impel-cli 0.17.12 → 0.17.14

package/README.md

@@ -40,9 +40,12 @@ surfaces for each tenant. You do not need to repeat setup tenant by tenant.
 3. Preserves the current CLI tenant when it is still accessible, or selects the
    control-plane default.
 4. Creates isolated Claude and Codex CLI profiles for every supported tenant.
-5. Installs or repairs supported tenant desktop apps on macOS and Windows.
-6. Registers tenant apps with Finder/Spotlight or Windows Start/Search.
-7. Verifies every supported tenant surface and prints a tenant-sorted summary.
+5. On Windows machines without git, installs a pinned, checksum-verified
+   MinGit into `~/.config/impel/tools/git` (no admin rights, no system PATH
+   change) so Claude and Codex can install the Impel skills marketplace.
+6. Installs or repairs supported tenant desktop apps on macOS and Windows.
+7. Registers tenant apps with Finder/Spotlight or Windows Start/Search.
+8. Verifies every supported tenant surface and prints a tenant-sorted summary.
 
 Use `--tenant` only to choose the default for CLI launches. It does not limit
 which tenants setup prepares:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.12",
+  "version": "0.17.14",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/commands/apps.js

@@ -43,7 +43,7 @@ import { syncAgentProfilesSafe } from "../agents.js";
 import { secureManagedCodexHome } from "../codexSecurity.js";
 import { impelCliInvocation } from "../selfInvocation.js";
 import { createProgressLogger, withProgress } from "../progress.js";
-import { findNativeBinary } from "../nativeProcess.js";
+import { environmentValue, findNativeBinary } from "../nativeProcess.js";
 import {
   ensureWindowsClaudeApp,
   ensureWindowsChatGPTApp,
@@ -56,6 +56,7 @@ import {
   stageWindowsChatGPTApp,
   windowsChatGPTStageIsCurrent,
   windowsClaudeUserData,
+  windowsManagedChatGPTRoot,
 } from "../windowsApps.js";
 
 const CLAUDE_KEYCHAIN_NOTICE = "Claude Keychain: enter your Mac login password and choose Always Allow on the first prompt for this tenant; Allow is temporary.";
@@ -112,11 +113,26 @@ function appTargetLabel(displayName) {
 // Each isolated desktop app maps to a client CLI + the env override that points
 // that CLI at the app's private profile, so skill syncing lands in the app's
 // installation rather than a global one.
-function appSkillTarget(target, paths) {
+function appSkillTarget(target, paths, {
+  platform = process.platform,
+  existsSync = fs.existsSync,
+  environment = process.env,
+} = {}) {
   if (target === "claude") {
     return { client: "claude", env: { CLAUDE_CONFIG_DIR: paths.claude.userData }, label: appTargetLabel(paths.claude.displayName) };
   }
-  return { client: "codex", env: { CODEX_HOME: paths.chatgpt.codexHome }, label: appTargetLabel(paths.chatgpt.displayName) };
+  const env = { CODEX_HOME: paths.chatgpt.codexHome };
+  // The staged Windows app ships the exact codex.exe the app itself runs, so
+  // plugin sync uses it instead of requiring a separately installed Codex CLI
+  // (a box without one would otherwise get no app skills at all) and the
+  // plugin state is always written by the same codex version that reads it.
+  // An operator's explicit IMPEL_CODEX_BIN stays authoritative — it is an
+  // override everywhere else the CLI resolves codex.
+  if (platform === "win32" && !environmentValue(environment, "IMPEL_CODEX_BIN")) {
+    const embedded = path.join(windowsManagedChatGPTRoot(paths.root), "resources", "codex.exe");
+    if (existsSync(embedded)) env.IMPEL_CODEX_BIN = embedded;
+  }
+  return { client: "codex", env, label: appTargetLabel(paths.chatgpt.displayName) };
 }
 
