impel-cli 0.7.3 → 0.9.0

package/README.md

@@ -121,6 +121,9 @@ impel update [--check] [--skip-apps]         Update EVERYTHING: reinstall the CL
                                              cascade to `app update all` and `skills sync all`
 impel auth [--pat <pat>] [--gateway <url>] [--app <url>]
                                              Store your Impel PAT + URLs
+impel pat create --label <label> [options]    Mint a personal PAT through the control plane
+impel pat create --agent <agent-id> [options]
+                                             Mint a PAT associated with an org agent
 impel token [--tenant <org>]                 Print a selected-tenant bearer
 impel mcp                                    Run the local MCP bridge used by Claude/Codex
 impel claude [claude args...]                Launch isolated Impel Claude Code
@@ -145,18 +148,22 @@ impel off [claude|codex|all]                 Alias for `impel use account`
 impel skills sync [claude|codex|all]         Sync Bifrost shared skills into managed clients (default: all)
 
 impel status                                 Launcher readiness + native mode + gateway reachability
-impel app install [claude|chatgpt|codex|all] Install isolated apps
-impel app update [claude|chatgpt|codex|all]  Refresh apps, configs, and models
-impel app refresh [claude|chatgpt|codex|all] Configs/catalog/skills only; safe while apps run
+impel app install [target] [--tenant <org>]  Install isolated apps for one tenant
+impel app update [target] [--tenant <org>]   Refresh that tenant's apps, configs, and models
+impel app refresh [target] [--tenant <org>]  Configs/catalog/skills only; safe while apps run
                                              (--stale-only: no-op unless 6h+ since last sync)
-impel app status [claude|chatgpt|codex|all]  Show launcher/vendor status
-impel app open [claude|chatgpt|codex|all]    Launch isolated instances (fast path: opens
+impel app status [target] [--tenant <org>]   Show tenant launcher/vendor status
+impel app open [target] [--tenant <org>]     Launch isolated instances (fast path: opens
                                              immediately when nothing changed since last open;
                                              a detached stale-only refresh keeps things current)
-impel app uninstall [target] [--keep-data]   Remove Impel-managed app files
+impel app uninstall [target] [--tenant <org>] [--keep-data]
+                                             Remove one tenant's Impel-managed app files
 impel help                                   Show help
 impel --version                              Show version
 
+For app commands, `target` is `claude`, `chatgpt`/`codex`, or `all` (the
+default). `--tenant` defaults to the currently selected organization.
+
 # `impel setup` no longer takes a per-tool target and never flips native
 # configs; flip a native tool explicitly with `impel use gateway [claude|codex]`.
 ```
@@ -179,6 +186,35 @@ Stores your PAT, gateway base URL, and app/control-plane URL in `~/.config/impel
 impel auth --pat impel_pat_xxxxxxxxxxxx --gateway https://gateway.useimpel.com --app https://www.useimpel.com
 ```
 
+### `impel pat create ...`  (alias `impel pat mint ...`)
+
+Mints a new PAT through the app/control-plane API, authenticated by the PAT
+already stored by `impel auth`. Identity remains the minting authority: the
+control plane verifies the current owner, target-org membership, requested
+scopes, product access, and (when applicable) agent access before it requests a
+new secret. The gateway never mints or verifies PATs.
+
+Use `--label` for a personal token or `--agent` for a token associated with an
+org agent. Agent PATs are still personal credentials: they act as you, are
+org-scoped, and use the same stable `Agent · <agent-id>` association as the agent
+setup UI.
+
+```sh
+impel pat create --label "Rahul's laptop"
+impel pat create --agent support-agent --org acme
+impel pat create --label ci-automation --scopes codex-gateway,tasks --ttl-days 30 --json
+```
+
+`--org` defaults to the selected tenant (`--tenant` is an alias). `--scopes`
+accepts `claude-code-gateway`, `codex-gateway`, and `tasks`; when omitted, the
+control plane chooses the defaults allowed by your access tier. `--ttl-days`
+accepts 1–365 and defaults to 90 days.
+
+The new secret is returned once on stdout and is deliberately **not** written to
+the config file. To rotate this CLI onto it, explicitly run
+`impel auth --pat <new-pat>` after copying it. `--json` includes the raw secret,
+so treat redirected output as a credential.
+
 ### `impel update`
 
