impel-cli 0.20.40 → 0.20.42

package/RELEASE_NOTES.md

@@ -1,5 +1,20 @@
 # Release notes
 
+## 0.20.41 — Windows onboarding: converge over an already-installed Store ChatGPT
+
+- Accepts winget's UPDATE_NOT_APPLICABLE result during setup as well as
+  update, gated by the pin-exact package probe, ending the unconvergeable
+  first-run failure loop on machines where the ChatGPT Store app already
+  exists (and, downstream, the managed sign-in loop it caused).
+- Registers a machine-wide staged Store package for the current user
+  (download-free, no elevation) when winget sees it but the per-user probe
+  does not, still failing closed through the pin-exact probe.
+- Resolves the app-open path strictly through the pinned finder so an
+  off-pin Store build can never be staged as the managed app.
+- Names installed-vs-pinned versions in vendor-install diagnostics with a
+  measured direction, adds the 0x8A15002B winget hint, and makes Windows
+  status require the staged managed app rather than config presence alone.
+
 ## 0.20.40 — Field-report fixes: launcher drift, sync ownership, Codex capability, one-run update
 
 - Survives Claude auto-update drift: `impel claude` resolves the exact reviewed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.40",
+  "version": "0.20.42",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/agents.js

@@ -21,6 +21,7 @@ import {
   IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV,
   IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
   IMPEL_NATIVE_AGENT_MCP_TARGET,
+  impelCliInvocation,
   impelNativeAgentMcpInvocation,
 } from "./selfInvocation.js";
 import {
@@ -31,6 +32,11 @@ import {
   usesDirectAnswer,
 } from "./directAnswer.js";
 import { normalizeTenantId } from "./tenants.js";
+import {
+  ensureClaudeNativeInterceptHook,
+  nativeInterceptEnabled,
+  nativeInterceptTimeoutMs,
+} from "./nativeInterception.js";
 import {
   adapterCallerSpawnGuidance,
   adapterFaithfulCompletionGuidance,
@@ -56,7 +62,9 @@ export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
 export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 22;
+export const MANAGED_AGENT_MANIFEST_VERSION = 23;
+export const IMPEL_NATIVE_PARENT_DIRECT_ENV = "IMPEL_NATIVE_PARENT_DIRECT";
+export const IMPEL_NATIVE_SLASH_COMMANDS_ENV = "IMPEL_NATIVE_SLASH_COMMANDS";
 
 // The host model only selects the fixed MCP tool and faithfully returns its
 // result. Spark minimizes those transport-only turns while the selected Eve
@@ -77,6 +85,18 @@ function nativeAgentToolNames(agent) {
 function eagerNativeAgentTransportEnabled() {
   return process.env.IMPEL_NATIVE_EAGER_TRANSPORT !== "0";
 }
+
+function enabledProfileFlag(environment, name) {
+  return ["1", "true"].includes(String(environment?.[name] || "").toLowerCase());
+}
+
+export function nativeParentDirectEnabled(environment = process.env) {
+  return enabledProfileFlag(environment, IMPEL_NATIVE_PARENT_DIRECT_ENV);
+}
+
+export function nativeSlashCommandsEnabled(environment = process.env) {
+  return enabledProfileFlag(environment, IMPEL_NATIVE_SLASH_COMMANDS_ENV);
+}
 const MAX_RETIRED_AGENT_BINDINGS = 50;
 const MAX_NATIVE_AGENT_STATE_BYTES = 512 * 1024;
 const TERMINAL_NATIVE_AGENT_STATUSES = new Set(["succeeded", "failed", "cancelled", "canceled"]);
@@ -780,6 +800,32 @@ function renderClaudeAgent({ tenantId, agent, name, invocation, recoveryOnly = f
   };
 }
 
+function claudeParentDirectInstructions(tenantId, agent) {
+  const attribution = `Response from managed agent ${JSON.stringify(agent.title)} (${agent.agentId}):`;
+  return [
+    `The user explicitly selected the managed agent ${JSON.stringify(agent.title)} (${agent.agentId}) for tenant ${JSON.stringify(tenantId)}.`,
+    `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the user's complete request. Do not spawn a relay subagent and do not perform the request yourself.`,
