impel-cli 0.16.2 → 0.16.3

package/README.md

@@ -554,8 +554,11 @@ default when personal and Impel sessions should coexist.
 Every Impel-managed Claude configuration uses the same strict sandbox defaults:
 the isolated `impel claude` profile, each tenant's Claude Desktop Code profile,
 the native profile while `impel use gateway claude` is active, and branded
-gateway-only CLI profiles. App config version 12 makes existing tenant profiles
-refresh onto this policy after the CLI update.
+gateway-only CLI profiles. App config version 14 also pins managed Claude
+Desktop profiles to third-party deployment mode, enables the 3P Chat tab so
+Code's "Back to Claude" route has a valid destination, and removes the unusable
+Claude.ai sign-in path. Existing tenant profiles refresh onto these policies
+after the CLI update.
 
 ### `impel use gateway [claude|codex|all]`  (alias `impel on`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.16.2",
+  "version": "0.16.3",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -163,7 +163,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 12;
+export const CURRENT_CONFIG_VERSION = 14;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -172,7 +172,7 @@ export const CURRENT_CONFIG_VERSION = 12;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-17.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-19.1";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -207,8 +207,24 @@ export function readBundleCompatibility(launcher) {
  * closed, so a routine CLI update that doesn't change bundle bytes must leave
  * the installed bundles — and their macOS permission grants — untouched.
  */
-export function bundleIsCurrent(status, { signingMode = desiredSigningMode() } = {}) {
+export function bundleIsCurrent(status, {
+  signingMode = desiredSigningMode(),
+  platform = process.platform,
+  osRelease = os.release(),
+} = {}) {
   if (!status.launcherInstalled || !status.vendorPath || !status.vendorVersion) return false;
+  // macOS 26 (Darwin 25) refuses to launch bundles whose CFBundleExecutable is
+  // a script (-10669). A wrapper in that state — either target — is broken
+  // regardless of its fingerprint; reporting it stale makes the next
+  // install/open rebuild it into a launchable layout (e.g. the ChatGPT
+  // launch-host layout once a compiler exists), with no fingerprint bump.
+  if (
+    platform === "darwin"
+    && Number.parseInt(osRelease, 10) >= 25
+    && !wrapperLaunchesOnTahoe(status)
+  ) {
+    return false;
+  }
   const compatibility = readBundleCompatibility(status.launcher);
   return Boolean(
     compatibility
@@ -238,6 +254,28 @@ export function bundleIsCurrent(status, { signingMode = desiredSigningMode() } =
   );
 }
 
+/**
+ * Whether a wrapper bundle's main executable is one macOS 26 will launch.
+ * The ChatGPT wrapper must be on the launch-host layout: its script fallback
+ * is exactly what Tahoe refuses (-10669). The Claude wrapper retains the
+ * vendor's Mach-O executable, so its only unlaunchable state is that
+ * executable going missing — the Mach-O bytes themselves are not probed
+ * because test fixtures legitimately stand in scripts for the vendor binary.
+ */
+function wrapperLaunchesOnTahoe(status) {
+  try {
+    const plist = fs.readFileSync(path.join(status.launcher, "Contents", "Info.plist"), "utf8");
+    const executable = plist.match(/<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/u)?.[1];
+    if (!executable) return false;
+    const file = path.join(status.launcher, "Contents", "MacOS", executable);
+    if (!fs.existsSync(file)) return false;
+    if (status.target === "chatgpt") return executable === "launch-host" && isMachO(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function managedClaudeRendererMatchesCompatibility(status, compatibility) {
   try {
     const renderer = compatibility.rendererAssets?.agentMentions;
@@ -853,6 +891,17 @@ function writeClaudeConfig(paths, config, models) {
     inferenceGatewayAuthScheme: "bearer",
     modelDiscoveryEnabled: false,
     inferenceModels: claudeModels,
+    // 3P builds leave Chat unavailable unless the administrator opts in. The
+    // Code install/disabled screen's "Back to Claude" link targets the Chat
+    // root; without this key the root router selects Code again and strands
+    // gateway users in a loop even though inference is healthy.
+    chatTabEnabled: true,
+    // Managed flat key (maps to authentication.disableClaudeAiSignIn, vendor
+    // 1.3834.0+): hides the Claude.ai sign-in option and keeps the app in 3P
+    // mode even when the persisted deploymentMode is missing or "1p". Claude.ai
+    // account login is a dead end for gateway profiles anyway — the server
+    // rejects it with custom_3p_not_available.
+    disableDeploymentModeChooser: true,
   };
   writeAtomic(path.join(dir, `${CLAUDE_CONFIG_ID}.json`), JSON.stringify(body, null, 2) + "\n", 0o600);
   writeAtomic(path.join(dir, "_meta.json"), JSON.stringify({
@@ -895,14 +944,29 @@ function writeClaudeDefaultApp(paths) {
   if (!preferences || typeof preferences !== "object" || Array.isArray(preferences)) {
     throw new Error(`Claude desktop preferences must contain a JSON object: ${configPath}`);
   }
+  // The desktop app gates its UI on a persisted top-level `deploymentMode`:
+  // until it is "3p", every launch lands on the sign-in / provider-chooser
+  // screen — even though the applied configLibrary gateway config loads fine —
+  // and Claude.ai email login is server-disabled for 3P profiles
+  // (custom_3p_not_available). A managed gateway profile is only ever 3P, so
+  // enforce the key like the sandbox policy (heal "1p"/cleared values too,
+  // e.g. after an in-app sign-out), not seed-once like a user preference.
+  const needsDeploymentMode = current.deploymentMode !== "3p";
   // Claude persists the selected top-level app as `preferences.sidebarMode`.
   // Seed Code for a new isolated profile, then leave subsequent user choices
   // alone during install, update, and background config refreshes.
-  if (Object.hasOwn(preferences, "sidebarMode")) return;
-  writeAtomic(configPath, JSON.stringify({
+  const needsSidebarMode = !Object.hasOwn(preferences, "sidebarMode");
+  if (!needsDeploymentMode && !needsSidebarMode) return;
+  const next = {
     ...current,
-    preferences: { ...preferences, sidebarMode: "code" },
-  }, null, 2) + "\n", 0o600);
+    ...(needsDeploymentMode ? { deploymentMode: "3p" } : {}),
+    preferences: needsSidebarMode ? { ...preferences, sidebarMode: "code" } : preferences,
+  };
+  // A vendor sign-out writes `awaitingSignIn: true` alongside "1p". Left in
+  // place it re-arms the app's quit-time revert — which deletes deploymentMode
+  // again — should the gateway config ever fail to load. Drop it when healing.
+  if (needsDeploymentMode) delete next.awaitingSignIn;
+  writeAtomic(configPath, JSON.stringify(next, null, 2) + "\n", 0o600);
 }
 
