impel-cli 0.20.54 → 0.20.55

package/RELEASE_NOTES.md

@@ -1,5 +1,17 @@
 # Release notes
 
+## 0.20.55 — Route managed CLIs through the signed runner
+
+- Launches `impel codex` and `impel claude` through the tenant-agnostic macOS
+  managed runner when the corresponding signed descriptor is installed.
+- Binds each launch to the exact logical application ID and leaves descriptor
+  signature, trust-anchor, runtime-lock, and payload verification with the
+  signed runner before any vendor CLI starts.
+- Prefers the standalone Codex MSI on Windows while retaining the legacy
+  ChatGPT-embedded Codex package only as a compatibility fallback.
+- Stops newly managed Codex sessions from reaching retired macOS wrappers that
+  injected an invalid `--console` argument into no-argument launches.
+
 ## 0.20.54 — Restore ChatGPT Store compatibility and scope skills per tenant
 
 - Restores managed ChatGPT/Codex installation on Windows by pinning Store

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.54",
+  "version": "0.20.55",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/managedApps.js

@@ -4,7 +4,12 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 
 const TENANT = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/u;
-const APPLICATION_BY_TOOL = Object.freeze({ claude: "claude", codex: "chatgpt" });
+const APPLICATIONS_BY_TOOL = Object.freeze({
+  claude: ["claude"],
+  codex: ["codex", "chatgpt"],
+});
+const MAC_RUNNER = "/Applications/Impel Managed App Runner.app/Contents/Library/LaunchServices/impel-managed-runner";
+const MAC_DESCRIPTOR_ROOT = "/Library/Application Support/Impel/Managed App Runner/descriptors";
 
 function regularFile(file) {
   try {
@@ -15,7 +20,7 @@ function regularFile(file) {
   }
 }
 
-function parseCandidate(manifestPath, launcher, tool, platform, home) {
+function parseCandidate(manifestPath, launcher, applicationId, platform, home) {
   if (!regularFile(manifestPath) || !regularFile(launcher)) return null;
   let manifest;
   try {
@@ -25,7 +30,6 @@ function parseCandidate(manifestPath, launcher, tool, platform, home) {
   } catch {
     return null;
   }
-  const applicationId = APPLICATION_BY_TOOL[tool];
   const tenantId = manifest?.tenant?.id;
   const expectedPlatform = platform === "win32" ? "windows" : "macos";
   if (
@@ -46,11 +50,12 @@ function parseCandidate(manifestPath, launcher, tool, platform, home) {
     tenantId,
     tenantDisplayName: typeof manifest.tenant.displayName === "string" ? manifest.tenant.displayName : tenantId,
     launcher,
+    logicalApplicationId: manifest.logicalApplicationId,
     manifestPath,
   };
 }
 
-function macCandidates(tool, home, applicationsRoot) {
+function legacyMacCandidates(tool, home, applicationsRoot) {
   let entries;
   try {
     entries = fs.readdirSync(applicationsRoot, { withFileTypes: true });
@@ -58,13 +63,14 @@ function macCandidates(tool, home, applicationsRoot) {
     return [];
   }
   const candidates = [];
+  const applicationId = tool === "codex" ? "chatgpt" : tool;
   for (const entry of entries) {
     if (!entry.isDirectory() || !entry.name.endsWith(".app")) continue;
     const root = path.join(applicationsRoot, entry.name, "Contents");
     const candidate = parseCandidate(
       path.join(root, "Resources", "app-manifest.json"),
       path.join(root, "MacOS", "impel-apps-launcher"),
-      tool,
+      applicationId,
       "darwin",
       home,
     );
@@ -73,6 +79,78 @@ function macCandidates(tool, home, applicationsRoot) {
   return candidates;
 }
 
