impel-cli 0.7.3 → 0.9.0

package/src/commands/apps.js

@@ -15,7 +15,13 @@ import {
   refreshUpdateCache,
   spawnDetachedAppRefresh,
 } from "../updates.js";
-import { assertProviderScopes, ensureTenantSelection, tenantCredential } from "../tenants.js";
+import {
+  assertProviderScopes,
+  ensureTenantSelection,
+  fetchTenants,
+  normalizeTenantId,
+  tenantCredential,
+} from "../tenants.js";
 import {
   CURRENT_CONFIG_VERSION,
   CLAUDE_CONFIG_ID,
@@ -111,6 +117,7 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     "skip-vendor": { type: "boolean" },
     "keep-data": { type: "boolean" },
     "stale-only": { type: "boolean" },
+    tenant: { type: "string" },
   });
   const io = {
     environment: process.env,
@@ -140,13 +147,20 @@ export async function cmdWindowsApps(argv, overrides = {}) {
   if (overrides.launchApp) io.launchClaudeApp = overrides.launchApp;
   if (overrides.userData) io.claudeUserData = overrides.userData;
   const stored = loadConfig();
-  const storedUserData = io.claudeUserData(io.environment, stored?.tenantId || null);
-  const paths = appPaths(io.homeDir, stored?.tenantId || null, { claudeUserData: storedUserData });
+  const localTenantId = flags.tenant
+    ? normalizeTenantId(flags.tenant)
+    : stored?.tenantId || null;
+  const localTenantName = localTenantId === stored?.tenantId ? stored?.tenantName : null;
+  const storedUserData = io.claudeUserData(io.environment, localTenantId);
+  const paths = appPaths(io.homeDir, localTenantId, {
+    claudeUserData: storedUserData,
+    tenantName: localTenantName,
+  });
   const claudeConfigPath = path.join(paths.claude.userData, "configLibrary", `${CLAUDE_CONFIG_ID}.json`);
   const chatgptConfigPath = path.join(paths.chatgpt.codexHome, "config.toml");
 
   if (action === "status") {
-    console.log(`Tenant: ${stored?.tenantId || "not selected"}`);
+    console.log(`Tenant: ${localTenantId || "not selected"}`);
     if (targets.includes("claude")) {
       console.log("Impel Claude:");
       console.log(`  profile: ${fs.existsSync(claudeConfigPath) ? paths.claude.userData : "not installed"}`);
@@ -167,7 +181,8 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     io.removeApps(targets, {
       homeDir: io.homeDir,
       keepData: Boolean(flags["keep-data"]),
-      tenantId: stored?.tenantId || null,
+      tenantId: localTenantId,
+      tenantName: localTenantName,
       claudeUserData: storedUserData,
     });
     if (targets.includes("chatgpt")) io.removeManagedChatGPTApp(paths.root);
@@ -186,9 +201,12 @@ export async function cmdWindowsApps(argv, overrides = {}) {
 
   try {
     if (action === "open") maybePrintUpdateNotice();
-    const config = await io.selectedConfig(targets);
+    const config = await io.selectedConfig(targets, flags.tenant || null);
     const actionUserData = io.claudeUserData(io.environment, config.tenantId);
-    const actionPaths = appPaths(io.homeDir, config.tenantId, { claudeUserData: actionUserData });
+    const actionPaths = appPaths(io.homeDir, config.tenantId, {
+      claudeUserData: actionUserData,
+      tenantName: config.tenantName,
+    });
     const vendorPaths = {};
     for (const target of targets) {
       const isClaude = target === "claude";
@@ -230,7 +248,10 @@ export async function cmdWindowsApps(argv, overrides = {}) {
     }
 
     const { userData } = configureWindowsApps(config, targets, vendorPaths, catalog, io);
-    const tenantPaths = appPaths(io.homeDir, config.tenantId, { claudeUserData: userData });
+    const tenantPaths = appPaths(io.homeDir, config.tenantId, {
+      claudeUserData: userData,
+      tenantName: config.tenantName,
+    });
     if (action === "install" || action === "update" || action === "refresh") {
       const verb = action === "install" ? "Installed" : action === "update" ? "Updated" : "Refreshed";
       for (const target of targets) {
@@ -282,17 +303,25 @@ export async function cmdApps(argv, overrides = {}) {
     "skip-vendor": { type: "boolean" },
     "keep-data": { type: "boolean" },
     "stale-only": { type: "boolean" },
+    tenant: { type: "string" },
   });
 
