impel-cli 0.17.15 → 0.17.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.15",
+  "version": "0.17.17",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/agents.js

@@ -12,6 +12,7 @@ import path from "node:path";
 import { normalizeGatewayUrl, redactSecretText } from "./config.js";
 import { impelMcpInvocation } from "./selfInvocation.js";
 import { normalizeTenantId } from "./tenants.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 
 export const AGENT_SYNC_TTL_MS = 6 * 60 * 60 * 1000;
 export const MANAGED_AGENT_DIRECTORY = "impel-managed";
@@ -52,7 +53,7 @@ function atomicPrivateWrite(filePath, contents) {
   const temporaryPath = `${filePath}.tmp-${process.pid}-${crypto.randomBytes(4).toString("hex")}`;
   try {
     fs.writeFileSync(temporaryPath, contents, { mode: 0o600 });
-    fs.renameSync(temporaryPath, filePath);
+    renameWithWindowsRetry(temporaryPath, filePath);
     try {
       fs.chmodSync(filePath, 0o600);
     } catch {

package/src/cliProfiles.js

@@ -12,6 +12,7 @@ import { CONFIG_DIR } from "./config.js";
 import { normalizeTenantId } from "./tenants.js";
 import { impelCliInvocation, impelMcpInvocation } from "./selfInvocation.js";
 import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
@@ -55,7 +56,7 @@ function writePrivateFile(filePath, contents) {
   const temporaryPath = `${filePath}.tmp-${process.pid}`;
   try {
     fs.writeFileSync(temporaryPath, contents, { mode: 0o600 });
-    fs.renameSync(temporaryPath, filePath);
+    renameWithWindowsRetry(temporaryPath, filePath);
     try {
       fs.chmodSync(filePath, 0o600);
     } catch {

package/src/commands/apps.js

@@ -261,9 +261,23 @@ async function maybeUpdateAllInstalledTenants(argv, overrides, platform) {
   return true;
 }
 
+// winget exits with HRESULTs; the raw decimal (e.g. 2316632066) hides the
+// recognizable 0x8A15xxxx APPINSTALLER facility, so render hex alongside it.
+const WINGET_EXIT_HINTS = new Map([
+  [0x8A150002, "winget rejected the command-line arguments"],
+  [0x8A150014, "no package matched the winget query"],
+  [0x8A15001B, "the Microsoft Store client is blocked by policy"],
+  [0x8A15001C, "the Microsoft Store app is blocked by policy"],
+]);
+
 function windowsProcessFailure(result) {
   if (result?.error?.message) return redactSecretText(result.error.message);
-  if (Number.isInteger(result?.status)) return `exit code ${result.status}`;
+  if (Number.isInteger(result?.status)) {
+    const status = result.status >>> 0;
+    if (status < 0x80000000) return `exit code ${result.status}`;
+    const hint = WINGET_EXIT_HINTS.get(status);
+    return `exit code ${result.status} (0x${status.toString(16).toUpperCase()}${hint ? ` — ${hint}` : ""})`;
+  }
   if (result?.signal) return `signal ${result.signal}`;
   return "no exit status";
 }
@@ -368,45 +382,62 @@ export async function reconcileWindowsTenantApps({
   const vendorPaths = {};
   const preparedTargets = new Set(skipVendor ? actionTargets : skipVendorTargets);
 
+  // A target that cannot proceed (declined confirmation, failed installer,
+  // missing vendor app) must not abort the other target's work: install
+  // recovery approves one vendor app at a time, and that approved install
+  // has to run even while its sibling stays missing.
+  const failed = [];
+  const fail = (target, error) => failed.push({ target, error });
+  const hasFailed = (target) => failed.some((failure) => failure.target === target);
+
   for (const target of actionTargets) {
     const isClaude = target === "claude";
+    const label = isClaude ? "Claude" : "ChatGPT/Codex";
     const find = isClaude ? io.findClaudeApp : io.findChatGPTApp;
     const ensure = isClaude ? io.ensureClaudeApp : io.ensureChatGPTApp;
     let binary = find(environment);
     if (!preparedTargets.has(target)) {
       const confirmed = await confirmVendorInstall(target, { platform: "win32", mode });
       if (!confirmed) {
-        throw new Error(`${isClaude ? "Claude" : "ChatGPT/Codex"} vendor ${mode === "update" ? "update" : "installation"} requires confirmation`);
+        fail(target, `${label} vendor ${mode === "update" ? "update" : "installation"} requires confirmation`);
+        continue;
       }
       const vendor = ensure({ update: mode === "update" }, { environment });
       binary = vendor.binary;
       if (!binary) {
-        const label = isClaude ? "Claude" : "ChatGPT/Codex";
-        throw new Error(`${label} vendor installation failed (${windowsProcessFailure(vendor.result)})`);
+        fail(target, `${label} vendor installation failed (${windowsProcessFailure(vendor.result)})`);
+        continue;
       }
     }
     if (binary) vendorPaths[target] = binary;
   }
-  if (actionTargets.includes("claude") && !vendorPaths.claude) {
-    throw new Error("Claude vendor app is unavailable");
+  if (actionTargets.includes("claude") && !hasFailed("claude") && !vendorPaths.claude) {
+    fail("claude", "Claude vendor app is unavailable");
   }
-  if (actionTargets.includes("chatgpt")) {
-    let managed = io.findManagedChatGPTApp(paths.root);
-    const stale = vendorPaths.chatgpt && !io.chatGPTStageIsCurrent(vendorPaths.chatgpt, paths.root);
-    if (!managed || stale) {
-      if (!vendorPaths.chatgpt) throw new Error("ChatGPT/Codex vendor app is unavailable");
-      managed = io.stageChatGPTApp(vendorPaths.chatgpt, paths.root);
+  if (actionTargets.includes("chatgpt") && !hasFailed("chatgpt")) {
+    try {
+      let managed = io.findManagedChatGPTApp(paths.root);
+      const stale = vendorPaths.chatgpt && !io.chatGPTStageIsCurrent(vendorPaths.chatgpt, paths.root);
+      if (!managed || stale) {
+        if (!vendorPaths.chatgpt) throw new Error("ChatGPT/Codex vendor app is unavailable");
+        managed = io.stageChatGPTApp(vendorPaths.chatgpt, paths.root);
+      }
+      if (!managed) throw new Error("the managed ChatGPT/Codex app could not be staged");
+    } catch (error) {
+      fail("chatgpt", redactSecretText(error?.message || error));
     }
-    if (!managed) throw new Error("the managed ChatGPT/Codex app could not be staged");
   }
+  const completedTargets = actionTargets.filter((target) => !hasFailed(target));
 
