impel-cli 0.16.2 → 0.16.4

package/README.md

@@ -551,11 +551,15 @@ impel codex exec --json "review the current diff"
 switch their native profiles in place; the isolated launchers are the safer
 default when personal and Impel sessions should coexist.
 
-Every Impel-managed Claude configuration uses the same strict sandbox defaults:
+Every Impel-managed Claude configuration uses the same strict sandbox defaults
+with unrestricted outbound network access:
 the isolated `impel claude` profile, each tenant's Claude Desktop Code profile,
 the native profile while `impel use gateway claude` is active, and branded
-gateway-only CLI profiles. App config version 12 makes existing tenant profiles
-refresh onto this policy after the CLI update.
+gateway-only CLI profiles. App config version 15 also pins managed Claude
+Desktop profiles to third-party deployment mode, enables the 3P Chat tab so
+Code's "Back to Claude" route has a valid destination, and removes the unusable
+Claude.ai sign-in path. Existing tenant profiles refresh onto these policies
+after the CLI update.
 
 ### `impel use gateway [claude|codex|all]`  (alias `impel on`)
 
@@ -563,12 +567,16 @@ Turns **on** gateway mode for the given tool (default `all`). Requires `impel au
 first.
 
 **Claude Code** — merges into `~/.claude/settings.json` (creating it if needed,
-leaving permissions, hooks, other env vars, and custom sandbox filesystem/network
-rules untouched). Gateway mode enables Claude's strict auto-allow sandbox by
+leaving existing permission rules, hooks, other env vars, and custom sandbox
+filesystem/network rules intact). Gateway mode enables Claude's strict auto-allow sandbox by
 default: Bash runs inside the OS sandbox without routine prompts, the
 `dangerouslyDisableSandbox` escape hatch is disabled, and supported platforms
 fail closed if isolation cannot initialize. Native Windows keeps startup
 available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
+A global `WebFetch(domain:*)` allow rule opens every outbound destination for Bash commands
+while retaining filesystem isolation. Explicit deny rules remain authoritative.
+On macOS, `enableWeakerNetworkIsolation` lets Go-based network tools reach the
+system TLS trust service while remaining sandboxed.
 
 ```json
 {
@@ -576,12 +584,16 @@ available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
   "env": {
     "ANTHROPIC_BASE_URL": "https://gateway.useimpel.com/anthropic"
   },
+  "permissions": {
+    "allow": ["WebFetch(domain:*)"]
+  },
   "sandbox": {
     "enabled": true,
     "failIfUnavailable": true,
     "autoAllowBashIfSandboxed": true,
     "allowUnsandboxedCommands": false,
-    "excludedCommands": []
+    "excludedCommands": [],
+    "enableWeakerNetworkIsolation": true
   }
 }
 ```
@@ -593,7 +605,9 @@ available because Claude's sandbox is supported only on macOS, Linux, and WSL2.
 as Claude Code's `apiKeyHelper`), so we reuse `impel token` there too instead of
 writing the PAT into `config.toml` or `~/.codex/auth.json`. The block written
 (fenced by markers, so everything else in your `config.toml` — other
-`model_providers`, `mcp_servers`, sandbox policy — is left alone):
+`model_providers`, `mcp_servers`, and unrelated sandbox policy — is left alone).
+Codex defaults to the `workspace-write` filesystem sandbox with unrestricted
+direct outbound access; its optional network proxy stays disabled:
 
 ```toml
 model_provider = "impel"
@@ -601,6 +615,9 @@ model_provider = "impel"
 # >>> impel-cli managed block (model_providers.impel) >>>
 # Generated by `impel use gateway codex`. Safe to re-run; do not hand-edit
 # the lines between the markers above/below, they'll be overwritten.
+sandbox_mode = "workspace-write"
+sandbox_workspace_write.network_access = true
+
 [model_providers.impel]
 name = "Impel Gateway"
 base_url = "https://gateway.useimpel.com/chatgpt_passthrough/backend-api/codex"
@@ -615,8 +632,9 @@ refresh_interval_ms = 300000
 ```
 
 Before overwriting anything, `impel` **backs up** what was there (any prior
-`apiKeyHelper`, `ANTHROPIC_BASE_URL`, Claude sandbox policy, and the prior Codex
-`model_provider` value) into `~/.config/impel/config.json`, so `impel use account`
+`apiKeyHelper`, `ANTHROPIC_BASE_URL`, Claude sandbox/permission policy, and the
+prior Codex `model_provider`, sandbox mode, and workspace network values) into
+`~/.config/impel/config.json`, so `impel use account`
 can restore it exactly. If `config.toml` already has a `[model_providers.impel]` table that
 wasn't written by this tool, `impel` refuses to touch the file and tells you to
 resolve it manually rather than risk emitting invalid/duplicate TOML.
@@ -629,11 +647,14 @@ removes **only** the Impel-added bits, never your own config:
 - **Claude Code** — removes `apiKeyHelper` only if it's `"impel token"`, and
   `env.ANTHROPIC_BASE_URL` only if it equals `<gateway>/anthropic`. Then restores
   whatever those keys held before gateway mode (from the backup). If there was
-  nothing before, they're deleted (and an emptied `env` is dropped).
+  nothing before, they're deleted (and an emptied `env` is dropped). It also
+  removes only the Impel-added global `WebFetch(domain:*)` allow rule.
 - **Codex** — removes the marker-fenced `[model_providers.impel]` block, and
   resets `model_provider` **only if it currently reads `"impel"`** — back to its
   backed-up prior value, or, if there was none, removes the line entirely so
-  Codex falls back to its built-in default. All other tables are untouched.
