impel-cli 0.17.2 → 0.17.3

package/README.md

@@ -311,3 +311,18 @@ run a real package manager, or modify native personal profiles.
 
 CI runs on Ubuntu, macOS, and Windows with supported Node versions. See
 [RELEASING.md](RELEASING.md) for the npm release process.
+
+The macOS config-contract job downloads the exact ChatGPT archive declared in
+`PINNED_VENDOR_APPS`, verifies its checksum, signature, app version, and
+embedded Codex version, then validates a deterministic generated profile with
+Codex's strict config loader. A ChatGPT pin update must also update the embedded
+Codex version and the reviewed config fixture when its contract changes.
+
+The pinned Claude contract job likewise force-downloads the exact desktop app,
+verifies the embedded Claude Code release manifest, builds the managed bundle
+with ad-hoc signing, and checks deterministic generated desktop and Claude Code
+settings against a reviewed fixture. The manifest-selected Claude Code runtime
+runs `doctor` in bare mode against an isolated profile; CI intercepts the
+`security` command so the check cannot read, reset, unlock, or modify a
+Keychain. A Claude pin update must also update its `claudeCodeVersion` and
+`claudeCodeCommit` pins and reviewed contract fixture.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -43,6 +43,8 @@ const APP_DEFINITIONS = {
 export const PINNED_VENDOR_APPS = Object.freeze({
   claude: Object.freeze({
     version: "1.20186.9",
+    claudeCodeVersion: "2.1.209",
+    claudeCodeCommit: "0fe048596fd45e79e99353cbe2c3d1b1ac069568",
     bundleName: "Claude.app",
     downloads: Object.freeze({
       arm64: Object.freeze({
@@ -57,6 +59,7 @@ export const PINNED_VENDOR_APPS = Object.freeze({
   }),
   chatgpt: Object.freeze({
     version: "26.707.72221",
+    codexVersion: "0.144.2",
     bundleName: "ChatGPT.app",
     downloads: Object.freeze({
       arm64: Object.freeze({
@@ -589,6 +592,7 @@ export function installManagedAppFiles({
   writeTokenHelperFile = true,
   claudeUserData = null,
   chatgptInvocations = null,
+  generatedAt = new Date().toISOString(),
 }) {
   // true = rebuild every target's bundle; false = configs only; an array
   // limits the expensive rebuild to just the stale targets.
@@ -621,7 +625,14 @@ export function installManagedAppFiles({
       ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
     }
     else {
-      writeChatGPTConfig(paths, config, models, vendorCodexModels, chatgptInvocations);
+      writeChatGPTConfig(
+        paths,
+        config,
+        models,
+        vendorCodexModels,
+        chatgptInvocations,
+        generatedAt,
+      );
       ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
     }
     // Non-bundle targets are the background-refresh / fast-open path: configs,
@@ -666,7 +677,7 @@ export function installManagedAppFiles({
       config,
     ),
     models: models.map((model) => model.id),
-    updatedAt: new Date().toISOString(),
+    updatedAt: generatedAt,
   }, null, 2) + "\n", 0o600);
   return installed;
 }
@@ -815,10 +826,13 @@ function installPinnedVendorApp(target, homeDir) {
   }
 }
 
-export function ensureVendorApp(target, { homeDir = os.homedir() } = {}) {
+export function ensureVendorApp(target, {
+  homeDir = os.homedir(),
+  forceDownload = false,
+} = {}) {
   const definition = APP_DEFINITIONS[target];
   const pin = PINNED_VENDOR_APPS[target];
-  const current = findVendorApp(target, homeDir);
+  const current = forceDownload ? null : findVendorApp(target, homeDir);
   if (current) return { path: current, action: "existing", note: `verified ${pin.version}` };
 
   // Name-collision transparency: e.g. OpenAI's native ChatGPT chat app
@@ -974,7 +988,14 @@ function writeClaudeDefaultApp(paths) {
   writeAtomic(configPath, JSON.stringify(next, null, 2) + "\n", 0o600);
 }
 
-function writeChatGPTConfig(paths, config, models, vendorCodexModels, invocations = null) {
+function writeChatGPTConfig(
+  paths,
+  config,
+  models,
+  vendorCodexModels,
+  invocations = null,
+  generatedAt = new Date().toISOString(),
+) {
   const experimental = crossAppModelsEnabled(config);
   const orderedModels = experimental
     ? [...models.filter((model) => model.provider === "codex"), ...models.filter((model) => model.provider === "claude")]
@@ -1008,7 +1029,7 @@ function writeChatGPTConfig(paths, config, models, vendorCodexModels, invocation
     ? configuredTier
     : (configuredTier === "fast" && supportedTiers.includes("priority") ? "priority" : null);
   const catalog = {
-    fetched_at: new Date().toISOString(),
+    fetched_at: generatedAt,
     client_version: "impel-managed-2",
     models: codexModels,
   };
@@ -1209,18 +1230,27 @@ function codexCatalogEntry(model, index, vendorModel) {
 function readVendorCodexModels(vendorPath) {
   const binary = vendorPath && path.join(vendorPath, "Contents", "Resources", "codex");
   if (!binary || !fs.existsSync(binary)) return new Map();
-  const env = { ...process.env };
-  delete env.CODEX_HOME;
-  for (const args of [["debug", "models"], ["debug", "models", "--bundled"]]) {
-    const result = spawnSync(binary, args, { encoding: "utf8", env, maxBuffer: 20 * 1024 * 1024 });
-    if (result.status !== 0) continue;
+  const codexHome = fs.mkdtempSync(path.join(os.tmpdir(), "impel-vendor-codex-models-"));
+  try {
+    // Vendor enrichment must come only from the exact bundled release. Reading
+    // the operator's native CODEX_HOME here would make generated app configs
+    // depend on unrelated local state and could trigger an online catalog read.
+    const env = { ...process.env, CODEX_HOME: codexHome };
+    const result = spawnSync(binary, ["debug", "models", "--bundled"], {
+      encoding: "utf8",
+      env,
+      maxBuffer: 20 * 1024 * 1024,
+    });
+    if (result.status !== 0) return new Map();
     try {
       const payload = JSON.parse(result.stdout);
       const models = Array.isArray(payload) ? payload : payload.models;
       if (Array.isArray(models)) return new Map(models.map((model) => [model.slug, model]));
     } catch {
-      // Fall through to the bundled catalog or the Impel-generated schema.
+      // Fall through to the Impel-generated schema.
     }
+  } finally {
+    fs.rmSync(codexHome, { recursive: true, force: true });
   }
   return new Map();
 }