impel-cli 0.12.0 → 0.12.1

package/README.md

@@ -153,7 +153,7 @@ impel agents sync [claude|codex|all]         Sync explicit tenant agents into na
 impel status                                 Launcher readiness + native mode + gateway reachability
 impel app install [target] [--tenant <org>]  Install isolated apps for one tenant
 impel app update [target] [--tenant <org>] [--force]
-                                             Refresh configs/models and rebuild only stale bundles;
+                                             `all` without --tenant updates every installed tenant;
                                              --force performs a clean full rebuild
 impel app refresh [target] [--tenant <org>]  Configs/catalog/skills/agents only; safe while apps run
                                              (--stale-only: no-op unless 6h+ since last sync)
@@ -167,7 +167,9 @@ impel help                                   Show help
 impel --version                              Show version
 
 For app commands, `target` is `claude`, `chatgpt`/`codex`, or `all` (the
-default). `--tenant` defaults to the currently selected organization.
+default). `impel app update all` without `--tenant` updates every locally
+installed tenant. Other app commands, a specific update target, or an explicit
+`--tenant` operate on one organization and default to the current selection.
 
 # `impel setup` no longer takes a per-tool target and never flips native
 # configs; flip a native tool explicitly with `impel use gateway [claude|codex]`.
@@ -239,10 +241,10 @@ before running another protected command.
 One command brings everything current, in dependency order: the CLI itself
 (`npm install -g impel-cli@latest` from npm, with no GitHub credentials),
 then — re-executing the freshly installed build — `impel app update all`
-(install the CLI-pinned vendor builds and rebuild only stale vendored Impel apps)
+(update every locally installed tenant and rebuild only stale vendored Impel apps)
 followed by `impel skills sync all` and `impel agents sync all` across every
-managed profile. The app cascade skips its own skills/agents pass so those
-profiles are synced once, in the dedicated bounded-concurrency steps.
+native and isolated CLI profile. Each tenant's app step syncs that tenant's app
+profiles; the dedicated steps exclude apps, so every profile is synced once.
 
 Update discovery compares the installed package version with npm's public
 `latest` metadata, cached for 6 hours in
@@ -737,9 +739,12 @@ impel app open all --tenant acme
 impel app open all --tenant globex
 ```
 
-Updates and uninstalls touch only the named tenant variant. The older global
-`Impel Claude.app` / `Impel ChatGPT.app` launcher is removed after the first
-successful tenant-specific rebuild.
+Updates with `--tenant` and all uninstalls touch only the named tenant variant.
+`impel app update all` without `--tenant` discovers every locally installed
+tenant and updates each sequentially; it does not install variants for tenants
+that have never been installed. The older global `Impel Claude.app` /
+`Impel ChatGPT.app` launcher is removed after the first successful
+tenant-specific rebuild.
 
 `impel app update` compares the installed bundle's CLI version, pinned vendor
 version, identity, profile paths, and ASAR compatibility hash before touching
@@ -749,6 +754,10 @@ in a bad state, `impel app update --force` removes the selected launcher and
 performs a clean rebuild while sweeping abandoned `.tmp-*` and `.previous-*`
 staging directories.
 
+Skills plugin subprocesses run asynchronously, so the TTY progress indicator
+continues animating while Claude or Codex refreshes a marketplace. Skill status
+lines temporarily clear and redraw the spinner instead of overwriting it.
