impel-cli 0.17.17 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.17",
+  "version": "0.18.0",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -209,7 +209,9 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // slow open path (and thus a full config rewrite) after a CLI update.
 // 19: Windows global installs bake the stable %LOCALAPPDATA% entry point into
 // hook/auth/MCP artifacts instead of the npm-prefix bin path.
-export const CURRENT_CONFIG_VERSION = 19;
+// 20: managed Claude sandbox disabled by default; the rewrite strips the old
+// strict sandbox keys from already-provisioned profiles.
+export const CURRENT_CONFIG_VERSION = 20;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this

package/src/claudeSandbox.js

@@ -1,3 +1,7 @@
+// Every sandbox key impel-cli has ever written into a managed profile. The
+// active policy (below) sets only a subset; apply/restore use this full list to
+// strip keys the policy no longer owns, so a profile provisioned by an older,
+// stricter CLI is fully cleaned up rather than left with inert leftovers.
 const MANAGED_SANDBOX_KEYS = Object.freeze([
   "enabled",
   "failIfUnavailable",
@@ -18,20 +22,18 @@ function sameJsonValue(left, right) {
 }
 
 /**
- * Claude Code's strict, auto-allow sandbox profile.
+ * Impel's Claude sandbox policy: disabled.
  *
- * Native Windows does not implement Claude's sandbox. Keep it enabled so the
- * same profile becomes effective in WSL, but do not make native Windows fail
- * at startup solely because the platform cannot initialize it.
+ * Managed installs run Bash with the same unrestricted network and filesystem
+ * access as a plain Claude Code install. Only `enabled: false` is asserted; all
+ * other sandbox keys are left to the user and actively stripped from profiles
+ * an older, stricter CLI wrote (see MANAGED_SANDBOX_KEYS). The `platform`
+ * argument is retained for signature compatibility with callers and tests.
  */
+// eslint-disable-next-line no-unused-vars
 export function impelClaudeSandboxPolicy(platform = process.platform) {
   return {
-    enabled: true,
-    failIfUnavailable: platform !== "win32",
-    autoAllowBashIfSandboxed: true,
-    allowUnsandboxedCommands: false,
-    excludedCommands: [],
-    ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
+    enabled: false,
   };
 }
 
@@ -48,8 +50,13 @@ function applyImpelClaudeNetworkPermission(permissions) {
 export function applyImpelClaudeSandbox(settings, platform = process.platform) {
   const current = isJsonObject(settings.sandbox) ? settings.sandbox : {};
   const policy = impelClaudeSandboxPolicy(platform);
+  // Drop every key impel-cli has ever managed before re-applying the policy, so
+  // strict keys written by an older CLI (failIfUnavailable, allowUnsandboxed…)
+  // don't survive as leftovers alongside the new enabled:false.
+  const preserved = { ...current };
+  for (const key of MANAGED_SANDBOX_KEYS) delete preserved[key];
   settings.sandbox = {
-    ...current,
+    ...preserved,
     ...policy,
   };
   settings.permissions = applyImpelClaudeNetworkPermission(settings.permissions);