impel-cli 0.17.16 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.16",
+  "version": "0.18.0",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/agents.js

@@ -12,6 +12,7 @@ import path from "node:path";
 import { normalizeGatewayUrl, redactSecretText } from "./config.js";
 import { impelMcpInvocation } from "./selfInvocation.js";
 import { normalizeTenantId } from "./tenants.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 
 export const AGENT_SYNC_TTL_MS = 6 * 60 * 60 * 1000;
 export const MANAGED_AGENT_DIRECTORY = "impel-managed";
@@ -52,7 +53,7 @@ function atomicPrivateWrite(filePath, contents) {
   const temporaryPath = `${filePath}.tmp-${process.pid}-${crypto.randomBytes(4).toString("hex")}`;
   try {
     fs.writeFileSync(temporaryPath, contents, { mode: 0o600 });
-    fs.renameSync(temporaryPath, filePath);
+    renameWithWindowsRetry(temporaryPath, filePath);
     try {
       fs.chmodSync(filePath, 0o600);
     } catch {

package/src/apps.js

@@ -209,7 +209,9 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // slow open path (and thus a full config rewrite) after a CLI update.
 // 19: Windows global installs bake the stable %LOCALAPPDATA% entry point into
 // hook/auth/MCP artifacts instead of the npm-prefix bin path.
-export const CURRENT_CONFIG_VERSION = 19;
+// 20: managed Claude sandbox disabled by default; the rewrite strips the old
+// strict sandbox keys from already-provisioned profiles.
+export const CURRENT_CONFIG_VERSION = 20;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this

package/src/claudeSandbox.js

@@ -1,3 +1,7 @@
+// Every sandbox key impel-cli has ever written into a managed profile. The
+// active policy (below) sets only a subset; apply/restore use this full list to
+// strip keys the policy no longer owns, so a profile provisioned by an older,
+// stricter CLI is fully cleaned up rather than left with inert leftovers.
 const MANAGED_SANDBOX_KEYS = Object.freeze([
   "enabled",
   "failIfUnavailable",
@@ -18,20 +22,18 @@ function sameJsonValue(left, right) {
 }
 
 /**
- * Claude Code's strict, auto-allow sandbox profile.
+ * Impel's Claude sandbox policy: disabled.
  *
- * Native Windows does not implement Claude's sandbox. Keep it enabled so the
- * same profile becomes effective in WSL, but do not make native Windows fail
- * at startup solely because the platform cannot initialize it.
+ * Managed installs run Bash with the same unrestricted network and filesystem
+ * access as a plain Claude Code install. Only `enabled: false` is asserted; all
+ * other sandbox keys are left to the user and actively stripped from profiles
+ * an older, stricter CLI wrote (see MANAGED_SANDBOX_KEYS). The `platform`
+ * argument is retained for signature compatibility with callers and tests.
  */
+// eslint-disable-next-line no-unused-vars
 export function impelClaudeSandboxPolicy(platform = process.platform) {
   return {
-    enabled: true,
-    failIfUnavailable: platform !== "win32",
-    autoAllowBashIfSandboxed: true,
-    allowUnsandboxedCommands: false,
-    excludedCommands: [],
-    ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
+    enabled: false,
   };
 }
 
@@ -48,8 +50,13 @@ function applyImpelClaudeNetworkPermission(permissions) {
 export function applyImpelClaudeSandbox(settings, platform = process.platform) {
   const current = isJsonObject(settings.sandbox) ? settings.sandbox : {};
   const policy = impelClaudeSandboxPolicy(platform);
+  // Drop every key impel-cli has ever managed before re-applying the policy, so
+  // strict keys written by an older CLI (failIfUnavailable, allowUnsandboxed…)
+  // don't survive as leftovers alongside the new enabled:false.
+  const preserved = { ...current };
+  for (const key of MANAGED_SANDBOX_KEYS) delete preserved[key];
   settings.sandbox = {
-    ...current,
+    ...preserved,
     ...policy,
   };
   settings.permissions = applyImpelClaudeNetworkPermission(settings.permissions);

package/src/cliProfiles.js

@@ -12,6 +12,7 @@ import { CONFIG_DIR } from "./config.js";
 import { normalizeTenantId } from "./tenants.js";
 import { impelCliInvocation, impelMcpInvocation } from "./selfInvocation.js";
 import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
@@ -55,7 +56,7 @@ function writePrivateFile(filePath, contents) {
   const temporaryPath = `${filePath}.tmp-${process.pid}`;
   try {
     fs.writeFileSync(temporaryPath, contents, { mode: 0o600 });
-    fs.renameSync(temporaryPath, filePath);
+    renameWithWindowsRetry(temporaryPath, filePath);
     try {
       fs.chmodSync(filePath, 0o600);
     } catch {

