impel-cli 0.20.55 → 0.20.57

package/src/macSetup.js

@@ -178,6 +178,7 @@ export async function prepareMacClis({
   skipInstall = false,
   inspectOnly = false,
   installTools = ["claude", "codex"],
+  crossAppModels = false,
 } = {}, dependencies = {}) {
   const io = {
     environment: process.env,
@@ -244,8 +245,8 @@ export async function prepareMacClis({
   const binaries = installAttempted
     ? detectMacClis(io.find, io.environment, io.verify)
     : before;
-  const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId);
-  const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId);
+  const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId, { crossAppModels });
+  const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId, { crossAppModels });
   if (binaries.claude) {
     await io.syncSkills({
       client: "claude",

package/src/managedProfileVersion.js

@@ -6,4 +6,12 @@
 // managed ChatGPT profiles.
 // v43 sends tenant-checked issue handoffs from the embedded board to the main
 // Impel browser app without expanding the capability-scoped desktop session.
-export const CURRENT_CONFIG_VERSION = 43;
+// v44 disables the vendor background auto-updater in managed Claude CLI
+// profiles so a session on the reviewed release cannot move the shared
+// launcher past the pin (the Windows drift behind the gateway lockouts).
+// v45 layers `impel models sync` over the isolated CLI Codex catalog: the
+// profile writer keeps a manifest-verified synced catalog instead of always
+// reasserting the FALLBACK_MODELS floor, records provenance in
+// models-manifest.json, and (with cross-app models enabled) routes the CLI
+// provider through the experimental OpenAI-compatible gateway path.
+export const CURRENT_CONFIG_VERSION = 45;

package/src/modelCatalog.js

@@ -4,6 +4,7 @@
 // tenant profiles in cliProfiles.js can consume it without an import cycle —
 // the 0.20.39 regression happened precisely because the CLI carried its own
 // hand-frozen copy of this data.
+import { redactSecretText } from "./config.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 const STANDARD_REASONING_LEVELS = [
@@ -65,6 +66,7 @@ export function codexCatalogEntry(model, index, vendorModel) {
     multi_agent_version: null,
   };
   const entry = vendorModel ? { ...generated, ...vendorModel } : generated;
+  const serviceTiers = Array.isArray(model.service_tiers) ? model.service_tiers : (entry.service_tiers || []);
   return {
     ...entry,
     slug: model.id,
@@ -74,7 +76,16 @@ export function codexCatalogEntry(model, index, vendorModel) {
     supported_reasoning_levels: Array.isArray(model.supported_reasoning_levels)
       ? model.supported_reasoning_levels
       : entry.supported_reasoning_levels,
-    service_tiers: Array.isArray(model.service_tiers) ? model.service_tiers : (entry.service_tiers || []),
+    service_tiers: serviceTiers,
+    // The vendor catalog always pairs the priority ("Fast") service tier with
+    // additional_speed_tiers: ["fast"], and the pinned Codex runtime
+    // serializes both to the renderer. Reconstruct the pair from the final
+    // service tiers (vendor enrichment may still carry its own value) so the
+    // Fast surface matches vendor shape — the impel-apps writer has always
+    // done this and the two projections must not drift (D15).
+    additional_speed_tiers: Array.isArray(vendorModel?.additional_speed_tiers)
+      ? vendorModel.additional_speed_tiers
+      : (serviceTiers.some((tier) => tier?.id === "priority") ? ["fast"] : []),
     visibility: "list",
     supported_in_api: true,
     priority: Number.isInteger(model.priority) ? model.priority : (entry.priority || index + 1),
@@ -86,6 +97,76 @@ export function codexCatalogEntry(model, index, vendorModel) {
   };
 }
 
