impel-cli 0.18.4 → 0.18.5

package/src/commands/launch.js

@@ -21,6 +21,7 @@ import {
   nativeSpawnInvocation,
   resolveNativeBinary,
 } from "../nativeProcess.js";
+import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 const CLAUDE_DIRECT_AUTH_ENV = [
   "ANTHROPIC_API_KEY",
@@ -53,6 +54,7 @@ const IMPEL_CODEX_RUNTIME_OVERRIDES = [
 ];
 
 export function impelLaunchArguments(tool, argv) {
+  if (!RUNTIME_BRAND.features.agents) return [...argv];
   if (tool === "claude") {
     return ["--append-system-prompt", IMPEL_SPECIALIST_DELEGATION_INSTRUCTIONS, ...argv];
   }
@@ -120,7 +122,7 @@ export async function cmdLaunch(tool, argv) {
     process.exitCode = 1;
     return;
   }
-  maybePrintUpdateNotice();
+  if (RUNTIME_BRAND.cli.packageName === "impel-cli") maybePrintUpdateNotice();
 
   const gatewayUrl = normalizeGatewayUrl(config.gatewayUrl || resolveDefaultGateway());
   const crossAppModels = tool === "claude" && crossAppModelsEnabled(config);
@@ -168,13 +170,15 @@ export async function cmdLaunch(tool, argv) {
 
   // Refresh at most every six hours. A network/catalog failure must not block
   // the isolated client; the last successfully generated agents remain usable.
-  await syncAgentProfilesSafe({
-    profiles: [agentProfile],
-    gatewayUrl,
-    credential: gatewayCredential,
-    tenantId,
-    staleOnly: true,
-  });
+  if (RUNTIME_BRAND.features.agents) {
+    await syncAgentProfilesSafe({
+      profiles: [agentProfile],
+      gatewayUrl,
+      credential: gatewayCredential,
+      tenantId,
+      staleOnly: true,
+    });
+  }
 
   // Both vendor CLIs shell out to `git` for plugin/marketplace operations; on
   // a fresh Windows machine the installed git (typically the Impel-managed

package/src/commands/pat.js

@@ -12,18 +12,21 @@ import {
   PAT_SCOPE_CODEX,
   PAT_SCOPE_TASKS,
 } from "../tenants.js";
+import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 const AGENT_PAT_LABEL_PREFIX = "Agent · ";
 const MAX_PAT_LABEL_LENGTH = 120;
 const MAX_PAT_TTL_DAYS = 365;
 const PAT_COLLECTION_PATH = "/api/cli/pats";
-const PAT_TOKEN_RE = /^impel_pat_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
-const PAT_TOKEN_INPUT_RE = /^impel_pat_([A-Za-z0-9_-]{8,128})\.[A-Za-z0-9_-]+$/u;
+const escapedPATPrefix = RUNTIME_BRAND.auth.patPrefix.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+const PAT_TOKEN_RE = new RegExp(`^${escapedPATPrefix}[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$`, "u");
+const PAT_TOKEN_INPUT_RE = new RegExp(`^${escapedPATPrefix}([A-Za-z0-9_-]{8,128})\\.[A-Za-z0-9_-]+$`, "u");
 const PAT_TOKEN_ID_RE = /^[A-Za-z0-9_-]{8,128}$/u;
 const AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,111}$/u;
 const CONTROL_CHARACTER_RE = /[\u0000-\u001F\u007F-\u009F]/u;
 const PAT_SCOPES = [PAT_SCOPE_CLAUDE, PAT_SCOPE_CODEX, PAT_SCOPE_TASKS];
 const PAT_SCOPE_SET = new Set(PAT_SCOPES);
+const PAT_COMMAND = `${RUNTIME_BRAND.cli.command} pat`;
 const FLAG_NAMES = new Set([
   "agent",
   "app",
@@ -50,16 +53,19 @@ const CREATE_FLAG_NAMES = new Set([
 ]);
 const REVOKE_FLAG_NAMES = new Set(["app", "help", "json", "yes"]);
 
-const HELP = `impel pat - manage personal access tokens through Impel
+const AGENT_PAT_HELP = RUNTIME_BRAND.capabilities.agentPats
+  ? `\n  ${RUNTIME_BRAND.cli.command} pat create --agent <agent-id> [options]`
+  : "";
+const HELP = `${RUNTIME_BRAND.cli.command} pat - manage personal access tokens through ${RUNTIME_BRAND.product.displayName}
 
