impel-cli 0.20.55 → 0.20.57

package/RELEASE_NOTES.md

@@ -1,5 +1,94 @@
 # Release notes
 
+## 0.20.57 — Live tenant model catalogs for `impel codex` (`impel models sync`)
+
+- Adds `impel models sync|list`: the isolated `impel codex` Codex picker now
+  follows the tenant's live gateway catalog (`GET /v1/models`) instead of
+  being frozen at CLI release time. `sync` rewrites the tenant `models.json`
+  atomically (with `--stale-only` TTL gating); `list` shows the picker
+  contents, whether they came from a gateway sync or the built-in offline
+  floor, and how stale they are.
+- Launches never block on the network: `ensureImpelCodexProfile` stays
+  synchronous and keeps writing the built-in catalog as the offline floor,
+  while an async, never-throwing `syncCodexModelsSafe` layers the gateway
+  catalog after it — at launch, from the detached 6h stale-only app refresh,
+  from codex session hooks, and from the `impel token` heartbeat Codex calls
+  every ~5 minutes. A valid synced catalog survives relaunches
+  (stale-beats-broken); a failed sync keeps the last good file.
+- Records catalog provenance in `models-manifest.json`
+  (`{schemaVersion, syncedAt, catalogVersion, digest}` plus tenant/gateway/
+  experiment bindings): tampered bytes or changed bindings fall back to the
+  floor, and `impel doctor` reports CLI catalog staleness per tenant.
+- Cross-app models (hidden experiment) now reach the isolated CLI: with
+  `experimental.crossAppModels` enabled, `impel codex` routes through the
+  experimental OpenAI-compatible gateway path and projects tenant Claude
+  models into the Codex picker — fail-closed on each model's verified
+  `client_capabilities.codex`, exactly like the desktop app.
+- Moves the Claude→Codex projection (`foreignClaudeCodexCatalogEntry`) and
+  the gateway catalog fetch (`fetchGatewayModels`) into leaf modules shared
+  by the CLI and desktop writers (re-exported from `src/apps.js`), so the
+  two surfaces can never fork the projection again. Gateway JSON is still
+  reconstructed field-by-field, never written through.
+- Bumps `CURRENT_CONFIG_VERSION` to 45 so existing installs take the slow
+  rewrite path once.
+- Release mechanics: the released-fixture corpus for 0.20.57 was re-captured
+  on the final release tree (after the projection-convergence merge added
+  `additional_speed_tiers` to the shared Codex projection) and is
+  byte-identical to the earlier capture — vendor model catalogs
+  (`models.json`), the only artifacts that projection change touches, are
+  excluded from the corpus by design (offline determinism), so no corpus
+  bytes moved.
+- Skipped the green requirement on the `Pinned ChatGPT/Codex Store install`
+  vendor-contract job because the Microsoft Store now fulfills
+  `OpenAI.Codex 26.818.5229.0` while the reviewed pin tracks `26.818.2441.0`
+  (upstream Store drift; the pin bump is tracked as its own follow-up). The
+  `Pinned Claude MSIX install and replacement` job is required green on the
+  release SHA as usual; the release gate is bypassed only via the documented
+  `workflow_dispatch` + `skip_release_gate` escape hatch with a written
+  reason naming that drift, after manually verifying every other required
+  check green on the tagged SHA.
+- Skipped the prerelease soak (testing-protocol §4.2): 0.20.57 ships stable
+  without a `next`-channel soak.
+- Local `pnpm test` on the release machine shows two known environmental
+  failures (launch.test.js / managed-apps.test.js, caused by this machine's
+  MSC-enrolled managed apps); they reproduce on clean `main` and all six CI
+  `Node {18,24}` legs run the same suite green.
+
+## 0.20.56 — Enforce reviewed Windows vendor CLIs, follow the Store pin, harden convergence
+
+- Bumps the Windows ChatGPT Store pin to `26.818.2441.0` (embedded Codex
+  `0.148.0-alpha.21`, verified from the registered package on the disposable
+  Windows runner): the Store stopped fulfilling `26.814.5167.0`, so fresh
+  Windows installs failed the exact registered-package check (IMP-590). The
+  macOS pin stays held at `26.810.41047` pending a build that passes the
+  managed Tasks board launch smoke. Exact package, publisher, executable, and
+  embedded-runtime verification is unchanged.
+
+- Enforces the exact reviewed Claude Code and Codex CLI releases on Windows,
+  matching the macOS contract: a vendor auto-update past the pin no longer
+  launches an unreviewed build against the gateway (the drift behind the
+  Windows `403 Forbidden` lockouts), and the launcher resolves the pinned
+  side-by-side release under `.local/share/claude/versions/` when the shared
+  launcher has drifted — including installs whose `HOME` diverges from
+  `USERPROFILE`.
+- Disables the vendor background auto-updater in managed Claude CLI profiles
+  (`DISABLE_AUTOUPDATER=1`) so a session on the reviewed release cannot move
+  the shared launcher past the pin; manual `claude update` still works.
+- Names vendor version drift in setup/update diagnostics ("installed v2.1.237
+  does not match the reviewed v2.1.220") instead of the misleading
+  "not installed or discoverable".
+- Stops `chmod` failures from aborting Windows tenant convergence: managed
+  profile writers treat the FAT-era mode bits as best-effort on Windows, and
+  the all-tenant security sweep no longer fails every tenant over one
+  tenant's locked file. POSIX keeps failing loudly.
+- Retries the Windows stable-entrypoint and managed-artifact renames through
+  the shared antivirus-tolerant retry helper.
+- Carries which tenants failed and why in the auto-filed
+  "Tenant convergence failed during `impel update`" report, via a redacted
+  on-disk summary the cascaded child leaves for the parent's single report.
+- Sends `X-Impel-Cli-Version` on gateway requests from `impel claude` so a
+  production 403 can be correlated to a CLI release.
+
 ## 0.20.55 — Route managed CLIs through the signed runner
 