+/**
+ * Project a gateway Claude model into the Codex picker. Fail-closed: every
+ * capability field must arrive verified in client_capabilities.codex, or the
+ * model is omitted (never guessed). Lives in this leaf (not apps.js) so the
+ * CLI catalog sync and the desktop writers share one projection; apps.js
+ * re-exports it for existing importers.
+ */
+export function foreignClaudeCodexCatalogEntry(model, index) {
+  const capability = model.client_capabilities?.codex;
+  const levels = capability?.supported_reasoning_levels;
+  const tiers = capability?.service_tiers;
+  const modalities = capability?.input_modalities;
+  const valid = capability && typeof capability === "object"
+    && Number.isInteger(capability.context_window) && capability.context_window > 0
+    && Number.isInteger(capability.max_context_window) && capability.max_context_window >= capability.context_window
+    && Array.isArray(levels) && levels.every((level) => (
+      level && typeof level.effort === "string" && typeof level.description === "string"
+    ))
+    && Array.isArray(tiers) && tiers.every((tier) => (
+      tier && typeof tier.id === "string" && typeof tier.name === "string" && typeof tier.description === "string"
+    ))
+    && Array.isArray(modalities) && modalities.every((value) => typeof value === "string")
+    && ["supports_parallel_tool_calls", "supports_reasoning_summaries", "supports_verbosity", "supports_search_tool", "supports_image_detail_original"]
+      .every((key) => typeof capability[key] === "boolean")
+    && (capability.default_reasoning_level == null
+      || capability.default_reasoning_level === ""
+      || levels.some((level) => level.effort === capability.default_reasoning_level))
+    && (capability.apply_patch_tool_type == null || typeof capability.apply_patch_tool_type === "string")
+    && (capability.web_search_tool_type == null || typeof capability.web_search_tool_type === "string");
+  if (!valid) {
+    console.warn(`impel: omitting model ${redactSecretText(model.id)} from Impel ChatGPT: missing verified Codex capabilities`);
+    return null;
+  }
+  return {
+    slug: model.id,
+    display_name: model.display_name || model.id,
+    description: model.description || `Claude model available through the Impel gateway (${model.id}).`,
+    ...(capability.default_reasoning_level ? { default_reasoning_level: capability.default_reasoning_level } : {}),
+    supported_reasoning_levels: levels,
+    service_tiers: tiers,
+    // Same vendor-shape pairing rule as codexCatalogEntry: a priority tier
+    // always travels with the "fast" speed tier.
+    additional_speed_tiers: tiers.some((tier) => tier?.id === "priority") ? ["fast"] : [],
+    shell_type: "shell_command",
+    visibility: "list",
+    supported_in_api: true,
+    priority: Number.isInteger(model.priority) ? model.priority : index + 1,
