impel-cli 0.18.15-beta.8 → 0.18.15

package/src/commands/launch.js

@@ -20,9 +20,8 @@ import { assertProviderScopes, ensureTenantSelection, tenantCredential } from ".
 import { maybePrintUpdateNotice } from "../updates.js";
 import {
   nativeSpawnInvocation,
+  resolveNativeBinary,
 } from "../nativeProcess.js";
-import { resolveReviewedVendorCliBinary } from "../vendorCliBinaries.js";
-import { PINNED_VENDOR_CLI_VERSIONS } from "../vendorCliVersions.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 import {
   cacheProviderReadiness,
@@ -116,15 +115,7 @@ async function assertLiveProviderReadiness({ config, gatewayUrl, credential, ten
 }
 
 function runNativeCli(tool, argv, environment) {
-  const binary = resolveReviewedVendorCliBinary(tool, environment);
-  if (!binary) {
-    const version = PINNED_VENDOR_CLI_VERSIONS[tool];
-    console.error(
-      `impel ${tool}: reviewed ${tool === "claude" ? "Claude Code" : "Codex"} CLI `
-      + `v${version} is not installed. Run \`impel update\` to repair it.`,
-    );
-    return Promise.resolve(127);
-  }
+  const binary = resolveNativeBinary(tool, environment);
   let invocation;
   try {
     invocation = nativeSpawnInvocation(binary, argv, environment);

package/src/commands/status.js

@@ -4,9 +4,8 @@ import path from "node:path";
 
 import { appPaths, CLAUDE_CONFIG_ID, readTenantManifest } from "../apps.js";
 import { crossAppModelsEnabled, loadConfig, maskSecret } from "../config.js";
-import { environmentValue } from "../nativeProcess.js";
+import { environmentValue, findNativeBinary } from "../nativeProcess.js";
 import { tenantCliClientReadiness } from "../provisioning.js";
-import { findReviewedVendorCliBinary } from "../vendorCliBinaries.js";
 import { windowsTenantShortcutName } from "../shellEntries.js";
 import {
   ensureTenantSelection,
@@ -87,7 +86,7 @@ export async function cmdStatus(overrides = {}) {
     cliReadiness: tenantCliClientReadiness,
     desktopReadiness,
     installedVersion,
-    findNativeBinary: findReviewedVendorCliBinary,
+    findNativeBinary,
     maybePrintUpdateNotice,
     platform: process.platform,
     environment: process.env,

package/src/commands/update.js

@@ -18,7 +18,6 @@ import {
   isNewerVersion,
   refreshUpdateCache,
   updateInstallSpec,
-  updateTagForVersion,
   writeUpdateCache,
 } from "../updates.js";
 
@@ -201,41 +200,30 @@ export async function cmdUpdate(argv, overrides = {}) {
   }
 
   const current = io.installedVersion();
-  const updateTag = updateTagForVersion(current);
-  const installSpec = updateInstallSpec(updateTag);
-  const remote = await io.progress(
-    "Checking npm for impel-cli updates",
-    () => io.fetchRemoteVersion({ tag: updateTag }),
-  );
+  const remote = await io.progress("Checking npm for impel-cli updates", () => io.fetchRemoteVersion());
   if (remote) io.writeCache({ remoteVersion: remote, checkedAt: Date.now() });
 
   console.log(`impel-cli v${current ?? "?"}`);
-  console.log(`npm ${updateTag}: ${remote ? `v${remote}` : "unknown — registry check failed"}`);
+  console.log(`npm latest: ${remote ? `v${remote}` : "unknown — registry check failed"}`);
 
   const updateAvailable = Boolean(current && remote && isNewerVersion(remote, current));
   const upToDate = Boolean(current && remote && !updateAvailable);
   if (flags.check) {
-    if (!remote) {
-      console.log("Update status unavailable; the installed CLI was not changed.");
-      process.exitCode = 1;
-    } else {
-      console.log(upToDate ? "Up to date." : "Update available: run `impel update`.");
-    }
+    console.log(upToDate ? "Up to date." : "Update available: run `impel update`.");
+    if (!remote) process.exitCode = 1;
     return;
   }
 
