impel-cli 0.20.46-beta.0 → 0.20.46

package/src/desktopTasks.js

@@ -1,6 +1,10 @@
 import path from "node:path";
 
-export const DESKTOP_TASKS_RESOURCE_URI = "ui://impel/tasks/v1/index.html";
+import { RUNTIME_BRAND } from "./runtimeBrand.js";
+
+export const DESKTOP_TASKS_BOOTSTRAP_PATH = "/api/cli/desktop-session";
+export const DESKTOP_TASKS_BOARD_PATH = "/tasks";
+export const DESKTOP_TASKS_READY_MARKER = "IMPEL_DESKTOP_SESSION_READY";
 
 // Claude's mode switch is the stable landmark across Home and Code, but its
 // plain New row is the visual template. ChatGPT/Codex keeps the established
@@ -21,130 +25,139 @@ export function desktopTasksAssetPaths(root) {
     directory,
     mainPreload: path.join(directory, "main-preload.cjs"),
     viewPreload: path.join(directory, "view-preload.cjs"),
+    // Kept as an owned cleanup target while older bundle launch metadata still
+    // contains the ignored environment key. No host document is generated.
     hostHtml: path.join(directory, "host.html"),
   };
 }
 
+export function desktopTasksAppOrigin(value) {
+  let url;
+  try {
+    url = new URL(String(value));
+  } catch {
+    throw new Error("desktop Tasks app URL is invalid");
+  }
+  if (
+    !["http:", "https:"].includes(url.protocol)
+    || url.username
+    || url.password
+  ) {
+    throw new Error("desktop Tasks app URL must be an HTTP(S) origin without credentials");
+  }
+  return url.origin;
+}
+
+function escapeRegex(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+export function parseDesktopTasksCredential(output, tenantId, {
+  patPrefix = RUNTIME_BRAND.auth.patPrefix,
+  tenantPrefix = RUNTIME_BRAND.auth.tenantPrefix,
+} = {}) {
+  if (typeof output !== "string" || output.length === 0 || output.length > 8192) {
+    throw new Error("desktop Tasks token helper returned invalid output");
+  }
+  const line = output.endsWith("\n") ? output.slice(0, -1) : output;
+  if (!line || /[\r\n\u0000-\u001f\u007f]/u.test(line)) {
+    throw new Error("desktop Tasks token helper returned invalid output");
+  }
+  const pattern = new RegExp(
+    `^${escapeRegex(tenantPrefix)}([A-Za-z0-9_-]+)\\.(${escapeRegex(patPrefix)}[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?)$`,
+    "u",
+  );
+  const match = pattern.exec(line);
+  if (!match) throw new Error("desktop Tasks token helper returned invalid output");
+
+  let decodedTenant;
+  try {
+    decodedTenant = Buffer.from(match[1], "base64url").toString("utf8");
+  } catch {
+    throw new Error("desktop Tasks token helper returned invalid output");
+  }
+  if (
+    Buffer.from(decodedTenant, "utf8").toString("base64url") !== match[1]
+    || decodedTenant !== tenantId
+  ) {
+    throw new Error("desktop Tasks token helper tenant did not match");
+  }
+  return match[2];
+}
+
 const NAV_ANCHOR_RULES_SOURCE = JSON.stringify(DESKTOP_TASKS_NAV_ANCHOR_RULES);
+const TASKS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="2"></rect><path d="M9 3v18"></path><path d="M15 3v18"></path></svg>';
 
 const NAVIGATION_SOURCE = String.raw`(() => {
   const NAV_ID = "impel-desktop-tasks-nav";
-  const NAV_SLOT_ID = "impel-desktop-tasks-nav-slot";
+  const SLOT_ID = "impel-desktop-tasks-nav-slot";
   const ACTIVE_CLASS = "impel-desktop-tasks-active";
-  const NAV_ANCHOR_RULES = ${NAV_ANCHOR_RULES_SOURCE}.map((rule) => ({
+  const RULES = ${NAV_ANCHOR_RULES_SOURCE}.map((rule) => ({
     ...rule,
     pattern: new RegExp(rule.pattern, "i"),
     template: rule.template ? new RegExp(rule.template, "i") : null,
   }));
-  const TASKS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="2"></rect><path d="M9 3v18"></path><path d="M15 3v18"></path></svg>';
-  if (window.__impelDesktopTasksCleanup) window.__impelDesktopTasksCleanup();
+  window.__impelDesktopTasksCleanup?.();
 
   let nav = null;
   let slot = null;
   let active = false;
   let lastAnchor = null;
-
+  const roots = () => {
+    const result = [document];
+    for (let index = 0; index < result.length; index += 1) {
+      for (const element of result[index].querySelectorAll("*")) {
+        if (element.shadowRoot && !result.includes(element.shadowRoot)) result.push(element.shadowRoot);
+      }
+    }
+    return result;
+  };
+  const all = (selector) => roots().flatMap((root) => [...root.querySelectorAll(selector)]);
   const label = (element) => [
     element.getAttribute("aria-label"),
     element.getAttribute("title"),
     element.textContent,
   ].filter(Boolean).join(" ").replace(/\s+/g, " ").trim();
-
   const visible = (element) => {
     const rect = element.getBoundingClientRect();
     const style = getComputedStyle(element);
-    return rect.width > 0 && rect.height > 0 && rect.right > 0 && rect.bottom > 0
-      && rect.left < innerWidth && rect.top < innerHeight
-      && style.display !== "none" && style.visibility !== "hidden";
-  };
-
-  const roots = () => {
-    const found = [document];
-    for (let index = 0; index < found.length; index += 1) {
-      for (const element of found[index].querySelectorAll("*")) {
-        if (element.shadowRoot && !found.includes(element.shadowRoot)) found.push(element.shadowRoot);
-      }
-    }
-    return found;
+    return rect.width > 0 && rect.height > 0 && style.display !== "none" && style.visibility !== "hidden";
   };
-
-  const queryAll = (selector) => roots().flatMap((root) => [...root.querySelectorAll(selector)]);
-  const queryFirst = (selector) => queryAll(selector)[0] || null;
-
-  const controls = () => queryAll("button, a, [role=\"button\"], [role=\"link\"], [tabindex]")
-    .filter((element) => !element.closest("#" + NAV_ID + ", #" + NAV_SLOT_ID));
-
+  const sidebar = () => all("aside.app-shell-left-panel, aside, [data-app-shell-left-panel], nav[aria-label]")
+    .find(visible) || null;
+  const controls = () => all('button, a, [role="button"], [role="link"], [tabindex]')
+    .filter((element) => !element.closest("#" + NAV_ID + ", #" + SLOT_ID));
   const findControl = (pattern) => {
-    const matches = controls().filter((element) => pattern.test(label(element)));
-    const sidebar = findSidebar();
-    if (sidebar) {
-      const sidebarMatch = matches.find((element) => sidebar.contains(element) && visible(element))
-        || matches.find((element) => sidebar.contains(element));
-      if (sidebarMatch) return sidebarMatch;
-    }
-    return matches.find(visible) || matches[0] || null;
-  };
-
-  const findSidebar = () => {
-    const explicit = queryFirst("aside.app-shell-left-panel, aside, [data-app-shell-left-panel], nav[aria-label]");
-    if (explicit && visible(explicit)) return explicit;
-    return null;
+    const candidates = controls().filter((element) => pattern.test(label(element)));
+    const side = sidebar();
+    return candidates.find((element) => side?.contains(element) && visible(element))
+      || candidates.find((element) => side?.contains(element))
+      || candidates.find(visible)
+      || candidates[0]
+      || null;
   };
-
-  const findMain = () => {
-    const candidates = [
-      queryFirst("main[data-app-shell-main-surface]"),
-      queryFirst("main.main-surface"),
-      queryFirst("main"),
-      queryFirst("[role=\"main\"]"),
-    ].filter(Boolean);
-    return candidates.find(visible) || candidates[0] || null;
-  };
-
   const mainBounds = () => {
-    const main = findMain();
-    let rect = main?.getBoundingClientRect();
-    const sidebar = findSidebar();
-    const side = sidebar?.getBoundingClientRect();
+    const main = all('main[data-app-shell-main-surface], main.main-surface, main, [role="main"]')
+      .find(visible);
+    const side = sidebar()?.getBoundingClientRect();
     const anchor = lastAnchor?.getBoundingClientRect();
-    const inferred = anchor
-      && anchor.left < 48
