impel-cli 0.17.13 → 0.17.15

package/README.md

@@ -40,9 +40,12 @@ surfaces for each tenant. You do not need to repeat setup tenant by tenant.
 3. Preserves the current CLI tenant when it is still accessible, or selects the
    control-plane default.
 4. Creates isolated Claude and Codex CLI profiles for every supported tenant.
-5. Installs or repairs supported tenant desktop apps on macOS and Windows.
-6. Registers tenant apps with Finder/Spotlight or Windows Start/Search.
-7. Verifies every supported tenant surface and prints a tenant-sorted summary.
+5. On Windows machines without git, installs a pinned, checksum-verified
+   MinGit into `~/.config/impel/tools/git` (no admin rights, no system PATH
+   change) so Claude and Codex can install the Impel skills marketplace.
+6. Installs or repairs supported tenant desktop apps on macOS and Windows.
+7. Registers tenant apps with Finder/Spotlight or Windows Start/Search.
+8. Verifies every supported tenant surface and prints a tenant-sorted summary.
 
 Use `--tenant` only to choose the default for CLI launches. It does not limit
 which tenants setup prepares:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.13",
+  "version": "0.17.15",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -1355,6 +1355,29 @@ function mergeManagedChatGPTToml(current, managed) {
   return `${managed}\n${remainder ? `\n${remainder.replace(/\s*$/u, "")}\n` : ""}`;
 }
 
+/**
+ * True when a managed ChatGPT profile exists but its config no longer routes
+ * inference through the Impel gateway. The Codex desktop app rewrites
+ * config.toml with its own settings writer (model picker, project trust,
+ * migrations) and can drop the managed top-level `model_provider` key; without
+ * it the built-in ChatGPT provider derives its inference endpoint from
+ * chatgpt.com and sends the Impel token there, which chatgpt.com rejects with
+ * 403 "Unknown personal access token". Stale-only refreshes treat this drift
+ * as staleness so the profile heals immediately instead of waiting out the
+ * manifest TTL.
+ */
+export function managedChatGPTConfigDrifted(paths) {
+  let current;
+  try {
+    current = fs.readFileSync(path.join(paths.chatgpt.codexHome, "config.toml"), "utf8");
+  } catch {
+    return false; // No managed profile; install/update owns creating one.
+  }
+  return !current.includes(CHATGPT_CONFIG_START)
+    || readTopLevelTomlString(current, "model_provider") !== "impel"
+    || !readTopLevelTomlString(current, "chatgpt_base_url");
+}
+
 function readTopLevelTomlString(toml, key) {
   const topLevel = toml.split(/^\s*\[/mu, 1)[0];
   const match = topLevel.match(new RegExp(`^\\s*${escapeRegex(key)}\\s*=\\s*("(?:[^"\\\\]|\\\\.)*")\\s*$`, "mu"));

package/src/commands/apps.js

@@ -32,6 +32,7 @@ import {
   ensureVendorApp,
   fetchGatewayModels,
   installManagedAppFiles,
+  managedChatGPTConfigDrifted,
   managedLauncherName,
   normalizeAppTarget,
   quitBlockingApps,
@@ -662,7 +663,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
           claudeUserData: io.claudeUserData(io.environment, staleTenantId),
           tenantName: staleTenantId === stored.tenantId ? stored.tenantName : null,
         });
-        if (manifestIsFresh(stalePaths, stored)) return true;
+        if (manifestIsFresh(stalePaths, stored) && !managedChatGPTConfigDrifted(stalePaths)) return true;
       }
     }
     const config = await io.selectedConfig(targets, flags.tenant || null);
@@ -1241,7 +1242,7 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
       ? stored.tenantName || manifest?.tenantName
       : manifest?.tenantName,
   });
-  if (staleOnly && manifestIsFresh(paths, stored)) return;
+  if (staleOnly && manifestIsFresh(paths, stored) && !managedChatGPTConfigDrifted(paths)) return;
 
   let config;
   try {

package/src/commands/launch.js

@@ -14,6 +14,7 @@ import {
   resolveDefaultGateway,
 } from "../config.js";
 import { impelClaudeBaseUrl, impelCrossAppClaudeBaseUrl } from "../claudeSetup.js";
+import { withGitEnvironment } from "../skills.js";
 import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
 import { maybePrintUpdateNotice } from "../updates.js";
 import {
@@ -170,6 +171,10 @@ export async function cmdLaunch(tool, argv) {
     staleOnly: true,
   });
 
