impel-cli 0.18.14-beta.0 → 0.18.14-beta.1

package/README.md

@@ -286,16 +286,10 @@ compatibility for one release, but no command can enable native routing.
 - Run `impel.cmd setup` or `impel.cmd update` from PowerShell so restricted
   script policy cannot select the npm-generated `impel.ps1` shim. Impel does
   not modify persistent PowerShell execution policy.
-- Claude Chat and Code remain available through the per-user managed profile.
-  Cowork is enabled only when a read-only check confirms Virtual Machine
-  Platform, the HCS services and `vfpext` driver, nested virtualization when
-  applicable, and machine-wide provisioning of the exact pinned Claude MSIX.
-- When those Cowork prerequisites are missing or cannot be read, Impel hides
-  the Cowork tab and reports the reason and remediation in setup, update, and
-  status. Impel never enables Windows features, restarts Windows, provisions a
-  machine-wide package, or elevates itself.
-- Machine-wide deployment requirements are documented by Anthropic in
-  [Deploy Claude Desktop for Windows](https://support.claude.com/en/articles/12622703-deploy-claude-desktop-for-windows).
+- Claude Chat, Code, and Cowork remain enabled through the per-user managed
+  profile. Impel does not infer Cowork runtime support during setup or update.
+- If Cowork reports a problem, open Claude Desktop's **Help > Troubleshooting >
+  Show Logs** and use the vendor diagnostics for that exact runtime failure.
 - Claude Desktop is downloaded from Anthropic as the exact x64 or arm64 MSIX
   pinned by this CLI. Its SHA-256, Authenticode signature, package identity,
   version, architecture, and required layout are checked before installation.
@@ -379,6 +373,15 @@ run a real package manager, or modify native personal profiles.
 CI runs on Ubuntu, macOS, and Windows with supported Node versions. See
 [RELEASING.md](RELEASING.md) for the npm release process.
 
+The pinned macOS CLI installer contract follows the official Claude and Codex
+installer redirects with the production downloader, then verifies their
+reviewed final origins, size, shell-script marker, and SHA-256 without executing
+either script or touching a local profile. Run it explicitly with:
+
+```sh
+IMPEL_VALIDATE_PINNED_MAC_CLI_INSTALLERS=1 node --test test/mac-installer-contract.test.js
+```
+
 The separate Windows vendor contract runs only on a disposable GitHub-hosted
 Windows VM. It installs the exact newer Claude fixture that preceded the
 current compatibility pin, invokes the production downloader and installer to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.14-beta.0",
+  "version": "0.18.14-beta.1",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -57,7 +57,6 @@ export const PINNED_VENDOR_APPS = Object.freeze({
       packageName: "Claude",
       packageVersion: "1.24012.9.0",
       publisher: 'CN="Anthropic, PBC", O="Anthropic, PBC", L=San Francisco, S=California, C=US, SERIALNUMBER=4860621, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US',
-      publisherId: "pzs8sxrjxfjjc",
       executable: "app\\Claude.exe",
       downloads: Object.freeze({
         arm64: Object.freeze({
@@ -235,7 +234,9 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // enterprise machines do not enter the administrator-only setup flow.
 // 24: thread the inspected Windows Cowork host capability into Claude config
 // and the tenant manifest so unsupported hosts keep Chat and Code usable.
-export const CURRENT_CONFIG_VERSION = 24;
+// 25: remove the unproven Windows Cowork capability gate from beta.0 profiles
+// and restore the reviewed always-enabled managed policy.
+export const CURRENT_CONFIG_VERSION = 25;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -713,7 +714,6 @@ export function installManagedAppFiles({
   writeTokenHelperFile = true,
   claudeUserData = null,
   chatgptInvocations = null,
-  windowsCoworkCapability = null,
   generatedAt = new Date().toISOString(),
 }) {
   // true = rebuild every target's bundle; false = configs only; an array
@@ -772,7 +772,7 @@ export function installManagedAppFiles({
       migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
       writeClaudeNative3PSelection(paths);
       writeClaudeCodeSettings(paths);
-      writeClaudeConfig(paths, config, models, windowsCoworkCapability);
+      writeClaudeConfig(paths, config, models);
       if (RUNTIME_BRAND.features.sessions) ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
     }
     else {
@@ -793,33 +793,8 @@ export function installManagedAppFiles({
     });
   }
 
