impel-cli 0.17.6 → 0.17.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.6",
+  "version": "0.17.8",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -41,19 +41,26 @@ const APP_DEFINITIONS = {
 // CLI release therefore installs and accepts only the exact app builds tested
 // with its compatibility patches. Updating a pin requires a new CLI release.
 export const PINNED_VENDOR_APPS = Object.freeze({
+  // 1.22209.3 (the previous pin) routes every managed 3P gateway profile into
+  // the Claude Code marketing page at app://localhost/code/disabled: the
+  // desktop Code surface never becomes available, the hardcoded-off
+  // claude_code_web gate traps /code/*, and the page's "Back to Claude" link
+  // targets "/" so the persisted Code mode loops straight back. 1.20186.9 is
+  // the last build verified working end-to-end for gateway profiles. Do not
+  // re-upgrade without a verified fix for the Code-surface routing contract.
   claude: Object.freeze({
-    version: "1.22209.3",
-    claudeCodeVersion: "2.1.215",
-    claudeCodeCommit: "316ce99628e89900bf0b1328fed3b8fec0c0c92d",
+    version: "1.20186.9",
+    claudeCodeVersion: "2.1.209",
+    claudeCodeCommit: "0fe048596fd45e79e99353cbe2c3d1b1ac069568",
     bundleName: "Claude.app",
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.22209.3/Claude-babe11577dfefe3e209c06bd674628d862f0dbae.zip",
-        sha256: "b110e0fdb7b2601d80dfdd7893f7811de382de84c4586113e7873e28f17680fc",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.zip",
+        sha256: "9364648c74bd525aa293a28103eb37262a5553de21c7ca907766d7fc40623015",
       }),
       x64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.22209.3/Claude-babe11577dfefe3e209c06bd674628d862f0dbae.zip",
-        sha256: "b110e0fdb7b2601d80dfdd7893f7811de382de84c4586113e7873e28f17680fc",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.20186.9/Claude-69f150a4c9316d5c8cd7b9f130ed583d15c0383e.zip",
+        sha256: "9364648c74bd525aa293a28103eb37262a5553de21c7ca907766d7fc40623015",
       }),
     }),
   }),
@@ -85,10 +92,12 @@ const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning
 const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
 const FAST_MODE_AUTH_GATE = /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)&&!([A-Za-z_$][\w$]*)&&([A-Za-z_$][\w$]*)!=null&&\4\?\.requirements\?\.featureRequirements\?\.fast_mode!==!1/gu;
 const CHATGPT_RESOURCE_ROOT = "linked_vendor_resources_with_patched_asar";
-const CLAUDE_PLAN_USAGE_GUARD = "if(!Vve()){f8();return}if(!et().hasOrgPolicyBackend())return;if((r=yr())";
-const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `if(!Vve()){f8();return}${"".padEnd("if(!et().hasOrgPolicyBackend())return;".length, " ")}if((r=yr())`;
-const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===He&&s';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===He?s:Le?.agent??!1';
+const CLAUDE_PLAN_USAGE_GUARD = "if(!Ze().hasOrgPolicyBackend())return;if((r=fr())";
+const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `${"if(!wze())return;".padEnd("if(!Ze().hasOrgPolicyBackend())return;".length, " ")}if((r=fr())`;
+const CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch(`${ht()}/api/organizations/${o}/usage`,{signal:AbortSignal.timeout(mcr)})';
+const IMPEL_CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch("https://gateway.useimpel.com/ui/a/u",{headers:{key:dR(Oe()).apiKey}})'.padEnd(CLAUDE_PLAN_USAGE_REQUEST.length, " ");
+const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Be&&s';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Be?s:Le?.agent??!1';
 const CLAUDE_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!s||e.name.toLowerCase().includes(s))).slice(0,10)';
 const IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!s||e.name.toLowerCase().includes(s))&&("string"!=typeof y||e.name===y)).slice(0,10)';
 const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(null))';
@@ -174,7 +183,7 @@ export const CURRENT_CONFIG_VERSION = 17;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-20.3";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-21.1";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -245,6 +254,7 @@ export function bundleIsCurrent(status, {
       compatibility.patches?.followupBoundAgentEnable === 1
       && compatibility.patches?.followupBoundAgentFilter === 1
       && compatibility.patches?.followupBoundAgentChip === 1
+      && claudePatchSetMatchesCompatibility(compatibility)
       && managedClaudeRendererMatchesCompatibility(status, compatibility)
     ))
     && (status.target !== "chatgpt" || (
@@ -278,6 +288,36 @@ function wrapperLaunchesOnTahoe(status) {
   }
 }
 
