impel-cli 0.20.38 → 0.20.39

package/src/agents.js

@@ -56,7 +56,7 @@ export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
 export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 20;
+export const MANAGED_AGENT_MANIFEST_VERSION = 22;
 
 // The host model only selects the fixed MCP tool and faithfully returns its
 // result. Spark minimizes those transport-only turns while the selected Eve
@@ -623,7 +623,7 @@ function claudeAdapterInstructions(tenantId, agent) {
       `Confirm that the request fits the synchronized capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)}.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema, add handle metadata, or fabricate a continuation from any other field. If the answer call is cancelled or fails before returning any continuation, call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} again with the same question; once a continuation has been returned, never call it again for this request.`,
       completionGuidance,
     ].join(" ");
   }
@@ -673,7 +673,7 @@ function codexAdapterInstructions(tenantId, agent) {
       `Confirm that the assigned request fits the cataloged capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)} before answering.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema, add handle metadata, or fabricate a continuation from any other field. If the answer call is cancelled or fails before returning any continuation, call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} again with the same question; once a continuation has been returned, never call it again for this request.`,
       completionGuidance,
     ].join("\n\n");
   }
@@ -827,6 +827,13 @@ function renderCodexConfiguration({
     ...(directCodeMode ? [
       "[features]",
       "multi_agent = false",
+      // Fixed-binding adapters cannot use host plugins. Disable both local and
+      // remote plugin paths so profile layering does not load the ordinary
+      // tenant Codex plugin catalog or make unrelated catalog requests.
+      "plugins = false",
+      "remote_plugin = false",
+      "plugin_sharing = false",
+      "recommended_plugins = false",
       "",
       "[features.code_mode]",
       "enabled = true",
@@ -1333,9 +1340,23 @@ export function syncAgentProfile({
   const priorUsesDiscoveryRoot = Number.isInteger(prior?.version)
     && prior.version >= 2
     && prior.version <= MANAGED_AGENT_MANIFEST_VERSION;
-  const priorOwnsCodexProfiles = priorUsesDiscoveryRoot
-    && prior?.client === "codex"
+  // Ownership requires the client and tenant to match on every leg; a manifest
+  // from another scope must neither authorize overwrites nor deletions.
+  const priorOwnsManagedFiles = priorUsesDiscoveryRoot
+    && prior?.client === client
     && prior?.tenantId === tenantId;
+  // A colliding artifact whose bytes match the recorded digest of a
+  // non-owning manifest is provably impel-generated (e.g. after a tenant
+  // scope-key drift), so reclaiming it cannot lose operator-authored content.
+  const reclaimable = (digestKey, destination) => {
+    const recorded = prior?.contentDigests?.[digestKey];
+    if (typeof recorded !== "string" || !recorded) return false;
+    try {
+      return contentDigest(fs.readFileSync(destination)) === recorded;
+    } catch {
+      return false;
+    }
+  };
 
