = optionalResourceContext(args);
       const waitSeconds = typeof args["waitSeconds"] === "number" ? Math.max(0, Math.min(120, Math.floor(args["waitSeconds"]))) : 30;
+      const waitForApproval = args["waitForApproval"] === true;
       const createResult = await topolo.client.callAction(
         AGENT_INVOCATIONS_CREATE,
         invocationInput,
@@ -4513,7 +4671,7 @@ var TOOLS = [
       );
       let invocation = invocationFrom(createResult);
       const deadline = Date.now() + waitSeconds * 1e3;
-      while (invocation["terminal"] !== true && invocation["status"] !== "awaiting_approval" && Date.now() < deadline) {
+      while (invocation["terminal"] !== true && (invocation["status"] !== "awaiting_approval" || waitForApproval) && Date.now() < deadline) {
         const recommended = typeof invocation["recommendedPollAfterSeconds"] === "number" ? invocation["recommendedPollAfterSeconds"] : 2;
         const delayMs = Math.min(
           Math.max(250, recommended * 1e3),
@@ -4901,14 +5059,14 @@ function displayAppId(entry) {
 
 // src/version.ts
 import { readFileSync } from "fs";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { fileURLToPath } from "url";
 function readMcpVersion() {
   try {
     const here = dirname3(fileURLToPath(import.meta.url));
     const candidates = [
-      join3(here, "package.json"),
-      join3(here, "..", "package.json")
+      join4(here, "package.json"),
+      join4(here, "..", "package.json")
     ];
     for (const path of candidates) {
       try {
@@ -5031,7 +5189,7 @@ function toolError(context, error) {
 }
 
 // src/context-credential.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // src/auth.ts
 function resolveCredentialFromEnv(environment = "production") {
@@ -5175,7 +5333,7 @@ async function resolveMcpCredential(environment, selector = process.env.TOPOLO_C
         "TOPOLO_AGENT_INSTALLATION_ID cannot be combined with TOPOLO_CONTEXT or an environment credential"
       );
     }
-    const taskId = taskSelector?.trim() || `task_${randomUUID()}`;
+    const taskId = taskSelector?.trim() || `task_${randomUUID2()}`;
     const config2 = await dependencies.readConfig();
     const serviceUrls = resolveServiceUrls(
       profileForEnvironment(config2, environment).serviceUrls,
@@ -5274,6 +5432,7 @@ var DEFAULT_DEPENDENCIES2 = {
   resolveAgentName,
   resolveServiceUrls,
   createTopolo,
+  createProtectedActionSecretStore,
   buildServer,
   createTransport: createStdioTransport,
   advertisedToolNames,
@@ -5296,6 +5455,7 @@ async function runStdioMcp(dependencies = DEFAULT_DEPENDENCIES2) {
   const topolo = dependencies.createTopolo({
     credential,
     environment,
+    actionSecretStore: dependencies.createProtectedActionSecretStore({ environment, identity: () => topolo.client.introspect() }),
     actorContext: {
       channel: "mcp",
       ...resolvedCredential.taskId ? { taskId: resolvedCredential.taskId } : {}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/mcp",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.14.1",
-  "topoloPublishedVersion": "0.14.1",
+  "version": "0.14.3",
+  "topoloPublishedVersion": "0.14.3",
   "description": "Model Context Protocol server for the Topolo platform. Exposes scope-gated tools that third-party agents (Claude, Codex, etc.) can call natively.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/sdk": "0.21.2"
+    "@topolo/sdk": "0.21.3"
   },
   "devDependencies": {
     "@types/node": "^20.12.0",