 Usage:
-  impel pat create --label <label> [options]
-  impel pat create --agent <agent-id> [options]
-  impel pat revoke <token-id> --yes [options]
+  ${RUNTIME_BRAND.cli.command} pat create --label <label> [options]
+${AGENT_PAT_HELP}
+  ${RUNTIME_BRAND.cli.command} pat revoke <token-id> --yes [options]
 
 Aliases:
-  impel pats ...
-  impel pat mint ...
+  ${RUNTIME_BRAND.cli.command} pats ...
+  ${RUNTIME_BRAND.cli.command} pat mint ...
 
 Options:
   --org <org>          Target org. Defaults to the selected tenant.
@@ -71,7 +77,7 @@ Options:
   --json               Print the result as JSON.
   --yes                Confirm irreversible PAT revocation.
 
-The stored PAT authenticates this request. The control plane verifies the owner,
+The stored ${RUNTIME_BRAND.product.displayName} PAT authenticates this request. The control plane verifies the owner,
 organization membership, requested scopes, and agent access before identity mints
 the new secret or revokes the selected token. New PATs are shown once and are not
 stored automatically. Revoke accepts a token id or a full PAT and never echoes a secret.
@@ -101,14 +107,14 @@ function flagSpec() {
 function rejectUnsupportedFlags(flags, allowed, action) {
   const unsupported = Object.keys(flags).find((name) => !allowed.has(name));
   if (unsupported) {
-    fail(`impel pat ${action}: option --${redactSecretText(unsupported)} is not supported.`);
+    fail(`${PAT_COMMAND} ${action}: option --${redactSecretText(unsupported)} is not supported.`);
   }
 }
 
 function requireConfig(flags) {
   const config = loadConfig();
   if (!config?.pat) {
-    fail("impel pat: not authenticated. Run `impel setup` (or `impel auth`) first.");
+    fail(`${RUNTIME_BRAND.cli.command} pat: not authenticated. Run \`${RUNTIME_BRAND.cli.command} setup\` (or \`${RUNTIME_BRAND.cli.command} auth\`) first.`);
   }
 
   const appUrl = normalizeGatewayUrl(flags.app || config.appUrl || resolveDefaultAppUrl());
@@ -116,7 +122,7 @@ function requireConfig(flags) {
   try {
     parsed = new URL(appUrl);
   } catch {
-    fail("impel pat: --app must be an HTTP or HTTPS URL.");
+    fail(`${PAT_COMMAND}: --app must be an HTTP or HTTPS URL.`);
   }
   if (
     (parsed.protocol !== "http:" && parsed.protocol !== "https:")
@@ -126,7 +132,7 @@ function requireConfig(flags) {
     || parsed.search
     || parsed.hash
   ) {
-    fail("impel pat: --app must be a bare HTTP or HTTPS origin without credentials, a path, query, or fragment.");
+    fail(`${PAT_COMMAND}: --app must be a bare HTTP or HTTPS origin without credentials, a path, query, or fragment.`);
   }
   return { appUrl, config };
 }
@@ -138,11 +144,11 @@ function requestedScopes(value) {
     .map((scope) => scope.trim())
     .filter(Boolean);
   if (requested.length === 0) {
-    fail("impel pat: --scopes must contain at least one scope.");
+    fail(`${PAT_COMMAND}: --scopes must contain at least one scope.`);
   }
   for (const scope of requested) {
     if (!PAT_SCOPE_SET.has(scope)) {
-      fail(`impel pat: unknown scope "${redactSecretText(scope)}".`);
+      fail(`${PAT_COMMAND}: unknown scope "${redactSecretText(scope)}".`);
     }
   }
   const requestedSet = new Set(requested);
@@ -152,23 +158,23 @@ function requestedScopes(value) {
 function requestedTtlDays(value) {
   if (value === undefined) return undefined;
   if (!/^\d+$/u.test(String(value))) {
-    fail(`impel pat: --ttl-days must be an integer from 1 to ${MAX_PAT_TTL_DAYS}.`);
+    fail(`${PAT_COMMAND}: --ttl-days must be an integer from 1 to ${MAX_PAT_TTL_DAYS}.`);
   }
   const days = Number(value);
   if (!Number.isSafeInteger(days) || days < 1 || days > MAX_PAT_TTL_DAYS) {
-    fail(`impel pat: --ttl-days must be an integer from 1 to ${MAX_PAT_TTL_DAYS}.`);
+    fail(`${PAT_COMMAND}: --ttl-days must be an integer from 1 to ${MAX_PAT_TTL_DAYS}.`);
   }
   return days;
 }
 