+    base_instructions: "You are an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
+    include_skills_usage_instructions: false,
+    supports_reasoning_summaries: capability.supports_reasoning_summaries,
+    support_verbosity: capability.supports_verbosity,
+    ...(capability.supports_reasoning_summaries ? { default_reasoning_summary: "none" } : {}),
+    ...(capability.supports_verbosity ? { default_verbosity: "low" } : {}),
+    ...(capability.apply_patch_tool_type ? { apply_patch_tool_type: capability.apply_patch_tool_type } : {}),
+    ...(capability.web_search_tool_type ? { web_search_tool_type: capability.web_search_tool_type } : {}),
+    truncation_policy: { mode: "tokens", limit: 10000 },
+    context_window: capability.context_window,
+    max_context_window: capability.max_context_window,
+    effective_context_window_percent: 95,
+    experimental_supported_tools: [],
+    input_modalities: modalities,
+    supports_parallel_tool_calls: capability.supports_parallel_tool_calls,
+    supports_image_detail_original: capability.supports_image_detail_original,
+    supports_search_tool: capability.supports_search_tool,
+    use_responses_lite: false,
+    tool_mode: null,
+    multi_agent_version: null,
+  };
+}
+
 /**
  * The managed CLI Codex catalog, projected from the same model registry the
  * desktop app uses so reasoning efforts, service tiers, and tool modes can
@@ -101,3 +182,30 @@ export function managedCodexCliCatalog(now = new Date()) {
       .map((model, index) => codexCatalogEntry(model, index)),
   };
 }
+
+/**
+ * The same catalog document, projected from live gateway models instead of
+ * the FALLBACK_MODELS floor (`impel models sync`). The gateway payload never
+ * flows through: every entry is reconstructed by codexCatalogEntry /
+ * foreignClaudeCodexCatalogEntry from validated fields, exactly like the
+ * desktop writer (D15). Claude models join the picker only when crossAppModels
+ * is enabled AND each carries verified client_capabilities.codex (fail-closed
+ * in the foreign projection). Returns null when nothing projects — an empty
+ * catalog must never replace the floor.
+ */
+export function gatewayCodexCliCatalog(models, { crossAppModels = false, now = new Date() } = {}) {
+  const ordered = crossAppModels
+    ? [...models.filter((model) => model.provider === "codex"), ...models.filter((model) => model.provider === "claude")]
+    : models.filter((model) => model.provider === "codex");
+  const codexModels = ordered
+    .map((model, index) => model.provider === "codex"
+      ? codexCatalogEntry(model, index)
+      : foreignClaudeCodexCatalogEntry(model, index))
+    .filter(Boolean);
+  if (codexModels.length === 0) return null;
+  return {
+    fetched_at: now.toISOString(),
+    client_version: `${RUNTIME_BRAND.cli.command}-managed-2`,
+    models: codexModels,
+  };
+}