-  const manifestCoworkCapability = windowsCoworkCapability
-    ? {
-        schemaVersion: 1,
-        status: ["available", "unavailable", "unknown"].includes(windowsCoworkCapability.status)
-          ? windowsCoworkCapability.status
-          : "unknown",
-        enabled: windowsCoworkCapability.enabled === true,
-        checks: {
-          virtualMachinePlatform: windowsCoworkCapability.checks?.virtualMachinePlatform ?? "unknown",
-          restartPending: windowsCoworkCapability.checks?.restartPending ?? null,
-          vmcompute: windowsCoworkCapability.checks?.vmcompute ?? "unknown",
-          hns: windowsCoworkCapability.checks?.hns ?? "unknown",
-          vfpext: windowsCoworkCapability.checks?.vfpext ?? "unknown",
-          machineProvisioned: windowsCoworkCapability.checks?.machineProvisioned ?? null,
-          virtualMachine: windowsCoworkCapability.checks?.virtualMachine ?? null,
-          nestedVirtualization: windowsCoworkCapability.checks?.nestedVirtualization ?? null,
-        },
-        reasonCodes: Array.isArray(windowsCoworkCapability.reasonCodes)
-          ? [...windowsCoworkCapability.reasonCodes]
-          : ["inspector-malformed-output"],
-        remediation: Array.isArray(windowsCoworkCapability.remediation)
-          ? [...windowsCoworkCapability.remediation]
-          : [],
-      }
-    : null;
   writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
-    schemaVersion: 5,
+    schemaVersion: 6,
     configVersion: CURRENT_CONFIG_VERSION,
     modelCatalogVersion: 3,
     gatewayUrl: config.gatewayUrl,
@@ -832,7 +807,6 @@ export function installManagedAppFiles({
       models,
       config,
     ),
-    ...(manifestCoworkCapability ? { capabilities: { claudeCowork: manifestCoworkCapability } } : {}),
     models: models.map((model) => model.id),
     updatedAt: generatedAt,
   }, null, 2) + "\n", 0o600);
@@ -1059,7 +1033,7 @@ export function removeManagedApps(targets, {
   }
 }
 
-function writeClaudeConfig(paths, config, models, windowsCoworkCapability = null) {
+function writeClaudeConfig(paths, config, models) {
   const dir = path.join(paths.claude.userData, "configLibrary");
   const experimental = crossAppModelsEnabled(config);
   const claudeModels = experimental
@@ -1074,13 +1048,10 @@ function writeClaudeConfig(paths, config, models, windowsCoworkCapability = null
     inferenceGatewayAuthScheme: "bearer",
     modelDiscoveryEnabled: false,
     inferenceModels: claudeModels,
-    // These are Anthropic's native managed 3P surface controls. Windows
-    // enables Cowork only after a separate read-only host inspection proves
-    // the VMP/HCS/machine-provisioning prerequisites. Other platforms and
-    // legacy callers without a Windows observation retain the reviewed true.
-    coworkTabEnabled: windowsCoworkCapability
-      ? windowsCoworkCapability.enabled === true
-      : true,
+    // These are Anthropic's native managed 3P surface controls. Cowork and
+    // Code default to enabled in the pinned build, but state them explicitly
+    // so an older generated profile cannot leave either surface disabled.
+    coworkTabEnabled: true,
     isClaudeCodeForDesktopEnabled: true,
     // Chat is the only opt-in surface in the pinned build.
     chatTabEnabled: true,

package/src/commands/apps.js

@@ -60,11 +60,6 @@ import {
   windowsManagedChatGPTRoot,
 } from "../windowsApps.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
-import {
-  formatWindowsClaudeCoworkCapability,
-  inspectWindowsClaudeCoworkCapability,
-  unknownWindowsClaudeCoworkCapability,
-} from "../windowsCapabilities.js";
 
 const CLAUDE_KEYCHAIN_NOTICE = "Claude Keychain: enter your Mac login password and choose Always Allow on the first prompt for this tenant; Allow is temporary.";
 