+// The exact patch and renderer-asset groups this CLI build writes. A bundle
+// whose compatibility metadata records a DIFFERENT set — even a superset — was
+// built by different patching logic (e.g. a dev working tree that reused the
+// released fingerprint), so it must be reported stale and rebuilt rather than
+// trusted to behave like a reviewed release.
+const CLAUDE_COMPATIBILITY_PATCH_KEYS = Object.freeze([
+  "aggregatePlanUsageGuard",
+  "aggregatePlanUsageRequest",
+  "safeStorageName",
+  "followupBoundAgentEnable",
+  "followupBoundAgentFilter",
+  "followupBoundAgentChip",
+]);
+const CLAUDE_COMPATIBILITY_RENDERER_GROUPS = Object.freeze(["agentMentions"]);
+
+function claudePatchSetMatchesCompatibility(compatibility) {
+  try {
+    const patchKeys = Object.keys(compatibility.patches ?? {}).sort();
+    const rendererGroups = Object.keys(compatibility.rendererAssets ?? {}).sort();
+    return (
+      patchKeys.length === CLAUDE_COMPATIBILITY_PATCH_KEYS.length
+      && [...CLAUDE_COMPATIBILITY_PATCH_KEYS].sort().every((key, index) => patchKeys[index] === key)
+      && rendererGroups.length === CLAUDE_COMPATIBILITY_RENDERER_GROUPS.length
+      && [...CLAUDE_COMPATIBILITY_RENDERER_GROUPS].sort().every((key, index) => rendererGroups[index] === key)
+    );
+  } catch {
+    return false;
+  }
+}
+
 function managedClaudeRendererMatchesCompatibility(status, compatibility) {
   try {
     const renderers = compatibility.rendererAssets?.agentMentions;
@@ -618,27 +658,13 @@ export function installManagedAppFiles({
 
   const installed = [];
   for (const target of targets) {
-    if (target === "claude") {
-      migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
-      writeClaudeNative3PSelection(paths);
-      writeClaudeCodeSettings(paths);
-      writeClaudeConfig(paths, config, models);
-      ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
-    }
-    else {
-      writeChatGPTConfig(
-        paths,
-        config,
-        models,
-        vendorCodexModels,
-        chatgptInvocations,
-        generatedAt,
-      );
-      ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
-    }
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app
     // to be closed (see quitBlockingApps), so those paths never attempt one.
+    // A stale bundle is rebuilt BEFORE its profile config is rewritten: the
+    // generated config is only reviewed against the pinned vendor build, so a
+    // failed rebuild must leave the old bundle paired with its old config
+    // rather than stranding it with a contract written for a different app.
     if (bundleTargets.has(target)) {
       if (resolvedVendorPaths[target] && isVendableVendorApp(target, resolvedVendorPaths[target])) {
         assertPinnedVendorAppVersion(target, resolvedVendorPaths[target]);
@@ -656,6 +682,24 @@ export function installManagedAppFiles({
         fs.rmSync(appPaths(homeDir)[target].launcher, { recursive: true, force: true });
       }
     }
+    if (target === "claude") {
+      migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
+      writeClaudeNative3PSelection(paths);
+      writeClaudeCodeSettings(paths);
+      writeClaudeConfig(paths, config, models);
+      ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
+    }
+    else {
+      writeChatGPTConfig(
+        paths,
+        config,
+        models,
+        vendorCodexModels,
+        chatgptInvocations,
+        generatedAt,
+      );
+      ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
+    }
     installed.push({
       target,
       launcher: paths[target].launcher,
@@ -1672,6 +1716,23 @@ function patchFixedWidthAsarString(asarPath, original, replacement, label) {
 function patchClaudePlanUsageRequest(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");
+  const legacyPatches = [];
+  for (
+    let offset = source.indexOf(CLAUDE_PLAN_USAGE_REQUEST);
+    offset !== -1;
+    offset = source.indexOf(CLAUDE_PLAN_USAGE_REQUEST, offset + CLAUDE_PLAN_USAGE_REQUEST.length)
+  ) {
+    legacyPatches.push({
+      offset,
+      original: CLAUDE_PLAN_USAGE_REQUEST,
+      replacement: IMPEL_CLAUDE_PLAN_USAGE_REQUEST,
+    });
+  }
+  if (legacyPatches.length > 0) {
+    return applyFixedWidthAsarPatches(
+      asarPath, archive, legacyPatches, "Claude plan-usage gateway request",
+    );
+  }
   const credentialAccessor = source.match(
     /function ([A-Za-z_$][\w$]*)\(e\)\{var t;return [\s\S]{0,500}?\[custom-3p\] Credentials loaded from managed config/u,
   )?.[1];
@@ -1687,10 +1748,10 @@ function patchClaudePlanUsageRequest(asarPath) {
     return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude plan-usage gateway request");
   }
 