 One command brings everything current, in dependency order: the CLI itself
@@ -237,12 +273,14 @@ not bleed between tenants. `impel tenant use <org> --launch claude|codex|apps`
 selects and launches in one command.
 
 On macOS, desktop app state is isolated under
-`~/.config/impel/apps/tenants/<org>/`. The app bundle in `~/Applications` is a
-launcher for the currently opened tenant; `impel app open` refreshes that
-launcher, the tenant-scoped bearer, model catalog, and specialist MCP arguments
-before starting a new isolated instance. Switching tenants never deletes local
-history or projects; switch back to the original tenant to reopen that tenant's
-preserved profile. Windows Claude Desktop keeps each
+`~/.config/impel/apps/tenants/<org>/`. Every installed tenant keeps its own app
+bundles in `~/Applications`, with names such as `Impel Claude (Acme)` and
+`Impel ChatGPT (Acme)`, stable tenant-specific bundle identifiers, and fixed
+tenant profile/auth paths. Different tenants can stay open concurrently.
+`impel app open --tenant <org>` refreshes and launches a tenant directly without
+changing the globally selected tenant. Switching tenants never deletes local
+history or projects; each tenant's preserved profile reopens independently.
+Windows Claude Desktop keeps each
 tenant under `%LOCALAPPDATA%\Claude-3p\Impel\<org>` and launches the unchanged
 signed vendor executable with that profile selected. Windows ChatGPT keeps its
 Codex and browser state under the same tenant-scoped Impel apps root used on
@@ -577,21 +615,24 @@ app-target names.
 
 ### macOS Claude and ChatGPT
 
-`impel app install` creates `Impel Claude.app` and `Impel ChatGPT.app` in
-`~/Applications`. They have separate bundle identities and gateway
-configuration:
+`impel app install` creates tenant-specific apps such as
+`Impel Claude (acme).app` and `Impel ChatGPT (acme).app` in `~/Applications`.
+Their visible bundle names use the organization display name, for example
+`Impel Claude (Acme)` and `Impel ChatGPT (Acme)`. Each tenant/product pair has
+a stable, unique bundle identifier and gateway configuration:
 
 - Impel Claude is an APFS-cloned vendored copy of the official app with its own
   bundle and helper identities. Its LaunchServices environment sets the
-  vendor-supported `CLAUDE_USER_DATA_DIR` and writes the 3P gateway `configLibrary` below
-  `~/.config/impel/apps/claude`. A narrowly version-checked compatibility patch
-  connects Claude's native plan-usage meter to the authenticated aggregate
-  Claude subscription pool exposed by the Impel gateway.
+  vendor-supported `CLAUDE_USER_DATA_DIR` and writes the 3P gateway
+  `configLibrary` below `~/.config/impel/apps/tenants/<org>/claude`. A narrowly
+  version-checked compatibility patch connects Claude's native plan-usage meter
+  to the authenticated aggregate Claude subscription pool exposed by the Impel
+  gateway.
 - Impel ChatGPT wraps an APFS-cloned official app while preserving the nested
   OpenAI-signed bundle and executable. Its outer resource root contains the
   narrowly patched renderer ASAR used at runtime. The wrapper sets `CODEX_HOME`,
   passes a separate Chromium `--user-data-dir`, and writes its provider config
-  and model catalog below `~/.config/impel/apps/chatgpt`. It also supplies a
+  and model catalog below `~/.config/impel/apps/tenants/<org>/chatgpt`. It also supplies a
   process-scoped, Codex-compatible wrapper around the Impel PAT so native
   `/status` requests can read the organization's aggregated subscription pool
   from the gateway. Its generated Codex config uses the same snapshot and
@@ -601,9 +642,22 @@ configuration:
 - Neither app changes `~/.claude`, `~/.claude.json`, `~/.codex`, or the
   normal vendor app's browser/profile data.
 
