impel-cli 0.20.63-canary.7 → 0.20.64

package/README.md

@@ -219,7 +219,7 @@ skill-catalog prompt context; the selected Eve agent still performs the
 substantive work. Model, profile,
 developer-instruction, MCP, approval, sandbox, and feature overrides are
 rejected for its managed path. Ordinary `impel claude`, user-authored Claude
-agent, and `impel codex` passthrough are unchanged.
+agent, and `impel codex` are unchanged.
 
 ## Remote Fargate sessions
 

package/RELEASE_NOTES.md

@@ -1,5 +1,32 @@
 # Release notes
 
+## 0.20.64 — Windows cmd-compatible Codex hooks; rebuilt managed macOS package
+
+- Emits managed Codex hooks with cmd-compatible quoting on Windows. Codex's
+  Windows hook runner passes `commandWindows` to cmd.exe as one raw command
+  line, so the PowerShell call syntax used before failed every Windows hook
+  even though the same command worked on macOS. Bumps the managed config
+  contract to 49 so existing Windows profiles are rewritten.
+- New version so the managed macOS `Impel-CLI` package can be reissued and
+  reinstalled by Munki. The 0.20.63 package published with release 0.1.134 was
+  re-signed without the Node runtime's JIT entitlements and its bundled Node
+  aborts at startup; the impel-apps builders now restore those entitlements,
+  but Munki only replaces the package when its version increases.
+
+## 0.20.63 — Route isolated Codex through the typed gateway surface
+
+- Moves the `impel codex` and `impel use gateway codex` model provider from the
+  raw `/chatgpt_passthrough/backend-api/codex` route to `/openai/v1`, the typed
+  OpenAI-compatible surface the managed ChatGPT desktop profile already uses.
+  The raw route forwards bytes to chatgpt.com and can only serve Codex-native
+  models; every OpenAI-compatible subscription model (MiniMax, GLM, Qwen)
+  answered `400 model is not available on this client protocol` there.
+  Cross-app mode no longer switches routes; it only changes the catalog.
+- Pins `supports_websockets = false` on every generated Codex provider block.
+  Without it Codex dials `wss://…/responses` first and retries the handshake
+  five times per turn, showing each gateway refusal to the user, before falling
+  back to HTTPS. Bumps the managed config version so existing profiles rewrite.
+
 ## 0.20.62 — Silence the Codex apps connector in desktop profiles
 
 - Persists `features.apps = false` in the managed ChatGPT desktop `config.toml`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.63-canary.7",
+  "version": "0.20.64",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -34,7 +34,6 @@ import {
   TELEMETRY_FLUSH_COMMAND,
 } from "./posthog.js";
 import { maybePrintTelemetryNotice } from "./telemetryNotice.js";
-import { versionLine } from "./runtimeBrand.js";
 
 const HELP = `impel — isolated Impel workspaces for every tenant
 
@@ -94,7 +93,7 @@ Config file:
 function printVersion() {
   const pkgPath = fileURLToPath(new URL("../package.json", import.meta.url));
   const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-  console.log(versionLine(pkg.version));
+  console.log(pkg.version);
 }
 
 // Accepts "claude" | "codex" | "all" | undefined; returns a normalized target

package/src/cliProfiles.js

@@ -208,13 +208,16 @@ function codexManagedBlock(gatewayUrl, tenantId, { crossAppModels = false } = {}
     `# Generated for \`${RUNTIME_BRAND.cli.command} codex\`. Other profile settings outside this block are preserved.`,
     `[model_providers.${providerId}]`,
     `name = ${JSON.stringify(`${RUNTIME_BRAND.product.displayName} Gateway`)}`,
-    // The experimental OpenAI-compatible route can dispatch both provider
-    // families (the desktop ChatGPT profile's cross-app path); the default
-    // route is the byte-preserving Codex passthrough.
-    `base_url = ${JSON.stringify(crossAppModels
-      ? `${gatewayUrl}/experimental/openai/v1`
-      : impelCodexBaseUrl(gatewayUrl))}`,
+    // The typed OpenAI-compatible route serves Codex-native and every
+    // OpenAI-compatible subscription model, and is what the managed ChatGPT
+    // desktop profile already uses. Cross-app mode only changes which models
+    // the catalog lists, not the route. The old byte-preserving Codex
+    // passthrough could serve Codex-native models only.
+    `base_url = ${JSON.stringify(impelCodexBaseUrl(gatewayUrl))}`,
     'wire_api = "responses"',
+    // HTTPS only: without this Codex retries a wss:// handshake five times
+    // per turn before falling back.
+    "supports_websockets = false",
     `env_key = ${JSON.stringify(CODEX_GATEWAY_TOKEN_ENV)}`,
   ];
   if (RUNTIME_BRAND.features.mcp) {

