impel-cli 0.12.0 → 0.13.0

package/README.md

@@ -153,7 +153,7 @@ impel agents sync [claude|codex|all]         Sync explicit tenant agents into na
 impel status                                 Launcher readiness + native mode + gateway reachability
 impel app install [target] [--tenant <org>]  Install isolated apps for one tenant
 impel app update [target] [--tenant <org>] [--force]
-                                             Refresh configs/models and rebuild only stale bundles;
+                                             `all` without --tenant updates every installed tenant;
                                              --force performs a clean full rebuild
 impel app refresh [target] [--tenant <org>]  Configs/catalog/skills/agents only; safe while apps run
                                              (--stale-only: no-op unless 6h+ since last sync)
@@ -167,7 +167,9 @@ impel help                                   Show help
 impel --version                              Show version
 
 For app commands, `target` is `claude`, `chatgpt`/`codex`, or `all` (the
-default). `--tenant` defaults to the currently selected organization.
+default). `impel app update all` without `--tenant` updates every locally
+installed tenant. Other app commands, a specific update target, or an explicit
+`--tenant` operate on one organization and default to the current selection.
 
 # `impel setup` no longer takes a per-tool target and never flips native
 # configs; flip a native tool explicitly with `impel use gateway [claude|codex]`.
@@ -239,10 +241,18 @@ before running another protected command.
 One command brings everything current, in dependency order: the CLI itself
 (`npm install -g impel-cli@latest` from npm, with no GitHub credentials),
 then — re-executing the freshly installed build — `impel app update all`
-(install the CLI-pinned vendor builds and rebuild only stale vendored Impel apps)
+(update every locally installed tenant and rebuild only stale vendored Impel apps)
 followed by `impel skills sync all` and `impel agents sync all` across every
-managed profile. The app cascade skips its own skills/agents pass so those
-profiles are synced once, in the dedicated bounded-concurrency steps.
+native and isolated CLI profile. Each tenant's app step syncs that tenant's app
+profiles; the dedicated steps exclude apps, so every profile is synced once.
+
+Most updates are in place — the desktop apps are **not** closed. A vendored
+bundle is only rebuilt (and therefore only quit) when the bundle-building logic
+or the pinned vendor version actually changes, not on every CLI release, so a
+routine update just rewrites configs, skills, and agents while the apps keep
+running. When a rebuild genuinely is required, `impel app update` closes only
+the app whose bundle it will swap and **reopens it afterward**, so the swap
+lands without you relaunching by hand. Apps you had already closed stay closed.
 
 Update discovery compares the installed package version with npm's public
 `latest` metadata, cached for 6 hours in
@@ -737,17 +747,27 @@ impel app open all --tenant acme
 impel app open all --tenant globex
 ```
 
-Updates and uninstalls touch only the named tenant variant. The older global
-`Impel Claude.app` / `Impel ChatGPT.app` launcher is removed after the first
-successful tenant-specific rebuild.
-
-`impel app update` compares the installed bundle's CLI version, pinned vendor
-version, identity, profile paths, and ASAR compatibility hash before touching
-it. A current bundle is not closed, cloned, patched, or codesigned; its config
-and model catalog are still refreshed. If an interrupted update left a machine
-in a bad state, `impel app update --force` removes the selected launcher and
-performs a clean rebuild while sweeping abandoned `.tmp-*` and `.previous-*`
-staging directories.
+Updates with `--tenant` and all uninstalls touch only the named tenant variant.
+`impel app update all` without `--tenant` discovers every locally installed
+tenant and updates each sequentially; it does not install variants for tenants
+that have never been installed. The older global `Impel Claude.app` /
+`Impel ChatGPT.app` launcher is removed after the first successful
+tenant-specific rebuild.
+
+`impel app update` compares the installed bundle's build fingerprint, signing
+mode, pinned vendor version, identity, profile paths, and ASAR compatibility
+hash before touching it. The build fingerprint tracks the bundle-BUILDING logic
+(asar patches, plist rewrites, signing), not the CLI version, so a CLI release
+that doesn't change bundle bytes leaves installed bundles — and their macOS
+permission grants — alone. A current bundle is not closed, cloned, patched, or
+codesigned; its config and model catalog are still refreshed. If an interrupted
+update left a machine in a bad state, `impel app update --force` removes the
+selected launcher and performs a clean rebuild while sweeping abandoned
+`.tmp-*` and `.previous-*` staging directories.
+
+Skills plugin subprocesses run asynchronously, so the TTY progress indicator
+continues animating while Claude or Codex refreshes a marketplace. Skill status
+lines temporarily clear and redraw the spinner instead of overwriting it.
 
 The official Claude and ChatGPT apps remain separate installations and keep
 their normal accounts, updater, profiles, and bundle identities. Each CLI
@@ -767,7 +787,7 @@ For ChatGPT/Codex, the gateway controls which models and capabilities are
 enabled while the installer merges those entries with the vendor app's native
 catalog. The Impel copy relaxes the vendor renderer's ChatGPT-account-only Fast
 gate because gateway auth supplies the entitlement instead. The outer wrapper
-is then ad-hoc signed locally without replacing the nested OpenAI signing
+is then signed locally (see below) without replacing the nested OpenAI signing
 identity. This preserves model-specific instructions and exposes
 the same reasoning-effort and service-tier controls as the normal app, including
 Ultra where supported and Fast only on models that advertise the `priority`
@@ -777,10 +797,26 @@ Impel PAT. Config refreshes replace only the Impel-managed gateway block; plugin
 desktop preferences, projects, and other settings written by the isolated app
 are kept.
 
-Impel Claude and the outer Impel ChatGPT wrapper are ad-hoc signed locally after
-their bundle identities and launch wrappers are installed. The nested ChatGPT
-bundle retains OpenAI's signature. The Claude 3P config necessarily contains
-the PAT because that app accepts a
+Impel Claude and the outer Impel ChatGPT wrapper are signed locally after their
+bundle identities and launch wrappers are installed. The nested ChatGPT bundle
+retains OpenAI's signature.
+
+By default the CLI signs each rebuild with a **stable per-machine identity** — a
+self-signed certificate created once in a dedicated keychain under
+`~/.config/impel/codesign` (no Apple Developer account is involved). macOS ties
+every privacy (TCC) grant — microphone, screen recording, folder access,
+Automation, accessibility — to the app's code-signing designated requirement. A
+stable identity keeps that requirement constant across rebuilds, so the grants
+you approve survive `impel app update` the way they do for a normal app instead
+of re-prompting after every rebuild. The one-time switch from the old ad-hoc
+signature to the stable identity triggers a single final round of prompts. If
+the local signing toolchain is unavailable the CLI logs a notice and falls back
+to ad-hoc signing (the previous behavior). Two environment overrides are
+available: `IMPEL_CODESIGN_ADHOC=1` forces ad-hoc signing, and
+`IMPEL_CODESIGN_IDENTITY=<name>` signs with a specific existing identity (e.g. a
+real `Developer ID Application: …`).
