impel-cli 0.15.0 → 0.15.2

package/README.md

@@ -118,9 +118,10 @@ isolated command-line workflow.
 If setup or the CLI self-update fails, Impel first runs a deterministic local
 check. In an interactive terminal it then offers assisted recovery; use
 `impel setup --repair` (or `impel update --repair`) to opt in explicitly. Before
-upload, the CLI prints the exact sanitized payload. The hosted agent can only
-return a reviewed action ID; the CLI rejects free-form commands and asks before
-every mutation. Sessions expire after 15 minutes, mutation capabilities are
+upload, the CLI prints the exact sanitized payload. The hosted agent returns a
+reviewed action ID, and the CLI runs its allowlisted command locally; free-form
+model commands are rejected and every mutation requires confirmation. Sessions
+expire after 15 minutes, mutation capabilities are
 single-use, and a private checkpoint lets `--repair` resume an interrupted run.
 Use `--no-recovery` or `IMPEL_DISABLE_INSTALL_RECOVERY=1` to keep recovery off.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -114,6 +114,16 @@ export function normalizeAppTarget(value) {
   return null;
 }
 
+/** Return only app targets backed by at least one live tenant model. */
+export function appTargetsSupportedByModels(targets, models, config = {}) {
+  if (!Array.isArray(models) || models.length === 0) return [];
+  if (crossAppModelsEnabled(config)) return [...targets];
+  const providers = new Set(models.map((model) => model?.provider));
+  return targets.filter((target) => providers.has(
+    target === "claude" ? "claude" : "codex",
+  ));
+}
+
 function tenantAppName(value, fallback) {
   const name = redactSecretText(String(value || fallback))
     .normalize("NFC")
@@ -151,7 +161,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 10;
+export const CURRENT_CONFIG_VERSION = 11;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -604,6 +614,11 @@ export function installManagedAppFiles({
     tenantName: config.tenantName || config.tenantId || null,
     experiments: { crossAppModels: crossAppModelsEnabled(config) },
     targets,
+    availableTargets: appTargetsSupportedByModels(
+      ["claude", "chatgpt"],
+      models,
+      config,
+    ),
     models: models.map((model) => model.id),
     updatedAt: new Date().toISOString(),
   }, null, 2) + "\n", 0o600);

package/src/commands/apps.js

@@ -25,6 +25,7 @@ import {
 import {
   CURRENT_CONFIG_VERSION,
   CLAUDE_CONFIG_ID,
+  appTargetsSupportedByModels,
   appPaths,
   appStatus,
   bundleIsCurrent,
@@ -58,6 +59,45 @@ import {
 
 const CLAUDE_KEYCHAIN_NOTICE = "Claude Keychain: enter your Mac login password and choose Always Allow on the first prompt for this tenant; Allow is temporary.";
 
