impel-cli 0.20.48 → 0.20.50

package/RELEASE_NOTES.md

@@ -1,5 +1,45 @@
 # Release notes
 
+## 0.20.50 — Restore ChatGPT Tasks safely
+
+- Restores one embedded Tasks entry in the managed ChatGPT sidebar while
+  keeping Claude's production preload inert and preserving normal ChatGPT
+  startup and navigation.
+- Disables the native fallback in the production ChatGPT profile, so Tasks
+  cannot create a second control view or cover the vendor app during startup.
+- Debounces sidebar discovery, makes attached-control checks constant-time,
+  and removes the outer reinjection retry chain that could repeatedly scan the
+  renderer while its sidebar anchor was late.
+- Injects and accepts Tasks navigation only in the main vendor frame; subframes
+  cannot open, resize, or bootstrap the authenticated board.
+- Deduplicates paired Electron navigation events and reuses the loaded board,
+  keeping one tenant-bound credential exchange across ordinary hide/reopen
+  cycles while allowing an expired or failed board session to recover.
+- Advances the managed profile contract to v41 so existing macOS ChatGPT apps
+  rewrite and reload the repaired preload without rebuilding vendor bundles.
+- Adds a known-bad `0.20.48` control and a real packaged-app gate with screenshot
+  artifacts for the normal surface, one Tasks tab, and the interactive board;
+  it also externally observes the board target becoming compositor-hidden when
+  host navigation is restored, with zero fallback controls and one bootstrap.
+
+## 0.20.49 — Restore managed app startup
+
+- Restores normal ChatGPT and Claude startup by disabling the experimental
+  embedded Tasks UI in managed vendor apps. The fallback's Electron window and
+  DOM-injection paths no longer run in production.
+- Retains tenant-bound Tasks through the CLI and MCP while the desktop entry
+  point is redesigned against an explicitly supported vendor integration seam.
+- Makes every production-generated main preload an exact inert stub. The
+  reviewed prototype remains test-only and cannot be enabled by a managed app
+  environment variable.
+- Advances the managed profile contract to v40 so every existing macOS app
+  rewrites and reloads the corrected external Tasks preload. Vendor pins and
+  built bundle bytes remain unchanged.
+- Adds a production-default contract proving the embedded path is inert, while
+  retaining deterministic coverage for the prototype behind its opt-in. The
+  pinned managed-app smoke also requires the normal working surface, the exact
+  inert preload bytes, zero injected controls, and zero Tasks web requests.
+
 ## 0.20.48 — Confine Tasks to the primary app window
 
 - Fixes the remaining `0.20.47` regression that let an auxiliary ChatGPT or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.48",
+  "version": "0.20.50",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -660,9 +660,12 @@ export function appPaths(homeDir = os.homedir(), tenantId = null, {
   };
 }
 
-function writeDesktopTasksProfileAssets(root, appUrl) {
+function writeDesktopTasksProfileAssets(root, appUrl, { enableEmbed = false } = {}) {
   const assets = desktopTasksAssetPaths(root);
-  writeAtomic(assets.mainPreload, desktopTasksMainPreload(appUrl), 0o600);
+  writeAtomic(assets.mainPreload, desktopTasksMainPreload(appUrl, {
+    enableEmbed,
+    enableNativeFallback: false,
+  }), 0o600);
   writeAtomic(assets.viewPreload, desktopTasksViewPreload(), 0o600);
   // This exact path is Impel-owned. Remove the former local MCP Apps host when
   // a profile is regenerated; old released clients keep the immutable server
@@ -879,6 +882,7 @@ export function installManagedAppFiles({
     writeDesktopTasksProfileAssets(
       paths[target].root,
       config.appUrl || RUNTIME_BRAND.controlPlane.defaultOrigin,
+      { enableEmbed: target === "chatgpt" },
     );
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app

package/src/desktopTasks.js

@@ -87,6 +87,7 @@ export function parseDesktopTasksCredential(output, tenantId, {
 
