impel-cli 0.20.38 → 0.20.40

package/src/agents.js

@@ -56,7 +56,7 @@ export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
 export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 20;
+export const MANAGED_AGENT_MANIFEST_VERSION = 22;
 
 // The host model only selects the fixed MCP tool and faithfully returns its
 // result. Spark minimizes those transport-only turns while the selected Eve
@@ -623,7 +623,7 @@ function claudeAdapterInstructions(tenantId, agent) {
       `Confirm that the request fits the synchronized capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)}.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema, add handle metadata, or fabricate a continuation from any other field. If the answer call is cancelled or fails before returning any continuation, call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} again with the same question; once a continuation has been returned, never call it again for this request.`,
       completionGuidance,
     ].join(" ");
   }
@@ -673,7 +673,7 @@ function codexAdapterInstructions(tenantId, agent) {
       `Confirm that the assigned request fits the cataloged capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)} before answering.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema, add handle metadata, or fabricate a continuation from any other field. If the answer call is cancelled or fails before returning any continuation, call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} again with the same question; once a continuation has been returned, never call it again for this request.`,
       completionGuidance,
     ].join("\n\n");
   }
@@ -827,6 +827,13 @@ function renderCodexConfiguration({
     ...(directCodeMode ? [
       "[features]",
       "multi_agent = false",
+      // Fixed-binding adapters cannot use host plugins. Disable both local and
+      // remote plugin paths so profile layering does not load the ordinary
+      // tenant Codex plugin catalog or make unrelated catalog requests.
+      "plugins = false",
+      "remote_plugin = false",
+      "plugin_sharing = false",
+      "recommended_plugins = false",
       "",
       "[features.code_mode]",
       "enabled = true",
@@ -1333,9 +1340,23 @@ export function syncAgentProfile({
   const priorUsesDiscoveryRoot = Number.isInteger(prior?.version)
     && prior.version >= 2
     && prior.version <= MANAGED_AGENT_MANIFEST_VERSION;
-  const priorOwnsCodexProfiles = priorUsesDiscoveryRoot
-    && prior?.client === "codex"
+  // Ownership requires the client and tenant to match on every leg; a manifest
+  // from another scope must neither authorize overwrites nor deletions.
+  const priorOwnsManagedFiles = priorUsesDiscoveryRoot
+    && prior?.client === client
     && prior?.tenantId === tenantId;
+  // A colliding artifact whose bytes match the recorded digest of a
+  // non-owning manifest is provably impel-generated (e.g. after a tenant
+  // scope-key drift), so reclaiming it cannot lose operator-authored content.
+  const reclaimable = (digestKey, destination) => {
+    const recorded = prior?.contentDigests?.[digestKey];
+    if (typeof recorded !== "string" || !recorded) return false;
+    try {
+      return contentDigest(fs.readFileSync(destination)) === recorded;
+    } catch {
+      return false;
+    }
+  };
 
