impel-cli 0.20.15 → 0.20.17

package/README.md

@@ -378,10 +378,14 @@ control-plane HTTP bearer credential, and fixes tenant selection in the
 transport header. Generated Claude/Codex MCP entries contain neither the PAT
 nor a tenant-derived credential.
 
-- The pinned Impel Claude Desktop can render the standard MCP Apps Tasks
-  resource when its host supports that protocol.
-- Claude Code and stable Codex receive complete headless task tools and text
-  results; no experimental Codex MCP Apps flag is enabled.
+- The pinned Impel Claude Desktop renders the standard MCP Apps task board when
+  its host supports that protocol.
+- The exact pinned Impel Codex desktop profile enables its reviewed
+  `enable_mcp_apps` contract so `show_tasks` can render the same board. The
+  vendor-pin test fails closed if the embedded Codex binary stops accepting it.
+- Claude Code and Codex CLI profiles remain headless and receive complete task
+  tools plus text results; the desktop-only renderer flag is never written to
+  those profiles.
 - Profiles preserve unrelated MCP servers. If a user-authored server already
   owns the `impel-tasks` name, setup/update fails with remediation instead of
   overwriting it.

package/RELEASE_NOTES.md

@@ -1,5 +1,21 @@
 # Release notes
 
+## 0.20.17 — Managed desktop task views
+
+- Enables the reviewed MCP Apps renderer only in exact managed Codex Desktop
+  profiles, while keeping Codex CLI profiles on their text and tool fallback.
+- Captures Claude permission, notification, and task lifecycle events through
+  the existing asynchronous, tenant-bound session hooks.
+- Preserves the additional lifecycle context needed to correlate task updates
+  without expanding the oversized-hook payload boundary.
+
+## 0.20.16 — Correlated Codex transport timing
+
+- Derives native-agent MCP duration from correlated, timestamped Codex rollout
+  events when durable profiles correctly omit transient telemetry destinations.
+- Retries one unestablished tenant-preflight result while still requiring one
+  exact selected tenant before every profiled Codex attempt.
+
 ## 0.20.15 — Direct Codex native agents
 
 - Classifies the exact `mcp__impel_agent` namespace as direct-only in generated

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.15",
+  "version": "0.20.17",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/scripts/analyze-native-codex.mjs

@@ -151,12 +151,15 @@ export function summarizeCodexRollouts(rollouts) {
   let inputTokens = 0;
   let cachedInputTokens = 0;
   let outputTokens = 0;
+  let mcpDurationMs = 0;
+  let mcpCompletedCalls = 0;
 
   for (const events of rollouts) {
     eventCount += events.length;
     const metadata = rolloutSessionMetadata(events);
     const scopedCounts = metadata.parentThreadId ? childToolCounts : parentToolCounts;
     let latestUsage = null;
+    const mcpStarts = new Map();
     for (const event of events) {
       const payload = event.payload && typeof event.payload === "object" ? event.payload : {};
       if (event.type === "response_item"
@@ -166,6 +169,27 @@ export function summarizeCodexRollouts(rollouts) {
         increment(scopedCounts, tool);
         if (tool === "exec" || payload.type === "custom_tool_call") codeCells += tool === "exec" ? 1 : 0;
         if (tool === "wait") codeWaits += 1;
+        const startedAt = Date.parse(event.timestamp || "");
+        if (SAFE_MCP_TOOLS.has(tool)
+          && typeof payload.call_id === "string"
+          && Number.isFinite(startedAt)) {
+          mcpStarts.set(payload.call_id, startedAt);
+        }
+      }
+      if (event.type === "event_msg"
+        && payload.type === "mcp_tool_call_end"
+        && typeof payload.call_id === "string") {
+        const startedAt = mcpStarts.get(payload.call_id);
+        const endedAt = Date.parse(event.timestamp || "");
+        const duration = endedAt - startedAt;
+        if (Number.isFinite(startedAt)
+          && Number.isFinite(endedAt)
+          && duration >= 0
+          && duration <= 24 * 60 * 60 * 1000) {
+          mcpDurationMs += duration;
+          mcpCompletedCalls += 1;
+          mcpStarts.delete(payload.call_id);
+        }
       }
       if (event.type === "event_msg" && payload.type === "token_count") {
         const usage = payload.info?.total_token_usage;
@@ -190,6 +214,8 @@ export function summarizeCodexRollouts(rollouts) {
     inputTokens,
     cachedInputTokens,
     outputTokens,
+    mcpDurationMs,
+    mcpCompletedCalls,
   };
 }
 
@@ -249,7 +275,9 @@ export function summarizeRawAttempt({ stdoutText, telemetryText = "", rolloutTex
         codeWaits: rollout.codeWaits,
         inputTokens: rollout.inputTokens,
         cachedInputTokens: rollout.cachedInputTokens,
-        outputTokens: rollout.outputTokens,
+      outputTokens: rollout.outputTokens,
+        mcpDurationMs: rollout.mcpDurationMs,
+        mcpCompletedCalls: rollout.mcpCompletedCalls,
       } : {}),
       parentToolCounts: rollout.parentToolCounts,
       childToolCounts: rollout.childToolCounts,

package/scripts/profile-native-codex.mjs

@@ -211,13 +211,16 @@ function runCaptured(command, args, { environment = process.env, timeoutMs = 60_
 }
 
