impel-cli 0.19.3 → 0.20.0-beta.0

package/README.md

@@ -228,6 +228,30 @@ impel remote dispatch --provider claude --session <session-id> --fork
 impel remote dispatch --provider codex --session <session-id> --fork
 ```
 
+The installable `remote-control` skill turns this into an in-app handoff. Ask
+Claude Code or Codex to run the current session remotely, or invoke the skill
+directly, and it resolves the current Claude session/Codex thread id before
+running:
+
+```sh
+impel remote handoff . --provider <codex|claude> --session <session-id>
+```
+
+Unlike `up` or `dispatch`, `handoff` launches a detached headless worker inside
+Fargate and follows the provider's structured event stream. Inference, tools,
+commands, and edits execute in the runner; the local app only displays the
+stream. Normal completion stops the task, revokes its disposable PAT, and
+removes its SSH alias. To let the task continue without keeping the stream
+open, add `--detach`, then reconnect later:
+
+```sh
+impel remote follow <run-id>
+```
+
+If the viewer disconnects, the detached worker keeps running and its normal
+session hooks continue syncing the remote transcript to `impel-sessions`. The
+task TTL remains the fallback stop and credential-revocation boundary.
+
 Remote vendor commands run in dangerous/bypass mode as the unprivileged
 `agent` user; the disposable Fargate task is the isolation boundary. Existing
 Impel lifecycle hooks continue mirroring remote transcripts to
@@ -326,6 +350,37 @@ impel tasks delete IMP-123 --yes
 Use `--json` when exact machine-readable fields matter. Gateway-only members
 cannot use task CRUD.
 
+### Native Tasks MCP App
+
+Setup and update register a second tenant-bound MCP server named
+`impel-tasks` in Impel-managed Claude and Codex/ChatGPT profiles. It is separate
+from the existing `impel` specialist server: removing or disabling Tasks does
+not change specialist routing or approvals.
+
+The managed entry launches an absolute, upgrade-stable invocation equivalent
+to:
+
+```sh
+impel mcp --target tasks --tenant <fixed-tenant>
+```
+
+This is an internal transport command, not an interactive PAT interface. The
+child process reads the PAT from Impel's private config, sends it only as the
+control-plane HTTP bearer credential, and fixes tenant selection in the
+transport header. Generated Claude/Codex MCP entries contain neither the PAT
+nor a tenant-derived credential.
+
+- The pinned Impel Claude Desktop can render the standard MCP Apps Tasks
+  resource when its host supports that protocol.
+- Claude Code and stable Codex receive complete headless task tools and text
+  results; no experimental Codex MCP Apps flag is enabled.
+- Profiles preserve unrelated MCP servers. If a user-authored server already
+  owns the `impel-tasks` name, setup/update fails with remediation instead of
+  overwriting it.
+- The Tasks bridge accepts Streamable HTTP's required JSON/SSE media types but
+  deliberately requires bounded JSON responses from the control plane. It
+  does not establish an SSE session or persist protocol state.
+
 ## PAT lifecycle
 
 Minting and revocation remain explicit account operations:

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "impel-cli",
-  "version": "0.19.3",
+  "version": "0.20.0-beta.0",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
+  "packageManager": "pnpm@11.17.0",
   "bin": {
     "impel": "bin/impel.js"
   },
@@ -19,6 +20,9 @@
   "engines": {
     "node": ">=18.0.0"
   },
+  "scripts": {
+    "test": "node --test"
+  },
   "license": "UNLICENSED",
   "publishConfig": {
     "access": "public",
@@ -27,8 +31,5 @@
   "repository": {
     "type": "git",
     "url": "git+https://github.com/UseImpel/impel-cli.git"
-  },
-  "scripts": {
-    "test": "node --test"
   }
-}
+}

package/src/agents.js

@@ -10,8 +10,24 @@ import os from "node:os";
 import path from "node:path";
 
 import { normalizeGatewayUrl, redactSecretText } from "./config.js";
+import {
+  adapterAnswerHardCompletionGuidance,
+  adapterAnswerSoftCompletionGuidance,
+  claudeAnswerHardCompletionGuidance,
+  claudeAnswerSoftCompletionGuidance,
+  usesDirectAnswer,
+} from "./directAnswer.js";
 import { impelMcpInvocation } from "./selfInvocation.js";
