impel-cli 0.17.14 → 0.17.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.14",
+  "version": "0.17.16",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -1355,6 +1355,29 @@ function mergeManagedChatGPTToml(current, managed) {
   return `${managed}\n${remainder ? `\n${remainder.replace(/\s*$/u, "")}\n` : ""}`;
 }
 
+/**
+ * True when a managed ChatGPT profile exists but its config no longer routes
+ * inference through the Impel gateway. The Codex desktop app rewrites
+ * config.toml with its own settings writer (model picker, project trust,
+ * migrations) and can drop the managed top-level `model_provider` key; without
+ * it the built-in ChatGPT provider derives its inference endpoint from
+ * chatgpt.com and sends the Impel token there, which chatgpt.com rejects with
+ * 403 "Unknown personal access token". Stale-only refreshes treat this drift
+ * as staleness so the profile heals immediately instead of waiting out the
+ * manifest TTL.
+ */
+export function managedChatGPTConfigDrifted(paths) {
+  let current;
+  try {
+    current = fs.readFileSync(path.join(paths.chatgpt.codexHome, "config.toml"), "utf8");
+  } catch {
+    return false; // No managed profile; install/update owns creating one.
+  }
+  return !current.includes(CHATGPT_CONFIG_START)
+    || readTopLevelTomlString(current, "model_provider") !== "impel"
+    || !readTopLevelTomlString(current, "chatgpt_base_url");
+}
+
 function readTopLevelTomlString(toml, key) {
   const topLevel = toml.split(/^\s*\[/mu, 1)[0];
   const match = topLevel.match(new RegExp(`^\\s*${escapeRegex(key)}\\s*=\\s*("(?:[^"\\\\]|\\\\.)*")\\s*$`, "mu"));

package/src/commands/apps.js

@@ -32,6 +32,7 @@ import {
   ensureVendorApp,
   fetchGatewayModels,
   installManagedAppFiles,
+  managedChatGPTConfigDrifted,
   managedLauncherName,
   normalizeAppTarget,
   quitBlockingApps,
@@ -260,9 +261,23 @@ async function maybeUpdateAllInstalledTenants(argv, overrides, platform) {
   return true;
 }
 
+// winget exits with HRESULTs; the raw decimal (e.g. 2316632066) hides the
+// recognizable 0x8A15xxxx APPINSTALLER facility, so render hex alongside it.
+const WINGET_EXIT_HINTS = new Map([
+  [0x8A150002, "winget rejected the command-line arguments"],
+  [0x8A150014, "no package matched the winget query"],
+  [0x8A15001B, "the Microsoft Store client is blocked by policy"],
+  [0x8A15001C, "the Microsoft Store app is blocked by policy"],
+]);
+
 function windowsProcessFailure(result) {
   if (result?.error?.message) return redactSecretText(result.error.message);
-  if (Number.isInteger(result?.status)) return `exit code ${result.status}`;
+  if (Number.isInteger(result?.status)) {
+    const status = result.status >>> 0;
+    if (status < 0x80000000) return `exit code ${result.status}`;
+    const hint = WINGET_EXIT_HINTS.get(status);
+    return `exit code ${result.status} (0x${status.toString(16).toUpperCase()}${hint ? ` — ${hint}` : ""})`;
+  }
   if (result?.signal) return `signal ${result.signal}`;
   return "no exit status";
 }
@@ -367,45 +382,62 @@ export async function reconcileWindowsTenantApps({
   const vendorPaths = {};
   const preparedTargets = new Set(skipVendor ? actionTargets : skipVendorTargets);
 
