impel-cli 0.20.37 → 0.20.39

package/src/apps.js

@@ -157,6 +157,27 @@ const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(n
 const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof v?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
 const LEGACY_CLAUDE_SAFE_STORAGE_NAME = "Claude";
 const CLAUDE_SAFE_STORAGE_METADATA = "safe-storage.json";
+// The pinned Claude desktop build refuses remote debugging unless
+// process.env.CLAUDE_CDP_AUTH carries a token Ed25519-signed by the private
+// half of this baked-in public key: its main process runs
+// `eae(process.argv)&&!_9()&&process.exit(1)` where eae() is true for any
+// --remote-debugging-port/-pipe flag and _9() verifies CLAUDE_CDP_AUTH with
+// crypto.verify(null, `${ms}.${base64(userData)}`, createPublicKey(<key>),
+// sig). The exact PEM literal appears TWICE in the pinned ASAR (the
+// main-process gate and a shared utility chunk whose token verifiers reuse the
+// same anchor); both are the identical CDP-auth trust anchor. Swapping it to
+// the Impel key below lets the CI-isolated launch smoke drive the managed
+// bundle over CDP with a token signed by the matching private key (held only
+// in GitHub Actions secrets), which is required to verify pins by behavior
+// (docs/testing-protocol.md P0-1). This deliberately moves the managed
+// bundle's CDP trust anchor from Anthropic's key to an Impel CI-held key;
+// flagged for maintainer review in the PR. Both keys are Ed25519 SPKI PEM of
+// identical byte length, so the fixed-width ASAR swap preserves layout.
+const CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEApH/vaEiLV0sNY/eS+Ct/IMbMqw8i/vC/cNC84BAbBq8=\n-----END PUBLIC KEY-----";
+const IMPEL_CLAUDE_CDP_AUTH_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAXG1l1V6YxCaH1Dbn27EIkeQjYU4urRx2aPrDwAULUfw=\n-----END PUBLIC KEY-----";
+// The pinned build embeds the anchor in exactly this many chunks. Fail closed
+// (no loose regex, no "best effort") if a vendor update changes the count.
+const CLAUDE_CDP_AUTH_KEY_COPIES = 2;
 // The pinned Claude renderer decides desktop-vs-web mode SOLELY by matching its
 // own Electron user-agent against /claude(nest|gov)?\/([^ ]+)/i (functions o_,
 // x_, i_ in ion-dist). Electron derives that UA product token from app.name as
@@ -290,7 +311,11 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // and install Claude task, notification, and permission lifecycle hooks.
 // 32: install a persistent tenant-bound Tasks navigation surface in the
 // managed Claude and ChatGPT/Codex desktop wrappers.
-export const CURRENT_CONFIG_VERSION = 32;
+// 33: size the Codex verbatim-relay parent wait to outlast the child's
+// native-agent attachment window so the visible working span is not
+// truncated while the child is still running.
+// 34: isolate fixed-binding Codex profiles from local and remote host plugins.
+export const CURRENT_CONFIG_VERSION = 34;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -299,7 +324,7 @@ export const CURRENT_CONFIG_VERSION = 32;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.4";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.5";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -423,6 +448,7 @@ const CLAUDE_COMPATIBILITY_PATCH_KEYS = Object.freeze([
   "followupBoundAgentFilter",
   "followupBoundAgentChip",
   "desktopTasksPreload",
+  "cdpAuthKey",
 ]);
 const CLAUDE_COMPATIBILITY_RENDERER_GROUPS = Object.freeze(["agentMentions"]);
 
@@ -1659,6 +1685,187 @@ function removeTopLevelTomlString(toml, key) {
   return topLevel + toml.slice(topLevelEnd);
 }
 