-      && anchor.right >= 180
-      && anchor.right < innerWidth * 0.55
-      ? anchor.right + 8
-      : 0;
     const sidebarRight = side && side.left <= 8 && side.width < innerWidth * 0.55
       ? side.right
-      : inferred;
-    if (!rect || rect.width < 240 || rect.height < 240) {
-      rect = { left: sidebarRight, top: 0, width: innerWidth - sidebarRight, height: innerHeight };
-    } else if (sidebarRight > rect.left + 8 && rect.width > innerWidth * 0.7) {
-      rect = {
-        left: sidebarRight,
-        top: rect.top,
-        width: innerWidth - sidebarRight,
-        height: rect.height,
-      };
-    }
+      : anchor && anchor.left < 48 && anchor.right < innerWidth * 0.55
+        ? anchor.right + 8
+        : 0;
+    const rect = main?.getBoundingClientRect();
     return {
-      x: Math.max(0, Math.round(rect.left)),
-      y: Math.max(0, Math.round(rect.top)),
-      width: Math.max(320, Math.round(rect.width)),
-      height: Math.max(320, Math.round(rect.height)),
+      x: Math.max(0, Math.round(rect && rect.width >= 240 ? Math.max(rect.left, sidebarRight) : sidebarRight)),
+      y: Math.max(0, Math.round(rect && rect.height >= 240 ? rect.top : 0)),
+      width: Math.max(320, Math.round(innerWidth - sidebarRight)),
+      height: Math.max(320, Math.round(rect && rect.height >= 240 ? rect.height : innerHeight)),
     };
   };
-
   const signal = (action) => {
-    const bounds = mainBounds();
-    const query = new URLSearchParams({
-      x: String(bounds.x),
-      y: String(bounds.y),
-      width: String(bounds.width),
-      height: String(bounds.height),
-    });
-    location.href = "impel-tasks://" + action + "?" + query.toString();
+    const query = new URLSearchParams(Object.entries(mainBounds()).map(([key, value]) => [key, String(value)]));
+    location.href = "impel-tasks://" + action + "?" + query;
   };
-
   const select = (selected) => {
     active = selected;
     if (!nav) return;
@@ -154,195 +167,90 @@ const NAVIGATION_SOURCE = String.raw`(() => {
     nav.classList.toggle(ACTIVE_CLASS, selected);
   };
   window.__impelDesktopTasksSetActive = select;
-
-  const replaceText = (element) => {
-    const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT);
-    let changed = false;
-    while (walker.nextNode()) {
-      const text = walker.currentNode.nodeValue || "";
-      if (!/(?:new(?:\s+(?:chat|thread))?|pull requests?|scheduled|plugins?|skills?|cowork|code)\b/i.test(text)) continue;
-      walker.currentNode.nodeValue = text.replace(
-        /(?:new(?:\s+(?:chat|thread))?|pull requests?|scheduled|plugins?|skills?|cowork|code)\b/i,
-        "Tasks",
-      );
-      changed = true;
+  const visualRow = (control) => {
+    const controlRect = control.getBoundingClientRect();
+    let child = control;
+    let parent = control.parentElement;
+    while (parent && parent !== document.body) {
+      const rect = parent.getBoundingClientRect();
+      const sameVisualRow = Math.abs(rect.top - controlRect.top) <= 8
+        && Math.abs(rect.bottom - controlRect.bottom) <= 8;
+      if (!sameVisualRow) break;
+      child = parent;
+      parent = parent.parentElement;
     }
-    return changed;
+    return parent && parent !== document.body ? { parent, child } : null;
   };
-
-  const stripVendorActions = (element) => {
-    for (const candidate of [element, ...element.querySelectorAll("*")]) {
+  const makeNav = (template) => {
+    const button = template.cloneNode(true);
+    for (const candidate of [button, ...button.querySelectorAll("*")]) {
       for (const attribute of [...candidate.attributes]) {
         if (attribute.name.startsWith("data-app-action-") || attribute.name === "data-testid") {
           candidate.removeAttribute(attribute.name);
         }
       }
     }
-    element.removeAttribute("href");
-    element.removeAttribute("target");
-    element.querySelectorAll("[id]").forEach((candidate) => candidate.removeAttribute("id"));
-    element.querySelectorAll("kbd, [data-slot=\"shortcut\"]").forEach((candidate) => candidate.remove());
-  };
-
-  const stripTemplateGlyphs = (element) => {
-    element.querySelectorAll("svg, [aria-hidden=\"true\"]").forEach((candidate) => candidate.remove());
-    const walker = document.createTreeWalker(element, NodeFilter.SHOW_TEXT);
-    const glyphs = [];
-    while (walker.nextNode()) {
-      if (/^(?:\+|＋|<\/>|<>)$/u.test((walker.currentNode.nodeValue || "").trim())) {
-        glyphs.push(walker.currentNode);
-      }
-    }
-    glyphs.forEach((candidate) => {
-      const parent = candidate.parentElement;
-      candidate.remove();
-      if (
-        parent
-        && parent !== element
-        && !parent.textContent?.trim()
-        && !parent.querySelector("svg, img")
-      ) parent.remove();
-    });
-    [...element.querySelectorAll("*")].reverse().forEach((candidate) => {
-      if (
-        !candidate.textContent?.trim()
-        && !candidate.querySelector("svg, img, input")
-      ) candidate.remove();
-    });
-  };
-
-  const makeNav = (template) => {
-    const button = template ? template.cloneNode(true) : document.createElement("button");
-    stripVendorActions(button);
-    stripTemplateGlyphs(button);
+    button.querySelectorAll('svg, [aria-hidden="true"], kbd, [data-slot="shortcut"]').forEach((node) => node.remove());
+    button.querySelectorAll("[id]").forEach((node) => node.removeAttribute("id"));
+    button.removeAttribute("href");
+    button.removeAttribute("target");
     button.id = NAV_ID;
     button.type = "button";
     button.setAttribute("aria-label", "Tasks");
     button.setAttribute("title", "Tasks");
-    button.classList.add("impel-desktop-tasks-nav");
-    if (!replaceText(button)) button.textContent = "Tasks";
-    button.insertAdjacentHTML("afterbegin", TASKS_ICON);
+    button.textContent = "Tasks";
+    button.insertAdjacentHTML("afterbegin", ${JSON.stringify(TASKS_ICON)});
     button.addEventListener("click", (event) => {
       event.preventDefault();
       event.stopPropagation();
       select(true);
       signal("show");
     });
-    button.addEventListener("keydown", (event) => {
-      if (event.key !== "Enter" && event.key !== " ") return;
-      event.preventDefault();
-      select(true);
-      signal("show");
-    });
     return button;
   };
-
-  const placement = (control) => {
-    if (!control) return null;
-    const controlRect = control.getBoundingClientRect();
-    let child = control;
-    let parent = control.parentElement;
-    while (parent && parent !== document.body) {
-      const rect = parent.getBoundingClientRect();
-      const sameVisualRow = Math.abs(rect.top - controlRect.top) <= 8
-        && Math.abs(rect.bottom - controlRect.bottom) <= 8;
-      if (!sameVisualRow) break;
-      child = parent;
-      parent = parent.parentElement;
-    }
-    return parent && parent !== document.body ? { stack: parent, child } : null;
-  };
-
   const ensureNav = () => {
-    let anchorRule = null;
+    let rule = null;
     let anchor = null;
-    for (const rule of NAV_ANCHOR_RULES) {
-      anchor = findControl(rule.pattern);
-      if (anchor) {
-        anchorRule = rule;
-        break;
-      }
+    for (const candidate of RULES) {
+      anchor = findControl(candidate.pattern);
+      if (anchor) { rule = candidate; break; }
     }
-    const template = anchorRule?.template ? findControl(anchorRule.template) : anchor;
+    const template = rule?.template ? findControl(rule.template) : anchor;
     lastAnchor = anchor;
-    // Claude mounts its Home/Code switcher before the New row. Do not clone the
-    // switcher as a temporary fallback: its Code glyph would remain in the
-    // injected control after the intended visual template appears.