+  // A target that cannot proceed (declined confirmation, failed installer,
+  // missing vendor app) must not abort the other target's work: install
+  // recovery approves one vendor app at a time, and that approved install
+  // has to run even while its sibling stays missing.
+  const failed = [];
+  const fail = (target, error) => failed.push({ target, error });
+  const hasFailed = (target) => failed.some((failure) => failure.target === target);
+
   for (const target of actionTargets) {
     const isClaude = target === "claude";
+    const label = isClaude ? "Claude" : "ChatGPT/Codex";
     const find = isClaude ? io.findClaudeApp : io.findChatGPTApp;
     const ensure = isClaude ? io.ensureClaudeApp : io.ensureChatGPTApp;
     let binary = find(environment);
     if (!preparedTargets.has(target)) {
       const confirmed = await confirmVendorInstall(target, { platform: "win32", mode });
       if (!confirmed) {
-        throw new Error(`${isClaude ? "Claude" : "ChatGPT/Codex"} vendor ${mode === "update" ? "update" : "installation"} requires confirmation`);
+        fail(target, `${label} vendor ${mode === "update" ? "update" : "installation"} requires confirmation`);
+        continue;
       }
       const vendor = ensure({ update: mode === "update" }, { environment });
       binary = vendor.binary;
       if (!binary) {
-        const label = isClaude ? "Claude" : "ChatGPT/Codex";
-        throw new Error(`${label} vendor installation failed (${windowsProcessFailure(vendor.result)})`);
+        fail(target, `${label} vendor installation failed (${windowsProcessFailure(vendor.result)})`);
+        continue;
       }
     }
     if (binary) vendorPaths[target] = binary;
   }
-  if (actionTargets.includes("claude") && !vendorPaths.claude) {
-    throw new Error("Claude vendor app is unavailable");
+  if (actionTargets.includes("claude") && !hasFailed("claude") && !vendorPaths.claude) {
+    fail("claude", "Claude vendor app is unavailable");
   }
-  if (actionTargets.includes("chatgpt")) {
-    let managed = io.findManagedChatGPTApp(paths.root);
-    const stale = vendorPaths.chatgpt && !io.chatGPTStageIsCurrent(vendorPaths.chatgpt, paths.root);
-    if (!managed || stale) {
-      if (!vendorPaths.chatgpt) throw new Error("ChatGPT/Codex vendor app is unavailable");
-      managed = io.stageChatGPTApp(vendorPaths.chatgpt, paths.root);
+  if (actionTargets.includes("chatgpt") && !hasFailed("chatgpt")) {
+    try {
+      let managed = io.findManagedChatGPTApp(paths.root);
+      const stale = vendorPaths.chatgpt && !io.chatGPTStageIsCurrent(vendorPaths.chatgpt, paths.root);
+      if (!managed || stale) {
+        if (!vendorPaths.chatgpt) throw new Error("ChatGPT/Codex vendor app is unavailable");
+        managed = io.stageChatGPTApp(vendorPaths.chatgpt, paths.root);
+      }
+      if (!managed) throw new Error("the managed ChatGPT/Codex app could not be staged");
+    } catch (error) {
+      fail("chatgpt", redactSecretText(error?.message || error));
     }
-    if (!managed) throw new Error("the managed ChatGPT/Codex app could not be staged");
   }
+  const completedTargets = actionTargets.filter((target) => !hasFailed(target));
 
-  configureWindowsApps(config, actionTargets, vendorPaths, catalog, {
-    ...io,
-    homeDir,
-    environment,
-  });
+  if (completedTargets.length) {
+    configureWindowsApps(config, completedTargets, vendorPaths, catalog, {
+      ...io,
+      homeDir,
+      environment,
+    });
+  }
   const agentTargets = [];
-  for (const target of actionTargets) {
+  for (const target of completedTargets) {
     const { client, env, label } = appSkillTarget(target, paths, {
       platform: "win32",
       existsSync: io.existsSync,
@@ -430,11 +462,11 @@ export async function reconcileWindowsTenantApps({
     });
   }
   const verification = {
-    claude: !actionTargets.includes("claude") || io.existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)),
-    chatgpt: !actionTargets.includes("chatgpt") || io.existsSync(path.join(paths.chatgpt.codexHome, "config.toml")),
+    claude: !completedTargets.includes("claude") || io.existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)),
+    chatgpt: !completedTargets.includes("chatgpt") || io.existsSync(path.join(paths.chatgpt.codexHome, "config.toml")),
   };
   if (!Object.values(verification).every(Boolean)) throw new Error("Windows app profile verification failed");
-  return { tenantId: config.tenantId, targets: actionTargets, unsupported, paths, verification };
+  return { tenantId: config.tenantId, targets: completedTargets, unsupported, paths, verification, failed };
 }
 
