impel-cli 0.16.5 → 0.17.0

package/src/provisioning.js

@@ -0,0 +1,354 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { syncAgentProfilesSafe } from "./agents.js";
+import { crossAppModelsEnabled, redactSecretText } from "./config.js";
+import { ensureImpelClaudeProfile, ensureImpelCodexProfile, tenantCliProfilePaths } from "./cliProfiles.js";
+import { findNativeBinary } from "./nativeProcess.js";
+import { mapWithConcurrency } from "./progress.js";
+import { registerTenantShellEntries } from "./shellEntries.js";
+import { resolveSkillsGateway, syncSkillsSafe } from "./skills.js";
+import {
+  normalizeTenantId,
+  PAT_SCOPE_CLAUDE,
+  PAT_SCOPE_CODEX,
+  tenantCredential,
+} from "./tenants.js";
+import { reconcileTenantApps } from "./commands/apps.js";
+
+export function selectDefaultTenant(listing, { requested = null, currentTenantId = null } = {}) {
+  const normalized = requested ? normalizeTenantId(requested) : null;
+  if (normalized) {
+    const explicit = listing.tenants.find((tenant) => tenant.id === normalized || tenant.slug === normalized);
+    if (!explicit) throw new Error(`tenant "${normalized}" is not available to this user`);
+    return explicit;
+  }
+  return listing.tenants.find((tenant) => tenant.id === currentTenantId)
+    || listing.tenants.find((tenant) => tenant.id === listing.defaultTenantId)
+    || listing.tenants[0];
+}
+
+export async function mapSettledWithConcurrency(items, limit, fn) {
+  return mapWithConcurrency(items, limit, async (item, index) => {
+    try {
+      return { status: "fulfilled", value: await fn(item, index) };
+    } catch (error) {
+      return { status: "rejected", reason: error };
+    }
+  });
+}
+
+export function buildTenantInventory(listing, {
+  requestedTenantId = null,
+  currentTenantId = null,
+  localTenantIds = [],
+} = {}) {
+  const live = [...listing.tenants].sort((left, right) => left.id.localeCompare(right.id));
+  const liveIds = new Set(live.map((tenant) => tenant.id));
+  const local = [...new Set(localTenantIds.map((tenantId) => normalizeTenantId(tenantId)))].sort();
+  const selected = selectDefaultTenant(listing, {
+    requested: requestedTenantId,
+    currentTenantId,
+  });
+  return {
+    live,
+    selectedTenantId: selected.id,
+    missing: live.filter((tenant) => !local.includes(tenant.id)),
+    existing: live.filter((tenant) => local.includes(tenant.id)),
+    retainedInaccessible: local.filter((tenantId) => !liveIds.has(tenantId)),
+  };
+}
+
+export function locallyKnownTenantIds({ homeDir = os.homedir(), readDirectory = fs.readdirSync } = {}) {
+  const roots = [
+    path.join(homeDir, ".config", "impel", "cli", "tenants"),
+    path.join(homeDir, ".config", "impel", "apps", "tenants"),
+  ];
+  const ids = new Set();
+  for (const root of roots) {
+    try {
+      for (const entry of readDirectory(root, { withFileTypes: true })) {
+        if (!entry.isDirectory()) continue;
+        try { ids.add(normalizeTenantId(entry.name)); } catch { /* ignore invalid local debris */ }
+      }
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+    }
+  }
+  return [...ids].sort((left, right) => left.localeCompare(right));
+}
+
+function providerSupported(scopes, scope) {
+  return scopes == null || scopes.includes(scope);
+}
+
+async function prepareTenantCli(config, tenant, io, binaries) {