package/src/modelSync.js

@@ -0,0 +1,197 @@
+// The async half of the CLI Codex catalog layering (D13): fetch the tenant's
+// live gateway catalog and atomically replace the models.json that
+// ensureImpelCodexProfile pinned, recording provenance in
+// models-manifest.json so the synchronous floor writer and the TTL machinery
+// can tell a synced catalog from the offline floor.
+//
+// Layering contract:
+//   - ensureImpelCodexProfile (cliProfiles.js) stays synchronous and offline;
+//     it writes the FALLBACK_MODELS floor unless the manifest proves the
+//     on-disk catalog is the last synced one for the same bindings.
+//   - syncCodexModelsSafe runs AFTER it — at launch (the syncAgentProfilesSafe
+//     idiom), from `impel models sync`, from the detached stale-only app
+//     refresh, and from the `impel token` heartbeat repair. It never throws
+//     and never blocks a launch on the network.
+//   - A gateway catalog replaces the floor only when valid and non-empty:
+//     fetchGatewayModels validates org/product attribution and fails closed
+//     on empty data (isExplicitNoSeatCatalog only relaxes lifecycle
+//     reconciliation, not this sync), and gatewayCodexCliCatalog reconstructs
+//     every entry from validated fields — raw gateway JSON never flows into
+//     models.json (D15).
+
+import fs from "node:fs";
+
+import { normalizeGatewayUrl, redactSecretText } from "./config.js";
+import { tenantCliProfilePaths } from "./cliProfiles.js";
+import { fetchGatewayModels } from "./gatewayModels.js";
+import { gatewayCodexCliCatalog } from "./modelCatalog.js";
+import {
+  catalogDigest,
+  codexCatalogIsFresh,
+  codexModelsManifestPath,
+  CODEX_MODELS_MANIFEST_SCHEMA_VERSION,
+  readCodexModelsManifest,
+  writeAtomicPrivateFile,
+  writeCodexModelsManifest,
+} from "./modelsManifest.js";
+import { normalizeTenantId } from "./tenants.js";
+
+/**
+ * One catalog sync for one tenant's isolated CLI Codex profile. Throws on
+ * failure (callers that must not fail use syncCodexModelsSafe). Returns
+ * { synced, skipped?, reason?, catalogPath, models? }.
+ */
+export async function syncCodexModels({
+  gatewayUrl,
+  credential,
+  tenantId,
+  crossAppModels = false,
+  staleOnly = false,
+  now = Date.now(),
+  fetchModels = fetchGatewayModels,
+}) {
+  if (process.env.IMPEL_SKIP_MODEL_SYNC === "1" || process.env.IMPEL_SKIP_MODEL_SYNC === "true") {
+    return { synced: false, skipped: true, reason: "disabled" };
+  }
+  const normalizedTenant = normalizeTenantId(tenantId);
+  const normalizedGateway = normalizeGatewayUrl(gatewayUrl);
+  const { codexHome, codexCatalog } = tenantCliProfilePaths(normalizedTenant);
+  const bindings = {
+    tenantId: normalizedTenant,
+    gatewayUrl: normalizedGateway,
+    crossAppModels,
+  };
+  if (!fs.existsSync(codexCatalog)) {
+    // Never conjure a half-initialized profile just to sync models into it;
+    // the profile writer owns directory creation and hardening.
+    return { synced: false, skipped: true, reason: "uninitialized", catalogPath: codexCatalog };
+  }
+  if (staleOnly && codexCatalogIsFresh(codexHome, codexCatalog, { ...bindings, now })) {
+    return { synced: false, skipped: true, reason: "fresh", catalogPath: codexCatalog };
+  }
+
+  const fetched = await fetchModels({
+    gatewayUrl: normalizedGateway,
+    pat: credential,
+    tenantId: normalizedTenant,
+  });
+  const catalog = gatewayCodexCliCatalog(fetched.models, {
+    crossAppModels,
+    now: new Date(now),
+  });
+  if (!catalog) {
+    // Valid-and-non-empty gate: a tenant with zero projectable Codex-picker
+    // models keeps its current catalog (floor or last sync) rather than
+    // shipping Codex an empty picker.
+    throw new Error("gateway returned no models projectable into the Codex picker");
