impel-cli 0.20.56 → 0.20.58

package/src/commands/models.js

@@ -0,0 +1,160 @@
+// `impel models sync|list` — the explicit surface over the CLI Codex model
+// catalog layering (D13). `sync` fetches the tenant's gateway catalog and
+// rewrites the isolated `impel codex` models.json (with provenance in
+// models-manifest.json); `list` is near-free diagnostics over the same files:
+// what the picker will show next launch, where it came from (gateway sync or
+// the offline floor), and how stale it is. Launches never depend on this
+// command — the same sync runs launch-layered, TTL-gated, and from the token
+// heartbeat; this is the direct repair/inspection path.
+
+import { parseFlags } from "../args.js";
+import {
+  crossAppModelsEnabled,
+  loadConfig,
+  normalizeGatewayUrl,
+  redactSecretText,
+  resolveDefaultGateway,
+} from "../config.js";
+import { codexCatalogStatus, syncCodexModels } from "../modelSync.js";
+import { MODEL_SYNC_TTL_MS } from "../modelsManifest.js";
+import { ensureTenantSelection, normalizeTenantId, tenantCredential } from "../tenants.js";
+import { RUNTIME_BRAND } from "../runtimeBrand.js";
+
+const HELP = `impel models - inspect or refresh the isolated Codex model catalog
+
+Usage:
+  impel models list [--tenant <org>] [--json]
+  impel models sync [--tenant <org>] [--stale-only]
+
+list shows the catalog \`impel codex\` will load next launch: each model, and
+whether the file is the last gateway sync (with its age) or the built-in
+offline floor. sync fetches the tenant's live gateway catalog and rewrites the
+catalog atomically; --stale-only exits without fetching while the last sync is
+inside its ${MODEL_SYNC_TTL_MS / (60 * 60 * 1000)}h window. Launches never block on this: they layer the same
+sync after the offline floor write and keep the last good catalog on failure.
+`;
+
+function formatAge(ageMs) {
+  const minutes = Math.floor(ageMs / 60_000);
+  if (minutes < 1) return "just now";
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 48) return `${hours}h ago`;
+  return `${Math.floor(hours / 24)}d ago`;
+}
+
+export function describeCatalogStatus(status) {
+  if (status.catalogError === "missing") {
+    return `not initialized (run \`${RUNTIME_BRAND.cli.command} setup\` or \`${RUNTIME_BRAND.cli.command} codex\` first)`;
+  }
+  if (status.catalogError) return "unreadable (rerun the launcher to regenerate it)";
+  if (status.source === "floor") {
+    return `offline floor (never synced; run \`${RUNTIME_BRAND.cli.command} models sync\`)`;
+  }
+  const age = status.ageMs === null ? "unknown age" : formatAge(status.ageMs);
+  const version = status.manifest?.catalogVersion == null ? "" : `, catalog v${status.manifest.catalogVersion}`;
+  return `gateway sync ${age}${version}, ${status.fresh ? "fresh" : "stale"}`;
+}
+
+export async function cmdModels(argv, overrides = {}) {
+  const [action, ...rest] = argv;
+  if (action === undefined || ["help", "--help", "-h"].includes(action)) {
+    console.log(HELP);
+    return;
+  }
+  if (!["sync", "list"].includes(action)) {
+    console.error(`impel models: unknown action "${action}". Use \`sync\` or \`list\`.`);
+    process.exitCode = 1;
+    return;
+  }
+  const { flags, positionals } = parseFlags(rest, {
+    tenant: { type: "string" },
