impel-cli 0.7.0

package/src/commands/apps.js

@@ -0,0 +1,538 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { parseFlags } from "../args.js";
+import {
+  loadConfig,
+  crossAppModelsEnabled,
+  normalizeGatewayUrl,
+  redactSecretText,
+  resolveDefaultGateway,
+} from "../config.js";
+import {
+  maybePrintUpdateNotice,
+  refreshUpdateCache,
+  spawnDetachedAppRefresh,
+} from "../updates.js";
+import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
+import {
+  CURRENT_CONFIG_VERSION,
+  CLAUDE_CONFIG_ID,
+  appPaths,
+  appStatus,
+  bundleIsCurrent,
+  ensureVendorApp,
+  fetchGatewayModels,
+  installManagedAppFiles,
+  normalizeAppTarget,
+  quitBlockingApps,
+  readTenantManifest,
+  removeManagedApps,
+} from "../apps.js";
+import { resolveSkillsGateway, syncSkillsSafe } from "../skills.js";
+import { secureManagedCodexHome } from "../codexSecurity.js";
+import { impelCliInvocation } from "../selfInvocation.js";
+import {
+  ensureWindowsClaudeApp,
+  ensureWindowsChatGPTApp,
+  findWindowsClaudeApp,
+  findWindowsChatGPTApp,
+  findManagedWindowsChatGPTApp,
+  launchWindowsClaudeApp,
+  launchWindowsChatGPTApp,
+  removeManagedWindowsChatGPTApp,
+  stageWindowsChatGPTApp,
+  windowsChatGPTStageIsCurrent,
+  windowsClaudeUserData,
+} from "../windowsApps.js";
+
+// Each isolated desktop app maps to a client CLI + the env override that points
+// that CLI at the app's private profile, so skill syncing lands in the app's
+// installation rather than a global one.
+function appSkillTarget(target, paths) {
+  if (target === "claude") {
+    return { client: "claude", env: { CLAUDE_CONFIG_DIR: paths.claude.userData }, label: "Impel Claude app" };
+  }
+  return { client: "codex", env: { CODEX_HOME: paths.chatgpt.codexHome }, label: "Impel ChatGPT app" };
+}
+
+function windowsAppTargets(targetToken) {
+  if (targetToken === undefined || targetToken === "all") return ["claude", "chatgpt"];
+  if (targetToken === "claude") return ["claude"];
+  if (targetToken === "chatgpt" || targetToken === "codex") return ["chatgpt"];
+  return null;
+}
+
+function windowsProcessFailure(result) {
+  if (result?.error?.message) return redactSecretText(result.error.message);
+  if (Number.isInteger(result?.status)) return `exit code ${result.status}`;
+  if (result?.signal) return `signal ${result.signal}`;
+  return "no exit status";
+}
+
+async function fetchWindowsCatalog(config, io) {
+  try {
+    return await io.fetchModels(config);
+  } catch (error) {
+    throw new Error(`tenant model catalog is unavailable (${redactSecretText(error.message)}); the Impel app profiles were not changed`);
+  }
+}
+
+function configureWindowsApps(config, targets, vendorPaths, catalog, io) {
+  const userData = io.claudeUserData(io.environment, config.tenantId);
+  const auth = impelCliInvocation(["token", "--tenant", config.tenantId]);
+  const mcp = impelCliInvocation(["mcp", "--tenant", config.tenantId]);
+  io.installFiles({
+    config,
+    targets,
+    models: catalog.models,
+    homeDir: io.homeDir,
+    vendorPaths,
+    writeBundles: false,
+    writeTokenHelperFile: false,
+    claudeUserData: userData,
+    chatgptInvocations: { auth, mcp },
+  });
+  return { catalog, userData };
+}
+
+export async function cmdWindowsApps(argv, overrides = {}) {
+  const [action = "status", rawTarget, ...rest] = argv;
+  const targetToken = rawTarget?.startsWith("--") ? undefined : rawTarget;
+  const targets = windowsAppTargets(targetToken);
+  if (!targets) {
+    console.error(`impel app: unknown app target "${targetToken}"; use claude, chatgpt, codex, or all.`);
+    process.exitCode = 1;
+    return false;
+  }
+  const flagArgs = rawTarget?.startsWith("--") ? [rawTarget, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, {
+    "skip-vendor": { type: "boolean" },
+    "keep-data": { type: "boolean" },
+    "stale-only": { type: "boolean" },
