impel-cli 0.9.1 → 0.9.2

package/README.md

@@ -154,8 +154,8 @@ impel app update [target] [--tenant <org>]   Refresh that tenant's apps, configs
 impel app refresh [target] [--tenant <org>]  Configs/catalog/skills only; safe while apps run
                                              (--stale-only: no-op unless 6h+ since last sync)
 impel app status [target] [--tenant <org>]   Show tenant launcher/vendor status
-impel app open [target] [--tenant <org>]     Launch isolated instances (fast path: opens
-                                             immediately when nothing changed since last open;
+impel app open [target] [--tenant <org>]     Install/configure a tenant on first use, then launch
+                                             it (later opens are immediate when nothing changed;
                                              a detached stale-only refresh keeps things current)
 impel app uninstall [target] [--tenant <org>] [--keep-data]
                                              Remove one tenant's Impel-managed app files
@@ -292,9 +292,13 @@ On macOS, desktop app state is isolated under
 bundles in `~/Applications`, with names such as `Impel Claude (Acme)` and
 `Impel ChatGPT (Acme)`, stable tenant-specific bundle identifiers, and fixed
 tenant profile/auth paths. Different tenants can stay open concurrently.
-`impel app open --tenant <org>` refreshes and launches a tenant directly without
-changing the globally selected tenant. Switching tenants never deletes local
-history or projects; each tenant's preserved profile reopens independently.
+`impel app open --tenant <org>` installs and configures a missing tenant variant
+on first use, then launches it directly without changing the globally selected
+tenant. Later opens use the existing isolated app and profile. Switching tenants
+never deletes local history or projects; each tenant's preserved profile reopens
+independently. The first-use setup still requires an authenticated user PAT and
+live membership in the requested organization; it does not create a PAT per
+tenant.
 Windows Claude Desktop keeps each
 tenant under `%LOCALAPPDATA%\Claude-3p\Impel\<org>` and launches the unchanged
 signed vendor executable with that profile selected. Windows ChatGPT keeps its
@@ -460,8 +464,9 @@ the selected tenant's 3P gateway configuration beneath Anthropic's reserved
 normal Claude profile unchanged. `impel app install codex` installs/updates
 OpenAI's `OpenAI.Codex` Store package, stages its unchanged signed app payload
 inside Impel's shared app cache, and writes separate Codex and Chromium
-profiles. `impel app open claude` and `impel app open codex` launch those
-isolated profiles without changing either normal vendor profile.
+profiles. `impel app open claude` and `impel app open codex` install a missing
+official app and configure the selected tenant on first use, then launch the
+isolated profile without changing either normal vendor profile.
 
 For Claude, the Impel PAT is supplied only to the launched child process as an
 authentication token and disappears when that process exits; it is never
@@ -602,10 +607,8 @@ Codex CLI and the Codex IDE extension / desktop app share the same
 ### Windows Claude and ChatGPT Desktop
 
 ```powershell
-impel app install claude
 impel app open claude
 impel app status claude
-impel app install codex
 impel app open codex
 impel app status codex
 ```
@@ -630,7 +633,8 @@ app-target names.
 
 ### macOS Claude and ChatGPT
 
-`impel app install` creates tenant-specific apps such as
+The first `impel app open --tenant <org>` (or an explicit `impel app install`)
+creates tenant-specific apps such as
 `Impel Claude (acme).app` and `Impel ChatGPT (acme).app` in `~/Applications`.
 Their visible bundle names use the organization display name, for example
 `Impel Claude (Acme)` and `Impel ChatGPT (Acme)`. Each tenant/product pair has
@@ -657,11 +661,10 @@ a stable, unique bundle identifier and gateway configuration:
 - Neither app changes `~/.claude`, `~/.claude.json`, `~/.codex`, or the
   normal vendor app's browser/profile data.
 
