impel-cli 0.16.0 → 0.16.2

package/README.md

@@ -551,19 +551,37 @@ impel codex exec --json "review the current diff"
 switch their native profiles in place; the isolated launchers are the safer
 default when personal and Impel sessions should coexist.
 
+Every Impel-managed Claude configuration uses the same strict sandbox defaults:
+the isolated `impel claude` profile, each tenant's Claude Desktop Code profile,
+the native profile while `impel use gateway claude` is active, and branded
+gateway-only CLI profiles. App config version 12 makes existing tenant profiles
+refresh onto this policy after the CLI update.
+
 ### `impel use gateway [claude|codex|all]`  (alias `impel on`)
 
 Turns **on** gateway mode for the given tool (default `all`). Requires `impel auth`
 first.
 
 **Claude Code** — merges into `~/.claude/settings.json` (creating it if needed,
-leaving every other key — permissions, hooks, other env vars — untouched):
+leaving permissions, hooks, other env vars, and custom sandbox filesystem/network
+rules untouched). Gateway mode enables Claude's strict auto-allow sandbox by
+default: Bash runs inside the OS sandbox without routine prompts, the
+`dangerouslyDisableSandbox` escape hatch is disabled, and supported platforms
+fail closed if isolation cannot initialize. Native Windows keeps startup
+available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
 
 ```json
 {
   "apiKeyHelper": "impel token",
   "env": {
     "ANTHROPIC_BASE_URL": "https://gateway.useimpel.com/anthropic"
+  },
+  "sandbox": {
+    "enabled": true,
+    "failIfUnavailable": true,
+    "autoAllowBashIfSandboxed": true,
+    "allowUnsandboxedCommands": false,
+    "excludedCommands": []
   }
 }
 ```
@@ -597,9 +615,9 @@ refresh_interval_ms = 300000
 ```
 
 Before overwriting anything, `impel` **backs up** what was there (any prior
-`apiKeyHelper` / `ANTHROPIC_BASE_URL`, and the prior Codex `model_provider`
-value) into `~/.config/impel/config.json`, so `impel use account` can restore it
-exactly. If `config.toml` already has a `[model_providers.impel]` table that
+`apiKeyHelper`, `ANTHROPIC_BASE_URL`, Claude sandbox policy, and the prior Codex
+`model_provider` value) into `~/.config/impel/config.json`, so `impel use account`
+can restore it exactly. If `config.toml` already has a `[model_providers.impel]` table that
 wasn't written by this tool, `impel` refuses to touch the file and tells you to
 resolve it manually rather than risk emitting invalid/duplicate TOML.
 
@@ -908,7 +926,7 @@ impel status             # see where each tool stands right now
 ```
 
 How the clean revert is guaranteed: `impel on` records the pre-existing values
-(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL`, and Codex's prior
+(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL` / Claude sandbox policy, and Codex's prior
 `model_provider`) into `~/.config/impel/config.json` **before** overwriting them,
 and only ever captures a real *account-mode* value (re-running `impel on` never
 clobbers the backup with Impel's own values). `impel off` removes only keys that
@@ -916,8 +934,9 @@ still point at Impel and restores those backups — so a full `on` → `off`
 round-trip leaves `settings.json` and `config.toml` byte-for-byte back to where
 they started, with all your unrelated keys and tables intact.
 
-If you'd rather revert by hand: delete `apiKeyHelper` + the Impel
-`ANTHROPIC_BASE_URL` from `~/.claude/settings.json`; delete the block between the
+If you'd rather revert by hand: delete `apiKeyHelper`, the Impel
+`ANTHROPIC_BASE_URL`, and the Impel-managed sandbox keys from
+`~/.claude/settings.json`; delete the block between the
 `# >>> impel-cli managed block ... >>>` / `# <<< impel-cli managed block <<<`
 markers in `~/.codex/config.toml` and reset `model_provider`; and
 `rm -rf ~/.config/impel` to forget the PAT + gateway entirely.
@@ -969,6 +988,12 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
 - https://developers.openai.com/codex/auth
 - https://developers.openai.com/codex/ide
 
