impel-cli 0.18.15 → 0.18.16

package/src/macSetup.js

@@ -7,11 +7,12 @@ import { spawnSync } from "node:child_process";
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile } from "./cliProfiles.js";
 import { findNativeBinary } from "./nativeProcess.js";
 import { syncSkillsSafe } from "./skills.js";
+import { verifyReviewedMacVendorCli } from "./vendorCliBinaries.js";
+import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
 
 const MAX_INSTALLER_BYTES = 512 * 1024;
 const INSTALLER_DOWNLOAD_TIMEOUT_MS = 30_000;
 const INSTALLER_RUN_TIMEOUT_MS = 10 * 60 * 1_000;
-const MAC_SIGNING_TEAMS = Object.freeze({ claude: "Q6L2SF6YDW", codex: "2DC432GLL2" });
 
 /**
  * The script bytes are pinned per impel-cli release. Both vendor scripts then
@@ -19,59 +20,34 @@ const MAC_SIGNING_TEAMS = Object.freeze({ claude: "Q6L2SF6YDW", codex: "2DC432GL
  */
 export const MAC_CLI_INSTALLERS = Object.freeze({
   claude: Object.freeze({
+    version: PINNED_VENDOR_CLI_VERSIONS.claude,
     url: "https://claude.ai/install.sh",
     trustedOrigins: Object.freeze([
       "https://claude.ai",
       "https://downloads.claude.ai",
     ]),
     sha256: "cde4f1702d3b1695f92b73d26888364e17bca476e17f0fd676484c951d36c125",
-    command: "curl -fsSL https://claude.ai/install.sh | bash -s stable",
-    args: Object.freeze(["stable"]),
+    command: `curl -fsSL https://claude.ai/install.sh | bash -s ${PINNED_VENDOR_CLI_VERSIONS.claude}`,
+    args: Object.freeze([PINNED_VENDOR_CLI_VERSIONS.claude]),
     environment: Object.freeze({}),
   }),
   codex: Object.freeze({
+    version: PINNED_VENDOR_CLI_VERSIONS.codex,
     url: "https://chatgpt.com/codex/install.sh",
     trustedOrigins: Object.freeze([
       "https://chatgpt.com",
       "https://releases.openai.com",
     ]),
     sha256: "ba92dd27e5c06f0d3bbc58bfa4b9cfb6599cd2742fbb1f92a2765e6c07dedb5a",
-    command: "curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 CODEX_RELEASE=0.144.6 sh",
+    command: `curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 CODEX_RELEASE=${PINNED_VENDOR_CLI_VERSIONS.codex} sh`,
     args: Object.freeze([]),
-    environment: Object.freeze({ CODEX_NON_INTERACTIVE: "1", CODEX_RELEASE: "0.144.6" }),
+    environment: Object.freeze({
+      CODEX_NON_INTERACTIVE: "1",
+      CODEX_RELEASE: PINNED_VENDOR_CLI_VERSIONS.codex,
+    }),
   }),
 });
 
-function verifyMacCli(tool, binary, environment, run = spawnSync) {
-  try {
-    const result = run(binary, ["--version"], {
-      encoding: "utf8",
-      env: environment,
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15_000,
-    });
-    if (result?.status !== 0 || result?.error) return false;
-    const explicitOverride = tool === "claude" ? environment.IMPEL_CLAUDE_BIN : environment.IMPEL_CODEX_BIN;
-    if (explicitOverride && path.resolve(explicitOverride) === path.resolve(binary)) return true;
-    const resolved = fs.realpathSync(binary);
-    const verified = run("/usr/bin/codesign", ["--verify", "--strict", resolved], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15_000,
-    });
-    if (verified?.status !== 0 || verified?.error) return false;
-    const details = run("/usr/bin/codesign", ["-dv", "--verbose=4", resolved], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15_000,
-    });
-    return details?.status === 0
-      && String(details.stderr || details.stdout || "").includes(`TeamIdentifier=${MAC_SIGNING_TEAMS[tool]}`);
-  } catch {
-    return false;
-  }
-}
-
 function detectMacClis(find, environment, verify) {
   const detect = (tool) => find(
     tool,
@@ -200,7 +176,7 @@ export async function prepareMacClis({
   const io = {
     environment: process.env,
     find: findNativeBinary,
-    verify: verifyMacCli,
+    verify: verifyReviewedMacVendorCli,
     run: spawnSync,
     fetchImpl: fetch,
     fsImpl: fs,
@@ -252,7 +228,10 @@ export async function prepareMacClis({
     await io.syncSkills({
       client: "claude",
       gatewayUrl,
-      env: { CLAUDE_CONFIG_DIR: claudeProfile.configDir },
+      env: {
+        CLAUDE_CONFIG_DIR: claudeProfile.configDir,
+        IMPEL_CLAUDE_BIN: binaries.claude,
+      },
       label: "Impel isolated Claude (impel claude)",
       // Lets Windows spawns use a git-safe cwd (see skillSyncSpawnDirectory).
       homeDir: os.homedir(),
@@ -262,7 +241,10 @@ export async function prepareMacClis({
     await io.syncSkills({
       client: "codex",
       gatewayUrl,
-      env: { CODEX_HOME: codexProfile.codexHome },
+      env: {
+        CODEX_HOME: codexProfile.codexHome,
+        IMPEL_CODEX_BIN: binaries.codex,
+      },
       label: "Impel isolated Codex (impel codex)",
       homeDir: os.homedir(),
     });