+    "stale-only": { type: "boolean" },
+    json: { type: "boolean" },
+  });
+  if (positionals.length > 0) {
+    console.error(`impel models: unexpected argument "${positionals[0]}"`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const io = {
+    loadConfig,
+    ensureTenantSelection,
+    syncModels: syncCodexModels,
+    catalogStatus: codexCatalogStatus,
+    log: (message) => console.log(message),
+    ...overrides,
+  };
+  const config = io.loadConfig();
+  if (!config?.pat) {
+    console.error(`impel models: not authenticated. Run \`${RUNTIME_BRAND.cli.command} setup\` (or \`${RUNTIME_BRAND.cli.command} auth\`) first.`);
+    process.exitCode = 1;
+    return;
+  }
+
+  try {
+    const tenantId = flags.tenant
+      ? normalizeTenantId(flags.tenant)
+      : (await io.ensureTenantSelection(config)).tenantId;
+    const gatewayUrl = normalizeGatewayUrl(config.gatewayUrl || resolveDefaultGateway());
+    const crossAppModels = crossAppModelsEnabled(config);
+
+    if (action === "sync") {
+      const result = await io.syncModels({
+        gatewayUrl,
+        credential: tenantCredential(config.pat, tenantId),
+        tenantId,
+        crossAppModels,
+        staleOnly: Boolean(flags["stale-only"]),
+      });
+      if (result.skipped && result.reason === "uninitialized") {
+        console.error(
+          `impel models: the isolated Codex profile for tenant "${tenantId}" is not initialized. `
+          + `Run \`${RUNTIME_BRAND.cli.command} setup\` (or \`${RUNTIME_BRAND.cli.command} codex\`) first.`,
+        );
+        process.exitCode = 1;
+        return;
+      }
+      if (result.skipped) {
+        io.log(`Models: catalog for tenant ${tenantId} is fresh; nothing to sync.`);
+        return;
+      }
+      io.log(
+        `Models: synced ${result.models} model${result.models === 1 ? "" : "s"} for tenant ${tenantId}`
+        + `${result.catalogVersion == null ? "" : ` (catalog v${result.catalogVersion})`}. `
+        + "The picker updates on the next launch.",
+      );
+      return;
+    }
+
+    const status = io.catalogStatus(tenantId, { gatewayUrl, crossAppModels });
+    if (flags.json) {
+      io.log(JSON.stringify({
+        tenantId: status.tenantId,
+        catalogPath: status.catalogPath,
+        source: status.catalogError ? null : status.source,
+        catalogError: status.catalogError,
+        syncedAt: status.syncedAt,
+        catalogVersion: status.manifest?.catalogVersion ?? null,
+        fresh: status.fresh,
+        crossAppModels,
+        models: status.models.map((model) => model.slug),
+      }, null, 2));
+      return;
+    }
+    io.log(`Tenant:  ${tenantId}`);
+    io.log(`Catalog: ${status.catalogPath}`);
+    io.log(`Status:  ${describeCatalogStatus(status)}`);
+    if (crossAppModels) io.log("Experiments: cross-app models enabled");
+    if (status.models.length > 0) {
+      io.log(`Models (${status.models.length}):`);
+      for (const model of status.models) {
+        io.log(`  ${model.slug}${model.display_name && model.display_name !== model.slug ? ` — ${model.display_name}` : ""}`);
+      }
+    }
+  } catch (error) {
+    console.error(`impel models: ${redactSecretText(error?.message || error)}`);
+    process.exitCode = 1;
+  }
+}