+  const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
+  const definitions = {
+    claude: {
+      supported: providerSupported(config.scopes, PAT_SCOPE_CLAUDE),
+      ensure: () => io.ensureClaude(config.gatewayUrl, tenant.id, {
+        crossAppModels: crossAppModelsEnabled(config),
+      }),
+      root: (profile) => profile.configDir,
+      env: (profile) => ({ CLAUDE_CONFIG_DIR: profile.configDir }),
+    },
+    codex: {
+      supported: providerSupported(config.scopes, PAT_SCOPE_CODEX),
+      ensure: () => io.ensureCodex(config.gatewayUrl, tenant.id),
+      root: (profile) => profile.codexHome,
+      env: (profile) => ({ CODEX_HOME: profile.codexHome }),
+    },
+  };
+  const clients = {};
+  for (const [client, definition] of Object.entries(definitions)) {
+    if (!definition.supported) {
+      clients[client] = { status: "unsupported", root: null, error: null };
+      continue;
+    }
+    try {
+      const profile = definition.ensure();
+      const root = definition.root(profile);
+      await io.syncSkills({
+        client,
+        gatewayUrl,
+        env: definition.env(profile),
+        label: `Impel ${client === "claude" ? "Claude" : "Codex"} CLI (${tenant.id})`,
+      });
+      clients[client] = binaries[client]
+        ? { status: "ready", root, error: null }
+        : {
+            status: "failed",
+            root,
+            error: `${client === "claude" ? "Claude Code" : "Codex"} CLI is not installed or discoverable`,
+          };
+    } catch (error) {
+      clients[client] = {
+        status: "failed",
+        root: null,
+        error: redactSecretText(error?.message || error),
+      };
+    }
+  }
+
+  const agentProfiles = Object.entries(clients)
+    .filter(([, client]) => client.root)
+    .map(([client, value]) => ({
+      client,
+      root: value.root,
+      label: `Impel ${client === "claude" ? "Claude" : "Codex"} CLI (${tenant.id})`,
+    }));
+  if (agentProfiles.length) {
+    try {
+      await io.syncAgents({
+        profiles: agentProfiles,
+        gatewayUrl: config.gatewayUrl,
+        credential: tenantCredential(config.pat, tenant.id),
+        tenantId: tenant.id,
+      });
+    } catch (error) {
+      const message = redactSecretText(error?.message || error);
+      for (const client of Object.values(clients)) {
+        if (client.root) {
+          client.status = "failed";
+          client.error = message;
+        }
+      }
+    }
+  }
+  return clients;
+}
+
+export async function reconcileAllTenants({
+  config,
+  listing,
+  mode = "update",
+  includeApps = true,
+  platform = process.platform,
+  homeDir = os.homedir(),
+  environment = process.env,
+  concurrency = 4,
+  confirmVendorInstall = async () => false,
+} = {}, overrides = {}) {
+  const io = {
+    ensureClaude: ensureImpelClaudeProfile,
+    ensureCodex: ensureImpelCodexProfile,
+    syncSkills: syncSkillsSafe,
+    syncAgents: syncAgentProfilesSafe,
+    findBinary: findNativeBinary,
+    reconcileApps: reconcileTenantApps,
+    registerShellEntries: registerTenantShellEntries,
+    knownTenantIds: locallyKnownTenantIds,
+    ...overrides,
+  };
+  // Dependency-injection compatibility for older embedders/tests. Production
+  // uses the explicit reconciler above and never calls the public app parser.