 - Launches `impel codex` and `impel claude` through the tenant-agnostic macOS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.55",
+  "version": "0.20.57",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -11,7 +11,7 @@ import {
   secureManagedCodexHome,
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
-import { codexCatalogEntry } from "./modelCatalog.js";
+import { codexCatalogEntry, foreignClaudeCodexCatalogEntry } from "./modelCatalog.js";
 import {
   IMPEL_CLI_ENTRYPOINT,
   IMPEL_TASKS_MCP_SERVER_NAME,
@@ -20,6 +20,7 @@ import {
   isImpelTasksMcpInvocation,
 } from "./selfInvocation.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
+import { chmodWithPlatformPolicy, renameWithWindowsRetry } from "./windowsFs.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
 import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
@@ -131,12 +132,15 @@ export const PINNED_VENDOR_APPS = Object.freeze({
       // against this value. updateManifestUrl below is advertisement, read by
       // the contract test alone and never by the install path.
       //
-      // Those two disagree as of 2026-08-18: the manifest advertises
-      // 26.814.5517.0 while the Store installs 26.814.5167.0. Pin what actually
-      // installs — a pin matching only the advertisement would fail closed on
-      // every real machine.
-      packageVersion: "26.814.5167.0",
-      codexVersion: "0.148.0-alpha.15",
+      // Those two disagree again as of 2026-08-20: the manifest advertises
+      // 26.818.2872.0 while the disposable-runner Store install registered
+      // 26.818.2441.0 (the Store stopped fulfilling 26.814.5167.0 entirely —
+      // IMP-590). Pin what actually installs — a pin matching only the
+      // advertisement would fail closed on every real machine.
+      packageVersion: "26.818.2441.0",
+      // Verified on the disposable Windows runner: the registered package's
+      // embedded codex.exe --version reports exactly this release.
+      codexVersion: "0.148.0-alpha.21",
       publisherId: "2p2nqsd0c76g0",
       executable: "app\\ChatGPT.exe",
       updateManifestUrl: "https://persistent.oaistatic.com/codex-app-prod/windows-store-update.json",
@@ -230,7 +234,11 @@ const LEGACY_TRAPPED_CLAUDE_NAME = new RegExp(`^${escapedDisplayPrefix} Claude(
 // modelCatalog.js (a leaf module) so cliProfiles.js can consume them
 // without importing this module's launch-command cycle. Re-exported here
 // for the many existing consumers.
-export { FALLBACK_MODELS, managedCodexCliCatalog } from "./modelCatalog.js";
+// Re-exported from their leaf homes so existing importers keep working;
+// modelCatalog.js and gatewayModels.js must never import from apps.js (the
+// leaf constraint behind the 0.20.39 fork regression).
+export { FALLBACK_MODELS, foreignClaudeCodexCatalogEntry, managedCodexCliCatalog } from "./modelCatalog.js";
+export { fetchGatewayModels } from "./gatewayModels.js";
 