 import { normalizeTenantId } from "./tenants.js";
+import {
+  adapterCallerSpawnGuidance,
+  adapterHardCompletionGuidance,
+  adapterSoftCompletionGuidance,
+  claudeHardCompletionGuidance,
+  claudeSoftCompletionGuidance,
+  customAgentVerbatimDescriptionLead,
+  usesVerbatimRelay,
+} from "./verbatimRelay.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
 
 export const AGENT_SYNC_TTL_MS = 6 * 60 * 60 * 1000;
@@ -20,14 +36,22 @@ export const MANAGED_AGENT_MANIFEST = ".manifest.json";
 export const NATIVE_AGENT_LIST_TOOL = "impel_specialists-list_native_agents";
 export const NATIVE_AGENT_START_TOOL = "impel_specialists-start_native_agent_run";
 export const NATIVE_AGENT_READ_TOOL = "impel_specialists-read_native_agent_run";
+export const NATIVE_AGENT_ANSWER_TOOL = "impel_specialists-answer_native_agent";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 4;
+export const MANAGED_AGENT_MANIFEST_VERSION = 6;
 
-const NATIVE_AGENT_TOOL_NAMES = [
+const NATIVE_AGENT_SESSION_TOOL_NAMES = [
   NATIVE_AGENT_LIST_TOOL,
   NATIVE_AGENT_START_TOOL,
   NATIVE_AGENT_READ_TOOL,
 ];
+
+function nativeAgentToolNames(agent) {
+  return usesDirectAnswer(agent)
+    ? [NATIVE_AGENT_ANSWER_TOOL]
+    : NATIVE_AGENT_SESSION_TOOL_NAMES;
+}
+
 const SAFE_AGENT_ID_RE = /^[A-Za-z0-9_.:-]{1,160}$/u;
 const SAFE_SCOPE_PARAM_RE = /^[A-Za-z0-9_.:-]{1,160}$/u;
 const MAX_CATALOG_ITEMS = 500;
@@ -125,6 +149,12 @@ export function normalizeNativeAgentCatalog(payload, expectedTenantId) {
       throw new Error(`native-agent catalog returned duplicate binding ${binding}`);
     }
     seenBindings.add(binding);
+    if (agent.verbatimRelay !== undefined && typeof agent.verbatimRelay !== "boolean") {
+      throw new Error("native-agent catalog returned an invalid verbatimRelay");
+    }
+    if (agent.directAnswer !== undefined && typeof agent.directAnswer !== "boolean") {
+      throw new Error("native-agent catalog returned an invalid directAnswer");
+    }
     return {
       agentId,
       title: boundedString(agent.title, "title", { max: 160 }),
@@ -135,6 +165,8 @@ export function normalizeNativeAgentCatalog(payload, expectedTenantId) {
       exclusions: stringList(agent.exclusions, "exclusions"),
       requiredContext: stringList(agent.requiredContext, "requiredContext"),
       sideEffects: enumString(agent.sideEffects, "sideEffects", ["read-only", "writes"]),
+      ...(agent.verbatimRelay === true ? { verbatimRelay: true } : {}),
+      ...(agent.directAnswer === true ? { directAnswer: true } : {}),
     };
   });
   return { orgId: tenantId, agents };
@@ -329,14 +361,35 @@ function claudeAdapterInstructions(tenantId, agent) {
   const sideEffectInstruction = agent.sideEffects === "writes"
     ? `The catalog declares that this agent writes user or workspace data. Use this adapter only when the user explicitly selected this exact agent for the current request; that explicit selection is the required side-effect confirmation, so pass confirmedSideEffects true. If the agent was chosen automatically or the selection is ambiguous, do not start it and ask the user to select it explicitly.`
     : `The catalog declares that this agent is read-only; omit confirmedSideEffects.`;
+  const callerSpawnGuidance = usesVerbatimRelay(agent)
+    ? adapterCallerSpawnGuidance("Claude")
+    : null;
+  if (usesDirectAnswer(agent)) {
+    const completionGuidance = usesVerbatimRelay(agent)
+      ? claudeAnswerHardCompletionGuidance()
+      : claudeAnswerSoftCompletionGuidance();
+    return [
+      `You are a thin transport adapter for the exact Impel native agent ${JSON.stringify(agent.agentId)} in tenant ${JSON.stringify(tenantId)}.`,
+      ...(callerSpawnGuidance ? [callerSpawnGuidance] : []),
+      `Do not perform the assigned task yourself, do not delegate to any other agent, and do not call Impel start_native_agent_run or read_native_agent_run.`,
+      `Confirm that the assigned request fits the cataloged capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)} before answering.${contextRequirement}`,
+      sideEffectInstruction,
