impel-cli 0.17.8 → 0.17.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.8",
+  "version": "0.17.9",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -104,6 +104,39 @@ const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(n
 const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof y?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
 const LEGACY_CLAUDE_SAFE_STORAGE_NAME = "Claude";
 const CLAUDE_SAFE_STORAGE_METADATA = "safe-storage.json";
+// The pinned Claude renderer decides desktop-vs-web mode SOLELY by matching its
+// own Electron user-agent against /claude(nest|gov)?\/([^ ]+)/i (functions o_,
+// x_, i_ in ion-dist). Electron derives that UA product token from app.name as
+// `${app.name}/${version}`, and our Safe Storage rename patch sets app.name to
+// this Safe Storage name. So the name MUST yield a "…Claude/<version>" token or
+// the app runs in web mode, where /epitaxy is rewritten to /code and the
+// sunset claude_code_web gate strands every session on /code/disabled ("Code
+// with Claude anywhere"). The token matches iff "claude" is immediately
+// followed by "/", i.e. the app.name ends in "Claude". Keep tenant scoping by
+// putting the tenant BEFORE the word, never after it.
+const CLAUDE_UA_DESKTOP_PATTERN = /claude(nest|gov)?\/[^ ]+/iu;
+
+/** The Electron UA token Electron builds from this app.name at the pinned version. */
+function claudeUserAgentToken(appName) {
+  return `${appName}/${PINNED_VENDOR_APPS.claude.version}`;
+}
+
+/** Whether an app.name keeps the renderer in desktop mode (see pattern above). */
+export function claudeAppNameKeepsDesktopMode(appName) {
+  return CLAUDE_UA_DESKTOP_PATTERN.test(claudeUserAgentToken(appName));
+}
+
+/** Tenant-scoped Safe Storage / app name that still ends in "Claude". */
+function impelClaudeSafeStorageName(tenantId) {
+  return tenantId
+    ? `Impel [${normalizeTenantId(tenantId)}] Claude`
+    : "Impel Claude";
+}
+
+// The pre-0.17.9 format put the tenant AFTER "Claude" ("Impel Claude [tenant]"),
+// which breaks the desktop-mode UA match. Recognize exactly the names this CLI
+// used to write so we can heal them without touching an unrelated custom name.
+const LEGACY_TRAPPED_CLAUDE_NAME = /^Impel Claude( \[[^\]]+\])?$/u;
 
 export const FALLBACK_MODELS = [
   { id: "claude-opus-4-8", provider: "claude", display_name: "Claude Opus 4.8", family: "opus", family_default: true, default: true, context_window: 200000 },
@@ -174,7 +207,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 17;
+export const CURRENT_CONFIG_VERSION = 18;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -183,7 +216,7 @@ export const CURRENT_CONFIG_VERSION = 17;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-21.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-21.2";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -494,20 +527,38 @@ function readClaudeSafeStorageMetadata(paths) {
 }
 
 /**
- * Electron keys macOS Safe Storage by app.name. Existing profiles already have
- * encrypted data under `Claude Safe Storage`, so changing their name would make
- * that data unreadable. New profiles can safely start with an immutable,
- * tenant-specific namespace and never touch the vendor/shared Keychain item.
+ * Electron keys macOS Safe Storage by app.name, AND derives the renderer's
+ * user-agent (hence its desktop-vs-web mode) from it. Existing profiles already
+ * have encrypted data under `Claude Safe Storage`, so changing their name would
+ * make that data unreadable; they keep the legacy name (which is UA-safe). New
+ * profiles get an immutable, tenant-specific namespace that still ends in
+ * "Claude" so the renderer stays in desktop mode.
+ *
+ * A profile provisioned by 0.17.4–0.17.8 was written with the old
+ * "Impel Claude [tenant]" format, which forces the renderer into web mode and
+ * strands it on /code/disabled. Heal exactly those names in place: such
+ * profiles never worked, so they carry no Safe Storage secrets worth keeping.
  */
 export function ensureClaudeSafeStorageName(paths, tenantId = null) {
   const existing = readClaudeSafeStorageMetadata(paths);
+  if (existing && claudeAppNameKeepsDesktopMode(existing.appName)) return existing.appName;
+  const metadataPath = path.join(paths.claude.root, CLAUDE_SAFE_STORAGE_METADATA);
+  if (existing && LEGACY_TRAPPED_CLAUDE_NAME.test(existing.appName)) {
+    const healedName = impelClaudeSafeStorageName(tenantId);
+    writeAtomic(metadataPath, `${JSON.stringify({
+      schemaVersion: 1,
+      appName: healedName,
+      mode: existing.mode === "legacy" ? "legacy" : "tenant",
+    }, null, 2)}\n`, 0o600);
+    return healedName;
+  }
   if (existing) return existing.appName;
   const hasExistingProfile = fs.existsSync(paths.claude.userData)
     && fs.readdirSync(paths.claude.userData).length > 0;
   const appName = hasExistingProfile
     ? LEGACY_CLAUDE_SAFE_STORAGE_NAME
-    : `Impel Claude${tenantId ? ` [${normalizeTenantId(tenantId)}]` : ""}`;
-  writeAtomic(path.join(paths.claude.root, CLAUDE_SAFE_STORAGE_METADATA), `${JSON.stringify({
+    : impelClaudeSafeStorageName(tenantId);
+  writeAtomic(metadataPath, `${JSON.stringify({
     schemaVersion: 1,
     appName,
     mode: hasExistingProfile ? "legacy" : "tenant",
@@ -966,6 +1017,12 @@ function writeClaudeConfig(paths, config, models) {
     // with an inference config present the pinned app selects 3P and hides the
     // inapplicable Claude.ai sign-in option.
     disableDeploymentModeChooser: true,
+    // The bundle is pinned to an exact vendor version whose renderer patches
+    // this CLI depends on. Left enabled, the app's Squirrel auto-updater pulls
+    // newer builds from api.anthropic.com (only a re-signing mismatch has been
+    // stopping the install), which would silently move a tenant off the pinned
+    // version and reintroduce the /code/disabled desktop trap fixed here.
+    disableAutoUpdates: true,
   };
   writeAtomic(path.join(dir, `${CLAUDE_CONFIG_ID}.json`), JSON.stringify(body, null, 2) + "\n", 0o600);
   writeAtomic(path.join(dir, "_meta.json"), JSON.stringify({