     if (!anchor || !template) return;
     if (!nav?.isConnected) nav = makeNav(template);
-    const target = placement(anchor);
-    const templateTarget = placement(template);
+    const target = visualRow(anchor);
+    const templateTarget = visualRow(template);
     if (target) {
       if (!slot?.isConnected || (slot !== nav && !slot.contains(nav))) {
         slot = templateTarget?.child === template ? nav : templateTarget?.child.cloneNode(false) || nav;
-        if (slot !== nav) {
-          slot.id = NAV_SLOT_ID;
-          slot.removeAttribute("aria-label");
-          slot.removeAttribute("title");
-          slot.append(nav);
-        }
+        if (slot !== nav) { slot.id = SLOT_ID; slot.append(nav); }
       }
-      const after = anchorRule?.position === "after";
-      const correctlyPlaced = slot.parentElement === target.stack
-        && (after ? slot.previousElementSibling === target.child : slot.nextElementSibling === target.child);
-      if (!correctlyPlaced) {
-        target.stack.insertBefore(slot, after ? target.child.nextElementSibling : target.child);
-      }
-    } else if (anchor?.parentElement) {
-      anchor.insertAdjacentElement(anchorRule?.position === "after" ? "afterend" : "beforebegin", nav);
+      const reference = rule.position === "after" ? target.child.nextElementSibling : target.child;
+      if (slot.parentElement !== target.parent || slot !== reference) target.parent.insertBefore(slot, reference);
+    } else if (anchor.parentElement) {
+      anchor.insertAdjacentElement(rule.position === "after" ? "afterend" : "beforebegin", nav);
       slot = nav;
-    } else if (!nav.isConnected) {
-      slot = null;
     }
     select(active);
   };
-
   const style = document.createElement("style");
-  style.id = "impel-desktop-tasks-nav-style";
-  style.textContent = [
-    "#" + NAV_ID + " svg { width: 16px; height: 16px; flex: 0 0 auto; }",
-    "#" + NAV_ID + "." + ACTIVE_CLASS + " { background: color-mix(in srgb, CanvasText 10%, transparent); }",
-    "#" + NAV_ID + ":focus-visible { outline: 2px solid #7c8cff; outline-offset: 2px; }",
-  ].join("\n");
+  style.textContent = "#" + NAV_ID + " svg{width:16px;height:16px;flex:0 0 auto}#" + NAV_ID + "." + ACTIVE_CLASS + "{background:color-mix(in srgb,CanvasText 10%,transparent)}#" + NAV_ID + ":focus-visible{outline:2px solid #7c8cff;outline-offset:2px}";
   document.head.append(style);
-
   const onClick = (event) => {
     if (!active || event.target instanceof Element && event.target.closest("#" + NAV_ID)) return;
-    const sidebar = findSidebar();
-    if (!sidebar || !(event.target instanceof Node) || !sidebar.contains(event.target)) return;
-    select(false);
-    setTimeout(() => signal("hide"), 0);
-  };
-  const onResize = () => {
-    if (active) signal("layout");
+    const side = sidebar();
+    if (side && event.target instanceof Node && side.contains(event.target)) {
+      select(false);
+      setTimeout(() => signal("hide"), 0);
+    }
   };
+  const onResize = () => { if (active) signal("layout"); };
   window.addEventListener("click", onClick, true);
   window.addEventListener("resize", onResize);
-
-  const observer = new MutationObserver((records) => {
-    const external = records.some((record) => {
-      const target = record.target instanceof Element ? record.target : record.target?.parentElement;
-      return target && !target.closest("#" + NAV_ID + ", #" + NAV_SLOT_ID);
-    });
-    if (external) ensureNav();
-  });
+  const observer = new MutationObserver(() => ensureNav());
   observer.observe(document.body, { childList: true, subtree: true });
   ensureNav();
-
-  const navRect = nav?.getBoundingClientRect();
-  const result = {
-    connected: Boolean(nav?.isConnected),
-    visible: Boolean(nav && visible(nav)),
-    text: nav?.textContent?.replace(/\s+/g, " ").trim() || null,
-    anchor: lastAnchor ? label(lastAnchor) : null,
-    bounds: navRect ? {
-      x: Math.round(navRect.x),
-      y: Math.round(navRect.y),
-      width: Math.round(navRect.width),
-      height: Math.round(navRect.height),
-    } : null,
-  };
-
   window.__impelDesktopTasksCleanup = () => {
     observer.disconnect();
     window.removeEventListener("click", onClick, true);
@@ -352,50 +260,15 @@ const NAVIGATION_SOURCE = String.raw`(() => {
     style.remove();
     delete window.__impelDesktopTasksSetActive;
   };
-  return result;
+  return { anchor: lastAnchor ? label(lastAnchor) : null, connected: Boolean(nav?.isConnected) };
 })();`;
 
-const NATIVE_NAVIGATION_HTML = `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width,initial-scale=1">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'">
-    <style>
-      :root { color-scheme: light dark; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-      * { box-sizing: border-box; }
-      html, body { width: 100%; height: 100%; margin: 0; overflow: hidden; background: transparent; }
-      button {
-        width: 100%; height: 100%; display: flex; align-items: center; gap: 9px;
-        border: 0; border-radius: 8px; padding: 0 12px;
-        background: color-mix(in srgb, Canvas 92%, CanvasText 8%); color: CanvasText;
-        font: 13px/1 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-        text-align: left; cursor: pointer;
-      }
-      button:hover, button[data-active="true"] { background: color-mix(in srgb, CanvasText 13%, Canvas); }
-      button:focus-visible { outline: 2px solid #7c8cff; outline-offset: -2px; }
-      svg { width: 16px; height: 16px; flex: 0 0 auto; }
-    </style>
-  </head>
-  <body>
-    <button id="tasks" type="button" aria-label="Tasks">
-      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="2"></rect><path d="M9 3v18"></path><path d="M15 3v18"></path></svg>
-      <span>Tasks</span>
-    </button>
-    <script>
-      const button = document.getElementById("tasks");
-      button.addEventListener("pointerdown", (event) => {
-        if (event.button !== 0) return;
-        event.preventDefault();
-        button.dataset.active = "true";
-        window.impelDesktopTasks.show();
-      });
-      window.__impelDesktopTasksSetActive = (active) => { button.dataset.active = String(Boolean(active)); };
-    </script>
-  </body>
-</html>`;
+const NATIVE_NAVIGATION_HTML = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none';script-src 'unsafe-inline';style-src 'unsafe-inline'"><style>:root{color-scheme:light dark;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}*{box-sizing:border-box}html,body{width:100%;height:100%;margin:0;overflow:hidden}button{width:100%;height:100%;display:flex;align-items:center;gap:9px;border:0;border-radius:8px;padding:0 12px;background:color-mix(in srgb,Canvas 92%,CanvasText 8%);color:CanvasText;cursor:pointer}svg{width:16px;height:16px}</style></head><body><button id="tasks" type="button" aria-label="Tasks">${TASKS_ICON}<span>Tasks</span></button><script>const button=document.getElementById("tasks");button.addEventListener("click",()=>{button.dataset.active="true";window.impelDesktopTasks.show()});window.__impelDesktopTasksSetActive=active=>{button.dataset.active=String(Boolean(active))}</script></body></html>`;
 
-export function desktopTasksMainPreload() {
+export function desktopTasksMainPreload(appUrl) {
+  const appOrigin = desktopTasksAppOrigin(appUrl);
+  const parserSource = parseDesktopTasksCredential.toString();
+  const escapeRegexSource = escapeRegex.toString();
   return `"use strict";
 
 if (
@@ -403,36 +276,29 @@ if (