+Install or open several tenants without changing the current selection:
+
+```sh
+impel app install all --tenant acme
+impel app install all --tenant globex
+impel app open all --tenant acme
+impel app open all --tenant globex
+```
+
+Updates and uninstalls touch only the named tenant variant. The older global
+`Impel Claude.app` / `Impel ChatGPT.app` launcher is removed after the first
+successful tenant-specific rebuild.
+
 The official Claude and ChatGPT apps remain separate installations and keep
 their normal accounts, updater, profiles, and bundle identities. Each CLI
-release pins exact, tested vendor builds (v0.7.2 pins Claude `1.20186.9` and
+release pins exact, tested vendor builds (v0.9.0 pins Claude `1.20186.9` and
 ChatGPT `26.707.72221`) and their archive SHA-256 digests. The installer reuses
 an existing official app only when its version exactly matches; otherwise it
 downloads the pinned signed archive into Impel's managed vendor cache under
@@ -715,3 +769,15 @@ OpenAI Responses front door for SDK/Eve traffic and may normalize the body
 - https://developers.openai.com/codex/config-advanced
 - https://developers.openai.com/codex/auth
 - https://developers.openai.com/codex/ide
+
+## Sources consulted for concurrent tenant apps
+
+- Electron v43.1.0 release: https://github.com/electron/electron/releases/tag/v43.1.0
+- Electron applies `--user-data-dir` before app JavaScript:
+  https://github.com/electron/electron/blob/b5c102b3f0f7e9c5be064ba337a3547a83cf7d09/shell/app/electron_main_delegate.cc#L247-L256
+- Electron scopes its single-instance lock to the resolved user-data directory:
+  https://github.com/electron/electron/blob/b5c102b3f0f7e9c5be064ba337a3547a83cf7d09/shell/browser/api/electron_api_app.cc#L1049-L1073
+- Electron macOS bundle rebranding requirements:
+  https://github.com/electron/electron/blob/b5c102b3f0f7e9c5be064ba337a3547a83cf7d09/docs/tutorial/application-distribution.md#L79-L96
+- Apple `CFBundleIdentifier` reference:
+  https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleidentifier

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.7.3",
+  "version": "0.9.0",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -21,11 +21,13 @@ const CLI_VERSION = JSON.parse(
 const APP_DEFINITIONS = {
   claude: {
     label: "Impel Claude",
+    bundleIdentifier: "com.useimpel.claude",
     names: ["Claude.app"],
     executableNames: ["Claude"],
   },
   chatgpt: {
     label: "Impel ChatGPT",
+    bundleIdentifier: "com.useimpel.chatgpt",
     names: ["ChatGPT.app", "Codex.app"],
     executableNames: ["ChatGPT", "Codex"],
   },
@@ -103,9 +105,44 @@ export function normalizeAppTarget(value) {
   return null;
 }
 