+/** Read one co-owned JSON artifact; distinguishes "absent" from "corrupt". */
+function readManagedJsonArtifact(filePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf8");
+  } catch {
+    return { present: false, value: null };
+  }
+  try {
+    const value = JSON.parse(raw);
+    return {
+      present: true,
+      value: value && typeof value === "object" && !Array.isArray(value) ? value : null,
+    };
+  } catch {
+    return { present: true, value: null };
+  }
+}
+
+// Mirrors the session-hook installer's tenant gate (sessionHooks.js
+// validTenantId): hooks are only ever written for ids matching this shape, so
+// the drift check must not demand them for ids the installer skipped.
+const SESSION_HOOK_TENANT_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+
+/** Whether the managed session-hook heal channel survives in settings.json. */
+function claudeSettingsCarrySessionHooks(settings) {
+  const hooks = settings.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) return false;
+  const marker = `--${RUNTIME_BRAND.cli.command}-managed-session-hook-v1`;
+  return Object.values(hooks).some((groups) => Array.isArray(groups) && groups.some((group) => (
+    Array.isArray(group?.hooks) && group.hooks.some((handler) => (
+      (Array.isArray(handler?.args) && handler.args.includes(marker))
+      || (typeof handler?.command === "string" && handler.command.includes(marker))
+    ))
+  )));
+}
+
+/**
+ * True when a managed Claude profile exists but its artifacts no longer carry
+ * the load-bearing managed keys. Claude Desktop and the embedded Claude Code
+ * runtime co-own these files and rewrite them with their own settings writers,
+ * which normalize away optional fields (the persisted Tasks MCP entry loses
+ * `type: "stdio"`), reorder keys, and reformat whitespace. Those cosmetic
+ * rewrites are NOT drift — ownership recognition tolerates them through
+ * isImpelTasksMcpInvocation, and every check parses JSON rather than comparing
+ * bytes — but a lost or overwritten managed key (gateway routing config, the
+ * applied configLibrary selection, the 3P deployment selection, the
+ * tenant-bound Tasks MCP entry, the session-hook heal channel, the managed
+ * sandbox policy) is real drift. Stale-only refreshes treat it as staleness so
+ * the profile heals immediately instead of waiting out the manifest TTL.
+ * The content-based mirror of managedChatGPTConfigDrifted for the Claude
+ * target; like it, this never keys on TTLs or timestamps.
+ */
+export function managedClaudeConfigDrifted(paths) {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8"));
+  } catch {
+    return false; // No managed install; install/update owns creating one.
+  }
+  if (!Array.isArray(manifest?.targets) || !manifest.targets.includes("claude")) return false;
+  const tenantId = typeof manifest.tenantId === "string" && manifest.tenantId
+    ? manifest.tenantId
+    : null;
+
+  // configLibrary: the gateway inference routing the desktop app applies. A
+  // profile that loses it (or its provider/base-url/api-key wiring) no longer
+  // routes inference through the Impel gateway at all.
+  const configLibrary = readManagedJsonArtifact(
+    path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`),
+  );
+  if (
+    !configLibrary.value
+    || configLibrary.value.inferenceProvider !== "gateway"
+    || typeof configLibrary.value.inferenceGatewayBaseUrl !== "string"
+    || !configLibrary.value.inferenceGatewayBaseUrl
+    || typeof configLibrary.value.inferenceGatewayApiKey !== "string"
+    || !configLibrary.value.inferenceGatewayApiKey
+  ) {
+    return true;
+  }
+  const meta = readManagedJsonArtifact(path.join(paths.claude.userData, "configLibrary", "_meta.json"));
+  if (!meta.value || meta.value.appliedId !== CLAUDE_CONFIG_ID) return true;
+
+  // claude_desktop_config.json: the native 3P selection plus the tenant-bound
+  // Tasks MCP entry. Claude Desktop persists this file itself, without the
+  // optional `type` field and with its own key order — that vendor-normalized
+  // form must keep counting as ours (the 0.20.1 repair-refusal regression).
+  const desktop = readManagedJsonArtifact(path.join(paths.claude.userData, "claude_desktop_config.json"));
+  if (!desktop.value || desktop.value.deploymentMode !== "3p") return true;
+  if (RUNTIME_BRAND.features.mcp && tenantId) {
+    const servers = desktop.value.mcpServers;
+    const tasksEntry = servers && typeof servers === "object" && !Array.isArray(servers)
+      ? servers[IMPEL_TASKS_MCP_SERVER_NAME]
+      : undefined;
+    if (!isImpelTasksMcpInvocation(tasksEntry)) return true;
+  }
+