+  });
+  const io = {
+    environment: process.env,
+    homeDir: os.homedir(),
+    findClaudeApp: findWindowsClaudeApp,
+    ensureClaudeApp: ensureWindowsClaudeApp,
+    launchClaudeApp: launchWindowsClaudeApp,
+    claudeUserData: windowsClaudeUserData,
+    findChatGPTApp: findWindowsChatGPTApp,
+    ensureChatGPTApp: ensureWindowsChatGPTApp,
+    findManagedChatGPTApp: findManagedWindowsChatGPTApp,
+    launchChatGPTApp: launchWindowsChatGPTApp,
+    removeManagedChatGPTApp: removeManagedWindowsChatGPTApp,
+    stageChatGPTApp: stageWindowsChatGPTApp,
+    chatGPTStageIsCurrent: windowsChatGPTStageIsCurrent,
+    fetchModels: fetchGatewayModels,
+    installFiles: installManagedAppFiles,
+    removeApps: removeManagedApps,
+    syncSkills: syncSkillsSafe,
+    selectedConfig: selectedAppConfig,
+    ...overrides,
+  };
+  // Preserve the original Windows-Claude override names used by embedders and
+  // tests while exposing explicit per-app hooks for the new second target.
+  if (overrides.findApp) io.findClaudeApp = overrides.findApp;
+  if (overrides.ensureApp) io.ensureClaudeApp = overrides.ensureApp;
+  if (overrides.launchApp) io.launchClaudeApp = overrides.launchApp;
+  if (overrides.userData) io.claudeUserData = overrides.userData;
+  const stored = loadConfig();
+  const storedUserData = io.claudeUserData(io.environment, stored?.tenantId || null);
+  const paths = appPaths(io.homeDir, stored?.tenantId || null, { claudeUserData: storedUserData });
+  const claudeConfigPath = path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`);
+  const chatgptConfigPath = path.join(paths.chatgpt.codexHome, "config.toml");
+
+  if (action === "status") {
+    console.log(`Tenant: ${stored?.tenantId || "not selected"}`);
+    if (targets.includes("claude")) {
+      console.log("Impel Claude:");
+      console.log(`  profile: ${fs.existsSync(claudeConfigPath) ? paths.claude.userData : "not installed"}`);
+      console.log(`  vendor:  ${io.findClaudeApp(io.environment) || "not installed"}`);
+      console.log("  open:    impel app open claude");
+    }
+    if (targets.includes("chatgpt")) {
+      console.log("Impel ChatGPT:");
+      console.log(`  profile: ${fs.existsSync(chatgptConfigPath) ? paths.chatgpt.root : "not installed"}`);
+      console.log(`  vendor:  ${io.findChatGPTApp(io.environment) || "not installed"}`);
+      console.log(`  staged:  ${io.findManagedChatGPTApp(paths.root) || "not installed"}`);
+      console.log("  open:    impel app open codex");
+    }
+    return true;
+  }
+
+  if (action === "uninstall") {
+    io.removeApps(targets, {
+      homeDir: io.homeDir,
+      keepData: Boolean(flags["keep-data"]),
+      tenantId: stored?.tenantId || null,
+      claudeUserData: storedUserData,
+    });
+    if (targets.includes("chatgpt")) io.removeManagedChatGPTApp(paths.root);
+    for (const target of targets) {
+      const label = target === "claude" ? "Claude" : "ChatGPT";
+      console.log(`Removed Impel ${label} profile${flags["keep-data"] ? " data was retained" : " and isolated data"}.`);
+    }
+    return true;
+  }
+
+  if (!["install", "update", "refresh", "open"].includes(action)) {
+    console.error(`impel app: unknown app action "${action}"; use install, update, refresh, status, open, or uninstall.`);
+    process.exitCode = 1;
+    return false;
+  }
+
+  try {
+    if (action === "open") maybePrintUpdateNotice();
+    const config = await io.selectedConfig(targets);
+    const actionUserData = io.claudeUserData(io.environment, config.tenantId);
+    const actionPaths = appPaths(io.homeDir, config.tenantId, { claudeUserData: actionUserData });
+    const vendorPaths = {};
+    for (const target of targets) {
+      const isClaude = target === "claude";
+      const find = isClaude ? io.findClaudeApp : io.findChatGPTApp;
+      const ensure = isClaude ? io.ensureClaudeApp : io.ensureChatGPTApp;
