impel-cli 0.20.46-beta.0 → 0.20.46

package/README.md

@@ -384,7 +384,7 @@ impel tasks delete IMP-123 --yes
 Use `--json` when exact machine-readable fields matter. Gateway-only members
 cannot use task CRUD.
 
-### Native Tasks MCP App
+### Native Tasks board and MCP tools
 
 Setup and update register a second tenant-bound MCP server named
 `impel-tasks` in Impel-managed Claude and Codex/ChatGPT profiles. It is separate
@@ -404,14 +404,20 @@ control-plane HTTP bearer credential, and fixes tenant selection in the
 transport header. Generated Claude/Codex MCP entries contain neither the PAT
 nor a tenant-derived credential.
 
-- The pinned Impel Claude Desktop renders the standard MCP Apps task board when
-  its host supports that protocol.
-- The exact pinned Impel Codex desktop profile enables its reviewed
-  `enable_mcp_apps` contract so `show_tasks` can render the same board. The
-  vendor-pin test fails closed if the embedded Codex binary stops accepting it.
+- Managed Claude and ChatGPT/Codex apps on macOS add one persistent Tasks
+  destination. Windows keeps the tenant-bound headless `impel-tasks` tools but
+  does not inject the board into the signed Store/MSIX apps: their verified
+  Electron archives cannot be patched without invalidating vendor signatures.
+  It loads the authenticated canonical Impel `/tasks` application directly in
+  a sandboxed, tenant-isolated web view; a fresh profile uses the existing
+  Board default.
+- The trusted native process obtains the selected tenant credential through a
+  private one-shot pipe, exchanges the PAT for a bounded HttpOnly web session,
+  and then loads `/tasks` without an Authorization header. The web renderer has
+  no preload, Node integration, credential API, or IPC bridge.
 - Claude Code and Codex CLI profiles remain headless and receive complete task
-  tools plus text results; the desktop-only renderer flag is never written to
-  those profiles.
+  tools plus text results. Desktop Codex no longer enables the MCP Apps
+  renderer; the headless `impel-tasks` server remains for model/tool access.
 - Profiles preserve unrelated MCP servers. If a user-authored server already
   owns the `impel-tasks` name, setup/update fails with remediation instead of
   overwriting it.

package/RELEASE_NOTES.md

@@ -1,5 +1,70 @@
 # Release notes
 
+## 0.20.46-beta.2 — Reload reconciled apps safely
+
+- Closes every running managed macOS app before rewriting its profile and
+  desktop Tasks preloads, then reopens only the managed launchers that the
+  reconcile run actually closed. Current bundles still avoid an unnecessary
+  rebuild.
+- Allows the production Tasks board to load GitHub-hosted member avatars while
+  keeping desktop web-view egress restricted to exact reviewed origins.
+- States the signed-platform boundary explicitly: persistent in-app Tasks
+  navigation is a macOS feature; Windows retains tenant-bound headless Tasks
+  tools because modifying Store/MSIX Electron archives would invalidate the
+  verified vendor signatures.
+- Gives Claude doctor probes enough output budget for reasoning-capable models
+  and reports non-terminal provider stop reasons such as token exhaustion
+  directly instead of presenting them as an unexplained missing acknowledgement.
+- Preserves the `0.20.46-beta.1` released fixture and captures this prerelease as
+  a separate upgrade corpus without advancing the managed config or bundle
+  fingerprints.
+
+## 0.20.46-beta.1 — Embed the canonical Tasks board
+
+- Replaces the duplicate desktop Tasks renderer with the authenticated
+  `www.useimpel.com/tasks` application in a sandboxed, tenant-isolated web
+  view. A fresh profile opens the existing Board default.
+- Exchanges the tenant-bound Tasks PAT for an eight-hour HttpOnly web session
+  through a one-shot, header-only bootstrap. The PAT never enters a URL,
+  renderer, IPC bridge, profile, launch argument, or log.
+- Removes the desktop-only Codex MCP Apps renderer flag while retaining the
+  tenant-bound headless Tasks MCP tools for CLI/model compatibility.
+- Keeps the v1 Tasks widget available on the control plane for already-installed
+  desktop clients; its source and resource are retired only after the beta and
+  stable rollout cutoff is explicitly approved.
+- Retains the telemetry, remote flags, and failure-reporting capabilities from
+  `0.20.46-beta.0`; beta users do not lose that prerelease functionality.
+- Keeps a selected board visible when its host loses focus, and confines the
+  native Tasks fallback to the primary vendor window so first-run auxiliary
+  windows cannot cover or stall the board.
+- Targets npm's existing `next` dist-tag. Promote the same
+  reviewed tree to stable `0.20.46` only after the session endpoint is deployed
+  and the isolated pinned-app launch smoke passes.
+
+## 0.20.46 — Ship hardened managed apps and the embedded Tasks board
+
+- Promotes the tested `0.20.46-beta.2` tree without changing its managed
+  profile or bundle fingerprints.
+- Updates the coordinated reviewed ChatGPT pin to desktop `26.803.81509`,
+  embedded Codex `0.147.0-alpha.6.6`, and Windows Store package
+  `26.803.10989.0`, keeping artifact, signature, runtime, and version checks
+  exact and fail-closed.
+- Embeds the authenticated canonical Impel Tasks board in managed macOS Claude
+  and ChatGPT apps through a sandboxed, tenant-isolated web view while retaining
+  tenant-bound headless Tasks tools on Windows and in both CLIs.
+- Closes every running managed macOS app before rewriting its profile and Tasks
+  preloads, then reopens only the exact managed launchers the update closed;
+  current bundles still avoid unnecessary rebuilds.
+- Uses a code-mode-compatible Codex model for explicit tenant-agent adapters
+  and refreshes existing generated adapters through the managed-agent manifest.
+- Keeps Tasks cold starts and the native navigation fallback reliable, permits
+  only the reviewed GitHub avatar origin, and gives reasoning-capable Claude
+  doctor probes enough output budget with actionable non-terminal stop reasons.
+- Retries gateway model-catalog body-read timeouts as readiness failures,
+  preserves original targeted-recovery diagnostics and healthy sibling apps,
+  prevents external-source additions on managed verbatim-relay surfaces, and
+  accepts the control plane's `cancelled` task progress value.
+
 ## 0.20.41 — Windows onboarding: converge over an already-installed Store ChatGPT
 