+  // settings.json: the managed sandbox policy and the session-hook heal
+  // channel. The hooks are the only Impel code guaranteed to run while the
+  // profile is broken, so losing them kills the self-repair path itself.
+  const settings = readManagedJsonArtifact(path.join(paths.claude.userData, "settings.json"));
+  if (!settings.value || settings.value.sandbox?.enabled !== false) return true;
+  if (
+    RUNTIME_BRAND.features.sessions
+    && tenantId
+    && SESSION_HOOK_TENANT_RE.test(tenantId)
+    && !claudeSettingsCarrySessionHooks(settings.value)
+  ) {
+    return true;
+  }
+  return false;
+}
+
+/** Distinct exit code for a failed managed-runtime preflight (EX_CONFIG). */
+export const MANAGED_RUNTIME_PREFLIGHT_EXIT_CODE = 78;
+
+function runtimeRepairInstruction(compatibility) {
+  const command = RUNTIME_BRAND.cli.command;
+  const tenantSource = `${compatibility.codexHome || ""}${compatibility.profileRoot || ""}`;
+  const tenantId = tenantSource.match(/[\\/]tenants[\\/]([^\\/]+)[\\/]/u)?.[1] || null;
+  return `run \`${command} update\` or \`${command} app refresh${tenantId ? ` --tenant ${tenantId}` : ""}\` to repair it`;
+}
+
+/**
+ * Runtime-presence preflight for the managed-launch seam: before a managed
+ * launcher is handed to the OS, require the vendored runtime it embeds to
+ * exist at the version this CLI pins (the v0.20.32 exit-127 rule: a pin bump
+ * that outruns the installed runtime must fail with one actionable line and a
+ * distinct exit code, never a bare ENOENT/127 crash). Checks are cheap —
+ * Impel's own build metadata, file existence, and the existing plist
+ * version-read helper; no binary is spawned. Bundles without Impel build
+ * metadata are not judged (the OS reports its own launch failure), so
+ * non-managed behavior is unchanged.
+ */
+export function managedRuntimePreflight(launcher, { pins = PINNED_VENDOR_APPS } = {}) {
+  const compatibility = readBundleCompatibility(launcher);
+  if (!compatibility) return { ok: true, checked: false };
+  const target = compatibility.codexHome ? "chatgpt" : "claude";
+  const pin = pins[target];
+  if (!pin) return { ok: true, checked: false };
+  const command = RUNTIME_BRAND.cli.command;
+  const repair = runtimeRepairInstruction(compatibility);
+  const fail = (message) => ({ ok: false, checked: true, target, message: `${command} app: ${message}; ${repair}` });
+
+  if (target === "claude") {
+    let executable = null;
+    try {
+      const plist = fs.readFileSync(path.join(launcher, "Contents", "Info.plist"), "utf8");
+      executable = plist.match(/<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/u)?.[1] || null;
+    } catch {
+      executable = null;
+    }
+    const binary = executable ? path.join(launcher, "Contents", "MacOS", executable) : null;
+    if (!binary || !fs.existsSync(binary)) {
+      return fail(`managed Claude runtime binary is missing at ${binary || path.join(launcher, "Contents", "MacOS")} (pinned ${pin.version})`);
+    }
+    const found = bundleVersion(launcher);
+    if (found !== pin.version) {
+      return fail(`managed Claude runtime is version ${found || "unknown"} at ${launcher}, but this CLI pins ${pin.version}`);
+    }
+    return { ok: true, checked: true, target };
+  }
+
+  const embedded = APP_DEFINITIONS.chatgpt.names
+    .map((name) => path.join(launcher, "Contents", "Resources", name))
+    .find((candidate) => fs.existsSync(candidate));
+  if (!embedded) {
+    return fail(`managed ChatGPT runtime bundle is missing under ${path.join(launcher, "Contents", "Resources")} (pinned ${pin.version})`);
+  }
+  const codexBinary = path.join(embedded, "Contents", "Resources", "codex");
+  if (!fs.existsSync(codexBinary)) {
+    return fail(`managed Codex runtime binary is missing at ${codexBinary} (pinned codex-cli ${pin.codexVersion})`);
+  }
+  const found = bundleVersion(embedded);
+  if (found !== pin.version) {
+    return fail(`managed ChatGPT runtime is version ${found || "unknown"} at ${embedded}, but this CLI pins ${pin.version} (codex-cli ${pin.codexVersion})`);
+  }
+  return { ok: true, checked: true, target };
+}
+
 /**
  * Rewrite one tenant's app token helper with the current node/CLI paths.
  * Cheap and Impel-owned, so install recovery can use it to heal helpers whose
@@ -1768,6 +1975,7 @@ function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStor
     }
     const safeStorageNamePatchCount = patchClaudeSafeStorageName(asarPath);
     const desktopTasksPreloadPatchCount = patchDesktopTasksPreload(asarPath, "claude");
+    const cdpAuthKeyPatchCount = patchClaudeCdpAuthKey(asarPath);
     const newAsarHash = asarHeaderHash(asarPath);
 
