impel-cli 0.20.51 → 0.20.52

package/README.md

@@ -410,7 +410,9 @@ nor a tenant-derived credential.
   Electron archives cannot be patched without invalidating vendor signatures.
   It loads the authenticated canonical Impel `/tasks` application directly in
   a sandboxed, tenant-isolated web view; a fresh profile uses the existing
-  Board default.
+  Board default. Selecting a card, list row, or fleet item opens that exact
+  tenant's ticket in the main Impel browser app; the constrained desktop
+  session remains board-only.
 - The trusted native process obtains the selected tenant credential through a
   private one-shot pipe, exchanges the PAT for a bounded HttpOnly web session,
   and then loads `/tasks` without an Authorization header. The web renderer has

package/RELEASE_NOTES.md

@@ -1,5 +1,20 @@
 # Release notes
 
+## 0.20.52 — Open embedded Tasks tickets safely
+
+- Makes cards, list rows, fleet items, and the card menu open their exact
+  tenant-scoped ticket in the main Impel browser app.
+- Keeps the embedded desktop session restricted to the Tasks board and sends
+  only the credential-free, membership-checked issue handoff to the system
+  browser.
+- Updates the coordinated reviewed ChatGPT/Codex pin to desktop
+  `26.810.41047`, embedded Codex `0.148.0-alpha.9`, and the currently
+  fulfillable Windows Store package `26.810.4967.0`, retaining exact artifact,
+  signature, package, publisher, executable, and runtime verification.
+- Skips the prerelease soak because this is an immediate stable repair for the
+  embedded ticket-navigation regression and Microsoft Store fulfillment drift;
+  the full release CI and Windows vendor contract remain mandatory before tag.
+
 ## 0.20.51 — Restore Claude Tasks in the sidebar
 
 - Restores one embedded Tasks row in managed Claude's existing sidebar,
@@ -85,7 +100,6 @@
   orchestration without changing vendor pins, generated profile contracts, or
   built bundle bytes; the full release CI, pinned managed-app launch smoke, and
   Windows vendor contracts remain mandatory before tagging.
-
 ## 0.20.46-beta.2 — Reload reconciled apps safely
 
 - Closes every running managed macOS app before rewriting its profile and

package/docs/native-agent-host-capability-matrix.md

@@ -1,6 +1,6 @@
 # Native-agent host capability matrix
 
-Validated on 2026-08-11 with isolated temporary homes and tenant profiles. The
+Validated on 2026-08-14 with isolated temporary homes and tenant profiles. The
 matrix is intentionally pinned: a client upgrade must be re-qualified before it
 is treated as an eager host.
 
@@ -9,7 +9,7 @@ is treated as an eager host.
 | Claude Code | 2.1.220 | Yes, agent frontmatter `tools` | Eager; optional single-thread selection | The bound run/answer, resume, and recovery tools are direct child tools. `impel claude --agent` verifies the exact managed adapter before enabling 2.1.220's bypass-permission opt-in and mode. |
 | Claude Desktop | 1.26832.0 (embedded Code 2.1.222) | Yes, agent frontmatter `tools` | Eager | Same direct-tool contract as Claude Code. |
 | Codex CLI through `impel codex` | 0.147.0 | Yes, with `features.code_mode.direct_only_tool_namespaces = ["mcp__impel_agent"]` | Eager; optional single-thread profile | Existing `@Agent` children call the fixed MCP namespace directly. `impel codex --agent` also removes the parent spawn/wait/relay thread. |
-| ChatGPT desktop Codex | 26.803.81509 (embedded Codex 0.147.0-alpha.6.6) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
+| ChatGPT desktop Codex | 26.810.41047 (embedded Codex 0.148.0-alpha.9) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
 
