impel-cli 0.18.13 → 0.18.14-beta.1

package/README.md

@@ -14,7 +14,7 @@ impel update
 
 ## Install
 
-Install the public npm package once per machine:
+On macOS and Linux, install the public npm package once per machine:
 
 ```sh
 npm install --global impel-cli
@@ -22,17 +22,31 @@ npm install --global impel-cli
 
 Node.js 18 or newer is required.
 
+On Windows PowerShell, invoke npm's command shims explicitly:
+
+```powershell
+npm.cmd install --global impel-cli
+impel.cmd setup
+```
+
+The explicit `.cmd` suffix prevents PowerShell from selecting npm's `.ps1`
+shim when script execution is restricted. Impel does not change the machine's
+or current user's PowerShell execution policy.
+
 On macOS, setup and update verify Apple's Xcode Command Line Tools before any
 profile, app, or skills work begins. If they are missing, Impel opens the
 system installer with `xcode-select --install` and stops safely; finish that
 installation, then rerun the same Impel command.
 
-Then run setup and paste an Impel Personal Access Token when prompted:
+Then run setup and paste an Impel Personal Access Token when prompted. On
+macOS and Linux:
 
 ```sh
 impel setup
 ```
 
+On Windows PowerShell, use `impel.cmd setup` as shown above.
+
 Setup discovers every tenant available to the PAT and prepares all supported
 surfaces for each tenant. You do not need to repeat setup tenant by tenant.
 
@@ -128,6 +142,12 @@ Run one command for routine maintenance:
 impel update
 ```
 
+On Windows PowerShell, keep the command shim explicit:
+
+```powershell
+impel.cmd update
+```
+
 Update:
 
 1. On macOS, verifies the Xcode Command Line Tools and opens Apple's installer
@@ -261,6 +281,15 @@ compatibility for one release, but no command can enable native routing.
 ### Windows
 
 - Missing official Claude Code and Codex CLIs can be installed during setup.
+- Each CLI prompt explains that Impel will download, verify, and install the
+  official vendor CLI for the current user; each defaults to No.
+- Run `impel.cmd setup` or `impel.cmd update` from PowerShell so restricted
+  script policy cannot select the npm-generated `impel.ps1` shim. Impel does
+  not modify persistent PowerShell execution policy.
+- Claude Chat, Code, and Cowork remain enabled through the per-user managed
+  profile. Impel does not infer Cowork runtime support during setup or update.
+- If Cowork reports a problem, open Claude Desktop's **Help > Troubleshooting >
+  Show Logs** and use the vendor diagnostics for that exact runtime failure.
 - Claude Desktop is downloaded from Anthropic as the exact x64 or arm64 MSIX
   pinned by this CLI. Its SHA-256, Authenticode signature, package identity,
   version, architecture, and required layout are checked before installation.
@@ -344,6 +373,15 @@ run a real package manager, or modify native personal profiles.
 CI runs on Ubuntu, macOS, and Windows with supported Node versions. See
 [RELEASING.md](RELEASING.md) for the npm release process.
 
+The pinned macOS CLI installer contract follows the official Claude and Codex
+installer redirects with the production downloader, then verifies their
+reviewed final origins, size, shell-script marker, and SHA-256 without executing
+either script or touching a local profile. Run it explicitly with:
+
+```sh
+IMPEL_VALIDATE_PINNED_MAC_CLI_INSTALLERS=1 node --test test/mac-installer-contract.test.js
+```
+
 The separate Windows vendor contract runs only on a disposable GitHub-hosted
 Windows VM. It installs the exact newer Claude fixture that preceded the
 current compatibility pin, invokes the production downloader and installer to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.13",
+  "version": "0.18.14-beta.1",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -232,7 +232,11 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // 22: refresh GPT-5.6 model windows from the pinned ChatGPT Codex catalog.
 // 23: select Codex's unelevated native Windows sandbox for managed profiles so
 // enterprise machines do not enter the administrator-only setup flow.
-export const CURRENT_CONFIG_VERSION = 23;
+// 24: thread the inspected Windows Cowork host capability into Claude config
+// and the tenant manifest so unsupported hosts keep Chat and Code usable.
+// 25: remove the unproven Windows Cowork capability gate from beta.0 profiles
+// and restore the reviewed always-enabled managed policy.
+export const CURRENT_CONFIG_VERSION = 25;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -790,7 +794,7 @@ export function installManagedAppFiles({
   }
 
   writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
-    schemaVersion: 4,
+    schemaVersion: 6,
     configVersion: CURRENT_CONFIG_VERSION,
     modelCatalogVersion: 3,
     gatewayUrl: config.gatewayUrl,

package/src/commands/apps.js

@@ -777,7 +777,9 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       managedChatGPT = io.stageChatGPTApp(vendorPaths.chatgpt, actionPaths.root);
     }
 