package/src/codexSetup.js

@@ -39,11 +39,16 @@ export const CODEX_CONFIG_PATH = path.join(CODEX_HOME, "config.toml");
 
 export const PROVIDER_ID = RUNTIME_BRAND.cli.providerId;
 
-// Genuine Codex CLI traffic has its own byte-preserving compatibility route.
-// With wire_api = "responses", Codex POSTs to `${base_url}/responses`, so this
-// base must stop immediately before that suffix. Do not point the CLI at the
-// separate `/v1/responses` SDK front door; the gateway may shape that body.
-export const CODEX_CLI_BASE_PATH = "/chatgpt_passthrough/backend-api/codex";
+// Codex CLI traffic uses the gateway's typed OpenAI-compatible surface, the
+// same route the managed ChatGPT desktop profile uses. With
+// wire_api = "responses", Codex POSTs to `${base_url}/responses`, so this base
+// must stop immediately before that suffix. The old raw
+// `/chatgpt_passthrough/backend-api/codex` route forwards bytes to chatgpt.com
+// and can only serve Codex-native models: every OpenAI-compatible subscription
+// model (MiniMax, GLM, Qwen) answered "model is not available on this client
+// protocol" there. Do not point the CLI at the separate `/v1/responses` SDK
+// front door either; the gateway may shape that body differently.
+export const CODEX_CLI_BASE_PATH = "/openai/v1";
 export const impelCodexBaseUrl = (gatewayUrl) => `${gatewayUrl}${CODEX_CLI_BASE_PATH}`;
 
 const START_MARK = `# >>> ${RUNTIME_BRAND.cli.managedMarker} managed block (model_providers.${PROVIDER_ID}) >>>`;
@@ -79,6 +84,10 @@ function providerTablesBlock(
     `name = ${JSON.stringify(`${RUNTIME_BRAND.product.displayName} Gateway`)}`,
     `base_url = "${baseUrl}"`,
     `wire_api = "responses"`,
+    // The gateway serves Responses over HTTPS only. Without this pin Codex
+    // dials wss://.../responses first and retries the handshake five times
+    // (surfacing each refusal to the user) before falling back to HTTPS.
+    `supports_websockets = false`,
     "",
     `[model_providers.${PROVIDER_ID}.auth]`,
     `command = ${JSON.stringify(auth.command)}`,

package/src/commands/auth.js

@@ -3,7 +3,6 @@ import {
   loadConfig,
   CONFIG_PATH,
   saveConfig,
-  foreignChannelOrigin,
   normalizeGatewayUrl,
   resolveDefaultGateway,
   resolveDefaultAppUrl,
@@ -13,8 +12,7 @@ import { promptSecret } from "../prompt.js";
 import { applyCliUser, fetchTenants, normalizeTenantId } from "../tenants.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
-export async function cmdAuth(argv, overrides = {}) {
-  const io = { fetchTenants, promptSecret, ...overrides };
+export async function cmdAuth(argv) {
   const { flags } = parseFlags(argv, {
     pat: { type: "string" },
     gateway: { type: "string" },
@@ -22,16 +20,11 @@ export async function cmdAuth(argv, overrides = {}) {
     tenant: { type: "string" },
   });
 