   && process.env.IMPEL_DESKTOP_TASKS_NODE
   && process.env.IMPEL_DESKTOP_TASKS_CLI
   && process.env.IMPEL_DESKTOP_TASKS_TENANT
-  && process.env.IMPEL_DESKTOP_TASKS_HOST_HTML
   && process.env.IMPEL_DESKTOP_TASKS_VIEW_PRELOAD
   && !globalThis.__impelDesktopTasksMainInstalled
 ) {
   globalThis.__impelDesktopTasksMainInstalled = true;
   const fs = require("node:fs");
   const path = require("node:path");
-  const readline = require("node:readline");
   const { spawn } = require("node:child_process");
-  const { pathToFileURL } = require("node:url");
   const navSource = ${JSON.stringify(NAVIGATION_SOURCE)};
   const nativeNavUrl = "data:text/html;charset=utf-8," + encodeURIComponent(${JSON.stringify(NATIVE_NAVIGATION_HTML)});
-  const nodePath = process.env.IMPEL_DESKTOP_TASKS_NODE;
-  const cliPath = process.env.IMPEL_DESKTOP_TASKS_CLI;
+  const appOrigin = ${JSON.stringify(appOrigin)};
+  const bootstrapUrl = appOrigin + ${JSON.stringify(DESKTOP_TASKS_BOOTSTRAP_PATH)};
+  const tasksUrl = appOrigin + ${JSON.stringify(DESKTOP_TASKS_BOARD_PATH)};
+  const readyMarker = ${JSON.stringify(DESKTOP_TASKS_READY_MARKER)};
   const tenantId = process.env.IMPEL_DESKTOP_TASKS_TENANT;
-  const hostHtml = process.env.IMPEL_DESKTOP_TASKS_HOST_HTML;
-  const viewPreload = process.env.IMPEL_DESKTOP_TASKS_VIEW_PRELOAD;
-  const resourceUri = ${JSON.stringify(DESKTOP_TASKS_RESOURCE_URI)};
-  const rpcChannel = "impel-desktop-tasks:rpc";
-  const openLinkChannel = "impel-desktop-tasks:open-link";
-  const closeChannel = "impel-desktop-tasks:close";
   const nativeShowChannel = "impel-desktop-tasks:native-show";
-  const runtimeStatusPath = path.join(path.dirname(hostHtml), "runtime-status.json");
-  const record = (stage, error = null) => {
+  const runtimeStatusPath = path.join(__dirname, "runtime-status.json");
+  const escapeRegex = ${escapeRegexSource};
+  const parseCredential = ${parserSource};
+  const record = (stage) => {
     try {
-      const detail = error instanceof Error ? error.message : error == null ? null : String(error);
       fs.writeFileSync(runtimeStatusPath, JSON.stringify({
-        schemaVersion: 1,
+        schemaVersion: 2,
         stage,
-        detail,
         processType: process.type || null,
         electronVersion: process.versions.electron || null,
         pid: process.pid,
@@ -440,366 +306,344 @@ if (
       }, null, 2) + "\\n", { mode: 0o600 });
     } catch {}
   };
-
-  class TasksMcpClient {
-    constructor() {
-      this.child = null;
-      this.starting = null;
-      this.pending = new Map();
-      this.sequence = 0;
-    }
-
-    failPending(message) {
-      for (const entry of this.pending.values()) entry.reject(new Error(message));
-      this.pending.clear();
-    }
-
-    send(method, params) {
-      if (!this.child?.stdin?.writable) return Promise.reject(new Error("Tasks bridge is unavailable."));
-      const id = ++this.sequence;
-      return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-          this.pending.delete(id);
-          try {
-            this.child?.stdin?.write(JSON.stringify({
-              jsonrpc: "2.0",
-              method: "notifications/cancelled",
-              params: { requestId: id, reason: "desktop Tasks request timed out" },
-            }) + "\\n");
-          } catch {}
-          reject(new Error("Tasks request timed out."));
-        }, 75000);
-        this.pending.set(id, {
-          resolve: (value) => { clearTimeout(timer); resolve(value); },
-          reject: (error) => { clearTimeout(timer); reject(error); },
-        });
-        this.child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\\n");
-      });
-    }
-
-    async ensureStarted() {
-      if (this.child?.stdin?.writable) return;
-      if (this.starting) return this.starting;
-      this.starting = (async () => {
-        if (!nodePath || !cliPath || !tenantId) throw new Error("Tasks bridge configuration is incomplete.");
-        const child = spawn(nodePath, [cliPath, "mcp", "--target", "tasks", "--tenant", tenantId], {
-          stdio: ["pipe", "pipe", "pipe"],
-          env: { ...process.env, IMPEL_MANAGED_MCP: "1" },
-        });
-        this.child = child;
-        child.stderr.resume();
-        const lines = readline.createInterface({ input: child.stdout, crlfDelay: Infinity });
-        lines.on("line", (line) => {
-          let message;
-          try { message = JSON.parse(line); } catch { return; }
-          const entry = this.pending.get(message.id);
-          if (!entry) return;
-          this.pending.delete(message.id);
-          if (message.error) entry.reject(new Error(message.error.message || "Tasks request failed."));
-          else entry.resolve(message.result);
-        });
-        const closed = () => {
-          if (this.child === child) this.child = null;
-          this.failPending("Tasks bridge exited.");
-        };
-        child.once("error", closed);
-        child.once("exit", closed);
-        try {
-          await this.send("initialize", {
-            protocolVersion: "2025-06-18",
-            capabilities: {},
-            clientInfo: { name: "impel-desktop-tasks", version: "1.0.0" },
-          });
-          child.stdin.write(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\\n");
-        } catch (error) {
-          if (this.child === child) this.child = null;
-          try { child.kill(); } catch {}
-          throw error;
-        }
-      })().finally(() => { this.starting = null; });
-      return this.starting;
-    }
-
-    async request(method, params) {
-      await this.ensureStarted();
-      return this.send(method, params);
-    }
-
-    close() {
-      const child = this.child;
-      this.child = null;
-      this.failPending("Tasks bridge closed.");
-      try { child?.kill(); } catch {}
+  const token = () => new Promise((resolve, reject) => {
+    const childEnvironment = { ...process.env };
+    for (const name of ["ANTHROPIC_API_KEY", "CODEX_ACCESS_TOKEN", "CODEX_API_KEY", "OPENAI_API_KEY"]) {
+      delete childEnvironment[name];
     }
-  }
+    const child = spawn(
+      process.env.IMPEL_DESKTOP_TASKS_NODE,
+      [process.env.IMPEL_DESKTOP_TASKS_CLI, "token", "--tenant", tenantId],
+      { stdio: ["ignore", "pipe", "pipe"], windowsHide: true, env: childEnvironment },
+    );
+    let stdout = "";
+    let stderrBytes = 0;
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (error) reject(error); else resolve(value);
+    };
+    const timer = setTimeout(() => {
+      try { child.kill(); } catch {}
+      finish(new Error("desktop Tasks token helper timed out"));
+    }, 15000);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString("utf8");
+      if (stdout.length > 8192) {
+        try { child.kill(); } catch {}
+        finish(new Error("desktop Tasks token helper output was too large"));
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderrBytes += chunk.length;
+      if (stderrBytes > 8192) {
+        try { child.kill(); } catch {}
+        finish(new Error("desktop Tasks token helper output was too large"));
+      }
+    });
+    child.once("error", () => finish(new Error("desktop Tasks token helper failed")));
+    child.once("close", (code) => {
+      if (code !== 0) return finish(new Error("desktop Tasks token helper failed"));
+      try {
+        finish(null, parseCredential(stdout, tenantId, {
+          patPrefix: ${JSON.stringify(RUNTIME_BRAND.auth.patPrefix)},