 function appAgentProfile(target, paths) {
@@ -335,6 +351,7 @@ export async function reconcileWindowsTenantApps({
     installFiles: installManagedAppFiles,
     syncSkills: syncSkillsSafe,
     syncAgents: syncAgentProfilesSafe,
+    secureCodexHome: secureManagedCodexHome,
     existsSync: fs.existsSync,
     findBinary: findNativeBinary,
     log: (message) => console.log(message),
@@ -389,12 +406,20 @@ export async function reconcileWindowsTenantApps({
   });
   const agentTargets = [];
   for (const target of actionTargets) {
-    const { client, env, label } = appSkillTarget(target, paths);
-    if (io.findBinary(client, environment, "win32")) {
+    const { client, env, label } = appSkillTarget(target, paths, {
+      platform: "win32",
+      existsSync: io.existsSync,
+      environment,
+    });
+    // Merge the sync env so an app-embedded binary (IMPEL_CODEX_BIN) satisfies
+    // the availability check even when no standalone CLI is installed.
+    if (io.findBinary(client, { ...environment, ...env }, "win32")) {
       await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label });
       agentTargets.push(target);
+    } else {
+      io.log(`Skipping skill/agent sync for ${label} — no ${client === "claude" ? "Claude Code" : "Codex"} binary is available to run plugin commands.`);
     }
-    if (target === "chatgpt") secureManagedCodexHome(paths.chatgpt.codexHome);
+    if (target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
   }
   if (agentTargets.length) {
     await io.syncAgents({
@@ -719,7 +744,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       for (const target of configuredTargets) {
         const profile = target === "claude" ? tenantPaths.claude.userData : tenantPaths.chatgpt.root;
         console.log(`${verb} Impel ${target === "claude" ? "Claude" : "ChatGPT"} profile at ${profile}`);
-        const { client, env, label } = appSkillTarget(target, tenantPaths);
+        const { client, env, label } = appSkillTarget(target, tenantPaths, { platform: "win32" });
         if (!flags["skip-skills"]) {
           await withProgress(`Syncing skills for ${label}`, (spinner) => (
             io.syncSkills({

package/src/commands/launch.js

@@ -14,6 +14,7 @@ import {
   resolveDefaultGateway,
 } from "../config.js";
 import { impelClaudeBaseUrl, impelCrossAppClaudeBaseUrl } from "../claudeSetup.js";
+import { withGitEnvironment } from "../skills.js";
 import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
 import { maybePrintUpdateNotice } from "../updates.js";
 import {
@@ -170,6 +171,10 @@ export async function cmdLaunch(tool, argv) {
     staleOnly: true,
   });
 
-  const exitCode = await runNativeCli(tool, impelLaunchArguments(tool, argv), environment);
+  // Both vendor CLIs shell out to `git` for plugin/marketplace operations; on
+  // a fresh Windows machine the installed git (typically the Impel-managed
+  // MinGit) sits off the inherited PATH, so repair it for the child session.
+  const { env: launchEnvironment } = withGitEnvironment(environment, { baseEnvironment: environment });
+  const exitCode = await runNativeCli(tool, impelLaunchArguments(tool, argv), launchEnvironment);
   if (exitCode !== 0) process.exitCode = exitCode;
 }

package/src/commands/skills.js

@@ -13,9 +13,10 @@ import { loadConfig } from "../config.js";
 import { CODEX_HOME } from "../codexSetup.js";
 import { tenantCliProfilePaths } from "../cliProfiles.js";
 import { CLAUDE_CONFIG_ID, appPaths } from "../apps.js";
+import { environmentValue } from "../nativeProcess.js";
 import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
 import { ensureTenantSelection } from "../tenants.js";
-import { windowsClaudeUserData } from "../windowsApps.js";
+import { windowsClaudeUserData, windowsManagedChatGPTRoot } from "../windowsApps.js";
 import { createProgressLogger, mapWithConcurrency, withProgress } from "../progress.js";
 
 const VALID_TARGETS = ["claude", "codex", "all"];
@@ -74,7 +75,16 @@ export function managedSkillProfiles(
       ? existsSync(path.join(paths.chatgpt.codexHome, "config.toml"))
       : existsSync(paths.chatgpt.launcher);
     if (includeApps && appInstalled) {
-      profiles.push({ label: "Impel ChatGPT app", env: { CODEX_HOME: paths.chatgpt.codexHome } });
+      const env = { CODEX_HOME: paths.chatgpt.codexHome };
+      // Mirror appSkillTarget (commands/apps.js): the staged Windows app
+      // bundles the codex.exe that reads this profile, so `impel skills sync`
+      // works on boxes without a standalone Codex CLI too. An operator's
+      // explicit IMPEL_CODEX_BIN stays authoritative.
+      if (platform === "win32" && !environmentValue(environment, "IMPEL_CODEX_BIN")) {
+        const embedded = path.join(windowsManagedChatGPTRoot(paths.root), "resources", "codex.exe");
+        if (existsSync(embedded)) env.IMPEL_CODEX_BIN = embedded;
+      }
+      profiles.push({ label: "Impel ChatGPT app", env });
     }
   }
 

