impel-cli 0.20.37 → 0.20.39

package/src/agents.js

@@ -17,6 +17,7 @@ import {
 } from "./config.js";
 import {
   CODEX_NATIVE_AGENT_ATTACHMENT_WINDOW_MS,
+  IMPEL_MANAGED_MCP_ENV,
   IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV,
   IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
   IMPEL_NATIVE_AGENT_MCP_TARGET,
@@ -55,7 +56,7 @@ export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
 export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 19;
+export const MANAGED_AGENT_MANIFEST_VERSION = 22;
 
 // The host model only selects the fixed MCP tool and faithfully returns its
 // result. Spark minimizes those transport-only turns while the selected Eve
@@ -82,6 +83,7 @@ const TERMINAL_NATIVE_AGENT_STATUSES = new Set(["succeeded", "failed", "cancelle
 const SAFE_AGENT_ID_RE = /^[A-Za-z0-9_.:-]{1,160}$/u;
 const SAFE_SCOPE_PARAM_RE = /^[A-Za-z0-9_.:-]{1,160}$/u;
 const MAX_CATALOG_ITEMS = 500;
+const MAX_CLAUDE_INLINE_AGENT_JSON_BYTES = 12 * 1024;
 const RETRYABLE_AGENT_CATALOG_ERROR = /request timed out|fetch failed|ECONNRESET|ETIMEDOUT|EAI_AGAIN|network error/iu;
 const RESERVED_AGENT_NAMES = Object.freeze({
   claude: new Set(["explore", "general-purpose", "plan"]),
@@ -621,7 +623,7 @@ function claudeAdapterInstructions(tenantId, agent) {
       `Confirm that the request fits the synchronized capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)}.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema, add handle metadata, or fabricate a continuation from any other field. If the answer call is cancelled or fails before returning any continuation, call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} again with the same question; once a continuation has been returned, never call it again for this request.`,
       completionGuidance,
     ].join(" ");
   }
@@ -671,7 +673,7 @@ function codexAdapterInstructions(tenantId, agent) {
       `Confirm that the assigned request fits the cataloged capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)} before answering.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema, add handle metadata, or fabricate a continuation from any other field. If the answer call is cancelled or fails before returning any continuation, call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} again with the same question; once a continuation has been returned, never call it again for this request.`,
       completionGuidance,
     ].join("\n\n");
   }
@@ -711,44 +713,73 @@ function customAgentDescription(tenantId, agent) {
   ).slice(0, 900);
 }
 
-function renderClaudeAgent({ tenantId, agent, name, invocation, recoveryOnly = false }) {
+function claudeAgentDefinition({ tenantId, agent, invocation, recoveryOnly = false }) {
   const description = recoveryOnly
     ? `Recovery-only access to pending runs for retired Impel binding ${agent.agentId} in tenant ${tenantId}.`
     : customAgentDescription(tenantId, agent);
   const toolNames = recoveryOnly ? NATIVE_AGENT_RECOVERY_TOOL_NAMES : nativeAgentToolNames(agent);
   const eager = eagerNativeAgentTransportEnabled();
+  return {
+    description,
+    prompt: recoveryOnly ? retiredAdapterInstructions(tenantId, agent) : claudeAdapterInstructions(tenantId, agent),
+    model: "haiku",
+    ...(eager ? {
+      permissionMode: "bypassPermissions",
+      tools: toolNames.map((tool) => nativeToolName(tool)),
+    } : {}),
+    mcpServers: [{
+      [MANAGED_AGENT_MCP_SERVER]: {
+        type: "stdio",
+        command: invocation.command,
+        args: [...invocation.args],
+        env: { ...(invocation.env || {}) },
+      },
+    }],
+  };
+}
+
+function renderClaudeAgentDefinition(name, definition) {
+  const server = definition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
   const lines = [
     "---",
     `name: ${JSON.stringify(name)}`,
-    `description: ${JSON.stringify(description)}`,
-    "model: haiku",
-    ...(eager
+    `description: ${JSON.stringify(definition.description)}`,
+    `model: ${definition.model}`,
+    ...(definition.permissionMode
       ? [
         // This agent receives only the exact fixed-binding MCP allowlist below,
         // so bypassing prompts cannot grant filesystem, shell, connector, or
         // arbitrary MCP access. It lets non-interactive/dontAsk hosts execute
         // the selected managed adapter instead of auto-denying its sole call.
-        "permissionMode: bypassPermissions",
+        `permissionMode: ${definition.permissionMode}`,
         "tools:",
-        ...toolNames.map((tool) => `  - ${JSON.stringify(nativeToolName(tool))}`),
+        ...definition.tools.map((tool) => `  - ${JSON.stringify(tool)}`),
       ]
       : []),
     "mcpServers:",
     `  - ${MANAGED_AGENT_MCP_SERVER}:`,
     "      type: stdio",
-    `      command: ${JSON.stringify(invocation.command)}`,
+    `      command: ${JSON.stringify(server.command)}`,
     "      args:",
-    ...invocation.args.map((argument) => `        - ${JSON.stringify(argument)}`),
+    ...server.args.map((argument) => `        - ${JSON.stringify(argument)}`),
     "      env:",
-    ...Object.entries(invocation.env || {}).map(([key, value]) => `        ${key}: ${JSON.stringify(value)}`),
+    ...Object.entries(server.env).map(([key, value]) => `        ${key}: ${JSON.stringify(value)}`),
     "---",
     "",
-    recoveryOnly ? retiredAdapterInstructions(tenantId, agent) : claudeAdapterInstructions(tenantId, agent),
+    definition.prompt,
     "",
   ];
   return lines.join("\n");
 }
 
