impel-cli 0.20.63-canary.5 → 0.20.63-canary.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.63-canary.5",
+  "version": "0.20.63-canary.7",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/scripts/npm-dist-tags.mjs

@@ -5,6 +5,15 @@ import { fileURLToPath } from "node:url";
 
 const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
 
+// npm accepts a version and returns success before every registry edge exposes
+// its new dist-tag. The post-publish verifier therefore treats a stale canary
+// tag as propagation, not proof that npm publish failed. Five minutes stays
+// comfortably inside the publish job's 15-minute timeout.
+const CANARY_TAG_VERIFY_ATTEMPTS = 20;
+const CANARY_TAG_VERIFY_DELAY_MS = 15_000;
+
+class CanaryDistTagMismatchError extends Error {}
+
 export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
   const latest = tags.latest ?? "";
   const canary = tags.canary ?? "";
@@ -15,11 +24,46 @@ export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
     );
   }
   if (canary !== expectedCanary) {
-    throw new Error(`dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`);
+    throw new CanaryDistTagMismatchError(
+      `dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`,
+    );
   }
   return { latest, canary };
 }
 
+/**
+ * Verify npm's public dist-tags after publish while allowing the canary tag to
+ * propagate. A moved `latest` remains an immediate failure: that is a release
+ * invariant violation, not ordinary registry propagation.
+ */
+export async function verifyCanaryDistTags({
+  beforeLatest,
+  expectedCanary,
+  readTags = readDistTags,
+  attempts = CANARY_TAG_VERIFY_ATTEMPTS,
+  delayMs = CANARY_TAG_VERIFY_DELAY_MS,
+  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+}) {
+  let lastObservedCanary = "";
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const tags = await readTags({ bustCache: true });
+    try {
+      return assertCanaryDistTags({ beforeLatest, expectedCanary, tags });
+    } catch (error) {
+      if (!(error instanceof CanaryDistTagMismatchError)) throw error;
+      lastObservedCanary = tags.canary ?? "";
+      lastError = error;
+      if (attempt < attempts) await sleep(delayMs);
+    }
+  }
+  throw new Error(
+    `npm accepted the canary publish but did not expose it after ${attempts} dist-tag checks: `
+    + `${lastError?.message || `last dist-tags.canary was ${lastObservedCanary || "<none>"}.`} `
+    + "This is registry propagation lag, not an unpublished tarball.",
+  );
+}
+
 async function readDistTags({ allowMissing, bustCache = false } = {}) {
   const url = bustCache ? `${DIST_TAGS_URL}?t=${Date.now()}` : DIST_TAGS_URL;
   let lastError;
@@ -67,8 +111,7 @@ async function main([command, ...args]) {
   }
   if (command === "assert-canary" && args.length === 2) {
     const [expectedCanary, beforeLatest] = args;
-    const tags = await readDistTags({ bustCache: true });
-    const { latest } = assertCanaryDistTags({ expectedCanary, beforeLatest, tags });
+    const { latest } = await verifyCanaryDistTags({ expectedCanary, beforeLatest });
     appendSummary([
       "## Canary published",
       "",

package/src/managedApps.js

@@ -2,14 +2,27 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 const TENANT = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/u;
 const APPLICATIONS_BY_TOOL = Object.freeze({
   claude: ["claude"],
   codex: ["codex", "chatgpt"],
 });
-const MAC_RUNNER = "/Applications/Impel Managed App Runner.app/Contents/Library/LaunchServices/impel-managed-runner";
-const MAC_DESCRIPTOR_ROOT = "/Library/Application Support/Impel/Managed App Runner/descriptors";
+// Managed-app discovery is channel scoped.  The canary installer may replace
+// the machine-global runner, but its descriptors and credentials must remain
+// disjoint from stable state so reinstall/recovery never crosses channels.
+const BRAND_DISPLAY_PREFIX = RUNTIME_BRAND.channel === "canary"
+  && RUNTIME_BRAND.apps.displayPrefix === "Impel"
+  ? "Impel Canary"
+  : RUNTIME_BRAND.apps.displayPrefix;
+const MAC_RUNNER = `/Applications/${BRAND_DISPLAY_PREFIX} Managed App Runner.app/Contents/Library/LaunchServices/impel-managed-runner`;
+const MAC_DESCRIPTOR_ROOT = `/Library/Application Support/${BRAND_DISPLAY_PREFIX}/Managed App Runner/descriptors`;
+const CONFIG_ROOT_SEGMENT = RUNTIME_BRAND.cli.configNamespace;
+
+function credentialPath(home, tenantId) {
+  return path.join(home, ".config", CONFIG_ROOT_SEGMENT, "apps", "credentials", `${tenantId}.json`);
+}
 
