impel-cli 0.18.15 → 0.18.16

package/src/apps.js

@@ -37,6 +37,17 @@ const APP_DEFINITIONS = {
     executableNames: ["ChatGPT", "Codex"],
   },
 };
+const BUNDLE_ARTIFACT_REMOVE_OPTIONS = Object.freeze({
+  recursive: true,
+  force: true,
+  maxRetries: 5,
+  retryDelay: 25,
+});
+const BUNDLE_LOCK_WAIT_MS = 120_000;
+const BUNDLE_LOCK_POLL_MS = 100;
+const BUNDLE_LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(4));
+const MACOS_O_EXLOCK = 0x00000020;
+const portableBundleMutationLocks = new Set();
 
 // Vendor updates can change minified renderer contracts without notice. Each
 // CLI release therefore installs and accepts only the exact app builds tested
@@ -81,17 +92,29 @@ export const PINNED_VENDOR_APPS = Object.freeze({
     }),
   }),
   chatgpt: Object.freeze({
-    version: "26.721.41059",
-    codexVersion: "0.146.0-alpha.3.1",
+    version: "26.727.40816",
+    codexVersion: "0.146.0-alpha.9.2",
     bundleName: "ChatGPT.app",
+    windows: Object.freeze({
+      storeProductId: "9PLM9XGG6VKS",
+      packageName: "OpenAI.Codex",
+      // The Microsoft Store manifest identifies this exact reviewed build.
+      // Keep one Windows package version so the manifest contract and local
+      // AppX validation cannot silently drift apart again.
+      packageVersion: "26.727.6591.0",
+      codexVersion: "0.146.0-alpha.9.2",
+      publisherId: "2p2nqsd0c76g0",
+      executable: "app\\ChatGPT.exe",
+      updateManifestUrl: "https://persistent.oaistatic.com/codex-app-prod/windows-store-update.json",
+    }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.721.41059.zip",
-        sha256: "e2b45056f3d1f8ab90f7f16249bfb5a40d09d0f8099f12ca0d8d7a8fdf9108ce",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.727.40816.zip",
+        sha256: "fdbede9b8a28b5bf3bbf1213fa04291724faa6ed2d1d61bb04853bbdfebce219",
       }),
       x64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.721.41059.zip",
-        sha256: "f00b09d9e1f5138f055fa972e5243991b493423c41f5d78951dc2e21a84089f4",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.727.40816.zip",
+        sha256: "12622d916a3993d61fb52a318dcff7af7449eea5070cdd7e094da29f380e3374",
       }),
     }),
   }),
@@ -236,7 +259,10 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // and the tenant manifest so unsupported hosts keep Chat and Code usable.
 // 25: remove the unproven Windows Cowork capability gate from beta.0 profiles
 // and restore the reviewed always-enabled managed policy.
-export const CURRENT_CONFIG_VERSION = 25;
+// 26: remember the managed provider defaults and move legacy GPT-5.5 profiles
+// onto GPT-5.6 Sol so ChatGPT's compact Work picker does not fall back to its
+// unsupported-selection "Reset to default" treatment.
+export const CURRENT_CONFIG_VERSION = 26;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -245,7 +271,7 @@ export const CURRENT_CONFIG_VERSION = 25;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-25.1";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-31.2";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -323,7 +349,7 @@ export function bundleIsCurrent(status, {
       compatibility.vendorSignaturesPreserved === true
       && compatibility.resourceRoot === CHATGPT_RESOURCE_ROOT
       && compatibility.patches?.fastModeForGatewayAuth > 0
-      && compatibility.patches?.tenantDisplayNamePreload === 1
+      && compatibility.patches?.tenantDisplayNamePreload === 2
     )),
   );
 }
@@ -679,7 +705,7 @@ export function migrateLegacyClaudeAppSessions(userData, homeDir = os.homedir())
   return copied;
 }
 
