impel-cli 0.9.0 → 0.9.2

package/README.md

@@ -124,6 +124,7 @@ impel auth [--pat <pat>] [--gateway <url>] [--app <url>]
 impel pat create --label <label> [options]    Mint a personal PAT through the control plane
 impel pat create --agent <agent-id> [options]
                                              Mint a PAT associated with an org agent
+impel pat revoke <token-id> --yes             Irreversibly revoke one of your PATs
 impel token [--tenant <org>]                 Print a selected-tenant bearer
 impel mcp                                    Run the local MCP bridge used by Claude/Codex
 impel claude [claude args...]                Launch isolated Impel Claude Code
@@ -153,8 +154,8 @@ impel app update [target] [--tenant <org>]   Refresh that tenant's apps, configs
 impel app refresh [target] [--tenant <org>]  Configs/catalog/skills only; safe while apps run
                                              (--stale-only: no-op unless 6h+ since last sync)
 impel app status [target] [--tenant <org>]   Show tenant launcher/vendor status
-impel app open [target] [--tenant <org>]     Launch isolated instances (fast path: opens
-                                             immediately when nothing changed since last open;
+impel app open [target] [--tenant <org>]     Install/configure a tenant on first use, then launch
+                                             it (later opens are immediate when nothing changed;
                                              a detached stale-only refresh keeps things current)
 impel app uninstall [target] [--tenant <org>] [--keep-data]
                                              Remove one tenant's Impel-managed app files
@@ -186,7 +187,7 @@ Stores your PAT, gateway base URL, and app/control-plane URL in `~/.config/impel
 impel auth --pat impel_pat_xxxxxxxxxxxx --gateway https://gateway.useimpel.com --app https://www.useimpel.com
 ```
 
-### `impel pat create ...`  (alias `impel pat mint ...`)
+### `impel pat create ...` / `impel pat revoke ...`
 
 Mints a new PAT through the app/control-plane API, authenticated by the PAT
 already stored by `impel auth`. Identity remains the minting authority: the
@@ -215,6 +216,20 @@ the config file. To rotate this CLI onto it, explicitly run
 `impel auth --pat <new-pat>` after copying it. `--json` includes the raw secret,
 so treat redirected output as a credential.
 
+Revoke a token by the token ID printed when it was created:
+
+```sh
+impel pat revoke personal1 --yes
+impel pat revoke personal1 --yes --json
+```
+
+Revocation is immediate and irreversible, so `--yes` is required. A full PAT is
+also accepted for recovery from older mint output, but using the token ID avoids
+putting a secret in shell history. The CLI extracts the ID without echoing the
+secret, authenticates with the currently stored PAT, and leaves the local config
+unchanged. If you revoke the stored PAT itself, authenticate again with a live PAT
+before running another protected command.
+
 ### `impel update`
 
 One command brings everything current, in dependency order: the CLI itself
@@ -277,9 +292,13 @@ On macOS, desktop app state is isolated under
 bundles in `~/Applications`, with names such as `Impel Claude (Acme)` and
 `Impel ChatGPT (Acme)`, stable tenant-specific bundle identifiers, and fixed
 tenant profile/auth paths. Different tenants can stay open concurrently.
-`impel app open --tenant <org>` refreshes and launches a tenant directly without
-changing the globally selected tenant. Switching tenants never deletes local
-history or projects; each tenant's preserved profile reopens independently.
+`impel app open --tenant <org>` installs and configures a missing tenant variant
+on first use, then launches it directly without changing the globally selected
+tenant. Later opens use the existing isolated app and profile. Switching tenants
+never deletes local history or projects; each tenant's preserved profile reopens
+independently. The first-use setup still requires an authenticated user PAT and
+live membership in the requested organization; it does not create a PAT per
+tenant.
 Windows Claude Desktop keeps each
 tenant under `%LOCALAPPDATA%\Claude-3p\Impel\<org>` and launches the unchanged
 signed vendor executable with that profile selected. Windows ChatGPT keeps its
@@ -445,8 +464,9 @@ the selected tenant's 3P gateway configuration beneath Anthropic's reserved
 normal Claude profile unchanged. `impel app install codex` installs/updates
 OpenAI's `OpenAI.Codex` Store package, stages its unchanged signed app payload
 inside Impel's shared app cache, and writes separate Codex and Chromium
-profiles. `impel app open claude` and `impel app open codex` launch those
-isolated profiles without changing either normal vendor profile.
+profiles. `impel app open claude` and `impel app open codex` install a missing
+official app and configure the selected tenant on first use, then launch the
+isolated profile without changing either normal vendor profile.
 
 For Claude, the Impel PAT is supplied only to the launched child process as an
 authentication token and disappears when that process exits; it is never
@@ -587,10 +607,8 @@ Codex CLI and the Codex IDE extension / desktop app share the same
 ### Windows Claude and ChatGPT Desktop
 