     updateBundleIdentity(plistPath, {
@@ -1824,6 +2032,7 @@ function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStor
         followupBoundAgentFilter: agentMentionPatches.filter,
         followupBoundAgentChip: agentMentionPatches.chip,
         desktopTasksPreload: desktopTasksPreloadPatchCount,
+        cdpAuthKey: cdpAuthKeyPatchCount,
       },
       rendererAssets: {
         agentMentions: agentMentionPatches.assets,
@@ -2200,6 +2409,28 @@ function patchClaudeSafeStorageName(asarPath) {
   return applyFixedWidthAsarPatches(asarPath, archive, patches, "Claude Safe Storage app name");
 }
 
+// Replace the baked-in CDP-auth trust anchor with the Impel key so the
+// CI-isolated launch smoke can drive the managed bundle over CDP with a token
+// signed by the matching (Actions-secret-held) private key. Fail closed on any
+// count other than the exact pinned number of copies, and let the shared
+// fixed-width helper enforce byte-length parity (both keys are Ed25519 SPKI
+// PEM of equal length) so the ASAR layout is preserved.
+function patchClaudeCdpAuthKey(asarPath) {
+  const source = fs.readFileSync(asarPath).toString("latin1");
+  const occurrences = exactTextMatchCount(source, CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY);
+  if (occurrences !== CLAUDE_CDP_AUTH_KEY_COPIES) {
+    throw new Error(
+      `Claude CDP-auth trust-anchor patch expected ${CLAUDE_CDP_AUTH_KEY_COPIES} vendor key copies, found ${occurrences}`,
+    );
+  }
+  return patchFixedWidthAsarString(
+    asarPath,
+    CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY,
+    IMPEL_CLAUDE_CDP_AUTH_PUBLIC_KEY,
+    "Claude CDP-auth trust anchor",
+  );
+}
+
 function patchFastModeAuthGate(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");

package/src/cli.js

@@ -34,6 +34,7 @@ Get started:
 
 Work:
   impel claude [args...]                      Launch Claude Code with an isolated Impel profile
+  impel claude --agent <id|exact-title> ...   Run one fixed tenant agent without a parent hop
   impel codex [args...]                       Launch Codex with an isolated Impel profile
   impel codex --agent <id|exact-title> ...    Run one fixed tenant agent without a parent hop
   impel remote handoff|dispatch|handback      Move or control provider-native sessions remotely

