impel-cli 0.7.2 → 0.8.0

package/README.md

@@ -145,18 +145,22 @@ impel off [claude|codex|all]                 Alias for `impel use account`
 impel skills sync [claude|codex|all]         Sync Bifrost shared skills into managed clients (default: all)
 
 impel status                                 Launcher readiness + native mode + gateway reachability
-impel app install [claude|chatgpt|codex|all] Install isolated apps
-impel app update [claude|chatgpt|codex|all]  Refresh apps, configs, and models
-impel app refresh [claude|chatgpt|codex|all] Configs/catalog/skills only; safe while apps run
+impel app install [target] [--tenant <org>]  Install isolated apps for one tenant
+impel app update [target] [--tenant <org>]   Refresh that tenant's apps, configs, and models
+impel app refresh [target] [--tenant <org>]  Configs/catalog/skills only; safe while apps run
                                              (--stale-only: no-op unless 6h+ since last sync)
-impel app status [claude|chatgpt|codex|all]  Show launcher/vendor status
-impel app open [claude|chatgpt|codex|all]    Launch isolated instances (fast path: opens
+impel app status [target] [--tenant <org>]   Show tenant launcher/vendor status
+impel app open [target] [--tenant <org>]     Launch isolated instances (fast path: opens
                                              immediately when nothing changed since last open;
                                              a detached stale-only refresh keeps things current)
-impel app uninstall [target] [--keep-data]   Remove Impel-managed app files
+impel app uninstall [target] [--tenant <org>] [--keep-data]
+                                             Remove one tenant's Impel-managed app files
 impel help                                   Show help
 impel --version                              Show version
 
+For app commands, `target` is `claude`, `chatgpt`/`codex`, or `all` (the
+default). `--tenant` defaults to the currently selected organization.
+
 # `impel setup` no longer takes a per-tool target and never flips native
 # configs; flip a native tool explicitly with `impel use gateway [claude|codex]`.
 ```
@@ -237,10 +241,14 @@ not bleed between tenants. `impel tenant use <org> --launch claude|codex|apps`
 selects and launches in one command.
 
 On macOS, desktop app state is isolated under
-`~/.config/impel/apps/tenants/<org>/`. The app bundle in `~/Applications` is a
-launcher for the currently opened tenant; `impel app open` refreshes that
-launcher, the tenant-scoped bearer, model catalog, and specialist MCP arguments
-before starting a new isolated instance. Windows Claude Desktop keeps each
+`~/.config/impel/apps/tenants/<org>/`. Every installed tenant keeps its own app
+bundles in `~/Applications`, with names such as `Impel Claude (Acme)` and
+`Impel ChatGPT (Acme)`, stable tenant-specific bundle identifiers, and fixed
+tenant profile/auth paths. Different tenants can stay open concurrently.
+`impel app open --tenant <org>` refreshes and launches a tenant directly without
+changing the globally selected tenant. Switching tenants never deletes local
+history or projects; each tenant's preserved profile reopens independently.
+Windows Claude Desktop keeps each
 tenant under `%LOCALAPPDATA%\Claude-3p\Impel\<org>` and launches the unchanged
 signed vendor executable with that profile selected. Windows ChatGPT keeps its
 Codex and browser state under the same tenant-scoped Impel apps root used on
@@ -575,21 +583,24 @@ app-target names.
 
 ### macOS Claude and ChatGPT
 
-`impel app install` creates `Impel Claude.app` and `Impel ChatGPT.app` in
-`~/Applications`. They have separate bundle identities and gateway
-configuration:
+`impel app install` creates tenant-specific apps such as
+`Impel Claude (acme).app` and `Impel ChatGPT (acme).app` in `~/Applications`.
+Their visible bundle names use the organization display name, for example
+`Impel Claude (Acme)` and `Impel ChatGPT (Acme)`. Each tenant/product pair has
+a stable, unique bundle identifier and gateway configuration:
 
 - Impel Claude is an APFS-cloned vendored copy of the official app with its own
   bundle and helper identities. Its LaunchServices environment sets the
-  vendor-supported `CLAUDE_USER_DATA_DIR` and writes the 3P gateway `configLibrary` below
-  `~/.config/impel/apps/claude`. A narrowly version-checked compatibility patch
-  connects Claude's native plan-usage meter to the authenticated aggregate
-  Claude subscription pool exposed by the Impel gateway.
+  vendor-supported `CLAUDE_USER_DATA_DIR` and writes the 3P gateway
+  `configLibrary` below `~/.config/impel/apps/tenants/<org>/claude`. A narrowly
+  version-checked compatibility patch connects Claude's native plan-usage meter
+  to the authenticated aggregate Claude subscription pool exposed by the Impel
+  gateway.
 - Impel ChatGPT wraps an APFS-cloned official app while preserving the nested
   OpenAI-signed bundle and executable. Its outer resource root contains the
   narrowly patched renderer ASAR used at runtime. The wrapper sets `CODEX_HOME`,
   passes a separate Chromium `--user-data-dir`, and writes its provider config
-  and model catalog below `~/.config/impel/apps/chatgpt`. It also supplies a
+  and model catalog below `~/.config/impel/apps/tenants/<org>/chatgpt`. It also supplies a
   process-scoped, Codex-compatible wrapper around the Impel PAT so native
   `/status` requests can read the organization's aggregated subscription pool
   from the gateway. Its generated Codex config uses the same snapshot and
@@ -599,9 +610,22 @@ configuration:
 - Neither app changes `~/.claude`, `~/.claude.json`, `~/.codex`, or the
   normal vendor app's browser/profile data.
 
+Install or open several tenants without changing the current selection:
+
+```sh
+impel app install all --tenant acme
+impel app install all --tenant globex
+impel app open all --tenant acme
+impel app open all --tenant globex
+```
+
+Updates and uninstalls touch only the named tenant variant. The older global
+`Impel Claude.app` / `Impel ChatGPT.app` launcher is removed after the first
+successful tenant-specific rebuild.