@@ -324,7 +319,6 @@ function configureWindowsApps(config, targets, vendorPaths, catalog, io) {
     writeTokenHelperFile: false,
     claudeUserData: userData,
     chatgptInvocations: { auth, mcp },
-    windowsCoworkCapability: io.windowsCoworkCapability || null,
   });
   return { catalog, userData };
 }
@@ -359,10 +353,7 @@ export async function reconcileWindowsTenantApps({
   confirmVendorInstall = async () => true,
   homeDir = os.homedir(),
   environment = process.env,
-  windowsCoworkCapability = null,
 } = {}, overrides = {}) {
-  const effectiveCoworkCapability = windowsCoworkCapability
-    || unknownWindowsClaudeCoworkCapability();
   const io = {
     findClaudeApp: findWindowsClaudeApp,
     ensureClaudeApp: ensureWindowsClaudeApp,
@@ -444,7 +435,6 @@ export async function reconcileWindowsTenantApps({
       ...io,
       homeDir,
       environment,
-      windowsCoworkCapability: effectiveCoworkCapability,
     });
   }
   const agentTargets = [];
@@ -638,7 +628,6 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     syncSkills: syncSkillsSafe,
     syncAgents: syncAgentProfilesSafe,
     selectedConfig: selectedAppConfig,
-    inspectCoworkCapability: inspectWindowsClaudeCoworkCapability,
     ...overrides,
   };
   // Preserve the original Windows-Claude override names used by embedders and
@@ -667,10 +656,6 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       console.log(`  profile: ${fs.existsSync(claudeConfigPath) ? paths.claude.userData : "not installed"}`);
       console.log(`  vendor:  ${io.findClaudeApp(io.environment) || "not installed"}`);
       console.log("  open:    impel app open claude");
-      const manifest = localTenantId ? readTenantManifest(io.homeDir, localTenantId) : null;
-      for (const line of formatWindowsClaudeCoworkCapability(manifest?.capabilities?.claudeCowork)) {
-        console.log(`  ${line}`);
-      }
     }
     if (targets.includes("chatgpt")) {
       console.log("Impel ChatGPT:");
@@ -792,13 +777,8 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       managedChatGPT = io.stageChatGPTApp(vendorPaths.chatgpt, actionPaths.root);
     }
 
-    const windowsCoworkCapability = io.inspectCoworkCapability({
-      environment: io.environment,
-      platform: "win32",
-    });
     const { userData } = configureWindowsApps(config, actionTargets, vendorPaths, catalog, {
       ...io,
-      windowsCoworkCapability,
     });
     const tenantPaths = appPaths(io.homeDir, config.tenantId, {
       claudeUserData: userData,

package/src/commands/status.js

@@ -17,7 +17,6 @@ import { installedVersion, maybePrintUpdateNotice } from "../updates.js";
 import { windowsClaudeUserData } from "../windowsApps.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 import { cachedProviderReadiness, providerAvailable } from "../providerReadiness.js";
-import { formatWindowsClaudeCoworkCapability } from "../windowsCapabilities.js";
 
 function readShellManifest(paths) {
   try {
@@ -38,7 +37,6 @@ export function desktopReadiness(tenant, {
     return {
       claude: { app: "unavailable", shell: "unavailable" },
       codex: { app: "unavailable", shell: "unavailable" },
-      cowork: null,
     };
   }
   const claudeUserData = platform === "win32" ? windowsClaudeUserData(environment, tenant.id) : null;
@@ -72,7 +70,6 @@ export function desktopReadiness(tenant, {
       shell: shellReady ? "ready" : "missing",
     };
   }
-  states.cowork = manifest?.capabilities?.claudeCowork || null;
   return states;
 }
 
@@ -128,8 +125,6 @@ export async function cmdStatus(overrides = {}) {
   };
   console.log("Tenant readiness:");
   let incomplete = false;
-  let currentCowork = null;
-  let fallbackCowork = null;
   for (const tenant of [...selected.tenants].sort((left, right) => left.id.localeCompare(right.id))) {
     const profiles = io.cliReadiness(tenant.id);
     const desktop = io.desktopReadiness(tenant, overrides);
@@ -150,15 +145,12 @@ export async function cmdStatus(overrides = {}) {
     });
     const states = [claudeCli, codexCli, desktop.claude.app, desktop.codex.app, desktop.claude.shell, desktop.codex.shell];
     if (states.includes("missing")) incomplete = true;
-    fallbackCowork ||= desktop.cowork || null;
-    if (tenant.id === selected.tenantId) currentCowork = desktop.cowork || null;
     console.log(
       `  ${tenant.id}${tenant.id === selected.tenantId ? " (current)" : ""}: `
       + `Claude CLI ${claudeCli}, Codex CLI ${codexCli}, `
       + `Claude app ${desktop.claude.app}, ChatGPT app ${desktop.codex.app}`,
     );
   }
-  for (const line of formatWindowsClaudeCoworkCapability(currentCowork || fallbackCowork)) console.log(line);
   if (incomplete) {
     console.log(RUNTIME_BRAND.tenant.defaultId
       ? `Repair or finish missing tenant surfaces with: ${RUNTIME_BRAND.cli.command} setup`

