impel-cli 0.12.1 → 0.13.0

package/README.md

@@ -246,6 +246,14 @@ followed by `impel skills sync all` and `impel agents sync all` across every
 native and isolated CLI profile. Each tenant's app step syncs that tenant's app
 profiles; the dedicated steps exclude apps, so every profile is synced once.
 
+Most updates are in place — the desktop apps are **not** closed. A vendored
+bundle is only rebuilt (and therefore only quit) when the bundle-building logic
+or the pinned vendor version actually changes, not on every CLI release, so a
+routine update just rewrites configs, skills, and agents while the apps keep
+running. When a rebuild genuinely is required, `impel app update` closes only
+the app whose bundle it will swap and **reopens it afterward**, so the swap
+lands without you relaunching by hand. Apps you had already closed stay closed.
+
 Update discovery compares the installed package version with npm's public
 `latest` metadata, cached for 6 hours in
 `~/.config/impel/update-check.json`. It does not invoke Git or contact GitHub.
@@ -746,13 +754,16 @@ that have never been installed. The older global `Impel Claude.app` /
 `Impel ChatGPT.app` launcher is removed after the first successful
 tenant-specific rebuild.
 
-`impel app update` compares the installed bundle's CLI version, pinned vendor
-version, identity, profile paths, and ASAR compatibility hash before touching
-it. A current bundle is not closed, cloned, patched, or codesigned; its config
-and model catalog are still refreshed. If an interrupted update left a machine
-in a bad state, `impel app update --force` removes the selected launcher and
-performs a clean rebuild while sweeping abandoned `.tmp-*` and `.previous-*`
-staging directories.
+`impel app update` compares the installed bundle's build fingerprint, signing
+mode, pinned vendor version, identity, profile paths, and ASAR compatibility
+hash before touching it. The build fingerprint tracks the bundle-BUILDING logic
+(asar patches, plist rewrites, signing), not the CLI version, so a CLI release
+that doesn't change bundle bytes leaves installed bundles — and their macOS
+permission grants — alone. A current bundle is not closed, cloned, patched, or
+codesigned; its config and model catalog are still refreshed. If an interrupted
+update left a machine in a bad state, `impel app update --force` removes the
+selected launcher and performs a clean rebuild while sweeping abandoned
+`.tmp-*` and `.previous-*` staging directories.
 
 Skills plugin subprocesses run asynchronously, so the TTY progress indicator
 continues animating while Claude or Codex refreshes a marketplace. Skill status
@@ -776,7 +787,7 @@ For ChatGPT/Codex, the gateway controls which models and capabilities are
 enabled while the installer merges those entries with the vendor app's native
 catalog. The Impel copy relaxes the vendor renderer's ChatGPT-account-only Fast
 gate because gateway auth supplies the entitlement instead. The outer wrapper
-is then ad-hoc signed locally without replacing the nested OpenAI signing
+is then signed locally (see below) without replacing the nested OpenAI signing
 identity. This preserves model-specific instructions and exposes
 the same reasoning-effort and service-tier controls as the normal app, including
 Ultra where supported and Fast only on models that advertise the `priority`
@@ -786,10 +797,26 @@ Impel PAT. Config refreshes replace only the Impel-managed gateway block; plugin
 desktop preferences, projects, and other settings written by the isolated app
 are kept.
 
