impel-cli 0.17.9 → 0.17.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.17.9",
+  "version": "0.17.10",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/commands/apps.js

@@ -623,6 +623,23 @@ export async function cmdWindowsApps(argv, overrides = {}) {
 
   try {
     if (action === "open") maybePrintUpdateNotice();
+    // Background token-helper refreshes pass --stale-only; honor the manifest
+    // TTL here like the darwin refresh path does, so every vendor token call
+    // does not become a full catalog fetch + profile rewrite (and its child
+    // process fan-out) on Windows.
+    if (action === "refresh" && flags["stale-only"]) {
+      const stored = loadConfig();
+      if (stored?.pat) {
+        const staleTenantId = flags.tenant
+          ? normalizeTenantId(flags.tenant)
+          : stored.tenantId || null;
+        const stalePaths = appPaths(io.homeDir, staleTenantId, {
+          claudeUserData: io.claudeUserData(io.environment, staleTenantId),
+          tenantName: staleTenantId === stored.tenantId ? stored.tenantName : null,
+        });
+        if (manifestIsFresh(stalePaths, stored)) return true;
+      }
+    }
     const config = await io.selectedConfig(targets, flags.tenant || null);
     const catalog = await withProgress("Fetching the tenant model catalog", () => (
       fetchWindowsCatalog(config, io)

package/src/commands/converge.js

@@ -79,9 +79,22 @@ export async function cmdConverge(argv = [], overrides = {}) {
       return false;
     }
     const label = target === "claude" ? "Claude" : "ChatGPT/Codex";
-    const allowed = confirmed(await io.promptText(
-      `Allow the verified ${label} vendor ${context.mode === "update" ? "update" : "installation"}? [y/N] `,
-    ));
+    // Decline by default after 60s: an unanswered prompt in a forgotten
+    // terminal must not park the whole convergence (with its child processes
+    // and any background respawns) indefinitely. The prompt says so, and the
+    // question is re-asked on the next explicit run. The timer is cleared on
+    // answer (not unref'd) so the auto-decline reliably fires even when the
+    // prompt is the only thing keeping the event loop alive.
+    const allowed = confirmed(await new Promise((resolve) => {
+      const timer = setTimeout(() => resolve(""), io.vendorPromptTimeoutMs ?? 60_000);
+      const settle = (answer) => {
+        clearTimeout(timer);
+        resolve(answer);
+      };
+      Promise.resolve(io.promptText(
+        `Allow the verified ${label} vendor ${context.mode === "update" ? "update" : "installation"}? [y/N] (auto-N in 60s) `,
+      )).then(settle, () => settle(""));
+    }));
     vendorAppDecisions.set(target, allowed);
     return allowed;
   };

package/src/commands/sessions.js

@@ -1,7 +1,16 @@
 import { spawn } from "node:child_process";
 
 import { parseFlags } from "../args.js";
-import { collectSessionHook, flushCollectedSession, readHookInput, sessionOutboxStatus } from "../sessionCollector.js";
+import {
+  clearSessionFlushLock,
+  collectSessionHook,
+  flushCollectedSession,
+  readHookInput,
+  sessionFlushLockIsFresh,
+  sessionFlushLockPath,
+  sessionOutboxStatus,
+  touchSessionFlushLock,
+} from "../sessionCollector.js";
 import { loadConfig, redactSecretText } from "../config.js";
 import { impelCliInvocation } from "../selfInvocation.js";
 