+      let binary = find(io.environment);
+      if ((action === "install" || action === "update") && !flags["skip-vendor"]) {
+        const vendor = ensure({ update: action === "update" }, { environment: io.environment });
+        binary = vendor.binary;
+        console.log(`${target}: vendor app ${vendor.action}`);
+        if (!binary) {
+          const label = isClaude ? "Claude" : "ChatGPT/Codex";
+          const url = isClaude ? "https://claude.com/download" : "https://apps.microsoft.com/detail/9plm9xgg6vks";
+          throw new Error(
+            `${label} vendor installation failed (${windowsProcessFailure(vendor.result)}); install it from ${url}, then re-run`,
+          );
+        }
+      }
+      if (binary) vendorPaths[target] = binary;
+    }
+
+    if (targets.includes("claude") && action !== "refresh" && !vendorPaths.claude) {
+      throw new Error("Claude vendor app is unavailable; run `impel app install claude` or install it from https://claude.com/download");
+    }
+    const catalog = await fetchWindowsCatalog(config, io);
+    let managedChatGPT = targets.includes("chatgpt")
+      ? io.findManagedChatGPTApp(actionPaths.root)
+      : null;
+    const mustStageChatGPT = targets.includes("chatgpt")
+      && (action === "install"
+        || action === "update"
+        || (action === "open" && (!managedChatGPT
+          || (vendorPaths.chatgpt && !io.chatGPTStageIsCurrent(vendorPaths.chatgpt, actionPaths.root)))));
+    if (mustStageChatGPT) {
+      if (!vendorPaths.chatgpt) {
+        throw new Error("ChatGPT/Codex vendor app is unavailable; run `impel app install codex` or install it from https://apps.microsoft.com/detail/9plm9xgg6vks");
+      }
+      managedChatGPT = io.stageChatGPTApp(vendorPaths.chatgpt, actionPaths.root);
+    }
+
+    const { userData } = configureWindowsApps(config, targets, vendorPaths, catalog, io);
+    const tenantPaths = appPaths(io.homeDir, config.tenantId, { claudeUserData: userData });
+    if (action === "install" || action === "update" || action === "refresh") {
+      const verb = action === "install" ? "Installed" : action === "update" ? "Updated" : "Refreshed";
+      for (const target of targets) {
+        const profile = target === "claude" ? tenantPaths.claude.userData : tenantPaths.chatgpt.root;
+        console.log(`${verb} Impel ${target === "claude" ? "Claude" : "ChatGPT"} profile at ${profile}`);
+        const { client, env, label } = appSkillTarget(target, tenantPaths);
+        await io.syncSkills({ client, gatewayUrl: resolveSkillsGateway(config.gatewayUrl), env, label });
+        if (target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
+      }
+      console.log(`Models: ${catalog.models.length} from ${catalog.source}. The signed vendor apps and their normal profiles were not changed.`);
+    }
+    if (action === "open") {
+      if (targets.includes("claude")) {
+        await io.launchClaudeApp(vendorPaths.claude, tenantPaths.claude.userData, { environment: io.environment });
+        console.log("Opened Impel Claude with its tenant-isolated Windows profile.");
+      }
+      if (targets.includes("chatgpt")) {
+        managedChatGPT ||= io.findManagedChatGPTApp(tenantPaths.root);
+        if (!managedChatGPT) throw new Error("Impel ChatGPT is not staged; run `impel app install codex`");
+        await io.launchChatGPTApp(managedChatGPT, {
+          browserData: tenantPaths.chatgpt.browserData,
+          codexHome: tenantPaths.chatgpt.codexHome,
+          credential: config.pat,
+          gatewayUrl: config.gatewayUrl,
+        }, { environment: io.environment });
+        console.log("Opened Impel ChatGPT with its tenant-isolated Windows profile.");
+      }
+    }
+    return true;
+  } catch (error) {
+    console.error(`impel app: ${redactSecretText(error?.message || error)}`);
+    process.exitCode = 1;
+    return false;