 function requestedTokenId(value) {
   if (value === undefined) {
-    fail("impel pat revoke: missing token id.");
+    fail(`${PAT_COMMAND} revoke: missing token id.`);
   }
   const requested = String(value).trim();
   const tokenId = PAT_TOKEN_INPUT_RE.exec(requested)?.[1] || requested;
   if (!PAT_TOKEN_ID_RE.test(tokenId)) {
-    fail("impel pat revoke: expected a valid token id or full Impel PAT.");
+    fail(`${PAT_COMMAND} revoke: expected a valid token id or full ${RUNTIME_BRAND.product.displayName} PAT.`);
   }
   return tokenId;
 }
@@ -177,31 +183,34 @@ function requestedSubject(flags) {
   const agentId = flags.agent === undefined ? null : String(flags.agent).trim();
   const personalLabel = flags.label === undefined ? null : String(flags.label).trim();
   if (agentId !== null && personalLabel !== null) {
-    fail("impel pat create: use either --label for a personal PAT or --agent for an agent PAT, not both.");
+    fail(`${PAT_COMMAND} create: use either --label for a personal PAT or --agent for an agent PAT, not both.`);
   }
   if (agentId !== null) {
+    if (!RUNTIME_BRAND.capabilities.agentPats) {
+      fail(`${PAT_COMMAND} create: agent PATs are not available in this branded CLI.`);
+    }
     if (!AGENT_ID_RE.test(agentId)) {
-      fail("impel pat create: --agent must be a valid agent id (letters, numbers, dots, dashes, or underscores).");
+      fail(`${PAT_COMMAND} create: --agent must be a valid agent id (letters, numbers, dots, dashes, or underscores).`);
     }
     const label = `${AGENT_PAT_LABEL_PREFIX}${agentId}`;
     if (label.length > MAX_PAT_LABEL_LENGTH) {
-      fail(`impel pat create: the generated agent label exceeds ${MAX_PAT_LABEL_LENGTH} characters.`);
+      fail(`${PAT_COMMAND} create: the generated agent label exceeds ${MAX_PAT_LABEL_LENGTH} characters.`);
     }
     return { agentId, kind: "agent", label };
   }
 
   if (!personalLabel) {
-    fail("impel pat create: --label is required for a personal PAT; use --agent <id> for an agent PAT.");
+    fail(`${PAT_COMMAND} create: --label is required for a personal PAT; use --agent <id> for an agent PAT.`);
   }
   if (personalLabel.length > MAX_PAT_LABEL_LENGTH || CONTROL_CHARACTER_RE.test(personalLabel)) {
-    fail(`impel pat create: --label must be 1 to ${MAX_PAT_LABEL_LENGTH} characters without control characters.`);
+    fail(`${PAT_COMMAND} create: --label must be 1 to ${MAX_PAT_LABEL_LENGTH} characters without control characters.`);
   }
   return { agentId: null, kind: "personal", label: personalLabel };
 }
 
 async function requestedOrgId(flags, config, appUrl) {
   if (flags.org !== undefined && flags.tenant !== undefined && flags.org !== flags.tenant) {
-    fail("impel pat: --org and --tenant must name the same org when both are passed.");
+    fail(`${PAT_COMMAND}: --org and --tenant must name the same org when both are passed.`);
   }
   const requested = flags.org ?? flags.tenant;
   try {
@@ -210,7 +219,7 @@ async function requestedOrgId(flags, config, appUrl) {
     const listing = await fetchTenants({ ...config, appUrl });
     return listing.defaultTenantId;
   } catch (error) {
-    fail(`impel pat: could not resolve the target org: ${redactSecretText(error?.message || error)}`);
+    fail(`${PAT_COMMAND}: could not resolve the target org: ${redactSecretText(error?.message || error)}`);
   }
 }
 