+function renderClaudeAgent({ tenantId, agent, name, invocation, recoveryOnly = false }) {
+  const definition = claudeAgentDefinition({ tenantId, agent, invocation, recoveryOnly });
+  return {
+    contents: renderClaudeAgentDefinition(name, definition),
+    launchDefinition: definition,
+  };
+}
+
 function codexInvocationEnvironment(invocation, { durableProfile = false } = {}) {
   const entries = Object.entries(invocation.env || {});
   const transient = new Set(IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES);
@@ -796,6 +827,13 @@ function renderCodexConfiguration({
     ...(directCodeMode ? [
       "[features]",
       "multi_agent = false",
+      // Fixed-binding adapters cannot use host plugins. Disable both local and
+      // remote plugin paths so profile layering does not load the ordinary
+      // tenant Codex plugin catalog or make unrelated catalog requests.
+      "plugins = false",
+      "remote_plugin = false",
+      "plugin_sharing = false",
+      "recommended_plugins = false",
       "",
       "[features.code_mode]",
       "enabled = true",
@@ -871,9 +909,11 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
     // collision-safe, filesystem-safe identifiers, so use them as filenames.
     const fileStem = client === "claude" ? name : fileStems[index];
     const boundInvocation = boundNativeAgentInvocation(normalizedTenant, agent, invocation);
-    const contents = client === "claude"
+    const claudeRendered = client === "claude"
       ? renderClaudeAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation })
-      : renderCodexAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation, directCodeMode });
+      : null;
+    const contents = claudeRendered?.contents
+      ?? renderCodexAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation, directCodeMode });
     const profileName = client === "codex" ? fileStem : null;
     return {
       agentId: agent.agentId,
@@ -885,6 +925,7 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
       name,
       fileName: `${fileStem}${extension}`,
       contents,
+      ...(claudeRendered ? { launchDefinition: claudeRendered.launchDefinition } : {}),
       ...(profileName ? {
         profileName,
         profileFileName: `${profileName}.config.toml`,
@@ -939,9 +980,11 @@ function renderRetiredManagedAgents(client, tenantId, bindings, active, invocati
       policyFingerprint: binding.policyFingerprint,
       mode: "recovery",
     });
-    const contents = client === "claude"
+    const claudeRendered = client === "claude"
       ? renderClaudeAgent({ tenantId, agent, name, invocation: boundInvocation, recoveryOnly: true })
-      : renderCodexAgent({ tenantId, agent, name, invocation: boundInvocation, recoveryOnly: true, directCodeMode });
+      : null;
+    const contents = claudeRendered?.contents
+      ?? renderCodexAgent({ tenantId, agent, name, invocation: boundInvocation, recoveryOnly: true, directCodeMode });
     const profileName = client === "codex" ? path.basename(fileName, extension) : null;
     return {
       agentId: binding.agentId,
@@ -953,6 +996,7 @@ function renderRetiredManagedAgents(client, tenantId, bindings, active, invocati
       name,
       fileName,
       contents,
+      ...(claudeRendered ? { launchDefinition: claudeRendered.launchDefinition } : {}),
       ...(profileName ? {
         profileName,
         profileFileName: `${profileName}.config.toml`,
@@ -999,7 +1043,8 @@ function managedManifestPath(root) {
 }
 
 function contentDigest(contents) {
-  return crypto.createHash("sha256").update(contents, "utf8").digest("hex");
+  const bytes = Buffer.isBuffer(contents) ? contents : Buffer.from(contents, "utf8");
+  return crypto.createHash("sha256").update(bytes).digest("hex");
 }
 
