impel-cli 0.20.46 → 0.20.48

package/RELEASE_NOTES.md

@@ -1,5 +1,38 @@
 # Release notes
 
+## 0.20.48 — Confine Tasks to the primary app window
+
+- Fixes the remaining `0.20.47` regression that let an auxiliary ChatGPT or
+  Claude renderer attach a second authenticated Tasks board in a large framed
+  window, obscuring the normal app.
+- Binds Tasks once to the canonical primary vendor window, rejects child,
+  internal, auxiliary, and unowned renderers fail-closed, and removes focused-
+  window guessing from navigation ownership.
+- Couples fallback installation to the canonical renderer and deduplicates
+  paired Electron navigation events so one user action creates at most one
+  board view.
+- Advances the managed profile contract to v39 so every existing install
+  rewrites and reloads the corrected external Tasks preload. Vendor pins and
+  built bundle bytes remain unchanged.
+- Adds a behavioral reproduction of the production screenshot: an auxiliary
+  renderer fires both navigation events before the fallback is clicked, while
+  the test proves exactly one board attaches to the primary window and the
+  fallback remains a frameless 120×38 control.
+
+## 0.20.47 — Keep Tasks on the primary app window
+
+- Makes the native Tasks fallback choose the earliest surviving primary host
+  window deterministically, so a later ChatGPT auxiliary renderer cannot win a
+  probe race and cover the real app with an empty grey window.
+- Adds a behavioral regression that returns the auxiliary window first, lets it
+  finish navigation probing first, and proves the fallback and authenticated
+  board still attach only to the primary window.
+- Skips the prerelease soak because this is an immediate stable regression
+  hotfix for `0.20.46`. The change updates the external Tasks preload
+  orchestration without changing vendor pins, generated profile contracts, or
+  built bundle bytes; the full release CI, pinned managed-app launch smoke, and
+  Windows vendor contracts remain mandatory before tagging.
+
 ## 0.20.46-beta.2 — Reload reconciled apps safely
 
 - Closes every running managed macOS app before rewriting its profile and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.46",
+  "version": "0.20.48",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/desktopTasks.js