+const APP_CAPABILITIES = Object.freeze({
+  claude: Object.freeze({ label: "Impel Claude", provider: "Claude" }),
+  chatgpt: Object.freeze({ label: "Impel ChatGPT", provider: "Codex" }),
+});
+
+/**
+ * Select targets the live tenant catalog can actually run. An explicit target
+ * remains fail-closed; `all` degrades to the available app with a clear notice.
+ */
+export function selectCatalogAppTargets(
+  requestedTargets,
+  models,
+  config,
+  { log = console.log } = {},
+) {
+  const supported = appTargetsSupportedByModels(
+    requestedTargets,
+    models,
+    config,
+  );
+  const supportedSet = new Set(supported);
+  const unavailable = requestedTargets.filter((target) => !supportedSet.has(target));
+  if (unavailable.length === 0) return supported;
+
+  if (requestedTargets.length === 1 || supported.length === 0) {
+    const target = unavailable[0];
+    const capability = APP_CAPABILITIES[target];
+    throw new Error(
+      `${capability.label} is unavailable because the selected tenant has no ${capability.provider} models; choose a tenant with ${capability.provider} access or install the other app`,
+    );
+  }
+
+  for (const target of unavailable) {
+    const capability = APP_CAPABILITIES[target];
+    log(`Skipping ${capability.label}: the selected tenant has no ${capability.provider} models.`);
+  }
+  return supported;
+}
+
 // Each isolated desktop app maps to a client CLI + the env override that points
 // that CLI at the app's private profile, so skill syncing lands in the app's
 // installation rather than a global one.
@@ -328,6 +368,14 @@ export async function cmdWindowsApps(argv, overrides = {}) {
   try {
     if (action === "open") maybePrintUpdateNotice();
     const config = await io.selectedConfig(targets, flags.tenant || null);
+    const catalog = await withProgress("Fetching the tenant model catalog", () => (
+      fetchWindowsCatalog(config, io)
+    ));
+    const actionTargets = selectCatalogAppTargets(
+      targets,
+      catalog.models,
+      config,
+    );
     const actionUserData = io.claudeUserData(io.environment, config.tenantId);
     const actionPaths = appPaths(io.homeDir, config.tenantId, {
       claudeUserData: actionUserData,
@@ -342,7 +390,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       chatgpt: fs.existsSync(path.join(actionPaths.chatgpt.codexHome, "config.toml")),
     };
     const vendorPaths = {};
-    for (const target of targets) {
+    for (const target of actionTargets) {
       const isClaude = target === "claude";
       const find = isClaude ? io.findClaudeApp : io.findChatGPTApp;
       const ensure = isClaude ? io.ensureClaudeApp : io.ensureChatGPTApp;
@@ -367,16 +415,13 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       if (binary) vendorPaths[target] = binary;
     }
 
-    if (targets.includes("claude") && action !== "refresh" && !vendorPaths.claude) {
+    if (actionTargets.includes("claude") && action !== "refresh" && !vendorPaths.claude) {
       throw new Error("Claude vendor app is unavailable; run `impel app install claude` or install it from https://claude.com/download");
     }
-    const catalog = await withProgress("Fetching the tenant model catalog", () => (
-      fetchWindowsCatalog(config, io)
-    ));
-    let managedChatGPT = targets.includes("chatgpt")
+    let managedChatGPT = actionTargets.includes("chatgpt")
       ? io.findManagedChatGPTApp(actionPaths.root)
       : null;
-    const mustStageChatGPT = targets.includes("chatgpt")
+    const mustStageChatGPT = actionTargets.includes("chatgpt")
       && (action === "install"
         || action === "update"
         || (action === "open" && (!managedChatGPT
@@ -388,14 +433,14 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       managedChatGPT = io.stageChatGPTApp(vendorPaths.chatgpt, actionPaths.root);
     }
 
-    const { userData } = configureWindowsApps(config, targets, vendorPaths, catalog, io);
+    const { userData } = configureWindowsApps(config, actionTargets, vendorPaths, catalog, io);
     const tenantPaths = appPaths(io.homeDir, config.tenantId, {
       claudeUserData: userData,
       tenantName: config.tenantName,
     });
     const configuredTargets = action === "open"
-      ? targets.filter((target) => !profileWasInstalled[target])
-      : targets;
+      ? actionTargets.filter((target) => !profileWasInstalled[target])
+      : actionTargets;
     if (action === "install" || action === "update" || action === "refresh" || configuredTargets.length > 0) {
       const verb = action === "update" ? "Updated" : action === "refresh" ? "Refreshed" : "Installed";
       for (const target of configuredTargets) {
@@ -417,7 +462,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       }
       if (!flags["skip-agents"]) {
         await withProgress("Syncing app agent profiles", () => io.syncAgents({
-          profiles: targets.map((target) => appAgentProfile(target, tenantPaths)),
+          profiles: actionTargets.map((target) => appAgentProfile(target, tenantPaths)),
           gatewayUrl: config.gatewayUrl,
           credential: config.pat,
           tenantId: config.tenantId,
@@ -426,11 +471,11 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       console.log(`Models: ${catalog.models.length} from ${catalog.source}. The signed vendor apps and their normal profiles were not changed.`);
     }
     if (action === "open") {
-      if (targets.includes("claude")) {
+      if (actionTargets.includes("claude")) {
         await io.launchClaudeApp(vendorPaths.claude, tenantPaths.claude.userData, { environment: io.environment });
         console.log("Opened Impel Claude with its tenant-isolated Windows profile.");
       }
-      if (targets.includes("chatgpt")) {
+      if (actionTargets.includes("chatgpt")) {
         managedChatGPT ||= io.findManagedChatGPTApp(tenantPaths.root);
         if (!managedChatGPT) throw new Error("Impel ChatGPT is not staged; run `impel app install codex`");
         await io.launchChatGPTApp(managedChatGPT, {
@@ -558,9 +603,24 @@ export async function cmdApps(argv, overrides = {}) {
   const config = await io.selectedConfig(targets, flags.tenant || null);
   console.log(`Tenant: ${config.tenantId} (desktop history is isolated per tenant).`);
 