+## Sources consulted for the Claude sandbox config
+
+- https://code.claude.com/docs/en/settings#sandbox-settings
+- https://code.claude.com/docs/en/sandboxing#configure-the-sandbox-for-your-organization
+- https://github.com/anthropics/claude-code/blob/v2.1.205/examples/settings/settings-bash-sandbox.json
+
 ## Sources consulted for concurrent tenant apps
 
 - Electron v43.1.0 release: https://github.com/electron/electron/releases/tag/v43.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -10,8 +10,10 @@ import {
   secureManagedCodexHome,
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
+import { impelCliInvocation } from "./selfInvocation.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
 import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
+import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 
 export const CLAUDE_CONFIG_ID = "1ced0000-0000-4000-8000-000000000001";
 const CHATGPT_CONFIG_START = "# >>> impel app managed gateway >>>";
@@ -161,7 +163,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 11;
+export const CURRENT_CONFIG_VERSION = 12;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -575,6 +577,7 @@ export function installManagedAppFiles({
     if (target === "claude") {
       migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
       writeClaudeDefaultApp(paths);
+      writeClaudeCodeSettings(paths);
       writeClaudeConfig(paths, config, models);
     }
     else writeChatGPTConfig(paths, config, models, vendorCodexModels, chatgptInvocations);
@@ -858,6 +861,23 @@ function writeClaudeConfig(paths, config, models) {
   }, null, 2) + "\n", 0o600);
 }
 
+function writeClaudeCodeSettings(paths) {
+  const settingsPath = path.join(paths.claude.userData, "settings.json");
+  let settings = {};
+  if (fs.existsSync(settingsPath)) {
+    try {
+      settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+    } catch {
+      throw new Error(`Claude Code settings are not valid JSON: ${settingsPath}`);
+    }
+  }
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+    throw new Error(`Claude Code settings must contain a JSON object: ${settingsPath}`);
+  }
+  applyImpelClaudeSandbox(settings);
+  writeAtomic(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, 0o600);
+}
+
 function writeClaudeDefaultApp(paths) {
   const configPath = path.join(paths.claude.userData, "claude_desktop_config.json");
   let current = {};
@@ -925,9 +945,16 @@ function writeChatGPTConfig(paths, config, models, vendorCodexModels, invocation
   };
   writeAtomic(paths.chatgpt.catalog, JSON.stringify(catalog, null, 2) + "\n", 0o600);
   const auth = invocations?.auth || { command: paths.tokenHelper, args: null };
+  // Finder/Dock-launched apps inherit a minimal PATH without npm/nvm bin
+  // directories, so a PATH-relative "impel" never spawns there. Bake the
+  // absolute node + CLI invocation; the launch-time `app refresh` rewrites
+  // this config whenever those paths change.
+  const mcpInvocation = impelCliInvocation(
+    config.tenantId ? ["mcp", "--tenant", config.tenantId] : ["mcp"]
+  );
   const mcp = invocations?.mcp || {
-    command: "impel",
-    args: config.tenantId ? ["mcp", "--tenant", config.tenantId] : ["mcp"],
+    command: mcpInvocation.command,
+    args: [...mcpInvocation.args],
   };
 
   const managedToml = [
@@ -1153,20 +1180,63 @@ function readTopLevelTomlString(toml, key) {
   }
 }
 
