impel-cli 0.14.3 → 0.15.1

package/README.md

@@ -110,8 +110,20 @@ impel update               # install the latest Impel CLI later
 
 `impel setup` keeps your normal Claude and Codex profiles separate. On Mac and
 Windows it also prepares the supported isolated desktop experiences. On Windows,
-it installs missing official vendor command-line tools when needed. On Linux,
-it prepares the isolated command-line workflow.
+it installs missing official vendor command-line tools with the vendors'
+checksum-verifying native installers, so Claude Code does not inherit its newer
+Node.js requirement from the deprecated npm package. On Linux, it prepares the
+isolated command-line workflow.
+
+If setup or the CLI self-update fails, Impel first runs a deterministic local
+check. In an interactive terminal it then offers assisted recovery; use
+`impel setup --repair` (or `impel update --repair`) to opt in explicitly. Before
+upload, the CLI prints the exact sanitized payload. The hosted agent returns a
+reviewed action ID, and the CLI runs its allowlisted command locally; free-form
+model commands are rejected and every mutation requires confirmation. Sessions
+expire after 15 minutes, mutation capabilities are
+single-use, and a private checkpoint lets `--repair` resume an interrupted run.
+Use `--no-recovery` or `IMPEL_DISABLE_INSTALL_RECOVERY=1` to keep recovery off.
 
 ### If something does not work
 
@@ -133,11 +145,13 @@ access, scopes, and organization membership for every protected action.
 
 ```
 impel setup [--pat <pat>] [--tenant <org>] [--skip-apps] [--skip-clis]
+            [--repair|--no-recovery]
                                              Guided setup: token, tenant, platform clients, verify
                                              (closes running Claude/ChatGPT apps, updates the vendor
                                               apps, then installs the vendored Impel apps on macOS;
-                                              installs missing vendor CLIs on Windows)
-impel update [--check] [--skip-apps]         Update EVERYTHING: reinstall the CLI from npm, then
+                                              runs official native vendor CLI installers on Windows)
+impel update [--check] [--skip-apps] [--repair|--no-recovery]
+                                             Update EVERYTHING: reinstall the CLI from npm, then
                                              cascade to `app update all`, `skills sync all`, and
                                              `agents sync all`
 impel auth [--pat <pat>] [--gateway <url>] [--app <url>]
@@ -472,26 +486,36 @@ and pre-tenancy Impel CLI profiles, so switching organizations cannot strand an
 older snapshot. These safeguards apply only to Impel-owned `CODEX_HOME`
 directories; native `~/.codex` remains untouched.
 
-On Windows, `impel setup` ensures the official `@anthropic-ai/claude-code` and
-`@openai/codex` packages are available, installing only the missing package(s)
-with the same npm installation that supplies Impel. Use `--skip-clis` to prepare
-the profiles without installing missing vendor CLIs. The launchers and skill
-sync resolve native executables through `PATH`/`PATHEXT`, including global npm
-`.cmd` and `.bat` shims. Windows environment references such as `%NVM_SYMLINK%`
-are expanded during lookup, and the standard npm-global, Claude native-installer,
-and Codex standalone-installer directories are checked even when the parent
-PowerShell PATH is stale. Arguments are forwarded through an explicitly escaped
-`cmd.exe` invocation without Node shell mode; NULs and line breaks, which cannot
-be represented safely through a batch shim, are rejected before anything is
-launched. Managed Codex auth and MCP subprocesses bypass batch shims entirely by
-calling Node directly.
-
-If npm itself fails during setup, the wizard prints the native spawn error and
-the exact vendor-package command to retry in PowerShell. If npm succeeds but the
-new commands remain undiscoverable, close and reopen PowerShell; then use
-`npm prefix --global` to identify the directory that must be on the user PATH.
-Setup exits non-zero and says it is incomplete until both launchers are ready—it
-does not print a success banner after a failed installation.
+On Windows, `impel setup` installs only missing command-line tools through the
+vendors' current native PowerShell installers. Claude Code's npm installation is
+deprecated and its current package requires Node.js 22, while Impel itself still
+supports Node.js 18 or newer. The native path keeps that valid Impel setup
+working. Codex's installer is run non-interactively. Both installers download
+platform-specific native releases and verify their published SHA-256 checksums.
+Use `--skip-clis` to prepare the profiles without installing missing vendor
+CLIs. Each tool is installed independently, so a failure from one vendor does
+not prevent the other tool from being installed and configured.