+
 The official Claude and ChatGPT apps remain separate installations and keep
 their normal accounts, updater, profiles, and bundle identities. Each CLI
 release pins exact, tested vendor builds (v0.10.0 pins Claude `1.20186.9` and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -49,8 +49,8 @@ Manage:
 Desktop apps (macOS and Windows):
   target is claude, chatgpt/codex, or all (default: all)
   impel app install [target] [--tenant <org>] Install that tenant's isolated app/profile
-  impel app update [target] [--tenant <org>]  Update profiles; rebuild only stale bundles
-                                              (--force performs a clean full rebuild)
+  impel app update [target] [--tenant <org>]  Update profiles; all without --tenant updates
+                                              every installed tenant (--force: clean rebuild)
   impel app refresh [target] [--tenant <org>] Configs/catalog/skills/agents only; safe while apps run
   impel app status [target] [--tenant <org>]  Show isolated app and vendor versions
   impel app uninstall [target] [--tenant <org>] [--keep-data]

package/src/commands/agents.js

@@ -4,6 +4,7 @@
 import os from "node:os";
 
 import { agentProfileRoot, syncAgentProfiles } from "../agents.js";
+import { parseFlags } from "../args.js";
 import { loadConfig, normalizeGatewayUrl, redactSecretText, resolveDefaultGateway } from "../config.js";
 import { ensureTenantSelection, tenantCredential } from "../tenants.js";
 import { managedSkillProfiles } from "./skills.js";
@@ -41,7 +42,8 @@ export function managedAgentProfiles(client, options = {}) {
 }
 
 export async function cmdAgents(argv, overrides = {}) {
-  const [action = "sync", targetToken] = argv;
+  const [action = "sync", rawTarget, ...rest] = argv;
+  const targetToken = rawTarget?.startsWith("--") ? undefined : rawTarget;
   if (["help", "--help", "-h"].includes(action)) {
     console.log(HELP);
     return;
@@ -57,6 +59,8 @@ export async function cmdAgents(argv, overrides = {}) {
     process.exitCode = 1;
     return;
   }
+  const flagArgs = rawTarget?.startsWith("--") ? [rawTarget, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, { "skip-apps": { type: "boolean" } });
 
   const io = {
     loadConfig,
@@ -83,6 +87,7 @@ export async function cmdAgents(argv, overrides = {}) {
       tenantId,
       environment: io.environment,
       homeDir: io.homeDir,
+      includeApps: !flags["skip-apps"],
     }));
     await io.syncAgentProfiles({
       profiles,

package/src/commands/apps.js

@@ -40,7 +40,7 @@ import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
 import { syncAgentProfilesSafe } from "../agents.js";
 import { secureManagedCodexHome } from "../codexSecurity.js";
 import { impelCliInvocation } from "../selfInvocation.js";
-import { withProgress } from "../progress.js";
+import { createProgressLogger, withProgress } from "../progress.js";
 import {
   ensureWindowsClaudeApp,
   ensureWindowsChatGPTApp,
@@ -79,6 +79,102 @@ function windowsAppTargets(targetToken) {
   return null;
 }
 
+function macTargetOrArtifactExists(paths, target, existsSync = fs.existsSync) {
+  const launcher = paths[target].launcher;
+  if (existsSync(launcher)) return true;
+  try {
+    const baseName = path.basename(launcher);
+    return fs.readdirSync(path.dirname(launcher)).some((entry) => (
+      entry.startsWith(`${baseName}.tmp-`) || entry.startsWith(`${baseName}.previous-`)
+    ));
+  } catch {
+    return false;
+  }
+}
+
+/** Locally installed tenant variants eligible for an all-target app update. */
+export function installedAppTenantIds(targets, {
+  homeDir = os.homedir(),
+  platform = process.platform,
+  environment = process.env,
+  existsSync = fs.existsSync,
+  readdirSync = fs.readdirSync,
+} = {}) {
+  const tenantsRoot = path.join(appPaths(homeDir).root, "tenants");
+  let entries;
+  try {
+    entries = readdirSync(tenantsRoot, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  }
+
+  const installed = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    let tenantId;
+    try {
+      tenantId = normalizeTenantId(entry.name);
+    } catch {
+      continue;
+    }
+    const manifest = readTenantManifest(homeDir, tenantId);
+    const claudeUserData = platform === "win32"
+      ? windowsClaudeUserData(environment, tenantId)
+      : null;
+    const paths = appPaths(homeDir, tenantId, {
+      claudeUserData,
+      tenantName: manifest?.tenantName,
+    });
+    const hasTarget = targets.some((target) => {