+/**
+ * Rewrite one tenant's app token helper with the current node/CLI paths.
+ * Cheap and Impel-owned, so install recovery can use it to heal helpers whose
+ * baked interpreter or checkout paths went stale.
+ */
+export function rewriteTenantTokenHelper(tenantId, homeDir = os.homedir()) {
+  const paths = appPaths(homeDir, tenantId);
+  if (!fs.existsSync(path.dirname(paths.tokenHelper))) return false;
+  writeTokenHelper(paths.tokenHelper, tenantId);
+  return true;
+}
+
 function writeTokenHelper(target, tenantId) {
   const cliPath = fileURLToPath(new URL("../bin/impel.js", import.meta.url));
   const node = shellQuote(process.execPath);
   const cli = shellQuote(cliPath);
   const tenantArgs = tenantId ? ` --tenant ${shellQuote(tenantId)}` : "";
-  const refreshTenantArgs = tenantId ? ` --tenant ${shellQuote(tenantId)}` : "";
   // The apps invoke this helper whenever they need auth, which makes it the
   // one hook that fires on Finder/Dock launches too. Piggyback a detached,
   // TTL-gated config/catalog/skills refresh (`app refresh --stale-only`) so
   // the managed apps keep themselves current without touching stdout — the
   // caller consumes stdout as the token.
+  //
+  // The baked interpreter/CLI paths are only first choices: an nvm upgrade or
+  // a moved checkout deletes them, and a helper that hardcodes them strands
+  // every managed app with no auth (observed as "provider auth command exited
+  // with status 1" outages). Resolve again at call time before giving up, and
+  // prefer the global npm install next to whichever node is found so the
+  // refresh keeps rewriting this helper with current paths.
   const script = `#!/bin/sh
-(${node} ${cli} app refresh --stale-only${refreshTenantArgs} </dev/null >/dev/null 2>&1 &)
-exec ${node} ${cli} token${tenantArgs}
+# Managed by impel-cli; regenerated by \`impel app refresh\`.
+NODE=${node}
+CLI=${cli}
+if ! [ -x "$NODE" ]; then
+  NODE="$(command -v node 2>/dev/null || true)"
+fi
+if ! [ -x "$NODE" ]; then
+  for candidate in /opt/homebrew/bin/node /usr/local/bin/node "$HOME"/.nvm/versions/node/*/bin/node; do
+    if [ -x "$candidate" ]; then NODE="$candidate"; fi
+  done
+fi
+if ! [ -x "$NODE" ]; then
+  echo 'impel token helper: no usable node runtime found; re-run \`impel setup\`' >&2
+  exit 1
+fi
+if ! [ -f "$CLI" ]; then
+  CLI="$(dirname "$NODE")/../lib/node_modules/impel-cli/bin/impel.js"
+fi
+if ! [ -f "$CLI" ]; then
+  CLI="$(command -v impel 2>/dev/null || true)"
+fi
+if [ -z "$CLI" ] || ! [ -f "$CLI" ]; then
+  echo 'impel token helper: impel-cli not found; re-run \`impel setup\`' >&2
+  exit 1
+fi
+("$NODE" "$CLI" app refresh --stale-only${tenantArgs} </dev/null >/dev/null 2>&1 &)
+exec "$NODE" "$CLI" token${tenantArgs}
 `;
   writeAtomic(target, script, 0o700);
 }

package/src/claudeSandbox.js

@@ -0,0 +1,80 @@
+const MANAGED_SANDBOX_KEYS = Object.freeze([
+  "enabled",
+  "failIfUnavailable",
+  "autoAllowBashIfSandboxed",
+  "allowUnsandboxedCommands",
+  "excludedCommands",
+]);
+
+function isJsonObject(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+function sameJsonValue(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+/**
+ * Claude Code's strict, auto-allow sandbox profile.
+ *
+ * Native Windows does not implement Claude's sandbox. Keep it enabled so the
+ * same profile becomes effective in WSL, but do not make native Windows fail
+ * at startup solely because the platform cannot initialize it.
+ */
+export function impelClaudeSandboxPolicy(platform = process.platform) {
+  return {
+    enabled: true,
+    failIfUnavailable: platform !== "win32",
+    autoAllowBashIfSandboxed: true,
+    allowUnsandboxedCommands: false,
+    excludedCommands: [],
+  };
+}
+
+/** Apply the managed sandbox keys while preserving unrelated sandbox config. */
+export function applyImpelClaudeSandbox(settings, platform = process.platform) {
+  const current = isJsonObject(settings.sandbox) ? settings.sandbox : {};
+  settings.sandbox = {
+    ...current,
+    ...impelClaudeSandboxPolicy(platform),
+  };
+  return settings.sandbox;
+}
+
+/** Capture the exact pre-Impel value for reversible native-profile switching. */
+export function captureClaudeSandbox(settings) {
+  return Object.hasOwn(settings, "sandbox")
+    ? { present: true, value: settings.sandbox }
+    : { present: false };
+}
+
+/**
+ * Restore only managed keys that still hold Impel's values. User changes made
+ * while gateway mode was active, plus unrelated filesystem/network keys, win.
+ */
+export function restoreClaudeSandbox(settings, snapshot, platform = process.platform) {
+  if (!isJsonObject(settings.sandbox)) return false;
+  const policy = impelClaudeSandboxPolicy(platform);
+  const prior = snapshot?.present === true && isJsonObject(snapshot.value)
+    ? snapshot.value
+    : null;
+  const sandbox = { ...settings.sandbox };
+  let changed = false;
+
+  for (const key of MANAGED_SANDBOX_KEYS) {
+    if (!Object.hasOwn(sandbox, key) || !sameJsonValue(sandbox[key], policy[key])) continue;
+    if (prior && Object.hasOwn(prior, key)) sandbox[key] = prior[key];
+    else delete sandbox[key];
+    changed = true;
+  }
+
+  if (!changed) return false;
+  if (Object.keys(sandbox).length > 0 || (snapshot?.present === true && prior)) {
+    settings.sandbox = sandbox;
+  } else if (snapshot?.present === true) {
+    settings.sandbox = snapshot.value;
+  } else {
+    delete settings.sandbox;
+  }
+  return true;
+}

