impel-cli 0.18.15-beta.6 → 0.18.15-beta.8

package/README.md

@@ -223,6 +223,11 @@ impel update --no-recovery    # disable recovery for this run
 schema verified by that CLI. It does not mean cloning an untested moving vendor
 release.
 
+Stable installations follow npm's `latest` tag. Prerelease installations made
+from `impel-cli@next` remain on the `next` channel during `impel update`. If npm
+metadata is temporarily unavailable, update preserves the installed CLI build
+and continues tenant reconciliation without attempting a downgrade.
+
 ## Status and diagnosis
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.15-beta.6",
+  "version": "0.18.15-beta.8",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -269,7 +269,7 @@ export const CURRENT_CONFIG_VERSION = 26;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-31.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-31.2";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -347,7 +347,7 @@ export function bundleIsCurrent(status, {
       compatibility.vendorSignaturesPreserved === true
       && compatibility.resourceRoot === CHATGPT_RESOURCE_ROOT
       && compatibility.patches?.fastModeForGatewayAuth > 0
-      && compatibility.patches?.tenantDisplayNamePreload === 1
+      && compatibility.patches?.tenantDisplayNamePreload === 2
     )),
   );
 }
@@ -1772,7 +1772,7 @@ function writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir
       patches: {
         fastModeForGatewayAuth: fastModePatchCount,
         desktopAPIForGatewayAuth: 0,
-        tenantDisplayNamePreload: 1,
+        tenantDisplayNamePreload: 2,
       },
       vendorSignaturesPreserved: true,
       resourceRoot: CHATGPT_RESOURCE_ROOT,
@@ -2299,6 +2299,7 @@ secure_codex_home
 BROWSER_DATA=${shellQuote(paths.chatgpt.browserData)}
 mkdir -p "$BROWSER_DATA"
 export IMPEL_APP_DISPLAY_NAME=${shellQuote(paths.chatgpt.displayName)}
+export IMPEL_APP_BUNDLE_ID=${shellQuote(paths.chatgpt.bundleIdentifier)}
 PRELOAD="$HERE/../Resources/impel-chatgpt-preload.cjs"
 export NODE_OPTIONS="--require=\\\"$PRELOAD\\\""
 # Electron resolves resources from the Impel wrapper when the nested app is
@@ -2313,13 +2314,14 @@ function vendoredChatGPTDisplayNamePreload() {
   return `"use strict";
 
 const displayName = process.env.IMPEL_APP_DISPLAY_NAME;
-if (process.type === "browser" && displayName) {
+const bundleIdentifier = process.env.IMPEL_APP_BUNDLE_ID;
+if (process.type === "browser" && displayName && bundleIdentifier) {
   const Module = require("node:module");
   const path = require("node:path");
   const load = Module._load;
   let objc;
   let appKit;
-  let launchServicesNamed = false;
+  let launchServicesIdentified = false;
   let activationPolicyRefreshed = false;
 
   const loadNativeBridge = () => {
@@ -2331,20 +2333,31 @@ if (process.type === "browser" && displayName) {
     return { objc, appKit };
   };
 