package/src/commands/apps.js

@@ -32,8 +32,11 @@ import {
   ensureVendorApp,
   fetchGatewayModels,
   installManagedAppFiles,
+  MANAGED_RUNTIME_PREFLIGHT_EXIT_CODE,
   managedChatGPTConfigDrifted,
+  managedClaudeConfigDrifted,
   managedLauncherName,
+  managedRuntimePreflight,
   normalizeAppTarget,
   quitBlockingApps,
   readTenantManifest,
@@ -294,7 +297,18 @@ function windowsProcessFailure(result) {
 export function openManagedLauncher(launcher, {
   spawn = spawnSync,
   reportError = console.error,
+  preflight = managedRuntimePreflight,
 } = {}) {
+  // Runtime-presence preflight (the v0.20.32 exit-127 rule): never hand a
+  // managed bundle whose vendored runtime is missing or off-pin to the OS —
+  // that launch dies with an unactionable bare failure. One actionable line
+  // and a distinct exit code instead; unmanaged bundles are not judged here.
+  const runtime = preflight(launcher);
+  if (runtime && runtime.ok === false) {
+    reportError(runtime.message);
+    process.exitCode = MANAGED_RUNTIME_PREFLIGHT_EXIT_CODE;
+    return false;
+  }
   const result = spawn("/usr/bin/open", ["-n", launcher], { encoding: "utf8" });
   if (!result?.error && result?.status === 0) return true;
   const detail = result?.error?.message
@@ -740,7 +754,11 @@ export async function cmdWindowsApps(argv, overrides = {}) {
           claudeUserData: io.claudeUserData(io.environment, staleTenantId),
           tenantName: staleTenantId === stored.tenantId ? stored.tenantName : null,
         });
-        if (manifestIsFresh(stalePaths, stored) && !managedChatGPTConfigDrifted(stalePaths)) return true;
+        if (
+          manifestIsFresh(stalePaths, stored)
+          && !managedChatGPTConfigDrifted(stalePaths)
+          && !managedClaudeConfigDrifted(stalePaths)
+        ) return true;
       }
     }
     const config = await io.selectedConfig(targets, flags.tenant || null);
@@ -1329,7 +1347,12 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
       ? stored.tenantName || manifest?.tenantName
       : manifest?.tenantName,
   });
-  if (staleOnly && manifestIsFresh(paths, stored) && !managedChatGPTConfigDrifted(paths)) return;
+  if (
+    staleOnly
+    && manifestIsFresh(paths, stored)
+    && !managedChatGPTConfigDrifted(paths)
+    && !managedClaudeConfigDrifted(paths)
+  ) return;
 
   let config;
   try {

package/src/commands/launch.js

@@ -6,7 +6,11 @@ import {
   ensureImpelClaudeProfile,
   ensureImpelCodexProfile,
 } from "../cliProfiles.js";
-import { resolveManagedCodexAgentProfile, syncAgentProfilesSafe } from "../agents.js";
+import {
+  resolveManagedClaudeAgent,
+  resolveManagedCodexAgentProfile,
+  syncAgentProfilesSafe,
+} from "../agents.js";
 import {
   crossAppModelsEnabled,
   loadConfig,
@@ -77,10 +81,43 @@ const IMPEL_CODEX_RUNTIME_OVERRIDES = [
 ];
 
 const IMPEL_CODEX_UNRESTRICTED_ARGUMENT = "--dangerously-bypass-approvals-and-sandbox";
+const IMPEL_CLAUDE_MANAGED_AGENT_ARGUMENTS = [
+  "--allow-dangerously-skip-permissions",
+  "--permission-mode",
+  "bypassPermissions",
+  // Pinned Claude 2.1.220 treats agents, skills, commands, and settings as
+  // source-scoped. Load only the isolated user profile so project/local agent
+  // definitions cannot replace the integrity-verified adapter after launch.
+  "--setting-sources",
+  "user",
+];
 