-  const requestPattern = /const ([A-Za-z_$][\w$]*)=`\$\{[A-Za-z_$][\w$]*\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage\$\{[A-Za-z_$][\w$]*\?"\?skip_spend=1":""\}`,([A-Za-z_$][\w$]*)=await ([A-Za-z_$][\w$]*)\.net\.fetch\(\1,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
+  const requestPattern = /([A-Za-z_$][\w$]*)\.net\.fetch\(`\$\{[A-Za-z_$][\w$]*\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage`,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
   const patches = [...source.matchAll(requestPattern)].map((match) => {
     const original = match[0];
-    const replacement = `const ${match[1]}="https://gateway.useimpel.com/ui/a/u",${match[2]}=await ${match[3]}.net.fetch(${match[1]},{headers:{key:${credentialAccessor}(${configAccessor}()).apiKey}})`;
+    const replacement = `${match[1]}.net.fetch("https://gateway.useimpel.com/ui/a/u",{headers:{key:${credentialAccessor}(${configAccessor}()).apiKey}})`;
     if (replacement.length > original.length) {
       throw new Error("Claude plan-usage gateway request replacement no longer fits the vendor ASAR contract");
     }

package/src/cli.js

@@ -17,6 +17,7 @@ import { cmdDoctor } from "./commands/doctor.js";
 import { cmdSetup } from "./commands/setup.js";
 import { cmdSessions } from "./commands/sessions.js";
 import { cmdUpdate } from "./commands/update.js";
+import { cmdNuke } from "./commands/nuke.js";
 import { cmdExperimental } from "./commands/experimental.js";
 import { cmdConverge } from "./commands/converge.js";
 import { refuseElevatedMacExecution } from "./privileges.js";
@@ -48,6 +49,10 @@ Diagnostics:
   impel status                                Authentication, current tenant, and local readiness
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
 
+Reset:
+  impel nuke [--yes]                          Erase ALL Impel-managed local state (apps, profiles,
+                                              caches, keychain items, auth) for a clean reinstall
+
   impel help                                  Show this help
   impel --version                             Show the installed version
 
@@ -134,6 +139,9 @@ export async function main(argv) {
     case "apps":
       return cmdApps(rest);
 
+    case "nuke":
+      return cmdNuke(rest);
+
     case "skills":
     case "skill":
       return cmdSkills(rest);

package/src/commands/apps.js

@@ -772,7 +772,7 @@ export async function cmdApps(argv, overrides = {}) {
     return refreshApps(targets, {
       staleOnly: Boolean(flags["stale-only"]),
       tenantId: flags.tenant || null,
-    });
+    }, overrides);
   }
   if (action === "uninstall") {
     const config = loadConfig();
@@ -1163,8 +1163,20 @@ function claudeConfigIsCurrent(configPath, config, gatewayUrl) {
 // run (config writes only, never a bundle swap, never quits anything) and
 // silent on any failure: it is invoked detached from the apps' token helper,
 // so there is no user to talk to and nothing may leak to stdout.
-async function refreshApps(targets, { staleOnly = false, tenantId = null } = {}) {
-  const stored = loadConfig();
+async function refreshApps(targets, { staleOnly = false, tenantId = null } = {}, overrides = {}) {
+  const io = {
+    loadStoredConfig: loadConfig,
+    selectedConfig: selectedAppConfig,
+    status: appStatus,
+    bundleCurrent: bundleIsCurrent,
+    fetchModels: fetchGatewayModels,
+    installFiles: installManagedAppFiles,
+    syncSkills: syncSkillsSafe,
+    syncAgents: syncAgentProfilesSafe,
+    secureCodexHome: secureManagedCodexHome,
+    ...overrides,
+  };
+  const stored = io.loadStoredConfig();
   if (!stored?.pat) return;
   const requestedTenantId = tenantId
     ? normalizeTenantId(tenantId)
@@ -1181,17 +1193,25 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
 