package/src/commands/provisionVendorClis.js

@@ -0,0 +1,92 @@
+// `impel _provision-vendor-clis` — put the reviewed vendor CLIs on the machine
+// without authenticating.
+//
+// `impel setup` is the authenticated path: it needs a PAT, and it also writes
+// this CLI's isolated Claude/Codex profiles. An enrolled managed device has
+// neither. Its credential is the tenant credential the bootstrap wrote, and its
+// profiles belong to the managed runtime (impel-apps), which supplies
+// CLAUDE_CONFIG_DIR/CODEX_HOME, the gateway origin, and the credential at
+// launch. The one thing the managed chain cannot do is put Claude Code on the
+// machine — the managed `claude` package is Claude Desktop, and the runtime
+// requires a separately installed vendor Claude Code CLI at the reviewed pin.
+//
+// So enrollment calls this: the same reviewed installers `impel setup` runs,
+// the same version gate, and nothing else. It is intentionally quiet and it
+// never throws — a device must finish enrolling even if a vendor endpoint is
+// unreachable, and `impel setup`, `impel update`, and the next enrollment
+// refresh all re-run the same installer.
+import { parseFlags } from "../args.js";
+import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
+import { PINNED_VENDOR_CLI_VERSIONS } from "../vendorCliVersions.js";
+
+const SUPPORTED_TOOLS = Object.freeze(["claude", "codex"]);
+
+export function parseProvisionTools(value) {
+  if (value === undefined || value === true || value === null || value === "") return [...SUPPORTED_TOOLS];
+  const requested = String(value).split(",").map((tool) => tool.trim()).filter(Boolean);
+  const unsupported = requested.filter((tool) => !SUPPORTED_TOOLS.includes(tool));
+  if (unsupported.length) throw new Error(`unsupported vendor CLI: ${unsupported.join(", ")}`);
+  return [...new Set(requested)];
+}
+
+export async function cmdProvisionVendorClis(argv = [], overrides = {}) {
+  const io = {
+    platform: process.platform,
+    preparePlatformClis,
+    logger: console,
+    ...overrides,
+  };
+  const { flags } = parseFlags(argv, {
+    tools: { type: "string" },
+    json: { type: "boolean" },
+    "skip-install": { type: "boolean" },
+  });
+
+  let installTools;
+  try {
+    installTools = parseProvisionTools(flags.tools);
+  } catch (error) {
+    io.logger.error(`impel _provision-vendor-clis: ${error.message}`);
+    process.exitCode = 1;
+    return null;
+  }
+
+  let prepared;
+  try {
+    prepared = await io.preparePlatformClis({
+      platform: io.platform,
+      vendorClisOnly: true,
+      skipInstall: flags["skip-install"] === true,
+      installTools,
+    });
+  } catch (error) {
+    // Enrollment must not fail because a vendor endpoint did. Report and exit
+    // nonzero so a caller that cares can see it; the bootstrap ignores it.
+    const report = { ok: false, versions: PINNED_VENDOR_CLI_VERSIONS, error: String(error?.message || error) };
+    io.logger.error(flags.json ? JSON.stringify(report) : `impel _provision-vendor-clis: ${report.error}`);
+    process.exitCode = 1;
+    return report;
+  }
+
+  const installed = Object.fromEntries(
+    installTools.map((tool) => [tool, prepared.binaries?.[tool] || null]),
+  );
+  const missing = installTools.filter((tool) => !installed[tool]);
+  const report = {
+    ok: missing.length === 0,
+    versions: Object.fromEntries(installTools.map((tool) => [tool, PINNED_VENDOR_CLI_VERSIONS[tool]])),
+    installed,
+    missing,
+    installAttempted: prepared.installAttempted === true,
+  };
+
+  if (flags.json) io.logger.log(JSON.stringify(report));
+  else {
+    for (const tool of installTools) {
+      if (installed[tool]) io.logger.log(`${tool} ${PINNED_VENDOR_CLI_VERSIONS[tool]}: ${installed[tool]}`);
+    }
+    if (missing.length) io.logger.error(`impel _provision-vendor-clis: ${describeCliFailure(prepared, { commandName: "_provision-vendor-clis", isTTY: false, skipClis: flags["skip-install"] === true })}`);
+  }
+  if (!report.ok) process.exitCode = 1;
+  return report;
+}

package/src/commands/sessions.js

@@ -14,9 +14,17 @@ import {
   sessionOutboxStatus,
   touchSessionFlushLock,
 } from "../sessionCollector.js";
-import { loadConfig, redactSecretText } from "../config.js";
+import {
+  crossAppModelsEnabled,
+  loadConfig,
+  normalizeGatewayUrl,
+  redactSecretText,
+  resolveDefaultGateway,
+} from "../config.js";
+import { tenantCliProfilePaths } from "../cliProfiles.js";
+import { cliCodexCatalogStale } from "../modelSync.js";
 import { impelCliInvocation } from "../selfInvocation.js";
-import { spawnDetachedAppRefresh } from "../updates.js";
+import { spawnDetachedAppRefresh, spawnDetachedModelSync } from "../updates.js";
 import { brandedEnvironmentName, RUNTIME_BRAND } from "../runtimeBrand.js";
 
 const MANAGED_SESSION_HOOK_FLAG = `${RUNTIME_BRAND.cli.command}-managed-session-hook-v1`;
@@ -71,6 +79,45 @@ export function maybeRepairManagedApps(tenantId, {
   return true;
 }
 