@@ -270,7 +279,7 @@ async function requestControlPlane({ appUrl, currentPat, path, method, body, fea
     });
   } catch (error) {
     const message = error?.name === "AbortError" ? "request timed out" : error?.message || error;
-    fail(`impel pat: could not reach ${appUrl}: ${redactSecretText(message)}`);
+    fail(`${PAT_COMMAND}: could not reach ${appUrl}: ${redactSecretText(message)}`);
   } finally {
     clearTimeout(timeout);
   }
@@ -284,10 +293,10 @@ async function requestControlPlane({ appUrl, currentPat, path, method, body, fea
   }
   if (!response.ok) {
     if (response.status === 404 && !payload?.error) {
-      fail(`impel pat: PAT ${feature} is not available on ${appUrl}; update the Impel control plane and try again.`);
+      fail(`${PAT_COMMAND}: PAT ${feature} is not available on ${appUrl}; update the ${RUNTIME_BRAND.product.displayName} control plane and try again.`);
     }
     const message = redactSecretText(payload?.error || `${response.status} ${response.statusText}`.trim());
-    fail(`impel pat: ${message}`);
+    fail(`${PAT_COMMAND}: ${message}`);
   }
   return payload;
 }
@@ -303,7 +312,7 @@ async function createPat({ appUrl, currentPat, body }) {
   });
   const created = normalizeCreatedPat(payload, body);
   if (!created) {
-    fail("impel pat: the control plane returned an invalid PAT creation response; the secret was not displayed.");
+    fail(`${PAT_COMMAND}: the control plane returned an invalid PAT creation response; the secret was not displayed.`);
   }
   return created;
 }
@@ -338,7 +347,7 @@ function printCreatedPat(created, subject, json) {
   console.log(`Scopes:  ${created.scopes.join(", ") || "none"}`);
   console.log(`Expires: ${created.expiresAt === null ? "never" : new Date(created.expiresAt).toISOString()}`);
   console.log("");
-  console.log("Copy this token now. Impel cannot show the secret again:");
+  console.log(`Copy this token now. ${RUNTIME_BRAND.product.displayName} cannot show the secret again:`);
   console.log(created.token);
 }
 
@@ -357,8 +366,8 @@ export async function cmdPat(argv) {
     return;
   }
   if (action !== "create" && action !== "mint" && action !== "revoke") {
-    console.error(`impel pat: unknown subcommand "${redactSecretText(action)}".`);
-    console.error("  Use `impel pat create --label <label>`, `impel pat create --agent <agent-id>`, or `impel pat revoke <token-id> --yes`.");
+    console.error(`${PAT_COMMAND}: unknown subcommand "${redactSecretText(action)}".`);
+    console.error(`  Use \`${PAT_COMMAND} create --label <label>\`, \`${PAT_COMMAND} create --agent <agent-id>\`, or \`${PAT_COMMAND} revoke <token-id> --yes\`.`);
     process.exitCode = 1;
     return;
   }
@@ -370,16 +379,16 @@ export async function cmdPat(argv) {
       return;
     }
     const unknownFlag = Object.keys(flags).find((name) => !FLAG_NAMES.has(name));
-    if (unknownFlag) fail(`impel pat: unknown option --${redactSecretText(unknownFlag)}.`);
+    if (unknownFlag) fail(`${PAT_COMMAND}: unknown option --${redactSecretText(unknownFlag)}.`);
 
     if (action === "revoke") {
       rejectUnsupportedFlags(flags, REVOKE_FLAG_NAMES, "revoke");
       const tokenId = requestedTokenId(positionals[0]);
       if (positionals.length > 1) {
-        fail(`impel pat revoke: unexpected argument "${redactSecretText(positionals[1])}".`);
+        fail(`${PAT_COMMAND} revoke: unexpected argument "${redactSecretText(positionals[1])}".`);
       }
       if (flags.yes !== true) {
-        fail("impel pat revoke: refusing to revoke without --yes.");
+        fail(`${PAT_COMMAND} revoke: refusing to revoke without --yes.`);
       }
       const { appUrl, config } = requireConfig(flags);
       const revoked = await revokePat({ appUrl, currentPat: config.pat, tokenId });
@@ -389,7 +398,7 @@ export async function cmdPat(argv) {
 
     rejectUnsupportedFlags(flags, CREATE_FLAG_NAMES, "create");
     if (positionals.length > 0) {
-      fail(`impel pat create: unexpected argument "${redactSecretText(positionals[0])}".`);
+      fail(`${PAT_COMMAND} create: unexpected argument "${redactSecretText(positionals[0])}".`);
     }
 
     const subject = requestedSubject(flags);

package/src/commands/setup.js

@@ -22,8 +22,9 @@ import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
 import { refreshUpdateCache, updateNoticeLine } from "../updates.js";
 import { restoreNativeProfiles } from "./use.js";
+import { brandedEnvironmentName, brandedText, RUNTIME_BRAND } from "../runtimeBrand.js";
 
