impel-cli 0.20.29 → 0.20.31

package/RELEASE_NOTES.md

@@ -1,5 +1,26 @@
 # Release notes
 
+## 0.20.31 — Complete embedded Tasks controls
+
+- Allows the guarded `delete_task` operation through the tenant desktop bridge
+  so the MCP App can complete the full task CRUD lifecycle.
+- Keeps the embedded board below the macOS title-bar drag region so Board,
+  List, scope, refresh, create, and external-link controls receive pointer
+  input normally.
+- Rebuilds managed Claude and ChatGPT bundles onto the corrected Tasks host
+  contract while preserving tenant profiles and app state.
+
+## 0.20.30 — Stable Claude and Codex upgrades
+
+- Updates the reviewed native CLI pins to Claude Code 2.1.220 and Codex
+  0.147.0 using the vendors' signed stable installers.
+- Updates the managed Claude desktop pin to 1.26832.0 with its exact embedded
+  Claude Code 2.1.222 manifest and signed macOS and Windows artifacts.
+- Updates the managed ChatGPT desktop pin to 26.803.41515 with embedded Codex
+  0.147.0-alpha.6.5, using the exact signed macOS production artifacts.
+- Rebuilds tenant bundles only after both upgraded desktop contracts pass
+  validation.
+
 ## 0.20.28 — Exact opaque answer resumes
 
 - Aligns generated Claude and Codex direct-answer adapters with the opaque

package/docs/native-agent-host-capability-matrix.md

@@ -1,15 +1,15 @@
 # Native-agent host capability matrix
 
-Validated on 2026-08-07 with isolated temporary homes and tenant profiles. The
+Validated on 2026-08-08 with isolated temporary homes and tenant profiles. The
 matrix is intentionally pinned: a client upgrade must be re-qualified before it
 is treated as an eager host.
 
 | Surface | Pinned build | Exact selected tools | Selected path | Host behavior |
 | --- | --- | --- | --- | --- |
-| Claude Code | 2.1.212 | Yes, agent frontmatter `tools` | Eager | The bound run/answer, resume, and recovery tools are direct child tools. No catalog discovery or code-cell polling is required. |
-| Claude Desktop | 1.24012.9 (embedded Code 2.1.219) | Yes, agent frontmatter `tools` | Eager | Same direct-tool contract as Claude Code. |
-| Codex CLI through `impel codex` | 0.146.0 | Yes, with `features.code_mode.direct_only_tool_namespaces = ["mcp__impel_agent"]` | Eager; optional single-thread profile | Existing `@Agent` children call the fixed MCP namespace directly. `impel codex --agent` also removes the parent spawn/wait/relay thread. |
-| ChatGPT desktop Codex | 26.727.40816 (embedded Codex 0.146.0 contract) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
+| Claude Code | 2.1.220 | Yes, agent frontmatter `tools` | Eager | The bound run/answer, resume, and recovery tools are direct child tools. No catalog discovery or code-cell polling is required. |
+| Claude Desktop | 1.26832.0 (embedded Code 2.1.222) | Yes, agent frontmatter `tools` | Eager | Same direct-tool contract as Claude Code. |
+| Codex CLI through `impel codex` | 0.147.0 | Yes, with `features.code_mode.direct_only_tool_namespaces = ["mcp__impel_agent"]` | Eager; optional single-thread profile | Existing `@Agent` children call the fixed MCP namespace directly. `impel codex --agent` also removes the parent spawn/wait/relay thread. |
+| ChatGPT desktop Codex | 26.803.41515 (embedded Codex 0.147.0-alpha.6.5) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
 