package/src/provisioning.js

@@ -5,7 +5,6 @@ import path from "node:path";
 import { syncAgentProfilesSafe } from "./agents.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile, tenantCliProfilePaths } from "./cliProfiles.js";
-import { findNativeBinary } from "./nativeProcess.js";
 import { mapWithConcurrency } from "./progress.js";
 import { registerTenantShellEntries } from "./shellEntries.js";
 import { resolveSkillsGateway, syncSkillsSafe } from "./skills.js";
@@ -17,6 +16,7 @@ import {
 } from "./tenants.js";
 import { reconcileTenantApps } from "./commands/apps.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
+import { findReviewedVendorCliBinary } from "./vendorCliBinaries.js";
 
 export function selectDefaultTenant(listing, { requested = null, currentTenantId = null } = {}) {
   const normalized = requested ? normalizeTenantId(requested) : null;
@@ -93,13 +93,19 @@ async function prepareTenantCli(config, tenant, io, binaries) {
         crossAppModels: crossAppModelsEnabled(config),
       }),
       root: (profile) => profile.configDir,
-      env: (profile) => ({ CLAUDE_CONFIG_DIR: profile.configDir }),
+      env: (profile) => ({
+        CLAUDE_CONFIG_DIR: profile.configDir,
+        IMPEL_CLAUDE_BIN: binaries.claude,
+      }),
     },
     codex: {
       supported: providerSupported(config.scopes, PAT_SCOPE_CODEX),
       ensure: () => io.ensureCodex(config.gatewayUrl, tenant.id),
       root: (profile) => profile.codexHome,
-      env: (profile) => ({ CODEX_HOME: profile.codexHome }),
+      env: (profile) => ({
+        CODEX_HOME: profile.codexHome,
+        IMPEL_CODEX_BIN: binaries.codex,
+      }),
     },
   };
   const clients = {};
@@ -181,7 +187,7 @@ export async function reconcileAllTenants({
     ensureCodex: ensureImpelCodexProfile,
     syncSkills: syncSkillsSafe,
     syncAgents: syncAgentProfilesSafe,
-    findBinary: findNativeBinary,
+    findBinary: findReviewedVendorCliBinary,
     reconcileApps: reconcileTenantApps,
     registerShellEntries: registerTenantShellEntries,
     knownTenantIds: locallyKnownTenantIds,

package/src/skills.js

@@ -25,6 +25,8 @@ import path from "node:path";
 
 import { resolveDefaultGateway, normalizeGatewayUrl } from "./config.js";
 import { findNativeBinary, nativeCommandInvocation } from "./nativeProcess.js";
+import { findReviewedVendorCliBinary } from "./vendorCliBinaries.js";
+import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
 
 /** The bundled plugin the Bifrost registry publishes; contains every served skill. */
 export const SKILL_PLUGIN_NAME = "bifrost-all-skills";
@@ -499,6 +501,7 @@ export async function syncSkills({
   platform = process.platform,
   findGit = findNativeBinary,
   homeDir = null,
+  findVendorBinary = findReviewedVendorCliBinary,
 } = {}) {
   const spec = CLIENT_SPECS[client];
   if (!spec) {
@@ -512,6 +515,18 @@ export async function syncSkills({
     return { client, label: displayLabel, skipped: true, reason: "disabled" };
   }
 
