impel-cli 0.7.0

package/src/apps.js

@@ -0,0 +1,1263 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+  hardenManagedCodexToml,
+  secureAllManagedCodexHomes,
+  secureManagedCodexHome,
+} from "./codexSecurity.js";
+import { normalizeTenantId } from "./tenants.js";
+import { crossAppModelsEnabled, redactSecretText } from "./config.js";
+
+export const CLAUDE_CONFIG_ID = "1ced0000-0000-4000-8000-000000000001";
+const CHATGPT_CONFIG_START = "# >>> impel app managed gateway >>>";
+const CHATGPT_CONFIG_END = "# <<< impel app managed gateway <<<";
+const CLI_VERSION = JSON.parse(
+  fs.readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"),
+).version;
+const APP_DEFINITIONS = {
+  claude: {
+    label: "Impel Claude",
+    cask: "claude",
+    names: ["Claude.app"],
+    executableNames: ["Claude"],
+  },
+  chatgpt: {
+    label: "Impel ChatGPT",
+    cask: "codex-app",
+    names: ["ChatGPT.app", "Codex.app"],
+    executableNames: ["ChatGPT", "Codex"],
+  },
+};
+
+const STANDARD_REASONING_LEVELS = [
+  { effort: "low", description: "Fast responses with lighter reasoning" },
+  { effort: "medium", description: "Balances speed and reasoning depth for everyday tasks" },
+  { effort: "high", description: "Greater reasoning depth for complex problems" },
+  { effort: "xhigh", description: "Extra high reasoning depth for complex problems" },
+];
+const MAX_REASONING_LEVEL = { effort: "max", description: "Maximum reasoning depth for the hardest problems" };
+const ULTRA_REASONING_LEVEL = { effort: "ultra", description: "Maximum reasoning with automatic task delegation" };
+const FAST_SERVICE_TIER = { id: "priority", name: "Fast", description: "1.5x speed, increased usage" };
+const CLAUDE_PLAN_USAGE_GUARD = "if(!Ze().hasOrgPolicyBackend())return;if((r=fr())";
+const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `${"if(!wze())return;".padEnd("if(!Ze().hasOrgPolicyBackend())return;".length, " ")}if((r=fr())`;
+const CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch(`${ht()}/api/organizations/${o}/usage`,{signal:AbortSignal.timeout(mcr)})';
+const IMPEL_CLAUDE_PLAN_USAGE_REQUEST = 'P.net.fetch("https://gateway.useimpel.com/ui/a/u",{headers:{key:dR(Oe()).apiKey}})'.padEnd(CLAUDE_PLAN_USAGE_REQUEST.length, " ");
+
+export const FALLBACK_MODELS = [
+  { id: "claude-opus-4-8", provider: "claude", display_name: "Claude Opus 4.8", family: "opus", family_default: true, default: true, context_window: 200000 },
+  { id: "claude-sonnet-5", provider: "claude", display_name: "Claude Sonnet 5", family: "sonnet", family_default: true, context_window: 200000 },
+  { id: "claude-sonnet-4-6", provider: "claude", display_name: "Claude Sonnet 4.6", family: "sonnet", context_window: 200000 },
+  { id: "claude-haiku-4-5", provider: "claude", display_name: "Claude Haiku 4.5", family: "haiku", family_default: true, context_window: 200000 },
+  { id: "claude-fable-5", provider: "claude", display_name: "Claude Fable 5", family: "fable", family_default: true, context_window: 200000 },
+  { id: "gpt-5.6-sol", provider: "codex", display_name: "GPT-5.6-Sol", description: "Latest frontier agentic coding model.", default: true, priority: 1, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 372000, max_context_window: 372000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
+  { id: "gpt-5.6-terra", provider: "codex", display_name: "GPT-5.6-Terra", description: "Balanced agentic coding model for everyday work.", priority: 2, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL, ULTRA_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 372000, max_context_window: 372000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v2" },
+  { id: "gpt-5.6-luna", provider: "codex", display_name: "GPT-5.6-Luna", description: "Fast and affordable agentic coding model.", priority: 3, default_reasoning_level: "medium", supported_reasoning_levels: [...STANDARD_REASONING_LEVELS, MAX_REASONING_LEVEL], service_tiers: [FAST_SERVICE_TIER], context_window: 372000, max_context_window: 372000, use_responses_lite: true, tool_mode: "code_mode_only", multi_agent_version: "v1" },
+  { id: "gpt-5.5", provider: "codex", display_name: "GPT-5.5", description: "Frontier model for complex coding, research, and real-world work.", priority: 7, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+  { id: "gpt-5.4", provider: "codex", display_name: "GPT-5.4", description: "Strong model for everyday coding.", priority: 16, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [FAST_SERVICE_TIER], context_window: 272000, max_context_window: 1000000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+  { id: "gpt-5.4-mini", provider: "codex", display_name: "GPT-5.4-Mini", description: "Small, fast, and cost-efficient model for simpler coding tasks.", priority: 23, default_reasoning_level: "medium", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 272000, max_context_window: 272000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+  { id: "gpt-5.3-codex-spark", provider: "codex", display_name: "GPT-5.3-Codex-Spark", description: "Ultra-fast coding model.", priority: 26, default_reasoning_level: "high", supported_reasoning_levels: STANDARD_REASONING_LEVELS, service_tiers: [], context_window: 128000, max_context_window: 128000, use_responses_lite: false, tool_mode: null, multi_agent_version: null },
+];
+
+export function normalizeAppTarget(value) {
+  if (value == null || value === "all") return ["claude", "chatgpt"];
+  if (value === "codex") return ["chatgpt"];
+  if (value === "claude" || value === "chatgpt") return [value];
+  return null;
+}
+
+// Bump when the written config/manifest schema changes; a mismatch forces the
+// slow open path (and thus a full config rewrite) after a CLI update.
+export const CURRENT_CONFIG_VERSION = 8;
+
+/** Parse the tenant's install manifest, or null when absent/corrupt. */
+export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
+  try {
+    const manifest = JSON.parse(
+      fs.readFileSync(path.join(appPaths(homeDir, tenantId).tenantRoot, "manifest.json"), "utf8"),
+    );
+    return manifest && typeof manifest === "object" ? manifest : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Parse a vendored bundle's build record, or null when absent/corrupt. */
+export function readBundleCompatibility(launcher) {
+  try {
+    const compatibility = JSON.parse(
+      fs.readFileSync(path.join(launcher, "Contents", "Resources", "impel-compatibility.json"), "utf8"),
+    );
+    return compatibility && typeof compatibility === "object" ? compatibility : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A vendored bundle needs no rebuild when it was built by this CLI version
+ * from the vendor app version currently on disk. Rebuilds are the expensive
+ * part of install/open (bundle clone + asar patch + deep codesign), so this
+ * check is what makes repeat opens fast.
+ */
+export function bundleIsCurrent(status) {
+  if (!status.launcherInstalled || !status.vendorPath || !status.vendorVersion) return false;
+  const compatibility = readBundleCompatibility(status.launcher);
+  return Boolean(
+    compatibility
+    && compatibility.cliVersion === CLI_VERSION
+    && compatibility.vendorVersion === status.vendorVersion
+    && (status.target !== "chatgpt" || (
+      compatibility.vendorSignaturesPreserved === true
+      && compatibility.resourceRoot === "linked_vendor_resources"
+    )),
+  );
+}
+
+// Install/update must not run while the vendor or Impel-managed apps are open:
+// `brew` refuses to upgrade a running cask, and cloning/replacing a bundle
+// under a running instance produces broken copies and codesign failures.
