impel-cli 0.17.4 → 0.17.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.4",
+  "version": "0.17.6",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -165,7 +165,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 16;
+export const CURRENT_CONFIG_VERSION = 17;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -174,7 +174,7 @@ export const CURRENT_CONFIG_VERSION = 16;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-20.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-20.3";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -620,7 +620,7 @@ export function installManagedAppFiles({
   for (const target of targets) {
     if (target === "claude") {
       migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
-      writeClaudeDefaultApp(paths);
+      writeClaudeNative3PSelection(paths);
       writeClaudeCodeSettings(paths);
       writeClaudeConfig(paths, config, models);
       ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
@@ -911,16 +911,16 @@ function writeClaudeConfig(paths, config, models) {
     inferenceGatewayAuthScheme: "bearer",
     modelDiscoveryEnabled: false,
     inferenceModels: claudeModels,
-    // 3P builds leave Chat unavailable unless the administrator opts in. The
-    // Code install/disabled screen's "Back to Claude" link targets the Chat
-    // root; without this key the root router selects Code again and strands
-    // gateway users in a loop even though inference is healthy.
+    // These are Anthropic's native managed 3P surface controls. Cowork and
+    // Code default to enabled in the pinned build, but state them explicitly
+    // so an older generated profile cannot leave either surface disabled.
+    coworkTabEnabled: true,
+    isClaudeCodeForDesktopEnabled: true,
+    // Chat is the only opt-in surface in the pinned build.
     chatTabEnabled: true,
-    // Managed flat key (maps to authentication.disableClaudeAiSignIn, vendor
-    // 1.3834.0+): hides the Claude.ai sign-in option and keeps the app in 3P
-    // mode even when the persisted deploymentMode is missing or "1p". Claude.ai
-    // account login is a dead end for gateway profiles anyway — the server
-    // rejects it with custom_3p_not_available.
+    // Native managed flat key (maps to authentication.disableClaudeAiSignIn):
+    // with an inference config present the pinned app selects 3P and hides the
+    // inapplicable Claude.ai sign-in option.
     disableDeploymentModeChooser: true,
   };
   writeAtomic(path.join(dir, `${CLAUDE_CONFIG_ID}.json`), JSON.stringify(body, null, 2) + "\n", 0o600);
@@ -947,7 +947,7 @@ function writeClaudeCodeSettings(paths) {
   writeAtomic(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, 0o600);
 }
 
-function writeClaudeDefaultApp(paths) {
+function writeClaudeNative3PSelection(paths) {
   const configPath = path.join(paths.claude.userData, "claude_desktop_config.json");
   let current = {};
   if (fs.existsSync(configPath)) {
@@ -960,33 +960,13 @@ function writeClaudeDefaultApp(paths) {
   if (!current || typeof current !== "object" || Array.isArray(current)) {
     throw new Error(`Claude desktop config must contain a JSON object: ${configPath}`);
   }
-  const preferences = current.preferences ?? {};
-  if (!preferences || typeof preferences !== "object" || Array.isArray(preferences)) {
-    throw new Error(`Claude desktop preferences must contain a JSON object: ${configPath}`);
-  }
-  // The desktop app gates its UI on a persisted top-level `deploymentMode`:
-  // until it is "3p", every launch lands on the sign-in / provider-chooser
-  // screen — even though the applied configLibrary gateway config loads fine —
-  // and Claude.ai email login is server-disabled for 3P profiles
-  // (custom_3p_not_available). A managed gateway profile is only ever 3P, so
-  // enforce the key like the sandbox policy (heal "1p"/cleared values too,
-  // e.g. after an in-app sign-out), not seed-once like a user preference.
-  const needsDeploymentMode = current.deploymentMode !== "3p";
-  // Claude persists the selected top-level app as `preferences.sidebarMode`.
-  // Seed Code for a new isolated profile, then leave subsequent user choices
-  // alone during install, update, and background config refreshes.
-  const needsSidebarMode = !Object.hasOwn(preferences, "sidebarMode");
-  if (!needsDeploymentMode && !needsSidebarMode) return;
-  const next = {
-    ...current,
-    ...(needsDeploymentMode ? { deploymentMode: "3p" } : {}),
-    preferences: needsSidebarMode ? { ...preferences, sidebarMode: "code" } : preferences,
-  };
-  // A vendor sign-out writes `awaitingSignIn: true` alongside "1p". Left in
-  // place it re-arms the app's quit-time revert — which deletes deploymentMode
-  // again — should the gateway config ever fail to load. Drop it when healing.
-  if (needsDeploymentMode) delete next.awaitingSignIn;
-  writeAtomic(configPath, JSON.stringify(next, null, 2) + "\n", 0o600);
+  // Mirror the pinned app's native "select 3P" persistence contract. This
+  // marks the first-run choice complete and clears a pending 1P sign-in while
+  // leaving Claude-owned preferences (including sidebarMode) untouched.
+  if (current.deploymentMode === "3p" && !Object.hasOwn(current, "awaitingSignIn")) return;
+  const next = { ...current, deploymentMode: "3p" };
+  delete next.awaitingSignIn;
+  writeAtomic(configPath, `${JSON.stringify(next, null, 2)}\n`, 0o600);
 }
 
