impel-cli 0.16.1 → 0.16.2

package/README.md

@@ -551,19 +551,37 @@ impel codex exec --json "review the current diff"
 switch their native profiles in place; the isolated launchers are the safer
 default when personal and Impel sessions should coexist.
 
+Every Impel-managed Claude configuration uses the same strict sandbox defaults:
+the isolated `impel claude` profile, each tenant's Claude Desktop Code profile,
+the native profile while `impel use gateway claude` is active, and branded
+gateway-only CLI profiles. App config version 12 makes existing tenant profiles
+refresh onto this policy after the CLI update.
+
 ### `impel use gateway [claude|codex|all]`  (alias `impel on`)
 
 Turns **on** gateway mode for the given tool (default `all`). Requires `impel auth`
 first.
 
 **Claude Code** — merges into `~/.claude/settings.json` (creating it if needed,
-leaving every other key — permissions, hooks, other env vars — untouched):
+leaving permissions, hooks, other env vars, and custom sandbox filesystem/network
+rules untouched). Gateway mode enables Claude's strict auto-allow sandbox by
+default: Bash runs inside the OS sandbox without routine prompts, the
+`dangerouslyDisableSandbox` escape hatch is disabled, and supported platforms
+fail closed if isolation cannot initialize. Native Windows keeps startup
+available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
 
 ```json
 {
   "apiKeyHelper": "impel token",
   "env": {
     "ANTHROPIC_BASE_URL": "https://gateway.useimpel.com/anthropic"
+  },
+  "sandbox": {
+    "enabled": true,
+    "failIfUnavailable": true,
+    "autoAllowBashIfSandboxed": true,
+    "allowUnsandboxedCommands": false,
+    "excludedCommands": []
   }
 }
 ```
@@ -597,9 +615,9 @@ refresh_interval_ms = 300000
 ```
 
 Before overwriting anything, `impel` **backs up** what was there (any prior
-`apiKeyHelper` / `ANTHROPIC_BASE_URL`, and the prior Codex `model_provider`
-value) into `~/.config/impel/config.json`, so `impel use account` can restore it
-exactly. If `config.toml` already has a `[model_providers.impel]` table that
+`apiKeyHelper`, `ANTHROPIC_BASE_URL`, Claude sandbox policy, and the prior Codex
+`model_provider` value) into `~/.config/impel/config.json`, so `impel use account`
+can restore it exactly. If `config.toml` already has a `[model_providers.impel]` table that
 wasn't written by this tool, `impel` refuses to touch the file and tells you to
 resolve it manually rather than risk emitting invalid/duplicate TOML.
 
@@ -908,7 +926,7 @@ impel status             # see where each tool stands right now
 ```
 
 How the clean revert is guaranteed: `impel on` records the pre-existing values
-(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL`, and Codex's prior
+(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL` / Claude sandbox policy, and Codex's prior
 `model_provider`) into `~/.config/impel/config.json` **before** overwriting them,
 and only ever captures a real *account-mode* value (re-running `impel on` never
 clobbers the backup with Impel's own values). `impel off` removes only keys that
@@ -916,8 +934,9 @@ still point at Impel and restores those backups — so a full `on` → `off`
 round-trip leaves `settings.json` and `config.toml` byte-for-byte back to where
 they started, with all your unrelated keys and tables intact.
 
-If you'd rather revert by hand: delete `apiKeyHelper` + the Impel
-`ANTHROPIC_BASE_URL` from `~/.claude/settings.json`; delete the block between the
+If you'd rather revert by hand: delete `apiKeyHelper`, the Impel
+`ANTHROPIC_BASE_URL`, and the Impel-managed sandbox keys from
+`~/.claude/settings.json`; delete the block between the
 `# >>> impel-cli managed block ... >>>` / `# <<< impel-cli managed block <<<`
 markers in `~/.codex/config.toml` and reset `model_provider`; and
 `rm -rf ~/.config/impel` to forget the PAT + gateway entirely.
@@ -969,6 +988,12 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
 - https://developers.openai.com/codex/auth
 - https://developers.openai.com/codex/ide
 
+## Sources consulted for the Claude sandbox config
+
+- https://code.claude.com/docs/en/settings#sandbox-settings
+- https://code.claude.com/docs/en/sandboxing#configure-the-sandbox-for-your-organization
+- https://github.com/anthropics/claude-code/blob/v2.1.205/examples/settings/settings-bash-sandbox.json
+
 ## Sources consulted for concurrent tenant apps
 