 /** Reconcile one explicit tenant's macOS app bundles and profiles. */
@@ -479,17 +511,27 @@ export async function reconcileMacTenantApps({
   const statuses = io.status(actionTargets, homeDir, config.tenantId, config.tenantName);
   for (const status of statuses) vendorPaths[status.target] ||= status.vendorPath;
   const preparedTargets = new Set(skipVendor ? actionTargets : skipVendorTargets);
-  {
-    for (const target of actionTargets.filter((target) => !preparedTargets.has(target))) {
-      if (vendorPaths[target]) continue;
-      const confirmed = await confirmVendorInstall(target, { platform: "darwin", mode });
-      if (!confirmed) throw new Error(`${target} vendor installation requires confirmation`);
-      const result = await io.ensureVendor(target, { homeDir });
-      vendorPaths[target] = result.path;
-      if (!result.path) throw new Error(`${target} verified vendor app is unavailable; retry the pinned download`);
+  // As on Windows, a declined or failed vendor install skips only that
+  // target so the sibling app still converges (install recovery approves one
+  // vendor app at a time).
+  const failed = [];
+  const fail = (target, error) => failed.push({ target, error });
+  const hasFailed = (target) => failed.some((failure) => failure.target === target);
+  for (const target of actionTargets.filter((target) => !preparedTargets.has(target))) {
+    if (vendorPaths[target]) continue;
+    const confirmed = await confirmVendorInstall(target, { platform: "darwin", mode });
+    if (!confirmed) {
+      fail(target, `${target} vendor installation requires confirmation`);
+      continue;
     }
+    const result = await io.ensureVendor(target, { homeDir });
+    vendorPaths[target] = result.path;
+    if (!result.path) fail(target, `${target} verified vendor app is unavailable; retry the pinned download`);
   }
-  const staleTargets = statuses.filter((status) => !io.bundleCurrent(status)).map((status) => status.target);
+  const completedTargets = actionTargets.filter((target) => !hasFailed(target));
+  const staleTargets = statuses
+    .filter((status) => completedTargets.includes(status.target) && !io.bundleCurrent(status))
+    .map((status) => status.target);
   let closedApps = [];
   if (staleTargets.length) {
     const result = await io.quitApps(staleTargets, { tenantId: config.tenantId, tenantName: config.tenantName });
@@ -498,14 +540,14 @@ export async function reconcileMacTenantApps({
   const reopenTargets = new Set(staleTargets.filter((target) => closedApps.includes(
     managedLauncherName(target, { tenantId: config.tenantId, tenantName: config.tenantName }),
   )));
-  const installed = await io.installFiles({
+  const installed = completedTargets.length ? await io.installFiles({
     config,
-    targets: actionTargets,
+    targets: completedTargets,
     models: catalog.models,
     homeDir,
     vendorPaths,
     writeBundles: staleTargets,
-  });
+  }) : [];
   const paths = appPaths(homeDir, config.tenantId, { tenantName: config.tenantName });
   const agentItems = [];
   for (const item of installed) {
@@ -527,7 +569,7 @@ export async function reconcileMacTenantApps({
   for (const item of installed) {
     if (reopenTargets.has(item.target)) io.openLauncher(item.launcher);
   }
-  const verification = Object.fromEntries(actionTargets.map((target) => [
+  const verification = Object.fromEntries(completedTargets.map((target) => [
     target,
     io.existsSync(paths[target].launcher) && io.existsSync(
       target === "claude"
@@ -536,7 +578,7 @@ export async function reconcileMacTenantApps({
     ),
   ]));
   if (!Object.values(verification).every(Boolean)) throw new Error("macOS app bundle/profile verification failed");
-  return { tenantId: config.tenantId, targets: actionTargets, unsupported, paths, verification, installed };
+  return { tenantId: config.tenantId, targets: completedTargets, unsupported, paths, verification, installed, failed };
 }
 
 export function reconcileTenantApps(options = {}, overrides = {}) {
@@ -662,7 +704,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
           claudeUserData: io.claudeUserData(io.environment, staleTenantId),
           tenantName: staleTenantId === stored.tenantId ? stored.tenantName : null,
         });
-        if (manifestIsFresh(stalePaths, stored)) return true;
+        if (manifestIsFresh(stalePaths, stored) && !managedChatGPTConfigDrifted(stalePaths)) return true;
       }
     }
     const config = await io.selectedConfig(targets, flags.tenant || null);
@@ -1241,7 +1283,7 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
       ? stored.tenantName || manifest?.tenantName
       : manifest?.tenantName,
   });
-  if (staleOnly && manifestIsFresh(paths, stored)) return;
+  if (staleOnly && manifestIsFresh(paths, stored) && !managedChatGPTConfigDrifted(paths)) return;
 
