impel-cli 0.20.55 → 0.20.57

package/src/vendorCliBinaries.js

@@ -5,6 +5,7 @@ import { spawnSync } from "node:child_process";
 import {
   environmentValue,
   findNativeBinary,
+  nativeSpawnInvocation,
   resolveNativeBinary,
 } from "./nativeProcess.js";
 import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
@@ -99,9 +100,100 @@ export function verifyReviewedMacVendorCli(
   }
 }
 
+/** Run `<binary> --version` through the platform-safe spawn and parse it. */
+export function windowsVendorCliVersion(binary, environment = process.env, { run = spawnSync } = {}) {
+  try {
+    const invocation = nativeSpawnInvocation(binary, ["--version"], environment, "win32");
+    const result = run(invocation.command, invocation.args, {
+      encoding: "utf8",
+      env: environment,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 15_000,
+      windowsHide: true,
+      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+    });
+    if (result?.status !== 0 || result?.error) return null;
+    return parseVendorCliVersion(`${result.stdout || ""}\n${result.stderr || ""}`);
+  } catch {
+    return null;
+  }
+}
+
 /**
- * Locate the reviewed macOS vendor CLI. On other platforms this intentionally
- * preserves the existing native resolution behavior.
+ * Accept only the exact reviewed release on Windows. Windows ships no
+ * in-box codesign equivalent for these unsigned-shim installs, so the gate
+ * is the exact version contract; explicit binary overrides remain
+ * authoritative for development and recovery, as on macOS.
+ */
+export function verifyReviewedWindowsVendorCli(
+  tool,
+  binary,
+  environment = process.env,
+  {
+    run = spawnSync,
+    versions = PINNED_VENDOR_CLI_VERSIONS,
+    environmentPrefix = "IMPEL",
+  } = {},
+) {
+  if (!versions[tool]) return false;
+  try {
+    const override = vendorOverrideName(tool, environmentPrefix);
+    const overriddenBinary = override ? environmentValue(environment, override) : null;
+    if (overriddenBinary && path.resolve(overriddenBinary) === path.resolve(binary)) return true;
+    return windowsVendorCliVersion(binary, environment, { run }) === versions[tool];
+  } catch {
+    return false;
+  }
+}
+
+function reviewedWindowsClaudeFallback(environment, environmentPrefix, accept, { find, realpath, stat }) {
+  // The native Windows installer keeps releases side by side under
+  // .local/share/claude/versions/<release> and its auto-updater replaces the
+  // .local/bin launcher in place. When the launcher drifts past the reviewed
+  // release, resolve the exact reviewed release directly instead of failing
+  // the launch; every candidate still passes the version verification.
+  const candidates = [];
+  const drifted = find("claude", environment, "win32", environmentPrefix);
+  if (drifted) {
+    try {
+      candidates.push(path.win32.join(
+        path.win32.dirname(realpath(drifted)),
+        "..", "share", "claude", "versions", PINNED_VENDOR_CLI_VERSIONS.claude,
+      ));
+    } catch {
+      // An unresolvable launcher only forfeits the derived candidate.
+    }
+  }
+  // USERPROFILE gates the fixed-root candidates: it is only set on real
+  // Windows sessions, so cross-platform tests injecting fake finders never
+  // fall through to a genuine macOS side-by-side install. HOME is probed too
+  // because the vendor updater follows HOME when it diverges from USERPROFILE.
+  const userProfile = environmentValue(environment, "USERPROFILE");
+  if (userProfile) {
+    const homes = [userProfile];
+    const home = environmentValue(environment, "HOME");
+    if (home && home !== userProfile) homes.push(home);
+    for (const root of homes) {
+      candidates.push(path.win32.join(root, ".local", "share", "claude", "versions", PINNED_VENDOR_CLI_VERSIONS.claude));
+    }
+  }
+  for (const base of candidates) {
+    // The release file is stored bare on every platform, but probe the .exe
+    // sibling too in case the installer ever normalizes Windows names.
+    for (const candidate of [base, `${base}.exe`]) {
+      try {
+        if (stat(candidate).isFile() && accept(candidate)) return candidate;
+      } catch {
+        // A missing side-by-side release keeps resolution fail-closed.
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Locate the reviewed vendor CLI on macOS and Windows. Other platforms
+ * intentionally preserve the existing native resolution behavior.
  */
 export function findReviewedVendorCliBinary(
   tool,
@@ -110,13 +202,17 @@ export function findReviewedVendorCliBinary(
   environmentPrefix = "IMPEL",
   {
     find = findNativeBinary,
-    verify = verifyReviewedMacVendorCli,
+    verify = null,
     realpath = fs.realpathSync,
     stat = fs.statSync,
   } = {},
 ) {
-  if (platform !== "darwin") return find(tool, environment, platform, environmentPrefix);
-  const accept = (binary) => verify(tool, binary, environment, { environmentPrefix });
+  if (platform !== "darwin" && platform !== "win32") {
+    return find(tool, environment, platform, environmentPrefix);
+  }
+  const verifier = verify
+    || (platform === "win32" ? verifyReviewedWindowsVendorCli : verifyReviewedMacVendorCli);
+  const accept = (binary) => verifier(tool, binary, environment, { environmentPrefix });
   const reviewed = find(tool, environment, platform, environmentPrefix, accept);
   if (reviewed || tool !== "claude") return reviewed;
   // An explicit override remains authoritative even while unusable: callers
@@ -124,6 +220,10 @@ export function findReviewedVendorCliBinary(
   const override = vendorOverrideName(tool, environmentPrefix);
   if (override && environmentValue(environment, override)) return null;
 