+  let commandBinary = spec.bin;
+  if (platform === "darwin" && run === runSkillCommand) {
+    commandBinary = findVendorBinary(client, { ...process.env, ...env }, platform);
+    if (!commandBinary) {
+      logger.warn(
+        `impel: skipping skill sync for ${displayLabel} — reviewed ${spec.label} `
+        + `v${PINNED_VENDOR_CLI_VERSIONS[client]} is not installed; run \`impel update\`.`,
+      );
+      return { client, label: displayLabel, skipped: true, reason: "binary-version-mismatch" };
+    }
+  }
+
   // Callers that manage real profiles pass their home directory so Windows
   // spawns happen from a git-safe cwd (see skillSyncSpawnDirectory).
   const spawnDirectory = skillSyncSpawnDirectory({ platform, homeDir });
@@ -521,9 +536,10 @@ export async function syncSkills({
 
   try {
     // Confirm the binary and its `plugin` subcommand exist before doing anything.
-    const help = await runCommand(spec.bin, ["plugin", "--help"], env);
+    const help = await runCommand(commandBinary, ["plugin", "--help"], env);
     if (help.missing) {
-      logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${spec.bin}\` CLI not found on PATH.`);
+      const location = commandBinary === spec.bin ? " on PATH" : "";
+      logger.warn(`impel: skipping skill sync for ${displayLabel} — \`${commandBinary}\` CLI not found${location}.`);
       return { client, label: displayLabel, skipped: true, reason: "binary-missing" };
     }
     if (!help.ok) {
@@ -555,12 +571,12 @@ export async function syncSkills({
     })[0];
     const registerResult = await runSkillCommandWithRetry(
       runCommand,
-      spec.bin,
+      commandBinary,
       registerCommand.args,
       env,
     );
     if (registerResult.missing) {
-      failures.push({ phase: registerCommand.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
+      failures.push({ phase: registerCommand.phase, reason: `\`${commandBinary}\` disappeared mid-sync` });
     } else if (!isBenign(registerResult)) {
       failures.push({
         phase: registerCommand.phase,
@@ -573,7 +589,7 @@ export async function syncSkills({
     // gives us the same dynamic name so refreshes can still use
     // PLUGIN@MARKETPLACE.
     if (!marketplaceName && !registerResult.missing) {
-      const listed = await runCommand(spec.bin, ["plugin", "marketplace", "list", "--json"], env);
+      const listed = await runCommand(commandBinary, ["plugin", "marketplace", "list", "--json"], env);
       if (listed.ok) marketplaceName = resolveConfiguredMarketplaceName(listed.stdout, sourceUrl);
     }
 
@@ -585,12 +601,12 @@ export async function syncSkills({
     for (const command of commands) {
       const result = await runSkillCommandWithRetry(
         runCommand,
-        spec.bin,
+        commandBinary,
         command.args,
         env,
       );
       if (result.missing) {
-        failures.push({ phase: command.phase, reason: `\`${spec.bin}\` disappeared mid-sync` });
+        failures.push({ phase: command.phase, reason: `\`${commandBinary}\` disappeared mid-sync` });
         break;
       }
       if (isBenign(result)) continue;
@@ -603,7 +619,7 @@ export async function syncSkills({
       ) {
         const repair = await reregisterCodexMarketplace({
           run: runCommand,
-          bin: spec.bin,
+          bin: commandBinary,
           env,
           marketplaceName,
           sourceUrl,

package/src/updates.js

@@ -36,8 +36,19 @@ export function updateRegistry() {
   ).replace(/\/+$/u, "");
 }
 
