impel-cli 0.18.15-beta.3 → 0.18.15-beta.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.15-beta.3",
+  "version": "0.18.15-beta.5",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -37,6 +37,17 @@ const APP_DEFINITIONS = {
     executableNames: ["ChatGPT", "Codex"],
   },
 };
+const BUNDLE_ARTIFACT_REMOVE_OPTIONS = Object.freeze({
+  recursive: true,
+  force: true,
+  maxRetries: 5,
+  retryDelay: 25,
+});
+const BUNDLE_LOCK_WAIT_MS = 120_000;
+const BUNDLE_LOCK_POLL_MS = 100;
+const BUNDLE_LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(4));
+const MACOS_O_EXLOCK = 0x00000020;
+const portableBundleMutationLocks = new Set();
 
 // Vendor updates can change minified renderer contracts without notice. Each
 // CLI release therefore installs and accepts only the exact app builds tested
@@ -81,17 +92,27 @@ export const PINNED_VENDOR_APPS = Object.freeze({
     }),
   }),
   chatgpt: Object.freeze({
-    version: "26.721.41059",
-    codexVersion: "0.146.0-alpha.3.1",
+    version: "26.727.40816",
+    codexVersion: "0.146.0-alpha.9.2",
     bundleName: "ChatGPT.app",
+    windows: Object.freeze({
+      storeProductId: "9PLM9XGG6VKS",
+      packageName: "OpenAI.Codex",
+      packageVersion: "26.721.11231.0",
+      advertisedPackageVersion: "26.727.4816.0",
+      codexVersion: "0.146.0-alpha.3.1",
+      publisherId: "2p2nqsd0c76g0",
+      executable: "app\\ChatGPT.exe",
+      updateManifestUrl: "https://persistent.oaistatic.com/codex-app-prod/windows-store-update.json",
+    }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.721.41059.zip",
-        sha256: "e2b45056f3d1f8ab90f7f16249bfb5a40d09d0f8099f12ca0d8d7a8fdf9108ce",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.727.40816.zip",
+        sha256: "fdbede9b8a28b5bf3bbf1213fa04291724faa6ed2d1d61bb04853bbdfebce219",
       }),
       x64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.721.41059.zip",
-        sha256: "f00b09d9e1f5138f055fa972e5243991b493423c41f5d78951dc2e21a84089f4",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.727.40816.zip",
+        sha256: "12622d916a3993d61fb52a318dcff7af7449eea5070cdd7e094da29f380e3374",
       }),
     }),
   }),
@@ -245,7 +266,7 @@ export const CURRENT_CONFIG_VERSION = 25;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-25.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-31.1";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -962,7 +983,6 @@ function installPinnedVendorApp(target, homeDir) {
       homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "vendor", target, pin.version, pin.bundleName,
     );
     fs.mkdirSync(path.dirname(destination), { recursive: true });
-    sweepStaleBundleArtifacts(path.dirname(destination), path.basename(destination));
     replaceDirectory(destination, extractedApp);
     return destination;
   } finally {
@@ -1519,6 +1539,12 @@ exec "$NODE" "$CLI" token${tenantArgs}
 }
 
 function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageName) {
+  return withBundleMutationLock(paths.claude.launcher, () => (
+    writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName)
+  ));
+}
+
+function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName) {
   if (!vendorPath) throw new Error("Claude vendor app is unavailable");
   if (!isVendableVendorApp("claude", vendorPath)) {
     const bundleId = readBundleIdentifier(vendorPath);
@@ -1532,9 +1558,8 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
   if (!executableName) throw new Error(`Claude executable is missing from ${vendorPath}`);
 
   const bundle = paths.claude.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
   sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   cloneAppBundle(vendorPath, staging);
   try {
     const plistPath = path.join(staging, "Contents", "Info.plist");
@@ -1616,9 +1641,9 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "Claude", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -1632,6 +1657,12 @@ function claudeUsageCompatibilityEnabled(gatewayUrl) {
 }
 