package/src/macSetup.js

@@ -20,13 +20,21 @@ const MAC_SIGNING_TEAMS = Object.freeze({ claude: "Q6L2SF6YDW", codex: "2DC432GL
 export const MAC_CLI_INSTALLERS = Object.freeze({
   claude: Object.freeze({
     url: "https://claude.ai/install.sh",
-    sha256: "b3f79015b54c751440a6488f07b1b64f9088742b9052bc1bd356d13108320d2a",
+    trustedOrigins: Object.freeze([
+      "https://claude.ai",
+      "https://downloads.claude.ai",
+    ]),
+    sha256: "cde4f1702d3b1695f92b73d26888364e17bca476e17f0fd676484c951d36c125",
     command: "curl -fsSL https://claude.ai/install.sh | bash -s stable",
     args: Object.freeze(["stable"]),
     environment: Object.freeze({}),
   }),
   codex: Object.freeze({
     url: "https://chatgpt.com/codex/install.sh",
+    trustedOrigins: Object.freeze([
+      "https://chatgpt.com",
+      "https://releases.openai.com",
+    ]),
     sha256: "1154e9daf713aacd1534efca8042bfd6665ad24bc1d1dfd86b8f439fe60a7a5d",
     command: "curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 CODEX_RELEASE=0.144.6 sh",
     args: Object.freeze([]),
@@ -75,7 +83,10 @@ function detectMacClis(find, environment, verify) {
   return { claude: detect("claude"), codex: detect("codex") };
 }
 
-async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers }) {
+export async function fetchVerifiedMacCliInstaller(tool, {
+  fetchImpl = fetch,
+  installers = MAC_CLI_INSTALLERS,
+} = {}) {
   const installer = installers[tool];
   if (!installer) throw new Error(`unsupported macOS CLI installer: ${tool}`);
   const controller = new AbortController();
@@ -87,9 +98,14 @@ async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers })
     clearTimeout(timeout);
   }
   if (!response.ok) throw new Error(`official ${tool} installer returned HTTP ${response.status}`);
-  const finalUrl = new URL(response.url || installer.url);
-  if (finalUrl.protocol !== "https:" || !["claude.ai", "chatgpt.com"].includes(finalUrl.hostname)) {
-    throw new Error(`official ${tool} installer redirected to an untrusted origin`);
+  let finalUrl;
+  try {
+    finalUrl = new URL(response.url || installer.url);
+  } catch {
+    throw new Error(`official ${tool} installer returned an invalid final URL`);
+  }
+  if (finalUrl.protocol !== "https:" || !installer.trustedOrigins?.includes(finalUrl.origin)) {
+    throw new Error(`official ${tool} installer redirected to untrusted origin ${finalUrl.origin}`);
   }
   const bytes = Buffer.from(await response.arrayBuffer());
   if (bytes.length === 0 || bytes.length > MAX_INSTALLER_BYTES) {
@@ -101,6 +117,11 @@ async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers })
   }
   const source = bytes.toString("utf8");
   if (!source.startsWith("#!")) throw new Error(`official ${tool} installer was not a shell script`);
+  return { bytes, finalUrl: finalUrl.href, sha256: digest, status: response.status };
+}
+
+async function downloadPinnedInstaller(tool, { fetchImpl, fsImpl, installers }) {
+  const { bytes } = await fetchVerifiedMacCliInstaller(tool, { fetchImpl, installers });
   const directory = fsImpl.mkdtempSync(path.join(os.tmpdir(), `impel-${tool}-installer-`));
   const script = path.join(directory, "install.sh");
   fsImpl.writeFileSync(script, bytes, { mode: 0o700 });

package/src/provisioning.js

@@ -17,10 +17,6 @@ import {
 } from "./tenants.js";
 import { reconcileTenantApps } from "./commands/apps.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
-import {
-  formatWindowsClaudeCoworkCapability,
-  inspectWindowsClaudeCoworkCapability,
-} from "./windowsCapabilities.js";
 