+  Codex falls back to its built-in default. The prior
+  `sandbox_mode` and `sandbox_workspace_write.network_access` values are
+  restored. All other tables are untouched.
 
 `impel use account` doesn't require the PAT and is safe to run repeatedly (if a
 tool is already in account mode it just says so and changes nothing).
@@ -926,8 +947,10 @@ impel status             # see where each tool stands right now
 ```
 
 How the clean revert is guaranteed: `impel on` records the pre-existing values
-(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL` / Claude sandbox policy, and Codex's prior
-`model_provider`) into `~/.config/impel/config.json` **before** overwriting them,
+(your own `apiKeyHelper` / `ANTHROPIC_BASE_URL` / Claude sandbox and permission
+policy, and Codex's prior `model_provider`, sandbox mode, and workspace network
+value) into
+`~/.config/impel/config.json` **before** overwriting them,
 and only ever captures a real *account-mode* value (re-running `impel on` never
 clobbers the backup with Impel's own values). `impel off` removes only keys that
 still point at Impel and restores those backups — so a full `on` → `off`
@@ -936,9 +959,10 @@ they started, with all your unrelated keys and tables intact.
 
 If you'd rather revert by hand: delete `apiKeyHelper`, the Impel
 `ANTHROPIC_BASE_URL`, and the Impel-managed sandbox keys from
-`~/.claude/settings.json`; delete the block between the
+`~/.claude/settings.json`, plus the Impel-added `WebFetch(domain:*)` allow rule; delete the block between the
 `# >>> impel-cli managed block ... >>>` / `# <<< impel-cli managed block <<<`
-markers in `~/.codex/config.toml` and reset `model_provider`; and
+markers in `~/.codex/config.toml`, reset `model_provider`, and restore or remove
+`sandbox_mode` and `sandbox_workspace_write.network_access`; and
 `rm -rf ~/.config/impel` to forget the PAT + gateway entirely.
 
 ## Codex compatibility route
@@ -977,9 +1001,9 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
   `impel token` rather than copying it into their own config files — one token,
   one rotation path, no stale copies.
 - **The `config.toml` merge is intentionally narrow**, not a general TOML
-  parser: it only ever touches a single top-level `model_provider` line and its
-  own fenced `[model_providers.impel*]` block, leaving unrelated tables (other
-  providers, MCP servers, sandbox policy, etc.) untouched.
+  parser: it touches the top-level `model_provider`, sandbox mode, the
+  workspace-write network toggle, and its own fenced `[model_providers.impel*]` block, leaving unrelated
+  tables (other providers, MCP servers, sandbox policy, etc.) untouched.
 
 ## Sources consulted for the Codex config
 
@@ -992,7 +1016,7 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
 
 - https://code.claude.com/docs/en/settings#sandbox-settings
 - https://code.claude.com/docs/en/sandboxing#configure-the-sandbox-for-your-organization
-- https://github.com/anthropics/claude-code/blob/v2.1.205/examples/settings/settings-bash-sandbox.json
+- https://github.com/anthropics/claude-code/blob/v2.1.214/examples/settings/settings-bash-sandbox.json
 
 ## Sources consulted for concurrent tenant apps
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.16.2",
+  "version": "0.16.4",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -163,7 +163,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 12;
+export const CURRENT_CONFIG_VERSION = 15;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -172,7 +172,7 @@ export const CURRENT_CONFIG_VERSION = 12;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-17.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-19.1";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -207,8 +207,24 @@ export function readBundleCompatibility(launcher) {
  * closed, so a routine CLI update that doesn't change bundle bytes must leave
  * the installed bundles — and their macOS permission grants — untouched.
  */
-export function bundleIsCurrent(status, { signingMode = desiredSigningMode() } = {}) {
+export function bundleIsCurrent(status, {
+  signingMode = desiredSigningMode(),
+  platform = process.platform,
+  osRelease = os.release(),
+} = {}) {
   if (!status.launcherInstalled || !status.vendorPath || !status.vendorVersion) return false;
+  // macOS 26 (Darwin 25) refuses to launch bundles whose CFBundleExecutable is
+  // a script (-10669). A wrapper in that state — either target — is broken
+  // regardless of its fingerprint; reporting it stale makes the next
+  // install/open rebuild it into a launchable layout (e.g. the ChatGPT
+  // launch-host layout once a compiler exists), with no fingerprint bump.
+  if (
+    platform === "darwin"
+    && Number.parseInt(osRelease, 10) >= 25
+    && !wrapperLaunchesOnTahoe(status)
+  ) {
+    return false;
+  }
   const compatibility = readBundleCompatibility(status.launcher);
   return Boolean(
     compatibility
@@ -238,6 +254,28 @@ export function bundleIsCurrent(status, { signingMode = desiredSigningMode() } =
   );
 }
 
+/**
+ * Whether a wrapper bundle's main executable is one macOS 26 will launch.
+ * The ChatGPT wrapper must be on the launch-host layout: its script fallback
+ * is exactly what Tahoe refuses (-10669). The Claude wrapper retains the
+ * vendor's Mach-O executable, so its only unlaunchable state is that
+ * executable going missing — the Mach-O bytes themselves are not probed
+ * because test fixtures legitimately stand in scripts for the vendor binary.