+
+The Claude 3P config necessarily contains the PAT because that app accepts a
 gateway API key rather than a token-helper command. It is stored in the same
 owner-only Impel config tree as the primary credential. ChatGPT/Codex uses a
 command-backed helper and does not copy the PAT into TOML. The installable app

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -11,6 +11,7 @@ import {
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
+import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
 
 export const CLAUDE_CONFIG_ID = "1ced0000-0000-4000-8000-000000000001";
 const CHATGPT_CONFIG_START = "# >>> impel app managed gateway >>>";
@@ -144,6 +145,15 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // slow open path (and thus a full config rewrite) after a CLI update.
 export const CURRENT_CONFIG_VERSION = 10;
 
+// Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
+// helper rebranding, and signing. A vendored bundle is rebuilt only when this
+// changes, NOT on every CLI release, so routine CLI updates (bug fixes, new
+// commands, config tweaks) no longer quit and re-sign the running desktop apps
+// — which is what made every `impel update` re-trigger macOS permission
+// prompts. Bump this ONLY when a code change alters the bytes of a built
+// bundle; leave it alone for changes that don't touch bundle contents.
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-16.1";
+
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
   try {
@@ -169,17 +179,21 @@ export function readBundleCompatibility(launcher) {
 }
 
 /**
- * A vendored bundle needs no rebuild when it was built by this CLI version
- * from the vendor app version currently on disk. Rebuilds are the expensive
- * part of install/open (bundle clone + asar patch + deep codesign), so this
- * check is what makes repeat opens fast.
+ * A vendored bundle needs no rebuild when it was built by the SAME bundle
+ * logic (BUNDLE_BUILD_FINGERPRINT) and signing mode, from the vendor app
+ * version currently on disk. Keying on the bundle fingerprint rather than the
+ * CLI version is deliberate: rebuilds are the expensive part of install/open
+ * (bundle clone + asar patch + deep codesign) AND they force the running apps
+ * closed, so a routine CLI update that doesn't change bundle bytes must leave
+ * the installed bundles — and their macOS permission grants — untouched.
  */
-export function bundleIsCurrent(status) {
+export function bundleIsCurrent(status, { signingMode = desiredSigningMode() } = {}) {
   if (!status.launcherInstalled || !status.vendorPath || !status.vendorVersion) return false;
   const compatibility = readBundleCompatibility(status.launcher);
   return Boolean(
     compatibility
-    && compatibility.cliVersion === CLI_VERSION
+    && compatibility.bundleFingerprint === BUNDLE_BUILD_FINGERPRINT
+    && compatibility.signingMode === signingMode
     && compatibility.vendorVersion === status.vendorVersion
     && compatibility.bundleIdentifier === status.bundleIdentifier
     && compatibility.displayName === status.label
@@ -251,7 +265,10 @@ const QUIT_POLL_MS = 500;
 /**
  * Closes every running app whose bundle the given targets will replace:
  * graceful AppleScript quit first, SIGTERM if it lingers, and a hard error
- * telling the user to close it themselves if even that fails.
+ * telling the user to close it themselves if even that fails. Returns the app
+ * names that were actually running and got closed, so callers can reopen the
+ * managed launchers afterward (an update the user did not ask to also relaunch
+ * leaves already-closed apps closed).
  */
 export async function quitBlockingApps(targets, {
   tenantId = null,
@@ -280,16 +297,28 @@ export async function quitBlockingApps(targets, {
     return !isRunning(name);
   }
 
+  const closed = [];
   for (const name of blockingAppNames(targets, { tenantId, tenantName })) {
     if (!isRunning(name)) continue;
     log(`${name} is running; closing it before touching app bundles…`);
     requestQuit(name);
-    if (await goneWithin(name, quitWaitMs)) continue;
+    if (await goneWithin(name, quitWaitMs)) { closed.push(name); continue; }
     log(`${name} did not quit gracefully; terminating it…`);
     forceQuit(name);
-    if (await goneWithin(name, killWaitMs)) continue;
+    if (await goneWithin(name, killWaitMs)) { closed.push(name); continue; }
     throw new Error(`${name} is still running; close it manually, then re-run`);
   }
+  return closed;
+}
+
+/**
+ * The managed (Impel-branded) launcher name for a target, as it appears in
+ * blockingAppNames / quitBlockingApps output. Used to decide which just-closed
+ * apps to reopen after an update — only the managed launchers, never a user's
+ * separate vendor Claude/ChatGPT.
+ */
+export function managedLauncherName(target, { tenantId = null, tenantName = null } = {}) {
+  return managedAppIdentity(target, tenantId, tenantName).launcherName.replace(/\.app$/u, "");
 }
 
 export function appPaths(homeDir = os.homedir(), tenantId = null, {
@@ -1016,8 +1045,10 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl) {
 
     const macos = path.join(staging, "Contents", "MacOS");
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 2,
+      schemaVersion: 3,
       cliVersion: CLI_VERSION,
+      bundleFingerprint: BUNDLE_BUILD_FINGERPRINT,
+      signingMode: desiredSigningMode(),
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
       bundleIdentifier: paths.claude.bundleIdentifier,
@@ -1100,8 +1131,10 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
       0o644,
     );
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 2,
+      schemaVersion: 3,
       cliVersion: CLI_VERSION,
+      bundleFingerprint: BUNDLE_BUILD_FINGERPRINT,
+      signingMode: desiredSigningMode(),
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
       bundleIdentifier: paths.chatgpt.bundleIdentifier,
@@ -1559,35 +1592,43 @@ if (process.type === "browser" && displayName) {
 `;
 }
 
-function signVendoredApp(bundle, vendorExecutable, label) {
+function signVendoredApp(bundle, vendorExecutable, label, identity = null) {
   if (process.platform !== "darwin" || !isMachO(vendorExecutable)) return;
+  // Resolve (and, on first use, create) the signing identity only once we know
+  // we will actually sign — this keeps the guard above side-effect-free.