+    `If the answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal; after a continuation exists, never call the answer tool again.`,
+    `On success, present the attribution line ${JSON.stringify(attribution)}, followed by the returned finalText verbatim with no rewriting, Markdown changes, or independent synthesis. On failure, attribute the failure to the same named managed agent and do not invent a replacement answer.`,
+  ].join(" ");
+}
+
+function claudeParentDirectDefinition({ tenantId, agent, invocation }) {
+  return {
+    prompt: claudeParentDirectInstructions(tenantId, agent),
+    permissionMode: "bypassPermissions",
+    tools: [NATIVE_AGENT_ANSWER_TOOL, NATIVE_AGENT_RESUME_TOOL].map((tool) => nativeToolName(tool)),
+    mcpServers: [{
+      [MANAGED_AGENT_MCP_SERVER]: {
+        type: "stdio",
+        command: invocation.command,
+        args: [...invocation.args],
+        env: { ...(invocation.env || {}) },
+      },
+    }],
+  };
+}
+
 function codexInvocationEnvironment(invocation, { durableProfile = false } = {}) {
   const entries = Object.entries(invocation.env || {});
   const transient = new Set(IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES);
@@ -867,34 +913,42 @@ function renderCodexProfile(options) {
 function boundNativeAgentInvocation(tenantId, agent, invocation, {
   policyFingerprint = nativeAgentPolicyFingerprint(agent),
   mode = usesDirectAnswer(agent) ? "answer" : "durable",
+  answerToolAttribution = false,
 } = {}) {
-  if (!invocation) {
-    return impelNativeAgentMcpInvocation({
+  const bound = !invocation
+    ? impelNativeAgentMcpInvocation({
       tenantId,
       agentId: agent.agentId,
       scopeParam: agent.scopeParam,
       policyFingerprint,
       mode,
-    });
-  }
-  const mcpIndex = invocation.args?.lastIndexOf("mcp") ?? -1;
-  if (mcpIndex < 0) throw new Error("native-agent MCP invocation has no mcp command");
-  return {
-    ...invocation,
-    args: [
-      ...invocation.args.slice(0, mcpIndex + 1),
-      "--target", IMPEL_NATIVE_AGENT_MCP_TARGET,
-      "--tenant", tenantId,
-      "--agent-id", agent.agentId,
-      "--scope-param", agent.scopeParam,
-      "--policy-fingerprint", policyFingerprint,
-      ...(mode === "recovery" ? ["--recovery-only"] : []),
-      ...(mode === "answer" ? ["--answer-only"] : []),
-    ],
-  };
+    })
+    : (() => {
+      const mcpIndex = invocation.args?.lastIndexOf("mcp") ?? -1;
+      if (mcpIndex < 0) throw new Error("native-agent MCP invocation has no mcp command");
+      return {
+        ...invocation,
+        args: [
+          ...invocation.args.slice(0, mcpIndex + 1),
+          "--target", IMPEL_NATIVE_AGENT_MCP_TARGET,
+          "--tenant", tenantId,
+          "--agent-id", agent.agentId,
+          "--scope-param", agent.scopeParam,
+          "--policy-fingerprint", policyFingerprint,
+          ...(mode === "recovery" ? ["--recovery-only"] : []),
+          ...(mode === "answer" ? ["--answer-only"] : []),
+        ],
+      };
+    })();
+  return answerToolAttribution
+    ? { ...bound, args: [...bound.args, "--agent-title", agent.title] }
+    : bound;
 }
 
-export function renderManagedAgents(client, tenantId, agents, invocation = null, { directCodeMode = true } = {}) {
+export function renderManagedAgents(client, tenantId, agents, invocation = null, {
+  directCodeMode = true,
+  nativeParentDirect = false,
+} = {}) {
   if (client !== "claude" && client !== "codex") throw new Error(`unknown agent client ${client}`);
   const normalizedTenant = normalizeTenantId(tenantId);
   const fileStems = generatedAgentFileStems(normalizedTenant, agents);
@@ -908,12 +962,20 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
     // builtin and remove it from the @ mention picker. Claude names are already
     // collision-safe, filesystem-safe identifiers, so use them as filenames.