+  if (overrides.installApps && !overrides.reconcileApps) {
+    io.reconcileApps = async ({ tenant, mode: appMode, skipVendor }) => {
+      const args = [appMode === "setup" ? "install" : "update", "all", "--tenant", tenant.id];
+      if (skipVendor) args.push("--skip-vendor");
+      const completed = await overrides.installApps(args);
+      if (completed === false) throw new Error("desktop app provisioning did not complete");
+      return { targets: ["claude", "chatgpt"], unsupported: [] };
+    };
+  }
+  const inventory = buildTenantInventory(listing, {
+    currentTenantId: config.tenantId,
+    localTenantIds: io.knownTenantIds({ homeDir }),
+  });
+  const liveTenants = inventory.live;
+  const inaccessible = inventory.retainedInaccessible;
+  const binaries = {
+    claude: io.findBinary("claude", environment, platform),
+    codex: io.findBinary("codex", environment, platform),
+  };
+  const results = new Map(liveTenants.map((tenant) => [tenant.id, {
+    tenantId: tenant.id,
+    tenantName: tenant.name,
+    cli: "pending",
+    apps: includeApps && ["darwin", "win32"].includes(platform) ? "pending" : "unavailable",
+    shell: includeApps && ["darwin", "win32"].includes(platform) ? "pending" : "unavailable",
+    clients: {
+      claude: { cli: "pending", app: includeApps && ["darwin", "win32"].includes(platform) ? "pending" : "unsupported", shell: includeApps && ["darwin", "win32"].includes(platform) ? "pending" : "unsupported" },
+      codex: { cli: "pending", app: includeApps && ["darwin", "win32"].includes(platform) ? "pending" : "unsupported", shell: includeApps && ["darwin", "win32"].includes(platform) ? "pending" : "unsupported" },
+    },
+    errors: [],
+  }]));
+
+  const cliOutcomes = await mapSettledWithConcurrency(liveTenants, concurrency, (tenant) => (
+    prepareTenantCli(config, tenant, io, binaries)
+  ));
+  cliOutcomes.forEach((outcome, index) => {
+    const result = results.get(liveTenants[index].id);
+    if (outcome.status === "fulfilled") {
+      for (const client of ["claude", "codex"]) {
+        const clientResult = outcome.value[client];
+        result.clients[client].cli = clientResult.status;
+        if (clientResult.error) result.errors.push(clientResult.error);
+      }
+      const states = [result.clients.claude.cli, result.clients.codex.cli];
+      result.cli = states.includes("failed")
+        ? "failed"
+        : states.includes("ready") ? "ready" : "unavailable";
+    }
+    else {
+      result.cli = "failed";
+      result.clients.claude.cli = "failed";
+      result.clients.codex.cli = "failed";
+      result.errors.push(redactSecretText(outcome.reason?.message || outcome.reason));
+    }
+  });
+
+  if (includeApps && ["darwin", "win32"].includes(platform)) {
+    const vendorPreparedTargets = new Set();
+    for (const tenant of liveTenants) {
+      const result = results.get(tenant.id);
+      let supported = new Set();
+      try {
+        const installed = await io.reconcileApps({
+          baseConfig: config,
+          tenant,
+          mode,
+          targets: ["claude", "chatgpt"],
+          skipVendorTargets: [...vendorPreparedTargets],
+          platform,
+          homeDir,
+          environment,
+          confirmVendorInstall,
+        }, overrides.appOverrides || {});
+        supported = new Set(installed.targets || []);
+        for (const target of supported) vendorPreparedTargets.add(target);
+        result.clients.claude.app = supported.has("claude") ? "ready" : "unsupported";
+        result.clients.codex.app = supported.has("chatgpt") ? "ready" : "unsupported";
+        result.apps = supported.size ? "ready" : "unavailable";
+      } catch (error) {
+        result.apps = "failed";
+        for (const client of Object.values(result.clients)) {
+          if (client.app === "pending") client.app = "failed";
+          if (client.shell === "pending") client.shell = "failed";
+        }
+        result.shell = "failed";
+        result.errors.push(redactSecretText(error?.message || error));
+        continue;
+      }
+
+      if (supported.size === 0) {
+        result.shell = "unavailable";
+        result.clients.claude.shell = "unsupported";
+        result.clients.codex.shell = "unsupported";
+        continue;
