impel-cli 0.20.39 → 0.20.41

package/RELEASE_NOTES.md

@@ -1,5 +1,47 @@
 # Release notes
 
+## 0.20.41 — Windows onboarding: converge over an already-installed Store ChatGPT
+
+- Accepts winget's UPDATE_NOT_APPLICABLE result during setup as well as
+  update, gated by the pin-exact package probe, ending the unconvergeable
+  first-run failure loop on machines where the ChatGPT Store app already
+  exists (and, downstream, the managed sign-in loop it caused).
+- Registers a machine-wide staged Store package for the current user
+  (download-free, no elevation) when winget sees it but the per-user probe
+  does not, still failing closed through the pin-exact probe.
+- Resolves the app-open path strictly through the pinned finder so an
+  off-pin Store build can never be staged as the managed app.
+- Names installed-vs-pinned versions in vendor-install diagnostics with a
+  measured direction, adds the 0x8A15002B winget hint, and makes Windows
+  status require the staged managed app rather than config presence alone.
+
+## 0.20.40 — Field-report fixes: launcher drift, sync ownership, Codex capability, one-run update
+
+- Survives Claude auto-update drift: `impel claude` resolves the exact reviewed
+  release from the installer's side-by-side layout instead of exiting 127 when
+  the vendor updater moves the shared symlink; setup/update detection shares
+  the same resolution, ending the reinstall loop.
+- Makes `impel agents sync` ownership symmetric across Claude and Codex with
+  digest-proven reclaim: manifest scope drift self-heals, operator-edited
+  files still refuse fail-closed, non-owning manifests can no longer delete
+  another tenant's files, and shared roots converge on tenant switch.
+- Unstrands answer-mode adapters: retrying the answer call is permitted only
+  before a continuation exists, continuation ids tolerate case drift, and the
+  invalid-handle error now says what to pass instead.
+- Restores Codex capability in the managed app and CLI: the generated desktop
+  profile enables the Code Mode host (pinned Codex fails closed on
+  code_mode_only models without it, hiding the 5.6 family with its max/ultra
+  efforts and Fast tier), the CLI model catalog is served from the same
+  registry as the desktop (max/ultra/Fast restored), and a dropped
+  code_mode_host key now self-heals as drift on current installs.
+- Sizes the Codex verbatim-relay parent wait from the child's attachment
+  window so visible working time is no longer truncated, and direct answers
+  emit progress notifications.
+- Converges `impel update` in one run: npm-prefix skew hands convergence to
+  the verified freshly installed entrypoint instead of aborting after a
+  partial update, and install-recovery re-probes live state so completed
+  steps are never re-issued.
+
 ## 0.20.39 — Isolate fixed Codex agent adapters
 
 - Disables local and remote plugin loading, locally built plugin sharing, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.39",
+  "version": "0.20.41",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -5,12 +5,14 @@ import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import {
+  enableManagedCodexDesktopCodeModeHost,
   enableManagedCodexDesktopMcpApps,
   hardenManagedCodexToml,
   secureAllManagedCodexHomes,
   secureManagedCodexHome,
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
+import { codexCatalogEntry } from "./modelCatalog.js";
 import {
   IMPEL_CLI_ENTRYPOINT,
   IMPEL_TASKS_MCP_SERVER_NAME,
@@ -132,15 +134,6 @@ export const PINNED_VENDOR_APPS = Object.freeze({
   }),
 });
 
-const STANDARD_REASONING_LEVELS = [
-  { effort: "low", description: "Fast responses with lighter reasoning" },
-  { effort: "medium", description: "Balances speed and reasoning depth for everyday tasks" },
-  { effort: "high", description: "Greater reasoning depth for complex problems" },
-  { effort: "xhigh", description: "Extra high reasoning depth for complex problems" },
-];
-const MAX_REASONING_LEVEL = { effort: "max", description: "Maximum reasoning depth for the hardest problems" };
-const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning with automatic task delegation" };
-const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
 const FAST_MODE_AUTH_GATE = /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)&&!([A-Za-z_$][\w$]*)&&([A-Za-z_$][\w$]*)!=null&&\4\?\.requirements\?\.featureRequirements\?\.fast_mode!==!1/gu;
 const CHATGPT_THREAD_START_PROVIDER = /serviceName:([A-Za-z_$][\w$]*)\.serviceName\?\?this\.options\.defaultServiceName,threadSource:\1\.threadSource===void 0\?`user`:\1\.threadSource/gu;
 const CHATGPT_THREAD_FORK_PROVIDER = /let ([A-Za-z_$][\w$]*)=\{\.\.\.([A-Za-z_$][\w$]*),threadSource:\2\.threadSource===void 0\?`user`:\2\.threadSource\}/gu;
@@ -213,21 +206,11 @@ function impelClaudeSafeStorageName(tenantId) {
 const escapedDisplayPrefix = RUNTIME_BRAND.apps.displayPrefix.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 const LEGACY_TRAPPED_CLAUDE_NAME = new RegExp(`^${escapedDisplayPrefix} Claude( \\[[^\\]]+\\])?$`, "u");
 
-export const FALLBACK_MODELS = [
-  { id: "claude-opus-5", provider: "claude", display_name: "Claude Opus 5", family: "opus", family_default: true, default: true, supports_1m: true, context_window: 1000000 },
-  { id: "claude-opus-4-8", provider: "claude", display_name: "Claude Opus 4.8", family: "opus", supports_1m: true, context_window: 1000000 },
-  { id: "claude-sonnet-5", provider: "claude", display_name: "Claude Sonnet 5", family: "sonnet", family_default: true, context_window: 200000 },
-  { id: "claude-sonnet-4-6", provider: "claude", display_name: "Claude Sonnet 4.6", family: "sonnet", context_window: 200000 },
-  { id: "claude-haiku-4-5", provider: "claude", display_name: "Claude Haiku 4.5", family: "haiku", family_default: true, context_window: 200000 },
-  { id: "claude-fable-5", provider: "claude", display_name: "Claude Fable 5", family: "fable", family_default: true, context_window: 200000 },
-  { id: "gpt-5.6-sol", provider: "codex", display_name: "GPT-5.6-Sol", description: "Latest frontier agentic coding model.", default: true, priority: 1, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
-  { id: "gpt-5.6-terra", provider: "codex", display_name: "GPT-5.6-Terra", description: "Balanced agentic coding model for everyday work.", priority: 2, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
-  { id: "gpt-5.6-luna", provider: "codex", display_name: "GPT-5.6-Luna", description: "Fast and affordable agentic coding model.", priority: 3, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v1" },
-  { id: "gpt-5.5", provider: "codex", display_name: "GPT-5.5", description: "Frontier model for complex coding, research, and real-world work.", priority: 7, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-  { id: "gpt-5.4", provider: "codex", display_name: "GPT-5.4", description: "Strong model for everyday coding.", priority: 16, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 1000000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-  { id: "gpt-5.4-mini", provider: "codex", display_name: "GPT-5.4-Mini", description: "Small, fast, and cost-efficient model for simpler coding tasks.", priority: 23, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-  { id: "gpt-5.3-codex-spark", provider: "codex", display_name: "GPT-5.3-Codex-Spark", description: "Ultra-fast coding model.", priority: 26, default_reasoning_level: "high", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 128000, max_context_window: 128000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
-];
+// The shared model registry and Codex catalog projection live in
+// modelCatalog.js (a leaf module) so cliProfiles.js can consume them
+// without importing this module's launch-command cycle. Re-exported here
+// for the many existing consumers.
+export { FALLBACK_MODELS, managedCodexCliCatalog } from "./modelCatalog.js";
 