+/**
+ * The model-catalog half of the token-helper heartbeat: when the isolated CLI
+ * Codex catalog for this tenant exists but is past its sync TTL (or its
+ * manifest no longer matches the file), kick one detached
+ * `models sync --stale-only`. Same shape as maybeRepairManagedApps — the
+ * vendor apps and Codex's auth command invoke `impel token` every ~5 minutes,
+ * so this is the channel that keeps catalogs converging on machines where
+ * nobody relaunches. The heartbeat lock stops repeated token calls from
+ * stacking sync children while the gateway is unreachable.
+ */
+export function maybeSyncCliModels(tenantId, {
+  config = null,
+  catalogStale = cliCodexCatalogStale,
+  lockIsFresh = sessionFlushLockIsFresh,
+  touchLock = touchSessionFlushLock,
+  spawnModelSync = spawnDetachedModelSync,
+} = {}) {
+  if (!tenantId) return false;
+  let stored = config;
+  if (stored === null) {
+    try {
+      stored = loadConfig();
+    } catch {
+      return false;
+    }
+  }
+  if (!stored?.pat) return false;
+  const gatewayUrl = normalizeGatewayUrl(stored.gatewayUrl || resolveDefaultGateway());
+  if (!catalogStale(tenantId, {
+    gatewayUrl,
+    crossAppModels: crossAppModelsEnabled(stored),
+  })) return false;
+  const lock = path.join(tenantCliProfilePaths(tenantId).codexHome, "models-sync-heartbeat");
+  if (lockIsFresh(lock, 60_000)) return false;
+  touchLock(lock);
+  spawnModelSync(tenantId);
+  return true;
+}
+
 /**
  * The codex session-hook entry point: same repair, scoped to ChatGPT/Codex
  * drift exactly as before the helper was generalized (the codex hook fires on
@@ -127,7 +174,13 @@ export async function cmdSessions(argv) {
         config,
         flush: false,
       });
-      if (flags.provider === "codex") maybeRepairManagedCodexApp(flags.tenant);
+      if (flags.provider === "codex") {
+        maybeRepairManagedCodexApp(flags.tenant);
+        // Same guaranteed-to-run channel, second artifact: keep the isolated
+        // CLI Codex model catalog converging from codex session events too
+        // (TTL + heartbeat-locked, detached `models sync --stale-only`).
+        maybeSyncCliModels(flags.tenant);
+      }
       // The Claude mirror of the codex repair above: Claude Desktop rewrites
       // its co-owned profile files too, and its session hooks are the only
       // Impel code guaranteed to still run afterward.

package/src/commands/setup.js

@@ -344,6 +344,7 @@ export async function cmdSetup(argv, overrides = {}) {
         tenantId: selected.id,
         platform: io.platform,
         skipInstall: true,
+        crossAppModels: config.experimental?.crossAppModels === true,
       });
       let prepared = inspected;
       if (inspected.missingAfter.length && !inspectOnly && !flags["skip-clis"]) {
@@ -376,6 +377,7 @@ export async function cmdSetup(argv, overrides = {}) {
             platform: io.platform,
             skipInstall: false,
             installTools,
+            crossAppModels: config.experimental?.crossAppModels === true,
           });
         }
       }

package/src/commands/tasks.js

@@ -27,6 +27,7 @@ const HELP = `impel tasks - CRUD tickets in Impel
 Usage:
   impel tasks list [--org <org>] [--scope visible|done|all] [--json]
   impel tasks get <id> [--org <org>] [--json]
+  impel tasks projects [--org <org>] [--json]
   impel tasks create --title <title> [--description <md> | --description-file <path>] [options] [--json]
   impel tasks update <id> [options] [--json]
   impel tasks delete <id> --yes [--org <org>] [--json]
@@ -49,6 +50,7 @@ Options:
   --assignee <id|none>              Assignee member id, or "none".
   --assigned-to <id|none>           Alias for --assignee.
   --due <YYYY-MM-DD|empty>          Due date, or empty string to clear.
+  --project <name|empty>             Project name, or empty string to clear.
   --json                            Print raw JSON response.
 `;
 
