impel-cli 0.20.50 → 0.20.52

package/README.md

@@ -410,7 +410,9 @@ nor a tenant-derived credential.
   Electron archives cannot be patched without invalidating vendor signatures.
   It loads the authenticated canonical Impel `/tasks` application directly in
   a sandboxed, tenant-isolated web view; a fresh profile uses the existing
-  Board default.
+  Board default. Selecting a card, list row, or fleet item opens that exact
+  tenant's ticket in the main Impel browser app; the constrained desktop
+  session remains board-only.
 - The trusted native process obtains the selected tenant credential through a
   private one-shot pipe, exchanges the PAT for a bounded HttpOnly web session,
   and then loads `/tasks` without an Authorization header. The web renderer has

package/RELEASE_NOTES.md

@@ -1,5 +1,33 @@
 # Release notes
 
+## 0.20.52 — Open embedded Tasks tickets safely
+
+- Makes cards, list rows, fleet items, and the card menu open their exact
+  tenant-scoped ticket in the main Impel browser app.
+- Keeps the embedded desktop session restricted to the Tasks board and sends
+  only the credential-free, membership-checked issue handoff to the system
+  browser.
+- Updates the coordinated reviewed ChatGPT/Codex pin to desktop
+  `26.810.41047`, embedded Codex `0.148.0-alpha.9`, and the currently
+  fulfillable Windows Store package `26.810.4967.0`, retaining exact artifact,
+  signature, package, publisher, executable, and runtime verification.
+- Skips the prerelease soak because this is an immediate stable repair for the
+  embedded ticket-navigation regression and Microsoft Store fulfillment drift;
+  the full release CI and Windows vendor contract remain mandatory before tag.
+
+## 0.20.51 — Restore Claude Tasks in the sidebar
+
+- Restores one embedded Tasks row in managed Claude's existing sidebar,
+  directly after the Home/Code switcher and before New and Customize.
+- Uses the same confined `WebContentsView` board lifecycle as ChatGPT while
+  keeping the native fallback disabled, so Tasks cannot cover Claude during
+  startup or create a second control window.
+- Promotes Claude's real pinned-app renderer smoke from boot-only to a required
+  UI contract: working surface, exact row placement, interactive tenant-bound
+  board, restored host navigation, screenshots, and credential/egress checks.
+- Advances the managed profile contract to v42 so installed Claude apps rewrite
+  the repaired preload and restart without rebuilding their vendor bundles.
+
 ## 0.20.50 — Restore ChatGPT Tasks safely
 
 - Restores one embedded Tasks entry in the managed ChatGPT sidebar while
@@ -72,7 +100,6 @@
   orchestration without changing vendor pins, generated profile contracts, or
   built bundle bytes; the full release CI, pinned managed-app launch smoke, and
   Windows vendor contracts remain mandatory before tagging.
-
 ## 0.20.46-beta.2 — Reload reconciled apps safely
 
 - Closes every running managed macOS app before rewriting its profile and

package/docs/native-agent-host-capability-matrix.md

@@ -1,6 +1,6 @@
 # Native-agent host capability matrix
 
-Validated on 2026-08-11 with isolated temporary homes and tenant profiles. The
+Validated on 2026-08-14 with isolated temporary homes and tenant profiles. The
 matrix is intentionally pinned: a client upgrade must be re-qualified before it
 is treated as an eager host.
 
@@ -9,7 +9,7 @@ is treated as an eager host.
 | Claude Code | 2.1.220 | Yes, agent frontmatter `tools` | Eager; optional single-thread selection | The bound run/answer, resume, and recovery tools are direct child tools. `impel claude --agent` verifies the exact managed adapter before enabling 2.1.220's bypass-permission opt-in and mode. |
 | Claude Desktop | 1.26832.0 (embedded Code 2.1.222) | Yes, agent frontmatter `tools` | Eager | Same direct-tool contract as Claude Code. |
 | Codex CLI through `impel codex` | 0.147.0 | Yes, with `features.code_mode.direct_only_tool_namespaces = ["mcp__impel_agent"]` | Eager; optional single-thread profile | Existing `@Agent` children call the fixed MCP namespace directly. `impel codex --agent` also removes the parent spawn/wait/relay thread. |
-| ChatGPT desktop Codex | 26.803.81509 (embedded Codex 0.147.0-alpha.6.6) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
+| ChatGPT desktop Codex | 26.810.41047 (embedded Codex 0.148.0-alpha.9) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
 
