impel-cli 0.18.15-beta.4 → 0.18.15-beta.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.15-beta.4",
+  "version": "0.18.15-beta.6",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -37,6 +37,17 @@ const APP_DEFINITIONS = {
     executableNames: ["ChatGPT", "Codex"],
   },
 };
+const BUNDLE_ARTIFACT_REMOVE_OPTIONS = Object.freeze({
+  recursive: true,
+  force: true,
+  maxRetries: 5,
+  retryDelay: 25,
+});
+const BUNDLE_LOCK_WAIT_MS = 120_000;
+const BUNDLE_LOCK_POLL_MS = 100;
+const BUNDLE_LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(4));
+const MACOS_O_EXLOCK = 0x00000020;
+const portableBundleMutationLocks = new Set();
 
 // Vendor updates can change minified renderer contracts without notice. Each
 // CLI release therefore installs and accepts only the exact app builds tested
@@ -246,7 +257,10 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // and the tenant manifest so unsupported hosts keep Chat and Code usable.
 // 25: remove the unproven Windows Cowork capability gate from beta.0 profiles
 // and restore the reviewed always-enabled managed policy.
-export const CURRENT_CONFIG_VERSION = 25;
+// 26: remember the managed provider defaults and move legacy GPT-5.5 profiles
+// onto GPT-5.6 Sol so ChatGPT's compact Work picker does not fall back to its
+// unsupported-selection "Reset to default" treatment.
+export const CURRENT_CONFIG_VERSION = 26;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -745,6 +759,7 @@ export function installManagedAppFiles({
     target,
     vendorPaths[target] || findVendorApp(target, homeDir),
   ]));
+  const previousManifest = readTenantManifest(homeDir, config.tenantId);
   const vendorCodexModels = targets.includes("chatgpt")
     ? readVendorCodexModels(resolvedVendorPaths.chatgpt)
     : new Map();
@@ -795,6 +810,7 @@ export function installManagedAppFiles({
         vendorCodexModels,
         chatgptInvocations,
         generatedAt,
+        previousManifest,
       );
       if (RUNTIME_BRAND.features.sessions) ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
     }
@@ -806,7 +822,7 @@ export function installManagedAppFiles({
   }
 
   writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
-    schemaVersion: 6,
+    schemaVersion: 7,
     configVersion: CURRENT_CONFIG_VERSION,
     modelCatalogVersion: 3,
     gatewayUrl: config.gatewayUrl,
@@ -819,6 +835,10 @@ export function installManagedAppFiles({
       models,
       config,
     ),
+    modelDefaults: {
+      claude: models.find((model) => model.provider === "claude" && model.default)?.id ?? null,
+      chatgpt: models.find((model) => model.provider === "codex" && model.default)?.id ?? null,
+    },
     models: models.map((model) => model.id),
     updatedAt: generatedAt,
   }, null, 2) + "\n", 0o600);
@@ -972,7 +992,6 @@ function installPinnedVendorApp(target, homeDir) {
       homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "vendor", target, pin.version, pin.bundleName,
     );
     fs.mkdirSync(path.dirname(destination), { recursive: true });
-    sweepStaleBundleArtifacts(path.dirname(destination), path.basename(destination));
     replaceDirectory(destination, extractedApp);
     return destination;
   } finally {
@@ -1153,6 +1172,7 @@ function writeChatGPTConfig(
   vendorCodexModels,
   invocations = null,
   generatedAt = new Date().toISOString(),
+  previousManifest = null,
 ) {
   const experimental = crossAppModelsEnabled(config);
   const orderedModels = experimental
@@ -1168,8 +1188,28 @@ function writeChatGPTConfig(
   const currentToml = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
   const configuredModel = readTopLevelTomlString(currentToml, "model");
   const defaultModelID = orderedModels.find((model) => model.provider === "codex" && model.default)?.id;
-  const selectedModel = codexModels.find((model) => model.slug === configuredModel)
-    || codexModels.find((model) => model.slug === defaultModelID)
+  const defaultModel = codexModels.find((model) => model.slug === defaultModelID);
+  const previousDefaultModelID = previousManifest?.modelDefaults?.chatgpt;
+  const followsPreviousManagedDefault = (
+    typeof previousDefaultModelID === "string"
+    && configuredModel === previousDefaultModelID
+    && configuredModel !== defaultModelID
+  );
+  // Profiles written before the default-model field existed cannot distinguish
+  // an old managed default from an explicit user choice. GPT-5.5 is the one
+  // observed legacy default that ChatGPT 26.727 renders as an unsupported
+  // compact-picker selection; migrate it once, while preserving every other
+  // explicit model choice.
+  const hasLegacyCompactPickerDefault = (
+    previousDefaultModelID == null
+    && Number(previousManifest?.configVersion ?? 0) < CURRENT_CONFIG_VERSION
+    && configuredModel === "gpt-5.5"
+    && defaultModelID === "gpt-5.6-sol"
+  );
+  const selectedModel = (followsPreviousManagedDefault || hasLegacyCompactPickerDefault
+    ? defaultModel
+    : codexModels.find((model) => model.slug === configuredModel))
+    || defaultModel
     || codexModels[0];
   if (!selectedModel) throw new Error("no Codex models are available for Impel ChatGPT");
   const configuredEffort = readTopLevelTomlString(currentToml, "model_reasoning_effort");
@@ -1529,6 +1569,12 @@ exec "$NODE" "$CLI" token${tenantArgs}
 }
 
 function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageName) {
+  return withBundleMutationLock(paths.claude.launcher, () => (
+    writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName)
+  ));
+}
+
+function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName) {
   if (!vendorPath) throw new Error("Claude vendor app is unavailable");
   if (!isVendableVendorApp("claude", vendorPath)) {
     const bundleId = readBundleIdentifier(vendorPath);
@@ -1542,9 +1588,8 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
   if (!executableName) throw new Error(`Claude executable is missing from ${vendorPath}`);
 