package/src/nativeProcess.js

@@ -118,6 +118,17 @@ function commonCandidates(tool, environment, platform) {
     if (tool === "powershell" && systemRoot) {
       locations.push([paths.join(systemRoot, "System32", "WindowsPowerShell", "v1.0"), "powershell"]);
     }
+
+    // Git for Windows standard install roots; `cmd` holds the PATH-safe
+    // git.exe. Codex shells out to git for marketplace clones, so skill
+    // syncing must find git even when the parent shell's PATH predates the
+    // Git installation. The Impel-managed MinGit (provisioned by setup/update
+    // on machines with no system Git) comes last so a user's own install wins.
+    if (tool === "git") {
+      if (programFiles) locations.push([paths.join(programFiles, "Git", "cmd"), "git"]);
+      if (localAppData) locations.push([paths.join(localAppData, "Programs", "Git", "cmd"), "git"]);
+      locations.push([paths.join(home, ".config", "impel", "tools", "git", "cmd"), "git"]);
+    }
   }
 
   return locations.flatMap(([directory, name]) => binaryCandidates(directory, name, environment, platform));

package/src/skills.js

@@ -20,9 +20,10 @@
 // so we keep a per-client command table rather than assuming one shape.
 
 import { spawn } from "node:child_process";
+import path from "node:path";
 
 import { resolveDefaultGateway, normalizeGatewayUrl } from "./config.js";
-import { nativeCommandInvocation } from "./nativeProcess.js";
+import { findNativeBinary, nativeCommandInvocation } from "./nativeProcess.js";
 
 /** The bundled plugin the Bifrost registry publishes; contains every served skill. */
 export const SKILL_PLUGIN_NAME = "bifrost-all-skills";
@@ -183,18 +184,58 @@ export function buildSkillCommands({ client, marketplaceSourceUrl: sourceUrl, ma
   return commands;
 }
 
+/**
+ * Both vendor CLIs shell out to `git` while syncing skills — Codex clones the
+ * marketplace repository at registration and Claude clones the plugin source
+ * at install — so a Windows machine without git breaks skill syncing for both.
+ * Resolve git up front: when an installed git (a user's Git for Windows or the
+ * Impel-managed MinGit) exists but the inherited PATH cannot see it, prepend
+ * its directory for the child commands; when git is genuinely absent, report
+ * that so the caller can skip with an actionable message instead of surfacing
+ * the vendors' raw "Command 'git' not found" / "failed to run git clone"
+ * errors.
+ */
+export function withGitEnvironment(env = {}, {
+  platform = process.platform,
+  baseEnvironment = process.env,
+  find = findNativeBinary,
+} = {}) {
+  if (platform !== "win32") return { env, gitAvailable: true };
+  const merged = { ...baseEnvironment, ...env };
+  const git = find("git", merged, platform);
+  if (!git) return { env, gitAvailable: false };
+  const gitDirectory = path.win32.dirname(git);
+  const normalize = (entry) => entry.trim().replace(/[\\/]+$/u, "").toLowerCase();
+  const pathKey = Object.keys(merged).find((key) => key.toLowerCase() === "path") || "Path";
+  const currentPath = String(merged[pathKey] || "");
+  if (currentPath.split(";").some((entry) => normalize(entry) === normalize(gitDirectory))) {
+    return { env, gitAvailable: true };
+  }
+  return {
+    env: { ...env, [pathKey]: currentPath ? `${gitDirectory};${currentPath}` : gitDirectory },
+    gitAvailable: true,
+  };
+}
+
 const SKILL_COMMAND_TIMEOUT_MS = 120_000;
 const SKILL_COMMAND_OUTPUT_LIMIT = 10 * 1024 * 1024;
 