 const NAV_ANCHOR_RULES_SOURCE = JSON.stringify(DESKTOP_TASKS_NAV_ANCHOR_RULES);
 const TASKS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="2"></rect><path d="M9 3v18"></path><path d="M15 3v18"></path></svg>';
+const NAVIGATION_NONCE_PLACEHOLDER = "IMPEL_DESKTOP_TASKS_NAVIGATION_NONCE_PLACEHOLDER";
 
 const NAVIGATION_SOURCE = String.raw`(() => {
   const NAV_ID = "impel-desktop-tasks-nav";
@@ -103,6 +104,10 @@ const NAVIGATION_SOURCE = String.raw`(() => {
   let slot = null;
   let active = false;
   let lastAnchor = null;
+  let readySignalled = false;
+  let ensureTimer = null;
+  const signalSequenceKey = "__impelDesktopTasksSignalSequence";
+  const navigationNonce = ${JSON.stringify(NAVIGATION_NONCE_PLACEHOLDER)};
   const roots = () => {
     const result = [document];
     for (let index = 0; index < result.length; index += 1) {
@@ -156,6 +161,10 @@ const NAVIGATION_SOURCE = String.raw`(() => {
   };
   const signal = (action) => {
     const query = new URLSearchParams(Object.entries(mainBounds()).map(([key, value]) => [key, String(value)]));
+    const signalSequence = Number(window[signalSequenceKey] || 0) + 1;
+    window[signalSequenceKey] = signalSequence;
+    query.set("event", Date.now().toString(36) + "-" + signalSequence.toString(36));
+    query.set("nonce", navigationNonce);
     location.href = "impel-tasks://" + action + "?" + query;
   };
   const select = (selected) => {
@@ -209,6 +218,10 @@ const NAVIGATION_SOURCE = String.raw`(() => {
     return button;
   };
   const ensureNav = () => {
+    if (nav?.isConnected) {
+      select(active);
+      return;
+    }
     let rule = null;
     let anchor = null;
     for (const candidate of RULES) {
@@ -233,6 +246,10 @@ const NAVIGATION_SOURCE = String.raw`(() => {
       slot = nav;
     }
     select(active);
+    if (nav?.isConnected && !readySignalled) {
+      readySignalled = true;
+      setTimeout(() => signal("ready"), 0);
+    }
   };
   const style = document.createElement("style");
   style.textContent = "#" + NAV_ID + " svg{width:16px;height:16px;flex:0 0 auto}#" + NAV_ID + "." + ACTIVE_CLASS + "{background:color-mix(in srgb,CanvasText 10%,transparent)}#" + NAV_ID + ":focus-visible{outline:2px solid #7c8cff;outline-offset:2px}";
@@ -248,11 +265,19 @@ const NAVIGATION_SOURCE = String.raw`(() => {
   const onResize = () => { if (active) signal("layout"); };
   window.addEventListener("click", onClick, true);
   window.addEventListener("resize", onResize);
-  const observer = new MutationObserver(() => ensureNav());
+  const scheduleEnsure = () => {
+    if (ensureTimer !== null) return;
+    ensureTimer = setTimeout(() => {
+      ensureTimer = null;
+      ensureNav();
+    }, 250);
+  };
+  const observer = new MutationObserver(scheduleEnsure);
   observer.observe(document.body, { childList: true, subtree: true });
   ensureNav();
   window.__impelDesktopTasksCleanup = () => {
     observer.disconnect();
+    if (ensureTimer !== null) clearTimeout(ensureTimer);
     window.removeEventListener("click", onClick, true);
     window.removeEventListener("resize", onResize);
     nav?.remove();
@@ -260,13 +285,22 @@ const NAVIGATION_SOURCE = String.raw`(() => {
     style.remove();
     delete window.__impelDesktopTasksSetActive;
   };
-  return { anchor: lastAnchor ? label(lastAnchor) : null, connected: Boolean(nav?.isConnected) };
+  const shellControls = controls().filter((element) => visible(element) && Boolean(label(element)));
+  return {
+    anchor: lastAnchor ? label(lastAnchor) : null,
+    connected: Boolean(nav?.isConnected),
+    shellReady: shellControls.length >= 2,
+  };
 })();`;
 