package/src/commands/apps.js

@@ -446,7 +446,7 @@ export async function reconcileWindowsTenantApps({
     // Merge the sync env so an app-embedded binary (IMPEL_CODEX_BIN) satisfies
     // the availability check even when no standalone CLI is installed.
     if (io.findBinary(client, { ...environment, ...env }, "win32")) {
-      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label });
+      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label, homeDir: os.homedir() });
       agentTargets.push(target);
     } else {
       io.log(`Skipping skill/agent sync for ${label} — no ${client === "claude" ? "Claude Code" : "Codex"} binary is available to run plugin commands.`);
@@ -553,7 +553,7 @@ export async function reconcileMacTenantApps({
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     if (io.findBinary(client, environment, "darwin")) {
-      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label });
+      await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label, homeDir: os.homedir() });
       agentItems.push(item);
     }
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
@@ -794,6 +794,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
               gatewayUrl: resolveSkillsGateway(config.gatewayUrl),
               env,
               label,
+              homeDir: os.homedir(),
               logger: createProgressLogger(spinner),
             })
           ));
@@ -1036,7 +1037,7 @@ export async function cmdApps(argv, overrides = {}) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     if (!flags["skip-skills"]) {
       await withProgress(`Syncing skills for ${label}`, (spinner) => (
-        io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
+        io.syncSkills({ client, gatewayUrl, env, label, homeDir: os.homedir(), logger: createProgressLogger(spinner) })
       ));
     }
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
@@ -1167,7 +1168,7 @@ export async function provisionAndOpenManagedApps({
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
     await withProgress(`Syncing skills for ${label}`, (spinner) => (
-      io.syncSkills({ client, gatewayUrl, env, label, logger: createProgressLogger(spinner) })
+      io.syncSkills({ client, gatewayUrl, env, label, homeDir: os.homedir(), logger: createProgressLogger(spinner) })
     ));
     if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
   }
@@ -1331,7 +1332,7 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const status of supportedStatuses) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
-    await io.syncSkills({ client, gatewayUrl, env, label });
+    await io.syncSkills({ client, gatewayUrl, env, label, homeDir: os.homedir() });
     if (status.target === "chatgpt") io.secureCodexHome(tenantPaths.chatgpt.codexHome);
   }
   await io.syncAgents({

package/src/commands/setup.js

@@ -20,6 +20,7 @@ import {
 } from "../provisioning.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
+import { refreshUpdateCache, updateNoticeLine } from "../updates.js";
 import { restoreNativeProfiles } from "./use.js";
 
 const HELP = `impel setup - prepare every accessible Impel tenant
@@ -149,6 +150,8 @@ export async function cmdSetup(argv, overrides = {}) {
     isTTY: process.stdin.isTTY,
     platform: process.platform,
     environment: process.env,
+    refreshUpdateCache,
+    updateNoticeLine,
     ...overrides,
   };
   if (overrides.prepareWindowsClis && !overrides.preparePlatformClis) {
@@ -220,6 +223,25 @@ export async function cmdSetup(argv, overrides = {}) {
   for (const tenant of orderedTenants) {
     console.log(`  ${tenant.id}${tenant.id === selected.id ? " (CLI default)" : ""} — ${tenant.name}`);
   }
+
+  // Setup is where a stale CLI hurts most (it re-hits installer bugs newer
+  // releases already fixed), and on a first run the launch-time notice cache
+  // is still empty — so check synchronously here. The token was just verified
+  // over the network, and the registry fetch is bounded (10s) and best-effort.
+  // TTY-gated like maybePrintUpdateNotice: the nudge is for a human who can
+  // stop and update, not for scripted/CI setups.
+  if (io.isTTY && !["1", "true"].includes(io.environment.IMPEL_SKIP_UPDATE_CHECK)) {
+    try {
+      const updateCache = await io.refreshUpdateCache();
+      const updateNotice = io.updateNoticeLine({ cache: updateCache });
+      if (updateNotice) {
+        console.warn(updateNotice);
+        console.warn("A newer impel-cli may already fix setup issues — consider updating first, then re-running `impel setup`.");
+      }
+    } catch {
+      // Never block setup on the update check.
+    }
+  }
   try {
     io.restoreNativeProfiles({ quiet: true });
   } catch (error) {

