impel-cli 0.20.51 → 0.20.53

package/README.md

@@ -410,7 +410,9 @@ nor a tenant-derived credential.
   Electron archives cannot be patched without invalidating vendor signatures.
   It loads the authenticated canonical Impel `/tasks` application directly in
   a sandboxed, tenant-isolated web view; a fresh profile uses the existing
-  Board default.
+  Board default. Selecting a card, list row, or fleet item opens that exact
+  tenant's ticket in the main Impel browser app; the constrained desktop
+  session remains board-only.
 - The trusted native process obtains the selected tenant credential through a
   private one-shot pipe, exchanges the PAT for a bounded HttpOnly web session,
   and then loads `/tasks` without an Authorization header. The web renderer has

package/RELEASE_NOTES.md

@@ -1,5 +1,32 @@
 # Release notes
 
+## 0.20.53 — Launch distributed managed CLIs
+
+- Adds `impel claude` and `impel codex` fallback launch through an installed
+  tenant-managed app when a standalone CLI credential is not configured.
+- Selects an explicit `--tenant`, configured tenant, or the sole installed
+  tenant; ambiguous installations fail closed with an actionable tenant list.
+- Validates the fixed application root, adjacent managed manifest, runtime
+  ownership, platform, logical tenant identity, and enrollment credential
+  presence without reading or placing the credential on the command line.
+- Keeps the existing standalone Claude and Codex launch behavior unchanged
+  whenever its separate CLI credential is configured.
+
+## 0.20.52 — Open embedded Tasks tickets safely
+
+- Makes cards, list rows, fleet items, and the card menu open their exact
+  tenant-scoped ticket in the main Impel browser app.
+- Keeps the embedded desktop session restricted to the Tasks board and sends
+  only the credential-free, membership-checked issue handoff to the system
+  browser.
+- Updates the coordinated reviewed ChatGPT/Codex pin to desktop
+  `26.810.41047`, embedded Codex `0.148.0-alpha.9`, and the currently
+  fulfillable Windows Store package `26.810.4967.0`, retaining exact artifact,
+  signature, package, publisher, executable, and runtime verification.
+- Skips the prerelease soak because this is an immediate stable repair for the
+  embedded ticket-navigation regression and Microsoft Store fulfillment drift;
+  the full release CI and Windows vendor contract remain mandatory before tag.
+
 ## 0.20.51 — Restore Claude Tasks in the sidebar
 
 - Restores one embedded Tasks row in managed Claude's existing sidebar,
@@ -85,7 +112,6 @@
   orchestration without changing vendor pins, generated profile contracts, or
   built bundle bytes; the full release CI, pinned managed-app launch smoke, and
   Windows vendor contracts remain mandatory before tagging.
-
 ## 0.20.46-beta.2 — Reload reconciled apps safely
 
 - Closes every running managed macOS app before rewriting its profile and

package/docs/native-agent-host-capability-matrix.md

@@ -1,6 +1,6 @@
 # Native-agent host capability matrix
 
-Validated on 2026-08-11 with isolated temporary homes and tenant profiles. The
+Validated on 2026-08-14 with isolated temporary homes and tenant profiles. The
 matrix is intentionally pinned: a client upgrade must be re-qualified before it
 is treated as an eager host.
 
@@ -9,7 +9,7 @@ is treated as an eager host.
 | Claude Code | 2.1.220 | Yes, agent frontmatter `tools` | Eager; optional single-thread selection | The bound run/answer, resume, and recovery tools are direct child tools. `impel claude --agent` verifies the exact managed adapter before enabling 2.1.220's bypass-permission opt-in and mode. |
 | Claude Desktop | 1.26832.0 (embedded Code 2.1.222) | Yes, agent frontmatter `tools` | Eager | Same direct-tool contract as Claude Code. |
 | Codex CLI through `impel codex` | 0.147.0 | Yes, with `features.code_mode.direct_only_tool_namespaces = ["mcp__impel_agent"]` | Eager; optional single-thread profile | Existing `@Agent` children call the fixed MCP namespace directly. `impel codex --agent` also removes the parent spawn/wait/relay thread. |
-| ChatGPT desktop Codex | 26.803.81509 (embedded Codex 0.147.0-alpha.6.6) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
+| ChatGPT desktop Codex | 26.810.41047 (embedded Codex 0.148.0-alpha.9) | Yes, with the same exact native namespace | Eager child, compatible parent | Keeps the app's supported `@Agent` parent/child route, but the child no longer needs code cells or code-mode waits. |
 