 ## Qualified contract
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.50",
+  "version": "0.20.52",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -105,8 +105,8 @@ export const PINNED_VENDOR_APPS = Object.freeze({
     }),
   }),
   chatgpt: Object.freeze({
-    version: "26.803.81509",
-    codexVersion: "0.147.0-alpha.6.6",
+    version: "26.810.41047",
+    codexVersion: "0.148.0-alpha.9",
     bundleName: "ChatGPT.app",
     windows: Object.freeze({
       storeProductId: "9PLM9XGG6VKS",
@@ -114,20 +114,20 @@ export const PINNED_VENDOR_APPS = Object.freeze({
       // The Microsoft Store manifest identifies this exact reviewed build.
       // Keep one Windows package version so the manifest contract and local
       // AppX validation cannot silently drift apart again.
-      packageVersion: "26.803.10989.0",
-      codexVersion: "0.147.0-alpha.6.6",
+      packageVersion: "26.810.4967.0",
+      codexVersion: "0.148.0-alpha.9",
       publisherId: "2p2nqsd0c76g0",
       executable: "app\\ChatGPT.exe",
       updateManifestUrl: "https://persistent.oaistatic.com/codex-app-prod/windows-store-update.json",
     }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.81509.zip",
-        sha256: "34c7e629678ad5d63a639ec694a5b83b85f4e1bd7c21ee2abcfefbb041095b9c",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.810.41047.zip",
+        sha256: "b8e82ade7b1f0161f1aec50c165bc97083ae5592703f8df3bff5850f57aaf287",
       }),
       x64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.803.81509.zip",
-        sha256: "c9d5a14803c3138a77be5e891a4944c04ff421645150043dd3eddd0bf34eda97",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.810.41047.zip",
+        sha256: "bec467c8ab052cfd6acb2492ba95439fbbbe0e001a138b3943f55036e0c51c4e",
       }),
     }),
   }),
@@ -882,7 +882,7 @@ export function installManagedAppFiles({
     writeDesktopTasksProfileAssets(
       paths[target].root,
       config.appUrl || RUNTIME_BRAND.controlPlane.defaultOrigin,
-      { enableEmbed: target === "chatgpt" },
+      { enableEmbed: true },
     );
     // Non-bundle targets are the background-refresh / fast-open path: configs,
     // token helper, catalog, and manifest only. Bundle swaps require the app

package/src/desktopTasks.js

@@ -286,10 +286,31 @@ const NAVIGATION_SOURCE = String.raw`(() => {
     delete window.__impelDesktopTasksSetActive;
   };
   const shellControls = controls().filter((element) => visible(element) && Boolean(label(element)));
+  const namedControl = (name) => shellControls.find((element) => [
+    element.getAttribute("aria-label"),
+    element.getAttribute("title"),
+    element.textContent,
+  ].some((value) => (value || "").replace(/\s+/g, " ").trim() === name)) || null;
+  const bounds = (element) => {
+    if (!element) return null;
+    const value = element.getBoundingClientRect();
+    return {
+      top: Math.round(value.top),
+      bottom: Math.round(value.bottom),
+      left: Math.round(value.left),
+      right: Math.round(value.right),
+    };
+  };
   return {
     anchor: lastAnchor ? label(lastAnchor) : null,
     connected: Boolean(nav?.isConnected),
     shellReady: shellControls.length >= 2,
+    placement: {
+      tasks: bounds(nav),
+      code: bounds(namedControl("Code")),
+      new: bounds(namedControl("New")),
+      customize: bounds(namedControl("Customize")),
+    },
   };
 })();`;
 