     const fileStem = client === "claude" ? name : fileStems[index];
-    const boundInvocation = boundNativeAgentInvocation(normalizedTenant, agent, invocation);
-    const claudeRendered = client === "claude"
+    const parentDirect = client === "claude" && nativeParentDirect && usesDirectAnswer(agent);
+    const boundInvocation = boundNativeAgentInvocation(normalizedTenant, agent, invocation, {
+      answerToolAttribution: parentDirect,
+    });
+    const claudeRendered = client === "claude" && !parentDirect
       ? renderClaudeAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation })
       : null;
+    const parentLaunchDefinition = parentDirect
+      ? claudeParentDirectDefinition({ tenantId: normalizedTenant, agent, invocation: boundInvocation })
+      : null;
     const contents = claudeRendered?.contents
-      ?? renderCodexAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation, directCodeMode });
+      ?? (client === "codex"
+        ? renderCodexAgent({ tenantId: normalizedTenant, agent, name, invocation: boundInvocation, directCodeMode })
+        : null);
     const profileName = client === "codex" ? fileStem : null;
     return {
       agentId: agent.agentId,
@@ -923,9 +985,10 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
       policyFingerprint: nativeAgentPolicyFingerprint(agent),
       retired: false,
       name,
-      fileName: `${fileStem}${extension}`,
+      fileName: parentDirect ? null : `${fileStem}${extension}`,
       contents,
       ...(claudeRendered ? { launchDefinition: claudeRendered.launchDefinition } : {}),
+      ...(parentLaunchDefinition ? { parentLaunchDefinition } : {}),
       ...(profileName ? {
         profileName,
         profileFileName: `${profileName}.config.toml`,
@@ -941,6 +1004,61 @@ export function renderManagedAgents(client, tenantId, agents, invocation = null,
   });
 }
 
+function shellQuote(value) {
+  return `'${String(value).replaceAll("'", `'"'"'`)}'`;
+}
+
+function claudeSlashCommandName(agent, generatedAgentName) {
+  const base = `ask-${generatedAgentName}`;
+  if (base.length <= 63) return base;
+  const prefix = generatedAgentName.slice(0, 50).replace(/-+$/u, "") || "agent";
+  return `ask-${prefix}-${agentBindingHash(agent)}`;
+}
+
+function renderClaudeSlashCommand(tenantId, agent, commandName, invocation) {
+  const tokens = [invocation.command, ...invocation.args].map(shellQuote).join(" ");
+  const bashCommand = `${tokens} --prompt "$ARGUMENTS" --json`;
+  const attribution = `Response from managed agent ${JSON.stringify(agent.title)} (${agent.agentId}):`;
+  return [
+    "---",
+    `description: ${JSON.stringify(`Ask managed agent ${agent.title} (${agent.agentId}) in Impel tenant ${tenantId}; its rendered answer is explicitly attributed.`)}`,
+    `argument-hint: ${JSON.stringify("<task>")}`,
+    `allowed-tools: ${JSON.stringify(`Bash(${tokens}:*)`)}`,
+    "---",
+    "",
+    `The JSON below came from managed agent ${JSON.stringify(agent.title)} (${agent.agentId}), not from the host model.`,
+    `Run the fixed command exactly once. If ok is true, output the attribution line ${JSON.stringify(attribution)} followed by finalText verbatim. If ok is false, attribute the reported error to the same managed agent. Do not perform, rewrite, or independently answer the task.`,
+    "",
+    `!\`${bashCommand}\``,
+    "",
+  ].join("\n");
+}
+
+export function renderManagedClaudeSlashCommands(tenantId, agents, invocation = null) {
+  const normalizedTenant = normalizeTenantId(tenantId);
+  const names = generatedClientAgentNames("claude", agents);
+  return agents.flatMap((agent, index) => {
+    if (!usesDirectAnswer(agent)) return [];
+    const commandName = claudeSlashCommandName(agent, names[index]);
+    const commandInvocation = invocation || impelCliInvocation([
+      "native", "answer",