 ## Qualified contract
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.51",
+  "version": "0.20.53",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -105,8 +105,8 @@ export const PINNED_VENDOR_APPS = Object.freeze({
     }),
   }),
   chatgpt: Object.freeze({
-    version: "26.803.81509",
-    codexVersion: "0.147.0-alpha.6.6",
+    version: "26.810.41047",
+    codexVersion: "0.148.0-alpha.9",
     bundleName: "ChatGPT.app",
     windows: Object.freeze({
       storeProductId: "9PLM9XGG6VKS",
@@ -114,20 +114,20 @@ export const PINNED_VENDOR_APPS = Object.freeze({
       // The Microsoft Store manifest identifies this exact reviewed build.
       // Keep one Windows package version so the manifest contract and local
       // AppX validation cannot silently drift apart again.
-      packageVersion: "26.803.10989.0",
-      codexVersion: "0.147.0-alpha.6.6",
+      packageVersion: "26.810.4967.0",
+      codexVersion: "0.148.0-alpha.9",
       publisherId: "2p2nqsd0c76g0",
       executable: "app\\ChatGPT.exe",
       updateManifestUrl: "https://persistent.oaistatic.com/codex-app-prod/windows-store-update.json",
     }),
     downloads: Object.freeze({
       arm64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.81509.zip",
-        sha256: "34c7e629678ad5d63a639ec694a5b83b85f4e1bd7c21ee2abcfefbb041095b9c",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.810.41047.zip",
+        sha256: "b8e82ade7b1f0161f1aec50c165bc97083ae5592703f8df3bff5850f57aaf287",
       }),
       x64: Object.freeze({
-        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.803.81509.zip",
-        sha256: "c9d5a14803c3138a77be5e891a4944c04ff421645150043dd3eddd0bf34eda97",
+        url: "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-x64-26.810.41047.zip",
+        sha256: "bec467c8ab052cfd6acb2492ba95439fbbbe0e001a138b3943f55036e0c51c4e",
       }),
     }),
   }),

package/src/cli.js

@@ -47,6 +47,8 @@ Work:
   impel codex [args...]                       Launch Codex with an isolated Impel profile
   impel codex --agent <id|exact-title> ...    Run one fixed tenant agent without a parent hop
   impel codex --benchmark ...                 Tag native-agent MCP calls as benchmark traffic
+  impel claude|codex --tenant <id> ...        Select an enrolled Managed Software Center tenant
+                                              when the CLI has no separate Impel authentication
   impel remote handoff|dispatch|handback      Move or control provider-native sessions remotely
   impel remote status|viewer|proxy            Inspect, control, or connect to a remote run
   impel tenant list                           List accessible organizations

package/src/commands/converge.js

@@ -15,6 +15,21 @@ import { createTenantRecoveryReportTracker } from "./tenantRecoveryReport.js";
 
 const RETRYABLE_TENANT_DISCOVERY_ERROR = /could not reach|request timed out|fetch failed|ECONNRESET|ECONNABORTED|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|network error|socket/iu;
 