 ```powershell
-impel app install claude
 impel app open claude
 impel app status claude
-impel app install codex
 impel app open codex
 impel app status codex
 ```
@@ -615,7 +633,8 @@ app-target names.
 
 ### macOS Claude and ChatGPT
 
-`impel app install` creates tenant-specific apps such as
+The first `impel app open --tenant <org>` (or an explicit `impel app install`)
+creates tenant-specific apps such as
 `Impel Claude (acme).app` and `Impel ChatGPT (acme).app` in `~/Applications`.
 Their visible bundle names use the organization display name, for example
 `Impel Claude (Acme)` and `Impel ChatGPT (Acme)`. Each tenant/product pair has
@@ -642,11 +661,10 @@ a stable, unique bundle identifier and gateway configuration:
 - Neither app changes `~/.claude`, `~/.claude.json`, `~/.codex`, or the
   normal vendor app's browser/profile data.
 
-Install or open several tenants without changing the current selection:
+Open several tenants without changing the current selection. A missing variant
+is installed and configured automatically before it opens:
 
 ```sh
-impel app install all --tenant acme
-impel app install all --tenant globex
 impel app open all --tenant acme
 impel app open all --tenant globex
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -29,7 +29,7 @@ Get started:
 Run:
   impel claude [args...]                      Launch Claude Code with an isolated Impel profile
   impel codex [args...]                       Launch Codex with an isolated Impel profile
-  impel app open [target] [--tenant <org>]    Open that tenant's isolated desktop app(s)
+  impel app open [target] [--tenant <org>]    Install/configure on first use, then open the app(s)
   impel status                                Tenant, PAT, per-tool mode, gateway reachability
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
 
@@ -37,6 +37,7 @@ Manage:
   impel auth [--pat <pat>]                    Store your PAT + URLs (--gateway/--app <url>)
   impel pat create --label <label>            Mint a personal PAT (--org/--scopes/--ttl-days)
   impel pat create --agent <agent-id>         Mint an org-scoped PAT associated with an agent
+  impel pat revoke <token-id> --yes           Irreversibly revoke one of your PATs
   impel tenant list|current|use <org>         List or select the active organization
   impel tasks list|get|create|update|delete   CRUD Impel tickets (aliases: task, ticket[s])
   impel token [--tenant <org>]                Print the selected-tenant bearer