+      "--tenant", normalizedTenant,
+      "--agent", agent.agentId,
+    ]);
+    return [{
+      agentId: agent.agentId,
+      name: commandName,
+      fileName: `${commandName}.md`,
+      contents: renderClaudeSlashCommand(
+        normalizedTenant,
+        agent,
+        commandName,
+        commandInvocation,
+      ),
+    }];
+  });
+}
+
 function renderRetiredManagedAgents(client, tenantId, bindings, active, invocation = null, { directCodeMode = true } = {}) {
   const usedNames = new Set(active.map(({ name }) => name));
   const usedFiles = new Set(active.map(({ fileName }) => fileName));
@@ -1154,6 +1272,54 @@ function validateClaudeLaunchDefinition(record, tenantId) {
   return definition;
 }
 
+function validateClaudeParentLaunchDefinition(record, tenantId) {
+  const definition = record.parentLaunchDefinition;
+  const expectedTools = [NATIVE_AGENT_ANSWER_TOOL, NATIVE_AGENT_RESUME_TOOL]
+    .map((name) => nativeToolName(name));
+  if (!exactObjectKeys(definition, ["prompt", "permissionMode", "tools", "mcpServers"])
+    || definition.prompt !== claudeParentDirectInstructions(tenantId, record)
+    || definition.permissionMode !== "bypassPermissions"
+    || JSON.stringify(definition.tools) !== JSON.stringify(expectedTools)
+    || !Array.isArray(definition.mcpServers)
+    || definition.mcpServers.length !== 1
+    || !exactObjectKeys(definition.mcpServers[0], [MANAGED_AGENT_MCP_SERVER])) {
+    throw new Error("the managed Claude parent-direct definition is invalid; run `impel agents sync claude`");
+  }
+  const server = definition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
+  const allowedEnvironment = new Set([IMPEL_MANAGED_MCP_ENV, ...IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES]);
+  if (!exactObjectKeys(server, ["type", "command", "args", "env"])
+    || server.type !== "stdio"
+    || typeof server.command !== "string"
+    || !server.command
+    || !Array.isArray(server.args)
+    || !server.args.every((argument) => typeof argument === "string")
+    || !server.env
+    || typeof server.env !== "object"
+    || Array.isArray(server.env)
+    || server.env[IMPEL_MANAGED_MCP_ENV] !== "1"
+    || !Object.entries(server.env).every(([key, value]) =>
+      allowedEnvironment.has(key)
+      && typeof value === "string"
+      && value.length <= 4096
+      && redactCredentialText(value) === value
+    )) {
+    throw new Error("the managed Claude parent-direct MCP definition is invalid; run `impel agents sync claude`");
+  }
+  const trustedInvocation = impelNativeAgentMcpInvocation({
+    tenantId,
+    agentId: record.agentId,
+    scopeParam: record.scopeParam,
+    policyFingerprint: record.policyFingerprint,
+    mode: "answer",
+  });
+  const trustedArgs = [...trustedInvocation.args, "--agent-title", record.title];
+  if (server.command !== trustedInvocation.command
+    || JSON.stringify(server.args) !== JSON.stringify(trustedArgs)) {
+    throw new Error("the managed Claude parent-direct binding is invalid; run `impel agents sync claude`");
+  }
+  return definition;
+}
+
 // A selector absent from the Impel manifest remains Claude-native. A matching
 // record is integrity checked, then re-declared under a random per-launch name
 // through Claude's higher-priority --agents source. This prevents project,
@@ -1192,11 +1358,34 @@ export function resolveManagedClaudeAgent(root, tenantId, selector) {
   const [record] = matches;
   if (typeof record.agentId !== "string"
     || !SAFE_AGENT_ID_RE.test(record.agentId)
+    || typeof record.title !== "string"
+    || !record.title.trim()
+    || record.title.length > 160
     || typeof record.scopeParam !== "string"
     || !SAFE_SCOPE_PARAM_RE.test(record.scopeParam)
     || !/^[a-f0-9]{64}$/u.test(record.policyFingerprint || "")) {
     throw new Error("the managed Claude binding metadata is invalid; run `impel agents sync claude`");