-const HELP = `impel setup - prepare every accessible Impel tenant
+const HELP = brandedText(`impel setup - prepare every accessible Impel tenant
 
 Stores your Personal Access Token, discovers every tenant you can access,
 prepares each tenant's isolated Claude and Codex CLI profiles, and installs
@@ -37,7 +38,7 @@ Usage:
   impel setup --skip-apps           Skip desktop apps
   impel setup --skip-clis           Do not install missing vendor CLIs
   impel setup --no-recovery         Disable automatic install recovery
-`;
+`);
 
 /** Kept as a pure compatibility helper for callers/tests. */
 export function resolveTenantChoice(listing, { requested = null, answer = null, currentTenantId = null } = {}) {
@@ -187,7 +188,7 @@ export async function cmdSetup(argv, overrides = {}) {
       ? (await io.promptSecret(`Token (${maskSecret(existing.pat)} stored; Enter keeps it): `)) || existing.pat
       : existing.pat;
   } else if (!pat && io.isTTY) {
-    pat = await io.promptSecret("Impel Personal Access Token (impel_pat_...): ");
+    pat = await io.promptSecret(`${RUNTIME_BRAND.product.displayName} Personal Access Token (${RUNTIME_BRAND.auth.patPrefix}...): `);
   }
   if (!pat) {
     console.error("impel setup: no token provided; pass --pat or run interactively.");
@@ -230,7 +231,7 @@ export async function cmdSetup(argv, overrides = {}) {
   // over the network, and the registry fetch is bounded (10s) and best-effort.
   // TTY-gated like maybePrintUpdateNotice: the nudge is for a human who can
   // stop and update, not for scripted/CI setups.
-  if (io.isTTY && !["1", "true"].includes(io.environment.IMPEL_SKIP_UPDATE_CHECK)) {
+  if (RUNTIME_BRAND.cli.packageName === "impel-cli" && io.isTTY && !["1", "true"].includes(io.environment[brandedEnvironmentName("SKIP_UPDATE_CHECK")])) {
     try {
       const updateCache = await io.refreshUpdateCache();
       const updateNotice = io.updateNoticeLine({ cache: updateCache });
@@ -242,10 +243,12 @@ export async function cmdSetup(argv, overrides = {}) {
       // Never block setup on the update check.
     }
   }
-  try {
-    io.restoreNativeProfiles({ quiet: true });
-  } catch (error) {
-    console.warn(`Legacy native-profile cleanup was skipped safely (${redactSecretText(error?.message || error)}).`);
+  if (RUNTIME_BRAND.product.id === "impel") {
+    try {
+      io.restoreNativeProfiles({ quiet: true });
+    } catch (error) {
+      console.warn(`Legacy native-profile cleanup was skipped safely (${redactSecretText(error?.message || error)}).`);
+    }
   }
 
   const vendorAppDecisions = new Map();

package/src/commands/status.js

@@ -15,6 +15,7 @@ import {
 } from "../tenants.js";
 import { installedVersion, maybePrintUpdateNotice } from "../updates.js";
 import { windowsClaudeUserData } from "../windowsApps.js";
+import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 function readShellManifest(paths) {
   try {
@@ -58,7 +59,7 @@ function desktopReadiness(tenant, {
     if (platform === "win32" && appData) {
       const shortcutPath = path.win32.join(
         appData,
-        "Microsoft", "Windows", "Start Menu", "Programs", "Impel",
+        "Microsoft", "Windows", "Start Menu", "Programs", RUNTIME_BRAND.apps.windowsStartMenuFolder,
         windowsTenantShortcutName(product, tenant.id, tenant.name),
       );
       shellReady = appReady && existsSync(shortcutPath);
@@ -90,10 +91,11 @@ export async function cmdStatus(overrides = {}) {
     ...overrides,
   };
   const config = io.loadConfig();
-  console.log(`impel-cli: v${io.installedVersion() || "?"}`);
+  const version = process.env.IMPEL_CLI_EXTENSION_VERSION || io.installedVersion() || "?";
+  console.log(`${RUNTIME_BRAND.cli.command}-cli: v${version}`);
   console.log(`Authentication: ${config?.pat ? `configured (${maskSecret(config.pat)})` : "not configured - run `impel setup`"}`);
   if (!config?.pat) {
-    io.maybePrintUpdateNotice();
+    if (RUNTIME_BRAND.cli.packageName === "impel-cli") io.maybePrintUpdateNotice();
     return;
   }
 