 export function normalizeAppTarget(value) {
   if (value == null || value === "all") return ["claude", "chatgpt"];
@@ -820,14 +828,14 @@ export function migrateLegacyClaudeAppSessions(userData, homeDir = os.homedir())
       const sourceStat = fs.statSync(source);
       if (fs.existsSync(destination) && fs.statSync(destination).mtimeMs >= sourceStat.mtimeMs) continue;
       fs.mkdirSync(destinationDirectory, { recursive: true, mode: 0o700 });
-      fs.chmodSync(destinationDirectory, 0o700);
+      chmodWithPlatformPolicy(destinationDirectory, 0o700);
       const temporary = `${destination}.tmp-${process.pid}`;
       try {
         fs.copyFileSync(source, temporary);
-        fs.chmodSync(temporary, 0o600);
-        fs.renameSync(temporary, destination);
+        chmodWithPlatformPolicy(temporary, 0o600);
+        renameWithWindowsRetry(temporary, destination);
         fs.utimesSync(destination, sourceStat.atime, sourceStat.mtime);
-        fs.chmodSync(destination, 0o600);
+        chmodWithPlatformPolicy(destination, 0o600);
         copied += 1;
       } finally {
         fs.rmSync(temporary, { force: true });
@@ -837,33 +845,6 @@ export function migrateLegacyClaudeAppSessions(userData, homeDir = os.homedir())
   return copied;
 }
 
-export async function fetchGatewayModels(config, fetchImpl = fetch, { allowEmpty = false } = {}) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 20000);
-  try {
-    const response = await fetchImpl(`${config.gatewayUrl}/v1/models`, {
-      headers: { authorization: `Bearer ${config.pat}` },
-      signal: controller.signal,
-    });
-    if (!response.ok) throw new Error(`HTTP ${response.status}`);
-    const payload = await response.json();
-    if (config.tenantId && payload?.org_id !== config.tenantId) {
-      throw new Error("gateway model catalog tenant did not match the selected tenant");
-    }
-    if (config.productAccess && payload?.product_access !== config.productAccess) {
-      throw new Error("gateway model catalog product access did not match the live entitlement");
-    }
-    if (!Array.isArray(payload?.data)) throw new Error("response has no model data array");
-    const models = payload.data.filter(isGatewayModel);
-    if (models.length === 0 && !(allowEmpty && isExplicitNoSeatCatalog(payload))) {
-      throw new Error("gateway returned no supported models");
-    }
-    return { models, source: "gateway", version: payload.version ?? null };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
 export function installManagedAppFiles({
   config,
   targets,
@@ -1551,66 +1532,6 @@ export function projectClaudeDesktopModels(models) {
   });
 }
 
