impel-cli 0.17.13 → 0.17.14

package/README.md

@@ -40,9 +40,12 @@ surfaces for each tenant. You do not need to repeat setup tenant by tenant.
 3. Preserves the current CLI tenant when it is still accessible, or selects the
    control-plane default.
 4. Creates isolated Claude and Codex CLI profiles for every supported tenant.
-5. Installs or repairs supported tenant desktop apps on macOS and Windows.
-6. Registers tenant apps with Finder/Spotlight or Windows Start/Search.
-7. Verifies every supported tenant surface and prints a tenant-sorted summary.
+5. On Windows machines without git, installs a pinned, checksum-verified
+   MinGit into `~/.config/impel/tools/git` (no admin rights, no system PATH
+   change) so Claude and Codex can install the Impel skills marketplace.
+6. Installs or repairs supported tenant desktop apps on macOS and Windows.
+7. Registers tenant apps with Finder/Spotlight or Windows Start/Search.
+8. Verifies every supported tenant surface and prints a tenant-sorted summary.
 
 Use `--tenant` only to choose the default for CLI launches. It does not limit
 which tenants setup prepares:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.13",
+  "version": "0.17.14",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/commands/launch.js

@@ -14,6 +14,7 @@ import {
   resolveDefaultGateway,
 } from "../config.js";
 import { impelClaudeBaseUrl, impelCrossAppClaudeBaseUrl } from "../claudeSetup.js";
+import { withGitEnvironment } from "../skills.js";
 import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
 import { maybePrintUpdateNotice } from "../updates.js";
 import {
@@ -170,6 +171,10 @@ export async function cmdLaunch(tool, argv) {
     staleOnly: true,
   });
 
-  const exitCode = await runNativeCli(tool, impelLaunchArguments(tool, argv), environment);
+  // Both vendor CLIs shell out to `git` for plugin/marketplace operations; on
+  // a fresh Windows machine the installed git (typically the Impel-managed
+  // MinGit) sits off the inherited PATH, so repair it for the child session.
+  const { env: launchEnvironment } = withGitEnvironment(environment, { baseEnvironment: environment });
+  const exitCode = await runNativeCli(tool, impelLaunchArguments(tool, argv), launchEnvironment);
   if (exitCode !== 0) process.exitCode = exitCode;
 }

package/src/nativeProcess.js

@@ -122,10 +122,12 @@ function commonCandidates(tool, environment, platform) {
     // Git for Windows standard install roots; `cmd` holds the PATH-safe
     // git.exe. Codex shells out to git for marketplace clones, so skill
     // syncing must find git even when the parent shell's PATH predates the
-    // Git installation.
+    // Git installation. The Impel-managed MinGit (provisioned by setup/update
+    // on machines with no system Git) comes last so a user's own install wins.
     if (tool === "git") {
       if (programFiles) locations.push([paths.join(programFiles, "Git", "cmd"), "git"]);
       if (localAppData) locations.push([paths.join(localAppData, "Programs", "Git", "cmd"), "git"]);
+      locations.push([paths.join(home, ".config", "impel", "tools", "git", "cmd"), "git"]);
     }
   }
 

package/src/skills.js

@@ -185,15 +185,17 @@ export function buildSkillCommands({ client, marketplaceSourceUrl: sourceUrl, ma
 }
 