@@ -57,11 +66,21 @@ export async function cmdSessions(argv) {
         flush: false,
       });
       if (config && (config.tenantId === flags.tenant || process.env.IMPEL_SESSIONS_DEV_ORG_ID)) {
-        startDetachedFlush({
+        // Hooks fire on every session event; only spawn a flush child when no
+        // live one is already polling this session's outbox (heartbeat lock).
+        const lock = sessionFlushLockPath({
+          tenantId: flags.tenant,
           provider: flags.provider,
-          tenant: flags.tenant,
-          session: String(input.session_id || ""),
+          sessionKey: String(input.session_id || ""),
         });
+        if (!sessionFlushLockIsFresh(lock)) {
+          touchSessionFlushLock(lock);
+          startDetachedFlush({
+            provider: flags.provider,
+            tenant: flags.tenant,
+            session: String(input.session_id || ""),
+          });
+        }
       }
     } catch (error) {
       // Session persistence is observational. A collector outage must never
@@ -83,16 +102,28 @@ export async function cmdSessions(argv) {
     if (!flags.provider || !flags.session || !flags.tenant) return;
     if (!["claude_code", "codex"].includes(flags.provider)) return;
     if (!config || flags.tenant !== config.tenantId && !process.env.IMPEL_SESSIONS_DEV_ORG_ID) return;
+    const lock = sessionFlushLockPath({
+      tenantId: flags.tenant,
+      provider: flags.provider,
+      sessionKey: flags.session,
+    });
     const deadline = Date.now() + 90_000;
-    while (Date.now() < deadline) {
-      const result = await flushCollectedSession({
-        tenantId: flags.tenant,
-        provider: flags.provider,
-        sessionKey: flags.session,
-        config,
-      });
-      if (result.pending === 0) break;
-      await new Promise((resolve) => setTimeout(resolve, result.error || result.busy ? 1000 : 250));
+    try {
+      while (Date.now() < deadline) {
+        // Refresh the heartbeat so hook dispatch keeps skipping extra spawns
+        // while this child is alive.
+        touchSessionFlushLock(lock);
+        const result = await flushCollectedSession({
+          tenantId: flags.tenant,
+          provider: flags.provider,
+          sessionKey: flags.session,
+          config,
+        });
+        if (result.pending === 0) break;
+        await new Promise((resolve) => setTimeout(resolve, result.error || result.busy ? 1000 : 250));
+      }
+    } finally {
+      clearSessionFlushLock(lock);
     }
     return;
   }

package/src/commands/update.js

@@ -1,6 +1,7 @@
 // `impel update` — update the CLI, then let the freshly installed build
 // reconcile every tenant and managed surface from the live control-plane list.
 
+import fs from "node:fs";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
@@ -20,6 +21,21 @@ import {
 
 const CLI_BIN = fileURLToPath(new URL("../../bin/impel.js", import.meta.url));
 
+/**
+ * The version now on disk at the package that owns CLI_BIN, read FRESH (never
+ * from this process's cached module graph). After `npm install -g` this is the
+ * ground truth for whether the cascade would re-execute new code.
+ */
+export function postInstallCliVersion() {
+  try {
+    const packagePath = fileURLToPath(new URL("../../package.json", import.meta.url));
+    const version = JSON.parse(fs.readFileSync(packagePath, "utf8"))?.version;
+    return typeof version === "string" && version.trim() ? version.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
 const HELP = `impel update - update everything Impel in one command
 
 Reinstalls impel-cli from npm, then uses the new build to discover every
@@ -141,6 +157,7 @@ export async function cmdUpdate(argv, overrides = {}) {
     platform: process.platform,
     progress: withProgress,
     recoverInstall: runInstallRecovery,
+    postInstallVersion: postInstallCliVersion,
     loadConfig,
     ...overrides,
   };
@@ -261,6 +278,21 @@ export async function cmdUpdate(argv, overrides = {}) {
       }
       console.log("CLI: recovery verified the update path.");
     }
+    // npm exiting 0 is NOT proof the RUNNING install was updated: with multiple
+    // Node installs / npm prefixes (common on Windows), the install can land in
+    // a different global prefix while CLI_BIN — the path the cascade re-executes
+    // — still holds the old build. Cascading then runs old code that believes
+    // an update is still pending, which is how unbounded respawn storms start.
+    // Probe the version at CLI_BIN fresh from disk and refuse to cascade on skew.
+    const postInstall = io.postInstallVersion();
+    if (remote && postInstall !== remote) {
+      console.error(`impel update: npm reported success but the running CLI still resolves v${postInstall ?? "?"} (expected v${remote}).`);
+      console.error(`  Running CLI: ${CLI_BIN}`);
+      console.error("  This usually means the `impel` on PATH belongs to a different npm prefix than `npm prefix -g`.");
+      console.error("  Fix: run `npm prefix -g`, confirm it owns the `impel` shim on PATH, then `npm install --global impel-cli@latest` there.");
+      process.exitCode = 1;
+      return;
+    }
     console.log(`CLI: updated${remote ? ` to v${remote}` : ""}.`);
   }
 

package/src/sessionCollector.js

@@ -471,7 +471,9 @@ function captureTranscript(root, sessionMeta, input) {
 
 function gitValue(cwd, args) {
   try {
-    const result = spawnSync("git", args, { cwd, encoding: "utf8", timeout: 1500, stdio: ["ignore", "pipe", "ignore"] });
+    // windowsHide: this runs inside console-less detached flush children on
+    // Windows, where each git.exe would otherwise allocate a visible console.
+    const result = spawnSync("git", args, { cwd, encoding: "utf8", timeout: 1500, stdio: ["ignore", "pipe", "ignore"], windowsHide: true });
     return result.status === 0 ? result.stdout.trim().slice(0, 2048) : "";
   } catch {
     return "";
@@ -983,6 +985,45 @@ export async function readHookInput(stream = process.stdin) {
   return value;
 }
 