+
+/** osascript application names whose bundles install/update will touch. */
+export function blockingAppNames(targets) {
+  const names = [];
+  for (const target of targets) {
+    const definition = APP_DEFINITIONS[target];
+    for (const bundleName of definition.names) names.push(bundleName.replace(/\.app$/u, ""));
+    names.push(definition.label);
+  }
+  return names;
+}
+
+/**
+ * pgrep/pkill -f pattern for one app's processes. Anchored on
+ * "/<Name>.app/Contents/MacOS/" so "Claude" never matches the space-prefixed
+ * "Impel Claude.app" path (and vice versa).
+ */
+export function appProcessPattern(name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return `/${escaped}\\.app/Contents/MacOS/`;
+}
+
+const QUIT_POLL_MS = 500;
+
+/**
+ * Closes every running app whose bundle the given targets will replace:
+ * graceful AppleScript quit first, SIGTERM if it lingers, and a hard error
+ * telling the user to close it themselves if even that fails.
+ */
+export async function quitBlockingApps(targets, {
+  log = console.log,
+  isRunning = (name) =>
+    spawnSync("/usr/bin/pgrep", ["-f", appProcessPattern(name)], { stdio: "ignore" }).status === 0,
+  requestQuit = (name) =>
+    // osascript `tell` would LAUNCH a non-running app, so callers must gate on
+    // isRunning first; the timeout covers apps stuck on a save/confirm dialog.
+    spawnSync("/usr/bin/osascript", ["-e", `tell application ${JSON.stringify(name)} to quit`], {
+      stdio: "ignore",
+      timeout: 8_000,
+    }),
+  forceQuit = (name) =>
+    spawnSync("/usr/bin/pkill", ["-f", appProcessPattern(name)], { stdio: "ignore" }),
+  wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  quitWaitMs = 10_000,
+  killWaitMs = 5_000,
+} = {}) {
+  async function goneWithin(name, budgetMs) {
+    for (let waited = 0; waited <= budgetMs; waited += QUIT_POLL_MS) {
+      if (!isRunning(name)) return true;
+      await wait(QUIT_POLL_MS);
+    }
+    return !isRunning(name);
+  }
+
+  for (const name of blockingAppNames(targets)) {
+    if (!isRunning(name)) continue;
+    log(`${name} is running; closing it before touching app bundles…`);
+    requestQuit(name);
+    if (await goneWithin(name, quitWaitMs)) continue;
+    log(`${name} did not quit gracefully; terminating it…`);
+    forceQuit(name);
+    if (await goneWithin(name, killWaitMs)) continue;
+    throw new Error(`${name} is still running; close it manually, then re-run`);
+  }
+}
+
+export function appPaths(homeDir = os.homedir(), tenantId = null, { claudeUserData = null } = {}) {
+  const root = process.env.IMPEL_APP_HOME || path.join(homeDir, ".config", "impel", "apps");
+  const tenantRoot = tenantId
+    ? path.join(root, "tenants", normalizeTenantId(tenantId))
+    : root;
+  return {
+    root,
+    tenantRoot,
+    tokenHelper: path.join(tenantRoot, "bin", "token"),
+    claude: {
+      root: claudeUserData || path.join(tenantRoot, "claude"),
+      userData: claudeUserData || path.join(tenantRoot, "claude", "user-data"),
+      launcher: path.join(homeDir, "Applications", "Impel Claude.app"),
+    },
+    chatgpt: {
+      root: path.join(tenantRoot, "chatgpt"),
+      codexHome: path.join(tenantRoot, "chatgpt", "codex-home"),
+      browserData: path.join(tenantRoot, "chatgpt", "browser-data"),
+      catalog: path.join(tenantRoot, "chatgpt", "codex-home", "models.json"),
+      launcher: path.join(homeDir, "Applications", "Impel ChatGPT.app"),
+    },
+  };
+}
+
+export async function fetchGatewayModels(config, fetchImpl = fetch) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 20000);
+  try {
+    const response = await fetchImpl(`${config.gatewayUrl}/v1/models`, {
+      headers: { authorization: `Bearer ${config.pat}` },
+      signal: controller.signal,
+    });
+    if (!response.ok) throw new Error(`HTTP ${response.status}`);
+    const payload = await response.json();
+    if (config.tenantId && payload?.org_id !== config.tenantId) {
+      throw new Error("gateway model catalog tenant did not match the selected tenant");
+    }
+    if (config.productAccess && payload?.product_access !== config.productAccess) {
+      throw new Error("gateway model catalog product access did not match the live entitlement");
+    }
+    if (!Array.isArray(payload?.data)) throw new Error("response has no model data array");
+    const models = payload.data.filter(isGatewayModel);
+    if (models.length === 0) throw new Error("gateway returned no supported models");
+    return { models, source: "gateway", version: payload.version ?? null };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+export function installManagedAppFiles({
+  config,
+  targets,
+  models,
+  homeDir = os.homedir(),
+  vendorPaths = {},
+  writeBundles = true,
+  writeTokenHelperFile = true,
+  claudeUserData = null,
+  chatgptInvocations = null,
+}) {
+  // true = rebuild every target's bundle; false = configs only; an array
+  // limits the expensive rebuild to just the stale targets.
+  const bundleTargets = new Set(writeBundles === true ? targets : writeBundles || []);
+  const paths = appPaths(homeDir, config.tenantId, { claudeUserData });
+  if (targets.includes("chatgpt")) secureAllManagedCodexHomes({ appsRoot: paths.root });
+  fs.mkdirSync(paths.tenantRoot, { recursive: true, mode: 0o700 });
+  if (writeTokenHelperFile) writeTokenHelper(paths.tokenHelper, config.tenantId);
+  const resolvedVendorPaths = Object.fromEntries(targets.map((target) => [
+    target,
+    vendorPaths[target] || findVendorApp(target, homeDir),
+  ]));
+  const vendorCodexModels = targets.includes("chatgpt")
+    ? readVendorCodexModels(resolvedVendorPaths.chatgpt)
+    : new Map();
+
+  const installed = [];
+  for (const target of targets) {
+    if (target === "claude") writeClaudeConfig(paths, config, models);
+    else writeChatGPTConfig(paths, config, models, vendorCodexModels, chatgptInvocations);
+    // Non-bundle targets are the background-refresh / fast-open path: configs,
+    // token helper, catalog, and manifest only. Bundle swaps require the app
+    // to be closed (see quitBlockingApps), so those paths never attempt one.
+    if (bundleTargets.has(target)) {
+      if (target === "chatgpt") writeVendoredChatGPTBundle(paths, resolvedVendorPaths.chatgpt, config.gatewayUrl);
+      else writeVendoredClaudeBundle(paths, resolvedVendorPaths.claude, config.gatewayUrl);
+    }
+    installed.push({ target, launcher: paths[target].launcher });
+  }
+
+  writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
+    schemaVersion: 3,
+    configVersion: CURRENT_CONFIG_VERSION,
+    modelCatalogVersion: 3,
+    gatewayUrl: config.gatewayUrl,
+    tenantId: config.tenantId,
+    experiments: { crossAppModels: crossAppModelsEnabled(config) },
+    targets,
+    models: models.map((model) => model.id),
+    updatedAt: new Date().toISOString(),
+  }, null, 2) + "\n", 0o600);
+  return installed;
+}
+
+function vendorSearchRoots(homeDir) {
+  return ["/Applications", path.join(homeDir, "Applications")];
+}
+
+export function readBundleIdentifier(appPath) {
+  const result = spawnSync(
+    "/usr/bin/plutil",
+    ["-extract", "CFBundleIdentifier", "raw", path.join(appPath, "Contents", "Info.plist")],
+    { encoding: "utf8" },
+  );
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+
+/**
+ * Only Electron-shaped bundles can be vendored — the clone gets asar patches —
+ * and app names genuinely collide: OpenAI's native ChatGPT *chat* app installs
+ * as ChatGPT.app, the same name older Codex desktop builds used. A candidate
+ * must carry the expected executable AND the Electron layout to count.