 function managedArtifactIsCurrent(root, relativePath, expectedDigest) {
@@ -1009,8 +1054,9 @@ function managedArtifactIsCurrent(root, relativePath, expectedDigest) {
   if (!/^[a-f0-9]{64}$/u.test(expectedDigest || "")) return false;
   const artifactPath = path.join(root, ...segments);
   try {
-    if (fs.lstatSync(artifactPath).isSymbolicLink()) return false;
-    return contentDigest(fs.readFileSync(artifactPath, "utf8")) === expectedDigest;
+    const stat = fs.lstatSync(artifactPath);
+    if (stat.isSymbolicLink() || !stat.isFile()) return false;
+    return contentDigest(fs.readFileSync(artifactPath)) === expectedDigest;
   } catch {
     return false;
   }
@@ -1033,6 +1079,156 @@ export function readManagedAgentManifest(root) {
   return readManifest(managedManifestPath(root));
 }
 
+function exactObjectKeys(value, keys) {
+  return value
+    && typeof value === "object"
+    && !Array.isArray(value)
+    && JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...keys].sort());
+}
+
+function validateClaudeLaunchDefinition(record, tenantId) {
+  const definition = record.launchDefinition;
+  if (!exactObjectKeys(definition, [
+    "description", "prompt", "model", "permissionMode", "tools", "mcpServers",
+  ])
+    || typeof definition.description !== "string"
+    || !definition.description
+    || definition.description.length > 900
+    || typeof definition.prompt !== "string"
+    || !definition.prompt
+    || Buffer.byteLength(definition.prompt, "utf8") > 256 * 1024
+    || definition.model !== "haiku"
+    || definition.permissionMode !== "bypassPermissions"
+    || !Array.isArray(definition.tools)
+    || definition.tools.length < 2
+    || definition.tools.length > 3
+    || new Set(definition.tools).size !== definition.tools.length
+    || !definition.tools.every((tool) => [
+      NATIVE_AGENT_ANSWER_TOOL,
+      NATIVE_AGENT_RUN_TOOL,
+      NATIVE_AGENT_RESUME_TOOL,
+      NATIVE_AGENT_RECOVER_TOOL,
+    ].map((name) => nativeToolName(name)).includes(tool))
+    || !Array.isArray(definition.mcpServers)
+    || definition.mcpServers.length !== 1
+    || !exactObjectKeys(definition.mcpServers[0], [MANAGED_AGENT_MCP_SERVER])) {
+    throw new Error("the managed Claude launch definition is invalid; run `impel agents sync claude`");
+  }
+  const server = definition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
+  const allowedEnvironment = new Set([IMPEL_MANAGED_MCP_ENV, ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES]);
+  if (!exactObjectKeys(server, ["type", "command", "args", "env"])
+    || server.type !== "stdio"
+    || typeof server.command !== "string"
+    || !server.command
+    || !Array.isArray(server.args)
+    || !server.args.every((argument) => typeof argument === "string")
+    || !server.env
+    || typeof server.env !== "object"
+    || Array.isArray(server.env)
+    || server.env[IMPEL_MANAGED_MCP_ENV] !== "1"
+    || !Object.entries(server.env).every(([key, value]) =>
+      allowedEnvironment.has(key)
+      && typeof value === "string"
+      && value.length <= 4096
+      && redactCredentialText(value) === value
+    )) {
+    throw new Error("the managed Claude MCP definition is invalid; run `impel agents sync claude`");
+  }
+  const answerOnly = server.args.at(-1) === "--answer-only";
+  const trustedInvocation = impelNativeAgentMcpInvocation({
+    tenantId,
+    agentId: record.agentId,
+    scopeParam: record.scopeParam,
+    policyFingerprint: record.policyFingerprint,
+    mode: answerOnly ? "answer" : "durable",
+  });
+  const expectedTools = (answerOnly
+    ? [NATIVE_AGENT_ANSWER_TOOL, NATIVE_AGENT_RESUME_TOOL]
+    : NATIVE_AGENT_TOOL_NAMES
+  ).map((name) => nativeToolName(name));
+  if (server.command !== trustedInvocation.command
+    || JSON.stringify(server.args) !== JSON.stringify(trustedInvocation.args)
+    || JSON.stringify(definition.tools) !== JSON.stringify(expectedTools)) {
+    throw new Error("the managed Claude binding is invalid; run `impel agents sync claude`");
+  }
+  return definition;
+}
+
+// A selector absent from the Impel manifest remains Claude-native. A matching
+// record is integrity checked, then re-declared under a random per-launch name
+// through Claude's higher-priority --agents source. This prevents project,
+// user, plugin, and fixed managed-settings names from replacing the adapter.
+export function resolveManagedClaudeAgent(root, tenantId, selector) {
+  const normalizedTenant = normalizeTenantId(tenantId);
+  if (typeof selector !== "string" || !selector || selector.length > 512) return null;