-Impel Claude and the outer Impel ChatGPT wrapper are ad-hoc signed locally after
-their bundle identities and launch wrappers are installed. The nested ChatGPT
-bundle retains OpenAI's signature. The Claude 3P config necessarily contains
-the PAT because that app accepts a
+Impel Claude and the outer Impel ChatGPT wrapper are signed locally after their
+bundle identities and launch wrappers are installed. The nested ChatGPT bundle
+retains OpenAI's signature.
+
+By default the CLI signs each rebuild with a **stable per-machine identity** — a
+self-signed certificate created once in a dedicated keychain under
+`~/.config/impel/codesign` (no Apple Developer account is involved). macOS ties
+every privacy (TCC) grant — microphone, screen recording, folder access,
+Automation, accessibility — to the app's code-signing designated requirement. A
+stable identity keeps that requirement constant across rebuilds, so the grants
+you approve survive `impel app update` the way they do for a normal app instead
+of re-prompting after every rebuild. The one-time switch from the old ad-hoc
+signature to the stable identity triggers a single final round of prompts. If
+the local signing toolchain is unavailable the CLI logs a notice and falls back
+to ad-hoc signing (the previous behavior). Two environment overrides are
+available: `IMPEL_CODESIGN_ADHOC=1` forces ad-hoc signing, and
+`IMPEL_CODESIGN_IDENTITY=<name>` signs with a specific existing identity (e.g. a
+real `Developer ID Application: …`).
+
+The Claude 3P config necessarily contains the PAT because that app accepts a
 gateway API key rather than a token-helper command. It is stored in the same
 owner-only Impel config tree as the primary credential. ChatGPT/Codex uses a
 command-backed helper and does not copy the PAT into TOML. The installable app

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -11,6 +11,7 @@ import {
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
+import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
 
 export const CLAUDE_CONFIG_ID = "1ced0000-0000-4000-8000-000000000001";
 const CHATGPT_CONFIG_START = "# >>> impel app managed gateway >>>";
@@ -144,6 +145,15 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // slow open path (and thus a full config rewrite) after a CLI update.
 export const CURRENT_CONFIG_VERSION = 10;
 
+// Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
+// helper rebranding, and signing. A vendored bundle is rebuilt only when this
+// changes, NOT on every CLI release, so routine CLI updates (bug fixes, new
+// commands, config tweaks) no longer quit and re-sign the running desktop apps
+// — which is what made every `impel update` re-trigger macOS permission
+// prompts. Bump this ONLY when a code change alters the bytes of a built
+// bundle; leave it alone for changes that don't touch bundle contents.
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-16.1";
+
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
   try {
@@ -169,17 +179,21 @@ export function readBundleCompatibility(launcher) {
 }
 
 /**
- * A vendored bundle needs no rebuild when it was built by this CLI version
- * from the vendor app version currently on disk. Rebuilds are the expensive
- * part of install/open (bundle clone + asar patch + deep codesign), so this
- * check is what makes repeat opens fast.
+ * A vendored bundle needs no rebuild when it was built by the SAME bundle
+ * logic (BUNDLE_BUILD_FINGERPRINT) and signing mode, from the vendor app
+ * version currently on disk. Keying on the bundle fingerprint rather than the
+ * CLI version is deliberate: rebuilds are the expensive part of install/open
+ * (bundle clone + asar patch + deep codesign) AND they force the running apps
+ * closed, so a routine CLI update that doesn't change bundle bytes must leave
+ * the installed bundles — and their macOS permission grants — untouched.
  */
-export function bundleIsCurrent(status) {
+export function bundleIsCurrent(status, { signingMode = desiredSigningMode() } = {}) {
   if (!status.launcherInstalled || !status.vendorPath || !status.vendorVersion) return false;
   const compatibility = readBundleCompatibility(status.launcher);
   return Boolean(
     compatibility
-    && compatibility.cliVersion === CLI_VERSION
+    && compatibility.bundleFingerprint === BUNDLE_BUILD_FINGERPRINT
+    && compatibility.signingMode === signingMode
     && compatibility.vendorVersion === status.vendorVersion
     && compatibility.bundleIdentifier === status.bundleIdentifier
     && compatibility.displayName === status.label
@@ -251,7 +265,10 @@ const QUIT_POLL_MS = 500;
 /**
  * Closes every running app whose bundle the given targets will replace:
  * graceful AppleScript quit first, SIGTERM if it lingers, and a hard error
- * telling the user to close it themselves if even that fails.
+ * telling the user to close it themselves if even that fails. Returns the app
+ * names that were actually running and got closed, so callers can reopen the
+ * managed launchers afterward (an update the user did not ask to also relaunch
+ * leaves already-closed apps closed).
  */
 export async function quitBlockingApps(targets, {
   tenantId = null,
@@ -280,16 +297,28 @@ export async function quitBlockingApps(targets, {
     return !isRunning(name);
   }
 
