impel-cli 0.20.57 → 0.20.58

package/RELEASE_NOTES.md

@@ -1,4 +1,8 @@
 # Release notes
+## 0.20.58 — Provision vendor CLIs on managed enrollment
+
+- Ensures freshly enrolled managed devices receive the reviewed Claude Code and Codex CLI binaries without requiring a personal PAT or interactive vendor login.
+- Keeps provisioning isolated from personal Claude/Codex profiles and reports missing vendor runtimes for follow-up convergence.
 
 ## 0.20.57 — Live tenant model catalogs for `impel codex` (`impel models sync`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.57",
+  "version": "0.20.58",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -22,6 +22,7 @@ import { cmdUpdate } from "./commands/update.js";
 import { cmdNuke } from "./commands/nuke.js";
 import { cmdExperimental } from "./commands/experimental.js";
 import { cmdConverge } from "./commands/converge.js";
+import { cmdProvisionVendorClis } from "./commands/provisionVendorClis.js";
 import { cmdRemote } from "./commands/remote.js";
 import { cmdNative } from "./commands/native.js";
 import { ensureMacDeveloperTools } from "./macDeveloperTools.js";
@@ -225,6 +226,12 @@ async function dispatch(cmd, rest) {
     case "_converge":
       return cmdConverge(rest);
 
+    // Hidden, unauthenticated vendor-CLI provisioning, called by the managed
+    // enrollment bootstrap. A managed device has no PAT, so it cannot reach
+    // `impel setup` — and without this nothing ever installs Claude Code.
+    case "_provision-vendor-clis":
+      return cmdProvisionVendorClis(rest);
+
     // Hidden OS-shell launcher. Setup/update guarantees the app is ready.
     case "_app-launch": {
       const [target = "all", ...args] = rest;

package/src/commands/provisionVendorClis.js

@@ -0,0 +1,92 @@
+// `impel _provision-vendor-clis` — put the reviewed vendor CLIs on the machine
+// without authenticating.
+//
+// `impel setup` is the authenticated path: it needs a PAT, and it also writes
+// this CLI's isolated Claude/Codex profiles. An enrolled managed device has
+// neither. Its credential is the tenant credential the bootstrap wrote, and its
+// profiles belong to the managed runtime (impel-apps), which supplies
+// CLAUDE_CONFIG_DIR/CODEX_HOME, the gateway origin, and the credential at
+// launch. The one thing the managed chain cannot do is put Claude Code on the
+// machine — the managed `claude` package is Claude Desktop, and the runtime
+// requires a separately installed vendor Claude Code CLI at the reviewed pin.
+//
+// So enrollment calls this: the same reviewed installers `impel setup` runs,
+// the same version gate, and nothing else. It is intentionally quiet and it
+// never throws — a device must finish enrolling even if a vendor endpoint is
+// unreachable, and `impel setup`, `impel update`, and the next enrollment
+// refresh all re-run the same installer.
+import { parseFlags } from "../args.js";
+import { describeCliFailure, preparePlatformClis } from "../platformSetup.js";
+import { PINNED_VENDOR_CLI_VERSIONS } from "../vendorCliVersions.js";
+
+const SUPPORTED_TOOLS = Object.freeze(["claude", "codex"]);
+
+export function parseProvisionTools(value) {
+  if (value === undefined || value === true || value === null || value === "") return [...SUPPORTED_TOOLS];
+  const requested = String(value).split(",").map((tool) => tool.trim()).filter(Boolean);
+  const unsupported = requested.filter((tool) => !SUPPORTED_TOOLS.includes(tool));
+  if (unsupported.length) throw new Error(`unsupported vendor CLI: ${unsupported.join(", ")}`);
+  return [...new Set(requested)];
+}
+
+export async function cmdProvisionVendorClis(argv = [], overrides = {}) {
+  const io = {
+    platform: process.platform,
+    preparePlatformClis,
+    logger: console,
+    ...overrides,
+  };
+  const { flags } = parseFlags(argv, {
+    tools: { type: "string" },
+    json: { type: "boolean" },
+    "skip-install": { type: "boolean" },
+  });
+
+  let installTools;
+  try {
+    installTools = parseProvisionTools(flags.tools);
+  } catch (error) {
+    io.logger.error(`impel _provision-vendor-clis: ${error.message}`);
+    process.exitCode = 1;
+    return null;
+  }
+
+  let prepared;
+  try {
+    prepared = await io.preparePlatformClis({
+      platform: io.platform,
+      vendorClisOnly: true,
+      skipInstall: flags["skip-install"] === true,
+      installTools,
+    });
+  } catch (error) {
+    // Enrollment must not fail because a vendor endpoint did. Report and exit
+    // nonzero so a caller that cares can see it; the bootstrap ignores it.
+    const report = { ok: false, versions: PINNED_VENDOR_CLI_VERSIONS, error: String(error?.message || error) };
+    io.logger.error(flags.json ? JSON.stringify(report) : `impel _provision-vendor-clis: ${report.error}`);
+    process.exitCode = 1;
+    return report;
+  }
+
+  const installed = Object.fromEntries(
+    installTools.map((tool) => [tool, prepared.binaries?.[tool] || null]),
+  );
+  const missing = installTools.filter((tool) => !installed[tool]);
+  const report = {
+    ok: missing.length === 0,
+    versions: Object.fromEntries(installTools.map((tool) => [tool, PINNED_VENDOR_CLI_VERSIONS[tool]])),
+    installed,
+    missing,
+    installAttempted: prepared.installAttempted === true,
+  };
+
+  if (flags.json) io.logger.log(JSON.stringify(report));
+  else {
+    for (const tool of installTools) {
+      if (installed[tool]) io.logger.log(`${tool} ${PINNED_VENDOR_CLI_VERSIONS[tool]}: ${installed[tool]}`);
+    }
+    if (missing.length) io.logger.error(`impel _provision-vendor-clis: ${describeCliFailure(prepared, { commandName: "_provision-vendor-clis", isTTY: false, skipClis: flags["skip-install"] === true })}`);
+  }
+  if (!report.ok) process.exitCode = 1;
+  return report;
+}