+ */
+export function isVendableVendorApp(target, appPath) {
+  const definition = APP_DEFINITIONS[target];
+  const hasExecutable = definition.executableNames.some((name) =>
+    fs.existsSync(path.join(appPath, "Contents", "MacOS", name)),
+  );
+  return (
+    hasExecutable
+    && fs.existsSync(path.join(appPath, "Contents", "Info.plist"))
+    && fs.existsSync(path.join(appPath, "Contents", "Resources", "app.asar"))
+  );
+}
+
+export function findVendorApp(target, homeDir = os.homedir(), { roots = vendorSearchRoots(homeDir) } = {}) {
+  const definition = APP_DEFINITIONS[target];
+  for (const base of roots) {
+    for (const name of definition.names) {
+      const candidate = path.join(base, name);
+      if (fs.existsSync(candidate) && isVendableVendorApp(target, candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
+/** Name-matched bundles that are NOT vendable — surfaced so "why was my app ignored?" is answerable. */
+export function rejectedVendorCandidates(target, homeDir = os.homedir(), { roots = vendorSearchRoots(homeDir) } = {}) {
+  const definition = APP_DEFINITIONS[target];
+  const rejected = [];
+  for (const base of roots) {
+    for (const name of definition.names) {
+      const candidate = path.join(base, name);
+      if (fs.existsSync(candidate) && !isVendableVendorApp(target, candidate)) {
+        rejected.push({ path: candidate, bundleId: readBundleIdentifier(candidate) });
+      }
+    }
+  }
+  return rejected;
+}
+
+export function ensureVendorApp(target, { homeDir = os.homedir(), update = false } = {}) {
+  const definition = APP_DEFINITIONS[target];
+  const current = findVendorApp(target, homeDir);
+  const brew = findCommand("brew");
+  if (!brew) return { path: current, action: current ? "existing" : "missing", note: "Homebrew is not installed" };
+
+  if (current && !update) return { path: current, action: "existing" };
+  if (current && update) {
+    const listed = spawnSync(brew, ["list", "--cask", definition.cask], { stdio: "ignore" });
+    if (listed.status !== 0) {
+      return { path: current, action: "existing", note: "vendor app is not Homebrew-managed; its built-in updater remains active" };
+    }
+    const upgraded = spawnSync(brew, ["upgrade", "--cask", definition.cask], { stdio: "inherit" });
+    return { path: findVendorApp(target, homeDir) || current, action: upgraded.status === 0 ? "updated" : "update-failed" };
+  }
+
+  // Name-collision transparency: e.g. OpenAI's native ChatGPT chat app
+  // (com.openai.chat) at /Applications/ChatGPT.app is NOT the Codex desktop
+  // app and cannot be vendored — say so instead of silently installing.
+  for (const candidate of rejectedVendorCandidates(target, homeDir)) {
+    console.log(
+      `${target}: ignoring ${candidate.path} (${candidate.bundleId || "unknown bundle id"}) — not a vendorable ${definition.label.replace("Impel ", "")} desktop app; installing the \`${definition.cask}\` cask instead`,
+    );
+  }
+  fs.mkdirSync(path.join(homeDir, "Applications"), { recursive: true });
+  const installed = spawnSync(brew, ["install", "--cask", `--appdir=${path.join(homeDir, "Applications")}`, definition.cask], { stdio: "inherit" });
+  return { path: findVendorApp(target, homeDir), action: installed.status === 0 ? "installed" : "install-failed" };
+}
+
+export function appStatus(targets, homeDir = os.homedir(), tenantId = null) {
+  const paths = appPaths(homeDir, tenantId);
+  return targets.map((target) => {
+    const vendorPath = findVendorApp(target, homeDir);
+    return {
+      target,
+      label: APP_DEFINITIONS[target].label,
+      launcher: paths[target].launcher,
+      launcherInstalled: fs.existsSync(paths[target].launcher),
+      vendorPath,
+      vendorVersion: vendorPath ? bundleVersion(vendorPath) : null,
+      configPath: target === "claude"
+        ? path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)
+        : path.join(paths.chatgpt.codexHome, "config.toml"),
+    };
+  });
+}
+
+export function removeManagedApps(targets, {
+  homeDir = os.homedir(),
+  keepData = false,
+  tenantId = null,
+  claudeUserData = null,
+} = {}) {
+  const paths = appPaths(homeDir, tenantId, { claudeUserData });
+  for (const target of targets) {
+    fs.rmSync(paths[target].launcher, { recursive: true, force: true });
+    if (!keepData) fs.rmSync(paths[target].root, { recursive: true, force: true });
+  }
+}
+
+function writeClaudeConfig(paths, config, models) {
+  const dir = path.join(paths.claude.userData, "configLibrary");
+  const experimental = crossAppModelsEnabled(config);
+  const claudeModels = experimental
+    ? projectClaudeDesktopModels(models)
+    : models.filter((model) => model.provider === "claude").map((model) => ({
+      name: model.id,
+      ...(model.family ? { anthropicFamilyTier: model.family } : {}),
+      ...(model.family_default ? { isFamilyDefault: true } : {}),
+    }));
+  const body = {
+    inferenceProvider: "gateway",
+    inferenceGatewayBaseUrl: experimental
+      ? `${config.gatewayUrl}/experimental/anthropic`
+      : `${config.gatewayUrl}/anthropic`,
+    inferenceGatewayApiKey: config.pat,
+    inferenceGatewayAuthScheme: "bearer",
+    modelDiscoveryEnabled: false,
+    inferenceModels: claudeModels,
+  };
+  writeAtomic(path.join(dir, `${CLAUDE_CONFIG_ID}.json`), JSON.stringify(body, null, 2) + "\n", 0o600);
+  writeAtomic(path.join(dir, "_meta.json"), JSON.stringify({
+    appliedId: CLAUDE_CONFIG_ID,
+    entries: [{ id: CLAUDE_CONFIG_ID, name: "Impel Gateway" }],
+  }, null, 2) + "\n", 0o600);
+}
+
+function writeChatGPTConfig(paths, config, models, vendorCodexModels, invocations = null) {
+  const experimental = crossAppModelsEnabled(config);
+  const orderedModels = experimental
+    ? [...models.filter((model) => model.provider === "codex"), ...models.filter((model) => model.provider === "claude")]
+    : models.filter((model) => model.provider === "codex");
+  const codexModels = orderedModels
+    .map((model, index) => model.provider === "codex"
+      ? codexCatalogEntry(model, index, vendorCodexModels.get(model.id))
+      : foreignClaudeCodexCatalogEntry(model, index))
+    .filter(Boolean);
+  const configPath = path.join(paths.chatgpt.codexHome, "config.toml");
+  secureManagedCodexHome(paths.chatgpt.codexHome);
+  const currentToml = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
+  const configuredModel = readTopLevelTomlString(currentToml, "model");
+  const defaultModelID = orderedModels.find((model) => model.provider === "codex" && model.default)?.id;
+  const selectedModel = codexModels.find((model) => model.slug === configuredModel)
+    || codexModels.find((model) => model.slug === defaultModelID)
+    || codexModels[0];
+  if (!selectedModel) throw new Error("no Codex models are available for Impel ChatGPT");
+  const configuredEffort = readTopLevelTomlString(currentToml, "model_reasoning_effort");
+  const supportedEfforts = Array.isArray(selectedModel.supported_reasoning_levels)
+    ? selectedModel.supported_reasoning_levels.map((level) => level.effort)
+    : [];
+  const selectedEffort = supportedEfforts.includes(configuredEffort)
+    ? configuredEffort
+    : (supportedEfforts.includes(selectedModel.default_reasoning_level)
+      ? selectedModel.default_reasoning_level
+      : (supportedEfforts[0] || null));
+  const configuredTier = readTopLevelTomlString(currentToml, "service_tier");
+  const supportedTiers = Array.isArray(selectedModel.service_tiers) ? selectedModel.service_tiers.map((tier) => tier.id) : [];
+  const selectedTier = supportedTiers.includes(configuredTier)
+    ? configuredTier
+    : (configuredTier === "fast" && supportedTiers.includes("priority") ? "priority" : null);
+  const catalog = {
+    fetched_at: new Date().toISOString(),
+    client_version: "impel-managed-2",
+    models: codexModels,
+  };
+  writeAtomic(paths.chatgpt.catalog, JSON.stringify(catalog, null, 2) + "\n", 0o600);
+  const auth = invocations?.auth || { command: paths.tokenHelper, args: null };
+  const mcp = invocations?.mcp || {
+    command: "impel",
+    args: config.tenantId ? ["mcp", "--tenant", config.tenantId] : ["mcp"],
+  };
+
+  const managedToml = [
+    CHATGPT_CONFIG_START,
+    "# Managed by `impel app update`. This profile is isolated from ~/.codex.",
+    `model = ${tomlString(selectedModel.slug)}`,
+    'model_provider = "impel"',
+    `chatgpt_base_url = ${tomlString(`${config.gatewayUrl}/chatgpt_passthrough/backend-api`)}`,
+    `model_catalog_json = ${tomlString(paths.chatgpt.catalog)}`,
+    ...(selectedEffort ? [`model_reasoning_effort = ${tomlString(selectedEffort)}`] : []),
+    ...(selectedTier ? [`service_tier = ${tomlString(selectedTier)}`] : []),
+    "",
+    // The built-in ChatGPT provider derives its inference endpoint from
+    // chatgpt.com even when chatgpt_base_url points at the gateway. Keep the
+    // native account client for status/usage, but route inference explicitly.