-    const { userData } = configureWindowsApps(config, actionTargets, vendorPaths, catalog, io);
+    const { userData } = configureWindowsApps(config, actionTargets, vendorPaths, catalog, {
+      ...io,
+    });
     const tenantPaths = appPaths(io.homeDir, config.tenantId, {
       claudeUserData: userData,
       tenantName: config.tenantName,

package/src/commands/converge.js

@@ -123,6 +123,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
     confirmVendorInstall: confirmInstall,
   }, overrides.reconcileOverrides || {});
 
+  const cliInstallDecisions = new Map();
   let sharedFailure = null;
   const prepareSharedClis = async ({ confirmedTools = null, inspectOnly = false } = {}) => {
     try {
@@ -141,11 +142,20 @@ export async function cmdConverge(argv = [], overrides = {}) {
             for (const tool of inspected.missingAfter) {
               if (!inspected.installCommands?.[tool]) continue;
               const label = tool === "claude" ? "Claude Code" : "Codex";
-              if (confirmed(await io.promptText(`Install the official ${label} CLI for this user? [y/N] `))) {
+              if (confirmed(await io.promptText(`Impel will download, verify, and install the official ${label} CLI for the current user. Continue? [y/N] `))) {
                 installTools.push(tool);
+                cliInstallDecisions.set(tool, "approved");
+              } else {
+                cliInstallDecisions.set(tool, "declined");
               }
             }
+          } else {
+            for (const tool of inspected.missingAfter) {
+              if (inspected.installCommands?.[tool]) cliInstallDecisions.set(tool, "confirmation-required");
+            }
           }
+        } else {
+          for (const tool of installTools) cliInstallDecisions.set(tool, "approved");
         }
         if (installTools.length) {
           prepared = await io.preparePlatformClis({
@@ -157,7 +167,15 @@ export async function cmdConverge(argv = [], overrides = {}) {
           });
         }
       }
-      sharedFailure = prepared.missingAfter.length ? describeCliFailure(prepared) : null;
+      sharedFailure = prepared.missingAfter.length
+        ? describeCliFailure(prepared, {
+            commandName: "update",
+            cliExecutable: io.platform === "win32" ? "impel.cmd" : "impel",
+            isTTY: io.isTTY,
+            decisions: cliInstallDecisions,
+            skipClis,
+          })
+        : null;
       return prepared;
     } catch (error) {
       sharedFailure = redactSecretText(error?.message || error);

package/src/commands/setup.js

@@ -253,6 +253,7 @@ export async function cmdSetup(argv, overrides = {}) {
     return allowed;
   };
 
+  const cliInstallDecisions = new Map();
   let sharedFailure = null;
   const prepareSharedClis = async ({ confirmedTools = null, inspectOnly = false } = {}) => {
     try {
@@ -271,11 +272,20 @@ export async function cmdSetup(argv, overrides = {}) {
             for (const tool of inspected.missingAfter) {
               if (!inspected.installCommands?.[tool]) continue;
               const label = tool === "claude" ? "Claude Code" : "Codex";
-              if (confirmed(await io.promptText(`Install the official ${label} CLI for this user? [y/N] `))) {
+              if (confirmed(await io.promptText(`Impel will download, verify, and install the official ${label} CLI for the current user. Continue? [y/N] `))) {
                 installTools.push(tool);
+                cliInstallDecisions.set(tool, "approved");
+              } else {
+                cliInstallDecisions.set(tool, "declined");
               }
             }
+          } else {
+            for (const tool of inspected.missingAfter) {
+              if (inspected.installCommands?.[tool]) cliInstallDecisions.set(tool, "confirmation-required");
+            }
           }
+        } else {
+          for (const tool of installTools) cliInstallDecisions.set(tool, "approved");
         }
         if (installTools.length) {
           prepared = await io.preparePlatformClis({
@@ -288,7 +298,13 @@ export async function cmdSetup(argv, overrides = {}) {
         }
       }
       if (prepared.missingAfter.length) {
-        sharedFailure = describeCliFailure(prepared);
+        sharedFailure = describeCliFailure(prepared, {
+          commandName: "setup",
+          cliExecutable: io.platform === "win32" ? "impel.cmd" : "impel",
+          isTTY: io.isTTY,
+          decisions: cliInstallDecisions,
+          skipClis: flags["skip-clis"],
+        });
         return prepared;
       }
       sharedFailure = null;
@@ -476,7 +492,8 @@ export async function cmdSetup(argv, overrides = {}) {
     : "Launch: no provider CLI is currently available for this tenant");
   if (!report.passed || sharedFailure) {
     if (sharedFailure) console.error(`Shared setup failure: ${sharedFailure}`);
-    console.error("Setup is incomplete. Fix the reported issue or rerun `impel setup`.");
+    const setupCommand = io.platform === "win32" ? "impel.cmd setup" : "impel setup";
+    console.error(`Setup is incomplete. Fix the reported issue or rerun \`${setupCommand}\`.`);
     process.exitCode = 1;
     return report;
   }