+  const closed = [];
   for (const name of blockingAppNames(targets, { tenantId, tenantName })) {
     if (!isRunning(name)) continue;
     log(`${name} is running; closing it before touching app bundles…`);
     requestQuit(name);
-    if (await goneWithin(name, quitWaitMs)) continue;
+    if (await goneWithin(name, quitWaitMs)) { closed.push(name); continue; }
     log(`${name} did not quit gracefully; terminating it…`);
     forceQuit(name);
-    if (await goneWithin(name, killWaitMs)) continue;
+    if (await goneWithin(name, killWaitMs)) { closed.push(name); continue; }
     throw new Error(`${name} is still running; close it manually, then re-run`);
   }
+  return closed;
+}
+
+/**
+ * The managed (Impel-branded) launcher name for a target, as it appears in
+ * blockingAppNames / quitBlockingApps output. Used to decide which just-closed
+ * apps to reopen after an update — only the managed launchers, never a user's
+ * separate vendor Claude/ChatGPT.
+ */
+export function managedLauncherName(target, { tenantId = null, tenantName = null } = {}) {
+  return managedAppIdentity(target, tenantId, tenantName).launcherName.replace(/\.app$/u, "");
 }
 
 export function appPaths(homeDir = os.homedir(), tenantId = null, {
@@ -1016,8 +1045,10 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl) {
 
     const macos = path.join(staging, "Contents", "MacOS");
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 2,
+      schemaVersion: 3,
       cliVersion: CLI_VERSION,
+      bundleFingerprint: BUNDLE_BUILD_FINGERPRINT,
+      signingMode: desiredSigningMode(),
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
       bundleIdentifier: paths.claude.bundleIdentifier,
@@ -1100,8 +1131,10 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
       0o644,
     );
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 2,
+      schemaVersion: 3,
       cliVersion: CLI_VERSION,
+      bundleFingerprint: BUNDLE_BUILD_FINGERPRINT,
+      signingMode: desiredSigningMode(),
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
       bundleIdentifier: paths.chatgpt.bundleIdentifier,
@@ -1559,35 +1592,43 @@ if (process.type === "browser" && displayName) {
 `;
 }
 
-function signVendoredApp(bundle, vendorExecutable, label) {
+function signVendoredApp(bundle, vendorExecutable, label, identity = null) {
   if (process.platform !== "darwin" || !isMachO(vendorExecutable)) return;
+  // Resolve (and, on first use, create) the signing identity only once we know
+  // we will actually sign — this keeps the guard above side-effect-free.
+  identity ||= resolveSigningIdentity();
   spawnSync("/usr/bin/xattr", ["-dr", "com.apple.quarantine", bundle], { stdio: "ignore" });
-  let signed = codesign(vendoredAppSigningArgs(bundle, label));
+  let signed = codesign(vendoredAppSigningArgs(bundle, label, identity));
   if (signed.status !== 0) throw new Error(`failed to sign vendored Impel ${label} app: ${signed.stderr.trim()}`);
   if (label === "Claude") {
-    signed = signVendoredClaudeCapabilities(bundle);
+    signed = signVendoredClaudeCapabilities(bundle, identity);
     if (signed.status !== 0) throw new Error(`failed to restore vendored Impel Claude capabilities: ${signed.stderr.trim()}`);
   }
   const verified = spawnSync("/usr/bin/codesign", ["--verify", "--deep", "--strict", bundle], { encoding: "utf8" });
   if (verified.status !== 0) throw new Error(`vendored Impel ${label} signature verification failed: ${verified.stderr.trim()}`);
 }
 