+
+The launchers and skill sync still resolve executables through `PATH`/`PATHEXT`,
+including existing global npm `.cmd` and `.bat` shims. Windows environment
+references such as `%NVM_SYMLINK%` are expanded during lookup, and the standard
+npm-global, Claude native-installer, Codex standalone-installer, and Windows
+PowerShell directories are checked even when the parent PowerShell PATH is
+stale. Candidates must also pass a bounded `--version` probe, so a stale or
+half-removed npm shim cannot hide a healthy native install later in the search
+path. Existing batch-shim arguments are forwarded through an explicitly
+escaped `cmd.exe` invocation without Node shell mode; NULs and line breaks,
+which cannot be represented safely through a batch shim, are rejected before
+anything is launched. Managed Codex auth and MCP subprocesses bypass batch
+shims entirely by calling Node directly.
+
+If a native installer fails, the wizard identifies the affected tool, preserves
+the other tool's successful install, and prints that vendor's exact official
+PowerShell command to retry. If an installer exits successfully but its command
+cannot be verified, close and reopen PowerShell, retry the printed command, and
+run `impel setup` again. Setup exits non-zero and says it is incomplete until
+both launchers are ready—it does not print a success banner after a failed
+installation.
 
 Windows receives the complete CLI workflow: setup/auth, tenant selection,
 isolated Claude and Codex launches, native profile switching, tasks, skills,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.14.3",
+  "version": "0.15.1",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -114,6 +114,16 @@ export function normalizeAppTarget(value) {
   return null;
 }
 
+/** Return only app targets backed by at least one live tenant model. */
+export function appTargetsSupportedByModels(targets, models, config = {}) {
+  if (!Array.isArray(models) || models.length === 0) return [];
+  if (crossAppModelsEnabled(config)) return [...targets];
+  const providers = new Set(models.map((model) => model?.provider));
+  return targets.filter((target) => providers.has(
+    target === "claude" ? "claude" : "codex",
+  ));
+}
+
 function tenantAppName(value, fallback) {
   const name = redactSecretText(String(value || fallback))
     .normalize("NFC")
@@ -151,7 +161,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 10;
+export const CURRENT_CONFIG_VERSION = 11;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -604,6 +614,11 @@ export function installManagedAppFiles({
     tenantName: config.tenantName || config.tenantId || null,
     experiments: { crossAppModels: crossAppModelsEnabled(config) },
     targets,
+    availableTargets: appTargetsSupportedByModels(
+      ["claude", "chatgpt"],
+      models,
+      config,
+    ),
     models: models.map((model) => model.id),
     updatedAt: new Date().toISOString(),
   }, null, 2) + "\n", 0o600);

package/src/cli.js

@@ -23,7 +23,8 @@ const HELP = `impel — the Impel gateway CLI: isolated Claude Code, Codex, and
 Get started:
   impel setup                                 Guided end-to-end onboarding: token, tenant,
                                               platform clients, gateway verification
-                                              (--pat <pat> --tenant <org> --skip-apps/--skip-clis)
+                                              (--pat <pat> --tenant <org> --skip-apps/--skip-clis
+                                               --repair/--no-recovery)
   impel update                                Update everything: the CLI itself, then the
                                               Impel apps, skills, and agents (--check, --skip-apps)
 
@@ -69,6 +70,7 @@ Env:
   IMPEL_APP_URL       Default app/control-plane URL for setup, auth, PATs, and tasks.
   IMPEL_SKIP_UPDATE_CHECK=1   Silence launch-time update notices.
   IMPEL_SKIP_AGENT_SYNC=1     Keep the last native-agent catalog without refreshing it.
+  IMPEL_DISABLE_INSTALL_RECOVERY=1   Disable local and hosted install recovery.
 
 Config file:
   ~/.config/impel/config.json (mode 0600)

package/src/commands/apps.js

@@ -25,6 +25,7 @@ import {
 import {
   CURRENT_CONFIG_VERSION,
   CLAUDE_CONFIG_ID,
+  appTargetsSupportedByModels,
   appPaths,
   appStatus,
   bundleIsCurrent,
@@ -58,6 +59,45 @@ import {
 
 const CLAUDE_KEYCHAIN_NOTICE = "Claude Keychain: enter your Mac login password and choose Always Allow on the first prompt for this tenant; Allow is temporary.";
 
+const APP_CAPABILITIES = Object.freeze({
+  claude: Object.freeze({ label: "Impel Claude", provider: "Claude" }),
+  chatgpt: Object.freeze({ label: "Impel ChatGPT", provider: "Codex" }),
+});
+
+/**
+ * Select targets the live tenant catalog can actually run. An explicit target
+ * remains fail-closed; `all` degrades to the available app with a clear notice.