 - Accepts winget's UPDATE_NOT_APPLICABLE result during setup as well as

package/docs/native-agent-host-capability-matrix.md

@@ -48,9 +48,9 @@ is treated as an eager host.
   and re-qualified rather than receiving unknown configuration.
 - `mcp__impel_agent` is the native tool namespace. The server id
   `impel_agent` is not equivalent and does not qualify as direct exposure.
-- Generated Codex fixed-binding adapters use the ultra-fast Codex Spark model
-  at low reasoning for the thin tool-selection and terminal-relay turns, with
-  unrelated local host, plugin, remote-plugin, and skill-catalog context
+- Generated Codex fixed-binding adapters use the Code Mode-compatible Luna
+  model at low reasoning for the thin tool-selection and terminal-relay turns,
+  with unrelated local host, plugin, remote-plugin, and skill-catalog context
   disabled. The selected Eve agent, not this wrapper model, still owns the
   substantive task.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.46-beta.0",
+  "version": "0.20.46",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/agents.js

@@ -65,14 +65,14 @@ export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
 export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 24;
+export const MANAGED_AGENT_MANIFEST_VERSION = 25;
 export const IMPEL_NATIVE_PARENT_DIRECT_ENV = "IMPEL_NATIVE_PARENT_DIRECT";
 export const IMPEL_NATIVE_SLASH_COMMANDS_ENV = "IMPEL_NATIVE_SLASH_COMMANDS";
 
 // The host model only selects the fixed MCP tool and faithfully returns its
-// result. Spark minimizes those transport-only turns while the selected Eve
-// agent remains responsible for the substantive work.
-const CODEX_AGENT_ADAPTER_MODEL = "gpt-5.3-codex-spark";
+// result. Luna advertises the code-mode contract required by the direct-only
+// adapter while the selected Eve agent remains responsible for substantive work.
+const CODEX_AGENT_ADAPTER_MODEL = "gpt-5.6-luna";
 
 const NATIVE_AGENT_TOOL_NAMES = [
   NATIVE_AGENT_RUN_TOOL,

package/src/apps.js

@@ -6,7 +6,6 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import {
   enableManagedCodexDesktopCodeModeHost,
-  enableManagedCodexDesktopMcpApps,
   hardenManagedCodexToml,
   secureAllManagedCodexHomes,
   secureManagedCodexHome,
@@ -29,7 +28,6 @@ import { CURRENT_CONFIG_VERSION } from "./managedProfileVersion.js";
 import { IMPEL_CODEX_PARENT_DELEGATION_INSTRUCTIONS } from "./commands/launch.js";
 import {
   desktopTasksAssetPaths,
-  desktopTasksHostHtml,
   desktopTasksMainPreload,
   desktopTasksViewPreload,
 } from "./desktopTasks.js";
@@ -511,6 +509,38 @@ export function blockingAppNames(targets, { tenantId = null, tenantName = null }
   return [...new Set(names)];
 }
 