   // Native clients discover standalone definitions directly under `agents/`.
   // Preflight every destination before writing so an unmanaged file with the
@@ -1343,12 +1364,13 @@ export function syncAgentProfile({
   for (const agent of rendered) {
     const destination = path.join(agentsDir, agent.fileName);
     if (fs.existsSync(destination)) {
-      if (!priorUsesDiscoveryRoot || !priorFiles.has(agent.fileName)) {
-        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
-      }
       if (fs.lstatSync(destination).isSymbolicLink()) {
         throw new Error(`refusing to overwrite symlinked native-agent file ${destination}`);
       }
+      if ((!priorOwnsManagedFiles || !priorFiles.has(agent.fileName))
+        && !reclaimable(`agents/${agent.fileName}`, destination)) {
+        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
+      }
     }
     if (client === "codex" && directProfiles) {
       const profileDestination = path.join(root, agent.profileFileName);
@@ -1356,7 +1378,8 @@ export function syncAgentProfile({
         if (fs.lstatSync(profileDestination).isSymbolicLink()) {
           throw new Error(`refusing to overwrite symlinked Codex profile ${profileDestination}`);
         }
-        if (!priorOwnsCodexProfiles || !priorProfiles.has(agent.profileFileName)) {
+        if ((!priorOwnsManagedFiles || !priorProfiles.has(agent.profileFileName))
+          && !reclaimable(agent.profileFileName, profileDestination)) {
           throw new Error(`refusing to overwrite unmanaged Codex profile ${profileDestination}`);
         }
       }
@@ -1370,20 +1393,29 @@ export function syncAgentProfile({
   const currentProfiles = new Set(client === "codex" && directProfiles
     ? rendered.map((agent) => agent.profileFileName)
     : []);
+  // Stale-file cleanup in the shared discovery root: an owning manifest's
+  // listing is authoritative, while a non-owning manifest (another tenant or
+  // a drifted scope) may only remove files it digest-proves impel wrote —
+  // native-profile roots are shared across tenants, so skipping cleanup
+  // entirely would orphan the previous tenant's agents forever, and deleting
+  // unproven listings could destroy another owner's live files. Legacy
+  // nested manifests only ever clean impel's private managed directory below.
+  const staleRemovable = (stale, digestKey, destination) =>
+    typeof stale === "string"
+    && path.basename(stale) === stale
+    && (priorOwnsManagedFiles || reclaimable(digestKey, destination));
   for (const stale of prior?.files || []) {
     if (
-      typeof stale === "string"
-      && path.basename(stale) === stale
+      staleRemovable(stale, `agents/${stale}`, path.join(agentsDir, stale))
       && !currentFiles.has(stale)
       && (stale.endsWith(".md") || stale.endsWith(".toml"))
     ) {
-      fs.rmSync(path.join(priorUsesDiscoveryRoot ? agentsDir : managedDir, stale), { force: true });
+      fs.rmSync(path.join(agentsDir, stale), { force: true });
     }
   }
-  for (const stale of priorOwnsCodexProfiles ? prior.profiles || [] : []) {
+  for (const stale of client === "codex" ? prior?.profiles || [] : []) {
     if (
-      typeof stale === "string"
-      && path.basename(stale) === stale
+      staleRemovable(stale, stale, path.join(root, stale))
       && stale.endsWith(".config.toml")
       && !currentProfiles.has(stale)
     ) {

package/src/apps.js

@@ -5,12 +5,14 @@ import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import {
+  enableManagedCodexDesktopCodeModeHost,
   enableManagedCodexDesktopMcpApps,
   hardenManagedCodexToml,
   secureAllManagedCodexHomes,
   secureManagedCodexHome,
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
+import { codexCatalogEntry } from "./modelCatalog.js";
 import {
   IMPEL_CLI_ENTRYPOINT,
   IMPEL_TASKS_MCP_SERVER_NAME,
@@ -132,15 +134,6 @@ export const PINNED_VENDOR_APPS = Object.freeze({
   }),
 });
 