+      `Call ${toolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with agentId ${JSON.stringify(agent.agentId)}, scopeParam ${JSON.stringify(agent.scopeParam)}, question set to the complete assigned task, optional context set to one string containing all supplied context (omit it when no context was supplied), contextKeys naming the context fields present in that string, and confirmedSideEffects as directed above.`,
+      completionGuidance,
+    ].join(" ");
+  }
+  const completionGuidance = usesVerbatimRelay(agent)
+    ? claudeHardCompletionGuidance()
+    : claudeSoftCompletionGuidance();
   return [
     `You are a thin transport adapter for the exact Impel native agent ${JSON.stringify(agent.agentId)} in tenant ${JSON.stringify(tenantId)}.`,
+    ...(callerSpawnGuidance ? [callerSpawnGuidance] : []),
     `Do not perform the assigned task yourself and do not delegate to any other agent.`,
     `First call ${toolName(NATIVE_AGENT_LIST_TOOL)} and verify that the exact agentId is still available with sideEffects ${JSON.stringify(agent.sideEffects)}. If it is unavailable or its policy excludes the request, stop with that explicit error.`,
     sideEffectInstruction,
     `Call ${toolName(NATIVE_AGENT_START_TOOL)} exactly once with agentId ${JSON.stringify(agent.agentId)}, scopeParam ${JSON.stringify(agent.scopeParam)}, task set to the complete assigned task, optional context set to one string containing all supplied context (omit it when no context was supplied), contextKeys naming the context fields present in that string, confirmedSideEffects as directed above, and one stable idempotencyKey that you reuse for this logical task.${contextRequirement}`,
     `Then call ${toolName(NATIVE_AGENT_READ_TOOL)} with the returned runId and waitSeconds 20 until the run reaches a terminal state.`,
-    `When it succeeds, return result.finalText faithfully as the answer. When it fails, return the durable runId, preserved output, and error. Never invent or independently synthesize a replacement result.`,
+    completionGuidance,
   ].join(" ");
 }
 
@@ -349,7 +402,96 @@ const CODEX_CONTEXT_PLACEHOLDER = "__IMPEL_OPTIONAL_CONTEXT_STRING_OR_NULL_JSON_
 const CODEX_CONTEXT_KEYS_PLACEHOLDER = "__IMPEL_SUPPLIED_CONTEXT_KEYS_JSON__";
 const CODEX_IDEMPOTENCY_KEY_PLACEHOLDER = "__IMPEL_LOGICAL_INVOCATION_IDEMPOTENCY_KEY_JSON__";
 
+function renderCodexDirectAnswerOrchestration(tenantId, agent) {
+  const expectedTenantId = normalizeTenantId(tenantId);
+  const nestedToolName = (toolName) => nativeToolName(toolName).replaceAll("-", "_");
+  const answerTool = nestedToolName(NATIVE_AGENT_ANSWER_TOOL);
+  return [
+    '// @exec: {"yield_time_ms": 30000, "max_output_tokens": 30000}',
+    `const assignedTask = ${CODEX_TASK_PLACEHOLDER};`,
+    `const suppliedContext = ${CODEX_CONTEXT_PLACEHOLDER};`,
+    `const suppliedContextKeys = ${CODEX_CONTEXT_KEYS_PLACEHOLDER};`,
+    `const idempotencyKey = ${CODEX_IDEMPOTENCY_KEY_PLACEHOLDER};`,
+    `const expectedTenantId = ${JSON.stringify(expectedTenantId)};`,
+    `const expectedAgent = ${JSON.stringify(agent)};`,
+    `const answerToolName = ${JSON.stringify(answerTool)};`,
+    "",
+    "function contentText(response) {",
+    '  return response?.content?.find((item) => item?.type === "text" && typeof item.text === "string")?.text;',
+    "}",
+    "",
+    "function toolPayload(response, label) {",
+    '  if (!response || typeof response !== "object") throw new Error(label + " returned no result");',
+    '  if (response.isError) throw new Error(contentText(response) || label + " failed");',
+    '  if (response.structuredContent && typeof response.structuredContent === "object") return response.structuredContent;',
+    "  const serialized = contentText(response);",
+    "  if (serialized !== undefined) {",
+    "    try {",
+    "      return JSON.parse(serialized);",
+    "    } catch {",
+    '      throw new Error(label + " returned invalid JSON");',
+    "    }",
+    "  }",
+    "  return response;",
+    "}",
+    "",
+    "function extractAnswerFinalText(payload) {",
+    '  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;',
+    '  for (const key of ["forUser", "answer"]) {',
+    "    const value = payload[key];",
+    '    if (typeof value === "string" && value.trim()) return value;',
+    "  }",
+    "  return null;",
+    "}",
+    "",