+
 The official Claude and ChatGPT apps remain separate installations and keep
 their normal accounts, updater, profiles, and bundle identities. Each CLI
-release pins exact, tested vendor builds (v0.7.2 pins Claude `1.20186.9` and
+release pins exact, tested vendor builds (v0.8.0 pins Claude `1.20186.9` and
 ChatGPT `26.707.72221`) and their archive SHA-256 digests. The installer reuses
 an existing official app only when its version exactly matches; otherwise it
 downloads the pinned signed archive into Impel's managed vendor cache under
@@ -713,3 +737,15 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
 - https://developers.openai.com/codex/config-advanced
 - https://developers.openai.com/codex/auth
 - https://developers.openai.com/codex/ide
+
+## Sources consulted for concurrent tenant apps
+
+- Electron v43.1.0 release: https://github.com/electron/electron/releases/tag/v43.1.0
+- Electron applies `--user-data-dir` before app JavaScript:
+  https://github.com/electron/electron/blob/b5c102b3f0f7e9c5be064ba337a3547a83cf7d09/shell/app/electron_main_delegate.cc#L247-L256
+- Electron scopes its single-instance lock to the resolved user-data directory:
+  https://github.com/electron/electron/blob/b5c102b3f0f7e9c5be064ba337a3547a83cf7d09/shell/browser/api/electron_api_app.cc#L1049-L1073
+- Electron macOS bundle rebranding requirements:
+  https://github.com/electron/electron/blob/b5c102b3f0f7e9c5be064ba337a3547a83cf7d09/docs/tutorial/application-distribution.md#L79-L96
+- Apple `CFBundleIdentifier` reference:
+  https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleidentifier

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -21,11 +21,13 @@ const CLI_VERSION = JSON.parse(
 const APP_DEFINITIONS = {
   claude: {
     label: "Impel Claude",
+    bundleIdentifier: "com.useimpel.claude",
     names: ["Claude.app"],
     executableNames: ["Claude"],
   },
   chatgpt: {
     label: "Impel ChatGPT",
+    bundleIdentifier: "com.useimpel.chatgpt",
     names: ["ChatGPT.app", "Codex.app"],
     executableNames: ["ChatGPT", "Codex"],
   },
@@ -103,9 +105,44 @@ export function normalizeAppTarget(value) {
   return null;
 }
 
+function tenantAppName(value, fallback) {
+  const name = redactSecretText(String(value || fallback))
+    .normalize("NFC")
+    .replace(/[/:]/gu, "-")
+    .replace(/\s+/gu, " ")
+    .trim()
+    .slice(0, 128);
+  return name || fallback;
+}
+
+/** Stable macOS name and LaunchServices identity for one tenant-bound app. */
+export function managedAppIdentity(target, tenantId = null, tenantName = null) {
+  const definition = APP_DEFINITIONS[target];
+  if (!definition) throw new Error(`unknown app target "${redactSecretText(target)}"`);
+  if (!tenantId) {
+    return {
+      displayName: definition.label,
+      launcherName: `${definition.label}.app`,
+      bundleIdentifier: definition.bundleIdentifier,
+      helperBundleIdentifier: `${definition.bundleIdentifier}.helper`,
+    };
+  }
+  const normalizedTenantId = normalizeTenantId(tenantId);
+  const displayName = `${definition.label} (${tenantAppName(tenantName, normalizedTenantId)})`;
+  const tenantKey = crypto.createHash("sha256").update(normalizedTenantId, "utf8").digest("hex").slice(0, 20);
+  return {
+    displayName,
+    // Keep the on-disk path stable if an organization is renamed; Finder,
+    // Launchpad, and the Dock use CFBundleDisplayName below for the human name.
+    launcherName: `${definition.label} (${normalizedTenantId}).app`,
+    bundleIdentifier: `${definition.bundleIdentifier}.tenant.${tenantKey}`,
+    helperBundleIdentifier: `${definition.bundleIdentifier}.tenant.${tenantKey}.helper`,
+  };
+}
+
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 8;
+export const CURRENT_CONFIG_VERSION = 9;
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -144,6 +181,13 @@ export function bundleIsCurrent(status) {
     compatibility
     && compatibility.cliVersion === CLI_VERSION
     && compatibility.vendorVersion === status.vendorVersion
+    && compatibility.bundleIdentifier === status.bundleIdentifier
+    && compatibility.displayName === status.label
+    && compatibility.profileRoot === status.profileRoot
+    && (status.target !== "chatgpt" || (
+      compatibility.codexHome === status.codexHome
+      && compatibility.browserData === status.browserData
+    ))
     && managedBundleMatchesCompatibility(status, compatibility)
     && (status.target !== "chatgpt" || (
       compatibility.vendorSignaturesPreserved === true
@@ -177,24 +221,28 @@ function managedBundleMatchesCompatibility(status, compatibility) {
 // and codesign failures.
 
 /** osascript application names whose bundles install/update will touch. */
-export function blockingAppNames(targets) {
+export function blockingAppNames(targets, { tenantId = null, tenantName = null } = {}) {
   const names = [];
   for (const target of targets) {
     const definition = APP_DEFINITIONS[target];
     for (const bundleName of definition.names) names.push(bundleName.replace(/\.app$/u, ""));
-    names.push(definition.label);
+    names.push(managedAppIdentity(target, tenantId, tenantName).launcherName.replace(/\.app$/u, ""));
+    // The pre-v0.8 launcher was global. Close it too while a tenant-specific
+    // bundle replaces/migrates it, but never close another tenant's variant.