 export function selectDefaultTenant(listing, { requested = null, currentTenantId = null } = {}) {
   const normalized = requested ? normalizeTenantId(requested) : null;
@@ -189,7 +185,6 @@ export async function reconcileAllTenants({
     reconcileApps: reconcileTenantApps,
     registerShellEntries: registerTenantShellEntries,
     knownTenantIds: locallyKnownTenantIds,
-    inspectCoworkCapability: inspectWindowsClaudeCoworkCapability,
     ...overrides,
   };
   // Dependency-injection compatibility for older embedders/tests. Production
@@ -213,9 +208,6 @@ export async function reconcileAllTenants({
     claude: io.findBinary("claude", environment, platform),
     codex: io.findBinary("codex", environment, platform),
   };
-  const windowsCoworkCapability = includeApps && platform === "win32"
-    ? io.inspectCoworkCapability({ environment, platform })
-    : null;
   const results = new Map(liveTenants.map((tenant) => [tenant.id, {
     tenantId: tenant.id,
     tenantName: tenant.name,
@@ -270,7 +262,6 @@ export async function reconcileAllTenants({
           homeDir,
           environment,
           confirmVendorInstall,
-          windowsCoworkCapability,
         }, overrides.appOverrides || {});
         supported = new Set(installed.targets || []);
         const failedApps = installed.failed || [];
@@ -342,7 +333,6 @@ export async function reconcileAllTenants({
     selectedTenantId: config.tenantId,
     tenants: values,
     inaccessible,
-    ...(windowsCoworkCapability ? { capabilities: { claudeCowork: windowsCoworkCapability } } : {}),
     passed: values.every((result) => (
       (result.cli === "ready" || result.cli === "unavailable")
       && (result.apps === "ready" || result.apps === "unavailable")
@@ -376,7 +366,6 @@ export function printReconciliationSummary(report, log = console.log) {
   if (report.inaccessible.length) {
     log(`  Retained local data for inaccessible tenants: ${report.inaccessible.join(", ")}`);
   }
-  for (const line of formatWindowsClaudeCoworkCapability(report.capabilities?.claudeCowork)) log(line);
 }
 