-export function foreignClaudeCodexCatalogEntry(model, index) {
-  const capability = model.client_capabilities?.codex;
-  const levels = capability?.supported_reasoning_levels;
-  const tiers = capability?.service_tiers;
-  const modalities = capability?.input_modalities;
-  const valid = capability && typeof capability === "object"
-    && Number.isInteger(capability.context_window) && capability.context_window > 0
-    && Number.isInteger(capability.max_context_window) && capability.max_context_window >= capability.context_window
-    && Array.isArray(levels) && levels.every((level) => (
-      level && typeof level.effort === "string" && typeof level.description === "string"
-    ))
-    && Array.isArray(tiers) && tiers.every((tier) => (
-      tier && typeof tier.id === "string" && typeof tier.name === "string" && typeof tier.description === "string"
-    ))
-    && Array.isArray(modalities) && modalities.every((value) => typeof value === "string")
-    && ["supports_parallel_tool_calls", "supports_reasoning_summaries", "supports_verbosity", "supports_search_tool", "supports_image_detail_original"]
-      .every((key) => typeof capability[key] === "boolean")
-    && (capability.default_reasoning_level == null
-      || capability.default_reasoning_level === ""
-      || levels.some((level) => level.effort === capability.default_reasoning_level))
-    && (capability.apply_patch_tool_type == null || typeof capability.apply_patch_tool_type === "string")
-    && (capability.web_search_tool_type == null || typeof capability.web_search_tool_type === "string");
-  if (!valid) {
-    console.warn(`impel: omitting model ${redactSecretText(model.id)} from Impel ChatGPT: missing verified Codex capabilities`);
-    return null;
-  }
-  return {
-    slug: model.id,
-    display_name: model.display_name || model.id,
-    description: model.description || `Claude model available through the Impel gateway (${model.id}).`,
-    ...(capability.default_reasoning_level ? { default_reasoning_level: capability.default_reasoning_level } : {}),
-    supported_reasoning_levels: levels,
-    service_tiers: tiers,
-    shell_type: "shell_command",
-    visibility: "list",
-    supported_in_api: true,
-    priority: Number.isInteger(model.priority) ? model.priority : index + 1,
-    base_instructions: "You are an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
-    include_skills_usage_instructions: false,
-    supports_reasoning_summaries: capability.supports_reasoning_summaries,
-    support_verbosity: capability.supports_verbosity,
-    ...(capability.supports_reasoning_summaries ? { default_reasoning_summary: "none" } : {}),
-    ...(capability.supports_verbosity ? { default_verbosity: "low" } : {}),
-    ...(capability.apply_patch_tool_type ? { apply_patch_tool_type: capability.apply_patch_tool_type } : {}),
-    ...(capability.web_search_tool_type ? { web_search_tool_type: capability.web_search_tool_type } : {}),
-    truncation_policy: { mode: "tokens", limit: 10000 },
-    context_window: capability.context_window,
-    max_context_window: capability.max_context_window,
-    effective_context_window_percent: 95,
-    experimental_supported_tools: [],
-    input_modalities: modalities,
-    supports_parallel_tool_calls: capability.supports_parallel_tool_calls,
-    supports_image_detail_original: capability.supports_image_detail_original,
-    supports_search_tool: capability.supports_search_tool,
-    use_responses_lite: false,
-    tool_mode: null,
-    multi_agent_version: null,
-  };
-}
-
 function readVendorCodexModels(vendorPath) {
   const binary = vendorPath && path.join(vendorPath, "Contents", "Resources", "codex");
   if (!binary || !fs.existsSync(binary)) return new Map();
@@ -3350,31 +3271,16 @@ export function replaceDirectory(destination, staging, options = {}) {
   ));
 }
 
-function isGatewayModel(model) {
-  return model && typeof model.id === "string" && (model.provider === "claude" || model.provider === "codex");
-}
-
-function isExplicitNoSeatCatalog(payload) {
-  const statuses = payload?.provider_status;
-  return Boolean(statuses
-    && typeof statuses === "object"
-    && !Array.isArray(statuses)
-    && ["claude", "codex"].every((provider) => (
-      statuses[provider]?.state === "no_seat"
-      && statuses[provider]?.routable === false
-    )));
-}
-
 function writeAtomic(target, contents, mode) {
   fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
   if (fs.existsSync(target) && fs.readFileSync(target, "utf8") === contents) {
-    fs.chmodSync(target, mode);
+    chmodWithPlatformPolicy(target, mode);
     return;
   }
   const tmp = `${target}.tmp-${process.pid}`;
   fs.writeFileSync(tmp, contents, { mode });
-  fs.renameSync(tmp, target);
-  fs.chmodSync(target, mode);
+  renameWithWindowsRetry(tmp, target);
+  chmodWithPlatformPolicy(target, mode);
 }
 