+      if (platform !== "win32") return macTargetOrArtifactExists(paths, target, existsSync);
+      return target === "claude"
+        ? existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`))
+        : existsSync(path.join(paths.chatgpt.codexHome, "config.toml"));
+    });
+    if (hasTarget) installed.push(tenantId);
+  }
+  return installed.sort((left, right) => left.localeCompare(right));
+}
+
+async function maybeUpdateAllInstalledTenants(argv, overrides, platform) {
+  if (overrides.singleTenantUpdate) return null;
+  const [action = "status", rawTarget, ...rest] = argv;
+  if (action !== "update") return null;
+  const targetToken = rawTarget?.startsWith("--") ? undefined : rawTarget;
+  const targets = normalizeAppTarget(targetToken);
+  if (!targets || targets.length !== 2) return null;
+  const flagArgs = rawTarget?.startsWith("--") ? [rawTarget, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, {
+    "skip-vendor": { type: "boolean" },
+    "skip-skills": { type: "boolean" },
+    "skip-agents": { type: "boolean" },
+    force: { type: "boolean" },
+    tenant: { type: "string" },
+  });
+  if (flags.tenant) return null;
+
+  const discover = overrides.installedTenantIds || installedAppTenantIds;
+  const tenantIds = discover(targets, {
+    homeDir: overrides.homeDir || os.homedir(),
+    platform,
+    environment: overrides.environment || process.env,
+  });
+  if (tenantIds.length === 0) return null;
+
+  const log = overrides.log || console.log;
+  log(`Updating all managed app targets across ${tenantIds.length} installed tenant${tenantIds.length === 1 ? "" : "s"}: ${tenantIds.join(", ")}`);
+  const runTenantUpdate = overrides.runTenantUpdate || cmdApps;
+  for (const tenantId of tenantIds) {
+    const result = await runTenantUpdate(
+      ["update", "all", ...flagArgs, "--tenant", tenantId],
+      { ...overrides, singleTenantUpdate: true },
+    );
+    if (result === false) return false;
+  }
+  return true;
+}
+
 function windowsProcessFailure(result) {
   if (result?.error?.message) return redactSecretText(result.error.message);
   if (Number.isInteger(result?.status)) return `exit code ${result.status}`;
@@ -304,8 +400,14 @@ export async function cmdWindowsApps(argv, overrides = {}) {
         console.log(`${verb} Impel ${target === "claude" ? "Claude" : "ChatGPT"} profile at ${profile}`);
         const { client, env, label } = appSkillTarget(target, tenantPaths);
         if (!flags["skip-skills"]) {
-          await withProgress(`Syncing skills for ${label}`, () => (
-            io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label })
+          await withProgress(`Syncing skills for ${label}`, (spinner) => (
+            io.syncSkills({
+              client,
+              gatewayUrl: resolveSkillsGateway(config.gatewayUrl),
+              env,
+              label,
+              logger: createProgressLogger(spinner),
+            })
           ));
         }
         if (target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
@@ -347,6 +449,8 @@ export async function cmdWindowsApps(argv, overrides = {}) {
 
 export async function cmdApps(argv, overrides = {}) {
   const platform = overrides.platform || process.platform;
+  const allTenantUpdate = await maybeUpdateAllInstalledTenants(argv, overrides, platform);
+  if (allTenantUpdate !== null) return allTenantUpdate;
   if (platform === "win32") return cmdWindowsApps(argv, overrides);
   if (platform !== "darwin") {
     console.error("impel app: isolated Impel desktop apps are unavailable on this platform.");
@@ -520,8 +624,8 @@ export async function cmdApps(argv, overrides = {}) {
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     if (!flags["skip-skills"]) {
-      await withProgress(`Syncing skills for ${label}`, () => (
-        io.syncSkills({ client, gatewayUrl, env, label })
+      await withProgress(`Syncing skills for ${label}`, (spinner) => (
+        io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
       ));
     }
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
@@ -628,8 +732,8 @@ export async function provisionAndOpenManagedApps({
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
-    await withProgress(`Syncing skills for ${label}`, () => (
-      io.syncSkills({ client, gatewayUrl, env, label })
+    await withProgress(`Syncing skills for ${label}`, (spinner) => (
+      io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
     ));
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
   }

package/src/commands/skills.js