package/src/config.js

@@ -15,6 +15,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { renameWithWindowsRetry } from "./windowsFs.js";
+
 export const DEFAULT_GATEWAY_URL = "https://gateway.useimpel.com";
 export const DEFAULT_APP_URL = "https://www.useimpel.com";
 const LEGACY_GATEWAY_URLS = new Set(["https://gateway.useimpel.ai"]);
@@ -68,12 +70,22 @@ export function saveConfig(config) {
   fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
   const json = JSON.stringify(config, null, 2) + "\n";
   const tmpPath = `${CONFIG_PATH}.tmp-${process.pid}`;
-  fs.writeFileSync(tmpPath, json, { mode: 0o600 });
-  fs.renameSync(tmpPath, CONFIG_PATH);
   try {
-    fs.chmodSync(CONFIG_PATH, 0o600);
-  } catch {
-    // best-effort on platforms (e.g. Windows) where chmod is a no-op
+    fs.writeFileSync(tmpPath, json, { mode: 0o600 });
+    renameWithWindowsRetry(tmpPath, CONFIG_PATH);
+    try {
+      fs.chmodSync(CONFIG_PATH, 0o600);
+    } catch {
+      // best-effort on platforms (e.g. Windows) where chmod is a no-op
+    }
+  } finally {
+    try {
+      // The rename removed the tmp file in the normal case; never leave
+      // config.json.tmp-* litter behind a failed swap.
+      fs.rmSync(tmpPath, { force: true });
+    } catch {
+      // Cleanup must never mask the write/rename outcome.
+    }
   }
 }
 

package/src/macSetup.js

@@ -233,6 +233,8 @@ export async function prepareMacClis({
       gatewayUrl,
       env: { CLAUDE_CONFIG_DIR: claudeProfile.configDir },
       label: "Impel isolated Claude (impel claude)",
+      // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
+      homeDir: os.homedir(),
     });
   }
   if (binaries.codex) {
@@ -241,6 +243,7 @@ export async function prepareMacClis({
       gatewayUrl,
       env: { CODEX_HOME: codexProfile.codexHome },
       label: "Impel isolated Codex (impel codex)",
+      homeDir: os.homedir(),
     });
   }
 

package/src/provisioning.js

@@ -123,6 +123,8 @@ async function prepareTenantCli(config, tenant, io, binaries) {
         gatewayUrl,
         env: definition.env(profile),
         label: `Impel ${client === "claude" ? "Claude" : "Codex"} CLI (${tenant.id})`,
+        // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
+        homeDir: os.homedir(),
       });
       clients[client] = { status: "ready", root, error: null };
     } catch (error) {

package/src/skills.js

@@ -20,6 +20,7 @@
 // so we keep a per-client command table rather than assuming one shape.
 
 import { spawn } from "node:child_process";
+import fs from "node:fs";
 import path from "node:path";
 
 import { resolveDefaultGateway, normalizeGatewayUrl } from "./config.js";
@@ -45,10 +46,13 @@ const BENIGN_OUTPUT = /already (exist|install|add|present|configur)|up[ -]?to[ -
 const TRANSIENT_SKILL_OUTPUT = /timed? out|timeout of \d+ms exceeded|ECONNRESET|ETIMEDOUT|EAI_AGAIN|network error|failed to download/i;
 
 // Codex `plugin marketplace upgrade` refreshes only Git marketplaces. A
-// registration recorded with a non-git source_type (an older Codex, or a
-// git-less fallback at registration time) fails every upgrade with this error
-// until the marketplace is re-registered — otherwise the profile keeps the
-// snapshot cloned at registration forever and every sync warns.
+// registration recorded with a non-git source_type (impel-cli ≤0.6.1
+// registered from the marketplace.json manifest URL instead of the Git source
+// root, and a git-less machine falls back the same way) fails every upgrade
+// with this error until the marketplace is re-registered — re-`add`ing the
+// same name is an "already exists" no-op, so without the reregister heal the
+// profile keeps the snapshot recorded at registration forever and every sync
+// warns.
 const NON_GIT_MARKETPLACE_RE = /not configured as a git marketplace/i;
 const MARKETPLACE_NOT_FOUND_RE = /not found|no marketplace/i;
 