-  // `auth` is the one command that must run against a config whose origins
-  // belong to another channel: it is how a device that carried a production
-  // config is moved onto the canary origins (and the message `loadConfig`
-  // prints elsewhere tells the tester to run it).
-  const canary = RUNTIME_BRAND.channel === "canary";
-  const existing = loadConfig({ rejectForeignOrigins: !canary });
+  const existing = loadConfig();
 
   let pat = flags.pat;
   if (!pat) {
-    pat = await io.promptSecret(`${RUNTIME_BRAND.product.displayName} Personal Access Token (${RUNTIME_BRAND.auth.patPrefix}...): `);
+    pat = await promptSecret(`${RUNTIME_BRAND.product.displayName} Personal Access Token (${RUNTIME_BRAND.auth.patPrefix}...): `);
   }
   if (!pat) {
     console.error("impel: no PAT provided, aborting.");
@@ -44,21 +37,12 @@ export async function cmdAuth(argv, overrides = {}) {
     );
   }
 
-  // Under the canary brand the stored origins are ignored in favour of the
-  // brand defaults; a production origin can only survive here if it is asked
-  // for explicitly, and then it is refused below rather than written.
-  const gatewayUrl = normalizeGatewayUrl(flags.gateway || (canary ? null : existing?.gatewayUrl) || resolveDefaultGateway());
-  const appUrl = normalizeGatewayUrl(flags.app || (canary ? null : existing?.appUrl) || resolveDefaultAppUrl());
-  for (const [key, value] of [["gatewayUrl", gatewayUrl], ["appUrl", appUrl]]) {
-    const expected = foreignChannelOrigin(key, value);
-    if (expected) {
-      throw new Error(`${key} ${value} is not a ${RUNTIME_BRAND.channel} origin; this ${RUNTIME_BRAND.channel} build talks only to ${expected}.`);
-    }
-  }
+  const gatewayUrl = normalizeGatewayUrl(flags.gateway || existing?.gatewayUrl || resolveDefaultGateway());
+  const appUrl = normalizeGatewayUrl(flags.app || existing?.appUrl || resolveDefaultAppUrl());
 
   const config = { ...(existing || {}), pat, gatewayUrl, appUrl, updatedAt: new Date().toISOString() };
   try {
-    const listing = await io.fetchTenants(config);
+    const listing = await fetchTenants(config);
     const requestedTenant = flags.tenant ? normalizeTenantId(flags.tenant) : null;
     const selected = requestedTenant
       ? listing.tenants.find((tenant) => tenant.id === requestedTenant || tenant.slug === requestedTenant)

package/src/commands/update.js

@@ -15,7 +15,7 @@ import {
   convergenceSummaryDiagnostics,
   readRecentConvergenceSummary,
 } from "../convergenceSummary.js";
-import { brandedEnvironmentName, brandedText, RUNTIME_BRAND, versionLine } from "../runtimeBrand.js";
+import { brandedEnvironmentName, brandedText, RUNTIME_BRAND } from "../runtimeBrand.js";
 import { IMPEL_CLI_ENTRYPOINT } from "../selfInvocation.js";
 import {
   fetchRemoteVersion,
@@ -68,9 +68,7 @@ export function postInstallCliRunnable(expectedVersion, { spawn = spawnSync, exe
       windowsHide: true,
     });
     if (run.status !== 0 || run.error) return false;
-    // The freshly installed build is the same package on the same channel, so
-    // its `--version` line carries the same channel suffix this build prints.
-    return String(run.stdout || "").trim() === versionLine(expectedVersion.trim());
+    return String(run.stdout || "").trim() === expectedVersion.trim();
   } catch {
     return false;
   }

package/src/config.js

@@ -47,39 +47,8 @@ export function normalizeGatewayUrl(url) {
   return LEGACY_GATEWAY_URLS.has(normalized) ? DEFAULT_GATEWAY_URL : normalized;
 }
 