+  let catalog;
+  try {
+    catalog = await withProgress("Fetching the tenant model catalog", () => io.fetchModels(config));
+  } catch (error) {
+    throw new Error(
+      `tenant model catalog is unavailable (${redactSecretText(error.message)}); no Impel app files were changed`,
+    );
+  }
+  const actionTargets = selectCatalogAppTargets(
+    targets,
+    catalog.models,
+    config,
+    { log: io.log },
+  );
+
   const vendorPaths = {};
   if (!flags["skip-vendor"]) {
-    for (const target of targets) {
+    for (const target of actionTargets) {
       // Reuse or install only the exact vendor build verified by this CLI.
       // Moving "latest" releases are never cloned into a managed bundle.
       const result = await withProgress(`Preparing the verified ${target} vendor app`, () => (
@@ -573,7 +633,7 @@ export async function cmdApps(argv, overrides = {}) {
   }
 
   const statuses = io.status(
-    targets,
+    actionTargets,
     io.homeDir,
     config.tenantId,
     config.tenantName,
@@ -581,18 +641,9 @@ export async function cmdApps(argv, overrides = {}) {
   for (const status of statuses) vendorPaths[status.target] ||= status.vendorPath;
   const force = Boolean(flags.force);
   const staleBundleTargets = force
-    ? [...targets]
+    ? [...actionTargets]
     : statuses.filter((status) => !io.bundleCurrent(status)).map((status) => status.target);
 
-  let catalog;
-  try {
-    catalog = await withProgress("Fetching the tenant model catalog", () => io.fetchModels(config));
-  } catch (error) {
-    throw new Error(
-      `tenant model catalog is unavailable (${redactSecretText(error.message)}); no Impel app files were changed`,
-    );
-  }
-
   // A running vendor or Impel app only needs to close when its bundle will be
   // swapped. Remember which managed launchers we closed so the update can
   // reopen them afterward and feel in-place (the fast path never quits at all).
@@ -616,7 +667,7 @@ export async function cmdApps(argv, overrides = {}) {
     staleBundleTargets.length > 0 ? "Rebuilding managed app bundles" : "Updating managed app profiles",
     () => io.installFiles({
       config,
-      targets,
+      targets: actionTargets,
       models: catalog.models,
       homeDir: io.homeDir,
       vendorPaths,
@@ -705,8 +756,17 @@ export async function provisionAndOpenManagedApps({
     );
   }
 
+  const actionTargets = selectCatalogAppTargets(
+    targets,
+    catalog.models,
+    config,
+    { log: io.log },
+  );
+  const actionTargetSet = new Set(actionTargets);
+  const actionStatuses = statuses.filter((status) => actionTargetSet.has(status.target));
+
   const vendorPaths = {};
-  for (const status of statuses) {
+  for (const status of actionStatuses) {
     let vendorPath = status.vendorPath;
     if (!vendorPath) {
       const result = await withProgress(`Preparing the verified ${status.target} vendor app`, () => (
@@ -723,7 +783,7 @@ export async function provisionAndOpenManagedApps({
 