-export function vendoredAppSigningArgs(bundle, label) {
+export function vendoredAppSigningArgs(bundle, label, identity = ADHOC_IDENTITY) {
+  // A stable local signing identity keeps the bundle's code-signing designated
+  // requirement constant across rebuilds, so macOS retains the user's TCC
+  // permission grants after every `impel app update` (see src/codesign.js).
+  //
   // Browser control authenticates the ChatGPT process by OpenAI's code-signing
-  // identity. Deep ad-hoc signing replaces that identity on every nested code
-  // object, including Contents/MacOS/ChatGPT, so sign only the modified outer
-  // bundle and preserve the vendor signatures within it. Claude deliberately
-  // retains its separate deep-signing and entitlement-restoration flow below.
+  // identity. Deep signing replaces that identity on every nested code object,
+  // including Contents/MacOS/ChatGPT, so sign only the modified outer bundle
+  // and preserve the vendor signatures within it. Claude deliberately retains
+  // its separate deep-signing and entitlement-restoration flow below.
   return label === "ChatGPT"
-    ? ["--force", "--sign", "-", bundle]
-    : ["--force", "--deep", "--sign", "-", bundle];
+    ? ["--force", ...codesignIdentityArgs(identity), bundle]
+    : ["--force", "--deep", ...codesignIdentityArgs(identity), bundle];
 }
 
-function signVendoredClaudeCapabilities(bundle) {
+function signVendoredClaudeCapabilities(bundle, identity = ADHOC_IDENTITY) {
   const fullEntitlements = entitlementPlist({
     "com.apple.security.cs.allow-jit": true,
-    // Ad-hoc signatures have no common Apple Team ID, so hardened runtime
-    // otherwise refuses to map the app's separately signed Electron framework.
+    // A local self-signed (or ad-hoc) signature shares no Apple Team ID with
+    // Anthropic's separately signed Electron framework, so hardened runtime
+    // otherwise refuses to map it. Library validation stays disabled for both.
     "com.apple.security.cs.disable-library-validation": true,
     "com.apple.security.device.audio-input": true,
     "com.apple.security.device.bluetooth": true,
@@ -1618,13 +1659,15 @@ function signVendoredClaudeCapabilities(bundle) {
     for (const helper of helpers) {
       const entitlements = helper.name.endsWith(" Helper.app") ? fullPath : jitPath;
       const result = codesign([
-        "--force", "--deep", "--options", "runtime", "--entitlements", entitlements, "--sign", "-",
+        "--force", "--deep", "--options", "runtime", "--entitlements", entitlements,
+        ...codesignIdentityArgs(identity),
         path.join(frameworks, helper.name),
       ]);
       if (result.status !== 0) return result;
     }
     return codesign([
-      "--force", "--options", "runtime", "--entitlements", fullPath, "--sign", "-", bundle,
+      "--force", "--options", "runtime", "--entitlements", fullPath,
+      ...codesignIdentityArgs(identity), bundle,
     ]);
   } finally {
     fs.rmSync(fullPath, { force: true });