package/src/claudeSetup.js

@@ -10,6 +10,11 @@ import os from "node:os";
 import path from "node:path";
 
 import { IMPEL_MANAGED_MCP_ENV, impelMcpInvocation } from "./selfInvocation.js";
+import {
+  applyImpelClaudeSandbox,
+  captureClaudeSandbox,
+  restoreClaudeSandbox,
+} from "./claudeSandbox.js";
 
 export const CLAUDE_DIR = path.join(os.homedir(), ".claude");
 export const CLAUDE_SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json");
@@ -123,12 +128,14 @@ export function applyClaudeGateway(gatewayUrl) {
 
   const priorApiKeyHelper = settings.apiKeyHelper;
   const priorBaseUrl = settings.env?.ANTHROPIC_BASE_URL;
+  const priorSandbox = captureClaudeSandbox(settings);
 
   settings.apiKeyHelper = IMPEL_API_KEY_HELPER;
   settings.env = {
     ...(settings.env || {}),
     ANTHROPIC_BASE_URL: impelClaudeBaseUrl(gatewayUrl),
   };
+  const sandbox = applyImpelClaudeSandbox(settings);
 
   writeSettings(settings);
   userConfig.mcpServers = {
@@ -143,6 +150,8 @@ export function applyClaudeGateway(gatewayUrl) {
     baseUrl: settings.env.ANTHROPIC_BASE_URL,
     priorApiKeyHelper,
     priorBaseUrl,
+    priorSandbox,
+    sandbox,
   };
 }
 
@@ -179,6 +188,9 @@ export function revertClaudeGateway(gatewayUrl, backup = {}) {
     changed = true;
   }
 
+  const restoredSandbox = restoreClaudeSandbox(settings, backup.sandbox);
+  if (restoredSandbox) changed = true;
+
   if (changed) writeSettings(settings);
 
   if (isImpelMcpServer(userConfig.mcpServers?.[IMPEL_MCP_SERVER_NAME])) {
@@ -201,6 +213,7 @@ export function revertClaudeGateway(gatewayUrl, backup = {}) {
     removedHelper,
     removedBaseUrl,
     removedMcpServer,
+    restoredSandbox,
     restoredApiKeyHelper: removedHelper && backup.apiKeyHelper != null ? backup.apiKeyHelper : null,
     restoredBaseUrl: removedBaseUrl && backup.ANTHROPIC_BASE_URL != null ? backup.ANTHROPIC_BASE_URL : null,
   };

package/src/cliProfiles.js

@@ -11,6 +11,7 @@ import {
 import { CONFIG_DIR } from "./config.js";
 import { normalizeTenantId } from "./tenants.js";
 import { impelCliInvocation, impelMcpInvocation } from "./selfInvocation.js";
+import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
 