+    if (tenantId) names.push(definition.label);
   }
-  return names;
+  return [...new Set(names)];
 }
 
 /**
  * pgrep/pkill -f pattern for one app's processes. Anchored on
- * "/<Name>.app/Contents/MacOS/" so "Claude" never matches the space-prefixed
- * "Impel Claude.app" path (and vice versa).
+ * "/<Name>.app/.../Contents/MacOS/" so "Claude" never matches the
+ * space-prefixed tenant launcher (and vice versa), while nested Electron
+ * executables and helpers still count as processes belonging to the wrapper.
  */
 export function appProcessPattern(name) {
   const escaped = name.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-  return `/${escaped}\\.app/Contents/MacOS/`;
+  return `/${escaped}\\.app/(.*/)?Contents/MacOS/`;
 }
 
 const QUIT_POLL_MS = 500;
@@ -205,6 +253,8 @@ const QUIT_POLL_MS = 500;
  * telling the user to close it themselves if even that fails.
  */
 export async function quitBlockingApps(targets, {
+  tenantId = null,
+  tenantName = null,
   log = console.log,
   isRunning = (name) =>
     spawnSync("/usr/bin/pgrep", ["-f", appProcessPattern(name)], { stdio: "ignore" }).status === 0,
@@ -229,7 +279,7 @@ export async function quitBlockingApps(targets, {
     return !isRunning(name);
   }
 
-  for (const name of blockingAppNames(targets)) {
+  for (const name of blockingAppNames(targets, { tenantId, tenantName })) {
     if (!isRunning(name)) continue;
     log(`${name} is running; closing it before touching app bundles…`);
     requestQuit(name);
@@ -241,26 +291,33 @@ export async function quitBlockingApps(targets, {
   }
 }
 
-export function appPaths(homeDir = os.homedir(), tenantId = null, { claudeUserData = null } = {}) {
+export function appPaths(homeDir = os.homedir(), tenantId = null, {
+  claudeUserData = null,
+  tenantName = null,
+} = {}) {
   const root = process.env.IMPEL_APP_HOME || path.join(homeDir, ".config", "impel", "apps");
   const tenantRoot = tenantId
     ? path.join(root, "tenants", normalizeTenantId(tenantId))
     : root;
+  const claudeIdentity = managedAppIdentity("claude", tenantId, tenantName);
+  const chatgptIdentity = managedAppIdentity("chatgpt", tenantId, tenantName);
   return {
     root,
     tenantRoot,
     tokenHelper: path.join(tenantRoot, "bin", "token"),
     claude: {
+      ...claudeIdentity,
       root: claudeUserData || path.join(tenantRoot, "claude"),
       userData: claudeUserData || path.join(tenantRoot, "claude", "user-data"),
-      launcher: path.join(homeDir, "Applications", "Impel Claude.app"),
+      launcher: path.join(homeDir, "Applications", claudeIdentity.launcherName),
     },
     chatgpt: {
+      ...chatgptIdentity,
       root: path.join(tenantRoot, "chatgpt"),
       codexHome: path.join(tenantRoot, "chatgpt", "codex-home"),
       browserData: path.join(tenantRoot, "chatgpt", "browser-data"),
       catalog: path.join(tenantRoot, "chatgpt", "codex-home", "models.json"),
-      launcher: path.join(homeDir, "Applications", "Impel ChatGPT.app"),
+      launcher: path.join(homeDir, "Applications", chatgptIdentity.launcherName),
     },
   };
 }
@@ -304,7 +361,10 @@ export function installManagedAppFiles({
   // true = rebuild every target's bundle; false = configs only; an array
   // limits the expensive rebuild to just the stale targets.
   const bundleTargets = new Set(writeBundles === true ? targets : writeBundles || []);
-  const paths = appPaths(homeDir, config.tenantId, { claudeUserData });
+  const paths = appPaths(homeDir, config.tenantId, {
+    claudeUserData,
+    tenantName: config.tenantName,
+  });
   if (targets.includes("chatgpt")) secureAllManagedCodexHomes({ appsRoot: paths.root });
   fs.mkdirSync(paths.tenantRoot, { recursive: true, mode: 0o700 });
   if (writeTokenHelperFile) writeTokenHelper(paths.tokenHelper, config.tenantId);
@@ -329,16 +389,22 @@ export function installManagedAppFiles({
       }
       if (target === "chatgpt") writeVendoredChatGPTBundle(paths, resolvedVendorPaths.chatgpt, config.gatewayUrl);
       else writeVendoredClaudeBundle(paths, resolvedVendorPaths.claude, config.gatewayUrl);
+      if (config.tenantId) {
+        // A successful tenant-specific rebuild supersedes the old global
+        // launcher. Other tenant launchers have distinct names and survive.