package/src/codesign.js

@@ -0,0 +1,246 @@
+// Stable local code-signing identity for the managed macOS app bundles.
+//
+// macOS ties every TCC privacy grant (microphone, screen recording, folder
+// access, Automation/AppleScript, accessibility, …) to the app's code-signing
+// "designated requirement". An ad-hoc signature (`codesign --sign -`) has no
+// stable identity: its requirement degenerates to the binary's own cdhash,
+// which changes on every rebuild. So each time `impel app update` re-signed a
+// rebuilt bundle, macOS saw a brand-new app and re-prompted for every
+// permission the user had already granted.
+//
+// Signing rebuilds with a stable per-machine self-signed certificate instead
+// gives the bundle a constant designated requirement, so TCC grants survive
+// updates the way they do for a normal app. The certificate lives in a
+// dedicated keychain under the Impel config dir; no Apple Developer account is
+// involved (these bundles are patched and built on the user's own machine, so
+// Developer ID signing is impossible anyway).
+//
+// Everything here is best-effort: if any step fails — no `security`/`openssl`,
+// a locked keychain, an unusual environment — we fall back to ad-hoc signing,
+// which is exactly today's behavior. Updates never fail because signing could
+// not be upgraded.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+
+import { CONFIG_DIR } from "./config.js";
+
+export const SIGNING_IDENTITY_NAME = "Impel Local Codesigning";
+
+// Ad-hoc: what every managed bundle was signed with before stable identities.
+export const ADHOC_IDENTITY = Object.freeze({
+  mode: "adhoc",
+  signArg: "-",
+  keychainArgs: Object.freeze([]),
+  descriptor: "adhoc",
+});
+
+/** `codesign` arguments that select the given identity (and its keychain). */
+export function codesignIdentityArgs(identity = ADHOC_IDENTITY) {
+  return [...identity.keychainArgs, "--sign", identity.signArg];
+}
+
+/**
+ * The coarse signing mode the current environment WANTS, without creating or
+ * touching any certificate. `bundleIsCurrent` compares this against the mode
+ * recorded when a bundle was built, so a change in signing preference (or an
+ * old ad-hoc bundle that predates stable signing) forces exactly one rebuild.
+ * Kept cheap on purpose: resolving the concrete local identity would create a
+ * keychain, which must not happen during a read-only currency check.
+ */
+export function desiredSigningMode(env = process.env, platform = process.platform) {
+  if (platform !== "darwin") return "adhoc";
+  if (truthyEnv(env.IMPEL_CODESIGN_ADHOC)) return "adhoc";
+  if (env.IMPEL_CODESIGN_IDENTITY) return `external:${env.IMPEL_CODESIGN_IDENTITY}`;
+  return "local";
+}
+
+function truthyEnv(value) {
+  return value === "1" || value === "true" || value === "yes";
+}
+
+function defaultRun(command, args, { input } = {}) {
+  return spawnSync(command, args, { encoding: "utf8", input });
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+// find-identity prints lines like `  1) 0A1B…40hex "Impel Local Codesigning"`.
+function parseIdentitySha(output, name) {
+  const pattern = new RegExp(`\\)\\s+([0-9A-Fa-f]{40})\\s+"${escapeRegExp(name)}"`, "u");
+  const match = String(output || "").match(pattern);
+  return match ? match[1] : null;
+}
+
+let cachedIdentity = null;
+
+/**
+ * Resolve the signing identity to use for managed bundles, creating the stable
+ * local certificate on first use. Cached per process. Returns an identity
+ * object whose `signArg`/`keychainArgs` feed straight into `codesign`.
+ *
+ * Env overrides:
+ *   IMPEL_CODESIGN_ADHOC=1        force ad-hoc signing (the pre-1.0 behavior)
+ *   IMPEL_CODESIGN_IDENTITY=<id>  sign with a specific existing identity
+ *                                 (e.g. a real "Developer ID Application: …")
+ */
+export function resolveSigningIdentity(deps = {}) {
+  const {
+    env = process.env,
+    platform = process.platform,
+    run = defaultRun,
+    configDir = CONFIG_DIR,
+    fsImpl = fs,
+    warn = (message) => console.warn(message),
+    randomBytes = crypto.randomBytes,
+    cache = true,
+  } = deps;
+
+  if (cache && cachedIdentity) return cachedIdentity;
+  if (platform !== "darwin") return ADHOC_IDENTITY;
+  if (truthyEnv(env.IMPEL_CODESIGN_ADHOC)) return ADHOC_IDENTITY;
+
+  if (env.IMPEL_CODESIGN_IDENTITY) {
+    const identity = {
+      mode: "external",
+      signArg: env.IMPEL_CODESIGN_IDENTITY,
+      keychainArgs: [],
+      descriptor: `external:${env.IMPEL_CODESIGN_IDENTITY}`,
+    };
+    if (cache) cachedIdentity = identity;
+    return identity;
+  }
+
+  try {
+    const identity = ensureLocalSigningIdentity({ run, configDir, fsImpl, randomBytes });
+    if (cache) cachedIdentity = identity;
+    return identity;
+  } catch (error) {
+    warn(`impel: falling back to ad-hoc app signing (${error?.message || error}); permission prompts may repeat after updates.`);
+    if (cache) cachedIdentity = ADHOC_IDENTITY;
+    return ADHOC_IDENTITY;
+  }
+}
+
+/** For tests: drop the per-process memo so env overrides take effect again. */
+export function resetSigningIdentityCache() {
+  cachedIdentity = null;