+ */
+export function selectCatalogAppTargets(
+  requestedTargets,
+  models,
+  config,
+  { log = console.log } = {},
+) {
+  const supported = appTargetsSupportedByModels(
+    requestedTargets,
+    models,
+    config,
+  );
+  const supportedSet = new Set(supported);
+  const unavailable = requestedTargets.filter((target) => !supportedSet.has(target));
+  if (unavailable.length === 0) return supported;
+
+  if (requestedTargets.length === 1 || supported.length === 0) {
+    const target = unavailable[0];
+    const capability = APP_CAPABILITIES[target];
+    throw new Error(
+      `${capability.label} is unavailable because the selected tenant has no ${capability.provider} models; choose a tenant with ${capability.provider} access or install the other app`,
+    );
+  }
+
+  for (const target of unavailable) {
+    const capability = APP_CAPABILITIES[target];
+    log(`Skipping ${capability.label}: the selected tenant has no ${capability.provider} models.`);
+  }
+  return supported;
+}
+
 // Each isolated desktop app maps to a client CLI + the env override that points
 // that CLI at the app's private profile, so skill syncing lands in the app's
 // installation rather than a global one.
@@ -328,6 +368,14 @@ export async function cmdWindowsApps(argv, overrides = {}) {
   try {
     if (action === "open") maybePrintUpdateNotice();
     const config = await io.selectedConfig(targets, flags.tenant || null);
+    const catalog = await withProgress("Fetching the tenant model catalog", () => (
+      fetchWindowsCatalog(config, io)
+    ));
+    const actionTargets = selectCatalogAppTargets(
+      targets,
+      catalog.models,
+      config,
+    );
     const actionUserData = io.claudeUserData(io.environment, config.tenantId);
     const actionPaths = appPaths(io.homeDir, config.tenantId, {
       claudeUserData: actionUserData,
@@ -342,7 +390,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       chatgpt: fs.existsSync(path.join(actionPaths.chatgpt.codexHome, "config.toml")),
     };
     const vendorPaths = {};
-    for (const target of targets) {
+    for (const target of actionTargets) {
       const isClaude = target === "claude";
       const find = isClaude ? io.findClaudeApp : io.findChatGPTApp;
       const ensure = isClaude ? io.ensureClaudeApp : io.ensureChatGPTApp;
@@ -367,16 +415,13 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       if (binary) vendorPaths[target] = binary;
     }
 
-    if (targets.includes("claude") && action !== "refresh" && !vendorPaths.claude) {
+    if (actionTargets.includes("claude") && action !== "refresh" && !vendorPaths.claude) {
       throw new Error("Claude vendor app is unavailable; run `impel app install claude` or install it from https://claude.com/download");
     }
-    const catalog = await withProgress("Fetching the tenant model catalog", () => (
-      fetchWindowsCatalog(config, io)
-    ));
-    let managedChatGPT = targets.includes("chatgpt")
+    let managedChatGPT = actionTargets.includes("chatgpt")
       ? io.findManagedChatGPTApp(actionPaths.root)
       : null;
-    const mustStageChatGPT = targets.includes("chatgpt")
+    const mustStageChatGPT = actionTargets.includes("chatgpt")
       && (action === "install"
         || action === "update"
         || (action === "open" && (!managedChatGPT
@@ -388,14 +433,14 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       managedChatGPT = io.stageChatGPTApp(vendorPaths.chatgpt, actionPaths.root);
     }
 
-    const { userData } = configureWindowsApps(config, targets, vendorPaths, catalog, io);
+    const { userData } = configureWindowsApps(config, actionTargets, vendorPaths, catalog, io);
     const tenantPaths = appPaths(io.homeDir, config.tenantId, {
       claudeUserData: userData,
       tenantName: config.tenantName,
     });
     const configuredTargets = action === "open"
-      ? targets.filter((target) => !profileWasInstalled[target])
-      : targets;
+      ? actionTargets.filter((target) => !profileWasInstalled[target])
+      : actionTargets;
     if (action === "install" || action === "update" || action === "refresh" || configuredTargets.length > 0) {
       const verb = action === "update" ? "Updated" : action === "refresh" ? "Refreshed" : "Installed";
       for (const target of configuredTargets) {
@@ -417,7 +462,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       }
       if (!flags["skip-agents"]) {
         await withProgress("Syncing app agent profiles", () => io.syncAgents({
