impel-cli 0.20.45 → 0.20.46-beta.2

package/README.md

@@ -384,7 +384,7 @@ impel tasks delete IMP-123 --yes
 Use `--json` when exact machine-readable fields matter. Gateway-only members
 cannot use task CRUD.
 
-### Native Tasks MCP App
+### Native Tasks board and MCP tools
 
 Setup and update register a second tenant-bound MCP server named
 `impel-tasks` in Impel-managed Claude and Codex/ChatGPT profiles. It is separate
@@ -404,14 +404,20 @@ control-plane HTTP bearer credential, and fixes tenant selection in the
 transport header. Generated Claude/Codex MCP entries contain neither the PAT
 nor a tenant-derived credential.
 
-- The pinned Impel Claude Desktop renders the standard MCP Apps task board when
-  its host supports that protocol.
-- The exact pinned Impel Codex desktop profile enables its reviewed
-  `enable_mcp_apps` contract so `show_tasks` can render the same board. The
-  vendor-pin test fails closed if the embedded Codex binary stops accepting it.
+- Managed Claude and ChatGPT/Codex apps on macOS add one persistent Tasks
+  destination. Windows keeps the tenant-bound headless `impel-tasks` tools but
+  does not inject the board into the signed Store/MSIX apps: their verified
+  Electron archives cannot be patched without invalidating vendor signatures.
+  It loads the authenticated canonical Impel `/tasks` application directly in
+  a sandboxed, tenant-isolated web view; a fresh profile uses the existing
+  Board default.
+- The trusted native process obtains the selected tenant credential through a
+  private one-shot pipe, exchanges the PAT for a bounded HttpOnly web session,
+  and then loads `/tasks` without an Authorization header. The web renderer has
+  no preload, Node integration, credential API, or IPC bridge.
 - Claude Code and Codex CLI profiles remain headless and receive complete task
-  tools plus text results; the desktop-only renderer flag is never written to
-  those profiles.
+  tools plus text results. Desktop Codex no longer enables the MCP Apps
+  renderer; the headless `impel-tasks` server remains for model/tool access.
 - Profiles preserve unrelated MCP servers. If a user-authored server already
   owns the `impel-tasks` name, setup/update fails with remediation instead of
   overwriting it.
@@ -525,15 +531,148 @@ Main paths:
 ~/.config/impel/config.json
 ~/.config/impel/cli/tenants/<tenant>/
 ~/.config/impel/apps/tenants/<tenant>/
+~/.config/impel/update-check.json
+~/.config/impel/flags.json
+~/.config/impel/telemetry-notice.json
+~/.config/impel/telemetry/
+~/.config/impel/reports/
 ```
 
 The config directory is owner-only and the config file is written with mode
 `0600` where supported. Generated client profiles use tenant-bound helper
 invocations; PAT material is not embedded into shell entries.
 
+`flags.json` caches server-evaluated feature flags for the current principal.
+`telemetry/` holds queued analytics events waiting to be sent, plus their
+send state; it is empty unless analytics are on. `reports/` holds bug reports
+that could not be delivered, kept so they are never lost, bounded to the last
+50 and nothing older than 30 days; its hidden `.last-auto-report.json` records
+what this machine last reported automatically, so the same failure is not
+reported twice in a day. Everything above lives under one directory, so
+`impel nuke` erases all of it.
+
 Losing membership does not delete local tenant data. A future cleanup feature
 must remain explicit and destructive-state aware.
 
+## Privacy
+
+Analytics are off unless you turn them on: nothing in the first table below is
+sent until `telemetry.enabled` is `true` in `config.json`, which only
+`impel setup --analytics on` writes.
+
+Failure reports are the one exception and are described in their own section
+further down. When `impel setup` or `impel update` runs out of ways to fix a
+failure, the CLI files a bug report about that failure whether or not analytics
+are on. That is deliberate: a broken install cannot be fixed by people who never
+hear about it, and the machines least likely to opt in are the ones failing.
