impel-cli 0.20.49 → 0.20.50

package/RELEASE_NOTES.md

@@ -1,5 +1,27 @@
 # Release notes
 
+## 0.20.50 — Restore ChatGPT Tasks safely
+
+- Restores one embedded Tasks entry in the managed ChatGPT sidebar while
+  keeping Claude's production preload inert and preserving normal ChatGPT
+  startup and navigation.
+- Disables the native fallback in the production ChatGPT profile, so Tasks
+  cannot create a second control view or cover the vendor app during startup.
+- Debounces sidebar discovery, makes attached-control checks constant-time,
+  and removes the outer reinjection retry chain that could repeatedly scan the
+  renderer while its sidebar anchor was late.
+- Injects and accepts Tasks navigation only in the main vendor frame; subframes
+  cannot open, resize, or bootstrap the authenticated board.
+- Deduplicates paired Electron navigation events and reuses the loaded board,
+  keeping one tenant-bound credential exchange across ordinary hide/reopen
+  cycles while allowing an expired or failed board session to recover.
+- Advances the managed profile contract to v41 so existing macOS ChatGPT apps
+  rewrite and reload the repaired preload without rebuilding vendor bundles.
+- Adds a known-bad `0.20.48` control and a real packaged-app gate with screenshot
+  artifacts for the normal surface, one Tasks tab, and the interactive board;
+  it also externally observes the board target becoming compositor-hidden when
+  host navigation is restored, with zero fallback controls and one bootstrap.
+
 ## 0.20.49 — Restore managed app startup
 
 - Restores normal ChatGPT and Claude startup by disabling the experimental

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.49",
+  "version": "0.20.50",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -660,9 +660,12 @@ export function appPaths(homeDir = os.homedir(), tenantId = null, {
   };
 }
 
-function writeDesktopTasksProfileAssets(root, appUrl) {
+function writeDesktopTasksProfileAssets(root, appUrl, { enableEmbed = false } = {}) {
   const assets = desktopTasksAssetPaths(root);
-  writeAtomic(assets.mainPreload, desktopTasksMainPreload(appUrl), 0o600);
+  writeAtomic(assets.mainPreload, desktopTasksMainPreload(appUrl, {
+    enableEmbed,
+    enableNativeFallback: false,
+  }), 0o600);
   writeAtomic(assets.viewPreload, desktopTasksViewPreload(), 0o600);
   // This exact path is Impel-owned. Remove the former local MCP Apps host when
   // a profile is regenerated; old released clients keep the immutable server
@@ -879,6 +882,7 @@ export function installManagedAppFiles({
     writeDesktopTasksProfileAssets(
       paths[target].root,
       config.appUrl || RUNTIME_BRAND.controlPlane.defaultOrigin,
+      { enableEmbed: target === "chatgpt" },
     );
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app

package/src/desktopTasks.js

@@ -87,6 +87,7 @@ export function parseDesktopTasksCredential(output, tenantId, {
 
 const NAV_ANCHOR_RULES_SOURCE = JSON.stringify(DESKTOP_TASKS_NAV_ANCHOR_RULES);
 const TASKS_ICON = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="18" height="18" rx="2"></rect><path d="M9 3v18"></path><path d="M15 3v18"></path></svg>';
+const NAVIGATION_NONCE_PLACEHOLDER = "IMPEL_DESKTOP_TASKS_NAVIGATION_NONCE_PLACEHOLDER";
 