-          profiles: targets.map((target) => appAgentProfile(target, tenantPaths)),
+          profiles: actionTargets.map((target) => appAgentProfile(target, tenantPaths)),
           gatewayUrl: config.gatewayUrl,
           credential: config.pat,
           tenantId: config.tenantId,
@@ -426,11 +471,11 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       console.log(`Models: ${catalog.models.length} from ${catalog.source}. The signed vendor apps and their normal profiles were not changed.`);
     }
     if (action === "open") {
-      if (targets.includes("claude")) {
+      if (actionTargets.includes("claude")) {
         await io.launchClaudeApp(vendorPaths.claude, tenantPaths.claude.userData, { environment: io.environment });
         console.log("Opened Impel Claude with its tenant-isolated Windows profile.");
       }
-      if (targets.includes("chatgpt")) {
+      if (actionTargets.includes("chatgpt")) {
         managedChatGPT ||= io.findManagedChatGPTApp(tenantPaths.root);
         if (!managedChatGPT) throw new Error("Impel ChatGPT is not staged; run `impel app install codex`");
         await io.launchChatGPTApp(managedChatGPT, {
@@ -558,9 +603,24 @@ export async function cmdApps(argv, overrides = {}) {
   const config = await io.selectedConfig(targets, flags.tenant || null);
   console.log(`Tenant: ${config.tenantId} (desktop history is isolated per tenant).`);
 
+  let catalog;
+  try {
+    catalog = await withProgress("Fetching the tenant model catalog", () => io.fetchModels(config));
+  } catch (error) {
+    throw new Error(
+      `tenant model catalog is unavailable (${redactSecretText(error.message)}); no Impel app files were changed`,
+    );
+  }
+  const actionTargets = selectCatalogAppTargets(
+    targets,
+    catalog.models,
+    config,
+    { log: io.log },
+  );
+
   const vendorPaths = {};
   if (!flags["skip-vendor"]) {
-    for (const target of targets) {
+    for (const target of actionTargets) {
       // Reuse or install only the exact vendor build verified by this CLI.
       // Moving "latest" releases are never cloned into a managed bundle.
       const result = await withProgress(`Preparing the verified ${target} vendor app`, () => (
@@ -573,7 +633,7 @@ export async function cmdApps(argv, overrides = {}) {
   }
 
   const statuses = io.status(
-    targets,
+    actionTargets,
     io.homeDir,
     config.tenantId,
     config.tenantName,
@@ -581,18 +641,9 @@ export async function cmdApps(argv, overrides = {}) {
   for (const status of statuses) vendorPaths[status.target] ||= status.vendorPath;
   const force = Boolean(flags.force);
   const staleBundleTargets = force
-    ? [...targets]
+    ? [...actionTargets]
     : statuses.filter((status) => !io.bundleCurrent(status)).map((status) => status.target);
 
-  let catalog;
-  try {
-    catalog = await withProgress("Fetching the tenant model catalog", () => io.fetchModels(config));
-  } catch (error) {
-    throw new Error(
-      `tenant model catalog is unavailable (${redactSecretText(error.message)}); no Impel app files were changed`,
-    );
-  }
-
   // A running vendor or Impel app only needs to close when its bundle will be
   // swapped. Remember which managed launchers we closed so the update can
   // reopen them afterward and feel in-place (the fast path never quits at all).
@@ -616,7 +667,7 @@ export async function cmdApps(argv, overrides = {}) {
     staleBundleTargets.length > 0 ? "Rebuilding managed app bundles" : "Updating managed app profiles",
     () => io.installFiles({
       config,
-      targets,
+      targets: actionTargets,
       models: catalog.models,
       homeDir: io.homeDir,
       vendorPaths,
@@ -705,8 +756,17 @@ export async function provisionAndOpenManagedApps({
     );
   }
 
+  const actionTargets = selectCatalogAppTargets(
+    targets,
+    catalog.models,
+    config,
+    { log: io.log },
+  );
+  const actionTargetSet = new Set(actionTargets);
+  const actionStatuses = statuses.filter((status) => actionTargetSet.has(status.target));
+
   const vendorPaths = {};
-  for (const status of statuses) {
+  for (const status of actionStatuses) {
     let vendorPath = status.vendorPath;
     if (!vendorPath) {
       const result = await withProgress(`Preparing the verified ${status.target} vendor app`, () => (
@@ -723,7 +783,7 @@ export async function provisionAndOpenManagedApps({
 
   // Only stale or absent bundles pay the clone + codesign rebuild. The model
   // catalog and vendor checks above finish before any running apps are closed.