@@ -225,6 +229,44 @@ export function withGitEnvironment(env = {}, {
   };
 }
 
+/**
+ * A git-safe working directory for the vendor plugin commands on Windows.
+ *
+ * Claude Code resolves `git` with `where.exe` and rejects any candidate whose
+ * path sits INSIDE the process working directory — including subdirectories —
+ * as a planted-binary defense ("Command 'git' not found or is in an unsafe
+ * location (current directory)"). `impel setup` is typically run from
+ * %USERPROFILE%, which contains every per-user git install: the Impel-managed
+ * MinGit under ~/.config/impel/tools/git, Git for Windows under
+ * %LOCALAPPDATA%\Programs\Git, scoop shims, all of them. From a home-directory
+ * shell the vendor CLI therefore rejects a perfectly good git and every plugin
+ * clone fails, even though withGitEnvironment put git on the child's PATH.
+ *
+ * Plugin syncing never depends on the caller's cwd (the commands only touch
+ * the profile named by CLAUDE_CONFIG_DIR/CODEX_HOME), so spawn them from a
+ * managed, always-empty directory instead: it contains no binaries and is
+ * never an ancestor of a git install. Returns null off Windows, when the
+ * caller did not opt in with a home directory, or when the directory cannot
+ * be created (spawns then inherit the caller's cwd, today's behavior).
+ */
+export function skillSyncSpawnDirectory({
+  platform = process.platform,
+  homeDir = null,
+  mkdir = fs.mkdirSync,
+} = {}) {
+  if (platform !== "win32" || !homeDir) return null;
+  // Platform-native join: identical to win32 join on a real Windows machine,
+  // and produces a creatable path when tests exercise the win32 branch on a
+  // POSIX temp home.
+  const directory = path.join(homeDir, ".config", "impel", "tools", "spawn-cwd");
+  try {
+    mkdir(directory, { recursive: true });
+    return directory;
+  } catch {
+    return null;
+  }
+}
+
 const SKILL_COMMAND_TIMEOUT_MS = 120_000;
 const SKILL_COMMAND_OUTPUT_LIMIT = 10 * 1024 * 1024;
 
@@ -239,6 +281,7 @@ export function runSkillCommand(bin, args, env, {
   spawnImpl = spawn,
   timeoutMs = SKILL_COMMAND_TIMEOUT_MS,
   platform = process.platform,
+  cwd = undefined,
 } = {}) {
   const environment = { ...process.env, ...env };
   let invocation;
@@ -260,6 +303,9 @@ export function runSkillCommand(bin, args, env, {
       child = spawnImpl(invocation.command, invocation.args, {
         env: environment,
         stdio: ["ignore", "pipe", "pipe"],
+        // A git-safe working directory (see skillSyncSpawnDirectory); undefined
+        // inherits the caller's cwd.
+        ...(cwd ? { cwd } : {}),
         windowsVerbatimArguments: invocation.windowsVerbatimArguments,
         // One update run spawns ~150 of these cmd.exe-wrapped plugin commands
         // across tenants; keep them off-screen on Windows.
@@ -356,14 +402,19 @@ async function runSkillCommandWithRetry(run, bin, args, env) {
 /**
  * Heal a Codex marketplace whose stored registration cannot be upgraded by
  * re-registering it: remove the stale record (which also drops its installed
- * plugins) and add the current source. The install command that follows the
- * refresh phase reinstalls the plugin from the fresh snapshot. Returns true
- * only when the re-registration fully succeeded.
+ * plugins), add the current Git source, then prove the refresh that just
+ * failed now works by re-running the exact same command. The install command
+ * that follows the refresh phase reinstalls the plugin from the fresh
+ * snapshot.
+ *
+ * Returns `{ repaired: true }` when every step landed, so the caller can drop
+ * the recorded failure; otherwise `{ repaired: false, reason }` names the step
+ * that broke so the sync warning stops being undiagnosable from user logs.
  */
-async function reregisterCodexMarketplace({ run, bin, env, marketplaceName, sourceUrl }) {
+async function reregisterCodexMarketplace({ run, bin, env, marketplaceName, sourceUrl, refreshArgs, logger, label }) {
   const removed = await run(bin, ["plugin", "marketplace", "remove", marketplaceName], env);
   if (!removed.ok && !MARKETPLACE_NOT_FOUND_RE.test(`${removed.stdout}\n${removed.stderr}`)) {
-    return false;
+    return { repaired: false, reason: `remove: ${firstLine(removed.stderr) || `exit ${removed.status}`}` };
   }
   const added = await runSkillCommandWithRetry(
     run,
@@ -371,7 +422,18 @@ async function reregisterCodexMarketplace({ run, bin, env, marketplaceName, sour
     ["plugin", "marketplace", "add", sourceUrl],
     env,
   );
-  return added.ok;
+  // "already exists" after a reported-successful remove means the stale record
+  // survived; that is a failed repair, not a benign outcome — so isBenign is
+  // deliberately NOT used here.
+  if (!added.ok) {
+    return { repaired: false, reason: `re-add: ${firstLine(added.stderr) || `exit ${added.status}`}` };
+  }
+  const refreshed = await runSkillCommandWithRetry(run, bin, refreshArgs, env);
+  if (!isBenign(refreshed)) {
+    return { repaired: false, reason: `re-refresh: ${firstLine(refreshed.stderr) || `exit ${refreshed.status}`}` };
+  }
+  logger.log(`Skills: re-registered the ${marketplaceName} marketplace for ${label} from its Git source.`);
+  return { repaired: true };
 }
 