+ */
+function wrapperLaunchesOnTahoe(status) {
+  try {
+    const plist = fs.readFileSync(path.join(status.launcher, "Contents", "Info.plist"), "utf8");
+    const executable = plist.match(/<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/u)?.[1];
+    if (!executable) return false;
+    const file = path.join(status.launcher, "Contents", "MacOS", executable);
+    if (!fs.existsSync(file)) return false;
+    if (status.target === "chatgpt") return executable === "launch-host" && isMachO(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function managedClaudeRendererMatchesCompatibility(status, compatibility) {
   try {
     const renderer = compatibility.rendererAssets?.agentMentions;
@@ -853,6 +891,17 @@ function writeClaudeConfig(paths, config, models) {
     inferenceGatewayAuthScheme: "bearer",
     modelDiscoveryEnabled: false,
     inferenceModels: claudeModels,
+    // 3P builds leave Chat unavailable unless the administrator opts in. The
+    // Code install/disabled screen's "Back to Claude" link targets the Chat
+    // root; without this key the root router selects Code again and strands
+    // gateway users in a loop even though inference is healthy.
+    chatTabEnabled: true,
+    // Managed flat key (maps to authentication.disableClaudeAiSignIn, vendor
+    // 1.3834.0+): hides the Claude.ai sign-in option and keeps the app in 3P
+    // mode even when the persisted deploymentMode is missing or "1p". Claude.ai
+    // account login is a dead end for gateway profiles anyway — the server
+    // rejects it with custom_3p_not_available.
+    disableDeploymentModeChooser: true,
   };
   writeAtomic(path.join(dir, `${CLAUDE_CONFIG_ID}.json`), JSON.stringify(body, null, 2) + "\n", 0o600);
   writeAtomic(path.join(dir, "_meta.json"), JSON.stringify({
@@ -895,14 +944,29 @@ function writeClaudeDefaultApp(paths) {
   if (!preferences || typeof preferences !== "object" || Array.isArray(preferences)) {
     throw new Error(`Claude desktop preferences must contain a JSON object: ${configPath}`);
   }
+  // The desktop app gates its UI on a persisted top-level `deploymentMode`:
+  // until it is "3p", every launch lands on the sign-in / provider-chooser
+  // screen — even though the applied configLibrary gateway config loads fine —
+  // and Claude.ai email login is server-disabled for 3P profiles
+  // (custom_3p_not_available). A managed gateway profile is only ever 3P, so
+  // enforce the key like the sandbox policy (heal "1p"/cleared values too,
+  // e.g. after an in-app sign-out), not seed-once like a user preference.
+  const needsDeploymentMode = current.deploymentMode !== "3p";
   // Claude persists the selected top-level app as `preferences.sidebarMode`.
   // Seed Code for a new isolated profile, then leave subsequent user choices
   // alone during install, update, and background config refreshes.
-  if (Object.hasOwn(preferences, "sidebarMode")) return;
-  writeAtomic(configPath, JSON.stringify({
+  const needsSidebarMode = !Object.hasOwn(preferences, "sidebarMode");
+  if (!needsDeploymentMode && !needsSidebarMode) return;
+  const next = {
     ...current,
-    preferences: { ...preferences, sidebarMode: "code" },
-  }, null, 2) + "\n", 0o600);
+    ...(needsDeploymentMode ? { deploymentMode: "3p" } : {}),
+    preferences: needsSidebarMode ? { ...preferences, sidebarMode: "code" } : preferences,
+  };
+  // A vendor sign-out writes `awaitingSignIn: true` alongside "1p". Left in
+  // place it re-arms the app's quit-time revert — which deletes deploymentMode
+  // again — should the gateway config ever fail to load. Drop it when healing.
+  if (needsDeploymentMode) delete next.awaitingSignIn;
+  writeAtomic(configPath, JSON.stringify(next, null, 2) + "\n", 0o600);
 }
 
 function writeChatGPTConfig(paths, config, models, vendorCodexModels, invocations = null) {
@@ -1386,16 +1450,28 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
     const runtimeAsarPath = path.join(staging, "Contents", "Resources", "app.asar");
     const fastModePatchCount = patchFastModeAuthGate(runtimeAsarPath);
     const asarHash = asarHeaderHash(runtimeAsarPath);
+    const launchHost = ensureChatGPTLaunchHost();
     writeAtomic(
       path.join(staging, "Contents", "Info.plist"),
-      vendoredChatGPTWrapperPlist(vendorPath, asarHash, paths.chatgpt),
+      vendoredChatGPTWrapperPlist(vendorPath, asarHash, paths.chatgpt, launchHost ? "launch-host" : "launch"),
       0o644,
     );
+    // With the Mach-O launch host as the bundle executable, the launch script
+    // lives in Resources (codesign seals it as a resource; anything else in
+    // Contents/MacOS would need its own code signature). Its $HERE/../Resources
+    // references resolve identically from either directory. Without a compiler
+    // the script stays in MacOS as the executable (pre-Tahoe layout).
     writeAtomic(
-      path.join(macos, "launch"),
+      path.join(launchHost ? path.join(staging, "Contents", "Resources") : macos, "launch"),
       vendoredChatGPTLauncher(paths, vendorBundleName, executableName, gatewayUrl),
       0o755,
     );
+    if (launchHost) {
+      fs.mkdirSync(macos, { recursive: true });
+      const hostTarget = path.join(macos, "launch-host");
+      fs.copyFileSync(launchHost, hostTarget);
+      fs.chmodSync(hostTarget, 0o755);
+    }
     writeAtomic(
       path.join(staging, "Contents", "Resources", "impel-chatgpt-preload.cjs"),
       vendoredChatGPTDisplayNamePreload(),
@@ -1779,12 +1855,101 @@ function rebrandElectronHelpers(bundle, { fromName, toName, fromIdentifier, toId
   }
 }
 
-function vendoredChatGPTWrapperPlist(vendorPath, asarHash, identity) {
+// macOS 26 (Tahoe) Launch Services refuses to launch a bundle whose
+// CFBundleExecutable is a script (_LSOpenURLsWithCompletionHandler error
+// -10669), so the wrapper's main executable must be a real Mach-O. This tiny
+// host binary exec()s the launch script in Contents/Resources, preserving the
+// script-based setup flow and the bundle's designated requirement.