   // Native clients discover standalone definitions directly under `agents/`.
   // Preflight every destination before writing so an unmanaged file with the
@@ -1343,12 +1364,13 @@ export function syncAgentProfile({
   for (const agent of rendered) {
     const destination = path.join(agentsDir, agent.fileName);
     if (fs.existsSync(destination)) {
-      if (!priorUsesDiscoveryRoot || !priorFiles.has(agent.fileName)) {
-        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
-      }
       if (fs.lstatSync(destination).isSymbolicLink()) {
         throw new Error(`refusing to overwrite symlinked native-agent file ${destination}`);
       }
+      if ((!priorOwnsManagedFiles || !priorFiles.has(agent.fileName))
+        && !reclaimable(`agents/${agent.fileName}`, destination)) {
+        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
+      }
     }
     if (client === "codex" && directProfiles) {
       const profileDestination = path.join(root, agent.profileFileName);
@@ -1356,7 +1378,8 @@ export function syncAgentProfile({
         if (fs.lstatSync(profileDestination).isSymbolicLink()) {
           throw new Error(`refusing to overwrite symlinked Codex profile ${profileDestination}`);
         }
-        if (!priorOwnsCodexProfiles || !priorProfiles.has(agent.profileFileName)) {
+        if ((!priorOwnsManagedFiles || !priorProfiles.has(agent.profileFileName))
+          && !reclaimable(agent.profileFileName, profileDestination)) {
           throw new Error(`refusing to overwrite unmanaged Codex profile ${profileDestination}`);
         }
       }
@@ -1370,20 +1393,29 @@ export function syncAgentProfile({
   const currentProfiles = new Set(client === "codex" && directProfiles
     ? rendered.map((agent) => agent.profileFileName)
     : []);
+  // Stale-file cleanup in the shared discovery root: an owning manifest's
+  // listing is authoritative, while a non-owning manifest (another tenant or
+  // a drifted scope) may only remove files it digest-proves impel wrote —
+  // native-profile roots are shared across tenants, so skipping cleanup
+  // entirely would orphan the previous tenant's agents forever, and deleting
+  // unproven listings could destroy another owner's live files. Legacy
+  // nested manifests only ever clean impel's private managed directory below.
+  const staleRemovable = (stale, digestKey, destination) =>
+    typeof stale === "string"
+    && path.basename(stale) === stale
+    && (priorOwnsManagedFiles || reclaimable(digestKey, destination));
   for (const stale of prior?.files || []) {
     if (
-      typeof stale === "string"
-      && path.basename(stale) === stale
+      staleRemovable(stale, `agents/${stale}`, path.join(agentsDir, stale))
       && !currentFiles.has(stale)
       && (stale.endsWith(".md") || stale.endsWith(".toml"))
     ) {
-      fs.rmSync(path.join(priorUsesDiscoveryRoot ? agentsDir : managedDir, stale), { force: true });
+      fs.rmSync(path.join(agentsDir, stale), { force: true });
     }
   }
-  for (const stale of priorOwnsCodexProfiles ? prior.profiles || [] : []) {
+  for (const stale of client === "codex" ? prior?.profiles || [] : []) {
     if (
-      typeof stale === "string"
-      && path.basename(stale) === stale
+      staleRemovable(stale, stale, path.join(root, stale))
       && stale.endsWith(".config.toml")
       && !currentProfiles.has(stale)
     ) {

package/src/apps.js