-export async function fetchGatewayModels(config, fetchImpl = fetch) {
+export async function fetchGatewayModels(config, fetchImpl = fetch, { allowEmpty = false } = {}) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 20000);
   try {
@@ -697,7 +723,9 @@ export async function fetchGatewayModels(config, fetchImpl = fetch) {
     }
     if (!Array.isArray(payload?.data)) throw new Error("response has no model data array");
     const models = payload.data.filter(isGatewayModel);
-    if (models.length === 0) throw new Error("gateway returned no supported models");
+    if (models.length === 0 && !(allowEmpty && isExplicitNoSeatCatalog(payload))) {
+      throw new Error("gateway returned no supported models");
+    }
     return { models, source: "gateway", version: payload.version ?? null };
   } finally {
     clearTimeout(timeout);
@@ -733,6 +761,7 @@ export function installManagedAppFiles({
     target,
     vendorPaths[target] || findVendorApp(target, homeDir),
   ]));
+  const previousManifest = readTenantManifest(homeDir, config.tenantId);
   const vendorCodexModels = targets.includes("chatgpt")
     ? readVendorCodexModels(resolvedVendorPaths.chatgpt)
     : new Map();
@@ -783,6 +812,7 @@ export function installManagedAppFiles({
         vendorCodexModels,
         chatgptInvocations,
         generatedAt,
+        previousManifest,
       );
       if (RUNTIME_BRAND.features.sessions) ensureCodexSessionHooks(paths.chatgpt.codexHome, config.tenantId, "codex_desktop");
     }
@@ -794,7 +824,7 @@ export function installManagedAppFiles({
   }
 
   writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
-    schemaVersion: 6,
+    schemaVersion: 7,
     configVersion: CURRENT_CONFIG_VERSION,
     modelCatalogVersion: 3,
     gatewayUrl: config.gatewayUrl,
@@ -807,6 +837,10 @@ export function installManagedAppFiles({
       models,
       config,
     ),
+    modelDefaults: {
+      claude: models.find((model) => model.provider === "claude" && model.default)?.id ?? null,
+      chatgpt: models.find((model) => model.provider === "codex" && model.default)?.id ?? null,
+    },
     models: models.map((model) => model.id),
     updatedAt: generatedAt,
   }, null, 2) + "\n", 0o600);
@@ -960,7 +994,6 @@ function installPinnedVendorApp(target, homeDir) {
       homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "vendor", target, pin.version, pin.bundleName,
     );
     fs.mkdirSync(path.dirname(destination), { recursive: true });
-    sweepStaleBundleArtifacts(path.dirname(destination), path.basename(destination));
     replaceDirectory(destination, extractedApp);
     return destination;
   } finally {
@@ -1141,6 +1174,7 @@ function writeChatGPTConfig(
   vendorCodexModels,
   invocations = null,
   generatedAt = new Date().toISOString(),
+  previousManifest = null,
 ) {
   const experimental = crossAppModelsEnabled(config);
   const orderedModels = experimental
@@ -1156,8 +1190,28 @@ function writeChatGPTConfig(
   const currentToml = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
   const configuredModel = readTopLevelTomlString(currentToml, "model");
   const defaultModelID = orderedModels.find((model) => model.provider === "codex" && model.default)?.id;
-  const selectedModel = codexModels.find((model) => model.slug === configuredModel)
-    || codexModels.find((model) => model.slug === defaultModelID)
+  const defaultModel = codexModels.find((model) => model.slug === defaultModelID);
+  const previousDefaultModelID = previousManifest?.modelDefaults?.chatgpt;
+  const followsPreviousManagedDefault = (
+    typeof previousDefaultModelID === "string"
+    && configuredModel === previousDefaultModelID
+    && configuredModel !== defaultModelID
+  );
+  // Profiles written before the default-model field existed cannot distinguish
+  // an old managed default from an explicit user choice. GPT-5.5 is the one
+  // observed legacy default that ChatGPT 26.727 renders as an unsupported
+  // compact-picker selection; migrate it once, while preserving every other
+  // explicit model choice.
+  const hasLegacyCompactPickerDefault = (
+    previousDefaultModelID == null
+    && Number(previousManifest?.configVersion ?? 0) < CURRENT_CONFIG_VERSION
+    && configuredModel === "gpt-5.5"
+    && defaultModelID === "gpt-5.6-sol"
+  );
+  const selectedModel = (followsPreviousManagedDefault || hasLegacyCompactPickerDefault
+    ? defaultModel
+    : codexModels.find((model) => model.slug === configuredModel))
+    || defaultModel
     || codexModels[0];
   if (!selectedModel) throw new Error("no Codex models are available for Impel ChatGPT");
   const configuredEffort = readTopLevelTomlString(currentToml, "model_reasoning_effort");
@@ -1517,6 +1571,12 @@ exec "$NODE" "$CLI" token${tenantArgs}
 }
 
 function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageName) {
+  return withBundleMutationLock(paths.claude.launcher, () => (
+    writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName)
+  ));
+}
+
+function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName) {
   if (!vendorPath) throw new Error("Claude vendor app is unavailable");
   if (!isVendableVendorApp("claude", vendorPath)) {
     const bundleId = readBundleIdentifier(vendorPath);
@@ -1530,9 +1590,8 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
   if (!executableName) throw new Error(`Claude executable is missing from ${vendorPath}`);
 