+    "[model_providers.impel]",
+    'name = "Impel Gateway"',
+    `base_url = ${tomlString(experimental
+      ? `${config.gatewayUrl}/experimental/openai/v1`
+      : `${config.gatewayUrl}/chatgpt_passthrough/backend-api/codex`)}`,
+    'wire_api = "responses"',
+    "supports_websockets = false",
+    "request_max_retries = 2",
+    "stream_max_retries = 2",
+    "stream_idle_timeout_ms = 600000",
+    "",
+    "[model_providers.impel.auth]",
+    `command = ${tomlString(auth.command)}`,
+    ...(Array.isArray(auth.args)
+      ? [`args = [${auth.args.map((argument) => tomlString(argument)).join(", ")}]`]
+      : []),
+    "timeout_ms = 5000",
+    "refresh_interval_ms = 300000",
+    "",
+    "[mcp_servers.impel]",
+    `command = ${tomlString(mcp.command)}`,
+    `args = [${mcp.args.map((argument) => tomlString(argument)).join(", ")}]`,
+    CHATGPT_CONFIG_END,
+  ].join("\n");
+  const mergedToml = mergeManagedChatGPTToml(currentToml, managedToml);
+  writeAtomic(configPath, hardenManagedCodexToml(mergedToml, configPath), 0o600);
+  secureManagedCodexHome(paths.chatgpt.codexHome);
+}
+
+export function projectClaudeDesktopModels(models) {
+  const ordered = [
+    ...models.filter((model) => model.provider === "claude"),
+    ...models.filter((model) => model.provider !== "claude"),
+  ];
+  return ordered.flatMap((model) => {
+    const capability = model.client_capabilities?.claude_desktop;
+    if (!capability || typeof capability.label !== "string" || capability.label.trim() === "") {
+      console.warn(`impel: omitting model ${redactSecretText(model.id)} from Impel Claude: missing verified desktop capabilities`);
+      return [];
+    }
+    return [{
+      name: model.id,
+      labelOverride: capability.label,
+      ...(typeof capability.anthropic_family_tier === "string" && capability.anthropic_family_tier
+        ? { anthropicFamilyTier: capability.anthropic_family_tier }
+        : {}),
+      ...(capability.family_default === true ? { isFamilyDefault: true } : {}),
+      ...(capability.supports_1m === true ? { supports1m: true } : {}),
+    }];
+  });
+}
+
+export function foreignClaudeCodexCatalogEntry(model, index) {
+  const capability = model.client_capabilities?.codex;
+  const levels = capability?.supported_reasoning_levels;
+  const tiers = capability?.service_tiers;
+  const modalities = capability?.input_modalities;
+  const valid = capability && typeof capability === "object"
+    && Number.isInteger(capability.context_window) && capability.context_window > 0
+    && Number.isInteger(capability.max_context_window) && capability.max_context_window >= capability.context_window
+    && Array.isArray(levels) && levels.every((level) => (
+      level && typeof level.effort === "string" && typeof level.description === "string"
+    ))
+    && Array.isArray(tiers) && tiers.every((tier) => (
+      tier && typeof tier.id === "string" && typeof tier.name === "string" && typeof tier.description === "string"
+    ))
+    && Array.isArray(modalities) && modalities.every((value) => typeof value === "string")
+    && ["supports_parallel_tool_calls", "supports_reasoning_summaries", "supports_verbosity", "supports_search_tool", "supports_image_detail_original"]
+      .every((key) => typeof capability[key] === "boolean")
+    && (capability.default_reasoning_level == null
+      || capability.default_reasoning_level === ""
+      || levels.some((level) => level.effort === capability.default_reasoning_level))
+    && (capability.apply_patch_tool_type == null || typeof capability.apply_patch_tool_type === "string")
+    && (capability.web_search_tool_type == null || typeof capability.web_search_tool_type === "string");
+  if (!valid) {
+    console.warn(`impel: omitting model ${redactSecretText(model.id)} from Impel ChatGPT: missing verified Codex capabilities`);
+    return null;
+  }
+  return {
+    slug: model.id,
+    display_name: model.display_name || model.id,
+    description: model.description || `Claude model available through the Impel gateway (${model.id}).`,
+    ...(capability.default_reasoning_level ? { default_reasoning_level: capability.default_reasoning_level } : {}),
+    supported_reasoning_levels: levels,
+    service_tiers: tiers,
+    shell_type: "shell_command",
+    visibility: "list",
+    supported_in_api: true,
+    priority: Number.isInteger(model.priority) ? model.priority : index + 1,
+    base_instructions: "You are an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
+    include_skills_usage_instructions: false,
+    supports_reasoning_summaries: capability.supports_reasoning_summaries,
+    support_verbosity: capability.supports_verbosity,
+    ...(capability.supports_reasoning_summaries ? { default_reasoning_summary: "none" } : {}),
+    ...(capability.supports_verbosity ? { default_verbosity: "low" } : {}),
+    ...(capability.apply_patch_tool_type ? { apply_patch_tool_type: capability.apply_patch_tool_type } : {}),
+    ...(capability.web_search_tool_type ? { web_search_tool_type: capability.web_search_tool_type } : {}),
+    truncation_policy: { mode: "tokens", limit: 10000 },
+    context_window: capability.context_window,
+    max_context_window: capability.max_context_window,
+    effective_context_window_percent: 95,
+    experimental_supported_tools: [],
+    input_modalities: modalities,
+    supports_parallel_tool_calls: capability.supports_parallel_tool_calls,
+    supports_image_detail_original: capability.supports_image_detail_original,
+    supports_search_tool: capability.supports_search_tool,
+    use_responses_lite: false,
+    tool_mode: null,
+    multi_agent_version: null,
+  };
+}
+
+function codexCatalogEntry(model, index, vendorModel) {
+  const generated = {
+    slug: model.id,
+    display_name: model.display_name || model.id,
+    description: `Available through the Impel gateway (${model.id}).`,
+    default_reasoning_level: "medium",
+    supported_reasoning_levels: STANDARD_REASONING_LEVELS,
+    shell_type: "shell_command",
+    visibility: "list",
+    supported_in_api: true,
+    priority: index + 1,
+    base_instructions: "You are Codex, an AI coding agent. Follow repository instructions, collaborate with the user, make scoped changes, and verify your work.",
+    include_skills_usage_instructions: false,
+    supports_reasoning_summaries: true,
+    default_reasoning_summary: "none",
+    support_verbosity: true,
+    default_verbosity: "low",
+    apply_patch_tool_type: "freeform",
+    web_search_tool_type: "text_and_image",
+    truncation_policy: { mode: "tokens", limit: 10000 },
+    context_window: model.context_window || 200000,
+    max_context_window: model.context_window || 200000,
+    effective_context_window_percent: 95,
+    experimental_supported_tools: [],
+    input_modalities: ["text", "image"],
+    supports_parallel_tool_calls: true,
+    supports_image_detail_original: true,
+    supports_search_tool: true,
+    use_responses_lite: false,