@@ -157,6 +157,27 @@ const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(n
 const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof v?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
 const LEGACY_CLAUDE_SAFE_STORAGE_NAME = "Claude";
 const CLAUDE_SAFE_STORAGE_METADATA = "safe-storage.json";
+// The pinned Claude desktop build refuses remote debugging unless
+// process.env.CLAUDE_CDP_AUTH carries a token Ed25519-signed by the private
+// half of this baked-in public key: its main process runs
+// `eae(process.argv)&&!_9()&&process.exit(1)` where eae() is true for any
+// --remote-debugging-port/-pipe flag and _9() verifies CLAUDE_CDP_AUTH with
+// crypto.verify(null, `${ms}.${base64(userData)}`, createPublicKey(<key>),
+// sig). The exact PEM literal appears TWICE in the pinned ASAR (the
+// main-process gate and a shared utility chunk whose token verifiers reuse the
+// same anchor); both are the identical CDP-auth trust anchor. Swapping it to
+// the Impel key below lets the CI-isolated launch smoke drive the managed
+// bundle over CDP with a token signed by the matching private key (held only
+// in GitHub Actions secrets), which is required to verify pins by behavior
+// (docs/testing-protocol.md P0-1). This deliberately moves the managed
+// bundle's CDP trust anchor from Anthropic's key to an Impel CI-held key;
+// flagged for maintainer review in the PR. Both keys are Ed25519 SPKI PEM of
+// identical byte length, so the fixed-width ASAR swap preserves layout.
+const CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEApH/vaEiLV0sNY/eS+Ct/IMbMqw8i/vC/cNC84BAbBq8=\n-----END PUBLIC KEY-----";
+const IMPEL_CLAUDE_CDP_AUTH_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAXG1l1V6YxCaH1Dbn27EIkeQjYU4urRx2aPrDwAULUfw=\n-----END PUBLIC KEY-----";
+// The pinned build embeds the anchor in exactly this many chunks. Fail closed
+// (no loose regex, no "best effort") if a vendor update changes the count.
+const CLAUDE_CDP_AUTH_KEY_COPIES = 2;
 // The pinned Claude renderer decides desktop-vs-web mode SOLELY by matching its
 // own Electron user-agent against /claude(nest|gov)?\/([^ ]+)/i (functions o_,
 // x_, i_ in ion-dist). Electron derives that UA product token from app.name as
@@ -290,7 +311,11 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // and install Claude task, notification, and permission lifecycle hooks.
 // 32: install a persistent tenant-bound Tasks navigation surface in the
 // managed Claude and ChatGPT/Codex desktop wrappers.
-export const CURRENT_CONFIG_VERSION = 32;
+// 33: size the Codex verbatim-relay parent wait to outlast the child's
+// native-agent attachment window so the visible working span is not
+// truncated while the child is still running.
+// 34: isolate fixed-binding Codex profiles from local and remote host plugins.
+export const CURRENT_CONFIG_VERSION = 34;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -299,7 +324,7 @@ export const CURRENT_CONFIG_VERSION = 32;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.4";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.5";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -423,6 +448,7 @@ const CLAUDE_COMPATIBILITY_PATCH_KEYS = Object.freeze([
   "followupBoundAgentFilter",
   "followupBoundAgentChip",
   "desktopTasksPreload",
+  "cdpAuthKey",
 ]);
 const CLAUDE_COMPATIBILITY_RENDERER_GROUPS = Object.freeze(["agentMentions"]);
 