+  }
+}
+
+export async function cmdApps(argv, overrides = {}) {
+  if (process.platform === "win32") return cmdWindowsApps(argv, overrides);
+  if (process.platform !== "darwin") {
+    console.error("impel app: isolated Impel desktop apps are unavailable on this platform.");
+    process.exitCode = 1;
+    return;
+  }
+  const [action = "status", targetToken, ...rest] = argv;
+  const targets = normalizeAppTarget(targetToken?.startsWith("--") ? undefined : targetToken);
+  if (!targets) throw new Error(`unknown app target "${targetToken}"; use claude, chatgpt, codex, or all`);
+  const flagArgs = targetToken?.startsWith("--") ? [targetToken, ...rest] : rest;
+  const { flags } = parseFlags(flagArgs, {
+    "skip-vendor": { type: "boolean" },
+    "keep-data": { type: "boolean" },
+    "stale-only": { type: "boolean" },
+  });
+
+  if (action === "status") return printStatus(targets);
+  if (action === "refresh") {
+    return refreshApps(targets, { staleOnly: Boolean(flags["stale-only"]) });
+  }
+  if (action === "uninstall") {
+    const config = loadConfig();
+    removeManagedApps(targets, {
+      keepData: Boolean(flags["keep-data"]),
+      tenantId: config?.tenantId || null,
+    });
+    for (const target of targets) console.log(`Removed Impel ${target} app${flags["keep-data"] ? " (kept isolated data)" : " and isolated data"}.`);
+    return;
+  }
+  if (action === "open") {
+    maybePrintUpdateNotice();
+    // Fast path: when the bundles were built by this CLI from the on-disk
+    // vendor versions and the written configs still match the stored
+    // credentials, there is nothing to fetch or rebuild — launch immediately
+    // and let a detached stale-only refresh keep configs/catalog/skills
+    // converging in the background.
+    const fastLaunchers = fastOpenLaunchers(targets);
+    if (fastLaunchers) {
+      spawnDetachedAppRefresh();
+      for (const launcher of fastLaunchers) {
+        spawnSync("/usr/bin/open", ["-n", launcher], { stdio: "inherit" });
+      }
+      return;
+    }
+
+    const config = await selectedAppConfig(targets);
+    const statuses = appStatus(targets, os.homedir(), config.tenantId);
+    for (const status of statuses) {
+      if (!status.launcherInstalled) throw new Error(`${status.label} is not installed; run \`impel app install ${status.target}\``);
+      if (!status.vendorPath) throw new Error(`${status.label} vendor app is unavailable; reinstall the vendor app first`);
+    }
+    let catalog;
+    try {
+      catalog = await fetchGatewayModels(config);
+    } catch (error) {
+      throw new Error(
+        `tenant model catalog is unavailable (${redactSecretText(error.message)}); the selected tenant app was not opened`,
+      );
+    }
+    // Only stale bundles pay the clone + codesign rebuild; a bundle swap needs
+    // its app closed, and quitting is fine here since we relaunch right after.
+    const staleBundleTargets = statuses
+      .filter((status) => !bundleIsCurrent(status))
+      .map((status) => status.target);
+    if (staleBundleTargets.length > 0) await quitBlockingApps(staleBundleTargets);
+    installManagedAppFiles({
+      config,
+      targets,
+      models: catalog.models,
+      homeDir: os.homedir(),
+      vendorPaths: Object.fromEntries(statuses.map((status) => [status.target, status.vendorPath])),
+      writeBundles: staleBundleTargets,
+    });
+    for (const status of appStatus(targets, os.homedir(), config.tenantId)) {
+      spawnSync("/usr/bin/open", ["-n", status.launcher], { stdio: "inherit" });
+    }
+    return;
+  }
+  if (action !== "install" && action !== "update") {
+    throw new Error(`unknown app action "${action}"; use install, update, refresh, status, open, or uninstall`);
+  }
+
+  const config = await selectedAppConfig(targets);
+
+  // A running vendor or Impel app makes the cask upgrade / bundle swap fail.