   let config;
   try {
-    config = await selectedAppConfig(targets, tenantId ? requestedTenantId : null);
+    config = await io.selectedConfig(targets, tenantId ? requestedTenantId : null);
   } catch {
     return;
   }
-  const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
-  const installedTargets = statuses.filter((status) => status.launcherInstalled);
+  // Refresh only targets whose installed bundle was built by THIS CLI's
+  // bundle logic. The generated config contract is reviewed against the
+  // pinned vendor build, so rewriting configs (and advancing the manifest)
+  // under a stale bundle would strand an old app with a config written for a
+  // different app version. Stale bundles wait for the next foreground
+  // install/open/update, which swaps bundle and config together.
+  const statuses = io.status(targets, os.homedir(), config.tenantId, config.tenantName);
+  const installedTargets = statuses.filter((status) => (
+    status.launcherInstalled && io.bundleCurrent(status)
+  ));
   if (installedTargets.length === 0) return;
 
   let catalog;
   try {
-    catalog = await fetchGatewayModels(config);
+    catalog = await io.fetchModels(config);
   } catch {
     return;
   }
@@ -1204,7 +1224,7 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
     supportedTargetSet.has(status.target)
   ));
   if (supportedStatuses.length === 0) return;
-  installManagedAppFiles({
+  io.installFiles({
     config,
     targets: supportedStatuses.map((status) => status.target),
     models: catalog.models,
@@ -1217,10 +1237,10 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {})
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const status of supportedStatuses) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
-    await syncSkillsSafe({ client, gatewayUrl, env, label });
-    if (status.target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
+    await io.syncSkills({ client, gatewayUrl, env, label });
+    if (status.target === "chatgpt") io.secureCodexHome(tenantPaths.chatgpt.codexHome);
   }
-  await syncAgentProfilesSafe({
+  await io.syncAgents({
     profiles: supportedStatuses.map((status) => appAgentProfile(status.target, tenantPaths)),
     gatewayUrl: config.gatewayUrl,
     credential: config.pat,