-  const exitCode = await runNativeCli(tool, impelLaunchArguments(tool, argv), environment);
+  // Both vendor CLIs shell out to `git` for plugin/marketplace operations; on
+  // a fresh Windows machine the installed git (typically the Impel-managed
+  // MinGit) sits off the inherited PATH, so repair it for the child session.
+  const { env: launchEnvironment } = withGitEnvironment(environment, { baseEnvironment: environment });
+  const exitCode = await runNativeCli(tool, impelLaunchArguments(tool, argv), launchEnvironment);
   if (exitCode !== 0) process.exitCode = exitCode;
 }

package/src/commands/sessions.js

@@ -1,6 +1,8 @@
 import { spawn } from "node:child_process";
+import path from "node:path";
 
 import { parseFlags } from "../args.js";
+import { appPaths, managedChatGPTConfigDrifted } from "../apps.js";
 import {
   clearSessionFlushLock,
   collectSessionHook,
@@ -13,6 +15,7 @@ import {
 } from "../sessionCollector.js";
 import { loadConfig, redactSecretText } from "../config.js";
 import { impelCliInvocation } from "../selfInvocation.js";
+import { spawnDetachedAppRefresh } from "../updates.js";
 
 const SPEC = {
   provider: { type: "string" },
@@ -22,6 +25,31 @@ const SPEC = {
   "impel-managed-session-hook-v1": { type: "boolean" },
 };
 
+/**
+ * Repair a managed ChatGPT profile the desktop app just rewrote out from under
+ * the gateway. Hooks are the only Impel code guaranteed to run while the app
+ * is broken (the app stops calling the provider token helper once the managed
+ * `model_provider` key is gone), so each codex hook event checks for drift and
+ * kicks one detached stale-only refresh — which the drift-aware staleness gate
+ * turns into a real repair. The heartbeat lock keeps repeated hook events from
+ * stacking refresh children while one is already running.
+ */
+export function maybeRepairManagedCodexApp(tenantId, {
+  drifted = managedChatGPTConfigDrifted,
+  lockIsFresh = sessionFlushLockIsFresh,
+  touchLock = touchSessionFlushLock,
+  spawnRefresh = spawnDetachedAppRefresh,
+} = {}) {
+  if (!tenantId) return false;
+  const paths = appPaths(undefined, tenantId);
+  if (!drifted(paths)) return false;
+  const lock = path.join(paths.tenantRoot, "app-repair-heartbeat");
+  if (lockIsFresh(lock, 60_000)) return false;
+  touchLock(lock);
+  spawnRefresh(tenantId);
+  return true;
+}
+
 function startDetachedFlush({ provider, tenant, session }) {
   const invocation = impelCliInvocation([
     "sessions",
@@ -65,6 +93,7 @@ export async function cmdSessions(argv) {
         config,
         flush: false,
       });
+      if (flags.provider === "codex") maybeRepairManagedCodexApp(flags.tenant);
       if (config && (config.tenantId === flags.tenant || process.env.IMPEL_SESSIONS_DEV_ORG_ID)) {
         // Hooks fire on every session event; only spawn a flush child when no
         // live one is already polling this session's outbox (heartbeat lock).

package/src/nativeProcess.js

@@ -122,10 +122,12 @@ function commonCandidates(tool, environment, platform) {
     // Git for Windows standard install roots; `cmd` holds the PATH-safe
     // git.exe. Codex shells out to git for marketplace clones, so skill
     // syncing must find git even when the parent shell's PATH predates the
-    // Git installation.
+    // Git installation. The Impel-managed MinGit (provisioned by setup/update
+    // on machines with no system Git) comes last so a user's own install wins.
     if (tool === "git") {
       if (programFiles) locations.push([paths.join(programFiles, "Git", "cmd"), "git"]);
       if (localAppData) locations.push([paths.join(localAppData, "Programs", "Git", "cmd"), "git"]);
+      locations.push([paths.join(home, ".config", "impel", "tools", "git", "cmd"), "git"]);
     }
   }
 

package/src/skills.js

@@ -185,15 +185,17 @@ export function buildSkillCommands({ client, marketplaceSourceUrl: sourceUrl, ma
 }
 