 export function tenantCliPathsReady(tenantId, existsSync = fs.existsSync) {

package/src/windowsCapabilities.js

@@ -1,334 +0,0 @@
-import { spawnSync } from "node:child_process";
-import crypto from "node:crypto";
-
-import { PINNED_VENDOR_APPS } from "./apps.js";
-import { environmentValue, nativeCommandInvocation } from "./nativeProcess.js";
-
-export const WINDOWS_COWORK_REMEDIATION = Object.freeze({
-  enableVirtualMachinePlatform: "Enable the Windows Virtual Machine Platform optional feature, then restart Windows.",
-  restartWindows: "Restart Windows to finish Virtual Machine Platform and service provisioning.",
-  restoreHcs: "Ask an administrator or endpoint manager to restore the vmcompute, hns, and vfpext Windows components.",
-  provisionClaude: "Ask an administrator or endpoint manager to machine-provision the exact pinned Claude MSIX with Add-AppxProvisionedPackage.",
-  enableNestedVirtualization: "Enable nested virtualization for this VM, or use a physical Windows host for Claude Cowork.",
-  inspectHost: "Ask an administrator to verify Virtual Machine Platform, HCS services, vfpext, and machine-wide Claude provisioning.",
-});
-
-const WINDOWS_PACKAGE_BASE32 = "0123456789abcdefghjkmnpqrstvwxyz";
-
-/** Derive the stable Package Family Name publisher id from the exact DN. */
-export function windowsPackagePublisherId(publisher) {
-  const hash = crypto.createHash("sha256").update(Buffer.from(String(publisher), "utf16le")).digest();
-  let bits = "";
-  for (const byte of hash.subarray(0, 8)) bits += byte.toString(2).padStart(8, "0");
-  bits += "0";
-  let publisherId = "";
-  for (let offset = 0; offset < 65; offset += 5) {
-    publisherId += WINDOWS_PACKAGE_BASE32[Number.parseInt(bits.slice(offset, offset + 5), 2)];
-  }
-  return publisherId;
-}
-
-export function windowsPackageFullName({ name, version, architecture, publisherId }) {
-  return `${name}_${version}_${String(architecture).toLowerCase()}__${publisherId}`;
-}
-
-export function windowsProvisionedPackageIdentityMatches(candidate, expected) {
-  if (!candidate || !expected) return false;
-  const expectedFullName = windowsPackageFullName(expected);
-  return candidate.displayName === expected.name
-    && candidate.version === expected.version
-    && String(candidate.architecture).toLowerCase() === String(expected.architecture).toLowerCase()
-    && candidate.packageName === expectedFullName;
-}
-
-// Fixed, read-only host observation. Expected package metadata is passed only
-// through fixed environment keys; no tenant, user, or path is interpolated
-// into PowerShell source.
-export const WINDOWS_COWORK_INSPECTION_SCRIPT = String.raw`
-$ErrorActionPreference = 'Stop'
-function Read-ServiceState([string]$Name) {
-  try {
-    $service = Get-Service -Name $Name -ErrorAction SilentlyContinue
-    if ($null -eq $service) { return 'missing' }
-    if ($service.Status -eq [System.ServiceProcess.ServiceControllerStatus]::Running) { return 'present-running' }
-    return 'present-stopped'
-  } catch { return 'unknown' }
-}
-function Read-DriverState([string]$Name) {
-  try {
-    $driver = Get-CimInstance -ClassName Win32_SystemDriver -Filter "Name='$Name'" -ErrorAction SilentlyContinue
-    if ($null -eq $driver) { return 'missing' }
-    if ($driver.State -eq 'Running') { return 'present-running' }
-    return 'present-stopped'
-  } catch { return 'unknown' }
-}
-$vmp = 'unknown'
-try {
-  $feature = Get-CimInstance -ClassName Win32_OptionalFeature -Filter "Name='VirtualMachinePlatform'" -ErrorAction Stop
-  if ($null -eq $feature) { $vmp = 'absent' }
-  elseif ($feature.InstallState -eq 1) { $vmp = 'enabled' }
-  elseif ($feature.InstallState -eq 2) { $vmp = 'disabled' }
-  elseif ($feature.InstallState -eq 3) { $vmp = 'absent' }
-} catch { $vmp = 'unknown' }
-$restartPending = $null
-try {
-  $cbs = Test-Path -LiteralPath 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'
-  $wu = Test-Path -LiteralPath 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
-  $restartPending = [bool]($cbs -or $wu)
-} catch { $restartPending = $null }
-$machineProvisioned = $null
-try {
-  $expectedName = $env:IMPEL_COWORK_EXPECTED_PACKAGE_NAME
-  $expectedVersion = $env:IMPEL_COWORK_EXPECTED_PACKAGE_VERSION
-  $expectedArchitecture = $env:IMPEL_COWORK_EXPECTED_PACKAGE_ARCHITECTURE
-  $expectedPublisherId = $env:IMPEL_COWORK_EXPECTED_PACKAGE_PUBLISHER_ID
-  $expectedPackageName = $expectedName + '_' + $expectedVersion + '_' + $expectedArchitecture.ToLowerInvariant() + '__' + $expectedPublisherId
-  $packages = Get-AppxProvisionedPackage -Online -ErrorAction Stop
-  $exact = $packages | Where-Object {
-    $displayMatches = ([string]$_.DisplayName -ceq $expectedName)