 const NAVIGATION_SOURCE = String.raw`(() => {
   const NAV_ID = "impel-desktop-tasks-nav";
@@ -104,6 +105,9 @@ const NAVIGATION_SOURCE = String.raw`(() => {
   let active = false;
   let lastAnchor = null;
   let readySignalled = false;
+  let ensureTimer = null;
+  const signalSequenceKey = "__impelDesktopTasksSignalSequence";
+  const navigationNonce = ${JSON.stringify(NAVIGATION_NONCE_PLACEHOLDER)};
   const roots = () => {
     const result = [document];
     for (let index = 0; index < result.length; index += 1) {
@@ -157,6 +161,10 @@ const NAVIGATION_SOURCE = String.raw`(() => {
   };
   const signal = (action) => {
     const query = new URLSearchParams(Object.entries(mainBounds()).map(([key, value]) => [key, String(value)]));
+    const signalSequence = Number(window[signalSequenceKey] || 0) + 1;
+    window[signalSequenceKey] = signalSequence;
+    query.set("event", Date.now().toString(36) + "-" + signalSequence.toString(36));
+    query.set("nonce", navigationNonce);
     location.href = "impel-tasks://" + action + "?" + query;
   };
   const select = (selected) => {
@@ -210,6 +218,10 @@ const NAVIGATION_SOURCE = String.raw`(() => {
     return button;
   };
   const ensureNav = () => {
+    if (nav?.isConnected) {
+      select(active);
+      return;
+    }
     let rule = null;
     let anchor = null;
     for (const candidate of RULES) {
@@ -253,11 +265,19 @@ const NAVIGATION_SOURCE = String.raw`(() => {
   const onResize = () => { if (active) signal("layout"); };
   window.addEventListener("click", onClick, true);
   window.addEventListener("resize", onResize);
-  const observer = new MutationObserver(() => ensureNav());
+  const scheduleEnsure = () => {
+    if (ensureTimer !== null) return;
+    ensureTimer = setTimeout(() => {
+      ensureTimer = null;
+      ensureNav();
+    }, 250);
+  };
+  const observer = new MutationObserver(scheduleEnsure);
   observer.observe(document.body, { childList: true, subtree: true });
   ensureNav();
   window.__impelDesktopTasksCleanup = () => {
     observer.disconnect();
+    if (ensureTimer !== null) clearTimeout(ensureTimer);
     window.removeEventListener("click", onClick, true);
     window.removeEventListener("resize", onResize);
     nav?.remove();
@@ -275,7 +295,10 @@ const NAVIGATION_SOURCE = String.raw`(() => {
 
 const NATIVE_NAVIGATION_HTML = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="Content-Security-Policy" content="default-src 'none';script-src 'unsafe-inline';style-src 'unsafe-inline'"><style>:root{color-scheme:light dark;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif}*{box-sizing:border-box}html,body{width:100%;height:100%;margin:0;overflow:hidden}button{width:100%;height:100%;display:flex;align-items:center;gap:9px;border:0;border-radius:8px;padding:0 12px;background:color-mix(in srgb,Canvas 92%,CanvasText 8%);color:CanvasText;cursor:pointer}svg{width:16px;height:16px}</style></head><body><button id="tasks" type="button" aria-label="Tasks">${TASKS_ICON}<span>Tasks</span></button><script>const button=document.getElementById("tasks");button.addEventListener("click",()=>{button.dataset.active="true";window.impelDesktopTasks.show()});window.__impelDesktopTasksSetActive=active=>{button.dataset.active=String(Boolean(active))}</script></body></html>`;
 