+
+**Usage analytics** (`cli_command_run`, one per command, sent when enabled):
+
+| Field | Example | Notes |
+|---|---|---|
+| `command` | `claude` | The command name only — never its arguments |
+| `outcome` | `success` | `success`, `failure`, or `refused` |
+| `durationBucket` | `lt_5s` | A coarse bucket, not a duration |
+| `cliVersion` | `0.20.41` | |
+| `channel` | `latest` | npm release channel |
+| `platform` | `darwin` | `darwin`, `linux`, `win32`, or `unknown` |
+
+**Bug reports** (`cli_bug_report`, one per delivered report): the same
+`cliVersion`, `channel`, and `platform`, plus whether a message was attached,
+whether a task was filed, and if not, why.
+
+Events are identified by the account your PAT resolves to, stamped by the
+server. Nothing else is collected: no command arguments, file contents,
+prompts, session content, environment variables, paths, or credentials. Events
+are validated against a closed allowlist before they reach disk, and anything
+that still looks like a secret after redaction is dropped locally and reported
+by `impel status`.
+
+Events are queued on disk and sent by a detached background process, so no
+command ever waits on the network. Analytics never initialize inside a managed
+desktop app profile or a non-interactive surface.
+
+**Turning analytics off.** Any one of these is enough, and each overrides a
+stored `yes`:
+
+```sh
+IMPEL_DISABLE_TELEMETRY=1 impel claude   # also accepts true/yes
+DO_NOT_TRACK=1 impel claude
+```
+
+Any non-empty `CI` value suppresses analytics as well. To change the stored
+answer, run `impel setup --analytics off`. To erase everything already queued,
+run `impel nuke`.
+
+## Automatic failure reports
+
+When `impel setup` or `impel update` fails in a way it cannot recover from, the
+CLI files a bug report about that failure and prints one line saying so, with
+the report's id and how to turn the behavior off. It does not ask first.
+
+**What triggers one.** Only a terminal failure of `impel setup` or `impel
+update` — a failure that recovery already tried and could not repair. A failure
+that recovery fixes is not a failure, and reports nothing. No other command
+reports itself, and a successful run never reports.
+
+**What is in it.** The same fields `impel report` sends, assembled from what the
+command already had in hand:
+
+| Field | Example | Notes |
+|---|---|---|
+| `message` | `The npm-verified global impel-cli update failed.` | Written by the CLI, not by you |
+| `cliVersion` | `0.20.41` | |
+| `nodeVersion` | `v22.11.0` | |
+| `platform` | `darwin` | |
+| `architecture` | `arm64` | |
+| `channel` | `latest` | npm release channel |
+| `command` | `npm install --global impel-cli` | The command that failed, when there was one |
+| `exitCode` | `1` | |
+| `errorCode` | `install_failed` | |
+| `stderr` | | That command's output, redacted |
+| `diagnostics` | `{ "step": "install.impel_cli", "reportId": "…" }` | The failing step, the report id, and a handful of scalars naming what the run was doing |
+
+Credentials, home directory paths, and email addresses are removed before
+anything leaves the machine, by the same redaction the manual command uses.
+Nothing else is collected: no arguments beyond the failing command line, no file
+contents, no prompts, no session content, no environment variables.
+
+**Turning it off.** Either of these, and only these:
+
+```sh
+IMPEL_DO_NOT_TRACK=1 impel setup
+IMPEL_CI=1 impel setup
+```
+
+Bare `DO_NOT_TRACK` and bare `CI` **do not** suppress failure reports, though
+they still suppress analytics. The two surfaces have different contracts on
+purpose: `CI` is set by every CI runner on earth and says nothing about whether
+its operators want to hear that installs are broken there, and deciding that for
+them is how a broken install stays broken. Suppressing a failure report takes
+the branded name, typed on purpose.