   let config;
   try {

package/src/commands/converge.js

@@ -2,7 +2,12 @@
 
 import { loadConfig, saveConfig, redactSecretText } from "../config.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
-import { printReconciliationSummary, reconcileAllTenants, selectDefaultTenant } from "../provisioning.js";
+import {
+  printReconciliationSummary,
+  reconcileAllTenants,
+  selectDefaultTenant,
+  vendorAppTargetReady,
+} from "../provisioning.js";
 import { fetchTenants } from "../tenants.js";
 import { promptText } from "../prompt.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
@@ -258,11 +263,17 @@ export async function cmdConverge(argv = [], overrides = {}) {
             return ["ready", "unavailable"].includes(profileReport.tenants[0]?.cli);
           },
           retryStep: () => retrySafeState(),
-          installVendorApp: (target) => retryTenant(async (product) => (
-            target === "all"
-            || product === target
-            || (target === "codex" && product === "chatgpt")
-          )),
+          // Succeed when the requested vendor app converged, even if the
+          // sibling app still fails: the goal check keeps demanding full
+          // tenant readiness, so recovery can approve one app at a time.
+          installVendorApp: async (target) => {
+            await retryTenant(async (product) => (
+              target === "all"
+              || product === target
+              || (target === "codex" && product === "chatgpt")
+            ));
+            return vendorAppTargetReady(retryReport, target);
+          },
         },
       }, overrides.recoveryOverrides || {});
       if (retryReport) mergeTenantReport(report, retryReport);

package/src/commands/launch.js

@@ -31,7 +31,12 @@ const CLAUDE_DIRECT_AUTH_ENV = [
 ];
 
 const CODEX_DIRECT_AUTH_ENV = ["CODEX_ACCESS_TOKEN", "CODEX_API_KEY", "OPENAI_API_KEY", "OPENAI_BASE_URL"];
-export { escapeWindowsBatchArgument, nativeSpawnInvocation, resolveNativeBinary } from "../nativeProcess.js";
+export {
+  escapeWindowsBareArgument,
+  escapeWindowsBatchArgument,
+  nativeSpawnInvocation,
+  resolveNativeBinary,
+} from "../nativeProcess.js";
 
 export const IMPEL_SPECIALIST_DELEGATION_INSTRUCTIONS = `You are running in an Impel tenant-scoped session. Before starting any non-trivial task, call the Impel MCP tool list_specialists. If exactly one available specialist clearly matches the user's request, its capabilities and its exclusions, delegate the complete request by calling start_specialist_run exactly once with a stable idempotency key, then call read_specialist_run until it reaches a terminal state. When the run succeeds, use the specialist's result as your response instead of redoing the work. If no specialist clearly matches, the tools are unavailable, or the run fails, continue normally yourself. Do not delegate trivial requests, do not call a specialist excluded from the request, and never invent a specialist result.`;
 

package/src/commands/sessions.js

@@ -1,6 +1,8 @@
 import { spawn } from "node:child_process";
+import path from "node:path";
 
 import { parseFlags } from "../args.js";
+import { appPaths, managedChatGPTConfigDrifted } from "../apps.js";
 import {
   clearSessionFlushLock,
   collectSessionHook,
@@ -13,6 +15,7 @@ import {
 } from "../sessionCollector.js";
 import { loadConfig, redactSecretText } from "../config.js";
 import { impelCliInvocation } from "../selfInvocation.js";
+import { spawnDetachedAppRefresh } from "../updates.js";
 
 const SPEC = {
   provider: { type: "string" },
@@ -22,6 +25,31 @@ const SPEC = {
   "impel-managed-session-hook-v1": { type: "boolean" },
 };
 