@@ -118,6 +119,7 @@ export function ensureImpelClaudeProfile(gatewayUrl, tenantId, { crossAppModels
     delete managedEnvironment.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY;
   }
   settings.env = managedEnvironment;
+  applyImpelClaudeSandbox(settings);
   userConfig.mcpServers = {
     ...(userConfig.mcpServers &&
     typeof userConfig.mcpServers === "object" &&

package/src/commands/setup.js

@@ -17,6 +17,7 @@ import {
 import { promptSecret, promptText } from "../prompt.js";
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile } from "../cliProfiles.js";
 import { fetchTenants, normalizeTenantId, tenantCredential } from "../tenants.js";
+import { rewriteTenantTokenHelper } from "../apps.js";
 import { cmdApps } from "./apps.js";
 import { prepareWindowsClis, windowsCliInstallCommands } from "../windowsSetup.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
@@ -490,6 +491,9 @@ export async function cmdSetup(argv, overrides = {}) {
                 crossAppModels: crossAppModelsEnabled(config),
               });
               ensureImpelCodexProfile(gatewayUrl, tenant.id);
+              // Also refresh the app token helper: a stale baked node/CLI
+              // path there breaks every managed app's auth.
+              rewriteTenantTokenHelper(tenant.id);
               return true;
             },
             installVendorApp,

package/src/commands/use.js

@@ -76,9 +76,13 @@ async function useGateway({ target, app }) {
     if (!isImpelClaudeBaseUrl(result.priorBaseUrl, gatewayUrl)) {
       backup.ANTHROPIC_BASE_URL = result.priorBaseUrl ?? null;
     }
+    if (!Object.hasOwn(backup, "sandbox")) {
+      backup.sandbox = result.priorSandbox;
+    }
     console.log(`Claude Code -> GATEWAY  (${result.path})`);
     console.log(`  apiKeyHelper = "${result.apiKeyHelper}"`);
     console.log(`  env.ANTHROPIC_BASE_URL = "${result.baseUrl}"`);
+    console.log(`  sandbox = strict auto-allow (${result.sandbox.failIfUnavailable ? "fail closed" : "platform fallback"})`);
     console.log(`  MCP server = "impel" (direct Impel CLI invocation)`);
   }
 
@@ -167,6 +171,9 @@ function useAccount({ target, app }) {
       if (result.removedMcpServer) {
         console.log(`  removed Impel MCP server`);
       }
+      if (result.restoredSandbox) {
+        console.log(`  restored prior Claude sandbox settings`);
+      }
     }
     if (config?.backups) delete config.backups.claude;
   }

package/src/gateway/index.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import readline from "node:readline";
 
 import { nativeCommandInvocation } from "../nativeProcess.js";
+import { applyImpelClaudeSandbox } from "../claudeSandbox.js";
 
 const SAFE_ID = /^[a-z][a-z0-9-]{2,31}$/u;
 const SAFE_NAMESPACE = /^[a-z][a-z0-9_-]{1,31}$/u;
@@ -301,6 +302,7 @@ export function createGatewayCli(options) {
     };
     delete settings.env.ANTHROPIC_API_KEY;
     delete settings.env.ANTHROPIC_AUTH_TOKEN;
+    applyImpelClaudeSandbox(settings);
     writePrivateFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`);
     return { configDir, settingsPath };
   }

package/src/installRecovery/checkpoint.js

@@ -36,8 +36,11 @@ export function saveInstallRecoveryCheckpoint(
 ) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
   const temporary = `${filePath}.tmp-${process.pid}`;
+  fs.rmSync(temporary, { force: true });
+  // "wx" refuses to follow a pre-planted symlink at the predictable temp path.
   fs.writeFileSync(temporary, `${JSON.stringify(checkpoint, null, 2)}\n`, {
     mode: 0o600,
+    flag: "wx",
   });
   fs.renameSync(temporary, filePath);
   try {

package/src/installRecovery/engine.js

@@ -28,6 +28,7 @@ import {
 import { createRecoveryInference, resolveRecoverySeat } from "./inference.js";
 import {
   installRecoveryFingerprint,
+  redactInstallRecoveryText,
   sanitizeInstallFailureEnvelope,
 } from "./redact.js";
 import {
@@ -93,8 +94,10 @@ async function runGoals(goals) {
 }
 
 function describeToolCall(name, input) {
+  // Model-supplied values render in approval prompts and logs; strip control
+  // sequences so a confused model cannot rewrite what the user is approving.
   const parameters = Object.entries(input || {})
-    .map(([key, value]) => `${key}=${value}`)
+    .map(([key, value]) => `${key}=${redactSecretText(String(value)).slice(0, 160)}`)
     .join(", ");
   return parameters ? `${name} (${parameters})` : name;
 }
@@ -141,7 +144,9 @@ async function executeCall(session, name, input, reason = null) {
 