-export function updateInstallSpec() {
-  return `${updatePackage()}@latest`;
+function normalizeUpdateTag(tag) {
+  if (tag === "latest" || tag === "next") return tag;
+  throw new Error(`unsupported npm update tag "${tag}"`);
+}
+
+/** Keep prerelease installs on npm's prerelease channel. */
+export function updateTagForVersion(version) {
+  const parsed = validVersion(version) ? version.match(VERSION_RE) : null;
+  return parsed?.[4] ? "next" : "latest";
+}
+
+export function updateInstallSpec(tag = "latest") {
+  return `${updatePackage()}@${normalizeUpdateTag(tag)}`;
 }
 
 export function installedVersion() {
@@ -88,15 +99,17 @@ export function isNewerVersion(candidate, current) {
 function fetchRemoteVersionWithNpm({
   packageName,
   registry,
+  tag,
   timeoutMs,
   spawnSyncImpl = spawnSync,
   environment = process.env,
   platform = process.platform,
 }) {
   try {
+    const target = tag === "latest" ? packageName : `${packageName}@${tag}`;
     const invocation = nativeCommandInvocation(
       "npm",
-      ["view", packageName, "version", "--json", "--registry", registry],
+      ["view", target, "version", "--json", "--registry", registry],
       environment,
       platform,
     );
@@ -122,39 +135,71 @@ function fetchRemoteVersionWithNpm({
 export async function fetchRemoteVersion({
   packageName = updatePackage(),
   registry = updateRegistry(),
+  tag = "latest",
   timeoutMs = 10_000,
   fetchImpl = null,
+  fallbackToNpm = fetchImpl === null,
   spawnSyncImpl = spawnSync,
   environment = process.env,
   platform = process.platform,
 } = {}) {
+  const normalizedTag = normalizeUpdateTag(tag);
   const normalizedRegistry = String(registry).replace(/\/+$/u, "");
   if (!fetchImpl && normalizedRegistry !== DEFAULT_UPDATE_REGISTRY) {
     return fetchRemoteVersionWithNpm({
       packageName,
       registry: normalizedRegistry,
+      tag: normalizedTag,
+      timeoutMs,
+      spawnSyncImpl,
+      environment,
+      platform,
+    });
+  }
+  // Windows npm commonly has proxy, certificate, or registry settings that
+  // Node's bare fetch does not inherit. Prefer the already-working npm client
+  // there, then retain the direct registry request as a fallback.
+  if (!fetchImpl && platform === "win32") {
+    const npmVersion = fetchRemoteVersionWithNpm({
+      packageName,
+      registry: normalizedRegistry,
+      tag: normalizedTag,
       timeoutMs,
       spawnSyncImpl,
       environment,
       platform,
     });
+    if (npmVersion) return npmVersion;
   }
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  let remoteVersion = null;
   try {
     const encodedName = encodeURIComponent(packageName);
-    const response = await (fetchImpl || globalThis.fetch)(`${normalizedRegistry}/${encodedName}/latest`, {
+    const response = await (fetchImpl || globalThis.fetch)(`${normalizedRegistry}/${encodedName}/${normalizedTag}`, {
       headers: { accept: "application/json" },
       signal: controller.signal,
     });
-    if (!response.ok) return null;
-    const metadata = await response.json();
-    return validVersion(metadata?.version) ? metadata.version : null;
+    if (response.ok) {
+      const metadata = await response.json();
+      remoteVersion = validVersion(metadata?.version) ? metadata.version : null;
+    }
   } catch {
-    return null;
+    // npm is the authoritative fallback below. It also honors npm's proxy and
+    // registry configuration, which is especially important on Windows.
   } finally {
     clearTimeout(timeout);
   }
+  if (remoteVersion || !fallbackToNpm) return remoteVersion;
+  return fetchRemoteVersionWithNpm({
+    packageName,
+    registry: normalizedRegistry,
+    tag: normalizedTag,
+    timeoutMs,
+    spawnSyncImpl,
+    environment,
+    platform,
+  });
 }
 
 export function readUpdateCache() {
@@ -198,7 +243,9 @@ export function cacheIsFresh(cache, now = Date.now()) {
 export async function refreshUpdateCache(dependencies = {}) {
   const fetchLatest = dependencies.fetchRemoteVersion || fetchRemoteVersion;
   const writeCache = dependencies.writeCache || writeUpdateCache;
-  const remoteVersion = await fetchLatest();
+  const currentVersion = (dependencies.installedVersion || installedVersion)();
+  const tag = updateTagForVersion(currentVersion);
+  const remoteVersion = await fetchLatest({ tag });
   if (!remoteVersion) {
     try {
       writeCache({ lastFailedAt: Date.now() });
@@ -207,7 +254,7 @@ export async function refreshUpdateCache(dependencies = {}) {
     }
     return null;
   }
-  return writeCache({ remoteVersion, checkedAt: Date.now() });
+  return writeCache({ remoteVersion, updateTag: tag, checkedAt: Date.now() });
 }
 