+      }
+      try {
+        const entries = io.registerShellEntries({
+          tenantId: tenant.id,
+          tenantName: tenant.name,
+          targets: [...supported],
+          platform,
+          homeDir,
+          environment,
+        });
+        const entryProducts = new Set(entries.map((entry) => entry.product));
+        result.clients.claude.shell = supported.has("claude")
+          ? (entryProducts.has("claude") ? "ready" : "failed")
+          : "unsupported";
+        result.clients.codex.shell = supported.has("chatgpt")
+          ? (entryProducts.has("chatgpt") ? "ready" : "failed")
+          : "unsupported";
+        result.shell = [...supported].every((target) => entryProducts.has(target)) ? "ready" : "failed";
+        if (result.shell === "failed") throw new Error("operating-system app registration did not complete");
+      } catch (error) {
+        result.shell = "failed";
+        for (const client of Object.values(result.clients)) {
+          if (client.shell === "pending") client.shell = "failed";
+        }
+        result.errors.push(redactSecretText(error?.message || error));
+      }
+    }
+  }
+
+  const values = liveTenants.map((tenant) => {
+    const result = results.get(tenant.id);
+    const states = Object.values(result.clients).flatMap((client) => [client.cli, client.app, client.shell]);
+    result.status = states.includes("failed") ? "failed" : states.includes("pending") ? "partial" : "ready";
+    return result;
+  });
+  return {
+    selectedTenantId: config.tenantId,
+    tenants: values,
+    inaccessible,
+    passed: values.every((result) => (
+      (result.cli === "ready" || result.cli === "unavailable")
+      && (result.apps === "ready" || result.apps === "unavailable")
+      && (result.shell === "ready" || result.shell === "unavailable")
+    )),
+  };
+}
+
+export function printReconciliationSummary(report, log = console.log) {
+  log("Tenant readiness:");
+  for (const tenant of report.tenants) {
+    const detail = tenant.errors.length ? ` — ${tenant.errors.join("; ")}` : "";
+    log(
+      `  ${tenant.tenantId}: Claude CLI ${tenant.clients.claude.cli}, Codex CLI ${tenant.clients.codex.cli}, `
+      + `Claude app ${tenant.clients.claude.app}, ChatGPT app ${tenant.clients.codex.app}, system launch ${tenant.shell}${detail}`,
+    );
+  }
+  if (report.inaccessible.length) {
+    log(`  Retained local data for inaccessible tenants: ${report.inaccessible.join(", ")}`);
+  }
+}
+
+export function tenantCliPathsReady(tenantId, existsSync = fs.existsSync) {
+  const paths = tenantCliProfilePaths(tenantId);
+  return existsSync(path.join(paths.claudeConfigDir, "settings.json"))
+    && existsSync(path.join(paths.codexHome, "config.toml"));
+}
+
+export function tenantCliClientReadiness(tenantId, existsSync = fs.existsSync) {
+  const paths = tenantCliProfilePaths(tenantId);
+  return {
+    claude: existsSync(path.join(paths.claudeConfigDir, "settings.json")),
+    codex: existsSync(path.join(paths.codexHome, "config.toml")),
+  };
+}

package/src/shellEntries.js

@@ -0,0 +1,186 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+import { appPaths, CLAUDE_CONFIG_ID } from "./apps.js";
+import { redactSecretText } from "./config.js";
+import { environmentValue, nativeCommandInvocation, resolveNativeBinary } from "./nativeProcess.js";
+import { IMPEL_CLI_ENTRYPOINT } from "./selfInvocation.js";
+import { normalizeTenantId } from "./tenants.js";
+import { windowsClaudeUserData } from "./windowsApps.js";
+
+const LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
+
+function safeShortcutSegment(value, fallback) {
+  const cleaned = String(value || "")
+    .replace(/[<>:"/\\|?*\u0000-\u001F]/gu, " ")
+    .replace(/[. ]+$/gu, "")
+    .replace(/\s+/gu, " ")
+    .trim()
+    .slice(0, 80);
+  const reserved = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/iu;
+  return cleaned && !reserved.test(cleaned) ? cleaned : fallback;
+}
+
+function powershellLiteral(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+// Serialize one argv token using the CommandLineToArgvW rules used by native
+// Windows executables. The resulting string is stored in a .lnk Arguments
+// field; no tenant-controlled value is evaluated as PowerShell source.