 function bundleVersion(bundle) {

package/src/cli.js

@@ -11,6 +11,7 @@ import { cmdApps } from "./commands/apps.js";
 import { cmdMcp } from "./commands/mcp.js";
 import { cmdLaunch } from "./commands/launch.js";
 import { cmdSkills } from "./commands/skills.js";
+import { cmdModels } from "./commands/models.js";
 import { cmdAgents } from "./commands/agents.js";
 import { cmdTenant } from "./commands/tenant.js";
 import { cmdDoctor } from "./commands/doctor.js";
@@ -68,6 +69,7 @@ Account:
 Diagnostics:
   impel status                                Authentication, current tenant, and local readiness
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
+  impel models list|sync                      Inspect or refresh the isolated Codex model catalog
   impel report --message "<text>"             Send a bug report; you approve the exact payload
 
 Reset:
@@ -183,6 +185,10 @@ async function dispatch(cmd, rest) {
     case "skill":
       return cmdSkills(rest);
 
+    case "models":
+    case "model":
+      return cmdModels(rest);
+
     case "agents":
     case "agent":
       return cmdAgents(rest);

package/src/cliProfiles.js

@@ -22,6 +22,7 @@ import { renameWithWindowsRetry } from "./windowsFs.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 import { managedCodexCliCatalog } from "./modelCatalog.js";
+import { codexModelsManifestPath, syncedCodexCatalogMatches } from "./modelsManifest.js";
 
 export const IMPEL_CLI_PROFILES_DIR = path.join(CONFIG_DIR, "cli");
 export const CODEX_GATEWAY_TOKEN_ENV = `${RUNTIME_BRAND.cli.providerId
@@ -120,6 +121,11 @@ export function ensureImpelClaudeProfile(gatewayUrl, tenantId, { crossAppModels
     ...(settings.env && typeof settings.env === "object" && !Array.isArray(settings.env)
       ? settings.env
       : {}),
+    // The launcher is shared machine-wide and this session runs the exact
+    // reviewed release; a background self-update from inside it would move
+    // that shared launcher past the reviewed pin for every later launch.
+    // Manual `claude update` keeps working.
+    DISABLE_AUTOUPDATER: "1",
     ANTHROPIC_BASE_URL: crossAppModels
       ? impelCrossAppClaudeBaseUrl(gatewayUrl)
       : impelClaudeBaseUrl(gatewayUrl),
@@ -195,14 +201,19 @@ function splitTomlPreamble(text) {
   return { preamble: text.slice(0, table.index), rest: text.slice(table.index) };
 }
 
-function codexManagedBlock(gatewayUrl, tenantId) {
+function codexManagedBlock(gatewayUrl, tenantId, { crossAppModels = false } = {}) {
   const providerId = RUNTIME_BRAND.cli.providerId;
   const lines = [
     CODEX_START_MARK,
     `# Generated for \`${RUNTIME_BRAND.cli.command} codex\`. Other profile settings outside this block are preserved.`,
     `[model_providers.${providerId}]`,
     `name = ${JSON.stringify(`${RUNTIME_BRAND.product.displayName} Gateway`)}`,
-    `base_url = ${JSON.stringify(impelCodexBaseUrl(gatewayUrl))}`,
+    // The experimental OpenAI-compatible route can dispatch both provider
+    // families (the desktop ChatGPT profile's cross-app path); the default
+    // route is the byte-preserving Codex passthrough.
+    `base_url = ${JSON.stringify(crossAppModels
+      ? `${gatewayUrl}/experimental/openai/v1`
+      : impelCodexBaseUrl(gatewayUrl))}`,
     'wire_api = "responses"',
     `env_key = ${JSON.stringify(CODEX_GATEWAY_TOKEN_ENV)}`,
   ];
@@ -228,7 +239,7 @@ function codexManagedBlock(gatewayUrl, tenantId) {
   return lines.join("\n");
 }
 