 /** One-line human notice when npm has a newer stable package. */

package/src/vendorCliBinaries.js

@@ -0,0 +1,121 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+import {
+  environmentValue,
+  findNativeBinary,
+  resolveNativeBinary,
+} from "./nativeProcess.js";
+import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
+
+export const MAC_VENDOR_SIGNING_TEAMS = Object.freeze({
+  claude: "Q6L2SF6YDW",
+  codex: "2DC432GLL2",
+});
+
+const VERSION_RE = /\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/u;
+
+function vendorOverrideName(tool, environmentPrefix = "IMPEL") {
+  if (tool === "claude") return `${environmentPrefix}_CLAUDE_BIN`;
+  if (tool === "codex") return `${environmentPrefix}_CODEX_BIN`;
+  return null;
+}
+
+/** Extract the vendor release from `claude --version` or `codex --version`. */
+export function parseVendorCliVersion(output) {
+  return String(output || "").match(VERSION_RE)?.[0] || null;
+}
+
+/**
+ * Accept only the exact reviewed macOS release and its vendor signature.
+ * Explicit binary overrides remain authoritative for development and recovery.
+ */
+export function verifyReviewedMacVendorCli(
+  tool,
+  binary,
+  environment = process.env,
+  {
+    run = spawnSync,
+    realpath = fs.realpathSync,
+    versions = PINNED_VENDOR_CLI_VERSIONS,
+    signingTeams = MAC_VENDOR_SIGNING_TEAMS,
+    environmentPrefix = "IMPEL",
+  } = {},
+) {
+  if (!versions[tool] || !signingTeams[tool]) return false;
+  try {
+    const override = vendorOverrideName(tool, environmentPrefix);
+    const overriddenBinary = override ? environmentValue(environment, override) : null;
+    if (overriddenBinary && path.resolve(overriddenBinary) === path.resolve(binary)) return true;
+
+    const result = run(binary, ["--version"], {
+      encoding: "utf8",
+      env: environment,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+    });
+    if (result?.status !== 0 || result?.error) return false;
+
+    const version = parseVendorCliVersion(`${result.stdout || ""}\n${result.stderr || ""}`);
+    if (version !== versions[tool]) return false;
+
+    const resolved = realpath(binary);
+    const verified = run("/usr/bin/codesign", ["--verify", "--strict", resolved], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+    });
+    if (verified?.status !== 0 || verified?.error) return false;
+    const details = run("/usr/bin/codesign", ["-dv", "--verbose=4", resolved], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+    });
+    return details?.status === 0
+      && String(details.stderr || details.stdout || "").includes(`TeamIdentifier=${signingTeams[tool]}`);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Locate the reviewed macOS vendor CLI. On other platforms this intentionally
+ * preserves the existing native resolution behavior.
+ */
+export function findReviewedVendorCliBinary(
+  tool,
+  environment = process.env,
+  platform = process.platform,
+  environmentPrefix = "IMPEL",
+  {
+    find = findNativeBinary,
+    verify = verifyReviewedMacVendorCli,
+  } = {},
+) {
+  if (platform !== "darwin") return find(tool, environment, platform, environmentPrefix);
+  return find(
+    tool,
+    environment,
+    platform,
+    environmentPrefix,
+    (binary) => verify(tool, binary, environment, { environmentPrefix }),
+  );
+}
+
+/**
+ * Resolve a launch target. macOS deliberately returns null when only an
+ * unreviewed or version-drifted binary exists so callers can request repair
+ * instead of silently launching it.
+ */
+export function resolveReviewedVendorCliBinary(
+  tool,
+  environment = process.env,
+  platform = process.platform,
+  environmentPrefix = "IMPEL",
+) {
+  if (platform !== "darwin") {
+    return resolveNativeBinary(tool, environment, platform, environmentPrefix);
+  }
+  return findReviewedVendorCliBinary(tool, environment, platform, environmentPrefix);
+}

package/src/vendorCliVersions.js

@@ -0,0 +1,7 @@
+// Exact vendor CLI releases reviewed for this impel-cli build. Keep macOS and
+// Windows installers on the same versions; do not replace these with moving
+// channels such as "stable" or "latest".
+export const PINNED_VENDOR_CLI_VERSIONS = Object.freeze({
+  claude: "2.1.212",
+  codex: "0.146.0",
+});