package/src/commands/apps.js

@@ -207,13 +207,26 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       claudeUserData: actionUserData,
       tenantName: config.tenantName,
     });
+    const profileWasInstalled = {
+      claude: fs.existsSync(path.join(
+        actionPaths.claude.userData,
+        "configLibrary",
+        `${CLAUDE_CONFIG_ID}.json`,
+      )),
+      chatgpt: fs.existsSync(path.join(actionPaths.chatgpt.codexHome, "config.toml")),
+    };
     const vendorPaths = {};
     for (const target of targets) {
       const isClaude = target === "claude";
       const find = isClaude ? io.findClaudeApp : io.findChatGPTApp;
       const ensure = isClaude ? io.ensureClaudeApp : io.ensureChatGPTApp;
       let binary = find(io.environment);
-      if ((action === "install" || action === "update") && !flags["skip-vendor"]) {
+      const shouldEnsureVendor = !flags["skip-vendor"] && (
+        action === "install"
+        || action === "update"
+        || (action === "open" && !binary)
+      );
+      if (shouldEnsureVendor) {
         const vendor = ensure({ update: action === "update" }, { environment: io.environment });
         binary = vendor.binary;
         console.log(`${target}: vendor app ${vendor.action}`);
@@ -252,9 +265,12 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       claudeUserData: userData,
       tenantName: config.tenantName,
     });
-    if (action === "install" || action === "update" || action === "refresh") {
-      const verb = action === "install" ? "Installed" : action === "update" ? "Updated" : "Refreshed";
-      for (const target of targets) {
+    const configuredTargets = action === "open"
+      ? targets.filter((target) => !profileWasInstalled[target])
+      : targets;
+    if (action === "install" || action === "update" || action === "refresh" || configuredTargets.length > 0) {
+      const verb = action === "update" ? "Updated" : action === "refresh" ? "Refreshed" : "Installed";
+      for (const target of configuredTargets) {
         const profile = target === "claude" ? tenantPaths.claude.userData : tenantPaths.chatgpt.root;
         console.log(`${verb} Impel ${target === "claude" ? "Claude" : "ChatGPT"} profile at ${profile}`);
         const { client, env, label } = appSkillTarget(target, tenantPaths);
@@ -358,43 +374,12 @@ export async function cmdApps(argv, overrides = {}) {
 
     const config = await selectedAppConfig(targets, flags.tenant || null);
     const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
-    const legacyPaths = appPaths(os.homedir());
-    for (const status of statuses) {
-      if (!status.launcherInstalled && !fs.existsSync(legacyPaths[status.target].launcher)) {
-        throw new Error(`${status.label} is not installed; run \`impel app install ${status.target}\``);
-      }
-      if (!status.vendorPath) throw new Error(`${status.label} vendor app is unavailable; reinstall the vendor app first`);
-    }
-    let catalog;
-    try {
-      catalog = await fetchGatewayModels(config);
-    } catch (error) {
-      throw new Error(
-        `tenant model catalog is unavailable (${redactSecretText(error.message)}); the selected tenant app was not opened`,
-      );
-    }
-    // Only stale bundles pay the clone + codesign rebuild; a bundle swap needs
-    // its app closed, and quitting is fine here since we relaunch right after.
-    const staleBundleTargets = statuses
-      .filter((status) => !bundleIsCurrent(status))
-      .map((status) => status.target);
-    if (staleBundleTargets.length > 0) {
-      await quitBlockingApps(staleBundleTargets, {
-        tenantId: config.tenantId,
-        tenantName: config.tenantName,
-      });
-    }
-    installManagedAppFiles({
+    await provisionAndOpenManagedApps({
       config,
       targets,
-      models: catalog.models,
+      statuses,
       homeDir: os.homedir(),
-      vendorPaths: Object.fromEntries(statuses.map((status) => [status.target, status.vendorPath])),
-      writeBundles: staleBundleTargets,
     });
-    for (const status of appStatus(targets, os.homedir(), config.tenantId, config.tenantName)) {
-      spawnSync("/usr/bin/open", ["-n", status.launcher], { stdio: "inherit" });
-    }
     return;
   }
   if (action !== "install" && action !== "update") {
@@ -445,6 +430,99 @@ export async function cmdApps(argv, overrides = {}) {
   }
 }
 