+  }
+  const text = `${JSON.stringify(catalog, null, 2)}\n`;
+  writeAtomicPrivateFile(codexCatalog, text);
+  writeCodexModelsManifest(codexHome, {
+    schemaVersion: CODEX_MODELS_MANIFEST_SCHEMA_VERSION,
+    syncedAt: new Date(now).toISOString(),
+    catalogVersion: fetched.version ?? null,
+    digest: catalogDigest(text),
+    tenantId: normalizedTenant,
+    gatewayUrl: normalizedGateway,
+    experiments: { crossAppModels: Boolean(crossAppModels) },
+  });
+  return {
+    synced: true,
+    catalogPath: codexCatalog,
+    models: catalog.models.length,
+    catalogVersion: fetched.version ?? null,
+  };
+}
+
+/**
+ * The launch-safe wrapper (the syncAgentProfilesSafe idiom): never throws,
+ * never blocks a launch outcome. A network/catalog failure leaves the last
+ * good models.json — floor or previously synced — in place.
+ */
+export async function syncCodexModelsSafe(options) {
+  try {
+    return await syncCodexModels(options);
+  } catch (error) {
+    const logger = options?.logger || console;
+    logger.warn(`impel: model catalog sync failed (${redactSecretText(error?.message || error)}); keeping the last good Codex model catalog.`);
+    return {
+      synced: false,
+      reason: "error",
+      error: redactSecretText(error?.message || error),
+    };
+  }
+}
+
+/**
+ * The `catalogIsFresh` gate for the TTL machinery (heartbeat repair, detached
+ * stale-only refresh): true only when an initialized CLI Codex catalog exists
+ * and is NOT provably fresh for these bindings. Uninitialized profiles are
+ * never stale — a sync would skip them anyway. Never throws.
+ */
+export function cliCodexCatalogStale(tenantId, {
+  gatewayUrl,
+  crossAppModels = false,
+  now = Date.now(),
+} = {}) {
+  try {
+    const normalizedTenant = normalizeTenantId(tenantId);
+    const { codexHome, codexCatalog } = tenantCliProfilePaths(normalizedTenant);
+    if (!fs.existsSync(codexCatalog)) return false;
+    return !codexCatalogIsFresh(codexHome, codexCatalog, {
+      tenantId: normalizedTenant,
+      gatewayUrl: normalizeGatewayUrl(gatewayUrl),
+      crossAppModels,
+      now,
+    });
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Staleness report for diagnostics (`impel models list`, `impel doctor`).
+ * Read-only and offline.
+ */
+export function codexCatalogStatus(tenantId, {
+  gatewayUrl = null,
+  crossAppModels = false,
+  now = Date.now(),
+} = {}) {
+  const normalizedTenant = normalizeTenantId(tenantId);
+  const { codexHome, codexCatalog } = tenantCliProfilePaths(normalizedTenant);
+  const manifest = readCodexModelsManifest(codexHome);
+  let catalog = null;
+  let catalogError = null;
+  try {
+    catalog = JSON.parse(fs.readFileSync(codexCatalog, "utf8"));
+  } catch (error) {
+    catalogError = error?.code === "ENOENT" ? "missing" : "unreadable";
+  }
+  const models = Array.isArray(catalog?.models)
+    ? catalog.models.filter((model) => model && typeof model.slug === "string")
+    : [];
+  const digestMatches = Boolean(manifest && catalog)
+    && catalogDigest(fs.readFileSync(codexCatalog, "utf8")) === manifest.digest;
+  const syncedAt = manifest ? Date.parse(manifest.syncedAt) : NaN;
+  const fresh = gatewayUrl !== null
+    ? codexCatalogIsFresh(codexHome, codexCatalog, {
+      tenantId: normalizedTenant,
+      gatewayUrl,
+      crossAppModels,
+      now,
+    })
+    : false;
+  return {
+    tenantId: normalizedTenant,
+    catalogPath: codexCatalog,
+    manifestPath: codexModelsManifestPath(codexHome),
+    catalogError,
+    models,
+    source: digestMatches ? "gateway" : "floor",
+    manifest,
+    syncedAt: Number.isFinite(syncedAt) ? new Date(syncedAt).toISOString() : null,
+    ageMs: Number.isFinite(syncedAt) ? Math.max(0, now - syncedAt) : null,
+    fresh,
+  };
+}