+/**
+ * Repair a managed ChatGPT profile the desktop app just rewrote out from under
+ * the gateway. Hooks are the only Impel code guaranteed to run while the app
+ * is broken (the app stops calling the provider token helper once the managed
+ * `model_provider` key is gone), so each codex hook event checks for drift and
+ * kicks one detached stale-only refresh — which the drift-aware staleness gate
+ * turns into a real repair. The heartbeat lock keeps repeated hook events from
+ * stacking refresh children while one is already running.
+ */
+export function maybeRepairManagedCodexApp(tenantId, {
+  drifted = managedChatGPTConfigDrifted,
+  lockIsFresh = sessionFlushLockIsFresh,
+  touchLock = touchSessionFlushLock,
+  spawnRefresh = spawnDetachedAppRefresh,
+} = {}) {
+  if (!tenantId) return false;
+  const paths = appPaths(undefined, tenantId);
+  if (!drifted(paths)) return false;
+  const lock = path.join(paths.tenantRoot, "app-repair-heartbeat");
+  if (lockIsFresh(lock, 60_000)) return false;
+  touchLock(lock);
+  spawnRefresh(tenantId);
+  return true;
+}
+
 function startDetachedFlush({ provider, tenant, session }) {
   const invocation = impelCliInvocation([
     "sessions",
@@ -65,6 +93,7 @@ export async function cmdSessions(argv) {
         config,
         flush: false,
       });
+      if (flags.provider === "codex") maybeRepairManagedCodexApp(flags.tenant);
       if (config && (config.tenantId === flags.tenant || process.env.IMPEL_SESSIONS_DEV_ORG_ID)) {
         // Hooks fire on every session event; only spawn a flush child when no
         // live one is already polling this session's outbox (heartbeat lock).

package/src/commands/setup.js

@@ -16,6 +16,7 @@ import {
   printReconciliationSummary,
   reconcileAllTenants,
   selectDefaultTenant,
+  vendorAppTargetReady,
 } from "../provisioning.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
@@ -49,9 +50,9 @@ export function resolveTenantChoice(listing, { requested = null, answer = null,
   return selectDefaultTenant(listing, { currentTenantId });
 }
 
-async function probeGateway(gatewayUrl, pat, tenantId, fetchImpl = fetch) {
+async function probeGatewayOnce(gatewayUrl, pat, tenantId, fetchImpl, timeoutMs) {
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 5_000);
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetchImpl(`${gatewayUrl}/v1/models`, {
       headers: {
@@ -69,13 +70,28 @@ async function probeGateway(gatewayUrl, pat, tenantId, fetchImpl = fetch) {
   } catch (error) {
     return {
       reachable: false,
-      error: error?.name === "AbortError" ? "timed out after 5s" : redactSecretText(error?.message || error),
+      error: error?.name === "AbortError"
+        ? `timed out after ${Math.round(timeoutMs / 1000)}s`
+        : redactSecretText(error?.message || error),
     };
   } finally {
     clearTimeout(timeout);
   }
 }
 
+// A single short probe misreports a cold gateway (serverless cold start plus
+// long-haul latency) as unreachable, and that transient verdict gets baked
+// into the convergence failure message. Retry once with a longer deadline
+// before concluding the gateway is down.
+export async function probeGateway(gatewayUrl, pat, tenantId, fetchImpl = fetch, timeoutsMs = [5_000, 10_000]) {
+  let probe = { reachable: false, error: "not probed" };
+  for (const timeoutMs of timeoutsMs) {
+    probe = await probeGatewayOnce(gatewayUrl, pat, tenantId, fetchImpl, timeoutMs);
+    if (probe.reachable) return probe;
+  }
+  return probe;
+}
+
 function markProbeFailures(report, probes) {
   probes.forEach((probe, index) => {
     if (probe.reachable && !probe.rejected && probe.healthy !== false) return;
@@ -406,11 +422,17 @@ export async function cmdSetup(argv, overrides = {}) {
             return ["ready", "unavailable"].includes(profileReport.tenants[0]?.cli);
           },
           retryStep: () => retrySafeState(),
-          installVendorApp: (target) => retryTenant(async (product) => (
-            target === "all"
-            || product === target
-            || (target === "codex" && product === "chatgpt")
-          )),
+          // Succeed when the requested vendor app converged, even if the
+          // sibling app still fails: the goal check keeps demanding full
+          // tenant readiness, so recovery can approve one app at a time.
+          installVendorApp: async (target) => {
+            await retryTenant(async (product) => (
+              target === "all"
+              || product === target
+              || (target === "codex" && product === "chatgpt")
+            ));
+            return vendorAppTargetReady(retryReport, target);
+          },
         },
       }, overrides.recoveryOverrides || {});
       if (retryReport) mergeTenantReport(report, retryReport);

