impel-cli 0.13.0 → 0.13.1

package/README.md

@@ -803,7 +803,9 @@ retains OpenAI's signature.
 
 By default the CLI signs each rebuild with a **stable per-machine identity** — a
 self-signed certificate created once in a dedicated keychain under
-`~/.config/impel/codesign` (no Apple Developer account is involved). macOS ties
+`~/.config/impel/codesign` (no Apple Developer account is involved). The
+certificate is trusted locally for the code-signing policy only; it is not a
+TLS or document-signing authority. macOS ties
 every privacy (TCC) grant — microphone, screen recording, folder access,
 Automation, accessibility — to the app's code-signing designated requirement. A
 stable identity keeps that requirement constant across rebuilds, so the grants

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -152,7 +152,7 @@ export const CURRENT_CONFIG_VERSION = 10;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-16.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-16.2";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {

package/src/codesign.js

@@ -143,17 +143,28 @@ function ensureLocalSigningIdentity({ run, configDir, fsImpl, randomBytes }) {
   if (fsImpl.existsSync(keychain) && fsImpl.existsSync(passwordFile)) {
     const password = fsImpl.readFileSync(passwordFile, "utf8").trim();
     unlockKeychain(run, keychain, password);
+    ensureKeychainInSearchList(run, keychain);
     const existing = findLocalIdentitySha(run, keychain);
     if (existing) return localIdentity(existing, keychain);
+
+    // v0.13.0 imported a self-signed certificate but never established code-
+    // signing trust for it. `security find-identity -v` therefore reported
+    // zero valid identities and every rebuild fell back to ad-hoc signing.
+    // Repair that exact state in place so the already-generated identity stays
+    // stable instead of accumulating a second certificate with the same name.
+    trustExistingLocalCertificate({ run, keychain, fsImpl });
+    const repaired = findLocalIdentitySha(run, keychain);
+    if (repaired) return localIdentity(repaired, keychain);
+    throw new Error("existing signing identity could not be trusted");
   }
 
   const password = randomBytes(24).toString("hex");
   createLocalSigningIdentity({ run, dir, keychain, password, fsImpl });
   fsImpl.writeFileSync(passwordFile, `${password}\n`, { mode: 0o600 });
 
+  ensureKeychainInSearchList(run, keychain);
   const sha = findLocalIdentitySha(run, keychain);
   if (!sha) throw new Error("created signing identity was not found in its keychain");
-  ensureKeychainInSearchList(run, keychain);
   return localIdentity(sha, keychain);
 }
 
@@ -214,13 +225,44 @@ function createLocalSigningIdentity({ run, dir, keychain, password, fsImpl }) {
     runOrThrow(run, "/usr/bin/security", [
       "set-key-partition-list", "-S", "apple-tool:,apple:,codesign:", "-s", "-k", password, keychain,
     ], "authorize codesign for the signing key");
+    trustLocalCertificate(run, keychain, certPath);
   } finally {
     fsImpl.rmSync(work, { recursive: true, force: true });
   }
 }
 
 function unlockKeychain(run, keychain, password) {
-  run("/usr/bin/security", ["unlock-keychain", "-p", password, keychain]);
+  runOrThrow(
+    run,
+    "/usr/bin/security",
+    ["unlock-keychain", "-p", password, keychain],
+    "unlock signing keychain",
+  );
+}
+
+function trustExistingLocalCertificate({ run, keychain, fsImpl }) {
+  const exported = run("/usr/bin/security", [
+    "find-certificate", "-p", "-c", SIGNING_IDENTITY_NAME, keychain,
+  ]);
+  if (exported.status !== 0 || exported.error || !String(exported.stdout || "").includes("BEGIN CERTIFICATE")) {
+    throw new Error("existing signing certificate was not found in its keychain");
+  }
+  const certPath = path.join(os.tmpdir(), `impel-codesign-cert-${process.pid}.pem`);
+  fsImpl.writeFileSync(certPath, exported.stdout, { mode: 0o600 });
+  try {
+    trustLocalCertificate(run, keychain, certPath);
+  } finally {
+    fsImpl.rmSync(certPath, { force: true });
+  }
+}
+
+function trustLocalCertificate(run, keychain, certPath) {
+  // Limit trust to the code-signing policy. This is a local build identity,
+  // not a TLS/document-signing CA, and it remains isolated in Impel's own
+  // keychain rather than the user's login keychain.
+  runOrThrow(run, "/usr/bin/security", [
+    "add-trusted-cert", "-r", "trustRoot", "-p", "codeSign", "-k", keychain, certPath,
+  ], "trust local code-signing certificate");
 }
 