package/src/modelsManifest.js

@@ -0,0 +1,132 @@
+// Freshness record for the isolated CLI Codex model catalog (models.json):
+// models-manifest.json, written beside the catalog in the tenant CODEX_HOME.
+//
+// Leaf module (node builtins + other leaf modules only). Both the synchronous
+// profile writer in cliProfiles.js — which must decide floor-vs-keep with
+// zero network I/O — and the async gateway sync in modelSync.js consult the
+// same record, so this logic must sit below both without importing either.
+//
+// The manifest pins the exact catalog bytes the last sync wrote (sha256
+// digest) plus the bindings that make a synced catalog valid for a launch:
+// tenant, gateway origin, and the cross-app experiment state. A digest or
+// binding mismatch means the catalog on disk is NOT the one the last sync
+// produced — the floor writer then reasserts the offline floor, and the TTL
+// machinery treats the catalog as stale regardless of syncedAt.
+
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+import { normalizeGatewayUrl } from "./config.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
+
+export const CODEX_MODELS_MANIFEST_BASENAME = "models-manifest.json";
+export const CODEX_MODELS_MANIFEST_SCHEMA_VERSION = 1;
+/** Same 6h cadence as the agent-profile and desktop-app refresh machinery. */
+export const MODEL_SYNC_TTL_MS = 6 * 60 * 60 * 1000;
+
+export function codexModelsManifestPath(codexHome) {
+  return path.join(codexHome, CODEX_MODELS_MANIFEST_BASENAME);
+}
+
+export function catalogDigest(text) {
+  return crypto.createHash("sha256").update(text, "utf8").digest("hex");
+}
+
+/** Atomic private write (write-temp-rename, 0600), matching the CLI's other config writers. */
+export function writeAtomicPrivateFile(target, contents) {
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  const temporaryPath = `${target}.tmp-${process.pid}`;
+  try {
+    fs.writeFileSync(temporaryPath, contents, { mode: 0o600 });
+    renameWithWindowsRetry(temporaryPath, target);
+    try {
+      fs.chmodSync(target, 0o600);
+    } catch {
+      // Best effort on platforms where chmod is unavailable.
+    }
+  } finally {
+    try {
+      fs.rmSync(temporaryPath, { force: true });
+    } catch {
+      // The rename already removed the temporary file in the normal case.
+    }
+  }
+}
+
+/** Parse and shape-validate the manifest; anything invalid reads as absent. */
+export function readCodexModelsManifest(codexHome) {
+  let raw;
+  try {
+    raw = fs.readFileSync(codexModelsManifestPath(codexHome), "utf8");
+  } catch {
+    return null;
+  }
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const valid = value
+    && typeof value === "object"
+    && !Array.isArray(value)
+    && value.schemaVersion === CODEX_MODELS_MANIFEST_SCHEMA_VERSION
+    && typeof value.syncedAt === "string"
+    && typeof value.digest === "string"
+    && /^[0-9a-f]{64}$/u.test(value.digest)
+    && typeof value.tenantId === "string"
+    && typeof value.gatewayUrl === "string"
+    && value.experiments
+    && typeof value.experiments === "object"
+    && !Array.isArray(value.experiments)
+    && typeof value.experiments.crossAppModels === "boolean";
+  return valid ? value : null;
+}
+
+export function writeCodexModelsManifest(codexHome, manifest) {
+  writeAtomicPrivateFile(
+    codexModelsManifestPath(codexHome),
+    `${JSON.stringify(manifest, null, 2)}\n`,
+  );
+}
+
+/**
+ * Whether the catalog on disk is exactly the one the last gateway sync wrote
+ * for these bindings. Deliberately TTL-free: a stale synced catalog still
+ * beats the offline floor (stale-beats-broken), so the synchronous profile
+ * writer keeps it; only the TTL gate below decides to refresh it.
+ */
+export function syncedCodexCatalogMatches(codexHome, catalogPath, {
+  tenantId,
+  gatewayUrl,
+  crossAppModels = false,
+} = {}) {
+  const manifest = readCodexModelsManifest(codexHome);
+  if (!manifest) return false;
+  if (manifest.tenantId !== tenantId) return false;
+  if (normalizeGatewayUrl(manifest.gatewayUrl) !== normalizeGatewayUrl(gatewayUrl)) return false;
+  if (manifest.experiments.crossAppModels !== Boolean(crossAppModels)) return false;
+  let text;
+  try {
+    text = fs.readFileSync(catalogPath, "utf8");
+  } catch {
+    return false;
+  }
+  return catalogDigest(text) === manifest.digest;
+}
+
+/** The TTL gate: an intact synced catalog whose last sync is inside the window. */
+export function codexCatalogIsFresh(codexHome, catalogPath, {
+  tenantId,
+  gatewayUrl,
+  crossAppModels = false,
+  now = Date.now(),
+  ttlMs = MODEL_SYNC_TTL_MS,
+} = {}) {
+  if (!syncedCodexCatalogMatches(codexHome, catalogPath, { tenantId, gatewayUrl, crossAppModels })) {
+    return false;
+  }
+  const syncedAt = Date.parse(readCodexModelsManifest(codexHome).syncedAt);
+  return Number.isFinite(syncedAt) && syncedAt <= now && now - syncedAt < ttlMs;
+}