package/src/nativeProcess.js

@@ -27,8 +27,13 @@ function isExecutable(filePath, platform = process.platform) {
     if (!fs.statSync(filePath).isFile()) return false;
     if (platform !== "win32") fs.accessSync(filePath, fs.constants.X_OK);
     return true;
-  } catch {
-    return false;
+  } catch (error) {
+    // Windows Store App Execution Aliases (winget.exe, python.exe, …) are
+    // zero-byte APPEXECLINK reparse points that CreateProcess launches fine,
+    // but fs.stat cannot read them on Node runtimes without libuv's
+    // AppExecLink fstat support. Those failures surface as EINVAL/UNKNOWN,
+    // never ENOENT, so an existing alias must still count as executable.
+    return platform === "win32" && ["EINVAL", "UNKNOWN"].includes(error?.code);
   }
 }
 
@@ -119,6 +124,12 @@ function commonCandidates(tool, environment, platform) {
       locations.push([paths.join(systemRoot, "System32", "WindowsPowerShell", "v1.0"), "powershell"]);
     }
 
+    // winget ships solely as a per-user App Execution Alias; cover its fixed
+    // home for environments whose PATH omits the WindowsApps directory.
+    if (tool === "winget" && localAppData) {
+      locations.push([paths.join(localAppData, "Microsoft", "WindowsApps"), "winget"]);
+    }
+
     // Git for Windows standard install roots; `cmd` holds the PATH-safe
     // git.exe. Codex shells out to git for marketplace clones, so skill
     // syncing must find git even when the parent shell's PATH predates the
@@ -183,13 +194,13 @@ export function resolveNativeBinary(
 
 // Windows cannot execute npm's .cmd/.bat shims directly. This is the escaping
 // strategy used by cross-spawn, inlined here to keep the CLI dependency-free.
-// Arguments are quoted individually and command metacharacters are escaped
-// twice because npm shims forward them through `%*`, causing a second parse.
+// Arguments are quoted individually and command metacharacters are
+// caret-escaped once per cmd parse the argument will go through.
 function escapeWindowsBatchCommand(value) {
   return String(value).replace(WINDOWS_SHELL_META_RE, "^$1");
 }
 
-export function escapeWindowsBatchArgument(value) {
+function encodeWindowsCommandArgument(value, metaEscapePasses) {
   let escaped = String(value);
   if (WINDOWS_UNSAFE_LINE_RE.test(escaped)) {
     throw new Error("cannot safely forward an argument containing a NUL or line break through a Windows batch shim");
@@ -197,17 +208,36 @@ export function escapeWindowsBatchArgument(value) {
   escaped = escaped.replace(/(?=(\\+?)?)\1"/gu, "$1$1\\\"");
   escaped = escaped.replace(/(?=(\\+?)?)\1$/gu, "$1$1");
   escaped = `"${escaped}"`;
-  escaped = escaped.replace(WINDOWS_SHELL_META_RE, "^$1");
-  return escaped.replace(WINDOWS_SHELL_META_RE, "^$1");
+  for (let pass = 0; pass < metaEscapePasses; pass += 1) {
+    escaped = escaped.replace(WINDOWS_SHELL_META_RE, "^$1");
+  }
+  return escaped;
+}
+
+// Batch shims re-read the command line through `%*`, so cmd parses these
+// arguments twice and the metacharacter escapes must survive both passes.
+export function escapeWindowsBatchArgument(value) {
+  return encodeWindowsCommandArgument(value, 2);
+}
+
+// A bare command name is resolved by cmd itself (covering App Execution
+// Aliases such as winget.exe that PATH stat probing cannot verify), but the
+// target program's command line is produced by cmd's single parse. Double
+// escaping here would deliver literal carets — winget then fails with
+// 0x8A150002 APPINSTALLER_CLI_ERROR_INVALID_CL_ARGUMENTS.
+export function escapeWindowsBareArgument(value) {
+  return encodeWindowsCommandArgument(value, 1);
 }
 