package/src/commands/status.js

@@ -27,7 +27,7 @@ function readShellManifest(paths) {
   }
 }
 
-function desktopReadiness(tenant, {
+export function desktopReadiness(tenant, {
   platform = process.platform,
   homeDir = os.homedir(),
   environment = process.env,

package/src/macSetup.js

@@ -20,13 +20,21 @@ const MAC_SIGNING_TEAMS = Object.freeze({ claude: "Q6L2SF6YDW", codex: "2DC432GL
 export const MAC_CLI_INSTALLERS = Object.freeze({
   claude: Object.freeze({
     url: "https://claude.ai/install.sh",
-    sha256: "b3f79015b54c751440a6488f07b1b64f9088742b9052bc1bd356d13108320d2a",
+    trustedOrigins: Object.freeze([
+      "https://claude.ai",
+      "https://downloads.claude.ai",
+    ]),
+    sha256: "cde4f1702d3b1695f92b73d26888364e17bca476e17f0fd676484c951d36c125",
     command: "curl -fsSL https://claude.ai/install.sh | bash -s stable",
     args: Object.freeze(["stable"]),
     environment: Object.freeze({}),
   }),
   codex: Object.freeze({
     url: "https://chatgpt.com/codex/install.sh",
+    trustedOrigins: Object.freeze([
+      "https://chatgpt.com",
+      "https://releases.openai.com",
+    ]),
     sha256: "1154e9daf713aacd1534efca8042bfd6665ad24bc1d1dfd86b8f439fe60a7a5d",
     command: "curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 CODEX_RELEASE=0.144.6 sh",
     args: Object.freeze([]),
@@ -75,7 +83,10 @@ function detectMacClis(find, environment, verify) {
   return { claude: detect("claude"), codex: detect("codex") };
 }
 
-async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers }) {
+export async function fetchVerifiedMacCliInstaller(tool, {
+  fetchImpl = fetch,
+  installers = MAC_CLI_INSTALLERS,
+} = {}) {
   const installer = installers[tool];
   if (!installer) throw new Error(`unsupported macOS CLI installer: ${tool}`);
   const controller = new AbortController();
@@ -87,9 +98,14 @@ async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers })
     clearTimeout(timeout);
   }
   if (!response.ok) throw new Error(`official ${tool} installer returned HTTP ${response.status}`);
-  const finalUrl = new URL(response.url || installer.url);
-  if (finalUrl.protocol !== "https:" || !["claude.ai", "chatgpt.com"].includes(finalUrl.hostname)) {
-    throw new Error(`official ${tool} installer redirected to an untrusted origin`);
+  let finalUrl;
+  try {
+    finalUrl = new URL(response.url || installer.url);
+  } catch {
+    throw new Error(`official ${tool} installer returned an invalid final URL`);
+  }
+  if (finalUrl.protocol !== "https:" || !installer.trustedOrigins?.includes(finalUrl.origin)) {
+    throw new Error(`official ${tool} installer redirected to untrusted origin ${finalUrl.origin}`);
   }
   const bytes = Buffer.from(await response.arrayBuffer());
   if (bytes.length === 0 || bytes.length > MAX_INSTALLER_BYTES) {
@@ -101,6 +117,11 @@ async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers })
   }
   const source = bytes.toString("utf8");
   if (!source.startsWith("#!")) throw new Error(`official ${tool} installer was not a shell script`);
+  return { bytes, finalUrl: finalUrl.href, sha256: digest, status: response.status };
+}
+
+async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers }) {
+  const { bytes } = await fetchVerifiedMacCliInstaller(tool, { fetchImpl, installers });
   const directory = fsImpl.mkdtempSync(path.join(os.tmpdir(), `impel-${tool}-installer-`));
   const script = path.join(directory, "install.sh");
   fsImpl.writeFileSync(script, bytes, { mode: 0o700 });

package/src/platformSetup.js

@@ -31,19 +31,39 @@ export async function preparePlatformClis(options = {}, dependencies = {}) {
   };
 }
 