 function buildFirstUserMessage(session, failure, deterministicSummary, goalReport) {
   const goalLines = goalReport.results.map(
-    (goal) => `- ${goal.ok ? "pass" : "FAIL"} ${goal.id}: ${goal.description}${goal.detail ? ` — ${goal.detail}` : ""}`
+    (goal) => `- ${goal.ok ? "pass" : "FAIL"} ${goal.id}: ${goal.description}${
+      goal.detail ? ` — ${redactInstallRecoveryText(goal.detail).slice(0, 300)}` : ""
+    }`
   );
   const lines = [
     "An `impel` installation step failed on this machine. Diagnose and repair it.",
@@ -359,7 +364,9 @@ export async function runInstallRecovery(options, overrides = {}) {
                 tool_use_id: call.id,
                 content: `Rejected: goal health checks still fail locally:\n${goalReport.results
                   .filter((goal) => !goal.ok)
-                  .map((goal) => `- ${goal.id}: ${goal.description}${goal.detail ? ` — ${goal.detail}` : ""}`)
+                  .map((goal) => `- ${goal.id}: ${goal.description}${
+                    goal.detail ? ` — ${redactInstallRecoveryText(goal.detail).slice(0, 300)}` : ""
+                  }`)
                   .join("\n")}\nKeep repairing or report blocked.`,
                 is_error: true,
               });

package/src/installRecovery/redact.js

@@ -5,9 +5,15 @@ import { redactSecretText } from "../config.js";
 
 const JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gu;
 const BEARER_RE = /\bBearer\s+[A-Za-z0-9._~+\/-]{8,}/giu;
-const SECRET_ASSIGNMENT_RE = /\b(api[_-]?key|authorization|password|secret|token)\s*[:=]\s*([^\s,;]+)/giu;
+// Quote-aware and prefix-tolerant: catches `token=x`, `"token": "x"`,
+// `ANTHROPIC_API_KEY=x`, and `Authorization: x` shapes alike.
+const SECRET_ASSIGNMENT_RE = /([A-Za-z0-9_.-]*(?:api[_-]?key|authorization|passwords?|secrets?|tokens?|credentials?)["']?\s*[:=]\s*["']?)([^\s"',;]+)/giu;
+// Common vendor credential formats that appear bare in logs with no key= prefix.
+const VENDOR_TOKEN_RE = /\b(?:sk-[A-Za-z0-9-]{2,20}-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{8,}|gho_[A-Za-z0-9]{8,}|ghu_[A-Za-z0-9]{8,}|ghs_[A-Za-z0-9]{8,}|github_pat_[A-Za-z0-9_]{8,}|glpat-[A-Za-z0-9_-]{8,}|xox[abposr]-[A-Za-z0-9-]{8,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{20,})\b/gu;
 const EMAIL_RE = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/giu;
-const WINDOWS_USER_PATH_RE = /\b[A-Za-z]:\\Users\\[^\\\s]+/giu;
+// Any per-user directory is PII, not just the current user's home.
+const WINDOWS_USER_PATH_RE = /\b[A-Za-z]:[\\/](?:Users|Profiles)[\\/][^\\/\s"']+/giu;
+const POSIX_USER_PATH_RE = /(?:^|[\s"'=:(])((?:\/Users|\/home)\/)([^\/\s"']+)/gu;
 
 function escapeRegex(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
@@ -20,9 +26,14 @@ export function redactInstallRecoveryText(value, { homeDir = os.homedir() } = {}
   }
   return text
     .replace(WINDOWS_USER_PATH_RE, "%USERPROFILE%")
+    .replace(POSIX_USER_PATH_RE, (_match, prefix, name, offset, whole) => {
+      const lead = whole[offset] === "/" ? "" : whole[offset];
+      return `${lead}${prefix}[USER]`.replace("//", "/");
+    })
     .replace(JWT_RE, "[REDACTED TOKEN]")
     .replace(BEARER_RE, "Bearer [REDACTED]")
-    .replace(SECRET_ASSIGNMENT_RE, (_match, name) => `${name}=[REDACTED]`)
+    .replace(SECRET_ASSIGNMENT_RE, (_match, name) => `${name}[REDACTED]`)
+    .replace(VENDOR_TOKEN_RE, "[REDACTED TOKEN]")
     .replace(EMAIL_RE, "[REDACTED EMAIL]")
     .slice(0, 12_000);
 }