   }
+  if (record.launchMode === "parent-direct") {
+    if (!manifest.nativeParentDirect) {
+      throw new Error("the managed Claude parent-direct binding is stale; run `impel agents sync claude`");
+    }
+    const parentLaunchDefinition = validateClaudeParentLaunchDefinition(record, normalizedTenant);
+    const server = parentLaunchDefinition.mcpServers[0][MANAGED_AGENT_MCP_SERVER];
+    return {
+      ...record,
+      fileName: null,
+      path: null,
+      parentDirect: true,
+      parentLaunchDefinition,
+      parentMcpConfigJson: JSON.stringify({
+        mcpServers: { [MANAGED_AGENT_MCP_SERVER]: server },
+      }),
+    };
+  }
+  if (record.launchMode !== undefined) {
+    throw new Error("the managed Claude launch mode is invalid; run `impel agents sync claude`");
+  }
   const fileName = `${record.name}.md`;
   if (path.basename(fileName) !== fileName || !manifest.files.includes(fileName)) {
     throw new Error("the managed Claude agent mapping is invalid; run `impel agents sync claude`");
@@ -1229,6 +1418,59 @@ export function resolveManagedClaudeAgent(root, tenantId, selector) {
   };
 }
 
+/**
+ * Resolve a synchronized, read-only Claude binding that is allowed to use the
+ * bounded direct-answer transport. The public `impel native answer` command
+ * deliberately trusts the integrity-tracked profile rather than accepting
+ * model- or user-supplied scope/fingerprint routing arguments.
+ */
+export function resolveManagedClaudeAnswerBinding(root, tenantId, selector) {
+  const resolved = resolveManagedClaudeAgent(root, tenantId, selector);
+  if (!resolved) {
+    throw new Error(
+      `managed Claude agent ${JSON.stringify(selector)} was not found for tenant ${JSON.stringify(normalizeTenantId(tenantId))}`,
+    );
+  }
+  const definition = resolved.parentDirect
+    ? resolved.parentLaunchDefinition
+    : resolved.launchDefinition;
+  const server = definition?.mcpServers?.[0]?.[MANAGED_AGENT_MCP_SERVER];
+  if (!Array.isArray(server?.args) || !server.args.includes("--answer-only")) {
+    throw new Error(
+      `managed Claude agent ${JSON.stringify(selector)} is not configured for direct answers`,
+    );
+  }
+  return {
+    tenantId: normalizeTenantId(tenantId),
+    agentId: resolved.agentId,
+    title: resolved.title,
+    name: resolved.name,
+    scopeParam: resolved.scopeParam,
+    policyFingerprint: resolved.policyFingerprint,
+  };
+}
+
+export function managedClaudeAnswerBindings(root, tenantId) {
+  const normalizedTenant = normalizeTenantId(tenantId);
+  const manifest = readManagedAgentManifest(root);
+  if (!manifest
+    || manifest.version !== MANAGED_AGENT_MANIFEST_VERSION
+    || manifest.client !== "claude"
+    || manifest.tenantId !== normalizedTenant
+    || !Array.isArray(manifest.agents)) {
+    return [];
+  }
+  return manifest.agents.flatMap((record) => {
+    if (!record || record.retired || typeof record.agentId !== "string") return [];
+    const definition = record.launchMode === "parent-direct"
+      ? record.parentLaunchDefinition
+      : record.launchDefinition;
+    const args = definition?.mcpServers?.[0]?.[MANAGED_AGENT_MCP_SERVER]?.args;
+    if (!Array.isArray(args) || !args.includes("--answer-only")) return [];
+    return [resolveManagedClaudeAnswerBinding(root, normalizedTenant, record.agentId)];
+  });
+}
+
 export function resolveManagedCodexAgentProfile(root, tenantId, selector) {
   const normalizedTenant = normalizeTenantId(tenantId);
   const normalizedSelector = boundedString(selector, "agent selector", { max: 512 });
@@ -1279,12 +1521,29 @@ function profileIsFresh(profile, tenantId, now, ttlMs) {
     || Array.isArray(manifest.contentDigests)) return false;
   const expectedDirectProfiles = profile.client === "codex" && profile.directProfiles !== false;