-export function impelLaunchArguments(tool, argv, { codexAgentProfile = null } = {}) {
+export function impelLaunchArguments(tool, argv, {
+  claudeManagedAgent = null,
+  codexAgentProfile = null,
+} = {}) {
   if (!RUNTIME_BRAND.features.agents) return [...argv];
   if (tool === "claude") {
+    if (claudeManagedAgent) {
+      const { launchName, launchAgentsJson } = claudeManagedAgent;
+      if (typeof launchName !== "string"
+        || !launchName
+        || typeof launchAgentsJson !== "string"
+        || !launchAgentsJson) {
+        throw new Error("managed Claude launch configuration is invalid");
+      }
+      if (Buffer.byteLength(launchAgentsJson, "utf8") > 12 * 1024) {
+        throw new Error("managed Claude launch configuration is too large");
+      }
+      return [
+        ...IMPEL_CLAUDE_MANAGED_AGENT_ARGUMENTS,
+        "--agents",
+        launchAgentsJson,
+        "--agent",
+        launchName,
+        ...argv,
+      ];
+    }
     return ["--append-system-prompt", IMPEL_CLAUDE_PARENT_DELEGATION_INSTRUCTIONS, ...argv];
   }
   if (tool === "codex") {
@@ -99,6 +136,113 @@ export function impelLaunchArguments(tool, argv, { codexAgentProfile = null } =
   throw new Error(`unsupported CLI launcher: ${tool}`);
 }
 
+const CLAUDE_MANAGED_AGENT_LOCKED_OPTIONS = new Set([
+  "--add-dir",
+  "--agents",
+  "--allow-tools",
+  "--allow-dangerously-skip-permissions",
+  "--allowedTools",
+  "--allowed-tools",
+  "--append-subagent-system-prompt",
+  "--append-system-prompt",
+  "--append-system-prompt-file",
+  "--bare",
+  "--brief",
+  "--chrome",
+  "--dangerously-skip-permissions",
+  "--disable-slash-commands",
+  "--disallowedTools",
+  "--disallowed-tools",
+  "--effort",
+  "--exclude-dynamic-system-prompt-sections",
+  "--fallback-model",
+  "--file",
+  "--ide",
+  "--managed-settings",
+  "--mcp-config",
+  "--model",
+  "--no-chrome",
+  "--permission-mode",
+  "--permission-prompt-tool",
+  "--plugin-dir",
+  "--plugin-dir-no-mcp",
+  "--plugin-url",
+  "--safe-mode",
+  "--setting-sources",
+  "--settings",
+  "--strict-mcp-config",
+  "--system-prompt",
+  "--system-prompt-file",
+  "--tmux",
+  "--tools",
+  "--worktree",
+]);
+
+function claudeManagedAgentLockedOption(argument) {
+  if (argument === "-w" || (argument.startsWith("-w") && argument.length > 2)) return "-w";
+  if (CLAUDE_MANAGED_AGENT_LOCKED_OPTIONS.has(argument)) return argument;
+  return [...CLAUDE_MANAGED_AGENT_LOCKED_OPTIONS].find((option) =>
+    argument.startsWith(`${option}=`)
+  ) || null;
+}
+
+export function parseClaudeAgentLaunchArguments(argv) {
+  const passthrough = [];
+  const selectors = [];
+  let literal = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (literal) {
+      passthrough.push(argument);
+      continue;
+    }
+    if (argument === "--") {
+      literal = true;
+      passthrough.push(argument);
+      continue;
+    }
+    if (argument === "--agent") {
+      const value = argv[index += 1];
+      selectors.push(typeof value === "string" && value && !value.startsWith("-") ? value : null);
+      continue;
+    }
+    if (argument.startsWith("--agent=")) {
+      const value = argument.slice("--agent=".length);
+      selectors.push(value && !value.startsWith("-") ? value : null);
+      continue;
+    }
+    passthrough.push(argument);
+  }
+  const selector = selectors.length === 1 ? selectors[0] : null;
+  return {
+    selector,
+    argv: selector === null ? [...argv] : passthrough,
+  };
+}
+
+export function assertManagedClaudeAgentLaunchArguments(argv) {
+  let literal = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (literal) continue;
+    if (argument === "--") {
+      literal = true;
+      continue;
+    }
+    if (argument === "--agent") {
+      index += 1;
+      continue;
+    }
+    if (argument.startsWith("--agent=")) continue;
+    const locked = claudeManagedAgentLockedOption(argument);
+    if (locked) {
+      throw new Error(
+        `${locked} cannot be used with a verified managed Claude agent; Impel locks model, instructions, tools, MCP, settings, and permission policy`,
+      );
+    }
+  }
+}
+
 const CODEX_AGENT_LOCKED_OPTIONS = new Set([
   "-c",
   "--config",
@@ -264,8 +408,11 @@ function runNativeCli(tool, argv, environment) {
 