 const NATIVE_NAVIGATION_HTML = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none';script-src 'unsafe-inline';style-src 'unsafe-inline'"><style>:root{color-scheme:light dark;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}*{box-sizing:border-box}html,body{width:100%;height:100%;margin:0;overflow:hidden}button{width:100%;height:100%;display:flex;align-items:center;gap:9px;border:0;border-radius:8px;padding:0 12px;background:color-mix(in srgb,Canvas 92%,CanvasText 8%);color:CanvasText;cursor:pointer}svg{width:16px;height:16px}</style></head><body><button id="tasks" type="button" aria-label="Tasks">${TASKS_ICON}<span>Tasks</span></button><script>const button=document.getElementById("tasks");button.addEventListener("click",()=>{button.dataset.active="true";window.impelDesktopTasks.show()});window.__impelDesktopTasksSetActive=active=>{button.dataset.active=String(Boolean(active))}</script></body></html>`;
 
-export function desktopTasksMainPreload(appUrl) {
+export function desktopTasksMainPreload(appUrl, {
+  enableEmbed = false,
+  enableNativeFallback = false,
+} = {}) {
   const appOrigin = desktopTasksAppOrigin(appUrl);
+  if (!enableEmbed) return `"use strict";\n`;
   const parserSource = parseDesktopTasksCredential.toString();
   const escapeRegexSource = escapeRegex.toString();
   return `"use strict";
@@ -283,12 +317,16 @@ if (
   const fs = require("node:fs");
   const path = require("node:path");
   const { spawn } = require("node:child_process");
+  const { randomBytes } = require("node:crypto");
   const navSource = ${JSON.stringify(NAVIGATION_SOURCE)};
+  const navigationNoncePlaceholder = ${JSON.stringify(NAVIGATION_NONCE_PLACEHOLDER)};
   const nativeNavUrl = "data:text/html;charset=utf-8," + encodeURIComponent(${JSON.stringify(NATIVE_NAVIGATION_HTML)});
   const appOrigin = ${JSON.stringify(appOrigin)};
   const bootstrapUrl = appOrigin + ${JSON.stringify(DESKTOP_TASKS_BOOTSTRAP_PATH)};
   const tasksUrl = appOrigin + ${JSON.stringify(DESKTOP_TASKS_BOARD_PATH)};
   const readyMarker = ${JSON.stringify(DESKTOP_TASKS_READY_MARKER)};
+  const nativeFallbackEnabled = ${JSON.stringify(enableNativeFallback)};
+  const boardSessionMaxAgeMs = 7 * 60 * 60 * 1000;
   const tenantId = process.env.IMPEL_DESKTOP_TASKS_TENANT;
   const nativeShowChannel = "impel-desktop-tasks:native-show";
   const runtimeStatusPath = path.join(__dirname, "runtime-status.json");
@@ -364,26 +402,15 @@ if (
       return;
     }
     const windows = new Map();
-    const internalWindows = new WeakSet();
     const internalContents = new Set();
     const nativeNavOwners = new Map();
     const configuredSessions = new WeakSet();
-    let creatingInternalWindow = false;
     let hasDomNavigation = false;
     let primaryHost = null;
-    const createInternalWindow = (options) => {
-      creatingInternalWindow = true;
-      try {
-        const window = new BrowserWindow(options);
-        internalWindows.add(window);
-        return window;
-      }
-      finally { creatingInternalWindow = false; }
-    };
     const stateFor = (window) => {
       let state = windows.get(window.id);
       if (!state) {
-        state = { view: null, bounds: null, visible: false, nativeNav: null, hasDomNavigation: false, loading: null, bootstrapping: false };
+        state = { view: null, bounds: null, visible: false, nativeNav: null, hasDomNavigation: false, loaded: false, loadedAt: 0, loading: null, bootstrapping: false };
         windows.set(window.id, state);
       }
       return state;
@@ -425,7 +452,16 @@ if (
     const errorDocument = "data:text/html;charset=utf-8," + encodeURIComponent(
       "<!doctype html><html><body style='font:14px system-ui;padding:32px'>Impel Tasks could not be loaded. Hide Tasks, check your connection, and try again.</body></html>",
     );
+    const loadErrorDocument = async (state) => {
+      const contents = state.view?.webContents;
+      if (!contents || contents.isDestroyed()) return;
+      await contents.loadURL(errorDocument).catch(() => {});
+    };
     const loadBoard = async (state) => {
+      const contents = state.view?.webContents;
+      if (!contents || contents.isDestroyed()) return;
+      state.loaded = false;