   // ── CLI ────────────────────────────────────────────────────────────────
-  if (!remote) {
-    console.warn("CLI: npm update check unavailable; keeping the installed build.");
-  } else if (upToDate) {
+  if (upToDate) {
     console.log("CLI: already up to date.");
   } else {
-    console.log(`CLI: installing the npm ${updateTag} build…`);
-    if (!await io.progress(`Installing the npm ${updateTag} impel-cli build`, () => io.selfUpdate(installSpec))) {
+    console.log("CLI: installing the latest build…");
+    if (!await io.progress("Installing the latest impel-cli build", () => io.selfUpdate(updateInstallSpec()))) {
       console.error("impel update: `npm install -g` failed; the CLI was not updated.");
       if (io.platform === "win32") {
         console.error("  Verify `npm --version` in PowerShell, then retry `impel update`.");
-        console.error(`  Manual recovery: \`npm install --global ${installSpec}\`.`);
+        console.error("  Manual recovery: `npm install --global impel-cli@latest`.");
       }
       const config = io.loadConfig();
       let recovered = false;
@@ -251,7 +239,7 @@ export async function cmdUpdate(argv, overrides = {}) {
                 platform: io.platform,
                 architecture: process.arch,
                 step: "install.impel_cli",
-                command: `npm install --global ${installSpec}`,
+                command: `npm install --global ${RUNTIME_BRAND.cli.packageName}@latest`,
                 message: `The npm-verified global ${RUNTIME_BRAND.cli.packageName} update failed.`,
               },
               config,
@@ -277,7 +265,7 @@ export async function cmdUpdate(argv, overrides = {}) {
                   }
                 },
                 retryStep: async () => {
-                  updateState.ok = io.selfUpdate(installSpec) === true;
+                  updateState.ok = io.selfUpdate(updateInstallSpec()) === true;
                   return updateState.ok;
                 },
               },
@@ -306,7 +294,7 @@ export async function cmdUpdate(argv, overrides = {}) {
       console.error(`impel update: npm reported success but the running CLI still resolves v${postInstall ?? "?"} (expected v${remote}).`);
       console.error(`  Running CLI: ${CLI_BIN}`);
       console.error("  This usually means the `impel` on PATH belongs to a different npm prefix than `npm prefix -g`.");
-      console.error(`  Fix: run \`npm prefix -g\`, confirm it owns the \`impel\` shim on PATH, then \`npm install --global ${installSpec}\` there.`);
+      console.error("  Fix: run `npm prefix -g`, confirm it owns the `impel` shim on PATH, then `npm install --global impel-cli@latest` there.");
       process.exitCode = 1;
       return;
     }

package/src/macSetup.js

@@ -7,12 +7,11 @@ import { spawnSync } from "node:child_process";
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile } from "./cliProfiles.js";
 import { findNativeBinary } from "./nativeProcess.js";
 import { syncSkillsSafe } from "./skills.js";
-import { verifyReviewedMacVendorCli } from "./vendorCliBinaries.js";
-import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
 
 const MAX_INSTALLER_BYTES = 512 * 1024;
 const INSTALLER_DOWNLOAD_TIMEOUT_MS = 30_000;
 const INSTALLER_RUN_TIMEOUT_MS = 10 * 60 * 1_000;
+const MAC_SIGNING_TEAMS = Object.freeze({ claude: "Q6L2SF6YDW", codex: "2DC432GLL2" });
 