@@ -105,7 +107,7 @@ export async function cmdStatus(overrides = {}) {
     console.log(`Authentication check: unavailable (${error?.message || error})`);
     console.log(`Current CLI tenant: ${config.tenantId || "not selected"}`);
     console.log("Run `impel setup` to refresh authentication, then `impel update` to repair local tenants.");
-    io.maybePrintUpdateNotice();
+    if (RUNTIME_BRAND.cli.packageName === "impel-cli") io.maybePrintUpdateNotice();
     return;
   }
 
@@ -141,5 +143,5 @@ export async function cmdStatus(overrides = {}) {
     );
   }
   if (incomplete) console.log("Repair or finish missing tenant surfaces with: impel update");
-  io.maybePrintUpdateNotice();
+  if (RUNTIME_BRAND.cli.packageName === "impel-cli") io.maybePrintUpdateNotice();
 }

package/src/commands/token.js

@@ -1,6 +1,7 @@
 import { loadConfig } from "../config.js";
 import { parseFlags } from "../args.js";
 import { ensureTenantSelection, normalizeTenantId, tenantCredential } from "../tenants.js";
+import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 // This is the `apiKeyHelper` / auth-command contract: stdout (and only
 // stdout) must be exactly the bearer token, nothing else. Both Claude Code's
@@ -9,7 +10,7 @@ export async function cmdToken(argv = []) {
   const { flags } = parseFlags(argv, { tenant: { type: "string" } });
   const config = loadConfig();
   if (!config?.pat) {
-    process.stderr.write("impel: not authenticated. Run `impel setup` (or `impel auth`) first.\n");
+    process.stderr.write(`${RUNTIME_BRAND.cli.command}: not authenticated. Run \`${RUNTIME_BRAND.cli.command} setup\` (or \`${RUNTIME_BRAND.cli.command} auth\`) first.\n`);
     process.exitCode = 1;
     return;
   }
@@ -19,7 +20,7 @@ export async function cmdToken(argv = []) {
       : (await ensureTenantSelection(config)).tenantId;
     process.stdout.write(`${tenantCredential(config.pat, tenantId)}\n`);
   } catch (error) {
-    process.stderr.write(`impel: ${error.message}\n`);
+    process.stderr.write(`${RUNTIME_BRAND.cli.command}: ${error.message}\n`);
     process.exitCode = 1;
   }
 }

package/src/config.js

@@ -15,13 +15,15 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { brandedEnvironmentName, RUNTIME_BRAND } from "./runtimeBrand.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
 
-export const DEFAULT_GATEWAY_URL = "https://gateway.useimpel.com";
-export const DEFAULT_APP_URL = "https://www.useimpel.com";
+export const DEFAULT_GATEWAY_URL = RUNTIME_BRAND.gateway.defaultOrigin;
+export const DEFAULT_APP_URL = RUNTIME_BRAND.controlPlane.defaultOrigin;
 const LEGACY_GATEWAY_URLS = new Set(["https://gateway.useimpel.ai"]);
 
-export const CONFIG_DIR = path.join(os.homedir(), ".config", "impel");
+export const CONFIG_DIR = process.env[brandedEnvironmentName("CONFIG_DIR")]
+  || path.join(os.homedir(), ".config", RUNTIME_BRAND.cli.configNamespace);
 export const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 
 /** Hidden, default-off experiment. Only the exact boolean true enables it. */
@@ -31,12 +33,12 @@ export function crossAppModelsEnabled(config) {
 
 /** Resolve the gateway URL to use when nothing is stored yet: env var, else the canonical gateway. */
 export function resolveDefaultGateway() {
-  return normalizeGatewayUrl(process.env.IMPEL_GATEWAY_URL || DEFAULT_GATEWAY_URL);
+  return normalizeGatewayUrl(process.env[brandedEnvironmentName("GATEWAY_URL")] || DEFAULT_GATEWAY_URL);
 }
 