   const bundle = paths.claude.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
   sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   cloneAppBundle(vendorPath, staging);
   try {
     const plistPath = path.join(staging, "Contents", "Info.plist");
@@ -1614,9 +1673,9 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "Claude", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -1630,6 +1689,12 @@ function claudeUsageCompatibilityEnabled(gatewayUrl) {
 }
 
 function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
+  return withBundleMutationLock(paths.chatgpt.launcher, () => (
+    writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir)
+  ));
+}
+
+function writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir) {
   if (!vendorPath) throw new Error("ChatGPT/Codex vendor app is unavailable");
   const definition = APP_DEFINITIONS.chatgpt;
   const executableName = definition.executableNames.find((name) => (
@@ -1638,11 +1703,10 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
   if (!executableName) throw new Error(`ChatGPT/Codex executable is missing from ${vendorPath}`);
 
   const bundle = paths.chatgpt.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
+  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   const vendorBundleName = path.basename(vendorPath);
   const vendorBundle = path.join(staging, "Contents", "Resources", vendorBundleName);
-  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
   cloneAppBundle(vendorPath, vendorBundle);
   try {
     const asarPath = path.join(vendorBundle, "Contents", "Resources", "app.asar");
@@ -1710,7 +1774,7 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
       patches: {
         fastModeForGatewayAuth: fastModePatchCount,
         desktopAPIForGatewayAuth: 0,
-        tenantDisplayNamePreload: 1,
+        tenantDisplayNamePreload: 2,
       },
       vendorSignaturesPreserved: true,
       resourceRoot: CHATGPT_RESOURCE_ROOT,
@@ -1718,9 +1782,9 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "ChatGPT", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -2213,6 +2277,7 @@ HERE=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 VENDOR_APP="$HERE/../Resources/"${shellQuote(vendorBundleName)}
 export CODEX_HOME=${shellQuote(paths.chatgpt.codexHome)}
 export CODEX_AUTHAPI_BASE_URL=${shellQuote(codexAccountBaseUrl)}
+export CODEX_SPARKLE_ENABLED=false
 unset CODEX_ACCESS_TOKEN CODEX_API_KEY OPENAI_API_KEY OPENAI_BASE_URL
 secure_codex_home() {
   [ ! -L "$CODEX_HOME" ] || exit 1
@@ -2236,6 +2301,7 @@ secure_codex_home
 BROWSER_DATA=${shellQuote(paths.chatgpt.browserData)}
 mkdir -p "$BROWSER_DATA"
 export IMPEL_APP_DISPLAY_NAME=${shellQuote(paths.chatgpt.displayName)}
+export IMPEL_APP_BUNDLE_ID=${shellQuote(paths.chatgpt.bundleIdentifier)}
 PRELOAD="$HERE/../Resources/impel-chatgpt-preload.cjs"
 export NODE_OPTIONS="--require=\\\"$PRELOAD\\\""
 # Electron resolves resources from the Impel wrapper when the nested app is
@@ -2250,13 +2316,14 @@ function vendoredChatGPTDisplayNamePreload() {
   return `"use strict";
 
 const displayName = process.env.IMPEL_APP_DISPLAY_NAME;
-if (process.type === "browser" && displayName) {
+const bundleIdentifier = process.env.IMPEL_APP_BUNDLE_ID;
+if (process.type === "browser" && displayName && bundleIdentifier) {
   const Module = require("node:module");
   const path = require("node:path");
   const load = Module._load;
   let objc;
   let appKit;
-  let launchServicesNamed = false;
+  let launchServicesIdentified = false;
   let activationPolicyRefreshed = false;
 
   const loadNativeBridge = () => {
@@ -2268,20 +2335,31 @@ if (process.type === "browser" && displayName) {
     return { objc, appKit };
   };
 