+const CHATGPT_LAUNCH_HOST_SOURCE = `#include <libgen.h>
+#include <limits.h>
+#include <mach-o/dyld.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+  char exe[PATH_MAX];
+  uint32_t size = sizeof(exe);
+  if (_NSGetExecutablePath(exe, &size) != 0) return 1;
+  char resolved[PATH_MAX];
+  if (!realpath(exe, resolved)) return 1;
+  char script[PATH_MAX];
+  if (snprintf(script, sizeof(script), "%s/../Resources/launch", dirname(resolved)) >= (int)sizeof(script)) return 1;
+  char **args = calloc((size_t)argc + 1, sizeof(char *));
+  if (!args) return 1;
+  args[0] = script;
+  for (int i = 1; i < argc; i++) args[i] = argv[i];
+  args[argc] = NULL;
+  execv(script, args);
+  perror("execv");
+  return 1;
+}
+`;
+
+/**
+ * Compile (once) and cache the Mach-O launch host for the ChatGPT wrapper.
+ * Returns the cached binary's path, or null when it cannot be built (no
+ * compiler); callers then fall back to the script-only layout. That fallback
+ * still launches on macOS ≤ 15, but macOS 26 refuses it (-10669), so the
+ * failure is reported loudly there instead of silently installing an app
+ * that will never open.
+ */
+export function ensureChatGPTLaunchHost({
+  platform = process.platform,
+  osRelease = os.release(),
+  compiler = "/usr/bin/cc",
+  cacheDir = fileURLToPath(new URL("../cache", import.meta.url)),
+  warn = console.warn,
+} = {}) {
+  if (platform !== "darwin") return null;
+  const sourceHash = crypto.createHash("sha256").update(CHATGPT_LAUNCH_HOST_SOURCE).digest("hex").slice(0, 12);
+  const hostPath = path.join(cacheDir, `launch-host-${sourceHash}`);
+  const failed = (detail) => {
+    // Darwin 25 == macOS 26, the first release that refuses script-executable
+    // bundles; earlier releases launch the fallback layout fine, so stay quiet.
+    if (Number.parseInt(osRelease, 10) >= 25) {
+      warn(
+        `impel: could not compile the Impel ChatGPT launch helper (${redactSecretText(String(detail || "unknown error"))}); `
+        + "macOS 26 refuses to open the script-based fallback app. Install the Xcode Command Line Tools "
+        + "(xcode-select --install), then run `impel app update chatgpt`.",
+      );
+    }
+    return null;
+  };
+  const building = path.join(cacheDir, `.launch-host-${sourceHash}.tmp-${process.pid}`);
+  try {
+    if (fs.existsSync(hostPath) && isMachO(hostPath)) return hostPath;
+    fs.mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+    const source = path.join(os.tmpdir(), `impel-launch-host-${process.pid}.c`);
+    fs.writeFileSync(source, CHATGPT_LAUNCH_HOST_SOURCE, { mode: 0o600 });
+    // Compile to a process-private path and rename into place: concurrent
+    // installs share this cache, and a reader must never see a partial binary.
+    const built = spawnSync(compiler, ["-O2", "-o", building, source], { encoding: "utf8" });
+    fs.rmSync(source, { force: true });
+    if (built.error || built.status !== 0 || !fs.existsSync(building) || !isMachO(building)) {
+      fs.rmSync(building, { force: true });
+      const detail = built.error?.message
+        || String(built.stderr || "").trim().split("\n")[0]
+        || `compiler exit code ${built.status}`;
+      return failed(detail);
+    }
+    fs.chmodSync(building, 0o755);
+    fs.renameSync(building, hostPath);
+    return hostPath;
+  } catch (error) {
+    fs.rmSync(building, { force: true });
+    return failed(error?.message);
+  }
+}
+
+function vendoredChatGPTWrapperPlist(vendorPath, asarHash, identity, executableName = "launch") {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
 <key>CFBundleDisplayName</key><string>${xmlEscape(identity.displayName)}</string>
-<key>CFBundleExecutable</key><string>launch</string>
+<key>CFBundleExecutable</key><string>${xmlEscape(executableName)}</string>
 <key>CFBundleIconFile</key><string>electron.icns</string>
 <key>CFBundleIdentifier</key><string>${xmlEscape(identity.bundleIdentifier)}</string>
 <key>CFBundleName</key><string>${xmlEscape(identity.displayName)}</string>

package/src/claudeSandbox.js

@@ -4,8 +4,11 @@ const MANAGED_SANDBOX_KEYS = Object.freeze([
   "autoAllowBashIfSandboxed",
   "allowUnsandboxedCommands",
   "excludedCommands",
+  "enableWeakerNetworkIsolation",
 ]);
 
+export const IMPEL_CLAUDE_NETWORK_PERMISSION = "WebFetch(domain:*)";
+
 function isJsonObject(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -28,24 +31,79 @@ export function impelClaudeSandboxPolicy(platform = process.platform) {
     autoAllowBashIfSandboxed: true,
     allowUnsandboxedCommands: false,
     excludedCommands: [],
+    ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
+  };
+}
+
+function applyImpelClaudeNetworkPermission(permissions) {
+  const current = isJsonObject(permissions) ? permissions : {};
+  const allow = Array.isArray(current.allow) ? current.allow : [];
+  return {
+    ...current,
+    allow: [...new Set([...allow, IMPEL_CLAUDE_NETWORK_PERMISSION])],
   };
 }
 
 /** Apply the managed sandbox keys while preserving unrelated sandbox config. */
 export function applyImpelClaudeSandbox(settings, platform = process.platform) {
   const current = isJsonObject(settings.sandbox) ? settings.sandbox : {};
+  const policy = impelClaudeSandboxPolicy(platform);
   settings.sandbox = {
     ...current,
-    ...impelClaudeSandboxPolicy(platform),
+    ...policy,
   };
+  settings.permissions = applyImpelClaudeNetworkPermission(settings.permissions);
   return settings.sandbox;
 }
 
 /** Capture the exact pre-Impel value for reversible native-profile switching. */
 export function captureClaudeSandbox(settings) {