+function tenantAppName(value, fallback) {
+  const name = redactSecretText(String(value || fallback))
+    .normalize("NFC")
+    .replace(/[/:]/gu, "-")
+    .replace(/\s+/gu, " ")
+    .trim()
+    .slice(0, 128);
+  return name || fallback;
+}
+
+/** Stable macOS name and LaunchServices identity for one tenant-bound app. */
+export function managedAppIdentity(target, tenantId = null, tenantName = null) {
+  const definition = APP_DEFINITIONS[target];
+  if (!definition) throw new Error(`unknown app target "${redactSecretText(target)}"`);
+  if (!tenantId) {
+    return {
+      displayName: definition.label,
+      launcherName: `${definition.label}.app`,
+      bundleIdentifier: definition.bundleIdentifier,
+      helperBundleIdentifier: `${definition.bundleIdentifier}.helper`,
+    };
+  }
+  const normalizedTenantId = normalizeTenantId(tenantId);
+  const displayName = `${definition.label} (${tenantAppName(tenantName, normalizedTenantId)})`;
+  const tenantKey = crypto.createHash("sha256").update(normalizedTenantId, "utf8").digest("hex").slice(0, 20);
+  return {
+    displayName,
+    // Keep the on-disk path stable if an organization is renamed; Finder,
+    // Launchpad, and the Dock use CFBundleDisplayName below for the human name.
+    launcherName: `${definition.label} (${normalizedTenantId}).app`,
+    bundleIdentifier: `${definition.bundleIdentifier}.tenant.${tenantKey}`,
+    helperBundleIdentifier: `${definition.bundleIdentifier}.tenant.${tenantKey}.helper`,
+  };
+}
+
 // Bump when the written config/manifest schema changes; a mismatch forces the
 // slow open path (and thus a full config rewrite) after a CLI update.
-export const CURRENT_CONFIG_VERSION = 8;
+export const CURRENT_CONFIG_VERSION = 9;
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -144,6 +181,8 @@ export function bundleIsCurrent(status) {
     compatibility
     && compatibility.cliVersion === CLI_VERSION
     && compatibility.vendorVersion === status.vendorVersion
+    && compatibility.bundleIdentifier === status.bundleIdentifier
+    && compatibility.displayName === status.label
     && compatibility.profileRoot === status.profileRoot
     && (status.target !== "chatgpt" || (
       compatibility.codexHome === status.codexHome
@@ -182,24 +221,28 @@ function managedBundleMatchesCompatibility(status, compatibility) {
 // and codesign failures.
 
 /** osascript application names whose bundles install/update will touch. */
-export function blockingAppNames(targets) {
+export function blockingAppNames(targets, { tenantId = null, tenantName = null } = {}) {
   const names = [];
   for (const target of targets) {
     const definition = APP_DEFINITIONS[target];
     for (const bundleName of definition.names) names.push(bundleName.replace(/\.app$/u, ""));
-    names.push(definition.label);
+    names.push(managedAppIdentity(target, tenantId, tenantName).launcherName.replace(/\.app$/u, ""));
+    // The pre-v0.8 launcher was global. Close it too while a tenant-specific
+    // bundle replaces/migrates it, but never close another tenant's variant.
+    if (tenantId) names.push(definition.label);
   }
-  return names;
+  return [...new Set(names)];
 }
 
 /**
  * pgrep/pkill -f pattern for one app's processes. Anchored on
- * "/<Name>.app/Contents/MacOS/" so "Claude" never matches the space-prefixed
- * "Impel Claude.app" path (and vice versa).
+ * "/<Name>.app/.../Contents/MacOS/" so "Claude" never matches the
+ * space-prefixed tenant launcher (and vice versa), while nested Electron
+ * executables and helpers still count as processes belonging to the wrapper.
  */
 export function appProcessPattern(name) {
   const escaped = name.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-  return `/${escaped}\\.app/Contents/MacOS/`;
+  return `/${escaped}\\.app/(.*/)?Contents/MacOS/`;
 }
 
 const QUIT_POLL_MS = 500;
@@ -210,6 +253,8 @@ const QUIT_POLL_MS = 500;
  * telling the user to close it themselves if even that fails.
  */
 export async function quitBlockingApps(targets, {
+  tenantId = null,
+  tenantName = null,
   log = console.log,
   isRunning = (name) =>
     spawnSync("/usr/bin/pgrep", ["-f", appProcessPattern(name)], { stdio: "ignore" }).status === 0,
@@ -234,7 +279,7 @@ export async function quitBlockingApps(targets, {
     return !isRunning(name);
   }
 