-const CHANNEL_ORIGIN_KEYS = Object.freeze({
-  gatewayUrl: Object.freeze({ brandDefault: DEFAULT_GATEWAY_URL, environmentSuffix: "GATEWAY_URL" }),
-  appUrl: Object.freeze({ brandDefault: DEFAULT_APP_URL, environmentSuffix: "APP_URL" }),
-});
-
-/**
- * Under the canary brand, an origin the CLI would use must be the canary row
- * the brand carries, or the explicit branded env override (how an engineer
- * points a build at a local service). Returns the origin `key` is required to
- * be when `value` is foreign, else null. The stable brand accepts every
- * origin, exactly as before channels existed.
- *
- * Why this exists: the canary CLI replaces the stable one on a device under
- * the same package name, so an engineer's existing production config would
- * otherwise keep a canary build talking to production with production
- * credentials (R17).
- */
-export function foreignChannelOrigin(key, value) {
-  if (RUNTIME_BRAND.channel !== "canary" || !value) return null;
-  const { brandDefault, environmentSuffix } = CHANNEL_ORIGIN_KEYS[key];
-  const normalized = normalizeGatewayUrl(value);
-  const override = process.env[brandedEnvironmentName(environmentSuffix)];
-  if (normalized === brandDefault || (override && normalized === normalizeGatewayUrl(override))) return null;
-  return brandDefault;
-}
-
-/**
- * Returns the parsed config object, or null if it doesn't exist yet. Throws
- * on malformed JSON, and — under the canary brand — on a stored origin outside
- * the canary row unless `rejectForeignOrigins` is false (`impel auth` reads
- * that way so it can move a device off a production config).
- */
-export function loadConfig({ rejectForeignOrigins = true } = {}) {
+/** Returns the parsed config object, or null if it doesn't exist yet. Throws on malformed JSON. */
+export function loadConfig() {
   let raw;
   try {
     raw = fs.readFileSync(CONFIG_PATH, "utf8");
@@ -87,27 +56,15 @@ export function loadConfig({ rejectForeignOrigins = true } = {}) {
     if (err.code === "ENOENT") return null;
     throw err;
   }
-  let config;
   try {
-    config = JSON.parse(raw);
+    const config = JSON.parse(raw);
+    if (config?.gatewayUrl) config.gatewayUrl = normalizeGatewayUrl(config.gatewayUrl);
+    return config;
   } catch {
     throw new Error(
       `${CONFIG_PATH} exists but isn't valid JSON. Fix or delete it, then run \`${RUNTIME_BRAND.cli.command} auth\` again.`
     );
   }
-  if (config?.gatewayUrl) config.gatewayUrl = normalizeGatewayUrl(config.gatewayUrl);
-  if (rejectForeignOrigins) {
-    for (const key of Object.keys(CHANNEL_ORIGIN_KEYS)) {
-      const expected = foreignChannelOrigin(key, config?.[key]);
-      if (expected) {
-        throw new Error(
-          `${CONFIG_PATH} stores ${key} ${normalizeGatewayUrl(config[key])}, but this ${RUNTIME_BRAND.channel} build talks only to ${expected}; `
-          + `run \`${RUNTIME_BRAND.cli.command} auth\` to re-enrol this device against the ${RUNTIME_BRAND.channel} origins.`
-        );
-      }
-    }
-  }
-  return config;
 }
 
 /** Writes the config atomically-ish and locks it down to 0600 (owner read/write only). */

package/src/extension/index.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 
 import { main as upstreamMain } from "../cli.js";
-import { brandedText, RUNTIME_BRAND, validateRuntimeBrand, versionLine } from "../runtimeBrand.js";
+import { brandedText, RUNTIME_BRAND, validateRuntimeBrand } from "../runtimeBrand.js";
 
 const ALIASES = Object.freeze({
   apps: "app",
@@ -95,7 +95,7 @@ export function createImpelCliExtension({ brand, entrypoint, version }) {
         return;
       }
       if (["--version", "-v"].includes(rawCommand)) {
-        process.stdout.write(`${versionLine(version)}\n`);
+        process.stdout.write(`${version}\n`);
         return;
       }
       const command = ALIASES[rawCommand] || rawCommand;

package/src/gateway/index.js

@@ -328,6 +328,7 @@ export function createGatewayCli(options) {
       `name = ${JSON.stringify(`${brand.product.displayName} Gateway`)}`,
       `base_url = ${JSON.stringify(gatewayRoutes.codex(gatewayUrl))}`,
       'wire_api = "responses"',
+      "supports_websockets = false",
       "",
       `[model_providers.${brand.cli.providerId}.auth]`,
       `command = ${JSON.stringify(auth.command)}`,

