impel-cli 0.18.13 → 0.18.14-beta.0

package/README.md

@@ -14,7 +14,7 @@ impel update
 
 ## Install
 
-Install the public npm package once per machine:
+On macOS and Linux, install the public npm package once per machine:
 
 ```sh
 npm install --global impel-cli
@@ -22,17 +22,31 @@ npm install --global impel-cli
 
 Node.js 18 or newer is required.
 
+On Windows PowerShell, invoke npm's command shims explicitly:
+
+```powershell
+npm.cmd install --global impel-cli
+impel.cmd setup
+```
+
+The explicit `.cmd` suffix prevents PowerShell from selecting npm's `.ps1`
+shim when script execution is restricted. Impel does not change the machine's
+or current user's PowerShell execution policy.
+
 On macOS, setup and update verify Apple's Xcode Command Line Tools before any
 profile, app, or skills work begins. If they are missing, Impel opens the
 system installer with `xcode-select --install` and stops safely; finish that
 installation, then rerun the same Impel command.
 
-Then run setup and paste an Impel Personal Access Token when prompted:
+Then run setup and paste an Impel Personal Access Token when prompted. On
+macOS and Linux:
 
 ```sh
 impel setup
 ```
 
+On Windows PowerShell, use `impel.cmd setup` as shown above.
+
 Setup discovers every tenant available to the PAT and prepares all supported
 surfaces for each tenant. You do not need to repeat setup tenant by tenant.
 
@@ -128,6 +142,12 @@ Run one command for routine maintenance:
 impel update
 ```
 
+On Windows PowerShell, keep the command shim explicit:
+
+```powershell
+impel.cmd update
+```
+
 Update:
 
 1. On macOS, verifies the Xcode Command Line Tools and opens Apple's installer
@@ -261,6 +281,21 @@ compatibility for one release, but no command can enable native routing.
 ### Windows
 
 - Missing official Claude Code and Codex CLIs can be installed during setup.
+- Each CLI prompt explains that Impel will download, verify, and install the
+  official vendor CLI for the current user; each defaults to No.
+- Run `impel.cmd setup` or `impel.cmd update` from PowerShell so restricted
+  script policy cannot select the npm-generated `impel.ps1` shim. Impel does
+  not modify persistent PowerShell execution policy.
+- Claude Chat and Code remain available through the per-user managed profile.
+  Cowork is enabled only when a read-only check confirms Virtual Machine
+  Platform, the HCS services and `vfpext` driver, nested virtualization when
+  applicable, and machine-wide provisioning of the exact pinned Claude MSIX.
+- When those Cowork prerequisites are missing or cannot be read, Impel hides
+  the Cowork tab and reports the reason and remediation in setup, update, and
+  status. Impel never enables Windows features, restarts Windows, provisions a
+  machine-wide package, or elevates itself.
+- Machine-wide deployment requirements are documented by Anthropic in
+  [Deploy Claude Desktop for Windows](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows).
 - Claude Desktop is downloaded from Anthropic as the exact x64 or arm64 MSIX
   pinned by this CLI. Its SHA-256, Authenticode signature, package identity,
   version, architecture, and required layout are checked before installation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.13",
+  "version": "0.18.14-beta.0",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -57,6 +57,7 @@ export const PINNED_VENDOR_APPS = Object.freeze({
       packageName: "Claude",
       packageVersion: "1.24012.9.0",
       publisher: 'CN="Anthropic, PBC", O="Anthropic, PBC", L=San Francisco, S=California, C=US, SERIALNUMBER=4860621, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US',
+      publisherId: "pzs8sxrjxfjjc",
       executable: "app\\Claude.exe",
       downloads: Object.freeze({
         arm64: Object.freeze({
@@ -232,7 +233,9 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // 22: refresh GPT-5.6 model windows from the pinned ChatGPT Codex catalog.
 // 23: select Codex's unelevated native Windows sandbox for managed profiles so
 // enterprise machines do not enter the administrator-only setup flow.
-export const CURRENT_CONFIG_VERSION = 23;
+// 24: thread the inspected Windows Cowork host capability into Claude config
+// and the tenant manifest so unsupported hosts keep Chat and Code usable.
+export const CURRENT_CONFIG_VERSION = 24;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -710,6 +713,7 @@ export function installManagedAppFiles({
   writeTokenHelperFile = true,
   claudeUserData = null,
   chatgptInvocations = null,
+  windowsCoworkCapability = null,
   generatedAt = new Date().toISOString(),
 }) {
   // true = rebuild every target's bundle; false = configs only; an array
@@ -768,7 +772,7 @@ export function installManagedAppFiles({
       migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
       writeClaudeNative3PSelection(paths);
       writeClaudeCodeSettings(paths);
-      writeClaudeConfig(paths, config, models);
+      writeClaudeConfig(paths, config, models, windowsCoworkCapability);
       if (RUNTIME_BRAND.features.sessions) ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
     }
     else {
@@ -789,8 +793,33 @@ export function installManagedAppFiles({
     });
   }
 