+        fs.rmSync(appPaths(homeDir)[target].launcher, { recursive: true, force: true });
+      }
     }
     installed.push({ target, launcher: paths[target].launcher });
   }
 
   writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
-    schemaVersion: 3,
+    schemaVersion: 4,
     configVersion: CURRENT_CONFIG_VERSION,
     modelCatalogVersion: 3,
     gatewayUrl: config.gatewayUrl,
     tenantId: config.tenantId,
+    tenantName: config.tenantName || config.tenantId || null,
     experiments: { crossAppModels: crossAppModelsEnabled(config) },
     targets,
     models: models.map((model) => model.id),
@@ -513,17 +579,24 @@ export function ensureVendorApp(target, { homeDir = os.homedir() } = {}) {
   return { path: installed, action: "installed", note: `verified ${pin.version}` };
 }
 
-export function appStatus(targets, homeDir = os.homedir(), tenantId = null) {
-  const paths = appPaths(homeDir, tenantId);
+export function appStatus(targets, homeDir = os.homedir(), tenantId = null, tenantName = null) {
+  const manifestName = tenantId && !tenantName
+    ? readTenantManifest(homeDir, tenantId)?.tenantName
+    : null;
+  const paths = appPaths(homeDir, tenantId, { tenantName: tenantName || manifestName });
   return targets.map((target) => {
     const vendorPath = findVendorApp(target, homeDir);
     return {
       target,
-      label: APP_DEFINITIONS[target].label,
+      label: paths[target].displayName,
       launcher: paths[target].launcher,
       launcherInstalled: fs.existsSync(paths[target].launcher),
+      bundleIdentifier: paths[target].bundleIdentifier,
+      profileRoot: target === "claude" ? paths.claude.userData : paths.chatgpt.root,
       vendorPath,
       vendorVersion: vendorPath ? bundleVersion(vendorPath) : null,
+      codexHome: target === "chatgpt" ? paths.chatgpt.codexHome : null,
+      browserData: target === "chatgpt" ? paths.chatgpt.browserData : null,
       configPath: target === "claude"
         ? path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`)
         : path.join(paths.chatgpt.codexHome, "config.toml"),
@@ -535,9 +608,10 @@ export function removeManagedApps(targets, {
   homeDir = os.homedir(),
   keepData = false,
   tenantId = null,
+  tenantName = null,
   claudeUserData = null,
 } = {}) {
-  const paths = appPaths(homeDir, tenantId, { claudeUserData });
+  const paths = appPaths(homeDir, tenantId, { claudeUserData, tenantName });
   for (const target of targets) {
     fs.rmSync(paths[target].launcher, { recursive: true, force: true });
     if (!keepData) fs.rmSync(paths[target].root, { recursive: true, force: true });
@@ -844,13 +918,14 @@ function writeTokenHelper(target, tenantId) {
   const node = shellQuote(process.execPath);
   const cli = shellQuote(cliPath);
   const tenantArgs = tenantId ? ` --tenant ${shellQuote(tenantId)}` : "";
+  const refreshTenantArgs = tenantId ? ` --tenant ${shellQuote(tenantId)}` : "";
   // The apps invoke this helper whenever they need auth, which makes it the
   // one hook that fires on Finder/Dock launches too. Piggyback a detached,
   // TTL-gated config/catalog/skills refresh (`app refresh --stale-only`) so
   // the managed apps keep themselves current without touching stdout — the
   // caller consumes stdout as the token.
   const script = `#!/bin/sh
-(${node} ${cli} app refresh --stale-only </dev/null >/dev/null 2>&1 &)
+(${node} ${cli} app refresh --stale-only${refreshTenantArgs} </dev/null >/dev/null 2>&1 &)
 exec ${node} ${cli} token${tenantArgs}
 `;
   writeAtomic(target, script, 0o700);
@@ -892,27 +967,28 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl) {
     const newAsarHash = asarHeaderHash(asarPath);
 
     updateBundleIdentity(plistPath, {
-      displayName: "Impel Claude",
+      displayName: paths.claude.displayName,
       executable: executableName,
-      identifier: "com.useimpel.claude",
-      name: "Impel Claude",
+      identifier: paths.claude.bundleIdentifier,
+      name: paths.claude.displayName,
     });
     updateAsarIntegrityPlist(plistPath, oldAsarHash, newAsarHash);
     setPlistEnvironmentString(plistPath, "CLAUDE_USER_DATA_DIR", paths.claude.userData);
     rebrandElectronHelpers(staging, {
       fromName: "Claude",
-      toName: "Impel Claude",
+      toName: paths.claude.displayName,
       fromIdentifier: "com.anthropic.claudefordesktop.helper",
-      toIdentifier: "com.useimpel.claude.helper",
+      toIdentifier: paths.claude.helperBundleIdentifier,
     });
 
     const macos = path.join(staging, "Contents", "MacOS");
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 1,
+      schemaVersion: 2,
       cliVersion: CLI_VERSION,
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
-      bundleIdentifier: "com.useimpel.claude",
+      bundleIdentifier: paths.claude.bundleIdentifier,
+      displayName: paths.claude.displayName,
       profileRoot: paths.claude.userData,
       launchMode: "LSEnvironment",
       patches: {
@@ -976,7 +1052,7 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
     const asarHash = asarHeaderHash(runtimeAsarPath);
     writeAtomic(
       path.join(staging, "Contents", "Info.plist"),
-      vendoredChatGPTWrapperPlist(vendorPath, asarHash),
+      vendoredChatGPTWrapperPlist(vendorPath, asarHash, paths.chatgpt),
       0o644,
     );
     writeAtomic(
@@ -985,10 +1061,15 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
       0o755,
     );
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 1,
+      schemaVersion: 2,
       cliVersion: CLI_VERSION,
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
+      bundleIdentifier: paths.chatgpt.bundleIdentifier,
+      displayName: paths.chatgpt.displayName,
+      profileRoot: paths.chatgpt.root,
+      codexHome: paths.chatgpt.codexHome,
+      browserData: paths.chatgpt.browserData,
       patches: { fastModeForGatewayAuth: fastModePatchCount, desktopAPIForGatewayAuth: 0 },
       vendorSignaturesPreserved: true,
       resourceRoot: CHATGPT_RESOURCE_ROOT,
@@ -1254,15 +1335,15 @@ function rebrandElectronHelpers(bundle, { fromName, toName, fromIdentifier, toId
   }
 }
 
-function vendoredChatGPTWrapperPlist(vendorPath, asarHash) {