+/**
+ * Complete the slow `app open` path. A first open is intentionally equivalent
+ * to an install for the selected tenant: verify or install the pinned vendor,
+ * build the isolated bundle/profile, sync skills, and only then launch it.
+ * Existing current installs never reach this helper because fastOpenLaunchers
+ * handles them without network or rebuild work.
+ */
+export async function provisionAndOpenManagedApps({
+  config,
+  targets,
+  statuses,
+  homeDir = os.homedir(),
+}, overrides = {}) {
+  const io = {
+    fetchModels: fetchGatewayModels,
+    ensureVendor: ensureVendorApp,
+    bundleCurrent: bundleIsCurrent,
+    quitApps: quitBlockingApps,
+    installFiles: installManagedAppFiles,
+    syncSkills: syncSkillsSafe,
+    secureCodexHome: secureManagedCodexHome,
+    openLauncher: (launcher) => spawnSync("/usr/bin/open", ["-n", launcher], { stdio: "inherit" }),
+    log: (message) => console.log(message),
+    ...overrides,
+  };
+
+  // Resolve the live tenant catalog before installing or changing anything.
+  // This keeps unavailable/unauthorized tenants fail-closed on first use.
+  let catalog;
+  try {
+    catalog = await io.fetchModels(config);
+  } catch (error) {
+    throw new Error(
+      `tenant model catalog is unavailable (${redactSecretText(error?.message || error)}); the selected tenant app was not opened`,
+    );
+  }
+
+  const vendorPaths = {};
+  for (const status of statuses) {
+    let vendorPath = status.vendorPath;
+    if (!vendorPath) {
+      const result = io.ensureVendor(status.target, { homeDir });
+      vendorPath = result.path;
+      io.log(`${status.target}: vendor app ${result.action}${result.note ? ` (${result.note})` : ""}`);
+      if (!vendorPath) {
+        throw new Error(`${status.target} verified vendor app is unavailable; retry the pinned download`);
+      }
+    }
+    vendorPaths[status.target] = vendorPath;
+  }
+
+  // Only stale or absent bundles pay the clone + codesign rebuild. The model
+  // catalog and vendor checks above finish before any running apps are closed.
+  const staleBundleTargets = statuses
+    .filter((status) => !io.bundleCurrent(status))
+    .map((status) => status.target);
+  if (staleBundleTargets.length > 0) {
+    await io.quitApps(staleBundleTargets, {
+      tenantId: config.tenantId,
+      tenantName: config.tenantName,
+    });
+  }
+
+  const installed = io.installFiles({
+    config,
+    targets,
+    models: catalog.models,
+    homeDir,
+    vendorPaths,
+    writeBundles: staleBundleTargets,
+  });
+  const newlyInstalled = new Set(
+    statuses.filter((status) => !status.launcherInstalled).map((status) => status.target),
+  );
+  for (const item of installed) {
+    if (newlyInstalled.has(item.target)) {
+      io.log(`Installed and configured ${item.launcher} for tenant ${config.tenantId}.`);
+    }
+  }
+
+  // Match explicit install setup without penalizing repeat opens: this helper
+  // only runs when the zero-network fast path has detected drift or first use.
+  const paths = appPaths(homeDir, config.tenantId, { tenantName: config.tenantName });
+  const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
+  for (const item of installed) {
+    const { client, env, label } = appSkillTarget(item.target, paths);
+    await io.syncSkills({ client, gatewayUrl, env, label });
+    if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
+  }
+  for (const item of installed) await io.openLauncher(item.launcher);
+  return installed;
+}
+
 const REFRESH_TTL_MS = 6 * 60 * 60 * 1000;
 
 /**

package/src/commands/pat.js

@@ -16,8 +16,9 @@ import {
 const AGENT_PAT_LABEL_PREFIX = "Agent · ";
 const MAX_PAT_LABEL_LENGTH = 120;
 const MAX_PAT_TTL_DAYS = 365;
-const PAT_CREATE_PATH = "/api/cli/pats";
+const PAT_COLLECTION_PATH = "/api/cli/pats";
 const PAT_TOKEN_RE = /^impel_pat_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
+const PAT_TOKEN_INPUT_RE = /^impel_pat_([A-Za-z0-9_-]{8,128})\.[A-Za-z0-9_-]+$/u;
 const PAT_TOKEN_ID_RE = /^[A-Za-z0-9_-]{8,128}$/u;
 const AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,111}$/u;
 const CONTROL_CHARACTER_RE = /[\u0000-\u001F\u007F-\u009F]/u;
@@ -33,13 +34,28 @@ const FLAG_NAMES = new Set([
   "scopes",
   "tenant",
   "ttl-days",
+  "yes",
 ]);
 