@@ -1659,6 +1685,187 @@ function removeTopLevelTomlString(toml, key) {
   return topLevel + toml.slice(topLevelEnd);
 }
 
+/** Read one co-owned JSON artifact; distinguishes "absent" from "corrupt". */
+function readManagedJsonArtifact(filePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf8");
+  } catch {
+    return { present: false, value: null };
+  }
+  try {
+    const value = JSON.parse(raw);
+    return {
+      present: true,
+      value: value && typeof value === "object" && !Array.isArray(value) ? value : null,
+    };
+  } catch {
+    return { present: true, value: null };
+  }
+}
+
+// Mirrors the session-hook installer's tenant gate (sessionHooks.js
+// validTenantId): hooks are only ever written for ids matching this shape, so
+// the drift check must not demand them for ids the installer skipped.
+const SESSION_HOOK_TENANT_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+
+/** Whether the managed session-hook heal channel survives in settings.json. */
+function claudeSettingsCarrySessionHooks(settings) {
+  const hooks = settings.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) return false;
+  const marker = `--${RUNTIME_BRAND.cli.command}-managed-session-hook-v1`;
+  return Object.values(hooks).some((groups) => Array.isArray(groups) && groups.some((group) => (
+    Array.isArray(group?.hooks) && group.hooks.some((handler) => (
+      (Array.isArray(handler?.args) && handler.args.includes(marker))
+      || (typeof handler?.command === "string" && handler.command.includes(marker))
+    ))
+  )));
+}
+
+/**
+ * True when a managed Claude profile exists but its artifacts no longer carry
+ * the load-bearing managed keys. Claude Desktop and the embedded Claude Code
+ * runtime co-own these files and rewrite them with their own settings writers,
+ * which normalize away optional fields (the persisted Tasks MCP entry loses
+ * `type: "stdio"`), reorder keys, and reformat whitespace. Those cosmetic
+ * rewrites are NOT drift — ownership recognition tolerates them through
+ * isImpelTasksMcpInvocation, and every check parses JSON rather than comparing
+ * bytes — but a lost or overwritten managed key (gateway routing config, the
+ * applied configLibrary selection, the 3P deployment selection, the
+ * tenant-bound Tasks MCP entry, the session-hook heal channel, the managed
+ * sandbox policy) is real drift. Stale-only refreshes treat it as staleness so
+ * the profile heals immediately instead of waiting out the manifest TTL.
+ * The content-based mirror of managedChatGPTConfigDrifted for the Claude
+ * target; like it, this never keys on TTLs or timestamps.
+ */
+export function managedClaudeConfigDrifted(paths) {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8"));
+  } catch {
+    return false; // No managed install; install/update owns creating one.
+  }
+  if (!Array.isArray(manifest?.targets) || !manifest.targets.includes("claude")) return false;
+  const tenantId = typeof manifest.tenantId === "string" && manifest.tenantId
+    ? manifest.tenantId
+    : null;
+
+  // configLibrary: the gateway inference routing the desktop app applies. A
+  // profile that loses it (or its provider/base-url/api-key wiring) no longer
+  // routes inference through the Impel gateway at all.
+  const configLibrary = readManagedJsonArtifact(
+    path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`),
+  );
+  if (
+    !configLibrary.value
+    || configLibrary.value.inferenceProvider !== "gateway"
+    || typeof configLibrary.value.inferenceGatewayBaseUrl !== "string"
+    || !configLibrary.value.inferenceGatewayBaseUrl
+    || typeof configLibrary.value.inferenceGatewayApiKey !== "string"
+    || !configLibrary.value.inferenceGatewayApiKey
+  ) {
+    return true;
+  }
+  const meta = readManagedJsonArtifact(path.join(paths.claude.userData, "configLibrary", "_meta.json"));
+  if (!meta.value || meta.value.appliedId !== CLAUDE_CONFIG_ID) return true;
+
+  // claude_desktop_config.json: the native 3P selection plus the tenant-bound
+  // Tasks MCP entry. Claude Desktop persists this file itself, without the
+  // optional `type` field and with its own key order — that vendor-normalized
+  // form must keep counting as ours (the 0.20.1 repair-refusal regression).
+  const desktop = readManagedJsonArtifact(path.join(paths.claude.userData, "claude_desktop_config.json"));
+  if (!desktop.value || desktop.value.deploymentMode !== "3p") return true;
+  if (RUNTIME_BRAND.features.mcp && tenantId) {
+    const servers = desktop.value.mcpServers;
+    const tasksEntry = servers && typeof servers === "object" && !Array.isArray(servers)
+      ? servers[IMPEL_TASKS_MCP_SERVER_NAME]
+      : undefined;