+  identity ||= resolveSigningIdentity();
   spawnSync("/usr/bin/xattr", ["-dr", "com.apple.quarantine", bundle], { stdio: "ignore" });
-  let signed = codesign(vendoredAppSigningArgs(bundle, label));
+  let signed = codesign(vendoredAppSigningArgs(bundle, label, identity));
   if (signed.status !== 0) throw new Error(`failed to sign vendored Impel ${label} app: ${signed.stderr.trim()}`);
   if (label === "Claude") {
-    signed = signVendoredClaudeCapabilities(bundle);
+    signed = signVendoredClaudeCapabilities(bundle, identity);
     if (signed.status !== 0) throw new Error(`failed to restore vendored Impel Claude capabilities: ${signed.stderr.trim()}`);
   }
   const verified = spawnSync("/usr/bin/codesign", ["--verify", "--deep", "--strict", bundle], { encoding: "utf8" });
   if (verified.status !== 0) throw new Error(`vendored Impel ${label} signature verification failed: ${verified.stderr.trim()}`);
 }
 
-export function vendoredAppSigningArgs(bundle, label) {
+export function vendoredAppSigningArgs(bundle, label, identity = ADHOC_IDENTITY) {
+  // A stable local signing identity keeps the bundle's code-signing designated
+  // requirement constant across rebuilds, so macOS retains the user's TCC
+  // permission grants after every `impel app update` (see src/codesign.js).
+  //
   // Browser control authenticates the ChatGPT process by OpenAI's code-signing
-  // identity. Deep ad-hoc signing replaces that identity on every nested code
-  // object, including Contents/MacOS/ChatGPT, so sign only the modified outer
-  // bundle and preserve the vendor signatures within it. Claude deliberately
-  // retains its separate deep-signing and entitlement-restoration flow below.
+  // identity. Deep signing replaces that identity on every nested code object,
+  // including Contents/MacOS/ChatGPT, so sign only the modified outer bundle
+  // and preserve the vendor signatures within it. Claude deliberately retains
+  // its separate deep-signing and entitlement-restoration flow below.
   return label === "ChatGPT"
-    ? ["--force", "--sign", "-", bundle]
-    : ["--force", "--deep", "--sign", "-", bundle];
+    ? ["--force", ...codesignIdentityArgs(identity), bundle]
+    : ["--force", "--deep", ...codesignIdentityArgs(identity), bundle];
 }
 
-function signVendoredClaudeCapabilities(bundle) {
+function signVendoredClaudeCapabilities(bundle, identity = ADHOC_IDENTITY) {
   const fullEntitlements = entitlementPlist({
     "com.apple.security.cs.allow-jit": true,
-    // Ad-hoc signatures have no common Apple Team ID, so hardened runtime
-    // otherwise refuses to map the app's separately signed Electron framework.
+    // A local self-signed (or ad-hoc) signature shares no Apple Team ID with
+    // Anthropic's separately signed Electron framework, so hardened runtime
+    // otherwise refuses to map it. Library validation stays disabled for both.
     "com.apple.security.cs.disable-library-validation": true,
     "com.apple.security.device.audio-input": true,
     "com.apple.security.device.bluetooth": true,
@@ -1618,13 +1659,15 @@ function signVendoredClaudeCapabilities(bundle) {
     for (const helper of helpers) {
       const entitlements = helper.name.endsWith(" Helper.app") ? fullPath : jitPath;
       const result = codesign([
-        "--force", "--deep", "--options", "runtime", "--entitlements", entitlements, "--sign", "-",
+        "--force", "--deep", "--options", "runtime", "--entitlements", entitlements,
+        ...codesignIdentityArgs(identity),
         path.join(frameworks, helper.name),
       ]);
       if (result.status !== 0) return result;
     }
     return codesign([
-      "--force", "--options", "runtime", "--entitlements", fullPath, "--sign", "-", bundle,
+      "--force", "--options", "runtime", "--entitlements", fullPath,
+      ...codesignIdentityArgs(identity), bundle,
     ]);
   } finally {
     fs.rmSync(fullPath, { force: true });

package/src/cli.js

@@ -49,8 +49,8 @@ Manage:
 Desktop apps (macOS and Windows):
   target is claude, chatgpt/codex, or all (default: all)
   impel app install [target] [--tenant <org>] Install that tenant's isolated app/profile
-  impel app update [target] [--tenant <org>]  Update profiles; rebuild only stale bundles
-                                              (--force performs a clean full rebuild)
+  impel app update [target] [--tenant <org>]  Update profiles; all without --tenant updates
+                                              every installed tenant (--force: clean rebuild)
   impel app refresh [target] [--tenant <org>] Configs/catalog/skills/agents only; safe while apps run
   impel app status [target] [--tenant <org>]  Show isolated app and vendor versions
   impel app uninstall [target] [--tenant <org>] [--keep-data]

package/src/codesign.js

@@ -0,0 +1,246 @@
+// Stable local code-signing identity for the managed macOS app bundles.
+//
+// macOS ties every TCC privacy grant (microphone, screen recording, folder
+// access, Automation/AppleScript, accessibility, …) to the app's code-signing
+// "designated requirement". An ad-hoc signature (`codesign --sign -`) has no
+// stable identity: its requirement degenerates to the binary's own cdhash,
+// which changes on every rebuild. So each time `impel app update` re-signed a
+// rebuilt bundle, macOS saw a brand-new app and re-prompted for every
+// permission the user had already granted.
+//
+// Signing rebuilds with a stable per-machine self-signed certificate instead
+// gives the bundle a constant designated requirement, so TCC grants survive
+// updates the way they do for a normal app. The certificate lives in a
+// dedicated keychain under the Impel config dir; no Apple Developer account is
+// involved (these bundles are patched and built on the user's own machine, so
+// Developer ID signing is impossible anyway).
+//
+// Everything here is best-effort: if any step fails — no `security`/`openssl`,
+// a locked keychain, an unusual environment — we fall back to ad-hoc signing,
+// which is exactly today's behavior. Updates never fail because signing could
+// not be upgraded.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+
+import { CONFIG_DIR } from "./config.js";
+
+export const SIGNING_IDENTITY_NAME = "Impel Local Codesigning";
+
+// Ad-hoc: what every managed bundle was signed with before stable identities.
+export const ADHOC_IDENTITY = Object.freeze({
+  mode: "adhoc",
+  signArg: "-",
+  keychainArgs: Object.freeze([]),
+  descriptor: "adhoc",
+});
+
+/** `codesign` arguments that select the given identity (and its keychain). */
+export function codesignIdentityArgs(identity = ADHOC_IDENTITY) {
+  return [...identity.keychainArgs, "--sign", identity.signArg];
+}
+
+/**
+ * The coarse signing mode the current environment WANTS, without creating or
+ * touching any certificate. `bundleIsCurrent` compares this against the mode
+ * recorded when a bundle was built, so a change in signing preference (or an
+ * old ad-hoc bundle that predates stable signing) forces exactly one rebuild.
+ * Kept cheap on purpose: resolving the concrete local identity would create a
+ * keychain, which must not happen during a read-only currency check.