 export async function cmdLaunch(tool, argv) {
   let nativeArgv = [...argv];
+  let claudeAgentSelector = null;
   let codexAgentSelector = null;
-  if (tool === "codex") {
+  if (tool === "claude" && RUNTIME_BRAND.features.agents) {
+    ({ selector: claudeAgentSelector, argv: nativeArgv } = parseClaudeAgentLaunchArguments(argv));
+  } else if (tool === "codex") {
     try {
       ({ selector: codexAgentSelector, argv: nativeArgv } = parseCodexAgentLaunchArguments(argv));
     } catch (error) {
@@ -356,6 +503,29 @@ export async function cmdLaunch(tool, argv) {
     });
   }
 
+  let claudeManagedAgent = null;
+  if (RUNTIME_BRAND.features.agents && claudeAgentSelector !== null) {
+    try {
+      claudeManagedAgent = resolveManagedClaudeAgent(
+        agentProfile.root,
+        tenantId,
+        claudeAgentSelector,
+      );
+      if (claudeManagedAgent) {
+        assertManagedClaudeAgentLaunchArguments(nativeArgv);
+      } else {
+        // `--agent` is also Claude's native user-agent selector. If the exact
+        // value is not in the integrity-tracked Impel manifest, preserve the
+        // user's original argv and ordinary permission behavior byte-for-byte.
+        nativeArgv = [...argv];
+      }
+    } catch (error) {
+      console.error(`impel claude: ${redactSecretText(error?.message || error)}`);
+      process.exitCode = 1;
+      return;
+    }
+  }
+
   let codexAgentProfile = null;
   if (codexAgentSelector !== null) {
     try {
@@ -377,7 +547,10 @@ export async function cmdLaunch(tool, argv) {
   const { env: launchEnvironment } = withGitEnvironment(environment, { baseEnvironment: environment });
   const exitCode = await runNativeCli(
     tool,
-    impelLaunchArguments(tool, nativeArgv, { codexAgentProfile }),
+    impelLaunchArguments(tool, nativeArgv, {
+      claudeManagedAgent,
+      codexAgentProfile,
+    }),
     launchEnvironment,
   );
   if (exitCode !== 0) process.exitCode = exitCode;

package/src/commands/mcp.js

@@ -263,7 +263,7 @@ export function runNativeAgentMcpServer({
         let value;
         if (name === NATIVE_AGENT_ANSWER_TOOL) {
           if (mode !== "answer") throw new Error("this native-agent binding cannot answer directly");
-          value = await transport.answer(args, { signal: controller.signal });
+          value = await transport.answer(args, { signal: controller.signal, onProgress });
         } else if (name === NATIVE_AGENT_RUN_TOOL) {
           if (mode === "recovery") throw new Error("retired native-agent bindings cannot start new runs");
           if (mode === "answer") throw new Error("direct-answer native-agent bindings cannot start durable runs");

package/src/commands/sessions.js

@@ -2,7 +2,8 @@ import { spawn } from "node:child_process";
 import path from "node:path";
 
 import { parseFlags } from "../args.js";
-import { appPaths, managedChatGPTConfigDrifted } from "../apps.js";
+import { appPaths, managedChatGPTConfigDrifted, managedClaudeConfigDrifted } from "../apps.js";
+import { windowsClaudeUserData } from "../windowsApps.js";
 import {
   clearSessionFlushLock,
   collectSessionHook,
@@ -32,23 +33,36 @@ const SPEC = {
   [MANAGED_SESSION_HOOK_FLAG]: { type: "boolean" },
 };
 