+}
+
+function ensureLocalSigningIdentity({ run, configDir, fsImpl, randomBytes }) {
+  const dir = path.join(configDir, "codesign");
+  const keychain = path.join(dir, "impel-codesign.keychain-db");
+  const passwordFile = path.join(dir, "keychain.pass");
+  fsImpl.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  // Reuse an already-created identity: the whole point is that the cert (and
+  // therefore the designated requirement) stays stable across updates.
+  if (fsImpl.existsSync(keychain) && fsImpl.existsSync(passwordFile)) {
+    const password = fsImpl.readFileSync(passwordFile, "utf8").trim();
+    unlockKeychain(run, keychain, password);
+    const existing = findLocalIdentitySha(run, keychain);
+    if (existing) return localIdentity(existing, keychain);
+  }
+
+  const password = randomBytes(24).toString("hex");
+  createLocalSigningIdentity({ run, dir, keychain, password, fsImpl });
+  fsImpl.writeFileSync(passwordFile, `${password}\n`, { mode: 0o600 });
+
+  const sha = findLocalIdentitySha(run, keychain);
+  if (!sha) throw new Error("created signing identity was not found in its keychain");
+  ensureKeychainInSearchList(run, keychain);
+  return localIdentity(sha, keychain);
+}
+
+function localIdentity(sha, keychain) {
+  return {
+    mode: "local",
+    signArg: sha,
+    keychainArgs: ["--keychain", keychain],
+    descriptor: `local:${sha}`,
+  };
+}
+
+function findLocalIdentitySha(run, keychain) {
+  const result = run("/usr/bin/security", ["find-identity", "-v", "-p", "codesigning", keychain]);
+  if (result.status !== 0) return null;
+  return parseIdentitySha(result.stdout, SIGNING_IDENTITY_NAME);
+}
+
+function createLocalSigningIdentity({ run, dir, keychain, password, fsImpl }) {
+  const work = fsImpl.mkdtempSync(path.join(os.tmpdir(), "impel-codesign-"));
+  const keyPath = path.join(work, "key.pem");
+  const certPath = path.join(work, "cert.pem");
+  const p12Path = path.join(work, "identity.p12");
+  const p12Pass = crypto.randomBytes(18).toString("hex");
+  try {
+    // A self-signed leaf certificate with the codeSigning EKU. It is never
+    // trusted for distribution; it only needs to exist so codesign can bind a
+    // stable identity into the signature. Locally built, de-quarantined apps
+    // launch regardless of certificate trust (Gatekeeper only gates quarantined
+    // downloads), exactly as the ad-hoc bundles do today.
+    runOrThrow(run, "/usr/bin/openssl", [
+      "req", "-x509", "-newkey", "rsa:2048",
+      "-keyout", keyPath, "-out", certPath,
+      "-days", "3650", "-nodes",
+      "-subj", `/CN=${SIGNING_IDENTITY_NAME}`,
+      "-addext", "basicConstraints=critical,CA:false",
+      "-addext", "keyUsage=critical,digitalSignature",
+      "-addext", "extendedKeyUsage=critical,codeSigning",
+    ], "generate signing certificate");
+    runOrThrow(run, "/usr/bin/openssl", [
+      "pkcs12", "-export", "-out", p12Path,
+      "-inkey", keyPath, "-in", certPath,
+      "-passout", `pass:${p12Pass}`,
+      "-name", SIGNING_IDENTITY_NAME,
+    ], "package signing certificate");
+
+    if (!fsImpl.existsSync(keychain)) {
+      runOrThrow(run, "/usr/bin/security", ["create-keychain", "-p", password, keychain], "create signing keychain");
+    }
+    // No auto-lock: codesign must reach the private key non-interactively.
+    run("/usr/bin/security", ["set-keychain-settings", keychain]);
+    unlockKeychain(run, keychain, password);
+    runOrThrow(run, "/usr/bin/security", [
+      "import", p12Path, "-k", keychain, "-P", p12Pass, "-T", "/usr/bin/codesign",
+    ], "import signing identity");
+    // Grant codesign non-interactive access to the key so signing never pops a
+    // "codesign wants to use a key" GUI prompt. We own the keychain password.
+    runOrThrow(run, "/usr/bin/security", [
+      "set-key-partition-list", "-S", "apple-tool:,apple:,codesign:", "-s", "-k", password, keychain,
+    ], "authorize codesign for the signing key");
+  } finally {
+    fsImpl.rmSync(work, { recursive: true, force: true });
+  }
+}
+
+function unlockKeychain(run, keychain, password) {
+  run("/usr/bin/security", ["unlock-keychain", "-p", password, keychain]);
+}
+
+// codesign resolves an identity by searching the user's keychain search list,
+// so the dedicated keychain has to be on it. Append without disturbing the
+// user's existing keychains (a bare `-s <one>` would replace the whole list).
+function ensureKeychainInSearchList(run, keychain) {
+  const listed = run("/usr/bin/security", ["list-keychains", "-d", "user"]);
+  const current = String(listed.stdout || "")
+    .split("\n")
+    .map((line) => line.trim().replace(/^"|"$/gu, ""))
+    .filter(Boolean);
+  if (current.includes(keychain)) return;
+  run("/usr/bin/security", ["list-keychains", "-d", "user", "-s", ...current, keychain]);
+}
+
+function runOrThrow(run, command, args, description) {
+  const result = run(command, args);
+  if (result.status !== 0 || result.error) {
+    const detail = result.error?.message || String(result.stderr || "").trim() || `exit ${result.status}`;
+    throw new Error(`${description} failed: ${detail}`);
+  }
+  return result;
+}