 /**
- * Codex registers marketplaces by shelling out to `git clone` (Claude fetches
- * its manifest over plain HTTP), so a Windows machine without git breaks
- * exactly the Codex half of skill syncing. Resolve git up front: when a
- * standard Git for Windows install exists but the inherited PATH cannot see
- * it, prepend its directory for the child commands; when git is genuinely
- * absent, report that so the caller can skip with an actionable message
- * instead of surfacing codex's raw "failed to run git clone" error.
+ * Both vendor CLIs shell out to `git` while syncing skills — Codex clones the
+ * marketplace repository at registration and Claude clones the plugin source
+ * at install — so a Windows machine without git breaks skill syncing for both.
+ * Resolve git up front: when an installed git (a user's Git for Windows or the
+ * Impel-managed MinGit) exists but the inherited PATH cannot see it, prepend
+ * its directory for the child commands; when git is genuinely absent, report
+ * that so the caller can skip with an actionable message instead of surfacing
+ * the vendors' raw "Command 'git' not found" / "failed to run git clone"
+ * errors.
  */
-export function withCodexGitEnvironment(env = {}, {
+export function withGitEnvironment(env = {}, {
   platform = process.platform,
   baseEnvironment = process.env,
   find = findNativeBinary,
@@ -430,18 +432,16 @@ export async function syncSkills({
       return { client, label: displayLabel, skipped: true, reason: "no-plugin-subcommand" };
     }
 
-    if (client === "codex") {
-      const gitReady = withCodexGitEnvironment(env, { platform, find: findGit });
-      if (!gitReady.gitAvailable) {
-        logger.warn(
-          `impel: skipping skill sync for ${displayLabel} — Codex fetches its skills marketplace with \`git\`, `
-            + "which is not installed. Install Git for Windows (https://git-scm.com/download/win), "
-            + "then re-run `impel update`."
-        );
-        return { client, label: displayLabel, skipped: true, reason: "git-missing" };
-      }
-      env = gitReady.env;
+    const gitReady = withGitEnvironment(env, { platform, find: findGit });
+    if (!gitReady.gitAvailable) {
+      logger.warn(
+        `impel: skipping skill sync for ${displayLabel} — ${spec.label} installs skills with \`git\`, `
+          + "which is not installed. Run `impel setup` to install it automatically, or install "
+          + "Git for Windows (https://git-scm.com/download/win), then re-run `impel update`."
+      );
+      return { client, label: displayLabel, skipped: true, reason: "git-missing" };
     }
+    env = gitReady.env;
 
     const manifestUrl = marketplaceUrl(gatewayUrl, client);
     const sourceUrl = marketplaceSourceUrl(gatewayUrl, client);