-  configureWindowsApps(config, actionTargets, vendorPaths, catalog, {
-    ...io,
-    homeDir,
-    environment,
-  });
+  if (completedTargets.length) {
+    configureWindowsApps(config, completedTargets, vendorPaths, catalog, {
+      ...io,
+      homeDir,
+      environment,
+    });
+  }
   const agentTargets = [];
-  for (const target of actionTargets) {
+  for (const target of completedTargets) {
     const { client, env, label } = appSkillTarget(target, paths, {
       platform: "win32",
       existsSync: io.existsSync,
@@ -415,7 +446,7 @@ export async function reconcileWindowsTenantApps({
     // Merge the sync env so an app-embedded binary (IMPEL_CODEX_BIN) satisfies
     // the availability check even when no standalone CLI is installed.
     if (io.findBinary(client, { ...environment, ...env }, "win32")) {
-      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label });
+      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label, homeDir: os.homedir() });
       agentTargets.push(target);
     } else {
       io.log(`Skipping skill/agent sync for ${label} — no ${client === "claude" ? "Claude Code" : "Codex"} binary is available to run plugin commands.`);
@@ -431,11 +462,11 @@ export async function reconcileWindowsTenantApps({
     });
   }
   const verification = {
-    claude: !actionTargets.includes("claude") || io.existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)),
-    chatgpt: !actionTargets.includes("chatgpt") || io.existsSync(path.join(paths.chatgpt.codexHome, "config.toml")),
+    claude: !completedTargets.includes("claude") || io.existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)),
+    chatgpt: !completedTargets.includes("chatgpt") || io.existsSync(path.join(paths.chatgpt.codexHome, "config.toml")),
   };
   if (!Object.values(verification).every(Boolean)) throw new Error("Windows app profile verification failed");
-  return { tenantId: config.tenantId, targets: actionTargets, unsupported, paths, verification };
+  return { tenantId: config.tenantId, targets: completedTargets, unsupported, paths, verification, failed };
 }
 
 /** Reconcile one explicit tenant's macOS app bundles and profiles. */
@@ -480,17 +511,27 @@ export async function reconcileMacTenantApps({
   const statuses = io.status(actionTargets, homeDir, config.tenantId, config.tenantName);
   for (const status of statuses) vendorPaths[status.target] ||= status.vendorPath;
   const preparedTargets = new Set(skipVendor ? actionTargets : skipVendorTargets);
-  {
-    for (const target of actionTargets.filter((target) => !preparedTargets.has(target))) {
-      if (vendorPaths[target]) continue;
-      const confirmed = await confirmVendorInstall(target, { platform: "darwin", mode });
-      if (!confirmed) throw new Error(`${target} vendor installation requires confirmation`);
-      const result = await io.ensureVendor(target, { homeDir });
-      vendorPaths[target] = result.path;
-      if (!result.path) throw new Error(`${target} verified vendor app is unavailable; retry the pinned download`);
+  // As on Windows, a declined or failed vendor install skips only that
+  // target so the sibling app still converges (install recovery approves one
+  // vendor app at a time).
+  const failed = [];
+  const fail = (target, error) => failed.push({ target, error });
+  const hasFailed = (target) => failed.some((failure) => failure.target === target);
+  for (const target of actionTargets.filter((target) => !preparedTargets.has(target))) {
+    if (vendorPaths[target]) continue;
+    const confirmed = await confirmVendorInstall(target, { platform: "darwin", mode });
+    if (!confirmed) {
+      fail(target, `${target} vendor installation requires confirmation`);
+      continue;
     }
+    const result = await io.ensureVendor(target, { homeDir });
+    vendorPaths[target] = result.path;
+    if (!result.path) fail(target, `${target} verified vendor app is unavailable; retry the pinned download`);
   }
-  const staleTargets = statuses.filter((status) => !io.bundleCurrent(status)).map((status) => status.target);
+  const completedTargets = actionTargets.filter((target) => !hasFailed(target));
+  const staleTargets = statuses
+    .filter((status) => completedTargets.includes(status.target) && !io.bundleCurrent(status))
+    .map((status) => status.target);
   let closedApps = [];
   if (staleTargets.length) {
     const result = await io.quitApps(staleTargets, { tenantId: config.tenantId, tenantName: config.tenantName });
@@ -499,20 +540,20 @@ export async function reconcileMacTenantApps({
   const reopenTargets = new Set(staleTargets.filter((target) => closedApps.includes(
     managedLauncherName(target, { tenantId: config.tenantId, tenantName: config.tenantName }),
   )));
-  const installed = await io.installFiles({
+  const installed = completedTargets.length ? await io.installFiles({
     config,
-    targets: actionTargets,
+    targets: completedTargets,
     models: catalog.models,
     homeDir,
     vendorPaths,
     writeBundles: staleTargets,
-  });
+  }) : [];
   const paths = appPaths(homeDir, config.tenantId, { tenantName: config.tenantName });
   const agentItems = [];
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     if (io.findBinary(client, environment, "darwin")) {
-      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label });
+      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label, homeDir: os.homedir() });
       agentItems.push(item);
     }
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
@@ -528,7 +569,7 @@ export async function reconcileMacTenantApps({
   for (const item of installed) {
     if (reopenTargets.has(item.target)) io.openLauncher(item.launcher);
   }
-  const verification = Object.fromEntries(actionTargets.map((target) => [
+  const verification = Object.fromEntries(completedTargets.map((target) => [
     target,
     io.existsSync(paths[target].launcher) && io.existsSync(
       target === "claude"
@@ -537,7 +578,7 @@ export async function reconcileMacTenantApps({
     ),
   ]));
   if (!Object.values(verification).every(Boolean)) throw new Error("macOS app bundle/profile verification failed");
-  return { tenantId: config.tenantId, targets: actionTargets, unsupported, paths, verification, installed };
+  return { tenantId: config.tenantId, targets: completedTargets, unsupported, paths, verification, installed, failed };
 }
 