-  for (const name of blockingAppNames(targets)) {
+  for (const name of blockingAppNames(targets, { tenantId, tenantName })) {
     if (!isRunning(name)) continue;
     log(`${name} is running; closing it before touching app bundles…`);
     requestQuit(name);
@@ -246,26 +291,33 @@ export async function quitBlockingApps(targets, {
   }
 }
 
-export function appPaths(homeDir = os.homedir(), tenantId = null, { claudeUserData = null } = {}) {
+export function appPaths(homeDir = os.homedir(), tenantId = null, {
+  claudeUserData = null,
+  tenantName = null,
+} = {}) {
   const root = process.env.IMPEL_APP_HOME || path.join(homeDir, ".config", "impel", "apps");
   const tenantRoot = tenantId
     ? path.join(root, "tenants", normalizeTenantId(tenantId))
     : root;
+  const claudeIdentity = managedAppIdentity("claude", tenantId, tenantName);
+  const chatgptIdentity = managedAppIdentity("chatgpt", tenantId, tenantName);
   return {
     root,
     tenantRoot,
     tokenHelper: path.join(tenantRoot, "bin", "token"),
     claude: {
+      ...claudeIdentity,
       root: claudeUserData || path.join(tenantRoot, "claude"),
       userData: claudeUserData || path.join(tenantRoot, "claude", "user-data"),
-      launcher: path.join(homeDir, "Applications", "Impel Claude.app"),
+      launcher: path.join(homeDir, "Applications", claudeIdentity.launcherName),
     },
     chatgpt: {
+      ...chatgptIdentity,
       root: path.join(tenantRoot, "chatgpt"),
       codexHome: path.join(tenantRoot, "chatgpt", "codex-home"),
       browserData: path.join(tenantRoot, "chatgpt", "browser-data"),
       catalog: path.join(tenantRoot, "chatgpt", "codex-home", "models.json"),
-      launcher: path.join(homeDir, "Applications", "Impel ChatGPT.app"),
+      launcher: path.join(homeDir, "Applications", chatgptIdentity.launcherName),
     },
   };
 }
@@ -309,7 +361,10 @@ export function installManagedAppFiles({
   // true = rebuild every target's bundle; false = configs only; an array
   // limits the expensive rebuild to just the stale targets.
   const bundleTargets = new Set(writeBundles === true ? targets : writeBundles || []);
-  const paths = appPaths(homeDir, config.tenantId, { claudeUserData });
+  const paths = appPaths(homeDir, config.tenantId, {
+    claudeUserData,
+    tenantName: config.tenantName,
+  });
   if (targets.includes("chatgpt")) secureAllManagedCodexHomes({ appsRoot: paths.root });
   fs.mkdirSync(paths.tenantRoot, { recursive: true, mode: 0o700 });
   if (writeTokenHelperFile) writeTokenHelper(paths.tokenHelper, config.tenantId);
@@ -334,16 +389,22 @@ export function installManagedAppFiles({
       }
       if (target === "chatgpt") writeVendoredChatGPTBundle(paths, resolvedVendorPaths.chatgpt, config.gatewayUrl);
       else writeVendoredClaudeBundle(paths, resolvedVendorPaths.claude, config.gatewayUrl);
+      if (config.tenantId) {
+        // A successful tenant-specific rebuild supersedes the old global
+        // launcher. Other tenant launchers have distinct names and survive.
+        fs.rmSync(appPaths(homeDir)[target].launcher, { recursive: true, force: true });
+      }
     }
     installed.push({ target, launcher: paths[target].launcher });
   }
 
   writeAtomic(path.join(paths.tenantRoot, "manifest.json"), JSON.stringify({
-    schemaVersion: 3,
+    schemaVersion: 4,
     configVersion: CURRENT_CONFIG_VERSION,
     modelCatalogVersion: 3,
     gatewayUrl: config.gatewayUrl,
     tenantId: config.tenantId,
+    tenantName: config.tenantName || config.tenantId || null,
     experiments: { crossAppModels: crossAppModelsEnabled(config) },
     targets,
     models: models.map((model) => model.id),
@@ -518,18 +579,22 @@ export function ensureVendorApp(target, { homeDir = os.homedir() } = {}) {
   return { path: installed, action: "installed", note: `verified ${pin.version}` };
 }
 