-export function desktopTasksMainPreload(appUrl, { enableEmbed = false } = {}) {
+export function desktopTasksMainPreload(appUrl, {
+  enableEmbed = false,
+  enableNativeFallback = false,
+} = {}) {
   const appOrigin = desktopTasksAppOrigin(appUrl);
   if (!enableEmbed) return `"use strict";\n`;
   const parserSource = parseDesktopTasksCredential.toString();
@@ -294,12 +317,16 @@ if (
   const fs = require("node:fs");
   const path = require("node:path");
   const { spawn } = require("node:child_process");
+  const { randomBytes } = require("node:crypto");
   const navSource = ${JSON.stringify(NAVIGATION_SOURCE)};
+  const navigationNoncePlaceholder = ${JSON.stringify(NAVIGATION_NONCE_PLACEHOLDER)};
   const nativeNavUrl = "data:text/html;charset=utf-8," + encodeURIComponent(${JSON.stringify(NATIVE_NAVIGATION_HTML)});
   const appOrigin = ${JSON.stringify(appOrigin)};
   const bootstrapUrl = appOrigin + ${JSON.stringify(DESKTOP_TASKS_BOOTSTRAP_PATH)};
   const tasksUrl = appOrigin + ${JSON.stringify(DESKTOP_TASKS_BOARD_PATH)};
   const readyMarker = ${JSON.stringify(DESKTOP_TASKS_READY_MARKER)};
+  const nativeFallbackEnabled = ${JSON.stringify(enableNativeFallback)};
+  const boardSessionMaxAgeMs = 7 * 60 * 60 * 1000;
   const tenantId = process.env.IMPEL_DESKTOP_TASKS_TENANT;
   const nativeShowChannel = "impel-desktop-tasks:native-show";
   const runtimeStatusPath = path.join(__dirname, "runtime-status.json");
@@ -383,7 +410,7 @@ if (
     const stateFor = (window) => {
       let state = windows.get(window.id);
       if (!state) {
-        state = { view: null, bounds: null, visible: false, nativeNav: null, hasDomNavigation: false, loading: null, bootstrapping: false };
+        state = { view: null, bounds: null, visible: false, nativeNav: null, hasDomNavigation: false, loaded: false, loadedAt: 0, loading: null, bootstrapping: false };
         windows.set(window.id, state);
       }
       return state;
@@ -425,7 +452,16 @@ if (
     const errorDocument = "data:text/html;charset=utf-8," + encodeURIComponent(
       "<!doctype html><html><body style='font:14px system-ui;padding:32px'>Impel Tasks could not be loaded. Hide Tasks, check your connection, and try again.</body></html>",
     );
+    const loadErrorDocument = async (state) => {
+      const contents = state.view?.webContents;
+      if (!contents || contents.isDestroyed()) return;
+      await contents.loadURL(errorDocument).catch(() => {});
+    };
     const loadBoard = async (state) => {
+      const contents = state.view?.webContents;
+      if (!contents || contents.isDestroyed()) return;
+      state.loaded = false;
+      state.loadedAt = 0;
       state.bootstrapping = true;
       let pat = null;
       try {
@@ -439,27 +475,32 @@ if (
           ].join("\\n"),
           postData: [{ type: "rawData", bytes: Buffer.alloc(0) }],
         };
-        await state.view.webContents.loadURL(bootstrapUrl, request);
-        if (state.view.webContents.getURL() !== bootstrapUrl) throw new Error("bootstrap redirected");
-        const ready = await state.view.webContents.executeJavaScript(
+        await contents.loadURL(bootstrapUrl, request);
+        if (contents.isDestroyed() || contents.getURL() !== bootstrapUrl) throw new Error("bootstrap redirected");
+        const ready = await contents.executeJavaScript(
           "document.body?.textContent?.trim() === " + JSON.stringify(readyMarker),
           true,
         );
         if (!ready) throw new Error("bootstrap marker missing");
       } catch {
         record("board-bootstrap-failed");
-        await state.view.webContents.loadURL(errorDocument).catch(() => {});
+        await loadErrorDocument(state);
         return;
       } finally {
         pat = null;
         state.bootstrapping = false;
       }
       try {
-        await state.view.webContents.loadURL(tasksUrl);
+        await contents.loadURL(tasksUrl);
+        if (contents.isDestroyed()) return;
+        state.loaded = true;
+        state.loadedAt = Date.now();
         record("board-loaded");
       } catch {
+        state.loaded = false;
+        state.loadedAt = 0;
         record("board-load-failed");