package/src/platformSetup.js

@@ -29,8 +29,9 @@ export async function preparePlatformClis(options = {}, dependencies = {}) {
   };
   // Discovery-only probes must not write profiles either.
   if (options.inspectOnly) return result;
-  const claudeProfile = (dependencies.ensureClaudeProfile || ensureImpelClaudeProfile)(options.gatewayUrl, options.tenantId);
-  const codexProfile = (dependencies.ensureCodexProfile || ensureImpelCodexProfile)(options.gatewayUrl, options.tenantId);
+  const crossAppModels = options.crossAppModels === true;
+  const claudeProfile = (dependencies.ensureClaudeProfile || ensureImpelClaudeProfile)(options.gatewayUrl, options.tenantId, { crossAppModels });
+  const codexProfile = (dependencies.ensureCodexProfile || ensureImpelCodexProfile)(options.gatewayUrl, options.tenantId, { crossAppModels });
   return {
     ...result,
     profiles: { claude: claudeProfile.configDir, codex: codexProfile.codexHome },
@@ -55,6 +56,7 @@ export function describeCliFailure(prepared, {
       || failure
       || installation?.succeeded === false,
     );
+    const drift = prepared.drifted?.[tool];
     const reason = failure?.message || failure?.code
       || (Number.isInteger(failure?.status)
         ? `exit ${failure.status}`
@@ -64,9 +66,11 @@ export function describeCliFailure(prepared, {
             ? "automatic installation was declined"
             : skipClis
               ? "installation was skipped by --skip-clis"
-              : !isTTY && prepared.installCommands?.[tool]
-                ? `interactive confirmation required; rerun \`${cliExecutable} ${commandName}\` interactively (or use \`--skip-clis\` to leave it uninstalled)`
-                : "not installed or discoverable");
+              : drift
+                ? `installed v${drift.version} does not match the reviewed v${drift.pinned} this release launches against the gateway`
+                : !isTTY && prepared.installCommands?.[tool]
+                  ? `interactive confirmation required; rerun \`${cliExecutable} ${commandName}\` interactively (or use \`--skip-clis\` to leave it uninstalled)`
+                  : "not installed or discoverable");
     details.push(`${labels[tool] || tool}: ${redactSecretText(reason)}`);
     const command = installation?.command || prepared.installCommands?.[tool];
     if (attempted && command) details.push(`manual ${tool} recovery command: ${redactSecretText(command)}`);

package/src/provisioning.js

@@ -101,7 +101,9 @@ async function prepareTenantCli(config, tenant, io, binaries) {
     },
     codex: {
       supported: providerSupported(config.scopes, PAT_SCOPE_CODEX),
-      ensure: () => io.ensureCodex(config.gatewayUrl, tenant.id),
+      ensure: () => io.ensureCodex(config.gatewayUrl, tenant.id, {
+        crossAppModels: crossAppModelsEnabled(config),
+      }),
       root: (profile) => profile.codexHome,
       env: (profile) => ({
         CODEX_HOME: profile.codexHome,

package/src/runtimeBrand.js

@@ -11,7 +11,7 @@ const CONTROL_RE = /[\u0000-\u001F\u007F-\u009F]/u;
 const SUPPORTED_COMMANDS = new Set([
   "setup", "auth", "pat", "token", "mcp", "sessions", "claude", "codex",
   "status", "doctor", "report", "tasks", "tenant", "app", "nuke", "skills",
-  "agents", "update", "use", "experimental",
+  "models", "agents", "update", "use", "experimental",
 ]);
 
 const DEFAULT = Object.freeze({

package/src/stableEntrypoint.js

@@ -8,6 +8,7 @@ import {
 } from "./selfInvocation.js";
 import { redactSecretText } from "./config.js";
 import { brandedEnvironmentName, RUNTIME_BRAND } from "./runtimeBrand.js";
+import { renameWithWindowsRetry } from "./windowsFs.js";
 
 /**
  * Render the stable Windows entry point (`%LOCALAPPDATA%\Impel\bin\impel-entry.cjs`).
@@ -172,7 +173,7 @@ export function ensureWindowsStableEntrypoint({
   const temporaryPath = `${target}.tmp-${process.pid}`;
   try {
     fs.writeFileSync(temporaryPath, content, { mode: 0o700 });
-    fs.renameSync(temporaryPath, target);
+    renameWithWindowsRetry(temporaryPath, target);
   } finally {
     try {
       fs.rmSync(temporaryPath, { force: true });

package/src/updates.js

@@ -295,6 +295,16 @@ export function spawnDetachedAppRefresh(tenantId = null) {
   ]);
 }
 
+/** Background CLI Codex model-catalog sync; no-ops inside the TTL. */
+export function spawnDetachedModelSync(tenantId) {
+  spawnDetached([
+    "models",
+    "sync",
+    "--stale-only",
+    ...(tenantId ? ["--tenant", tenantId] : []),
+  ]);
+}
+
 /**
  * Background telemetry send. Lives here beside the other detached spawns so
  * `spawnDetached`'s Windows-console handling has exactly one implementation,