+    "function errorValue(error, fallback) {",
+    "  if (error === undefined || error === null) return fallback;",
+    '  if (error instanceof Error) return error.message;',
+    "  return error;",
+    "}",
+    "",
+    "async function orchestrate() {",
+    "  try {",
+    '    if (typeof assignedTask !== "string" || !assignedTask.trim()) throw new Error("the complete assigned task is required");',
+    '    if (suppliedContext !== null && typeof suppliedContext !== "string") throw new Error("supplied context must be a string or null");',
+    '    if (expectedAgent.requiredContext.length && (typeof suppliedContext !== "string" || !suppliedContext.trim())) {',
+    '      throw new Error("nonblank supplied context is required for required context keys");',
+    "    }",
+    '    if (!Array.isArray(suppliedContextKeys)) throw new Error("supplied context keys must be an array");',
+    "    const missingContext = expectedAgent.requiredContext.filter((key) =>",
+    "      !suppliedContextKeys.includes(key)",
+    "    );",
+    '    if (missingContext.length) throw new Error("missing required context: " + missingContext.join(", "));',
+    "",
+    "    const answerArguments = {",
+    "      agentId: expectedAgent.agentId,",
+    "      scopeParam: expectedAgent.scopeParam,",
+    "      question: assignedTask,",
+    "      contextKeys: suppliedContextKeys,",
+    "    };",
+    "    if (suppliedContext !== null) answerArguments.context = suppliedContext;",
+    '    if (expectedAgent.sideEffects === "writes") answerArguments.confirmedSideEffects = true;',
+    "    const answered = toolPayload(await tools[answerToolName](answerArguments), \"native-agent answer\");",
+    "    const finalText = extractAnswerFinalText(answered);",
+    '    if (typeof finalText !== "string") throw new Error("native-agent answer returned no forUser/answer");',
+    "    text(finalText);",
+    "  } catch (error) {",
+    "    text(JSON.stringify({",
+    '      error: errorValue(error, "native-agent answer adapter failed"),',
+    "      tenantId: expectedTenantId,",
+    "      agentId: expectedAgent.agentId,",
+    "    }));",
+    "  }",
+    "}",
+    "",
+    "await orchestrate();",
+  ].join("\n");
+}
+
 export function renderCodexAdapterOrchestration(tenantId, agent) {
+  if (usesDirectAnswer(agent)) {
+    return renderCodexDirectAnswerOrchestration(tenantId, agent);
+  }
   const expectedTenantId = normalizeTenantId(tenantId);
   const nestedToolName = (toolName) => nativeToolName(toolName).replaceAll("-", "_");
   const listTool = nestedToolName(NATIVE_AGENT_LIST_TOOL);
@@ -494,29 +636,61 @@ function codexAdapterInstructions(tenantId, agent) {
     ? `The catalog declares that this agent writes user or workspace data. Use this adapter only when the user explicitly selected this exact agent for the current request; that explicit selection is the required side-effect confirmation. If the agent was chosen automatically or the selection is ambiguous, do not run the orchestration and ask the user to select this exact agent explicitly.`
     : `The catalog declares that this agent is read-only; the orchestration omits confirmedSideEffects.`;
   const source = renderCodexAdapterOrchestration(tenantId, agent);
+  const callerSpawnGuidance = usesVerbatimRelay(agent)
+    ? adapterCallerSpawnGuidance("Codex")
+    : null;
+  if (usesDirectAnswer(agent)) {
+    const completionGuidance = usesVerbatimRelay(agent)
+      ? adapterAnswerHardCompletionGuidance()
+      : adapterAnswerSoftCompletionGuidance();
+    return [
+      `You are a thin transport adapter for the exact Impel native agent ${JSON.stringify(agent.agentId)} in tenant ${JSON.stringify(tenantId)}.`,
+      ...(callerSpawnGuidance ? [callerSpawnGuidance] : []),
+      `Do not perform the assigned task yourself, do not delegate to any other agent, do not independently synthesize or rewrite the result, and do not call Impel start_native_agent_run or read_native_agent_run.`,
+      `Confirm that the assigned request fits the cataloged capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)} before answering.${contextRequirement}`,
+      sideEffectInstruction,