+function blockingAppEntries(targets, {
+  tenantId = null,
+  tenantName = null,
+  homeDir = os.homedir(),
+  bundleTargets = targets,
+} = {}) {
+  const bundleTargetSet = new Set(bundleTargets);
+  const paths = appPaths(homeDir, tenantId, { tenantName });
+  const legacyPaths = tenantId ? appPaths(homeDir) : null;
+  const entries = [];
+  for (const target of targets) {
+    if (bundleTargetSet.has(target)) {
+      for (const root of vendorSearchRoots(homeDir, target)) {
+        for (const bundleName of APP_DEFINITIONS[target].names) {
+          entries.push({
+            name: bundleName.replace(/\.app$/u, ""),
+            appPath: path.join(root, bundleName),
+          });
+        }
+      }
+      if (legacyPaths) {
+        entries.push({ name: APP_DEFINITIONS[target].label, appPath: legacyPaths[target].launcher });
+      }
+    }
+    entries.push({
+      name: managedLauncherName(target, { tenantId, tenantName }),
+      appPath: paths[target].launcher,
+    });
+  }
+  return [...new Map(entries.map((entry) => [entry.appPath, entry])).values()];
+}
+
 /**
  * pgrep/pkill -f pattern for one app's processes. Anchored on
  * "/<Name>.app/.../Contents/MacOS/" so "Claude" never matches the
@@ -522,6 +552,14 @@ export function appProcessPattern(name) {
   return `/${escaped}\\.app/(.*/)?Contents/MacOS/`;
 }
 
+/** Anchored process pattern for one exact outer app bundle. */
+export function appBundleProcessPattern(appPath) {
+  // App bundles and process argv paths are macOS/POSIX paths even when this
+  // pure helper is exercised by the cross-platform test matrix.
+  const escaped = path.posix.resolve(appPath).replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+  return `^${escaped}/(.*/)?Contents/MacOS/`;
+}
+
 const QUIT_POLL_MS = 500;
 
 /**
@@ -535,39 +573,46 @@ const QUIT_POLL_MS = 500;
 export async function quitBlockingApps(targets, {
   tenantId = null,
   tenantName = null,
+  homeDir = os.homedir(),
+  bundleTargets = targets,
   log = console.log,
-  isRunning = (name) =>
-    spawnSync("/usr/bin/pgrep", ["-f", appProcessPattern(name)], { stdio: "ignore" }).status === 0,
-  requestQuit = (name) =>
+  isRunning = (_name, appPath) =>
+    spawnSync("/usr/bin/pgrep", ["-f", appBundleProcessPattern(appPath)], { stdio: "ignore" }).status === 0,
+  requestQuit = (_name, appPath) =>
     // osascript `tell` would LAUNCH a non-running app, so callers must gate on
     // isRunning first; the timeout covers apps stuck on a save/confirm dialog.
-    spawnSync("/usr/bin/osascript", ["-e", `tell application ${JSON.stringify(name)} to quit`], {
+    spawnSync("/usr/bin/osascript", ["-e", `tell application ${JSON.stringify(appPath)} to quit`], {
       stdio: "ignore",
       timeout: 8_000,
     }),
-  forceQuit = (name) =>
-    spawnSync("/usr/bin/pkill", ["-f", appProcessPattern(name)], { stdio: "ignore" }),
+  forceQuit = (_name, appPath) =>
+    spawnSync("/usr/bin/pkill", ["-f", appBundleProcessPattern(appPath)], { stdio: "ignore" }),
   wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
   quitWaitMs = 10_000,
   killWaitMs = 5_000,
 } = {}) {
-  async function goneWithin(name, budgetMs) {
+  async function goneWithin(name, appPath, budgetMs) {
     for (let waited = 0; waited <= budgetMs; waited += QUIT_POLL_MS) {
-      if (!isRunning(name)) return true;
+      if (!isRunning(name, appPath)) return true;
       await wait(QUIT_POLL_MS);
     }
-    return !isRunning(name);
+    return !isRunning(name, appPath);
   }
 