package/src/commands/apps.js

@@ -99,21 +99,31 @@ export function selectCatalogAppTargets(
   return supported;
 }
 
+// Turn a tenant-aware bundle display name into an app-profile sync label:
+// "Impel Claude (cibi)" -> "Impel Claude app (cibi)", "Impel Claude" ->
+// "Impel Claude app". This keeps app-target sync/agent lines attributable to a
+// tenant, matching the "Impel Claude CLI (cibi)" convention the CLI targets use,
+// instead of the ambiguous tenant-less "Impel Claude app" repeated per tenant.
+function appTargetLabel(displayName) {
+  const match = displayName.match(/^(.*?)( \(.*\))$/u);
+  return match ? `${match[1]} app${match[2]}` : `${displayName} app`;
+}
+
 // Each isolated desktop app maps to a client CLI + the env override that points
 // that CLI at the app's private profile, so skill syncing lands in the app's
 // installation rather than a global one.
 function appSkillTarget(target, paths) {
   if (target === "claude") {
-    return { client: "claude", env: { CLAUDE_CONFIG_DIR: paths.claude.userData }, label: "Impel Claude app" };
+    return { client: "claude", env: { CLAUDE_CONFIG_DIR: paths.claude.userData }, label: appTargetLabel(paths.claude.displayName) };
   }
-  return { client: "codex", env: { CODEX_HOME: paths.chatgpt.codexHome }, label: "Impel ChatGPT app" };
+  return { client: "codex", env: { CODEX_HOME: paths.chatgpt.codexHome }, label: appTargetLabel(paths.chatgpt.displayName) };
 }
 
 function appAgentProfile(target, paths) {
   if (target === "claude") {
-    return { client: "claude", root: paths.claude.userData, label: "Impel Claude app" };
+    return { client: "claude", root: paths.claude.userData, label: appTargetLabel(paths.claude.displayName) };
   }
-  return { client: "codex", root: paths.chatgpt.codexHome, label: "Impel ChatGPT app" };
+  return { client: "codex", root: paths.chatgpt.codexHome, label: appTargetLabel(paths.chatgpt.displayName) };
 }
 
 function windowsAppTargets(targetToken) {

package/src/commands/nuke.js

@@ -75,9 +75,12 @@ function keychainCandidates(appsRoot) {
   const names = new Set();
   const tenantsRoot = path.join(appsRoot, "tenants");
   for (const tenantId of listEntries(tenantsRoot)) {
-    for (const target of ["Impel Claude", "Impel ChatGPT"]) {
-      names.add(`${target} [${tenantId}] Safe Storage`);
-    }
+    // Cover both app-name eras: the current UA-safe "Impel [tenant] Claude"
+    // and the pre-0.17.9 "Impel Claude [tenant]" that may have left an orphaned
+    // Keychain item behind.
+    names.add(`Impel [${tenantId}] Claude Safe Storage`);
+    names.add(`Impel Claude [${tenantId}] Safe Storage`);
+    names.add(`Impel ChatGPT [${tenantId}] Safe Storage`);
     const metadataPath = path.join(tenantsRoot, tenantId, "claude", "safe-storage.json");
     try {
       const appName = JSON.parse(fs.readFileSync(metadataPath, "utf8"))?.appName;

package/src/skills.js

@@ -27,6 +27,13 @@ import { nativeCommandInvocation } from "./nativeProcess.js";
 /** The bundled plugin the Bifrost registry publishes; contains every served skill. */
 export const SKILL_PLUGIN_NAME = "bifrost-all-skills";
 