 ## Qualified contract
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.29",
+  "version": "0.20.31",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -67,47 +67,45 @@ const portableBundleMutationLocks = new Set();
 // CLI release therefore installs and accepts only the exact app builds tested
 // with its compatibility patches. Updating a pin requires a new CLI release.
 export const PINNED_VENDOR_APPS = Object.freeze({
-  // 1.22209.3 routed managed 3P gateway profiles into /code/disabled because
-  // it did not translate the managed desktop-Code switch into renderer access.
-  // 1.24012.9 restores that contract by synthesizing claude_code and
-  // claude_code_desktop access from the configured code surface. The pinned
-  // contract test asserts that source path directly so this regression cannot
-  // hide behind otherwise-valid configLibrary schema markers again.
+  // Keep the desktop build, its embedded Claude Code manifest, and every
+  // renderer patch on one exact reviewed release. The pinned contract test
+  // asserts the managed desktop-Code access path directly so that regression
+  // cannot hide behind otherwise-valid configLibrary schema markers.
   claude: Object.freeze({
-    version: "1.24012.9",
-    claudeCodeVersion: "2.1.219",
-    claudeCodeCommit: "7006c4c3acac98e554d3997baeda6a7fa4d1ff7c",
+    version: "1.26832.0",
+    claudeCodeVersion: "2.1.222",
+    claudeCodeCommit: "fbf49312c28437bf9c2546b9ace3bd7b34eb6ff6",
     bundleName: "Claude.app",
     windows: Object.freeze({
       packageName: "Claude",
-      packageVersion: "1.24012.9.0",
+      packageVersion: "1.26832.0.0",
       publisher: 'CN="Anthropic, PBC", O="Anthropic, PBC", L=San Francisco, S=California, C=US, SERIALNUMBER=4860621, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US',
       executable: "app\\Claude.exe",
       downloads: Object.freeze({
         arm64: Object.freeze({
-          url: "https://downloads.claude.ai/releases/win32/arm64/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.msix",
-          sha256: "52ed0402ca70fc95e064417ff9bdf3a6336fe5dbf0612f7797937fd0d35ecdba",
+          url: "https://downloads.claude.ai/releases/win32/arm64/1.26832.0/Claude-056ee2be623b207f6a4d24dfb1b2fb5a82db0ecf.msix",
+          sha256: "16f9f9b074b1ce1bbc67c7facfd2279825c6b15b6abee28ccf7fedffe3e23a23",
         }),
         x64: Object.freeze({
-          url: "https://downloads.claude.ai/releases/win32/x64/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.msix",
-          sha256: "c7d61479f06a3490bd2598405aa95a428abb9fe31ed97f9e0a1fba7cd2745fe2",
+          url: "https://downloads.claude.ai/releases/win32/x64/1.26832.0/Claude-056ee2be623b207f6a4d24dfb1b2fb5a82db0ecf.msix",
+          sha256: "6dc210bca31b55c9fa307d11c6b13a42c7f3a3886ccc35ca2ecb7e9fceba0139",
         }),
       }),
     }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.zip",
-        sha256: "39ad2d181e2b1b017c5506f66c08399c23575c802d8b63927f40128e77103a9b",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.26832.0/Claude-056ee2be623b207f6a4d24dfb1b2fb5a82db0ecf.zip",
+        sha256: "6b0f2c51c5e1c3f6db3885233ad96e48f92e61438b0bd9892c69f2ea11c54950",
       }),
       x64: Object.freeze({
-        url: "https://downloads.claude.ai/releases/darwin/universal/1.24012.9/Claude-03c61d06f8e01a4db2273b9514e225f21d2ba62e.zip",
-        sha256: "39ad2d181e2b1b017c5506f66c08399c23575c802d8b63927f40128e77103a9b",
+        url: "https://downloads.claude.ai/releases/darwin/universal/1.26832.0/Claude-056ee2be623b207f6a4d24dfb1b2fb5a82db0ecf.zip",
+        sha256: "6b0f2c51c5e1c3f6db3885233ad96e48f92e61438b0bd9892c69f2ea11c54950",
       }),
     }),
   }),
   chatgpt: Object.freeze({