 /** Resolve the app/control-plane URL used by task APIs. */
 export function resolveDefaultAppUrl() {
-  return normalizeGatewayUrl(process.env.IMPEL_APP_URL || DEFAULT_APP_URL);
+  return normalizeGatewayUrl(process.env[brandedEnvironmentName("APP_URL")] || DEFAULT_APP_URL);
 }
 
 /** Strip trailing slashes so `${gatewayUrl}/anthropic` never ends up with a double slash. */
@@ -60,7 +62,7 @@ export function loadConfig() {
     return config;
   } catch {
     throw new Error(
-      `${CONFIG_PATH} exists but isn't valid JSON. Fix or delete it, then run \`impel auth\` again.`
+      `${CONFIG_PATH} exists but isn't valid JSON. Fix or delete it, then run \`${RUNTIME_BRAND.cli.command} auth\` again.`
     );
   }
 }
@@ -96,16 +98,18 @@ export function maskSecret(secret) {
   return `${secret.slice(0, 10)}...${secret.slice(-4)}`;
 }
 
-const TENANT_CREDENTIAL_RE = /impel_tenant_[A-Za-z0-9_-]+\.impel_pat_[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?/gu;
-const PAT_RE = /impel_pat_[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?/gu;
+const escapedPATPrefix = RUNTIME_BRAND.auth.patPrefix.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+const escapedTenantPrefix = RUNTIME_BRAND.auth.tenantPrefix.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+const TENANT_CREDENTIAL_RE = new RegExp(`${escapedTenantPrefix}[A-Za-z0-9_-]+\\.${escapedPATPrefix}[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?`, "gu");
+const PAT_RE = new RegExp(`${escapedPATPrefix}[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?`, "gu");
 const ANSI_ESCAPE_RE = /\u001B(?:\][^\u0007\u001B]*(?:\u0007|\u001B\\)|\[[0-?]*[ -/]*[@-~]|[@-_])/gu;
 const TERMINAL_CONTROL_RE = /[\u0000-\u001F\u007F-\u009F]/gu;
 
 /** Redact Impel bearer credentials without changing JSON/NDJSON whitespace. */
 export function redactCredentialText(value) {
   return String(value ?? "")
-    .replace(TENANT_CREDENTIAL_RE, "[REDACTED IMPEL CREDENTIAL]")
-    .replace(PAT_RE, "[REDACTED IMPEL CREDENTIAL]");
+    .replace(TENANT_CREDENTIAL_RE, `[REDACTED ${RUNTIME_BRAND.product.displayName.toUpperCase()} CREDENTIAL]`)
+    .replace(PAT_RE, `[REDACTED ${RUNTIME_BRAND.product.displayName.toUpperCase()} CREDENTIAL]`);
 }
 