 export function normalizeAppTarget(value) {
   if (value == null || value === "all") return ["claude", "chatgpt"];
@@ -315,7 +298,10 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // native-agent attachment window so the visible working span is not
 // truncated while the child is still running.
 // 34: isolate fixed-binding Codex profiles from local and remote host plugins.
-export const CURRENT_CONFIG_VERSION = 34;
+// 35: enable the Code Mode host in managed desktop profiles (pinned Codex
+// fails closed on code_mode_only models without it) and serve CLI model
+// catalogs from the shared registry so efforts and tiers cannot drift.
+export const CURRENT_CONFIG_VERSION = 35;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -1452,7 +1438,10 @@ function writeChatGPTConfig(
   const hardenedToml = hardenManagedCodexToml(mergedToml, configPath);
   writeAtomic(
     configPath,
-    enableManagedCodexDesktopMcpApps(hardenedToml, configPath),
+    enableManagedCodexDesktopCodeModeHost(
+      enableManagedCodexDesktopMcpApps(hardenedToml, configPath),
+      configPath,
+    ),
     0o600,
   );
   secureManagedCodexHome(paths.chatgpt.codexHome);
@@ -1541,60 +1530,6 @@ export function foreignClaudeCodexCatalogEntry(model, index) {
   };
 }
 
-function codexCatalogEntry(model, index, vendorModel) {
-  const generated = {
-    slug: model.id,
-    display_name: model.display_name || model.id,
-    description: `Available through the Impel gateway (${model.id}).`,
-    default_reasoning_level: "medium",
-    supported_reasoning_levels: STANDARD_REASONING_LEVELS,
-    shell_type: "shell_command",
-    visibility: "list",
-    supported_in_api: true,
-    priority: index + 1,
-    base_instructions: "You are Codex, an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
-    include_skills_usage_instructions: false,
-    supports_reasoning_summaries: true,
-    default_reasoning_summary: "none",
-    support_verbosity: true,
-    default_verbosity: "low",
-    apply_patch_tool_type: "freeform",
-    web_search_tool_type: "text_and_image",
-    truncation_policy: { mode: "tokens", limit: 10000 },
-    context_window: model.context_window || 200000,
-    max_context_window: model.context_window || 200000,
-    effective_context_window_percent: 95,
-    experimental_supported_tools: [],
-    input_modalities: ["text", "image"],
-    supports_parallel_tool_calls: true,
-    supports_image_detail_original: true,
-    supports_search_tool: true,
-    use_responses_lite: false,
-    tool_mode: null,
-    multi_agent_version: null,
-  };
-  const entry = vendorModel ? { ...generated, ...vendorModel } : generated;
-  return {
-    ...entry,
-    slug: model.id,
-    display_name: model.display_name || entry.display_name || model.id,
-    description: model.description || entry.description,
-    default_reasoning_level: model.default_reasoning_level || entry.default_reasoning_level,
-    supported_reasoning_levels: Array.isArray(model.supported_reasoning_levels)
-      ? model.supported_reasoning_levels
-      : entry.supported_reasoning_levels,
-    service_tiers: Array.isArray(model.service_tiers) ? model.service_tiers : (entry.service_tiers || []),
-    visibility: "list",
-    supported_in_api: true,
-    priority: Number.isInteger(model.priority) ? model.priority : (entry.priority || index + 1),
-    context_window: model.context_window || entry.context_window || 200000,
-    max_context_window: model.max_context_window || entry.max_context_window || model.context_window || 200000,
-    ...(typeof model.use_responses_lite === "boolean" ? { use_responses_lite: model.use_responses_lite } : {}),
-    ...(Object.hasOwn(model, "tool_mode") ? { tool_mode: model.tool_mode } : {}),
-    ...(Object.hasOwn(model, "multi_agent_version") ? { multi_agent_version: model.multi_agent_version } : {}),
-  };
-}
-
 function readVendorCodexModels(vendorPath) {
   const binary = vendorPath && path.join(vendorPath, "Contents", "Resources", "codex");
   if (!binary || !fs.existsSync(binary)) return new Map();
@@ -1659,9 +1594,31 @@ export function managedChatGPTConfigDrifted(paths) {
   } catch {
     return false; // No managed profile; install/update owns creating one.
   }
+  // The [features] table lives outside the managed block — exactly the
+  // surface the vendor settings writer rewrites. code_mode_host is
+  // load-bearing: without it pinned Codex fails closed on the code_mode_only
+  // default model, so a dropped key must self-heal as drift rather than wait
+  // out the refresh TTL. enable_mcp_apps only degrades rendering but rides
+  // the same check. Configs from generations before the keys existed are
+  // merely stale (the manifest version bump rewrites them), never drift —
+  // require the keys only once this install's manifest proves they were
+  // written.
+  let manifestConfigVersion = 0;
+  try {
+    manifestConfigVersion = Number(JSON.parse(
+      fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8"),
+    )?.configVersion) || 0;
+  } catch {
+    // Without a readable manifest the version gate stays closed.
+  }
+  const featuresTable = current.match(/^\[features\]\n(?:[^[\n][^\n]*\n|\n)*/mu)?.[0] || "";
+  const featureKeysDropped = manifestConfigVersion >= 35
+    && (!/^code_mode_host = true$/mu.test(featuresTable)
+      || !/^enable_mcp_apps = true$/mu.test(featuresTable));
   return !current.includes(CHATGPT_CONFIG_START)
     || readTopLevelTomlString(current, "model_provider") !== RUNTIME_BRAND.cli.providerId
-    || !readTopLevelTomlString(current, "chatgpt_base_url");
+    || !readTopLevelTomlString(current, "chatgpt_base_url")
+    || featureKeysDropped;
 }
 
 function readTopLevelTomlString(toml, key) {

package/src/cliProfiles.js

@@ -21,7 +21,7 @@ import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
-import { managedCodexCliCatalog } from "./codexCliCatalog.js";
+import { managedCodexCliCatalog } from "./modelCatalog.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
 export const CODEX_GATEWAY_TOKEN_ENV = `${RUNTIME_BRAND.cli.providerId

package/src/codexSecurity.js

@@ -166,6 +166,27 @@ export function enableManagedCodexDesktopMcpApps(
   );
 }
 
+/**
+ * Enable the Code Mode execution host in the exact pinned desktop profile.
+ * Pinned Codex fails closed when a code_mode_only model is selected while
+ * this feature is disabled, and the managed bundle ships the signed
+ * codex-code-mode-host companion. CLI launches receive the equivalent
+ * `-c features.code_mode_host=true` runtime override; the desktop app spawns
+ * Codex directly and must carry the flag in its generated config.
+ */
+export function enableManagedCodexDesktopCodeModeHost(
+  toml,
+  configPath = "managed Codex desktop config",
+) {
+  return upsertManagedScalar(
+    toml,
+    "features",
+    "code_mode_host",
+    "true",
+    configPath,
+  );
+}
+
 function assertSafeManagedPath(target, expectedType) {
   const stat = lstatOrNull(target);
   if (!stat) return null;