-Install or open several tenants without changing the current selection:
+Open several tenants without changing the current selection. A missing variant
+is installed and configured automatically before it opens:
 
 ```sh
-impel app install all --tenant acme
-impel app install all --tenant globex
 impel app open all --tenant acme
 impel app open all --tenant globex
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -29,7 +29,7 @@ Get started:
 Run:
   impel claude [args...]                      Launch Claude Code with an isolated Impel profile
   impel codex [args...]                       Launch Codex with an isolated Impel profile
-  impel app open [target] [--tenant <org>]    Open that tenant's isolated desktop app(s)
+  impel app open [target] [--tenant <org>]    Install/configure on first use, then open the app(s)
   impel status                                Tenant, PAT, per-tool mode, gateway reachability
   impel doctor [--tenant <org>|--all-tenants] Synthetic provider, routing, and latency checks
 

package/src/commands/apps.js

@@ -207,13 +207,26 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       claudeUserData: actionUserData,
       tenantName: config.tenantName,
     });
+    const profileWasInstalled = {
+      claude: fs.existsSync(path.join(
+        actionPaths.claude.userData,
+        "configLibrary",
+        `${CLAUDE_CONFIG_ID}.json`,
+      )),
+      chatgpt: fs.existsSync(path.join(actionPaths.chatgpt.codexHome, "config.toml")),
+    };
     const vendorPaths = {};
     for (const target of targets) {
       const isClaude = target === "claude";
       const find = isClaude ? io.findClaudeApp : io.findChatGPTApp;
       const ensure = isClaude ? io.ensureClaudeApp : io.ensureChatGPTApp;
       let binary = find(io.environment);
-      if ((action === "install" || action === "update") && !flags["skip-vendor"]) {
+      const shouldEnsureVendor = !flags["skip-vendor"] && (
+        action === "install"
+        || action === "update"
+        || (action === "open" && !binary)
+      );
+      if (shouldEnsureVendor) {
         const vendor = ensure({ update: action === "update" }, { environment: io.environment });
         binary = vendor.binary;
         console.log(`${target}: vendor app ${vendor.action}`);
@@ -252,9 +265,12 @@ export async function cmdWindowsApps(argv, overrides = {}) {
       claudeUserData: userData,
       tenantName: config.tenantName,
     });
-    if (action === "install" || action === "update" || action === "refresh") {
-      const verb = action === "install" ? "Installed" : action === "update" ? "Updated" : "Refreshed";
-      for (const target of targets) {
+    const configuredTargets = action === "open"
+      ? targets.filter((target) => !profileWasInstalled[target])
+      : targets;
+    if (action === "install" || action === "update" || action === "refresh" || configuredTargets.length > 0) {
+      const verb = action === "update" ? "Updated" : action === "refresh" ? "Refreshed" : "Installed";
+      for (const target of configuredTargets) {
         const profile = target === "claude" ? tenantPaths.claude.userData : tenantPaths.chatgpt.root;
         console.log(`${verb} Impel ${target === "claude" ? "Claude" : "ChatGPT"} profile at ${profile}`);
         const { client, env, label } = appSkillTarget(target, tenantPaths);
@@ -358,43 +374,12 @@ export async function cmdApps(argv, overrides = {}) {
 
     const config = await selectedAppConfig(targets, flags.tenant || null);
     const statuses = appStatus(targets, os.homedir(), config.tenantId, config.tenantName);
-    const legacyPaths = appPaths(os.homedir());
-    for (const status of statuses) {
-      if (!status.launcherInstalled && !fs.existsSync(legacyPaths[status.target].launcher)) {
-        throw new Error(`${status.label} is not installed; run \`impel app install ${status.target}\``);
-      }
-      if (!status.vendorPath) throw new Error(`${status.label} vendor app is unavailable; reinstall the vendor app first`);
-    }
-    let catalog;
-    try {
-      catalog = await fetchGatewayModels(config);
-    } catch (error) {
-      throw new Error(
-        `tenant model catalog is unavailable (${redactSecretText(error.message)}); the selected tenant app was not opened`,
-      );
-    }
-    // Only stale bundles pay the clone + codesign rebuild; a bundle swap needs
-    // its app closed, and quitting is fine here since we relaunch right after.
-    const staleBundleTargets = statuses