+  await quitBlockingApps(targets);
+
+  const vendorPaths = {};
+  if (!flags["skip-vendor"]) {
+    for (const target of targets) {
+      // Always bring the vendor (system) app to the latest version before
+      // cloning it into the vendored Impel bundle, so install and update both
+      // start from a current copy. A failed upgrade keeps the existing app.
+      const result = ensureVendorApp(target, { update: true });
+      vendorPaths[target] = result.path;
+      console.log(`${target}: vendor app ${result.action}${result.note ? ` (${result.note})` : ""}`);
+      if (!result.path) throw new Error(`${target} vendor app is unavailable; install it manually or fix Homebrew, then re-run`);
+    }
+  }
+
+  let catalog;
+  try {
+    catalog = await fetchGatewayModels(config);
+  } catch (error) {
+    throw new Error(
+      `tenant model catalog is unavailable (${redactSecretText(error.message)}); no Impel app files were changed`,
+    );
+  }
+  const installed = installManagedAppFiles({ config, targets, models: catalog.models, homeDir: os.homedir(), vendorPaths });
+  for (const item of installed) console.log(`${action === "install" ? "Installed" : "Updated"} ${item.launcher}`);
+  console.log(`Models: ${catalog.models.length} from ${catalog.source}. Normal ~/.claude and ~/.codex profiles were not changed.`);
+
+  // Best-effort: sync the Bifrost shared skills into each installed isolated app
+  // profile. Never fails the install/update.
+  const paths = appPaths(os.homedir(), config.tenantId);
+  const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
+  for (const item of installed) {
+    const { client, env, label } = appSkillTarget(item.target, paths);
+    await syncSkillsSafe({ client, gatewayUrl, env, label });
+    if (item.target === "chatgpt") secureManagedCodexHome(paths.chatgpt.codexHome);
+  }
+}
+
+const REFRESH_TTL_MS = 6 * 60 * 60 * 1000;
+
+/**
+ * The zero-network, zero-rebuild open decision. Returns the launcher paths to
+ * open when every requested target is provably current — bundle built by this
+ * CLI from the on-disk vendor version, manifest matching the stored
+ * gateway/tenant/config schema, and (for Claude, whose config embeds the
+ * tenant credential) the written credential matching the stored PAT. Any
+ * doubt returns null and the slow path re-derives everything.
+ */
+export function fastOpenLaunchers(targets, { homeDir = os.homedir(), config = loadConfig(), statuses = null } = {}) {
+  if (!config?.pat || !config?.tenantId) return null;
+  const gatewayUrl = normalizeGatewayUrl(config.gatewayUrl || resolveDefaultGateway());
+  const manifest = readTenantManifest(homeDir, config.tenantId);
+  if (
+    !manifest
+    || manifest.gatewayUrl !== gatewayUrl
+    || manifest.tenantId !== config.tenantId
+    || manifest.configVersion !== CURRENT_CONFIG_VERSION
+    || manifest.experiments?.crossAppModels !== crossAppModelsEnabled(config)
+  ) {
+    return null;
+  }
+  const launchers = [];
+  for (const status of statuses ?? appStatus(targets, homeDir, config.tenantId)) {
+    if (!bundleIsCurrent(status)) return null;
+    if (!fs.existsSync(status.configPath)) return null;
+    if (status.target === "claude" && !claudeConfigIsCurrent(status.configPath, config, gatewayUrl)) {
+      return null;
+    }
+    launchers.push(status.launcher);
+  }
+  return launchers;
+}
+
+function claudeConfigIsCurrent(configPath, config, gatewayUrl) {
+  try {
+    const body = JSON.parse(fs.readFileSync(configPath, "utf8"));
+    return (
+      body.inferenceGatewayBaseUrl === (crossAppModelsEnabled(config)
+        ? `${gatewayUrl}/experimental/anthropic`
+        : `${gatewayUrl}/anthropic`)
+      && body.inferenceGatewayApiKey === tenantCredential(config.pat, config.tenantId)
+    );
+  } catch {
+    return false;
+  }
+}
+
+// Best-effort config/catalog/skills refresh for installed apps — the
+// background half of "the apps keep themselves current". Safe while the apps
+// run (config writes only, never a bundle swap, never quits anything) and
+// silent on any failure: it is invoked detached from the apps' token helper,
+// so there is no user to talk to and nothing may leak to stdout.