 function writeChatGPTConfig(paths, config, models, vendorCodexModels, invocations = null) {
@@ -1386,16 +1450,28 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
     const runtimeAsarPath = path.join(staging, "Contents", "Resources", "app.asar");
     const fastModePatchCount = patchFastModeAuthGate(runtimeAsarPath);
     const asarHash = asarHeaderHash(runtimeAsarPath);
+    const launchHost = ensureChatGPTLaunchHost();
     writeAtomic(
       path.join(staging, "Contents", "Info.plist"),
-      vendoredChatGPTWrapperPlist(vendorPath, asarHash, paths.chatgpt),
+      vendoredChatGPTWrapperPlist(vendorPath, asarHash, paths.chatgpt, launchHost ? "launch-host" : "launch"),
       0o644,
     );
+    // With the Mach-O launch host as the bundle executable, the launch script
+    // lives in Resources (codesign seals it as a resource; anything else in
+    // Contents/MacOS would need its own code signature). Its $HERE/../Resources
+    // references resolve identically from either directory. Without a compiler
+    // the script stays in MacOS as the executable (pre-Tahoe layout).
     writeAtomic(
-      path.join(macos, "launch"),
+      path.join(launchHost ? path.join(staging, "Contents", "Resources") : macos, "launch"),
       vendoredChatGPTLauncher(paths, vendorBundleName, executableName, gatewayUrl),
       0o755,
     );
+    if (launchHost) {
+      fs.mkdirSync(macos, { recursive: true });
+      const hostTarget = path.join(macos, "launch-host");
+      fs.copyFileSync(launchHost, hostTarget);
+      fs.chmodSync(hostTarget, 0o755);
+    }
     writeAtomic(
       path.join(staging, "Contents", "Resources", "impel-chatgpt-preload.cjs"),
       vendoredChatGPTDisplayNamePreload(),
@@ -1779,12 +1855,101 @@ function rebrandElectronHelpers(bundle, { fromName, toName, fromIdentifier, toId
   }
 }
 