-  if (action === "status") return printStatus(targets);
+  if (action === "status") return printStatus(targets, flags.tenant || null);
   if (action === "refresh") {
-    return refreshApps(targets, { staleOnly: Boolean(flags["stale-only"]) });
+    return refreshApps(targets, {
+      staleOnly: Boolean(flags["stale-only"]),
+      tenantId: flags.tenant || null,
+    });
   }
   if (action === "uninstall") {
     const config = loadConfig();
+    const tenantId = flags.tenant
+      ? normalizeTenantId(flags.tenant)
+      : config?.tenantId || null;
     removeManagedApps(targets, {
       keepData: Boolean(flags["keep-data"]),
-      tenantId: config?.tenantId || null,
+      tenantId,
+      tenantName: tenantId === config?.tenantId ? config?.tenantName : null,
     });
     for (const target of targets) console.log(`Removed Impel ${target} app${flags["keep-data"] ? " (kept isolated data)" : " and isolated data"}.`);
     return;
@@ -304,19 +333,36 @@ export async function cmdApps(argv, overrides = {}) {
     // credentials, there is nothing to fetch or rebuild — launch immediately
     // and let a detached stale-only refresh keep configs/catalog/skills
     // converging in the background.
-    const fastLaunchers = fastOpenLaunchers(targets);
+    const stored = loadConfig();
+    const tenantId = flags.tenant
+      ? normalizeTenantId(flags.tenant)
+      : stored?.tenantId || null;
+    const manifest = tenantId ? readTenantManifest(os.homedir(), tenantId) : null;
+    const openConfig = stored && tenantId
+      ? {
+          ...stored,
+          tenantId,
+          tenantName: tenantId === stored.tenantId
+            ? manifest?.tenantName || stored.tenantName || tenantId
+            : manifest?.tenantName || tenantId,
+        }
+      : stored;
+    const fastLaunchers = fastOpenLaunchers(targets, { config: openConfig });
     if (fastLaunchers) {
-      spawnDetachedAppRefresh();
+      spawnDetachedAppRefresh(tenantId);
       for (const launcher of fastLaunchers) {
         spawnSync("/usr/bin/open", ["-n", launcher], { stdio: "inherit" });
       }
       return;
     }
 
-    const config = await selectedAppConfig(targets);
-    const statuses = appStatus(targets, os.homedir(), config.tenantId);
+    const config = await selectedAppConfig(targets, flags.tenant || null);
+    const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
+    const legacyPaths = appPaths(os.homedir());
     for (const status of statuses) {
-      if (!status.launcherInstalled) throw new Error(`${status.label} is not installed; run \`impel app install ${status.target}\``);
+      if (!status.launcherInstalled && !fs.existsSync(legacyPaths[status.target].launcher)) {
+        throw new Error(`${status.label} is not installed; run \`impel app install ${status.target}\``);
+      }
       if (!status.vendorPath) throw new Error(`${status.label} vendor app is unavailable; reinstall the vendor app first`);
     }
     let catalog;
@@ -332,7 +378,12 @@ export async function cmdApps(argv, overrides = {}) {
     const staleBundleTargets = statuses
       .filter((status) => !bundleIsCurrent(status))
       .map((status) => status.target);
-    if (staleBundleTargets.length > 0) await quitBlockingApps(staleBundleTargets);
+    if (staleBundleTargets.length > 0) {
+      await quitBlockingApps(staleBundleTargets, {
+        tenantId: config.tenantId,
+        tenantName: config.tenantName,
+      });
+    }
     installManagedAppFiles({
       config,
       targets,
@@ -341,7 +392,7 @@ export async function cmdApps(argv, overrides = {}) {
       vendorPaths: Object.fromEntries(statuses.map((status) => [status.target, status.vendorPath])),
       writeBundles: staleBundleTargets,
     });
-    for (const status of appStatus(targets, os.homedir(), config.tenantId)) {
+    for (const status of appStatus(targets, os.homedir(), config.tenantId, config.tenantName)) {
       spawnSync("/usr/bin/open", ["-n", status.launcher], { stdio: "inherit" });
     }
     return;
@@ -350,11 +401,14 @@ export async function cmdApps(argv, overrides = {}) {
     throw new Error(`unknown app action "${action}"; use install, update, refresh, status, open, or uninstall`);
   }
 