-const STANDARD_REASONING_LEVELS = [
-  { effort: "low", description: "Fast responses with lighter reasoning" },
-  { effort: "medium", description: "Balances speed and reasoning depth for everyday tasks" },
-  { effort: "high", description: "Greater reasoning depth for complex problems" },
-  { effort: "xhigh", description: "Extra high reasoning depth for complex problems" },
-];
-const MAX_REASONING_LEVEL = { effort: "max", description: "Maximum reasoning depth for the hardest problems" };
-const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning with automatic task delegation" };
-const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
 const FAST_MODE_AUTH_GATE = /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)&&!([A-Za-z_$][\w$]*)&&([A-Za-z_$][\w$]*)!=null&&\4\?\.requirements\?\.featureRequirements\?\.fast_mode!==!1/gu;
 const CHATGPT_THREAD_START_PROVIDER = /serviceName:([A-Za-z_$][\w$]*)\.serviceName\?\?this\.options\.defaultServiceName,threadSource:\1\.threadSource===void 0\?`user`:\1\.threadSource/gu;
 const CHATGPT_THREAD_FORK_PROVIDER = /let ([A-Za-z_$][\w$]*)=\{\.\.\.([A-Za-z_$][\w$]*),threadSource:\2\.threadSource===void 0\?`user`:\2\.threadSource\}/gu;
@@ -157,6 +150,27 @@ const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(n
 const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof v?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
 const LEGACY_CLAUDE_SAFE_STORAGE_NAME = "Claude";
 const CLAUDE_SAFE_STORAGE_METADATA = "safe-storage.json";
+// The pinned Claude desktop build refuses remote debugging unless
+// process.env.CLAUDE_CDP_AUTH carries a token Ed25519-signed by the private
+// half of this baked-in public key: its main process runs
+// `eae(process.argv)&&!_9()&&process.exit(1)` where eae() is true for any
+// --remote-debugging-port/-pipe flag and _9() verifies CLAUDE_CDP_AUTH with
+// crypto.verify(null, `${ms}.${base64(userData)}`, createPublicKey(<key>),
+// sig). The exact PEM literal appears TWICE in the pinned ASAR (the
+// main-process gate and a shared utility chunk whose token verifiers reuse the
+// same anchor); both are the identical CDP-auth trust anchor. Swapping it to
+// the Impel key below lets the CI-isolated launch smoke drive the managed
+// bundle over CDP with a token signed by the matching private key (held only
+// in GitHub Actions secrets), which is required to verify pins by behavior
+// (docs/testing-protocol.md P0-1). This deliberately moves the managed
+// bundle's CDP trust anchor from Anthropic's key to an Impel CI-held key;
+// flagged for maintainer review in the PR. Both keys are Ed25519 SPKI PEM of
+// identical byte length, so the fixed-width ASAR swap preserves layout.
+const CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEApH/vaEiLV0sNY/eS+Ct/IMbMqw8i/vC/cNC84BAbBq8=\n-----END PUBLIC KEY-----";
+const IMPEL_CLAUDE_CDP_AUTH_PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAXG1l1V6YxCaH1Dbn27EIkeQjYU4urRx2aPrDwAULUfw=\n-----END PUBLIC KEY-----";
+// The pinned build embeds the anchor in exactly this many chunks. Fail closed
+// (no loose regex, no "best effort") if a vendor update changes the count.
+const CLAUDE_CDP_AUTH_KEY_COPIES = 2;
 // The pinned Claude renderer decides desktop-vs-web mode SOLELY by matching its
 // own Electron user-agent against /claude(nest|gov)?\/([^ ]+)/i (functions o_,
 // x_, i_ in ion-dist). Electron derives that UA product token from app.name as
@@ -192,21 +206,11 @@ function impelClaudeSafeStorageName(tenantId) {
 const escapedDisplayPrefix = RUNTIME_BRAND.apps.displayPrefix.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 const LEGACY_TRAPPED_CLAUDE_NAME = new RegExp(`^${escapedDisplayPrefix} Claude( \\[[^\\]]+\\])?$`, "u");
 
-export const FALLBACK_MODELS = [
-  { id: "claude-opus-5", provider: "claude", display_name: "Claude Opus 5", family: "opus", family_default: true, default: true, supports_1m: true, context_window: 1000000 },
-  { id: "claude-opus-4-8", provider: "claude", display_name: "Claude Opus 4.8", family: "opus", supports_1m: true, context_window: 1000000 },
-  { id: "claude-sonnet-5", provider: "claude", display_name: "Claude Sonnet 5", family: "sonnet", family_default: true, context_window: 200000 },
-  { id: "claude-sonnet-4-6", provider: "claude", display_name: "Claude Sonnet 4.6", family: "sonnet", context_window: 200000 },
-  { id: "claude-haiku-4-5", provider: "claude", display_name: "Claude Haiku 4.5", family: "haiku", family_default: true, context_window: 200000 },
-  { id: "claude-fable-5", provider: "claude", display_name: "Claude Fable 5", family: "fable", family_default: true, context_window: 200000 },
-  { id: "gpt-5.6-sol", provider: "codex", display_name: "GPT-5.6-Sol", description: "Latest frontier agentic coding model.", default: true, priority: 1, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
-  { id: "gpt-5.6-terra", provider: "codex", display_name: "GPT-5.6-Terra", description: "Balanced agentic coding model for everyday work.", priority: 2, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
-  { id: "gpt-5.6-luna", provider: "codex", display_name: "GPT-5.6-Luna", description: "Fast and affordable agentic coding model.", priority: 3, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v1" },
-  { id: "gpt-5.5", provider: "codex", display_name: "GPT-5.5", description: "Frontier model for complex coding, research, and real-world work.", priority: 7, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-  { id: "gpt-5.4", provider: "codex", display_name: "GPT-5.4", description: "Strong model for everyday coding.", priority: 16, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 1000000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-  { id: "gpt-5.4-mini", provider: "codex", display_name: "GPT-5.4-Mini", description: "Small, fast, and cost-efficient model for simpler coding tasks.", priority: 23, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-  { id: "gpt-5.3-codex-spark", provider: "codex", display_name: "GPT-5.3-Codex-Spark", description: "Ultra-fast coding model.", priority: 26, default_reasoning_level: "high", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 128000, max_context_window: 128000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-];
+// The shared model registry and Codex catalog projection live in
+// modelCatalog.js (a leaf module) so cliProfiles.js can consume them
+// without importing this module's launch-command cycle. Re-exported here
+// for the many existing consumers.
+export { FALLBACK_MODELS, managedCodexCliCatalog } from "./modelCatalog.js";
 