 export function reconcileTenantApps(options = {}, overrides = {}) {
@@ -753,6 +794,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
               gatewayUrl: resolveSkillsGateway(config.gatewayUrl),
               env,
               label,
+              homeDir: os.homedir(),
               logger: createProgressLogger(spinner),
             })
           ));
@@ -995,7 +1037,7 @@ export async function cmdApps(argv, overrides = {}) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     if (!flags["skip-skills"]) {
       await withProgress(`Syncing skills for ${label}`, (spinner) => (
-        io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
+        io.syncSkills({ client, gatewayUrl, env, label, homeDir: os.homedir(), logger: createProgressLogger(spinner) })
       ));
     }
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
@@ -1126,7 +1168,7 @@ export async function provisionAndOpenManagedApps({
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     await withProgress(`Syncing skills for ${label}`, (spinner) => (
-      io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
+      io.syncSkills({ client, gatewayUrl, env, label, homeDir: os.homedir(), logger: createProgressLogger(spinner) })
     ));
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
   }
@@ -1290,7 +1332,7 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const status of supportedStatuses) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
-    await io.syncSkills({ client, gatewayUrl, env, label });
+    await io.syncSkills({ client, gatewayUrl, env, label, homeDir: os.homedir() });
     if (status.target === "chatgpt") io.secureCodexHome(tenantPaths.chatgpt.codexHome);
   }
   await io.syncAgents({

package/src/commands/converge.js

@@ -2,7 +2,12 @@
 
 import { loadConfig, saveConfig, redactSecretText } from "../config.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
-import { printReconciliationSummary, reconcileAllTenants, selectDefaultTenant } from "../provisioning.js";
+import {
+  printReconciliationSummary,
+  reconcileAllTenants,
+  selectDefaultTenant,
+  vendorAppTargetReady,
+} from "../provisioning.js";
 import { fetchTenants } from "../tenants.js";
 import { promptText } from "../prompt.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
@@ -258,11 +263,17 @@ export async function cmdConverge(argv = [], overrides = {}) {
             return ["ready", "unavailable"].includes(profileReport.tenants[0]?.cli);
           },
           retryStep: () => retrySafeState(),
-          installVendorApp: (target) => retryTenant(async (product) => (
-            target === "all"
-            || product === target
-            || (target === "codex" && product === "chatgpt")
-          )),
+          // Succeed when the requested vendor app converged, even if the
+          // sibling app still fails: the goal check keeps demanding full
+          // tenant readiness, so recovery can approve one app at a time.
+          installVendorApp: async (target) => {
+            await retryTenant(async (product) => (
+              target === "all"
+              || product === target
+              || (target === "codex" && product === "chatgpt")
+            ));
+            return vendorAppTargetReady(retryReport, target);
+          },
         },
       }, overrides.recoveryOverrides || {});
       if (retryReport) mergeTenantReport(report, retryReport);

package/src/commands/launch.js

@@ -31,7 +31,12 @@ const CLAUDE_DIRECT_AUTH_ENV = [
 ];
 
 const CODEX_DIRECT_AUTH_ENV = ["CODEX_ACCESS_TOKEN", "CODEX_API_KEY", "OPENAI_API_KEY", "OPENAI_BASE_URL"];
-export { escapeWindowsBatchArgument, nativeSpawnInvocation, resolveNativeBinary } from "../nativeProcess.js";
+export {
+  escapeWindowsBareArgument,
+  escapeWindowsBatchArgument,
+  nativeSpawnInvocation,
+  resolveNativeBinary,
+} from "../nativeProcess.js";
 
 export const IMPEL_SPECIALIST_DELEGATION_INSTRUCTIONS = `You are running in an Impel tenant-scoped session. Before starting any non-trivial task, call the Impel MCP tool list_specialists. If exactly one available specialist clearly matches the user's request, its capabilities and its exclusions, delegate the complete request by calling start_specialist_run exactly once with a stable idempotency key, then call read_specialist_run until it reaches a terminal state. When the run succeeds, use the specialist's result as your response instead of redoing the work. If no specialist clearly matches, the tools are unavailable, or the run fails, continue normally yourself. Do not delegate trivial requests, do not call a specialist excluded from the request, and never invent a specialist result.`;
 

package/src/commands/setup.js

@@ -16,9 +16,11 @@ import {
   printReconciliationSummary,
   reconcileAllTenants,
   selectDefaultTenant,
+  vendorAppTargetReady,
 } from "../provisioning.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
+import { refreshUpdateCache, updateNoticeLine } from "../updates.js";
 import { restoreNativeProfiles } from "./use.js";
 
 const HELP = `impel setup - prepare every accessible Impel tenant
@@ -49,9 +51,9 @@ export function resolveTenantChoice(listing, { requested = null, answer = null,
   return selectDefaultTenant(listing, { currentTenantId });
 }
 
-async function probeGateway(gatewayUrl, pat, tenantId, fetchImpl = fetch) {
+async function probeGatewayOnce(gatewayUrl, pat, tenantId, fetchImpl, timeoutMs) {
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 5_000);
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetchImpl(`${gatewayUrl}/v1/models`, {
       headers: {
@@ -69,13 +71,28 @@ async function probeGateway(gatewayUrl, pat, tenantId, fetchImpl = fetch) {
   } catch (error) {
     return {
       reachable: false,
-      error: error?.name === "AbortError" ? "timed out after 5s" : redactSecretText(error?.message || error),
+      error: error?.name === "AbortError"
+        ? `timed out after ${Math.round(timeoutMs / 1000)}s`
+        : redactSecretText(error?.message || error),
     };
   } finally {
     clearTimeout(timeout);
   }
 }
 