package/src/commands/apps.js

@@ -55,6 +55,7 @@ import {
   findWindowsChatGPTApp,
   findManagedWindowsChatGPTApp,
   launchWindowsClaudeApp,
+  pinnedWindowsChatGPTApp,
   launchWindowsChatGPTApp,
   removeManagedWindowsChatGPTApp,
   stageWindowsChatGPTApp,
@@ -280,6 +281,7 @@ const WINGET_EXIT_HINTS = new Map([
   [0x8A150014, "no package matched the winget query"],
   [0x8A15001B, "the Microsoft Store client is blocked by policy"],
   [0x8A15001C, "the Microsoft Store app is blocked by policy"],
+  [0x8A15002B, "a Store package is already installed but does not match the reviewed pin — its version likely moved past the pinned release"],
 ]);
 
 function windowsProcessFailure(result) {
@@ -380,7 +382,7 @@ export async function reconcileWindowsTenantApps({
     findClaudeApp: findWindowsClaudeApp,
     ensureClaudeApp: ensureWindowsClaudeApp,
     claudeUserData: windowsClaudeUserData,
-    findChatGPTApp: findWindowsChatGPTApp,
+    findChatGPTApp: (environment) => pinnedWindowsChatGPTApp(environment),
     ensureChatGPTApp: ensureWindowsChatGPTApp,
     findManagedChatGPTApp: findManagedWindowsChatGPTApp,
     stageChatGPTApp: stageWindowsChatGPTApp,
@@ -664,7 +666,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     ensureClaudeApp: ensureWindowsClaudeApp,
     launchClaudeApp: launchWindowsClaudeApp,
     claudeUserData: windowsClaudeUserData,
-    findChatGPTApp: findWindowsChatGPTApp,
+    findChatGPTApp: (environment) => pinnedWindowsChatGPTApp(environment),
     ensureChatGPTApp: ensureWindowsChatGPTApp,
     findManagedChatGPTApp: findManagedWindowsChatGPTApp,
     launchChatGPTApp: launchWindowsChatGPTApp,

package/src/commands/converge.js

@@ -214,7 +214,23 @@ export async function cmdConverge(argv = [], overrides = {}) {
       goals: [{
         id: "shared-vendor-clis-ready",
         description: "Shared vendor CLI prerequisites are installed and discoverable",
-        run: () => sharedReady,
+        // Live probe, not a session snapshot: a vendor CLI installed outside
+        // this process (for example by the user in another terminal while the
+        // recovery session runs) must count as complete the moment the goal
+        // is evaluated, so recovery never re-issues an already-finished step.
+        run: async () => {
+          if (sharedReady) return true;
+          const prepared = await io.preparePlatformClis({
+            gatewayUrl: config.gatewayUrl,
+            tenantId: selected.id,
+            platform: io.platform,
+            skipInstall: true,
+            // Goals re-run before every system-risk step: the probe must be
+            // pure discovery — no installs, profile writes, or skill syncs.
+            inspectOnly: true,
+          });
+          return prepared.missingAfter.length === 0;
+        },
       }],
       explicit: true,
       noRecovery: false,

package/src/commands/setup.js

@@ -370,7 +370,23 @@ export async function cmdSetup(argv, overrides = {}) {
       goals: [{
         id: "shared-vendor-clis-ready",
         description: "Shared vendor CLI prerequisites are installed and discoverable",
-        run: () => sharedReady,
+        // Live probe, not a session snapshot: a vendor CLI installed outside
+        // this process (for example by the user in another terminal while the
+        // recovery session runs) must count as complete the moment the goal
+        // is evaluated, so recovery never re-issues an already-finished step.
+        run: async () => {
+          if (sharedReady) return true;
+          const prepared = await io.preparePlatformClis({
+            gatewayUrl,
+            tenantId: selected.id,
+            platform: io.platform,
+            skipInstall: true,
+            // Goals re-run before every system-risk step: the probe must be
+            // pure discovery — no installs, profile writes, or skill syncs.
+            inspectOnly: true,
+          });
+          return prepared.missingAfter.length === 0;
+        },
       }],
       explicit: Boolean(flags.repair),
       noRecovery: false,

package/src/commands/status.js

@@ -15,7 +15,7 @@ import {
   productAccessLabel,
 } from "../tenants.js";
 import { installedVersion, maybePrintUpdateNotice } from "../updates.js";
-import { windowsClaudeUserData } from "../windowsApps.js";
+import { findManagedWindowsChatGPTApp, windowsClaudeUserData } from "../windowsApps.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 import { cachedProviderReadiness, providerAvailable } from "../providerReadiness.js";
 
@@ -52,11 +52,16 @@ export function desktopReadiness(tenant, {
       states[client] = { app: "unsupported", shell: "unsupported" };
       continue;
     }
+    // A generated config alone proves nothing launchable on Windows: when the
+    // vendor ensure failed, config.toml can exist while no managed app was
+    // ever staged — reporting "ready" then hides the exact failure the user
+    // is debugging (IMP-474). Require the staged binary too.
     const appReady = platform === "darwin"
       ? existsSync(paths[product].launcher)
-      : existsSync(product === "claude"
-        ? path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)
-        : path.join(paths.chatgpt.codexHome, "config.toml"));
+      : product === "claude"
+        ? existsSync(path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`))
+        : existsSync(path.join(paths.chatgpt.codexHome, "config.toml"))
+          && Boolean(findManagedWindowsChatGPTApp(paths.root, { isFile: existsSync }));
     let shellReady = appReady && registered.has(product);
     if (platform === "win32" && appData) {
       const shortcutPath = path.win32.join(

package/src/commands/update.js

@@ -10,7 +10,7 @@ import { loadConfig, redactSecretText } from "../config.js";
 import { nativeCommandInvocation } from "../nativeProcess.js";
 import { withProgress } from "../progress.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
-import { brandedText, RUNTIME_BRAND } from "../runtimeBrand.js";
+import { brandedEnvironmentName, brandedText, RUNTIME_BRAND } from "../runtimeBrand.js";
 import { IMPEL_CLI_ENTRYPOINT } from "../selfInvocation.js";
 import {
   fetchRemoteVersion,
@@ -18,12 +18,20 @@ import {
   isNewerVersion,
   refreshUpdateCache,
   updateInstallSpec,
+  updatePackage,
   updateTagForVersion,
   writeUpdateCache,
 } from "../updates.js";
 
 const CLI_BIN = IMPEL_CLI_ENTRYPOINT;
 