 /**
  * The script bytes are pinned per impel-cli release. Both vendor scripts then
@@ -20,34 +19,59 @@ const INSTALLER_RUN_TIMEOUT_MS = 10 * 60 * 1_000;
  */
 export const MAC_CLI_INSTALLERS = Object.freeze({
   claude: Object.freeze({
-    version: PINNED_VENDOR_CLI_VERSIONS.claude,
     url: "https://claude.ai/install.sh",
     trustedOrigins: Object.freeze([
       "https://claude.ai",
       "https://downloads.claude.ai",
     ]),
     sha256: "cde4f1702d3b1695f92b73d26888364e17bca476e17f0fd676484c951d36c125",
-    command: `curl -fsSL https://claude.ai/install.sh | bash -s ${PINNED_VENDOR_CLI_VERSIONS.claude}`,
-    args: Object.freeze([PINNED_VENDOR_CLI_VERSIONS.claude]),
+    command: "curl -fsSL https://claude.ai/install.sh | bash -s stable",
+    args: Object.freeze(["stable"]),
     environment: Object.freeze({}),
   }),
   codex: Object.freeze({
-    version: PINNED_VENDOR_CLI_VERSIONS.codex,
     url: "https://chatgpt.com/codex/install.sh",
     trustedOrigins: Object.freeze([
       "https://chatgpt.com",
       "https://releases.openai.com",
     ]),
     sha256: "ba92dd27e5c06f0d3bbc58bfa4b9cfb6599cd2742fbb1f92a2765e6c07dedb5a",
-    command: `curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 CODEX_RELEASE=${PINNED_VENDOR_CLI_VERSIONS.codex} sh`,
+    command: "curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 CODEX_RELEASE=0.144.6 sh",
     args: Object.freeze([]),
-    environment: Object.freeze({
-      CODEX_NON_INTERACTIVE: "1",
-      CODEX_RELEASE: PINNED_VENDOR_CLI_VERSIONS.codex,
-    }),
+    environment: Object.freeze({ CODEX_NON_INTERACTIVE: "1", CODEX_RELEASE: "0.144.6" }),
   }),
 });
 
+function verifyMacCli(tool, binary, environment, run = spawnSync) {
+  try {
+    const result = run(binary, ["--version"], {
+      encoding: "utf8",
+      env: environment,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+    });
+    if (result?.status !== 0 || result?.error) return false;
+    const explicitOverride = tool === "claude" ? environment.IMPEL_CLAUDE_BIN : environment.IMPEL_CODEX_BIN;
+    if (explicitOverride && path.resolve(explicitOverride) === path.resolve(binary)) return true;
+    const resolved = fs.realpathSync(binary);
+    const verified = run("/usr/bin/codesign", ["--verify", "--strict", resolved], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+    });
+    if (verified?.status !== 0 || verified?.error) return false;
+    const details = run("/usr/bin/codesign", ["-dv", "--verbose=4", resolved], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+    });
+    return details?.status === 0
+      && String(details.stderr || details.stdout || "").includes(`TeamIdentifier=${MAC_SIGNING_TEAMS[tool]}`);
+  } catch {
+    return false;
+  }
+}
+
 function detectMacClis(find, environment, verify) {
   const detect = (tool) => find(
     tool,
@@ -176,7 +200,7 @@ export async function prepareMacClis({
   const io = {
     environment: process.env,
     find: findNativeBinary,
-    verify: verifyReviewedMacVendorCli,
+    verify: verifyMacCli,
     run: spawnSync,
     fetchImpl: fetch,
     fsImpl: fs,
@@ -228,10 +252,7 @@ export async function prepareMacClis({
     await io.syncSkills({
       client: "claude",
       gatewayUrl,
-      env: {
-        CLAUDE_CONFIG_DIR: claudeProfile.configDir,
-        IMPEL_CLAUDE_BIN: binaries.claude,
-      },
+      env: { CLAUDE_CONFIG_DIR: claudeProfile.configDir },
       label: "Impel isolated Claude (impel claude)",
       // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
       homeDir: os.homedir(),
@@ -241,10 +262,7 @@ export async function prepareMacClis({
     await io.syncSkills({
       client: "codex",
       gatewayUrl,
-      env: {
-        CODEX_HOME: codexProfile.codexHome,
-        IMPEL_CODEX_BIN: binaries.codex,
-      },
+      env: { CODEX_HOME: codexProfile.codexHome },
       label: "Impel isolated Codex (impel codex)",
       homeDir: os.homedir(),
     });