+  const manifestCoworkCapability = windowsCoworkCapability
+    ? {
+        schemaVersion: 1,
+        status: ["available", "unavailable", "unknown"].includes(windowsCoworkCapability.status)
+          ? windowsCoworkCapability.status
+          : "unknown",
+        enabled: windowsCoworkCapability.enabled === true,
+        checks: {
+          virtualMachinePlatform: windowsCoworkCapability.checks?.virtualMachinePlatform ?? "unknown",
+          restartPending: windowsCoworkCapability.checks?.restartPending ?? null,
+          vmcompute: windowsCoworkCapability.checks?.vmcompute ?? "unknown",
+          hns: windowsCoworkCapability.checks?.hns ?? "unknown",
+          vfpext: windowsCoworkCapability.checks?.vfpext ?? "unknown",
+          machineProvisioned: windowsCoworkCapability.checks?.machineProvisioned ?? null,
+          virtualMachine: windowsCoworkCapability.checks?.virtualMachine ?? null,
+          nestedVirtualization: windowsCoworkCapability.checks?.nestedVirtualization ?? null,
+        },
+        reasonCodes: Array.isArray(windowsCoworkCapability.reasonCodes)
+          ? [...windowsCoworkCapability.reasonCodes]
+          : ["inspector-malformed-output"],
+        remediation: Array.isArray(windowsCoworkCapability.remediation)
+          ? [...windowsCoworkCapability.remediation]
+          : [],
+      }
+    : null;
   writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
-    schemaVersion: 4,
+    schemaVersion: 5,
     configVersion: CURRENT_CONFIG_VERSION,
     modelCatalogVersion: 3,
     gatewayUrl: config.gatewayUrl,
@@ -803,6 +832,7 @@ export function installManagedAppFiles({
       models,
       config,
     ),
+    ...(manifestCoworkCapability ? { capabilities: { claudeCowork: manifestCoworkCapability } } : {}),
     models: models.map((model) => model.id),
     updatedAt: generatedAt,
   }, null, 2) + "\n", 0o600);
@@ -1029,7 +1059,7 @@ export function removeManagedApps(targets, {
   }
 }
 
-function writeClaudeConfig(paths, config, models) {
+function writeClaudeConfig(paths, config, models, windowsCoworkCapability = null) {
   const dir = path.join(paths.claude.userData, "configLibrary");
   const experimental = crossAppModelsEnabled(config);
   const claudeModels = experimental
@@ -1044,10 +1074,13 @@ function writeClaudeConfig(paths, config, models) {
     inferenceGatewayAuthScheme: "bearer",
     modelDiscoveryEnabled: false,
     inferenceModels: claudeModels,
-    // These are Anthropic's native managed 3P surface controls. Cowork and
-    // Code default to enabled in the pinned build, but state them explicitly
-    // so an older generated profile cannot leave either surface disabled.
-    coworkTabEnabled: true,
+    // These are Anthropic's native managed 3P surface controls. Windows
+    // enables Cowork only after a separate read-only host inspection proves
+    // the VMP/HCS/machine-provisioning prerequisites. Other platforms and
+    // legacy callers without a Windows observation retain the reviewed true.
+    coworkTabEnabled: windowsCoworkCapability
+      ? windowsCoworkCapability.enabled === true
+      : true,
     isClaudeCodeForDesktopEnabled: true,
     // Chat is the only opt-in surface in the pinned build.
     chatTabEnabled: true,

package/src/commands/apps.js

@@ -60,6 +60,11 @@ import {
   windowsManagedChatGPTRoot,
 } from "../windowsApps.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
+import {
+  formatWindowsClaudeCoworkCapability,
+  inspectWindowsClaudeCoworkCapability,
+  unknownWindowsClaudeCoworkCapability,
+} from "../windowsCapabilities.js";
 
 const CLAUDE_KEYCHAIN_NOTICE = "Claude Keychain: enter your Mac login password and choose Always Allow on the first prompt for this tenant; Allow is temporary.";
 
@@ -319,6 +324,7 @@ function configureWindowsApps(config, targets, vendorPaths, catalog, io) {
     writeTokenHelperFile: false,
     claudeUserData: userData,
     chatgptInvocations: { auth, mcp },
+    windowsCoworkCapability: io.windowsCoworkCapability || null,
   });
   return { catalog, userData };
 }
@@ -353,7 +359,10 @@ export async function reconcileWindowsTenantApps({
   confirmVendorInstall = async () => true,
   homeDir = os.homedir(),
   environment = process.env,
+  windowsCoworkCapability = null,
 } = {}, overrides = {}) {
+  const effectiveCoworkCapability = windowsCoworkCapability
+    || unknownWindowsClaudeCoworkCapability();
   const io = {
     findClaudeApp: findWindowsClaudeApp,
     ensureClaudeApp: ensureWindowsClaudeApp,
@@ -435,6 +444,7 @@ export async function reconcileWindowsTenantApps({
       ...io,
       homeDir,
       environment,
+      windowsCoworkCapability: effectiveCoworkCapability,
     });
   }
   const agentTargets = [];
@@ -628,6 +638,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     syncSkills: syncSkillsSafe,
     syncAgents: syncAgentProfilesSafe,
     selectedConfig: selectedAppConfig,
+    inspectCoworkCapability: inspectWindowsClaudeCoworkCapability,
     ...overrides,
   };
   // Preserve the original Windows-Claude override names used by embedders and
@@ -656,6 +667,10 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       console.log(`  profile: ${fs.existsSync(claudeConfigPath) ? paths.claude.userData : "not installed"}`);
       console.log(`  vendor:  ${io.findClaudeApp(io.environment) || "not installed"}`);
       console.log("  open:    impel app open claude");
+      const manifest = localTenantId ? readTenantManifest(io.homeDir, localTenantId) : null;
+      for (const line of formatWindowsClaudeCoworkCapability(manifest?.capabilities?.claudeCowork)) {
+        console.log(`  ${line}`);
+      }
     }
     if (targets.includes("chatgpt")) {
       console.log("Impel ChatGPT:");
@@ -777,7 +792,14 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       managedChatGPT = io.stageChatGPTApp(vendorPaths.chatgpt, actionPaths.root);
     }
 