+/**
+ * Loop guard for the fresh-build continuation: `_converge` children run with
+ * this marker so a nested `impel update` inside the cascade can never start
+ * another self-update (and thus another cascade) recursively.
+ */
+export const UPDATE_CASCADE_ENV = brandedEnvironmentName("UPDATE_CASCADE");
+
 /**
  * The version now on disk at the package that owns CLI_BIN, read FRESH (never
  * from this process's cached module graph). After `npm install -g` this is the
@@ -39,6 +47,28 @@ export function postInstallCliVersion() {
   }
 }
 
+/**
+ * Whether the build at CLI_BIN actually RUNS and reports the expected
+ * version. A bare package.json read is not proof after a failed
+ * `npm install -g`: the global replace is non-atomic (notably on Windows),
+ * so a half-written package can carry the new manifest with broken code.
+ */
+export function postInstallCliRunnable(expectedVersion, { spawn = spawnSync, execPath = process.execPath } = {}) {
+  if (typeof expectedVersion !== "string" || !expectedVersion.trim()) return false;
+  try {
+    const run = spawn(execPath, [CLI_BIN, "--version"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+      windowsHide: true,
+    });
+    if (run.status !== 0 || run.error) return false;
+    return String(run.stdout || "").trim() === expectedVersion.trim();
+  } catch {
+    return false;
+  }
+}
+
 const HELP = brandedText(`impel update - update everything Impel in one command
 
 Reinstalls impel-cli from npm, then uses the new build to discover every
@@ -101,11 +131,67 @@ function defaultSelfUpdate(spec) {
   return installUpdateFromRegistry(spec);
 }
 
+/**
+ * After `npm install -g` exits 0 but the RUNNING CLI's own package still
+ * resolves the old version (npm-prefix skew: nvm/Homebrew node transitions,
+ * npm 11 dangling prepare-script symlinks), locate the build npm actually
+ * installed so the cascade can run under it. Fail-closed: the entry point
+ * must live inside the global root of the same `npm` the installer ran, and
+ * its package.json must resolve exactly the version npm reported for the
+ * update tag; anything else returns null and the caller keeps the hard error.
+ */
+export function resolveFreshGlobalEntrypoint(targetVersion, dependencies = {}) {
+  const io = {
+    spawnSync,
+    platform: process.platform,
+    environment: process.env,
+    readFileSync: fs.readFileSync,
+    existsSync: fs.existsSync,
+    ...dependencies,
+  };
+  if (typeof targetVersion !== "string" || !targetVersion.trim()) return null;
+  try {
+    const invocation = nativeCommandInvocation("npm", ["root", "-g"], io.environment, io.platform);
+    const run = io.spawnSync(invocation.command, invocation.args, {
+      encoding: "utf8",
+      env: io.environment,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+      windowsHide: true,
+      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+    });
+    if (run.status !== 0 || run.error) return null;
+    const globalRoot = String(run.stdout || "").trim();
+    if (!globalRoot || !path.isAbsolute(globalRoot)) return null;
+    // Containment is enforced at every hop: the package directory must stay
+    // inside the npm global root (an env-supplied package name cannot
+    // traverse out), the declared bin must stay inside the package, and the
+    // real (symlink-resolved) entry point must still live under the real
+    // global root. Anything else fails closed to the caller's hard error.
+    const packageRoot = path.resolve(path.join(globalRoot, ...updatePackage().split("/")));
+    if (!packageRoot.startsWith(path.resolve(globalRoot) + path.sep)) return null;
+    const pkg = JSON.parse(io.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+    if (pkg?.version !== targetVersion) return null;
+    const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.[RUNTIME_BRAND.cli.command];
+    if (typeof bin !== "string" || !bin.trim()) return null;
+    const entrypoint = path.resolve(packageRoot, bin);
+    if (!entrypoint.startsWith(packageRoot + path.sep)) return null;
+    if (!io.existsSync(entrypoint)) return null;
+    const realEntrypoint = (io.realpathSync || fs.realpathSync)(entrypoint);
+    const realRoot = (io.realpathSync || fs.realpathSync)(globalRoot);
+    if (!realEntrypoint.startsWith(realRoot + path.sep)) return null;
+    return entrypoint;
+  } catch {
+    return null;
+  }
+}
+
 // The cascading steps re-execute the (freshly installed) CLI binary so the
 // NEW code performs them, not the process that started the update. On
 // Windows this is also what refreshes the stable %LOCALAPPDATA% entry point:
 // bin/impel.js rewrites it at startup, so the shim is only ever updated by a
-// build that the postInstallCliVersion guard below already verified.
+// build verified either by the postInstallCliVersion guard below or by
+// resolveFreshGlobalEntrypoint's fail-closed skew resolution.
 export function defaultRunConvergence({
   skipApps = false,
   skipClis = false,
@@ -113,6 +199,7 @@ export function defaultRunConvergence({
   spawn = spawnSync,
   execPath = process.execPath,
   cliBin = CLI_BIN,
+  environment = process.env,
 } = {}) {
   const args = [cliBin, "_converge"];
   if (skipApps) args.push("--skip-apps");
@@ -120,6 +207,7 @@ export function defaultRunConvergence({
   if (noRecovery) args.push("--no-recovery");
   const result = spawn(execPath, args, {
     stdio: "inherit",
+    env: { ...environment, [UPDATE_CASCADE_ENV]: "1" },
   });
   return result.status === 0;
 }
@@ -161,9 +249,12 @@ export async function cmdUpdate(argv, overrides = {}) {
     runSkillsSync: defaultRunSkillsSync,
     runAgentsSync: defaultRunAgentsSync,
     platform: process.platform,
+    environment: process.env,
     progress: withProgress,
     recoverInstall: runInstallRecovery,
     postInstallVersion: postInstallCliVersion,
+    postInstallRunnable: postInstallCliRunnable,
+    resolveFreshInstall: resolveFreshGlobalEntrypoint,
     loadConfig,
     ...overrides,
   };
@@ -225,10 +316,22 @@ export async function cmdUpdate(argv, overrides = {}) {
   }
 