 function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
+  return withBundleMutationLock(paths.chatgpt.launcher, () => (
+    writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir)
+  ));
+}
+
+function writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir) {
   if (!vendorPath) throw new Error("ChatGPT/Codex vendor app is unavailable");
   const definition = APP_DEFINITIONS.chatgpt;
   const executableName = definition.executableNames.find((name) => (
@@ -1640,11 +1671,10 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
   if (!executableName) throw new Error(`ChatGPT/Codex executable is missing from ${vendorPath}`);
 
   const bundle = paths.chatgpt.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
+  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   const vendorBundleName = path.basename(vendorPath);
   const vendorBundle = path.join(staging, "Contents", "Resources", vendorBundleName);
-  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
   cloneAppBundle(vendorPath, vendorBundle);
   try {
     const asarPath = path.join(vendorBundle, "Contents", "Resources", "app.asar");
@@ -1720,9 +1750,9 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "ChatGPT", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -2215,6 +2245,7 @@ HERE=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 VENDOR_APP="$HERE/../Resources/"${shellQuote(vendorBundleName)}
 export CODEX_HOME=${shellQuote(paths.chatgpt.codexHome)}
 export CODEX_AUTHAPI_BASE_URL=${shellQuote(codexAccountBaseUrl)}
+export CODEX_SPARKLE_ENABLED=false
 unset CODEX_ACCESS_TOKEN CODEX_API_KEY OPENAI_API_KEY OPENAI_BASE_URL
 secure_codex_home() {
   [ ! -L "$CODEX_HOME" ] || exit 1
@@ -2525,24 +2556,105 @@ export function sweepStaleBundleArtifacts(dir, baseName) {
     throw error;
   }
   const prefixes = [`${baseName}.tmp-`, `${baseName}.previous-`];
-  const removed = entries.filter((entry) => prefixes.some((prefix) => entry.startsWith(prefix)));
-  for (const entry of removed) {
-    fs.rmSync(path.join(dir, entry), { recursive: true, force: true });
+  const removed = [];
+  for (const entry of entries.filter((candidate) => prefixes.some((prefix) => candidate.startsWith(prefix)))) {
+    if (removeBundleArtifact(path.join(dir, entry))) removed.push(entry);
   }
   return removed;
 }
 
