impel-cli 0.17.6 → 0.17.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.6",
+  "version": "0.17.7",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -41,19 +41,26 @@ const APP_DEFINITIONS = {
 // CLI release therefore installs and accepts only the exact app builds tested
 // with its compatibility patches. Updating a pin requires a new CLI release.
 export const PINNED_VENDOR_APPS = Object.freeze({
+  // 1.22209.3 (the previous pin) routes every managed 3P gateway profile into
+  // the Claude Code marketing page at app://localhost/code/disabled: the
+  // desktop Code surface never becomes available, the hardcoded-off
+  // claude_code_web gate traps /code/*, and the page's "Back to Claude" link
+  // targets "/" so the persisted Code mode loops straight back. 1.20186.9 is
+  // the last build verified working end-to-end for gateway profiles. Do not
+  // re-upgrade without a verified fix for the Code-surface routing contract.
   claude: Object.freeze({
-    version: "1.22209.3",
-    claudeCodeVersion: "2.1.215",
-    claudeCodeCommit: "316ce99628e89900bf0b1328fed3b8fec0c0c92d",
+    version: "1.20186.9",
+    claudeCodeVersion: "2.1.209",
+    claudeCodeCommit: "0fe048596fd45e79e99353cbe2c3d1b1ac069568",
     bundleName: "Claude.app",
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.22209.3/Claude-babe11577dfefe3e209c06bd674628d862f0dbae.zip",
-        sha256: "b110e0fdb7b2601d80dfdd7893f7811de382de84c4586113e7873e28f17680fc",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.zip",
+        sha256: "9364648c74bd525aa293a28103eb37262a5553de21c7ca907766d7fc40623015",
       }),
       x64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.22209.3/Claude-babe11577dfefe3e209c06bd674628d862f0dbae.zip",
-        sha256: "b110e0fdb7b2601d80dfdd7893f7811de382de84c4586113e7873e28f17680fc",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.zip",
+        sha256: "9364648c74bd525aa293a28103eb37262a5553de21c7ca907766d7fc40623015",
       }),
     }),
   }),
@@ -85,10 +92,12 @@ const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning
 const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
 const FAST_MODE_AUTH_GATE = /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)&&!([A-Za-z_$][\w$]*)&&([A-Za-z_$][\w$]*)!=null&&\4\?\.requirements\?\.featureRequirements\?\.fast_mode!==!1/gu;
 const CHATGPT_RESOURCE_ROOT = "linked_vendor_resources_with_patched_asar";
-const CLAUDE_PLAN_USAGE_GUARD = "if(!Vve()){f8();return}if(!et().hasOrgPolicyBackend())return;if((r=yr())";
-const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `if(!Vve()){f8();return}${"".padEnd("if(!et().hasOrgPolicyBackend())return;".length, " ")}if((r=yr())`;
-const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===He&&s';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===He?s:Le?.agent??!1';
+const CLAUDE_PLAN_USAGE_GUARD = "if(!Ze().hasOrgPolicyBackend())return;if((r=fr())";
+const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `${"if(!wze())return;".padEnd("if(!Ze().hasOrgPolicyBackend())return;".length, " ")}if((r=fr())`;
+const CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch(`${ht()}/api/organizations/${o}/usage`,{signal:AbortSignal.timeout(mcr)})';
+const IMPEL_CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch("https://gateway.useimpel.com/ui/a/u",{headers:{key:dR(Oe()).apiKey}})'.padEnd(CLAUDE_PLAN_USAGE_REQUEST.length, " ");
+const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Be&&s';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Be?s:Le?.agent??!1';
 const CLAUDE_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!s||e.name.toLowerCase().includes(s))).slice(0,10)';
 const IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!s||e.name.toLowerCase().includes(s))&&("string"!=typeof y||e.name===y)).slice(0,10)';
 const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(null))';
@@ -174,7 +183,7 @@ export const CURRENT_CONFIG_VERSION = 17;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-20.3";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-21.1";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -245,6 +254,7 @@ export function bundleIsCurrent(status, {
       compatibility.patches?.followupBoundAgentEnable === 1
       && compatibility.patches?.followupBoundAgentFilter === 1
       && compatibility.patches?.followupBoundAgentChip === 1
+      && claudePatchSetMatchesCompatibility(compatibility)
       && managedClaudeRendererMatchesCompatibility(status, compatibility)
     ))
     && (status.target !== "chatgpt" || (
@@ -278,6 +288,36 @@ function wrapperLaunchesOnTahoe(status) {
   }
 }
 