   // ── CLI ────────────────────────────────────────────────────────────────
+  let cascadeEntrypoint = null;
   if (!remote) {
     console.warn("CLI: npm update check unavailable; keeping the installed build.");
   } else if (upToDate) {
     console.log("CLI: already up to date.");
+  } else if (io.environment?.[UPDATE_CASCADE_ENV] === "1") {
+    // Loop guard: a self-update must never start from inside its own
+    // fresh-build continuation, or a buggy cascade could respawn forever.
+    // Degrade rather than abort: an inherited marker (e.g. a terminal opened
+    // under a converge child) must not permanently brick `impel update` —
+    // convergence still runs; only the self-update is withheld.
+    console.warn(
+      `impel update: skipping the self-update because ${UPDATE_CASCADE_ENV} is set `
+      + "(update cascade in progress, or inherited from one). Convergence continues; "
+      + `for a self-update, unset ${UPDATE_CASCADE_ENV} or open a fresh terminal.`,
+    );
   } else {
     console.log(`CLI: installing the npm ${updateTag} build…`);
     if (!await io.progress(`Installing the npm ${updateTag} impel-cli build`, () => io.selfUpdate(installSpec))) {
@@ -240,8 +343,11 @@ export async function cmdUpdate(argv, overrides = {}) {
       const config = io.loadConfig();
       let recovered = false;
       if (config?.pat && config?.tenantId) {
-        // The goal tracks the most recent reviewed retry of the npm install:
-        // recovery may only end "fixed" once that retry actually succeeded.
+        // The goal passes on the most recent reviewed retry of the npm
+        // install OR on a live disk probe of the package that owns the
+        // running CLI: when the user completes the printed manual
+        // `npm install --global …` in another terminal mid-recovery, the goal
+        // must observe that completion instead of re-issuing the same step.
         const updateState = { ok: false };
         try {
           const recovery = await io.recoverInstall(
@@ -259,7 +365,10 @@ export async function cmdUpdate(argv, overrides = {}) {
                 {
                   id: "cli-update",
                   description: `The global ${RUNTIME_BRAND.cli.packageName} npm update completed successfully`,
-                  run: () => updateState.ok === true,
+                  run: () => updateState.ok === true
+                    || (remote != null
+                      && io.postInstallVersion() === remote
+                      && io.postInstallRunnable(remote)),
                 },
               ],
               explicit: Boolean(flags.repair),
@@ -296,19 +405,35 @@ export async function cmdUpdate(argv, overrides = {}) {
       console.log("CLI: recovery verified the update path.");
     }
     // npm exiting 0 is NOT proof the RUNNING install was updated: with multiple
-    // Node installs / npm prefixes (common on Windows), the install can land in
-    // a different global prefix while CLI_BIN — the path the cascade re-executes
-    // — still holds the old build. Cascading then runs old code that believes
-    // an update is still pending, which is how unbounded respawn storms start.
-    // Probe the version at CLI_BIN fresh from disk and refuse to cascade on skew.
+    // Node installs / npm prefixes (nvm/Homebrew node transitions on macOS,
+    // prefix skew on Windows), the install can land in a different global
+    // prefix while CLI_BIN — the path the cascade re-executes — still holds
+    // the old build. Cascading old code that believes an update is still
+    // pending is how unbounded respawn storms start, so the cascade may only
+    // ever run a build that provably resolves the target version. Probe the
+    // version at CLI_BIN fresh from disk; on skew, locate and verify the
+    // build npm actually installed and hand the continuation to THAT binary.
+    // (The previous behavior — abort with exit 1 — left the machine
+    // half-updated: CLI updated in the other prefix, no tenant/app/skills
+    // convergence, and a rerun from the same terminal repeated the abort via
+    // the shell's stale command hash. That is the field-reported "run
+    // `impel update` twice, sometimes in separate terminals".)
     const postInstall = io.postInstallVersion();
     if (remote && postInstall !== remote) {
-      console.error(`impel update: npm reported success but the running CLI still resolves v${postInstall ?? "?"} (expected v${remote}).`);
-      console.error(`  Running CLI: ${CLI_BIN}`);
-      console.error("  This usually means the `impel` on PATH belongs to a different npm prefix than `npm prefix -g`.");
-      console.error(`  Fix: run \`npm prefix -g\`, confirm it owns the \`impel\` shim on PATH, then \`npm install --global ${installSpec}\` there.`);
-      process.exitCode = 1;
-      return;
+      cascadeEntrypoint = io.resolveFreshInstall(remote);
+      if (!cascadeEntrypoint) {
+        console.error(`impel update: npm reported success but the running CLI still resolves v${postInstall ?? "?"} (expected v${remote}), and the freshly installed build could not be located and verified.`);
+        console.error(`  Running CLI: ${CLI_BIN}`);
+        console.error("  This usually means the `impel` on PATH belongs to a different npm prefix than `npm prefix -g`.");
+        console.error(`  Fix: run \`npm prefix -g\`, confirm it owns the \`impel\` shim on PATH, then \`npm install --global ${installSpec}\` there.`);
+        process.exitCode = 1;
+        return;
+      }
+      console.warn(`impel update: the running CLI at ${CLI_BIN} still resolves v${postInstall ?? "?"}; continuing with the freshly installed v${remote}.`);
+      console.warn(`  Fresh build: ${cascadeEntrypoint}`);
+      console.warn(io.platform === "win32"
+        ? "  Your current shell may still launch the old install. Open a new terminal, and align the `impel` on PATH with `npm prefix -g`."
+        : "  Your current shell may still launch the old install. Run `hash -r` (zsh/bash) or open a new terminal, and align the `impel` on PATH with `npm prefix -g`.");
     }
     console.log(`CLI: updated${remote ? ` to v${remote}` : ""}.`);
   }
@@ -318,6 +443,9 @@ export async function cmdUpdate(argv, overrides = {}) {
     skipApps: Boolean(flags["skip-apps"]),
     skipClis: Boolean(flags["skip-clis"]),
     noRecovery: Boolean(flags["no-recovery"]),
+    // On npm-prefix skew the continuation must re-exec the verified fresh
+    // build; everywhere else CLI_BIN already holds the new bytes.
+    ...(cascadeEntrypoint ? { cliBin: cascadeEntrypoint } : {}),
   };
   if (!await io.runConvergence(convergenceArgs)) {
     console.error("impel update: tenant convergence failed; rerun `impel update` after addressing the reported issue.");

package/src/installRecovery/engine.js

@@ -358,6 +358,27 @@ export async function runInstallRecovery(options, overrides = {}) {
               continue;
             }
           }
+          // A blocked report gets one live goal pass before it stands: when
+          // every health check succeeds (a skipped step, or the user
+          // finishing the work in another terminal), the machine is healthy
+          // regardless of what the model concluded — mirroring the
+          // budget-exhaustion upgrade below.
+          if (status === "blocked") {
+            goalReport = await runGoals(session.goals);
+            if (goalReport.passed) {
+              finished = {
+                status: "fixed",
+                summary: "Every goal health check passes; the reported blocker is no longer present.",
+                userAction: null,
+              };
+              toolResults.push({
+                type: "tool_result",
+                tool_use_id: call.id,
+                content: "Outcome recorded.",
+              });
+              break;
+            }
+          }
           finished = {
             status,
             summary: String(call.input?.summary || "").slice(0, 2_000),
@@ -371,6 +392,24 @@ export async function runInstallRecovery(options, overrides = {}) {
           break;
         }
 