package/src/managedApps.js

@@ -2,27 +2,14 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
-import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 const TENANT = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/u;
 const APPLICATIONS_BY_TOOL = Object.freeze({
   claude: ["claude"],
   codex: ["codex", "chatgpt"],
 });
-// Managed-app discovery is channel scoped.  The canary installer may replace
-// the machine-global runner, but its descriptors and credentials must remain
-// disjoint from stable state so reinstall/recovery never crosses channels.
-const BRAND_DISPLAY_PREFIX = RUNTIME_BRAND.channel === "canary"
-  && RUNTIME_BRAND.apps.displayPrefix === "Impel"
-  ? "Impel Canary"
-  : RUNTIME_BRAND.apps.displayPrefix;
-const MAC_RUNNER = `/Applications/${BRAND_DISPLAY_PREFIX} Managed App Runner.app/Contents/Library/LaunchServices/impel-managed-runner`;
-const MAC_DESCRIPTOR_ROOT = `/Library/Application Support/${BRAND_DISPLAY_PREFIX}/Managed App Runner/descriptors`;
-const CONFIG_ROOT_SEGMENT = RUNTIME_BRAND.cli.configNamespace;
-
-function credentialPath(home, tenantId) {
-  return path.join(home, ".config", CONFIG_ROOT_SEGMENT, "apps", "credentials", `${tenantId}.json`);
-}
+const MAC_RUNNER = "/Applications/Impel Managed App Runner.app/Contents/Library/LaunchServices/impel-managed-runner";
+const MAC_DESCRIPTOR_ROOT = "/Library/Application Support/Impel/Managed App Runner/descriptors";
 
 function regularFile(file) {
   try {
@@ -57,7 +44,7 @@ function parseCandidate(manifestPath, launcher, applicationId, platform, home) {
     || String(tenantId).includes("..")
     || manifest?.logicalApplicationId !== `${tenantId}.${applicationId}`
   ) return null;
-  const credential = credentialPath(home, tenantId);
+  const credential = path.join(home, ".config", "impel", "apps", "credentials", `${tenantId}.json`);
   if (!regularFile(credential)) return null;
   return {
     tenantId,
@@ -114,7 +101,7 @@ function runnerEnvelopeCandidate(envelopePath, launcher, applicationId, home) {
     || String(tenantId).includes("..")
     || payload?.logicalApplicationId !== `${tenantId}.${applicationId}`
   ) return null;
-  const credential = credentialPath(home, tenantId);
+  const credential = path.join(home, ".config", "impel", "apps", "credentials", `${tenantId}.json`);
   if (!regularFile(credential)) return null;
   return {
     tenantId,
@@ -198,7 +185,7 @@ export function installedManagedAppCandidates(tool, {
   platform = process.platform,
   home = os.homedir(),
   applicationsRoot = platform === "win32"
-    ? path.join(process.env.ProgramFiles || "C:\\Program Files", BRAND_DISPLAY_PREFIX, "Apps")
+    ? path.join(process.env.ProgramFiles || "C:\\Program Files", "Impel", "Apps")
     : "/Applications",
   descriptorRoot = MAC_DESCRIPTOR_ROOT,
   runnerLauncher = MAC_RUNNER,

package/src/managedProfileVersion.js

@@ -17,4 +17,6 @@
 // v47 persists `features.apps = false` in the managed ChatGPT desktop profile
 // so the hosted codex_apps connector stops handshaking against the gateway
 // without a credential (the same gate 0.20.61 passed to CLI sessions).
-export const CURRENT_CONFIG_VERSION = 47;
+// v49 rewrites Codex `commandWindows` from PowerShell syntax to the
+// `cmd.exe` syntax required by Codex's hook runner.
+export const CURRENT_CONFIG_VERSION = 49;

package/src/posthog.js

@@ -101,7 +101,7 @@ export const TELEMETRY_CONTRACT = Object.freeze({
       name: "cli_bug_report",
       origin: "server",
       properties: [
-        { key: "channel", type: "string", required: true, values: ["latest", "next", "canary"] },
+        { key: "channel", type: "string", required: true, values: ["latest", "next"] },
         { key: "cliVersion", type: "string", required: true, maxLength: 32 },
         { key: "hasMessage", type: "boolean", required: true },
         {
@@ -123,7 +123,7 @@ export const TELEMETRY_CONTRACT = Object.freeze({
       name: "cli_command_run",
       origin: "cli",
       properties: [
-        { key: "channel", type: "string", required: true, values: ["latest", "next", "canary"] },
+        { key: "channel", type: "string", required: true, values: ["latest", "next"] },
         { key: "cliVersion", type: "string", required: true, maxLength: 32 },
         { key: "command", type: "string", required: true, maxLength: 64 },
         {