 // codesign resolves an identity by searching the user's keychain search list,
@@ -228,12 +270,21 @@ function unlockKeychain(run, keychain, password) {
 // user's existing keychains (a bare `-s <one>` would replace the whole list).
 function ensureKeychainInSearchList(run, keychain) {
   const listed = run("/usr/bin/security", ["list-keychains", "-d", "user"]);
+  if (listed.status !== 0 || listed.error) {
+    const detail = listed.error?.message || String(listed.stderr || "").trim() || `exit ${listed.status}`;
+    throw new Error(`read user keychain search list failed: ${detail}`);
+  }
   const current = String(listed.stdout || "")
     .split("\n")
     .map((line) => line.trim().replace(/^"|"$/gu, ""))
     .filter(Boolean);
   if (current.includes(keychain)) return;
-  run("/usr/bin/security", ["list-keychains", "-d", "user", "-s", ...current, keychain]);
+  runOrThrow(
+    run,
+    "/usr/bin/security",
+    ["list-keychains", "-d", "user", "-s", ...current, keychain],
+    "add Impel signing keychain to the user search list",
+  );
 }
 
 function runOrThrow(run, command, args, description) {

package/src/commands/update.js

@@ -165,6 +165,7 @@ export async function cmdUpdate(argv, overrides = {}) {
     runAgentsSync: defaultRunAgentsSync,
     appsInstalled: anyAppInstalled,
     platform: process.platform,
+    progress: withProgress,
     ...overrides,
   };
   const { flags } = parseFlags(argv, {
@@ -185,7 +186,7 @@ export async function cmdUpdate(argv, overrides = {}) {
   }
 
   const current = io.installedVersion();
-  const remote = await withProgress("Checking npm for impel-cli updates", () => io.fetchRemoteVersion());
+  const remote = await io.progress("Checking npm for impel-cli updates", () => io.fetchRemoteVersion());
   if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });
 
   console.log(`impel-cli v${current ?? "?"}`);
@@ -204,7 +205,7 @@ export async function cmdUpdate(argv, overrides = {}) {
     console.log("CLI: already up to date.");
   } else {
     console.log("CLI: installing the latest build…");
-    if (!await withProgress("Installing the latest impel-cli build", () => io.selfUpdate(updateInstallSpec()))) {
+    if (!await io.progress("Installing the latest impel-cli build", () => io.selfUpdate(updateInstallSpec()))) {
       console.error("impel update: `npm install -g` failed; the CLI was not updated.");
       if (io.platform === "win32") {
         console.error("  Verify `npm --version` in PowerShell, then retry `impel update`.");
@@ -228,20 +229,24 @@ export async function cmdUpdate(argv, overrides = {}) {
     console.log(io.platform === "win32"
       ? "Apps: updating every installed tenant's signed Claude and ChatGPT profiles…"
       : "Apps: refreshing every installed tenant and rebuilding only stale app bundles…");
-    if (!await withProgress("Updating managed desktop apps", () => io.runAppsUpdate())) {
+    // These child commands inherit the terminal and render their own progress
+    // and log lines. Wrapping them in another spinner makes both processes
+    // write the same terminal row, producing glued output such as
+    // "Updating managed desktop apps (...)Updating all managed...".
+    if (!await io.runAppsUpdate()) {
       console.error("impel update: the app update failed; re-run `impel app update` after fixing the issue.");
       cascadeFailed = true;
     }
   }
 
   console.log("Skills: syncing native and isolated CLI profiles…");
-  if (!await withProgress("Syncing skills across managed profiles", () => io.runSkillsSync())) {
+  if (!await io.runSkillsSync()) {
     console.error("impel update: skill sync failed; re-run `impel skills sync` after fixing the issue.");
     cascadeFailed = true;
   }
 
   console.log("Agents: syncing the selected tenant into native and isolated CLI profiles…");
-  if (!await withProgress("Syncing agents across managed profiles", () => io.runAgentsSync())) {
+  if (!await io.runAgentsSync()) {
     console.error("impel update: agent sync failed; re-run `impel agents sync` after fixing the issue.");
     cascadeFailed = true;
   }