+// cmd.exe reports a nonexistent command with exit code 9009 (and this stderr
+// line on English installs); the spawn itself succeeds, so without this check
+// a missing CLI is misreported as "has no plugin command".
+const WINDOWS_COMMAND_NOT_FOUND_STATUS = 9009;
+const WINDOWS_COMMAND_NOT_FOUND_RE = /is not recognized as an internal or external command/iu;
+
 /** Default async command runner: keeps progress timers responsive while plugins sync. */
 export function runSkillCommand(bin, args, env, {
   spawnImpl = spawn,
   timeoutMs = SKILL_COMMAND_TIMEOUT_MS,
+  platform = process.platform,
 } = {}) {
   const environment = { ...process.env, ...env };
   let invocation;
   try {
-    invocation = nativeCommandInvocation(bin, args, environment);
+    invocation = nativeCommandInvocation(bin, args, environment, platform);
   } catch (error) {
     return Promise.resolve({
       ok: false,
@@ -269,7 +310,14 @@ export function runSkillCommand(bin, args, env, {
     }));
     child.on("close", (status) => finish({
       ok: !timedOut && status === 0,
-      missing: false,
+      // Only a FAILED cmd.exe-wrapped launch can mean "the CLI itself was not
+      // found"; a successful run owns its own stderr, and a directly spawned
+      // binary owns its exit codes, where the same phrasing could describe
+      // some inner command instead.
+      missing: status !== 0
+        && invocation.windowsVerbatimArguments
+        && (status === WINDOWS_COMMAND_NOT_FOUND_STATUS
+          || WINDOWS_COMMAND_NOT_FOUND_RE.test(stderr)),
       status,
       stdout,
       stderr: timedOut ? `skill command timed out after ${timeoutMs}ms` : stderr,
@@ -357,6 +405,8 @@ export async function syncSkills({
   fetchImpl = fetch,
   run = runSkillCommand,
   logger = console,
+  platform = process.platform,
+  findGit = findNativeBinary,
 } = {}) {
   const spec = CLIENT_SPECS[client];
   if (!spec) {
@@ -382,6 +432,17 @@ export async function syncSkills({
       return { client, label: displayLabel, skipped: true, reason: "no-plugin-subcommand" };
     }
 
+    const gitReady = withGitEnvironment(env, { platform, find: findGit });
+    if (!gitReady.gitAvailable) {
+      logger.warn(
+        `impel: skipping skill sync for ${displayLabel} — ${spec.label} installs skills with \`git\`, `
+          + "which is not installed. Run `impel setup` to install it automatically, or install "
+          + "Git for Windows (https://git-scm.com/download/win), then re-run `impel update`."
+      );
+      return { client, label: displayLabel, skipped: true, reason: "git-missing" };
+    }
+    env = gitReady.env;
+
     const manifestUrl = marketplaceUrl(gatewayUrl, client);
     const sourceUrl = marketplaceSourceUrl(gatewayUrl, client);
     let marketplaceName = await fetchMarketplaceName(manifestUrl, fetchImpl);