@@ -74,6 +76,7 @@ function flagSpec() {
     assignee: { type: "string" },
     "assigned-to": { type: "string" },
     due: { type: "string" },
+    project: { type: "string" },
     yes: { type: "boolean" },
   };
 }
@@ -186,7 +189,22 @@ function descriptionFromFlags(flags) {
   return inline;
 }
 
-function mutationBody(flags, { requireTitle = false } = {}) {
+function validateProject(value) {
+  if (value === undefined || value === "") return value;
+  if (value.length > 120) fail("impel tasks: project must be 120 characters or fewer.");
+  if (value.trim() !== value) {
+    fail("impel tasks: project cannot have leading or trailing whitespace.");
+  }
+  if ([...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  })) {
+    fail("impel tasks: project cannot contain control characters.");
+  }
+  return value;
+}
+
+export function taskMutationBody(flags, { requireTitle = false } = {}) {
   const body = {};
   if (flags.org !== undefined) body.orgId = flags.org;
 
@@ -219,6 +237,8 @@ function mutationBody(flags, { requireTitle = false } = {}) {
   if (assignedTo !== undefined) body.assignedTo = assignedTo;
 
   if (flags.due !== undefined) body.dueDate = flags.due;
+  const project = validateProject(flags.project);
+  if (project !== undefined) body.project = project;
 
   return body;
 }
@@ -262,6 +282,7 @@ function printTask(task, { orgId, markdown } = {}) {
   console.log(`Priority:  ${task.priority || "none"}`);
   console.log(`Assignee:  ${task.assignedTo || "unassigned"}`);
   console.log(`Labels:    ${(task.labels || []).join(", ") || "none"}`);
+  console.log(`Project:   ${task.project || "none"}`);
   if (task.latestRunId) console.log(`Run:       ${task.latestRunId} (${task.runStatus || "unknown"})`);
   if (markdown) {
     console.log("");
@@ -294,6 +315,17 @@ export async function cmdTasks(argv) {
         return;
       }
 
+      case "projects": {
+        const payload = await requestJson({
+          flags,
+          path: "/api/cli/tasks/projects",
+          query: { orgId: flags.org },
+        });
+        if (flags.json) return printJson(payload);
+        for (const project of payload.projects || []) console.log(project);
+        return;
+      }
+
       case "get": {
         const issueId = positionals[0];
         if (!issueId) fail("impel tasks get: missing task id.");
@@ -308,7 +340,7 @@ export async function cmdTasks(argv) {
       }
 
       case "create": {
-        const body = mutationBody(flags, { requireTitle: true });
+        const body = taskMutationBody(flags, { requireTitle: true });
         const payload = await requestJson({
           flags,
           path: "/api/cli/tasks",
@@ -324,7 +356,7 @@ export async function cmdTasks(argv) {
       case "update": {
         const issueId = positionals[0];
         if (!issueId) fail("impel tasks update: missing task id.");
-        const body = mutationBody(flags);
+        const body = taskMutationBody(flags);
         if (Object.keys(body).filter((key) => key !== "orgId").length === 0) {
           fail("impel tasks update: pass at least one field to update.");
         }

package/src/commands/token.js

@@ -1,7 +1,7 @@
 import { loadConfig } from "../config.js";
 import { parseFlags } from "../args.js";
 import { ensureTenantSelection, normalizeTenantId, tenantCredential } from "../tenants.js";
-import { maybeRepairManagedApps } from "./sessions.js";
+import { maybeRepairManagedApps, maybeSyncCliModels } from "./sessions.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 // This is the `apiKeyHelper` / auth-command contract: stdout (and only
@@ -12,6 +12,7 @@ export async function cmdToken(argv = [], overrides = {}) {
     loadConfig,
     ensureTenantSelection,
     repairManagedApps: maybeRepairManagedApps,
+    syncCliModels: maybeSyncCliModels,
     ...overrides,
   };
   const { flags } = parseFlags(argv, { tenant: { type: "string" } });
@@ -39,6 +40,15 @@ export async function cmdToken(argv = [], overrides = {}) {
     } catch {
       // Opportunistic only; the token contract is already fulfilled.
     }
+    // Same heartbeat, second surface: Codex invokes this helper every ~5
+    // minutes, so it is also where a stale isolated-CLI model catalog gets
+    // its detached `models sync --stale-only` (D13). Identical contract:
+    // after the token bytes, never stdout, never the exit code.
+    try {
+      io.syncCliModels(tenantId, { config });
+    } catch {
+      // Opportunistic only; the token contract is already fulfilled.
+    }
   } catch (error) {
     process.stderr.write(`${RUNTIME_BRAND.cli.command}: ${error.message}\n`);
     process.exitCode = 1;