+      `Invoke functions.exec exactly once for the orchestration below. Do not call the MCP tools directly. Replace ${CODEX_TASK_PLACEHOLDER} with a JSON string literal for the complete assigned task. Replace ${CODEX_CONTEXT_PLACEHOLDER} with one JSON string literal containing all supplied caller context, or with null when no context was supplied; never use an object or array. Replace ${CODEX_CONTEXT_KEYS_PLACEHOLDER} with a JSON array naming the context fields present in that string, or [] when context is absent. Replace ${CODEX_IDEMPOTENCY_KEY_PLACEHOLDER} with one new opaque idempotency key for this logical invocation (unused by the answer tool but kept for adapter parity): choose it exactly once. Then pass the raw JavaScript without Markdown fences.`,
+      `The JavaScript validates required context and calls Impel answer_native_agent exactly once, returning forUser (else answer). If functions.exec yields a running cell, use functions.wait with max_tokens 30000 only to resume that same orchestration; never start another orchestration or open an Impel/Eve session.`,
+      completionGuidance,
+      "",
+      source,
+    ].join("\n\n");
+  }
+  const completionGuidance = usesVerbatimRelay(agent)
+    ? adapterHardCompletionGuidance()
+    : adapterSoftCompletionGuidance();
   return [
     `You are a thin transport adapter for the exact Impel native agent ${JSON.stringify(agent.agentId)} in tenant ${JSON.stringify(tenantId)}.`,
-    `Callers must spawn this explicit custom Codex agent with fork_turns="none" and must relay your result verbatim; this is caller guidance and cannot enforce host spawn behavior.`,
+    ...(callerSpawnGuidance ? [callerSpawnGuidance] : []),
     `Do not perform the assigned task yourself, do not delegate to any other agent, and do not independently synthesize or rewrite the result.`,
     `Confirm that the assigned request fits the cataloged capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)} before starting.${contextRequirement}`,
     sideEffectInstruction,
     `Invoke functions.exec exactly once for the orchestration below. Do not call the MCP tools directly or select a separate MCP call for any poll. Replace ${CODEX_TASK_PLACEHOLDER} with a JSON string literal for the complete assigned task. Replace ${CODEX_CONTEXT_PLACEHOLDER} with one JSON string literal containing all supplied caller context, or with null when no context was supplied; never use an object or array. Replace ${CODEX_CONTEXT_KEYS_PLACEHOLDER} with a JSON array naming the context fields present in that string, or [] when context is absent. Replace ${CODEX_IDEMPOTENCY_KEY_PLACEHOLDER} with one new opaque idempotency key for this logical invocation: choose it exactly once, reuse it unchanged for any retry of this invocation, and never reuse it for a separate request even when task and context are identical. Then pass the raw JavaScript without Markdown fences.`,
     `The JavaScript validates the exact tenant, agent binding, and catalog policy; passes the one stable logical-invocation idempotencyKey; starts exactly once; and polls deterministically with the compatible 20-second server wait until status is succeeded or failed. If functions.exec yields a running cell, use functions.wait with max_tokens 30000 only to resume that same orchestration; never start another orchestration or poll the MCP tool yourself.`,
-    `After the orchestration completes, return its single text output verbatim with no preface, rewriting, Markdown changes, or independent synthesis. A successful output is result.finalText exactly. A failure output preserves the durable runId, output, and error.`,
+    completionGuidance,
     "",
     source,
   ].join("\n\n");
 }
 
+function customAgentDescription(tenantId, agent) {
+  const sideEffectsLabel = agent.sideEffects === "writes" ? " (may write user or workspace data)" : " (read-only)";
+  return (usesVerbatimRelay(agent)
+    ? `${customAgentVerbatimDescriptionLead()}. Runs ${agent.title} for Impel tenant ${tenantId}${sideEffectsLabel}: ${agent.description}`
+    : `Explicitly runs ${agent.title} for Impel tenant ${tenantId}${sideEffectsLabel}: ${agent.description}`
+  ).slice(0, 900);
+}
+
 function renderClaudeAgent({ tenantId, agent, name, invocation }) {