-export function appStatus(targets, homeDir = os.homedir(), tenantId = null) {
-  const paths = appPaths(homeDir, tenantId);
+export function appStatus(targets, homeDir = os.homedir(), tenantId = null, tenantName = null) {
+  const manifestName = tenantId && !tenantName
+    ? readTenantManifest(homeDir, tenantId)?.tenantName
+    : null;
+  const paths = appPaths(homeDir, tenantId, { tenantName: tenantName || manifestName });
   return targets.map((target) => {
     const vendorPath = findVendorApp(target, homeDir);
     return {
       target,
-      label: APP_DEFINITIONS[target].label,
+      label: paths[target].displayName,
       launcher: paths[target].launcher,
       launcherInstalled: fs.existsSync(paths[target].launcher),
+      bundleIdentifier: paths[target].bundleIdentifier,
+      profileRoot: target === "claude" ? paths.claude.userData : paths.chatgpt.root,
       vendorPath,
       vendorVersion: vendorPath ? bundleVersion(vendorPath) : null,
-      profileRoot: target === "claude" ? paths.claude.userData : paths.chatgpt.root,
       codexHome: target === "chatgpt" ? paths.chatgpt.codexHome : null,
       browserData: target === "chatgpt" ? paths.chatgpt.browserData : null,
       configPath: target === "claude"
@@ -543,9 +608,10 @@ export function removeManagedApps(targets, {
   homeDir = os.homedir(),
   keepData = false,
   tenantId = null,
+  tenantName = null,
   claudeUserData = null,
 } = {}) {
-  const paths = appPaths(homeDir, tenantId, { claudeUserData });
+  const paths = appPaths(homeDir, tenantId, { claudeUserData, tenantName });
   for (const target of targets) {
     fs.rmSync(paths[target].launcher, { recursive: true, force: true });
     if (!keepData) fs.rmSync(paths[target].root, { recursive: true, force: true });
@@ -852,13 +918,14 @@ function writeTokenHelper(target, tenantId) {
   const node = shellQuote(process.execPath);
   const cli = shellQuote(cliPath);
   const tenantArgs = tenantId ? ` --tenant ${shellQuote(tenantId)}` : "";
+  const refreshTenantArgs = tenantId ? ` --tenant ${shellQuote(tenantId)}` : "";
   // The apps invoke this helper whenever they need auth, which makes it the
   // one hook that fires on Finder/Dock launches too. Piggyback a detached,
   // TTL-gated config/catalog/skills refresh (`app refresh --stale-only`) so
   // the managed apps keep themselves current without touching stdout — the
   // caller consumes stdout as the token.
   const script = `#!/bin/sh
-(${node} ${cli} app refresh --stale-only </dev/null >/dev/null 2>&1 &)
+(${node} ${cli} app refresh --stale-only${refreshTenantArgs} </dev/null >/dev/null 2>&1 &)
 exec ${node} ${cli} token${tenantArgs}
 `;
   writeAtomic(target, script, 0o700);
@@ -900,27 +967,28 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl) {
     const newAsarHash = asarHeaderHash(asarPath);
 