+ */
+export function desiredSigningMode(env = process.env, platform = process.platform) {
+  if (platform !== "darwin") return "adhoc";
+  if (truthyEnv(env.IMPEL_CODESIGN_ADHOC)) return "adhoc";
+  if (env.IMPEL_CODESIGN_IDENTITY) return `external:${env.IMPEL_CODESIGN_IDENTITY}`;
+  return "local";
+}
+
+function truthyEnv(value) {
+  return value === "1" || value === "true" || value === "yes";
+}
+
+function defaultRun(command, args, { input } = {}) {
+  return spawnSync(command, args, { encoding: "utf8", input });
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+// find-identity prints lines like `  1) 0A1B…40hex "Impel Local Codesigning"`.
+function parseIdentitySha(output, name) {
+  const pattern = new RegExp(`\\)\\s+([0-9A-Fa-f]{40})\\s+"${escapeRegExp(name)}"`, "u");
+  const match = String(output || "").match(pattern);
+  return match ? match[1] : null;
+}
+
+let cachedIdentity = null;
+
+/**
+ * Resolve the signing identity to use for managed bundles, creating the stable
+ * local certificate on first use. Cached per process. Returns an identity
+ * object whose `signArg`/`keychainArgs` feed straight into `codesign`.
+ *
+ * Env overrides:
+ *   IMPEL_CODESIGN_ADHOC=1        force ad-hoc signing (the pre-1.0 behavior)
+ *   IMPEL_CODESIGN_IDENTITY=<id>  sign with a specific existing identity
+ *                                 (e.g. a real "Developer ID Application: …")
+ */
+export function resolveSigningIdentity(deps = {}) {
+  const {
+    env = process.env,
+    platform = process.platform,
+    run = defaultRun,
+    configDir = CONFIG_DIR,
+    fsImpl = fs,
+    warn = (message) => console.warn(message),
+    randomBytes = crypto.randomBytes,
+    cache = true,
+  } = deps;
+
+  if (cache && cachedIdentity) return cachedIdentity;
+  if (platform !== "darwin") return ADHOC_IDENTITY;
+  if (truthyEnv(env.IMPEL_CODESIGN_ADHOC)) return ADHOC_IDENTITY;
+
+  if (env.IMPEL_CODESIGN_IDENTITY) {
+    const identity = {
+      mode: "external",
+      signArg: env.IMPEL_CODESIGN_IDENTITY,
+      keychainArgs: [],
+      descriptor: `external:${env.IMPEL_CODESIGN_IDENTITY}`,
+    };
+    if (cache) cachedIdentity = identity;
+    return identity;
+  }
+
+  try {
+    const identity = ensureLocalSigningIdentity({ run, configDir, fsImpl, randomBytes });
+    if (cache) cachedIdentity = identity;
+    return identity;
+  } catch (error) {
+    warn(`impel: falling back to ad-hoc app signing (${error?.message || error}); permission prompts may repeat after updates.`);
+    if (cache) cachedIdentity = ADHOC_IDENTITY;
+    return ADHOC_IDENTITY;
+  }
+}
+
+/** For tests: drop the per-process memo so env overrides take effect again. */
+export function resetSigningIdentityCache() {
+  cachedIdentity = null;
+}
+
+function ensureLocalSigningIdentity({ run, configDir, fsImpl, randomBytes }) {
+  const dir = path.join(configDir, "codesign");
+  const keychain = path.join(dir, "impel-codesign.keychain-db");
+  const passwordFile = path.join(dir, "keychain.pass");
+  fsImpl.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  // Reuse an already-created identity: the whole point is that the cert (and
+  // therefore the designated requirement) stays stable across updates.
+  if (fsImpl.existsSync(keychain) && fsImpl.existsSync(passwordFile)) {
+    const password = fsImpl.readFileSync(passwordFile, "utf8").trim();
+    unlockKeychain(run, keychain, password);
+    const existing = findLocalIdentitySha(run, keychain);
+    if (existing) return localIdentity(existing, keychain);
+  }
+
+  const password = randomBytes(24).toString("hex");
+  createLocalSigningIdentity({ run, dir, keychain, password, fsImpl });
+  fsImpl.writeFileSync(passwordFile, `${password}\n`, { mode: 0o600 });
+
+  const sha = findLocalIdentitySha(run, keychain);
+  if (!sha) throw new Error("created signing identity was not found in its keychain");
+  ensureKeychainInSearchList(run, keychain);
+  return localIdentity(sha, keychain);
+}
+
+function localIdentity(sha, keychain) {
+  return {
+    mode: "local",
+    signArg: sha,
+    keychainArgs: ["--keychain", keychain],
+    descriptor: `local:${sha}`,
+  };
+}
+
+function findLocalIdentitySha(run, keychain) {
+  const result = run("/usr/bin/security", ["find-identity", "-v", "-p", "codesigning", keychain]);
+  if (result.status !== 0) return null;
+  return parseIdentitySha(result.stdout, SIGNING_IDENTITY_NAME);
+}
+
+function createLocalSigningIdentity({ run, dir, keychain, password, fsImpl }) {
+  const work = fsImpl.mkdtempSync(path.join(os.tmpdir(), "impel-codesign-"));
+  const keyPath = path.join(work, "key.pem");
+  const certPath = path.join(work, "cert.pem");
+  const p12Path = path.join(work, "identity.p12");
+  const p12Pass = crypto.randomBytes(18).toString("hex");
+  try {
+    // A self-signed leaf certificate with the codeSigning EKU. It is never
+    // trusted for distribution; it only needs to exist so codesign can bind a
+    // stable identity into the signature. Locally built, de-quarantined apps
+    // launch regardless of certificate trust (Gatekeeper only gates quarantined
+    // downloads), exactly as the ad-hoc bundles do today.
+    runOrThrow(run, "/usr/bin/openssl", [
+      "req", "-x509", "-newkey", "rsa:2048",
+      "-keyout", keyPath, "-out", certPath,
+      "-days", "3650", "-nodes",
+      "-subj", `/CN=${SIGNING_IDENTITY_NAME}`,
+      "-addext", "basicConstraints=critical,CA:false",
+      "-addext", "keyUsage=critical,digitalSignature",
+      "-addext", "extendedKeyUsage=critical,codeSigning",
+    ], "generate signing certificate");
+    runOrThrow(run, "/usr/bin/openssl", [
+      "pkcs12", "-export", "-out", p12Path,
+      "-inkey", keyPath, "-in", certPath,
+      "-passout", `pass:${p12Pass}`,
+      "-name", SIGNING_IDENTITY_NAME,
+    ], "package signing certificate");
+
+    if (!fsImpl.existsSync(keychain)) {
+      runOrThrow(run, "/usr/bin/security", ["create-keychain", "-p", password, keychain], "create signing keychain");
+    }
+    // No auto-lock: codesign must reach the private key non-interactively.