+        // Live re-probe before any system-risk step: when every goal health
+        // check already passes, the state this step would produce is already
+        // present on the machine (typically because the user completed the
+        // instruction in another terminal mid-session). Skip the step instead
+        // of re-prompting for an installer the environment no longer needs.
+        if (installRecoveryToolRisk(call.name) === "system" && session.goals.length) {
+          const live = await runGoals(session.goals);
+          if (live.passed) {
+            io.log(`Install recovery: skipping ${call.name} — every goal health check already passes.`);
+            toolResults.push({
+              type: "tool_result",
+              tool_use_id: call.id,
+              content: "Skipped: every goal health check now passes — this step is already satisfied on this machine. Verify with check_health and finish with report_outcome.",
+            });
+            continue;
+          }
+        }
+
         const result = await executeCall(session, call.name, call.input);
         if (result.outcome === "declined" && installRecoveryToolRisk(call.name) === "system") {
           declinedSystemCalls += 1;
@@ -397,6 +436,12 @@ export async function runInstallRecovery(options, overrides = {}) {
       }
 
       if (declinedSystemCalls >= 2) {
+        // Same live upgrade as the blocked and budget paths: declining a
+        // repair the machine no longer needs must not read as a failure.
+        goalReport = await runGoals(session.goals);
+        if (goalReport.passed) {
+          return terminalReturn(session, "fixed", "The installation passes all health checks.");
+        }
         return terminalReturn(
           session,
           "aborted",

package/src/macSetup.js

@@ -172,6 +172,7 @@ export async function prepareMacClis({
   gatewayUrl,
   tenantId,
   skipInstall = false,
+  inspectOnly = false,
   installTools = ["claude", "codex"],
 } = {}, dependencies = {}) {
   const io = {
@@ -194,6 +195,22 @@ export async function prepareMacClis({
   if (requested.size !== installTools.length || [...requested].some((tool) => !io.installers[tool])) {
     throw new Error("installTools must contain unique supported macOS CLI names");
   }
+  // A pure discovery probe: recovery goals and health checks re-evaluate
+  // this repeatedly, so it must never install, write profiles, or sync
+  // skills — only report what is currently discoverable.
+  if (inspectOnly) {
+    return {
+      binaries: before,
+      missingBefore,
+      missingAfter: [...missingBefore],
+      installAttempted: false,
+      installSucceeded: null,
+      installFailure: null,
+      installations: {},
+      installCommands: {},
+      profiles: null,
+    };
+  }
 
   const installations = {};
   if (missingBefore.length && !skipInstall) {

package/src/modelCatalog.js

@@ -0,0 +1,103 @@
+// The single model registry shared by every managed Codex surface. This
+// module must stay a leaf (importing only other leaf modules such as
+// runtimeBrand.js) so both the desktop app generation in apps.js and the CLI
+// tenant profiles in cliProfiles.js can consume it without an import cycle —
+// the 0.20.39 regression happened precisely because the CLI carried its own
+// hand-frozen copy of this data.
+import { RUNTIME_BRAND } from "./runtimeBrand.js";
+
+const STANDARD_REASONING_LEVELS = [
+  { effort: "low", description: "Fast responses with lighter reasoning" },
+  { effort: "medium", description: "Balances speed and reasoning depth for everyday tasks" },
+  { effort: "high", description: "Greater reasoning depth for complex problems" },
+  { effort: "xhigh", description: "Extra high reasoning depth for complex problems" },
+];
+const MAX_REASONING_LEVEL = { effort: "max", description: "Maximum reasoning depth for the hardest problems" };
+const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning with automatic task delegation" };
+const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
+
+export const FALLBACK_MODELS = [
+  { id: "claude-opus-5", provider: "claude", display_name: "Claude Opus 5", family: "opus", family_default: true, default: true, supports_1m: true, context_window: 1000000 },
+  { id: "claude-opus-4-8", provider: "claude", display_name: "Claude Opus 4.8", family: "opus", supports_1m: true, context_window: 1000000 },
+  { id: "claude-sonnet-5", provider: "claude", display_name: "Claude Sonnet 5", family: "sonnet", family_default: true, context_window: 200000 },
+  { id: "claude-sonnet-4-6", provider: "claude", display_name: "Claude Sonnet 4.6", family: "sonnet", context_window: 200000 },
+  { id: "claude-haiku-4-5", provider: "claude", display_name: "Claude Haiku 4.5", family: "haiku", family_default: true, context_window: 200000 },
+  { id: "claude-fable-5", provider: "claude", display_name: "Claude Fable 5", family: "fable", family_default: true, context_window: 200000 },
+  { id: "gpt-5.6-sol", provider: "codex", display_name: "GPT-5.6-Sol", description: "Latest frontier agentic coding model.", default: true, priority: 1, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
+  { id: "gpt-5.6-terra", provider: "codex", display_name: "GPT-5.6-Terra", description: "Balanced agentic coding model for everyday work.", priority: 2, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
+  { id: "gpt-5.6-luna", provider: "codex", display_name: "GPT-5.6-Luna", description: "Fast and affordable agentic coding model.", priority: 3, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v1" },
+  { id: "gpt-5.5", provider: "codex", display_name: "GPT-5.5", description: "Frontier model for complex coding, research, and real-world work.", priority: 7, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+  { id: "gpt-5.4", provider: "codex", display_name: "GPT-5.4", description: "Strong model for everyday coding.", priority: 16, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 1000000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+  { id: "gpt-5.4-mini", provider: "codex", display_name: "GPT-5.4-Mini", description: "Small, fast, and cost-efficient model for simpler coding tasks.", priority: 23, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+  { id: "gpt-5.3-codex-spark", provider: "codex", display_name: "GPT-5.3-Codex-Spark", description: "Ultra-fast coding model.", priority: 26, default_reasoning_level: "high", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 128000, max_context_window: 128000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+];
+
+export function codexCatalogEntry(model, index, vendorModel) {
+  const generated = {
+    slug: model.id,
+    display_name: model.display_name || model.id,
+    description: `Available through the Impel gateway (${model.id}).`,
+    default_reasoning_level: "medium",
+    supported_reasoning_levels: STANDARD_REASONING_LEVELS,
+    shell_type: "shell_command",
+    visibility: "list",
+    supported_in_api: true,
+    priority: index + 1,
+    base_instructions: "You are Codex, an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
+    include_skills_usage_instructions: false,
+    supports_reasoning_summaries: true,
+    default_reasoning_summary: "none",
+    support_verbosity: true,
+    default_verbosity: "low",
+    apply_patch_tool_type: "freeform",
+    web_search_tool_type: "text_and_image",
+    truncation_policy: { mode: "tokens", limit: 10000 },
+    context_window: model.context_window || 200000,
+    max_context_window: model.context_window || 200000,
+    effective_context_window_percent: 95,
+    experimental_supported_tools: [],
+    input_modalities: ["text", "image"],
+    supports_parallel_tool_calls: true,
+    supports_image_detail_original: true,
+    supports_search_tool: true,
+    use_responses_lite: false,
+    tool_mode: null,
+    multi_agent_version: null,
+  };
+  const entry = vendorModel ? { ...generated, ...vendorModel } : generated;
+  return {
+    ...entry,
+    slug: model.id,
+    display_name: model.display_name || entry.display_name || model.id,
+    description: model.description || entry.description,
+    default_reasoning_level: model.default_reasoning_level || entry.default_reasoning_level,
+    supported_reasoning_levels: Array.isArray(model.supported_reasoning_levels)
+      ? model.supported_reasoning_levels
+      : entry.supported_reasoning_levels,
+    service_tiers: Array.isArray(model.service_tiers) ? model.service_tiers : (entry.service_tiers || []),
+    visibility: "list",
+    supported_in_api: true,
+    priority: Number.isInteger(model.priority) ? model.priority : (entry.priority || index + 1),
+    context_window: model.context_window || entry.context_window || 200000,
+    max_context_window: model.max_context_window || entry.max_context_window || model.context_window || 200000,
+    ...(typeof model.use_responses_lite === "boolean" ? { use_responses_lite: model.use_responses_lite } : {}),
+    ...(Object.hasOwn(model, "tool_mode") ? { tool_mode: model.tool_mode } : {}),
+    ...(Object.hasOwn(model, "multi_agent_version") ? { multi_agent_version: model.multi_agent_version } : {}),
+  };
+}
+
+/**
+ * The managed CLI Codex catalog, projected from the same model registry the
+ * desktop app uses so reasoning efforts, service tiers, and tool modes can
+ * never drift between the two surfaces. CLI profiles pin this file to keep
+ * launches offline; vendor enrichment stays a desktop-only concern.
+ */
+export function managedCodexCliCatalog(now = new Date()) {
+  return {
+    fetched_at: now.toISOString(),
+    client_version: `${RUNTIME_BRAND.cli.command}-managed-2`,
+    models: FALLBACK_MODELS
+      .filter((model) => model.provider === "codex")
+      .map((model, index) => codexCatalogEntry(model, index)),
+  };
+}