+    if (!isImpelTasksMcpInvocation(tasksEntry)) return true;
+  }
+
+  // settings.json: the managed sandbox policy and the session-hook heal
+  // channel. The hooks are the only Impel code guaranteed to run while the
+  // profile is broken, so losing them kills the self-repair path itself.
+  const settings = readManagedJsonArtifact(path.join(paths.claude.userData, "settings.json"));
+  if (!settings.value || settings.value.sandbox?.enabled !== false) return true;
+  if (
+    RUNTIME_BRAND.features.sessions
+    && tenantId
+    && SESSION_HOOK_TENANT_RE.test(tenantId)
+    && !claudeSettingsCarrySessionHooks(settings.value)
+  ) {
+    return true;
+  }
+  return false;
+}
+
+/** Distinct exit code for a failed managed-runtime preflight (EX_CONFIG). */
+export const MANAGED_RUNTIME_PREFLIGHT_EXIT_CODE = 78;
+
+function runtimeRepairInstruction(compatibility) {
+  const command = RUNTIME_BRAND.cli.command;
+  const tenantSource = `${compatibility.codexHome || ""}${compatibility.profileRoot || ""}`;
+  const tenantId = tenantSource.match(/[\\/]tenants[\\/]([^\\/]+)[\\/]/u)?.[1] || null;
+  return `run \`${command} update\` or \`${command} app refresh${tenantId ? ` --tenant ${tenantId}` : ""}\` to repair it`;
+}
+
+/**
+ * Runtime-presence preflight for the managed-launch seam: before a managed
+ * launcher is handed to the OS, require the vendored runtime it embeds to
+ * exist at the version this CLI pins (the v0.20.32 exit-127 rule: a pin bump
+ * that outruns the installed runtime must fail with one actionable line and a
+ * distinct exit code, never a bare ENOENT/127 crash). Checks are cheap —
+ * Impel's own build metadata, file existence, and the existing plist
+ * version-read helper; no binary is spawned. Bundles without Impel build
+ * metadata are not judged (the OS reports its own launch failure), so
+ * non-managed behavior is unchanged.
+ */
+export function managedRuntimePreflight(launcher, { pins = PINNED_VENDOR_APPS } = {}) {
+  const compatibility = readBundleCompatibility(launcher);
+  if (!compatibility) return { ok: true, checked: false };
+  const target = compatibility.codexHome ? "chatgpt" : "claude";
+  const pin = pins[target];
+  if (!pin) return { ok: true, checked: false };
+  const command = RUNTIME_BRAND.cli.command;
+  const repair = runtimeRepairInstruction(compatibility);
+  const fail = (message) => ({ ok: false, checked: true, target, message: `${command} app: ${message}; ${repair}` });
+
+  if (target === "claude") {
+    let executable = null;
+    try {
+      const plist = fs.readFileSync(path.join(launcher, "Contents", "Info.plist"), "utf8");
+      executable = plist.match(/<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/u)?.[1] || null;
+    } catch {
+      executable = null;
+    }
+    const binary = executable ? path.join(launcher, "Contents", "MacOS", executable) : null;
+    if (!binary || !fs.existsSync(binary)) {
+      return fail(`managed Claude runtime binary is missing at ${binary || path.join(launcher, "Contents", "MacOS")} (pinned ${pin.version})`);
+    }
+    const found = bundleVersion(launcher);
+    if (found !== pin.version) {
+      return fail(`managed Claude runtime is version ${found || "unknown"} at ${launcher}, but this CLI pins ${pin.version}`);
+    }
+    return { ok: true, checked: true, target };
+  }
+
+  const embedded = APP_DEFINITIONS.chatgpt.names
+    .map((name) => path.join(launcher, "Contents", "Resources", name))
+    .find((candidate) => fs.existsSync(candidate));
+  if (!embedded) {
+    return fail(`managed ChatGPT runtime bundle is missing under ${path.join(launcher, "Contents", "Resources")} (pinned ${pin.version})`);
+  }
+  const codexBinary = path.join(embedded, "Contents", "Resources", "codex");
+  if (!fs.existsSync(codexBinary)) {
+    return fail(`managed Codex runtime binary is missing at ${codexBinary} (pinned codex-cli ${pin.codexVersion})`);
+  }
+  const found = bundleVersion(embedded);
+  if (found !== pin.version) {
+    return fail(`managed ChatGPT runtime is version ${found || "unknown"} at ${embedded}, but this CLI pins ${pin.version} (codex-cli ${pin.codexVersion})`);
+  }
+  return { ok: true, checked: true, target };
+}
+
 /**
  * Rewrite one tenant's app token helper with the current node/CLI paths.
  * Cheap and Impel-owned, so install recovery can use it to heal helpers whose
@@ -1768,6 +1975,7 @@ function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStor
     }
     const safeStorageNamePatchCount = patchClaudeSafeStorageName(asarPath);
     const desktopTasksPreloadPatchCount = patchDesktopTasksPreload(asarPath, "claude");
+    const cdpAuthKeyPatchCount = patchClaudeCdpAuthKey(asarPath);
     const newAsarHash = asarHeaderHash(asarPath);
 