+    run("/usr/bin/security", ["set-keychain-settings", keychain]);
+    unlockKeychain(run, keychain, password);
+    runOrThrow(run, "/usr/bin/security", [
+      "import", p12Path, "-k", keychain, "-P", p12Pass, "-T", "/usr/bin/codesign",
+    ], "import signing identity");
+    // Grant codesign non-interactive access to the key so signing never pops a
+    // "codesign wants to use a key" GUI prompt. We own the keychain password.
+    runOrThrow(run, "/usr/bin/security", [
+      "set-key-partition-list", "-S", "apple-tool:,apple:,codesign:", "-s", "-k", password, keychain,
+    ], "authorize codesign for the signing key");
+  } finally {
+    fsImpl.rmSync(work, { recursive: true, force: true });
+  }
+}
+
+function unlockKeychain(run, keychain, password) {
+  run("/usr/bin/security", ["unlock-keychain", "-p", password, keychain]);
+}
+
+// codesign resolves an identity by searching the user's keychain search list,
+// so the dedicated keychain has to be on it. Append without disturbing the
+// user's existing keychains (a bare `-s <one>` would replace the whole list).
+function ensureKeychainInSearchList(run, keychain) {
+  const listed = run("/usr/bin/security", ["list-keychains", "-d", "user"]);
+  const current = String(listed.stdout || "")
+    .split("\n")
+    .map((line) => line.trim().replace(/^"|"$/gu, ""))
+    .filter(Boolean);
+  if (current.includes(keychain)) return;
+  run("/usr/bin/security", ["list-keychains", "-d", "user", "-s", ...current, keychain]);
+}
+
+function runOrThrow(run, command, args, description) {
+  const result = run(command, args);
+  if (result.status !== 0 || result.error) {
+    const detail = result.error?.message || String(result.stderr || "").trim() || `exit ${result.status}`;
+    throw new Error(`${description} failed: ${detail}`);
+  }
+  return result;
+}

package/src/commands/agents.js

@@ -4,6 +4,7 @@
 import os from "node:os";
 
 import { agentProfileRoot, syncAgentProfiles } from "../agents.js";
+import { parseFlags } from "../args.js";
 import { loadConfig, normalizeGatewayUrl, redactSecretText, resolveDefaultGateway } from "../config.js";
 import { ensureTenantSelection, tenantCredential } from "../tenants.js";
 import { managedSkillProfiles } from "./skills.js";
@@ -41,7 +42,8 @@ export function managedAgentProfiles(client, options = {}) {
 }
 
 export async function cmdAgents(argv, overrides = {}) {
-  const [action = "sync", targetToken] = argv;
+  const [action = "sync", rawTarget, ...rest] = argv;
+  const targetToken = rawTarget?.startsWith("--") ? undefined : rawTarget;
   if (["help", "--help", "-h"].includes(action)) {
     console.log(HELP);
     return;
@@ -57,6 +59,8 @@ export async function cmdAgents(argv, overrides = {}) {
     process.exitCode = 1;
     return;
   }
+  const flagArgs = rawTarget?.startsWith("--") ? [rawTarget, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, { "skip-apps": { type: "boolean" } });
 
   const io = {
     loadConfig,
@@ -83,6 +87,7 @@ export async function cmdAgents(argv, overrides = {}) {
       tenantId,
       environment: io.environment,
       homeDir: io.homeDir,
+      includeApps: !flags["skip-apps"],
     }));
     await io.syncAgentProfiles({
       profiles,

package/src/commands/apps.js

@@ -31,6 +31,7 @@ import {
   ensureVendorApp,
   fetchGatewayModels,
   installManagedAppFiles,
+  managedLauncherName,
   normalizeAppTarget,
   quitBlockingApps,
   readTenantManifest,
@@ -40,7 +41,7 @@ import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
 import { syncAgentProfilesSafe } from "../agents.js";
 import { secureManagedCodexHome } from "../codexSecurity.js";
 import { impelCliInvocation } from "../selfInvocation.js";
-import { withProgress } from "../progress.js";
+import { createProgressLogger, withProgress } from "../progress.js";
 import {
   ensureWindowsClaudeApp,
   ensureWindowsChatGPTApp,
@@ -79,6 +80,102 @@ function windowsAppTargets(targetToken) {
   return null;
 }
 
+function macTargetOrArtifactExists(paths, target, existsSync = fs.existsSync) {
+  const launcher = paths[target].launcher;
+  if (existsSync(launcher)) return true;
+  try {
+    const baseName = path.basename(launcher);
+    return fs.readdirSync(path.dirname(launcher)).some((entry) => (
+      entry.startsWith(`${baseName}.tmp-`) || entry.startsWith(`${baseName}.previous-`)
+    ));
+  } catch {
+    return false;
+  }
+}
+
+/** Locally installed tenant variants eligible for an all-target app update. */
+export function installedAppTenantIds(targets, {
+  homeDir = os.homedir(),
+  platform = process.platform,
+  environment = process.env,
+  existsSync = fs.existsSync,
+  readdirSync = fs.readdirSync,
+} = {}) {
+  const tenantsRoot = path.join(appPaths(homeDir).root, "tenants");
+  let entries;
+  try {
+    entries = readdirSync(tenantsRoot, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  }
+
+  const installed = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    let tenantId;
+    try {
+      tenantId = normalizeTenantId(entry.name);
+    } catch {
+      continue;
+    }
+    const manifest = readTenantManifest(homeDir, tenantId);
+    const claudeUserData = platform === "win32"
+      ? windowsClaudeUserData(environment, tenantId)
+      : null;
+    const paths = appPaths(homeDir, tenantId, {
+      claudeUserData,
+      tenantName: manifest?.tenantName,
+    });
+    const hasTarget = targets.some((target) => {
+      if (platform !== "win32") return macTargetOrArtifactExists(paths, target, existsSync);
+      return target === "claude"
+        ? existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`))