   const closed = [];
-  for (const name of blockingAppNames(targets, { tenantId, tenantName })) {
-    if (!isRunning(name)) continue;
+  for (const { name, appPath } of blockingAppEntries(targets, {
+    tenantId,
+    tenantName,
+    homeDir,
+    bundleTargets,
+  })) {
+    if (!isRunning(name, appPath)) continue;
     log(`${name} is running; closing it before touching app bundles…`);
-    requestQuit(name);
-    if (await goneWithin(name, quitWaitMs)) { closed.push(name); continue; }
+    requestQuit(name, appPath);
+    if (await goneWithin(name, appPath, quitWaitMs)) { closed.push(name); continue; }
     log(`${name} did not quit gracefully; terminating it…`);
-    forceQuit(name);
-    if (await goneWithin(name, killWaitMs)) { closed.push(name); continue; }
+    forceQuit(name, appPath);
+    if (await goneWithin(name, appPath, killWaitMs)) { closed.push(name); continue; }
     throw new Error(`${name} is still running; close it manually, then re-run`);
   }
   return closed;
@@ -615,11 +660,14 @@ export function appPaths(homeDir = os.homedir(), tenantId = null, {
   };
 }
 
-function writeDesktopTasksProfileAssets(root) {
+function writeDesktopTasksProfileAssets(root, appUrl) {
   const assets = desktopTasksAssetPaths(root);
-  writeAtomic(assets.mainPreload, desktopTasksMainPreload(), 0o600);
+  writeAtomic(assets.mainPreload, desktopTasksMainPreload(appUrl), 0o600);
   writeAtomic(assets.viewPreload, desktopTasksViewPreload(), 0o600);
-  writeAtomic(assets.hostHtml, desktopTasksHostHtml(), 0o600);
+  // This exact path is Impel-owned. Remove the former local MCP Apps host when
+  // a profile is regenerated; old released clients keep the immutable server
+  // resource during the rollout window.
+  fs.rmSync(assets.hostHtml, { force: true });
   return assets;
 }
 
@@ -828,7 +876,10 @@ export function installManagedAppFiles({
 
   const installed = [];
   for (const target of targets) {
-    writeDesktopTasksProfileAssets(paths[target].root);
+    writeDesktopTasksProfileAssets(
+      paths[target].root,
+      config.appUrl || RUNTIME_BRAND.controlPlane.defaultOrigin,
+    );
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app
     // to be closed (see quitBlockingApps), so those paths never attempt one.
@@ -1444,7 +1495,7 @@ function writeChatGPTConfig(
   writeAtomic(
     configPath,
     enableManagedCodexDesktopCodeModeHost(
-      enableManagedCodexDesktopMcpApps(hardenedToml, configPath),
+      hardenedToml,
       configPath,
     ),
     0o600,
@@ -1603,11 +1654,9 @@ export function managedChatGPTConfigDrifted(paths) {
   // surface the vendor settings writer rewrites. code_mode_host is
   // load-bearing: without it pinned Codex fails closed on the code_mode_only
   // default model, so a dropped key must self-heal as drift rather than wait
-  // out the refresh TTL. enable_mcp_apps only degrades rendering but rides
-  // the same check. Configs from generations before the keys existed are
+  // out the refresh TTL. Configs from generations before the key existed are
   // merely stale (the manifest version bump rewrites them), never drift —
-  // require the keys only once this install's manifest proves they were
-  // written.
+  // require it only once this install's manifest proves it was written.
   let manifestConfigVersion = 0;
   try {
     manifestConfigVersion = Number(JSON.parse(
@@ -1618,8 +1667,7 @@ export function managedChatGPTConfigDrifted(paths) {
   }
   const featuresTable = current.match(/^\[features\]\n(?:[^[\n][^\n]*\n|\n)*/mu)?.[0] || "";
   const featureKeysDropped = manifestConfigVersion >= 35
-    && (!/^code_mode_host = true$/mu.test(featuresTable)
-      || !/^enable_mcp_apps = true$/mu.test(featuresTable));
+    && !/^code_mode_host = true$/mu.test(featuresTable);
   return !current.includes(CHATGPT_CONFIG_START)
     || readTopLevelTomlString(current, "model_provider") !== RUNTIME_BRAND.cli.providerId
     || !readTopLevelTomlString(current, "chatgpt_base_url")

package/src/codexSecurity.js

@@ -148,24 +148,6 @@ export function hardenManagedCodexToml(toml, configPath = "managed Codex config"
   return applyManagedCodexSandboxPolicy(withoutCredentialSnapshots, configPath);
 }
 