-    const { userData } = configureWindowsApps(config, actionTargets, vendorPaths, catalog, io);
+    const windowsCoworkCapability = io.inspectCoworkCapability({
+      environment: io.environment,
+      platform: "win32",
+    });
+    const { userData } = configureWindowsApps(config, actionTargets, vendorPaths, catalog, {
+      ...io,
+      windowsCoworkCapability,
+    });
     const tenantPaths = appPaths(io.homeDir, config.tenantId, {
       claudeUserData: userData,
       tenantName: config.tenantName,

package/src/commands/converge.js

@@ -123,6 +123,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
     confirmVendorInstall: confirmInstall,
   }, overrides.reconcileOverrides || {});
 
+  const cliInstallDecisions = new Map();
   let sharedFailure = null;
   const prepareSharedClis = async ({ confirmedTools = null, inspectOnly = false } = {}) => {
     try {
@@ -141,11 +142,20 @@ export async function cmdConverge(argv = [], overrides = {}) {
             for (const tool of inspected.missingAfter) {
               if (!inspected.installCommands?.[tool]) continue;
               const label = tool === "claude" ? "Claude Code" : "Codex";
-              if (confirmed(await io.promptText(`Install the official ${label} CLI for this user? [y/N] `))) {
+              if (confirmed(await io.promptText(`Impel will download, verify, and install the official ${label} CLI for the current user. Continue? [y/N] `))) {
                 installTools.push(tool);
+                cliInstallDecisions.set(tool, "approved");
+              } else {
+                cliInstallDecisions.set(tool, "declined");
               }
             }
+          } else {
+            for (const tool of inspected.missingAfter) {
+              if (inspected.installCommands?.[tool]) cliInstallDecisions.set(tool, "confirmation-required");
+            }
           }
+        } else {
+          for (const tool of installTools) cliInstallDecisions.set(tool, "approved");
         }
         if (installTools.length) {
           prepared = await io.preparePlatformClis({
@@ -157,7 +167,15 @@ export async function cmdConverge(argv = [], overrides = {}) {
           });
         }
       }
-      sharedFailure = prepared.missingAfter.length ? describeCliFailure(prepared) : null;
+      sharedFailure = prepared.missingAfter.length
+        ? describeCliFailure(prepared, {
+            commandName: "update",
+            cliExecutable: io.platform === "win32" ? "impel.cmd" : "impel",
+            isTTY: io.isTTY,
+            decisions: cliInstallDecisions,
+            skipClis,
+          })
+        : null;
       return prepared;
     } catch (error) {
       sharedFailure = redactSecretText(error?.message || error);

package/src/commands/setup.js

@@ -253,6 +253,7 @@ export async function cmdSetup(argv, overrides = {}) {
     return allowed;
   };
 
+  const cliInstallDecisions = new Map();
   let sharedFailure = null;
   const prepareSharedClis = async ({ confirmedTools = null, inspectOnly = false } = {}) => {
     try {
@@ -271,11 +272,20 @@ export async function cmdSetup(argv, overrides = {}) {
             for (const tool of inspected.missingAfter) {
               if (!inspected.installCommands?.[tool]) continue;
               const label = tool === "claude" ? "Claude Code" : "Codex";
-              if (confirmed(await io.promptText(`Install the official ${label} CLI for this user? [y/N] `))) {
+              if (confirmed(await io.promptText(`Impel will download, verify, and install the official ${label} CLI for the current user. Continue? [y/N] `))) {
                 installTools.push(tool);
+                cliInstallDecisions.set(tool, "approved");
+              } else {
+                cliInstallDecisions.set(tool, "declined");
               }
             }
+          } else {
+            for (const tool of inspected.missingAfter) {
+              if (inspected.installCommands?.[tool]) cliInstallDecisions.set(tool, "confirmation-required");
+            }
           }
+        } else {
+          for (const tool of installTools) cliInstallDecisions.set(tool, "approved");
         }
         if (installTools.length) {
           prepared = await io.preparePlatformClis({
@@ -288,7 +298,13 @@ export async function cmdSetup(argv, overrides = {}) {
         }
       }
       if (prepared.missingAfter.length) {
-        sharedFailure = describeCliFailure(prepared);
+        sharedFailure = describeCliFailure(prepared, {
+          commandName: "setup",
+          cliExecutable: io.platform === "win32" ? "impel.cmd" : "impel",
+          isTTY: io.isTTY,
+          decisions: cliInstallDecisions,
+          skipClis: flags["skip-clis"],
+        });
         return prepared;
       }
       sharedFailure = null;
@@ -476,7 +492,8 @@ export async function cmdSetup(argv, overrides = {}) {
     : "Launch: no provider CLI is currently available for this tenant");
   if (!report.passed || sharedFailure) {
     if (sharedFailure) console.error(`Shared setup failure: ${sharedFailure}`);
-    console.error("Setup is incomplete. Fix the reported issue or rerun `impel setup`.");
+    const setupCommand = io.platform === "win32" ? "impel.cmd setup" : "impel setup";
+    console.error(`Setup is incomplete. Fix the reported issue or rerun \`${setupCommand}\`.`);
     process.exitCode = 1;
     return report;
   }