-  const setLaunchServicesApplicationName = () => {
-    if (launchServicesNamed) return;
+  const setLaunchServicesApplicationIdentity = () => {
+    if (launchServicesIdentified) return;
     try {
       const native = loadNativeBridge();
       new native.objc.NobjcLibrary(
         "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices",
       );
       const title = native.appKit.NSString.stringWithUTF8String$(displayName);
+      const identifier = native.appKit.NSString.stringWithUTF8String$(bundleIdentifier);
       const info = native.appKit.NSMutableDictionary.dictionaryWithDictionary$(
         native.appKit.NSBundle.mainBundle().infoDictionary(),
       );
       for (const key of ["CFBundleName", "CFBundleDisplayName"]) {
         info.setObject$forKey$(title, native.appKit.NSString.stringWithUTF8String$(key));
       }
+      // The signed vendor executable runs from the nested ChatGPT.app, so
+      // LaunchServices initially checks it in as com.openai.codex. When the
+      // native app is also open, Dock groups both processes under ChatGPT even
+      // though LSDisplayName was already tenant-branded. Check the process in
+      // again with the unique outer-wrapper identity to keep each tenant's
+      // Dock item distinct while preserving the vendor executable signature.
+      info.setObject$forKey$(
+        identifier,
+        native.appKit.NSString.stringWithUTF8String$("CFBundleIdentifier"),
+      );
       native.objc.callFunction(
         "_LSSetApplicationLaunchServicesServerConnectionStatus",
         { returns: "v", args: ["Q", "@"] },
@@ -2368,7 +2381,7 @@ if (process.type === "browser" && displayName) {
         title,
         null,
       );
-      launchServicesNamed = status === 0;
+      launchServicesIdentified = status === 0;
     } catch {
       // Keep the signed vendor app usable if LaunchServices changes this
       // private-but-established process-title API in a future macOS release.
@@ -2403,7 +2416,7 @@ if (process.type === "browser" && displayName) {
       const setName = loaded.app.setName.bind(loaded.app);
       setName(displayName);
       loaded.app.setName = () => setName(displayName);
-      setLaunchServicesApplicationName();
+      setLaunchServicesApplicationIdentity();
       setNativeApplicationMenuTitle();
       const setApplicationMenu = loaded.Menu.setApplicationMenu.bind(loaded.Menu);
       loaded.Menu.setApplicationMenu = (menu) => {
@@ -2414,11 +2427,11 @@ if (process.type === "browser" && displayName) {
           loaded.app.setActivationPolicy("accessory");
           setTimeout(() => {
             loaded.app.setActivationPolicy("regular");
-            launchServicesNamed = false;
-            setLaunchServicesApplicationName();
+            launchServicesIdentified = false;
+            setLaunchServicesApplicationIdentity();
             setApplicationMenu(menu);
             setNativeApplicationMenuTitle();
-          }, 0);
+          }, 100);
         }
         setTimeout(setNativeApplicationMenuTitle, 0);
         return result;

package/src/commands/converge.js

@@ -13,6 +13,8 @@ import { promptText } from "../prompt.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
 import { restoreNativeProfiles } from "./use.js";
 
+const RETRYABLE_TENANT_DISCOVERY_ERROR = /could not reach|request timed out|fetch failed|ECONNRESET|ECONNABORTED|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|network error|socket/iu;
+
 function confirmed(answer) {
   return /^(?:y|yes)$/iu.test(String(answer || "").trim());
 }
@@ -44,6 +46,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
     platform: process.platform,
     environment: process.env,
     preparePlatformClis,
+    discoveryLogger: console,
     ...overrides,
   };
   if (overrides.prepareWindowsClis && !overrides.preparePlatformClis) {
@@ -58,10 +61,22 @@ export async function cmdConverge(argv = [], overrides = {}) {
   let listing;
   try {
     listing = await io.fetchTenants(config);
+    // Tenant discovery is the entry gate for the whole convergence. A single
+    // transient timeout should not force a human to rerun every update step.
   } catch (error) {
-    console.error(`impel update: tenant discovery failed (${redactSecretText(error?.message || error)})`);
-    process.exitCode = 1;
-    return false;
+    if (!RETRYABLE_TENANT_DISCOVERY_ERROR.test(String(error?.message || error))) {
+      console.error(`impel update: tenant discovery failed (${redactSecretText(error?.message || error)})`);
+      process.exitCode = 1;
+      return false;
+    }
+    io.discoveryLogger.log("Tenants: discovery request failed transiently; retrying once…");
+    try {
+      listing = await io.fetchTenants(config);
+    } catch (retryError) {
+      console.error(`impel update: tenant discovery failed (${redactSecretText(retryError?.message || retryError)})`);
+      process.exitCode = 1;
+      return false;
+    }
   }
   const selected = selectDefaultTenant(listing, { currentTenantId: config.tenantId });
   config.tenantId = selected.id;

package/src/commands/update.js

@@ -18,6 +18,7 @@ import {
   isNewerVersion,
   refreshUpdateCache,
   updateInstallSpec,
+  updateTagForVersion,
   writeUpdateCache,
 } from "../updates.js";
 