-        await state.view.webContents.loadURL(errorDocument).catch(() => {});
+        await loadErrorDocument(state);
       }
     };
     const deactivateNavigation = () => {
@@ -468,9 +509,10 @@ if (
       }
       for (const contents of webContents.getAllWebContents()) {
         if (internalContents.has(contents) || contents.isDestroyed()) continue;
-        for (const frame of contents.mainFrame?.framesInSubtree || []) {
-          frame.executeJavaScript("window.__impelDesktopTasksSetActive?.(false)", true).catch(() => {});
-        }
+        contents.mainFrame?.executeJavaScript?.(
+          "window.__impelDesktopTasksSetActive?.(false)",
+          true,
+        )?.catch(() => {});
       }
     };
     const isHostWindow = (window) => {
@@ -498,6 +540,7 @@ if (
       state.view?.setVisible(false);
       window.webContents.focus();
       deactivateNavigation();
+      record("board-hidden");
     };
     const isPrimaryWindow = (window) => {
       return isHostWindow(window) && window === primaryHostWindow() && window.isVisible?.() !== false;
@@ -520,6 +563,8 @@ if (
         },
       });
       state.view = view;
+      state.loaded = false;
+      state.loadedAt = 0;
       internalContents.add(view.webContents);
       configureSession(view.webContents.session);
       window.contentView.addChildView(view);
@@ -547,7 +592,12 @@ if (
       view.webContents.on("destroyed", () => {
         internalContents.delete(view.webContents);
         try { window.contentView.removeChildView(view); } catch {}
-        if (state.view === view) state.view = null;
+        if (state.view === view) {
+          state.view = null;
+          state.loaded = false;
+          state.loadedAt = 0;
+          state.loading = null;
+        }
       });
       return state;
     };
@@ -560,7 +610,20 @@ if (
       state.view.webContents.focus();
       if (state.visible) return;
       state.visible = true;
-      state.loading = loadBoard(state).finally(() => { state.loading = null; });
+      let boardRoute = false;
+      try {
+        const current = new URL(state.view.webContents.getURL());
+        boardRoute = current.origin === appOrigin
+          && (current.pathname === tasksUrl.slice(appOrigin.length)
+            || current.pathname.startsWith(tasksUrl.slice(appOrigin.length) + "/"));
+      } catch {}
+      const reusableBoard = state.loaded
+        && Date.now() - state.loadedAt < boardSessionMaxAgeMs
+        && boardRoute;
+      if (!reusableBoard) state.loaded = false;
+      if (!state.loaded && !state.loading) {
+        state.loading = loadBoard(state).finally(() => { state.loading = null; });
+      }
       record("board-shown");
     };
     const layoutBoard = (window, bounds = null) => {
@@ -661,43 +724,74 @@ if (
     const attachContents = (contents) => {
       if (!contents || contents.isDestroyed() || contents.__impelDesktopTasksAttached || internalContents.has(contents)) return;
       contents.__impelDesktopTasksAttached = true;
-      const inject = (attempt = 0) => {
+      const navigationNonce = randomBytes(32).toString("base64url");
+      const contentsNavSource = navSource.replace(
+        JSON.stringify(navigationNoncePlaceholder),
+        JSON.stringify(navigationNonce),
+      );
+      const inject = () => {
         if (internalContents.has(contents)) return;
-        Promise.all((contents.mainFrame?.framesInSubtree || []).map((frame) => frame.executeJavaScript(navSource, true)))
-          .then((results) => {
+        const frame = contents.mainFrame;
+        if (!frame || typeof frame.executeJavaScript !== "function") return;
+        frame.executeJavaScript(contentsNavSource, true)
+          .then((result) => {
             const window = ownerWindow(contents);
             if (!window || window !== primaryHostWindow()) return;
             const state = stateFor(window);
-            const shellReady = results.some((result) => result?.shellReady);
-            if (results.some((result) => result?.anchor)) {
+            if (result?.anchor) {
               markDomNavigation(window);
-            } else if (!shellReady && attempt < 30) setTimeout(() => inject(attempt + 1), 1000);