package/src/windowsGit.js

@@ -0,0 +1,187 @@
+// Provisions a pinned, checksum-verified MinGit into the Impel-managed tools
+// directory (~/.config/impel/tools/git) so brand-new Windows machines get a
+// working `git` without an admin install or a system-wide PATH change. MinGit
+// is git-for-windows' official minimal distribution for automation; the vendor
+// Claude Code and Codex CLIs only need clone/fetch over HTTPS to install the
+// Bifrost skills marketplace. Discovery lives in nativeProcess.js: the managed
+// `cmd` directory is a standard common candidate for the `git` tool, behind
+// PATH and behind a user's own Git for Windows install.
+
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { nativeCommandInvocation, nativeSpawnInvocation } from "./nativeProcess.js";
+
+/**
+ * The exact MinGit release the CLI may install. Never use `latest` or an
+ * unverified archive: every architecture URL and SHA-256 changes together in a
+ * reviewed release, mirroring the vendor-app pin rules in AGENTS.md.
+ */
+export const PINNED_MINGIT = Object.freeze({
+  version: "2.55.0.3",
+  architectures: Object.freeze({
+    x64: Object.freeze({
+      url: "https://github.com/git-for-windows/git/releases/download/v2.55.0.windows.3/MinGit-2.55.0.3-64-bit.zip",
+      sha256: "f48e2d2dc74a24454adc6d8fd0ac25bf9c2386f19cfb06202b9465aaad4f9f05",
+    }),
+    arm64: Object.freeze({
+      url: "https://github.com/git-for-windows/git/releases/download/v2.55.0.windows.3/MinGit-2.55.0.3-arm64.zip",
+      sha256: "f7748965d5068e81ad93ca1923650db6742d6e22332b1ae7567a841c59f6bde5",
+    }),
+  }),
+});
+
+const MINGIT_DOWNLOAD_TIMEOUT_MS = 600_000;
+const MINGIT_EXTRACT_TIMEOUT_MS = 300_000;
+const MINGIT_VERIFY_TIMEOUT_MS = 30_000;
+
+// Same non-interactive PowerShell posture as the vendor CLI installers in
+// windowsSetup.js (kept local: windowsSetup imports this module).
+const POWERSHELL_ARGS = [
+  "-NoLogo",
+  "-NoProfile",
+  "-NonInteractive",
+  "-ExecutionPolicy",
+  "Bypass",
+  "-Command",
+];
+
+/** Root of the Impel-managed MinGit install. */
+export function managedGitRoot(homeDir = os.homedir()) {
+  return path.join(homeDir, ".config", "impel", "tools", "git");
+}
+
+/** The PATH-safe git.exe inside a MinGit root (MinGit unpacks `cmd/` at top level). */
+export function managedGitBinary(root) {
+  return path.join(root, "cmd", "git.exe");
+}
+
+function powershellQuote(value) {
+  return String(value).replace(/'/gu, "''");
+}
+
+function firstLine(text) {
+  return String(text || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
+}
+
+async function downloadArchive(url, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, { signal: controller.signal, redirect: "follow" });
+    if (!response?.ok) throw new Error(`MinGit download failed (HTTP ${response?.status ?? "error"})`);
+    return Buffer.from(await response.arrayBuffer());
+  } catch (error) {
+    if (error?.name === "AbortError") throw new Error(`MinGit download timed out after ${timeoutMs}ms`);
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function extractArchive(archivePath, destination, environment, run) {
+  const script = "$ProgressPreference = 'SilentlyContinue'; "
+    + `Expand-Archive -LiteralPath '${powershellQuote(archivePath)}' `
+    + `-DestinationPath '${powershellQuote(destination)}' -Force`;
+  const invocation = nativeCommandInvocation(
+    "powershell",
+    [...POWERSHELL_ARGS, script],
+    environment,
+    "win32",
+  );
+  const result = run(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: MINGIT_EXTRACT_TIMEOUT_MS,
+    windowsHide: true,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  });
+  if (result?.error) throw new Error(`MinGit extraction failed (${result.error.message || result.error})`);
+  if (result?.status !== 0) {
+    const detail = firstLine(result?.stderr) || `exit ${result?.status}`;
+    throw new Error(`MinGit extraction failed (${detail})`);
+  }
+}
+
+function verifyGitBinary(binary, environment, run) {
+  const invocation = nativeSpawnInvocation(binary, ["--version"], environment, "win32");
+  const result = run(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: MINGIT_VERIFY_TIMEOUT_MS,
+    windowsHide: true,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  });
+  if (result?.error) throw new Error(`extracted git failed to run (${result.error.message || result.error})`);
+  if (result?.status !== 0 || !/git version/u.test(String(result?.stdout || ""))) {
+    throw new Error(`extracted git failed verification (${firstLine(result?.stderr) || `exit ${result?.status}`})`);
+  }
+}
+
+/**
+ * Ensure the Impel-managed MinGit exists. Never throws: setup and update call
+ * this on every Windows run, and a failed download must degrade to the same
+ * "git is missing" skill-sync skip the machine already had — not break
+ * convergence. Returns `{ installed, binary, ... }`.
+ */
+export async function provisionWindowsGit({
+  homeDir = os.homedir(),
+  architecture = process.arch,
+  platform = process.platform,
+  environment = process.env,
+  fetchImpl = fetch,
+  run = spawnSync,
+  logger = console,
+  pin = PINNED_MINGIT,
+  downloadTimeoutMs = MINGIT_DOWNLOAD_TIMEOUT_MS,
+} = {}) {
+  if (platform !== "win32") return { installed: false, binary: null, reason: "unsupported-platform" };
+
+  const target = managedGitRoot(homeDir);
+  const existing = managedGitBinary(target);
+  if (fs.existsSync(existing)) return { installed: false, binary: existing, reason: "already-present" };
+
+  // 32-bit Node on a 64-bit OS still wants the 64-bit git: they are separate
+  // processes, and git-for-windows no longer targets 32-bit-only Windows.
+  const release = pin.architectures[architecture] || pin.architectures.x64;
+  const staging = `${target}.staging`;
+  const archive = `${target}.download.zip`;
+  logger.log(`Git: no usable git found; installing MinGit ${pin.version} into the Impel tools directory…`);
+  try {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.rmSync(archive, { force: true });
+
+    const payload = await downloadArchive(release.url, fetchImpl, downloadTimeoutMs);
+    const digest = createHash("sha256").update(payload).digest("hex");
+    if (digest !== release.sha256) {
+      throw new Error(`MinGit checksum mismatch (expected ${release.sha256}, got ${digest})`);
+    }
+    fs.writeFileSync(archive, payload);
+    extractArchive(archive, staging, environment, run);
+    verifyGitBinary(managedGitBinary(staging), environment, run);
+
+    // Replace atomically-enough: verified staging swaps in via a same-volume
+    // rename, so discovery never sees a half-extracted tree.
+    fs.rmSync(target, { recursive: true, force: true });
+    fs.renameSync(staging, target);
+    const binary = managedGitBinary(target);
+    logger.log(`Git: MinGit ${pin.version} ready (${binary}).`);
+    return { installed: true, binary, version: pin.version };
+  } catch (error) {
+    const reason = error?.message || String(error);
+    logger.warn(
+      `impel: could not install the managed Git (${reason}). Skill syncing needs git — `
+        + "install Git for Windows (https://git-scm.com/download/win), then re-run `impel update`.",
+    );
+    return { installed: false, binary: null, failure: reason };
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.rmSync(archive, { force: true });
+  }
+}