+// The exact patch and renderer-asset groups this CLI build writes. A bundle
+// whose compatibility metadata records a DIFFERENT set — even a superset — was
+// built by different patching logic (e.g. a dev working tree that reused the
+// released fingerprint), so it must be reported stale and rebuilt rather than
+// trusted to behave like a reviewed release.
+const CLAUDE_COMPATIBILITY_PATCH_KEYS = Object.freeze([
+  "aggregatePlanUsageGuard",
+  "aggregatePlanUsageRequest",
+  "safeStorageName",
+  "followupBoundAgentEnable",
+  "followupBoundAgentFilter",
+  "followupBoundAgentChip",
+]);
+const CLAUDE_COMPATIBILITY_RENDERER_GROUPS = Object.freeze(["agentMentions"]);
+
+function claudePatchSetMatchesCompatibility(compatibility) {
+  try {
+    const patchKeys = Object.keys(compatibility.patches ?? {}).sort();
+    const rendererGroups = Object.keys(compatibility.rendererAssets ?? {}).sort();
+    return (
+      patchKeys.length === CLAUDE_COMPATIBILITY_PATCH_KEYS.length
+      && [...CLAUDE_COMPATIBILITY_PATCH_KEYS].sort().every((key, index) => patchKeys[index] === key)
+      && rendererGroups.length === CLAUDE_COMPATIBILITY_RENDERER_GROUPS.length
+      && [...CLAUDE_COMPATIBILITY_RENDERER_GROUPS].sort().every((key, index) => rendererGroups[index] === key)
+    );
+  } catch {
+    return false;
+  }
+}
+
 function managedClaudeRendererMatchesCompatibility(status, compatibility) {
   try {
     const renderers = compatibility.rendererAssets?.agentMentions;
@@ -618,27 +658,13 @@ export function installManagedAppFiles({
 
   const installed = [];
   for (const target of targets) {
-    if (target === "claude") {
-      migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
-      writeClaudeNative3PSelection(paths);
-      writeClaudeCodeSettings(paths);
-      writeClaudeConfig(paths, config, models);
-      ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
-    }
-    else {
-      writeChatGPTConfig(
-        paths,
-        config,
-        models,
-        vendorCodexModels,
-        chatgptInvocations,
-        generatedAt,
-      );
-      ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
-    }
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app
     // to be closed (see quitBlockingApps), so those paths never attempt one.
+    // A stale bundle is rebuilt BEFORE its profile config is rewritten: the
+    // generated config is only reviewed against the pinned vendor build, so a
+    // failed rebuild must leave the old bundle paired with its old config
+    // rather than stranding it with a contract written for a different app.
     if (bundleTargets.has(target)) {
       if (resolvedVendorPaths[target] && isVendableVendorApp(target, resolvedVendorPaths[target])) {
         assertPinnedVendorAppVersion(target, resolvedVendorPaths[target]);
@@ -656,6 +682,24 @@ export function installManagedAppFiles({
         fs.rmSync(appPaths(homeDir)[target].launcher, { recursive: true, force: true });
       }
     }
+    if (target === "claude") {
+      migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
+      writeClaudeNative3PSelection(paths);
+      writeClaudeCodeSettings(paths);
+      writeClaudeConfig(paths, config, models);
+      ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
+    }
+    else {
+      writeChatGPTConfig(
+        paths,
+        config,
+        models,
+        vendorCodexModels,
+        chatgptInvocations,
+        generatedAt,
+      );
+      ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
+    }
     installed.push({
       target,
       launcher: paths[target].launcher,
@@ -1672,6 +1716,23 @@ function patchFixedWidthAsarString(asarPath, original, replacement, label) {
 function patchClaudePlanUsageRequest(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");
+  const legacyPatches = [];
+  for (
+    let offset = source.indexOf(CLAUDE_PLAN_USAGE_REQUEST);
+    offset !== -1;
+    offset = source.indexOf(CLAUDE_PLAN_USAGE_REQUEST, offset + CLAUDE_PLAN_USAGE_REQUEST.length)
+  ) {
+    legacyPatches.push({
+      offset,
+      original: CLAUDE_PLAN_USAGE_REQUEST,
+      replacement: IMPEL_CLAUDE_PLAN_USAGE_REQUEST,
+    });
+  }
+  if (legacyPatches.length > 0) {
+    return applyFixedWidthAsarPatches(
+      asarPath, archive, legacyPatches, "Claude plan-usage gateway request",
+    );
+  }
   const credentialAccessor = source.match(
     /function ([A-Za-z_$][\w$]*)\(e\)\{var t;return [\s\S]{0,500}?\[custom-3p\] Credentials loaded from managed config/u,
   )?.[1];
@@ -1687,10 +1748,10 @@ function patchClaudePlanUsageRequest(asarPath) {
     return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude plan-usage gateway request");
   }
 