 - Electron v43.1.0 release: https://github.com/electron/electron/releases/tag/v43.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -13,6 +13,7 @@ import { normalizeTenantId } from "./tenants.js";
 import { impelCliInvocation } from "./selfInvocation.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
 import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
+import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 
 export const CLAUDE_CONFIG_ID = "1ced0000-0000-4000-8000-000000000001";
 const CHATGPT_CONFIG_START = "# >>> impel app managed gateway >>>";
@@ -162,7 +163,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 11;
+export const CURRENT_CONFIG_VERSION = 12;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -576,6 +577,7 @@ export function installManagedAppFiles({
     if (target === "claude") {
       migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
       writeClaudeDefaultApp(paths);
+      writeClaudeCodeSettings(paths);
       writeClaudeConfig(paths, config, models);
     }
     else writeChatGPTConfig(paths, config, models, vendorCodexModels, chatgptInvocations);
@@ -859,6 +861,23 @@ function writeClaudeConfig(paths, config, models) {
   }, null, 2) + "\n", 0o600);
 }
 
+function writeClaudeCodeSettings(paths) {
+  const settingsPath = path.join(paths.claude.userData, "settings.json");
+  let settings = {};
+  if (fs.existsSync(settingsPath)) {
+    try {
+      settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+    } catch {
+      throw new Error(`Claude Code settings are not valid JSON: ${settingsPath}`);
+    }
+  }
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+    throw new Error(`Claude Code settings must contain a JSON object: ${settingsPath}`);
+  }
+  applyImpelClaudeSandbox(settings);
+  writeAtomic(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, 0o600);
+}
+
 function writeClaudeDefaultApp(paths) {
   const configPath = path.join(paths.claude.userData, "claude_desktop_config.json");
   let current = {};

package/src/claudeSandbox.js

@@ -0,0 +1,80 @@
+const MANAGED_SANDBOX_KEYS = Object.freeze([
+  "enabled",
+  "failIfUnavailable",
+  "autoAllowBashIfSandboxed",
+  "allowUnsandboxedCommands",
+  "excludedCommands",
+]);
+
+function isJsonObject(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+function sameJsonValue(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+/**
+ * Claude Code's strict, auto-allow sandbox profile.
+ *
+ * Native Windows does not implement Claude's sandbox. Keep it enabled so the
+ * same profile becomes effective in WSL, but do not make native Windows fail
+ * at startup solely because the platform cannot initialize it.
+ */
+export function impelClaudeSandboxPolicy(platform = process.platform) {
+  return {
+    enabled: true,
+    failIfUnavailable: platform !== "win32",
+    autoAllowBashIfSandboxed: true,
+    allowUnsandboxedCommands: false,
+    excludedCommands: [],
+  };
+}
+
+/** Apply the managed sandbox keys while preserving unrelated sandbox config. */
+export function applyImpelClaudeSandbox(settings, platform = process.platform) {
+  const current = isJsonObject(settings.sandbox) ? settings.sandbox : {};
+  settings.sandbox = {
+    ...current,
+    ...impelClaudeSandboxPolicy(platform),
+  };
+  return settings.sandbox;
+}
+
+/** Capture the exact pre-Impel value for reversible native-profile switching. */
+export function captureClaudeSandbox(settings) {
+  return Object.hasOwn(settings, "sandbox")
+    ? { present: true, value: settings.sandbox }
+    : { present: false };
+}
+
+/**
+ * Restore only managed keys that still hold Impel's values. User changes made
+ * while gateway mode was active, plus unrelated filesystem/network keys, win.
+ */
+export function restoreClaudeSandbox(settings, snapshot, platform = process.platform) {
+  if (!isJsonObject(settings.sandbox)) return false;
+  const policy = impelClaudeSandboxPolicy(platform);
+  const prior = snapshot?.present === true && isJsonObject(snapshot.value)
+    ? snapshot.value
+    : null;
+  const sandbox = { ...settings.sandbox };
+  let changed = false;
+
+  for (const key of MANAGED_SANDBOX_KEYS) {
+    if (!Object.hasOwn(sandbox, key) || !sameJsonValue(sandbox[key], policy[key])) continue;
+    if (prior && Object.hasOwn(prior, key)) sandbox[key] = prior[key];
+    else delete sandbox[key];
+    changed = true;
+  }
+
+  if (!changed) return false;
+  if (Object.keys(sandbox).length > 0 || (snapshot?.present === true && prior)) {
+    settings.sandbox = sandbox;
+  } else if (snapshot?.present === true) {
+    settings.sandbox = snapshot.value;
+  } else {
+    delete settings.sandbox;
+  }
+  return true;
+}

package/src/claudeSetup.js

@@ -10,6 +10,11 @@ import os from "node:os";
 import path from "node:path";
 
 import { IMPEL_MANAGED_MCP_ENV, impelMcpInvocation } from "./selfInvocation.js";
+import {
+  applyImpelClaudeSandbox,
+  captureClaudeSandbox,
+  restoreClaudeSandbox,
+} from "./claudeSandbox.js";
 