-    version: "26.727.40816",
-    codexVersion: "0.146.0-alpha.9.2",
+    version: "26.803.41515",
+    codexVersion: "0.147.0-alpha.6.5",
     bundleName: "ChatGPT.app",
     windows: Object.freeze({
       storeProductId: "9PLM9XGG6VKS",
@@ -123,12 +121,12 @@ export const PINNED_VENDOR_APPS = Object.freeze({
     }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.727.40816.zip",
-        sha256: "fdbede9b8a28b5bf3bbf1213fa04291724faa6ed2d1d61bb04853bbdfebce219",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.41515.zip",
+        sha256: "8abd46bf063bc27cbadcbc2863007ac44365b13a23ede17ceaee81fb9eeaeb9a",
       }),
       x64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.727.40816.zip",
-        sha256: "12622d916a3993d61fb52a318dcff7af7449eea5070cdd7e094da29f380e3374",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.803.41515.zip",
+        sha256: "87239a3dd12e2761de515ee78a0b73c02ac907c34c1f01a68dd6f093cf433fb1",
       }),
     }),
   }),
@@ -149,14 +147,14 @@ const CHATGPT_THREAD_FORK_PROVIDER = /let ([A-Za-z_$][\w$]*)=\{\.\.\.([A-Za-z_$]
 const CHATGPT_THREAD_RESUME_PROVIDER = /modelProvider:null,cwd:([A-Za-z_$][\w$]*)\?\.cwd\?\?null,approvalPolicy:null,sandbox:null,config:\1\?\.config\?\?null,developerInstructions:\1\?\.developerInstructions\?\?void 0/gu;
 const CHATGPT_STRUCTURED_PROVIDER_FALLBACK = /allowProviderModelFallback:!0/gu;
 const CHATGPT_RESOURCE_ROOT = "linked_vendor_resources_with_patched_asar";
-const CLAUDE_PLAN_USAGE_GUARD = "if(!PSe()){cz();return}if(!Ge().hasOrgPolicyBackend())return;if((r=ar())";
-const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `if(!PSe()){cz();return}${"".padEnd("if(!Ge().hasOrgPolicyBackend())return;".length, " ")}if((r=ar())`;
-const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Ge&&t';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Ge?t:Ue?.agent??!1';
+const CLAUDE_PLAN_USAGE_GUARD = "if(!Pi()){ua();return}if(!d.an().hasOrgPolicyBackend())return;let r=p.n();";
+const IMPEL_CLAUDE_PLAN_USAGE_GUARD = `if(!Pi()){ua();return}${"".padEnd("if(!d.an().hasOrgPolicyBackend())return;".length, " ")}let r=p.n();`;
+const CLAUDE_DRAFT_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Ke&&t';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTIONS = 'agentMentionsEnabled:"draft"===Ke?t:E?.agent??!1';
 const CLAUDE_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!n||e.name.toLowerCase().includes(n))).slice(0,10)';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!n||e.name.toLowerCase().includes(n))&&("string"!=typeof x||e.name===x)).slice(0,10)';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTION_FILTER = 'return e.filter(e=>"user"===e.source&&(!n||e.name.toLowerCase().includes(n))&&("string"!=typeof v||e.name===v)).slice(0,10)';
 const CLAUDE_AGENT_MENTION_SELECT = 'onSelect:t=>(e(String(t)),Promise.resolve(null))';
-const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof x?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
+const IMPEL_CLAUDE_BOUND_AGENT_MENTION_SELECT = 'onSelect:t=>"string"==typeof v?Promise.resolve({chipText:String(t)}):(e(String(t)),Promise.resolve(null))';
 const LEGACY_CLAUDE_SAFE_STORAGE_NAME = "Claude";
 const CLAUDE_SAFE_STORAGE_METADATA = "safe-storage.json";
 // The pinned Claude renderer decides desktop-vs-web mode SOLELY by matching its
@@ -301,7 +299,7 @@ export const CURRENT_CONFIG_VERSION = 32;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-08.2";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-08.4";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {
@@ -2102,11 +2100,61 @@ function patchFixedWidthAsarString(asarPath, original, replacement, label) {
   return applyFixedWidthAsarPatches(asarPath, archive, patches, label);
 }
 