-  const requestPattern = /const ([A-Za-z_$][\w$]*)=`\$\{[A-Za-z_$][\w$]*\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage\$\{[A-Za-z_$][\w$]*\?"\?skip_spend=1":""\}`,([A-Za-z_$][\w$]*)=await ([A-Za-z_$][\w$]*)\.net\.fetch\(\1,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
+  const requestPattern = /([A-Za-z_$][\w$]*)\.net\.fetch\(`\$\{[A-Za-z_$][\w$]*\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage`,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
   const patches = [...source.matchAll(requestPattern)].map((match) => {
     const original = match[0];
-    const replacement = `const ${match[1]}="https://gateway.useimpel.com/ui/a/u",${match[2]}=await ${match[3]}.net.fetch(${match[1]},{headers:{key:${credentialAccessor}(${configAccessor}()).apiKey}})`;
+    const replacement = `${match[1]}.net.fetch("https://gateway.useimpel.com/ui/a/u",{headers:{key:${credentialAccessor}(${configAccessor}()).apiKey}})`;
     if (replacement.length > original.length) {
       throw new Error("Claude plan-usage gateway request replacement no longer fits the vendor ASAR contract");
     }

package/src/commands/apps.js

@@ -772,7 +772,7 @@ export async function cmdApps(argv, overrides = {}) {
     return refreshApps(targets, {
       staleOnly: Boolean(flags["stale-only"]),
       tenantId: flags.tenant || null,
-    });
+    }, overrides);
   }
   if (action === "uninstall") {
     const config = loadConfig();
@@ -1163,8 +1163,20 @@ function claudeConfigIsCurrent(configPath, config, gatewayUrl) {
 // run (config writes only, never a bundle swap, never quits anything) and
 // silent on any failure: it is invoked detached from the apps' token helper,
 // so there is no user to talk to and nothing may leak to stdout.
-async function refreshApps(targets, { staleOnly = false, tenantId = null } = {}) {
-  const stored = loadConfig();
+async function refreshApps(targets, { staleOnly = false, tenantId = null } = {}, overrides = {}) {
+  const io = {
+    loadStoredConfig: loadConfig,
+    selectedConfig: selectedAppConfig,
+    status: appStatus,
+    bundleCurrent: bundleIsCurrent,
+    fetchModels: fetchGatewayModels,
+    installFiles: installManagedAppFiles,
+    syncSkills: syncSkillsSafe,
+    syncAgents: syncAgentProfilesSafe,
+    secureCodexHome: secureManagedCodexHome,
+    ...overrides,
+  };
+  const stored = io.loadStoredConfig();
   if (!stored?.pat) return;
   const requestedTenantId = tenantId
     ? normalizeTenantId(tenantId)
@@ -1181,17 +1193,25 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
 
   let config;
   try {
-    config = await selectedAppConfig(targets, tenantId ? requestedTenantId : null);
+    config = await io.selectedConfig(targets, tenantId ? requestedTenantId : null);
   } catch {
     return;
   }
-  const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
-  const installedTargets = statuses.filter((status) => status.launcherInstalled);
+  // Refresh only targets whose installed bundle was built by THIS CLI's
+  // bundle logic. The generated config contract is reviewed against the
+  // pinned vendor build, so rewriting configs (and advancing the manifest)
+  // under a stale bundle would strand an old app with a config written for a
+  // different app version. Stale bundles wait for the next foreground
+  // install/open/update, which swaps bundle and config together.
+  const statuses = io.status(targets, os.homedir(), config.tenantId, config.tenantName);
+  const installedTargets = statuses.filter((status) => (
+    status.launcherInstalled && io.bundleCurrent(status)
+  ));
   if (installedTargets.length === 0) return;
 
   let catalog;
   try {
-    catalog = await fetchGatewayModels(config);
+    catalog = await io.fetchModels(config);
   } catch {
     return;
   }
@@ -1204,7 +1224,7 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
     supportedTargetSet.has(status.target)
   ));
   if (supportedStatuses.length === 0) return;
-  installManagedAppFiles({
+  io.installFiles({
     config,
     targets: supportedStatuses.map((status) => status.target),
     models: catalog.models,
@@ -1217,10 +1237,10 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const status of supportedStatuses) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
-    await syncSkillsSafe({ client, gatewayUrl, env, label });
-    if (status.target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
+    await io.syncSkills({ client, gatewayUrl, env, label });
+    if (status.target === "chatgpt") io.secureCodexHome(tenantPaths.chatgpt.codexHome);
   }
-  await syncAgentProfilesSafe({
+  await io.syncAgents({
     profiles: supportedStatuses.map((status) => appAgentProfile(status.target, tenantPaths)),
     gatewayUrl: config.gatewayUrl,
     credential: config.pat,