+  if (platform === "win32") {
+    return reviewedWindowsClaudeFallback(environment, environmentPrefix, accept, { find, realpath, stat });
+  }
+
   // The standalone Claude installer keeps releases side by side under
   // versions/<release> and its auto-updater only moves the launcher symlink.
   // When the symlink drifts past the reviewed release, resolve the exact
@@ -153,9 +253,9 @@ export function findReviewedVendorCliBinary(
 }
 
 /**
- * Resolve a launch target. macOS deliberately returns null when only an
- * unreviewed or version-drifted binary exists so callers can request repair
- * instead of silently launching it.
+ * Resolve a launch target. macOS and Windows deliberately return null when
+ * only an unreviewed or version-drifted binary exists so callers can request
+ * repair instead of silently launching it.
  */
 export function resolveReviewedVendorCliBinary(
   tool,
@@ -163,7 +263,7 @@ export function resolveReviewedVendorCliBinary(
   platform = process.platform,
   environmentPrefix = "IMPEL",
 ) {
-  if (platform !== "darwin") {
+  if (platform !== "darwin" && platform !== "win32") {
     return resolveNativeBinary(tool, environment, platform, environmentPrefix);
   }
   return findReviewedVendorCliBinary(tool, environment, platform, environmentPrefix);

package/src/windowsFs.js

@@ -42,3 +42,26 @@ export function renameWithWindowsRetry(from, to, {
     }
   }
 }
+
+// chmod on Windows only toggles the FAT-era read-only attribute — it cannot
+// deliver the owner-only guarantee the POSIX callers rely on, and it fails
+// EPERM whenever the file is momentarily held by antivirus or carries an
+// inherited deny ACL (observed in the field: `setup.shared_vendor_clis`
+// aborting a whole tenant convergence over chmod of a managed models.json).
+// On POSIX the mode bits are a real security property, so failures there
+// still throw unless the caller explicitly opts into best-effort.
+
+/** chmod that swallows Windows failures; POSIX failures throw unless bestEffort. */
+export function chmodWithPlatformPolicy(target, mode, {
+  platform = process.platform,
+  chmod = fs.chmodSync,
+  bestEffort = false,
+} = {}) {
+  try {
+    chmod(target, mode);
+    return true;
+  } catch (error) {
+    if (platform === "win32" || bestEffort) return false;
+    throw error;
+  }
+}

package/src/windowsSetup.js

@@ -5,9 +5,13 @@ import { ensureImpelClaudeProfile, ensureImpelCodexProfile } from "./cliProfiles
 import {
   findNativeBinary,
   nativeCommandInvocation,
-  nativeSpawnInvocation,
 } from "./nativeProcess.js";
 import { syncSkillsSafe } from "./skills.js";
+import {
+  findReviewedVendorCliBinary,
+  verifyReviewedWindowsVendorCli,
+  windowsVendorCliVersion,
+} from "./vendorCliBinaries.js";
 import { PINNED_VENDOR_CLI_VERSIONS } from "./vendorCliVersions.js";
 import { provisionWindowsGit } from "./windowsGit.js";
 
@@ -47,37 +51,49 @@ export function windowsCliInstallCommands(tools = Object.keys(WINDOWS_CLI_INSTAL
   }));
 }
 