@@ -326,17 +347,24 @@ if (
   const tasksUrl = appOrigin + ${JSON.stringify(DESKTOP_TASKS_BOARD_PATH)};
   const readyMarker = ${JSON.stringify(DESKTOP_TASKS_READY_MARKER)};
   const nativeFallbackEnabled = ${JSON.stringify(enableNativeFallback)};
+  const smokeMode = process.env.IMPEL_DESKTOP_TASKS_SMOKE === "1";
+  const smokeDirectory = process.env.IMPEL_DESKTOP_TASKS_SMOKE_DIR || "";
   const boardSessionMaxAgeMs = 7 * 60 * 60 * 1000;
   const tenantId = process.env.IMPEL_DESKTOP_TASKS_TENANT;
   const nativeShowChannel = "impel-desktop-tasks:native-show";
   const runtimeStatusPath = path.join(__dirname, "runtime-status.json");
   const escapeRegex = ${escapeRegexSource};
   const parseCredential = ${parserSource};
-  const record = (stage) => {
+  const runtimeHistory = [];
+  const record = (stage, details = null) => {
     try {
+      runtimeHistory.push({ stage, details, at: new Date().toISOString() });
+      if (runtimeHistory.length > 32) runtimeHistory.shift();
       fs.writeFileSync(runtimeStatusPath, JSON.stringify({
         schemaVersion: 2,
         stage,
+        details,
+        history: runtimeHistory,
         processType: process.type || null,
         electronVersion: process.versions.electron || null,
         pid: process.pid,
@@ -344,6 +372,14 @@ if (
       }, null, 2) + "\\n", { mode: 0o600 });
     } catch {}
   };
+  const captureSmokeProof = async (name, capturer) => {
+    if (!smokeMode || !smokeDirectory || typeof capturer?.capturePage !== "function") return;
+    try {
+      fs.mkdirSync(smokeDirectory, { recursive: true });
+      const image = await capturer.capturePage();
+      fs.writeFileSync(path.join(smokeDirectory, name), image.toPNG(), { mode: 0o600 });
+    } catch { record("smoke-capture-failed", { name }); }
+  };
   const token = () => new Promise((resolve, reject) => {
     const childEnvironment = { ...process.env };
     for (const name of ["ANTHROPIC_API_KEY", "CODEX_ACCESS_TOKEN", "CODEX_API_KEY", "OPENAI_API_KEY"]) {
@@ -410,7 +446,7 @@ if (
     const stateFor = (window) => {
       let state = windows.get(window.id);
       if (!state) {
-        state = { view: null, bounds: null, visible: false, nativeNav: null, hasDomNavigation: false, loaded: false, loadedAt: 0, loading: null, bootstrapping: false };
+        state = { window, view: null, bounds: null, visible: false, nativeNav: null, hasDomNavigation: false, loaded: false, loadedAt: 0, loading: null, bootstrapping: false, smokeStarted: false };
         windows.set(window.id, state);
       }
       return state;
@@ -419,10 +455,33 @@ if (
       try { return new URL(rawUrl).origin === appOrigin; }
       catch { return false; }
     };
+    const issueHandoff = (rawUrl) => {
+      try {
+        const url = new URL(rawUrl);
+        const prefix = "/api/issues/open/";
+        const issueId = url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : "";
+        const orgIds = url.searchParams.getAll("orgId");
+        return url.origin === appOrigin
+          && !url.username
+          && !url.password
+          && !url.hash
+          && Boolean(issueId)
+          && !issueId.includes("/")
+          && issueId.length <= 128
+          && [...url.searchParams.keys()].every((key) => key === "orgId")
+          && orgIds.length === 1
+          && /^[A-Za-z0-9_.-]{1,128}$/u.test(orgIds[0]);
+      } catch { return false; }
+    };
     const external = (rawUrl) => {
       try {
         const url = new URL(rawUrl);
-        if (url.protocol === "https:" && !url.username && !url.password && url.origin !== appOrigin) {
+        if (
+          url.protocol === "https:"
+          && !url.username
+          && !url.password
+          && (url.origin !== appOrigin || issueHandoff(url.href))
+        ) {
           shell.openExternal(url.href).catch(() => record("external-link-failed"));
         }
       } catch {}
@@ -496,6 +555,35 @@ if (
         state.loaded = true;
         state.loadedAt = Date.now();
         record("board-loaded");
+        if (smokeMode && state.smokeStarted) {
+          let boardProof = null;