-  const description = `Explicitly runs ${agent.title} for Impel tenant ${tenantId}${agent.sideEffects === "writes" ? " (may write user or workspace data)" : " (read-only)"}: ${agent.description}`.slice(0, 900);
+  const description = customAgentDescription(tenantId, agent);
+  const toolNames = nativeAgentToolNames(agent);
   const lines = [
     "---",
     `name: ${JSON.stringify(name)}`,
     `description: ${JSON.stringify(description)}`,
     "model: inherit",
     "tools:",
-    ...NATIVE_AGENT_TOOL_NAMES.map((tool) => `  - ${JSON.stringify(nativeToolName(tool))}`),
+    ...toolNames.map((tool) => `  - ${JSON.stringify(nativeToolName(tool))}`),
     "mcpServers:",
     `  - ${MANAGED_AGENT_MCP_SERVER}:`,
     "      type: stdio",
@@ -534,7 +708,8 @@ function renderClaudeAgent({ tenantId, agent, name, invocation }) {
 }
 
 function renderCodexAgent({ tenantId, agent, name, invocation }) {
-  const description = `Explicit custom agent: callers must use fork_turns="none" and relay its result verbatim. Runs ${agent.title} for Impel tenant ${tenantId}${agent.sideEffects === "writes" ? " (may write user or workspace data)" : " (read-only)"}: ${agent.description}`.slice(0, 900);
+  const description = customAgentDescription(tenantId, agent);
+  const toolNames = nativeAgentToolNames(agent);
   const envEntries = Object.entries(invocation.env || {})
     .map(([key, value]) => `${JSON.stringify(key)} = ${JSON.stringify(value)}`)
     .join(", ");
@@ -547,11 +722,11 @@ function renderCodexAgent({ tenantId, agent, name, invocation }) {
     `[mcp_servers.${MANAGED_AGENT_MCP_SERVER}]`,
     `command = ${JSON.stringify(invocation.command)}`,
     `args = [${invocation.args.map((argument) => JSON.stringify(argument)).join(", ")}]`,
-    `enabled_tools = [${NATIVE_AGENT_TOOL_NAMES.map((tool) => JSON.stringify(tool)).join(", ")}]`,
+    `enabled_tools = [${toolNames.map((tool) => JSON.stringify(tool)).join(", ")}]`,
     ...(envEntries ? [`env = { ${envEntries} }`] : []),
     "",
   ];
-  for (const tool of NATIVE_AGENT_TOOL_NAMES) {
+  for (const tool of toolNames) {
     lines.push(`[mcp_servers.${MANAGED_AGENT_MCP_SERVER}.tools.${JSON.stringify(tool)}]`, 'approval_mode = "approve"', "");
   }
   return lines.join("\n");
@@ -628,7 +803,7 @@ export function syncAgentProfile({ client, root, label, tenantId, agents, now =
   const prior = readManifest(manifestPath);
   const rendered = renderManagedAgents(client, tenantId, agents);
   const priorFiles = new Set(prior?.files || []);
-  const priorUsesDiscoveryRoot = [2, 3, MANAGED_AGENT_MANIFEST_VERSION].includes(prior?.version);
+  const priorUsesDiscoveryRoot = [2, 3, 4, 5, MANAGED_AGENT_MANIFEST_VERSION].includes(prior?.version);
 
   // Native clients discover standalone definitions directly under `agents/`.
   // Preflight every destination before writing so an unmanaged file with the

package/src/apps.js

@@ -10,12 +10,19 @@ import {
   secureManagedCodexHome,
 } from "./codexSecurity.js";
 import { normalizeTenantId } from "./tenants.js";
-import { IMPEL_CLI_ENTRYPOINT, impelCliInvocation } from "./selfInvocation.js";
+import {
+  IMPEL_CLI_ENTRYPOINT,
+  IMPEL_TASKS_MCP_SERVER_NAME,
+  impelCliInvocation,
+  impelTasksMcpInvocation,
+  isImpelTasksMcpInvocation,
+} from "./selfInvocation.js";
 import { crossAppModelsEnabled, redactSecretText } from "./config.js";
 import { ensureClaudeSessionHooks, ensureCodexSessionHooks } from "./sessionHooks.js";
 import { ADHOC_IDENTITY, codesignIdentityArgs, desiredSigningMode, resolveSigningIdentity } from "./codesign.js";
 import { applyImpelClaudeSandbox } from "./claudeSandbox.js";
 import { brandedEnvironmentName, RUNTIME_BRAND } from "./runtimeBrand.js";
+import { IMPEL_CODEX_PARENT_DELEGATION_INSTRUCTIONS } from "./commands/launch.js";
 
 export const CLAUDE_CONFIG_ID = "1ced0000-0000-4000-8000-000000000001";
 const CHATGPT_CONFIG_START = `# >>> ${RUNTIME_BRAND.cli.command} app managed gateway >>>`;
@@ -266,7 +273,11 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // 26: remember the managed provider defaults and move legacy GPT-5.5 profiles
 // onto GPT-5.6 Sol so ChatGPT's compact Work picker does not fall back to its
 // unsupported-selection "Reset to default" treatment.