+  const manifest = readManagedAgentManifest(root);
+  if (!manifest
+    || manifest.version !== MANAGED_AGENT_MANIFEST_VERSION
+    || manifest.client !== "claude"
+    || manifest.tenantId !== normalizedTenant
+    || !Array.isArray(manifest.agents)) {
+    return null;
+  }
+  const records = manifest.agents.filter((record) => record
+    && typeof record === "object"
+    && typeof record.name === "string");
+  const active = records.filter((record) => !record.retired);
+  let matches = active.filter((record) => record.agentId === selector);
+  if (matches.length === 0) matches = active.filter((record) => record.title === selector);
+  if (matches.length === 0) matches = active.filter((record) => record.name === selector);
+  if (matches.length === 0 && records.some((record) => record.retired && [
+    record.agentId,
+    record.title,
+    record.name,
+  ].includes(selector))) {
+    throw new Error(`managed Claude agent ${JSON.stringify(selector)} is retired and cannot start new work`);
+  }
+  if (matches.length === 0) return null;
+  if (matches.length !== 1) {
+    throw new Error(
+      `managed Claude agent ${JSON.stringify(selector)} is ambiguous for tenant ${JSON.stringify(normalizedTenant)}`,
+    );
+  }
+  const [record] = matches;
+  if (typeof record.agentId !== "string"
+    || !SAFE_AGENT_ID_RE.test(record.agentId)
+    || typeof record.scopeParam !== "string"
+    || !SAFE_SCOPE_PARAM_RE.test(record.scopeParam)
+    || !/^[a-f0-9]{64}$/u.test(record.policyFingerprint || "")) {
+    throw new Error("the managed Claude binding metadata is invalid; run `impel agents sync claude`");
+  }
+  const fileName = `${record.name}.md`;
+  if (path.basename(fileName) !== fileName || !manifest.files.includes(fileName)) {
+    throw new Error("the managed Claude agent mapping is invalid; run `impel agents sync claude`");
+  }
+  const relativePath = `agents/${fileName}`;
+  if (!managedArtifactIsCurrent(root, relativePath, manifest.contentDigests?.[relativePath])) {
+    throw new Error("the managed Claude agent failed its integrity check; run `impel agents sync claude`");
+  }
+  const launchDefinition = validateClaudeLaunchDefinition(record, normalizedTenant);
+  if (contentDigest(renderClaudeAgentDefinition(record.name, launchDefinition))
+    !== manifest.contentDigests?.[relativePath]) {
+    throw new Error("the managed Claude launch definition does not match its agent file; run `impel agents sync claude`");
+  }
+  const suffix = crypto.randomBytes(12).toString("hex");
+  const prefix = `impel-${record.name}`.slice(0, 63 - suffix.length - 1).replace(/-+$/u, "");
+  const launchName = `${prefix}-${suffix}`;
+  const launchAgentsJson = JSON.stringify({ [launchName]: launchDefinition });
+  if (Buffer.byteLength(launchAgentsJson, "utf8") > MAX_CLAUDE_INLINE_AGENT_JSON_BYTES) {
+    throw new Error(
+      `managed Claude agent ${JSON.stringify(selector)} is too large for a safe cross-platform direct launch; shorten its synchronized catalog policy`,
+    );
+  }
+  return {
+    ...record,
+    fileName,
+    path: path.join(root, "agents", fileName),
+    launchName,
+    launchDefinition,
+    launchAgentsJson,
+  };
+}
+
 export function resolveManagedCodexAgentProfile(root, tenantId, selector) {
   const normalizedTenant = normalizeTenantId(tenantId);
   const normalizedSelector = boundedString(selector, "agent selector", { max: 512 });
@@ -1144,9 +1340,23 @@ export function syncAgentProfile({
   const priorUsesDiscoveryRoot = Number.isInteger(prior?.version)
     && prior.version >= 2
     && prior.version <= MANAGED_AGENT_MANIFEST_VERSION;
-  const priorOwnsCodexProfiles = priorUsesDiscoveryRoot
-    && prior?.client === "codex"
+  // Ownership requires the client and tenant to match on every leg; a manifest
+  // from another scope must neither authorize overwrites nor deletions.
+  const priorOwnsManagedFiles = priorUsesDiscoveryRoot
+    && prior?.client === client
     && prior?.tenantId === tenantId;
+  // A colliding artifact whose bytes match the recorded digest of a
+  // non-owning manifest is provably impel-generated (e.g. after a tenant
+  // scope-key drift), so reclaiming it cannot lose operator-authored content.
+  const reclaimable = (digestKey, destination) => {
+    const recorded = prior?.contentDigests?.[digestKey];
+    if (typeof recorded !== "string" || !recorded) return false;
+    try {
+      return contentDigest(fs.readFileSync(destination)) === recorded;
+    } catch {
+      return false;
+    }
+  };
 