     updateBundleIdentity(plistPath, {
@@ -1824,6 +2032,7 @@ function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStor
         followupBoundAgentFilter: agentMentionPatches.filter,
         followupBoundAgentChip: agentMentionPatches.chip,
         desktopTasksPreload: desktopTasksPreloadPatchCount,
+        cdpAuthKey: cdpAuthKeyPatchCount,
       },
       rendererAssets: {
         agentMentions: agentMentionPatches.assets,
@@ -2200,6 +2409,28 @@ function patchClaudeSafeStorageName(asarPath) {
   return applyFixedWidthAsarPatches(asarPath, archive, patches, "Claude Safe Storage app name");
 }
 
+// Replace the baked-in CDP-auth trust anchor with the Impel key so the
+// CI-isolated launch smoke can drive the managed bundle over CDP with a token
+// signed by the matching (Actions-secret-held) private key. Fail closed on any
+// count other than the exact pinned number of copies, and let the shared
+// fixed-width helper enforce byte-length parity (both keys are Ed25519 SPKI
+// PEM of equal length) so the ASAR layout is preserved.
+function patchClaudeCdpAuthKey(asarPath) {
+  const source = fs.readFileSync(asarPath).toString("latin1");
+  const occurrences = exactTextMatchCount(source, CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY);
+  if (occurrences !== CLAUDE_CDP_AUTH_KEY_COPIES) {
+    throw new Error(
+      `Claude CDP-auth trust-anchor patch expected ${CLAUDE_CDP_AUTH_KEY_COPIES} vendor key copies, found ${occurrences}`,
+    );
+  }
+  return patchFixedWidthAsarString(
+    asarPath,
+    CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY,
+    IMPEL_CLAUDE_CDP_AUTH_PUBLIC_KEY,
+    "Claude CDP-auth trust anchor",
+  );
+}
+
 function patchFastModeAuthGate(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");

package/src/commands/apps.js

@@ -32,8 +32,11 @@ import {
   ensureVendorApp,
   fetchGatewayModels,
   installManagedAppFiles,
+  MANAGED_RUNTIME_PREFLIGHT_EXIT_CODE,
   managedChatGPTConfigDrifted,
+  managedClaudeConfigDrifted,
   managedLauncherName,
+  managedRuntimePreflight,
   normalizeAppTarget,
   quitBlockingApps,
   readTenantManifest,
@@ -294,7 +297,18 @@ function windowsProcessFailure(result) {
 export function openManagedLauncher(launcher, {
   spawn = spawnSync,
   reportError = console.error,
+  preflight = managedRuntimePreflight,
 } = {}) {
+  // Runtime-presence preflight (the v0.20.32 exit-127 rule): never hand a
+  // managed bundle whose vendored runtime is missing or off-pin to the OS —
+  // that launch dies with an unactionable bare failure. One actionable line
+  // and a distinct exit code instead; unmanaged bundles are not judged here.
+  const runtime = preflight(launcher);
+  if (runtime && runtime.ok === false) {
+    reportError(runtime.message);
+    process.exitCode = MANAGED_RUNTIME_PREFLIGHT_EXIT_CODE;
+    return false;
+  }
   const result = spawn("/usr/bin/open", ["-n", launcher], { encoding: "utf8" });
   if (!result?.error && result?.status === 0) return true;
   const detail = result?.error?.message
@@ -740,7 +754,11 @@ export async function cmdWindowsApps(argv, overrides = {}) {
           claudeUserData: io.claudeUserData(io.environment, staleTenantId),
           tenantName: staleTenantId === stored.tenantId ? stored.tenantName : null,
         });
-        if (manifestIsFresh(stalePaths, stored) && !managedChatGPTConfigDrifted(stalePaths)) return true;
+        if (
+          manifestIsFresh(stalePaths, stored)
+          && !managedChatGPTConfigDrifted(stalePaths)
+          && !managedClaudeConfigDrifted(stalePaths)
+        ) return true;
       }
     }
     const config = await io.selectedConfig(targets, flags.tenant || null);
@@ -1329,7 +1347,12 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
       ? stored.tenantName || manifest?.tenantName
       : manifest?.tenantName,
   });
-  if (staleOnly && manifestIsFresh(paths, stored) && !managedChatGPTConfigDrifted(paths)) return;
+  if (
+    staleOnly
+    && manifestIsFresh(paths, stored)
+    && !managedChatGPTConfigDrifted(paths)
+    && !managedClaudeConfigDrifted(paths)
+  ) return;
 
   let config;
   try {

package/src/commands/mcp.js

@@ -263,7 +263,7 @@ export function runNativeAgentMcpServer({
         let value;
         if (name === NATIVE_AGENT_ANSWER_TOOL) {
           if (mode !== "answer") throw new Error("this native-agent binding cannot answer directly");
-          value = await transport.answer(args, { signal: controller.signal });
+          value = await transport.answer(args, { signal: controller.signal, onProgress });
         } else if (name === NATIVE_AGENT_RUN_TOOL) {
           if (mode === "recovery") throw new Error("retired native-agent bindings cannot start new runs");
           if (mode === "answer") throw new Error("direct-answer native-agent bindings cannot start durable runs");

package/src/commands/sessions.js

@@ -2,7 +2,8 @@ import { spawn } from "node:child_process";
 import path from "node:path";
 
 import { parseFlags } from "../args.js";
-import { appPaths, managedChatGPTConfigDrifted } from "../apps.js";
+import { appPaths, managedChatGPTConfigDrifted, managedClaudeConfigDrifted } from "../apps.js";
+import { windowsClaudeUserData } from "../windowsApps.js";
 import {
   clearSessionFlushLock,
   collectSessionHook,
@@ -32,23 +33,36 @@ const SPEC = {
   [MANAGED_SESSION_HOOK_FLAG]: { type: "boolean" },
 };
 