+function exportedAsarSymbol(source, localSymbol) {
+  const match = source.match(new RegExp(
+    `Object\\.defineProperty\\(exports,"([^"]+)",\\{enumerable:!0,get:function\\(\\)\\{return ${escapeRegex(localSymbol)}\\}\\}\\)`,
+    "u",
+  ));
+  return match?.[1] ?? null;
+}
+
+function claudeModularCredentialExpression(archive, requestOffset) {
+  const metadata = readAsarMetadata(archive);
+  const requestRecord = findAsarEntryRecord(metadata.header, metadata.dataOffset, requestOffset);
+  const requestStart = metadata.dataOffset + Number(requestRecord.entry.offset);
+  const requestSource = archive.subarray(
+    requestStart,
+    requestStart + Number(requestRecord.entry.size),
+  ).toString("latin1");
+  const importPattern = /([A-Za-z_$][\w$]*)=require\("([^"\n]+)"\)/gu;
+
+  for (const imported of requestSource.matchAll(importPattern)) {
+    const importedPath = path.posix.normalize(path.posix.join(
+      path.posix.dirname(requestRecord.path),
+      imported[2],
+    ));
+    const importedEntry = findAsarEntryByPath(metadata.header, importedPath);
+    if (!importedEntry) continue;
+    const importedStart = metadata.dataOffset + Number(importedEntry.offset);
+    const importedSource = archive.subarray(
+      importedStart,
+      importedStart + Number(importedEntry.size),
+    ).toString("latin1");
+    if (!importedSource.includes("[custom-3p] Credentials loaded from managed config")) continue;
+
+    const credentialParser = importedSource.match(
+      /([A-Za-z_$][\w$]*)=([A-Za-z_$][\w$]*)\(e,([A-Za-z_$][\w$]*)\(\)\),\1&&[\s\S]{0,250}?\[custom-3p\] Credentials loaded from managed config/u,
+    );
+    const configAccessor = importedSource.match(
+      /function ([A-Za-z_$][\w$]*)\(e\)\{let ([A-Za-z_$][\w$]*)=[A-Za-z_$][\w$]*\(\);return e\?\.ignoreScopes\?[\s\S]{0,200}?\2\.config\}/u,
+    )?.[1];
+    if (!credentialParser || !configAccessor) continue;
+
+    const parserExport = exportedAsarSymbol(importedSource, credentialParser[2]);
+    const errorsExport = exportedAsarSymbol(importedSource, credentialParser[3]);
+    const configExport = exportedAsarSymbol(importedSource, configAccessor);
+    if (!parserExport || !errorsExport || !configExport) continue;
+    const namespace = imported[1];
+    return `${namespace}.${parserExport}(${namespace}.${configExport}(),${namespace}.${errorsExport}()).apiKey`;
+  }
+  return null;
+}
+
 function patchClaudePlanUsageRequest(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");
   const credentialAccessor = source.match(
-    /function ([A-Za-z_$][\w$]*)\(e\)\{var t;return [\s\S]{0,500}?\[custom-3p\] Credentials loaded from managed config/u,
+    /function ([A-Za-z_$][\w$]*)\(e\)\{(?:var t;)?return [\s\S]{0,500}?\[custom-3p\] Credentials loaded from managed config/u,
   )?.[1];
   if (!credentialAccessor) {
     return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude plan-usage gateway request");
@@ -2116,14 +2164,16 @@ function patchClaudePlanUsageRequest(asarPath) {
     "u",
   );
   const configAccessor = source.match(configAccessorPattern)?.[1];
-  if (!configAccessor) {
-    return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude plan-usage gateway request");
-  }
-
-  const requestPattern = /const ([A-Za-z_$][\w$]*)=`\$\{[A-Za-z_$][\w$]*\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage\$\{[A-Za-z_$][\w$]*\?"\?skip_spend=1":""\}`,([A-Za-z_$][\w$]*)=await ([A-Za-z_$][\w$]*)\.net\.fetch\(\1,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
+  const requestPattern = /(?:const|let) ([A-Za-z_$][\w$]*)=`\$\{[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)?\(\)\}\/api\/organizations\/\$\{[A-Za-z_$][\w$]*\}\/usage\$\{[A-Za-z_$][\w$]*\?(?:"\?skip_spend=1"|`\?skip_spend=1`):(?:""|``)\}`,([A-Za-z_$][\w$]*)=await ([A-Za-z_$][\w$]*)\.net\.fetch\(\1,\{signal:AbortSignal\.timeout\([A-Za-z_$][\w$]*\)\}\)/gu;
   const patches = [...source.matchAll(requestPattern)].map((match) => {
     const original = match[0];
-    const replacement = `const ${match[1]}="https://gateway.useimpel.com/ui/a/u",${match[2]}=await ${match[3]}.net.fetch(${match[1]},{headers:{key:${credentialAccessor}(${configAccessor}()).apiKey}})`;
+    const credentialExpression = configAccessor
+      ? `${credentialAccessor}(${configAccessor}()).apiKey`
+      : claudeModularCredentialExpression(archive, match.index);
+    if (!credentialExpression) {
+      throw new Error("this desktop app version has an unsupported Claude plan-usage gateway credential accessor; update impel-cli before installing it");
+    }
+    const replacement = `const ${match[1]}="https://gateway.useimpel.com/ui/a/u",${match[2]}=await ${match[3]}.net.fetch(${match[1]},{headers:{key:${credentialExpression}}})`;
     if (replacement.length > original.length) {
       throw new Error("Claude plan-usage gateway request replacement no longer fits the vendor ASAR contract");
     }
@@ -2135,7 +2185,7 @@ function patchClaudePlanUsageRequest(asarPath) {
 function patchClaudeSafeStorageName(asarPath) {
   const archive = fs.readFileSync(asarPath);
   const source = archive.toString("latin1");
-  const startupPattern = /([A-Za-z_$][\w$]*)\.app\.isPackaged\|\|\1\.app\.setName\("Claude"\)/gu;
+  const startupPattern = /([A-Za-z_$][\w$]*)\.app\.isPackaged\|\|\1\.app\.setName\((?:"Claude"|`Claude`)\)/gu;
   const patches = [...source.matchAll(startupPattern)].map((match) => {
     const original = match[0];
     const replacement = `${match[1]}.app.setName(process.env.IMPEL_CN)`;
@@ -2165,10 +2215,41 @@ function patchFastModeAuthGate(asarPath) {
 }
 