-  return Object.hasOwn(settings, "sandbox")
+  const snapshot = Object.hasOwn(settings, "sandbox")
     ? { present: true, value: settings.sandbox }
     : { present: false };
+  snapshot.permissions = Object.hasOwn(settings, "permissions")
+    ? { present: true, value: settings.permissions }
+    : { present: false };
+  return snapshot;
+}
+
+function restoreClaudeNetworkPermission(settings, snapshot) {
+  if (!Object.hasOwn(settings, "permissions")) return false;
+  const priorSnapshot = snapshot?.permissions;
+  const priorPresent = priorSnapshot?.present === true;
+  const priorValue = priorPresent ? priorSnapshot.value : undefined;
+  const appliedPrior = applyImpelClaudeNetworkPermission(priorValue);
+
+  if (sameJsonValue(settings.permissions, appliedPrior)) {
+    if (priorPresent) settings.permissions = priorValue;
+    else delete settings.permissions;
+    return true;
+  }
+  if (!isJsonObject(settings.permissions) || !Array.isArray(settings.permissions.allow)) {
+    return false;
+  }
+
+  const priorPermissions = isJsonObject(priorValue) ? priorValue : null;
+  const priorAllow = priorPermissions && Array.isArray(priorPermissions.allow)
+    ? priorPermissions.allow
+    : [];
+  if (priorAllow.includes(IMPEL_CLAUDE_NETWORK_PERMISSION)) return false;
+
+  const allow = settings.permissions.allow.filter(
+    (rule) => rule !== IMPEL_CLAUDE_NETWORK_PERMISSION,
+  );
+  if (sameJsonValue(allow, settings.permissions.allow)) return false;
+
+  const permissions = { ...settings.permissions };
+  if (allow.length > 0 || (priorPermissions && Object.hasOwn(priorPermissions, "allow"))) {
+    permissions.allow = allow;
+  } else {
+    delete permissions.allow;
+  }
+  if (Object.keys(permissions).length > 0) settings.permissions = permissions;
+  else if (priorPresent) settings.permissions = priorValue;
+  else delete settings.permissions;
+  return true;
 }
 
 /**
@@ -53,28 +111,33 @@ export function captureClaudeSandbox(settings) {
  * while gateway mode was active, plus unrelated filesystem/network keys, win.
  */
 export function restoreClaudeSandbox(settings, snapshot, platform = process.platform) {
-  if (!isJsonObject(settings.sandbox)) return false;
   const policy = impelClaudeSandboxPolicy(platform);
   const prior = snapshot?.present === true && isJsonObject(snapshot.value)
     ? snapshot.value
     : null;
-  const sandbox = { ...settings.sandbox };
   let changed = false;
 
-  for (const key of MANAGED_SANDBOX_KEYS) {
-    if (!Object.hasOwn(sandbox, key) || !sameJsonValue(sandbox[key], policy[key])) continue;
-    if (prior && Object.hasOwn(prior, key)) sandbox[key] = prior[key];
-    else delete sandbox[key];
-    changed = true;
-  }
+  if (isJsonObject(settings.sandbox)) {
+    const sandbox = { ...settings.sandbox };
+    let sandboxChanged = false;
+    for (const key of MANAGED_SANDBOX_KEYS) {
+      if (!Object.hasOwn(sandbox, key) || !sameJsonValue(sandbox[key], policy[key])) continue;
+      if (prior && Object.hasOwn(prior, key)) sandbox[key] = prior[key];
+      else delete sandbox[key];
+      sandboxChanged = true;
+    }
 
-  if (!changed) return false;
-  if (Object.keys(sandbox).length > 0 || (snapshot?.present === true && prior)) {
-    settings.sandbox = sandbox;
-  } else if (snapshot?.present === true) {
-    settings.sandbox = snapshot.value;
-  } else {
-    delete settings.sandbox;
+    if (sandboxChanged) {
+      if (Object.keys(sandbox).length > 0 || (snapshot?.present === true && prior)) {
+        settings.sandbox = sandbox;
+      } else if (snapshot?.present === true) {
+        settings.sandbox = snapshot.value;
+      } else {
+        delete settings.sandbox;
+      }
+      changed = true;
+    }
   }
-  return true;
+
+  return restoreClaudeNetworkPermission(settings, snapshot) || changed;
 }

package/src/codexSecurity.js

@@ -80,19 +80,61 @@ function upsertManagedBoolean(toml, table, key, value, configPath) {
   return `${base}${base ? "\n\n" : ""}${MANAGED_COMMENT}\n[${table}]\n${key} = ${value}\n`;
 }
 
+function upsertManagedRootString(toml, key, value, configPath) {
+  const lines = String(toml || "").replace(/\r\n/gu, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/u.test(line));
+  const preambleEnd = firstTable === -1 ? lines.length : firstTable;
+  const pattern = new RegExp(`^(\\s*)${escapeRegex(key)}\\s*=.*$`, "u");
+  const indices = lines
+    .slice(0, preambleEnd)
+    .flatMap((line, index) => (pattern.test(line) ? [index] : []));
+  if (indices.length > 1) {
+    throw new Error(`${configPath} defines ${key} more than once; resolve it before re-running.`);
+  }
+  if (indices.length === 1) {
+    const index = indices[0];
+    const indent = lines[index].match(pattern)?.[1] || "";
+    lines[index] = `${indent}${key} = ${JSON.stringify(value)}`;
+  } else {
+    lines.splice(preambleEnd, 0, `${key} = ${JSON.stringify(value)}`, "");
+  }
+  return `${lines.join("\n").replace(/\s*$/u, "")}\n`;
+}
+
+/** Enable unrestricted outbound access while Codex remains in workspace-write. */
+export function enableManagedCodexNetworkAccess(
+  toml,
+  configPath = "managed Codex config",
+) {
+  const workspaceSandbox = upsertManagedRootString(
+    toml,
+    "sandbox_mode",
+    "workspace-write",
+    configPath,
+  );
+  return upsertManagedBoolean(
+    workspaceSandbox,
+    "sandbox_workspace_write",
+    "network_access",
+    "true",
+    configPath,
+  );
+}
+
 /**
  * Disable Codex shell snapshots and keep its default KEY/SECRET/TOKEN filter
  * enabled. Existing unrelated keys in either table are retained.