-export function ensureImpelCodexProfile(gatewayUrl, tenantId) {
+export function ensureImpelCodexProfile(gatewayUrl, tenantId, { crossAppModels = false } = {}) {
   secureAllManagedCodexHomes({ cliRoot: IMPEL_CLI_PROFILES_DIR });
   const { codexHome, codexCatalog } = tenantCliProfilePaths(tenantId);
   secureManagedCodexHome(codexHome);
@@ -264,14 +275,30 @@ export function ensureImpelCodexProfile(gatewayUrl, tenantId) {
     : `${nextPreamble.trimEnd()}\n${catalogLine}\n`;
   nextPreamble = nextPreamble.replace(/^bypass_hook_trust[ \t]*=[ \t]*(?:true|false)[ \t]*\n?/gm, "");
   const restText = rest.trim();
-  const next = [nextPreamble.trimEnd(), codexManagedBlock(gatewayUrl, tenantId), restText]
+  const next = [nextPreamble.trimEnd(), codexManagedBlock(gatewayUrl, tenantId, { crossAppModels }), restText]
     .filter(Boolean)
     .join("\n\n")
     .concat("\n");
 
   writePrivateFile(configPath, hardenManagedCodexToml(next, configPath));
-  writePrivateFile(codexCatalog, `${JSON.stringify(managedCodexCliCatalog(), null, 2)}\n`);
+  // Launch layering (D13), synchronous half: the FALLBACK_MODELS projection
+  // is the offline floor. A catalog that models-manifest.json proves is
+  // exactly what the last gateway sync wrote for THESE bindings (tenant,
+  // gateway, cross-app state) is kept even when its TTL has lapsed —
+  // stale-beats-broken — and syncCodexModelsSafe refreshes it afterwards
+  // without ever blocking this writer on the network. Anything else (first
+  // run, tampered bytes, changed bindings) is reset to the floor, and the
+  // stale manifest is removed so the TTL machinery sees the floor as stale.
+  const keepSyncedCatalog = syncedCodexCatalogMatches(codexHome, codexCatalog, {
+    tenantId: normalizeTenantId(tenantId),
+    gatewayUrl,
+    crossAppModels,
+  });
+  if (!keepSyncedCatalog) {
+    writePrivateFile(codexCatalog, `${JSON.stringify(managedCodexCliCatalog(), null, 2)}\n`);
+    fs.rmSync(codexModelsManifestPath(codexHome), { force: true });
+  }
   if (RUNTIME_BRAND.features.sessions) ensureCodexSessionHooks(codexHome, tenantId, "codex_cli");
   secureManagedCodexHome(codexHome);
-  return { codexHome, configPath, catalogPath: codexCatalog };
+  return { codexHome, configPath, catalogPath: codexCatalog, syncedCatalog: keepSyncedCatalog };
 }

package/src/codexSecurity.js

@@ -1,6 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
 
+import { chmodWithPlatformPolicy } from "./windowsFs.js";
+
 const PRIVATE_ROOT_FILES = ["auth.json", "config.toml", "models.json"];
 const MANAGED_COMMENT = "# Impel security policy: keep gateway credentials out of shell state.";
 
@@ -189,10 +191,10 @@ function assertSafeManagedPath(target, expectedType) {
  * to decide whether the file contains one. Known credential/config files are
  * owner-only. This function must never be called for the native ~/.codex home.
  */
-export function secureManagedCodexHome(codexHome) {
+export function secureManagedCodexHome(codexHome, { bestEffortChmod = false } = {}) {
   const existing = assertSafeManagedPath(codexHome, "directory");
   if (!existing) fs.mkdirSync(codexHome, { recursive: true, mode: 0o700 });
-  fs.chmodSync(codexHome, 0o700);
+  chmodWithPlatformPolicy(codexHome, 0o700, { bestEffort: bestEffortChmod });
 
   const snapshots = path.join(codexHome, "shell_snapshots");
   const snapshotStat = assertSafeManagedPath(snapshots, "directory");
@@ -201,7 +203,7 @@ export function secureManagedCodexHome(codexHome) {
     const filePath = path.join(codexHome, fileName);
     const stat = assertSafeManagedPath(filePath, "file");
     if (!stat) continue;
-    fs.chmodSync(filePath, 0o600);
+    chmodWithPlatformPolicy(filePath, 0o600, { bestEffort: bestEffortChmod });
   }
 }
 