 export function normalizeAppTarget(value) {
   if (value == null || value === "all") return ["claude", "chatgpt"];
@@ -290,7 +294,14 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // and install Claude task, notification, and permission lifecycle hooks.
 // 32: install a persistent tenant-bound Tasks navigation surface in the
 // managed Claude and ChatGPT/Codex desktop wrappers.
-export const CURRENT_CONFIG_VERSION = 32;
+// 33: size the Codex verbatim-relay parent wait to outlast the child's
+// native-agent attachment window so the visible working span is not
+// truncated while the child is still running.
+// 34: isolate fixed-binding Codex profiles from local and remote host plugins.
+// 35: enable the Code Mode host in managed desktop profiles (pinned Codex
+// fails closed on code_mode_only models without it) and serve CLI model
+// catalogs from the shared registry so efforts and tiers cannot drift.
+export const CURRENT_CONFIG_VERSION = 35;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -299,7 +310,7 @@ export const CURRENT_CONFIG_VERSION = 32;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.4";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.5";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -423,6 +434,7 @@ const CLAUDE_COMPATIBILITY_PATCH_KEYS = Object.freeze([
   "followupBoundAgentFilter",
   "followupBoundAgentChip",
   "desktopTasksPreload",
+  "cdpAuthKey",
 ]);
 const CLAUDE_COMPATIBILITY_RENDERER_GROUPS = Object.freeze(["agentMentions"]);
 
@@ -1426,7 +1438,10 @@ function writeChatGPTConfig(
   const hardenedToml = hardenManagedCodexToml(mergedToml, configPath);
   writeAtomic(
     configPath,
-    enableManagedCodexDesktopMcpApps(hardenedToml, configPath),
+    enableManagedCodexDesktopCodeModeHost(
+      enableManagedCodexDesktopMcpApps(hardenedToml, configPath),
+      configPath,
+    ),
     0o600,
   );
   secureManagedCodexHome(paths.chatgpt.codexHome);
@@ -1515,60 +1530,6 @@ export function foreignClaudeCodexCatalogEntry(model, index) {
   };
 }
 