package/src/platformSetup.js

@@ -15,10 +15,8 @@ export async function preparePlatformClis(options = {}, dependencies = {}) {
     claude: find("claude", environment, platform),
     codex: find("codex", environment, platform),
   };
-  const claudeProfile = (dependencies.ensureClaudeProfile || ensureImpelClaudeProfile)(options.gatewayUrl, options.tenantId);
-  const codexProfile = (dependencies.ensureCodexProfile || ensureImpelCodexProfile)(options.gatewayUrl, options.tenantId);
   const missingAfter = Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool);
-  return {
+  const result = {
     binaries,
     missingBefore: [...missingAfter],
     missingAfter,
@@ -27,6 +25,14 @@ export async function preparePlatformClis(options = {}, dependencies = {}) {
     installFailure: null,
     installations: {},
     installCommands: {},
+    profiles: null,
+  };
+  // Discovery-only probes must not write profiles either.
+  if (options.inspectOnly) return result;
+  const claudeProfile = (dependencies.ensureClaudeProfile || ensureImpelClaudeProfile)(options.gatewayUrl, options.tenantId);
+  const codexProfile = (dependencies.ensureCodexProfile || ensureImpelCodexProfile)(options.gatewayUrl, options.tenantId);
+  return {
+    ...result,
     profiles: { claude: claudeProfile.configDir, codex: codexProfile.codexHome },
   };
 }

package/src/windowsApps.js

@@ -90,6 +90,71 @@ function installedMsixChatGPT(environment, run = spawnSync, pin = null) {
   }
 }
 
+/**
+ * Register the already-staged ChatGPT Store package for the current user.
+ * winget resolves packages machine-wide, so on a machine where another user
+ * (or provisioning) installed the app, `winget install` reports
+ * UPDATE_NOT_APPLICABLE while the current user's Get-AppxPackage sees
+ * nothing. Add-AppxPackage -RegisterByFamilyName registers the existing
+ * staged bits for this user without downloading or elevating.
+ */
+export function registerProvisionedMsixChatGPT(environment, run = spawnSync) {
+  const familyName = `${WINDOWS_CHATGPT_PACKAGE_NAME}_${WINDOWS_CHATGPT_PUBLISHER_ID}`;
+  try {
+    const result = run("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      `Add-AppxPackage -RegisterByFamilyName -MainPackage '${familyName}' -ErrorAction Stop`,
+    ], {
+      encoding: "utf8",
+      env: windowsPowerShellEnvironment(environment),
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 120_000,
+      windowsHide: true,
+    });
+    return result?.status === 0 && !result?.error;
+  } catch {
+    return false;
+  }
+}
+
+function compareDottedVersions(left, right) {
+  const parse = (value) => String(value).split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const a = parse(left);
+  const b = parse(right);
+  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+    const delta = (a[index] || 0) - (b[index] || 0);
+    if (delta !== 0) return delta;
+  }
+  return 0;
+}
+
+/**
+ * The version string of whatever ChatGPT Store package is installed,
+ * regardless of the reviewed pin. Diagnostic-only: it lets a pin mismatch
+ * name the actual installed version instead of a bare winget HRESULT.
+ */
+export function installedMsixChatGPTVersion(environment, run = spawnSync) {
+  const script = [
+    `$package = Get-AppxPackage -Name '${WINDOWS_CHATGPT_PACKAGE_NAME}' -ErrorAction SilentlyContinue`,
+    `$package = $package | Where-Object { $_.PublisherId -ceq '${WINDOWS_CHATGPT_PUBLISHER_ID}' } | Sort-Object Version -Descending | Select-Object -First 1`,
+    "if ($package) { $package.Version.ToString() }",
+  ].join("; ");
+  try {
+    const result = run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+      encoding: "utf8",
+      env: windowsPowerShellEnvironment(environment),
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15_000,
+      windowsHide: true,
+    });
+    return result?.status === 0 ? String(result.stdout || "").trim() || null : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Candidate paths for Anthropic's signed per-user Windows desktop install. */
 export function windowsClaudeAppCandidates(environment = process.env, dependencies = {}) {
   const io = { readDirectory: fs.readdirSync, ...dependencies };
@@ -148,7 +213,7 @@ export function findWindowsChatGPTApp(environment = process.env, dependencies =
   return msix && exists(msix) ? path.win32.normalize(msix) : null;
 }
 