@@ -214,7 +216,12 @@ function secureExistingManagedHome(root, relativeParts, secured) {
     if (stat.isSymbolicLink()) throw new Error(`${current} must not be a symbolic link.`);
     if (!stat.isDirectory()) throw new Error(`${current} must be a directory.`);
   }
-  secureManagedCodexHome(current);
+  // The sweep opportunistically tightens every managed home, including other
+  // tenants'. A chmod refusal on a sibling tenant's file must not abort the
+  // active tenant's convergence (observed in the field as an all-tenant
+  // failure over one tenant's models.json); symlink/type violations above
+  // still fail closed because they indicate tampering, not permissions.
+  secureManagedCodexHome(current, { bestEffortChmod: true });
   secured.push(current);
 }
 

package/src/commands/apps.js

@@ -45,6 +45,7 @@ import {
 import { resolveSkillCredential } from "../skillBundle.js";
 import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
 import { syncAgentProfilesSafe } from "../agents.js";
+import { syncCodexModelsSafe } from "../modelSync.js";
 import { secureManagedCodexHome } from "../codexSecurity.js";
 import { impelCliInvocation } from "../selfInvocation.js";
 import { createProgressLogger, withProgress } from "../progress.js";
@@ -749,6 +750,28 @@ export async function cmdWindowsApps(argv, overrides = {}) {
 
   try {
     if (action === "open" && RUNTIME_BRAND.cli.packageName === "impel-cli") maybePrintUpdateNotice();
+    // Windows mirror of refreshApps' CLI-catalog leg: the detached
+    // `app refresh --stale-only` slot also converges the isolated
+    // `impel codex` model catalog (D13). Runs before the desktop manifest
+    // fast-path below because the CLI catalog has its own TTL manifest.
+    if (action === "refresh") {
+      const stored = loadConfig();
+      if (stored?.pat) {
+        const cliTenantId = flags.tenant
+          ? normalizeTenantId(flags.tenant)
+          : stored.tenantId || null;
+        if (cliTenantId) {
+          await (overrides.syncCliModels || syncCodexModelsSafe)({
+            gatewayUrl: normalizeGatewayUrl(stored.gatewayUrl || resolveDefaultGateway()),
+            credential: tenantCredential(stored.pat, cliTenantId),
+            tenantId: cliTenantId,
+            crossAppModels: crossAppModelsEnabled(stored),
+            staleOnly: Boolean(flags["stale-only"]),
+            logger: { warn: () => {} },
+          });
+        }
+      }
+    }
     // Background token-helper refreshes pass --stale-only; honor the manifest
     // TTL here like the darwin refresh path does, so every vendor token call
     // does not become a full catalog fetch + profile rewrite (and its child
@@ -1355,11 +1378,31 @@ async function refreshApps(targets, { staleOnly = false, tenantId = null } = {},
     installFiles: installManagedAppFiles,
     syncSkills: syncSkillsSafe,
     syncAgents: syncAgentProfilesSafe,
+    syncCliModels: syncCodexModelsSafe,
     secureCodexHome: secureManagedCodexHome,
     ...overrides,
   };
   const stored = io.loadStoredConfig();
   if (!stored?.pat) return;
+  // The isolated `impel codex` catalog rides the same detached refresh slot
+  // (D13). Independent of the desktop legs below: a CLI-only machine has no
+  // installed app bundles yet still needs its Codex picker converging.
+  // syncCodexModelsSafe skips uninitialized profiles, honors the 6h manifest
+  // TTL under --stale-only, never throws, and keeps the last good catalog on
+  // failure.
+  {
+    const cliTenantId = tenantId ? normalizeTenantId(tenantId) : stored.tenantId || null;
+    if (cliTenantId) {
+      await io.syncCliModels({
+        gatewayUrl: normalizeGatewayUrl(stored.gatewayUrl || resolveDefaultGateway()),
+        credential: tenantCredential(stored.pat, cliTenantId),
+        tenantId: cliTenantId,
+        crossAppModels: crossAppModelsEnabled(stored),
+        staleOnly,
+        logger: { warn: () => {} },
+      });
+    }
+  }
   const requestedTenantId = tenantId
     ? normalizeTenantId(tenantId)
     : stored.tenantId || null;

package/src/commands/converge.js

@@ -1,6 +1,7 @@
 // Hidden fresh-build continuation used by `impel update`.
 