package/src/extension/index.js

@@ -12,6 +12,7 @@ const ALIASES = Object.freeze({
   tenants: "tenant",
   org: "tenant",
   skill: "skills",
+  model: "models",
   agent: "agents",
   upgrade: "update",
   on: "use",
@@ -39,6 +40,7 @@ function help(version) {
   if (enabled.has("mcp")) lines.push(`  ${command} mcp                           Run the authenticated MCP transport`);
   if (enabled.has("sessions")) lines.push(`  ${command} sessions ...                  Run managed session lifecycle hooks`);
   if (enabled.has("skills")) lines.push(`  ${command} skills sync [...]             Sync gateway skills into managed clients`);
+  if (enabled.has("models")) lines.push(`  ${command} models list|sync              Inspect or refresh the isolated Codex model catalog`);
   if (enabled.has("agents")) lines.push(`  ${command} agents sync [...]             Sync tenant agents into managed clients`);
   if (enabled.has("status")) lines.push(`  ${command} status                        Show local readiness`);
   if (enabled.has("doctor")) lines.push(`  ${command} doctor [...]                  Run gateway and provider diagnostics`);

package/src/gatewayModels.js

@@ -0,0 +1,58 @@
+// The authenticated tenant model catalog fetch (GET /v1/models), shared by
+// the desktop app writers in apps.js and the CLI catalog sync in
+// modelSync.js. Leaf module (no imports): the model-catalog side of the CLI
+// must be loadable without pulling in the desktop bundle machinery, so this
+// cannot live in apps.js. apps.js re-exports it for existing importers.
+
+function isGatewayModel(model) {
+  return model && typeof model.id === "string" && (model.provider === "claude" || model.provider === "codex");
+}
+
+/**
+ * A tenant whose subscription genuinely has no Claude/Codex seats returns an
+ * explicitly marked empty catalog. Only lifecycle reconciliation may treat
+ * that as valid emptiness (allowEmpty) — every other caller keeps failing
+ * closed so a gateway outage can never masquerade as "no models".
+ */
+function isExplicitNoSeatCatalog(payload) {
+  const statuses = payload?.provider_status;
+  return Boolean(statuses
+    && typeof statuses === "object"
+    && !Array.isArray(statuses)
+    && ["claude", "codex"].every((provider) => (
+      statuses[provider]?.state === "no_seat"
+      && statuses[provider]?.routable === false
+    )));
+}
+
+export async function fetchGatewayModels(config, fetchImpl = fetch, { allowEmpty = false } = {}) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 20000);
+  try {
+    const response = await fetchImpl(`${config.gatewayUrl}/v1/models`, {
+      headers: { authorization: `Bearer ${config.pat}` },
+      signal: controller.signal,
+    });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const payload = await response.json();
+    if (config.tenantId && payload?.org_id !== config.tenantId) {
+      throw new Error("gateway model catalog tenant did not match the selected tenant");
+    }
+    if (config.productAccess && payload?.product_access !== config.productAccess) {
+      throw new Error("gateway model catalog product access did not match the live entitlement");
+    }
+    if (!Array.isArray(payload?.data)) throw new Error("response has no model data array");
+    // The envelope is additive at schema version 3: overlay-aware gateways
+    // also send entitlement_available and org_defaults beside the filtered
+    // data[], whose per-model default/family_default flags are already
+    // rewritten to the tenant's effective defaults. Clients trust the served
+    // flags as-is and tolerate unknown envelope fields.
+    const models = payload.data.filter(isGatewayModel);
+    if (models.length === 0 && !(allowEmpty && isExplicitNoSeatCatalog(payload))) {
+      throw new Error("gateway returned no supported models");
+    }
+    return { models, source: "gateway", version: payload.version ?? null };
+  } finally {
+    clearTimeout(timeout);
+  }
+}