@@ -200,30 +201,41 @@ export async function cmdUpdate(argv, overrides = {}) {
   }
 
   const current = io.installedVersion();
-  const remote = await io.progress("Checking npm for impel-cli updates", () => io.fetchRemoteVersion());
+  const updateTag = updateTagForVersion(current);
+  const installSpec = updateInstallSpec(updateTag);
+  const remote = await io.progress(
+    "Checking npm for impel-cli updates",
+    () => io.fetchRemoteVersion({ tag: updateTag }),
+  );
   if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });
 
   console.log(`impel-cli v${current ?? "?"}`);
-  console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);
+  console.log(`npm ${updateTag}: ${remote ? `v${remote}` : "unknown — registry check failed"}`);
 
   const updateAvailable = Boolean(current && remote && isNewerVersion(remote, current));
   const upToDate = Boolean(current && remote && !updateAvailable);
   if (flags.check) {
-    console.log(upToDate ? "Up to date." : "Update available: run `impel update`.");
-    if (!remote) process.exitCode = 1;
+    if (!remote) {
+      console.log("Update status unavailable; the installed CLI was not changed.");
+      process.exitCode = 1;
+    } else {
+      console.log(upToDate ? "Up to date." : "Update available: run `impel update`.");
+    }
     return;
   }
 
   // ── CLI ────────────────────────────────────────────────────────────────
-  if (upToDate) {
+  if (!remote) {
+    console.warn("CLI: npm update check unavailable; keeping the installed build.");
+  } else if (upToDate) {
     console.log("CLI: already up to date.");
   } else {
-    console.log("CLI: installing the latest build…");
-    if (!await io.progress("Installing the latest impel-cli build", () => io.selfUpdate(updateInstallSpec()))) {
+    console.log(`CLI: installing the npm ${updateTag} build…`);
+    if (!await io.progress(`Installing the npm ${updateTag} impel-cli build`, () => io.selfUpdate(installSpec))) {
       console.error("impel update: `npm install -g` failed; the CLI was not updated.");
       if (io.platform === "win32") {
         console.error("  Verify `npm --version` in PowerShell, then retry `impel update`.");
-        console.error("  Manual recovery: `npm install --global impel-cli@latest`.");
+        console.error(`  Manual recovery: \`npm install --global ${installSpec}\`.`);
       }
       const config = io.loadConfig();
       let recovered = false;
@@ -239,7 +251,7 @@ export async function cmdUpdate(argv, overrides = {}) {
                 platform: io.platform,
                 architecture: process.arch,
                 step: "install.impel_cli",
-                command: `npm install --global ${RUNTIME_BRAND.cli.packageName}@latest`,
+                command: `npm install --global ${installSpec}`,
                 message: `The npm-verified global ${RUNTIME_BRAND.cli.packageName} update failed.`,
               },
               config,
@@ -265,7 +277,7 @@ export async function cmdUpdate(argv, overrides = {}) {
                   }
                 },
                 retryStep: async () => {
-                  updateState.ok = io.selfUpdate(updateInstallSpec()) === true;
+                  updateState.ok = io.selfUpdate(installSpec) === true;
                   return updateState.ok;
                 },
               },
@@ -294,7 +306,7 @@ export async function cmdUpdate(argv, overrides = {}) {
       console.error(`impel update: npm reported success but the running CLI still resolves v${postInstall ?? "?"} (expected v${remote}).`);
       console.error(`  Running CLI: ${CLI_BIN}`);
       console.error("  This usually means the `impel` on PATH belongs to a different npm prefix than `npm prefix -g`.");
-      console.error("  Fix: run `npm prefix -g`, confirm it owns the `impel` shim on PATH, then `npm install --global impel-cli@latest` there.");
+      console.error(`  Fix: run \`npm prefix -g\`, confirm it owns the \`impel\` shim on PATH, then \`npm install --global ${installSpec}\` there.`);
       process.exitCode = 1;
       return;
     }

package/src/updates.js

@@ -36,8 +36,19 @@ export function updateRegistry() {
   ).replace(/\/+$/u, "");
 }
 
-export function updateInstallSpec() {
-  return `${updatePackage()}@latest`;
+function normalizeUpdateTag(tag) {
+  if (tag === "latest" || tag === "next") return tag;
+  throw new Error(`unsupported npm update tag "${tag}"`);
+}
+
+/** Keep prerelease installs on npm's prerelease channel. */
+export function updateTagForVersion(version) {
+  const parsed = validVersion(version) ? version.match(VERSION_RE) : null;
+  return parsed?.[4] ? "next" : "latest";
+}
+
+export function updateInstallSpec(tag = "latest") {
+  return `${updatePackage()}@${normalizeUpdateTag(tag)}`;
 }
 