+    tool_mode: null,
+    multi_agent_version: null,
+  };
+  const entry = vendorModel ? { ...generated, ...vendorModel } : generated;
+  return {
+    ...entry,
+    slug: model.id,
+    display_name: model.display_name || entry.display_name || model.id,
+    description: model.description || entry.description,
+    default_reasoning_level: model.default_reasoning_level || entry.default_reasoning_level,
+    supported_reasoning_levels: Array.isArray(model.supported_reasoning_levels)
+      ? model.supported_reasoning_levels
+      : entry.supported_reasoning_levels,
+    service_tiers: Array.isArray(model.service_tiers) ? model.service_tiers : (entry.service_tiers || []),
+    visibility: "list",
+    supported_in_api: true,
+    priority: Number.isInteger(model.priority) ? model.priority : (entry.priority || index + 1),
+    context_window: model.context_window || entry.context_window || 200000,
+    max_context_window: model.max_context_window || entry.max_context_window || model.context_window || 200000,
+    ...(typeof model.use_responses_lite === "boolean" ? { use_responses_lite: model.use_responses_lite } : {}),
+    ...(Object.hasOwn(model, "tool_mode") ? { tool_mode: model.tool_mode } : {}),
+    ...(Object.hasOwn(model, "multi_agent_version") ? { multi_agent_version: model.multi_agent_version } : {}),
+  };
+}
+
+function readVendorCodexModels(vendorPath) {
+  const binary = vendorPath && path.join(vendorPath, "Contents", "Resources", "codex");
+  if (!binary || !fs.existsSync(binary)) return new Map();
+  const env = { ...process.env };
+  delete env.CODEX_HOME;
+  for (const args of [["debug", "models"], ["debug", "models", "--bundled"]]) {
+    const result = spawnSync(binary, args, { encoding: "utf8", env, maxBuffer: 20 * 1024 * 1024 });
+    if (result.status !== 0) continue;
+    try {
+      const payload = JSON.parse(result.stdout);
+      const models = Array.isArray(payload) ? payload : payload.models;
+      if (Array.isArray(models)) return new Map(models.map((model) => [model.slug, model]));
+    } catch {
+      // Fall through to the bundled catalog or the Impel-generated schema.
+    }
+  }
+  return new Map();
+}
+
+function mergeManagedChatGPTToml(current, managed) {
+  let remainder = current;
+  const start = current.indexOf(CHATGPT_CONFIG_START);
+  const end = current.indexOf(CHATGPT_CONFIG_END);
+  if (start !== -1 && end > start) {
+    remainder = current.slice(0, start) + current.slice(end + CHATGPT_CONFIG_END.length);
+  } else if (current.startsWith("# Managed by `impel app update`. This profile is isolated from ~/.codex.")) {
+    const legacyEnd = current.match(/refresh_interval_ms = \d+\r?\n/u);
+    if (legacyEnd?.index != null) remainder = current.slice(legacyEnd.index + legacyEnd[0].length);
+  }
+  remainder = remainder.replace(/^\s+/u, "");
+  return `${managed}\n${remainder ? `\n${remainder.replace(/\s*$/u, "")}\n` : ""}`;
+}
+
+function readTopLevelTomlString(toml, key) {
+  const topLevel = toml.split(/^\s*\[/mu, 1)[0];
+  const match = topLevel.match(new RegExp(`^\\s*${escapeRegex(key)}\\s*=\\s*("(?:[^"\\\\]|\\\\.)*")\\s*$`, "mu"));
+  if (!match) return null;
+  try {
+    return JSON.parse(match[1]);
+  } catch {
+    return null;
+  }
+}
+
+function writeTokenHelper(target, tenantId) {
+  const cliPath = fileURLToPath(new URL("../bin/impel.js", import.meta.url));
+  const node = shellQuote(process.execPath);
+  const cli = shellQuote(cliPath);
+  const tenantArgs = tenantId ? ` --tenant ${shellQuote(tenantId)}` : "";
+  // The apps invoke this helper whenever they need auth, which makes it the
+  // one hook that fires on Finder/Dock launches too. Piggyback a detached,
+  // TTL-gated config/catalog/skills refresh (`app refresh --stale-only`) so
+  // the managed apps keep themselves current without touching stdout — the
+  // caller consumes stdout as the token.
+  const script = `#!/bin/sh
+(${node} ${cli} app refresh --stale-only </dev/null >/dev/null 2>&1 &)
+exec ${node} ${cli} token${tenantArgs}
+`;
+  writeAtomic(target, script, 0o700);
+}
+
+function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl) {
+  if (!vendorPath) throw new Error("Claude vendor app is unavailable");
+  const executableName = APP_DEFINITIONS.claude.executableNames.find((name) => (
+    fs.existsSync(path.join(vendorPath, "Contents", "MacOS", name))
+  ));
+  if (!executableName) throw new Error(`Claude executable is missing from ${vendorPath}`);
+
+  const bundle = paths.claude.launcher;
+  const staging = `${bundle}.tmp-${process.pid}`;
+  fs.rmSync(staging, { recursive: true, force: true });
+  cloneAppBundle(vendorPath, staging);
+  try {
+    const plistPath = path.join(staging, "Contents", "Info.plist");
+    const asarPath = path.join(staging, "Contents", "Resources", "app.asar");
+    if (!fs.existsSync(plistPath) || !fs.existsSync(asarPath)) {
+      const bundleId = readBundleIdentifier(vendorPath);
+      throw new Error(
+        `unsupported Claude bundle layout in ${vendorPath}${bundleId ? ` (bundle id ${bundleId})` : ""}`,
+      );
+    }
+
+    const oldAsarHash = asarHeaderHash(asarPath);
+    let planUsageGuardPatchCount = 0;
+    let planUsageRequestPatchCount = 0;
+    if (claudeUsageCompatibilityEnabled(gatewayUrl)) {
+      planUsageGuardPatchCount = patchFixedWidthAsarString(
+        asarPath,
+        CLAUDE_PLAN_USAGE_GUARD,
+        IMPEL_CLAUDE_PLAN_USAGE_GUARD,
+        "Claude plan-usage eligibility guard",
+      );
+      planUsageRequestPatchCount = patchFixedWidthAsarString(
+        asarPath,
+        CLAUDE_PLAN_USAGE_REQUEST,
+        IMPEL_CLAUDE_PLAN_USAGE_REQUEST,
+        "Claude plan-usage gateway request",
+      );
+    }
+    const newAsarHash = asarHeaderHash(asarPath);
+
+    updateBundleIdentity(plistPath, {
+      displayName: "Impel Claude",
+      executable: executableName,
+      identifier: "com.useimpel.claude",
+      name: "Impel Claude",
+    });
+    updateAsarIntegrityPlist(plistPath, oldAsarHash, newAsarHash);
+    setPlistEnvironmentString(plistPath, "CLAUDE_USER_DATA_DIR", paths.claude.userData);
+    rebrandElectronHelpers(staging, {
+      fromName: "Claude",
+      toName: "Impel Claude",
+      fromIdentifier: "com.anthropic.claudefordesktop.helper",
+      toIdentifier: "com.useimpel.claude.helper",
+    });
+
+    const macos = path.join(staging, "Contents", "MacOS");
+    writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
+      schemaVersion: 1,
+      cliVersion: CLI_VERSION,
+      vendorVersion: bundleVersion(vendorPath),
+      sourceBundle: vendorPath,
+      bundleIdentifier: "com.useimpel.claude",
+      profileRoot: paths.claude.userData,
+      launchMode: "LSEnvironment",
+      patches: {
+        aggregatePlanUsageGuard: planUsageGuardPatchCount,
+        aggregatePlanUsageRequest: planUsageRequestPatchCount,
+      },
+      asarHeaderSha256: newAsarHash,
+    }, null, 2) + "\n", 0o644);
+