 function writeChatGPTConfig(
@@ -1407,7 +1387,7 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
     const vendorExecutable = path.join(macos, executableName);
     const signingIdentity = resolveVendoredAppSigningIdentity(vendorExecutable);
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 5,
+      schemaVersion: 7,
       cliVersion: CLI_VERSION,
       bundleFingerprint: BUNDLE_BUILD_FINGERPRINT,
       signingMode: signingModeForIdentity(signingIdentity),
@@ -1565,31 +1545,48 @@ function linkVendoredChatGPTResources(bundle, vendorBundleName) {
 }
 
 function patchClaudeFollowupAgentMentions(bundle) {
+  const assets = patchClaudeRendererContracts(bundle, {
+    supportLabel: "follow-up agent mentions",
+    patchLabel: "follow-up agent-mention",
+    contracts: [
+      {
+        key: "enable",
+        original: CLAUDE_DRAFT_AGENT_MENTIONS,
+        replacement: IMPEL_CLAUDE_BOUND_AGENT_MENTIONS,
+      },
+      {
+        key: "filter",
+        original: CLAUDE_AGENT_MENTION_FILTER,
+        replacement: IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER,
+      },
+      {
+        key: "chip",
+        original: CLAUDE_AGENT_MENTION_SELECT,
+        replacement: IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT,
+      },
+    ],
+  });
+  return {
+    enable: 1,
+    filter: 1,
+    chip: 1,
+    assets,
+  };
+}
+
+function patchClaudeRendererContracts(bundle, {
+  supportLabel,
+  patchLabel,
+  contracts,
+}) {
   const version = bundleVersion(bundle);
   if (version !== PINNED_VENDOR_APPS.claude.version) {
     throw new Error(
-      `Claude follow-up agent mentions support is pinned to ${PINNED_VENDOR_APPS.claude.version}; found ${version || "unknown"}`,
+      `Claude ${supportLabel} support is pinned to ${PINNED_VENDOR_APPS.claude.version}; found ${version || "unknown"}`,
     );
   }
 
   const ionDist = path.join(bundle, "Contents", "Resources", "ion-dist");
-  const contracts = [
-    {
-      key: "enable",
-      original: CLAUDE_DRAFT_AGENT_MENTIONS,
-      replacement: IMPEL_CLAUDE_BOUND_AGENT_MENTIONS,
-    },
-    {
-      key: "filter",
-      original: CLAUDE_AGENT_MENTION_FILTER,
-      replacement: IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER,
-    },
-    {
-      key: "chip",
-      original: CLAUDE_AGENT_MENTION_SELECT,
-      replacement: IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT,
-    },
-  ];
   const sources = new Map(listJavaScriptFiles(ionDist).map((candidate) => [
     candidate,
     fs.readFileSync(candidate, "utf8"),
@@ -1604,7 +1601,7 @@ function patchClaudeFollowupAgentMentions(bundle) {
   for (const contract of contracts) {
     const count = matches.get(contract.key).reduce((total, match) => total + match.count, 0);
     if (count !== 1) {
-      throw new Error(`Claude follow-up agent-mention ${contract.key} patch expected 1 match, found ${count}`);
+      throw new Error(`Claude ${patchLabel} ${contract.key} patch expected 1 match, found ${count}`);
     }
   }
 
@@ -1626,12 +1623,7 @@ function patchClaudeFollowupAgentMentions(bundle) {
     });
   }
 
-  return {
-    enable: 1,
-    filter: 1,
-    chip: 1,
-    assets,
-  };
+  return assets;
 }
 
 function listJavaScriptFiles(root) {