 function regularFile(file) {
   try {
@@ -44,7 +57,7 @@ function parseCandidate(manifestPath, launcher, applicationId, platform, home) {
     || String(tenantId).includes("..")
     || manifest?.logicalApplicationId !== `${tenantId}.${applicationId}`
   ) return null;
-  const credential = path.join(home, ".config", "impel", "apps", "credentials", `${tenantId}.json`);
+  const credential = credentialPath(home, tenantId);
   if (!regularFile(credential)) return null;
   return {
     tenantId,
@@ -101,7 +114,7 @@ function runnerEnvelopeCandidate(envelopePath, launcher, applicationId, home) {
     || String(tenantId).includes("..")
     || payload?.logicalApplicationId !== `${tenantId}.${applicationId}`
   ) return null;
-  const credential = path.join(home, ".config", "impel", "apps", "credentials", `${tenantId}.json`);
+  const credential = credentialPath(home, tenantId);
   if (!regularFile(credential)) return null;
   return {
     tenantId,
@@ -185,7 +198,7 @@ export function installedManagedAppCandidates(tool, {
   platform = process.platform,
   home = os.homedir(),
   applicationsRoot = platform === "win32"
-    ? path.join(process.env.ProgramFiles || "C:\\Program Files", "Impel", "Apps")
+    ? path.join(process.env.ProgramFiles || "C:\\Program Files", BRAND_DISPLAY_PREFIX, "Apps")
     : "/Applications",
   descriptorRoot = MAC_DESCRIPTOR_ROOT,
   runnerLauncher = MAC_RUNNER,

package/src/remote/transfer.js

@@ -5,6 +5,7 @@ import { tenantCliProfilePaths } from "../cliProfiles.js";
 import { redactSecretText } from "../config.js";
 import { runBuffer, runCapture, runInteractive, sleep } from "./process.js";
 import { runPaths } from "./state.js";
+import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 // LEGACY ONLY: this module's SSH upload and PAT-bearing remote configuration
 // are isolated to portable-legacy. Broker-backed modes use immutable workspace
@@ -15,6 +16,7 @@ const REMOTE_REPO = "/workspace/repo";
 const REMOTE_BUNDLE = "/tmp/impel-remote-repo.bundle";
 const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
 const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+export const REMOTE_CONFIG_ROOT = `/home/agent/.config/${RUNTIME_BRAND.cli.configNamespace}`;
 
 function git(args, options = {}) {
   return runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", args, options).stdout.trim();
@@ -190,16 +192,16 @@ export function uploadRemoteConfiguration(state, {
   const environmentFile = Object.entries(selectedEnvironment)
     .map(([name, value]) => `export ${name}=${shellQuote(value)}`)
     .join("\n") + "\n";
-  const profileRoot = `/home/agent/.config/impel/cli/tenants/${tenant.tenantId}`;
+  const profileRoot = `${REMOTE_CONFIG_ROOT}/cli/tenants/${tenant.tenantId}`;
   const claudeSettings = {
     permissions: { defaultMode: "bypassPermissions" },
     sandbox: { enabled: false },
   };
   const files = [
-    { path: "/home/agent/.config/impel/config.json", contents: `${JSON.stringify(remoteConfig, null, 2)}\n` },
-    { path: "/home/agent/.config/impel/remote/env.sh", contents: environmentFile },
+    { path: `${REMOTE_CONFIG_ROOT}/config.json`, contents: `${JSON.stringify(remoteConfig, null, 2)}\n` },
+    { path: `${REMOTE_CONFIG_ROOT}/remote/env.sh`, contents: environmentFile },
     {
-      path: "/home/agent/.config/impel/remote/run.json",
+      path: `${REMOTE_CONFIG_ROOT}/remote/run.json`,
       contents: `${JSON.stringify({
         runId: state.runId,
         credentialTokenId: credential.tokenId,
@@ -214,12 +216,12 @@ const path = require("node:path");
 const payload = JSON.parse(fs.readFileSync(0, "utf8"));
 for (const file of payload.files) {
   const target = path.resolve(file.path);
-  if (!target.startsWith("/home/agent/.config/impel/")) throw new Error("refusing remote path");
+  if (!target.startsWith(payload.root + "/")) throw new Error("refusing remote path");
   fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
   fs.writeFileSync(target, file.contents, { mode: 0o600 });
   fs.chmodSync(target, 0o600);
 }
-`, { files });
+`, { files, root: REMOTE_CONFIG_ROOT });
 }
 
 export function uploadRepository(state, repository) {
@@ -294,8 +296,8 @@ export function transferSessionCheckpoint(state, { provider, sessionId, tenantId
   const profiles = tenantCliProfilePaths(tenantId);
   const localRoot = provider === "claude" ? profiles.claudeConfigDir : profiles.codexHome;
   const remoteRoot = provider === "claude"
-    ? `/home/agent/.config/impel/cli/tenants/${tenantId}/claude`
-    : `/home/agent/.config/impel/cli/tenants/${tenantId}/codex`;
+    ? `${REMOTE_CONFIG_ROOT}/cli/tenants/${tenantId}/claude`
+    : `${REMOTE_CONFIG_ROOT}/cli/tenants/${tenantId}/codex`;
   const files = collectSessionFiles(localRoot, sessionId);
   if (files.length === 0) {
     throw new Error(`could not find ${provider} session ${sessionId} in the selected Impel CLI profile`);

package/src/windowsGit.js

@@ -15,6 +15,7 @@ import path from "node:path";
 
 import { nativeCommandInvocation, nativeSpawnInvocation } from "./nativeProcess.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
+import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 /**
  * The exact MinGit release the CLI may install. Never use `latest` or an
@@ -52,7 +53,7 @@ const POWERSHELL_ARGS = [
 
 /** Root of the Impel-managed MinGit install. */
 export function managedGitRoot(homeDir = os.homedir()) {
-  return path.join(homeDir, ".config", "impel", "tools", "git");
+  return path.join(homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "tools", "git");
 }
 
 /** The PATH-safe git.exe inside a MinGit root (MinGit unpacks `cmd/` at top level). */