package/src/commands/status.js

@@ -17,6 +17,7 @@ import { installedVersion, maybePrintUpdateNotice } from "../updates.js";
 import { windowsClaudeUserData } from "../windowsApps.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 import { cachedProviderReadiness, providerAvailable } from "../providerReadiness.js";
+import { formatWindowsClaudeCoworkCapability } from "../windowsCapabilities.js";
 
 function readShellManifest(paths) {
   try {
@@ -27,7 +28,7 @@ function readShellManifest(paths) {
   }
 }
 
-function desktopReadiness(tenant, {
+export function desktopReadiness(tenant, {
   platform = process.platform,
   homeDir = os.homedir(),
   environment = process.env,
@@ -37,6 +38,7 @@ function desktopReadiness(tenant, {
     return {
       claude: { app: "unavailable", shell: "unavailable" },
       codex: { app: "unavailable", shell: "unavailable" },
+      cowork: null,
     };
   }
   const claudeUserData = platform === "win32" ? windowsClaudeUserData(environment, tenant.id) : null;
@@ -70,6 +72,7 @@ function desktopReadiness(tenant, {
       shell: shellReady ? "ready" : "missing",
     };
   }
+  states.cowork = manifest?.capabilities?.claudeCowork || null;
   return states;
 }
 
@@ -125,6 +128,8 @@ export async function cmdStatus(overrides = {}) {
   };
   console.log("Tenant readiness:");
   let incomplete = false;
+  let currentCowork = null;
+  let fallbackCowork = null;
   for (const tenant of [...selected.tenants].sort((left, right) => left.id.localeCompare(right.id))) {
     const profiles = io.cliReadiness(tenant.id);
     const desktop = io.desktopReadiness(tenant, overrides);
@@ -145,12 +150,15 @@ export async function cmdStatus(overrides = {}) {
     });
     const states = [claudeCli, codexCli, desktop.claude.app, desktop.codex.app, desktop.claude.shell, desktop.codex.shell];
     if (states.includes("missing")) incomplete = true;
+    fallbackCowork ||= desktop.cowork || null;
+    if (tenant.id === selected.tenantId) currentCowork = desktop.cowork || null;
     console.log(
       `  ${tenant.id}${tenant.id === selected.tenantId ? " (current)" : ""}: `
       + `Claude CLI ${claudeCli}, Codex CLI ${codexCli}, `
       + `Claude app ${desktop.claude.app}, ChatGPT app ${desktop.codex.app}`,
     );
   }
+  for (const line of formatWindowsClaudeCoworkCapability(currentCowork || fallbackCowork)) console.log(line);
   if (incomplete) {
     console.log(RUNTIME_BRAND.tenant.defaultId
       ? `Repair or finish missing tenant surfaces with: ${RUNTIME_BRAND.cli.command} setup`

package/src/platformSetup.js

@@ -31,19 +31,39 @@ export async function preparePlatformClis(options = {}, dependencies = {}) {
   };
 }
 
-export function describeCliFailure(prepared) {
+export function describeCliFailure(prepared, {
+  commandName = "setup",
+  cliExecutable = "impel",
+  isTTY = true,
+  decisions = {},
+  skipClis = false,
+} = {}) {
   const labels = { claude: "Claude Code", codex: "Codex" };
   const details = [];
   for (const tool of prepared.missingAfter || []) {
     const installation = prepared.installations?.[tool];
     const failure = installation?.failure;
+    const decision = decisions instanceof Map ? decisions.get(tool) : decisions?.[tool];
+    const attempted = Boolean(
+      installation?.attempted
+      || failure
+      || installation?.succeeded === false,
+    );
     const reason = failure?.message || failure?.code
       || (Number.isInteger(failure?.status)
         ? `exit ${failure.status}`
-        : installation ? "not discoverable after installation" : "not installed or discoverable");
+        : attempted
+          ? "not discoverable after installation"
+          : decision === "declined"
+            ? "automatic installation was declined"
+            : skipClis
+              ? "installation was skipped by --skip-clis"
+              : !isTTY && prepared.installCommands?.[tool]
+                ? `interactive confirmation required; rerun \`${cliExecutable} ${commandName}\` interactively (or use \`--skip-clis\` to leave it uninstalled)`
+                : "not installed or discoverable");
     details.push(`${labels[tool] || tool}: ${redactSecretText(reason)}`);
     const command = installation?.command || prepared.installCommands?.[tool];
-    if (command) details.push(`manual ${tool} installer: ${redactSecretText(command)}`);
+    if (attempted && command) details.push(`manual ${tool} recovery command: ${redactSecretText(command)}`);
   }
   return details.join("; ") || `missing vendor CLIs: ${(prepared.missingAfter || []).join(", ")}`;
 }

