impel-cli 0.20.63 → 0.20.64

package/RELEASE_NOTES.md

@@ -1,5 +1,18 @@
 # Release notes
 
+## 0.20.64 — Windows cmd-compatible Codex hooks; rebuilt managed macOS package
+
+- Emits managed Codex hooks with cmd-compatible quoting on Windows. Codex's
+  Windows hook runner passes `commandWindows` to cmd.exe as one raw command
+  line, so the PowerShell call syntax used before failed every Windows hook
+  even though the same command worked on macOS. Bumps the managed config
+  contract to 49 so existing Windows profiles are rewritten.
+- New version so the managed macOS `Impel-CLI` package can be reissued and
+  reinstalled by Munki. The 0.20.63 package published with release 0.1.134 was
+  re-signed without the Node runtime's JIT entitlements and its bundled Node
+  aborts at startup; the impel-apps builders now restore those entitlements,
+  but Munki only replaces the package when its version increases.
+
 ## 0.20.63 — Route isolated Codex through the typed gateway surface
 
 - Moves the `impel codex` and `impel use gateway codex` model provider from the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.63",
+  "version": "0.20.64",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/managedProfileVersion.js

@@ -17,9 +17,6 @@
 // v47 persists `features.apps = false` in the managed ChatGPT desktop profile
 // so the hosted codex_apps connector stops handshaking against the gateway
 // without a credential (the same gate 0.20.61 passed to CLI sessions).
-// v48 moves the isolated CLI Codex provider from the raw
-// `/chatgpt_passthrough/backend-api/codex` route (Codex-native models only) to
-// the typed `/openai/v1` route the managed ChatGPT desktop profile uses, and
-// pins `supports_websockets = false` so Codex stops retrying a wss://
-// handshake the gateway refuses before every HTTPS turn.
-export const CURRENT_CONFIG_VERSION = 48;
+// v49 rewrites Codex `commandWindows` from PowerShell syntax to the
+// `cmd.exe` syntax required by Codex's hook runner.
+export const CURRENT_CONFIG_VERSION = 49;

package/src/sessionHooks.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import crypto from "node:crypto";
 import path from "node:path";
 
+import { escapeWindowsBareArgument } from "./nativeProcess.js";
 import { impelCliInvocation } from "./selfInvocation.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
@@ -146,12 +147,6 @@ function shellQuote(value) {
   return `'${String(value).replaceAll("'", `'"'"'`)}'`;
 }
 
-function powershellQuote(value) {
-  const text = String(value);
-  if (/[\r\n\0]/u.test(text)) throw new Error("cannot safely write this Windows hook command");
-  return `'${text.replaceAll("'", "''")}'`;
-}
-
 function canonicalize(value) {
   if (Array.isArray(value)) return value.map(canonicalize);
   if (!value || typeof value !== "object") return value;
@@ -214,11 +209,9 @@ export function ensureCodexSessionHooks(codexHome, tenantId, surface = "codex_cl
   const document = readJsonObject(hooksPath);
   const invocation = managedInvocation("codex", surface, tenantId);
   const unixCommand = [invocation.command, ...invocation.args].map(shellQuote).join(" ");
-  const windowsTokens = [invocation.command, ...invocation.args].map(powershellQuote).join(" ");
-  // Codex runs commandWindows through the session's normal Windows shell,
-  // which is PowerShell. A quoted executable is only invoked when prefixed by
-  // the call operator; cmd.exe's doubled outer-quote form is invalid here.
-  const windowsCommand = `& ${windowsTokens}`;
+  const windowsCommand = [invocation.command, ...invocation.args]
+    .map(escapeWindowsBareArgument)
+    .join(" ");
   const handler = {
     type: "command",
     command: unixCommand,