package/src/remote/transfer.js

@@ -5,7 +5,6 @@ import { tenantCliProfilePaths } from "../cliProfiles.js";
 import { redactSecretText } from "../config.js";
 import { runBuffer, runCapture, runInteractive, sleep } from "./process.js";
 import { runPaths } from "./state.js";
-import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 // LEGACY ONLY: this module's SSH upload and PAT-bearing remote configuration
 // are isolated to portable-legacy. Broker-backed modes use immutable workspace
@@ -16,7 +15,6 @@ const REMOTE_REPO = "/workspace/repo";
 const REMOTE_BUNDLE = "/tmp/impel-remote-repo.bundle";
 const SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
 const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/u;
-export const REMOTE_CONFIG_ROOT = `/home/agent/.config/${RUNTIME_BRAND.cli.configNamespace}`;
 
 function git(args, options = {}) {
   return runCapture(process.env.IMPEL_REMOTE_GIT_BIN || "git", args, options).stdout.trim();
@@ -192,16 +190,16 @@ export function uploadRemoteConfiguration(state, {
   const environmentFile = Object.entries(selectedEnvironment)
     .map(([name, value]) => `export ${name}=${shellQuote(value)}`)
     .join("\n") + "\n";
-  const profileRoot = `${REMOTE_CONFIG_ROOT}/cli/tenants/${tenant.tenantId}`;
+  const profileRoot = `/home/agent/.config/impel/cli/tenants/${tenant.tenantId}`;
   const claudeSettings = {
     permissions: { defaultMode: "bypassPermissions" },
     sandbox: { enabled: false },
   };
   const files = [
-    { path: `${REMOTE_CONFIG_ROOT}/config.json`, contents: `${JSON.stringify(remoteConfig, null, 2)}\n` },
-    { path: `${REMOTE_CONFIG_ROOT}/remote/env.sh`, contents: environmentFile },
+    { path: "/home/agent/.config/impel/config.json", contents: `${JSON.stringify(remoteConfig, null, 2)}\n` },
+    { path: "/home/agent/.config/impel/remote/env.sh", contents: environmentFile },
     {
-      path: `${REMOTE_CONFIG_ROOT}/remote/run.json`,
+      path: "/home/agent/.config/impel/remote/run.json",
       contents: `${JSON.stringify({
         runId: state.runId,
         credentialTokenId: credential.tokenId,
@@ -216,12 +214,12 @@ const path = require("node:path");
 const payload = JSON.parse(fs.readFileSync(0, "utf8"));
 for (const file of payload.files) {
   const target = path.resolve(file.path);
-  if (!target.startsWith(payload.root + "/")) throw new Error("refusing remote path");
+  if (!target.startsWith("/home/agent/.config/impel/")) throw new Error("refusing remote path");
   fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
   fs.writeFileSync(target, file.contents, { mode: 0o600 });
   fs.chmodSync(target, 0o600);
 }
-`, { files, root: REMOTE_CONFIG_ROOT });
+`, { files });
 }
 
 export function uploadRepository(state, repository) {
@@ -296,8 +294,8 @@ export function transferSessionCheckpoint(state, { provider, sessionId, tenantId
   const profiles = tenantCliProfilePaths(tenantId);
   const localRoot = provider === "claude" ? profiles.claudeConfigDir : profiles.codexHome;
   const remoteRoot = provider === "claude"
-    ? `${REMOTE_CONFIG_ROOT}/cli/tenants/${tenantId}/claude`
-    : `${REMOTE_CONFIG_ROOT}/cli/tenants/${tenantId}/codex`;
+    ? `/home/agent/.config/impel/cli/tenants/${tenantId}/claude`
+    : `/home/agent/.config/impel/cli/tenants/${tenantId}/codex`;
   const files = collectSessionFiles(localRoot, sessionId);
   if (files.length === 0) {
     throw new Error(`could not find ${provider} session ${sessionId} in the selected Impel CLI profile`);

package/src/runtimeBrand.js

@@ -14,48 +14,22 @@ const SUPPORTED_COMMANDS = new Set([
   "models", "agents", "update", "use", "experimental",
 ]);
 
