impel-cli 0.20.34 → 0.20.36

package/RELEASE_NOTES.md

@@ -1,5 +1,24 @@
 # Release notes
 
+## 0.20.36 — Restore Codex execution
+
+- Keeps Codex 0.147's stable code-mode host enabled instead of overriding it
+  off, restoring filesystem, shell, and repository tools in `impel codex`.
+- Launches ordinary tenant Codex sessions with unrestricted filesystem access
+  and no approval prompts by default while preserving read-only fixed-agent
+  profiles.
+- Requires the reviewed macOS Codex install to include its separately signed
+  `codex-code-mode-host` companion before the CLI can launch it.
+
+## 0.20.35 — Normalize the Claude Tasks destination
+
+- Waits for Claude's native New row before cloning the Tasks destination,
+  preventing the earlier Home/Code switcher from leaking its Code glyph into
+  the injected control.
+- Removes cloned vendor glyphs and their empty wrappers so Tasks renders with
+  exactly one board icon in both Claude modes.
+- Rebuilds existing managed bundles onto the corrected navigation lifecycle.
+
 ## 0.20.34 — Stabilize desktop Tasks navigation
 
 - Places Tasks immediately after Claude's persistent Home/Code switcher in both

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.34",
+  "version": "0.20.36",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -299,7 +299,7 @@ export const CURRENT_CONFIG_VERSION = 32;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.3";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-09.4";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {

package/src/commands/launch.js

@@ -70,13 +70,14 @@ export const IMPEL_CODEX_PARENT_DELEGATION_INSTRUCTIONS =
   `${IMPEL_CODEX_SPECIALIST_DELEGATION_INSTRUCTIONS} ${IMPEL_CUSTOM_AGENT_VERBATIM_RELAY_APPENDIX}`;
 
 const IMPEL_CODEX_RUNTIME_OVERRIDES = [
-  // Codex models may select code mode even when the standalone
-  // `codex-code-mode-host` companion is not present in the vendor install.
-  // The embedded runtime is the vendor-supported equivalent and is scoped to
-  // this Impel invocation, so the user's native Codex profile is unaffected.
-  "features.code_mode_host=false",
+  // Codex 0.147 fails closed when a model selects code mode while this stable
+  // feature is disabled. The reviewed standalone install includes the signed
+  // companion host, so keep the execution path enabled for Impel sessions.
+  "features.code_mode_host=true",
 ];
 
+const IMPEL_CODEX_UNRESTRICTED_ARGUMENT = "--dangerously-bypass-approvals-and-sandbox";
+
 export function impelLaunchArguments(tool, argv, { codexAgentProfile = null } = {}) {
   if (!RUNTIME_BRAND.features.agents) return [...argv];
   if (tool === "claude") {
@@ -89,6 +90,7 @@ export function impelLaunchArguments(tool, argv, { codexAgentProfile = null } =
       ...(codexAgentProfile ? ["--profile", codexAgentProfile] : [
         "-c",
         `developer_instructions=${JSON.stringify(IMPEL_CODEX_PARENT_DELEGATION_INSTRUCTIONS)}`,
+        IMPEL_CODEX_UNRESTRICTED_ARGUMENT,
       ]),
       ...IMPEL_CODEX_RUNTIME_OVERRIDES.flatMap((override) => ["-c", override]),
       ...argv,

package/src/desktopTasks.js

@@ -7,7 +7,7 @@ export const DESKTOP_TASKS_RESOURCE_URI = "ui://impel/tasks/v1/index.html";
 // position immediately before Pull requests.
 export const DESKTOP_TASKS_NAV_ANCHOR_RULES = Object.freeze([
   { pattern: "^pull requests?\\b", position: "before" },
-  { pattern: "^code\\b", position: "after", template: "^new\\b" },
+  { pattern: "^code\\b", position: "after", template: "\\bnew\\b" },
   { pattern: "^(?:start\\s+)?new\\s+(?:chat|thread)\\b", position: "before" },
   { pattern: "^new\\b", position: "before" },
   { pattern: "^scheduled\\b", position: "before" },
@@ -184,26 +184,44 @@ const NAVIGATION_SOURCE = String.raw`(() => {
     element.querySelectorAll("kbd, [data-slot=\"shortcut\"]").forEach((candidate) => candidate.remove());
   };
 