+function vendoredChatGPTWrapperPlist(vendorPath, asarHash, identity) {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
-<key>CFBundleDisplayName</key><string>Impel ChatGPT</string>
+<key>CFBundleDisplayName</key><string>${xmlEscape(identity.displayName)}</string>
 <key>CFBundleExecutable</key><string>launch</string>
 <key>CFBundleIconFile</key><string>electron.icns</string>
-<key>CFBundleIdentifier</key><string>com.useimpel.chatgpt</string>
-<key>CFBundleName</key><string>Impel ChatGPT</string>
+<key>CFBundleIdentifier</key><string>${xmlEscape(identity.bundleIdentifier)}</string>
+<key>CFBundleName</key><string>${xmlEscape(identity.displayName)}</string>
 <key>CFBundlePackageType</key><string>APPL</string>
 <key>CFBundleShortVersionString</key><string>${xmlEscape(bundleVersion(vendorPath) || "1")}</string>
 <key>ElectronAsarIntegrity</key><dict><key>Resources/app.asar</key><dict><key>algorithm</key><string>SHA256</string><key>hash</key><string>${xmlEscape(asarHash)}</string></dict></dict>
@@ -1361,9 +1442,14 @@ function signVendoredClaudeCapabilities(bundle) {
   try {
     const frameworks = path.join(bundle, "Contents", "Frameworks");
     const helpers = fs.readdirSync(frameworks, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && /^Impel Claude Helper(?: \([^)]+\))?\.app$/u.test(entry.name));
+      .filter((entry) => (
+        entry.isDirectory()
+        && entry.name.startsWith("Impel Claude")
+        && entry.name.includes(" Helper")
+        && entry.name.endsWith(".app")
+      ));
     for (const helper of helpers) {
-      const entitlements = helper.name === "Impel Claude Helper.app" ? fullPath : jitPath;
+      const entitlements = helper.name.endsWith(" Helper.app") ? fullPath : jitPath;
       const result = codesign([
         "--force", "--deep", "--options", "runtime", "--entitlements", entitlements, "--sign", "-",
         path.join(frameworks, helper.name),

package/src/cli.js

@@ -28,7 +28,7 @@ Get started:
 Run:
   impel claude [args...]                      Launch Claude Code with an isolated Impel profile
   impel codex [args...]                       Launch Codex with an isolated Impel profile
-  impel app open [claude|chatgpt|codex|all]   Open the isolated Impel desktop app(s)
+  impel app open [target] [--tenant <org>]    Open that tenant's isolated desktop app(s)
   impel status                                Tenant, PAT, per-tool mode, gateway reachability
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
 
@@ -41,11 +41,13 @@ Manage:
   impel skills sync [claude|codex|all]        Sync shared skills into managed clients
 
 Desktop apps (macOS and Windows):
-  impel app install [claude|chatgpt|codex|all] Install the isolated Impel desktop app/profile
-  impel app update [claude|chatgpt|codex|all]  Update vendor apps and managed profiles
-  impel app refresh [claude|chatgpt|codex|all] Configs/catalog/skills only; safe while apps run
-  impel app status [claude|chatgpt|codex|all]  Show isolated app and vendor versions
-  impel app uninstall [target] [--keep-data]  Remove only Impel-managed apps/data
+  target is claude, chatgpt/codex, or all (default: all)
+  impel app install [target] [--tenant <org>] Install that tenant's isolated app/profile
+  impel app update [target] [--tenant <org>]  Update vendor apps and managed profiles
+  impel app refresh [target] [--tenant <org>] Configs/catalog/skills only; safe while apps run
+  impel app status [target] [--tenant <org>]  Show isolated app and vendor versions
+  impel app uninstall [target] [--tenant <org>] [--keep-data]
+                                              Remove only that tenant's managed apps/data
 
 Native profile switching (advanced; setup never touches native tools):
   impel use gateway [claude|codex|all]        Route native Claude Code/Codex through the gateway

package/src/commands/apps.js

@@ -15,7 +15,13 @@ import {
   refreshUpdateCache,
   spawnDetachedAppRefresh,
 } from "../updates.js";
-import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
+import {
+  assertProviderScopes,
+  ensureTenantSelection,
+  fetchTenants,
+  normalizeTenantId,
+  tenantCredential,
+} from "../tenants.js";
 import {
   CURRENT_CONFIG_VERSION,
   CLAUDE_CONFIG_ID,
@@ -111,6 +117,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     "skip-vendor": { type: "boolean" },
     "keep-data": { type: "boolean" },
     "stale-only": { type: "boolean" },
+    tenant: { type: "string" },
   });
   const io = {
     environment: process.env,
@@ -140,13 +147,20 @@ export async function cmdWindowsApps(argv, overrides = {}) {
   if (overrides.launchApp) io.launchClaudeApp = overrides.launchApp;
   if (overrides.userData) io.claudeUserData = overrides.userData;
   const stored = loadConfig();
-  const storedUserData = io.claudeUserData(io.environment, stored?.tenantId || null);
-  const paths = appPaths(io.homeDir, stored?.tenantId || null, { claudeUserData: storedUserData });
+  const localTenantId = flags.tenant
+    ? normalizeTenantId(flags.tenant)
+    : stored?.tenantId || null;
+  const localTenantName = localTenantId === stored?.tenantId ? stored?.tenantName : null;
+  const storedUserData = io.claudeUserData(io.environment, localTenantId);
+  const paths = appPaths(io.homeDir, localTenantId, {
+    claudeUserData: storedUserData,
+    tenantName: localTenantName,
+  });
   const claudeConfigPath = path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`);
   const chatgptConfigPath = path.join(paths.chatgpt.codexHome, "config.toml");
 
   if (action === "status") {
-    console.log(`Tenant: ${stored?.tenantId || "not selected"}`);
+    console.log(`Tenant: ${localTenantId || "not selected"}`);
     if (targets.includes("claude")) {
       console.log("Impel Claude:");
       console.log(`  profile: ${fs.existsSync(claudeConfigPath) ? paths.claude.userData : "not installed"}`);
@@ -167,7 +181,8 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     io.removeApps(targets, {
       homeDir: io.homeDir,
       keepData: Boolean(flags["keep-data"]),
-      tenantId: stored?.tenantId || null,
+      tenantId: localTenantId,
+      tenantName: localTenantName,
       claudeUserData: storedUserData,