   const expectedDirectCodeMode = profile.client === "codex" && profile.directCodeMode !== false;
+  const expectedNativeParentDirect = profile.client === "claude"
+    && (profile.nativeParentDirect ?? nativeParentDirectEnabled());
+  const expectedNativeSlashCommands = profile.client === "claude"
+    && (profile.nativeSlashCommands ?? nativeSlashCommandsEnabled());
+  const expectedNativeIntercept = profile.client === "claude"
+    && (profile.nativeIntercept ?? nativeInterceptEnabled());
+  const expectedNativeInterceptTimeoutMs = expectedNativeIntercept
+    ? (profile.nativeInterceptTimeoutMs ?? nativeInterceptTimeoutMs())
+    : null;
   if (manifest.directProfiles !== expectedDirectProfiles
-    || manifest.directCodeMode !== expectedDirectCodeMode) return false;
+    || manifest.directCodeMode !== expectedDirectCodeMode
+    || Boolean(manifest.nativeParentDirect) !== expectedNativeParentDirect
+    || Boolean(manifest.nativeSlashCommands) !== expectedNativeSlashCommands
+    || Boolean(manifest.nativeIntercept) !== expectedNativeIntercept
+    || (expectedNativeIntercept
+      && manifest.nativeInterceptTimeoutMs !== expectedNativeInterceptTimeoutMs)) return false;
   const syncedAt = Date.parse(manifest.syncedAt || "");
   if (!Number.isFinite(syncedAt) || now - syncedAt >= ttlMs) return false;
   const artifacts = [
     ...manifest.files.map((fileName) => `agents/${fileName}`),
+    ...(Array.isArray(manifest.commands)
+      ? manifest.commands.map((fileName) => `commands/${fileName}`)
+      : []),
     ...(Array.isArray(manifest.profiles) ? manifest.profiles : []),
   ];
   // Renderer changes are invalidated by the manifest version/capability fields
@@ -1306,10 +1565,15 @@ export function syncAgentProfile({
   agents,
   directProfiles = client === "codex",
   directCodeMode = client === "codex",
+  nativeParentDirect = client === "claude" && nativeParentDirectEnabled(),
+  nativeSlashCommands = client === "claude" && nativeSlashCommandsEnabled(),
+  nativeIntercept = client === "claude" && nativeInterceptEnabled(),
+  nativeInterceptTimeoutMs: interceptTimeoutMs = nativeIntercept ? nativeInterceptTimeoutMs() : null,
   now = Date.now(),
   nativeAgentRunsRoot = path.join(CONFIG_DIR, "native-agent-runs"),
 }) {
   const agentsDir = path.join(root, "agents");
+  const commandsDir = path.join(root, "commands");
   for (const candidate of [root, agentsDir]) {
     if (fs.existsSync(candidate) && fs.lstatSync(candidate).isSymbolicLink()) {
       throw new Error(`refusing to use symlinked native-agent path ${candidate}`);
@@ -1319,7 +1583,15 @@ export function syncAgentProfile({
   privateDirectory(managedDir);
   const manifestPath = path.join(managedDir, MANAGED_AGENT_MANIFEST);
   const prior = readManifest(manifestPath);
-  const active = renderManagedAgents(client, tenantId, agents, null, { directCodeMode });
+  if ((nativeSlashCommands || prior?.commands?.length > 0)
+    && fs.existsSync(commandsDir)
+    && fs.lstatSync(commandsDir).isSymbolicLink()) {
+    throw new Error(`refusing to use symlinked native-agent path ${commandsDir}`);
+  }
+  const active = renderManagedAgents(client, tenantId, agents, null, {
+    directCodeMode,
+    nativeParentDirect,
+  });
   const activeBindings = new Set(active.map((agent) =>
     `${agent.agentId}\0${agent.scopeParam}\0${agent.policyFingerprint}`
   ));
@@ -1329,14 +1601,22 @@ export function syncAgentProfile({
     ));
   const retired = renderRetiredManagedAgents(client, tenantId, retiredBindings, active, null, { directCodeMode });
   const rendered = [...active, ...retired];
+  const commands = client === "claude" && nativeSlashCommands
+    ? renderManagedClaudeSlashCommands(tenantId, agents)
+    : [];
+  const renderedFiles = rendered.filter(({ fileName }) => typeof fileName === "string");
   if (new Set(rendered.map(({ name }) => name)).size !== rendered.length