+        : existsSync(path.join(paths.chatgpt.codexHome, "config.toml"));
+    });
+    if (hasTarget) installed.push(tenantId);
+  }
+  return installed.sort((left, right) => left.localeCompare(right));
+}
+
+async function maybeUpdateAllInstalledTenants(argv, overrides, platform) {
+  if (overrides.singleTenantUpdate) return null;
+  const [action = "status", rawTarget, ...rest] = argv;
+  if (action !== "update") return null;
+  const targetToken = rawTarget?.startsWith("--") ? undefined : rawTarget;
+  const targets = normalizeAppTarget(targetToken);
+  if (!targets || targets.length !== 2) return null;
+  const flagArgs = rawTarget?.startsWith("--") ? [rawTarget, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, {
+    "skip-vendor": { type: "boolean" },
+    "skip-skills": { type: "boolean" },
+    "skip-agents": { type: "boolean" },
+    force: { type: "boolean" },
+    tenant: { type: "string" },
+  });
+  if (flags.tenant) return null;
+
+  const discover = overrides.installedTenantIds || installedAppTenantIds;
+  const tenantIds = discover(targets, {
+    homeDir: overrides.homeDir || os.homedir(),
+    platform,
+    environment: overrides.environment || process.env,
+  });
+  if (tenantIds.length === 0) return null;
+
+  const log = overrides.log || console.log;
+  log(`Updating all managed app targets across ${tenantIds.length} installed tenant${tenantIds.length === 1 ? "" : "s"}: ${tenantIds.join(", ")}`);
+  const runTenantUpdate = overrides.runTenantUpdate || cmdApps;
+  for (const tenantId of tenantIds) {
+    const result = await runTenantUpdate(
+      ["update", "all", ...flagArgs, "--tenant", tenantId],
+      { ...overrides, singleTenantUpdate: true },
+    );
+    if (result === false) return false;
+  }
+  return true;
+}
+
 function windowsProcessFailure(result) {
   if (result?.error?.message) return redactSecretText(result.error.message);
   if (Number.isInteger(result?.status)) return `exit code ${result.status}`;
@@ -304,8 +401,14 @@ export async function cmdWindowsApps(argv, overrides = {}) {
         console.log(`${verb} Impel ${target === "claude" ? "Claude" : "ChatGPT"} profile at ${profile}`);
         const { client, env, label } = appSkillTarget(target, tenantPaths);
         if (!flags["skip-skills"]) {
-          await withProgress(`Syncing skills for ${label}`, () => (
-            io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label })
+          await withProgress(`Syncing skills for ${label}`, (spinner) => (
+            io.syncSkills({
+              client,
+              gatewayUrl: resolveSkillsGateway(config.gatewayUrl),
+              env,
+              label,
+              logger: createProgressLogger(spinner),
+            })
           ));
         }
         if (target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
@@ -347,6 +450,8 @@ export async function cmdWindowsApps(argv, overrides = {}) {
 
 export async function cmdApps(argv, overrides = {}) {
   const platform = overrides.platform || process.platform;
+  const allTenantUpdate = await maybeUpdateAllInstalledTenants(argv, overrides, platform);
+  if (allTenantUpdate !== null) return allTenantUpdate;
   if (platform === "win32") return cmdWindowsApps(argv, overrides);
   if (platform !== "darwin") {
     console.error("impel app: isolated Impel desktop apps are unavailable on this platform.");
@@ -444,6 +549,7 @@ export async function cmdApps(argv, overrides = {}) {
     syncAgents: syncAgentProfilesSafe,
     secureCodexHome: secureManagedCodexHome,
     removeLauncher: (launcher) => fs.rmSync(launcher, { recursive: true, force: true }),
+    openLauncher: openManagedLauncher,
     log: (message) => console.log(message),
     ...overrides,
   };
@@ -485,13 +591,22 @@ export async function cmdApps(argv, overrides = {}) {
     );
   }
 
-  // A running vendor or Impel app only needs to close when its bundle will be swapped.
+  // A running vendor or Impel app only needs to close when its bundle will be
+  // swapped. Remember which managed launchers we closed so the update can
+  // reopen them afterward and feel in-place (the fast path never quits at all).
+  let closedApps = [];
   if (staleBundleTargets.length > 0) {
-    await io.quitApps(staleBundleTargets, {
+    const quitResult = await io.quitApps(staleBundleTargets, {
       tenantId: config.tenantId,
       tenantName: config.tenantName,
     });
+    if (Array.isArray(quitResult)) closedApps = quitResult;
   }
+  const reopenTargets = new Set(
+    staleBundleTargets.filter((target) => closedApps.includes(
+      managedLauncherName(target, { tenantId: config.tenantId, tenantName: config.tenantName }),
+    )),
+  );
   if (force) {
     for (const status of statuses) io.removeLauncher(status.launcher);
   }
@@ -520,8 +635,8 @@ export async function cmdApps(argv, overrides = {}) {
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     if (!flags["skip-skills"]) {
-      await withProgress(`Syncing skills for ${label}`, () => (
-        io.syncSkills({ client, gatewayUrl, env, label })
+      await withProgress(`Syncing skills for ${label}`, (spinner) => (
+        io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
       ));
     }
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
@@ -534,6 +649,15 @@ export async function cmdApps(argv, overrides = {}) {
       tenantId: config.tenantId,
     }));
   }
+
+  // Reopen the managed apps we had to close for the bundle swap, so the update
+  // lands in place from the user's point of view. Apps that were already
+  // closed (not in reopenTargets) stay closed.