  */
 export function hardenManagedCodexToml(toml, configPath = "managed Codex config") {
   const withoutSnapshots = upsertManagedBoolean(toml, "features", "shell_snapshot", "false", configPath);
-  return upsertManagedBoolean(
+  const withoutCredentialSnapshots = upsertManagedBoolean(
     withoutSnapshots,
     "shell_environment_policy",
     "ignore_default_excludes",
     "false",
     configPath,
   );
+  return enableManagedCodexNetworkAccess(withoutCredentialSnapshots, configPath);
 }
 
 function assertSafeManagedPath(target, expectedType) {

package/src/codexSetup.js

@@ -49,8 +49,17 @@ const START_MARK = `# >>> impel-cli managed block (model_providers.${PROVIDER_ID
 const END_MARK = `# <<< impel-cli managed block <<<`;
 
 const PROVIDER_LINE_RE = /^model_provider[ \t]*=[ \t]*"([^"]*)"[ \t]*$/m;
+const NETWORK_TABLE = "sandbox_workspace_write";
+const NETWORK_KEY = "network_access";
+const NETWORK_DOTTED_RE = /^(\s*)sandbox_workspace_write\.network_access\s*=.*$/u;
+const NETWORK_HEADER_RE = /^\s*\[sandbox_workspace_write\]\s*(?:#.*)?$/u;
+const NETWORK_KEY_RE = /^(\s*)network_access\s*=.*$/u;
+const SANDBOX_MODE_RE = /^(\s*)sandbox_mode\s*=.*$/u;
 
-function providerTablesBlock(gatewayUrl) {
+function providerTablesBlock(
+  gatewayUrl,
+  { includeNetworkAccess = false, includeSandboxMode = false } = {},
+) {
   const baseUrl = impelCodexBaseUrl(gatewayUrl);
   const auth = impelCliInvocation(["token"]);
   const mcp = impelCliInvocation(["mcp"]);
@@ -58,6 +67,8 @@ function providerTablesBlock(gatewayUrl) {
     START_MARK,
     "# Generated by `impel use gateway codex`. Safe to re-run; do not hand-edit",
     "# the lines between the markers above/below, they'll be overwritten.",
+    ...(includeSandboxMode ? ['sandbox_mode = "workspace-write"'] : []),
+    ...(includeNetworkAccess ? [`${NETWORK_TABLE}.${NETWORK_KEY} = true`, ""] : []),
     `[model_providers.${PROVIDER_ID}]`,
     `name = "Impel Gateway"`,
     `base_url = "${baseUrl}"`,
@@ -76,6 +87,123 @@ function providerTablesBlock(gatewayUrl) {
   ].join("\n");
 }
 
+function applyCodexSandboxMode(text, configPath = CODEX_CONFIG_PATH) {
+  const lines = String(text || "").replace(/\r\n/gu, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/u.test(line));
+  const preambleEnd = firstTable === -1 ? lines.length : firstTable;
+  const indices = lines
+    .slice(0, preambleEnd)
+    .flatMap((line, index) => (SANDBOX_MODE_RE.test(line) ? [index] : []));
+  if (indices.length > 1) {
+    throw new Error(`${configPath} defines sandbox_mode more than once; resolve it before re-running.`);
+  }
+  if (indices.length === 0) {
+    return { text, prior: { kind: "absent" }, includeInBlock: true };
+  }
+  const index = indices[0];
+  const line = lines[index];
+  const indent = line.match(SANDBOX_MODE_RE)?.[1] || "";
+  lines[index] = `${indent}sandbox_mode = "workspace-write"`;
+  return {
+    text: lines.join("\n"),
+    prior: { kind: "root", line },
+    includeInBlock: false,
+  };
+}
+
+function restoreCodexSandboxMode(text, snapshot) {
+  if (!snapshot || snapshot.kind === "absent") return { text, changed: false };
+  const lines = String(text || "").replace(/\r\n/gu, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/u.test(line));
+  const preambleEnd = firstTable === -1 ? lines.length : firstTable;
+  const indices = lines
+    .slice(0, preambleEnd)
+    .flatMap((line, index) => (SANDBOX_MODE_RE.test(line) ? [index] : []));
+  if (indices.length !== 1 || !/^\s*sandbox_mode\s*=\s*"workspace-write"\s*(?:#.*)?$/u.test(lines[indices[0]])) {
+    return { text, changed: false };
+  }
+  lines[indices[0]] = snapshot.line;
+  return { text: lines.join("\n"), changed: true };
+}
+
+function locateCodexNetworkAccess(text, configPath = CODEX_CONFIG_PATH) {
+  const lines = String(text || "").replace(/\r\n/gu, "\n").split("\n");
+  const firstTable = lines.findIndex((line) => /^\s*\[/u.test(line));
+  const preambleEnd = firstTable === -1 ? lines.length : firstTable;
+  const dotted = lines
+    .slice(0, preambleEnd)
+    .flatMap((line, index) => (NETWORK_DOTTED_RE.test(line) ? [index] : []));
+  const headers = lines.flatMap((line, index) => (NETWORK_HEADER_RE.test(line) ? [index] : []));
+  if (dotted.length > 1 || headers.length > 1 || (dotted.length && headers.length)) {