+/**
+ * Wait before the single discovery retry.
+ *
+ * An immediate retry cannot change the answer for the failure it most often
+ * sees: the OS caches a negative DNS result, so a second lookup microseconds
+ * later reads the same cached entry. This is long enough for a resolver or
+ * interface blip to clear and short enough that nobody watching decides the
+ * command has hung.
+ */
+export const TENANT_DISCOVERY_RETRY_DELAY_MS = 1_500;
+
+function sleep(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
 function confirmed(answer) {
   return /^(?:y|yes)$/iu.test(String(answer || "").trim());
 }
@@ -36,6 +51,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
     environment: process.env,
     preparePlatformClis,
     discoveryLogger: console,
+    sleep,
     ...overrides,
   };
   if (overrides.prepareWindowsClis && !overrides.preparePlatformClis) {
@@ -59,6 +75,7 @@ export async function cmdConverge(argv = [], overrides = {}) {
       return false;
     }
     io.discoveryLogger.log("Tenants: discovery request failed transiently; retrying once…");
+    await io.sleep(TENANT_DISCOVERY_RETRY_DELAY_MS);
     try {
       listing = await io.fetchTenants(config);
     } catch (retryError) {

package/src/commands/launch.js

@@ -29,6 +29,12 @@ import { IMPEL_NATIVE_BENCHMARK_ENV } from "../selfInvocation.js";
 import { resolveReviewedVendorCliBinary } from "../vendorCliBinaries.js";
 import { PINNED_VENDOR_CLI_VERSIONS } from "../vendorCliVersions.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
+import {
+  installedManagedAppCandidates,
+  parseManagedTenantArgument,
+  runManagedAppCli,
+  selectManagedAppCandidate,
+} from "../managedApps.js";
 import {
   cacheProviderReadiness,
   cachedProviderReadiness,
@@ -462,7 +468,23 @@ export async function cmdLaunch(tool, argv) {
   }
   const config = loadConfig();
   if (!config?.pat) {
-    console.error(`impel ${tool}: not authenticated. Run \`impel auth\` first.`);
+    try {
+      const parsed = parseManagedTenantArgument(nativeArgv);
+      const candidate = selectManagedAppCandidate(installedManagedAppCandidates(tool), {
+        requestedTenant: parsed.tenantId,
+        configuredTenant: config?.tenantId || null,
+      });
+      if (candidate) {
+        const exitCode = await runManagedAppCli(candidate, tool, parsed.argv);
+        if (exitCode !== 0) process.exitCode = exitCode;
+        return;
+      }
+    } catch (error) {
+      console.error(`impel ${tool}: ${redactSecretText(error?.message || error)}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.error(`impel ${tool}: not authenticated and no enrolled managed application is installed. Run \`impel auth\` or install it from Managed Software Center.`);
     process.exitCode = 1;
     return;
   }

package/src/desktopTasks.js

@@ -455,10 +455,33 @@ if (
       try { return new URL(rawUrl).origin === appOrigin; }
       catch { return false; }
     };
+    const issueHandoff = (rawUrl) => {
+      try {
+        const url = new URL(rawUrl);
+        const prefix = "/api/issues/open/";
+        const issueId = url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : "";
+        const orgIds = url.searchParams.getAll("orgId");
+        return url.origin === appOrigin
+          && !url.username
+          && !url.password
+          && !url.hash
+          && Boolean(issueId)
+          && !issueId.includes("/")
+          && issueId.length <= 128
+          && [...url.searchParams.keys()].every((key) => key === "orgId")
+          && orgIds.length === 1
+          && /^[A-Za-z0-9_.-]{1,128}$/u.test(orgIds[0]);
+      } catch { return false; }
+    };
     const external = (rawUrl) => {
       try {
         const url = new URL(rawUrl);
-        if (url.protocol === "https:" && !url.username && !url.password && url.origin !== appOrigin) {
+        if (
+          url.protocol === "https:"
+          && !url.username
+          && !url.password
+          && (url.origin !== appOrigin || issueHandoff(url.href))
+        ) {
           shell.openExternal(url.href).catch(() => record("external-link-failed"));
         }
       } catch {}
@@ -636,7 +659,8 @@ if (
       view.setVisible(false);
       view.setBackgroundColor("#181818");
       view.webContents.setWindowOpenHandler(({ url }) => {
-        if (exactOrigin(url)) view.webContents.loadURL(url).catch(() => record("board-navigation-failed"));
+        if (issueHandoff(url)) external(url);
+        else if (exactOrigin(url)) view.webContents.loadURL(url).catch(() => record("board-navigation-failed"));
         else external(url);
         return { action: "deny" };
       });