   const bundle = paths.claude.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
   sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   cloneAppBundle(vendorPath, staging);
   try {
     const plistPath = path.join(staging, "Contents", "Info.plist");
@@ -1626,9 +1671,9 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "Claude", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -1642,6 +1687,12 @@ function claudeUsageCompatibilityEnabled(gatewayUrl) {
 }
 
 function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
+  return withBundleMutationLock(paths.chatgpt.launcher, () => (
+    writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir)
+  ));
+}
+
+function writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir) {
   if (!vendorPath) throw new Error("ChatGPT/Codex vendor app is unavailable");
   const definition = APP_DEFINITIONS.chatgpt;
   const executableName = definition.executableNames.find((name) => (
@@ -1650,11 +1701,10 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
   if (!executableName) throw new Error(`ChatGPT/Codex executable is missing from ${vendorPath}`);
 
   const bundle = paths.chatgpt.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
+  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   const vendorBundleName = path.basename(vendorPath);
   const vendorBundle = path.join(staging, "Contents", "Resources", vendorBundleName);
-  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
   cloneAppBundle(vendorPath, vendorBundle);
   try {
     const asarPath = path.join(vendorBundle, "Contents", "Resources", "app.asar");
@@ -1730,9 +1780,9 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "ChatGPT", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -2536,24 +2586,105 @@ export function sweepStaleBundleArtifacts(dir, baseName) {
     throw error;
   }
   const prefixes = [`${baseName}.tmp-`, `${baseName}.previous-`];
-  const removed = entries.filter((entry) => prefixes.some((prefix) => entry.startsWith(prefix)));
-  for (const entry of removed) {
-    fs.rmSync(path.join(dir, entry), { recursive: true, force: true });
+  const removed = [];
+  for (const entry of entries.filter((candidate) => prefixes.some((prefix) => candidate.startsWith(prefix)))) {
+    if (removeBundleArtifact(path.join(dir, entry))) removed.push(entry);
   }
   return removed;
 }
 
-function replaceDirectory(destination, staging) {
-  const backup = `${destination}.previous-${process.pid}`;
-  fs.rmSync(backup, { recursive: true, force: true });
-  if (fs.existsSync(destination)) fs.renameSync(destination, backup);
+function uniqueBundleArtifactPath(destination, kind) {
+  return `${destination}.${kind}-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+}
+
+function removeBundleArtifact(candidate) {
+  try {
+    fs.rmSync(candidate, BUNDLE_ARTIFACT_REMOVE_OPTIONS);
+    return !fs.existsSync(candidate);
+  } catch {
+    return false;
+  }
+}
+
+export function withBundleMutationLock(destination, run) {
+  const lockPath = path.join(
+    path.dirname(destination),
+    `.${path.basename(destination)}.impel-install.lock`,
+  );
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+
+  if (process.platform !== "darwin") {
+    if (portableBundleMutationLocks.has(lockPath)) {
+      throw new Error(`another Impel app update is already replacing ${path.basename(destination)}`);
+    }
+    const descriptor = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_RDWR, 0o600);
+    portableBundleMutationLocks.add(lockPath);
+    try {
+      return run();
+    } finally {
+      portableBundleMutationLocks.delete(lockPath);
+      fs.closeSync(descriptor);
+    }
+  }
+
+  const deadline = Date.now() + BUNDLE_LOCK_WAIT_MS;
+  let descriptor;
+  while (descriptor === undefined) {
+    try {
+      descriptor = fs.openSync(
+        lockPath,
+        fs.constants.O_CREAT | fs.constants.O_RDWR | fs.constants.O_NONBLOCK | MACOS_O_EXLOCK,
+        0o600,
+      );
+    } catch (error) {
+      if (!["EAGAIN", "EWOULDBLOCK"].includes(error?.code)) throw error;
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another Impel app update to replace ${path.basename(destination)}`);
+      }
+      Atomics.wait(BUNDLE_LOCK_SLEEP, 0, 0, BUNDLE_LOCK_POLL_MS);
+    }
+  }
+  try {
+    return run();
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function replaceDirectoryUnlocked(destination, staging, {
+  removeArtifact = removeBundleArtifact,
+} = {}) {
+  const backup = fs.existsSync(destination)
+    ? uniqueBundleArtifactPath(destination, "previous")
+    : null;
+  if (backup) fs.renameSync(destination, backup);
   try {
     fs.renameSync(staging, destination);
-    fs.rmSync(backup, { recursive: true, force: true });
   } catch (error) {
-    if (!fs.existsSync(destination) && fs.existsSync(backup)) fs.renameSync(backup, destination);
+    if (backup && !fs.existsSync(destination) && fs.existsSync(backup)) {
+      fs.renameSync(backup, destination);
+    }
     throw error;
   }
+
+  // The new bundle is committed once staging has been renamed into place.
+  // Finder, LaunchServices, or a just-closed helper can briefly keep changing
+  // the old tree and make recursive removal end with ENOTEMPTY. Do not turn
+  // that post-commit housekeeping race into a failed tenant update: the next
+  // sweep will retry any backup that remains.
+  if (backup) {
+    try {
+      removeArtifact(backup);
+    } catch {
+      // Cleanup is best-effort after the committed rename.
+    }
+  }
+}
+
+export function replaceDirectory(destination, staging, options = {}) {
+  return withBundleMutationLock(destination, () => (
+    replaceDirectoryUnlocked(destination, staging, options)
+  ));
 }
 
 function isGatewayModel(model) {