-  const config = await selectedAppConfig(targets);
+  const config = await selectedAppConfig(targets, flags.tenant || null);
   console.log(`Tenant: ${config.tenantId} (desktop history is isolated per tenant).`);
 
   // A running vendor or Impel app makes the pinned vendor install / bundle swap fail.
-  await quitBlockingApps(targets);
+  await quitBlockingApps(targets, {
+    tenantId: config.tenantId,
+    tenantName: config.tenantName,
+  });
 
   const vendorPaths = {};
   if (!flags["skip-vendor"]) {
@@ -382,7 +436,7 @@ export async function cmdApps(argv, overrides = {}) {
 
   // Best-effort: sync the Bifrost shared skills into each installed isolated app
   // profile. Never fails the install/update.
-  const paths = appPaths(os.homedir(), config.tenantId);
+  const paths = appPaths(os.homedir(), config.tenantId, { tenantName: config.tenantName });
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const item of installed) {
     const { client, env, label } = appSkillTarget(item.target, paths);
@@ -415,7 +469,12 @@ export function fastOpenLaunchers(targets, { homeDir = os.homedir(), config = lo
     return null;
   }
   const launchers = [];
-  for (const status of statuses ?? appStatus(targets, homeDir, config.tenantId)) {
+  for (const status of statuses ?? appStatus(
+    targets,
+    homeDir,
+    config.tenantId,
+    config.tenantName || manifest.tenantName,
+  )) {
     if (!bundleIsCurrent(status)) return null;
     if (!fs.existsSync(status.configPath)) return null;
     if (status.target === "claude" && !claudeConfigIsCurrent(status.configPath, config, gatewayUrl)) {
@@ -445,19 +504,29 @@ function claudeConfigIsCurrent(configPath, config, gatewayUrl) {
 // run (config writes only, never a bundle swap, never quits anything) and
 // silent on any failure: it is invoked detached from the apps' token helper,
 // so there is no user to talk to and nothing may leak to stdout.
-async function refreshApps(targets, { staleOnly = false } = {}) {
+async function refreshApps(targets, { staleOnly = false, tenantId = null } = {}) {
   const stored = loadConfig();
   if (!stored?.pat) return;
-  const paths = appPaths(os.homedir(), stored.tenantId || null);
+  const requestedTenantId = tenantId
+    ? normalizeTenantId(tenantId)
+    : stored.tenantId || null;
+  const manifest = requestedTenantId
+    ? readTenantManifest(os.homedir(), requestedTenantId)
+    : null;
+  const paths = appPaths(os.homedir(), requestedTenantId, {
+    tenantName: requestedTenantId === stored.tenantId
+      ? stored.tenantName || manifest?.tenantName
+      : manifest?.tenantName,
+  });
   if (staleOnly && manifestIsFresh(paths, stored)) return;
 
   let config;
   try {
-    config = await selectedAppConfig(targets);
+    config = await selectedAppConfig(targets, tenantId ? requestedTenantId : null);
   } catch {
     return;
   }
-  const statuses = appStatus(targets, os.homedir(), config.tenantId);
+  const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
   const installedTargets = statuses.filter((status) => status.launcherInstalled);
   if (installedTargets.length === 0) return;
 
@@ -476,7 +545,7 @@ async function refreshApps(targets, { staleOnly = false } = {}) {
     writeBundles: false,
   });
 
-  const tenantPaths = appPaths(os.homedir(), config.tenantId);
+  const tenantPaths = appPaths(os.homedir(), config.tenantId, { tenantName: config.tenantName });
   const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
   for (const status of installedTargets) {
     const { client, env, label } = appSkillTarget(status.target, tenantPaths);
@@ -505,10 +574,28 @@ function manifestIsFresh(paths, config, now = Date.now()) {
   }
 }
 