-    || new Set(rendered.map(({ fileName }) => fileName)).size !== rendered.length
+    || new Set(renderedFiles.map(({ fileName }) => fileName)).size !== renderedFiles.length
     || (client === "codex" && directProfiles
       && new Set(rendered.map(({ profileFileName }) => profileFileName)).size !== rendered.length)) {
     throw new Error("generated native-agent destinations are not unique");
   }
+  if (new Set(commands.map(({ fileName }) => fileName)).size !== commands.length) {
+    throw new Error("generated native-agent slash command destinations are not unique");
+  }
   const priorFiles = new Set(prior?.files || []);
   const priorProfiles = new Set(prior?.profiles || []);
+  const priorCommands = new Set(prior?.commands || []);
   const priorUsesDiscoveryRoot = Number.isInteger(prior?.version)
     && prior.version >= 2
     && prior.version <= MANAGED_AGENT_MANIFEST_VERSION;
@@ -1362,14 +1642,16 @@ export function syncAgentProfile({
   // Preflight every destination before writing so an unmanaged file with the
   // same generated name is never overwritten.
   for (const agent of rendered) {
-    const destination = path.join(agentsDir, agent.fileName);
-    if (fs.existsSync(destination)) {
-      if (fs.lstatSync(destination).isSymbolicLink()) {
-        throw new Error(`refusing to overwrite symlinked native-agent file ${destination}`);
-      }
-      if ((!priorOwnsManagedFiles || !priorFiles.has(agent.fileName))
-        && !reclaimable(`agents/${agent.fileName}`, destination)) {
-        throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
+    if (agent.fileName) {
+      const destination = path.join(agentsDir, agent.fileName);
+      if (fs.existsSync(destination)) {
+        if (fs.lstatSync(destination).isSymbolicLink()) {
+          throw new Error(`refusing to overwrite symlinked native-agent file ${destination}`);
+        }
+        if ((!priorOwnsManagedFiles || !priorFiles.has(agent.fileName))
+          && !reclaimable(`agents/${agent.fileName}`, destination)) {
+          throw new Error(`refusing to overwrite unmanaged native-agent file ${destination}`);
+        }
       }
     }
     if (client === "codex" && directProfiles) {
@@ -1385,11 +1667,27 @@ export function syncAgentProfile({
       }
     }
   }
+  for (const command of commands) {
+    const destination = path.join(commandsDir, command.fileName);
+    if (fs.existsSync(destination)) {
+      if (fs.lstatSync(destination).isSymbolicLink()) {
+        throw new Error(`refusing to overwrite symlinked native-agent slash command ${destination}`);
+      }
+      if ((!priorOwnsManagedFiles || !priorCommands.has(command.fileName))
+        && !reclaimable(`commands/${command.fileName}`, destination)) {
+        throw new Error(`refusing to overwrite unmanaged native-agent slash command ${destination}`);
+      }
+    }
+  }
   for (const agent of rendered) {
-    atomicPrivateWrite(path.join(agentsDir, agent.fileName), agent.contents);
+    if (agent.fileName) atomicPrivateWrite(path.join(agentsDir, agent.fileName), agent.contents);
     if (client === "codex" && directProfiles) atomicPrivateWrite(path.join(root, agent.profileFileName), agent.profileContents);
   }
-  const currentFiles = new Set(rendered.map((agent) => agent.fileName));
+  for (const command of commands) {
+    atomicPrivateWrite(path.join(commandsDir, command.fileName), command.contents);
+  }
+  const currentFiles = new Set(renderedFiles.map((agent) => agent.fileName));
+  const currentCommands = new Set(commands.map((command) => command.fileName));
   const currentProfiles = new Set(client === "codex" && directProfiles
     ? rendered.map((agent) => agent.profileFileName)
     : []);
@@ -1422,6 +1720,15 @@ export function syncAgentProfile({
       fs.rmSync(path.join(root, stale), { force: true });
     }
   }