-  const setLaunchServicesApplicationName = () => {
-    if (launchServicesNamed) return;
+  const setLaunchServicesApplicationIdentity = () => {
+    if (launchServicesIdentified) return;
     try {
       const native = loadNativeBridge();
       new native.objc.NobjcLibrary(
         "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices",
       );
       const title = native.appKit.NSString.stringWithUTF8String$(displayName);
+      const identifier = native.appKit.NSString.stringWithUTF8String$(bundleIdentifier);
       const info = native.appKit.NSMutableDictionary.dictionaryWithDictionary$(
         native.appKit.NSBundle.mainBundle().infoDictionary(),
       );
       for (const key of ["CFBundleName", "CFBundleDisplayName"]) {
         info.setObject$forKey$(title, native.appKit.NSString.stringWithUTF8String$(key));
       }
+      // The signed vendor executable runs from the nested ChatGPT.app, so
+      // LaunchServices initially checks it in as com.openai.codex. When the
+      // native app is also open, Dock groups both processes under ChatGPT even
+      // though LSDisplayName was already tenant-branded. Check the process in
+      // again with the unique outer-wrapper identity to keep each tenant's
+      // Dock item distinct while preserving the vendor executable signature.
+      info.setObject$forKey$(
+        identifier,
+        native.appKit.NSString.stringWithUTF8String$("CFBundleIdentifier"),
+      );
       native.objc.callFunction(
         "_LSSetApplicationLaunchServicesServerConnectionStatus",
         { returns: "v", args: ["Q", "@"] },
@@ -2305,7 +2383,7 @@ if (process.type === "browser" && displayName) {
         title,
         null,
       );
-      launchServicesNamed = status === 0;
+      launchServicesIdentified = status === 0;
     } catch {
       // Keep the signed vendor app usable if LaunchServices changes this
       // private-but-established process-title API in a future macOS release.
@@ -2340,7 +2418,7 @@ if (process.type === "browser" && displayName) {
       const setName = loaded.app.setName.bind(loaded.app);
       setName(displayName);
       loaded.app.setName = () => setName(displayName);
-      setLaunchServicesApplicationName();
+      setLaunchServicesApplicationIdentity();
       setNativeApplicationMenuTitle();
       const setApplicationMenu = loaded.Menu.setApplicationMenu.bind(loaded.Menu);
       loaded.Menu.setApplicationMenu = (menu) => {
@@ -2351,11 +2429,11 @@ if (process.type === "browser" && displayName) {
           loaded.app.setActivationPolicy("accessory");
           setTimeout(() => {
             loaded.app.setActivationPolicy("regular");
-            launchServicesNamed = false;
-            setLaunchServicesApplicationName();
+            launchServicesIdentified = false;
+            setLaunchServicesApplicationIdentity();
             setApplicationMenu(menu);
             setNativeApplicationMenuTitle();
-          }, 0);
+          }, 100);
         }
         setTimeout(setNativeApplicationMenuTitle, 0);
         return result;
@@ -2523,30 +2601,122 @@ export function sweepStaleBundleArtifacts(dir, baseName) {
     throw error;
   }
   const prefixes = [`${baseName}.tmp-`, `${baseName}.previous-`];
-  const removed = entries.filter((entry) => prefixes.some((prefix) => entry.startsWith(prefix)));
-  for (const entry of removed) {
-    fs.rmSync(path.join(dir, entry), { recursive: true, force: true });
+  const removed = [];
+  for (const entry of entries.filter((candidate) => prefixes.some((prefix) => candidate.startsWith(prefix)))) {
+    if (removeBundleArtifact(path.join(dir, entry))) removed.push(entry);
   }
   return removed;
 }
 