+          tenantPrefix: ${JSON.stringify(RUNTIME_BRAND.auth.tenantPrefix)},
+        }));
+      } catch {
+        finish(new Error("desktop Tasks token helper returned invalid output"));
+      }
+    });
+  });
 
   const install = (electron) => {
-    const {
-      app,
-      BrowserWindow,
-      WebContentsView,
-      ipcMain,
-      shell,
-      webContents: electronWebContents,
-    } = electron;
-    if (!app || !BrowserWindow || !WebContentsView || !ipcMain || !electronWebContents) {
+    const { app, BrowserWindow, WebContentsView, ipcMain, shell, webContents } = electron;
+    if (!app || !BrowserWindow || !WebContentsView || !ipcMain || !webContents) {
       record("unsupported-electron-surface");
       return;
     }
-    const client = new TasksMcpClient();
     const windows = new Map();
-    const allowedViewContents = new Set();
-    const internalViewContents = new Set();
+    const internalContents = new Set();
     const nativeNavOwners = new Map();
-    const hostUrl = pathToFileURL(hostHtml).href;
-    let hasAnyDomNavigation = false;
+    const configuredSessions = new WeakSet();
     let creatingInternalWindow = false;
+    let hasDomNavigation = false;
     const createInternalWindow = (options) => {
       creatingInternalWindow = true;
-      try {
-        return new BrowserWindow(options);
-      } finally {
-        creatingInternalWindow = false;
-      }
-    };
-
-    const parseBounds = (url, window) => {
-      const parsed = new URL(url);
-      const content = window.getContentBounds();
-      const interactiveTop = process.platform === "darwin" ? 48 : 0;
-      const number = (name, fallback) => {
-        const value = Number.parseInt(parsed.searchParams.get(name) || "", 10);
-        return Number.isFinite(value) ? value : fallback;
-      };
-      const x = Math.max(0, Math.min(content.width - 240, number("x", 0)));
-      const y = Math.max(
-        interactiveTop,
-        Math.min(content.height - 240, number("y", 0)),
-      );
-      return {
-        x,
-        y,
-        width: Math.max(240, Math.min(content.width - x, number("width", content.width - x))),
-        height: Math.max(240, Math.min(content.height - y, number("height", content.height - y))),
-      };
+      try { return new BrowserWindow(options); }
+      finally { creatingInternalWindow = false; }
     };
-
     const stateFor = (window) => {
       let state = windows.get(window.id);
       if (!state) {
-        state = {
-          view: null,
-          bounds: null,
-          visible: false,
-          nativeNav: null,
-          hasDomNavigation: false,
-        };
+        state = { view: null, bounds: null, visible: false, nativeNav: null, hasDomNavigation: false, loading: null, bootstrapping: false };
         windows.set(window.id, state);
       }
       return state;
     };
-
+    const exactOrigin = (rawUrl) => {
+      try { return new URL(rawUrl).origin === appOrigin; }
+      catch { return false; }
+    };
+    const external = (rawUrl) => {
+      try {
+        const url = new URL(rawUrl);
+        if (url.protocol === "https:" && !url.username && !url.password && url.origin !== appOrigin) {
+          shell.openExternal(url.href).catch(() => record("external-link-failed"));
+        }
+      } catch {}
+    };
+    const configureSession = (session) => {
+      if (configuredSessions.has(session)) return;
+      configuredSessions.add(session);
+      session.setPermissionCheckHandler(() => false);
+      session.setPermissionRequestHandler((_contents, _permission, callback) => callback(false));
+      session.on("will-download", (event) => event.preventDefault());
+      const allowedOrigins = new Set([
+        appOrigin,
+        "https://api.liveblocks.io",
+        "wss://api.liveblocks.io",
+        "https://api.dicebear.com",
+        "https://avatars.githubusercontent.com",
+      ]);
+      session.webRequest.onBeforeRequest({ urls: ["<all_urls>"] }, (details, callback) => {
+        let allowed = false;
+        try {
+          const url = new URL(details.url);
+          allowed = ["data:", "blob:"].includes(url.protocol) || allowedOrigins.has(url.origin);
+        } catch {}
+        callback({ cancel: !allowed });
+      });
+    };
+    const errorDocument = "data:text/html;charset=utf-8," + encodeURIComponent(
+      "<!doctype html><html><body style='font:14px system-ui;padding:32px'>Impel Tasks could not be loaded. Hide Tasks, check your connection, and try again.</body></html>",
+    );
+    const loadBoard = async (state) => {
+      state.bootstrapping = true;
+      let pat = null;
+      try {
+        pat = await token();
+        const request = {
+          extraHeaders: [
+            "Authorization: Bearer " + pat,
+            "X-Impel-Tenant: " + tenantId,
+            "Cache-Control: no-store",
+            "Pragma: no-cache",
+          ].join("\\n"),
+          postData: [{ type: "rawData", bytes: Buffer.alloc(0) }],
+        };
+        await state.view.webContents.loadURL(bootstrapUrl, request);
+        if (state.view.webContents.getURL() !== bootstrapUrl) throw new Error("bootstrap redirected");
+        const ready = await state.view.webContents.executeJavaScript(
+          "document.body?.textContent?.trim() === " + JSON.stringify(readyMarker),
+          true,
+        );
+        if (!ready) throw new Error("bootstrap marker missing");
+      } catch {
+        record("board-bootstrap-failed");
+        await state.view.webContents.loadURL(errorDocument).catch(() => {});
+        return;
+      } finally {
+        pat = null;
+        state.bootstrapping = false;
+      }
+      try {
+        await state.view.webContents.loadURL(tasksUrl);
+        record("board-loaded");
+      } catch {
+        record("board-load-failed");
+        await state.view.webContents.loadURL(errorDocument).catch(() => {});
+      }
+    };
+    const deactivateNavigation = () => {
+      for (const state of windows.values()) {
+        state.nativeNav?.webContents.executeJavaScript("window.__impelDesktopTasksSetActive?.(false)", true).catch(() => {});
+      }
+      for (const contents of webContents.getAllWebContents()) {
+        if (internalContents.has(contents) || contents.isDestroyed()) continue;
+        for (const frame of contents.mainFrame?.framesInSubtree || []) {
+          frame.executeJavaScript("window.__impelDesktopTasksSetActive?.(false)", true).catch(() => {});
+        }
+      }
+    };
+    const hide = (window) => {
+      const state = windows.get(window.id);
+      if (!state) return;
+      state.visible = false;
+      state.view?.setVisible(false);
+      window.webContents.focus();
+      deactivateNavigation();
+    };
+    const isPrimaryWindow = (window) => {
+      if (!window || window.isDestroyed() || window.getParentWindow?.()) return false;
+      try {
+        const url = new URL(window.webContents.getURL());
+        if (url.searchParams.has("initialRoute")) return false;
+      } catch {}
+      return window.isVisible?.() !== false;
+    };
     const createView = (window) => {
       const state = stateFor(window);
       if (state.view && !state.view.webContents.isDestroyed()) return state;
       const view = new WebContentsView({
         webPreferences: {
-          preload: viewPreload,
           contextIsolation: true,
           nodeIntegration: false,
           sandbox: true,
           spellcheck: false,
+          partition: "persist:impel-desktop-tasks",
         },