+// A single short probe misreports a cold gateway (serverless cold start plus
+// long-haul latency) as unreachable, and that transient verdict gets baked
+// into the convergence failure message. Retry once with a longer deadline
+// before concluding the gateway is down.
+export async function probeGateway(gatewayUrl, pat, tenantId, fetchImpl = fetch, timeoutsMs = [5_000, 10_000]) {
+  let probe = { reachable: false, error: "not probed" };
+  for (const timeoutMs of timeoutsMs) {
+    probe = await probeGatewayOnce(gatewayUrl, pat, tenantId, fetchImpl, timeoutMs);
+    if (probe.reachable) return probe;
+  }
+  return probe;
+}
+
 function markProbeFailures(report, probes) {
   probes.forEach((probe, index) => {
     if (probe.reachable && !probe.rejected && probe.healthy !== false) return;
@@ -133,6 +150,8 @@ export async function cmdSetup(argv, overrides = {}) {
     isTTY: process.stdin.isTTY,
     platform: process.platform,
     environment: process.env,
+    refreshUpdateCache,
+    updateNoticeLine,
     ...overrides,
   };
   if (overrides.prepareWindowsClis && !overrides.preparePlatformClis) {
@@ -204,6 +223,25 @@ export async function cmdSetup(argv, overrides = {}) {
   for (const tenant of orderedTenants) {
     console.log(`  ${tenant.id}${tenant.id === selected.id ? " (CLI default)" : ""} — ${tenant.name}`);
   }
+
+  // Setup is where a stale CLI hurts most (it re-hits installer bugs newer
+  // releases already fixed), and on a first run the launch-time notice cache
+  // is still empty — so check synchronously here. The token was just verified
+  // over the network, and the registry fetch is bounded (10s) and best-effort.
+  // TTY-gated like maybePrintUpdateNotice: the nudge is for a human who can
+  // stop and update, not for scripted/CI setups.
+  if (io.isTTY && !["1", "true"].includes(io.environment.IMPEL_SKIP_UPDATE_CHECK)) {
+    try {
+      const updateCache = await io.refreshUpdateCache();
+      const updateNotice = io.updateNoticeLine({ cache: updateCache });
+      if (updateNotice) {
+        console.warn(updateNotice);
+        console.warn("A newer impel-cli may already fix setup issues — consider updating first, then re-running `impel setup`.");
+      }
+    } catch {
+      // Never block setup on the update check.
+    }
+  }
   try {
     io.restoreNativeProfiles({ quiet: true });
   } catch (error) {
@@ -406,11 +444,17 @@ export async function cmdSetup(argv, overrides = {}) {
             return ["ready", "unavailable"].includes(profileReport.tenants[0]?.cli);
           },
           retryStep: () => retrySafeState(),
-          installVendorApp: (target) => retryTenant(async (product) => (
-            target === "all"
-            || product === target
-            || (target === "codex" && product === "chatgpt")
-          )),
+          // Succeed when the requested vendor app converged, even if the
+          // sibling app still fails: the goal check keeps demanding full
+          // tenant readiness, so recovery can approve one app at a time.
+          installVendorApp: async (target) => {
+            await retryTenant(async (product) => (
+              target === "all"
+              || product === target
+              || (target === "codex" && product === "chatgpt")
+            ));
+            return vendorAppTargetReady(retryReport, target);
+          },
         },
       }, overrides.recoveryOverrides || {});
       if (retryReport) mergeTenantReport(report, retryReport);

package/src/config.js

@@ -15,6 +15,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { renameWithWindowsRetry } from "./windowsFs.js";
+
 export const DEFAULT_GATEWAY_URL = "https://gateway.useimpel.com";
 export const DEFAULT_APP_URL = "https://www.useimpel.com";
 const LEGACY_GATEWAY_URLS = new Set(["https://gateway.useimpel.ai"]);
@@ -68,12 +70,22 @@ export function saveConfig(config) {
   fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
   const json = JSON.stringify(config, null, 2) + "\n";
   const tmpPath = `${CONFIG_PATH}.tmp-${process.pid}`;
-  fs.writeFileSync(tmpPath, json, { mode: 0o600 });
-  fs.renameSync(tmpPath, CONFIG_PATH);
   try {
-    fs.chmodSync(CONFIG_PATH, 0o600);
-  } catch {
-    // best-effort on platforms (e.g. Windows) where chmod is a no-op
+    fs.writeFileSync(tmpPath, json, { mode: 0o600 });
+    renameWithWindowsRetry(tmpPath, CONFIG_PATH);
+    try {
+      fs.chmodSync(CONFIG_PATH, 0o600);
+    } catch {
+      // best-effort on platforms (e.g. Windows) where chmod is a no-op
+    }
+  } finally {
+    try {
+      // The rename removed the tmp file in the normal case; never leave
+      // config.json.tmp-* litter behind a failed swap.
+      fs.rmSync(tmpPath, { force: true });
+    } catch {
+      // Cleanup must never mask the write/rename outcome.
+    }
   }
 }
 

package/src/macSetup.js

@@ -233,6 +233,8 @@ export async function prepareMacClis({
       gatewayUrl,
       env: { CLAUDE_CONFIG_DIR: claudeProfile.configDir },
       label: "Impel isolated Claude (impel claude)",
+      // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
+      homeDir: os.homedir(),
     });
   }
   if (binaries.codex) {
@@ -241,6 +243,7 @@ export async function prepareMacClis({
       gatewayUrl,
       env: { CODEX_HOME: codexProfile.codexHome },
       label: "Impel isolated Codex (impel codex)",
+      homeDir: os.homedir(),
     });
   }
 

package/src/nativeProcess.js

@@ -27,8 +27,13 @@ function isExecutable(filePath, platform = process.platform) {
     if (!fs.statSync(filePath).isFile()) return false;
     if (platform !== "win32") fs.accessSync(filePath, fs.constants.X_OK);
     return true;
-  } catch {
-    return false;
+  } catch (error) {
+    // Windows Store App Execution Aliases (winget.exe, python.exe, …) are
+    // zero-byte APPEXECLINK reparse points that CreateProcess launches fine,
+    // but fs.stat cannot read them on Node runtimes without libuv's
+    // AppExecLink fstat support. Those failures surface as EINVAL/UNKNOWN,
+    // never ENOENT, so an existing alias must still count as executable.
+    return platform === "win32" && ["EINVAL", "UNKNOWN"].includes(error?.code);
   }
 }
 