+      state.loadedAt = 0;
       state.bootstrapping = true;
       let pat = null;
       try {
@@ -439,27 +475,32 @@ if (
           ].join("\\n"),
           postData: [{ type: "rawData", bytes: Buffer.alloc(0) }],
         };
-        await state.view.webContents.loadURL(bootstrapUrl, request);
-        if (state.view.webContents.getURL() !== bootstrapUrl) throw new Error("bootstrap redirected");
-        const ready = await state.view.webContents.executeJavaScript(
+        await contents.loadURL(bootstrapUrl, request);
+        if (contents.isDestroyed() || contents.getURL() !== bootstrapUrl) throw new Error("bootstrap redirected");
+        const ready = await contents.executeJavaScript(
           "document.body?.textContent?.trim() === " + JSON.stringify(readyMarker),
           true,
         );
         if (!ready) throw new Error("bootstrap marker missing");
       } catch {
         record("board-bootstrap-failed");
-        await state.view.webContents.loadURL(errorDocument).catch(() => {});
+        await loadErrorDocument(state);
         return;
       } finally {
         pat = null;
         state.bootstrapping = false;
       }
       try {
-        await state.view.webContents.loadURL(tasksUrl);
+        await contents.loadURL(tasksUrl);
+        if (contents.isDestroyed()) return;
+        state.loaded = true;
+        state.loadedAt = Date.now();
         record("board-loaded");
       } catch {
+        state.loaded = false;
+        state.loadedAt = 0;
         record("board-load-failed");
-        await state.view.webContents.loadURL(errorDocument).catch(() => {});
+        await loadErrorDocument(state);
       }
     };
     const deactivateNavigation = () => {
@@ -468,17 +509,20 @@ if (
       }
       for (const contents of webContents.getAllWebContents()) {
         if (internalContents.has(contents) || contents.isDestroyed()) continue;
-        for (const frame of contents.mainFrame?.framesInSubtree || []) {
-          frame.executeJavaScript("window.__impelDesktopTasksSetActive?.(false)", true).catch(() => {});
-        }
+        contents.mainFrame?.executeJavaScript?.(
+          "window.__impelDesktopTasksSetActive?.(false)",
+          true,
+        )?.catch(() => {});
       }
     };
     const isHostWindow = (window) => {
-      if (!window || window.isDestroyed() || internalWindows.has(window) || window.getParentWindow?.()) return false;
+      if (!window || window.isDestroyed() || window.getParentWindow?.()) return false;
       try {
-        const url = new URL(window.webContents.getURL());
+        const rawUrl = window.webContents.getURL();
+        if (!rawUrl || rawUrl === "about:blank") return false;
+        const url = new URL(rawUrl);
         if (url.searchParams.has("initialRoute")) return false;
-      } catch {}
+      } catch { return false; }
       return true;
     };
     const primaryHostWindow = () => {
@@ -496,6 +540,7 @@ if (
       state.view?.setVisible(false);
       window.webContents.focus();
       deactivateNavigation();
+      record("board-hidden");
     };
     const isPrimaryWindow = (window) => {
       return isHostWindow(window) && window === primaryHostWindow() && window.isVisible?.() !== false;
@@ -518,6 +563,8 @@ if (
         },
       });
       state.view = view;
+      state.loaded = false;
+      state.loadedAt = 0;
       internalContents.add(view.webContents);
       configureSession(view.webContents.session);
       window.contentView.addChildView(view);
@@ -545,7 +592,12 @@ if (
       view.webContents.on("destroyed", () => {
         internalContents.delete(view.webContents);
         try { window.contentView.removeChildView(view); } catch {}
-        if (state.view === view) state.view = null;
+        if (state.view === view) {
+          state.view = null;
+          state.loaded = false;
+          state.loadedAt = 0;
+          state.loading = null;
+        }
       });
       return state;
     };
@@ -558,7 +610,20 @@ if (
       state.view.webContents.focus();
       if (state.visible) return;
       state.visible = true;
-      state.loading = loadBoard(state).finally(() => { state.loading = null; });
+      let boardRoute = false;