package/src/provisioning.js

@@ -17,6 +17,10 @@ import {
 } from "./tenants.js";
 import { reconcileTenantApps } from "./commands/apps.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
+import {
+  formatWindowsClaudeCoworkCapability,
+  inspectWindowsClaudeCoworkCapability,
+} from "./windowsCapabilities.js";
 
 export function selectDefaultTenant(listing, { requested = null, currentTenantId = null } = {}) {
   const normalized = requested ? normalizeTenantId(requested) : null;
@@ -185,6 +189,7 @@ export async function reconcileAllTenants({
     reconcileApps: reconcileTenantApps,
     registerShellEntries: registerTenantShellEntries,
     knownTenantIds: locallyKnownTenantIds,
+    inspectCoworkCapability: inspectWindowsClaudeCoworkCapability,
     ...overrides,
   };
   // Dependency-injection compatibility for older embedders/tests. Production
@@ -208,6 +213,9 @@ export async function reconcileAllTenants({
     claude: io.findBinary("claude", environment, platform),
     codex: io.findBinary("codex", environment, platform),
   };
+  const windowsCoworkCapability = includeApps && platform === "win32"
+    ? io.inspectCoworkCapability({ environment, platform })
+    : null;
   const results = new Map(liveTenants.map((tenant) => [tenant.id, {
     tenantId: tenant.id,
     tenantName: tenant.name,
@@ -262,6 +270,7 @@ export async function reconcileAllTenants({
           homeDir,
           environment,
           confirmVendorInstall,
+          windowsCoworkCapability,
         }, overrides.appOverrides || {});
         supported = new Set(installed.targets || []);
         const failedApps = installed.failed || [];
@@ -333,6 +342,7 @@ export async function reconcileAllTenants({
     selectedTenantId: config.tenantId,
     tenants: values,
     inaccessible,
+    ...(windowsCoworkCapability ? { capabilities: { claudeCowork: windowsCoworkCapability } } : {}),
     passed: values.every((result) => (
       (result.cli === "ready" || result.cli === "unavailable")
       && (result.apps === "ready" || result.apps === "unavailable")
@@ -366,6 +376,7 @@ export function printReconciliationSummary(report, log = console.log) {
   if (report.inaccessible.length) {
     log(`  Retained local data for inaccessible tenants: ${report.inaccessible.join(", ")}`);
   }
+  for (const line of formatWindowsClaudeCoworkCapability(report.capabilities?.claudeCowork)) log(line);
 }
 
 export function tenantCliPathsReady(tenantId, existsSync = fs.existsSync) {

package/src/shellEntries.js

@@ -8,7 +8,11 @@ import { redactSecretText } from "./config.js";
 import { environmentValue, nativeCommandInvocation, resolveNativeBinary } from "./nativeProcess.js";
 import { managedCliEntrypoint } from "./selfInvocation.js";
 import { normalizeTenantId } from "./tenants.js";
-import { windowsClaudeUserData } from "./windowsApps.js";
+import {
+  findManagedWindowsChatGPTApp,
+  findWindowsClaudeApp,
+  windowsClaudeUserData,
+} from "./windowsApps.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 const LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
@@ -151,6 +155,8 @@ export function registerTenantShellEntries({
   run = spawnSync,
   writeManifest = writeShellEntryManifest,
   shortcut = registerWindowsTenantShortcut,
+  findClaudeApp = findWindowsClaudeApp,
+  findChatGPTApp = findManagedWindowsChatGPTApp,
 } = {}) {
   const id = normalizeTenantId(tenantId);
   const paths = appPaths(homeDir, id, {
@@ -175,9 +181,27 @@ export function registerTenantShellEntries({
     };
     for (const product of targets) {
       if (!available[product]) throw new Error(`managed ${product} profile is missing for tenant ${id}`);
+      let iconExecutable;
+      try {
+        iconExecutable = product === "claude"
+          ? findClaudeApp(environment)
+          : findChatGPTApp(paths.root);
+      } catch (error) {
+        throw new Error(`could not resolve ${product} shortcut icon (${redactSecretText(error?.message || String(error))})`);
+      }
+      if (!iconExecutable || !path.win32.isAbsolute(iconExecutable)) {
+        throw new Error(`managed ${product} shortcut icon executable is unavailable for tenant ${id}`);
+      }
       registered.push({
         product,
-        path: shortcut({ product, tenantId: id, tenantName, environment, run }),
+        path: shortcut({
+          product,
+          tenantId: id,
+          tenantName,
+          environment,
+          run,
+          iconPath: `${path.win32.normalize(iconExecutable)},0`,
+        }),
         status: "ready",
       });
     }