@@ -119,6 +124,12 @@ function commonCandidates(tool, environment, platform) {
       locations.push([paths.join(systemRoot, "System32", "WindowsPowerShell", "v1.0"), "powershell"]);
     }
 
+    // winget ships solely as a per-user App Execution Alias; cover its fixed
+    // home for environments whose PATH omits the WindowsApps directory.
+    if (tool === "winget" && localAppData) {
+      locations.push([paths.join(localAppData, "Microsoft", "WindowsApps"), "winget"]);
+    }
+
     // Git for Windows standard install roots; `cmd` holds the PATH-safe
     // git.exe. Codex shells out to git for marketplace clones, so skill
     // syncing must find git even when the parent shell's PATH predates the
@@ -183,13 +194,13 @@ export function resolveNativeBinary(
 
 // Windows cannot execute npm's .cmd/.bat shims directly. This is the escaping
 // strategy used by cross-spawn, inlined here to keep the CLI dependency-free.
-// Arguments are quoted individually and command metacharacters are escaped
-// twice because npm shims forward them through `%*`, causing a second parse.
+// Arguments are quoted individually and command metacharacters are
+// caret-escaped once per cmd parse the argument will go through.
 function escapeWindowsBatchCommand(value) {
   return String(value).replace(WINDOWS_SHELL_META_RE, "^$1");
 }
 
-export function escapeWindowsBatchArgument(value) {
+function encodeWindowsCommandArgument(value, metaEscapePasses) {
   let escaped = String(value);
   if (WINDOWS_UNSAFE_LINE_RE.test(escaped)) {
     throw new Error("cannot safely forward an argument containing a NUL or line break through a Windows batch shim");
@@ -197,17 +208,36 @@ export function escapeWindowsBatchArgument(value) {
   escaped = escaped.replace(/(?=(\\+?)?)\1"/gu, "$1$1\\\"");
   escaped = escaped.replace(/(?=(\\+?)?)\1$/gu, "$1$1");
   escaped = `"${escaped}"`;
-  escaped = escaped.replace(WINDOWS_SHELL_META_RE, "^$1");
-  return escaped.replace(WINDOWS_SHELL_META_RE, "^$1");
+  for (let pass = 0; pass < metaEscapePasses; pass += 1) {
+    escaped = escaped.replace(WINDOWS_SHELL_META_RE, "^$1");
+  }
+  return escaped;
+}
+
+// Batch shims re-read the command line through `%*`, so cmd parses these
+// arguments twice and the metacharacter escapes must survive both passes.
+export function escapeWindowsBatchArgument(value) {
+  return encodeWindowsCommandArgument(value, 2);
+}
+
+// A bare command name is resolved by cmd itself (covering App Execution
+// Aliases such as winget.exe that PATH stat probing cannot verify), but the
+// target program's command line is produced by cmd's single parse. Double
+// escaping here would deliver literal carets — winget then fails with
+// 0x8A150002 APPINSTALLER_CLI_ERROR_INVALID_CL_ARGUMENTS.
+export function escapeWindowsBareArgument(value) {
+  return encodeWindowsCommandArgument(value, 1);
 }
 
 export function nativeSpawnInvocation(binary, argv, environment = process.env, platform = process.platform) {
+  const batchShim = platform === "win32" && WINDOWS_BATCH_EXTENSION_RE.test(binary);
   const bareWindowsCommand = (
     platform === "win32"
+    && !batchShim
     && WINDOWS_BARE_COMMAND_RE.test(binary)
     && path.win32.basename(binary) === binary
   );
-  if (platform !== "win32" || (!WINDOWS_BATCH_EXTENSION_RE.test(binary) && !bareWindowsCommand)) {
+  if (platform !== "win32" || (!batchShim && !bareWindowsCommand)) {
     return { command: binary, args: argv, windowsVerbatimArguments: false };
   }
   if (WINDOWS_UNSAFE_LINE_RE.test(binary)) {
@@ -215,7 +245,7 @@ export function nativeSpawnInvocation(binary, argv, environment = process.env, p
   }
   const shellCommand = [
     escapeWindowsBatchCommand(pathApi(platform).normalize(binary)),
-    ...argv.map(escapeWindowsBatchArgument),
+    ...argv.map(batchShim ? escapeWindowsBatchArgument : escapeWindowsBareArgument),
   ].join(" ");
   return {
     command: environmentValue(environment, "ComSpec") || "cmd.exe",

package/src/provisioning.js

@@ -123,6 +123,8 @@ async function prepareTenantCli(config, tenant, io, binaries) {
         gatewayUrl,
         env: definition.env(profile),
         label: `Impel ${client === "claude" ? "Claude" : "Codex"} CLI (${tenant.id})`,
+        // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
+        homeDir: os.homedir(),
       });
       clients[client] = { status: "ready", root, error: null };
     } catch (error) {
@@ -247,6 +249,7 @@ export async function reconcileAllTenants({
     for (const tenant of liveTenants) {
       const result = results.get(tenant.id);
       let supported = new Set();
+      let failedTargets = new Set();
       try {
         const installed = await io.reconcileApps({
           baseConfig: config,
@@ -260,10 +263,17 @@ export async function reconcileAllTenants({
           confirmVendorInstall,
         }, overrides.appOverrides || {});
         supported = new Set(installed.targets || []);
+        const failedApps = installed.failed || [];
+        failedTargets = new Set(failedApps.map((failure) => failure.target));
         for (const target of supported) vendorPreparedTargets.add(target);
-        result.clients.claude.app = supported.has("claude") ? "ready" : "unsupported";
-        result.clients.codex.app = supported.has("chatgpt") ? "ready" : "unsupported";
-        result.apps = supported.size ? "ready" : "unavailable";
+        result.clients.claude.app = supported.has("claude")
+          ? "ready"
+          : failedTargets.has("claude") ? "failed" : "unsupported";
+        result.clients.codex.app = supported.has("chatgpt")
+          ? "ready"
+          : failedTargets.has("chatgpt") ? "failed" : "unsupported";
+        result.apps = failedTargets.size ? "failed" : supported.size ? "ready" : "unavailable";
+        for (const failure of failedApps) result.errors.push(redactSecretText(failure.error));
       } catch (error) {
         result.apps = "failed";
         for (const client of Object.values(result.clients)) {
@@ -276,9 +286,9 @@ export async function reconcileAllTenants({
       }
 