+// The Claude drift check reads the Claude app profile, which lives under
+// %LOCALAPPDATA% on Windows rather than the darwin tenant root.
+function managedAppDriftPaths(tenantId) {
+  return appPaths(undefined, tenantId, process.platform === "win32"
+    ? { claudeUserData: windowsClaudeUserData(process.env, tenantId) }
+    : {});
+}
+
+function anyManagedAppConfigDrifted(paths) {
+  return managedChatGPTConfigDrifted(paths) || managedClaudeConfigDrifted(paths);
+}
+
 /**
- * Repair a managed ChatGPT profile the desktop app just rewrote out from under
- * the gateway. Hooks are the only Impel code guaranteed to run while the app
- * is broken (the app stops calling the provider token helper once the managed
- * `model_provider` key is gone), so each codex hook event checks for drift and
- * kicks one detached stale-only refresh — which the drift-aware staleness gate
- * turns into a real repair. The heartbeat lock keeps repeated hook events from
- * stacking refresh children while one is already running.
+ * Repair a managed app profile a vendor just rewrote out from under the
+ * gateway. Hooks and the token helper are the only Impel code guaranteed to
+ * run while an app is broken (a drifted config can stop calling the provider
+ * token helper entirely), so both check for drift and kick one detached
+ * stale-only refresh — which the drift-aware staleness gate turns into a real
+ * repair. The heartbeat lock keeps repeated events from stacking refresh
+ * children while one is already running. Content-checks both managed
+ * surfaces (ChatGPT/Codex and Claude) by default.
  */
-export function maybeRepairManagedCodexApp(tenantId, {
-  drifted = managedChatGPTConfigDrifted,
+export function maybeRepairManagedApps(tenantId, {
+  drifted = anyManagedAppConfigDrifted,
   lockIsFresh = sessionFlushLockIsFresh,
   touchLock = touchSessionFlushLock,
   spawnRefresh = spawnDetachedAppRefresh,
 } = {}) {
   if (!tenantId) return false;
-  const paths = appPaths(undefined, tenantId);
+  const paths = managedAppDriftPaths(tenantId);
   if (!drifted(paths)) return false;
   const lock = path.join(paths.tenantRoot, "app-repair-heartbeat");
   if (lockIsFresh(lock, 60_000)) return false;
@@ -57,6 +71,19 @@ export function maybeRepairManagedCodexApp(tenantId, {
   return true;
 }
 
+/**
+ * The codex session-hook entry point: same repair, scoped to ChatGPT/Codex
+ * drift exactly as before the helper was generalized (the codex hook fires on
+ * codex events; Claude drift is healed by the token helper and the Claude
+ * session hooks' own refresh channel).
+ */
+export function maybeRepairManagedCodexApp(tenantId, overrides = {}) {
+  return maybeRepairManagedApps(tenantId, {
+    drifted: managedChatGPTConfigDrifted,
+    ...overrides,
+  });
+}
+
 function startDetachedFlush({ provider, tenant, session }) {
   const invocation = impelCliInvocation([
     "sessions",
@@ -101,6 +128,12 @@ export async function cmdSessions(argv) {
         flush: false,
       });
       if (flags.provider === "codex") maybeRepairManagedCodexApp(flags.tenant);
+      // The Claude mirror of the codex repair above: Claude Desktop rewrites
+      // its co-owned profile files too, and its session hooks are the only
+      // Impel code guaranteed to still run afterward.
+      if (flags.provider === "claude_code") {
+        maybeRepairManagedApps(flags.tenant, { drifted: managedClaudeConfigDrifted });
+      }
       if (config && (config.tenantId === flags.tenant || environmentValue("SESSIONS_DEV_ORG_ID"))) {
         // Hooks fire on every session event; only spawn a flush child when no
         // live one is already polling this session's outbox (heartbeat lock).