 function patchDesktopTasksPreload(asarPath, target) {
+  const legacyClaudeFooter = "//# sourceMappingURL=index.pre.js.map\n";
   const footer = target === "claude"
-    ? "//# sourceMappingURL=index.pre.js.map\n"
+    ? legacyClaudeFooter
     : "//# sourceMappingURL=early-bootstrap.js.map";
   const loader = "require(process.env.IMPEL_DT)";
+  if (target === "claude") {
+    const archive = fs.readFileSync(asarPath);
+    const source = archive.toString("latin1");
+    const legacyMatches = exactTextMatchCount(source, legacyClaudeFooter);
+    if (legacyMatches === 0) {
+      const appNameMatches = [...source.matchAll(/[A-Za-z_$][\w$]*\.app\.setName\(process\.env\.IMPEL_CN\)/gu)];
+      if (appNameMatches.length !== 1) {
+        return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude desktop Tasks preload");
+      }
+      const metadata = readAsarMetadata(archive);
+      const record = findAsarEntryRecord(metadata.header, metadata.dataOffset, appNameMatches[0].index);
+      const currentFooter = "//# sourceMappingURL=index.js.map";
+      const footerOffset = metadata.dataOffset + Number(record.entry.offset) + Number(record.entry.size)
+        - Buffer.byteLength(currentFooter, "latin1");
+      if (source.slice(footerOffset, footerOffset + currentFooter.length) !== currentFooter) {
+        return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude desktop Tasks preload");
+      }
+      if (loader.length >= currentFooter.length) {
+        throw new Error("desktop Tasks preload no longer fits the vendor ASAR contract");
+      }
+      return applyFixedWidthAsarPatches(asarPath, archive, [{
+        offset: footerOffset,
+        original: currentFooter,
+        replacement: loader.padEnd(currentFooter.length, " "),
+      }], "Claude desktop Tasks preload");
+    }
+    if (legacyMatches !== 1) {
+      return applyFixedWidthAsarPatches(asarPath, archive, [], "Claude desktop Tasks preload");
+    }
+  }
   const trailingNewline = footer.endsWith("\n") ? "\n" : "";
   if (loader.length >= footer.length - trailingNewline.length) {
     throw new Error("desktop Tasks preload no longer fits the vendor ASAR contract");
@@ -2324,23 +2405,36 @@ function readAsarMetadata(archive) {
   return { dataOffset, header, headerLength };
 }
 