@@ -364,14 +364,20 @@ if (
       return;
     }
     const windows = new Map();
+    const internalWindows = new WeakSet();
     const internalContents = new Set();
     const nativeNavOwners = new Map();
     const configuredSessions = new WeakSet();
     let creatingInternalWindow = false;
     let hasDomNavigation = false;
+    let primaryHost = null;
     const createInternalWindow = (options) => {
       creatingInternalWindow = true;
-      try { return new BrowserWindow(options); }
+      try {
+        const window = new BrowserWindow(options);
+        internalWindows.add(window);
+        return window;
+      }
       finally { creatingInternalWindow = false; }
     };
     const stateFor = (window) => {
@@ -467,7 +473,23 @@ if (
         }
       }
     };
+    const isHostWindow = (window) => {
+      if (!window || window.isDestroyed() || internalWindows.has(window) || window.getParentWindow?.()) return false;
+      try {
+        const url = new URL(window.webContents.getURL());
+        if (url.searchParams.has("initialRoute")) return false;
+      } catch {}
+      return true;
+    };
+    const primaryHostWindow = () => {
+      if (isHostWindow(primaryHost)) return primaryHost;
+      primaryHost = BrowserWindow.getAllWindows()
+        .filter(isHostWindow)
+        .sort((left, right) => left.id - right.id)[0] || null;
+      return primaryHost;
+    };
     const hide = (window) => {
+      if (window !== primaryHostWindow()) return;
       const state = windows.get(window.id);
       if (!state) return;
       state.visible = false;
@@ -476,14 +498,14 @@ if (
       deactivateNavigation();
     };
     const isPrimaryWindow = (window) => {
-      if (!window || window.isDestroyed() || window.getParentWindow?.()) return false;
-      try {
-        const url = new URL(window.webContents.getURL());
-        if (url.searchParams.has("initialRoute")) return false;
-      } catch {}
-      return window.isVisible?.() !== false;
+      return isHostWindow(window) && window === primaryHostWindow() && window.isVisible?.() !== false;
+    };
+    const fallbackHostWindow = () => {
+      const window = primaryHostWindow();
+      return isPrimaryWindow(window) ? window : null;
     };
     const createView = (window) => {
+      if (!window || window !== primaryHostWindow() || !isHostWindow(window)) return null;
       const state = stateFor(window);
       if (state.view && !state.view.webContents.isDestroyed()) return state;
       const view = new WebContentsView({
@@ -529,6 +551,7 @@ if (
     };
     const show = (window, bounds) => {
       const state = createView(window);
+      if (!state) return;
       state.bounds = bounds;
       state.view.setBounds(bounds);
       state.view.setVisible(true);
@@ -539,6 +562,7 @@ if (
       record("board-shown");
     };
     const layoutBoard = (window, bounds = null) => {
+      if (window !== primaryHostWindow()) return;
       const state = windows.get(window.id);
       if (!state?.visible || !state.view || state.view.webContents.isDestroyed()) return;
       if (bounds) state.bounds = bounds;
@@ -573,8 +597,12 @@ if (
       const content = window.getContentBounds();
       state.nativeNav.setBounds({ x: content.x + 12, y: content.y + Math.max(48, content.height - 92), width: Math.min(120, Math.max(80, content.width - 24)), height: 38 });
     };
-    const ensureNativeNav = (window) => {
-      if (!isPrimaryWindow(window)) return;
+    const ensureNativeNav = (probeWindow) => {
+      // Renderer probes finish independently. Only the canonical host may
+      // install the singleton fallback; an auxiliary renderer cannot redirect
+      // it or acquire its own authenticated board view.
+      const window = fallbackHostWindow();
+      if (!window || probeWindow !== window) return;
       const state = stateFor(window);
       if (state.nativeNav && !state.nativeNav.isDestroyed()) return;
       // Auxiliary vendor windows (for example Codex's hidden avatar overlay)
@@ -621,11 +649,10 @@ if (
       nativeNavOwners.delete(nativeNav.webContents);
       try { nativeNav.destroy(); } catch {}
     };
-    const ownerWindow = (contents) => BrowserWindow.fromWebContents(contents)
-      || contents.getOwnerBrowserWindow?.()
-      || BrowserWindow.getFocusedWindow()
-      || BrowserWindow.getAllWindows().find((window) => !window.isDestroyed())
-      || null;
+    const ownerWindow = (contents) => {
+      const window = BrowserWindow.fromWebContents(contents) || contents.getOwnerBrowserWindow?.() || null;
+      return isHostWindow(window) ? window : null;
+    };
     const attachContents = (contents) => {
       if (!contents || contents.isDestroyed() || contents.__impelDesktopTasksAttached || internalContents.has(contents)) return;
       contents.__impelDesktopTasksAttached = true;
@@ -634,7 +661,7 @@ if (
         Promise.all((contents.mainFrame?.framesInSubtree || []).map((frame) => frame.executeJavaScript(navSource, true)))
           .then((results) => {
             const window = ownerWindow(contents);
-            if (!window) return;
+            if (!window || window !== primaryHostWindow()) return;
             const state = stateFor(window);
             if (results.some((result) => result?.anchor)) {
               hasDomNavigation = true;
@@ -648,11 +675,15 @@ if (
       contents.on("did-finish-load", () => inject());
       contents.on("did-frame-finish-load", () => inject());
       if (!contents.isLoadingMainFrame()) setTimeout(() => inject(), 0);
+      let handledNavigation = null;
       const handleNavigation = (event, url) => {
         if (!String(url).startsWith("impel-tasks://")) return;
         event.preventDefault();
         const window = ownerWindow(contents);
-        if (!window) return;
+        if (!window || window !== primaryHostWindow()) return;
+        if (handledNavigation === url) return;
+        handledNavigation = url;
+        queueMicrotask(() => { if (handledNavigation === url) handledNavigation = null; });
         let action;
         try { action = new URL(url).hostname; } catch { return; }
         if (action === "hide") hide(window);
@@ -692,11 +723,13 @@ if (
       });
       window.on("closed", () => {
         const state = windows.get(window.id);
-        if (!state) return;
-        try { if (state.view) window.contentView.removeChildView(state.view); } catch {}
-        try { state.view?.webContents.close(); } catch {}
-        try { state.nativeNav?.destroy(); } catch {}
+        if (state) {
+          try { if (state.view) window.contentView.removeChildView(state.view); } catch {}
+          try { state.view?.webContents.close(); } catch {}
+          try { state.nativeNav?.destroy(); } catch {}
+        }
         windows.delete(window.id);
+        if (primaryHost === window) primaryHost = null;
       });
     };
     ipcMain.on(nativeShowChannel, (event) => {

package/src/managedProfileVersion.js

@@ -1,6 +1,6 @@
 // Fleet generation shared by managed-profile writers and upstream clients.
 // Keep this isolated from apps.js so latency-sensitive transports do not load
 // desktop bundle machinery just to identify their managed config contract.
-// v38 replaces the generated desktop MCP Apps host with the authenticated web
-// board and removes the desktop-only Codex renderer flag.
-export const CURRENT_CONFIG_VERSION = 38;
+// v39 confines the authenticated desktop Tasks view to one canonical primary
+// vendor window and forces every existing managed profile to receive the fix.
+export const CURRENT_CONFIG_VERSION = 39;