+async function refreshApps(targets, { staleOnly = false } = {}) {
+  const stored = loadConfig();
+  if (!stored?.pat) return;
+  const paths = appPaths(os.homedir(), stored.tenantId || null);
+  if (staleOnly && manifestIsFresh(paths, stored)) return;
+
+  let config;
+  try {
+    config = await selectedAppConfig(targets);
+  } catch {
+    return;
+  }
+  const statuses = appStatus(targets, os.homedir(), config.tenantId);
+  const installedTargets = statuses.filter((status) => status.launcherInstalled);
+  if (installedTargets.length === 0) return;
+
+  let catalog;
+  try {
+    catalog = await fetchGatewayModels(config);
+  } catch {
+    return;
+  }
+  installManagedAppFiles({
+    config,
+    targets: installedTargets.map((status) => status.target),
+    models: catalog.models,
+    homeDir: os.homedir(),
+    vendorPaths: Object.fromEntries(installedTargets.map((status) => [status.target, status.vendorPath])),
+    writeBundles: false,
+  });
+
+  const tenantPaths = appPaths(os.homedir(), config.tenantId);
+  const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
+  for (const status of installedTargets) {
+    const { client, env, label } = appSkillTarget(status.target, tenantPaths);
+    await syncSkillsSafe({ client, gatewayUrl, env, label });
+    if (status.target === "chatgpt") secureManagedCodexHome(tenantPaths.chatgpt.codexHome);
+  }
+  // Keep the update-notice cache warm from the same background slot.
+  try {
+    refreshUpdateCache();
+  } catch {
+    // opportunistic only
+  }
+}
+
+function manifestIsFresh(paths, config, now = Date.now()) {
+  try {
+    const manifest = JSON.parse(
+      fs.readFileSync(path.join(paths.tenantRoot, "manifest.json"), "utf8")
+    );
+    const updatedAt = Date.parse(manifest?.updatedAt || "");
+    return Number.isFinite(updatedAt)
+      && manifest?.experiments?.crossAppModels === crossAppModelsEnabled(config)
+      && now - updatedAt < REFRESH_TTL_MS;
+  } catch {
+    return false;
+  }
+}
+
+async function selectedAppConfig(targets) {
+  const config = loadConfig();
+  if (!config?.pat || !config?.gatewayUrl) throw new Error("run `impel auth` before using Impel apps");
+  const selected = await ensureTenantSelection(config, { refresh: true });
+  if (!selected.productAccess) {
+    throw new Error("the control plane did not return a live product access entitlement; retry after it is upgraded");
+  }
+  const providers = crossAppModelsEnabled(selected.config)
+    ? ["claude", "codex"]
+    : targets.map((target) => (target === "claude" ? "claude" : "codex"));
+  assertProviderScopes(selected.scopes, providers, { requireLive: true });
+  const tenantId = selected.tenantId;
+  return {
+    ...config,
+    tenantId,
+    productAccess: selected.productAccess,
+    scopes: selected.scopes,
+    pat: tenantCredential(config.pat, tenantId),
+  };
+}
+
+function printStatus(targets) {
+  const config = loadConfig();
+  if (config?.tenantId) console.log(`Tenant: ${config.tenantId}`);
+  for (const status of appStatus(targets, os.homedir(), config?.tenantId || null)) {
+    console.log(`${status.label}:`);
+    console.log(`  launcher: ${status.launcherInstalled ? status.launcher : "not installed"}`);
+    console.log(`  vendor:   ${status.vendorPath || "not installed"}${status.vendorVersion ? ` (${status.vendorVersion})` : ""}`);
+    console.log(`  config:   ${status.configPath}`);
+  }
+}

package/src/commands/auth.js

@@ -0,0 +1,89 @@