-function replaceDirectory(destination, staging) {
-  const backup = `${destination}.previous-${process.pid}`;
-  fs.rmSync(backup, { recursive: true, force: true });
-  if (fs.existsSync(destination)) fs.renameSync(destination, backup);
+function uniqueBundleArtifactPath(destination, kind) {
+  return `${destination}.${kind}-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+}
+
+function removeBundleArtifact(candidate) {
+  try {
+    fs.rmSync(candidate, BUNDLE_ARTIFACT_REMOVE_OPTIONS);
+    return !fs.existsSync(candidate);
+  } catch {
+    return false;
+  }
+}
+
+export function withBundleMutationLock(destination, run) {
+  const lockPath = path.join(
+    path.dirname(destination),
+    `.${path.basename(destination)}.impel-install.lock`,
+  );
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+
+  if (process.platform !== "darwin") {
+    if (portableBundleMutationLocks.has(lockPath)) {
+      throw new Error(`another Impel app update is already replacing ${path.basename(destination)}`);
+    }
+    const descriptor = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_RDWR, 0o600);
+    portableBundleMutationLocks.add(lockPath);
+    try {
+      return run();
+    } finally {
+      portableBundleMutationLocks.delete(lockPath);
+      fs.closeSync(descriptor);
+    }
+  }
+
+  const deadline = Date.now() + BUNDLE_LOCK_WAIT_MS;
+  let descriptor;
+  while (descriptor === undefined) {
+    try {
+      descriptor = fs.openSync(
+        lockPath,
+        fs.constants.O_CREAT | fs.constants.O_RDWR | fs.constants.O_NONBLOCK | MACOS_O_EXLOCK,
+        0o600,
+      );
+    } catch (error) {
+      if (!["EAGAIN", "EWOULDBLOCK"].includes(error?.code)) throw error;
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another Impel app update to replace ${path.basename(destination)}`);
+      }
+      Atomics.wait(BUNDLE_LOCK_SLEEP, 0, 0, BUNDLE_LOCK_POLL_MS);
+    }
+  }
+  try {
+    return run();
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function replaceDirectoryUnlocked(destination, staging, {
+  removeArtifact = removeBundleArtifact,
+} = {}) {
+  const backup = fs.existsSync(destination)
+    ? uniqueBundleArtifactPath(destination, "previous")
+    : null;
+  if (backup) fs.renameSync(destination, backup);
   try {
     fs.renameSync(staging, destination);
-    fs.rmSync(backup, { recursive: true, force: true });
   } catch (error) {
-    if (!fs.existsSync(destination) && fs.existsSync(backup)) fs.renameSync(backup, destination);
+    if (backup && !fs.existsSync(destination) && fs.existsSync(backup)) {
+      fs.renameSync(backup, destination);
+    }
     throw error;
   }
+
+  // The new bundle is committed once staging has been renamed into place.
+  // Finder, LaunchServices, or a just-closed helper can briefly keep changing
+  // the old tree and make recursive removal end with ENOTEMPTY. Do not turn
+  // that post-commit housekeeping race into a failed tenant update: the next
+  // sweep will retry any backup that remains.
+  if (backup) {
+    try {
+      removeArtifact(backup);
+    } catch {
+      // Cleanup is best-effort after the committed rename.
+    }
+  }
+}
+
+export function replaceDirectory(destination, staging, options = {}) {
+  return withBundleMutationLock(destination, () => (
+    replaceDirectoryUnlocked(destination, staging, options)
+  ));
 }
 
 function isGatewayModel(model) {

package/src/windowsApps.js

@@ -11,9 +11,10 @@ import { environmentValue, nativeCommandInvocation } from "./nativeProcess.js";
 import { normalizeTenantId } from "./tenants.js";
 import { brandedEnvironmentName, RUNTIME_BRAND } from "./runtimeBrand.js";
 
-export const WINDOWS_CHATGPT_PACKAGE = "9PLM9XGG6VKS";
-export const WINDOWS_CHATGPT_PACKAGE_NAME = "OpenAI.Codex";
-export const WINDOWS_CHATGPT_PUBLISHER_ID = "2p2nqsd0c76g0";
+const WINDOWS_CHATGPT_PIN = PINNED_VENDOR_APPS.chatgpt.windows;
+export const WINDOWS_CHATGPT_PACKAGE = WINDOWS_CHATGPT_PIN.storeProductId;
+export const WINDOWS_CHATGPT_PACKAGE_NAME = WINDOWS_CHATGPT_PIN.packageName;
+export const WINDOWS_CHATGPT_PUBLISHER_ID = WINDOWS_CHATGPT_PIN.publisherId;
 const WINDOWS_CLAUDE_DOWNLOAD_TIMEOUT_MS = 5 * 60 * 1000;
 const WINDOWS_WINGET_UPDATE_NOT_APPLICABLE = 0x8A15002B;
 
@@ -60,20 +61,26 @@ function versionedSquirrelCandidates(root, readDirectory = fs.readdirSync) {
   }
 }
 