package/src/windowsCapabilities.js

@@ -0,0 +1,334 @@
+import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+
+import { PINNED_VENDOR_APPS } from "./apps.js";
+import { environmentValue, nativeCommandInvocation } from "./nativeProcess.js";
+
+export const WINDOWS_COWORK_REMEDIATION = Object.freeze({
+  enableVirtualMachinePlatform: "Enable the Windows Virtual Machine Platform optional feature, then restart Windows.",
+  restartWindows: "Restart Windows to finish Virtual Machine Platform and service provisioning.",
+  restoreHcs: "Ask an administrator or endpoint manager to restore the vmcompute, hns, and vfpext Windows components.",
+  provisionClaude: "Ask an administrator or endpoint manager to machine-provision the exact pinned Claude MSIX with Add-AppxProvisionedPackage.",
+  enableNestedVirtualization: "Enable nested virtualization for this VM, or use a physical Windows host for Claude Cowork.",
+  inspectHost: "Ask an administrator to verify Virtual Machine Platform, HCS services, vfpext, and machine-wide Claude provisioning.",
+});
+
+const WINDOWS_PACKAGE_BASE32 = "0123456789abcdefghjkmnpqrstvwxyz";
+
+/** Derive the stable Package Family Name publisher id from the exact DN. */
+export function windowsPackagePublisherId(publisher) {
+  const hash = crypto.createHash("sha256").update(Buffer.from(String(publisher), "utf16le")).digest();
+  let bits = "";
+  for (const byte of hash.subarray(0, 8)) bits += byte.toString(2).padStart(8, "0");
+  bits += "0";
+  let publisherId = "";
+  for (let offset = 0; offset < 65; offset += 5) {
+    publisherId += WINDOWS_PACKAGE_BASE32[Number.parseInt(bits.slice(offset, offset + 5), 2)];
+  }
+  return publisherId;
+}
+
+export function windowsPackageFullName({ name, version, architecture, publisherId }) {
+  return `${name}_${version}_${String(architecture).toLowerCase()}__${publisherId}`;
+}
+
+export function windowsProvisionedPackageIdentityMatches(candidate, expected) {
+  if (!candidate || !expected) return false;
+  const expectedFullName = windowsPackageFullName(expected);
+  return candidate.displayName === expected.name
+    && candidate.version === expected.version
+    && String(candidate.architecture).toLowerCase() === String(expected.architecture).toLowerCase()
+    && candidate.packageName === expectedFullName;
+}
+
+// Fixed, read-only host observation. Expected package metadata is passed only
+// through fixed environment keys; no tenant, user, or path is interpolated
+// into PowerShell source.
+export const WINDOWS_COWORK_INSPECTION_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+function Read-ServiceState([string]$Name) {
+  try {
+    $service = Get-Service -Name $Name -ErrorAction SilentlyContinue
+    if ($null -eq $service) { return 'missing' }
+    if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { return 'present-running' }
+    return 'present-stopped'
+  } catch { return 'unknown' }
+}
+function Read-DriverState([string]$Name) {
+  try {
+    $driver = Get-CimInstance -ClassName Win32_SystemDriver -Filter "Name='$Name'" -ErrorAction SilentlyContinue
+    if ($null -eq $driver) { return 'missing' }
+    if ($driver.State -eq 'Running') { return 'present-running' }
+    return 'present-stopped'
+  } catch { return 'unknown' }
+}
+$vmp = 'unknown'
+try {
+  $feature = Get-CimInstance -ClassName Win32_OptionalFeature -Filter "Name='VirtualMachinePlatform'" -ErrorAction Stop
+  if ($null -eq $feature) { $vmp = 'absent' }
+  elseif ($feature.InstallState -eq 1) { $vmp = 'enabled' }
+  elseif ($feature.InstallState -eq 2) { $vmp = 'disabled' }
+  elseif ($feature.InstallState -eq 3) { $vmp = 'absent' }
+} catch { $vmp = 'unknown' }
+$restartPending = $null
+try {
+  $cbs = Test-Path -LiteralPath 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'
+  $wu = Test-Path -LiteralPath 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
+  $restartPending = [bool]($cbs -or $wu)
+} catch { $restartPending = $null }
+$machineProvisioned = $null
+try {
+  $expectedName = $env:IMPEL_COWORK_EXPECTED_PACKAGE_NAME
+  $expectedVersion = $env:IMPEL_COWORK_EXPECTED_PACKAGE_VERSION
+  $expectedArchitecture = $env:IMPEL_COWORK_EXPECTED_PACKAGE_ARCHITECTURE
+  $expectedPublisherId = $env:IMPEL_COWORK_EXPECTED_PACKAGE_PUBLISHER_ID
+  $expectedPackageName = $expectedName + '_' + $expectedVersion + '_' + $expectedArchitecture.ToLowerInvariant() + '__' + $expectedPublisherId
+  $packages = Get-AppxProvisionedPackage -Online -ErrorAction Stop
+  $exact = $packages | Where-Object {
+    $displayMatches = ([string]$_.DisplayName -ceq $expectedName)
+    $versionMatches = ([string]$_.Version -ceq $expectedVersion)