-async function selectedAppConfig(targets) {
+async function selectedAppConfig(targets, tenantOverride = null) {
   const config = loadConfig();
   if (!config?.pat || !config?.gatewayUrl) throw new Error("run `impel auth` before using Impel apps");
-  const selected = await ensureTenantSelection(config, { refresh: true });
+  let selected;
+  if (tenantOverride) {
+    const requested = normalizeTenantId(tenantOverride);
+    const listing = await fetchTenants(config);
+    const tenant = listing.tenants.find((candidate) => (
+      candidate.id === requested || candidate.slug === requested
+    ));
+    if (!tenant) throw new Error(`tenant "${requested}" is not available to this user`);
+    selected = {
+      config,
+      tenantId: tenant.id,
+      tenantName: tenant.name,
+      tenant,
+      productAccess: listing.productAccess,
+      scopes: listing.scopes,
+    };
+  } else {
+    selected = await ensureTenantSelection(config, { refresh: true });
+  }
   if (!selected.productAccess) {
     throw new Error("the control plane did not return a live product access entitlement; retry after it is upgraded");
   }
@@ -520,16 +607,24 @@ async function selectedAppConfig(targets) {
   return {
     ...config,
     tenantId,
+    tenantName: selected.tenantName || selected.tenant?.name || tenantId,
     productAccess: selected.productAccess,
     scopes: selected.scopes,
     pat: tenantCredential(config.pat, tenantId),
   };
 }
 
-function printStatus(targets) {
+function printStatus(targets, tenantOverride = null) {
   const config = loadConfig();
-  if (config?.tenantId) console.log(`Tenant: ${config.tenantId}`);
-  for (const status of appStatus(targets, os.homedir(), config?.tenantId || null)) {
+  const tenantId = tenantOverride
+    ? normalizeTenantId(tenantOverride)
+    : config?.tenantId || null;
+  const manifest = tenantId ? readTenantManifest(os.homedir(), tenantId) : null;
+  const tenantName = tenantId === config?.tenantId
+    ? manifest?.tenantName || config?.tenantName
+    : manifest?.tenantName;
+  if (tenantId) console.log(`Tenant: ${tenantId}${tenantName && tenantName !== tenantId ? ` (${tenantName})` : ""}`);
+  for (const status of appStatus(targets, os.homedir(), tenantId, tenantName)) {
     console.log(`${status.label}:`);
     console.log(`  launcher: ${status.launcherInstalled ? status.launcher : "not installed"}`);
     console.log(`  vendor:   ${status.vendorPath || "not installed"}${status.vendorVersion ? ` (${status.vendorVersion})` : ""}`);

package/src/commands/auth.js

@@ -53,6 +53,8 @@ export async function cmdAuth(argv) {
         ? existing.tenantId
         : listing.defaultTenantId
     );
+    config.tenantName = listing.tenants.find((tenant) => tenant.id === config.tenantId)?.name
+      || config.tenantId;
     if (listing.productAccess) config.productAccess = listing.productAccess;
     else delete config.productAccess;
     if (listing.scopes) config.scopes = listing.scopes;
@@ -62,8 +64,10 @@ export async function cmdAuth(argv) {
     if (flags.tenant) throw error;
     if (existing?.tenantId && existing.pat === pat) {
       config.tenantId = existing.tenantId;
+      config.tenantName = existing.tenantName || existing.tenantId;
     } else {
       delete config.tenantId;
+      delete config.tenantName;
       delete config.productAccess;
       delete config.scopes;
     }