+      try {
+        const current = new URL(state.view.webContents.getURL());
+        boardRoute = current.origin === appOrigin
+          && (current.pathname === tasksUrl.slice(appOrigin.length)
+            || current.pathname.startsWith(tasksUrl.slice(appOrigin.length) + "/"));
+      } catch {}
+      const reusableBoard = state.loaded
+        && Date.now() - state.loadedAt < boardSessionMaxAgeMs
+        && boardRoute;
+      if (!reusableBoard) state.loaded = false;
+      if (!state.loaded && !state.loading) {
+        state.loading = loadBoard(state).finally(() => { state.loading = null; });
+      }
       record("board-shown");
     };
     const layoutBoard = (window, bounds = null) => {
@@ -593,9 +658,9 @@ if (
     };
     const layoutNativeNav = (window) => {
       const state = windows.get(window.id);
-      if (!state?.nativeNav || state.nativeNav.isDestroyed()) return;
+      if (!state?.nativeNav || state.nativeNav.webContents.isDestroyed()) return;
       const content = window.getContentBounds();
-      state.nativeNav.setBounds({ x: content.x + 12, y: content.y + Math.max(48, content.height - 92), width: Math.min(120, Math.max(80, content.width - 24)), height: 38 });
+      state.nativeNav.setBounds({ x: 12, y: Math.max(48, content.height - 92), width: Math.min(120, Math.max(80, content.width - 24)), height: 38 });
     };
     const ensureNativeNav = (probeWindow) => {
       // Renderer probes finish independently. Only the canonical host may
@@ -604,21 +669,14 @@ if (
       const window = fallbackHostWindow();
       if (!window || probeWindow !== window) return;
       const state = stateFor(window);
-      if (state.nativeNav && !state.nativeNav.isDestroyed()) return;
+      if (state.nativeNav && !state.nativeNav.webContents.isDestroyed()) return;
       // Auxiliary vendor windows (for example Codex's hidden avatar overlay)
       // are also top-level BrowserWindows. Never give them their own Tasks
-      // fallback: duplicate child windows interfere with first-run navigation
-      // and can cover the primary shell.
+      // fallback: duplicate views can cover the primary shell.
       if ([...windows.values()].some((candidate) => (
-        candidate.nativeNav && !candidate.nativeNav.isDestroyed()
+        candidate.nativeNav && !candidate.nativeNav.webContents.isDestroyed()
       ))) return;
-      const nativeNav = createInternalWindow({
-        parent: window,
-        frame: false,
-        show: false,
-        resizable: false,
-        skipTaskbar: true,
-        backgroundColor: "#292929",
+      const nativeNav = new WebContentsView({
         webPreferences: {
           preload: process.env.IMPEL_DESKTOP_TASKS_VIEW_PRELOAD,
           contextIsolation: true,
@@ -629,15 +687,19 @@ if (
       state.nativeNav = nativeNav;
       internalContents.add(nativeNav.webContents);
       nativeNavOwners.set(nativeNav.webContents, window);
+      window.contentView.addChildView(nativeNav);
+      nativeNav.setVisible(false);
+      nativeNav.setBackgroundColor("#292929");
       nativeNav.webContents.setWindowOpenHandler(() => ({ action: "deny" }));
       nativeNav.webContents.on("will-navigate", (event, url) => { if (url !== nativeNavUrl) event.preventDefault(); });
       nativeNav.webContents.on("destroyed", () => {
         internalContents.delete(nativeNav.webContents);
         nativeNavOwners.delete(nativeNav.webContents);
+        if (state.nativeNav === nativeNav) state.nativeNav = null;
       });
       nativeNav.webContents.loadURL(nativeNavUrl).catch(() => record("native-navigation-load-failed"));
       layoutNativeNav(window);
-      nativeNav.showInactive();
+      nativeNav.setVisible(true);
       record("native-navigation-installed");
     };
     const removeNativeNav = (window) => {
@@ -647,7 +709,13 @@ if (
       state.nativeNav = null;
       internalContents.delete(nativeNav.webContents);
       nativeNavOwners.delete(nativeNav.webContents);
-      try { nativeNav.destroy(); } catch {}
+      try { window.contentView.removeChildView(nativeNav); } catch {}
+      try { nativeNav.webContents.close(); } catch {}
+    };
+    const markDomNavigation = (window) => {
+      hasDomNavigation = true;