-            else if (shellReady && !state.hasDomNavigation && !hasDomNavigation) ensureNativeNav(window);
-            else if (!shellReady) record("navigation-shell-unready");
+            } else if (result?.shellReady && !state.hasDomNavigation && !hasDomNavigation && nativeFallbackEnabled) {
+              ensureNativeNav(window);
+            }
           })
           .catch(() => record("navigation-injection-failed"));
       };
       contents.on("did-finish-load", () => inject());
-      contents.on("did-frame-finish-load", () => inject());
       if (!contents.isLoadingMainFrame()) setTimeout(() => inject(), 0);
-      let handledNavigation = null;
+      const handledNavigationEvents = new Set();
+      let handledLegacyNavigation = null;
       const handleNavigation = (event, url) => {
         if (!String(url).startsWith("impel-tasks://")) return;
         event.preventDefault();
         const window = ownerWindow(contents);
         if (!window || window !== primaryHostWindow()) return;
-        if (handledNavigation === url) return;
-        handledNavigation = url;
-        queueMicrotask(() => { if (handledNavigation === url) handledNavigation = null; });
-        let action;
-        try { action = new URL(url).hostname; } catch { return; }
+        let navigation;
+        try { navigation = new URL(url); } catch { return; }
+        if (navigation.searchParams.get("nonce") !== navigationNonce) return;
+        const action = navigation.hostname;
+        const eventId = navigation.searchParams.get("event");
+        if (eventId) {
+          const navigationKey = action + ":" + eventId;
+          if (handledNavigationEvents.has(navigationKey)) return;
+          handledNavigationEvents.add(navigationKey);
+          if (handledNavigationEvents.size > 128) {
+            handledNavigationEvents.delete(handledNavigationEvents.values().next().value);
+          }
+        } else {
+          if (handledLegacyNavigation === url) return;
+          handledLegacyNavigation = url;
+          queueMicrotask(() => { if (handledLegacyNavigation === url) handledLegacyNavigation = null; });
+        }
         if (action === "ready") markDomNavigation(window);
         else if (action === "hide") hide(window);
         else if (action === "show") show(window, parseBounds(url, window));
         else if (action === "layout") layoutBoard(window, parseBounds(url, window));
       };
-      contents.on("will-navigate", handleNavigation);
-      contents.on("will-frame-navigate", handleNavigation);
+      const eventUrl = (event, deprecatedUrl) => (
+        typeof event?.url === "string" ? event.url : String(deprecatedUrl || "")
+      );
+      contents.on("will-navigate", (event, deprecatedUrl) => {
+        handleNavigation(event, eventUrl(event, deprecatedUrl));
+      });
+      contents.on("will-frame-navigate", (event, deprecatedUrl, _isInPlace, deprecatedIsMainFrame) => {
+        const url = eventUrl(event, deprecatedUrl);
+        if (!url.startsWith("impel-tasks://")) return;
+        event.preventDefault();
+        const isMainFrame = typeof event?.isMainFrame === "boolean"
+          ? event.isMainFrame
+          : deprecatedIsMainFrame === true;
+        if (isMainFrame) handleNavigation(event, url);
+      });
     };
     const attachWindow = (window) => {
       if (!window || window.isDestroyed() || window.getParentWindow?.() || window.__impelDesktopTasksWindowAttached) return;

package/src/managedProfileVersion.js

@@ -1,6 +1,8 @@
 // Fleet generation shared by managed-profile writers and upstream clients.
 // Keep this isolated from apps.js so latency-sensitive transports do not load
 // desktop bundle machinery just to identify their managed config contract.
-// v40 renders the Tasks fallback inside the vendor window and waits for the app
-// shell, so no child BrowserWindow can pin ChatGPT's transient startup splash.
-export const CURRENT_CONFIG_VERSION = 40;
+// v41 restores ChatGPT's embedded Tasks entry through its real sidebar only.
+// The native fallback stays disabled, and a valid authenticated board is
+// reused across hide/show cycles so it cannot obscure or repeatedly bootstrap
+// the host.
+export const CURRENT_CONFIG_VERSION = 41;