       });
+      state.view = view;
+      internalContents.add(view.webContents);
+      configureSession(view.webContents.session);
       window.contentView.addChildView(view);
       view.setVisible(false);
       view.setBackgroundColor("#181818");
-      allowedViewContents.add(view.webContents);
-      internalViewContents.add(view.webContents);
-      view.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
+      view.webContents.setWindowOpenHandler(({ url }) => {
+        if (exactOrigin(url)) view.webContents.loadURL(url).catch(() => record("board-navigation-failed"));
+        else external(url);
+        return { action: "deny" };
+      });
       view.webContents.on("will-navigate", (event, url) => {
-        if (url !== hostUrl) event.preventDefault();
+        if (exactOrigin(url)) return;
+        event.preventDefault();
+        external(url);
+      });
+      view.webContents.on("will-redirect", (event, url) => {
+        if (state.bootstrapping || !exactOrigin(url)) event.preventDefault();
+      });
+      view.webContents.on("before-input-event", (event, input) => {
+        if (input.key === "Escape" && input.type === "keyDown") {
+          event.preventDefault();
+          hide(window);
+        }
       });
       view.webContents.on("destroyed", () => {
-        allowedViewContents.delete(view.webContents);
-        internalViewContents.delete(view.webContents);
+        internalContents.delete(view.webContents);
         try { window.contentView.removeChildView(view); } catch {}
         if (state.view === view) state.view = null;
       });
-      view.webContents.loadURL(hostUrl).catch((error) => record("view-load-failed", error));
-      state.view = view;
       return state;
     };
-
     const show = (window, bounds) => {
       const state = createView(window);
       state.bounds = bounds;
-      state.visible = true;
       state.view.setBounds(bounds);
       state.view.setVisible(true);
       state.view.webContents.focus();
-      const boardStatus = () => ({
-        parentBounds: window.getBounds(),
-        parentContentBounds: window.getContentBounds(),
-        boardBounds: state.view.getBounds(),
-        boardVisible: state.visible,
-        boardFocused: state.view.webContents.isFocused(),
-      });
-      record("board-shown", JSON.stringify(boardStatus()));
-      setTimeout(() => {
-        if (state.view && !state.view.webContents.isDestroyed()) record("board-visible-check", JSON.stringify(boardStatus()));
-      }, 2000);
-    };
-    const hide = (window) => {
-      const state = windows.get(window.id);
-      if (!state) return;
-      state.visible = false;
-      state.view?.setVisible(false);
-      window.webContents.focus();
+      if (state.visible) return;
+      state.visible = true;
+      state.loading = loadBoard(state).finally(() => { state.loading = null; });
+      record("board-shown");
     };
-
-    const layoutBoard = (window) => {
+    const layoutBoard = (window, bounds = null) => {
       const state = windows.get(window.id);
-      if (!state?.visible || !state.view || !state.bounds || state.view.webContents.isDestroyed()) return;
-      state.view.setBounds(state.bounds);
+      if (!state?.visible || !state.view || state.view.webContents.isDestroyed()) return;
+      if (bounds) state.bounds = bounds;
+      if (state.bounds) state.view.setBounds(state.bounds);
     };
-
-    const nativeBoardBounds = (window) => {
+    const parseBounds = (rawUrl, window) => {
+      const parsed = new URL(rawUrl);
       const content = window.getContentBounds();
-      const x = Math.min(296, Math.max(0, content.width - 240));
       const interactiveTop = process.platform === "darwin" ? 48 : 0;
+      const number = (name, fallback) => {
+        const value = Number.parseInt(parsed.searchParams.get(name) || "", 10);
+        return Number.isFinite(value) ? value : fallback;
+      };
+      const x = Math.max(0, Math.min(content.width - 240, number("x", 0)));
+      const y = Math.max(interactiveTop, Math.min(content.height - 240, number("y", interactiveTop)));
       return {
         x,
-        y: interactiveTop,
-        width: Math.max(240, content.width - x),
-        height: Math.max(240, content.height - interactiveTop),
+        y,
+        width: Math.max(240, Math.min(content.width - x, number("width", content.width - x))),
+        height: Math.max(240, Math.min(content.height - y, number("height", content.height - y))),
       };
     };
-
+    const nativeBoardBounds = (window) => {
+      const content = window.getContentBounds();
+      const x = Math.min(296, Math.max(0, content.width - 240));
+      const interactiveTop = process.platform === "darwin" ? 48 : 0;
+      return { x, y: interactiveTop, width: Math.max(240, content.width - x), height: Math.max(240, content.height - interactiveTop) };
+    };
     const layoutNativeNav = (window) => {
       const state = windows.get(window.id);
       if (!state?.nativeNav || state.nativeNav.isDestroyed()) return;
       const content = window.getContentBounds();
-      state.nativeNav.setBounds({
-        x: content.x + 12,
-        y: content.y + Math.max(48, content.height - 92),
-        width: Math.min(120, Math.max(80, content.width - 24)),
-        height: 38,
-      });
+      state.nativeNav.setBounds({ x: content.x + 12, y: content.y + Math.max(48, content.height - 92), width: Math.min(120, Math.max(80, content.width - 24)), height: 38 });
     };
-
     const ensureNativeNav = (window) => {
-      if (!window || window.isDestroyed()) return;
+      if (!isPrimaryWindow(window)) return;
       const state = stateFor(window);
       if (state.nativeNav && !state.nativeNav.isDestroyed()) return;
-      const navView = createInternalWindow({
+      // Auxiliary vendor windows (for example Codex's hidden avatar overlay)
+      // are also top-level BrowserWindows. Never give them their own Tasks
+      // fallback: duplicate child windows interfere with first-run navigation
+      // and can cover the primary shell.
+      if ([...windows.values()].some((candidate) => (
+        candidate.nativeNav && !candidate.nativeNav.isDestroyed()
+      ))) return;
+      const nativeNav = createInternalWindow({
         parent: window,
         frame: false,
-        transparent: false,
         show: false,
         resizable: false,
-        movable: false,
-        minimizable: false,
-        maximizable: false,
-        fullscreenable: false,
         skipTaskbar: true,
-        hasShadow: false,
-        acceptFirstMouse: true,
         backgroundColor: "#292929",
         webPreferences: {
-          preload: viewPreload,
+          preload: process.env.IMPEL_DESKTOP_TASKS_VIEW_PRELOAD,
           contextIsolation: true,
           nodeIntegration: false,
           sandbox: true,
-          spellcheck: false,
         },
       });
-      navView.setAlwaysOnTop(true, "floating");
-      state.nativeNav = navView;
-      internalViewContents.add(navView.webContents);
-      nativeNavOwners.set(navView.webContents, window);
-      navView.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
-      navView.webContents.on("will-navigate", (event, url) => {
-        if (url !== nativeNavUrl) event.preventDefault();
-      });
-      navView.webContents.on("destroyed", () => {
-        internalViewContents.delete(navView.webContents);
-        nativeNavOwners.delete(navView.webContents);
-      });
-      navView.webContents.on("did-finish-load", () => {