 ## Qualified contract
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.51",
+  "version": "0.20.52",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -105,8 +105,8 @@ export const PINNED_VENDOR_APPS = Object.freeze({
     }),
   }),
   chatgpt: Object.freeze({
-    version: "26.803.81509",
-    codexVersion: "0.147.0-alpha.6.6",
+    version: "26.810.41047",
+    codexVersion: "0.148.0-alpha.9",
     bundleName: "ChatGPT.app",
     windows: Object.freeze({
       storeProductId: "9PLM9XGG6VKS",
@@ -114,20 +114,20 @@ export const PINNED_VENDOR_APPS = Object.freeze({
       // The Microsoft Store manifest identifies this exact reviewed build.
       // Keep one Windows package version so the manifest contract and local
       // AppX validation cannot silently drift apart again.
-      packageVersion: "26.803.10989.0",
-      codexVersion: "0.147.0-alpha.6.6",
+      packageVersion: "26.810.4967.0",
+      codexVersion: "0.148.0-alpha.9",
       publisherId: "2p2nqsd0c76g0",
       executable: "app\\ChatGPT.exe",
       updateManifestUrl: "https://persistent.oaistatic.com/codex-app-prod/windows-store-update.json",
     }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.81509.zip",
-        sha256: "34c7e629678ad5d63a639ec694a5b83b85f4e1bd7c21ee2abcfefbb041095b9c",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.810.41047.zip",
+        sha256: "b8e82ade7b1f0161f1aec50c165bc97083ae5592703f8df3bff5850f57aaf287",
       }),
       x64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.803.81509.zip",
-        sha256: "c9d5a14803c3138a77be5e891a4944c04ff421645150043dd3eddd0bf34eda97",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.810.41047.zip",
+        sha256: "bec467c8ab052cfd6acb2492ba95439fbbbe0e001a138b3943f55036e0c51c4e",
       }),
     }),
   }),

package/src/desktopTasks.js

@@ -455,10 +455,33 @@ if (
       try { return new URL(rawUrl).origin === appOrigin; }
       catch { return false; }
     };
+    const issueHandoff = (rawUrl) => {
+      try {
+        const url = new URL(rawUrl);
+        const prefix = "/api/issues/open/";
+        const issueId = url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : "";
+        const orgIds = url.searchParams.getAll("orgId");
+        return url.origin === appOrigin
+          && !url.username
+          && !url.password
+          && !url.hash
+          && Boolean(issueId)
+          && !issueId.includes("/")
+          && issueId.length <= 128
+          && [...url.searchParams.keys()].every((key) => key === "orgId")
+          && orgIds.length === 1
+          && /^[A-Za-z0-9_.-]{1,128}$/u.test(orgIds[0]);
+      } catch { return false; }
+    };
     const external = (rawUrl) => {
       try {
         const url = new URL(rawUrl);
-        if (url.protocol === "https:" && !url.username && !url.password && url.origin !== appOrigin) {
+        if (
+          url.protocol === "https:"
+          && !url.username
+          && !url.password
+          && (url.origin !== appOrigin || issueHandoff(url.href))
+        ) {
           shell.openExternal(url.href).catch(() => record("external-link-failed"));
         }
       } catch {}
@@ -636,7 +659,8 @@ if (
       view.setVisible(false);
       view.setBackgroundColor("#181818");
       view.webContents.setWindowOpenHandler(({ url }) => {
-        if (exactOrigin(url)) view.webContents.loadURL(url).catch(() => record("board-navigation-failed"));
+        if (issueHandoff(url)) external(url);
+        else if (exactOrigin(url)) view.webContents.loadURL(url).catch(() => record("board-navigation-failed"));
         else external(url);
         return { action: "deny" };
       });

package/src/managedProfileVersion.js

@@ -4,4 +4,6 @@
 // v42 restores Claude's embedded Tasks entry through its real sidebar, using
 // the same fallback-free, tenant-bound board lifecycle already enabled for
 // managed ChatGPT profiles.
-export const CURRENT_CONFIG_VERSION = 42;
+// v43 sends tenant-checked issue handoffs from the embedded board to the main
+// Impel browser app without expanding the capability-scoped desktop session.
+export const CURRENT_CONFIG_VERSION = 43;