package/src/managedApps.js

@@ -0,0 +1,194 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+
+const TENANT = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/u;
+const APPLICATION_BY_TOOL = Object.freeze({ claude: "claude", codex: "chatgpt" });
+
+function regularFile(file) {
+  try {
+    const stat = fs.lstatSync(file);
+    return stat.isFile() && !stat.isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+
+function parseCandidate(manifestPath, launcher, tool, platform, home) {
+  if (!regularFile(manifestPath) || !regularFile(launcher)) return null;
+  let manifest;
+  try {
+    const raw = fs.readFileSync(manifestPath, "utf8");
+    if (Buffer.byteLength(raw, "utf8") > 512 * 1024) return null;
+    manifest = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const applicationId = APPLICATION_BY_TOOL[tool];
+  const tenantId = manifest?.tenant?.id;
+  const expectedPlatform = platform === "win32" ? "windows" : "macos";
+  if (
+    manifest?.schemaVersion !== 2
+    || manifest?.kind !== "com.useimpel.managed-application"
+    || manifest?.runtime?.owner !== "impel-apps"
+    || manifest?.runtime?.entrypoint !== "engine/main.mjs"
+    || manifest?.platform !== expectedPlatform
+    || manifest?.application?.id !== applicationId
+    || manifest?.application?.adapter !== applicationId
+    || !TENANT.test(tenantId || "")
+    || String(tenantId).includes("..")
+    || manifest?.logicalApplicationId !== `${tenantId}.${applicationId}`
+  ) return null;
+  const credential = path.join(home, ".config", "impel", "apps", "credentials", `${tenantId}.json`);
+  if (!regularFile(credential)) return null;
+  return {
+    tenantId,
+    tenantDisplayName: typeof manifest.tenant.displayName === "string" ? manifest.tenant.displayName : tenantId,
+    launcher,
+    manifestPath,
+  };
+}
+
+function macCandidates(tool, home, applicationsRoot) {
+  let entries;
+  try {
+    entries = fs.readdirSync(applicationsRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.endsWith(".app")) continue;
+    const root = path.join(applicationsRoot, entry.name, "Contents");
+    const candidate = parseCandidate(
+      path.join(root, "Resources", "app-manifest.json"),
+      path.join(root, "MacOS", "impel-apps-launcher"),
+      tool,
+      "darwin",
+      home,
+    );
+    if (candidate) candidates.push(candidate);
+  }
+  return candidates;
+}
+
+function windowsCandidates(tool, home, applicationsRoot) {
+  const candidates = [];
+  let tenants;
+  try {
+    tenants = fs.readdirSync(applicationsRoot, { withFileTypes: true });
+  } catch {
+    return candidates;
+  }
+  for (const tenant of tenants) {
+    if (!tenant.isDirectory() || !TENANT.test(tenant.name) || tenant.name.includes("..")) continue;
+    const root = path.join(applicationsRoot, tenant.name, APPLICATION_BY_TOOL[tool]);
+    const candidate = parseCandidate(
+      path.join(root, "resources", "app-manifest.json"),
+      path.join(root, "impel-apps-launcher.exe"),
+      tool,
+      "win32",
+      home,
+    );
+    if (candidate) candidates.push(candidate);
+  }
+  return candidates;
+}
+
+export function installedManagedAppCandidates(tool, {
+  platform = process.platform,
+  home = os.homedir(),
+  applicationsRoot = platform === "win32"
+    ? path.join(process.env.ProgramFiles || "C:\\Program Files", "Impel", "Apps")
+    : "/Applications",
+} = {}) {
+  if (!APPLICATION_BY_TOOL[tool]) return [];
+  const candidates = platform === "win32"
+    ? windowsCandidates(tool, home, applicationsRoot)
+    : platform === "darwin" ? macCandidates(tool, home, applicationsRoot) : [];
+  return candidates.sort((left, right) => left.tenantId.localeCompare(right.tenantId));
+}
+
+export function parseManagedTenantArgument(argv) {
+  const passthrough = [];
+  let tenantId = null;
+  let literal = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (literal) {
+      passthrough.push(argument);
+      continue;
+    }
+    if (argument === "--") {
+      literal = true;
+      passthrough.push(argument);
+      continue;
+    }
+    if (argument === "--tenant") {
+      tenantId = argv[index += 1] || null;
+      continue;
+    }
+    if (argument.startsWith("--tenant=")) {
+      tenantId = argument.slice("--tenant=".length) || null;
+      continue;
+    }
+    passthrough.push(argument);
+  }
+  if (tenantId !== null && (!TENANT.test(tenantId) || tenantId.includes(".."))) {
+    throw new Error("--tenant requires a valid managed tenant id");
+  }
+  return { tenantId, argv: passthrough };
+}
+
+export function selectManagedAppCandidate(candidates, {
+  requestedTenant = null,
+  environment = process.env,
+  configuredTenant = null,
+} = {}) {
+  const tenantId = requestedTenant || environment.IMPEL_MANAGED_TENANT || configuredTenant;
+  if (tenantId) {
+    const selected = candidates.find((candidate) => candidate.tenantId === tenantId);
+    if (!selected) throw new Error(`no installed managed application is available for tenant "${tenantId}"`);
+    return selected;
+  }
+  if (candidates.length === 1) return candidates[0];
+  if (candidates.length === 0) return null;
+  throw new Error(
+    `more than one managed tenant is installed (${candidates.map(({ tenantId: id }) => id).join(", ")}); pass --tenant <id>`,
+  );
+}
+
+function childExitCode(code, signal) {
+  if (Number.isInteger(code)) return code;
+  const signalNumber = signal ? os.constants.signals[signal] : null;
+  return Number.isInteger(signalNumber) ? 128 + signalNumber : 1;
+}
+
+export function runManagedAppCli(candidate, tool, argv, {
+  environment = process.env,
+  cwd = process.cwd(),
+  spawnProcess = spawn,
+} = {}) {
+  return new Promise((resolve) => {
+    const child = spawnProcess(candidate.launcher, ["--managed-cli", tool, "--", ...argv], {
+      cwd,
+      env: environment,
+      stdio: "inherit",
+      windowsHide: false,
+    });
+    let settled = false;
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      console.error(`impel ${tool}: could not launch the managed application: ${error.message}`);
+      resolve(127);
+    });
+    child.once("exit", (code, signal) => {
+      if (settled) return;
+      settled = true;
+      resolve(childExitCode(code, signal));
+    });
+  });
+}
+