+export function windowsShortcutArgument(value) {
+  const text = String(value);
+  if (/[\u0000\r\n]/u.test(text)) throw new Error("cannot put a NUL or line break in a Windows shortcut argument");
+  if (text && !/[\s"]/u.test(text)) return text;
+  return `"${text
+    .replace(/(\\*)"/gu, "$1$1\\\"")
+    .replace(/(\\*)$/u, "$1$1")}"`;
+}
+
+export function windowsTenantShortcutName(product, tenantId, tenantName) {
+  const id = normalizeTenantId(tenantId);
+  const name = safeShortcutSegment(tenantName, id);
+  const label = product === "claude" ? "Impel Claude" : "Impel ChatGPT";
+  return `${label} (${name} · ${id}).lnk`;
+}
+
+export function registerWindowsTenantShortcut({
+  product,
+  tenantId,
+  tenantName,
+  environment = process.env,
+  run = spawnSync,
+  execPath = process.execPath,
+  cliEntrypoint = IMPEL_CLI_ENTRYPOINT,
+  iconPath = null,
+  mkdirSync = fs.mkdirSync,
+}) {
+  const appData = environmentValue(environment, "APPDATA");
+  if (!appData) throw new Error("Windows APPDATA is unavailable; Start menu entry was not created");
+  const shortcutDirectory = path.win32.join(appData, "Microsoft", "Windows", "Start Menu", "Programs", "Impel");
+  mkdirSync(shortcutDirectory, { recursive: true });
+  const shortcutPath = path.win32.join(
+    shortcutDirectory,
+    windowsTenantShortcutName(product, tenantId, tenantName),
+  );
+  const command = [
+    "&",
+    powershellLiteral(execPath),
+    powershellLiteral(cliEntrypoint),
+    powershellLiteral("_app-launch"),
+    powershellLiteral(product),
+    powershellLiteral("--tenant"),
+    powershellLiteral(normalizeTenantId(tenantId)),
+  ].join(" ");
+  const launcherTarget = resolveNativeBinary("powershell", environment, "win32");
+  const launcherArgs = [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-ExecutionPolicy",
+    "Bypass",
+    "-Command",
+    command,
+  ];
+  const createScript = [
+    "$w=New-Object -ComObject WScript.Shell",
+    "$s=$w.CreateShortcut($env:IMPEL_SHORTCUT_PATH)",
+    "$s.TargetPath=$env:IMPEL_SHORTCUT_TARGET",
+    "$s.Arguments=$env:IMPEL_SHORTCUT_ARGS",
+    "$s.WorkingDirectory=$env:IMPEL_SHORTCUT_WORKDIR",
+    "if($env:IMPEL_SHORTCUT_ICON){$s.IconLocation=$env:IMPEL_SHORTCUT_ICON}",
+    "$s.WindowStyle=7",
+    "$s.Save()",
+  ].join("; ");
+  const powershell = nativeCommandInvocation("powershell", [
+    "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", createScript,
+  ], environment, "win32");
+  const result = run(powershell.command, powershell.args, {
+    encoding: "utf8",
+    env: {
+      ...environment,
+      IMPEL_SHORTCUT_PATH: shortcutPath,
+      IMPEL_SHORTCUT_TARGET: launcherTarget,
+      IMPEL_SHORTCUT_ARGS: launcherArgs.map(windowsShortcutArgument).join(" "),
+      IMPEL_SHORTCUT_WORKDIR: path.win32.dirname(execPath),
+      IMPEL_SHORTCUT_ICON: iconPath || "",
+    },
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
+    windowsVerbatimArguments: powershell.windowsVerbatimArguments,
+  });
+  if (result?.error || result?.status !== 0) {
+    throw new Error(`could not create ${path.win32.basename(shortcutPath)} (${redactSecretText(result?.error?.message || result?.stderr || `exit ${result?.status}`)})`);
+  }
+  return shortcutPath;
+}
+
+function writeShellEntryManifest(manifestPath, entries, {
+  mkdirSync = fs.mkdirSync,
+  writeFileSync = fs.writeFileSync,
+  renameSync = fs.renameSync,
+  rmSync = fs.rmSync,
+} = {}) {