 export function nativeSpawnInvocation(binary, argv, environment = process.env, platform = process.platform) {
+  const batchShim = platform === "win32" && WINDOWS_BATCH_EXTENSION_RE.test(binary);
   const bareWindowsCommand = (
     platform === "win32"
+    && !batchShim
     && WINDOWS_BARE_COMMAND_RE.test(binary)
     && path.win32.basename(binary) === binary
   );
-  if (platform !== "win32" || (!WINDOWS_BATCH_EXTENSION_RE.test(binary) && !bareWindowsCommand)) {
+  if (platform !== "win32" || (!batchShim && !bareWindowsCommand)) {
     return { command: binary, args: argv, windowsVerbatimArguments: false };
   }
   if (WINDOWS_UNSAFE_LINE_RE.test(binary)) {
@@ -215,7 +245,7 @@ export function nativeSpawnInvocation(binary, argv, environment = process.env, p
   }
   const shellCommand = [
     escapeWindowsBatchCommand(pathApi(platform).normalize(binary)),
-    ...argv.map(escapeWindowsBatchArgument),
+    ...argv.map(batchShim ? escapeWindowsBatchArgument : escapeWindowsBareArgument),
   ].join(" ");
   return {
     command: environmentValue(environment, "ComSpec") || "cmd.exe",

package/src/provisioning.js

@@ -247,6 +247,7 @@ export async function reconcileAllTenants({
     for (const tenant of liveTenants) {
       const result = results.get(tenant.id);
       let supported = new Set();
+      let failedTargets = new Set();
       try {
         const installed = await io.reconcileApps({
           baseConfig: config,
@@ -260,10 +261,17 @@ export async function reconcileAllTenants({
           confirmVendorInstall,
         }, overrides.appOverrides || {});
         supported = new Set(installed.targets || []);
+        const failedApps = installed.failed || [];
+        failedTargets = new Set(failedApps.map((failure) => failure.target));
         for (const target of supported) vendorPreparedTargets.add(target);
-        result.clients.claude.app = supported.has("claude") ? "ready" : "unsupported";
-        result.clients.codex.app = supported.has("chatgpt") ? "ready" : "unsupported";
-        result.apps = supported.size ? "ready" : "unavailable";
+        result.clients.claude.app = supported.has("claude")
+          ? "ready"
+          : failedTargets.has("claude") ? "failed" : "unsupported";
+        result.clients.codex.app = supported.has("chatgpt")
+          ? "ready"
+          : failedTargets.has("chatgpt") ? "failed" : "unsupported";
+        result.apps = failedTargets.size ? "failed" : supported.size ? "ready" : "unavailable";
+        for (const failure of failedApps) result.errors.push(redactSecretText(failure.error));
       } catch (error) {
         result.apps = "failed";
         for (const client of Object.values(result.clients)) {
@@ -276,9 +284,9 @@ export async function reconcileAllTenants({
       }
 
       if (supported.size === 0) {
-        result.shell = "unavailable";
-        result.clients.claude.shell = "unsupported";
-        result.clients.codex.shell = "unsupported";
+        result.shell = failedTargets.size ? "failed" : "unavailable";
+        result.clients.claude.shell = failedTargets.has("claude") ? "failed" : "unsupported";
+        result.clients.codex.shell = failedTargets.has("chatgpt") ? "failed" : "unsupported";
         continue;
       }
       try {
@@ -293,12 +301,15 @@ export async function reconcileAllTenants({
         const entryProducts = new Set(entries.map((entry) => entry.product));
         result.clients.claude.shell = supported.has("claude")
           ? (entryProducts.has("claude") ? "ready" : "failed")
-          : "unsupported";
+          : failedTargets.has("claude") ? "failed" : "unsupported";
         result.clients.codex.shell = supported.has("chatgpt")
           ? (entryProducts.has("chatgpt") ? "ready" : "failed")
-          : "unsupported";
-        result.shell = [...supported].every((target) => entryProducts.has(target)) ? "ready" : "failed";
-        if (result.shell === "failed") throw new Error("operating-system app registration did not complete");
+          : failedTargets.has("chatgpt") ? "failed" : "unsupported";
+        const registered = [...supported].every((target) => entryProducts.has(target));
+        // A failed vendor target has no launchable entry, so the tenant's
+        // launch surface stays failed even when every present app registered.
+        result.shell = registered && !failedTargets.size ? "ready" : "failed";
+        if (!registered) throw new Error("operating-system app registration did not complete");
       } catch (error) {
         result.shell = "failed";
         for (const client of Object.values(result.clients)) {
@@ -327,6 +338,19 @@ export async function reconcileAllTenants({
   };
 }
 
