impel-cli 0.17.14 → 0.17.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.14",
+  "version": "0.17.15",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -1355,6 +1355,29 @@ function mergeManagedChatGPTToml(current, managed) {
   return `${managed}\n${remainder ? `\n${remainder.replace(/\s*$/u, "")}\n` : ""}`;
 }
 
+/**
+ * True when a managed ChatGPT profile exists but its config no longer routes
+ * inference through the Impel gateway. The Codex desktop app rewrites
+ * config.toml with its own settings writer (model picker, project trust,
+ * migrations) and can drop the managed top-level `model_provider` key; without
+ * it the built-in ChatGPT provider derives its inference endpoint from
+ * chatgpt.com and sends the Impel token there, which chatgpt.com rejects with
+ * 403 "Unknown personal access token". Stale-only refreshes treat this drift
+ * as staleness so the profile heals immediately instead of waiting out the
+ * manifest TTL.
+ */
+export function managedChatGPTConfigDrifted(paths) {
+  let current;
+  try {
+    current = fs.readFileSync(path.join(paths.chatgpt.codexHome, "config.toml"), "utf8");
+  } catch {
+    return false; // No managed profile; install/update owns creating one.
+  }
+  return !current.includes(CHATGPT_CONFIG_START)
+    || readTopLevelTomlString(current, "model_provider") !== "impel"
+    || !readTopLevelTomlString(current, "chatgpt_base_url");
+}
+
 function readTopLevelTomlString(toml, key) {
   const topLevel = toml.split(/^\s*\[/mu, 1)[0];
   const match = topLevel.match(new RegExp(`^\\s*${escapeRegex(key)}\\s*=\\s*("(?:[^"\\\\]|\\\\.)*")\\s*$`, "mu"));

package/src/commands/apps.js

@@ -32,6 +32,7 @@ import {
   ensureVendorApp,
   fetchGatewayModels,
   installManagedAppFiles,
+  managedChatGPTConfigDrifted,
   managedLauncherName,
   normalizeAppTarget,
   quitBlockingApps,
@@ -662,7 +663,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
           claudeUserData: io.claudeUserData(io.environment, staleTenantId),
           tenantName: staleTenantId === stored.tenantId ? stored.tenantName : null,
         });
-        if (manifestIsFresh(stalePaths, stored)) return true;
+        if (manifestIsFresh(stalePaths, stored) && !managedChatGPTConfigDrifted(stalePaths)) return true;
       }
     }
     const config = await io.selectedConfig(targets, flags.tenant || null);
@@ -1241,7 +1242,7 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
       ? stored.tenantName || manifest?.tenantName
       : manifest?.tenantName,
   });
-  if (staleOnly && manifestIsFresh(paths, stored)) return;
+  if (staleOnly && manifestIsFresh(paths, stored) && !managedChatGPTConfigDrifted(paths)) return;
 
   let config;
   try {

package/src/commands/sessions.js

@@ -1,6 +1,8 @@
 import { spawn } from "node:child_process";
+import path from "node:path";
 
 import { parseFlags } from "../args.js";
+import { appPaths, managedChatGPTConfigDrifted } from "../apps.js";
 import {
   clearSessionFlushLock,
   collectSessionHook,
@@ -13,6 +15,7 @@ import {
 } from "../sessionCollector.js";
 import { loadConfig, redactSecretText } from "../config.js";
 import { impelCliInvocation } from "../selfInvocation.js";
+import { spawnDetachedAppRefresh } from "../updates.js";
 
 const SPEC = {
   provider: { type: "string" },
@@ -22,6 +25,31 @@ const SPEC = {
   "impel-managed-session-hook-v1": { type: "boolean" },
 };
 
+/**
+ * Repair a managed ChatGPT profile the desktop app just rewrote out from under
+ * the gateway. Hooks are the only Impel code guaranteed to run while the app
+ * is broken (the app stops calling the provider token helper once the managed
+ * `model_provider` key is gone), so each codex hook event checks for drift and
+ * kicks one detached stale-only refresh — which the drift-aware staleness gate
+ * turns into a real repair. The heartbeat lock keeps repeated hook events from
+ * stacking refresh children while one is already running.
+ */
+export function maybeRepairManagedCodexApp(tenantId, {
+  drifted = managedChatGPTConfigDrifted,
+  lockIsFresh = sessionFlushLockIsFresh,
+  touchLock = touchSessionFlushLock,
+  spawnRefresh = spawnDetachedAppRefresh,
+} = {}) {
+  if (!tenantId) return false;
+  const paths = appPaths(undefined, tenantId);
+  if (!drifted(paths)) return false;
+  const lock = path.join(paths.tenantRoot, "app-repair-heartbeat");
+  if (lockIsFresh(lock, 60_000)) return false;
+  touchLock(lock);
+  spawnRefresh(tenantId);
+  return true;
+}
+
 function startDetachedFlush({ provider, tenant, session }) {
   const invocation = impelCliInvocation([
     "sessions",
@@ -65,6 +93,7 @@ export async function cmdSessions(argv) {
         config,
         flush: false,
       });
+      if (flags.provider === "codex") maybeRepairManagedCodexApp(flags.tenant);
       if (config && (config.tenantId === flags.tenant || process.env.IMPEL_SESSIONS_DEV_ORG_ID)) {
         // Hooks fire on every session event; only spawn a flush child when no
         // live one is already polling this session's outbox (heartbeat lock).