+  const stripTemplateGlyphs = (element) => {
+    element.querySelectorAll("svg, [aria-hidden=\"true\"]").forEach((candidate) => candidate.remove());
+    const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT);
+    const glyphs = [];
+    while (walker.nextNode()) {
+      if (/^(?:\+|＋|<\/>|<>)$/u.test((walker.currentNode.nodeValue || "").trim())) {
+        glyphs.push(walker.currentNode);
+      }
+    }
+    glyphs.forEach((candidate) => {
+      const parent = candidate.parentElement;
+      candidate.remove();
+      if (
+        parent
+        && parent !== element
+        && !parent.textContent?.trim()
+        && !parent.querySelector("svg, img")
+      ) parent.remove();
+    });
+    [...element.querySelectorAll("*")].reverse().forEach((candidate) => {
+      if (
+        !candidate.textContent?.trim()
+        && !candidate.querySelector("svg, img, input")
+      ) candidate.remove();
+    });
+  };
+
   const makeNav = (template) => {
     const button = template ? template.cloneNode(true) : document.createElement("button");
     stripVendorActions(button);
+    stripTemplateGlyphs(button);
     button.id = NAV_ID;
     button.type = "button";
     button.setAttribute("aria-label", "Tasks");
     button.setAttribute("title", "Tasks");
     button.classList.add("impel-desktop-tasks-nav");
     if (!replaceText(button)) button.textContent = "Tasks";
-    const icon = button.querySelector("svg");
-    if (icon) {
-      icon.setAttribute("viewBox", "0 0 24 24");
-      icon.setAttribute("fill", "none");
-      icon.setAttribute("stroke", "currentColor");
-      icon.setAttribute("stroke-width", "2");
-      icon.setAttribute("stroke-linecap", "round");
-      icon.setAttribute("stroke-linejoin", "round");
-      icon.innerHTML = '<rect x="3" y="3" width="18" height="18" rx="2"></rect><path d="M9 3v18"></path><path d="M15 3v18"></path>';
-    }
-    else button.insertAdjacentHTML("afterbegin", TASKS_ICON);
+    button.insertAdjacentHTML("afterbegin", TASKS_ICON);
     button.addEventListener("click", (event) => {
       event.preventDefault();
       event.stopPropagation();
@@ -245,8 +263,12 @@ const NAVIGATION_SOURCE = String.raw`(() => {
         break;
       }
     }
-    const template = anchorRule?.template ? findControl(anchorRule.template) || anchor : anchor;
+    const template = anchorRule?.template ? findControl(anchorRule.template) : anchor;
     lastAnchor = anchor;
+    // Claude mounts its Home/Code switcher before the New row. Do not clone the
+    // switcher as a temporary fallback: its Code glyph would remain in the
+    // injected control after the intended visual template appears.
+    if (!anchor || !template) return;
     if (!nav?.isConnected) nav = makeNav(template);
     const target = placement(anchor);
     const templateTarget = placement(template);

package/src/vendorCliBinaries.js

@@ -38,6 +38,7 @@ export function verifyReviewedMacVendorCli(
   {
     run = spawnSync,
     realpath = fs.realpathSync,
+    stat = fs.statSync,
     versions = PINNED_VENDOR_CLI_VERSIONS,
     signingTeams = MAC_VENDOR_SIGNING_TEAMS,
     environmentPrefix = "IMPEL",
@@ -61,6 +62,25 @@ export function verifyReviewedMacVendorCli(
     if (version !== versions[tool]) return false;
 
     const resolved = realpath(binary);
+    if (tool === "codex") {
+      const codeModeHost = path.join(path.dirname(resolved), "codex-code-mode-host");
+      if (!stat(codeModeHost).isFile()) return false;
+      const helperVerified = run("/usr/bin/codesign", ["--verify", "--strict", codeModeHost], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 15_000,
+      });
+      if (helperVerified?.status !== 0 || helperVerified?.error) return false;
+      const helperDetails = run("/usr/bin/codesign", ["-dv", "--verbose=4", codeModeHost], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 15_000,
+      });
+      if (helperDetails?.status !== 0
+        || !String(helperDetails.stderr || helperDetails.stdout || "").includes(`TeamIdentifier=${signingTeams[tool]}`)) {
+        return false;
+      }
+    }
     const verified = run("/usr/bin/codesign", ["--verify", "--strict", resolved], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],