+      stateFor(window).hasDomNavigation = true;
+      for (const owner of BrowserWindow.getAllWindows()) removeNativeNav(owner);
     };
     const ownerWindow = (contents) => {
       const window = BrowserWindow.fromWebContents(contents) || contents.getOwnerBrowserWindow?.() || null;
@@ -656,69 +724,100 @@ if (
     const attachContents = (contents) => {
       if (!contents || contents.isDestroyed() || contents.__impelDesktopTasksAttached || internalContents.has(contents)) return;
       contents.__impelDesktopTasksAttached = true;
-      const inject = (attempt = 0) => {
+      const navigationNonce = randomBytes(32).toString("base64url");
+      const contentsNavSource = navSource.replace(
+        JSON.stringify(navigationNoncePlaceholder),
+        JSON.stringify(navigationNonce),
+      );
+      const inject = () => {
         if (internalContents.has(contents)) return;
-        Promise.all((contents.mainFrame?.framesInSubtree || []).map((frame) => frame.executeJavaScript(navSource, true)))
-          .then((results) => {
+        const frame = contents.mainFrame;
+        if (!frame || typeof frame.executeJavaScript !== "function") return;
+        frame.executeJavaScript(contentsNavSource, true)
+          .then((result) => {
             const window = ownerWindow(contents);
             if (!window || window !== primaryHostWindow()) return;
             const state = stateFor(window);
-            if (results.some((result) => result?.anchor)) {
-              hasDomNavigation = true;
-              state.hasDomNavigation = true;
-              for (const owner of BrowserWindow.getAllWindows()) removeNativeNav(owner);
-            } else if (attempt < 3) setTimeout(() => inject(attempt + 1), 1000);
-            else if (!state.hasDomNavigation && !hasDomNavigation) ensureNativeNav(window);
+            if (result?.anchor) {
+              markDomNavigation(window);
+            } else if (result?.shellReady && !state.hasDomNavigation && !hasDomNavigation && nativeFallbackEnabled) {
+              ensureNativeNav(window);
+            }
           })
           .catch(() => record("navigation-injection-failed"));
       };
       contents.on("did-finish-load", () => inject());
-      contents.on("did-frame-finish-load", () => inject());
       if (!contents.isLoadingMainFrame()) setTimeout(() => inject(), 0);
-      let handledNavigation = null;
+      const handledNavigationEvents = new Set();
+      let handledLegacyNavigation = null;
       const handleNavigation = (event, url) => {
         if (!String(url).startsWith("impel-tasks://")) return;
         event.preventDefault();
         const window = ownerWindow(contents);
         if (!window || window !== primaryHostWindow()) return;
-        if (handledNavigation === url) return;
-        handledNavigation = url;
-        queueMicrotask(() => { if (handledNavigation === url) handledNavigation = null; });
-        let action;
-        try { action = new URL(url).hostname; } catch { return; }
-        if (action === "hide") hide(window);
+        let navigation;
+        try { navigation = new URL(url); } catch { return; }
+        if (navigation.searchParams.get("nonce") !== navigationNonce) return;
+        const action = navigation.hostname;
+        const eventId = navigation.searchParams.get("event");
+        if (eventId) {
+          const navigationKey = action + ":" + eventId;
+          if (handledNavigationEvents.has(navigationKey)) return;
+          handledNavigationEvents.add(navigationKey);
+          if (handledNavigationEvents.size > 128) {
+            handledNavigationEvents.delete(handledNavigationEvents.values().next().value);
+          }
+        } else {
+          if (handledLegacyNavigation === url) return;
+          handledLegacyNavigation = url;
+          queueMicrotask(() => { if (handledLegacyNavigation === url) handledLegacyNavigation = null; });
+        }
+        if (action === "ready") markDomNavigation(window);
+        else if (action === "hide") hide(window);
         else if (action === "show") show(window, parseBounds(url, window));
         else if (action === "layout") layoutBoard(window, parseBounds(url, window));