 export function installedVersion() {
@@ -88,15 +99,17 @@ export function isNewerVersion(candidate, current) {
 function fetchRemoteVersionWithNpm({
   packageName,
   registry,
+  tag,
   timeoutMs,
   spawnSyncImpl = spawnSync,
   environment = process.env,
   platform = process.platform,
 }) {
   try {
+    const target = tag === "latest" ? packageName : `${packageName}@${tag}`;
     const invocation = nativeCommandInvocation(
       "npm",
-      ["view", packageName, "version", "--json", "--registry", registry],
+      ["view", target, "version", "--json", "--registry", registry],
       environment,
       platform,
     );
@@ -122,39 +135,71 @@ function fetchRemoteVersionWithNpm({
 export async function fetchRemoteVersion({
   packageName = updatePackage(),
   registry = updateRegistry(),
+  tag = "latest",
   timeoutMs = 10_000,
   fetchImpl = null,
+  fallbackToNpm = fetchImpl === null,
   spawnSyncImpl = spawnSync,
   environment = process.env,
   platform = process.platform,
 } = {}) {
+  const normalizedTag = normalizeUpdateTag(tag);
   const normalizedRegistry = String(registry).replace(/\/+$/u, "");
   if (!fetchImpl && normalizedRegistry !== DEFAULT_UPDATE_REGISTRY) {
     return fetchRemoteVersionWithNpm({
       packageName,
       registry: normalizedRegistry,
+      tag: normalizedTag,
+      timeoutMs,
+      spawnSyncImpl,
+      environment,
+      platform,
+    });
+  }
+  // Windows npm commonly has proxy, certificate, or registry settings that
+  // Node's bare fetch does not inherit. Prefer the already-working npm client
+  // there, then retain the direct registry request as a fallback.
+  if (!fetchImpl && platform === "win32") {
+    const npmVersion = fetchRemoteVersionWithNpm({
+      packageName,
+      registry: normalizedRegistry,
+      tag: normalizedTag,
       timeoutMs,
       spawnSyncImpl,
       environment,
       platform,
     });
+    if (npmVersion) return npmVersion;
   }
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  let remoteVersion = null;
   try {
     const encodedName = encodeURIComponent(packageName);
-    const response = await (fetchImpl || globalThis.fetch)(`${normalizedRegistry}/${encodedName}/latest`, {
+    const response = await (fetchImpl || globalThis.fetch)(`${normalizedRegistry}/${encodedName}/${normalizedTag}`, {
       headers: { accept: "application/json" },
       signal: controller.signal,
     });
-    if (!response.ok) return null;
-    const metadata = await response.json();
-    return validVersion(metadata?.version) ? metadata.version : null;
+    if (response.ok) {
+      const metadata = await response.json();
+      remoteVersion = validVersion(metadata?.version) ? metadata.version : null;
+    }
   } catch {
-    return null;
+    // npm is the authoritative fallback below. It also honors npm's proxy and
+    // registry configuration, which is especially important on Windows.
   } finally {
     clearTimeout(timeout);
   }
+  if (remoteVersion || !fallbackToNpm) return remoteVersion;
+  return fetchRemoteVersionWithNpm({
+    packageName,
+    registry: normalizedRegistry,
+    tag: normalizedTag,
+    timeoutMs,
+    spawnSyncImpl,
+    environment,
+    platform,
+  });
 }
 
 export function readUpdateCache() {
@@ -198,7 +243,9 @@ export function cacheIsFresh(cache, now = Date.now()) {
 export async function refreshUpdateCache(dependencies = {}) {
   const fetchLatest = dependencies.fetchRemoteVersion || fetchRemoteVersion;
   const writeCache = dependencies.writeCache || writeUpdateCache;
-  const remoteVersion = await fetchLatest();
+  const currentVersion = (dependencies.installedVersion || installedVersion)();
+  const tag = updateTagForVersion(currentVersion);
+  const remoteVersion = await fetchLatest({ tag });
   if (!remoteVersion) {
     try {
       writeCache({ lastFailedAt: Date.now() });
@@ -207,7 +254,7 @@ export async function refreshUpdateCache(dependencies = {}) {
     }
     return null;
   }
-  return writeCache({ remoteVersion, checkedAt: Date.now() });
+  return writeCache({ remoteVersion, updateTag: tag, checkedAt: Date.now() });
 }
 
 /** One-line human notice when npm has a newer stable package. */