-function codexCatalogEntry(model, index, vendorModel) {
-  const generated = {
-    slug: model.id,
-    display_name: model.display_name || model.id,
-    description: `Available through the Impel gateway (${model.id}).`,
-    default_reasoning_level: "medium",
-    supported_reasoning_levels: STANDARD_REASONING_LEVELS,
-    shell_type: "shell_command",
-    visibility: "list",
-    supported_in_api: true,
-    priority: index + 1,
-    base_instructions: "You are Codex, an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
-    include_skills_usage_instructions: false,
-    supports_reasoning_summaries: true,
-    default_reasoning_summary: "none",
-    support_verbosity: true,
-    default_verbosity: "low",
-    apply_patch_tool_type: "freeform",
-    web_search_tool_type: "text_and_image",
-    truncation_policy: { mode: "tokens", limit: 10000 },
-    context_window: model.context_window || 200000,
-    max_context_window: model.context_window || 200000,
-    effective_context_window_percent: 95,
-    experimental_supported_tools: [],
-    input_modalities: ["text", "image"],
-    supports_parallel_tool_calls: true,
-    supports_image_detail_original: true,
-    supports_search_tool: true,
-    use_responses_lite: false,
-    tool_mode: null,
-    multi_agent_version: null,
-  };
-  const entry = vendorModel ? { ...generated, ...vendorModel } : generated;
-  return {
-    ...entry,
-    slug: model.id,
-    display_name: model.display_name || entry.display_name || model.id,
-    description: model.description || entry.description,
-    default_reasoning_level: model.default_reasoning_level || entry.default_reasoning_level,
-    supported_reasoning_levels: Array.isArray(model.supported_reasoning_levels)
-      ? model.supported_reasoning_levels
-      : entry.supported_reasoning_levels,
-    service_tiers: Array.isArray(model.service_tiers) ? model.service_tiers : (entry.service_tiers || []),
-    visibility: "list",
-    supported_in_api: true,
-    priority: Number.isInteger(model.priority) ? model.priority : (entry.priority || index + 1),
-    context_window: model.context_window || entry.context_window || 200000,
-    max_context_window: model.max_context_window || entry.max_context_window || model.context_window || 200000,
-    ...(typeof model.use_responses_lite === "boolean" ? { use_responses_lite: model.use_responses_lite } : {}),
-    ...(Object.hasOwn(model, "tool_mode") ? { tool_mode: model.tool_mode } : {}),
-    ...(Object.hasOwn(model, "multi_agent_version") ? { multi_agent_version: model.multi_agent_version } : {}),
-  };
-}
-
 function readVendorCodexModels(vendorPath) {
   const binary = vendorPath && path.join(vendorPath, "Contents", "Resources", "codex");
   if (!binary || !fs.existsSync(binary)) return new Map();
@@ -1633,9 +1594,31 @@ export function managedChatGPTConfigDrifted(paths) {
   } catch {
     return false; // No managed profile; install/update owns creating one.
   }
+  // The [features] table lives outside the managed block — exactly the
+  // surface the vendor settings writer rewrites. code_mode_host is
+  // load-bearing: without it pinned Codex fails closed on the code_mode_only
+  // default model, so a dropped key must self-heal as drift rather than wait
+  // out the refresh TTL. enable_mcp_apps only degrades rendering but rides
+  // the same check. Configs from generations before the keys existed are
+  // merely stale (the manifest version bump rewrites them), never drift —
+  // require the keys only once this install's manifest proves they were
+  // written.
+  let manifestConfigVersion = 0;
+  try {
+    manifestConfigVersion = Number(JSON.parse(
+      fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8"),
+    )?.configVersion) || 0;
+  } catch {
+    // Without a readable manifest the version gate stays closed.
+  }
+  const featuresTable = current.match(/^\[features\]\n(?:[^[\n][^\n]*\n|\n)*/mu)?.[0] || "";
+  const featureKeysDropped = manifestConfigVersion >= 35
+    && (!/^code_mode_host = true$/mu.test(featuresTable)
+      || !/^enable_mcp_apps = true$/mu.test(featuresTable));
   return !current.includes(CHATGPT_CONFIG_START)
     || readTopLevelTomlString(current, "model_provider") !== RUNTIME_BRAND.cli.providerId
-    || !readTopLevelTomlString(current, "chatgpt_base_url");
+    || !readTopLevelTomlString(current, "chatgpt_base_url")
+    || featureKeysDropped;
 }
 
 function readTopLevelTomlString(toml, key) {
@@ -1659,6 +1642,187 @@ function removeTopLevelTomlString(toml, key) {
   return topLevel + toml.slice(topLevelEnd);
 }
 