@@ -8,6 +8,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { parseFlags } from "../args.js";
 import { loadConfig } from "../config.js";
 import { CODEX_HOME } from "../codexSetup.js";
 import { tenantCliProfilePaths } from "../cliProfiles.js";
@@ -15,7 +16,7 @@ import { CLAUDE_CONFIG_ID, appPaths } from "../apps.js";
 import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
 import { ensureTenantSelection } from "../tenants.js";
 import { windowsClaudeUserData } from "../windowsApps.js";
-import { mapWithConcurrency, withProgress } from "../progress.js";
+import { createProgressLogger, mapWithConcurrency, withProgress } from "../progress.js";
 
 const VALID_TARGETS = ["claude", "codex", "all"];
 
@@ -40,6 +41,7 @@ export function managedSkillProfiles(
     tenantId = null,
     platform = process.platform,
     environment = process.env,
+    includeApps = true,
   } = {},
 ) {
   const profiles = [];
@@ -59,7 +61,7 @@ export function managedSkillProfiles(
     const appInstalled = platform === "win32"
       ? existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`))
       : existsSync(paths.claude.launcher);
-    if (appInstalled) {
+    if (includeApps && appInstalled) {
       profiles.push({ label: "Impel Claude app", env: { CLAUDE_CONFIG_DIR: paths.claude.userData } });
     }
   } else {
@@ -71,7 +73,7 @@ export function managedSkillProfiles(
     const appInstalled = platform === "win32"
       ? existsSync(path.join(paths.chatgpt.codexHome, "config.toml"))
       : existsSync(paths.chatgpt.launcher);
-    if (appInstalled) {
+    if (includeApps && appInstalled) {
       profiles.push({ label: "Impel ChatGPT app", env: { CODEX_HOME: paths.chatgpt.codexHome } });
     }
   }
@@ -80,7 +82,8 @@ export function managedSkillProfiles(
 }
 
 export async function cmdSkills(argv, overrides = {}) {
-  const [action = "sync", targetToken] = argv;
+  const [action = "sync", rawTarget, ...rest] = argv;
+  const targetToken = rawTarget?.startsWith("--") ? undefined : rawTarget;
   if (action !== "sync") {
     console.error(`impel skills: unknown action "${action}". Try \`impel skills sync [claude|codex|all]\`.`);
     process.exitCode = 1;
@@ -93,6 +96,8 @@ export async function cmdSkills(argv, overrides = {}) {
     process.exitCode = 1;
     return;
   }
+  const flagArgs = rawTarget?.startsWith("--") ? [rawTarget, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, { "skip-apps": { type: "boolean" } });
 
   const io = {
     loadConfig,
@@ -108,12 +113,21 @@ export async function cmdSkills(argv, overrides = {}) {
     : null;
   const clients = target === "all" ? ["claude", "codex"] : [target];
   const profiles = clients.flatMap((client) => (
-    io.managedProfiles(client, { tenantId }).map((profile) => ({ client, profile }))
+    io.managedProfiles(client, {
+      tenantId,
+      includeApps: !flags["skip-apps"],
+    }).map((profile) => ({ client, profile }))
   ));
 
-  await withProgress(`Syncing skills into ${profiles.length} managed profile${profiles.length === 1 ? "" : "s"}`, () => (
+  await withProgress(`Syncing skills into ${profiles.length} managed profile${profiles.length === 1 ? "" : "s"}`, (spinner) => (
     mapWithConcurrency(profiles, 4, ({ client, profile }) => (
-      io.syncSkills({ client, gatewayUrl, env: profile.env, label: profile.label })
+      io.syncSkills({
+        client,
+        gatewayUrl,
+        env: profile.env,
+        label: profile.label,
+        logger: createProgressLogger(spinner),
+      })
     ))
   ));
 }

package/src/commands/update.js

@@ -15,6 +15,7 @@ import { loadConfig, redactSecretText } from "../config.js";
 import { nativeCommandInvocation } from "../nativeProcess.js";
 import { windowsClaudeUserData } from "../windowsApps.js";
 import { withProgress } from "../progress.js";
+import { installedAppTenantIds } from "./apps.js";
 import {
   fetchRemoteVersion,
   installedVersion,
@@ -29,9 +30,9 @@ const CLI_BIN = fileURLToPath(new URL("../../bin/impel.js", import.meta.url));
 const HELP = `impel update - update everything Impel in one command
 
 Reinstalls impel-cli from npm, then cascades with the NEW build:
-\`impel app update all\` (update the platform's vendor apps and managed app
-profiles) when Impel apps are installed, then \`impel skills sync all\` and
-\`impel agents sync all\` across every managed profile.
+\`impel app update all\` (update every locally installed tenant's vendor apps
+and managed app profiles), then \`impel skills sync all\` and
+\`impel agents sync all\` across native and isolated CLI profiles.