+    signVendoredApp(staging, path.join(macos, executableName), "Claude");
+    replaceDirectory(bundle, staging);
+  } catch (error) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function claudeUsageCompatibilityEnabled(gatewayUrl) {
+  try {
+    return new URL(gatewayUrl).origin === "https://gateway.useimpel.com";
+  } catch {
+    return false;
+  }
+}
+
+function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
+  if (!vendorPath) throw new Error("ChatGPT/Codex vendor app is unavailable");
+  const definition = APP_DEFINITIONS.chatgpt;
+  const executableName = definition.executableNames.find((name) => (
+    fs.existsSync(path.join(vendorPath, "Contents", "MacOS", name))
+  ));
+  if (!executableName) throw new Error(`ChatGPT/Codex executable is missing from ${vendorPath}`);
+
+  const bundle = paths.chatgpt.launcher;
+  const staging = `${bundle}.tmp-${process.pid}`;
+  const vendorBundleName = path.basename(vendorPath);
+  const vendorBundle = path.join(staging, "Contents", "Resources", vendorBundleName);
+  fs.rmSync(staging, { recursive: true, force: true });
+  cloneAppBundle(vendorPath, vendorBundle);
+  try {
+    const asarPath = path.join(vendorBundle, "Contents", "Resources", "app.asar");
+    const plistPath = path.join(vendorBundle, "Contents", "Info.plist");
+    if (!fs.existsSync(asarPath) || !fs.existsSync(plistPath)) {
+      const bundleId = readBundleIdentifier(vendorPath);
+      const hint = bundleId === "com.openai.chat"
+        ? " — this is OpenAI's ChatGPT chat app, not the Codex desktop app; install the desktop app with `brew install --cask codex-app` and re-run"
+        : bundleId
+          ? ` (bundle id ${bundleId})`
+          : "";
+      throw new Error(`unsupported ChatGPT/Codex bundle layout in ${vendorPath}${hint}`);
+    }
+
+    const asarHash = asarHeaderHash(asarPath);
+
+    const macos = path.join(staging, "Contents", "MacOS");
+    writeAtomic(path.join(staging, "Contents", "Info.plist"), vendoredChatGPTWrapperPlist(vendorPath), 0o644);
+    const vendorIcon = path.join(vendorBundle, "Contents", "Resources", "electron.icns");
+    if (fs.existsSync(vendorIcon)) {
+      fs.copyFileSync(vendorIcon, path.join(staging, "Contents", "Resources", "electron.icns"));
+    }
+    linkVendoredChatGPTResources(staging, vendorBundleName);
+    writeAtomic(
+      path.join(macos, "launch"),
+      vendoredChatGPTLauncher(paths, vendorBundleName, executableName, gatewayUrl),
+      0o755,
+    );
+    writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
+      schemaVersion: 1,
+      cliVersion: CLI_VERSION,
+      vendorVersion: bundleVersion(vendorPath),
+      sourceBundle: vendorPath,
+      patches: { fastModeForGatewayAuth: 0, desktopAPIForGatewayAuth: 0 },
+      vendorSignaturesPreserved: true,
+      resourceRoot: "linked_vendor_resources",
+      asarHeaderSha256: asarHash,
+    }, null, 2) + "\n", 0o644);
+
+    signVendoredApp(staging, path.join(vendorBundle, "Contents", "MacOS", executableName), "ChatGPT");
+    replaceDirectory(bundle, staging);
+  } catch (error) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function linkVendoredChatGPTResources(bundle, vendorBundleName) {
+  const outerResources = path.join(bundle, "Contents", "Resources");
+  const vendorResources = path.join(outerResources, vendorBundleName, "Contents", "Resources");
+  for (const entry of fs.readdirSync(vendorResources, { withFileTypes: true })) {
+    // The wrapper owns its icon and compatibility record. Every other vendor
+    // resource is exposed at the outer Electron resource root through a
+    // relative link, leaving the OpenAI-signed nested bundle untouched.
+    if (entry.name === "electron.icns") continue;
+    const target = path.join(vendorBundleName, "Contents", "Resources", entry.name);
+    fs.symlinkSync(target, path.join(outerResources, entry.name));
+  }
+}
+
+function patchFixedWidthAsarString(asarPath, original, replacement, label) {
+  if (Buffer.byteLength(original, "latin1") !== Buffer.byteLength(replacement, "latin1")) {
+    throw new Error(`${label} replacement must preserve the vendor ASAR byte length`);
+  }
+  const archive = fs.readFileSync(asarPath);
+  const metadata = readAsarMetadata(archive);
+  const source = archive.toString("latin1");
+  const patchOffsets = [];
+  for (let offset = source.indexOf(original); offset !== -1; offset = source.indexOf(original, offset + original.length)) {
+    patchOffsets.push(offset);
+  }
+  if (patchOffsets.length === 0) {
+    throw new Error(`this desktop app version has an unsupported ${label}; update impel-cli before installing it`);
+  }
+  const patchedArchive = Buffer.from(source.replaceAll(original, replacement), "latin1");
+  const entries = new Set(patchOffsets.map((offset) => findAsarEntry(metadata.header, metadata.dataOffset, offset)));
+  for (const entry of entries) updateAsarEntryIntegrity(patchedArchive, metadata.dataOffset, entry);
+  const header = Buffer.from(JSON.stringify(metadata.header));
+  if (header.length !== metadata.headerLength) {
+    throw new Error(`desktop app ASAR header changed size while applying the ${label} patch`);
+  }
+  header.copy(patchedArchive, 16);
+  fs.writeFileSync(asarPath, patchedArchive);
+  return patchOffsets.length;
+}
+
+function cloneAppBundle(source, destination) {
+  fs.mkdirSync(path.dirname(destination), { recursive: true });
+  if (process.platform === "darwin") {
+    const cloned = spawnSync("/bin/cp", ["-cR", source, destination], { encoding: "utf8" });
+    if (cloned.status === 0) return;
+    fs.rmSync(destination, { recursive: true, force: true });
+  }
+  fs.cpSync(source, destination, { recursive: true, dereference: false, preserveTimestamps: true });
+}
+
+function readAsarMetadata(archive) {
+  if (archive.length < 16) throw new Error("ChatGPT/Codex app.asar header is invalid");
+  const headerLength = archive.readUInt32LE(12);
+  const dataOffset = 8 + archive.readUInt32LE(4);
+  if (headerLength <= 0 || 16 + headerLength > dataOffset || dataOffset > archive.length) {
+    throw new Error("ChatGPT/Codex app.asar offsets are invalid");
+  }
+  let header;
+  try {
+    header = JSON.parse(archive.subarray(16, 16 + headerLength).toString("utf8"));
+  } catch {
+    throw new Error("ChatGPT/Codex app.asar header is not valid JSON");
+  }
+  return { dataOffset, header, headerLength };
+}
+
+function findAsarEntry(header, dataOffset, archiveOffset) {
+  const relativeOffset = archiveOffset - dataOffset;
+  let found = null;
+  const visit = (directory) => {
+    for (const entry of Object.values(directory?.files || {})) {
+      if (entry.files) visit(entry);
+      else if (entry.offset != null) {
+        const start = Number(entry.offset);
+        if (start <= relativeOffset && relativeOffset < start + Number(entry.size)) found = entry;
+      }
+    }
+  };
+  visit(header);
+  if (!found?.integrity) throw new Error("Fast-mode renderer asset has no supported ASAR integrity metadata");