package/src/commands/tasks.js

@@ -27,6 +27,7 @@ const HELP = `impel tasks - CRUD tickets in Impel
 Usage:
   impel tasks list [--org <org>] [--scope visible|done|all] [--json]
   impel tasks get <id> [--org <org>] [--json]
+  impel tasks projects [--org <org>] [--json]
   impel tasks create --title <title> [--description <md> | --description-file <path>] [options] [--json]
   impel tasks update <id> [options] [--json]
   impel tasks delete <id> --yes [--org <org>] [--json]
@@ -49,6 +50,7 @@ Options:
   --assignee <id|none>              Assignee member id, or "none".
   --assigned-to <id|none>           Alias for --assignee.
   --due <YYYY-MM-DD|empty>          Due date, or empty string to clear.
+  --project <name|empty>             Project name, or empty string to clear.
   --json                            Print raw JSON response.
 `;
 
@@ -74,6 +76,7 @@ function flagSpec() {
     assignee: { type: "string" },
     "assigned-to": { type: "string" },
     due: { type: "string" },
+    project: { type: "string" },
     yes: { type: "boolean" },
   };
 }
@@ -186,7 +189,22 @@ function descriptionFromFlags(flags) {
   return inline;
 }
 
-function mutationBody(flags, { requireTitle = false } = {}) {
+function validateProject(value) {
+  if (value === undefined || value === "") return value;
+  if (value.length > 120) fail("impel tasks: project must be 120 characters or fewer.");
+  if (value.trim() !== value) {
+    fail("impel tasks: project cannot have leading or trailing whitespace.");
+  }
+  if ([...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  })) {
+    fail("impel tasks: project cannot contain control characters.");
+  }
+  return value;
+}
+
+export function taskMutationBody(flags, { requireTitle = false } = {}) {
   const body = {};
   if (flags.org !== undefined) body.orgId = flags.org;
 