 
 Usage:
   impel update              Update the CLI, then cascade to apps, skills, and agents
@@ -94,27 +95,40 @@ export function defaultRunAppsUpdate({
   execPath = process.execPath,
   cliBin = CLI_BIN,
 } = {}) {
-  const result = spawn(execPath, [cliBin, "app", "update", "all", "--skip-skills", "--skip-agents"], {
+  const result = spawn(execPath, [cliBin, "app", "update", "all"], {
     stdio: "inherit",
   });
   return result.status === 0;
 }
 
-function defaultRunSkillsSync() {
-  const result = spawnSync(process.execPath, [CLI_BIN, "skills", "sync", "all"], {
+export function defaultRunSkillsSync({
+  spawn = spawnSync,
+  execPath = process.execPath,
+  cliBin = CLI_BIN,
+} = {}) {
+  const result = spawn(execPath, [cliBin, "skills", "sync", "all", "--skip-apps"], {
     stdio: "inherit",
   });
   return result.status === 0;
 }
 
-function defaultRunAgentsSync() {
-  const result = spawnSync(process.execPath, [CLI_BIN, "agents", "sync", "all"], {
+export function defaultRunAgentsSync({
+  spawn = spawnSync,
+  execPath = process.execPath,
+  cliBin = CLI_BIN,
+} = {}) {
+  const result = spawn(execPath, [cliBin, "agents", "sync", "all", "--skip-apps"], {
     stdio: "inherit",
   });
   return result.status === 0;
 }
 
 function anyAppInstalled(homeDir = os.homedir()) {
+  if (installedAppTenantIds(["claude", "chatgpt"], {
+    homeDir,
+    platform: process.platform,
+    environment: process.env,
+  }).length > 0) return true;
   const config = loadConfig();
   const claudeUserData = process.platform === "win32"
     ? windowsClaudeUserData(process.env, config?.tenantId || null)
@@ -202,7 +216,7 @@ export async function cmdUpdate(argv, overrides = {}) {
     console.log(`CLI: updated${remote ? ` to v${remote}` : ""}.`);
   }
 
-  // ── Cascade: apps, then skills across every managed profile ────────────
+  // ── Cascade: every tenant app, then non-app managed profiles ───────────
   let cascadeFailed = false;
   if (flags["skip-apps"]) {
     console.log("Apps: skipped (--skip-apps).");
@@ -212,21 +226,21 @@ export async function cmdUpdate(argv, overrides = {}) {
     console.log("Apps: none installed; skipping (run `impel app install` or `impel setup`).");
   } else {
     console.log(io.platform === "win32"
-      ? "Apps: updating the signed Claude and ChatGPT vendor apps and isolated profiles…"
-      : "Apps: refreshing profiles and rebuilding only stale app bundles…");
+      ? "Apps: updating every installed tenant's signed Claude and ChatGPT profiles…"
+      : "Apps: refreshing every installed tenant and rebuilding only stale app bundles…");
     if (!await withProgress("Updating managed desktop apps", () => io.runAppsUpdate())) {
       console.error("impel update: the app update failed; re-run `impel app update` after fixing the issue.");
       cascadeFailed = true;
     }
   }
 
-  console.log("Skills: syncing every managed profile…");
+  console.log("Skills: syncing native and isolated CLI profiles…");
   if (!await withProgress("Syncing skills across managed profiles", () => io.runSkillsSync())) {
     console.error("impel update: skill sync failed; re-run `impel skills sync` after fixing the issue.");
     cascadeFailed = true;
   }
 
-  console.log("Agents: syncing the selected tenant into every managed profile…");
+  console.log("Agents: syncing the selected tenant into native and isolated CLI profiles…");
   if (!await withProgress("Syncing agents across managed profiles", () => io.runAgentsSync())) {
     console.error("impel update: agent sync failed; re-run `impel agents sync` after fixing the issue.");
     cascadeFailed = true;

package/src/progress.js

@@ -2,7 +2,9 @@ const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "
 
 function noopSpinner() {
   return {
+    active: false,
     update() {},
+    writeLine() { return false; },
     succeed() {},
     fail() {},
   };
@@ -37,9 +39,16 @@ export function createSpinner(label, { stream = process.stderr } = {}) {
   const timer = setInterval(render, 80);
   timer.unref?.();
   return {
+    active: true,
     update(nextLabel) {
       if (!finished && nextLabel) currentLabel = String(nextLabel);
     },
+    writeLine(message) {
+      if (finished) return false;
+      stream.write(`\r\x1b[K${String(message)}\n`);
+      render();
+      return true;
+    },
     succeed(nextLabel) {
       finish("✓", nextLabel);
     },
@@ -49,6 +58,18 @@ export function createSpinner(label, { stream = process.stderr } = {}) {
   };
 }
 
+/** Keep ordinary log lines from overwriting an active progress display. */
+export function createProgressLogger(spinner, fallback = console) {
+  const write = (method, args) => {
+    const message = args.map((value) => String(value)).join(" ");
+    if (!spinner?.writeLine?.(message)) fallback[method](...args);
+  };
+  return {
+    log: (...args) => write("log", args),
+    warn: (...args) => write("warn", args),
+  };
+}
+
 export async function withProgress(label, fn, options) {
   const spinner = createSpinner(label, options);
   try {

package/src/skills.js

@@ -19,7 +19,7 @@
 //   - Codex:       `plugin marketplace add|upgrade`, `plugin add` (install + refresh)
 // so we keep a per-client command table rather than assuming one shape.