-/**
- * The closed per-channel origin row (canary release cycle, KTD9).
- *
- * A brand names its channel and every default origin must be that channel's
- * row: a canary build pointed at production, or a stable build pointed at
- * dev, is rejected at validation. `channel` is absent from the shipped
- * source's third-party brands and defaults to `stable`, which constrains
- * nothing beyond "not the canary row" so embedders' own origins stay valid.
- * `scripts/bake-canary-brand.mjs` rewrites DEFAULT below to the canary row at
- * publish time; the literals there are what it substitutes.
- */
-export const CHANNEL_ORIGINS = Object.freeze({
-  stable: Object.freeze({
-    gateway: "https://gateway.useimpel.com",
-    sessions: "https://sessions.useimpel.com",
-    controlPlane: "https://www.useimpel.com",
-  }),
-  canary: Object.freeze({
-    gateway: "https://gateway.dev.useimpel.com",
-    sessions: "https://sessions.dev.useimpel.com",
-    controlPlane: "https://next.dev.useimpel.com",
-  }),
-});
-const CANARY_ORIGIN_SET = new Set(Object.values(CHANNEL_ORIGINS.canary));
-
 const DEFAULT = Object.freeze({
   schemaVersion: 1,
-  channel: "canary",
   product: Object.freeze({ id: "impel", displayName: "Impel" }),
   cli: Object.freeze({
     command: "impel",
     packageName: "impel-cli",
-    configNamespace: "impel-canary",
+    configNamespace: "impel",
     providerId: "impel",
     managedMarker: "impel-cli",
     environmentPrefix: "IMPEL",
   }),
   auth: Object.freeze({ patPrefix: "impel_pat_", tenantPrefix: "impel_tenant_" }),
   tenant: Object.freeze({ defaultId: null, displayName: null }),
-  gateway: Object.freeze({ defaultOrigin: "https://gateway.dev.useimpel.com" }),
-  sessions: Object.freeze({ defaultOrigin: "https://sessions.dev.useimpel.com" }),
-  controlPlane: Object.freeze({ defaultOrigin: "https://next.dev.useimpel.com" }),
+  gateway: Object.freeze({ defaultOrigin: "https://gateway.useimpel.com" }),
+  sessions: Object.freeze({ defaultOrigin: "https://sessions.useimpel.com" }),
+  controlPlane: Object.freeze({ defaultOrigin: "https://www.useimpel.com" }),
   updates: Object.freeze({ registry: null }),
   apps: Object.freeze({
     displayPrefix: "Impel",
@@ -100,32 +74,10 @@ function pathSegment(name, value) {
   return result;
 }
 