-function replaceDirectory(destination, staging) {
-  const backup = `${destination}.previous-${process.pid}`;
-  fs.rmSync(backup, { recursive: true, force: true });
-  if (fs.existsSync(destination)) fs.renameSync(destination, backup);
+function uniqueBundleArtifactPath(destination, kind) {
+  return `${destination}.${kind}-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+}
+
+function removeBundleArtifact(candidate) {
+  try {
+    fs.rmSync(candidate, BUNDLE_ARTIFACT_REMOVE_OPTIONS);
+    return !fs.existsSync(candidate);
+  } catch {
+    return false;
+  }
+}
+
+export function withBundleMutationLock(destination, run) {
+  const lockPath = path.join(
+    path.dirname(destination),
+    `.${path.basename(destination)}.impel-install.lock`,
+  );
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+
+  if (process.platform !== "darwin") {
+    if (portableBundleMutationLocks.has(lockPath)) {
+      throw new Error(`another Impel app update is already replacing ${path.basename(destination)}`);
+    }
+    const descriptor = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_RDWR, 0o600);
+    portableBundleMutationLocks.add(lockPath);
+    try {
+      return run();
+    } finally {
+      portableBundleMutationLocks.delete(lockPath);
+      fs.closeSync(descriptor);
+    }
+  }
+
+  const deadline = Date.now() + BUNDLE_LOCK_WAIT_MS;
+  let descriptor;
+  while (descriptor === undefined) {
+    try {
+      descriptor = fs.openSync(
+        lockPath,
+        fs.constants.O_CREAT | fs.constants.O_RDWR | fs.constants.O_NONBLOCK | MACOS_O_EXLOCK,
+        0o600,
+      );
+    } catch (error) {
+      if (!["EAGAIN", "EWOULDBLOCK"].includes(error?.code)) throw error;
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another Impel app update to replace ${path.basename(destination)}`);
+      }
+      Atomics.wait(BUNDLE_LOCK_SLEEP, 0, 0, BUNDLE_LOCK_POLL_MS);
+    }
+  }
+  try {
+    return run();
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function replaceDirectoryUnlocked(destination, staging, {
+  removeArtifact = removeBundleArtifact,
+} = {}) {
+  const backup = fs.existsSync(destination)
+    ? uniqueBundleArtifactPath(destination, "previous")
+    : null;
+  if (backup) fs.renameSync(destination, backup);
   try {
     fs.renameSync(staging, destination);
-    fs.rmSync(backup, { recursive: true, force: true });
   } catch (error) {
-    if (!fs.existsSync(destination) && fs.existsSync(backup)) fs.renameSync(backup, destination);
+    if (backup && !fs.existsSync(destination) && fs.existsSync(backup)) {
+      fs.renameSync(backup, destination);
+    }
     throw error;
   }
+
+  // The new bundle is committed once staging has been renamed into place.
+  // Finder, LaunchServices, or a just-closed helper can briefly keep changing
+  // the old tree and make recursive removal end with ENOTEMPTY. Do not turn
+  // that post-commit housekeeping race into a failed tenant update: the next
+  // sweep will retry any backup that remains.
+  if (backup) {
+    try {
+      removeArtifact(backup);
+    } catch {
+      // Cleanup is best-effort after the committed rename.
+    }
+  }
+}
+
+export function replaceDirectory(destination, staging, options = {}) {
+  return withBundleMutationLock(destination, () => (
+    replaceDirectoryUnlocked(destination, staging, options)
+  ));
 }
 
 function isGatewayModel(model) {
   return model && typeof model.id === "string" && (model.provider === "claude" || model.provider === "codex");
 }
 
+function isExplicitNoSeatCatalog(payload) {
+  const statuses = payload?.provider_status;
+  return Boolean(statuses
+    && typeof statuses === "object"
+    && !Array.isArray(statuses)
+    && ["claude", "codex"].every((provider) => (
+      statuses[provider]?.state === "no_seat"
+      && statuses[provider]?.routable === false
+    )));
+}
+
 function writeAtomic(target, contents, mode) {
   fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
   if (fs.existsSync(target) && fs.readFileSync(target, "utf8") === contents) {

package/src/commands/apps.js

@@ -76,7 +76,7 @@ export function selectCatalogAppTargets(
   requestedTargets,
   models,
   config,
-  { log = console.log } = {},
+  { log = console.log, allowNone = false } = {},
 ) {
   const supported = appTargetsSupportedByModels(
     requestedTargets,
@@ -87,6 +87,14 @@ export function selectCatalogAppTargets(
   const unavailable = requestedTargets.filter((target) => !supportedSet.has(target));
   if (unavailable.length === 0) return supported;
 
+  if (allowNone && supported.length === 0) {
+    for (const target of unavailable) {
+      const capability = APP_CAPABILITIES[target];
+      log(`Skipping ${capability.label}: the selected tenant has no ${capability.provider} models.`);
+    }
+    return supported;
+  }
+
   if (requestedTargets.length === 1 || supported.length === 0) {
     const target = unavailable[0];
     const capability = APP_CAPABILITIES[target];
@@ -297,9 +305,9 @@ export function openManagedLauncher(launcher, {
   return false;
 }
 