   // Only stale or absent bundles pay the clone + codesign rebuild. The model
   // catalog and vendor checks above finish before any running apps are closed.
-  const staleBundleTargets = statuses
+  const staleBundleTargets = actionStatuses
     .filter((status) => !io.bundleCurrent(status))
     .map((status) => status.target);
   if (staleBundleTargets.length > 0) {
@@ -737,7 +797,7 @@ export async function provisionAndOpenManagedApps({
     staleBundleTargets.length > 0 ? "Rebuilding managed app bundles" : "Updating managed app profiles",
     () => io.installFiles({
       config,
-      targets,
+      targets: actionTargets,
       models: catalog.models,
       homeDir,
       vendorPaths,
@@ -745,7 +805,7 @@ export async function provisionAndOpenManagedApps({
     }),
   );
   const newlyInstalled = new Set(
-    statuses.filter((status) => !status.launcherInstalled).map((status) => status.target),
+    actionStatuses.filter((status) => !status.launcherInstalled).map((status) => status.target),
   );
   for (const item of installed) {
     if (newlyInstalled.has(item.target)) {
@@ -802,13 +862,30 @@ export function fastOpenLaunchers(targets, { homeDir = os.homedir(), config = lo
   ) {
     return null;
   }
+  const availableTargets = Array.isArray(manifest.availableTargets)
+    ? manifest.availableTargets
+    : [];
+  const candidateTargets = targets.length > 1
+    ? targets.filter((target) => availableTargets.includes(target))
+    : targets;
+  if (
+    candidateTargets.length === 0
+    || candidateTargets.some((target) => !availableTargets.includes(target))
+    || candidateTargets.some((target) => !manifest.targets?.includes(target))
+  ) {
+    return null;
+  }
+  const candidateTargetSet = new Set(candidateTargets);
+  const candidateStatuses = statuses
+    ? statuses.filter((status) => candidateTargetSet.has(status.target))
+    : appStatus(
+      candidateTargets,
+      homeDir,
+      config.tenantId,
+      config.tenantName || manifest.tenantName,
+    );
   const launchers = [];
-  for (const status of statuses ?? appStatus(
-    targets,
-    homeDir,
-    config.tenantId,
-    config.tenantName || manifest.tenantName,
-  )) {
+  for (const status of candidateStatuses) {
     if (!bundleIsCurrent(status)) return null;
     if (!fs.existsSync(status.configPath)) return null;
     if (status.target === "claude" && !claudeConfigIsCurrent(status.configPath, config, gatewayUrl)) {
@@ -870,24 +947,33 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
   } catch {
     return;
   }
+  const supportedTargetSet = new Set(appTargetsSupportedByModels(
+    installedTargets.map((status) => status.target),
+    catalog.models,
+    config,
+  ));
+  const supportedStatuses = installedTargets.filter((status) => (
+    supportedTargetSet.has(status.target)
+  ));
+  if (supportedStatuses.length === 0) return;
   installManagedAppFiles({
     config,
-    targets: installedTargets.map((status) => status.target),
+    targets: supportedStatuses.map((status) => status.target),
     models: catalog.models,
     homeDir: os.homedir(),
-    vendorPaths: Object.fromEntries(installedTargets.map((status) => [status.target, status.vendorPath])),
+    vendorPaths: Object.fromEntries(supportedStatuses.map((status) => [status.target, status.vendorPath])),
     writeBundles: false,
   });
 
   const tenantPaths = appPaths(os.homedir(), config.tenantId, { tenantName: config.tenantName });
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
-  for (const status of installedTargets) {
+  for (const status of supportedStatuses) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
     await syncSkillsSafe({ client, gatewayUrl, env, label });
     if (status.target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
   }
   await syncAgentProfilesSafe({
-    profiles: installedTargets.map((status) => appAgentProfile(status.target, tenantPaths)),
+    profiles: supportedStatuses.map((status) => appAgentProfile(status.target, tenantPaths)),
     gatewayUrl: config.gatewayUrl,
     credential: config.pat,
     tenantId: config.tenantId,