       if (supported.size === 0) {
-        result.shell = "unavailable";
-        result.clients.claude.shell = "unsupported";
-        result.clients.codex.shell = "unsupported";
+        result.shell = failedTargets.size ? "failed" : "unavailable";
+        result.clients.claude.shell = failedTargets.has("claude") ? "failed" : "unsupported";
+        result.clients.codex.shell = failedTargets.has("chatgpt") ? "failed" : "unsupported";
         continue;
       }
       try {
@@ -293,12 +303,15 @@ export async function reconcileAllTenants({
         const entryProducts = new Set(entries.map((entry) => entry.product));
         result.clients.claude.shell = supported.has("claude")
           ? (entryProducts.has("claude") ? "ready" : "failed")
-          : "unsupported";
+          : failedTargets.has("claude") ? "failed" : "unsupported";
         result.clients.codex.shell = supported.has("chatgpt")
           ? (entryProducts.has("chatgpt") ? "ready" : "failed")
-          : "unsupported";
-        result.shell = [...supported].every((target) => entryProducts.has(target)) ? "ready" : "failed";
-        if (result.shell === "failed") throw new Error("operating-system app registration did not complete");
+          : failedTargets.has("chatgpt") ? "failed" : "unsupported";
+        const registered = [...supported].every((target) => entryProducts.has(target));
+        // A failed vendor target has no launchable entry, so the tenant's
+        // launch surface stays failed even when every present app registered.
+        result.shell = registered && !failedTargets.size ? "ready" : "failed";
+        if (!registered) throw new Error("operating-system app registration did not complete");
       } catch (error) {
         result.shell = "failed";
         for (const client of Object.values(result.clients)) {
@@ -327,6 +340,19 @@ export async function reconcileAllTenants({
   };
 }
 
+/**
+ * Whether a single-tenant reconcile report shows the requested vendor app
+ * (claude, codex, or all) as converged. "unsupported" counts as converged:
+ * the tenant catalog offers nothing to install for that product.
+ */
+export function vendorAppTargetReady(report, target) {
+  const clients = report?.tenants?.[0]?.clients;
+  if (!clients) return false;
+  const converged = (client) => ["ready", "unsupported"].includes(client?.app);
+  if (target === "all") return converged(clients.claude) && converged(clients.codex);
+  return converged(target === "claude" ? clients.claude : clients.codex);
+}
+
 export function printReconciliationSummary(report, log = console.log) {
   log("Tenant readiness:");
   for (const tenant of report.tenants) {

package/src/skills.js

@@ -20,6 +20,7 @@
 // so we keep a per-client command table rather than assuming one shape.
 
 import { spawn } from "node:child_process";
+import fs from "node:fs";
 import path from "node:path";
 
 import { resolveDefaultGateway, normalizeGatewayUrl } from "./config.js";
@@ -44,6 +45,17 @@ export const SKILLS_FALLBACK_GATEWAY_URL = "https://gateway.useimpel.ai";
 const BENIGN_OUTPUT = /already (exist|install|add|present|configur)|up[ -]?to[ -]?date|no changes|nothing to (do|update)/i;
 const TRANSIENT_SKILL_OUTPUT = /timed? out|timeout of \d+ms exceeded|ECONNRESET|ETIMEDOUT|EAI_AGAIN|network error|failed to download/i;
 
+// Codex `plugin marketplace upgrade` refreshes only Git marketplaces. A
+// registration recorded with a non-git source_type (impel-cli ≤0.6.1
+// registered from the marketplace.json manifest URL instead of the Git source
+// root, and a git-less machine falls back the same way) fails every upgrade
+// with this error until the marketplace is re-registered — re-`add`ing the
+// same name is an "already exists" no-op, so without the reregister heal the
+// profile keeps the snapshot recorded at registration forever and every sync
+// warns.
+const NON_GIT_MARKETPLACE_RE = /not configured as a git marketplace/i;
+const MARKETPLACE_NOT_FOUND_RE = /not found|no marketplace/i;
+
 const CLIENT_SPECS = {
   claude: {
     bin: "claude",
@@ -217,6 +229,44 @@ export function withGitEnvironment(env = {}, {
   };
 }
 
+/**
+ * A git-safe working directory for the vendor plugin commands on Windows.
+ *
+ * Claude Code resolves `git` with `where.exe` and rejects any candidate whose
+ * path sits INSIDE the process working directory — including subdirectories —
+ * as a planted-binary defense ("Command 'git' not found or is in an unsafe
+ * location (current directory)"). `impel setup` is typically run from
+ * %USERPROFILE%, which contains every per-user git install: the Impel-managed
+ * MinGit under ~/.config/impel/tools/git, Git for Windows under
+ * %LOCALAPPDATA%\Programs\Git, scoop shims, all of them. From a home-directory
+ * shell the vendor CLI therefore rejects a perfectly good git and every plugin
+ * clone fails, even though withGitEnvironment put git on the child's PATH.
+ *
+ * Plugin syncing never depends on the caller's cwd (the commands only touch
+ * the profile named by CLAUDE_CONFIG_DIR/CODEX_HOME), so spawn them from a
+ * managed, always-empty directory instead: it contains no binaries and is
+ * never an ancestor of a git install. Returns null off Windows, when the
+ * caller did not opt in with a home directory, or when the directory cannot
+ * be created (spawns then inherit the caller's cwd, today's behavior).
+ */
+export function skillSyncSpawnDirectory({
+  platform = process.platform,
+  homeDir = null,
+  mkdir = fs.mkdirSync,
+} = {}) {
+  if (platform !== "win32" || !homeDir) return null;
+  // Platform-native join: identical to win32 join on a real Windows machine,
+  // and produces a creatable path when tests exercise the win32 branch on a
+  // POSIX temp home.
+  const directory = path.join(homeDir, ".config", "impel", "tools", "spawn-cwd");
+  try {
+    mkdir(directory, { recursive: true });
+    return directory;
+  } catch {
+    return null;
+  }
+}
+
 const SKILL_COMMAND_TIMEOUT_MS = 120_000;
 const SKILL_COMMAND_OUTPUT_LIMIT = 10 * 1024 * 1024;
 