package/src/windowsGit.js

@@ -0,0 +1,187 @@
+// Provisions a pinned, checksum-verified MinGit into the Impel-managed tools
+// directory (~/.config/impel/tools/git) so brand-new Windows machines get a
+// working `git` without an admin install or a system-wide PATH change. MinGit
+// is git-for-windows' official minimal distribution for automation; the vendor
+// Claude Code and Codex CLIs only need clone/fetch over HTTPS to install the
+// Bifrost skills marketplace. Discovery lives in nativeProcess.js: the managed
+// `cmd` directory is a standard common candidate for the `git` tool, behind
+// PATH and behind a user's own Git for Windows install.
+
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { nativeCommandInvocation, nativeSpawnInvocation } from "./nativeProcess.js";
+
+/**
+ * The exact MinGit release the CLI may install. Never use `latest` or an
+ * unverified archive: every architecture URL and SHA-256 changes together in a
+ * reviewed release, mirroring the vendor-app pin rules in AGENTS.md.
+ */
+export const PINNED_MINGIT = Object.freeze({
+  version: "2.55.0.3",
+  architectures: Object.freeze({
+    x64: Object.freeze({
+      url: "https://github.com/git-for-windows/git/releases/download/v2.55.0.windows.3/MinGit-2.55.0.3-64-bit.zip",
+      sha256: "f48e2d2dc74a24454adc6d8fd0ac25bf9c2386f19cfb06202b9465aaad4f9f05",
+    }),
+    arm64: Object.freeze({
+      url: "https://github.com/git-for-windows/git/releases/download/v2.55.0.windows.3/MinGit-2.55.0.3-arm64.zip",
+      sha256: "f7748965d5068e81ad93ca1923650db6742d6e22332b1ae7567a841c59f6bde5",
+    }),
+  }),
+});
+
+const MINGIT_DOWNLOAD_TIMEOUT_MS = 600_000;
+const MINGIT_EXTRACT_TIMEOUT_MS = 300_000;
+const MINGIT_VERIFY_TIMEOUT_MS = 30_000;
+
+// Same non-interactive PowerShell posture as the vendor CLI installers in
+// windowsSetup.js (kept local: windowsSetup imports this module).
+const POWERSHELL_ARGS = [
+  "-NoLogo",
+  "-NoProfile",
+  "-NonInteractive",
+  "-ExecutionPolicy",
+  "Bypass",
+  "-Command",
+];
+
+/** Root of the Impel-managed MinGit install. */
+export function managedGitRoot(homeDir = os.homedir()) {
+  return path.join(homeDir, ".config", "impel", "tools", "git");
+}
+
+/** The PATH-safe git.exe inside a MinGit root (MinGit unpacks `cmd/` at top level). */
+export function managedGitBinary(root) {
+  return path.join(root, "cmd", "git.exe");
+}
+
+function powershellQuote(value) {
+  return String(value).replace(/'/gu, "''");
+}
+
+function firstLine(text) {
+  return String(text || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
+}
+
+async function downloadArchive(url, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, { signal: controller.signal, redirect: "follow" });
+    if (!response?.ok) throw new Error(`MinGit download failed (HTTP ${response?.status ?? "error"})`);
+    return Buffer.from(await response.arrayBuffer());
+  } catch (error) {
+    if (error?.name === "AbortError") throw new Error(`MinGit download timed out after ${timeoutMs}ms`);
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function extractArchive(archivePath, destination, environment, run) {
+  const script = "$ProgressPreference = 'SilentlyContinue'; "
+    + `Expand-Archive -LiteralPath '${powershellQuote(archivePath)}' `
+    + `-DestinationPath '${powershellQuote(destination)}' -Force`;
+  const invocation = nativeCommandInvocation(
+    "powershell",
+    [...POWERSHELL_ARGS, script],
+    environment,
+    "win32",
+  );
+  const result = run(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: MINGIT_EXTRACT_TIMEOUT_MS,
+    windowsHide: true,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  });
+  if (result?.error) throw new Error(`MinGit extraction failed (${result.error.message || result.error})`);
+  if (result?.status !== 0) {
+    const detail = firstLine(result?.stderr) || `exit ${result?.status}`;
+    throw new Error(`MinGit extraction failed (${detail})`);
+  }
+}
+
+function verifyGitBinary(binary, environment, run) {
+  const invocation = nativeSpawnInvocation(binary, ["--version"], environment, "win32");
+  const result = run(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: MINGIT_VERIFY_TIMEOUT_MS,
+    windowsHide: true,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  });
+  if (result?.error) throw new Error(`extracted git failed to run (${result.error.message || result.error})`);
+  if (result?.status !== 0 || !/git version/u.test(String(result?.stdout || ""))) {
+    throw new Error(`extracted git failed verification (${firstLine(result?.stderr) || `exit ${result?.status}`})`);
+  }
+}
+
+/**
+ * Ensure the Impel-managed MinGit exists. Never throws: setup and update call
+ * this on every Windows run, and a failed download must degrade to the same
+ * "git is missing" skill-sync skip the machine already had — not break
+ * convergence. Returns `{ installed, binary, ... }`.
+ */
+export async function provisionWindowsGit({
+  homeDir = os.homedir(),
+  architecture = process.arch,
+  platform = process.platform,
+  environment = process.env,
+  fetchImpl = fetch,
+  run = spawnSync,
+  logger = console,
+  pin = PINNED_MINGIT,
+  downloadTimeoutMs = MINGIT_DOWNLOAD_TIMEOUT_MS,
+} = {}) {
+  if (platform !== "win32") return { installed: false, binary: null, reason: "unsupported-platform" };
+
+  const target = managedGitRoot(homeDir);
+  const existing = managedGitBinary(target);
+  if (fs.existsSync(existing)) return { installed: false, binary: existing, reason: "already-present" };
+
+  // 32-bit Node on a 64-bit OS still wants the 64-bit git: they are separate
+  // processes, and git-for-windows no longer targets 32-bit-only Windows.
+  const release = pin.architectures[architecture] || pin.architectures.x64;
+  const staging = `${target}.staging`;
+  const archive = `${target}.download.zip`;
+  logger.log(`Git: no usable git found; installing MinGit ${pin.version} into the Impel tools directory…`);
+  try {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.rmSync(archive, { force: true });
+
+    const payload = await downloadArchive(release.url, fetchImpl, downloadTimeoutMs);
+    const digest = createHash("sha256").update(payload).digest("hex");
+    if (digest !== release.sha256) {
+      throw new Error(`MinGit checksum mismatch (expected ${release.sha256}, got ${digest})`);
+    }
+    fs.writeFileSync(archive, payload);
+    extractArchive(archive, staging, environment, run);
+    verifyGitBinary(managedGitBinary(staging), environment, run);
+
+    // Replace atomically-enough: verified staging swaps in via a same-volume
+    // rename, so discovery never sees a half-extracted tree.
+    fs.rmSync(target, { recursive: true, force: true });
+    fs.renameSync(staging, target);
+    const binary = managedGitBinary(target);
+    logger.log(`Git: MinGit ${pin.version} ready (${binary}).`);
+    return { installed: true, binary, version: pin.version };
+  } catch (error) {
+    const reason = error?.message || String(error);
+    logger.warn(
+      `impel: could not install the managed Git (${reason}). Skill syncing needs git — `
+        + "install Git for Windows (https://git-scm.com/download/win), then re-run `impel update`.",
+    );
+    return { installed: false, binary: null, failure: reason };
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.rmSync(archive, { force: true });
+  }
+}