-    $versionMatches = ([string]$_.Version -ceq $expectedVersion)
-    $architectureMatches = ([string]$_.Architecture -ieq $expectedArchitecture)
-    $packageNameMatches = ([string]$_.PackageName -ceq $expectedPackageName)
-    $displayMatches -and $versionMatches -and $architectureMatches -and $packageNameMatches
-  } | Select-Object -First 1
-  $machineProvisioned = [bool]($null -ne $exact)
-} catch { $machineProvisioned = $null }
-$virtualMachine = $null
-$nestedVirtualization = $null
-try {
-  $computer = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop
-  $identity = (([string]$computer.Manufacturer) + ' ' + ([string]$computer.Model))
-  $virtualMachine = [bool]($identity -match 'Virtual|VMware|KVM|HVM|Hyper-V|Parallels|Xen')
-  if ($virtualMachine) {
-    $processors = @(Get-CimInstance -ClassName Win32_Processor -ErrorAction Stop)
-    $nestedVirtualization = [bool]($processors.Count -gt 0 -and ($processors | Where-Object {
-      -not ($_.VirtualizationFirmwareEnabled -and $_.VMMonitorModeExtensions)
-    }).Count -eq 0)
-  } else {
-    $nestedVirtualization = $true
-  }
-} catch {
-  $virtualMachine = $null
-  $nestedVirtualization = $null
-}
-[ordered]@{
-  schemaVersion = 1
-  virtualMachinePlatform = $vmp
-  restartPending = $restartPending
-  vmcompute = Read-ServiceState 'vmcompute'
-  hns = Read-ServiceState 'hns'
-  vfpext = Read-DriverState 'vfpext'
-  machineProvisioned = $machineProvisioned
-  virtualMachine = $virtualMachine
-  nestedVirtualization = $nestedVirtualization
-} | ConvertTo-Json -Compress -Depth 3
-`.trim();
-
-const VMP_STATES = new Set(["enabled", "disabled", "absent", "unknown"]);
-const COMPONENT_STATES = new Set(["present-running", "present-stopped", "missing", "unknown"]);
-
-function emptyChecks() {
-  return {
-    virtualMachinePlatform: "unknown",
-    restartPending: null,
-    vmcompute: "unknown",
-    hns: "unknown",
-    vfpext: "unknown",
-    machineProvisioned: null,
-    virtualMachine: null,
-    nestedVirtualization: null,
-  };
-}
-
-function normalizedFailure(reasonCode) {
-  return {
-    schemaVersion: 1,
-    status: "unknown",
-    enabled: false,
-    checks: emptyChecks(),
-    reasonCodes: [reasonCode],
-    remediation: [WINDOWS_COWORK_REMEDIATION.inspectHost],
-  };
-}
-
-export function unknownWindowsClaudeCoworkCapability(reasonCode = "inspector-not-run") {
-  return normalizedFailure(reasonCode);
-}
-
-function nullableBoolean(value) {
-  return value === null || typeof value === "boolean";
-}
-
-export function normalizeWindowsClaudeCoworkCapability(observation) {
-  if (
-    !observation
-    || observation.schemaVersion !== 1
-    || !VMP_STATES.has(observation.virtualMachinePlatform)
-    || !COMPONENT_STATES.has(observation.vmcompute)
-    || !COMPONENT_STATES.has(observation.hns)
-    || !COMPONENT_STATES.has(observation.vfpext)
-    || !nullableBoolean(observation.restartPending)
-    || !nullableBoolean(observation.machineProvisioned)
-    || !nullableBoolean(observation.virtualMachine)
-    || !nullableBoolean(observation.nestedVirtualization)
-  ) return normalizedFailure("inspector-malformed-output");
-
-  const checks = {
-    virtualMachinePlatform: observation.virtualMachinePlatform,
-    restartPending: observation.restartPending,
-    vmcompute: observation.vmcompute,
-    hns: observation.hns,
-    vfpext: observation.vfpext,
-    machineProvisioned: observation.machineProvisioned,
-    virtualMachine: observation.virtualMachine,
-    nestedVirtualization: observation.nestedVirtualization,
-  };
-  const reasonCodes = [];
-  const knownUnavailable = [];
-  const unknown = [];
-  const addKnown = (reason) => {
-    reasonCodes.push(reason);
-    knownUnavailable.push(reason);
-  };
-  const addUnknown = (reason) => {
-    reasonCodes.push(reason);
-    unknown.push(reason);
-  };
-
-  if (checks.virtualMachinePlatform === "disabled") addKnown("virtual-machine-platform-disabled");
-  else if (checks.virtualMachinePlatform === "absent") addKnown("virtual-machine-platform-absent");
-  else if (checks.virtualMachinePlatform === "unknown") addUnknown("virtual-machine-platform-unknown");
-
-  if (checks.virtualMachinePlatform === "enabled") {
-    for (const component of ["vmcompute", "hns", "vfpext"]) {
-      if (checks[component] === "missing") addKnown(`${component}-missing`);
-      else if (checks[component] === "unknown") addUnknown(`${component}-unknown`);
-    }
-  }
-  const componentsReady = [checks.vmcompute, checks.hns, checks.vfpext]
-    .every((state) => state.startsWith("present-"));
-  if (checks.restartPending === true && (
-    checks.virtualMachinePlatform !== "enabled" || !componentsReady
-  )) addKnown("restart-required");