+/** Read one co-owned JSON artifact; distinguishes "absent" from "corrupt". */
+function readManagedJsonArtifact(filePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf8");
+  } catch {
+    return { present: false, value: null };
+  }
+  try {
+    const value = JSON.parse(raw);
+    return {
+      present: true,
+      value: value && typeof value === "object" && !Array.isArray(value) ? value : null,
+    };
+  } catch {
+    return { present: true, value: null };
+  }
+}
+
+// Mirrors the session-hook installer's tenant gate (sessionHooks.js
+// validTenantId): hooks are only ever written for ids matching this shape, so
+// the drift check must not demand them for ids the installer skipped.
+const SESSION_HOOK_TENANT_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+
+/** Whether the managed session-hook heal channel survives in settings.json. */
+function claudeSettingsCarrySessionHooks(settings) {
+  const hooks = settings.hooks;
+  if (!hooks || typeof hooks !== "object" || Array.isArray(hooks)) return false;
+  const marker = `--${RUNTIME_BRAND.cli.command}-managed-session-hook-v1`;
+  return Object.values(hooks).some((groups) => Array.isArray(groups) && groups.some((group) => (
+    Array.isArray(group?.hooks) && group.hooks.some((handler) => (
+      (Array.isArray(handler?.args) && handler.args.includes(marker))
+      || (typeof handler?.command === "string" && handler.command.includes(marker))
+    ))
+  )));
+}
+
+/**
+ * True when a managed Claude profile exists but its artifacts no longer carry
+ * the load-bearing managed keys. Claude Desktop and the embedded Claude Code
+ * runtime co-own these files and rewrite them with their own settings writers,
+ * which normalize away optional fields (the persisted Tasks MCP entry loses
+ * `type: "stdio"`), reorder keys, and reformat whitespace. Those cosmetic
+ * rewrites are NOT drift — ownership recognition tolerates them through
+ * isImpelTasksMcpInvocation, and every check parses JSON rather than comparing
+ * bytes — but a lost or overwritten managed key (gateway routing config, the
+ * applied configLibrary selection, the 3P deployment selection, the
+ * tenant-bound Tasks MCP entry, the session-hook heal channel, the managed
+ * sandbox policy) is real drift. Stale-only refreshes treat it as staleness so
+ * the profile heals immediately instead of waiting out the manifest TTL.
+ * The content-based mirror of managedChatGPTConfigDrifted for the Claude
+ * target; like it, this never keys on TTLs or timestamps.
+ */
+export function managedClaudeConfigDrifted(paths) {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8"));
+  } catch {
+    return false; // No managed install; install/update owns creating one.
+  }
+  if (!Array.isArray(manifest?.targets) || !manifest.targets.includes("claude")) return false;
+  const tenantId = typeof manifest.tenantId === "string" && manifest.tenantId
+    ? manifest.tenantId
+    : null;
+
+  // configLibrary: the gateway inference routing the desktop app applies. A
+  // profile that loses it (or its provider/base-url/api-key wiring) no longer
+  // routes inference through the Impel gateway at all.
+  const configLibrary = readManagedJsonArtifact(
+    path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`),
+  );
+  if (
+    !configLibrary.value
+    || configLibrary.value.inferenceProvider !== "gateway"
+    || typeof configLibrary.value.inferenceGatewayBaseUrl !== "string"
+    || !configLibrary.value.inferenceGatewayBaseUrl
+    || typeof configLibrary.value.inferenceGatewayApiKey !== "string"
+    || !configLibrary.value.inferenceGatewayApiKey
+  ) {
+    return true;
+  }
+  const meta = readManagedJsonArtifact(path.join(paths.claude.userData, "configLibrary", "_meta.json"));
+  if (!meta.value || meta.value.appliedId !== CLAUDE_CONFIG_ID) return true;
+
+  // claude_desktop_config.json: the native 3P selection plus the tenant-bound
+  // Tasks MCP entry. Claude Desktop persists this file itself, without the
+  // optional `type` field and with its own key order — that vendor-normalized
+  // form must keep counting as ours (the 0.20.1 repair-refusal regression).
+  const desktop = readManagedJsonArtifact(path.join(paths.claude.userData, "claude_desktop_config.json"));
+  if (!desktop.value || desktop.value.deploymentMode !== "3p") return true;
+  if (RUNTIME_BRAND.features.mcp && tenantId) {
+    const servers = desktop.value.mcpServers;
+    const tasksEntry = servers && typeof servers === "object" && !Array.isArray(servers)
+      ? servers[IMPEL_TASKS_MCP_SERVER_NAME]
+      : undefined;
+    if (!isImpelTasksMcpInvocation(tasksEntry)) return true;
+  }
+