package/src/commands/pat.js

@@ -0,0 +1,331 @@
+import { parseFlags } from "../args.js";
+import {
+  loadConfig,
+  normalizeGatewayUrl,
+  redactSecretText,
+  resolveDefaultAppUrl,
+} from "../config.js";
+import {
+  fetchTenants,
+  normalizeTenantId,
+  PAT_SCOPE_CLAUDE,
+  PAT_SCOPE_CODEX,
+  PAT_SCOPE_TASKS,
+} from "../tenants.js";
+
+const AGENT_PAT_LABEL_PREFIX = "Agent · ";
+const MAX_PAT_LABEL_LENGTH = 120;
+const MAX_PAT_TTL_DAYS = 365;
+const PAT_CREATE_PATH = "/api/cli/pats";
+const PAT_TOKEN_RE = /^impel_pat_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
+const PAT_TOKEN_ID_RE = /^[A-Za-z0-9_-]{8,128}$/u;
+const AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,111}$/u;
+const CONTROL_CHARACTER_RE = /[\u0000-\u001F\u007F-\u009F]/u;
+const PAT_SCOPES = [PAT_SCOPE_CLAUDE, PAT_SCOPE_CODEX, PAT_SCOPE_TASKS];
+const PAT_SCOPE_SET = new Set(PAT_SCOPES);
+const FLAG_NAMES = new Set([
+  "agent",
+  "app",
+  "help",
+  "json",
+  "label",
+  "org",
+  "scopes",
+  "tenant",
+  "ttl-days",
+]);
+
+const HELP = `impel pat - mint a personal access token through Impel
+
+Usage:
+  impel pat create --label <label> [options]
+  impel pat create --agent <agent-id> [options]
+
+Aliases:
+  impel pats ...
+  impel pat mint ...
+
+Options:
+  --org <org>          Target org. Defaults to the selected tenant.
+  --tenant <org>       Alias for --org.
+  --scopes <csv>       Requested scopes: ${PAT_SCOPES.join(", ")}.
+                       Defaults are chosen by the control plane for your access tier.
+  --ttl-days <days>    Expiry from 1 to ${MAX_PAT_TTL_DAYS} days. Default: 90.
+  --app <url>          Override the app/control-plane URL for this command.
+  --json               Print the created PAT and metadata as JSON.
+
+The stored PAT authenticates this request. The control plane verifies the owner,
+organization membership, requested scopes, and agent access before identity mints
+the new secret. The new PAT is shown once and is not stored automatically.
+`;
+
+class PatCommandError extends Error {}
+
+function fail(message) {
+  throw new PatCommandError(message);
+}
+
+function flagSpec() {
+  return {
+    agent: { type: "string" },
+    app: { type: "string" },
+    help: { type: "boolean" },
+    json: { type: "boolean" },
+    label: { type: "string" },
+    org: { type: "string" },
+    scopes: { type: "string" },
+    tenant: { type: "string" },
+    "ttl-days": { type: "string" },
+  };
+}
+
+function requireConfig(flags) {
+  const config = loadConfig();
+  if (!config?.pat) {
+    fail("impel pat: not authenticated. Run `impel setup` (or `impel auth`) first.");
+  }
+
+  const appUrl = normalizeGatewayUrl(flags.app || config.appUrl || resolveDefaultAppUrl());
+  let parsed;
+  try {
+    parsed = new URL(appUrl);
+  } catch {
+    fail("impel pat: --app must be an HTTP or HTTPS URL.");
+  }
+  if (
+    (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    || parsed.username
+    || parsed.password
+    || parsed.pathname !== "/"
+    || parsed.search
+    || parsed.hash
+  ) {
+    fail("impel pat: --app must be a bare HTTP or HTTPS origin without credentials, a path, query, or fragment.");
+  }
+  return { appUrl, config };
+}
+
+function requestedScopes(value) {
+  if (value === undefined) return undefined;
+  const requested = String(value)
+    .split(",")
+    .map((scope) => scope.trim())
+    .filter(Boolean);
+  if (requested.length === 0) {
+    fail("impel pat: --scopes must contain at least one scope.");
+  }
+  for (const scope of requested) {
+    if (!PAT_SCOPE_SET.has(scope)) {
+      fail(`impel pat: unknown scope "${redactSecretText(scope)}".`);
+    }
+  }
+  const requestedSet = new Set(requested);
+  return PAT_SCOPES.filter((scope) => requestedSet.has(scope));
+}
+
+function requestedTtlDays(value) {
+  if (value === undefined) return undefined;
+  if (!/^\d+$/u.test(String(value))) {
+    fail(`impel pat: --ttl-days must be an integer from 1 to ${MAX_PAT_TTL_DAYS}.`);
+  }
+  const days = Number(value);