     updateBundleIdentity(plistPath, {
-      displayName: "Impel Claude",
+      displayName: paths.claude.displayName,
       executable: executableName,
-      identifier: "com.useimpel.claude",
-      name: "Impel Claude",
+      identifier: paths.claude.bundleIdentifier,
+      name: paths.claude.displayName,
     });
     updateAsarIntegrityPlist(plistPath, oldAsarHash, newAsarHash);
     setPlistEnvironmentString(plistPath, "CLAUDE_USER_DATA_DIR", paths.claude.userData);
     rebrandElectronHelpers(staging, {
       fromName: "Claude",
-      toName: "Impel Claude",
+      toName: paths.claude.displayName,
       fromIdentifier: "com.anthropic.claudefordesktop.helper",
-      toIdentifier: "com.useimpel.claude.helper",
+      toIdentifier: paths.claude.helperBundleIdentifier,
     });
 
     const macos = path.join(staging, "Contents", "MacOS");
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 1,
+      schemaVersion: 2,
       cliVersion: CLI_VERSION,
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
-      bundleIdentifier: "com.useimpel.claude",
+      bundleIdentifier: paths.claude.bundleIdentifier,
+      displayName: paths.claude.displayName,
       profileRoot: paths.claude.userData,
       launchMode: "LSEnvironment",
       patches: {
@@ -984,7 +1052,7 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
     const asarHash = asarHeaderHash(runtimeAsarPath);
     writeAtomic(
       path.join(staging, "Contents", "Info.plist"),
-      vendoredChatGPTWrapperPlist(vendorPath, asarHash),
+      vendoredChatGPTWrapperPlist(vendorPath, asarHash, paths.chatgpt),
       0o644,
     );
     writeAtomic(
@@ -993,10 +1061,12 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl) {
       0o755,
     );
     writeAtomic(path.join(staging, "Contents", "Resources", "impel-compatibility.json"), JSON.stringify({
-      schemaVersion: 1,
+      schemaVersion: 2,
       cliVersion: CLI_VERSION,
       vendorVersion: bundleVersion(vendorPath),
       sourceBundle: vendorPath,
+      bundleIdentifier: paths.chatgpt.bundleIdentifier,
+      displayName: paths.chatgpt.displayName,
       profileRoot: paths.chatgpt.root,
       codexHome: paths.chatgpt.codexHome,
       browserData: paths.chatgpt.browserData,
@@ -1265,15 +1335,15 @@ function rebrandElectronHelpers(bundle, { fromName, toName, fromIdentifier, toId
   }
 }
 
-function vendoredChatGPTWrapperPlist(vendorPath, asarHash) {
+function vendoredChatGPTWrapperPlist(vendorPath, asarHash, identity) {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict>
-<key>CFBundleDisplayName</key><string>Impel ChatGPT</string>
+<key>CFBundleDisplayName</key><string>${xmlEscape(identity.displayName)}</string>
 <key>CFBundleExecutable</key><string>launch</string>
 <key>CFBundleIconFile</key><string>electron.icns</string>
-<key>CFBundleIdentifier</key><string>com.useimpel.chatgpt</string>
-<key>CFBundleName</key><string>Impel ChatGPT</string>
+<key>CFBundleIdentifier</key><string>${xmlEscape(identity.bundleIdentifier)}</string>
+<key>CFBundleName</key><string>${xmlEscape(identity.displayName)}</string>
 <key>CFBundlePackageType</key><string>APPL</string>
 <key>CFBundleShortVersionString</key><string>${xmlEscape(bundleVersion(vendorPath) || "1")}</string>
 <key>ElectronAsarIntegrity</key><dict><key>Resources/app.asar</key><dict><key>algorithm</key><string>SHA256</string><key>hash</key><string>${xmlEscape(asarHash)}</string></dict></dict>
@@ -1372,9 +1442,14 @@ function signVendoredClaudeCapabilities(bundle) {
   try {
     const frameworks = path.join(bundle, "Contents", "Frameworks");
     const helpers = fs.readdirSync(frameworks, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && /^Impel Claude Helper(?: \([^)]+\))?\.app$/u.test(entry.name));
+      .filter((entry) => (
+        entry.isDirectory()
+        && entry.name.startsWith("Impel Claude")
+        && entry.name.includes(" Helper")
+        && entry.name.endsWith(".app")
+      ));
     for (const helper of helpers) {
-      const entitlements = helper.name === "Impel Claude Helper.app" ? fullPath : jitPath;
+      const entitlements = helper.name.endsWith(" Helper.app") ? fullPath : jitPath;
       const result = codesign([
         "--force", "--deep", "--options", "runtime", "--entitlements", entitlements, "--sign", "-",
         path.join(frameworks, helper.name),