+
+The consequence is worth stating plainly: a GitHub Actions job sets `CI=true`,
+not `IMPEL_CI`, so a repeatedly failing `impel setup` in an unmodified CI
+pipeline files a report every run until someone sets `IMPEL_CI=1`.
+
+Reports are also suppressed when the CLI is a rebranded distribution, when it
+runs inside a managed desktop app profile, and when there is no PAT to attribute
+the report to.
+
+**The same failure is not reported twice in a day.** The report id is a
+fingerprint of the report's own contents, so an identical failure produces an
+identical id; `~/.config/impel/reports/.last-auto-report.json` records what was
+reported and when, and a repeat inside 24 hours is dropped silently.
+
+**Delivery is best effort and never blocks.** Two retries against an unreachable
+control plane, then the report is written to `~/.config/impel/reports/` like any
+other undelivered report. A reporting failure never changes the exit code of the
+command that failed, and never adds a second error message to the one you
+already got.
+
+`impel report` remains a message you choose to send: neither switch above
+disables it, and it works whether or not analytics are on.
+
 ## Public command surface
 
 ```text
@@ -548,6 +687,7 @@ impel tasks ...
 impel pat ...
 impel status
 impel doctor
+impel report
 ```
 
 Profile helpers, content synchronization, desktop maintenance, and transport

package/RELEASE_NOTES.md

@@ -1,5 +1,64 @@
 # Release notes
 
+## 0.20.46-beta.2 — Reload reconciled apps safely
+
+- Closes every running managed macOS app before rewriting its profile and
+  desktop Tasks preloads, then reopens only the managed launchers that the
+  reconcile run actually closed. Current bundles still avoid an unnecessary
+  rebuild.
+- Allows the production Tasks board to load GitHub-hosted member avatars while
+  keeping desktop web-view egress restricted to exact reviewed origins.
+- States the signed-platform boundary explicitly: persistent in-app Tasks
+  navigation is a macOS feature; Windows retains tenant-bound headless Tasks
+  tools because modifying Store/MSIX Electron archives would invalidate the
+  verified vendor signatures.
+- Gives Claude doctor probes enough output budget for reasoning-capable models
+  and reports non-terminal provider stop reasons such as token exhaustion
+  directly instead of presenting them as an unexplained missing acknowledgement.
+- Preserves the `0.20.46-beta.1` released fixture and captures this prerelease as
+  a separate upgrade corpus without advancing the managed config or bundle
+  fingerprints.
+
+## 0.20.46-beta.1 — Embed the canonical Tasks board
+
+- Replaces the duplicate desktop Tasks renderer with the authenticated
+  `www.useimpel.com/tasks` application in a sandboxed, tenant-isolated web
+  view. A fresh profile opens the existing Board default.
+- Exchanges the tenant-bound Tasks PAT for an eight-hour HttpOnly web session
+  through a one-shot, header-only bootstrap. The PAT never enters a URL,
+  renderer, IPC bridge, profile, launch argument, or log.
+- Removes the desktop-only Codex MCP Apps renderer flag while retaining the
+  tenant-bound headless Tasks MCP tools for CLI/model compatibility.
+- Keeps the v1 Tasks widget available on the control plane for already-installed
+  desktop clients; its source and resource are retired only after the beta and
+  stable rollout cutoff is explicitly approved.
+- Retains the telemetry, remote flags, and failure-reporting capabilities from
+  `0.20.46-beta.0`; beta users do not lose that prerelease functionality.
+- Keeps a selected board visible when its host loses focus, and confines the
+  native Tasks fallback to the primary vendor window so first-run auxiliary
+  windows cannot cover or stall the board.
+- Targets npm's existing `next` dist-tag. Promote the same
+  reviewed tree to stable `0.20.46` only after the session endpoint is deployed
+  and the isolated pinned-app launch smoke passes.