package/src/commands/apps.js

@@ -31,6 +31,7 @@ import {
   ensureVendorApp,
   fetchGatewayModels,
   installManagedAppFiles,
+  managedLauncherName,
   normalizeAppTarget,
   quitBlockingApps,
   readTenantManifest,
@@ -548,6 +549,7 @@ export async function cmdApps(argv, overrides = {}) {
     syncAgents: syncAgentProfilesSafe,
     secureCodexHome: secureManagedCodexHome,
     removeLauncher: (launcher) => fs.rmSync(launcher, { recursive: true, force: true }),
+    openLauncher: openManagedLauncher,
     log: (message) => console.log(message),
     ...overrides,
   };
@@ -589,13 +591,22 @@ export async function cmdApps(argv, overrides = {}) {
     );
   }
 
-  // A running vendor or Impel app only needs to close when its bundle will be swapped.
+  // A running vendor or Impel app only needs to close when its bundle will be
+  // swapped. Remember which managed launchers we closed so the update can
+  // reopen them afterward and feel in-place (the fast path never quits at all).
+  let closedApps = [];
   if (staleBundleTargets.length > 0) {
-    await io.quitApps(staleBundleTargets, {
+    const quitResult = await io.quitApps(staleBundleTargets, {
       tenantId: config.tenantId,
       tenantName: config.tenantName,
     });
+    if (Array.isArray(quitResult)) closedApps = quitResult;
   }
+  const reopenTargets = new Set(
+    staleBundleTargets.filter((target) => closedApps.includes(
+      managedLauncherName(target, { tenantId: config.tenantId, tenantName: config.tenantName }),
+    )),
+  );
   if (force) {
     for (const status of statuses) io.removeLauncher(status.launcher);
   }
@@ -638,6 +649,15 @@ export async function cmdApps(argv, overrides = {}) {
       tenantId: config.tenantId,
     }));
   }
+
+  // Reopen the managed apps we had to close for the bundle swap, so the update
+  // lands in place from the user's point of view. Apps that were already
+  // closed (not in reopenTargets) stay closed.
+  for (const item of installed) {
+    if (!reopenTargets.has(item.target)) continue;
+    io.log(`Reopening ${item.launcher} after the update…`);
+    io.openLauncher(item.launcher);
+  }
 }
 
 /**