       };
-      contents.on("will-navigate", handleNavigation);
-      contents.on("will-frame-navigate", handleNavigation);
+      const eventUrl = (event, deprecatedUrl) => (
+        typeof event?.url === "string" ? event.url : String(deprecatedUrl || "")
+      );
+      contents.on("will-navigate", (event, deprecatedUrl) => {
+        handleNavigation(event, eventUrl(event, deprecatedUrl));
+      });
+      contents.on("will-frame-navigate", (event, deprecatedUrl, _isInPlace, deprecatedIsMainFrame) => {
+        const url = eventUrl(event, deprecatedUrl);
+        if (!url.startsWith("impel-tasks://")) return;
+        event.preventDefault();
+        const isMainFrame = typeof event?.isMainFrame === "boolean"
+          ? event.isMainFrame
+          : deprecatedIsMainFrame === true;
+        if (isMainFrame) handleNavigation(event, url);
+      });
     };
     const attachWindow = (window) => {
-      if (!window || window.isDestroyed() || creatingInternalWindow || window.getParentWindow?.() || window.__impelDesktopTasksWindowAttached) return;
+      if (!window || window.isDestroyed() || window.getParentWindow?.() || window.__impelDesktopTasksWindowAttached) return;
       window.__impelDesktopTasksWindowAttached = true;
       attachContents(window.webContents);
       window.on("resize", () => { layoutNativeNav(window); layoutBoard(window); });
       window.on("focus", () => {
         const state = windows.get(window.id);
-        state?.nativeNav?.showInactive();
+        state?.nativeNav?.setVisible(true);
         if (state?.visible) state.view?.setVisible(true);
       });
       window.on("blur", () => setTimeout(() => {
         const state = windows.get(window.id);
-        if (BrowserWindow.getFocusedWindow() === state?.nativeNav) return;
         // Keep the only path to Tasks available while the app is frontmost.
-        // BrowserWindow blur also fires when a user clicks the child fallback;
-        // hiding it here made the button disappear before its click arrived.
-        if (state?.nativeNav && (!window.isVisible() || window.isMinimized())) state.nativeNav.hide();
+        // Moving focus into the fallback view must not hide it before the click
+        // arrives; only a hidden or minimized host hides the affordance.
+        if (state?.nativeNav && (!window.isVisible() || window.isMinimized())) state.nativeNav.setVisible(false);
       }, 150));
       window.on("minimize", () => {
         const state = windows.get(window.id);
-        state?.nativeNav?.hide();
+        state?.nativeNav?.setVisible(false);
         state?.view?.setVisible(false);
       });
       window.on("restore", () => {
         const state = windows.get(window.id);
-        state?.nativeNav?.showInactive();
+        state?.nativeNav?.setVisible(true);
         if (state?.visible) state.view?.setVisible(true);
       });
       window.on("closed", () => {
@@ -726,7 +825,8 @@ if (
         if (state) {
           try { if (state.view) window.contentView.removeChildView(state.view); } catch {}
           try { state.view?.webContents.close(); } catch {}
-          try { state.nativeNav?.destroy(); } catch {}
+          try { if (state.nativeNav) window.contentView.removeChildView(state.nativeNav); } catch {}
+          try { state.nativeNav?.webContents.close(); } catch {}
         }
         windows.delete(window.id);
         if (primaryHost === window) primaryHost = null;

package/src/managedProfileVersion.js

@@ -1,6 +1,8 @@
 // Fleet generation shared by managed-profile writers and upstream clients.
 // Keep this isolated from apps.js so latency-sensitive transports do not load
 // desktop bundle machinery just to identify their managed config contract.
-// v39 confines the authenticated desktop Tasks view to one canonical primary
-// vendor window and forces every existing managed profile to receive the fix.
-export const CURRENT_CONFIG_VERSION = 39;
+// v41 restores ChatGPT's embedded Tasks entry through its real sidebar only.
+// The native fallback stays disabled, and a valid authenticated board is
+// reused across hide/show cycles so it cannot obscure or repeatedly bootstrap
+// the host.
+export const CURRENT_CONFIG_VERSION = 41;