+
+## 0.20.46 — Restore exact ChatGPT Store compatibility
+
+- Updates the coordinated reviewed ChatGPT pin to desktop `26.803.81509`,
+  embedded Codex `0.147.0-alpha.6.6`, and Windows Store package
+  `26.803.10989.0`, restoring managed installation while keeping artifact,
+  signature, runtime, and version checks exact and fail-closed.
+- Retries gateway model-catalog body-read timeouts as readiness failures while
+  preserving malformed-catalog failures and one shared bounded retry policy.
+- Prevents cooperating verbatim-relay hosts from adding external sources on
+  every managed relay surface, including the default Claude slash command.
+- Preserves the original vendor-install failure and the untouched sibling app
+  during targeted recovery, instead of replacing useful diagnostics or
+  disturbing an otherwise healthy managed app.
+- Accepts the control plane's `cancelled` task progress value in `impel tasks`
+  validation and command help.
+- Carries the exact-pin compatibility repair through the `0.20.46` prerelease
+  train before stable promotion.
+
 ## 0.20.41 — Windows onboarding: converge over an already-installed Store ChatGPT
 
 - Accepts winget's UPDATE_NOT_APPLICABLE result during setup as well as

package/docs/native-agent-host-capability-matrix.md

@@ -1,6 +1,6 @@
 # Native-agent host capability matrix
 
-Validated on 2026-08-09 with isolated temporary homes and tenant profiles. The
+Validated on 2026-08-11 with isolated temporary homes and tenant profiles. The
 matrix is intentionally pinned: a client upgrade must be re-qualified before it
 is treated as an eager host.
 
@@ -9,7 +9,7 @@ is treated as an eager host.
 | Claude Code | 2.1.220 | Yes, agent frontmatter `tools` | Eager; optional single-thread selection | The bound run/answer, resume, and recovery tools are direct child tools. `impel claude --agent` verifies the exact managed adapter before enabling 2.1.220's bypass-permission opt-in and mode. |
 | Claude Desktop | 1.26832.0 (embedded Code 2.1.222) | Yes, agent frontmatter `tools` | Eager | Same direct-tool contract as Claude Code. |
 | Codex CLI through `impel codex` | 0.147.0 | Yes, with `features.code_mode.direct_only_tool_namespaces = ["mcp__impel_agent"]` | Eager; optional single-thread profile | Existing `@Agent` children call the fixed MCP namespace directly. `impel codex --agent` also removes the parent spawn/wait/relay thread. |
-| ChatGPT desktop Codex | 26.803.41515 (embedded Codex 0.147.0-alpha.6.5) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
+| ChatGPT desktop Codex | 26.803.81509 (embedded Codex 0.147.0-alpha.6.6) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
 
 ## Qualified contract
 
@@ -48,9 +48,9 @@ is treated as an eager host.
   and re-qualified rather than receiving unknown configuration.
 - `mcp__impel_agent` is the native tool namespace. The server id
   `impel_agent` is not equivalent and does not qualify as direct exposure.
-- Generated Codex fixed-binding adapters use the ultra-fast Codex Spark model
-  at low reasoning for the thin tool-selection and terminal-relay turns, with
-  unrelated local host, plugin, remote-plugin, and skill-catalog context
+- Generated Codex fixed-binding adapters use the Code Mode-compatible Luna
+  model at low reasoning for the thin tool-selection and terminal-relay turns,
+  with unrelated local host, plugin, remote-plugin, and skill-catalog context
   disabled. The selected Eve agent, not this wrapper model, still owns the
   substantive task.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.45",
+  "version": "0.20.46-beta.2",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/agents.js

@@ -65,14 +65,14 @@ export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
 export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 24;
+export const MANAGED_AGENT_MANIFEST_VERSION = 25;
 export const IMPEL_NATIVE_PARENT_DIRECT_ENV = "IMPEL_NATIVE_PARENT_DIRECT";
 export const IMPEL_NATIVE_SLASH_COMMANDS_ENV = "IMPEL_NATIVE_SLASH_COMMANDS";
 
 // The host model only selects the fixed MCP tool and faithfully returns its
-// result. Spark minimizes those transport-only turns while the selected Eve
-// agent remains responsible for the substantive work.