-export const CURRENT_CONFIG_VERSION = 26;
+// 27: register the separate tenant-bound Tasks MCP server in managed Claude
+// and ChatGPT/Codex profiles without changing the specialist MCP server.
+// 28: add managed ChatGPT parent delegation instructions, including custom-agent
+// verbatim relay opt-in and directAnswer one-shot MCP answer routing.
+export const CURRENT_CONFIG_VERSION = 28;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -807,7 +818,7 @@ export function installManagedAppFiles({
     }
     if (target === "claude") {
       migrateLegacyClaudeAppSessions(paths.claude.userData, homeDir);
-      writeClaudeNative3PSelection(paths);
+      writeClaudeNative3PSelection(paths, config);
       writeClaudeCodeSettings(paths);
       writeClaudeConfig(paths, config, models);
       if (RUNTIME_BRAND.features.sessions) ensureClaudeSessionHooks(paths.claude.userData, config.tenantId, "claude_desktop");
@@ -1153,7 +1164,7 @@ function writeClaudeCodeSettings(paths) {
   writeAtomic(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, 0o600);
 }
 
-function writeClaudeNative3PSelection(paths) {
+function writeClaudeNative3PSelection(paths, config) {
   const configPath = path.join(paths.claude.userData, "claude_desktop_config.json");
   let current = {};
   if (fs.existsSync(configPath)) {
@@ -1166,15 +1177,64 @@ function writeClaudeNative3PSelection(paths) {
   if (!current || typeof current !== "object" || Array.isArray(current)) {
     throw new Error(`Claude desktop config must contain a JSON object: ${configPath}`);
   }
-  // Mirror the pinned app's native "select 3P" persistence contract. This
-  // marks the first-run choice complete and clears a pending 1P sign-in while
-  // leaving Claude-owned preferences (including sidebarMode) untouched.
-  if (current.deploymentMode === "3p" && !Object.hasOwn(current, "awaitingSignIn")) return;
+  if (Object.hasOwn(current, "mcpServers") && (
+    !current.mcpServers
+    || typeof current.mcpServers !== "object"
+    || Array.isArray(current.mcpServers)
+  )) {
+    throw new Error(`Claude desktop config has an invalid mcpServers value: ${configPath}`);
+  }
+  const currentMcpServers = current.mcpServers
+    && typeof current.mcpServers === "object"
+    && !Array.isArray(current.mcpServers)
+    ? current.mcpServers
+    : {};
+  const currentTasksServer = currentMcpServers[IMPEL_TASKS_MCP_SERVER_NAME];
+  if (RUNTIME_BRAND.features.mcp && config.tenantId) {
+    if (Object.hasOwn(currentMcpServers, IMPEL_TASKS_MCP_SERVER_NAME)
+      && !isImpelTasksMcpInvocation(currentTasksServer)) {
+      throw new Error(
+        `${configPath} already has an mcpServers.${IMPEL_TASKS_MCP_SERVER_NAME} entry `
+        + "that wasn't written by impel-cli. Remove or rename it, then re-run."
+      );
+    }
+  }
+
+  // Mirror the pinned app's native "select 3P" persistence contract and add
+  // only the tenant-bound Tasks entry we own. Claude-owned preferences and
+  // foreign MCP entries remain untouched.