+  mkdirSync(path.dirname(manifestPath), { recursive: true, mode: 0o700 });
+  const temporary = `${manifestPath}.tmp-${process.pid}`;
+  try {
+    writeFileSync(temporary, `${JSON.stringify({
+      schemaVersion: 1,
+      entries: entries.map(({ product, path: entryPath }) => ({ product, path: entryPath })),
+      updatedAt: new Date().toISOString(),
+    }, null, 2)}\n`, { mode: 0o600 });
+    renameSync(temporary, manifestPath);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
+
+export function registerTenantShellEntries({
+  tenantId,
+  tenantName,
+  targets = ["claude", "chatgpt"],
+  platform = process.platform,
+  homeDir = os.homedir(),
+  environment = process.env,
+  existsSync = fs.existsSync,
+  run = spawnSync,
+  writeManifest = writeShellEntryManifest,
+  shortcut = registerWindowsTenantShortcut,
+} = {}) {
+  const id = normalizeTenantId(tenantId);
+  const paths = appPaths(homeDir, id, {
+    tenantName,
+    claudeUserData: platform === "win32" ? windowsClaudeUserData(environment, id) : null,
+  });
+  const registered = [];
+  if (platform === "darwin") {
+    for (const product of targets) {
+      const launcher = paths[product].launcher;
+      if (!existsSync(launcher)) throw new Error(`managed launcher is missing: ${launcher}`);
+      const result = run(LSREGISTER, ["-f", launcher], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+      if (result?.error || result?.status !== 0) {
+        throw new Error(`LaunchServices registration failed for ${launcher} (${redactSecretText(result?.error?.message || result?.stderr || `exit ${result?.status}`)})`);
+      }
+      registered.push({ product, path: launcher, status: "ready" });
+    }
+  } else if (platform === "win32") {
+    const available = {
+      claude: existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)),
+      chatgpt: existsSync(path.join(paths.chatgpt.codexHome, "config.toml")),
+    };
+    for (const product of targets) {
+      if (!available[product]) throw new Error(`managed ${product} profile is missing for tenant ${id}`);
+      registered.push({
+        product,
+        path: shortcut({ product, tenantId: id, tenantName, environment, run }),
+        status: "ready",
+      });
+    }
+  }
+  if (registered.length) {
+    writeManifest(path.join(paths.tenantRoot, "shell-entries.json"), registered);
+  }
+  return registered;
+}

package/src/skills.js

@@ -409,7 +409,7 @@ export async function syncSkills({
       const first = failures[0];
       logger.warn(
         `impel: skill sync for ${displayLabel} finished with warnings (${first.phase}: ${first.reason}). ` +
-          `Skills may be stale; re-run \`impel skills sync\`.`
+          `Skills may be stale; re-run \`impel update\`.`
       );
       return { client, label: displayLabel, synced: false, marketplaceName, failures };
     }

package/src/tenants.js

@@ -58,7 +58,7 @@ export function assertProviderScopes(scopes, providers, { requireLive = false }
   if (!missing.length) return;
   const labels = missing.map((scope) => `"${scope}"`).join(" and ");
   throw new Error(
-    `this PAT is missing the ${labels} scope${missing.length === 1 ? "" : "s"}; create a fresh PAT in Impel Gateway setup, then run \`impel auth --pat <pat>\``,
+    `this PAT is missing the ${labels} scope${missing.length === 1 ? "" : "s"}; create a fresh PAT in Impel Gateway setup, then run \`impel setup\` and provide it`,
   );
 }