+    throw new Error(`${configPath} defines ${NETWORK_TABLE}.${NETWORK_KEY} more than once; resolve it before re-running.`);
+  }
+  if (dotted.length === 1) {
+    const index = dotted[0];
+    return { lines, kind: "dotted", index, line: lines[index] };
+  }
+  if (headers.length === 1) {
+    const header = headers[0];
+    const nextTableOffset = lines.slice(header + 1).findIndex((line) => /^\s*\[/u.test(line));
+    const end = nextTableOffset === -1 ? lines.length : header + 1 + nextTableOffset;
+    const keys = lines
+      .slice(header + 1, end)
+      .flatMap((line, index) => (NETWORK_KEY_RE.test(line) ? [header + 1 + index] : []));
+    if (keys.length > 1) {
+      throw new Error(`${configPath} defines ${NETWORK_KEY} more than once in [${NETWORK_TABLE}].`);
+    }
+    if (keys.length === 1) {
+      const index = keys[0];
+      return { lines, kind: "table", index, line: lines[index] };
+    }
+    return { lines, kind: "table-missing", header };
+  }
+  if (lines.slice(0, preambleEnd).some((line) => /^\s*sandbox_workspace_write\s*=/u.test(line))) {
+    throw new Error(`${configPath} defines ${NETWORK_TABLE} as an inline table; convert it to [${NETWORK_TABLE}] before re-running.`);
+  }
+  return { lines, kind: "absent" };
+}
+
+function applyCodexNetworkAccess(text, configPath = CODEX_CONFIG_PATH) {
+  const state = locateCodexNetworkAccess(text, configPath);
+  if (state.kind === "absent") {
+    return { text, prior: { kind: "absent" }, includeInBlock: true };
+  }
+  if (state.kind === "table-missing") {
+    state.lines.splice(state.header + 1, 0, `${NETWORK_KEY} = true`);
+    return {
+      text: state.lines.join("\n"),
+      prior: { kind: "table-missing" },
+      includeInBlock: false,
+    };
+  }
+  const indent = state.line.match(state.kind === "dotted" ? NETWORK_DOTTED_RE : NETWORK_KEY_RE)?.[1] || "";
+  state.lines[state.index] = state.kind === "dotted"
+    ? `${indent}${NETWORK_TABLE}.${NETWORK_KEY} = true`
+    : `${indent}${NETWORK_KEY} = true`;
+  return {
+    text: state.lines.join("\n"),
+    prior: { kind: state.kind, line: state.line },
+    includeInBlock: false,
+  };
+}
+
+function restoreCodexNetworkAccess(text, snapshot, configPath = CODEX_CONFIG_PATH) {
+  if (!snapshot || snapshot.kind === "absent") return { text, changed: false };
+  const state = locateCodexNetworkAccess(text, configPath);
+  if (!["dotted", "table"].includes(state.kind) || !/=\s*true\s*(?:#.*)?$/u.test(state.line)) {
+    return { text, changed: false };
+  }
+  if (snapshot.kind === "table-missing" && state.kind === "table") {
+    state.lines.splice(state.index, 1);
+    return { text: state.lines.join("\n"), changed: true };
+  }
+  if (snapshot.kind !== state.kind || typeof snapshot.line !== "string") {
+    return { text, changed: false };
+  }
+  state.lines[state.index] = snapshot.line;
+  return { text: state.lines.join("\n"), changed: true };
+}
+
 function readConfig() {
   const exists = fs.existsSync(CODEX_CONFIG_PATH);
   const text = exists ? fs.readFileSync(CODEX_CONFIG_PATH, "utf8") : "";
@@ -155,7 +283,10 @@ export function applyCodexGateway(gatewayUrl) {
     );
   }
 
-  const { preamble, rest } = splitPreamble(withoutOurBlock);
+  const sandboxMode = applyCodexSandboxMode(withoutOurBlock);
+  const networkAccess = applyCodexNetworkAccess(sandboxMode.text);
+
+  const { preamble, rest } = splitPreamble(networkAccess.text);
   const priorProviderValue = preamble.match(PROVIDER_LINE_RE)?.[1] ?? null;
   const newProviderLine = `model_provider = "${PROVIDER_ID}"`;
 
@@ -167,7 +298,10 @@ export function applyCodexGateway(gatewayUrl) {
     newPreamble = trimmed ? `${trimmed}\n${newProviderLine}\n` : `${newProviderLine}\n`;
   }
 
-  const block = providerTablesBlock(gatewayUrl);
+  const block = providerTablesBlock(gatewayUrl, {
+    includeNetworkAccess: networkAccess.includeInBlock,
+    includeSandboxMode: sandboxMode.includeInBlock,
+  });
   const restTrimmed = rest.trim();
   const newText = `${newPreamble.trimEnd()}\n\n${block}\n` + (restTrimmed ? `\n${restTrimmed}\n` : "");
 
@@ -177,6 +311,8 @@ export function applyCodexGateway(gatewayUrl) {
     path: CODEX_CONFIG_PATH,
     baseUrl: impelCodexBaseUrl(gatewayUrl),