@@ -219,6 +237,8 @@ function mutationBody(flags, { requireTitle = false } = {}) {
   if (assignedTo !== undefined) body.assignedTo = assignedTo;
 
   if (flags.due !== undefined) body.dueDate = flags.due;
+  const project = validateProject(flags.project);
+  if (project !== undefined) body.project = project;
 
   return body;
 }
@@ -262,6 +282,7 @@ function printTask(task, { orgId, markdown } = {}) {
   console.log(`Priority:  ${task.priority || "none"}`);
   console.log(`Assignee:  ${task.assignedTo || "unassigned"}`);
   console.log(`Labels:    ${(task.labels || []).join(", ") || "none"}`);
+  console.log(`Project:   ${task.project || "none"}`);
   if (task.latestRunId) console.log(`Run:       ${task.latestRunId} (${task.runStatus || "unknown"})`);
   if (markdown) {
     console.log("");
@@ -294,6 +315,17 @@ export async function cmdTasks(argv) {
         return;
       }
 
+      case "projects": {
+        const payload = await requestJson({
+          flags,
+          path: "/api/cli/tasks/projects",
+          query: { orgId: flags.org },
+        });
+        if (flags.json) return printJson(payload);
+        for (const project of payload.projects || []) console.log(project);
+        return;
+      }
+
       case "get": {
         const issueId = positionals[0];
         if (!issueId) fail("impel tasks get: missing task id.");
@@ -308,7 +340,7 @@ export async function cmdTasks(argv) {
       }
 
       case "create": {
-        const body = mutationBody(flags, { requireTitle: true });
+        const body = taskMutationBody(flags, { requireTitle: true });
         const payload = await requestJson({
           flags,
           path: "/api/cli/tasks",
@@ -324,7 +356,7 @@ export async function cmdTasks(argv) {
       case "update": {
         const issueId = positionals[0];
         if (!issueId) fail("impel tasks update: missing task id.");
-        const body = mutationBody(flags);
+        const body = taskMutationBody(flags);
         if (Object.keys(body).filter((key) => key !== "orgId").length === 0) {
           fail("impel tasks update: pass at least one field to update.");
         }

package/src/macSetup.js

@@ -26,7 +26,7 @@ export const MAC_CLI_INSTALLERS = Object.freeze({
       "https://claude.ai",
       "https://downloads.claude.ai",
     ]),
-    sha256: "cde4f1702d3b1695f92b73d26888364e17bca476e17f0fd676484c951d36c125",
+    sha256: "3a68d3406cf674e17bed1733a4dcf37805e2e47d87417700007d7e1aa766a944",
     command: `curl -fsSL https://claude.ai/install.sh | bash -s ${PINNED_VENDOR_CLI_VERSIONS.claude}`,
     args: Object.freeze([PINNED_VENDOR_CLI_VERSIONS.claude]),
     environment: Object.freeze({}),
@@ -177,6 +177,10 @@ export async function prepareMacClis({
   credential = null,
   skipInstall = false,
   inspectOnly = false,
+  // Install the reviewed vendor binaries and stop there; see the same option
+  // on prepareWindowsClis for why an enrolled managed device wants the
+  // binaries without this CLI's isolated profiles.
+  vendorClisOnly = false,
   installTools = ["claude", "codex"],
   crossAppModels = false,
 } = {}, dependencies = {}) {
@@ -245,6 +249,25 @@ export async function prepareMacClis({
   const binaries = installAttempted
     ? detectMacClis(io.find, io.environment, io.verify)
     : before;
+  const missingAfter = Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool);
+  const installSucceeded = installAttempted
+    ? Object.values(installations).every((installation) => installation.succeeded)
+    : null;
+  const installFailure = Object.values(installations).find((installation) => installation.failure)?.failure || null;
+  const installCommands = Object.fromEntries(missingBefore.map((tool) => [tool, io.installers[tool].command]));
+  if (vendorClisOnly) {
+    return {
+      binaries,
+      missingBefore,
+      missingAfter,
+      installAttempted,
+      installSucceeded,
+      installFailure,
+      installations,
+      installCommands,
+      profiles: null,
+    };
+  }
   const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId, { crossAppModels });
   const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId, { crossAppModels });
   if (binaries.claude) {
@@ -278,14 +301,12 @@ export async function prepareMacClis({
   return {
     binaries,
     missingBefore,
-    missingAfter: Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool),
+    missingAfter,
     installAttempted,
-    installSucceeded: installAttempted
-      ? Object.values(installations).every((installation) => installation.succeeded)
-      : null,
-    installFailure: Object.values(installations).find((installation) => installation.failure)?.failure || null,
+    installSucceeded,
+    installFailure,
     installations,
-    installCommands: Object.fromEntries(missingBefore.map((tool) => [tool, io.installers[tool].command])),
+    installCommands,
     profiles: { claude: claudeProfile.configDir, codex: codexProfile.codexHome },
   };
 }