@@ -231,6 +281,7 @@ export function runSkillCommand(bin, args, env, {
   spawnImpl = spawn,
   timeoutMs = SKILL_COMMAND_TIMEOUT_MS,
   platform = process.platform,
+  cwd = undefined,
 } = {}) {
   const environment = { ...process.env, ...env };
   let invocation;
@@ -252,6 +303,9 @@ export function runSkillCommand(bin, args, env, {
       child = spawnImpl(invocation.command, invocation.args, {
         env: environment,
         stdio: ["ignore", "pipe", "pipe"],
+        // A git-safe working directory (see skillSyncSpawnDirectory); undefined
+        // inherits the caller's cwd.
+        ...(cwd ? { cwd } : {}),
         windowsVerbatimArguments: invocation.windowsVerbatimArguments,
         // One update run spawns ~150 of these cmd.exe-wrapped plugin commands
         // across tenants; keep them off-screen on Windows.
@@ -345,6 +399,43 @@ async function runSkillCommandWithRetry(run, bin, args, env) {
   return run(bin, args, env);
 }
 
+/**
+ * Heal a Codex marketplace whose stored registration cannot be upgraded by
+ * re-registering it: remove the stale record (which also drops its installed
+ * plugins), add the current Git source, then prove the refresh that just
+ * failed now works by re-running the exact same command. The install command
+ * that follows the refresh phase reinstalls the plugin from the fresh
+ * snapshot.
+ *
+ * Returns `{ repaired: true }` when every step landed, so the caller can drop
+ * the recorded failure; otherwise `{ repaired: false, reason }` names the step
+ * that broke so the sync warning stops being undiagnosable from user logs.
+ */
+async function reregisterCodexMarketplace({ run, bin, env, marketplaceName, sourceUrl, refreshArgs, logger, label }) {
+  const removed = await run(bin, ["plugin", "marketplace", "remove", marketplaceName], env);
+  if (!removed.ok && !MARKETPLACE_NOT_FOUND_RE.test(`${removed.stdout}\n${removed.stderr}`)) {
+    return { repaired: false, reason: `remove: ${firstLine(removed.stderr) || `exit ${removed.status}`}` };
+  }
+  const added = await runSkillCommandWithRetry(
+    run,
+    bin,
+    ["plugin", "marketplace", "add", sourceUrl],
+    env,
+  );
+  // "already exists" after a reported-successful remove means the stale record
+  // survived; that is a failed repair, not a benign outcome — so isBenign is
+  // deliberately NOT used here.
+  if (!added.ok) {
+    return { repaired: false, reason: `re-add: ${firstLine(added.stderr) || `exit ${added.status}`}` };
+  }
+  const refreshed = await runSkillCommandWithRetry(run, bin, refreshArgs, env);
+  if (!isBenign(refreshed)) {
+    return { repaired: false, reason: `re-refresh: ${firstLine(refreshed.stderr) || `exit ${refreshed.status}`}` };
+  }
+  logger.log(`Skills: re-registered the ${marketplaceName} marketplace for ${label} from its Git source.`);
+  return { repaired: true };
+}
+
 const MARKETPLACE_FETCH_TIMEOUT_MS = 30_000;
 
 // The gateway serves marketplace.json from a serverless function with an 8-15s
@@ -407,6 +498,7 @@ export async function syncSkills({
   logger = console,
   platform = process.platform,
   findGit = findNativeBinary,
+  homeDir = null,
 } = {}) {
   const spec = CLIENT_SPECS[client];
   if (!spec) {
@@ -420,9 +512,16 @@ export async function syncSkills({
     return { client, label: displayLabel, skipped: true, reason: "disabled" };
   }
 
+  // Callers that manage real profiles pass their home directory so Windows
+  // spawns happen from a git-safe cwd (see skillSyncSpawnDirectory).
+  const spawnDirectory = skillSyncSpawnDirectory({ platform, homeDir });
+  const runCommand = spawnDirectory
+    ? (commandBin, commandArgs, commandEnv) => run(commandBin, commandArgs, commandEnv, { cwd: spawnDirectory })
+    : run;
+
   try {
     // Confirm the binary and its `plugin` subcommand exist before doing anything.
-    const help = await run(spec.bin, ["plugin", "--help"], env);
+    const help = await runCommand(spec.bin, ["plugin", "--help"], env);
     if (help.missing) {
       logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${spec.bin}\` CLI not found on PATH.`);
       return { client, label: displayLabel, skipped: true, reason: "binary-missing" };
@@ -455,7 +554,7 @@ export async function syncSkills({
       marketplaceName,
     })[0];
     const registerResult = await runSkillCommandWithRetry(
-      run,
+      runCommand,
       spec.bin,
       registerCommand.args,
       env,
@@ -474,7 +573,7 @@ export async function syncSkills({
     // gives us the same dynamic name so refreshes can still use
     // PLUGIN@MARKETPLACE.
     if (!marketplaceName && !registerResult.missing) {
-      const listed = await run(spec.bin, ["plugin", "marketplace", "list", "--json"], env);
+      const listed = await runCommand(spec.bin, ["plugin", "marketplace", "list", "--json"], env);
       if (listed.ok) marketplaceName = resolveConfiguredMarketplaceName(listed.stdout, sourceUrl);
     }
 