     priorProviderValue,
+    priorNetworkAccess: networkAccess.prior,
+    priorSandboxMode: sandboxMode.prior,
   };
 }
 
@@ -196,6 +332,11 @@ export function revertCodexGateway(backup = {}) {
   const removedBlock = original.includes(START_MARK);
   let text = stripManagedBlock(original);
 
+  const networkAccess = restoreCodexNetworkAccess(text, backup.network_access);
+  text = networkAccess.text;
+  const sandboxMode = restoreCodexSandboxMode(text, backup.sandbox_mode);
+  text = sandboxMode.text;
+
   let resetProvider = false;
   let restoredProvider = null;
   if (currentProviderValue(text) === PROVIDER_ID) {
@@ -220,5 +361,7 @@ export function revertCodexGateway(backup = {}) {
     removedBlock,
     resetProvider,
     restoredProvider,
+    restoredNetworkAccess: networkAccess.changed,
+    restoredSandboxMode: sandboxMode.changed,
   };
 }

package/src/commands/apps.js

@@ -986,13 +986,14 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
   }
 }
 
-function manifestIsFresh(paths, config, now = Date.now()) {
+export function manifestIsFresh(paths, config, now = Date.now()) {
   try {
     const manifest = JSON.parse(
       fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8")
     );
     const updatedAt = Date.parse(manifest?.updatedAt || "");
     return Number.isFinite(updatedAt)
+      && manifest?.configVersion === CURRENT_CONFIG_VERSION
       && manifest?.experiments?.crossAppModels === crossAppModelsEnabled(config)
       && now - updatedAt < REFRESH_TTL_MS;
   } catch {

package/src/commands/use.js

@@ -78,6 +78,11 @@ async function useGateway({ target, app }) {
     }
     if (!Object.hasOwn(backup, "sandbox")) {
       backup.sandbox = result.priorSandbox;
+    } else if (
+      !Object.hasOwn(backup.sandbox, "permissions")
+      && Object.hasOwn(result.priorSandbox, "permissions")
+    ) {
+      backup.sandbox.permissions = result.priorSandbox.permissions;
     }
     console.log(`Claude Code -> GATEWAY  (${result.path})`);
     console.log(`  apiKeyHelper = "${result.apiKeyHelper}"`);
@@ -99,12 +104,19 @@ async function useGateway({ target, app }) {
     if (result.priorProviderValue !== PROVIDER_ID) {
       backup.model_provider = result.priorProviderValue ?? null;
     }
+    if (!Object.hasOwn(backup, "network_access")) {
+      backup.network_access = result.priorNetworkAccess;
+    }
+    if (!Object.hasOwn(backup, "sandbox_mode")) {
+      backup.sandbox_mode = result.priorSandboxMode;
+    }
 
     console.log(`Codex ${app ? "app/IDE" : "CLI"} -> GATEWAY  (${result.path})`);
     console.log(`  model_provider = "${PROVIDER_ID}"`);
     console.log(`  [model_providers.${PROVIDER_ID}] base_url = "${result.baseUrl}"`);
     console.log(`  [model_providers.${PROVIDER_ID}.auth] = direct Impel CLI invocation`);
     console.log(`  [mcp_servers.${PROVIDER_ID}] = direct Impel CLI invocation`);
+    console.log(`  sandbox workspace-write network = unrestricted`);
   }
 
   saveConfig(config);
@@ -194,6 +206,8 @@ function useAccount({ target, app }) {
             : `  removed model_provider line (Codex falls back to its default)`
         );
       }
+      if (result.restoredNetworkAccess) console.log(`  restored prior Codex sandbox network setting`);
+      if (result.restoredSandboxMode) console.log(`  restored prior Codex sandbox mode`);
     }
     if (config?.backups) delete config.backups.codex;
   }

package/src/gateway/index.js

@@ -6,6 +6,7 @@ import readline from "node:readline";
 
 import { nativeCommandInvocation } from "../nativeProcess.js";
 import { applyImpelClaudeSandbox } from "../claudeSandbox.js";
+import { enableManagedCodexNetworkAccess } from "../codexSecurity.js";
 
 const SAFE_ID = /^[a-z][a-z0-9-]{2,31}$/u;
 const SAFE_NAMESPACE = /^[a-z][a-z0-9_-]{1,31}$/u;
@@ -355,7 +356,7 @@ export function createGatewayCli(options) {
     const withoutProvider = outside.replace(/^\s*model_provider\s*=.*$/mu, "").trim();
     const next = [`model_provider = ${JSON.stringify(brand.cli.providerId)}`, codexManagedBlock(gatewayUrl), withoutProvider]
       .filter(Boolean).join("\n\n").concat("\n");
-    writePrivateFile(filePath, next);
+    writePrivateFile(filePath, enableManagedCodexNetworkAccess(next, filePath));
     return { codexHome, filePath };
   }