+  for (const item of installed) {
+    if (!reopenTargets.has(item.target)) continue;
+    io.log(`Reopening ${item.launcher} after the update…`);
+    io.openLauncher(item.launcher);
+  }
 }
 
 /**
@@ -628,8 +752,8 @@ export async function provisionAndOpenManagedApps({
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
-    await withProgress(`Syncing skills for ${label}`, () => (
-      io.syncSkills({ client, gatewayUrl, env, label })
+    await withProgress(`Syncing skills for ${label}`, (spinner) => (
+      io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
     ));
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
   }

package/src/commands/skills.js

@@ -8,6 +8,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { parseFlags } from "../args.js";
 import { loadConfig } from "../config.js";
 import { CODEX_HOME } from "../codexSetup.js";
 import { tenantCliProfilePaths } from "../cliProfiles.js";
@@ -15,7 +16,7 @@ import { CLAUDE_CONFIG_ID, appPaths } from "../apps.js";
 import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
 import { ensureTenantSelection } from "../tenants.js";
 import { windowsClaudeUserData } from "../windowsApps.js";
-import { mapWithConcurrency, withProgress } from "../progress.js";
+import { createProgressLogger, mapWithConcurrency, withProgress } from "../progress.js";
 
 const VALID_TARGETS = ["claude", "codex", "all"];
 
@@ -40,6 +41,7 @@ export function managedSkillProfiles(
     tenantId = null,
     platform = process.platform,
     environment = process.env,
+    includeApps = true,
   } = {},
 ) {
   const profiles = [];
@@ -59,7 +61,7 @@ export function managedSkillProfiles(
     const appInstalled = platform === "win32"
       ? existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`))
       : existsSync(paths.claude.launcher);
-    if (appInstalled) {
+    if (includeApps && appInstalled) {
       profiles.push({ label: "Impel Claude app", env: { CLAUDE_CONFIG_DIR: paths.claude.userData } });
     }
   } else {
@@ -71,7 +73,7 @@ export function managedSkillProfiles(
     const appInstalled = platform === "win32"
       ? existsSync(path.join(paths.chatgpt.codexHome, "config.toml"))
       : existsSync(paths.chatgpt.launcher);
-    if (appInstalled) {
+    if (includeApps && appInstalled) {
       profiles.push({ label: "Impel ChatGPT app", env: { CODEX_HOME: paths.chatgpt.codexHome } });
     }
   }
@@ -80,7 +82,8 @@ export function managedSkillProfiles(
 }
 
 export async function cmdSkills(argv, overrides = {}) {
-  const [action = "sync", targetToken] = argv;
+  const [action = "sync", rawTarget, ...rest] = argv;
+  const targetToken = rawTarget?.startsWith("--") ? undefined : rawTarget;
   if (action !== "sync") {
     console.error(`impel skills: unknown action "${action}". Try \`impel skills sync [claude|codex|all]\`.`);
     process.exitCode = 1;
@@ -93,6 +96,8 @@ export async function cmdSkills(argv, overrides = {}) {
     process.exitCode = 1;
     return;
   }
+  const flagArgs = rawTarget?.startsWith("--") ? [rawTarget, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, { "skip-apps": { type: "boolean" } });
 
   const io = {
     loadConfig,
@@ -108,12 +113,21 @@ export async function cmdSkills(argv, overrides = {}) {
     : null;
   const clients = target === "all" ? ["claude", "codex"] : [target];
   const profiles = clients.flatMap((client) => (
-    io.managedProfiles(client, { tenantId }).map((profile) => ({ client, profile }))
+    io.managedProfiles(client, {
+      tenantId,
+      includeApps: !flags["skip-apps"],
+    }).map((profile) => ({ client, profile }))
   ));
 
-  await withProgress(`Syncing skills into ${profiles.length} managed profile${profiles.length === 1 ? "" : "s"}`, () => (
+  await withProgress(`Syncing skills into ${profiles.length} managed profile${profiles.length === 1 ? "" : "s"}`, (spinner) => (
     mapWithConcurrency(profiles, 4, ({ client, profile }) => (
-      io.syncSkills({ client, gatewayUrl, env: profile.env, label: profile.label })
+      io.syncSkills({
+        client,
+        gatewayUrl,
+        env: profile.env,
+        label: profile.label,
+        logger: createProgressLogger(spinner),
+      })
     ))
   ));
 }

package/src/commands/update.js

@@ -15,6 +15,7 @@ import { loadConfig, redactSecretText } from "../config.js";
 import { nativeCommandInvocation } from "../nativeProcess.js";
 import { windowsClaudeUserData } from "../windowsApps.js";
 import { withProgress } from "../progress.js";
+import { installedAppTenantIds } from "./apps.js";
 import {
   fetchRemoteVersion,
   installedVersion,
@@ -29,9 +30,9 @@ const CLI_BIN = fileURLToPath(new URL("../../bin/impel.js", import.meta.url));
 const HELP = `impel update - update everything Impel in one command
 
 Reinstalls impel-cli from npm, then cascades with the NEW build:
-\`impel app update all\` (update the platform's vendor apps and managed app
-profiles) when Impel apps are installed, then \`impel skills sync all\` and
-\`impel agents sync all\` across every managed profile.
+\`impel app update all\` (update every locally installed tenant's vendor apps
+and managed app profiles), then \`impel skills sync all\` and
+\`impel agents sync all\` across native and isolated CLI profiles.
 
 Usage:
   impel update              Update the CLI, then cascade to apps, skills, and agents
@@ -94,27 +95,40 @@ export function defaultRunAppsUpdate({
   execPath = process.execPath,
   cliBin = CLI_BIN,
 } = {}) {
-  const result = spawn(execPath, [cliBin, "app", "update", "all", "--skip-skills", "--skip-agents"], {
+  const result = spawn(execPath, [cliBin, "app", "update", "all"], {
     stdio: "inherit",
   });
   return result.status === 0;
 }
 
-function defaultRunSkillsSync() {
-  const result = spawnSync(process.execPath, [CLI_BIN, "skills", "sync", "all"], {
+export function defaultRunSkillsSync({
+  spawn = spawnSync,
+  execPath = process.execPath,
+  cliBin = CLI_BIN,
+} = {}) {
+  const result = spawn(execPath, [cliBin, "skills", "sync", "all", "--skip-apps"], {
     stdio: "inherit",
   });
   return result.status === 0;
 }
 
-function defaultRunAgentsSync() {
-  const result = spawnSync(process.execPath, [CLI_BIN, "agents", "sync", "all"], {
+export function defaultRunAgentsSync({
+  spawn = spawnSync,
+  execPath = process.execPath,
+  cliBin = CLI_BIN,
+} = {}) {
+  const result = spawn(execPath, [cliBin, "agents", "sync", "all", "--skip-apps"], {
     stdio: "inherit",
   });
   return result.status === 0;
 }
 
 function anyAppInstalled(homeDir = os.homedir()) {
+  if (installedAppTenantIds(["claude", "chatgpt"], {
+    homeDir,
+    platform: process.platform,
+    environment: process.env,
+  }).length > 0) return true;
   const config = loadConfig();
   const claudeUserData = process.platform === "win32"
     ? windowsClaudeUserData(process.env, config?.tenantId || null)
@@ -202,7 +216,7 @@ export async function cmdUpdate(argv, overrides = {}) {
     console.log(`CLI: updated${remote ? ` to v${remote}` : ""}.`);
   }
 
-  // ── Cascade: apps, then skills across every managed profile ────────────
+  // ── Cascade: every tenant app, then non-app managed profiles ───────────
   let cascadeFailed = false;
   if (flags["skip-apps"]) {
     console.log("Apps: skipped (--skip-apps).");
@@ -212,21 +226,21 @@ export async function cmdUpdate(argv, overrides = {}) {
     console.log("Apps: none installed; skipping (run `impel app install` or `impel setup`).");
   } else {
     console.log(io.platform === "win32"
-      ? "Apps: updating the signed Claude and ChatGPT vendor apps and isolated profiles…"