+/**
+ * Whether a single-tenant reconcile report shows the requested vendor app
+ * (claude, codex, or all) as converged. "unsupported" counts as converged:
+ * the tenant catalog offers nothing to install for that product.
+ */
+export function vendorAppTargetReady(report, target) {
+  const clients = report?.tenants?.[0]?.clients;
+  if (!clients) return false;
+  const converged = (client) => ["ready", "unsupported"].includes(client?.app);
+  if (target === "all") return converged(clients.claude) && converged(clients.codex);
+  return converged(target === "claude" ? clients.claude : clients.codex);
+}
+
 export function printReconciliationSummary(report, log = console.log) {
   log("Tenant readiness:");
   for (const tenant of report.tenants) {

package/src/skills.js

@@ -44,6 +44,14 @@ export const SKILLS_FALLBACK_GATEWAY_URL = "https://gateway.useimpel.ai";
 const BENIGN_OUTPUT = /already (exist|install|add|present|configur)|up[ -]?to[ -]?date|no changes|nothing to (do|update)/i;
 const TRANSIENT_SKILL_OUTPUT = /timed? out|timeout of \d+ms exceeded|ECONNRESET|ETIMEDOUT|EAI_AGAIN|network error|failed to download/i;
 
+// Codex `plugin marketplace upgrade` refreshes only Git marketplaces. A
+// registration recorded with a non-git source_type (an older Codex, or a
+// git-less fallback at registration time) fails every upgrade with this error
+// until the marketplace is re-registered — otherwise the profile keeps the
+// snapshot cloned at registration forever and every sync warns.
+const NON_GIT_MARKETPLACE_RE = /not configured as a git marketplace/i;
+const MARKETPLACE_NOT_FOUND_RE = /not found|no marketplace/i;
+
 const CLIENT_SPECS = {
   claude: {
     bin: "claude",
@@ -345,6 +353,27 @@ async function runSkillCommandWithRetry(run, bin, args, env) {
   return run(bin, args, env);
 }
 
+/**
+ * Heal a Codex marketplace whose stored registration cannot be upgraded by
+ * re-registering it: remove the stale record (which also drops its installed
+ * plugins) and add the current source. The install command that follows the
+ * refresh phase reinstalls the plugin from the fresh snapshot. Returns true
+ * only when the re-registration fully succeeded.
+ */
+async function reregisterCodexMarketplace({ run, bin, env, marketplaceName, sourceUrl }) {
+  const removed = await run(bin, ["plugin", "marketplace", "remove", marketplaceName], env);
+  if (!removed.ok && !MARKETPLACE_NOT_FOUND_RE.test(`${removed.stdout}\n${removed.stderr}`)) {
+    return false;
+  }
+  const added = await runSkillCommandWithRetry(
+    run,
+    bin,
+    ["plugin", "marketplace", "add", sourceUrl],
+    env,
+  );
+  return added.ok;
+}
+
 const MARKETPLACE_FETCH_TIMEOUT_MS = 30_000;
 
 // The gateway serves marketplace.json from a serverless function with an 8-15s
@@ -494,9 +523,23 @@ export async function syncSkills({
         failures.push({ phase: command.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
         break;
       }
-      if (!isBenign(result)) {
-        failures.push({ phase: command.phase, reason: firstLine(result.stderr) || `exit ${result.status}` });
+      if (isBenign(result)) continue;
+      if (
+        client === "codex"
+        && command.phase === "refresh-marketplace"
+        && marketplaceName
+        && NON_GIT_MARKETPLACE_RE.test(`${result.stdout}\n${result.stderr}`)
+      ) {
+        const reregistered = await reregisterCodexMarketplace({
+          run,
+          bin: spec.bin,
+          env,
+          marketplaceName,
+          sourceUrl,
+        });
+        if (reregistered) continue;
       }
+      failures.push({ phase: command.phase, reason: firstLine(result.stderr) || `exit ${result.status}` });
     }
 
     if (failures.length > 0) {