 const MARKETPLACE_FETCH_TIMEOUT_MS = 30_000;
@@ -436,6 +498,7 @@ export async function syncSkills({
   logger = console,
   platform = process.platform,
   findGit = findNativeBinary,
+  homeDir = null,
 } = {}) {
   const spec = CLIENT_SPECS[client];
   if (!spec) {
@@ -449,9 +512,16 @@ export async function syncSkills({
     return { client, label: displayLabel, skipped: true, reason: "disabled" };
   }
 
+  // Callers that manage real profiles pass their home directory so Windows
+  // spawns happen from a git-safe cwd (see skillSyncSpawnDirectory).
+  const spawnDirectory = skillSyncSpawnDirectory({ platform, homeDir });
+  const runCommand = spawnDirectory
+    ? (commandBin, commandArgs, commandEnv) => run(commandBin, commandArgs, commandEnv, { cwd: spawnDirectory })
+    : run;
+
   try {
     // Confirm the binary and its `plugin` subcommand exist before doing anything.
-    const help = await run(spec.bin, ["plugin", "--help"], env);
+    const help = await runCommand(spec.bin, ["plugin", "--help"], env);
     if (help.missing) {
       logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${spec.bin}\` CLI not found on PATH.`);
       return { client, label: displayLabel, skipped: true, reason: "binary-missing" };
@@ -484,7 +554,7 @@ export async function syncSkills({
       marketplaceName,
     })[0];
     const registerResult = await runSkillCommandWithRetry(
-      run,
+      runCommand,
       spec.bin,
       registerCommand.args,
       env,
@@ -503,7 +573,7 @@ export async function syncSkills({
     // gives us the same dynamic name so refreshes can still use
     // PLUGIN@MARKETPLACE.
     if (!marketplaceName && !registerResult.missing) {
-      const listed = await run(spec.bin, ["plugin", "marketplace", "list", "--json"], env);
+      const listed = await runCommand(spec.bin, ["plugin", "marketplace", "list", "--json"], env);
       if (listed.ok) marketplaceName = resolveConfiguredMarketplaceName(listed.stdout, sourceUrl);
     }
 
@@ -514,7 +584,7 @@ export async function syncSkills({
     }).slice(1);
     for (const command of commands) {
       const result = await runSkillCommandWithRetry(
-        run,
+        runCommand,
         spec.bin,
         command.args,
         env,
@@ -524,22 +594,29 @@ export async function syncSkills({
         break;
       }
       if (isBenign(result)) continue;
+      let reason = firstLine(result.stderr) || `exit ${result.status}`;
       if (
         client === "codex"
         && command.phase === "refresh-marketplace"
         && marketplaceName
         && NON_GIT_MARKETPLACE_RE.test(`${result.stdout}\n${result.stderr}`)
       ) {
-        const reregistered = await reregisterCodexMarketplace({
-          run,
+        const repair = await reregisterCodexMarketplace({
+          run: runCommand,
           bin: spec.bin,
           env,
           marketplaceName,
           sourceUrl,
+          refreshArgs: command.args,
+          logger,
+          label: displayLabel,
         });
-        if (reregistered) continue;
+        if (repair.repaired) continue;
+        // Keep the original refresh error primary, but name the repair step
+        // that broke so a failed heal is diagnosable from user logs.
+        reason += `; marketplace re-registration failed (${repair.reason})`;
       }
-      failures.push({ phase: command.phase, reason: firstLine(result.stderr) || `exit ${result.status}` });
+      failures.push({ phase: command.phase, reason });
     }
 