package/src/provisioning.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import { syncAgentProfilesSafe } from "./agents.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile, tenantCliProfilePaths } from "./cliProfiles.js";
+import { findNativeBinary } from "./nativeProcess.js";
 import { mapWithConcurrency } from "./progress.js";
 import { registerTenantShellEntries } from "./shellEntries.js";
 import { resolveSkillsGateway, syncSkillsSafe } from "./skills.js";
@@ -16,7 +17,6 @@ import {
 } from "./tenants.js";
 import { reconcileTenantApps } from "./commands/apps.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
-import { findReviewedVendorCliBinary } from "./vendorCliBinaries.js";
 
 export function selectDefaultTenant(listing, { requested = null, currentTenantId = null } = {}) {
   const normalized = requested ? normalizeTenantId(requested) : null;
@@ -93,19 +93,13 @@ async function prepareTenantCli(config, tenant, io, binaries) {
         crossAppModels: crossAppModelsEnabled(config),
       }),
       root: (profile) => profile.configDir,
-      env: (profile) => ({
-        CLAUDE_CONFIG_DIR: profile.configDir,
-        IMPEL_CLAUDE_BIN: binaries.claude,
-      }),
+      env: (profile) => ({ CLAUDE_CONFIG_DIR: profile.configDir }),
     },
     codex: {
       supported: providerSupported(config.scopes, PAT_SCOPE_CODEX),
       ensure: () => io.ensureCodex(config.gatewayUrl, tenant.id),
       root: (profile) => profile.codexHome,
-      env: (profile) => ({
-        CODEX_HOME: profile.codexHome,
-        IMPEL_CODEX_BIN: binaries.codex,
-      }),
+      env: (profile) => ({ CODEX_HOME: profile.codexHome }),
     },
   };
   const clients = {};
@@ -187,7 +181,7 @@ export async function reconcileAllTenants({
     ensureCodex: ensureImpelCodexProfile,
     syncSkills: syncSkillsSafe,
     syncAgents: syncAgentProfilesSafe,
-    findBinary: findReviewedVendorCliBinary,
+    findBinary: findNativeBinary,
     reconcileApps: reconcileTenantApps,
     registerShellEntries: registerTenantShellEntries,
     knownTenantIds: locallyKnownTenantIds,

package/src/skills.js

@@ -25,8 +25,6 @@ import path from "node:path";
 
 import { resolveDefaultGateway, normalizeGatewayUrl } from "./config.js";
 import { findNativeBinary, nativeCommandInvocation } from "./nativeProcess.js";
-import { findReviewedVendorCliBinary } from "./vendorCliBinaries.js";
-import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
 
 /** The bundled plugin the Bifrost registry publishes; contains every served skill. */
 export const SKILL_PLUGIN_NAME = "bifrost-all-skills";
@@ -501,7 +499,6 @@ export async function syncSkills({
   platform = process.platform,
   findGit = findNativeBinary,
   homeDir = null,
-  findVendorBinary = findReviewedVendorCliBinary,
 } = {}) {
   const spec = CLIENT_SPECS[client];
   if (!spec) {
@@ -515,18 +512,6 @@ export async function syncSkills({
     return { client, label: displayLabel, skipped: true, reason: "disabled" };
   }
 