+          const proofDeadline = Date.now() + 15000;
+          while (!contents.isDestroyed() && Date.now() < proofDeadline) {
+            try {
+              boardProof = await contents.executeJavaScript(
+                "(() => { const ready = document.querySelector('[data-impel-desktop-board-ready=\\\"true\\\"]') !== null; const action = document.getElementById('board-action'); if (action) action.click(); return {ready,actionClicked:Boolean(action),interactive:Boolean(document.getElementById('board-result')?.textContent?.trim())}; })()",
+                true,
+              );
+            } catch {}
+            if (boardProof?.ready && boardProof?.interactive) break;
+            await new Promise((resolve) => setTimeout(resolve, 100));
+          }
+          record("board-smoke-verified", boardProof);
+          await captureSmokeProof("claude-tasks-board.png", contents);
+          let hostClick = null;
+          try {
+            hostClick = await state.window.webContents.mainFrame.executeJavaScript(
+              "(() => { const norm = value => (value || '').replace(/\\s+/g, ' ').trim(); const visible = element => { const rect = element.getBoundingClientRect(); const style = getComputedStyle(element); return rect.width > 0 && rect.height > 0 && style.display !== 'none' && style.visibility !== 'hidden'; }; const controls = [...document.querySelectorAll('button, a, [role=\\\"button\\\"], [role=\\\"link\\\"], [tabindex]')]; const hit = controls.find(element => visible(element) && [element.getAttribute('aria-label'), element.getAttribute('title'), element.textContent].some(value => norm(value) === 'New')); if (!hit) return {clicked:false}; hit.click(); return {clicked:true}; })()",
+              true,
+            );
+          } catch {}
+          const restoreDeadline = Date.now() + 3000;
+          while (state.visible && Date.now() < restoreDeadline) {
+            await new Promise((resolve) => setTimeout(resolve, 50));
+          }
+          record("navigation-smoke-restored", { hostClick, boardHidden: !state.visible });
+          await captureSmokeProof("claude-restored.png", state.window);
+        }
       } catch {
         state.loaded = false;
         state.loadedAt = 0;
@@ -571,7 +659,8 @@ if (
       view.setVisible(false);
       view.setBackgroundColor("#181818");
       view.webContents.setWindowOpenHandler(({ url }) => {
-        if (exactOrigin(url)) view.webContents.loadURL(url).catch(() => record("board-navigation-failed"));
+        if (issueHandoff(url)) external(url);
+        else if (exactOrigin(url)) view.webContents.loadURL(url).catch(() => record("board-navigation-failed"));
         else external(url);
         return { action: "deny" };
       });
@@ -724,30 +813,88 @@ if (
     const attachContents = (contents) => {
       if (!contents || contents.isDestroyed() || contents.__impelDesktopTasksAttached || internalContents.has(contents)) return;
       contents.__impelDesktopTasksAttached = true;
+      record("renderer-attached", {
+        type: typeof contents.getType === "function" ? contents.getType() : null,
+        hasMainFrame: Boolean(contents.mainFrame),
+      });
       const navigationNonce = randomBytes(32).toString("base64url");
       const contentsNavSource = navSource.replace(
         JSON.stringify(navigationNoncePlaceholder),
         JSON.stringify(navigationNonce),
       );
+      let injectionPending = false;
+      let navigationReady = false;
+      let injectionAttempts = 0;
+      let injectionTimer = null;
       const inject = () => {
-        if (internalContents.has(contents)) return;
+        if (navigationReady || injectionPending || internalContents.has(contents) || contents.isDestroyed()) return;
+        injectionAttempts += 1;
         const frame = contents.mainFrame;
-        if (!frame || typeof frame.executeJavaScript !== "function") return;
+        if (!frame || typeof frame.executeJavaScript !== "function") {
+          if (injectionAttempts < 120) scheduleInject(500);
+          return;
+        }
+        injectionPending = true;