+  for (const stale of client === "claude" ? prior?.commands || [] : []) {
+    if (
+      staleRemovable(stale, `commands/${stale}`, path.join(commandsDir, stale))
+      && stale.endsWith(".md")
+      && !currentCommands.has(stale)
+    ) {
+      fs.rmSync(path.join(commandsDir, stale), { force: true });
+    }
+  }
   if (!priorUsesDiscoveryRoot) {
     for (const legacy of prior?.files || []) {
       if (
@@ -1433,20 +1740,36 @@ export function syncAgentProfile({
       }
     }
   }
+  if (client === "claude") {
+    ensureClaudeNativeInterceptHook(root, tenantId, {
+      enabled: nativeIntercept,
+      ...(nativeIntercept ? { timeoutMs: interceptTimeoutMs } : {}),
+    });
+  }
   const contentDigests = Object.fromEntries(rendered.flatMap((agent) => [
-    [`agents/${agent.fileName}`, contentDigest(agent.contents)],
+    ...(agent.fileName ? [[`agents/${agent.fileName}`, contentDigest(agent.contents)]] : []),
     ...(client === "codex" && directProfiles
       ? [[agent.profileFileName, contentDigest(agent.profileContents)]]
       : []),
-  ]).sort(([left], [right]) => left.localeCompare(right)));
+  ]).concat(commands.map((command) => [
+    `commands/${command.fileName}`,
+    contentDigest(command.contents),
+  ])).sort(([left], [right]) => left.localeCompare(right)));
   atomicPrivateWrite(manifestPath, `${JSON.stringify({
     version: MANAGED_AGENT_MANIFEST_VERSION,
     tenantId,
     client,
     directProfiles: client === "codex" && directProfiles,
     directCodeMode: client === "codex" && directCodeMode,
+    ...(client === "claude" && nativeParentDirect ? { nativeParentDirect: true } : {}),
+    ...(client === "claude" && nativeSlashCommands ? { nativeSlashCommands: true } : {}),
+    ...(client === "claude" && nativeIntercept ? {
+      nativeIntercept: true,
+      nativeInterceptTimeoutMs: interceptTimeoutMs,
+    } : {}),
     syncedAt: new Date(now).toISOString(),
     files: [...currentFiles].sort(),
+    ...(client === "claude" && nativeSlashCommands ? { commands: [...currentCommands].sort() } : {}),
     profiles: [...currentProfiles].sort(),
     contentDigests,
     agents: rendered.map((agent) => ({
@@ -1458,7 +1781,9 @@ export function syncAgentProfile({
       retired: agent.retired,
       name: agent.name,
       ...(client === "claude" ? {
-        launchDefinition: agent.launchDefinition,
+        ...(agent.parentLaunchDefinition
+          ? { launchMode: "parent-direct", parentLaunchDefinition: agent.parentLaunchDefinition }
+          : { launchDefinition: agent.launchDefinition }),
       } : {}),
       ...(client === "codex" && directProfiles ? {
         profileName: agent.profileName,
@@ -1474,6 +1799,7 @@ export function syncAgentProfile({
     count: active.length,
     recoveryCount: retired.length,
     files: [...currentFiles],
+    ...(client === "claude" && nativeSlashCommands ? { commands: [...currentCommands] } : {}),
     profiles: [...currentProfiles],
   };
 }

package/src/apps.js

@@ -25,6 +25,7 @@ import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHook
 import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
 import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 import { brandedEnvironmentName, RUNTIME_BRAND } from "./runtimeBrand.js";
+import { CURRENT_CONFIG_VERSION } from "./managedProfileVersion.js";
 import { IMPEL_CODEX_PARENT_DELEGATION_INSTRUCTIONS } from "./commands/launch.js";
 import {
   desktopTasksAssetPaths,
@@ -301,7 +302,7 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // 35: enable the Code Mode host in managed desktop profiles (pinned Codex
 // fails closed on code_mode_only models without it) and serve CLI model
 // catalogs from the shared registry so efforts and tiers cannot drift.
-export const CURRENT_CONFIG_VERSION = 35;
+export { CURRENT_CONFIG_VERSION };
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this