+function runnerEnvelopeCandidate(envelopePath, launcher, tool, home) {
+  if (!regularFile(envelopePath) || !regularFile(launcher)) return null;
+  let envelope;
+  try {
+    const raw = fs.readFileSync(envelopePath, "utf8");
+    if (Buffer.byteLength(raw, "utf8") > 512 * 1024) return null;
+    envelope = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const payload = envelope?.payload;
+  const tenantId = payload?.tenant?.id;
+  if (
+    envelope?.schemaVersion !== 1
+    || payload?.kind !== "com.useimpel.managed-application-descriptor"
+    || payload?.runtimeContract?.entrypoint !== "engine/main.mjs"
+    || payload?.application?.id !== tool
+    || payload?.application?.adapter !== tool
+    || !TENANT.test(tenantId || "")
+    || String(tenantId).includes("..")
+    || payload?.logicalApplicationId !== `${tenantId}.${tool}`
+  ) return null;
+  const credential = path.join(home, ".config", "impel", "apps", "credentials", `${tenantId}.json`);
+  if (!regularFile(credential)) return null;
+  return {
+    tenantId,
+    tenantDisplayName: typeof payload.tenant.displayName === "string" ? payload.tenant.displayName : tenantId,
+    launcher,
+    logicalApplicationId: payload.logicalApplicationId,
+    managedRunner: true,
+  };
+}
+
+function managedRunnerMacCandidates(tool, home, descriptorRoot, runnerLauncher) {
+  if (!regularFile(runnerLauncher)) return [];
+  let entries;
+  try {
+    entries = fs.readdirSync(descriptorRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    if (!entry.isDirectory() || !entry.name.endsWith(`.${tool}`)) continue;
+    const directory = path.join(descriptorRoot, entry.name);
+    let envelopes;
+    try {
+      envelopes = fs.readdirSync(directory, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const envelope of envelopes.sort((left, right) => left.name.localeCompare(right.name))) {
+      if (!envelope.isFile() || !envelope.name.endsWith(".json")) continue;
+      const candidate = runnerEnvelopeCandidate(path.join(directory, envelope.name), runnerLauncher, tool, home);
+      if (!candidate || candidate.logicalApplicationId !== entry.name) continue;
+      candidates.push(candidate);
+      break;
+    }
+  }
+  return candidates;
+}
+
+function macCandidates(tool, home, applicationsRoot, descriptorRoot, runnerLauncher) {
+  const preferred = managedRunnerMacCandidates(tool, home, descriptorRoot, runnerLauncher);
+  const legacy = legacyMacCandidates(tool, home, applicationsRoot);
+  const byTenant = new Map();
+  for (const candidate of [...preferred, ...legacy]) {
+    if (!byTenant.has(candidate.tenantId)) byTenant.set(candidate.tenantId, candidate);
+  }
+  return [...byTenant.values()];
+}
+
 function windowsCandidates(tool, home, applicationsRoot) {
   const candidates = [];
   let tenants;
@@ -83,15 +161,19 @@ function windowsCandidates(tool, home, applicationsRoot) {
   }
   for (const tenant of tenants) {
     if (!tenant.isDirectory() || !TENANT.test(tenant.name) || tenant.name.includes("..")) continue;
-    const root = path.join(applicationsRoot, tenant.name, APPLICATION_BY_TOOL[tool]);
-    const candidate = parseCandidate(
-      path.join(root, "resources", "app-manifest.json"),
-      path.join(root, "impel-apps-launcher.exe"),
-      tool,
-      "win32",
-      home,
-    );
-    if (candidate) candidates.push(candidate);
+    for (const applicationId of APPLICATIONS_BY_TOOL[tool]) {
+      const root = path.join(applicationsRoot, tenant.name, applicationId);
+      const candidate = parseCandidate(
+        path.join(root, "resources", "app-manifest.json"),
+        path.join(root, "impel-apps-launcher.exe"),
+        applicationId,
+        "win32",
+        home,
+      );
+      if (!candidate) continue;
+      candidates.push(candidate);
+      break;
+    }
   }
   return candidates;
 }
@@ -102,11 +184,15 @@ export function installedManagedAppCandidates(tool, {
   applicationsRoot = platform === "win32"
     ? path.join(process.env.ProgramFiles || "C:\\Program Files", "Impel", "Apps")
     : "/Applications",
+  descriptorRoot = MAC_DESCRIPTOR_ROOT,
+  runnerLauncher = MAC_RUNNER,
 } = {}) {
-  if (!APPLICATION_BY_TOOL[tool]) return [];
+  if (!APPLICATIONS_BY_TOOL[tool]) return [];
   const candidates = platform === "win32"
     ? windowsCandidates(tool, home, applicationsRoot)
-    : platform === "darwin" ? macCandidates(tool, home, applicationsRoot) : [];
+    : platform === "darwin"
+      ? macCandidates(tool, home, applicationsRoot, descriptorRoot, runnerLauncher)
+      : [];
   return candidates.sort((left, right) => left.tenantId.localeCompare(right.tenantId));
 }
 
@@ -170,8 +256,11 @@ export function runManagedAppCli(candidate, tool, argv, {
   cwd = process.cwd(),
   spawnProcess = spawn,
 } = {}) {
+  const args = candidate.managedRunner === true
+    ? ["--descriptor", candidate.logicalApplicationId, "--managed-cli", tool, "--", ...argv]
+    : ["--managed-cli", tool, "--", ...argv];
   return new Promise((resolve) => {
-    const child = spawnProcess(candidate.launcher, ["--managed-cli", tool, "--", ...argv], {
+    const child = spawnProcess(candidate.launcher, args, {
       cwd,
       env: environment,
       stdio: "inherit",
@@ -191,4 +280,3 @@ export function runManagedAppCli(candidate, tool, argv, {
     });
   });
 }
-