+/**
+ * Heartbeat lock for the detached `sessions flush` child. Hooks fire on every
+ * session event; without this, each event stacks another detached child that
+ * polls the same outbox for up to 90 s — hundreds of concurrent processes on a
+ * busy session. The flush child refreshes the mtime while polling; hook
+ * dispatch skips the spawn while the heartbeat is fresh.
+ */
+export function sessionFlushLockPath({ tenantId, provider, sessionKey }) {
+  // NOT "flush.lock": acquireLock(root, "flush") owns that exact path (as a
+  // directory) for outbox batch mutual exclusion; this heartbeat is a separate,
+  // advisory spawn-rate limiter and must never collide with it.
+  return path.join(sessionDirectory(tenantId, provider, sessionKey), "flush-heartbeat");
+}
+
+export function touchSessionFlushLock(target) {
+  try {
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(target, `${process.pid}\n`, { mode: 0o600 });
+  } catch {
+    // Lock upkeep is best-effort; a missing lock only allows an extra child.
+  }
+}
+
+export function sessionFlushLockIsFresh(target, maxAgeMs = 15_000, now = Date.now()) {
+  try {
+    return now - fs.statSync(target).mtimeMs < maxAgeMs;
+  } catch {
+    return false;
+  }
+}
+
+export function clearSessionFlushLock(target) {
+  try {
+    fs.rmSync(target, { force: true });
+  } catch {
+    // Stale locks expire via mtime anyway.
+  }
+}
+
 export function sessionOutboxStatus({ tenantId, provider, sessionKey }) {
   const root = sessionDirectory(tenantId, provider, sessionKey);
   return {

package/src/skills.js

@@ -212,6 +212,9 @@ export function runSkillCommand(bin, args, env, {
         env: environment,
         stdio: ["ignore", "pipe", "pipe"],
         windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+        // One update run spawns ~150 of these cmd.exe-wrapped plugin commands
+        // across tenants; keep them off-screen on Windows.
+        windowsHide: true,
       });
     } catch (error) {
       resolve({

package/src/updates.js

@@ -122,8 +122,15 @@ export function writeUpdateCache(patch) {
   return next;
 }
 
+// A failed registry check must still count as "we tried": without stamping the
+// failure, a machine with broken registry access has a permanently stale cache
+// and EVERY TTY command respawns the detached refresh child — which on Windows
+// used to mean one more console window per command, forever.
+const UPDATE_CHECK_FAILURE_BACKOFF_MS = 60 * 60 * 1000;
+
 export function cacheIsFresh(cache, now = Date.now()) {
-  return Boolean(cache?.checkedAt && now - cache.checkedAt < UPDATE_CHECK_TTL_MS);
+  if (cache?.checkedAt && now - cache.checkedAt < UPDATE_CHECK_TTL_MS) return true;
+  return Boolean(cache?.lastFailedAt && now - cache.lastFailedAt < UPDATE_CHECK_FAILURE_BACKOFF_MS);
 }
 
 /** Fetch npm's latest version and record it; returns the updated cache (or null). */
@@ -131,7 +138,14 @@ export async function refreshUpdateCache(dependencies = {}) {
   const fetchLatest = dependencies.fetchRemoteVersion || fetchRemoteVersion;
   const writeCache = dependencies.writeCache || writeUpdateCache;
   const remoteVersion = await fetchLatest();
-  if (!remoteVersion) return null;
+  if (!remoteVersion) {
+    try {
+      writeCache({ lastFailedAt: Date.now() });
+    } catch {
+      // The stamp is a spawn-rate limiter, not required state.
+    }
+    return null;
+  }
   return writeCache({ remoteVersion, checkedAt: Date.now() });
 }
 
@@ -178,6 +192,10 @@ function spawnDetached(args) {
     const child = spawn(process.execPath, [path.join(CLI_ROOT, "bin", "impel.js"), ...args], {
       detached: true,
       stdio: "ignore",
+      // Windows: a detached console-subsystem child gets its OWN console — a
+      // visible Command Prompt window per spawn — unless it is hidden. This is
+      // the same option startDetachedFlush already passes.
+      windowsHide: true,
     });
     child.unref();
   } catch {