+  if (!Number.isSafeInteger(days) || days < 1 || days > MAX_PAT_TTL_DAYS) {
+    fail(`impel pat: --ttl-days must be an integer from 1 to ${MAX_PAT_TTL_DAYS}.`);
+  }
+  return days;
+}
+
+function requestedSubject(flags) {
+  const agentId = flags.agent === undefined ? null : String(flags.agent).trim();
+  const personalLabel = flags.label === undefined ? null : String(flags.label).trim();
+  if (agentId !== null && personalLabel !== null) {
+    fail("impel pat create: use either --label for a personal PAT or --agent for an agent PAT, not both.");
+  }
+  if (agentId !== null) {
+    if (!AGENT_ID_RE.test(agentId)) {
+      fail("impel pat create: --agent must be a valid agent id (letters, numbers, dots, dashes, or underscores).");
+    }
+    const label = `${AGENT_PAT_LABEL_PREFIX}${agentId}`;
+    if (label.length > MAX_PAT_LABEL_LENGTH) {
+      fail(`impel pat create: the generated agent label exceeds ${MAX_PAT_LABEL_LENGTH} characters.`);
+    }
+    return { agentId, kind: "agent", label };
+  }
+
+  if (!personalLabel) {
+    fail("impel pat create: --label is required for a personal PAT; use --agent <id> for an agent PAT.");
+  }
+  if (personalLabel.length > MAX_PAT_LABEL_LENGTH || CONTROL_CHARACTER_RE.test(personalLabel)) {
+    fail(`impel pat create: --label must be 1 to ${MAX_PAT_LABEL_LENGTH} characters without control characters.`);
+  }
+  return { agentId: null, kind: "personal", label: personalLabel };
+}
+
+async function requestedOrgId(flags, config, appUrl) {
+  if (flags.org !== undefined && flags.tenant !== undefined && flags.org !== flags.tenant) {
+    fail("impel pat: --org and --tenant must name the same org when both are passed.");
+  }
+  const requested = flags.org ?? flags.tenant;
+  try {
+    if (requested !== undefined) return normalizeTenantId(requested);
+    if (config.tenantId) return normalizeTenantId(config.tenantId);
+    const listing = await fetchTenants({ ...config, appUrl });
+    return listing.defaultTenantId;
+  } catch (error) {
+    fail(`impel pat: could not resolve the target org: ${redactSecretText(error?.message || error)}`);
+  }
+}
+
+function timestamp(value, { nullable = false } = {}) {
+  if (nullable && value === null) return null;
+  if (!Number.isSafeInteger(value) || Number.isNaN(new Date(value).getTime())) return undefined;
+  return value;
+}
+
+function normalizeCreatedPat(payload, expected) {
+  const value = payload?.pat && typeof payload.pat === "object" ? payload.pat : payload;
+  if (!value || typeof value !== "object") return null;
+  const scopes = Array.isArray(value.scopes)
+    && value.scopes.every((scope) => typeof scope === "string" && PAT_SCOPE_SET.has(scope))
+    ? [...new Set(value.scopes)]
+    : null;
+  const createdAt = timestamp(value.createdAt);
+  const expiresAt = timestamp(value.expiresAt, { nullable: true });
+  if (
+    typeof value.token !== "string"
+    || !PAT_TOKEN_RE.test(value.token)
+    || typeof value.tokenId !== "string"
+    || !PAT_TOKEN_ID_RE.test(value.tokenId)
+    || value.orgId !== expected.orgId
+    || value.label !== expected.label
+    || !scopes
+    || createdAt === undefined
+    || expiresAt === undefined
+  ) {
+    return null;
+  }
+  return {
+    token: value.token,
+    tokenId: value.tokenId,
+    orgId: value.orgId,
+    label: value.label,
+    scopes,
+    createdAt,
+    expiresAt,
+  };
+}
+
+async function createPat({ appUrl, currentPat, body }) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 10_000);
+  let response;
+  try {
+    response = await fetch(new URL(PAT_CREATE_PATH, appUrl), {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${currentPat}`,
+        "content-type": "application/json",
+      },
+      body: JSON.stringify(body),
+      signal: controller.signal,
+    });
+  } catch (error) {
+    const message = error?.name === "AbortError" ? "request timed out" : error?.message || error;
+    fail(`impel pat: could not reach ${appUrl}: ${redactSecretText(message)}`);
+  } finally {
+    clearTimeout(timeout);
+  }
+
+  const text = await response.text();