package/src/installRecovery/tools.js

@@ -70,6 +70,12 @@ export const INSTALL_RECOVERY_TOOLS = Object.freeze({
       "Run a synthetic authenticated probe against the Impel gateway. Reports reachable/rejected status; never sends user content.",
     schema: {},
   },
+  check_auth_helper: {
+    risk: "read",
+    description:
+      "Run the tenant's Impel-owned app token helper with a bounded timeout and classify the result (works, missing, stale interpreter/CLI path, or failing). Use when managed apps report auth/credential failures.",
+    schema: {},
+  },
   check_health: {
     risk: "read",
     description:
@@ -297,6 +303,52 @@ function readProfile(input, context) {
   });
 }
 
+function checkAuthHelper(context, io) {
+  if (!context.tenantId) {
+    return result("failed", "No tenant is selected; the app token helper has not been created yet.");
+  }
+  if (context.platform === "win32") {
+    return result("failed", "Windows managed apps do not use a shell token helper; check the CLI profiles instead.");
+  }
+  const helperPath = path.join(
+    CONFIG_DIR,
+    "apps",
+    "tenants",
+    context.tenantId,
+    "bin",
+    "token"
+  );
+  if (!fs.existsSync(helperPath)) {
+    return result("failed", "The tenant app token helper is missing; repair_impel_profile regenerates it.");
+  }
+  const run = io.spawnSync(helperPath, [], {
+    encoding: "utf8",
+    env: context.environment,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 20_000,
+    windowsHide: true,
+  });
+  if (run?.error) {
+    return result("failed", `The app token helper could not be executed (${run.error.code || run.error.message}).`);
+  }
+  if (run.status === 0 && /impel_/u.test(String(run.stdout || ""))) {
+    return result("succeeded", "The app token helper runs and emits a credential.");
+  }
+  const stderr = String(run.stderr || "");
+  const classified = /Cannot find module|MODULE_NOT_FOUND/iu.test(stderr)
+    ? "its embedded impel-cli path no longer exists"
+    : /No such file or directory|not found|no usable node/iu.test(stderr)
+      ? "its embedded node runtime path no longer exists"
+      : /SyntaxError/iu.test(stderr)
+        ? "it points at an incompatible impel-cli checkout"
+        : "it exited without emitting a credential";
+  return result(
+    "failed",
+    `The app token helper is broken: ${classified}. repair_impel_profile rewrites it with current paths.`,
+    { exitCode: run.status, output: stderr.slice(0, 2_000) }
+  );
+}
+
 async function probeGateway(context) {
   if (typeof context.probeGateway !== "function") {
     return result("failed", "Gateway verification is unavailable in this recovery context.");
@@ -517,6 +569,7 @@ export async function executeInstallRecoveryTool(name, rawInput, context = {}, d
     case "inspect_processes": return inspectProcesses(resolvedContext, io);
     case "check_binary": return checkBinary(input, resolvedContext, io);
     case "read_profile": return readProfile(input, resolvedContext);
+    case "check_auth_helper": return checkAuthHelper(resolvedContext, io);
     case "probe_gateway": return probeGateway(resolvedContext);
     case "check_health": return checkHealth(resolvedContext);
     case "repair_impel_profile": return repairImpelProfile(resolvedContext);
@@ -577,5 +630,19 @@ export function deterministicInstallRecoveryPlan(failure, platform = process.pla
       reason: "Transient npm/network failures often succeed on a clean retry.",
     });
   }
+  if (/provider auth command|cannot find module|module_not_found|token helper/u.test(text)) {
+    plan.push(
+      {
+        tool: "check_auth_helper",
+        input: {},
+        reason: "The failure mentions the app auth helper; classify how it is broken.",
+      },
+      {
+        tool: "repair_impel_profile",
+        input: {},
+        reason: "Regenerating Impel-owned profiles rewrites the token helper with current paths.",
+      }
+    );
+  }
   return plan;
 }