+  return found;
+}
+
+function updateAsarEntryIntegrity(archive, dataOffset, entry) {
+  const start = dataOffset + Number(entry.offset);
+  const contents = archive.subarray(start, start + Number(entry.size));
+  const blockSize = Number(entry.integrity.blockSize);
+  if (entry.integrity.algorithm !== "SHA256" || !Number.isInteger(blockSize) || blockSize <= 0) {
+    throw new Error("Fast-mode renderer asset uses unsupported ASAR integrity settings");
+  }
+  entry.integrity.hash = sha256(contents);
+  entry.integrity.blocks = [];
+  for (let offset = 0; offset < contents.length; offset += blockSize) {
+    entry.integrity.blocks.push(sha256(contents.subarray(offset, offset + blockSize)));
+  }
+}
+
+function updateBundleIdentity(plistPath, identity) {
+  let plist = fs.readFileSync(plistPath, "utf8");
+  plist = replacePlistString(plist, "CFBundleDisplayName", identity.displayName);
+  plist = replacePlistString(plist, "CFBundleExecutable", identity.executable);
+  plist = replacePlistString(plist, "CFBundleIdentifier", identity.identifier);
+  plist = replacePlistString(plist, "CFBundleName", identity.name);
+  fs.writeFileSync(plistPath, plist, { mode: 0o644 });
+}
+
+function updateAsarIntegrityPlist(plistPath, oldAsarHash, newAsarHash) {
+  let plist = fs.readFileSync(plistPath, "utf8");
+  if (!plist.includes(oldAsarHash)) {
+    throw new Error("ChatGPT/Codex ASAR integrity metadata is missing or unsupported");
+  }
+  plist = plist.replace(oldAsarHash, newAsarHash);
+  fs.writeFileSync(plistPath, plist, { mode: 0o644 });
+}
+
+function replacePlistString(plist, key, value) {
+  const pattern = new RegExp(`(<key>${escapeRegex(key)}</key>\\s*<string>)[^<]*(</string>)`, "u");
+  if (!pattern.test(plist)) throw new Error(`vendored app Info.plist has no ${key}`);
+  return plist.replace(pattern, `$1${xmlEscape(value)}$2`);
+}
+
+function setPlistEnvironmentString(plistPath, key, value) {
+  let plist = fs.readFileSync(plistPath, "utf8");
+  const entry = `<key>${xmlEscape(key)}</key><string>${xmlEscape(value)}</string>`;
+  const existing = new RegExp(`<key>${escapeRegex(key)}</key>\\s*<string>[^<]*</string>`, "u");
+  if (existing.test(plist)) {
+    plist = plist.replace(existing, entry);
+  } else {
+    const environment = /(<key>LSEnvironment<\/key>\s*<dict>)/u;
+    if (environment.test(plist)) {
+      plist = plist.replace(environment, `$1${entry}`);
+    } else {
+      const closing = plist.lastIndexOf("</dict>");
+      if (closing === -1) throw new Error("vendored app Info.plist has no root dictionary");
+      plist = `${plist.slice(0, closing)}<key>LSEnvironment</key><dict>${entry}</dict>${plist.slice(closing)}`;
+    }
+  }
+  fs.writeFileSync(plistPath, plist, { mode: 0o644 });
+}
+
+function rebrandElectronHelpers(bundle, { fromName, toName, fromIdentifier, toIdentifier }) {
+  const frameworks = path.join(bundle, "Contents", "Frameworks");
+  if (!fs.existsSync(frameworks)) throw new Error("vendored app has no Electron helper bundles");
+  const helperPattern = new RegExp(`^${escapeRegex(fromName)} Helper(?: \\([^)]+\\))?\\.app$`, "u");
+  const helpers = fs.readdirSync(frameworks, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && helperPattern.test(entry.name));
+  if (helpers.length === 0) throw new Error("vendored app has no recognized Electron helper bundles");
+
+  for (const helper of helpers) {
+    const oldBundleName = helper.name.slice(0, -4);
+    const newBundleName = oldBundleName.replace(fromName, toName);
+    const oldBundle = path.join(frameworks, helper.name);
+    const plistPath = path.join(oldBundle, "Contents", "Info.plist");
+    const oldExecutable = path.join(oldBundle, "Contents", "MacOS", oldBundleName);
+    const newExecutable = path.join(oldBundle, "Contents", "MacOS", newBundleName);
+    if (!fs.existsSync(plistPath) || !fs.existsSync(oldExecutable)) {
+      throw new Error(`unsupported Electron helper layout in ${oldBundle}`);
+    }
+
+    let plist = fs.readFileSync(plistPath, "utf8");
+    plist = replacePlistString(plist, "CFBundleDisplayName", newBundleName);
+    plist = replacePlistString(plist, "CFBundleExecutable", newBundleName);
+    plist = replacePlistString(plist, "CFBundleIdentifier", toIdentifier);
+    plist = replacePlistString(
+      plist,
+      "CFBundleName",
+      oldBundleName === `${fromName} Helper` ? toName : newBundleName,
+    );
+    plist = plist.replaceAll(`msauth.${fromIdentifier}`, `msauth.${toIdentifier}`);
+    fs.writeFileSync(plistPath, plist, { mode: 0o644 });
+    fs.renameSync(oldExecutable, newExecutable);
+    fs.renameSync(oldBundle, path.join(frameworks, `${newBundleName}.app`));
+  }
+}
+
+function vendoredChatGPTWrapperPlist(vendorPath) {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>CFBundleDisplayName</key><string>Impel ChatGPT</string>
+<key>CFBundleExecutable</key><string>launch</string>
+<key>CFBundleIconFile</key><string>electron.icns</string>
+<key>CFBundleIdentifier</key><string>com.useimpel.chatgpt</string>
+<key>CFBundleName</key><string>Impel ChatGPT</string>
+<key>CFBundlePackageType</key><string>APPL</string>
+<key>CFBundleShortVersionString</key><string>${xmlEscape(bundleVersion(vendorPath) || "1")}</string>
+<key>LSMinimumSystemVersion</key><string>12.0</string>
+<key>NSHighResolutionCapable</key><true/>
+</dict></plist>
+`;
+}
+
+function vendoredChatGPTLauncher(paths, vendorBundleName, executableName, gatewayUrl) {
+  const codexAccountBaseUrl = `${gatewayUrl}/chatgpt_passthrough/backend-api`;
+  return `#!/bin/sh
+set -eu
+umask 077
+HERE=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+VENDOR_APP="$HERE/../Resources/"${shellQuote(vendorBundleName)}
+export CODEX_HOME=${shellQuote(paths.chatgpt.codexHome)}
+export CODEX_AUTHAPI_BASE_URL=${shellQuote(codexAccountBaseUrl)}
+unset CODEX_ACCESS_TOKEN CODEX_API_KEY OPENAI_API_KEY OPENAI_BASE_URL
+secure_codex_home() {
+  [ ! -L "$CODEX_HOME" ] || exit 1
+  mkdir -p "$CODEX_HOME"
+  chmod 700 "$CODEX_HOME"
+  rm -rf -- "$CODEX_HOME/shell_snapshots"
+  for FILE in "$CODEX_HOME/auth.json" "$CODEX_HOME/config.toml" "$CODEX_HOME/models.json"; do
+    [ ! -L "$FILE" ] || exit 1
+    [ ! -e "$FILE" ] || chmod 600 "$FILE"
+  done
+}
+secure_codex_home
+CODEX_BIN="$VENDOR_APP/Contents/Resources/codex"
+"$CODEX_BIN" features disable shell_snapshot >/dev/null 2>&1
+secure_codex_home
+TOKEN=$(${shellQuote(paths.tokenHelper)})
+[ -n "$TOKEN" ] || exit 1
+printf 'at-%s\\n' "$TOKEN" | "$CODEX_BIN" login --with-access-token >/dev/null 2>&1
+unset TOKEN
+secure_codex_home
+BROWSER_DATA=${shellQuote(paths.chatgpt.browserData)}
+mkdir -p "$BROWSER_DATA"
+# Electron resolves resources from the Impel wrapper when a nested app is
+# executed directly. The wrapper exposes the vendor resource tree there, so
+# app.asar and companion binaries resolve without LaunchServices handing the
+# process to the separately running, identically identified vendor app.