-function channel(value) {
-  if (value == null) return "stable";
-  if (value === "stable" || value === "canary") return value;
-  throw new Error("impel-cli runtime brand channel must be stable or canary");
-}
-
-/** Validate one default origin against the brand's channel row (R10). */
-function channelOrigin(name, value, brandChannel) {
-  const normalized = origin(name, value);
-  const column = name.split(".")[0];
-  if (brandChannel === "canary") {
-    const expected = CHANNEL_ORIGINS.canary[column];
-    if (normalized !== expected) {
-      throw new Error(`impel-cli runtime brand ${name} must be ${expected} on the canary channel`);
-    }
-  } else if (CANARY_ORIGIN_SET.has(normalized)) {
-    throw new Error(`impel-cli runtime brand ${name} is a canary origin; the stable channel must not carry it`);
-  }
-  return normalized;
-}
-
 export function validateRuntimeBrand(input) {
   if (!input || Array.isArray(input) || typeof input !== "object" || input.schemaVersion !== 1) {
     throw new Error("impel-cli runtime brand schemaVersion must be 1");
   }
-  const brandChannel = channel(input.channel);
   const command = text("cli.command", input.cli?.command, SAFE_ID);
   const packageName = text("cli.packageName", input.cli?.packageName || command, SAFE_PACKAGE);
   if (path.isAbsolute(packageName)) throw new Error("impel-cli runtime brand cli.packageName is invalid");
@@ -140,7 +92,6 @@ export function validateRuntimeBrand(input) {
   }
   return Object.freeze({
     schemaVersion: 1,
-    channel: brandChannel,
     product: Object.freeze({
       id: text("product.id", input.product?.id, SAFE_ID),
       displayName: text("product.displayName", input.product?.displayName),
@@ -161,15 +112,14 @@ export function validateRuntimeBrand(input) {
       defaultId: defaultTenant,
       displayName: input.tenant?.displayName == null ? defaultTenant : text("tenant.displayName", input.tenant.displayName),
     }),
-    gateway: Object.freeze({ defaultOrigin: channelOrigin("gateway.defaultOrigin", input.gateway?.defaultOrigin, brandChannel) }),
+    gateway: Object.freeze({ defaultOrigin: origin("gateway.defaultOrigin", input.gateway?.defaultOrigin) }),
     sessions: Object.freeze({
-      defaultOrigin: channelOrigin(
+      defaultOrigin: origin(
         "sessions.defaultOrigin",
         input.sessions?.defaultOrigin || input.gateway?.defaultOrigin,
-        brandChannel,
       ),
     }),
-    controlPlane: Object.freeze({ defaultOrigin: channelOrigin("controlPlane.defaultOrigin", input.controlPlane?.defaultOrigin, brandChannel) }),
+    controlPlane: Object.freeze({ defaultOrigin: origin("controlPlane.defaultOrigin", input.controlPlane?.defaultOrigin) }),
     updates: Object.freeze({
       registry: input.updates?.registry == null
         ? null
@@ -208,15 +158,6 @@ export function brandedEnvironmentName(suffix) {
   return `${RUNTIME_BRAND.cli.environmentPrefix}_${suffix}`;
 }
 
-/**
- * The line `--version` prints. Off the stable channel it names the channel so
- * a tester can tell a canary process from a stable one at a glance (R8); the
- * stable output is the bare version, byte-identical to before channels existed.
- */
-export function versionLine(version) {
-  return RUNTIME_BRAND.channel === "stable" ? String(version) : `${version} (${RUNTIME_BRAND.channel})`;
-}
-
 export function brandedText(value) {
   return String(value)
     .replaceAll("impel-cli", `${RUNTIME_BRAND.cli.command}-cli`)

package/src/sessionHooks.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import crypto from "node:crypto";
 import path from "node:path";
 
+import { escapeWindowsBareArgument } from "./nativeProcess.js";
 import { impelCliInvocation } from "./selfInvocation.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
@@ -146,12 +147,6 @@ function shellQuote(value) {
   return `'${String(value).replaceAll("'", `'"'"'`)}'`;
 }
 
-function powershellQuote(value) {
-  const text = String(value);
-  if (/[\r\n\0]/u.test(text)) throw new Error("cannot safely write this Windows hook command");
-  return `'${text.replaceAll("'", "''")}'`;
-}
-
 function canonicalize(value) {
   if (Array.isArray(value)) return value.map(canonicalize);
   if (!value || typeof value !== "object") return value;
@@ -214,11 +209,9 @@ export function ensureCodexSessionHooks(codexHome, tenantId, surface = "codex_cl
   const document = readJsonObject(hooksPath);
   const invocation = managedInvocation("codex", surface, tenantId);
   const unixCommand = [invocation.command, ...invocation.args].map(shellQuote).join(" ");
-  const windowsTokens = [invocation.command, ...invocation.args].map(powershellQuote).join(" ");
-  // Codex runs commandWindows through the session's normal Windows shell,
-  // which is PowerShell. A quoted executable is only invoked when prefixed by
-  // the call operator; cmd.exe's doubled outer-quote form is invalid here.
-  const windowsCommand = `& ${windowsTokens}`;
+  const windowsCommand = [invocation.command, ...invocation.args]
+    .map(escapeWindowsBareArgument)
+    .join(" ");
   const handler = {
     type: "command",
     command: unixCommand,