-async function fetchWindowsCatalog(config, io) {
+async function fetchWindowsCatalog(config, io, { allowEmpty = false } = {}) {
   try {
-    return await io.fetchModels(config);
+    return await io.fetchModels(config, undefined, { allowEmpty });
   } catch (error) {
     throw new Error(`tenant model catalog is unavailable (${redactSecretText(error.message)}); the Impel app profiles were not changed`);
   }
@@ -374,12 +382,25 @@ export async function reconcileWindowsTenantApps({
     ...overrides,
   };
   const config = explicitTenantAppConfig(baseConfig, tenant, targets);
-  const catalog = await fetchWindowsCatalog(config, io);
-  const actionTargets = selectCatalogAppTargets(targets, catalog.models, config, { log: io.log });
+  const catalog = await fetchWindowsCatalog(config, io, { allowEmpty: true });
+  const actionTargets = selectCatalogAppTargets(targets, catalog.models, config, {
+    log: io.log,
+    allowNone: true,
+  });
   const supported = new Set(actionTargets);
   const unsupported = targets.filter((target) => !supported.has(target));
   const userData = io.claudeUserData(environment, config.tenantId);
   const paths = appPaths(homeDir, config.tenantId, { claudeUserData: userData, tenantName: config.tenantName });
+  if (actionTargets.length === 0) {
+    return {
+      tenantId: config.tenantId,
+      targets: [],
+      unsupported,
+      paths,
+      verification: {},
+      failed: [],
+    };
+  }
   const vendorPaths = {};
   const preparedTargets = new Set(skipVendor ? actionTargets : skipVendorTargets);
 
@@ -501,13 +522,28 @@ export async function reconcileMacTenantApps({
   const config = explicitTenantAppConfig(baseConfig, tenant, targets);
   let catalog;
   try {
-    catalog = await io.fetchModels(config);
+    catalog = await io.fetchModels(config, undefined, { allowEmpty: true });
   } catch (error) {
     throw new Error(`tenant model catalog is unavailable (${redactSecretText(error?.message || error)}); no Impel app files were changed`);
   }
-  const actionTargets = selectCatalogAppTargets(targets, catalog.models, config, { log: io.log });
+  const actionTargets = selectCatalogAppTargets(targets, catalog.models, config, {
+    log: io.log,
+    allowNone: true,
+  });
   const supported = new Set(actionTargets);
   const unsupported = targets.filter((target) => !supported.has(target));
+  const paths = appPaths(homeDir, config.tenantId, { tenantName: config.tenantName });
+  if (actionTargets.length === 0) {
+    return {
+      tenantId: config.tenantId,
+      targets: [],
+      unsupported,
+      paths,
+      verification: {},
+      installed: [],
+      failed: [],
+    };
+  }
   const vendorPaths = {};
   const statuses = io.status(actionTargets, homeDir, config.tenantId, config.tenantName);
   for (const status of statuses) vendorPaths[status.target] ||= status.vendorPath;
@@ -549,7 +585,6 @@ export async function reconcileMacTenantApps({
     vendorPaths,
     writeBundles: staleTargets,
   }) : [];
-  const paths = appPaths(homeDir, config.tenantId, { tenantName: config.tenantName });
   const agentItems = [];
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);

package/src/commands/converge.js

@@ -13,6 +13,8 @@ import { promptText } from "../prompt.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
 import { restoreNativeProfiles } from "./use.js";
 
+const RETRYABLE_TENANT_DISCOVERY_ERROR = /could not reach|request timed out|fetch failed|ECONNRESET|ECONNABORTED|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|network error|socket/iu;
+
 function confirmed(answer) {
   return /^(?:y|yes)$/iu.test(String(answer || "").trim());
 }
@@ -44,6 +46,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
     platform: process.platform,
     environment: process.env,
     preparePlatformClis,
+    discoveryLogger: console,
     ...overrides,
   };
   if (overrides.prepareWindowsClis && !overrides.preparePlatformClis) {
@@ -58,10 +61,22 @@ export async function cmdConverge(argv = [], overrides = {}) {
   let listing;
   try {
     listing = await io.fetchTenants(config);
+    // Tenant discovery is the entry gate for the whole convergence. A single
+    // transient timeout should not force a human to rerun every update step.
   } catch (error) {
-    console.error(`impel update: tenant discovery failed (${redactSecretText(error?.message || error)})`);
-    process.exitCode = 1;
-    return false;
+    if (!RETRYABLE_TENANT_DISCOVERY_ERROR.test(String(error?.message || error))) {
+      console.error(`impel update: tenant discovery failed (${redactSecretText(error?.message || error)})`);
+      process.exitCode = 1;
+      return false;
+    }
+    io.discoveryLogger.log("Tenants: discovery request failed transiently; retrying once…");
+    try {
+      listing = await io.fetchTenants(config);
+    } catch (retryError) {
+      console.error(`impel update: tenant discovery failed (${redactSecretText(retryError?.message || retryError)})`);
+      process.exitCode = 1;
+      return false;
+    }
   }
   const selected = selectDefaultTenant(listing, { currentTenantId: config.tenantId });
   config.tenantId = selected.id;