+exec "$VENDOR_APP/Contents/MacOS/${executableName}" --user-data-dir="$BROWSER_DATA" "$@"
+`;
+}
+
+function signVendoredApp(bundle, vendorExecutable, label) {
+  if (process.platform !== "darwin" || !isMachO(vendorExecutable)) return;
+  spawnSync("/usr/bin/xattr", ["-dr", "com.apple.quarantine", bundle], { stdio: "ignore" });
+  let signed = codesign(vendoredAppSigningArgs(bundle, label));
+  if (signed.status !== 0) throw new Error(`failed to sign vendored Impel ${label} app: ${signed.stderr.trim()}`);
+  if (label === "Claude") {
+    signed = signVendoredClaudeCapabilities(bundle);
+    if (signed.status !== 0) throw new Error(`failed to restore vendored Impel Claude capabilities: ${signed.stderr.trim()}`);
+  }
+  const verified = spawnSync("/usr/bin/codesign", ["--verify", "--deep", "--strict", bundle], { encoding: "utf8" });
+  if (verified.status !== 0) throw new Error(`vendored Impel ${label} signature verification failed: ${verified.stderr.trim()}`);
+}
+
+export function vendoredAppSigningArgs(bundle, label) {
+  // Browser control authenticates the ChatGPT process by OpenAI's code-signing
+  // identity. Deep ad-hoc signing replaces that identity on every nested code
+  // object, including Contents/MacOS/ChatGPT, so sign only the modified outer
+  // bundle and preserve the vendor signatures within it. Claude deliberately
+  // retains its separate deep-signing and entitlement-restoration flow below.
+  return label === "ChatGPT"
+    ? ["--force", "--sign", "-", bundle]
+    : ["--force", "--deep", "--sign", "-", bundle];
+}
+
+function signVendoredClaudeCapabilities(bundle) {
+  const fullEntitlements = entitlementPlist({
+    "com.apple.security.cs.allow-jit": true,
+    // Ad-hoc signatures have no common Apple Team ID, so hardened runtime
+    // otherwise refuses to map the app's separately signed Electron framework.
+    "com.apple.security.cs.disable-library-validation": true,
+    "com.apple.security.device.audio-input": true,
+    "com.apple.security.device.bluetooth": true,
+    "com.apple.security.device.camera": true,
+    "com.apple.security.device.print": true,
+    "com.apple.security.device.usb": true,
+    "com.apple.security.personal-information.location": true,
+    "com.apple.security.personal-information.photos-library": true,
+    "com.apple.security.virtualization": true,
+  });
+  const jitEntitlements = entitlementPlist({
+    "com.apple.security.cs.allow-jit": true,
+    "com.apple.security.cs.disable-library-validation": true,
+  });
+  const fullPath = path.join(os.tmpdir(), `impel-claude-entitlements-${process.pid}.plist`);
+  const jitPath = path.join(os.tmpdir(), `impel-claude-helper-entitlements-${process.pid}.plist`);
+  fs.writeFileSync(fullPath, fullEntitlements, { mode: 0o600 });
+  fs.writeFileSync(jitPath, jitEntitlements, { mode: 0o600 });
+  try {
+    const frameworks = path.join(bundle, "Contents", "Frameworks");
+    const helpers = fs.readdirSync(frameworks, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && /^Impel Claude Helper(?: \([^)]+\))?\.app$/u.test(entry.name));
+    for (const helper of helpers) {
+      const entitlements = helper.name === "Impel Claude Helper.app" ? fullPath : jitPath;
+      const result = codesign([
+        "--force", "--deep", "--options", "runtime", "--entitlements", entitlements, "--sign", "-",
+        path.join(frameworks, helper.name),
+      ]);
+      if (result.status !== 0) return result;
+    }
+    return codesign([
+      "--force", "--options", "runtime", "--entitlements", fullPath, "--sign", "-", bundle,
+    ]);
+  } finally {
+    fs.rmSync(fullPath, { force: true });
+    fs.rmSync(jitPath, { force: true });
+  }
+}
+
+function entitlementPlist(values) {
+  const entries = Object.entries(values).map(([key, value]) => (
+    `  <key>${xmlEscape(key)}</key>\n  <${value ? "true" : "false"}/>`
+  )).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+${entries}
+</dict></plist>
+`;
+}
+
+function codesign(args) {
+  return spawnSync("/usr/bin/codesign", args, { encoding: "utf8" });
+}
+
+function isMachO(file) {
+  const handle = fs.openSync(file, "r");
+  try {
+    const magic = Buffer.alloc(4);
+    if (fs.readSync(handle, magic, 0, 4, 0) !== 4) return false;
+    return ["cffaedfe", "feedfacf", "cafebabe", "bebafeca"].includes(magic.toString("hex"));
+  } finally {
+    fs.closeSync(handle);
+  }
+}
+
+function asarHeaderHash(file) {
+  const archive = fs.readFileSync(file);
+  const { headerLength } = readAsarMetadata(archive);
+  return sha256(archive.subarray(16, 16 + headerLength));
+}
+
+function sha256(contents) {
+  return crypto.createHash("sha256").update(contents).digest("hex");
+}
+
+function replaceDirectory(destination, staging) {
+  const backup = `${destination}.previous-${process.pid}`;
+  fs.rmSync(backup, { recursive: true, force: true });
+  if (fs.existsSync(destination)) fs.renameSync(destination, backup);
+  try {
+    fs.renameSync(staging, destination);
+    fs.rmSync(backup, { recursive: true, force: true });
+  } catch (error) {
+    if (!fs.existsSync(destination) && fs.existsSync(backup)) fs.renameSync(backup, destination);
+    throw error;
+  }
+}
+
+function isGatewayModel(model) {
+  return model && typeof model.id === "string" && (model.provider === "claude" || model.provider === "codex");
+}
+
+function writeAtomic(target, contents, mode) {
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+  if (fs.existsSync(target) && fs.readFileSync(target, "utf8") === contents) {
+    fs.chmodSync(target, mode);
+    return;
+  }
+  const tmp = `${target}.tmp-${process.pid}`;
+  fs.writeFileSync(tmp, contents, { mode });
+  fs.renameSync(tmp, target);
+  fs.chmodSync(target, mode);
+}
+
+function bundleVersion(bundle) {
+  const plistPath = path.join(bundle, "Contents", "Info.plist");
+  const result = spawnSync("/usr/bin/plutil", ["-extract", "CFBundleShortVersionString", "raw", plistPath], { encoding: "utf8" });
+  if (result.status === 0) return result.stdout.trim();
+  try {
+    const plist = fs.readFileSync(plistPath, "utf8");
+    return plist.match(/<key>CFBundleShortVersionString<\/key>\s*<string>([^<]+)<\/string>/u)?.[1] || null;
+  } catch {
+    return null;
+  }
+}
+
+function findCommand(command) {
+  const result = spawnSync("/usr/bin/which", [command], { encoding: "utf8" });
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'"'"'`)}'`;
+}
+
+function escapeRegex(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+function tomlString(value) {
+  return JSON.stringify(String(value));
+}
+
+function xmlEscape(value) {
+  return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}