     });
     if (targets.includes("chatgpt")) io.removeManagedChatGPTApp(paths.root);
@@ -186,9 +201,12 @@ export async function cmdWindowsApps(argv, overrides = {}) {
 
   try {
     if (action === "open") maybePrintUpdateNotice();
-    const config = await io.selectedConfig(targets);
+    const config = await io.selectedConfig(targets, flags.tenant || null);
     const actionUserData = io.claudeUserData(io.environment, config.tenantId);
-    const actionPaths = appPaths(io.homeDir, config.tenantId, { claudeUserData: actionUserData });
+    const actionPaths = appPaths(io.homeDir, config.tenantId, {
+      claudeUserData: actionUserData,
+      tenantName: config.tenantName,
+    });
     const vendorPaths = {};
     for (const target of targets) {
       const isClaude = target === "claude";
@@ -230,7 +248,10 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     }
 
     const { userData } = configureWindowsApps(config, targets, vendorPaths, catalog, io);
-    const tenantPaths = appPaths(io.homeDir, config.tenantId, { claudeUserData: userData });
+    const tenantPaths = appPaths(io.homeDir, config.tenantId, {
+      claudeUserData: userData,
+      tenantName: config.tenantName,
+    });
     if (action === "install" || action === "update" || action === "refresh") {
       const verb = action === "install" ? "Installed" : action === "update" ? "Updated" : "Refreshed";
       for (const target of targets) {
@@ -282,17 +303,25 @@ export async function cmdApps(argv, overrides = {}) {
     "skip-vendor": { type: "boolean" },
     "keep-data": { type: "boolean" },
     "stale-only": { type: "boolean" },
+    tenant: { type: "string" },
   });
 
-  if (action === "status") return printStatus(targets);
+  if (action === "status") return printStatus(targets, flags.tenant || null);
   if (action === "refresh") {
-    return refreshApps(targets, { staleOnly: Boolean(flags["stale-only"]) });
+    return refreshApps(targets, {
+      staleOnly: Boolean(flags["stale-only"]),
+      tenantId: flags.tenant || null,
+    });
   }
   if (action === "uninstall") {
     const config = loadConfig();
+    const tenantId = flags.tenant
+      ? normalizeTenantId(flags.tenant)
+      : config?.tenantId || null;
     removeManagedApps(targets, {
       keepData: Boolean(flags["keep-data"]),
-      tenantId: config?.tenantId || null,
+      tenantId,
+      tenantName: tenantId === config?.tenantId ? config?.tenantName : null,
     });
     for (const target of targets) console.log(`Removed Impel ${target} app${flags["keep-data"] ? " (kept isolated data)" : " and isolated data"}.`);
     return;
@@ -304,19 +333,36 @@ export async function cmdApps(argv, overrides = {}) {
     // credentials, there is nothing to fetch or rebuild — launch immediately
     // and let a detached stale-only refresh keep configs/catalog/skills
     // converging in the background.
-    const fastLaunchers = fastOpenLaunchers(targets);
+    const stored = loadConfig();
+    const tenantId = flags.tenant
+      ? normalizeTenantId(flags.tenant)
+      : stored?.tenantId || null;
+    const manifest = tenantId ? readTenantManifest(os.homedir(), tenantId) : null;
+    const openConfig = stored && tenantId
+      ? {
+          ...stored,
+          tenantId,
+          tenantName: tenantId === stored.tenantId
+            ? manifest?.tenantName || stored.tenantName || tenantId
+            : manifest?.tenantName || tenantId,
+        }
+      : stored;
+    const fastLaunchers = fastOpenLaunchers(targets, { config: openConfig });
     if (fastLaunchers) {
-      spawnDetachedAppRefresh();
+      spawnDetachedAppRefresh(tenantId);
       for (const launcher of fastLaunchers) {
         spawnSync("/usr/bin/open", ["-n", launcher], { stdio: "inherit" });
       }
       return;
     }
 
-    const config = await selectedAppConfig(targets);
-    const statuses = appStatus(targets, os.homedir(), config.tenantId);
+    const config = await selectedAppConfig(targets, flags.tenant || null);
+    const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
+    const legacyPaths = appPaths(os.homedir());
     for (const status of statuses) {
-      if (!status.launcherInstalled) throw new Error(`${status.label} is not installed; run \`impel app install ${status.target}\``);
+      if (!status.launcherInstalled && !fs.existsSync(legacyPaths[status.target].launcher)) {
+        throw new Error(`${status.label} is not installed; run \`impel app install ${status.target}\``);
+      }
       if (!status.vendorPath) throw new Error(`${status.label} vendor app is unavailable; reinstall the vendor app first`);
     }
     let catalog;
@@ -332,7 +378,12 @@ export async function cmdApps(argv, overrides = {}) {
     const staleBundleTargets = statuses
       .filter((status) => !bundleIsCurrent(status))
       .map((status) => status.target);
-    if (staleBundleTargets.length > 0) await quitBlockingApps(staleBundleTargets);
+    if (staleBundleTargets.length > 0) {
+      await quitBlockingApps(staleBundleTargets, {
+        tenantId: config.tenantId,
+        tenantName: config.tenantName,
+      });
+    }
     installManagedAppFiles({
       config,
       targets,
@@ -341,7 +392,7 @@ export async function cmdApps(argv, overrides = {}) {
       vendorPaths: Object.fromEntries(statuses.map((status) => [status.target, status.vendorPath])),
       writeBundles: staleBundleTargets,
     });
-    for (const status of appStatus(targets, os.homedir(), config.tenantId)) {
+    for (const status of appStatus(targets, os.homedir(), config.tenantId, config.tenantName)) {
       spawnSync("/usr/bin/open", ["-n", status.launcher], { stdio: "inherit" });
     }
     return;
@@ -350,10 +401,14 @@ export async function cmdApps(argv, overrides = {}) {
     throw new Error(`unknown app action "${action}"; use install, update, refresh, status, open, or uninstall`);
   }
 
-  const config = await selectedAppConfig(targets);
+  const config = await selectedAppConfig(targets, flags.tenant || null);
+  console.log(`Tenant: ${config.tenantId} (desktop history is isolated per tenant).`);
 
   // A running vendor or Impel app makes the pinned vendor install / bundle swap fail.