@@ -485,7 +584,7 @@ export async function syncSkills({
     }).slice(1);
     for (const command of commands) {
       const result = await runSkillCommandWithRetry(
-        run,
+        runCommand,
         spec.bin,
         command.args,
         env,
@@ -494,9 +593,30 @@ export async function syncSkills({
         failures.push({ phase: command.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
         break;
       }
-      if (!isBenign(result)) {
-        failures.push({ phase: command.phase, reason: firstLine(result.stderr) || `exit ${result.status}` });
+      if (isBenign(result)) continue;
+      let reason = firstLine(result.stderr) || `exit ${result.status}`;
+      if (
+        client === "codex"
+        && command.phase === "refresh-marketplace"
+        && marketplaceName
+        && NON_GIT_MARKETPLACE_RE.test(`${result.stdout}\n${result.stderr}`)
+      ) {
+        const repair = await reregisterCodexMarketplace({
+          run: runCommand,
+          bin: spec.bin,
+          env,
+          marketplaceName,
+          sourceUrl,
+          refreshArgs: command.args,
+          logger,
+          label: displayLabel,
+        });
+        if (repair.repaired) continue;
+        // Keep the original refresh error primary, but name the repair step
+        // that broke so a failed heal is diagnosable from user logs.
+        reason += `; marketplace re-registration failed (${repair.reason})`;
       }
+      failures.push({ phase: command.phase, reason });
     }
 
     if (failures.length > 0) {

package/src/updates.js

@@ -13,6 +13,7 @@ import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 import { CONFIG_DIR } from "./config.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 
 export const UPDATE_CACHE_PATH = path.join(CONFIG_DIR, "update-check.json");
 export const UPDATE_CHECK_TTL_MS = 6 * 60 * 60 * 1000;
@@ -117,8 +118,16 @@ export function writeUpdateCache(patch) {
   const next = { ...(readUpdateCache() || {}), ...patch };
   fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
   const tmp = `${UPDATE_CACHE_PATH}.tmp-${process.pid}`;
-  fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
-  fs.renameSync(tmp, UPDATE_CACHE_PATH);
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    renameWithWindowsRetry(tmp, UPDATE_CACHE_PATH);
+  } finally {
+    try {
+      fs.rmSync(tmp, { force: true });
+    } catch {
+      // Cleanup must never mask the write/rename outcome.
+    }
+  }
   return next;
 }
 

package/src/windowsFs.js

@@ -0,0 +1,44 @@
+// Windows-aware rename for the CLI's atomic tmp→destination file swaps.
+//
+// fs.renameSync over an existing file is atomic-enough on every platform impel
+// supports, but on Windows the destination is frequently held open for a
+// moment by antivirus/search-indexer services scanning the bytes that were
+// JUST written — the rename then fails with EPERM/EACCES/EBUSY even though
+// nothing is wrong with either file. (Observed in the field: `impel setup`
+// saves config.json three times in quick succession and the third rename lost
+// the race to a scanner, aborting legacy-profile cleanup and leaving a
+// config.json.tmp-* file behind.) Retry briefly on exactly those transient
+// codes before giving up — the same class of retry graceful-fs and npm apply
+// to Windows renames. Non-Windows platforms never retry: there the codes
+// indicate real permission problems that must surface immediately.
+
+import fs from "node:fs";
+
+const TRANSIENT_WINDOWS_RENAME_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const RENAME_ATTEMPTS = 8;
+const RENAME_BACKOFF_STEP_MS = 50; // 50, 100, … 350ms between tries: ~1.4s worst case
+
+// Dependency-free synchronous sleep: Atomics.wait blocks without spinning the
+// CPU, and these writers are all synchronous call paths.
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/** Rename `from` onto `to`, retrying transient Windows sharing violations. */
+export function renameWithWindowsRetry(from, to, {
+  platform = process.platform,
+  rename = fs.renameSync,
+  sleep = sleepSync,
+  attempts = RENAME_ATTEMPTS,
+} = {}) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      rename(from, to);
+      return;
+    } catch (error) {
+      const transient = platform === "win32" && TRANSIENT_WINDOWS_RENAME_CODES.has(error?.code);
+      if (!transient || attempt >= attempts) throw error;
+      sleep(RENAME_BACKOFF_STEP_MS * attempt);
+    }
+  }
+}

package/src/windowsGit.js

@@ -14,6 +14,7 @@ import os from "node:os";
 import path from "node:path";
 
 import { nativeCommandInvocation, nativeSpawnInvocation } from "./nativeProcess.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 
 /**
  * The exact MinGit release the CLI may install. Never use `latest` or an
@@ -169,7 +170,8 @@ export async function provisionWindowsGit({
     // Replace atomically-enough: verified staging swaps in via a same-volume
     // rename, so discovery never sees a half-extracted tree.
     fs.rmSync(target, { recursive: true, force: true });
-    fs.renameSync(staging, target);
+    // Defender loves scanning freshly extracted executables; ride out the lock.
+    renameWithWindowsRetry(staging, target);
     const binary = managedGitBinary(target);
     logger.log(`Git: MinGit ${pin.version} ready (${binary}).`);
     return { installed: true, binary, version: pin.version };

package/src/windowsSetup.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import os from "node:os";
 
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile } from "./cliProfiles.js";
 import {
@@ -200,6 +201,8 @@ export async function prepareWindowsClis({
       gatewayUrl,
       env: { CLAUDE_CONFIG_DIR: claudeProfile.configDir },
       label: "Impel isolated Claude (impel claude)",
+      // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
+      homeDir: os.homedir(),
     });
   }
   if (binaries.codex) {
@@ -208,6 +211,7 @@ export async function prepareWindowsClis({
       gatewayUrl,
       env: { CODEX_HOME: codexProfile.codexHome },
       label: "Impel isolated Codex (impel codex)",
+      homeDir: os.homedir(),
     });
   }