+// The Claude drift check reads the Claude app profile, which lives under
+// %LOCALAPPDATA% on Windows rather than the darwin tenant root.
+function managedAppDriftPaths(tenantId) {
+  return appPaths(undefined, tenantId, process.platform === "win32"
+    ? { claudeUserData: windowsClaudeUserData(process.env, tenantId) }
+    : {});
+}
+
+function anyManagedAppConfigDrifted(paths) {
+  return managedChatGPTConfigDrifted(paths) || managedClaudeConfigDrifted(paths);
+}
+
 /**
- * Repair a managed ChatGPT profile the desktop app just rewrote out from under
- * the gateway. Hooks are the only Impel code guaranteed to run while the app
- * is broken (the app stops calling the provider token helper once the managed
- * `model_provider` key is gone), so each codex hook event checks for drift and
- * kicks one detached stale-only refresh — which the drift-aware staleness gate
- * turns into a real repair. The heartbeat lock keeps repeated hook events from
- * stacking refresh children while one is already running.
+ * Repair a managed app profile a vendor just rewrote out from under the
+ * gateway. Hooks and the token helper are the only Impel code guaranteed to
+ * run while an app is broken (a drifted config can stop calling the provider
+ * token helper entirely), so both check for drift and kick one detached
+ * stale-only refresh — which the drift-aware staleness gate turns into a real
+ * repair. The heartbeat lock keeps repeated events from stacking refresh
+ * children while one is already running. Content-checks both managed
+ * surfaces (ChatGPT/Codex and Claude) by default.
  */
-export function maybeRepairManagedCodexApp(tenantId, {
-  drifted = managedChatGPTConfigDrifted,
+export function maybeRepairManagedApps(tenantId, {
+  drifted = anyManagedAppConfigDrifted,
   lockIsFresh = sessionFlushLockIsFresh,
   touchLock = touchSessionFlushLock,
   spawnRefresh = spawnDetachedAppRefresh,
 } = {}) {
   if (!tenantId) return false;
-  const paths = appPaths(undefined, tenantId);
+  const paths = managedAppDriftPaths(tenantId);
   if (!drifted(paths)) return false;
   const lock = path.join(paths.tenantRoot, "app-repair-heartbeat");
   if (lockIsFresh(lock, 60_000)) return false;
@@ -57,6 +71,19 @@ export function maybeRepairManagedCodexApp(tenantId, {
   return true;
 }
 
+/**
+ * The codex session-hook entry point: same repair, scoped to ChatGPT/Codex
+ * drift exactly as before the helper was generalized (the codex hook fires on
+ * codex events; Claude drift is healed by the token helper and the Claude
+ * session hooks' own refresh channel).
+ */
+export function maybeRepairManagedCodexApp(tenantId, overrides = {}) {
+  return maybeRepairManagedApps(tenantId, {
+    drifted: managedChatGPTConfigDrifted,
+    ...overrides,
+  });
+}
+
 function startDetachedFlush({ provider, tenant, session }) {
   const invocation = impelCliInvocation([
     "sessions",
@@ -101,6 +128,12 @@ export async function cmdSessions(argv) {
         flush: false,
       });
       if (flags.provider === "codex") maybeRepairManagedCodexApp(flags.tenant);
+      // The Claude mirror of the codex repair above: Claude Desktop rewrites
+      // its co-owned profile files too, and its session hooks are the only
+      // Impel code guaranteed to still run afterward.
+      if (flags.provider === "claude_code") {
+        maybeRepairManagedApps(flags.tenant, { drifted: managedClaudeConfigDrifted });
+      }
       if (config && (config.tenantId === flags.tenant || environmentValue("SESSIONS_DEV_ORG_ID"))) {
         // Hooks fire on every session event; only spawn a flush child when no
         // live one is already polling this session's outbox (heartbeat lock).