package/src/commands/setup.js

@@ -329,7 +329,7 @@ export async function cmdSetup(argv, overrides = {}) {
             message: "Windows desktop app setup returned an unsuccessful result.",
           });
         } else {
-          console.log("    ✓ Impel Claude and Impel ChatGPT profiles are ready");
+          console.log("    ✓ available Impel desktop app profiles are ready");
         }
       } catch (error) {
         platformSetupFailed = true;
@@ -354,7 +354,7 @@ export async function cmdSetup(argv, overrides = {}) {
     );
     try {
       await io.installApps(["install", "all"]);
-      console.log("    ✓ Impel Claude and Impel ChatGPT installed");
+      console.log("    ✓ available Impel desktop apps installed");
     } catch (error) {
       platformSetupFailed = true;
       console.error(

package/src/installRecovery/loop.js

@@ -72,7 +72,7 @@ async function uploadConsent(io, explicit, failure) {
     "Install recovery can send a sanitized failure envelope to Impel. Credentials, home paths, email addresses, ANSI controls, and raw tokens are removed."
   );
   io.log(
-    "The hosted agent can only propose typed action IDs; it cannot run commands or access this machine."
+    "The hosted agent selects typed action IDs; the Impel CLI runs the corresponding reviewed commands on this machine after local policy and confirmation checks."
   );
   io.log("Sanitized payload preview:");
   io.log(JSON.stringify(failure, null, 2));

package/src/skills.js

@@ -74,6 +74,23 @@ export function resolveMarketplaceName(marketplace) {
   return typeof name === "string" && name.trim() ? name.trim() : null;
 }
 
+/** Resolve a marketplace name from Claude's local `marketplace list --json`. */
+export function resolveConfiguredMarketplaceName(output, sourceUrl) {
+  let marketplaces;
+  try {
+    marketplaces = JSON.parse(String(output || ""));
+  } catch {
+    return null;
+  }
+  if (!Array.isArray(marketplaces)) return null;
+  const normalizedSource = String(sourceUrl || "").replace(/\/+$/u, "");
+  const marketplace = marketplaces.find((candidate) => (
+    typeof candidate?.url === "string"
+    && candidate.url.replace(/\/+$/u, "") === normalizedSource
+  ));
+  return resolveMarketplaceName(marketplace);
+}
+
 /**
  * Resolve the gateway URL for skill serving. Reuses the CLI's configured gateway
  * (the caller passes `config.gatewayUrl`), then the env/default from config.js,
@@ -317,11 +334,38 @@ export async function syncSkills({
 
     const manifestUrl = marketplaceUrl(gatewayUrl, client);
     const sourceUrl = marketplaceSourceUrl(gatewayUrl, client);
-    const marketplaceName = await fetchMarketplaceName(manifestUrl, fetchImpl);
-    const commands = buildSkillCommands({ client, marketplaceSourceUrl: sourceUrl, marketplaceName });
+    let marketplaceName = await fetchMarketplaceName(manifestUrl, fetchImpl);
 
     logger.log(`Skills: syncing ${SKILL_PLUGIN_NAME} for ${displayLabel}…`);
     const failures = [];
+    const registerCommand = buildSkillCommands({
+      client,
+      marketplaceSourceUrl: sourceUrl,
+      marketplaceName,
+    })[0];
+    const registerResult = await run(spec.bin, registerCommand.args, env);
+    if (registerResult.missing) {
+      failures.push({ phase: registerCommand.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
+    } else if (!isBenign(registerResult)) {
+      failures.push({
+        phase: registerCommand.phase,
+        reason: firstLine(registerResult.stderr) || `exit ${registerResult.status}`,
+      });
+    }
+
+    // The public manifest fetch is deliberately best-effort and can time out.
+    // Once Claude has registered the marketplace, its local JSON index gives us
+    // the same dynamic name so refreshes can still use PLUGIN@MARKETPLACE.
+    if (!marketplaceName && client === "claude" && !registerResult.missing) {
+      const listed = await run(spec.bin, ["plugin", "marketplace", "list", "--json"], env);
+      if (listed.ok) marketplaceName = resolveConfiguredMarketplaceName(listed.stdout, sourceUrl);
+    }
+
+    const commands = registerResult.missing ? [] : buildSkillCommands({
+      client,
+      marketplaceSourceUrl: sourceUrl,
+      marketplaceName,
+    }).slice(1);
     for (const command of commands) {
       const result = await run(spec.bin, command.args, env);
       if (result.missing) {