-  else if (checks.restartPending === null && (
-    checks.virtualMachinePlatform !== "enabled" || !componentsReady
-  )) addUnknown("restart-state-unknown");
-
-  if (checks.machineProvisioned === false) addKnown("claude-machine-provisioning-missing");
-  else if (checks.machineProvisioned === null) addUnknown("claude-machine-provisioning-unknown");
-
-  if (checks.virtualMachine === null) addUnknown("virtualization-environment-unknown");
-  else if (checks.virtualMachine && checks.nestedVirtualization === false) addKnown("nested-virtualization-unavailable");
-  else if (checks.virtualMachine && checks.nestedVirtualization === null) addUnknown("nested-virtualization-unknown");
-
-  const enabled = checks.virtualMachinePlatform === "enabled"
-    && componentsReady
-    && checks.machineProvisioned === true
-    && checks.virtualMachine !== null
-    && (!checks.virtualMachine || checks.nestedVirtualization === true);
-  if (enabled) {
-    return {
-      schemaVersion: 1,
-      status: "available",
-      enabled: true,
-      checks,
-      reasonCodes: [],
-      remediation: [],
-    };
-  }
-
-  const remediation = [];
-  const addRemediation = (message) => {
-    if (!remediation.includes(message)) remediation.push(message);
-  };
-  if (reasonCodes.some((reason) => reason.startsWith("virtual-machine-platform-"))) {
-    addRemediation(WINDOWS_COWORK_REMEDIATION.enableVirtualMachinePlatform);
-  }
-  if (reasonCodes.includes("restart-required")) addRemediation(WINDOWS_COWORK_REMEDIATION.restartWindows);
-  if (reasonCodes.some((reason) => /^(?:vmcompute|hns|vfpext)-missing$/u.test(reason))) {
-    addRemediation(WINDOWS_COWORK_REMEDIATION.restoreHcs);
-  }
-  if (reasonCodes.includes("claude-machine-provisioning-missing")) {
-    addRemediation(WINDOWS_COWORK_REMEDIATION.provisionClaude);
-  }
-  if (reasonCodes.includes("nested-virtualization-unavailable")) {
-    addRemediation(WINDOWS_COWORK_REMEDIATION.enableNestedVirtualization);
-  }
-  if (unknown.length) addRemediation(WINDOWS_COWORK_REMEDIATION.inspectHost);
-
-  return {
-    schemaVersion: 1,
-    status: knownUnavailable.length ? "unavailable" : "unknown",
-    enabled: false,
-    checks,
-    reasonCodes,
-    remediation,
-  };
-}
-
-export function inspectWindowsClaudeCoworkCapability({
-  environment = process.env,
-  platform = process.platform,
-  run = spawnSync,
-  architecture = process.arch,
-} = {}) {
-  if (platform !== "win32") return normalizedFailure("inspector-not-windows");
-  const expectedArchitecture = /arm64/iu.test(
-    environmentValue(environment, "PROCESSOR_ARCHITEW6432")
-      || environmentValue(environment, "PROCESSOR_ARCHITECTURE")
-      || architecture,
-  ) ? "arm64" : "x64";
-  const pin = PINNED_VENDOR_APPS.claude.windows;
-  if (windowsPackagePublisherId(pin.publisher) !== pin.publisherId) {
-    return normalizedFailure("inspector-pinned-publisher-invalid");
-  }
-  let invocation;
-  try {
-    invocation = nativeCommandInvocation("powershell", [
-      "-NoLogo",
-      "-NoProfile",
-      "-NonInteractive",
-      "-ExecutionPolicy",
-      "Bypass",
-      "-Command",
-      WINDOWS_COWORK_INSPECTION_SCRIPT,
-    ], environment, "win32");
-  } catch {
-    return normalizedFailure("inspector-powershell-failed");
-  }
-  let result;
-  try {
-    result = run(invocation.command, invocation.args, {
-      encoding: "utf8",
-      env: {
-        ...environment,
-        IMPEL_COWORK_EXPECTED_PACKAGE_NAME: pin.packageName,
-        IMPEL_COWORK_EXPECTED_PACKAGE_VERSION: pin.packageVersion,
-        IMPEL_COWORK_EXPECTED_PACKAGE_ARCHITECTURE: expectedArchitecture,
-        IMPEL_COWORK_EXPECTED_PACKAGE_PUBLISHER_ID: pin.publisherId,
-      },
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true,
-      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
-    });
-  } catch {
-    return normalizedFailure("inspector-powershell-failed");
-  }
-  if (result?.error || result?.status !== 0) return normalizedFailure("inspector-powershell-failed");
-  try {
-    return normalizeWindowsClaudeCoworkCapability(JSON.parse(String(result.stdout || "").trim()));
-  } catch {
-    return normalizedFailure("inspector-malformed-output");
-  }
-}
-
-export function formatWindowsClaudeCoworkCapability(capability) {
-  if (!capability || capability.enabled === true) return [];
-  const reasons = Array.isArray(capability.reasonCodes) && capability.reasonCodes.length
-    ? capability.reasonCodes.join(", ")
-    : "host-prerequisites-unknown";
-  return [
-    `Claude Cowork ${capability.status || "unknown"} (${reasons}). Chat and Code remain available.`,
-    ...(Array.isArray(capability.remediation) ? capability.remediation.map((message) => `  ${message}`) : []),
-  ];
-}