-      .filter((status) => !bundleIsCurrent(status))
-      .map((status) => status.target);
-    if (staleBundleTargets.length > 0) {
-      await quitBlockingApps(staleBundleTargets, {
-        tenantId: config.tenantId,
-        tenantName: config.tenantName,
-      });
-    }
-    installManagedAppFiles({
+    await provisionAndOpenManagedApps({
       config,
       targets,
-      models: catalog.models,
+      statuses,
       homeDir: os.homedir(),
-      vendorPaths: Object.fromEntries(statuses.map((status) => [status.target, status.vendorPath])),
-      writeBundles: staleBundleTargets,
     });
-    for (const status of appStatus(targets, os.homedir(), config.tenantId, config.tenantName)) {
-      spawnSync("/usr/bin/open", ["-n", status.launcher], { stdio: "inherit" });
-    }
     return;
   }
   if (action !== "install" && action !== "update") {
@@ -445,6 +430,99 @@ export async function cmdApps(argv, overrides = {}) {
   }
 }
 
+/**
+ * Complete the slow `app open` path. A first open is intentionally equivalent
+ * to an install for the selected tenant: verify or install the pinned vendor,
+ * build the isolated bundle/profile, sync skills, and only then launch it.
+ * Existing current installs never reach this helper because fastOpenLaunchers
+ * handles them without network or rebuild work.
+ */
+export async function provisionAndOpenManagedApps({
+  config,
+  targets,
+  statuses,
+  homeDir = os.homedir(),
+}, overrides = {}) {
+  const io = {
+    fetchModels: fetchGatewayModels,
+    ensureVendor: ensureVendorApp,
+    bundleCurrent: bundleIsCurrent,
+    quitApps: quitBlockingApps,
+    installFiles: installManagedAppFiles,
+    syncSkills: syncSkillsSafe,
+    secureCodexHome: secureManagedCodexHome,
+    openLauncher: (launcher) => spawnSync("/usr/bin/open", ["-n", launcher], { stdio: "inherit" }),
+    log: (message) => console.log(message),
+    ...overrides,
+  };
+
+  // Resolve the live tenant catalog before installing or changing anything.
+  // This keeps unavailable/unauthorized tenants fail-closed on first use.
+  let catalog;
+  try {
+    catalog = await io.fetchModels(config);
+  } catch (error) {
+    throw new Error(
+      `tenant model catalog is unavailable (${redactSecretText(error?.message || error)}); the selected tenant app was not opened`,
+    );
+  }
+
+  const vendorPaths = {};
+  for (const status of statuses) {
+    let vendorPath = status.vendorPath;
+    if (!vendorPath) {
+      const result = io.ensureVendor(status.target, { homeDir });
+      vendorPath = result.path;
+      io.log(`${status.target}: vendor app ${result.action}${result.note ? ` (${result.note})` : ""}`);
+      if (!vendorPath) {
+        throw new Error(`${status.target} verified vendor app is unavailable; retry the pinned download`);
+      }
+    }
+    vendorPaths[status.target] = vendorPath;
+  }
+
+  // Only stale or absent bundles pay the clone + codesign rebuild. The model
+  // catalog and vendor checks above finish before any running apps are closed.
+  const staleBundleTargets = statuses
+    .filter((status) => !io.bundleCurrent(status))
+    .map((status) => status.target);
+  if (staleBundleTargets.length > 0) {
+    await io.quitApps(staleBundleTargets, {
+      tenantId: config.tenantId,
+      tenantName: config.tenantName,
+    });
+  }
+
+  const installed = io.installFiles({
+    config,
+    targets,
+    models: catalog.models,
+    homeDir,
+    vendorPaths,
+    writeBundles: staleBundleTargets,
+  });
+  const newlyInstalled = new Set(
+    statuses.filter((status) => !status.launcherInstalled).map((status) => status.target),
+  );
+  for (const item of installed) {
+    if (newlyInstalled.has(item.target)) {
+      io.log(`Installed and configured ${item.launcher} for tenant ${config.tenantId}.`);
+    }
+  }
+
+  // Match explicit install setup without penalizing repeat opens: this helper
+  // only runs when the zero-network fast path has detected drift or first use.
+  const paths = appPaths(homeDir, config.tenantId, { tenantName: config.tenantName });
+  const gatewayUrl = resolveSkillsGateway(config.gatewayUrl);
+  for (const item of installed) {
+    const { client, env, label } = appSkillTarget(item.target, paths);
+    await io.syncSkills({ client, gatewayUrl, env, label });
+    if (item.target === "chatgpt") io.secureCodexHome(paths.chatgpt.codexHome);
+  }
+  for (const item of installed) await io.openLauncher(item.launcher);
+  return installed;
+}
+
 const REFRESH_TTL_MS = 6 * 60 * 60 * 1000;
 
 /**