+    $architectureMatches = ([string]$_.Architecture -ieq $expectedArchitecture)
+    $packageNameMatches = ([string]$_.PackageName -ceq $expectedPackageName)
+    $displayMatches -and $versionMatches -and $architectureMatches -and $packageNameMatches
+  } | Select-Object -First 1
+  $machineProvisioned = [bool]($null -ne $exact)
+} catch { $machineProvisioned = $null }
+$virtualMachine = $null
+$nestedVirtualization = $null
+try {
+  $computer = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop
+  $identity = (([string]$computer.Manufacturer) + ' ' + ([string]$computer.Model))
+  $virtualMachine = [bool]($identity -match 'Virtual|VMware|KVM|HVM|Hyper-V|Parallels|Xen')
+  if ($virtualMachine) {
+    $processors = @(Get-CimInstance -ClassName Win32_Processor -ErrorAction Stop)
+    $nestedVirtualization = [bool]($processors.Count -gt 0 -and ($processors | Where-Object {
+      -not ($_.VirtualizationFirmwareEnabled -and $_.VMMonitorModeExtensions)
+    }).Count -eq 0)
+  } else {
+    $nestedVirtualization = $true
+  }
+} catch {
+  $virtualMachine = $null
+  $nestedVirtualization = $null
+}
+[ordered]@{
+  schemaVersion = 1
+  virtualMachinePlatform = $vmp
+  restartPending = $restartPending
+  vmcompute = Read-ServiceState 'vmcompute'
+  hns = Read-ServiceState 'hns'
+  vfpext = Read-DriverState 'vfpext'
+  machineProvisioned = $machineProvisioned
+  virtualMachine = $virtualMachine
+  nestedVirtualization = $nestedVirtualization
+} | ConvertTo-Json -Compress -Depth 3
+`.trim();
+
+const VMP_STATES = new Set(["enabled", "disabled", "absent", "unknown"]);
+const COMPONENT_STATES = new Set(["present-running", "present-stopped", "missing", "unknown"]);
+
+function emptyChecks() {
+  return {
+    virtualMachinePlatform: "unknown",
+    restartPending: null,
+    vmcompute: "unknown",
+    hns: "unknown",
+    vfpext: "unknown",
+    machineProvisioned: null,
+    virtualMachine: null,
+    nestedVirtualization: null,
+  };
+}
+
+function normalizedFailure(reasonCode) {
+  return {
+    schemaVersion: 1,
+    status: "unknown",
+    enabled: false,
+    checks: emptyChecks(),
+    reasonCodes: [reasonCode],
+    remediation: [WINDOWS_COWORK_REMEDIATION.inspectHost],
+  };
+}
+
+export function unknownWindowsClaudeCoworkCapability(reasonCode = "inspector-not-run") {
+  return normalizedFailure(reasonCode);
+}
+
+function nullableBoolean(value) {
+  return value === null || typeof value === "boolean";
+}
+
+export function normalizeWindowsClaudeCoworkCapability(observation) {
+  if (
+    !observation
+    || observation.schemaVersion !== 1
+    || !VMP_STATES.has(observation.virtualMachinePlatform)
+    || !COMPONENT_STATES.has(observation.vmcompute)
+    || !COMPONENT_STATES.has(observation.hns)
+    || !COMPONENT_STATES.has(observation.vfpext)
+    || !nullableBoolean(observation.restartPending)
+    || !nullableBoolean(observation.machineProvisioned)
+    || !nullableBoolean(observation.virtualMachine)
+    || !nullableBoolean(observation.nestedVirtualization)
+  ) return normalizedFailure("inspector-malformed-output");
+
+  const checks = {
+    virtualMachinePlatform: observation.virtualMachinePlatform,
+    restartPending: observation.restartPending,
+    vmcompute: observation.vmcompute,
+    hns: observation.hns,
+    vfpext: observation.vfpext,
+    machineProvisioned: observation.machineProvisioned,
+    virtualMachine: observation.virtualMachine,
+    nestedVirtualization: observation.nestedVirtualization,
+  };
+  const reasonCodes = [];
+  const knownUnavailable = [];
+  const unknown = [];
+  const addKnown = (reason) => {
+    reasonCodes.push(reason);
+    knownUnavailable.push(reason);
+  };
+  const addUnknown = (reason) => {
+    reasonCodes.push(reason);
+    unknown.push(reason);
+  };
+
+  if (checks.virtualMachinePlatform === "disabled") addKnown("virtual-machine-platform-disabled");
+  else if (checks.virtualMachinePlatform === "absent") addKnown("virtual-machine-platform-absent");
+  else if (checks.virtualMachinePlatform === "unknown") addUnknown("virtual-machine-platform-unknown");
+
+  if (checks.virtualMachinePlatform === "enabled") {
+    for (const component of ["vmcompute", "hns", "vfpext"]) {
+      if (checks[component] === "missing") addKnown(`${component}-missing`);
+      else if (checks[component] === "unknown") addUnknown(`${component}-unknown`);
+    }
+  }
+  const componentsReady = [checks.vmcompute, checks.hns, checks.vfpext]
+    .every((state) => state.startsWith("present-"));
+  if (checks.restartPending === true && (
+    checks.virtualMachinePlatform !== "enabled" || !componentsReady
+  )) addKnown("restart-required");
