impel-cli 0.18.16 → 0.18.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.16",
+  "version": "0.18.17",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -130,6 +130,10 @@ const MAX_REASONING_LEVEL = { effort: "max", description: "Maximum reasoning dep
 const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning with automatic task delegation" };
 const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
 const FAST_MODE_AUTH_GATE = /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)&&!([A-Za-z_$][\w$]*)&&([A-Za-z_$][\w$]*)!=null&&\4\?\.requirements\?\.featureRequirements\?\.fast_mode!==!1/gu;
+const CHATGPT_THREAD_START_PROVIDER = /serviceName:([A-Za-z_$][\w$]*)\.serviceName\?\?this\.options\.defaultServiceName,threadSource:\1\.threadSource===void 0\?`user`:\1\.threadSource/gu;
+const CHATGPT_THREAD_FORK_PROVIDER = /let ([A-Za-z_$][\w$]*)=\{\.\.\.([A-Za-z_$][\w$]*),threadSource:\2\.threadSource===void 0\?`user`:\2\.threadSource\}/gu;
+const CHATGPT_THREAD_RESUME_PROVIDER = /modelProvider:null,cwd:([A-Za-z_$][\w$]*)\?\.cwd\?\?null,approvalPolicy:null,sandbox:null,config:\1\?\.config\?\?null,developerInstructions:\1\?\.developerInstructions\?\?void 0/gu;
+const CHATGPT_STRUCTURED_PROVIDER_FALLBACK = /allowProviderModelFallback:!0/gu;
 const CHATGPT_RESOURCE_ROOT = "linked_vendor_resources_with_patched_asar";
 const CLAUDE_PLAN_USAGE_GUARD = "if(!PSe()){cz();return}if(!Ge().hasOrgPolicyBackend())return;if((r=ar())";
 const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `if(!PSe()){cz();return}${"".padEnd("if(!Ge().hasOrgPolicyBackend())return;".length, " ")}if((r=ar())`;
@@ -271,7 +275,7 @@ export const CURRENT_CONFIG_VERSION = 26;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-07-31.2";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-01.1";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -349,6 +353,10 @@ export function bundleIsCurrent(status, {
       compatibility.vendorSignaturesPreserved === true
       && compatibility.resourceRoot === CHATGPT_RESOURCE_ROOT
       && compatibility.patches?.fastModeForGatewayAuth > 0
+      && compatibility.patches?.threadStartProviderOverride === 1
+      && compatibility.patches?.threadForkProviderOverride === 1
+      && compatibility.patches?.threadResumeProviderOverride === 1
+      && compatibility.patches?.structuredProviderFallbackDisabled === 2
       && compatibility.patches?.tenantDisplayNamePreload === 2
     )),
   );
@@ -1729,6 +1737,8 @@ function writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir
     linkVendoredChatGPTResources(staging, vendorBundleName);
     const runtimeAsarPath = path.join(staging, "Contents", "Resources", "app.asar");
     const fastModePatchCount = patchFastModeAuthGate(runtimeAsarPath);
+    const threadProviderPatches = patchChatGPTThreadRouting(runtimeAsarPath);
+    const structuredFallbackPatchCount = patchChatGPTStructuredProviderFallback(runtimeAsarPath);
     const asarHash = asarHeaderHash(runtimeAsarPath);
     const vendorExecutable = path.join(vendorBundle, "Contents", "MacOS", executableName);
     const signingIdentity = resolveVendoredAppSigningIdentity(vendorExecutable);
@@ -1773,6 +1783,10 @@ function writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir
       browserData: paths.chatgpt.browserData,
       patches: {
         fastModeForGatewayAuth: fastModePatchCount,
+        threadStartProviderOverride: threadProviderPatches.start,
+        threadForkProviderOverride: threadProviderPatches.fork,
+        threadResumeProviderOverride: threadProviderPatches.resume,
+        structuredProviderFallbackDisabled: structuredFallbackPatchCount,
         desktopAPIForGatewayAuth: 0,
         tenantDisplayNamePreload: 2,
       },
@@ -1995,6 +2009,99 @@ function patchFastModeAuthGate(asarPath) {
   return applyFixedWidthAsarPatches(asarPath, archive, patches, "ChatGPT/Codex Fast-mode eligibility contract");
 }
 
+/**
+ * Force every desktop app-server thread request onto the tenant's configured
+ * Impel provider. The pinned renderer passes null for internal metadata turns,
+ * which otherwise lets those turns escape to native OpenAI authentication.
