impel-cli 0.17.17 → 0.18.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.17",
+  "version": "0.18.1",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -209,7 +209,11 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // slow open path (and thus a full config rewrite) after a CLI update.
 // 19: Windows global installs bake the stable %LOCALAPPDATA% entry point into
 // hook/auth/MCP artifacts instead of the npm-prefix bin path.
-export const CURRENT_CONFIG_VERSION = 19;
+// 20: managed Claude sandbox disabled by default; the rewrite strips the old
+// strict sandbox keys from already-provisioned profiles.
+// 21: Windows Codex hooks use the pinned client's PowerShell execution
+// contract instead of cmd.exe quoting that failed every managed hook.
+export const CURRENT_CONFIG_VERSION = 21;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this

package/src/claudeSandbox.js

@@ -1,3 +1,7 @@
+// Every sandbox key impel-cli has ever written into a managed profile. The
+// active policy (below) sets only a subset; apply/restore use this full list to
+// strip keys the policy no longer owns, so a profile provisioned by an older,
+// stricter CLI is fully cleaned up rather than left with inert leftovers.
 const MANAGED_SANDBOX_KEYS = Object.freeze([
   "enabled",
   "failIfUnavailable",
@@ -18,20 +22,18 @@ function sameJsonValue(left, right) {
 }
 
 /**
- * Claude Code's strict, auto-allow sandbox profile.
+ * Impel's Claude sandbox policy: disabled.
  *
- * Native Windows does not implement Claude's sandbox. Keep it enabled so the
- * same profile becomes effective in WSL, but do not make native Windows fail
- * at startup solely because the platform cannot initialize it.
+ * Managed installs run Bash with the same unrestricted network and filesystem
+ * access as a plain Claude Code install. Only `enabled: false` is asserted; all
+ * other sandbox keys are left to the user and actively stripped from profiles
+ * an older, stricter CLI wrote (see MANAGED_SANDBOX_KEYS). The `platform`
+ * argument is retained for signature compatibility with callers and tests.
  */
+// eslint-disable-next-line no-unused-vars
 export function impelClaudeSandboxPolicy(platform = process.platform) {
   return {
-    enabled: true,
-    failIfUnavailable: platform !== "win32",
-    autoAllowBashIfSandboxed: true,
-    allowUnsandboxedCommands: false,
-    excludedCommands: [],
-    ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
+    enabled: false,
   };
 }
 
@@ -48,8 +50,13 @@ function applyImpelClaudeNetworkPermission(permissions) {
 export function applyImpelClaudeSandbox(settings, platform = process.platform) {
   const current = isJsonObject(settings.sandbox) ? settings.sandbox : {};
   const policy = impelClaudeSandboxPolicy(platform);
+  // Drop every key impel-cli has ever managed before re-applying the policy, so
+  // strict keys written by an older CLI (failIfUnavailable, allowUnsandboxed…)
+  // don't survive as leftovers alongside the new enabled:false.
+  const preserved = { ...current };
+  for (const key of MANAGED_SANDBOX_KEYS) delete preserved[key];
   settings.sandbox = {
-    ...current,
+    ...preserved,
     ...policy,
   };
   settings.permissions = applyImpelClaudeNetworkPermission(settings.permissions);

package/src/sessionHooks.js

@@ -141,10 +141,10 @@ function shellQuote(value) {
   return `'${String(value).replaceAll("'", `'"'"'`)}'`;
 }
 
-function windowsCommandQuote(value) {
+function powershellQuote(value) {
   const text = String(value);
-  if (/[\r\n\0%]/u.test(text)) throw new Error("cannot safely write this Windows hook command");
-  return `"${text.replaceAll('"', '""')}"`;
+  if (/[\r\n\0]/u.test(text)) throw new Error("cannot safely write this Windows hook command");
+  return `'${text.replaceAll("'", "''")}'`;
 }
 
 function canonicalize(value) {
@@ -209,10 +209,11 @@ export function ensureCodexSessionHooks(codexHome, tenantId, surface = "codex_cl
   const document = readJsonObject(hooksPath);
   const invocation = managedInvocation("codex", surface, tenantId);
   const unixCommand = [invocation.command, ...invocation.args].map(shellQuote).join(" ");
-  const windowsTokens = [invocation.command, ...invocation.args].map(windowsCommandQuote).join(" ");
-  // Codex executes commandWindows with `cmd.exe /C`. The outer quote preserves
-  // a quoted executable path when it contains spaces.
-  const windowsCommand = `"${windowsTokens}"`;
+  const windowsTokens = [invocation.command, ...invocation.args].map(powershellQuote).join(" ");
+  // Codex runs commandWindows through the session's normal Windows shell,
+  // which is PowerShell. A quoted executable is only invoked when prefixed by
+  // the call operator; cmd.exe's doubled outer-quote form is invalid here.
+  const windowsCommand = `& ${windowsTokens}`;
   const handler = {
     type: "command",
     command: unixCommand,