-const CODEX_AGENT_ADAPTER_MODEL = "gpt-5.3-codex-spark";
+// result. Luna advertises the code-mode contract required by the direct-only
+// adapter while the selected Eve agent remains responsible for substantive work.
+const CODEX_AGENT_ADAPTER_MODEL = "gpt-5.6-luna";
 
 const NATIVE_AGENT_TOOL_NAMES = [
   NATIVE_AGENT_RUN_TOOL,

package/src/apps.js

@@ -6,7 +6,6 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import {
   enableManagedCodexDesktopCodeModeHost,
-  enableManagedCodexDesktopMcpApps,
   hardenManagedCodexToml,
   secureAllManagedCodexHomes,
   secureManagedCodexHome,
@@ -29,7 +28,6 @@ import { CURRENT_CONFIG_VERSION } from "./managedProfileVersion.js";
 import { IMPEL_CODEX_PARENT_DELEGATION_INSTRUCTIONS } from "./commands/launch.js";
 import {
   desktopTasksAssetPaths,
-  desktopTasksHostHtml,
   desktopTasksMainPreload,
   desktopTasksViewPreload,
 } from "./desktopTasks.js";
@@ -107,8 +105,8 @@ export const PINNED_VENDOR_APPS = Object.freeze({
     }),
   }),
   chatgpt: Object.freeze({
-    version: "26.803.41515",
-    codexVersion: "0.147.0-alpha.6.5",
+    version: "26.803.81509",
+    codexVersion: "0.147.0-alpha.6.6",
     bundleName: "ChatGPT.app",
     windows: Object.freeze({
       storeProductId: "9PLM9XGG6VKS",
@@ -116,20 +114,20 @@ export const PINNED_VENDOR_APPS = Object.freeze({
       // The Microsoft Store manifest identifies this exact reviewed build.
       // Keep one Windows package version so the manifest contract and local
       // AppX validation cannot silently drift apart again.
-      packageVersion: "26.803.5235.0",
-      codexVersion: "0.147.0-alpha.6.5",
+      packageVersion: "26.803.10989.0",
+      codexVersion: "0.147.0-alpha.6.6",
       publisherId: "2p2nqsd0c76g0",
       executable: "app\\ChatGPT.exe",
       updateManifestUrl: "https://persistent.oaistatic.com/codex-app-prod/windows-store-update.json",
     }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.41515.zip",
-        sha256: "8abd46bf063bc27cbadcbc2863007ac44365b13a23ede17ceaee81fb9eeaeb9a",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.81509.zip",
+        sha256: "34c7e629678ad5d63a639ec694a5b83b85f4e1bd7c21ee2abcfefbb041095b9c",
       }),
       x64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.803.41515.zip",
-        sha256: "87239a3dd12e2761de515ee78a0b73c02ac907c34c1f01a68dd6f093cf433fb1",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.803.81509.zip",
+        sha256: "c9d5a14803c3138a77be5e891a4944c04ff421645150043dd3eddd0bf34eda97",
       }),
     }),
   }),
@@ -511,6 +509,38 @@ export function blockingAppNames(targets, { tenantId = null, tenantName = null }
   return [...new Set(names)];
 }
 
+function blockingAppEntries(targets, {
+  tenantId = null,
+  tenantName = null,
+  homeDir = os.homedir(),
+  bundleTargets = targets,
+} = {}) {
+  const bundleTargetSet = new Set(bundleTargets);
+  const paths = appPaths(homeDir, tenantId, { tenantName });
+  const legacyPaths = tenantId ? appPaths(homeDir) : null;
+  const entries = [];
+  for (const target of targets) {
+    if (bundleTargetSet.has(target)) {
+      for (const root of vendorSearchRoots(homeDir, target)) {
+        for (const bundleName of APP_DEFINITIONS[target].names) {
+          entries.push({
+            name: bundleName.replace(/\.app$/u, ""),
+            appPath: path.join(root, bundleName),
+          });