package/src/windowsSetup.js

@@ -7,6 +7,7 @@ import {
   nativeSpawnInvocation,
 } from "./nativeProcess.js";
 import { syncSkillsSafe } from "./skills.js";
+import { provisionWindowsGit } from "./windowsGit.js";
 
 const POWERSHELL_ARGS = [
   "-NoLogo",
@@ -126,6 +127,8 @@ export async function prepareWindowsClis({
     ensureClaudeProfile: ensureImpelClaudeProfile,
     ensureCodexProfile: ensureImpelCodexProfile,
     syncSkills: syncSkillsSafe,
+    provisionGit: provisionWindowsGit,
+    logger: console,
     ...dependencies,
   };
 
@@ -142,6 +145,19 @@ export async function prepareWindowsClis({
     throw new Error("installTools must contain unique supported Windows CLI names");
   }
 
+  // Both vendor CLIs need `git` to install the skills marketplace, and the
+  // target machines are brand new — provision the Impel-managed MinGit before
+  // any skill sync, on every setup/update pass (idempotent once installed).
+  // A failure degrades to the skill-sync "git is missing" skip, never a throw.
+  let gitBinary = io.find("git", io.environment, "win32");
+  let gitProvision = null;
+  if (!gitBinary) {
+    gitProvision = await io.provisionGit({ environment: io.environment, logger: io.logger });
+    gitBinary = gitProvision?.installed
+      ? gitProvision.binary
+      : io.find("git", io.environment, "win32");
+  }
+
   if (missingBefore.length > 0 && !skipInstall) {
     // Install independently: one broken vendor endpoint or local conflict must
     // not prevent the other client from reaching a usable state.
@@ -205,5 +221,6 @@ export async function prepareWindowsClis({
     installations,
     installCommands: windowsCliInstallCommands(missingBefore),
     profiles: { claude: claudeProfile.configDir, codex: codexProfile.codexHome },
+    git: { binary: gitBinary || null, provision: gitProvision },
   };
 }