 import { loadConfig, saveConfig, redactSecretText } from "../config.js";
+import { writeConvergenceSummary } from "../convergenceSummary.js";
 import { runInstallRecovery } from "../installRecovery/engine.js";
 import {
   printReconciliationSummary,
@@ -10,6 +11,7 @@ import {
 import { applyCliUser, fetchTenants } from "../tenants.js";
 import { promptText } from "../prompt.js";
 import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
+import { brandedEnvironmentName } from "../runtimeBrand.js";
 import { restoreNativeProfiles } from "./use.js";
 import { createTenantRecoveryReportTracker } from "./tenantRecoveryReport.js";
 import { resolveSkillCredential } from "../skillBundle.js";
@@ -58,9 +60,22 @@ export async function cmdConverge(argv = [], overrides = {}) {
   if (overrides.prepareWindowsClis && !overrides.preparePlatformClis) {
     io.preparePlatformClis = overrides.prepareWindowsClis;
   }
+  // The summary exists solely for the `impel update` parent's failure report;
+  // a directly invoked `_converge` (tests, manual runs) writes nothing.
+  const cascade = io.environment?.[brandedEnvironmentName("UPDATE_CASCADE")] === "1";
+  const leaveSummary = (outcome) => {
+    if (!cascade) return;
+    (io.writeConvergenceSummary || writeConvergenceSummary)(outcome);
+  };
+  const summarize = (sharedFailure) => leaveSummary({
+    passed: false,
+    sharedFailure,
+    failedTenants: [],
+  });
   const config = io.loadConfig();
   if (!config?.pat) {
     console.error("impel update: not authenticated; run `impel setup` first.");
+    summarize("not authenticated");
     process.exitCode = 1;
     return false;
   }
@@ -72,6 +87,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
   } catch (error) {
     if (!RETRYABLE_TENANT_DISCOVERY_ERROR.test(String(error?.message || error))) {
       console.error(`impel update: tenant discovery failed (${redactSecretText(error?.message || error)})`);
+      summarize(`tenant discovery failed: ${error?.message || error}`);
       process.exitCode = 1;
       return false;
     }
@@ -81,6 +97,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
       listing = await io.fetchTenants(config);
     } catch (retryError) {
       console.error(`impel update: tenant discovery failed (${redactSecretText(retryError?.message || retryError)})`);
+      summarize(`tenant discovery failed after retry: ${retryError?.message || retryError}`);
       process.exitCode = 1;
       return false;
     }
@@ -156,6 +173,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
         credential: resolveSkillCredential({ pat: config.pat, tenantId: selected.id }),
         platform: io.platform,
         skipInstall: true,
+        crossAppModels: config.experimental?.crossAppModels === true,
       });
       let prepared = inspected;
       if (inspected.missingAfter.length && !inspectOnly && !skipClis) {
@@ -189,6 +207,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
             platform: io.platform,
             skipInstall: false,
             installTools,
+            crossAppModels: config.experimental?.crossAppModels === true,
           });
         }
       }
@@ -346,7 +365,17 @@ export async function cmdConverge(argv = [], overrides = {}) {
   }
   printReconciliationSummary(report);
   console.log(`CLI tenant: ${selected.id} (change with \`impel tenant use <tenant>\`)`);
-  if (!report.passed || sharedFailure) {
+  const passed = report.passed && !sharedFailure;
+  // Leave the machine-readable outcome for the `impel update` parent, whose
+  // auto-filed report otherwise knows nothing beyond this child's exit status.
+  leaveSummary({
+    passed,
+    sharedFailure,
+    failedTenants: report.tenants
+      .filter((tenant) => tenant.status === "failed")
+      .map((tenant) => ({ tenantId: tenant.tenantId, errors: tenant.errors })),
+  });
+  if (!passed) {
     if (sharedFailure) console.error(`Shared update failure: ${sharedFailure}`);
     console.error("impel update: one or more tenant surfaces remain incomplete.");
     process.exitCode = 1;