package/src/commands/nuke.js

@@ -0,0 +1,230 @@
+// `impel nuke` — erase every Impel-managed footprint on this machine so the
+// next `impel setup` runs as a true first install. Removes managed app
+// launchers (including stale staging/rotation artifacts), all isolated app and
+// CLI profiles, macOS system remnants (caches, preference domains, HTTP
+// storages, saved state, launch agents), Impel-owned Safe Storage Keychain
+// items, and the CLI's own config/auth state. Never touches vendor apps,
+// native `~/.claude`/`~/.codex` profiles, or the shared legacy "Claude" Safe
+// Storage item that the vendor Claude app also uses.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+import { CONFIG_DIR } from "../config.js";
+import { parseFlags } from "../args.js";
+import { promptText } from "../prompt.js";
+import { appProcessPattern } from "../apps.js";
+import { windowsClaudeUserData } from "../windowsApps.js";
+
+// Launcher artifacts the CLI may have written into ~/Applications: the
+// tenant-scoped bundles, the pre-v0.8 global bundles, and any interrupted
+// `.tmp-<pid>` staging or `.previous-<pid>` rotation directories they left
+// behind. Anchored so unrelated apps that merely start with "Impel" survive.
+const MANAGED_LAUNCHER_RE = /^Impel (Claude|ChatGPT)(\.app| \()/u;
+
+// Every Impel-managed bundle identifier starts with this prefix; the vendor
+// apps use com.anthropic.* / com.openai.* and are never matched.
+const MANAGED_BUNDLE_PREFIX = "com.useimpel.";
+
+// macOS per-app state locations that accumulate entries keyed by bundle id.
+const MAC_LIBRARY_LOCATIONS = [
+  "Caches",
+  "Preferences",
+  "HTTPStorages",
+  "Saved Application State",
+  "Logs",
+  "Application Support",
+  "WebKit",
+  "Containers",
+  "Group Containers",
+  "LaunchAgents",
+];
+
+const HELP = `impel nuke - erase all Impel-managed state on this machine
+
+Removes managed desktop app launchers, every isolated app and CLI profile,
+macOS caches/preferences/keychain items owned by the managed apps, and the
+CLI's auth/config state, so \`impel setup\` runs as a true first install.
+
+Never touches the vendor Claude/ChatGPT apps, native ~/.claude or ~/.codex
+profiles, or non-Impel Keychain items.
+
+Usage:
+  impel nuke          Show what will be erased and ask for confirmation
+  impel nuke --yes    Erase without prompting (for scripts)
+`;
+
+function listEntries(directory) {
+  try {
+    return fs.readdirSync(directory);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Electron keys Safe Storage entries as "<app name> Safe Storage". Collect the
+ * exact names our managed profiles recorded plus the deterministic
+ * tenant-derived names, so orphans from half-removed installs still match.
+ * The legacy shared "Claude" name is excluded unconditionally: the vendor
+ * Claude app keys the operator's own encrypted data under it.
+ */
+function keychainCandidates(appsRoot) {
+  const names = new Set();
+  const tenantsRoot = path.join(appsRoot, "tenants");
+  for (const tenantId of listEntries(tenantsRoot)) {
+    for (const target of ["Impel Claude", "Impel ChatGPT"]) {
+      names.add(`${target} [${tenantId}] Safe Storage`);
+    }
+    const metadataPath = path.join(tenantsRoot, tenantId, "claude", "safe-storage.json");
+    try {
+      const appName = JSON.parse(fs.readFileSync(metadataPath, "utf8"))?.appName;
+      if (typeof appName === "string" && appName.trim()) names.add(`${appName} Safe Storage`);
+    } catch {
+      // Absent or corrupt metadata leaves only the derived names.
+    }
+  }
+  names.delete("Claude Safe Storage");
+  return [...names].sort();
+}
+
+function managedLauncherEntries(homeDir) {
+  const applications = path.join(homeDir, "Applications");
+  return listEntries(applications)
+    .filter((entry) => MANAGED_LAUNCHER_RE.test(entry))
+    .map((entry) => path.join(applications, entry));
+}
+
+function macLibraryRemnants(homeDir) {
+  const remnants = [];
+  for (const location of MAC_LIBRARY_LOCATIONS) {
+    const root = path.join(homeDir, "Library", location);
+    for (const entry of listEntries(root)) {
+      if (entry.startsWith(MANAGED_BUNDLE_PREFIX)) remnants.push(path.join(root, entry));
+    }
+  }
+  return remnants;
+}
+
+function windowsProfileRemnants(appsRoot, environment) {
+  const remnants = [];
+  for (const tenantId of listEntries(path.join(appsRoot, "tenants"))) {
+    try {
+      const userData = windowsClaudeUserData(environment, tenantId);
+      if (userData && fs.existsSync(userData)) remnants.push(userData);
+    } catch {
+      // Windows vendor install absent; nothing tenant-scoped to remove.