package/src/platformSetup.js

@@ -27,8 +27,10 @@ export async function preparePlatformClis(options = {}, dependencies = {}) {
     installCommands: {},
     profiles: null,
   };
-  // Discovery-only probes must not write profiles either.
-  if (options.inspectOnly) return result;
+  // Discovery-only probes must not write profiles either, and neither does a
+  // vendor-CLI-only pass — which on this platform has no installer to run, so
+  // it degrades to the same discovery result.
+  if (options.inspectOnly || options.vendorClisOnly) return result;
   const crossAppModels = options.crossAppModels === true;
   const claudeProfile = (dependencies.ensureClaudeProfile || ensureImpelClaudeProfile)(options.gatewayUrl, options.tenantId, { crossAppModels });
   const codexProfile = (dependencies.ensureCodexProfile || ensureImpelCodexProfile)(options.gatewayUrl, options.tenantId, { crossAppModels });

package/src/windowsSetup.js

@@ -142,6 +142,13 @@ export async function prepareWindowsClis({
   credential = null,
   skipInstall = false,
   inspectOnly = false,
+  // Install the reviewed vendor binaries and stop there. An enrolled managed
+  // device has no PAT and never uses this CLI's isolated profiles: the managed
+  // runtime supplies CLAUDE_CONFIG_DIR/CODEX_HOME, the credential, and the
+  // gateway origin at launch. What it cannot do is put Claude Code on the
+  // machine, so enrollment reuses this installer for the binaries alone
+  // (`impel _provision-vendor-clis`) and writes no profile it would not read.
+  vendorClisOnly = false,
   installTools = ["claude", "codex"],
   crossAppModels = false,
 } = {}, dependencies = {}) {
@@ -196,9 +203,10 @@ export async function prepareWindowsClis({
   // target machines are brand new — provision the Impel-managed MinGit before
   // any skill sync, on every setup/update pass (idempotent once installed).
   // A failure degrades to the skill-sync "git is missing" skip, never a throw.
-  let gitBinary = io.find("git", io.environment, "win32");
+  // A vendor-CLI-only pass syncs no skills, so it downloads no git either.
+  let gitBinary = vendorClisOnly ? null : io.find("git", io.environment, "win32");
   let gitProvision = null;
-  if (!gitBinary) {
+  if (!vendorClisOnly && !gitBinary) {
     gitProvision = await io.provisionGit({ environment: io.environment, logger: io.logger });
     gitBinary = gitProvision?.installed
       ? gitProvision.binary
@@ -239,6 +247,22 @@ export async function prepareWindowsClis({
     ? detectWindowsClis(io.find, io.environment, io.verify)
     : before;
   const drifted = detectDriftedWindowsClis(io.find, io.environment, binaries, { versionOf: io.versionOf });
+  const missingAfter = Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool);
+  if (vendorClisOnly) {
+    return {
+      binaries,
+      missingBefore,
+      missingAfter,
+      drifted,
+      installAttempted,
+      installSucceeded,
+      installFailure,
+      installations,
+      installCommands: windowsCliInstallCommands(missingBefore),
+      profiles: null,
+      git: { binary: null, provision: null },
+    };
+  }
   const claudeProfile = io.ensureClaudeProfile(gatewayUrl, tenantId, { crossAppModels });
   const codexProfile = io.ensureCodexProfile(gatewayUrl, tenantId, { crossAppModels });
 
@@ -267,7 +291,7 @@ export async function prepareWindowsClis({
   return {
     binaries,
     missingBefore,
-    missingAfter: Object.entries(binaries).filter(([, binary]) => !binary).map(([tool]) => tool),
+    missingAfter,
     drifted,
     installAttempted,
     installSucceeded,