+  else if (checks.restartPending === null && (
+    checks.virtualMachinePlatform !== "enabled" || !componentsReady
+  )) addUnknown("restart-state-unknown");
+
+  if (checks.machineProvisioned === false) addKnown("claude-machine-provisioning-missing");
+  else if (checks.machineProvisioned === null) addUnknown("claude-machine-provisioning-unknown");
+
+  if (checks.virtualMachine === null) addUnknown("virtualization-environment-unknown");
+  else if (checks.virtualMachine && checks.nestedVirtualization === false) addKnown("nested-virtualization-unavailable");
+  else if (checks.virtualMachine && checks.nestedVirtualization === null) addUnknown("nested-virtualization-unknown");
+
+  const enabled = checks.virtualMachinePlatform === "enabled"
+    && componentsReady
+    && checks.machineProvisioned === true
+    && checks.virtualMachine !== null
+    && (!checks.virtualMachine || checks.nestedVirtualization === true);
+  if (enabled) {
+    return {
+      schemaVersion: 1,
+      status: "available",
+      enabled: true,
+      checks,
+      reasonCodes: [],
+      remediation: [],
+    };
+  }
+
+  const remediation = [];
+  const addRemediation = (message) => {
+    if (!remediation.includes(message)) remediation.push(message);
+  };
+  if (reasonCodes.some((reason) => reason.startsWith("virtual-machine-platform-"))) {
+    addRemediation(WINDOWS_COWORK_REMEDIATION.enableVirtualMachinePlatform);
+  }
+  if (reasonCodes.includes("restart-required")) addRemediation(WINDOWS_COWORK_REMEDIATION.restartWindows);
+  if (reasonCodes.some((reason) => /^(?:vmcompute|hns|vfpext)-missing$/u.test(reason))) {
+    addRemediation(WINDOWS_COWORK_REMEDIATION.restoreHcs);
+  }
+  if (reasonCodes.includes("claude-machine-provisioning-missing")) {
+    addRemediation(WINDOWS_COWORK_REMEDIATION.provisionClaude);
+  }
+  if (reasonCodes.includes("nested-virtualization-unavailable")) {
+    addRemediation(WINDOWS_COWORK_REMEDIATION.enableNestedVirtualization);
+  }
+  if (unknown.length) addRemediation(WINDOWS_COWORK_REMEDIATION.inspectHost);
+
+  return {
+    schemaVersion: 1,
+    status: knownUnavailable.length ? "unavailable" : "unknown",
+    enabled: false,
+    checks,
+    reasonCodes,
+    remediation,
+  };
+}
+
+export function inspectWindowsClaudeCoworkCapability({
+  environment = process.env,
+  platform = process.platform,
+  run = spawnSync,
+  architecture = process.arch,
+} = {}) {
+  if (platform !== "win32") return normalizedFailure("inspector-not-windows");
+  const expectedArchitecture = /arm64/iu.test(
+    environmentValue(environment, "PROCESSOR_ARCHITEW6432")
+      || environmentValue(environment, "PROCESSOR_ARCHITECTURE")
+      || architecture,
+  ) ? "arm64" : "x64";
+  const pin = PINNED_VENDOR_APPS.claude.windows;
+  if (windowsPackagePublisherId(pin.publisher) !== pin.publisherId) {
+    return normalizedFailure("inspector-pinned-publisher-invalid");
+  }
+  let invocation;
+  try {
+    invocation = nativeCommandInvocation("powershell", [
+      "-NoLogo",
+      "-NoProfile",
+      "-NonInteractive",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      WINDOWS_COWORK_INSPECTION_SCRIPT,
+    ], environment, "win32");
+  } catch {
+    return normalizedFailure("inspector-powershell-failed");
+  }
+  let result;
+  try {
+    result = run(invocation.command, invocation.args, {
+      encoding: "utf8",
+      env: {
+        ...environment,
+        IMPEL_COWORK_EXPECTED_PACKAGE_NAME: pin.packageName,
+        IMPEL_COWORK_EXPECTED_PACKAGE_VERSION: pin.packageVersion,
+        IMPEL_COWORK_EXPECTED_PACKAGE_ARCHITECTURE: expectedArchitecture,
+        IMPEL_COWORK_EXPECTED_PACKAGE_PUBLISHER_ID: pin.publisherId,
+      },
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+    });
+  } catch {
+    return normalizedFailure("inspector-powershell-failed");
+  }
+  if (result?.error || result?.status !== 0) return normalizedFailure("inspector-powershell-failed");
+  try {
+    return normalizeWindowsClaudeCoworkCapability(JSON.parse(String(result.stdout || "").trim()));
+  } catch {
+    return normalizedFailure("inspector-malformed-output");
+  }
+}
+
+export function formatWindowsClaudeCoworkCapability(capability) {
+  if (!capability || capability.enabled === true) return [];
+  const reasons = Array.isArray(capability.reasonCodes) && capability.reasonCodes.length
+    ? capability.reasonCodes.join(", ")
+    : "host-prerequisites-unknown";
+  return [
+    `Claude Cowork ${capability.status || "unknown"} (${reasons}). Chat and Code remain available.`,
+    ...(Array.isArray(capability.remediation) ? capability.remediation.map((message) => `  ${message}`) : []),
+  ];
+}