 /** Remove credentials and terminal control sequences from untrusted text. */

package/src/extension/index.js

@@ -0,0 +1,81 @@
+import path from "node:path";
+
+import { main as upstreamMain } from "../cli.js";
+import { brandedText, RUNTIME_BRAND, validateRuntimeBrand } from "../runtimeBrand.js";
+
+const ALIASES = Object.freeze({ apps: "app", pats: "pat" });
+
+function help(version) {
+  const command = RUNTIME_BRAND.cli.command;
+  const product = RUNTIME_BRAND.product.displayName;
+  const enabled = new Set(RUNTIME_BRAND.capabilities.commands);
+  const lines = [`${command} — ${product} managed apps and isolated CLI profiles`, ""];
+  if (enabled.has("setup")) lines.push(`  ${command} setup                         Configure and prepare ${product} CLI/app profiles`);
+  if (enabled.has("auth")) lines.push(`  ${command} auth                          Store an existing ${product} PAT`);
+  if (enabled.has("pat")) lines.push(`  ${command} pat create|revoke             Mint or revoke a ${product} PAT`);
+  if (enabled.has("app")) lines.push(`  ${command} app install|update|open ...   Manage isolated desktop apps`);
+  if (enabled.has("claude")) lines.push(`  ${command} claude [args...]              Launch isolated Claude Code`);
+  if (enabled.has("codex")) lines.push(`  ${command} codex [args...]               Launch isolated Codex`);
+  if (enabled.has("status")) lines.push(`  ${command} status                        Show local readiness`);
+  lines.push("", `Version: ${version}`);
+  return `${lines.join("\n")}\n`;
+}
+
+async function withBrandedConsole(run) {
+  const original = { log: console.log, error: console.error, warn: console.warn };
+  const rewrite = (method) => (...values) => original[method](...values.map((value) => (
+    typeof value === "string" ? brandedText(value) : value
+  )));
+  console.log = rewrite("log");
+  console.error = rewrite("error");
+  console.warn = rewrite("warn");
+  try { return await run(); }
+  finally {
+    console.log = original.log;
+    console.error = original.error;
+    console.warn = original.warn;
+  }
+}
+
+/**
+ * Create a strict branded CLI using the canonical Impel command implementations.
+ * The brand must be installed in IMPEL_CLI_RUNTIME_BRAND before this module is
+ * imported so path and self-invocation constants are initialized atomically.
+ */
+export function createImpelCliExtension({ brand, entrypoint, version }) {
+  const expected = validateRuntimeBrand(brand);
+  if (JSON.stringify(expected) !== JSON.stringify(RUNTIME_BRAND)) {
+    throw new Error("runtime brand does not match IMPEL_CLI_RUNTIME_BRAND");
+  }
+  if (!path.isAbsolute(String(entrypoint || ""))) throw new Error("extension entrypoint must be absolute");
+  if (process.env.IMPEL_CLI_EXTENSION_ENTRYPOINT !== entrypoint) {
+    throw new Error("IMPEL_CLI_EXTENSION_ENTRYPOINT must identify the branded executable");
+  }
+  if (!/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/u.test(String(version || ""))) {
+    throw new Error("extension version is invalid");
+  }
+  process.env.IMPEL_CLI_EXTENSION_VERSION = String(version);
+  const allowed = new Set(RUNTIME_BRAND.capabilities.commands);
+
+  return Object.freeze({
+    async main(argv = []) {
+      const [rawCommand] = argv;
+      if (rawCommand === undefined || ["help", "--help", "-h"].includes(rawCommand)) {
+        process.stdout.write(help(version));
+        return;
+      }
+      if (["--version", "-v"].includes(rawCommand)) {
+        process.stdout.write(`${version}\n`);
+        return;
+      }
+      const command = ALIASES[rawCommand] || rawCommand;
+      const hiddenAppCommand = rawCommand === "_app-launch";
+      if ((!hiddenAppCommand && !allowed.has(command)) || (hiddenAppCommand && !allowed.has("app"))) {
+        process.stderr.write(`${RUNTIME_BRAND.cli.command}: command ${JSON.stringify(rawCommand)} is not available\n`);
+        process.exitCode = 1;
+        return;
+      }
+      return withBrandedConsole(() => upstreamMain(argv));
+    },
+  });
+}

package/src/provisioning.js

@@ -16,6 +16,7 @@ import {
   tenantCredential,
 } from "./tenants.js";
 import { reconcileTenantApps } from "./commands/apps.js";
+import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 export function selectDefaultTenant(listing, { requested = null, currentTenantId = null } = {}) {
   const normalized = requested ? normalizeTenantId(requested) : null;
@@ -62,8 +63,8 @@ export function buildTenantInventory(listing, {
 
 export function locallyKnownTenantIds({ homeDir = os.homedir(), readDirectory = fs.readdirSync } = {}) {
   const roots = [
-    path.join(homeDir, ".config", "impel", "cli", "tenants"),
-    path.join(homeDir, ".config", "impel", "apps", "tenants"),
+    path.join(homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "cli", "tenants"),
+    path.join(homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "apps", "tenants"),
   ];
   const ids = new Set();
   for (const root of roots) {
@@ -118,7 +119,7 @@ async function prepareTenantCli(config, tenant, io, binaries) {
         };
         continue;
       }
-      await io.syncSkills({
+      if (RUNTIME_BRAND.features.skills) await io.syncSkills({
         client,
         gatewayUrl,
         env: definition.env(profile),
@@ -143,7 +144,7 @@ async function prepareTenantCli(config, tenant, io, binaries) {
       root: value.root,
       label: `Impel ${client === "claude" ? "Claude" : "Codex"} CLI (${tenant.id})`,
     }));
-  if (agentProfiles.length) {
+  if (RUNTIME_BRAND.features.agents && agentProfiles.length) {
     try {
       await io.syncAgents({
         profiles: agentProfiles,