+import { parseFlags } from "../args.js";
+import {
+  loadConfig,
+  saveConfig,
+  normalizeGatewayUrl,
+  resolveDefaultGateway,
+  resolveDefaultAppUrl,
+  maskSecret,
+} from "../config.js";
+import { promptSecret } from "../prompt.js";
+import { fetchTenants, normalizeTenantId } from "../tenants.js";
+
+export async function cmdAuth(argv) {
+  const { flags } = parseFlags(argv, {
+    pat: { type: "string" },
+    gateway: { type: "string" },
+    app: { type: "string" },
+    tenant: { type: "string" },
+  });
+
+  const existing = loadConfig();
+
+  let pat = flags.pat;
+  if (!pat) {
+    pat = await promptSecret("Impel Personal Access Token (impel_pat_...): ");
+  }
+  if (!pat) {
+    console.error("impel: no PAT provided, aborting.");
+    process.exitCode = 1;
+    return;
+  }
+  if (!pat.startsWith("impel_pat_")) {
+    console.warn(
+      `impel: warning: that token doesn't start with "impel_pat_" — double check you copied the right value.`
+    );
+  }
+
+  const gatewayUrl = normalizeGatewayUrl(flags.gateway || existing?.gatewayUrl || resolveDefaultGateway());
+  const appUrl = normalizeGatewayUrl(flags.app || existing?.appUrl || resolveDefaultAppUrl());
+
+  const config = { ...(existing || {}), pat, gatewayUrl, appUrl, updatedAt: new Date().toISOString() };
+  try {
+    const listing = await fetchTenants(config);
+    const requestedTenant = flags.tenant ? normalizeTenantId(flags.tenant) : null;
+    const selected = requestedTenant
+      ? listing.tenants.find((tenant) => tenant.id === requestedTenant || tenant.slug === requestedTenant)
+      : null;
+    if (requestedTenant && !selected) {
+      throw new Error(`tenant "${requestedTenant}" is not available to this user`);
+    }
+    config.tenantId = selected?.id || (
+      listing.tenants.some((tenant) => tenant.id === existing?.tenantId)
+        ? existing.tenantId
+        : listing.defaultTenantId
+    );
+    if (listing.productAccess) config.productAccess = listing.productAccess;
+    else delete config.productAccess;
+    if (listing.scopes) config.scopes = listing.scopes;
+    else delete config.scopes;
+    config.tenantsUpdatedAt = new Date().toISOString();
+  } catch (error) {
+    if (flags.tenant) throw error;
+    if (existing?.tenantId && existing.pat === pat) {
+      config.tenantId = existing.tenantId;
+    } else {
+      delete config.tenantId;
+      delete config.productAccess;
+      delete config.scopes;
+    }
+    console.warn(`impel: tenant discovery deferred (${error.message})`);
+  }
+  saveConfig(config);
+
+  console.log(`impel: stored credentials in ~/.config/impel/config.json (mode 0600)`);
+  console.log(`  gateway: ${gatewayUrl}`);
+  console.log(`  app:     ${appUrl}`);
+  console.log(`  pat:     ${maskSecret(pat)}`);
+  console.log(`  tenant:  ${config.tenantId || "not selected — run `impel tenant list`"}`);
+  if (config.productAccess) console.log(`  access:  ${config.productAccess}`);
+  console.log("");
+  const setupAction = process.platform === "darwin"
+    ? "installs the Impel desktop apps"
+    : process.platform === "win32"
+      ? "installs missing vendor CLIs and isolated Claude/ChatGPT Desktop profiles"
+      : "prepares the isolated CLI workflow";
+  console.log(`Next: run \`impel setup\` to finish onboarding (${setupAction}`);
+  console.log("      and verifies the gateway), or jump straight into `impel claude` /");
+  console.log("      `impel codex`. Native Claude and Codex profiles remain untouched.");
+}