   // Native clients discover standalone definitions directly under `agents/`.
   // Preflight every destination before writing so an unmanaged file with the
@@ -1154,12 +1364,13 @@ export function syncAgentProfile({
   for (const agent of rendered) {
     const destination = path.join(agentsDir, agent.fileName);
     if (fs.existsSync(destination)) {
-      if (!priorUsesDiscoveryRoot || !priorFiles.has(agent.fileName)) {
-        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
-      }
       if (fs.lstatSync(destination).isSymbolicLink()) {
         throw new Error(`refusing to overwrite symlinked native-agent file ${destination}`);
       }
+      if ((!priorOwnsManagedFiles || !priorFiles.has(agent.fileName))
+        && !reclaimable(`agents/${agent.fileName}`, destination)) {
+        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
+      }
     }
     if (client === "codex" && directProfiles) {
       const profileDestination = path.join(root, agent.profileFileName);
@@ -1167,7 +1378,8 @@ export function syncAgentProfile({
         if (fs.lstatSync(profileDestination).isSymbolicLink()) {
           throw new Error(`refusing to overwrite symlinked Codex profile ${profileDestination}`);
         }
-        if (!priorOwnsCodexProfiles || !priorProfiles.has(agent.profileFileName)) {
+        if ((!priorOwnsManagedFiles || !priorProfiles.has(agent.profileFileName))
+          && !reclaimable(agent.profileFileName, profileDestination)) {
           throw new Error(`refusing to overwrite unmanaged Codex profile ${profileDestination}`);
         }
       }
@@ -1181,20 +1393,29 @@ export function syncAgentProfile({
   const currentProfiles = new Set(client === "codex" && directProfiles
     ? rendered.map((agent) => agent.profileFileName)
     : []);
+  // Stale-file cleanup in the shared discovery root: an owning manifest's
+  // listing is authoritative, while a non-owning manifest (another tenant or
+  // a drifted scope) may only remove files it digest-proves impel wrote —
+  // native-profile roots are shared across tenants, so skipping cleanup
+  // entirely would orphan the previous tenant's agents forever, and deleting
+  // unproven listings could destroy another owner's live files. Legacy
+  // nested manifests only ever clean impel's private managed directory below.
+  const staleRemovable = (stale, digestKey, destination) =>
+    typeof stale === "string"
+    && path.basename(stale) === stale
+    && (priorOwnsManagedFiles || reclaimable(digestKey, destination));
   for (const stale of prior?.files || []) {
     if (
-      typeof stale === "string"
-      && path.basename(stale) === stale
+      staleRemovable(stale, `agents/${stale}`, path.join(agentsDir, stale))
       && !currentFiles.has(stale)
       && (stale.endsWith(".md") || stale.endsWith(".toml"))
     ) {
-      fs.rmSync(path.join(priorUsesDiscoveryRoot ? agentsDir : managedDir, stale), { force: true });
+      fs.rmSync(path.join(agentsDir, stale), { force: true });
     }
   }
-  for (const stale of priorOwnsCodexProfiles ? prior.profiles || [] : []) {
+  for (const stale of client === "codex" ? prior?.profiles || [] : []) {
     if (
-      typeof stale === "string"
-      && path.basename(stale) === stale
+      staleRemovable(stale, stale, path.join(root, stale))
       && stale.endsWith(".config.toml")
       && !currentProfiles.has(stale)
     ) {
@@ -1236,6 +1457,9 @@ export function syncAgentProfile({
       policyFingerprint: agent.policyFingerprint,
       retired: agent.retired,
       name: agent.name,
+      ...(client === "claude" ? {
+        launchDefinition: agent.launchDefinition,
+      } : {}),
       ...(client === "codex" && directProfiles ? {
         profileName: agent.profileName,
         profileFileName: agent.profileFileName,