 
-import { spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 
 import { resolveDefaultGateway, normalizeGatewayUrl } from "./config.js";
 import { nativeCommandInvocation } from "./nativeProcess.js";
@@ -159,44 +159,95 @@ export function buildSkillCommands({ client, marketplaceSourceUrl: sourceUrl, ma
   return commands;
 }
 
-/** Default command runner: spawns the client binary non-interactively. */
-function defaultRun(bin, args, env) {
+const SKILL_COMMAND_TIMEOUT_MS = 120_000;
+const SKILL_COMMAND_OUTPUT_LIMIT = 10 * 1024 * 1024;
+
+/** Default async command runner: keeps progress timers responsive while plugins sync. */
+export function runSkillCommand(bin, args, env, {
+  spawnImpl = spawn,
+  timeoutMs = SKILL_COMMAND_TIMEOUT_MS,
+} = {}) {
   const environment = { ...process.env, ...env };
   let invocation;
   try {
     invocation = nativeCommandInvocation(bin, args, environment);
   } catch (error) {
-    return {
+    return Promise.resolve({
       ok: false,
       missing: false,
       status: null,
       stdout: "",
       stderr: error?.message || String(error),
-    };
+    });
   }
-  const result = spawnSync(invocation.command, invocation.args, {
-    env: environment,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: 120000,
-    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
-  });
-  if (result.error) {
-    return {
+
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnImpl(invocation.command, invocation.args, {
+        env: environment,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+      });
+    } catch (error) {
+      resolve({
+        ok: false,
+        missing: error?.code === "ENOENT",
+        status: null,
+        stdout: "",
+        stderr: error?.message || String(error),
+      });
+      return;
+    }
+
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const append = (current, chunk) => (
+      `${current}${String(chunk)}`.slice(-SKILL_COMMAND_OUTPUT_LIMIT)
+    );
+    child.stdout?.setEncoding?.("utf8");
+    child.stderr?.setEncoding?.("utf8");
+    child.stdout?.on("data", (chunk) => { stdout = append(stdout, chunk); });
+    child.stderr?.on("data", (chunk) => { stderr = append(stderr, chunk); });
+
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      resolve(result);
+    };
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      try {
+        child.kill();
+      } catch {
+        // The process may have exited between the timer firing and kill().
+      }
+      finish({
+        ok: false,
+        missing: false,
+        status: null,
+        stdout,
+        stderr: `skill command timed out after ${timeoutMs}ms`,
+      });
+    }, timeoutMs);
+    child.on("error", (error) => finish({
       ok: false,
-      missing: result.error.code === "ENOENT",
+      missing: error?.code === "ENOENT",
       status: null,
-      stdout: "",
-      stderr: result.error.message || String(result.error),
-    };
-  }
-  return {
-    ok: result.status === 0,
-    missing: false,
-    status: result.status,
-    stdout: result.stdout || "",
-    stderr: result.stderr || "",
-  };
+      stdout,
+      stderr: error?.message || String(error),
+    }));
+    child.on("close", (status) => finish({
+      ok: !timedOut && status === 0,
+      missing: false,
+      status,
+      stdout,
+      stderr: timedOut ? `skill command timed out after ${timeoutMs}ms` : stderr,
+    }));
+  });
 }
 
 function firstLine(text) {
@@ -237,7 +288,7 @@ export async function syncSkills({
   env = {},
   label,
   fetchImpl = fetch,
-  run = defaultRun,
+  run = runSkillCommand,
   logger = console,
 } = {}) {
   const spec = CLIENT_SPECS[client];
@@ -254,7 +305,7 @@ export async function syncSkills({
 
   try {
     // Confirm the binary and its `plugin` subcommand exist before doing anything.
-    const help = run(spec.bin, ["plugin", "--help"], env);
+    const help = await run(spec.bin, ["plugin", "--help"], env);
     if (help.missing) {
       logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${spec.bin}\` CLI not found on PATH.`);
       return { client, label: displayLabel, skipped: true, reason: "binary-missing" };
@@ -272,7 +323,7 @@ export async function syncSkills({
     logger.log(`Skills: syncing ${SKILL_PLUGIN_NAME} for ${displayLabel}…`);
     const failures = [];
     for (const command of commands) {
-      const result = run(spec.bin, command.args, env);
+      const result = await run(spec.bin, command.args, env);
       if (result.missing) {
         failures.push({ phase: command.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
         break;