-  await quitBlockingApps(targets);
+  await quitBlockingApps(targets, {
+    tenantId: config.tenantId,
+    tenantName: config.tenantName,
+  });
 
   const vendorPaths = {};
   if (!flags["skip-vendor"]) {
@@ -381,7 +436,7 @@ export async function cmdApps(argv, overrides = {}) {
 
   // Best-effort: sync the Bifrost shared skills into each installed isolated app
   // profile. Never fails the install/update.
-  const paths = appPaths(os.homedir(), config.tenantId);
+  const paths = appPaths(os.homedir(), config.tenantId, { tenantName: config.tenantName });
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
@@ -414,7 +469,12 @@ export function fastOpenLaunchers(targets, { homeDir = os.homedir(), config = lo
     return null;
   }
   const launchers = [];
-  for (const status of statuses ?? appStatus(targets, homeDir, config.tenantId)) {
+  for (const status of statuses ?? appStatus(
+    targets,
+    homeDir,
+    config.tenantId,
+    config.tenantName || manifest.tenantName,
+  )) {
     if (!bundleIsCurrent(status)) return null;
     if (!fs.existsSync(status.configPath)) return null;
     if (status.target === "claude" && !claudeConfigIsCurrent(status.configPath, config, gatewayUrl)) {
@@ -444,19 +504,29 @@ function claudeConfigIsCurrent(configPath, config, gatewayUrl) {
 // run (config writes only, never a bundle swap, never quits anything) and
 // silent on any failure: it is invoked detached from the apps' token helper,
 // so there is no user to talk to and nothing may leak to stdout.
-async function refreshApps(targets, { staleOnly = false } = {}) {
+async function refreshApps(targets, { staleOnly = false, tenantId = null } = {}) {
   const stored = loadConfig();
   if (!stored?.pat) return;
-  const paths = appPaths(os.homedir(), stored.tenantId || null);
+  const requestedTenantId = tenantId
+    ? normalizeTenantId(tenantId)
+    : stored.tenantId || null;
+  const manifest = requestedTenantId
+    ? readTenantManifest(os.homedir(), requestedTenantId)
+    : null;
+  const paths = appPaths(os.homedir(), requestedTenantId, {
+    tenantName: requestedTenantId === stored.tenantId
+      ? stored.tenantName || manifest?.tenantName
+      : manifest?.tenantName,
+  });
   if (staleOnly && manifestIsFresh(paths, stored)) return;
 
   let config;
   try {
-    config = await selectedAppConfig(targets);
+    config = await selectedAppConfig(targets, tenantId ? requestedTenantId : null);
   } catch {
     return;
   }
-  const statuses = appStatus(targets, os.homedir(), config.tenantId);
+  const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
   const installedTargets = statuses.filter((status) => status.launcherInstalled);
   if (installedTargets.length === 0) return;
 
@@ -475,7 +545,7 @@ async function refreshApps(targets, { staleOnly = false } = {}) {
     writeBundles: false,
   });
 
-  const tenantPaths = appPaths(os.homedir(), config.tenantId);
+  const tenantPaths = appPaths(os.homedir(), config.tenantId, { tenantName: config.tenantName });
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const status of installedTargets) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
@@ -504,10 +574,28 @@ function manifestIsFresh(paths, config, now = Date.now()) {
   }
 }
 
-async function selectedAppConfig(targets) {
+async function selectedAppConfig(targets, tenantOverride = null) {
   const config = loadConfig();
   if (!config?.pat || !config?.gatewayUrl) throw new Error("run `impel auth` before using Impel apps");
-  const selected = await ensureTenantSelection(config, { refresh: true });
+  let selected;
+  if (tenantOverride) {
+    const requested = normalizeTenantId(tenantOverride);
+    const listing = await fetchTenants(config);
+    const tenant = listing.tenants.find((candidate) => (
+      candidate.id === requested || candidate.slug === requested
+    ));
+    if (!tenant) throw new Error(`tenant "${requested}" is not available to this user`);
+    selected = {
+      config,
+      tenantId: tenant.id,
+      tenantName: tenant.name,
+      tenant,
+      productAccess: listing.productAccess,
+      scopes: listing.scopes,
+    };
+  } else {
+    selected = await ensureTenantSelection(config, { refresh: true });
+  }
   if (!selected.productAccess) {
     throw new Error("the control plane did not return a live product access entitlement; retry after it is upgraded");
   }
@@ -519,16 +607,24 @@ async function selectedAppConfig(targets) {
   return {
     ...config,
     tenantId,
+    tenantName: selected.tenantName || selected.tenant?.name || tenantId,
     productAccess: selected.productAccess,
     scopes: selected.scopes,
     pat: tenantCredential(config.pat, tenantId),
   };
 }
 
-function printStatus(targets) {
+function printStatus(targets, tenantOverride = null) {
   const config = loadConfig();
-  if (config?.tenantId) console.log(`Tenant: ${config.tenantId}`);
-  for (const status of appStatus(targets, os.homedir(), config?.tenantId || null)) {
+  const tenantId = tenantOverride
+    ? normalizeTenantId(tenantOverride)
+    : config?.tenantId || null;
+  const manifest = tenantId ? readTenantManifest(os.homedir(), tenantId) : null;
+  const tenantName = tenantId === config?.tenantId
+    ? manifest?.tenantName || config?.tenantName