 async function currentTenant(impelBinary, environment) {
-  const invocation = impelInvocation(impelBinary, ["tenant", "current"], environment);
-  const result = await runCaptured(invocation.command, invocation.args, { environment });
-  const lines = result.stdout.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
-  if (result.code !== 0 || lines.length !== 1 || !/^[A-Za-z0-9_.:-]{1,160}$/u.test(lines[0])) {
-    throw new Error("could not establish one exact current Impel tenant");
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const invocation = impelInvocation(impelBinary, ["tenant", "current"], environment);
+    const result = await runCaptured(invocation.command, invocation.args, { environment });
+    const lines = result.stdout.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
+    if (result.code === 0 && lines.length === 1 && /^[A-Za-z0-9_.:-]{1,160}$/u.test(lines[0])) {
+      return lines[0];
+    }
+    if (attempt === 0) await delay(250);
   }
-  return lines[0];
+  throw new Error("could not establish one exact current Impel tenant after two bounded attempts");
 }
 
 export async function assertExpectedTenant({ expectedTenant, impelBinary = "impel", environment = process.env }) {
@@ -373,7 +376,10 @@ function safeAttemptRecord({ options, index, processResult, summary, jsonValid,
   const codex = summary?.codex || {};
   const telemetry = summary?.telemetry || {};
   const durationMs = processResult.endedAtMs - processResult.startedAtMs;
-  const mcpDurationMs = telemetry.mcpDurationMs || 0;
+  const telemetryCompleted = telemetry.eventCounts?.local_tool_completed || 0;
+  const mcpDurationMs = telemetryCompleted > 0
+    ? telemetry.mcpDurationMs || 0
+    : codex.mcpDurationMs || 0;
   const startCalls = (codex.toolCounts?.answer_native_agent || 0)
     + (codex.toolCounts?.run_native_agent || 0);
   const success = processResult.exitCode === 0
@@ -414,6 +420,9 @@ function safeAttemptRecord({ options, index, processResult, summary, jsonValid,
     cachedInputTokens: codex.cachedInputTokens || 0,
     outputTokens: codex.outputTokens || 0,
     mcpDurationMs,
+    mcpDurationSource: telemetryCompleted > 0
+      ? "telemetry"
+      : (codex.mcpCompletedCalls || 0) > 0 ? "rollout" : "unavailable",
     nonMcpOverheadMs: Math.max(0, durationMs - mcpDurationMs),
     telemetryEventCount: telemetry.eventCount || 0,
     telemetryCorrelationCount: telemetry.correlationCount || 0,

package/src/apps.js

@@ -5,6 +5,7 @@ import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import {
+  enableManagedCodexDesktopMcpApps,
   hardenManagedCodexToml,
   secureAllManagedCodexHomes,
   secureManagedCodexHome,
@@ -281,7 +282,9 @@ export function managedAppIdentity(target, tenantId = null, tenantName = null) {
 // expose direct-answer native agents through their one-shot local MCP binding.
 // 30: generate integrity-tracked top-level Codex profiles and direct code-mode
 // namespaces for fixed native-agent bindings.
-export const CURRENT_CONFIG_VERSION = 30;
+// 31: enable the reviewed MCP Apps renderer in pinned Codex Desktop profiles
+// and install Claude task, notification, and permission lifecycle hooks.
+export const CURRENT_CONFIG_VERSION = 31;
 
 // Identifies the bundle-BUILDING logic — the asar patches, plist rewrites,
 // helper rebranding, and signing. A vendored bundle is rebuilt only when this
@@ -1400,7 +1403,12 @@ function writeChatGPTConfig(
     CHATGPT_CONFIG_END,
   ].join("\n");
   const mergedToml = mergeManagedChatGPTToml(preservedToml, managedToml);
-  writeAtomic(configPath, hardenManagedCodexToml(mergedToml, configPath), 0o600);
+  const hardenedToml = hardenManagedCodexToml(mergedToml, configPath);
+  writeAtomic(
+    configPath,
+    enableManagedCodexDesktopMcpApps(hardenedToml, configPath),
+    0o600,
+  );
   secureManagedCodexHome(paths.chatgpt.codexHome);
 }
 

package/src/codexSecurity.js

@@ -148,6 +148,24 @@ export function hardenManagedCodexToml(toml, configPath = "managed Codex config"
   return applyManagedCodexSandboxPolicy(withoutCredentialSnapshots, configPath);
 }
 
+/**
+ * Enable the standard MCP Apps renderer only in the exact pinned desktop
+ * profile. CLI profiles deliberately stay headless, and vendor-pin contract
+ * tests must prove that the embedded Codex binary still recognizes this flag.
+ */
+export function enableManagedCodexDesktopMcpApps(
+  toml,
+  configPath = "managed Codex desktop config",
+) {
+  return upsertManagedScalar(
+    toml,
+    "features",
+    "enable_mcp_apps",
+    "true",
+    configPath,
+  );
+}
+
 function assertSafeManagedPath(target, expectedType) {
   const stat = lstatOrNull(target);
   if (!stat) return null;

package/src/sessionCollector.js

@@ -236,7 +236,8 @@ function compactLedgerPayload(input) {
   const keys = [
     "session_id", "hook_event_name", "cwd", "permission_mode", "model", "source", "reason",
     "turn_id", "prompt_id", "agent_id", "agent_type", "tool_name", "tool_use_id", "error",
-    "error_details", "last_assistant_message",
+    "error_details", "last_assistant_message", "notification_type", "message", "title",
+    "task_id", "task_subject", "task_description", "teammate_name", "tool_input",
   ];
   const payload = {};
   for (const key of keys) {

package/src/sessionHooks.js

@@ -12,10 +12,14 @@ const CODEX_TRUST_END = `# <<< ${RUNTIME_BRAND.product.id} managed session hook
 export const CLAUDE_SESSION_EVENTS = Object.freeze([
   "SessionStart",
   "UserPromptSubmit",
+  "PermissionRequest",
   "PostToolUse",
   "PostToolUseFailure",
+  "Notification",
   "SubagentStart",
   "SubagentStop",
+  "TaskCreated",
+  "TaskCompleted",
   "PreCompact",
   "PostCompact",
   "Stop",