-function installedMsixChatGPT(environment, run = spawnSync) {
+function installedMsixChatGPT(environment, run = spawnSync, pin = null) {
   const script = [
     `$package = Get-AppxPackage -Name '${WINDOWS_CHATGPT_PACKAGE_NAME}' -ErrorAction SilentlyContinue`,
-    `$package = $package | Where-Object PublisherId -eq '${WINDOWS_CHATGPT_PUBLISHER_ID}' | Sort-Object Version -Descending | Select-Object -First 1`,
+    `$package = $package | Where-Object { $_.PublisherId -ceq '${WINDOWS_CHATGPT_PUBLISHER_ID}' -and (-not $env:IMPEL_CHATGPT_PACKAGE_VERSION -or $_.Version.ToString() -ceq $env:IMPEL_CHATGPT_PACKAGE_VERSION) } | Sort-Object Version -Descending | Select-Object -First 1`,
     "if ($package) {",
     "  $manifest = Get-AppxPackageManifest -Package $package",
     "  $relative = $manifest.Package.Applications.Application | Where-Object Id -eq 'App' | Select-Object -First 1 -ExpandProperty Executable",
-    "  if ($relative) { Join-Path $package.InstallLocation $relative }",
+    "  $normalized = ([string]$relative).Replace('/', '\\')",
+    "  $expected = ([string]$env:IMPEL_CHATGPT_PACKAGE_EXECUTABLE).Replace('/', '\\')",
+    "  if ($relative -and (-not $expected -or $normalized -ieq $expected)) { Join-Path $package.InstallLocation $relative }",
     "}",
   ].join("; ");
   try {
     const result = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
       encoding: "utf8",
-      env: windowsPowerShellEnvironment(environment),
+      env: {
+        ...windowsPowerShellEnvironment(environment),
+        IMPEL_CHATGPT_PACKAGE_VERSION: pin?.packageVersion || "",
+        IMPEL_CHATGPT_PACKAGE_EXECUTABLE: pin?.executable || "",
+      },
       stdio: ["ignore", "pipe", "ignore"],
       windowsHide: true,
     });
@@ -141,9 +148,23 @@ export function findWindowsChatGPTApp(environment = process.env, dependencies =
   return msix && exists(msix) ? path.win32.normalize(msix) : null;
 }
 
-function wingetInvocation(action, environment, { packageId, source = "winget", scope = "user" }) {
+function pinnedWindowsChatGPTApp(environment = process.env, dependencies = {}) {
+  const exists = dependencies.isFile || isFile;
+  const pin = dependencies.pin || WINDOWS_CHATGPT_PIN;
+  const msix = (dependencies.queryMsix || installedMsixChatGPT)(environment, dependencies.run, pin);
+  return msix && exists(msix) ? path.win32.normalize(msix) : null;
+}
+
+function wingetInvocation(action, environment, {
+  packageId,
+  source = "winget",
+  scope = "user",
+}) {
   const verb = action === "update" ? "upgrade" : "install";
   const scopeArgs = scope ? ["--scope", scope] : [];
+  // Microsoft Store packages commonly report Version "Unknown" to winget.
+  // Without this switch winget refuses to consider their available update.
+  const updateArgs = action === "update" ? ["--include-unknown"] : [];
   return nativeCommandInvocation(
     "winget",
     [
@@ -154,6 +175,7 @@ function wingetInvocation(action, environment, { packageId, source = "winget", s
       "--source",
       source,
       ...scopeArgs,
+      ...updateArgs,
       "--silent",
       "--disable-interactivity",
       "--accept-package-agreements",
@@ -372,21 +394,31 @@ export async function ensureWindowsClaudeApp(_options = {}, dependencies = {}) {
 
 /** Install/update OpenAI's official ChatGPT/Codex Store package. */
 export function ensureWindowsChatGPTApp({ update = false } = {}, dependencies = {}) {
+  const find = dependencies.find || findWindowsChatGPTApp;
+  const findPinned = dependencies.findPinned || dependencies.find || pinnedWindowsChatGPTApp;
   const io = {
     environment: process.env,
-    find: findWindowsChatGPTApp,
+    find,
+    findPinned,
     logger: console,
+    pin: WINDOWS_CHATGPT_PIN,
     run: spawnSync,
     ...dependencies,
   };
   const before = io.find(io.environment);
-  if (before && !update) return { binary: before, action: "existing", result: null };
+  const pinnedBefore = io.findPinned(io.environment, { pin: io.pin, run: io.run });
+  if (pinnedBefore && !update) {
+    return { binary: pinnedBefore, action: "existing", result: null };
+  }
 