+// The marketplace `name` the gateway declares in every served marketplace.json
+// (identical for the Claude and Codex flavors). Used only as a last resort when
+// BOTH the manifest fetch and the `marketplace list --json` recovery fail:
+// Codex's `plugin add` rejects a bare plugin id, so a known-name @-qualified
+// install still has a chance where a bare add is guaranteed to error.
+export const SKILL_MARKETPLACE_FALLBACK_NAME = "bifrost-skills";
+
 /** Final fallback only — prefer the configured gateway (see resolveSkillsGateway). */
 export const SKILLS_FALLBACK_GATEWAY_URL = "https://gateway.useimpel.ai";
 
@@ -150,32 +157,27 @@ export function buildSkillCommands({ client, marketplaceSourceUrl: sourceUrl, ma
       args: ["plugin", "update", name ? `${plugin}@${name}` : plugin],
     });
   } else {
-    // Codex's `plugin add` requires a marketplace (PLUGIN@MARKETPLACE). Without a
-    // name we can only best-effort a bare add; with a name we install, upgrade
-    // the snapshot, and re-add to pin the refreshed bundle.
+    // Codex resolves `plugin add PLUGIN@MARKETPLACE` from the marketplace
+    // snapshot cloned at registration time; a re-registration is a no-op that
+    // does NOT refresh it. So upgrade the snapshot BEFORE installing — installing
+    // first against a snapshot that predates the current bundle fails with
+    // "plugin … was not found in marketplace …", then the old code's trailing
+    // re-add silently fixed it, producing a spurious warning. With the name we
+    // upgrade then install once; without it, an @-qualified install against the
+    // known fallback name still beats a bare add, which Codex always rejects.
+    const marketplaceName = name || SKILL_MARKETPLACE_FALLBACK_NAME;
     if (name) {
-      commands.push({
-        phase: "install",
-        description: `install ${plugin}`,
-        args: ["plugin", "add", `${plugin}@${name}`],
-      });
       commands.push({
         phase: "refresh-marketplace",
         description: "refresh marketplace",
         args: ["plugin", "marketplace", "upgrade", name],
       });
-      commands.push({
-        phase: "refresh-plugin",
-        description: `update ${plugin}`,
-        args: ["plugin", "add", `${plugin}@${name}`],
-      });
-    } else {
-      commands.push({
-        phase: "install",
-        description: `install ${plugin}`,
-        args: ["plugin", "add", plugin],
-      });
     }
+    commands.push({
+      phase: "install",
+      description: `install ${plugin}`,
+      args: ["plugin", "add", `${plugin}@${marketplaceName}`],
+    });
   }
 
   return commands;
@@ -292,10 +294,19 @@ async function runSkillCommandWithRetry(run, bin, args, env) {
   return run(bin, args, env);
 }
 
-/** Fetch the marketplace.json and return its registered name, or null on any failure. */
-export async function fetchMarketplaceName(url, fetchImpl = fetch) {
+const MARKETPLACE_FETCH_TIMEOUT_MS = 30_000;
+
+// The gateway serves marketplace.json from a serverless function with an 8-15s
+// cold TTFB. The vendor Claude CLI aborts its OWN marketplace fetch at a
+// hardcoded 10s, so a cold gateway makes `plugin marketplace update` time out.
+// Fetching here first (with a generous timeout and a retry) both resolves the
+// name and warms the endpoint so the vendor CLI's later fetch hits a warm cache.
+// A process-lifetime memo keeps a multi-tenant run from re-racing the cold path.
+const marketplaceNameCache = new Map();
+
+async function fetchMarketplaceNameOnce(url, fetchImpl, timeoutMs) {
   const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 10000);
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetchImpl(url, { signal: controller.signal });
     if (!response?.ok) return null;
@@ -308,6 +319,25 @@ export async function fetchMarketplaceName(url, fetchImpl = fetch) {
   }
 }
 
+/** Fetch the marketplace.json and return its registered name, or null on any failure. */
+export async function fetchMarketplaceName(url, fetchImpl = fetch, {
+  timeoutMs = MARKETPLACE_FETCH_TIMEOUT_MS,
+  useCache = true,
+} = {}) {
+  if (useCache && marketplaceNameCache.has(url)) return marketplaceNameCache.get(url);
+  let name = await fetchMarketplaceNameOnce(url, fetchImpl, timeoutMs);
+  if (name === null) name = await fetchMarketplaceNameOnce(url, fetchImpl, timeoutMs);
+  // Only memoize a resolved name: a transient failure must not poison later
+  // syncs in the same run, but a warmed name is stable for the process lifetime.
+  if (useCache && name !== null) marketplaceNameCache.set(url, name);
+  return name;
+}
+
+/** Test-only: drop the per-process marketplace-name memo. */
+export function clearMarketplaceNameCache() {
+  marketplaceNameCache.clear();
+}
+
 /**
  * Idempotently sync the Bifrost shared-skills plugin into one managed client
  * profile. Targets the SAME binary + profile the caller manages by passing the