+        }
+      }
+      if (legacyPaths) {
+        entries.push({ name: APP_DEFINITIONS[target].label, appPath: legacyPaths[target].launcher });
+      }
+    }
+    entries.push({
+      name: managedLauncherName(target, { tenantId, tenantName }),
+      appPath: paths[target].launcher,
+    });
+  }
+  return [...new Map(entries.map((entry) => [entry.appPath, entry])).values()];
+}
+
 /**
  * pgrep/pkill -f pattern for one app's processes. Anchored on
  * "/<Name>.app/.../Contents/MacOS/" so "Claude" never matches the
@@ -522,6 +552,14 @@ export function appProcessPattern(name) {
   return `/${escaped}\\.app/(.*/)?Contents/MacOS/`;
 }
 
+/** Anchored process pattern for one exact outer app bundle. */
+export function appBundleProcessPattern(appPath) {
+  // App bundles and process argv paths are macOS/POSIX paths even when this
+  // pure helper is exercised by the cross-platform test matrix.
+  const escaped = path.posix.resolve(appPath).replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return `^${escaped}/(.*/)?Contents/MacOS/`;
+}
+
 const QUIT_POLL_MS = 500;
 
 /**
@@ -535,39 +573,46 @@ const QUIT_POLL_MS = 500;
 export async function quitBlockingApps(targets, {
   tenantId = null,
   tenantName = null,
+  homeDir = os.homedir(),
+  bundleTargets = targets,
   log = console.log,
-  isRunning = (name) =>
-    spawnSync("/usr/bin/pgrep", ["-f", appProcessPattern(name)], { stdio: "ignore" }).status === 0,
-  requestQuit = (name) =>
+  isRunning = (_name, appPath) =>
+    spawnSync("/usr/bin/pgrep", ["-f", appBundleProcessPattern(appPath)], { stdio: "ignore" }).status === 0,
+  requestQuit = (_name, appPath) =>
     // osascript `tell` would LAUNCH a non-running app, so callers must gate on
     // isRunning first; the timeout covers apps stuck on a save/confirm dialog.
-    spawnSync("/usr/bin/osascript", ["-e", `tell application ${JSON.stringify(name)} to quit`], {
+    spawnSync("/usr/bin/osascript", ["-e", `tell application ${JSON.stringify(appPath)} to quit`], {
       stdio: "ignore",
       timeout: 8_000,
     }),
-  forceQuit = (name) =>
-    spawnSync("/usr/bin/pkill", ["-f", appProcessPattern(name)], { stdio: "ignore" }),
+  forceQuit = (_name, appPath) =>
+    spawnSync("/usr/bin/pkill", ["-f", appBundleProcessPattern(appPath)], { stdio: "ignore" }),
   wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
   quitWaitMs = 10_000,
   killWaitMs = 5_000,
 } = {}) {
-  async function goneWithin(name, budgetMs) {
+  async function goneWithin(name, appPath, budgetMs) {
     for (let waited = 0; waited <= budgetMs; waited += QUIT_POLL_MS) {
-      if (!isRunning(name)) return true;
+      if (!isRunning(name, appPath)) return true;
       await wait(QUIT_POLL_MS);
     }
-    return !isRunning(name);
+    return !isRunning(name, appPath);
   }
 
   const closed = [];
-  for (const name of blockingAppNames(targets, { tenantId, tenantName })) {
-    if (!isRunning(name)) continue;
+  for (const { name, appPath } of blockingAppEntries(targets, {
+    tenantId,
+    tenantName,
+    homeDir,
+    bundleTargets,
+  })) {
+    if (!isRunning(name, appPath)) continue;
     log(`${name} is running; closing it before touching app bundles…`);
-    requestQuit(name);
-    if (await goneWithin(name, quitWaitMs)) { closed.push(name); continue; }
+    requestQuit(name, appPath);
+    if (await goneWithin(name, appPath, quitWaitMs)) { closed.push(name); continue; }