-/**
- * Enable the standard MCP Apps renderer only in the exact pinned desktop
- * profile. CLI profiles deliberately stay headless, and vendor-pin contract
- * tests must prove that the embedded Codex binary still recognizes this flag.
- */
-export function enableManagedCodexDesktopMcpApps(
-  toml,
-  configPath = "managed Codex desktop config",
-) {
-  return upsertManagedScalar(
-    toml,
-    "features",
-    "enable_mcp_apps",
-    "true",
-    configPath,
-  );
-}
-
 /**
  * Enable the Code Mode execution host in the exact pinned desktop profile.
  * Pinned Codex fails closed when a code_mode_only model is selected while

package/src/commands/apps.js

@@ -592,11 +592,11 @@ export async function reconcileMacTenantApps({
     .filter((status) => completedTargets.includes(status.target) && !io.bundleCurrent(status))
     .map((status) => status.target);
   let closedApps = [];
-  if (staleTargets.length) {
-    const result = await io.quitApps(staleTargets, { tenantId: config.tenantId, tenantName: config.tenantName });
+  if (completedTargets.length) {
+    const result = await io.quitApps(completedTargets, { tenantId: config.tenantId, tenantName: config.tenantName });
     if (Array.isArray(result)) closedApps = result;
   }
-  const reopenTargets = new Set(staleTargets.filter((target) => closedApps.includes(
+  const reopenTargets = new Set(completedTargets.filter((target) => closedApps.includes(
     managedLauncherName(target, { tenantId: config.tenantId, tenantName: config.tenantName }),
   )));
   const installed = completedTargets.length ? await io.installFiles({
@@ -1054,19 +1054,34 @@ export async function cmdApps(argv, overrides = {}) {
     ? [...actionTargets]
     : statuses.filter((status) => !io.bundleCurrent(status)).map((status) => status.target);
 
-  // A running vendor or Impel app only needs to close when its bundle will be
-  // swapped. Remember which managed launchers we closed so the update can
-  // reopen them afterward and feel in-place (the fast path never quits at all).
+  if (flags["skip-vendor"]) {
+    const missingVendorTargets = statuses
+      .filter((status) => staleBundleTargets.includes(status.target) && !status.vendorPath)
+      .map((status) => status.target);
+    if (missingVendorTargets.length > 0) {
+      throw new Error(
+        `${missingVendorTargets.join(", ")} verified vendor app is unavailable; rerun without --skip-vendor`,
+      );
+    }
+  }
+
+  // Every explicit install/update rewrites the isolated model profile and may
+  // refresh skills or native agents. Close a running managed app even when its
+  // bundle is current so its long-lived client process cannot keep serving the
+  // pre-update catalog. Remember only the managed launchers we actually closed
+  // and reopen those after every profile sync finishes.
   let closedApps = [];
-  if (staleBundleTargets.length > 0) {
-    const quitResult = await io.quitApps(staleBundleTargets, {
+  if (actionTargets.length > 0) {
+    const quitResult = await io.quitApps(actionTargets, {
       tenantId: config.tenantId,
       tenantName: config.tenantName,
+      homeDir: io.homeDir,
+      bundleTargets: staleBundleTargets,
     });
     if (Array.isArray(quitResult)) closedApps = quitResult;
   }
   const reopenTargets = new Set(
-    staleBundleTargets.filter((target) => closedApps.includes(
+    actionTargets.filter((target) => closedApps.includes(
       managedLauncherName(target, { tenantId: config.tenantId, tenantName: config.tenantName }),
     )),
   );
@@ -1118,8 +1133,7 @@ export async function cmdApps(argv, overrides = {}) {
     }));
   }
 
-  // Reopen the managed apps we had to close for the bundle swap, so the update
-  // lands in place from the user's point of view. Apps that were already
+  // Reopen the managed apps we closed for the update. Apps that were already
   // closed (not in reopenTargets) stay closed.
   for (const item of installed) {
     if (!reopenTargets.has(item.target)) continue;