   // `impel update` also repairs missing surfaces. A missing Store package must
   // be installed, not sent to `winget upgrade` (which returns 0x8A150014).
   const shouldUpdate = Boolean(update && before);
+  // The msstore source rejects its AppX package version as a winget --version
+  // selector. Install the current Store package, then fail closed below unless
+  // Windows registered the exact reviewed package version and executable.
   const invocation = wingetInvocation(shouldUpdate ? "update" : "install", io.environment, {
-    packageId: WINDOWS_CHATGPT_PACKAGE,
+    packageId: io.pin.storeProductId,
     source: "msstore",
     scope: null,
   });
@@ -400,26 +432,36 @@ export function ensureWindowsChatGPTApp({ update = false } = {}, dependencies =
   } catch (error) {
     result = { status: null, error };
   }
-  const binary = io.find(io.environment) || before;
+  let resultBinary = io.findPinned(io.environment, { pin: io.pin, run: io.run });
   // winget uses an error HRESULT when `upgrade` finds an installed package
   // with no newer Store release. That is a healthy idempotent update result,
   // not an installation failure (APPINSTALLER_CLI_ERROR_UPDATE_NOT_APPLICABLE).
   const alreadyUpToDate = Boolean(
     shouldUpdate
-    && binary
+    && resultBinary
     && !result?.error
     && Number.isInteger(result?.status)
     && (result.status >>> 0) === WINDOWS_WINGET_UPDATE_NOT_APPLICABLE,
   );
   if (alreadyUpToDate) {
-    io.logger.log("ChatGPT/Codex: Microsoft Store package already up to date.");
+    io.logger.log(`ChatGPT/Codex: Microsoft Store package ${io.pin.packageVersion} already up to date.`);
+  }
+  const commandSucceeded = (result?.status === 0 && !result?.error) || alreadyUpToDate;
+  if (commandSucceeded && !resultBinary) {
+    result = {
+      ...result,
+      error: new Error(
+        `ChatGPT/Codex Store package ${io.pin.packageVersion} did not appear after winget completed`,
+      ),
+    };
   }
-  const succeeded = (result?.status === 0 && !result?.error) || alreadyUpToDate;
+  const succeeded = commandSucceeded && Boolean(resultBinary);
+  if (!succeeded) resultBinary = null;
   return {
-    binary,
+    binary: resultBinary,
     action: alreadyUpToDate
       ? "existing"
-      : succeeded ? (shouldUpdate ? "updated" : "installed") : (before ? "existing" : "install-failed"),
+      : succeeded ? (shouldUpdate ? "updated" : "installed") : "install-failed",
     result,
   };
 }
@@ -617,6 +659,7 @@ export function launchWindowsChatGPTApp(binary, {
     "CODEX_AUTHAPI_BASE_URL",
     "CODEX_ELECTRON_USER_DATA_PATH",
     "CODEX_HOME",
+    "CODEX_SPARKLE_ENABLED",
     "OPENAI_API_KEY",
     "OPENAI_BASE_URL",
   ]);
@@ -625,6 +668,7 @@ export function launchWindowsChatGPTApp(binary, {
   }
   environment.CODEX_HOME = codexHome;
   environment.CODEX_AUTHAPI_BASE_URL = `${gatewayUrl}/chatgpt_passthrough/backend-api`;
+  environment.CODEX_SPARKLE_ENABLED = "false";
   // Codex Desktop resolves this before acquiring Electron's single-instance
   // lock. Keep --user-data-dir below as a compatibility fallback for builds
   // that predate the dedicated desktop override.