-const HELP = `impel pat - mint a personal access token through Impel
+const CREATE_FLAG_NAMES = new Set([
+  "agent",
+  "app",
+  "help",
+  "json",
+  "label",
+  "org",
+  "scopes",
+  "tenant",
+  "ttl-days",
+]);
+const REVOKE_FLAG_NAMES = new Set(["app", "help", "json", "yes"]);
+
+const HELP = `impel pat - manage personal access tokens through Impel
 
 Usage:
   impel pat create --label <label> [options]
   impel pat create --agent <agent-id> [options]
+  impel pat revoke <token-id> --yes [options]
 
 Aliases:
   impel pats ...
@@ -52,11 +68,13 @@ Options:
                        Defaults are chosen by the control plane for your access tier.
   --ttl-days <days>    Expiry from 1 to ${MAX_PAT_TTL_DAYS} days. Default: 90.
   --app <url>          Override the app/control-plane URL for this command.
-  --json               Print the created PAT and metadata as JSON.
+  --json               Print the result as JSON.
+  --yes                Confirm irreversible PAT revocation.
 
 The stored PAT authenticates this request. The control plane verifies the owner,
 organization membership, requested scopes, and agent access before identity mints
-the new secret. The new PAT is shown once and is not stored automatically.
+the new secret or revokes the selected token. New PATs are shown once and are not
+stored automatically. Revoke accepts a token id or a full PAT and never echoes a secret.
 `;
 
 class PatCommandError extends Error {}
@@ -76,9 +94,17 @@ function flagSpec() {
     scopes: { type: "string" },
     tenant: { type: "string" },
     "ttl-days": { type: "string" },
+    yes: { type: "boolean" },
   };
 }
 
+function rejectUnsupportedFlags(flags, allowed, action) {
+  const unsupported = Object.keys(flags).find((name) => !allowed.has(name));
+  if (unsupported) {
+    fail(`impel pat ${action}: option --${redactSecretText(unsupported)} is not supported.`);
+  }
+}
+
 function requireConfig(flags) {
   const config = loadConfig();
   if (!config?.pat) {
@@ -135,6 +161,18 @@ function requestedTtlDays(value) {
   return days;
 }
 
+function requestedTokenId(value) {
+  if (value === undefined) {
+    fail("impel pat revoke: missing token id.");
+  }
+  const requested = String(value).trim();
+  const tokenId = PAT_TOKEN_INPUT_RE.exec(requested)?.[1] || requested;
+  if (!PAT_TOKEN_ID_RE.test(tokenId)) {
+    fail("impel pat revoke: expected a valid token id or full Impel PAT.");
+  }
+  return tokenId;
+}
+
 function requestedSubject(flags) {
   const agentId = flags.agent === undefined ? null : String(flags.agent).trim();
   const personalLabel = flags.label === undefined ? null : String(flags.label).trim();
@@ -215,19 +253,19 @@ function normalizeCreatedPat(payload, expected) {
   };
 }
 
-async function createPat({ appUrl, currentPat, body }) {
+async function requestControlPlane({ appUrl, currentPat, path, method, body, feature }) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 10_000);
   let response;
   try {
-    response = await fetch(new URL(PAT_CREATE_PATH, appUrl), {
-      method: "POST",
+    response = await fetch(new URL(path, appUrl), {
+      method,
       headers: {
         accept: "application/json",
         authorization: `Bearer ${currentPat}`,
-        "content-type": "application/json",
+        ...(body === undefined ? {} : { "content-type": "application/json" }),
       },
-      body: JSON.stringify(body),
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
       signal: controller.signal,
     });
   } catch (error) {
@@ -245,13 +283,24 @@ async function createPat({ appUrl, currentPat, body }) {
     payload = null;
   }
   if (!response.ok) {
-    if (response.status === 404) {
-      fail(`impel pat: PAT minting is not available on ${appUrl}; update the Impel control plane and try again.`);
+    if (response.status === 404 && !payload?.error) {
+      fail(`impel pat: PAT ${feature} is not available on ${appUrl}; update the Impel control plane and try again.`);
     }
     const message = redactSecretText(payload?.error || `${response.status} ${response.statusText}`.trim());
     fail(`impel pat: ${message}`);
   }
+  return payload;
+}
 