 /**
- * Codex registers marketplaces by shelling out to `git clone` (Claude fetches
- * its manifest over plain HTTP), so a Windows machine without git breaks
- * exactly the Codex half of skill syncing. Resolve git up front: when a
- * standard Git for Windows install exists but the inherited PATH cannot see
- * it, prepend its directory for the child commands; when git is genuinely
- * absent, report that so the caller can skip with an actionable message
- * instead of surfacing codex's raw "failed to run git clone" error.
+ * Both vendor CLIs shell out to `git` while syncing skills — Codex clones the
+ * marketplace repository at registration and Claude clones the plugin source
+ * at install — so a Windows machine without git breaks skill syncing for both.
+ * Resolve git up front: when an installed git (a user's Git for Windows or the
+ * Impel-managed MinGit) exists but the inherited PATH cannot see it, prepend
+ * its directory for the child commands; when git is genuinely absent, report
+ * that so the caller can skip with an actionable message instead of surfacing
+ * the vendors' raw "Command 'git' not found" / "failed to run git clone"
+ * errors.
  */
-export function withCodexGitEnvironment(env = {}, {
+export function withGitEnvironment(env = {}, {
   platform = process.platform,
   baseEnvironment = process.env,
   find = findNativeBinary,
@@ -430,18 +432,16 @@ export async function syncSkills({
       return { client, label: displayLabel, skipped: true, reason: "no-plugin-subcommand" };
     }
 
-    if (client === "codex") {
-      const gitReady = withCodexGitEnvironment(env, { platform, find: findGit });
-      if (!gitReady.gitAvailable) {
-        logger.warn(
-          `impel: skipping skill sync for ${displayLabel} — Codex fetches its skills marketplace with \`git\`, `
-            + "which is not installed. Install Git for Windows (https://git-scm.com/download/win), "
-            + "then re-run `impel update`."
-        );
-        return { client, label: displayLabel, skipped: true, reason: "git-missing" };
-      }
-      env = gitReady.env;
+    const gitReady = withGitEnvironment(env, { platform, find: findGit });
+    if (!gitReady.gitAvailable) {
+      logger.warn(
+        `impel: skipping skill sync for ${displayLabel} — ${spec.label} installs skills with \`git\`, `
+          + "which is not installed. Run `impel setup` to install it automatically, or install "
+          + "Git for Windows (https://git-scm.com/download/win), then re-run `impel update`."
+      );
+      return { client, label: displayLabel, skipped: true, reason: "git-missing" };
     }
+    env = gitReady.env;
 
     const manifestUrl = marketplaceUrl(gatewayUrl, client);
     const sourceUrl = marketplaceSourceUrl(gatewayUrl, client);