+ */
+function patchChatGPTThreadRouting(asarPath) {
+  const archive = fs.readFileSync(asarPath);
+  const source = archive.toString("latin1");
+  const provider = JSON.stringify(RUNTIME_BRAND.cli.providerId);
+  const contracts = [
+    {
+      name: "start",
+      pattern: CHATGPT_THREAD_START_PROVIDER,
+      replacement: (match) => (
+        `modelProvider:${provider},serviceName:${match[1]}.serviceName??this.options.defaultServiceName,`
+        + `threadSource:${match[1]}.threadSource??\`user\``
+      ),
+    },
+    {
+      name: "fork",
+      pattern: CHATGPT_THREAD_FORK_PROVIDER,
+      replacement: (match) => (
+        `let ${match[1]}={...${match[2]},modelProvider:${provider},`
+        + `threadSource:${match[2]}.threadSource??\`user\`}`
+      ),
+    },
+    {
+      name: "resume",
+      pattern: CHATGPT_THREAD_RESUME_PROVIDER,
+      replacement: (match) => (
+        `modelProvider:${provider},cwd:${match[1]}?.cwd??null,approvalPolicy:null,sandbox:null,`
+        + `config:${match[1]}?.config??null,developerInstructions:${match[1]}?.developerInstructions`
+      ),
+    },
+  ];
+  const counts = {};
+  const patches = [];
+  for (const contract of contracts) {
+    const matches = [...source.matchAll(contract.pattern)];
+    if (matches.length !== 1) {
+      throw new Error(
+        `ChatGPT/Codex thread-${contract.name} provider patch expected 1 match, found ${matches.length}`,
+      );
+    }
+    const match = matches[0];
+    const replacement = contract.replacement(match);
+    if (replacement.length > match[0].length) {
+      throw new Error(
+        `ChatGPT/Codex thread-${contract.name} provider replacement no longer fits the vendor ASAR contract`,
+      );
+    }
+    patches.push({
+      offset: match.index,
+      original: match[0],
+      replacement: replacement.padEnd(match[0].length, " "),
+    });
+    counts[contract.name] = 1;
+  }
+  applyFixedWidthAsarPatches(
+    asarPath,
+    archive,
+    patches,
+    "ChatGPT/Codex thread-provider routing contract",
+  );
+  return counts;
+}
+
+/**
+ * Structured title, description, and classification turns opt into falling
+ * back to another provider in the pinned renderer. Keep those turns fail
+ * closed on Impel by changing the two reviewed boolean literals in place.
+ */
+function patchChatGPTStructuredProviderFallback(asarPath) {
+  const archive = fs.readFileSync(asarPath);
+  const source = archive.toString("latin1");
+  const matches = [...source.matchAll(CHATGPT_STRUCTURED_PROVIDER_FALLBACK)];
+  if (matches.length !== 2) {
+    throw new Error(
+      `ChatGPT/Codex structured provider-fallback patch expected 2 matches, found ${matches.length}`,
+    );
+  }
+  return applyFixedWidthAsarPatches(
+    asarPath,
+    archive,
+    matches.map((match) => ({
+      offset: match.index,
+      original: match[0],
+      replacement: "allowProviderModelFallback:!1",
+    })),
+    "ChatGPT/Codex structured provider-fallback contract",
+  );
+}
+
 function applyFixedWidthAsarPatches(asarPath, archive, patches, label) {
   if (patches.length === 0) {
     throw new Error(`this desktop app version has an unsupported ${label}; update impel-cli before installing it`);