+async function createPat({ appUrl, currentPat, body }) {
+  const payload = await requestControlPlane({
+    appUrl,
+    currentPat,
+    path: PAT_COLLECTION_PATH,
+    method: "POST",
+    body,
+    feature: "minting",
+  });
   const created = normalizeCreatedPat(payload, body);
   if (!created) {
     fail("impel pat: the control plane returned an invalid PAT creation response; the secret was not displayed.");
@@ -259,6 +308,17 @@ async function createPat({ appUrl, currentPat, body }) {
   return created;
 }
 
+async function revokePat({ appUrl, currentPat, tokenId }) {
+  await requestControlPlane({
+    appUrl,
+    currentPat,
+    path: `${PAT_COLLECTION_PATH}/${encodeURIComponent(tokenId)}`,
+    method: "DELETE",
+    feature: "revocation",
+  });
+  return { revoked: true, tokenId };
+}
+
 function printCreatedPat(created, subject, json) {
   if (json) {
     console.log(JSON.stringify({
@@ -274,6 +334,7 @@ function printCreatedPat(created, subject, json) {
   } else {
     console.log(`Created personal PAT ${JSON.stringify(created.label)} in ${created.orgId}.`);
   }
+  console.log(`Token ID: ${created.tokenId}`);
   console.log(`Scopes:  ${created.scopes.join(", ") || "none"}`);
   console.log(`Expires: ${created.expiresAt === null ? "never" : new Date(created.expiresAt).toISOString()}`);
   console.log("");
@@ -281,15 +342,23 @@ function printCreatedPat(created, subject, json) {
   console.log(created.token);
 }
 
+function printRevokedPat(revoked, json) {
+  if (json) {
+    console.log(JSON.stringify(revoked, null, 2));
+    return;
+  }
+  console.log(`Revoked PAT ${revoked.tokenId}.`);
+}
+
 export async function cmdPat(argv) {
   const [action, ...rest] = argv;
   if (!action || action === "help" || action === "--help" || action === "-h") {
     console.log(HELP);
     return;
   }
-  if (action !== "create" && action !== "mint") {
+  if (action !== "create" && action !== "mint" && action !== "revoke") {
     console.error(`impel pat: unknown subcommand "${redactSecretText(action)}".`);
-    console.error("  Use `impel pat create --label <label>` or `impel pat create --agent <agent-id>`.");
+    console.error("  Use `impel pat create --label <label>`, `impel pat create --agent <agent-id>`, or `impel pat revoke <token-id> --yes`.");
     process.exitCode = 1;
     return;
   }
@@ -302,6 +371,23 @@ export async function cmdPat(argv) {
     }
     const unknownFlag = Object.keys(flags).find((name) => !FLAG_NAMES.has(name));
     if (unknownFlag) fail(`impel pat: unknown option --${redactSecretText(unknownFlag)}.`);
+
+    if (action === "revoke") {
+      rejectUnsupportedFlags(flags, REVOKE_FLAG_NAMES, "revoke");
+      const tokenId = requestedTokenId(positionals[0]);
+      if (positionals.length > 1) {
+        fail(`impel pat revoke: unexpected argument "${redactSecretText(positionals[1])}".`);
+      }
+      if (flags.yes !== true) {
+        fail("impel pat revoke: refusing to revoke without --yes.");
+      }
+      const { appUrl, config } = requireConfig(flags);
+      const revoked = await revokePat({ appUrl, currentPat: config.pat, tokenId });
+      printRevokedPat(revoked, flags.json === true);
+      return;
+    }
+
+    rejectUnsupportedFlags(flags, CREATE_FLAG_NAMES, "create");
     if (positionals.length > 0) {
       fail(`impel pat create: unexpected argument "${redactSecretText(positionals[0])}".`);
     }