-export function describeCliFailure(prepared) {
+export function describeCliFailure(prepared, {
+  commandName = "setup",
+  cliExecutable = "impel",
+  isTTY = true,
+  decisions = {},
+  skipClis = false,
+} = {}) {
   const labels = { claude: "Claude Code", codex: "Codex" };
   const details = [];
   for (const tool of prepared.missingAfter || []) {
     const installation = prepared.installations?.[tool];
     const failure = installation?.failure;
+    const decision = decisions instanceof Map ? decisions.get(tool) : decisions?.[tool];
+    const attempted = Boolean(
+      installation?.attempted
+      || failure
+      || installation?.succeeded === false,
+    );
     const reason = failure?.message || failure?.code
       || (Number.isInteger(failure?.status)
         ? `exit ${failure.status}`
-        : installation ? "not discoverable after installation" : "not installed or discoverable");
+        : attempted
+          ? "not discoverable after installation"
+          : decision === "declined"
+            ? "automatic installation was declined"
+            : skipClis
+              ? "installation was skipped by --skip-clis"
+              : !isTTY && prepared.installCommands?.[tool]
+                ? `interactive confirmation required; rerun \`${cliExecutable} ${commandName}\` interactively (or use \`--skip-clis\` to leave it uninstalled)`
+                : "not installed or discoverable");
     details.push(`${labels[tool] || tool}: ${redactSecretText(reason)}`);
     const command = installation?.command || prepared.installCommands?.[tool];
-    if (command) details.push(`manual ${tool} installer: ${redactSecretText(command)}`);
+    if (attempted && command) details.push(`manual ${tool} recovery command: ${redactSecretText(command)}`);
   }
   return details.join("; ") || `missing vendor CLIs: ${(prepared.missingAfter || []).join(", ")}`;
 }

package/src/shellEntries.js

@@ -8,7 +8,11 @@ import { redactSecretText } from "./config.js";
 import { environmentValue, nativeCommandInvocation, resolveNativeBinary } from "./nativeProcess.js";
 import { managedCliEntrypoint } from "./selfInvocation.js";
 import { normalizeTenantId } from "./tenants.js";
-import { windowsClaudeUserData } from "./windowsApps.js";
+import {
+  findManagedWindowsChatGPTApp,
+  findWindowsClaudeApp,
+  windowsClaudeUserData,
+} from "./windowsApps.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 const LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
@@ -151,6 +155,8 @@ export function registerTenantShellEntries({
   run = spawnSync,
   writeManifest = writeShellEntryManifest,
   shortcut = registerWindowsTenantShortcut,
+  findClaudeApp = findWindowsClaudeApp,
+  findChatGPTApp = findManagedWindowsChatGPTApp,
 } = {}) {
   const id = normalizeTenantId(tenantId);
   const paths = appPaths(homeDir, id, {
@@ -175,9 +181,27 @@ export function registerTenantShellEntries({
     };
     for (const product of targets) {
       if (!available[product]) throw new Error(`managed ${product} profile is missing for tenant ${id}`);
+      let iconExecutable;
+      try {
+        iconExecutable = product === "claude"
+          ? findClaudeApp(environment)
+          : findChatGPTApp(paths.root);
+      } catch (error) {
+        throw new Error(`could not resolve ${product} shortcut icon (${redactSecretText(error?.message || String(error))})`);
+      }
+      if (!iconExecutable || !path.win32.isAbsolute(iconExecutable)) {
+        throw new Error(`managed ${product} shortcut icon executable is unavailable for tenant ${id}`);
+      }
       registered.push({
         product,
-        path: shortcut({ product, tenantId: id, tenantName, environment, run }),
+        path: shortcut({
+          product,
+          tenantId: id,
+          tenantName,
+          environment,
+          run,
+          iconPath: `${path.win32.normalize(iconExecutable)},0`,
+        }),
         status: "ready",
       });
     }