+  let payload = null;
+  try {
+    payload = text ? JSON.parse(text) : null;
+  } catch {
+    payload = null;
+  }
+  if (!response.ok) {
+    if (response.status === 404) {
+      fail(`impel pat: PAT minting is not available on ${appUrl}; update the Impel control plane and try again.`);
+    }
+    const message = redactSecretText(payload?.error || `${response.status} ${response.statusText}`.trim());
+    fail(`impel pat: ${message}`);
+  }
+
+  const created = normalizeCreatedPat(payload, body);
+  if (!created) {
+    fail("impel pat: the control plane returned an invalid PAT creation response; the secret was not displayed.");
+  }
+  return created;
+}
+
+function printCreatedPat(created, subject, json) {
+  if (json) {
+    console.log(JSON.stringify({
+      kind: subject.kind,
+      ...(subject.agentId ? { agentId: subject.agentId } : {}),
+      ...created,
+    }, null, 2));
+    return;
+  }
+
+  if (subject.kind === "agent") {
+    console.log(`Created an agent PAT for ${subject.agentId} in ${created.orgId}.`);
+  } else {
+    console.log(`Created personal PAT ${JSON.stringify(created.label)} in ${created.orgId}.`);
+  }
+  console.log(`Scopes:  ${created.scopes.join(", ") || "none"}`);
+  console.log(`Expires: ${created.expiresAt === null ? "never" : new Date(created.expiresAt).toISOString()}`);
+  console.log("");
+  console.log("Copy this token now. Impel cannot show the secret again:");
+  console.log(created.token);
+}
+
+export async function cmdPat(argv) {
+  const [action, ...rest] = argv;
+  if (!action || action === "help" || action === "--help" || action === "-h") {
+    console.log(HELP);
+    return;
+  }
+  if (action !== "create" && action !== "mint") {
+    console.error(`impel pat: unknown subcommand "${redactSecretText(action)}".`);
+    console.error("  Use `impel pat create --label <label>` or `impel pat create --agent <agent-id>`.");
+    process.exitCode = 1;
+    return;
+  }
+
+  const { flags, positionals } = parseFlags(rest, flagSpec());
+  try {
+    if (flags.help) {
+      console.log(HELP);
+      return;
+    }
+    const unknownFlag = Object.keys(flags).find((name) => !FLAG_NAMES.has(name));
+    if (unknownFlag) fail(`impel pat: unknown option --${redactSecretText(unknownFlag)}.`);
+    if (positionals.length > 0) {
+      fail(`impel pat create: unexpected argument "${redactSecretText(positionals[0])}".`);
+    }
+
+    const subject = requestedSubject(flags);
+    const scopes = requestedScopes(flags.scopes);
+    const ttlDays = requestedTtlDays(flags["ttl-days"]);
+    const { appUrl, config } = requireConfig(flags);
+    const orgId = await requestedOrgId(flags, config, appUrl);
+    const body = {
+      orgId,
+      label: subject.label,
+      ...(subject.agentId ? { agentId: subject.agentId } : {}),
+      ...(scopes ? { scopes } : {}),
+      ...(ttlDays ? { ttlDays } : {}),
+    };
+    const created = await createPat({ appUrl, currentPat: config.pat, body });
+    printCreatedPat(created, subject, flags.json === true);
+  } catch (error) {
+    if (error instanceof PatCommandError) {
+      console.error(error.message);
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+}

package/src/commands/setup.js

@@ -214,6 +214,7 @@ export async function cmdSetup(argv, overrides = {}) {
   }
 
   config.tenantId = tenant.id;
+  config.tenantName = tenant.name;
   if (listing.productAccess) config.productAccess = listing.productAccess;
   else delete config.productAccess;
   if (listing.scopes) config.scopes = listing.scopes;

package/src/commands/update.js

@@ -118,8 +118,12 @@ function anyAppInstalled(homeDir = os.homedir()) {
       || fs.existsSync(path.join(paths.chatgpt.codexHome, "config.toml"))
     );
   }
+  const legacyPaths = appPaths(homeDir);
   return (
-    fs.existsSync(paths.claude.launcher) || fs.existsSync(paths.chatgpt.launcher)
+    fs.existsSync(paths.claude.launcher)
+    || fs.existsSync(paths.chatgpt.launcher)
+    || fs.existsSync(legacyPaths.claude.launcher)
+    || fs.existsSync(legacyPaths.chatgpt.launcher)
   );
 }