package/src/windowsGit.js

@@ -0,0 +1,187 @@
+// Provisions a pinned, checksum-verified MinGit into the Impel-managed tools
+// directory (~/.config/impel/tools/git) so brand-new Windows machines get a
+// working `git` without an admin install or a system-wide PATH change. MinGit
+// is git-for-windows' official minimal distribution for automation; the vendor
+// Claude Code and Codex CLIs only need clone/fetch over HTTPS to install the
+// Bifrost skills marketplace. Discovery lives in nativeProcess.js: the managed
+// `cmd` directory is a standard common candidate for the `git` tool, behind
+// PATH and behind a user's own Git for Windows install.
+
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { nativeCommandInvocation, nativeSpawnInvocation } from "./nativeProcess.js";
+
+/**
+ * The exact MinGit release the CLI may install. Never use `latest` or an
+ * unverified archive: every architecture URL and SHA-256 changes together in a
+ * reviewed release, mirroring the vendor-app pin rules in AGENTS.md.
+ */
+export const PINNED_MINGIT = Object.freeze({
+  version: "2.55.0.3",
+  architectures: Object.freeze({
+    x64: Object.freeze({
+      url: "https://github.com/git-for-windows/git/releases/download/v2.55.0.windows.3/MinGit-2.55.0.3-64-bit.zip",
+      sha256: "f48e2d2dc74a24454adc6d8fd0ac25bf9c2386f19cfb06202b9465aaad4f9f05",
+    }),
+    arm64: Object.freeze({
+      url: "https://github.com/git-for-windows/git/releases/download/v2.55.0.windows.3/MinGit-2.55.0.3-arm64.zip",
+      sha256: "f7748965d5068e81ad93ca1923650db6742d6e22332b1ae7567a841c59f6bde5",
+    }),
+  }),
+});
+
+const MINGIT_DOWNLOAD_TIMEOUT_MS = 600_000;
+const MINGIT_EXTRACT_TIMEOUT_MS = 300_000;
+const MINGIT_VERIFY_TIMEOUT_MS = 30_000;
+
+// Same non-interactive PowerShell posture as the vendor CLI installers in
+// windowsSetup.js (kept local: windowsSetup imports this module).
+const POWERSHELL_ARGS = [
+  "-NoLogo",
+  "-NoProfile",
+  "-NonInteractive",
+  "-ExecutionPolicy",
+  "Bypass",
+  "-Command",
+];
+
+/** Root of the Impel-managed MinGit install. */
+export function managedGitRoot(homeDir = os.homedir()) {
+  return path.join(homeDir, ".config", "impel", "tools", "git");
+}
+
+/** The PATH-safe git.exe inside a MinGit root (MinGit unpacks `cmd/` at top level). */
+export function managedGitBinary(root) {
+  return path.join(root, "cmd", "git.exe");
+}
+
+function powershellQuote(value) {
+  return String(value).replace(/'/gu, "''");
+}
+
+function firstLine(text) {
+  return String(text || "").split(/\r?\n/).map((line) => line.trim()).find(Boolean) || "";
+}
+
+async function downloadArchive(url, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, { signal: controller.signal, redirect: "follow" });
+    if (!response?.ok) throw new Error(`MinGit download failed (HTTP ${response?.status ?? "error"})`);
+    return Buffer.from(await response.arrayBuffer());
+  } catch (error) {
+    if (error?.name === "AbortError") throw new Error(`MinGit download timed out after ${timeoutMs}ms`);
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function extractArchive(archivePath, destination, environment, run) {
+  const script = "$ProgressPreference = 'SilentlyContinue'; "
+    + `Expand-Archive -LiteralPath '${powershellQuote(archivePath)}' `
+    + `-DestinationPath '${powershellQuote(destination)}' -Force`;
+  const invocation = nativeCommandInvocation(
+    "powershell",
+    [...POWERSHELL_ARGS, script],
+    environment,
+    "win32",
+  );
+  const result = run(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: MINGIT_EXTRACT_TIMEOUT_MS,
+    windowsHide: true,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  });
+  if (result?.error) throw new Error(`MinGit extraction failed (${result.error.message || result.error})`);
+  if (result?.status !== 0) {
+    const detail = firstLine(result?.stderr) || `exit ${result?.status}`;
+    throw new Error(`MinGit extraction failed (${detail})`);
+  }
+}
+
+function verifyGitBinary(binary, environment, run) {
+  const invocation = nativeSpawnInvocation(binary, ["--version"], environment, "win32");
+  const result = run(invocation.command, invocation.args, {
+    encoding: "utf8",
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: MINGIT_VERIFY_TIMEOUT_MS,
+    windowsHide: true,
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  });
+  if (result?.error) throw new Error(`extracted git failed to run (${result.error.message || result.error})`);
+  if (result?.status !== 0 || !/git version/u.test(String(result?.stdout || ""))) {
+    throw new Error(`extracted git failed verification (${firstLine(result?.stderr) || `exit ${result?.status}`})`);
+  }
+}
+
+/**
+ * Ensure the Impel-managed MinGit exists. Never throws: setup and update call
+ * this on every Windows run, and a failed download must degrade to the same
+ * "git is missing" skill-sync skip the machine already had — not break
+ * convergence. Returns `{ installed, binary, ... }`.
+ */
+export async function provisionWindowsGit({
+  homeDir = os.homedir(),
+  architecture = process.arch,
+  platform = process.platform,
+  environment = process.env,
+  fetchImpl = fetch,
+  run = spawnSync,
+  logger = console,
+  pin = PINNED_MINGIT,
+  downloadTimeoutMs = MINGIT_DOWNLOAD_TIMEOUT_MS,
+} = {}) {
+  if (platform !== "win32") return { installed: false, binary: null, reason: "unsupported-platform" };
+
+  const target = managedGitRoot(homeDir);
+  const existing = managedGitBinary(target);
+  if (fs.existsSync(existing)) return { installed: false, binary: existing, reason: "already-present" };
+
+  // 32-bit Node on a 64-bit OS still wants the 64-bit git: they are separate
+  // processes, and git-for-windows no longer targets 32-bit-only Windows.
+  const release = pin.architectures[architecture] || pin.architectures.x64;
+  const staging = `${target}.staging`;
+  const archive = `${target}.download.zip`;
+  logger.log(`Git: no usable git found; installing MinGit ${pin.version} into the Impel tools directory…`);
+  try {
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.rmSync(archive, { force: true });
+
+    const payload = await downloadArchive(release.url, fetchImpl, downloadTimeoutMs);
+    const digest = createHash("sha256").update(payload).digest("hex");
+    if (digest !== release.sha256) {
+      throw new Error(`MinGit checksum mismatch (expected ${release.sha256}, got ${digest})`);
+    }
+    fs.writeFileSync(archive, payload);
+    extractArchive(archive, staging, environment, run);
+    verifyGitBinary(managedGitBinary(staging), environment, run);
+
+    // Replace atomically-enough: verified staging swaps in via a same-volume
+    // rename, so discovery never sees a half-extracted tree.
+    fs.rmSync(target, { recursive: true, force: true });
+    fs.renameSync(staging, target);
+    const binary = managedGitBinary(target);
+    logger.log(`Git: MinGit ${pin.version} ready (${binary}).`);
+    return { installed: true, binary, version: pin.version };
+  } catch (error) {
+    const reason = error?.message || String(error);
+    logger.warn(
+      `impel: could not install the managed Git (${reason}). Skill syncing needs git — `
+        + "install Git for Windows (https://git-scm.com/download/win), then re-run `impel update`.",
+    );
+    return { installed: false, binary: null, failure: reason };
+  } finally {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.rmSync(archive, { force: true });
+  }
+}