-function vendoredChatGPTWrapperPlist(vendorPath, asarHash, identity) {
+// macOS 26 (Tahoe) Launch Services refuses to launch a bundle whose
+// CFBundleExecutable is a script (_LSOpenURLsWithCompletionHandler error
+// -10669), so the wrapper's main executable must be a real Mach-O. This tiny
+// host binary exec()s the launch script in Contents/Resources, preserving the
+// script-based setup flow and the bundle's designated requirement.
+const CHATGPT_LAUNCH_HOST_SOURCE = `#include <libgen.h>
+#include <limits.h>
+#include <mach-o/dyld.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+  char exe[PATH_MAX];
+  uint32_t size = sizeof(exe);
+  if (_NSGetExecutablePath(exe, &size) != 0) return 1;
+  char resolved[PATH_MAX];
+  if (!realpath(exe, resolved)) return 1;
+  char script[PATH_MAX];
+  if (snprintf(script, sizeof(script), "%s/../Resources/launch", dirname(resolved)) >= (int)sizeof(script)) return 1;
+  char **args = calloc((size_t)argc + 1, sizeof(char *));
+  if (!args) return 1;
+  args[0] = script;
+  for (int i = 1; i < argc; i++) args[i] = argv[i];
+  args[argc] = NULL;
+  execv(script, args);
+  perror("execv");
+  return 1;
+}
+`;
+
+/**
+ * Compile (once) and cache the Mach-O launch host for the ChatGPT wrapper.
+ * Returns the cached binary's path, or null when it cannot be built (no
+ * compiler); callers then fall back to the script-only layout. That fallback
+ * still launches on macOS ≤ 15, but macOS 26 refuses it (-10669), so the
+ * failure is reported loudly there instead of silently installing an app
+ * that will never open.
+ */
+export function ensureChatGPTLaunchHost({
+  platform = process.platform,
+  osRelease = os.release(),
+  compiler = "/usr/bin/cc",
+  cacheDir = fileURLToPath(new URL("../cache", import.meta.url)),
+  warn = console.warn,
+} = {}) {
+  if (platform !== "darwin") return null;
+  const sourceHash = crypto.createHash("sha256").update(CHATGPT_LAUNCH_HOST_SOURCE).digest("hex").slice(0, 12);
+  const hostPath = path.join(cacheDir, `launch-host-${sourceHash}`);
+  const failed = (detail) => {
+    // Darwin 25 == macOS 26, the first release that refuses script-executable
+    // bundles; earlier releases launch the fallback layout fine, so stay quiet.
+    if (Number.parseInt(osRelease, 10) >= 25) {
+      warn(
+        `impel: could not compile the Impel ChatGPT launch helper (${redactSecretText(String(detail || "unknown error"))}); `
+        + "macOS 26 refuses to open the script-based fallback app. Install the Xcode Command Line Tools "
+        + "(xcode-select --install), then run `impel app update chatgpt`.",
+      );
+    }
+    return null;
+  };
+  const building = path.join(cacheDir, `.launch-host-${sourceHash}.tmp-${process.pid}`);
+  try {
+    if (fs.existsSync(hostPath) && isMachO(hostPath)) return hostPath;
+    fs.mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+    const source = path.join(os.tmpdir(), `impel-launch-host-${process.pid}.c`);
+    fs.writeFileSync(source, CHATGPT_LAUNCH_HOST_SOURCE, { mode: 0o600 });
+    // Compile to a process-private path and rename into place: concurrent
+    // installs share this cache, and a reader must never see a partial binary.
+    const built = spawnSync(compiler, ["-O2", "-o", building, source], { encoding: "utf8" });
+    fs.rmSync(source, { force: true });
+    if (built.error || built.status !== 0 || !fs.existsSync(building) || !isMachO(building)) {
+      fs.rmSync(building, { force: true });
+      const detail = built.error?.message
+        || String(built.stderr || "").trim().split("\n")[0]
+        || `compiler exit code ${built.status}`;
+      return failed(detail);
+    }
+    fs.chmodSync(building, 0o755);
+    fs.renameSync(building, hostPath);
+    return hostPath;
+  } catch (error) {
+    fs.rmSync(building, { force: true });
+    return failed(error?.message);
+  }
+}
+
+function vendoredChatGPTWrapperPlist(vendorPath, asarHash, identity, executableName = "launch") {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
 <key>CFBundleDisplayName</key><string>${xmlEscape(identity.displayName)}</string>
-<key>CFBundleExecutable</key><string>launch</string>
+<key>CFBundleExecutable</key><string>${xmlEscape(executableName)}</string>
 <key>CFBundleIconFile</key><string>electron.icns</string>
 <key>CFBundleIdentifier</key><string>${xmlEscape(identity.bundleIdentifier)}</string>
 <key>CFBundleName</key><string>${xmlEscape(identity.displayName)}</string>

package/src/commands/apps.js

@@ -986,13 +986,14 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
   }
 }
 
-function manifestIsFresh(paths, config, now = Date.now()) {
+export function manifestIsFresh(paths, config, now = Date.now()) {
   try {
     const manifest = JSON.parse(
       fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8")
     );
     const updatedAt = Date.parse(manifest?.updatedAt || "");
     return Number.isFinite(updatedAt)
+      && manifest?.configVersion === CURRENT_CONFIG_VERSION
       && manifest?.experiments?.crossAppModels === crossAppModelsEnabled(config)
       && now - updatedAt < REFRESH_TTL_MS;
   } catch {