+  // settings.json: the managed sandbox policy and the session-hook heal
+  // channel. The hooks are the only Impel code guaranteed to run while the
+  // profile is broken, so losing them kills the self-repair path itself.
+  const settings = readManagedJsonArtifact(path.join(paths.claude.userData, "settings.json"));
+  if (!settings.value || settings.value.sandbox?.enabled !== false) return true;
+  if (
+    RUNTIME_BRAND.features.sessions
+    && tenantId
+    && SESSION_HOOK_TENANT_RE.test(tenantId)
+    && !claudeSettingsCarrySessionHooks(settings.value)
+  ) {
+    return true;
+  }
+  return false;
+}
+
+/** Distinct exit code for a failed managed-runtime preflight (EX_CONFIG). */
+export const MANAGED_RUNTIME_PREFLIGHT_EXIT_CODE = 78;
+
+function runtimeRepairInstruction(compatibility) {
+  const command = RUNTIME_BRAND.cli.command;
+  const tenantSource = `${compatibility.codexHome || ""}${compatibility.profileRoot || ""}`;
+  const tenantId = tenantSource.match(/[\\/]tenants[\\/]([^\\/]+)[\\/]/u)?.[1] || null;
+  return `run \`${command} update\` or \`${command} app refresh${tenantId ? ` --tenant ${tenantId}` : ""}\` to repair it`;
+}
+
+/**
+ * Runtime-presence preflight for the managed-launch seam: before a managed
+ * launcher is handed to the OS, require the vendored runtime it embeds to
+ * exist at the version this CLI pins (the v0.20.32 exit-127 rule: a pin bump
+ * that outruns the installed runtime must fail with one actionable line and a
+ * distinct exit code, never a bare ENOENT/127 crash). Checks are cheap —
+ * Impel's own build metadata, file existence, and the existing plist
+ * version-read helper; no binary is spawned. Bundles without Impel build
+ * metadata are not judged (the OS reports its own launch failure), so
+ * non-managed behavior is unchanged.
+ */
+export function managedRuntimePreflight(launcher, { pins = PINNED_VENDOR_APPS } = {}) {
+  const compatibility = readBundleCompatibility(launcher);
+  if (!compatibility) return { ok: true, checked: false };
+  const target = compatibility.codexHome ? "chatgpt" : "claude";
+  const pin = pins[target];
+  if (!pin) return { ok: true, checked: false };
+  const command = RUNTIME_BRAND.cli.command;
+  const repair = runtimeRepairInstruction(compatibility);
+  const fail = (message) => ({ ok: false, checked: true, target, message: `${command} app: ${message}; ${repair}` });
+
+  if (target === "claude") {
+    let executable = null;
+    try {
+      const plist = fs.readFileSync(path.join(launcher, "Contents", "Info.plist"), "utf8");
+      executable = plist.match(/<key>CFBundleExecutable<\/key>\s*<string>([^<]+)<\/string>/u)?.[1] || null;
+    } catch {
+      executable = null;
+    }
+    const binary = executable ? path.join(launcher, "Contents", "MacOS", executable) : null;
+    if (!binary || !fs.existsSync(binary)) {
+      return fail(`managed Claude runtime binary is missing at ${binary || path.join(launcher, "Contents", "MacOS")} (pinned ${pin.version})`);
+    }
+    const found = bundleVersion(launcher);
+    if (found !== pin.version) {
+      return fail(`managed Claude runtime is version ${found || "unknown"} at ${launcher}, but this CLI pins ${pin.version}`);
+    }
+    return { ok: true, checked: true, target };
+  }
+
+  const embedded = APP_DEFINITIONS.chatgpt.names
+    .map((name) => path.join(launcher, "Contents", "Resources", name))
+    .find((candidate) => fs.existsSync(candidate));
+  if (!embedded) {
+    return fail(`managed ChatGPT runtime bundle is missing under ${path.join(launcher, "Contents", "Resources")} (pinned ${pin.version})`);
+  }
+  const codexBinary = path.join(embedded, "Contents", "Resources", "codex");
+  if (!fs.existsSync(codexBinary)) {
+    return fail(`managed Codex runtime binary is missing at ${codexBinary} (pinned codex-cli ${pin.codexVersion})`);
+  }
+  const found = bundleVersion(embedded);
+  if (found !== pin.version) {
+    return fail(`managed ChatGPT runtime is version ${found || "unknown"} at ${embedded}, but this CLI pins ${pin.version} (codex-cli ${pin.codexVersion})`);
+  }
+  return { ok: true, checked: true, target };
+}
+
 /**
  * Rewrite one tenant's app token helper with the current node/CLI paths.
  * Cheap and Impel-owned, so install recovery can use it to heal helpers whose
@@ -1768,6 +1932,7 @@ function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStor
     }
     const safeStorageNamePatchCount = patchClaudeSafeStorageName(asarPath);
     const desktopTasksPreloadPatchCount = patchDesktopTasksPreload(asarPath, "claude");
+    const cdpAuthKeyPatchCount = patchClaudeCdpAuthKey(asarPath);
     const newAsarHash = asarHeaderHash(asarPath);
 