-function verifyWindowsCli(_tool, binary, environment) {
-  try {
-    const invocation = nativeSpawnInvocation(binary, ["--version"], environment, "win32");
-    const result = spawnSync(invocation.command, invocation.args, {
-      encoding: "utf8",
-      env: environment,
-      stdio: ["ignore", "pipe", "pipe"],
-      timeout: 15_000,
-      windowsHide: true,
-      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
-    });
-    return result?.status === 0 && !result?.error;
-  } catch {
-    return false;
-  }
+function verifyWindowsCli(tool, binary, environment) {
+  // The exact reviewed release, matching the macOS contract: a runnable but
+  // version-drifted vendor CLI must count as missing so setup/update repair
+  // it, instead of launching an unreviewed build against the gateway
+  // (observed in the field: Windows Claude auto-updated past the pin and the
+  // gateway rejected the session while macOS stayed on the reviewed release).
+  return verifyReviewedWindowsVendorCli(tool, binary, environment);
 }
 
 function detectWindowsClis(find, environment, verify) {
-  const detect = (tool) => find(
-    tool,
-    environment,
-    "win32",
-    "IMPEL",
-    (binary) => verify(tool, binary, environment),
-  );
+  // Detection must share the launcher's reviewed resolution (including the
+  // side-by-side fallback after vendor auto-update drift); a raw PATH probe
+  // here would classify a drifted-but-launchable install as missing and
+  // reinstall it on every setup/update pass.
+  const detect = (tool) => findReviewedVendorCliBinary(tool, environment, "win32", "IMPEL", {
+    find,
+    verify: (candidateTool, binary, candidateEnvironment) =>
+      verify(candidateTool, binary, candidateEnvironment),
+  });
   return {
     claude: detect("claude"),
     codex: detect("codex"),
   };
 }
 
+/**
+ * Pin-agnostic probe for the drift diagnostic: which build is actually on
+ * this machine when the reviewed detection came back empty.
+ */
+function detectDriftedWindowsClis(find, environment, binaries, { versionOf = windowsVendorCliVersion } = {}) {
+  const drifted = {};
+  for (const tool of ["claude", "codex"]) {
+    if (binaries[tool]) continue;
+    const binary = find(tool, environment, "win32", "IMPEL");
+    if (!binary) continue;
+    const version = versionOf(binary, environment);
+    if (version && version !== PINNED_VENDOR_CLI_VERSIONS[tool]) {
+      drifted[tool] = { binary, version, pinned: PINNED_VENDOR_CLI_VERSIONS[tool] };
+    }
+  }
+  return drifted;
+}
+
 function installCli(tool, { environment, run }) {
   const installer = WINDOWS_CLI_INSTALLERS[tool];
   if (!installer) throw new Error(`unsupported Windows CLI installer: ${tool}`);
@@ -127,11 +143,13 @@ export async function prepareWindowsClis({
   skipInstall = false,
   inspectOnly = false,
   installTools = ["claude", "codex"],
+  crossAppModels = false,
 } = {}, dependencies = {}) {
   const io = {
     environment: process.env,
     find: findNativeBinary,
     verify: verifyWindowsCli,
+    versionOf: windowsVendorCliVersion,
     run: spawnSync,
     ensureClaudeProfile: ensureImpelClaudeProfile,
     ensureCodexProfile: ensureImpelCodexProfile,
@@ -164,6 +182,7 @@ export async function prepareWindowsClis({
       binaries: before,
       missingBefore,
       missingAfter: [...missingBefore],
+      drifted: detectDriftedWindowsClis(io.find, io.environment, before, { versionOf: io.versionOf }),
       installAttempted: false,
       installSucceeded: null,
       installFailure: null,
@@ -219,8 +238,9 @@ export async function prepareWindowsClis({
   const binaries = installAttempted
     ? detectWindowsClis(io.find, io.environment, io.verify)
     : before;
-  const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId);
-  const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId);
+  const drifted = detectDriftedWindowsClis(io.find, io.environment, binaries, { versionOf: io.versionOf });
+  const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId, { crossAppModels });
+  const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId, { crossAppModels });
 
   if (binaries.claude) {
     await io.syncSkills({
@@ -248,6 +268,7 @@ export async function prepareWindowsClis({
     binaries,
     missingBefore,
     missingAfter: Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool),
+    drifted,
     installAttempted,
     installSucceeded,
     installFailure,