     if (failures.length > 0) {

package/src/updates.js

@@ -13,6 +13,7 @@ import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 import { CONFIG_DIR } from "./config.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 
 export const UPDATE_CACHE_PATH = path.join(CONFIG_DIR, "update-check.json");
 export const UPDATE_CHECK_TTL_MS = 6 * 60 * 60 * 1000;
@@ -117,8 +118,16 @@ export function writeUpdateCache(patch) {
   const next = { ...(readUpdateCache() || {}), ...patch };
   fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
   const tmp = `${UPDATE_CACHE_PATH}.tmp-${process.pid}`;
-  fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
-  fs.renameSync(tmp, UPDATE_CACHE_PATH);
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    renameWithWindowsRetry(tmp, UPDATE_CACHE_PATH);
+  } finally {
+    try {
+      fs.rmSync(tmp, { force: true });
+    } catch {
+      // Cleanup must never mask the write/rename outcome.
+    }
+  }
   return next;
 }
 

package/src/windowsFs.js

@@ -0,0 +1,44 @@
+// Windows-aware rename for the CLI's atomic tmp→destination file swaps.
+//
+// fs.renameSync over an existing file is atomic-enough on every platform impel
+// supports, but on Windows the destination is frequently held open for a
+// moment by antivirus/search-indexer services scanning the bytes that were
+// JUST written — the rename then fails with EPERM/EACCES/EBUSY even though
+// nothing is wrong with either file. (Observed in the field: `impel setup`
+// saves config.json three times in quick succession and the third rename lost
+// the race to a scanner, aborting legacy-profile cleanup and leaving a
+// config.json.tmp-* file behind.) Retry briefly on exactly those transient
+// codes before giving up — the same class of retry graceful-fs and npm apply
+// to Windows renames. Non-Windows platforms never retry: there the codes
+// indicate real permission problems that must surface immediately.
+
+import fs from "node:fs";
+
+const TRANSIENT_WINDOWS_RENAME_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const RENAME_ATTEMPTS = 8;
+const RENAME_BACKOFF_STEP_MS = 50; // 50, 100, … 350ms between tries: ~1.4s worst case
+
+// Dependency-free synchronous sleep: Atomics.wait blocks without spinning the
+// CPU, and these writers are all synchronous call paths.
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/** Rename `from` onto `to`, retrying transient Windows sharing violations. */
+export function renameWithWindowsRetry(from, to, {
+  platform = process.platform,
+  rename = fs.renameSync,
+  sleep = sleepSync,
+  attempts = RENAME_ATTEMPTS,
+} = {}) {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      rename(from, to);
+      return;
+    } catch (error) {
+      const transient = platform === "win32" && TRANSIENT_WINDOWS_RENAME_CODES.has(error?.code);
+      if (!transient || attempt >= attempts) throw error;
+      sleep(RENAME_BACKOFF_STEP_MS * attempt);
+    }
+  }
+}

package/src/windowsGit.js

@@ -14,6 +14,7 @@ import os from "node:os";
 import path from "node:path";
 
 import { nativeCommandInvocation, nativeSpawnInvocation } from "./nativeProcess.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 
 /**
  * The exact MinGit release the CLI may install. Never use `latest` or an
@@ -169,7 +170,8 @@ export async function provisionWindowsGit({
     // Replace atomically-enough: verified staging swaps in via a same-volume
     // rename, so discovery never sees a half-extracted tree.
     fs.rmSync(target, { recursive: true, force: true });
-    fs.renameSync(staging, target);
+    // Defender loves scanning freshly extracted executables; ride out the lock.
+    renameWithWindowsRetry(staging, target);
     const binary = managedGitBinary(target);
     logger.log(`Git: MinGit ${pin.version} ready (${binary}).`);
     return { installed: true, binary, version: pin.version };

package/src/windowsSetup.js

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import os from "node:os";
 
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile } from "./cliProfiles.js";
 import {
@@ -200,6 +201,8 @@ export async function prepareWindowsClis({
       gatewayUrl,
       env: { CLAUDE_CONFIG_DIR: claudeProfile.configDir },
       label: "Impel isolated Claude (impel claude)",
+      // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
+      homeDir: os.homedir(),
     });
   }
   if (binaries.codex) {
@@ -208,6 +211,7 @@ export async function prepareWindowsClis({
       gatewayUrl,
       env: { CODEX_HOME: codexProfile.codexHome },
       label: "Impel isolated Codex (impel codex)",
+      homeDir: os.homedir(),
     });
   }