-function pinnedWindowsChatGPTApp(environment = process.env, dependencies = {}) {
+export function pinnedWindowsChatGPTApp(environment = process.env, dependencies = {}) {
   const exists = dependencies.isFile || isFile;
   const pin = dependencies.pin || WINDOWS_CHATGPT_PIN;
   const msix = (dependencies.queryMsix || installedMsixChatGPT)(environment, dependencies.run, pin);
@@ -434,16 +499,36 @@ export function ensureWindowsChatGPTApp({ update = false } = {}, dependencies =
     result = { status: null, error };
   }
   let resultBinary = io.findPinned(io.environment, { pin: io.pin, run: io.run });
-  // winget uses an error HRESULT when `upgrade` finds an installed package
-  // with no newer Store release. That is a healthy idempotent update result,
-  // not an installation failure (APPINSTALLER_CLI_ERROR_UPDATE_NOT_APPLICABLE).
-  const alreadyUpToDate = Boolean(
-    shouldUpdate
-    && resultBinary
-    && !result?.error
+  const noApplicableUpgrade = !result?.error
     && Number.isInteger(result?.status)
-    && (result.status >>> 0) === WINDOWS_WINGET_UPDATE_NOT_APPLICABLE,
-  );
+    && (result.status >>> 0) === WINDOWS_WINGET_UPDATE_NOT_APPLICABLE;
+  // winget resolves machine-wide: when it reports the package installed but
+  // the current user's probe sees nothing, the staged bits are registered to
+  // another user or provisioning. Registering them for this user is a local,
+  // download-free repair; the pin-exact probe afterwards keeps it fail-closed.
+  let registeredOffPin = false;
+  if (noApplicableUpgrade && !resultBinary) {
+    io.logger.log("ChatGPT/Codex: attempting to register the machine-wide Microsoft Store package for the current user…");
+    if ((io.registerProvisioned || registerProvisionedMsixChatGPT)(io.environment, io.run)) {
+      resultBinary = io.findPinned(io.environment, { pin: io.pin, run: io.run });
+      if (resultBinary) {
+        io.logger.log("ChatGPT/Codex: registered the already-staged Microsoft Store package for the current user.");
+      } else {
+        registeredOffPin = true;
+      }
+    } else {
+      io.logger.log("ChatGPT/Codex: the Store package could not be registered for the current user.");
+    }
+  }
+  // winget uses an error HRESULT when it finds an installed package with no
+  // newer Store release (APPINSTALLER_CLI_ERROR_UPDATE_NOT_APPLICABLE). That
+  // is a healthy idempotent result whenever the pin-exact re-query proves the
+  // reviewed package is present — during setup/install as much as update:
+  // `winget install` reports the same HRESULT for an already-installed
+  // package, and treating it as failure strands first-run machines in an
+  // unconvergeable recovery loop. Acceptance stays fail-closed through the
+  // pin-exact probe below.
+  const alreadyUpToDate = Boolean(resultBinary && noApplicableUpgrade);
   if (alreadyUpToDate) {
     io.logger.log(`ChatGPT/Codex: Microsoft Store package ${io.pin.packageVersion} already up to date.`);
   }
@@ -456,6 +541,33 @@ export function ensureWindowsChatGPTApp({ update = false } = {}, dependencies =
       ),
     };
   }
+  // A no-applicable-upgrade result over a package that fails the pin-exact
+  // probe means the Store carries a different (usually newer) build the
+  // Store cannot downgrade. Name both versions so the operator learns this
+  // needs a CLI release with an updated ChatGPT pin, not another retry.
+  if (!commandSucceeded && !resultBinary && noApplicableUpgrade) {
+    const installedVersion = (io.installedVersion || installedMsixChatGPTVersion)(io.environment, io.run);
+    if (installedVersion) {
+      const newer = compareDottedVersions(installedVersion, io.pin.packageVersion) > 0;
+      result = {
+        ...result,
+        error: new Error(
+          `installed ChatGPT Store package ${installedVersion} does not match the reviewed pin ${io.pin.packageVersion}; `
+          + (newer
+            ? "the Microsoft Store cannot downgrade, so this needs a CLI release with an updated ChatGPT pin"
+            : "the Store has not fulfilled the pinned build on this machine yet — retry once the Store catches up"),
+        ),
+      };
+    } else if (registeredOffPin) {
+      result = {
+        ...result,
+        error: new Error(
+          "a machine-wide ChatGPT Store package was registered for the current user but does not match "
+          + `the reviewed pin ${io.pin.packageVersion}; the managed app stays uninstalled until a matching build is available`,
+        ),
+      };
+    }
+  }
   const succeeded = commandSucceeded && Boolean(resultBinary);
   if (!succeeded) resultBinary = null;
   return {

package/src/windowsSetup.js

@@ -121,6 +121,7 @@ export async function prepareWindowsClis({
   gatewayUrl,
   tenantId,
   skipInstall = false,
+  inspectOnly = false,
   installTools = ["claude", "codex"],
 } = {}, dependencies = {}) {
   const io = {
@@ -149,6 +150,25 @@ export async function prepareWindowsClis({
     throw new Error("installTools must contain unique supported Windows CLI names");
   }
 
+  // A pure discovery probe: recovery goals and health checks re-evaluate
+  // this repeatedly, so it must never download git, install anything, write
+  // profiles, or sync skills — only report what is currently discoverable.
+  // This short-circuit MUST stay ahead of the git provisioning below, which
+  // performs an unprompted network install when git is absent.
+  if (inspectOnly) {
+    return {
+      binaries: before,
+      missingBefore,
+      missingAfter: [...missingBefore],
+      installAttempted: false,
+      installSucceeded: null,
+      installFailure: null,
+      installations: {},
+      installCommands: {},
+      profiles: null,
+    };
+  }
+
   // Both vendor CLIs need `git` to install the skills marketplace, and the
   // target machines are brand new — provision the Impel-managed MinGit before
   // any skill sync, on every setup/update pass (idempotent once installed).

package/src/codexCliCatalog.js

@@ -1,56 +0,0 @@
-const LEVELS = ["low", "medium", "high", "xhigh"].map((effort) => ({
-  effort,
-  description: `${effort} reasoning effort`,
-}));
-
-const MODELS = [
-  ["gpt-5.6-sol", "GPT-5.6-Sol", 1, "medium", "code_mode_only", "v2"],
-  ["gpt-5.6-terra", "GPT-5.6-Terra", 2, "medium", "code_mode_only", "v2"],
-  ["gpt-5.6-luna", "GPT-5.6-Luna", 3, "medium", "code_mode_only", "v1"],
-  ["gpt-5.5", "GPT-5.5", 7, "medium", null, null],
-  ["gpt-5.4", "GPT-5.4", 16, "medium", null, null],
-  ["gpt-5.4-mini", "GPT-5.4-Mini", 23, "medium", null, null],
-  ["gpt-5.3-codex-spark", "GPT-5.3-Codex-Spark", 26, "high", null, null],
-];
-
-// Reviewed static projection of the exact pinned Codex 0.146 catalog. Keeping
-// it process-local prevents the client from issuing unsupported online model
-// refreshes during every managed launch.
-export function managedCodexCliCatalog(now = new Date()) {
-  return {
-    fetched_at: now.toISOString(),
-    client_version: "impel-managed-codex-0.146",
-    models: MODELS.map(([slug, displayName, priority, effort, toolMode, multiAgentVersion]) => ({
-      slug,
-      display_name: displayName,
-      description: `Available through the Impel gateway (${slug}).`,
-      default_reasoning_level: effort,
-      supported_reasoning_levels: LEVELS,
-      service_tiers: [],
-      shell_type: "shell_command",
-      visibility: "list",
-      supported_in_api: true,
-      priority,
-      base_instructions: "You are Codex, an AI coding agent. Follow repository instructions and verify your work.",
-      include_skills_usage_instructions: false,
-      supports_reasoning_summaries: true,
-      default_reasoning_summary: "none",
-      support_verbosity: true,
-      default_verbosity: "low",
-      apply_patch_tool_type: "freeform",
-      web_search_tool_type: "text_and_image",
-      truncation_policy: { mode: "tokens", limit: 10_000 },
-      context_window: slug === "gpt-5.3-codex-spark" ? 128_000 : 272_000,
-      max_context_window: slug === "gpt-5.4" ? 1_000_000 : (slug === "gpt-5.3-codex-spark" ? 128_000 : 272_000),
-      effective_context_window_percent: 95,
-      experimental_supported_tools: [],
-      input_modalities: ["text", "image"],
-      supports_parallel_tool_calls: true,
-      supports_image_detail_original: true,
-      supports_search_tool: true,
-      use_responses_lite: slug.startsWith("gpt-5.6-"),
-      tool_mode: toolMode,
-      multi_agent_version: multiAgentVersion,
-    })),
-  };
-}