package/src/cli.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import { fileURLToPath } from "node:url";
 
 import { cmdAuth } from "./commands/auth.js";
+import { cmdPat } from "./commands/pat.js";
 import { cmdToken } from "./commands/token.js";
 import { cmdUse } from "./commands/use.js";
 import { cmdStatus } from "./commands/status.js";
@@ -28,12 +29,14 @@ Get started:
 Run:
   impel claude [args...]                      Launch Claude Code with an isolated Impel profile
   impel codex [args...]                       Launch Codex with an isolated Impel profile
-  impel app open [claude|chatgpt|codex|all]   Open the isolated Impel desktop app(s)
+  impel app open [target] [--tenant <org>]    Open that tenant's isolated desktop app(s)
   impel status                                Tenant, PAT, per-tool mode, gateway reachability
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
 
 Manage:
   impel auth [--pat <pat>]                    Store your PAT + URLs (--gateway/--app <url>)
+  impel pat create --label <label>            Mint a personal PAT (--org/--scopes/--ttl-days)
+  impel pat create --agent <agent-id>         Mint an org-scoped PAT associated with an agent
   impel tenant list|current|use <org>         List or select the active organization
   impel tasks list|get|create|update|delete   CRUD Impel tickets (aliases: task, ticket[s])
   impel token [--tenant <org>]                Print the selected-tenant bearer
@@ -41,11 +44,13 @@ Manage:
   impel skills sync [claude|codex|all]        Sync shared skills into managed clients
 
 Desktop apps (macOS and Windows):
-  impel app install [claude|chatgpt|codex|all] Install the isolated Impel desktop app/profile
-  impel app update [claude|chatgpt|codex|all]  Update vendor apps and managed profiles
-  impel app refresh [claude|chatgpt|codex|all] Configs/catalog/skills only; safe while apps run
-  impel app status [claude|chatgpt|codex|all]  Show isolated app and vendor versions
-  impel app uninstall [target] [--keep-data]  Remove only Impel-managed apps/data
+  target is claude, chatgpt/codex, or all (default: all)
+  impel app install [target] [--tenant <org>] Install that tenant's isolated app/profile
+  impel app update [target] [--tenant <org>]  Update vendor apps and managed profiles
+  impel app refresh [target] [--tenant <org>] Configs/catalog/skills only; safe while apps run
+  impel app status [target] [--tenant <org>]  Show isolated app and vendor versions
+  impel app uninstall [target] [--tenant <org>] [--keep-data]
+                                              Remove only that tenant's managed apps/data
 
 Native profile switching (advanced; setup never touches native tools):
   impel use gateway [claude|codex|all]        Route native Claude Code/Codex through the gateway
@@ -57,7 +62,7 @@ Native profile switching (advanced; setup never touches native tools):
 
 Env:
   IMPEL_GATEWAY_URL   Default gateway URL when --gateway isn't passed.
-  IMPEL_APP_URL       Default app/control-plane URL for setup, auth, and tasks.
+  IMPEL_APP_URL       Default app/control-plane URL for setup, auth, PATs, and tasks.
   IMPEL_SKIP_UPDATE_CHECK=1   Silence launch-time update notices.
 
 Config file:
@@ -99,6 +104,10 @@ export async function main(argv) {
     case "auth":
       return cmdAuth(rest);
 
+    case "pat":
+    case "pats":
+      return cmdPat(rest);
+
     case "token":
       return cmdToken(rest);