impel-cli 0.18.0 → 0.18.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -211,7 +211,9 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // hook/auth/MCP artifacts instead of the npm-prefix bin path.
 // 20: managed Claude sandbox disabled by default; the rewrite strips the old
 // strict sandbox keys from already-provisioned profiles.
-export const CURRENT_CONFIG_VERSION = 20;
+// 21: Windows Codex hooks use the pinned client's PowerShell execution
+// contract instead of cmd.exe quoting that failed every managed hook.
+export const CURRENT_CONFIG_VERSION = 21;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this

package/src/sessionHooks.js

@@ -141,10 +141,10 @@ function shellQuote(value) {
   return `'${String(value).replaceAll("'", `'"'"'`)}'`;
 }
 
-function windowsCommandQuote(value) {
+function powershellQuote(value) {
   const text = String(value);
-  if (/[\r\n\0%]/u.test(text)) throw new Error("cannot safely write this Windows hook command");
-  return `"${text.replaceAll('"', '""')}"`;
+  if (/[\r\n\0]/u.test(text)) throw new Error("cannot safely write this Windows hook command");
+  return `'${text.replaceAll("'", "''")}'`;
 }
 
 function canonicalize(value) {
@@ -209,10 +209,11 @@ export function ensureCodexSessionHooks(codexHome, tenantId, surface = "codex_cl
   const document = readJsonObject(hooksPath);
   const invocation = managedInvocation("codex", surface, tenantId);
   const unixCommand = [invocation.command, ...invocation.args].map(shellQuote).join(" ");
-  const windowsTokens = [invocation.command, ...invocation.args].map(windowsCommandQuote).join(" ");
-  // Codex executes commandWindows with `cmd.exe /C`. The outer quote preserves
-  // a quoted executable path when it contains spaces.
-  const windowsCommand = `"${windowsTokens}"`;
+  const windowsTokens = [invocation.command, ...invocation.args].map(powershellQuote).join(" ");
+  // Codex runs commandWindows through the session's normal Windows shell,
+  // which is PowerShell. A quoted executable is only invoked when prefixed by
+  // the call operator; cmd.exe's doubled outer-quote form is invalid here.
+  const windowsCommand = `& ${windowsTokens}`;
   const handler = {
     type: "command",
     command: unixCommand,