 export const CLAUDE_DIR = path.join(os.homedir(), ".claude");
 export const CLAUDE_SETTINGS_PATH = path.join(CLAUDE_DIR, "settings.json");
@@ -123,12 +128,14 @@ export function applyClaudeGateway(gatewayUrl) {
 
   const priorApiKeyHelper = settings.apiKeyHelper;
   const priorBaseUrl = settings.env?.ANTHROPIC_BASE_URL;
+  const priorSandbox = captureClaudeSandbox(settings);
 
   settings.apiKeyHelper = IMPEL_API_KEY_HELPER;
   settings.env = {
     ...(settings.env || {}),
     ANTHROPIC_BASE_URL: impelClaudeBaseUrl(gatewayUrl),
   };
+  const sandbox = applyImpelClaudeSandbox(settings);
 
   writeSettings(settings);
   userConfig.mcpServers = {
@@ -143,6 +150,8 @@ export function applyClaudeGateway(gatewayUrl) {
     baseUrl: settings.env.ANTHROPIC_BASE_URL,
     priorApiKeyHelper,
     priorBaseUrl,
+    priorSandbox,
+    sandbox,
   };
 }
 
@@ -179,6 +188,9 @@ export function revertClaudeGateway(gatewayUrl, backup = {}) {
     changed = true;
   }
 
+  const restoredSandbox = restoreClaudeSandbox(settings, backup.sandbox);
+  if (restoredSandbox) changed = true;
+
   if (changed) writeSettings(settings);
 
   if (isImpelMcpServer(userConfig.mcpServers?.[IMPEL_MCP_SERVER_NAME])) {
@@ -201,6 +213,7 @@ export function revertClaudeGateway(gatewayUrl, backup = {}) {
     removedHelper,
     removedBaseUrl,
     removedMcpServer,
+    restoredSandbox,
     restoredApiKeyHelper: removedHelper && backup.apiKeyHelper != null ? backup.apiKeyHelper : null,
     restoredBaseUrl: removedBaseUrl && backup.ANTHROPIC_BASE_URL != null ? backup.ANTHROPIC_BASE_URL : null,
   };

package/src/cliProfiles.js

@@ -11,6 +11,7 @@ import {
 import { CONFIG_DIR } from "./config.js";
 import { normalizeTenantId } from "./tenants.js";
 import { impelCliInvocation, impelMcpInvocation } from "./selfInvocation.js";
+import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
 
@@ -118,6 +119,7 @@ export function ensureImpelClaudeProfile(gatewayUrl, tenantId, { crossAppModels
     delete managedEnvironment.CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY;
   }
   settings.env = managedEnvironment;
+  applyImpelClaudeSandbox(settings);
   userConfig.mcpServers = {
     ...(userConfig.mcpServers &&
     typeof userConfig.mcpServers === "object" &&

package/src/commands/use.js

@@ -76,9 +76,13 @@ async function useGateway({ target, app }) {
     if (!isImpelClaudeBaseUrl(result.priorBaseUrl, gatewayUrl)) {
       backup.ANTHROPIC_BASE_URL = result.priorBaseUrl ?? null;
     }
+    if (!Object.hasOwn(backup, "sandbox")) {
+      backup.sandbox = result.priorSandbox;
+    }
     console.log(`Claude Code -> GATEWAY  (${result.path})`);
     console.log(`  apiKeyHelper = "${result.apiKeyHelper}"`);
     console.log(`  env.ANTHROPIC_BASE_URL = "${result.baseUrl}"`);
+    console.log(`  sandbox = strict auto-allow (${result.sandbox.failIfUnavailable ? "fail closed" : "platform fallback"})`);
     console.log(`  MCP server = "impel" (direct Impel CLI invocation)`);
   }
 
@@ -167,6 +171,9 @@ function useAccount({ target, app }) {
       if (result.removedMcpServer) {
         console.log(`  removed Impel MCP server`);
       }
+      if (result.restoredSandbox) {
+        console.log(`  restored prior Claude sandbox settings`);
+      }
     }
     if (config?.backups) delete config.backups.claude;
   }

package/src/gateway/index.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import readline from "node:readline";
 
 import { nativeCommandInvocation } from "../nativeProcess.js";
+import { applyImpelClaudeSandbox } from "../claudeSandbox.js";
 
 const SAFE_ID = /^[a-z][a-z0-9-]{2,31}$/u;
 const SAFE_NAMESPACE = /^[a-z][a-z0-9_-]{1,31}$/u;
@@ -301,6 +302,7 @@ export function createGatewayCli(options) {
     };
     delete settings.env.ANTHROPIC_API_KEY;
     delete settings.env.ANTHROPIC_AUTH_TOKEN;
+    applyImpelClaudeSandbox(settings);
     writePrivateFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`);
     return { configDir, settingsPath };
   }