-        navView.webContents.executeJavaScript(
-          "typeof window.impelDesktopTasks?.show === 'function'",
-          true,
-        ).then((ready) => record(ready ? "native-navigation-ready" : "native-navigation-bridge-missing"))
-          .catch((error) => record("native-navigation-check-failed", error));
+      state.nativeNav = nativeNav;
+      internalContents.add(nativeNav.webContents);
+      nativeNavOwners.set(nativeNav.webContents, window);
+      nativeNav.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
+      nativeNav.webContents.on("will-navigate", (event, url) => { if (url !== nativeNavUrl) event.preventDefault(); });
+      nativeNav.webContents.on("destroyed", () => {
+        internalContents.delete(nativeNav.webContents);
+        nativeNavOwners.delete(nativeNav.webContents);
       });
-      navView.webContents.loadURL(nativeNavUrl).catch((error) => record("native-navigation-load-failed", error));
+      nativeNav.webContents.loadURL(nativeNavUrl).catch(() => record("native-navigation-load-failed"));
       layoutNativeNav(window);
-      navView.showInactive();
-      navView.moveTop();
+      nativeNav.showInactive();
       record("native-navigation-installed");
     };
-
     const removeNativeNav = (window) => {
       const state = windows.get(window.id);
-      if (!state?.nativeNav) return;
-      const navView = state.nativeNav;
+      const nativeNav = state?.nativeNav;
+      if (!nativeNav) return;
       state.nativeNav = null;
-      internalViewContents.delete(navView.webContents);
-      nativeNavOwners.delete(navView.webContents);
-      try {
-        navView.destroy();
-      } catch {}
-    };
-
-    const ownerWindow = (contents) => {
-      const direct = BrowserWindow.fromWebContents(contents);
-      if (direct && !direct.isDestroyed()) return direct;
-      const owner = contents.getOwnerBrowserWindow?.();
-      if (owner && !owner.isDestroyed()) return owner;
-      const focused = BrowserWindow.getFocusedWindow();
-      if (focused && !focused.isDestroyed()) return focused;
-      return BrowserWindow.getAllWindows().find((window) => !window.isDestroyed() && window.isVisible())
-        || BrowserWindow.getAllWindows().find((window) => !window.isDestroyed())
-        || null;
+      internalContents.delete(nativeNav.webContents);
+      nativeNavOwners.delete(nativeNav.webContents);
+      try { nativeNav.destroy(); } catch {}
     };
-
+    const ownerWindow = (contents) => BrowserWindow.fromWebContents(contents)
+      || contents.getOwnerBrowserWindow?.()
+      || BrowserWindow.getFocusedWindow()
+      || BrowserWindow.getAllWindows().find((window) => !window.isDestroyed())
+      || null;
     const attachContents = (contents) => {
-      if (
-        !contents
-        || contents.isDestroyed()
-        || contents.__impelDesktopTasksAttached
-        || internalViewContents.has(contents)
-      ) return;
+      if (!contents || contents.isDestroyed() || contents.__impelDesktopTasksAttached || internalContents.has(contents)) return;
       contents.__impelDesktopTasksAttached = true;
-      const surface = () => ({
-        id: contents.id,
-        type: contents.getType?.() || null,
-        url: contents.getURL?.() || null,
-      });
       const inject = (attempt = 0) => {
-        if (internalViewContents.has(contents) || contents.getURL?.() === hostUrl) return;
-        const frames = contents.mainFrame?.framesInSubtree || [];
-        Promise.all(frames.map(async (frame) => ({
-          frameUrl: frame.url,
-          result: await frame.executeJavaScript(navSource, true),
-        })))
+        if (internalContents.has(contents)) return;
+        Promise.all((contents.mainFrame?.framesInSubtree || []).map((frame) => frame.executeJavaScript(navSource, true)))
           .then((results) => {
-            record("navigation-injected", JSON.stringify({ ...surface(), frames: results }));
             const window = ownerWindow(contents);
             if (!window) return;
             const state = stateFor(window);
-            if (results.some(({ result }) => result?.anchor)) {
-              hasAnyDomNavigation = true;
+            if (results.some((result) => result?.anchor)) {
+              hasDomNavigation = true;
               state.hasDomNavigation = true;
               for (const owner of BrowserWindow.getAllWindows()) removeNativeNav(owner);
             } else if (attempt < 3) setTimeout(() => inject(attempt + 1), 1000);
-            else if (!state.hasDomNavigation && !hasAnyDomNavigation) ensureNativeNav(window);
+            else if (!state.hasDomNavigation && !hasDomNavigation) ensureNativeNav(window);
           })
-          .catch((error) => record(
-            "navigation-injection-failed",
-            JSON.stringify(surface()) + ": " + String(error),
-          ));
+          .catch(() => record("navigation-injection-failed"));
       };
       contents.on("did-finish-load", () => inject());
       contents.on("did-frame-finish-load", () => inject());
@@ -813,45 +657,29 @@ if (
         try { action = new URL(url).hostname; } catch { return; }
         if (action === "hide") hide(window);
         else if (action === "show") show(window, parseBounds(url, window));
-        else if (action === "layout") {
-          const state = windows.get(window.id);
-          if (state?.visible) show(window, parseBounds(url, window));
-        }
+        else if (action === "layout") layoutBoard(window, parseBounds(url, window));
       };
       contents.on("will-navigate", handleNavigation);
       contents.on("will-frame-navigate", handleNavigation);
     };
-
     const attachWindow = (window) => {
-      if (
-        !window
-        || window.isDestroyed()
-        || creatingInternalWindow
-        || window.getParentWindow?.()
-        || window.__impelDesktopTasksWindowAttached
-      ) return;
+      if (!window || window.isDestroyed() || creatingInternalWindow || window.getParentWindow?.() || window.__impelDesktopTasksWindowAttached) return;
       window.__impelDesktopTasksWindowAttached = true;
       attachContents(window.webContents);
-      window.on("resize", () => {
-        layoutNativeNav(window);
-        layoutBoard(window);
-      });
-      window.on("move", () => layoutBoard(window));
+      window.on("resize", () => { layoutNativeNav(window); layoutBoard(window); });
       window.on("focus", () => {
         const state = windows.get(window.id);
-        if (state?.nativeNav && !state.nativeNav.isDestroyed()) {
-          state.nativeNav.showInactive();
-          state.nativeNav.moveTop();
-        }
-        if (state?.visible && state.view && !state.view.webContents.isDestroyed()) state.view.setVisible(true);
+        state?.nativeNav?.showInactive();
+        if (state?.visible) state.view?.setVisible(true);
       });
       window.on("blur", () => setTimeout(() => {
         const state = windows.get(window.id);
-        const focused = BrowserWindow.getFocusedWindow();
-        if (focused === state?.nativeNav) return;
-        state?.nativeNav?.hide();
-        state?.view?.setVisible(false);
-      }, 1000));
+        if (BrowserWindow.getFocusedWindow() === state?.nativeNav) return;
+        // Keep the only path to Tasks available while the app is frontmost.
+        // BrowserWindow blur also fires when a user clicks the child fallback;
+        // hiding it here made the button disappear before its click arrived.