package/src/windowsSetup.js

@@ -7,6 +7,7 @@ import {
   nativeSpawnInvocation,
 } from "./nativeProcess.js";
 import { syncSkillsSafe } from "./skills.js";
+import { provisionWindowsGit } from "./windowsGit.js";
 
 const POWERSHELL_ARGS = [
   "-NoLogo",
@@ -126,6 +127,8 @@ export async function prepareWindowsClis({
     ensureClaudeProfile: ensureImpelClaudeProfile,
     ensureCodexProfile: ensureImpelCodexProfile,
     syncSkills: syncSkillsSafe,
+    provisionGit: provisionWindowsGit,
+    logger: console,
     ...dependencies,
   };
 
@@ -142,6 +145,19 @@ export async function prepareWindowsClis({
     throw new Error("installTools must contain unique supported Windows CLI names");
   }
 
+  // Both vendor CLIs need `git` to install the skills marketplace, and the
+  // target machines are brand new — provision the Impel-managed MinGit before
+  // any skill sync, on every setup/update pass (idempotent once installed).
+  // A failure degrades to the skill-sync "git is missing" skip, never a throw.
+  let gitBinary = io.find("git", io.environment, "win32");
+  let gitProvision = null;
+  if (!gitBinary) {
+    gitProvision = await io.provisionGit({ environment: io.environment, logger: io.logger });
+    gitBinary = gitProvision?.installed
+      ? gitProvision.binary
+      : io.find("git", io.environment, "win32");
+  }
+
   if (missingBefore.length > 0 && !skipInstall) {
     // Install independently: one broken vendor endpoint or local conflict must
     // not prevent the other client from reaching a usable state.
@@ -205,5 +221,6 @@ export async function prepareWindowsClis({
     installations,
     installCommands: windowsCliInstallCommands(missingBefore),
     profiles: { claude: claudeProfile.configDir, codex: codexProfile.codexHome },
+    git: { binary: gitBinary || null, provision: gitProvision },
   };
 }