-  let commandBinary = spec.bin;
-  if (platform === "darwin" && run === runSkillCommand) {
-    commandBinary = findVendorBinary(client, { ...process.env, ...env }, platform);
-    if (!commandBinary) {
-      logger.warn(
-        `impel: skipping skill sync for ${displayLabel} — reviewed ${spec.label} `
-        + `v${PINNED_VENDOR_CLI_VERSIONS[client]} is not installed; run \`impel update\`.`,
-      );
-      return { client, label: displayLabel, skipped: true, reason: "binary-version-mismatch" };
-    }
-  }
-
   // Callers that manage real profiles pass their home directory so Windows
   // spawns happen from a git-safe cwd (see skillSyncSpawnDirectory).
   const spawnDirectory = skillSyncSpawnDirectory({ platform, homeDir });
@@ -536,10 +521,9 @@ export async function syncSkills({
 
   try {
     // Confirm the binary and its `plugin` subcommand exist before doing anything.
-    const help = await runCommand(commandBinary, ["plugin", "--help"], env);
+    const help = await runCommand(spec.bin, ["plugin", "--help"], env);
     if (help.missing) {
-      const location = commandBinary === spec.bin ? " on PATH" : "";
-      logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${commandBinary}\` CLI not found${location}.`);
+      logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${spec.bin}\` CLI not found on PATH.`);
       return { client, label: displayLabel, skipped: true, reason: "binary-missing" };
     }
     if (!help.ok) {
@@ -571,12 +555,12 @@ export async function syncSkills({
     })[0];
     const registerResult = await runSkillCommandWithRetry(
       runCommand,
-      commandBinary,
+      spec.bin,
       registerCommand.args,
       env,
     );
     if (registerResult.missing) {
-      failures.push({ phase: registerCommand.phase, reason: `\`${commandBinary}\` disappeared mid-sync` });
+      failures.push({ phase: registerCommand.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
     } else if (!isBenign(registerResult)) {
       failures.push({
         phase: registerCommand.phase,
@@ -589,7 +573,7 @@ export async function syncSkills({
     // gives us the same dynamic name so refreshes can still use
     // PLUGIN@MARKETPLACE.
     if (!marketplaceName && !registerResult.missing) {
-      const listed = await runCommand(commandBinary, ["plugin", "marketplace", "list", "--json"], env);
+      const listed = await runCommand(spec.bin, ["plugin", "marketplace", "list", "--json"], env);
       if (listed.ok) marketplaceName = resolveConfiguredMarketplaceName(listed.stdout, sourceUrl);
     }
 
@@ -601,12 +585,12 @@ export async function syncSkills({
     for (const command of commands) {
       const result = await runSkillCommandWithRetry(
         runCommand,
-        commandBinary,
+        spec.bin,
         command.args,
         env,
       );
       if (result.missing) {
-        failures.push({ phase: command.phase, reason: `\`${commandBinary}\` disappeared mid-sync` });
+        failures.push({ phase: command.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
         break;
       }
       if (isBenign(result)) continue;
@@ -619,7 +603,7 @@ export async function syncSkills({
       ) {
         const repair = await reregisterCodexMarketplace({
           run: runCommand,
-          bin: commandBinary,
+          bin: spec.bin,
           env,
           marketplaceName,
           sourceUrl,

package/src/updates.js

@@ -36,19 +36,8 @@ export function updateRegistry() {
   ).replace(/\/+$/u, "");
 }
 
-function normalizeUpdateTag(tag) {
-  if (tag === "latest" || tag === "next") return tag;
-  throw new Error(`unsupported npm update tag "${tag}"`);
-}
-
-/** Keep prerelease installs on npm's prerelease channel. */
-export function updateTagForVersion(version) {
-  const parsed = validVersion(version) ? version.match(VERSION_RE) : null;
-  return parsed?.[4] ? "next" : "latest";
-}
-
-export function updateInstallSpec(tag = "latest") {
-  return `${updatePackage()}@${normalizeUpdateTag(tag)}`;
+export function updateInstallSpec() {
+  return `${updatePackage()}@latest`;
 }
 