+    }
+  }
+  return remnants;
+}
+
+/** Gracefully quit, then kill, every process from a managed launcher bundle. */
+function stopManagedProcesses(launcherPaths, run) {
+  const names = launcherPaths
+    .map((launcher) => path.basename(launcher))
+    .filter((entry) => entry.endsWith(".app"))
+    .map((entry) => entry.replace(/\.app$/u, ""));
+  for (const name of names) {
+    run("/usr/bin/osascript", ["-e", `quit app "${name}"`]);
+  }
+  for (const name of names) {
+    const pattern = appProcessPattern(name);
+    run("/usr/bin/pkill", ["-f", pattern]);
+    run("/usr/bin/pkill", ["-9", "-f", pattern]);
+  }
+}
+
+export async function cmdNuke(argv = [], overrides = {}) {
+  const { flags } = parseFlags(argv, {
+    yes: { type: "boolean" },
+    help: { type: "boolean" },
+  });
+  if (flags.help) {
+    console.log(HELP);
+    return;
+  }
+
+  const io = {
+    homeDir: os.homedir(),
+    configDir: CONFIG_DIR,
+    platform: process.platform,
+    environment: process.env,
+    log: (message) => console.log(message),
+    confirm: promptText,
+    run: (command, args) => spawnSync(command, args, { stdio: "ignore" }),
+    ...overrides,
+  };
+
+  const appsRoot = io.environment.IMPEL_APP_HOME || path.join(io.configDir, "apps");
+  const darwin = io.platform === "darwin";
+  const launchers = darwin ? managedLauncherEntries(io.homeDir) : [];
+  const libraryRemnants = darwin ? macLibraryRemnants(io.homeDir) : [];
+  const keychainItems = darwin ? keychainCandidates(appsRoot) : [];
+  const windowsRemnants = io.platform === "win32"
+    ? windowsProfileRemnants(appsRoot, io.environment)
+    : [];
+  const configDirExists = fs.existsSync(io.configDir);
+
+  const total = launchers.length + libraryRemnants.length + keychainItems.length
+    + windowsRemnants.length + (configDirExists ? 1 : 0);
+  if (total === 0) {
+    io.log("impel nuke: no Impel-managed state found; this machine is already clean.");
+    return;
+  }
+
+  io.log("impel nuke will erase ALL Impel-managed state on this machine:");
+  if (launchers.length) io.log(`  App launchers and staging artifacts: ${launchers.length}`);
+  if (libraryRemnants.length) io.log(`  macOS caches/preferences/state entries: ${libraryRemnants.length}`);
+  if (keychainItems.length) io.log(`  Keychain Safe Storage items: ${keychainItems.length}`);
+  if (windowsRemnants.length) io.log(`  Windows managed Claude profiles: ${windowsRemnants.length}`);
+  if (configDirExists) io.log(`  CLI state, profiles, vendor cache, and auth: ${io.configDir}`);
+  io.log("Vendor apps and native ~/.claude and ~/.codex profiles are not touched.");
+
+  if (!flags.yes) {
+    const answer = await io.confirm('Type "nuke" to erase everything (anything else aborts): ');
+    if (answer !== "nuke") {
+      io.log("impel nuke: aborted; nothing was changed.");
+      return;
+    }
+  }
+
+  if (darwin && launchers.length) {
+    stopManagedProcesses(launchers, io.run);
+  }
+
+  for (const launcher of launchers) {
+    fs.rmSync(launcher, { recursive: true, force: true });
+  }
+  if (launchers.length) io.log(`Removed ${launchers.length} managed launcher artifact${launchers.length === 1 ? "" : "s"}.`);
+
+  for (const remnant of libraryRemnants) {
+    // Preference domains are registered with cfprefsd; deleting the domain
+    // first stops the daemon from resurrecting the plist from its cache.
+    if (remnant.endsWith(".plist") && path.dirname(remnant).endsWith("Preferences")) {
+      io.run("/usr/bin/defaults", ["delete", path.basename(remnant, ".plist")]);
+    }
+    fs.rmSync(remnant, { recursive: true, force: true });
+  }
+  if (libraryRemnants.length) io.log(`Removed ${libraryRemnants.length} macOS state entr${libraryRemnants.length === 1 ? "y" : "ies"}.`);
+
+  for (const item of keychainItems) {
+    // Missing items exit non-zero; that just means there is nothing to remove.
+    io.run("/usr/bin/security", ["delete-generic-password", "-s", item]);
+  }
+  if (keychainItems.length) io.log(`Cleared ${keychainItems.length} Impel Safe Storage Keychain item${keychainItems.length === 1 ? "" : "s"}.`);
+
+  for (const remnant of windowsRemnants) {
+    fs.rmSync(remnant, { recursive: true, force: true });
+  }
+  if (windowsRemnants.length) io.log(`Removed ${windowsRemnants.length} Windows managed profile${windowsRemnants.length === 1 ? "" : "s"}.`);
+
+  if (configDirExists) {
+    fs.rmSync(io.configDir, { recursive: true, force: true });
+    io.log(`Removed ${io.configDir} (profiles, vendor cache, sessions, and auth).`);
+  }
+
+  io.log("impel nuke: complete. Run `impel setup` for a clean install.");
+}