+        if (state?.nativeNav && (!window.isVisible() || window.isMinimized())) state.nativeNav.hide();
+      }, 150));
       window.on("minimize", () => {
         const state = windows.get(window.id);
         state?.nativeNav?.hide();
@@ -864,231 +692,36 @@ if (
       });
       window.on("closed", () => {
         const state = windows.get(window.id);
-        if (state) {
-          if (state.view) {
-            allowedViewContents.delete(state.view.webContents);
-            internalViewContents.delete(state.view.webContents);
-          }
-          if (state.nativeNav) internalViewContents.delete(state.nativeNav.webContents);
-          if (state.nativeNav) nativeNavOwners.delete(state.nativeNav.webContents);
-          try {
-            if (state.view) {
-              window.contentView.removeChildView(state.view);
-              state.view.webContents.close();
-            }
-            if (state.nativeNav) {
-              state.nativeNav.destroy();
-            }
-          } catch {}
-          windows.delete(window.id);
-        }
+        if (!state) return;
+        try { if (state.view) window.contentView.removeChildView(state.view); } catch {}
+        try { state.view?.webContents.close(); } catch {}
+        try { state.nativeNav?.destroy(); } catch {}
+        windows.delete(window.id);
       });
     };
-
-    ipcMain.handle(rpcChannel, async (event, request) => {
-      if (!allowedViewContents.has(event.sender)) throw new Error("Untrusted Tasks view.");
-      if (request?.method === "resources/read" && request?.params?.uri === resourceUri) {
-        return client.request("resources/read", { uri: resourceUri });
-      }
-      if (request?.method === "tools/call") {
-        const name = request?.params?.name;
-        const allowed = new Set([
-          "show_tasks",
-          "list_tasks",
-          "get_task",
-          "list_members",
-          "create_task",
-          "update_task",
-          "delete_task",
-        ]);
-        if (!allowed.has(name)) throw new Error("Unsupported Tasks tool.");
-        const args = request?.params?.arguments;
-        if (args != null && (typeof args !== "object" || Array.isArray(args))) {
-          throw new Error("Invalid Tasks tool arguments.");
-        }
-        return client.request("tools/call", { name, arguments: args || {} });
-      }
-      throw new Error("Unsupported Tasks request.");
-    });
-    ipcMain.handle(openLinkChannel, async (event, rawUrl) => {
-      if (!allowedViewContents.has(event.sender)) throw new Error("Untrusted Tasks view.");
-      const url = new URL(String(rawUrl));
-      if (url.protocol !== "https:" || url.username || url.password) throw new Error("Invalid Tasks link.");
-      await shell.openExternal(url.href);
-      return {};
-    });
-    ipcMain.on(closeChannel, (event) => {
-      if (!allowedViewContents.has(event.sender)) return;
-      for (const window of BrowserWindow.getAllWindows()) {
-        if (windows.get(window.id)?.view?.webContents === event.sender) {
-          hide(window);
-          const nativeNav = windows.get(window.id)?.nativeNav;
-          nativeNav?.webContents.executeJavaScript(
-            "window.__impelDesktopTasksSetActive?.(false);",
-            true,
-          ).catch(() => {});
-          for (const contents of electronWebContents.getAllWebContents()) {
-            if (internalViewContents.has(contents) || contents.isDestroyed()) continue;
-            for (const frame of contents.mainFrame?.framesInSubtree || []) {
-              frame.executeJavaScript(
-                "window.__impelDesktopTasksSetActive?.(false);",
-                true,
-              ).catch(() => {});
-            }
-          }
-          break;
-        }
-      }
-    });
     ipcMain.on(nativeShowChannel, (event) => {
       const window = nativeNavOwners.get(event.sender);
-      if (!window || window.isDestroyed()) return;
-      record("native-navigation-selected");
-      show(window, nativeBoardBounds(window));
+      if (window && !window.isDestroyed()) show(window, nativeBoardBounds(window));
     });
-
-    const hideAuxiliaryOutsideApp = () => {
-      const focused = BrowserWindow.getFocusedWindow();
-      if (focused && (windows.has(focused.id) || internalViewContents.has(focused.webContents))) return;
-      for (const state of windows.values()) {
-        state.nativeNav?.hide();
-        state.view?.setVisible(false);
-      }
-    };
-
     app.on("browser-window-created", (_event, window) => attachWindow(window));
-    app.on("browser-window-blur", () => setTimeout(hideAuxiliaryOutsideApp, 150));
-    app.on("hide", hideAuxiliaryOutsideApp);
     app.on("web-contents-created", (_event, contents) => setTimeout(() => attachContents(contents), 0));
-    app.on("before-quit", () => client.close());
     for (const window of BrowserWindow.getAllWindows()) attachWindow(window);
-    for (const contents of electronWebContents.getAllWebContents()) attachContents(contents);
+    for (const contents of webContents.getAllWebContents()) attachContents(contents);
     record("main-installed");
   };
-
   record("preload-loaded");
-  try {
-    install(require("electron"));
-  } catch (error) {
-    record("main-install-failed", error);
-  }
+  try { install(require("electron")); }
+  catch { record("main-install-failed"); }
 }
 `;
 }
 
+/** The fallback native navigation window exposes only its one show action. */
 export function desktopTasksViewPreload() {
   return `"use strict";
-
 const { contextBridge, ipcRenderer } = require("electron");
 contextBridge.exposeInMainWorld("impelDesktopTasks", Object.freeze({
-  rpc: (request) => ipcRenderer.invoke("impel-desktop-tasks:rpc", request),
-  openLink: (url) => ipcRenderer.invoke("impel-desktop-tasks:open-link", url),
-  close: () => ipcRenderer.send("impel-desktop-tasks:close"),
   show: () => ipcRenderer.send("impel-desktop-tasks:native-show"),
 }));
 `;
 }
-
-export function desktopTasksHostHtml() {
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width,initial-scale=1">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; frame-src 'self' data:; img-src data:;">
-    <title>Impel Tasks</title>
-    <style>
-      :root { color-scheme: light dark; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
-      * { box-sizing: border-box; }
-      html, body { width: 100%; height: 100%; margin: 0; overflow: hidden; background: Canvas; color: CanvasText; }
-      body { display: grid; grid-template-rows: minmax(0, 1fr); }
-      iframe { width: 100%; height: 100%; border: 0; background: Canvas; }
-      #status { display: grid; place-items: center; padding: 24px; color: color-mix(in srgb, CanvasText 65%, transparent); text-align: center; }
-      #status[hidden] { display: none; }
-    </style>
-  </head>
-  <body>
-    <div id="status" role="status">Loading Impel Tasks…</div>
-    <iframe id="widget" title="Impel Tasks" sandbox="allow-scripts allow-forms" hidden></iframe>
-    <script>
-      (() => {
-        const bridge = window.impelDesktopTasks;
-        const frame = document.getElementById("widget");
-        const status = document.getElementById("status");
-        let initialResult = null;
-        let initialized = false;
-        const send = (message) => frame.contentWindow?.postMessage(message, "*");
-        const reply = (id, result, error) => send(error
-          ? { jsonrpc: "2.0", id, error: { code: -32000, message: error } }
-          : { jsonrpc: "2.0", id, result });
-
-        window.addEventListener("message", async (event) => {
-          if (event.source !== frame.contentWindow) return;
-          const message = event.data;
-          if (!message || message.jsonrpc !== "2.0") return;
-          if (message.method === "ui/initialize") {
-            reply(message.id, {
-              protocolVersion: "2026-01-26",
-              hostInfo: { name: "Impel Desktop Tasks", version: "1.0.0" },
-              hostCapabilities: { openLinks: {}, serverTools: {} },
-              hostContext: {
-                theme: matchMedia("(prefers-color-scheme: dark)").matches ? "dark" : "light",
-                platform: "desktop",
-                displayMode: "fullscreen",
-                availableDisplayModes: ["fullscreen"],
-              },
-            });
-            return;
-          }
-          if (message.method === "ui/notifications/initialized") {
-            if (!initialized && initialResult) {
-              initialized = true;
-              send({ jsonrpc: "2.0", method: "ui/notifications/tool-result", params: initialResult });
-            }
-            return;
-          }
-          if (message.method === "tools/call") {
-            try {
-              const result = await bridge.rpc({ method: "tools/call", params: message.params || {} });
-              reply(message.id, result);
-            } catch (error) {
-              reply(message.id, null, error instanceof Error ? error.message : "Tasks request failed.");
-            }
-            return;
-          }
-          if (message.method === "ui/open-link") {
-            try {
-              await bridge.openLink(message.params?.url);
-              reply(message.id, {});
-            } catch (error) {
-              reply(message.id, null, error instanceof Error ? error.message : "Tasks link failed.");
-            }
-            return;
-          }
-          if (message.method === "ui/request-display-mode") {
-            reply(message.id, { mode: "fullscreen" });
-          }
-        });
-
-        window.addEventListener("keydown", (event) => {
-          if (event.key === "Escape") bridge.close();
-        });
-        Promise.all([
-          bridge.rpc({ method: "resources/read", params: { uri: ${JSON.stringify(DESKTOP_TASKS_RESOURCE_URI)} } }),
-          bridge.rpc({ method: "tools/call", params: { name: "show_tasks", arguments: { scope: "visible", limit: 50 } } }),
-        ]).then(([resource, result]) => {
-          const html = resource?.contents?.find((entry) => entry?.uri === ${JSON.stringify(DESKTOP_TASKS_RESOURCE_URI)})?.text;
-          if (typeof html !== "string" || !html.includes("<html")) throw new Error("Tasks widget resource is unavailable.");
-          initialResult = result;
-          status.hidden = true;
-          frame.hidden = false;
-          frame.srcdoc = html;
-        }).catch((error) => {
-          status.textContent = error instanceof Error ? error.message : "Impel Tasks could not be loaded.";
-        });
-      })();
-    </script>
-  </body>
-</html>
-`;
-}