         frame.executeJavaScript(contentsNavSource, true)
-          .then((result) => {
+          .then(async (result) => {
             const window = ownerWindow(contents);
             if (!window || window !== primaryHostWindow()) return;
             const state = stateFor(window);
+            record("navigation-probed", result || null);
+            const placementReady = Boolean(
+              result?.placement?.tasks
+              && result?.placement?.code
+              && result?.placement?.new
+              && result?.placement?.customize,
+            );
+            navigationReady = Boolean(result?.connected && (!smokeMode || placementReady));
             if (result?.anchor) {
               markDomNavigation(window);
             } else if (result?.shellReady && !state.hasDomNavigation && !hasDomNavigation && nativeFallbackEnabled) {
               ensureNativeNav(window);
             }
+            if (
+              smokeMode
+              && placementReady
+              && !state.smokeStarted
+            ) {
+              state.smokeStarted = true;
+              await captureSmokeProof("claude-navigation.png", window);
+              let clicked = false;
+              try {
+                clicked = await frame.executeJavaScript(
+                  "Boolean(document.getElementById('impel-desktop-tasks-nav')?.click?.() || true)",
+                  true,
+                );
+              } catch {}
+              record("navigation-smoke-clicked", { clicked: Boolean(clicked), placement: result.placement || null });
+            }
           })
-          .catch(() => record("navigation-injection-failed"));
+          .catch(() => record("navigation-injection-failed"))
+          .finally(() => {
+            injectionPending = false;
+            if (!navigationReady && injectionAttempts < 120 && !contents.isDestroyed()) scheduleInject(500);
+          });
       };
-      contents.on("did-finish-load", () => inject());
-      if (!contents.isLoadingMainFrame()) setTimeout(() => inject(), 0);
+      // Claude can create its renderer while this main preload is still being
+      // installed. In that race isLoadingMainFrame() is true but the one
+      // did-finish-load edge has already crossed, leaving the injection dormant
+      // forever. Probe immediately and at each renderer-ready edge; navSource
+      // is idempotent and its MutationObserver handles the later SPA mount.
+      const scheduleInject = (delay = 0) => {
+        if (navigationReady || injectionPending || injectionTimer !== null) return;
+        injectionTimer = setTimeout(() => {
+          injectionTimer = null;
+          inject();
+        }, delay);
+      };
+      contents.on("dom-ready", () => scheduleInject());
+      contents.on("did-finish-load", () => scheduleInject());
+      contents.once("destroyed", () => {
+        if (injectionTimer !== null) clearTimeout(injectionTimer);
+        injectionTimer = null;
+      });
+      scheduleInject();
       const handledNavigationEvents = new Set();
       let handledLegacyNavigation = null;
       const handleNavigation = (event, url) => {

package/src/managedProfileVersion.js

@@ -1,8 +1,9 @@
 // Fleet generation shared by managed-profile writers and upstream clients.
 // Keep this isolated from apps.js so latency-sensitive transports do not load
 // desktop bundle machinery just to identify their managed config contract.
-// v41 restores ChatGPT's embedded Tasks entry through its real sidebar only.
-// The native fallback stays disabled, and a valid authenticated board is
-// reused across hide/show cycles so it cannot obscure or repeatedly bootstrap
-// the host.
-export const CURRENT_CONFIG_VERSION = 41;
+// v42 restores Claude's embedded Tasks entry through its real sidebar, using
+// the same fallback-free, tenant-bound board lifecycle already enabled for
+// managed ChatGPT profiles.
+// v43 sends tenant-checked issue handoffs from the embedded board to the main
+// Impel browser app without expanding the capability-scoped desktop session.
+export const CURRENT_CONFIG_VERSION = 43;