     log(`${name} did not quit gracefully; terminating it…`);
-    forceQuit(name);
-    if (await goneWithin(name, killWaitMs)) { closed.push(name); continue; }
+    forceQuit(name, appPath);
+    if (await goneWithin(name, appPath, killWaitMs)) { closed.push(name); continue; }
     throw new Error(`${name} is still running; close it manually, then re-run`);
   }
   return closed;
@@ -615,11 +660,14 @@ export function appPaths(homeDir = os.homedir(), tenantId = null, {
   };
 }
 
-function writeDesktopTasksProfileAssets(root) {
+function writeDesktopTasksProfileAssets(root, appUrl) {
   const assets = desktopTasksAssetPaths(root);
-  writeAtomic(assets.mainPreload, desktopTasksMainPreload(), 0o600);
+  writeAtomic(assets.mainPreload, desktopTasksMainPreload(appUrl), 0o600);
   writeAtomic(assets.viewPreload, desktopTasksViewPreload(), 0o600);
-  writeAtomic(assets.hostHtml, desktopTasksHostHtml(), 0o600);
+  // This exact path is Impel-owned. Remove the former local MCP Apps host when
+  // a profile is regenerated; old released clients keep the immutable server
+  // resource during the rollout window.
+  fs.rmSync(assets.hostHtml, { force: true });
   return assets;
 }
 
@@ -828,7 +876,10 @@ export function installManagedAppFiles({
 
   const installed = [];
   for (const target of targets) {
-    writeDesktopTasksProfileAssets(paths[target].root);
+    writeDesktopTasksProfileAssets(
+      paths[target].root,
+      config.appUrl || RUNTIME_BRAND.controlPlane.defaultOrigin,
+    );
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app
     // to be closed (see quitBlockingApps), so those paths never attempt one.
@@ -1444,7 +1495,7 @@ function writeChatGPTConfig(
   writeAtomic(
     configPath,
     enableManagedCodexDesktopCodeModeHost(
-      enableManagedCodexDesktopMcpApps(hardenedToml, configPath),
+      hardenedToml,
       configPath,
     ),
     0o600,
@@ -1603,11 +1654,9 @@ export function managedChatGPTConfigDrifted(paths) {
   // surface the vendor settings writer rewrites. code_mode_host is
   // load-bearing: without it pinned Codex fails closed on the code_mode_only
   // default model, so a dropped key must self-heal as drift rather than wait
-  // out the refresh TTL. enable_mcp_apps only degrades rendering but rides
-  // the same check. Configs from generations before the keys existed are
+  // out the refresh TTL. Configs from generations before the key existed are
   // merely stale (the manifest version bump rewrites them), never drift —
-  // require the keys only once this install's manifest proves they were
-  // written.
+  // require it only once this install's manifest proves it was written.
   let manifestConfigVersion = 0;
   try {
     manifestConfigVersion = Number(JSON.parse(
@@ -1618,8 +1667,7 @@ export function managedChatGPTConfigDrifted(paths) {
   }
   const featuresTable = current.match(/^\[features\]\n(?:[^[\n][^\n]*\n|\n)*/mu)?.[0] || "";
   const featureKeysDropped = manifestConfigVersion >= 35
-    && (!/^code_mode_host = true$/mu.test(featuresTable)
-      || !/^enable_mcp_apps = true$/mu.test(featuresTable));
+    && !/^code_mode_host = true$/mu.test(featuresTable);
   return !current.includes(CHATGPT_CONFIG_START)
     || readTopLevelTomlString(current, "model_provider") !== RUNTIME_BRAND.cli.providerId
     || !readTopLevelTomlString(current, "chatgpt_base_url")