+    : manifest?.tenantName;
+  if (tenantId) console.log(`Tenant: ${tenantId}${tenantName && tenantName !== tenantId ? ` (${tenantName})` : ""}`);
+  for (const status of appStatus(targets, os.homedir(), tenantId, tenantName)) {
     console.log(`${status.label}:`);
     console.log(`  launcher: ${status.launcherInstalled ? status.launcher : "not installed"}`);
     console.log(`  vendor:   ${status.vendorPath || "not installed"}${status.vendorVersion ? ` (${status.vendorVersion})` : ""}`);

package/src/commands/auth.js

@@ -53,6 +53,8 @@ export async function cmdAuth(argv) {
         ? existing.tenantId
         : listing.defaultTenantId
     );
+    config.tenantName = listing.tenants.find((tenant) => tenant.id === config.tenantId)?.name
+      || config.tenantId;
     if (listing.productAccess) config.productAccess = listing.productAccess;
     else delete config.productAccess;
     if (listing.scopes) config.scopes = listing.scopes;
@@ -62,8 +64,10 @@ export async function cmdAuth(argv) {
     if (flags.tenant) throw error;
     if (existing?.tenantId && existing.pat === pat) {
       config.tenantId = existing.tenantId;
+      config.tenantName = existing.tenantName || existing.tenantId;
     } else {
       delete config.tenantId;
+      delete config.tenantName;
       delete config.productAccess;
       delete config.scopes;
     }

package/src/commands/setup.js

@@ -214,6 +214,7 @@ export async function cmdSetup(argv, overrides = {}) {
   }
 
   config.tenantId = tenant.id;
+  config.tenantName = tenant.name;
   if (listing.productAccess) config.productAccess = listing.productAccess;
   else delete config.productAccess;
   if (listing.scopes) config.scopes = listing.scopes;

package/src/commands/tenant.js

@@ -65,6 +65,7 @@ export async function cmdTenant(argv) {
   if (!tenantId) throw new Error("tenant use requires an org slug; run `impel tenant list`");
   const { tenant } = await selectTenant(config, tenantId);
   console.log(`Tenant -> ${tenant.id} (${tenant.name})`);
+  console.log("Local CLI and desktop history in other tenants is preserved and remains available when you switch back.");
 
   const launch = flags.launch;
   if (!launch) {

package/src/commands/update.js

@@ -118,8 +118,12 @@ function anyAppInstalled(homeDir = os.homedir()) {
       || fs.existsSync(path.join(paths.chatgpt.codexHome, "config.toml"))
     );
   }
+  const legacyPaths = appPaths(homeDir);
   return (
-    fs.existsSync(paths.claude.launcher) || fs.existsSync(paths.chatgpt.launcher)
+    fs.existsSync(paths.claude.launcher)
+    || fs.existsSync(paths.chatgpt.launcher)
+    || fs.existsSync(legacyPaths.claude.launcher)
+    || fs.existsSync(legacyPaths.chatgpt.launcher)
   );
 }
 

package/src/config.js

@@ -6,6 +6,7 @@
 //     "gatewayUrl": "https://gateway.useimpel.com",
 //     "appUrl": "https://www.useimpel.com",
 //     "tenantId": "impel",
+//     "tenantName": "Impel",
 //     "experimental": { "crossAppModels": true },
 //     "updatedAt": "2026-07-08T00:00:00.000Z"
 //   }

package/src/tenants.js

@@ -148,6 +148,12 @@ export async function ensureTenantSelection(config, { refresh = false } = {}) {
     return {
       config,
       tenantId,
+      tenantName: config.tenantName || tenantId,
+      tenant: {
+        id: tenantId,
+        slug: tenantId,
+        name: config.tenantName || tenantId,
+      },
       tenants: null,
       defaultTenantId: null,
       productAccess: normalizeProductAccess(config.productAccess, { allowMissing: true }),
@@ -159,7 +165,9 @@ export async function ensureTenantSelection(config, { refresh = false } = {}) {
   const current = config.tenantId && listing.tenants.some((tenant) => tenant.id === config.tenantId)
     ? config.tenantId
     : listing.defaultTenantId;
+  const tenant = listing.tenants.find((candidate) => candidate.id === current);
   config.tenantId = current;
+  config.tenantName = tenant.name;
   if (listing.productAccess) config.productAccess = listing.productAccess;
   else delete config.productAccess;
   if (listing.scopes) config.scopes = listing.scopes;
@@ -169,6 +177,8 @@ export async function ensureTenantSelection(config, { refresh = false } = {}) {
   return {
     config,
     tenantId: current,
+    tenantName: tenant.name,
+    tenant,
     tenants: listing.tenants,
     defaultTenantId: listing.defaultTenantId,
     productAccess: listing.productAccess,
@@ -184,6 +194,7 @@ export async function selectTenant(config, tenantId) {
     throw new Error(`tenant "${selected}" is not available to this user`);
   }
   config.tenantId = tenant.id;
+  config.tenantName = tenant.name;
   if (listing.productAccess) config.productAccess = listing.productAccess;
   else delete config.productAccess;
   if (listing.scopes) config.scopes = listing.scopes;

package/src/updates.js

@@ -164,8 +164,13 @@ export function spawnDetachedCacheRefresh() {
 }
 
 /** Background config/catalog/skills convergence; no-ops inside the TTL. */
-export function spawnDetachedAppRefresh() {
-  spawnDetached(["app", "refresh", "--stale-only"]);
+export function spawnDetachedAppRefresh(tenantId = null) {
+  spawnDetached([
+    "app",
+    "refresh",
+    "--stale-only",
+    ...(tenantId ? ["--tenant", tenantId] : []),
+  ]);
 }
 
 function spawnDetached(args) {