package/src/windowsSetup.js

@@ -7,6 +7,7 @@ import {
   nativeSpawnInvocation,
 } from "./nativeProcess.js";
 import { syncSkillsSafe } from "./skills.js";
+import { provisionWindowsGit } from "./windowsGit.js";
 
 const POWERSHELL_ARGS = [
   "-NoLogo",
@@ -126,6 +127,8 @@ export async function prepareWindowsClis({
     ensureClaudeProfile: ensureImpelClaudeProfile,
     ensureCodexProfile: ensureImpelCodexProfile,
     syncSkills: syncSkillsSafe,
+    provisionGit: provisionWindowsGit,
+    logger: console,
     ...dependencies,
   };
 
@@ -142,6 +145,19 @@ export async function prepareWindowsClis({
     throw new Error("installTools must contain unique supported Windows CLI names");
   }
 
+  // Both vendor CLIs need `git` to install the skills marketplace, and the
+  // target machines are brand new — provision the Impel-managed MinGit before
+  // any skill sync, on every setup/update pass (idempotent once installed).
+  // A failure degrades to the skill-sync "git is missing" skip, never a throw.
+  let gitBinary = io.find("git", io.environment, "win32");
+  let gitProvision = null;
+  if (!gitBinary) {
+    gitProvision = await io.provisionGit({ environment: io.environment, logger: io.logger });
+    gitBinary = gitProvision?.installed
+      ? gitProvision.binary
+      : io.find("git", io.environment, "win32");
+  }
+
   if (missingBefore.length > 0 && !skipInstall) {
     // Install independently: one broken vendor endpoint or local conflict must
     // not prevent the other client from reaching a usable state.
@@ -205,5 +221,6 @@ export async function prepareWindowsClis({
     installations,
     installCommands: windowsCliInstallCommands(missingBefore),
     profiles: { claude: claudeProfile.configDir, codex: codexProfile.codexHome },
+    git: { binary: gitBinary || null, provision: gitProvision },
   };
 }