package/src/macSetup.js

@@ -26,7 +26,7 @@ export const MAC_CLI_INSTALLERS = Object.freeze({
       "https://claude.ai",
       "https://downloads.claude.ai",
     ]),
-    sha256: "cde4f1702d3b1695f92b73d26888364e17bca476e17f0fd676484c951d36c125",
+    sha256: "3a68d3406cf674e17bed1733a4dcf37805e2e47d87417700007d7e1aa766a944",
     command: `curl -fsSL https://claude.ai/install.sh | bash -s ${PINNED_VENDOR_CLI_VERSIONS.claude}`,
     args: Object.freeze([PINNED_VENDOR_CLI_VERSIONS.claude]),
     environment: Object.freeze({}),
@@ -177,7 +177,12 @@ export async function prepareMacClis({
   credential = null,
   skipInstall = false,
   inspectOnly = false,
+  // Install the reviewed vendor binaries and stop there; see the same option
+  // on prepareWindowsClis for why an enrolled managed device wants the
+  // binaries without this CLI's isolated profiles.
+  vendorClisOnly = false,
   installTools = ["claude", "codex"],
+  crossAppModels = false,
 } = {}, dependencies = {}) {
   const io = {
     environment: process.env,
@@ -244,8 +249,27 @@ export async function prepareMacClis({
   const binaries = installAttempted
     ? detectMacClis(io.find, io.environment, io.verify)
     : before;
-  const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId);
-  const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId);
+  const missingAfter = Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool);
+  const installSucceeded = installAttempted
+    ? Object.values(installations).every((installation) => installation.succeeded)
+    : null;
+  const installFailure = Object.values(installations).find((installation) => installation.failure)?.failure || null;
+  const installCommands = Object.fromEntries(missingBefore.map((tool) => [tool, io.installers[tool].command]));
+  if (vendorClisOnly) {
+    return {
+      binaries,
+      missingBefore,
+      missingAfter,
+      installAttempted,
+      installSucceeded,
+      installFailure,
+      installations,
+      installCommands,
+      profiles: null,
+    };
+  }
+  const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId, { crossAppModels });
+  const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId, { crossAppModels });
   if (binaries.claude) {
     await io.syncSkills({
       client: "claude",
@@ -277,14 +301,12 @@ export async function prepareMacClis({
   return {
     binaries,
     missingBefore,
-    missingAfter: Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool),
+    missingAfter,
     installAttempted,
-    installSucceeded: installAttempted
-      ? Object.values(installations).every((installation) => installation.succeeded)
-      : null,
-    installFailure: Object.values(installations).find((installation) => installation.failure)?.failure || null,
+    installSucceeded,
+    installFailure,
     installations,
-    installCommands: Object.fromEntries(missingBefore.map((tool) => [tool, io.installers[tool].command])),
+    installCommands,
     profiles: { claude: claudeProfile.configDir, codex: codexProfile.codexHome },
   };
 }

package/src/managedProfileVersion.js

@@ -9,4 +9,9 @@
 // v44 disables the vendor background auto-updater in managed Claude CLI
 // profiles so a session on the reviewed release cannot move the shared
 // launcher past the pin (the Windows drift behind the gateway lockouts).
-export const CURRENT_CONFIG_VERSION = 44;
+// v45 layers `impel models sync` over the isolated CLI Codex catalog: the
+// profile writer keeps a manifest-verified synced catalog instead of always
+// reasserting the FALLBACK_MODELS floor, records provenance in
+// models-manifest.json, and (with cross-app models enabled) routes the CLI
+// provider through the experimental OpenAI-compatible gateway path.
+export const CURRENT_CONFIG_VERSION = 45;