     updateBundleIdentity(plistPath, {
@@ -1824,6 +1989,7 @@ function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStor
         followupBoundAgentFilter: agentMentionPatches.filter,
         followupBoundAgentChip: agentMentionPatches.chip,
         desktopTasksPreload: desktopTasksPreloadPatchCount,
+        cdpAuthKey: cdpAuthKeyPatchCount,
       },
       rendererAssets: {
         agentMentions: agentMentionPatches.assets,
@@ -2200,6 +2366,28 @@ function patchClaudeSafeStorageName(asarPath) {
   return applyFixedWidthAsarPatches(asarPath, archive, patches, "Claude Safe Storage app name");
 }
 
+// Replace the baked-in CDP-auth trust anchor with the Impel key so the
+// CI-isolated launch smoke can drive the managed bundle over CDP with a token
+// signed by the matching (Actions-secret-held) private key. Fail closed on any
+// count other than the exact pinned number of copies, and let the shared
+// fixed-width helper enforce byte-length parity (both keys are Ed25519 SPKI
+// PEM of equal length) so the ASAR layout is preserved.
+function patchClaudeCdpAuthKey(asarPath) {
+  const source = fs.readFileSync(asarPath).toString("latin1");
+  const occurrences = exactTextMatchCount(source, CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY);
+  if (occurrences !== CLAUDE_CDP_AUTH_KEY_COPIES) {
+    throw new Error(
+      `Claude CDP-auth trust-anchor patch expected ${CLAUDE_CDP_AUTH_KEY_COPIES} vendor key copies, found ${occurrences}`,
+    );
+  }
+  return patchFixedWidthAsarString(
+    asarPath,
+    CLAUDE_CDP_AUTH_VENDOR_PUBLIC_KEY,
+    IMPEL_CLAUDE_CDP_AUTH_PUBLIC_KEY,
+    "Claude CDP-auth trust anchor",
+  );
+}
+
 function patchFastModeAuthGate(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");

package/src/cliProfiles.js

@@ -21,7 +21,7 @@ import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
-import { managedCodexCliCatalog } from "./codexCliCatalog.js";
+import { managedCodexCliCatalog } from "./modelCatalog.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
 export const CODEX_GATEWAY_TOKEN_ENV = `${RUNTIME_BRAND.cli.providerId

package/src/codexSecurity.js

@@ -166,6 +166,27 @@ export function enableManagedCodexDesktopMcpApps(
   );
 }
 
+/**
+ * Enable the Code Mode execution host in the exact pinned desktop profile.
+ * Pinned Codex fails closed when a code_mode_only model is selected while
+ * this feature is disabled, and the managed bundle ships the signed
+ * codex-code-mode-host companion. CLI launches receive the equivalent
+ * `-c features.code_mode_host=true` runtime override; the desktop app spawns
+ * Codex directly and must carry the flag in its generated config.
+ */
+export function enableManagedCodexDesktopCodeModeHost(
+  toml,
+  configPath = "managed Codex desktop config",
+) {
+  return upsertManagedScalar(
+    toml,
+    "features",
+    "code_mode_host",
+    "true",
+    configPath,
+  );
+}
+
 function assertSafeManagedPath(target, expectedType) {
   const stat = lstatOrNull(target);
   if (!stat) return null;