   const next = { ...current, deploymentMode: "3p" };
   delete next.awaitingSignIn;
+  if (RUNTIME_BRAND.features.mcp && config.tenantId) {
+    next.mcpServers = {
+      ...currentMcpServers,
+      [IMPEL_TASKS_MCP_SERVER_NAME]: impelTasksMcpInvocation(config.tenantId),
+    };
+  } else if (isImpelTasksMcpInvocation(currentTasksServer)) {
+    next.mcpServers = { ...currentMcpServers };
+    delete next.mcpServers[IMPEL_TASKS_MCP_SERVER_NAME];
+    if (Object.keys(next.mcpServers).length === 0) delete next.mcpServers;
+  }
   writeAtomic(configPath, `${JSON.stringify(next, null, 2)}\n`, 0o600);
 }
 
+function tasksInvocationFromBaseMcp(mcp, tenantId) {
+  if (!mcp || typeof mcp.command !== "string" || !Array.isArray(mcp.args)) {
+    return impelTasksMcpInvocation(tenantId);
+  }
+  const mcpIndex = mcp.args.lastIndexOf("mcp");
+  if (mcpIndex === -1) return impelTasksMcpInvocation(tenantId);
+  return {
+    command: mcp.command,
+    args: [
+      ...mcp.args.slice(0, mcpIndex + 1),
+      "--target",
+      "tasks",
+      ...mcp.args.slice(mcpIndex + 1),
+    ],
+  };
+}
+
 function writeChatGPTConfig(
   paths,
   config,
@@ -1256,6 +1316,25 @@ function writeChatGPTConfig(
     command: mcpInvocation.command,
     args: [...mcpInvocation.args],
   };
+  const tasksMcp = invocations?.tasksMcp
+    || tasksInvocationFromBaseMcp(mcp, config.tenantId);
+
+  if (RUNTIME_BRAND.features.mcp && config.tenantId) {
+    const unmanagedToml = stripManagedChatGPTToml(currentToml);
+    const tasksName = escapeRegex(IMPEL_TASKS_MCP_SERVER_NAME);
+    const mcpServersKey = `(?:mcp_servers|"mcp_servers"|'mcp_servers')`;
+    const tasksKey = `(?:${tasksName}|"${tasksName}"|'${tasksName}')`;
+    const foreignTasksTable = new RegExp(
+      `^[ \\t]*\\[[ \\t]*${mcpServersKey}[ \\t]*\\.[ \\t]*${tasksKey}(?:[ \\t]*\\.[ \\t]*|[ \\t]*\\])`,
+      "mu",
+    );
+    if (foreignTasksTable.test(unmanagedToml)) {
+      throw new Error(
+        `${configPath} already has an mcp_servers.${IMPEL_TASKS_MCP_SERVER_NAME} table `
+        + "outside the impel-cli managed block. Remove or rename it, then re-run."
+      );
+    }
+  }
 
   const managedToml = [
     CHATGPT_CONFIG_START,
@@ -1269,6 +1348,9 @@ function writeChatGPTConfig(
     `model_catalog_json = ${tomlString(paths.chatgpt.catalog)}`,
     ...(selectedEffort ? [`model_reasoning_effort = ${tomlString(selectedEffort)}`] : []),
     ...(selectedTier ? [`service_tier = ${tomlString(selectedTier)}`] : []),
+    ...(RUNTIME_BRAND.features.agents
+      ? [`developer_instructions = ${tomlString(IMPEL_CODEX_PARENT_DELEGATION_INSTRUCTIONS)}`]
+      : []),
     "",
     // The built-in ChatGPT provider derives its inference endpoint from
     // chatgpt.com even when chatgpt_base_url points at the gateway. Keep the
@@ -1296,6 +1378,12 @@ function writeChatGPTConfig(
       `[mcp_servers.${RUNTIME_BRAND.cli.providerId}]`,
       `command = ${tomlString(mcp.command)}`,
       `args = [${mcp.args.map((argument) => tomlString(argument)).join(", ")}]`,
+      ...(config.tenantId ? [
+        "",
+        `[mcp_servers.${IMPEL_TASKS_MCP_SERVER_NAME}]`,
+        `command = ${tomlString(tasksMcp.command)}`,
+        `args = [${tasksMcp.args.map((argument) => tomlString(argument)).join(", ")}]`,
+      ] : []),
     ] : []),
     CHATGPT_CONFIG_END,
   ].join("\n");
@@ -1469,7 +1557,7 @@ function readVendorCodexModels(vendorPath) {
   return new Map();
 }
 
-function mergeManagedChatGPTToml(current, managed) {
+function stripManagedChatGPTToml(current) {
   let remainder = current;
   const start = current.indexOf(CHATGPT_CONFIG_START);
   const end = current.indexOf(CHATGPT_CONFIG_END);
@@ -1479,7 +1567,11 @@ function mergeManagedChatGPTToml(current, managed) {
     const legacyEnd = current.match(/refresh_interval_ms = \d+\r?\n/u);
     if (legacyEnd?.index != null) remainder = current.slice(legacyEnd.index + legacyEnd[0].length);
   }
-  remainder = remainder.replace(/^\s+/u, "");
+  return remainder.replace(/^\s+/u, "");
+}
+
+function mergeManagedChatGPTToml(current, managed) {
+  const remainder = stripManagedChatGPTToml(current);
   return `${managed}\n${remainder ? `\n${remainder.replace(/\s*$/u, "")}\n` : ""}`;
 }