-function findAsarEntry(header, dataOffset, archiveOffset) {
+function findAsarEntryRecord(header, dataOffset, archiveOffset) {
   const relativeOffset = archiveOffset - dataOffset;
   let found = null;
-  const visit = (directory) => {
-    for (const entry of Object.values(directory?.files || {})) {
-      if (entry.files) visit(entry);
+  const visit = (directory, parent = "") => {
+    for (const [name, entry] of Object.entries(directory?.files || {})) {
+      const entryPath = parent ? `${parent}/${name}` : name;
+      if (entry.files) visit(entry, entryPath);
       else if (entry.offset != null) {
         const start = Number(entry.offset);
-        if (start <= relativeOffset && relativeOffset < start + Number(entry.size)) found = entry;
+        if (start <= relativeOffset && relativeOffset < start + Number(entry.size)) {
+          found = { entry, path: entryPath };
+        }
       }
     }
   };
   visit(header);
-  if (!found?.integrity) throw new Error("Fast-mode renderer asset has no supported ASAR integrity metadata");
+  if (!found?.entry?.integrity) throw new Error("Fast-mode renderer asset has no supported ASAR integrity metadata");
   return found;
 }
 
+function findAsarEntry(header, dataOffset, archiveOffset) {
+  return findAsarEntryRecord(header, dataOffset, archiveOffset).entry;
+}
+
+function findAsarEntryByPath(header, targetPath) {
+  let current = header;
+  for (const part of targetPath.split("/")) current = current?.files?.[part];
+  return current?.offset != null ? current : null;
+}
+
 function updateAsarEntryIntegrity(archive, dataOffset, entry) {
   const start = dataOffset + Number(entry.offset);
   const contents = archive.subarray(start, start + Number(entry.size));

package/src/desktopTasks.js

@@ -509,12 +509,16 @@ if (
     const parseBounds = (url, window) => {
       const parsed = new URL(url);
       const content = window.getContentBounds();
+      const interactiveTop = process.platform === "darwin" ? 48 : 0;
       const number = (name, fallback) => {
         const value = Number.parseInt(parsed.searchParams.get(name) || "", 10);
         return Number.isFinite(value) ? value : fallback;
       };
       const x = Math.max(0, Math.min(content.width - 240, number("x", 0)));
-      const y = Math.max(0, Math.min(content.height - 240, number("y", 0)));
+      const y = Math.max(
+        interactiveTop,
+        Math.min(content.height - 240, number("y", 0)),
+      );
       return {
         x,
         y,
@@ -606,7 +610,13 @@ if (
     const nativeBoardBounds = (window) => {
       const content = window.getContentBounds();
       const x = Math.min(296, Math.max(0, content.width - 240));
-      return { x, y: 0, width: Math.max(240, content.width - x), height: Math.max(240, content.height) };
+      const interactiveTop = process.platform === "darwin" ? 48 : 0;
+      return {
+        x,
+        y: interactiveTop,
+        width: Math.max(240, content.width - x),
+        height: Math.max(240, content.height - interactiveTop),
+      };
     };
 
     const layoutNativeNav = (window) => {
@@ -825,7 +835,15 @@ if (
       }
       if (request?.method === "tools/call") {
         const name = request?.params?.name;
-        const allowed = new Set(["show_tasks", "list_tasks", "get_task", "list_members", "create_task", "update_task"]);
+        const allowed = new Set([
+          "show_tasks",
+          "list_tasks",
+          "get_task",
+          "list_members",
+          "create_task",
+          "update_task",
+          "delete_task",
+        ]);
         if (!allowed.has(name)) throw new Error("Unsupported Tasks tool.");
         const args = request?.params?.arguments;
         if (args != null && (typeof args !== "object" || Array.isArray(args))) {

package/src/vendorCliVersions.js

@@ -2,6 +2,6 @@
 // Windows installers on the same versions; do not replace these with moving
 // channels such as "stable" or "latest".
 export const PINNED_VENDOR_CLI_VERSIONS = Object.freeze({
-  claude: "2.1.212",
-  codex: "0.146.0",
+  claude: "2.1.220",
+  codex: "0.147.0",
 });