 export function installedVersion() {
@@ -99,17 +88,15 @@ export function isNewerVersion(candidate, current) {
 function fetchRemoteVersionWithNpm({
   packageName,
   registry,
-  tag,
   timeoutMs,
   spawnSyncImpl = spawnSync,
   environment = process.env,
   platform = process.platform,
 }) {
   try {
-    const target = tag === "latest" ? packageName : `${packageName}@${tag}`;
     const invocation = nativeCommandInvocation(
       "npm",
-      ["view", target, "version", "--json", "--registry", registry],
+      ["view", packageName, "version", "--json", "--registry", registry],
       environment,
       platform,
     );
@@ -135,71 +122,39 @@ function fetchRemoteVersionWithNpm({
 export async function fetchRemoteVersion({
   packageName = updatePackage(),
   registry = updateRegistry(),
-  tag = "latest",
   timeoutMs = 10_000,
   fetchImpl = null,
-  fallbackToNpm = fetchImpl === null,
   spawnSyncImpl = spawnSync,
   environment = process.env,
   platform = process.platform,
 } = {}) {
-  const normalizedTag = normalizeUpdateTag(tag);
   const normalizedRegistry = String(registry).replace(/\/+$/u, "");
   if (!fetchImpl && normalizedRegistry !== DEFAULT_UPDATE_REGISTRY) {
     return fetchRemoteVersionWithNpm({
       packageName,
       registry: normalizedRegistry,
-      tag: normalizedTag,
-      timeoutMs,
-      spawnSyncImpl,
-      environment,
-      platform,
-    });
-  }
-  // Windows npm commonly has proxy, certificate, or registry settings that
-  // Node's bare fetch does not inherit. Prefer the already-working npm client
-  // there, then retain the direct registry request as a fallback.
-  if (!fetchImpl && platform === "win32") {
-    const npmVersion = fetchRemoteVersionWithNpm({
-      packageName,
-      registry: normalizedRegistry,
-      tag: normalizedTag,
       timeoutMs,
       spawnSyncImpl,
       environment,
       platform,
     });
-    if (npmVersion) return npmVersion;
   }
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  let remoteVersion = null;
   try {
     const encodedName = encodeURIComponent(packageName);
-    const response = await (fetchImpl || globalThis.fetch)(`${normalizedRegistry}/${encodedName}/${normalizedTag}`, {
+    const response = await (fetchImpl || globalThis.fetch)(`${normalizedRegistry}/${encodedName}/latest`, {
       headers: { accept: "application/json" },
       signal: controller.signal,
     });
-    if (response.ok) {
-      const metadata = await response.json();
-      remoteVersion = validVersion(metadata?.version) ? metadata.version : null;
-    }
+    if (!response.ok) return null;
+    const metadata = await response.json();
+    return validVersion(metadata?.version) ? metadata.version : null;
   } catch {
-    // npm is the authoritative fallback below. It also honors npm's proxy and
-    // registry configuration, which is especially important on Windows.
+    return null;
   } finally {
     clearTimeout(timeout);
   }
-  if (remoteVersion || !fallbackToNpm) return remoteVersion;
-  return fetchRemoteVersionWithNpm({
-    packageName,
-    registry: normalizedRegistry,
-    tag: normalizedTag,
-    timeoutMs,
-    spawnSyncImpl,
-    environment,
-    platform,
-  });
 }
 
 export function readUpdateCache() {
@@ -243,9 +198,7 @@ export function cacheIsFresh(cache, now = Date.now()) {
 export async function refreshUpdateCache(dependencies = {}) {
   const fetchLatest = dependencies.fetchRemoteVersion || fetchRemoteVersion;
   const writeCache = dependencies.writeCache || writeUpdateCache;
-  const currentVersion = (dependencies.installedVersion || installedVersion)();
-  const tag = updateTagForVersion(currentVersion);
-  const remoteVersion = await fetchLatest({ tag });
+  const remoteVersion = await fetchLatest();
   if (!remoteVersion) {
     try {
       writeCache({ lastFailedAt: Date.now() });
@@ -254,7 +207,7 @@ export async function refreshUpdateCache(dependencies = {}) {
     }
     return null;
   }
-  return writeCache({ remoteVersion, updateTag: tag, checkedAt: Date.now() });
+  return writeCache({ remoteVersion, checkedAt: Date.now() });
 }
 
 /** One-line human notice when npm has a newer stable package. */