-  const staleBundleTargets = statuses
+  const staleBundleTargets = actionStatuses
     .filter((status) => !io.bundleCurrent(status))
     .map((status) => status.target);
   if (staleBundleTargets.length > 0) {
@@ -737,7 +797,7 @@ export async function provisionAndOpenManagedApps({
     staleBundleTargets.length > 0 ? "Rebuilding managed app bundles" : "Updating managed app profiles",
     () => io.installFiles({
       config,
-      targets,
+      targets: actionTargets,
       models: catalog.models,
       homeDir,
       vendorPaths,
@@ -745,7 +805,7 @@ export async function provisionAndOpenManagedApps({
     }),
   );
   const newlyInstalled = new Set(
-    statuses.filter((status) => !status.launcherInstalled).map((status) => status.target),
+    actionStatuses.filter((status) => !status.launcherInstalled).map((status) => status.target),
   );
   for (const item of installed) {
     if (newlyInstalled.has(item.target)) {
@@ -802,13 +862,30 @@ export function fastOpenLaunchers(targets, { homeDir = os.homedir(), config = lo
   ) {
     return null;
   }
+  const availableTargets = Array.isArray(manifest.availableTargets)
+    ? manifest.availableTargets
+    : [];
+  const candidateTargets = targets.length > 1
+    ? targets.filter((target) => availableTargets.includes(target))
+    : targets;
+  if (
+    candidateTargets.length === 0
+    || candidateTargets.some((target) => !availableTargets.includes(target))
+    || candidateTargets.some((target) => !manifest.targets?.includes(target))
+  ) {
+    return null;
+  }
+  const candidateTargetSet = new Set(candidateTargets);
+  const candidateStatuses = statuses
+    ? statuses.filter((status) => candidateTargetSet.has(status.target))
+    : appStatus(
+      candidateTargets,
+      homeDir,
+      config.tenantId,
+      config.tenantName || manifest.tenantName,
+    );
   const launchers = [];
-  for (const status of statuses ?? appStatus(
-    targets,
-    homeDir,
-    config.tenantId,
-    config.tenantName || manifest.tenantName,
-  )) {
+  for (const status of candidateStatuses) {
     if (!bundleIsCurrent(status)) return null;
     if (!fs.existsSync(status.configPath)) return null;
     if (status.target === "claude" && !claudeConfigIsCurrent(status.configPath, config, gatewayUrl)) {
@@ -870,24 +947,33 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
   } catch {
     return;
   }
+  const supportedTargetSet = new Set(appTargetsSupportedByModels(
+    installedTargets.map((status) => status.target),
+    catalog.models,
+    config,
+  ));
+  const supportedStatuses = installedTargets.filter((status) => (
+    supportedTargetSet.has(status.target)
+  ));
+  if (supportedStatuses.length === 0) return;
   installManagedAppFiles({
     config,
-    targets: installedTargets.map((status) => status.target),
+    targets: supportedStatuses.map((status) => status.target),
     models: catalog.models,
     homeDir: os.homedir(),
-    vendorPaths: Object.fromEntries(installedTargets.map((status) => [status.target, status.vendorPath])),
+    vendorPaths: Object.fromEntries(supportedStatuses.map((status) => [status.target, status.vendorPath])),
     writeBundles: false,
   });
 
   const tenantPaths = appPaths(os.homedir(), config.tenantId, { tenantName: config.tenantName });
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
-  for (const status of installedTargets) {
+  for (const status of supportedStatuses) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
     await syncSkillsSafe({ client, gatewayUrl, env, label });
     if (status.target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
   }
   await syncAgentProfilesSafe({
-    profiles: installedTargets.map((status) => appAgentProfile(status.target, tenantPaths)),
+    profiles: supportedStatuses.map((status) => appAgentProfile(status.target, tenantPaths)),
     gatewayUrl: config.gatewayUrl,
     credential: config.pat,
     tenantId: config.tenantId,