-      : "Apps: refreshing profiles and rebuilding only stale app bundles…");
+      ? "Apps: updating every installed tenant's signed Claude and ChatGPT profiles…"
+      : "Apps: refreshing every installed tenant and rebuilding only stale app bundles…");
     if (!await withProgress("Updating managed desktop apps", () => io.runAppsUpdate())) {
       console.error("impel update: the app update failed; re-run `impel app update` after fixing the issue.");
       cascadeFailed = true;
     }
   }
 
-  console.log("Skills: syncing every managed profile…");
+  console.log("Skills: syncing native and isolated CLI profiles…");
   if (!await withProgress("Syncing skills across managed profiles", () => io.runSkillsSync())) {
     console.error("impel update: skill sync failed; re-run `impel skills sync` after fixing the issue.");
     cascadeFailed = true;
   }
 
-  console.log("Agents: syncing the selected tenant into every managed profile…");
+  console.log("Agents: syncing the selected tenant into native and isolated CLI profiles…");
   if (!await withProgress("Syncing agents across managed profiles", () => io.runAgentsSync())) {
     console.error("impel update: agent sync failed; re-run `impel agents sync` after fixing the issue.");
     cascadeFailed = true;

package/src/progress.js

@@ -2,7 +2,9 @@ const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "
 
 function noopSpinner() {
   return {
+    active: false,
     update() {},
+    writeLine() { return false; },
     succeed() {},
     fail() {},
   };
@@ -37,9 +39,16 @@ export function createSpinner(label, { stream = process.stderr } = {}) {
   const timer = setInterval(render, 80);
   timer.unref?.();
   return {
+    active: true,
     update(nextLabel) {
       if (!finished && nextLabel) currentLabel = String(nextLabel);
     },
+    writeLine(message) {
+      if (finished) return false;
+      stream.write(`\r\x1b[K${String(message)}\n`);
+      render();
+      return true;
+    },
     succeed(nextLabel) {
       finish("✓", nextLabel);
     },
@@ -49,6 +58,18 @@ export function createSpinner(label, { stream = process.stderr } = {}) {
   };
 }
 
+/** Keep ordinary log lines from overwriting an active progress display. */
+export function createProgressLogger(spinner, fallback = console) {
+  const write = (method, args) => {
+    const message = args.map((value) => String(value)).join(" ");
+    if (!spinner?.writeLine?.(message)) fallback[method](...args);
+  };
+  return {
+    log: (...args) => write("log", args),
+    warn: (...args) => write("warn", args),
+  };
+}
+
 export async function withProgress(label, fn, options) {
   const spinner = createSpinner(label, options);
   try {

package/src/skills.js

@@ -19,7 +19,7 @@
 //   - Codex:       `plugin marketplace add|upgrade`, `plugin add` (install + refresh)
 // so we keep a per-client command table rather than assuming one shape.
 
-import { spawnSync } from "node:child_process";
+import { spawn } from "node:child_process";
 
 import { resolveDefaultGateway, normalizeGatewayUrl } from "./config.js";
 import { nativeCommandInvocation } from "./nativeProcess.js";
@@ -159,44 +159,95 @@ export function buildSkillCommands({ client, marketplaceSourceUrl: sourceUrl, ma
   return commands;
 }
 
-/** Default command runner: spawns the client binary non-interactively. */
-function defaultRun(bin, args, env) {
+const SKILL_COMMAND_TIMEOUT_MS = 120_000;
+const SKILL_COMMAND_OUTPUT_LIMIT = 10 * 1024 * 1024;
+
+/** Default async command runner: keeps progress timers responsive while plugins sync. */
+export function runSkillCommand(bin, args, env, {
+  spawnImpl = spawn,
+  timeoutMs = SKILL_COMMAND_TIMEOUT_MS,
+} = {}) {
   const environment = { ...process.env, ...env };
   let invocation;
   try {
     invocation = nativeCommandInvocation(bin, args, environment);
   } catch (error) {
-    return {
+    return Promise.resolve({
       ok: false,
       missing: false,
       status: null,
       stdout: "",
       stderr: error?.message || String(error),
-    };
+    });
   }
-  const result = spawnSync(invocation.command, invocation.args, {
-    env: environment,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: 120000,
-    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
-  });
-  if (result.error) {
-    return {
+
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnImpl(invocation.command, invocation.args, {
+        env: environment,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+      });
+    } catch (error) {
+      resolve({
+        ok: false,
+        missing: error?.code === "ENOENT",
+        status: null,
+        stdout: "",
+        stderr: error?.message || String(error),
+      });
+      return;
+    }
+
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const append = (current, chunk) => (
+      `${current}${String(chunk)}`.slice(-SKILL_COMMAND_OUTPUT_LIMIT)
+    );
+    child.stdout?.setEncoding?.("utf8");
+    child.stderr?.setEncoding?.("utf8");
+    child.stdout?.on("data", (chunk) => { stdout = append(stdout, chunk); });
+    child.stderr?.on("data", (chunk) => { stderr = append(stderr, chunk); });
+
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      resolve(result);
+    };
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      try {
+        child.kill();
+      } catch {
+        // The process may have exited between the timer firing and kill().
+      }
+      finish({
+        ok: false,
+        missing: false,
+        status: null,
+        stdout,
+        stderr: `skill command timed out after ${timeoutMs}ms`,
+      });
+    }, timeoutMs);
+    child.on("error", (error) => finish({
       ok: false,
-      missing: result.error.code === "ENOENT",
+      missing: error?.code === "ENOENT",
       status: null,
-      stdout: "",
-      stderr: result.error.message || String(result.error),
-    };
-  }
-  return {
-    ok: result.status === 0,
-    missing: false,
-    status: result.status,
-    stdout: result.stdout || "",
-    stderr: result.stderr || "",
-  };
+      stdout,
+      stderr: error?.message || String(error),
+    }));
+    child.on("close", (status) => finish({
+      ok: !timedOut && status === 0,
+      missing: false,
+      status,
+      stdout,
+      stderr: timedOut ? `skill command timed out after ${timeoutMs}ms` : stderr,
+    }));
+  });
 }
 
 function firstLine(text) {
@@ -237,7 +288,7 @@ export async function syncSkills({
   env = {},
   label,
   fetchImpl = fetch,
-  run = defaultRun,
+  run = runSkillCommand,
   logger = console,
 } = {}) {
   const spec = CLIENT_SPECS[client];
@@ -254,7 +305,7 @@ export async function syncSkills({
 
   try {
     // Confirm the binary and its `plugin` subcommand exist before doing anything.
-    const help = run(spec.bin, ["plugin", "--help"], env);
+    const help = await run(spec.bin, ["plugin", "--help"], env);
     if (help.missing) {
       logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${spec.bin}\` CLI not found on PATH.`);
       return { client, label: displayLabel, skipped: true, reason: "binary-missing" };
@@ -272,7 +323,7 @@ export async function syncSkills({
     logger.log(`Skills: syncing ${SKILL_PLUGIN_NAME} for ${displayLabel}…`);
     const failures = [];
     for (const command of commands) {
-      const result = run(spec.bin, command.args, env);
+      const result = await run(spec.bin, command.args, env);
       if (result.missing) {
         failures.push({ phase: command.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
         break;