package/src/commands/token.js

@@ -1,14 +1,21 @@
 import { loadConfig } from "../config.js";
 import { parseFlags } from "../args.js";
 import { ensureTenantSelection, normalizeTenantId, tenantCredential } from "../tenants.js";
+import { maybeRepairManagedApps } from "./sessions.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 // This is the `apiKeyHelper` / auth-command contract: stdout (and only
 // stdout) must be exactly the bearer token, nothing else. Both Claude Code's
 // apiKeyHelper and Codex CLI's `model_providers.<id>.auth.command` call this.
-export async function cmdToken(argv = []) {
+export async function cmdToken(argv = [], overrides = {}) {
+  const io = {
+    loadConfig,
+    ensureTenantSelection,
+    repairManagedApps: maybeRepairManagedApps,
+    ...overrides,
+  };
   const { flags } = parseFlags(argv, { tenant: { type: "string" } });
-  const config = loadConfig();
+  const config = io.loadConfig();
   if (!config?.pat) {
     process.stderr.write(`${RUNTIME_BRAND.cli.command}: not authenticated. Run \`${RUNTIME_BRAND.cli.command} setup\` (or \`${RUNTIME_BRAND.cli.command} auth\`) first.\n`);
     process.exitCode = 1;
@@ -17,8 +24,21 @@ export async function cmdToken(argv = []) {
   try {
     const tenantId = flags.tenant
       ? normalizeTenantId(flags.tenant)
-      : (await ensureTenantSelection(config)).tenantId;
+      : (await io.ensureTenantSelection(config)).tenantId;
     process.stdout.write(`${tenantCredential(config.pat, tenantId)}\n`);
+    // Drift-aware self-heal, strictly AFTER the token bytes are on stdout: the
+    // vendor apps call this helper on every auth, which makes it an Impel
+    // entry point that keeps running even after a vendor settings-writer
+    // rewrites a managed profile (a drifted config once stopped invoking the
+    // rest of the heal channel entirely). Kick the same detached,
+    // heartbeat-locked stale-only refresh the session hooks use — for both
+    // Codex and Claude drift. It must never write to stdout, never block the
+    // emission above, and never change this command's exit code.
+    try {
+      io.repairManagedApps(tenantId);
+    } catch {
+      // Opportunistic only; the token contract is already fulfilled.
+    }
   } catch (error) {
     process.stderr.write(`${RUNTIME_BRAND.cli.command}: ${error.message}\n`);
     process.exitCode = 1;

package/src/macSetup.js

@@ -7,7 +7,7 @@ import { spawnSync } from "node:child_process";
 import { ensureImpelClaudeProfile, ensureImpelCodexProfile } from "./cliProfiles.js";
 import { findNativeBinary } from "./nativeProcess.js";
 import { syncSkillsSafe } from "./skills.js";
-import { verifyReviewedMacVendorCli } from "./vendorCliBinaries.js";
+import { findReviewedVendorCliBinary, verifyReviewedMacVendorCli } from "./vendorCliBinaries.js";
 import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
 
 const MAX_INSTALLER_BYTES = 512 * 1024;
@@ -49,13 +49,14 @@ export const MAC_CLI_INSTALLERS = Object.freeze({
 });
 
 function detectMacClis(find, environment, verify) {
-  const detect = (tool) => find(
-    tool,
-    environment,
-    "darwin",
-    "IMPEL",
-    (binary) => verify(tool, binary, environment),
-  );
+  // Detection must share the launcher's reviewed resolution (including the
+  // side-by-side fallback after vendor auto-update drift); a raw PATH probe
+  // here would classify a drifted-but-launchable install as missing and
+  // reinstall it on every setup/update pass.
+  const detect = (tool) => findReviewedVendorCliBinary(tool, environment, "darwin", "IMPEL", {
+    find,
+    verify,
+  });
   return { claude: detect("claude"), codex: detect("codex") };
 }