package/src/managedProfileVersion.js

@@ -4,4 +4,6 @@
 // v42 restores Claude's embedded Tasks entry through its real sidebar, using
 // the same fallback-free, tenant-bound board lifecycle already enabled for
 // managed ChatGPT profiles.
-export const CURRENT_CONFIG_VERSION = 42;
+// v43 sends tenant-checked issue handoffs from the embedded board to the main
+// Impel browser app without expanding the capability-scoped desktop session.
+export const CURRENT_CONFIG_VERSION = 43;

package/src/tenants.js

@@ -25,6 +25,10 @@ const PRODUCT_ACCESS_VALUES = new Set([
 const PROVIDER_SCOPE = Object.freeze({ claude: PAT_SCOPE_CLAUDE, codex: PAT_SCOPE_CODEX });
 const TENANT_ID_RE = /^[A-Za-z0-9_.-]{1,128}$/u;
 const PAT_SCOPE_RE = /^[a-z0-9][a-z0-9:._-]{0,63}$/u;
+// Node surfaces a name-resolution failure through these `getaddrinfo` codes.
+// `EAI_AGAIN` is a transient resolver error; `ENOTFOUND` is a negative answer
+// the OS then caches, which is why an immediate retry re-reads the same result.
+const DNS_FAILURE_CODES = new Set(["ENOTFOUND", "EAI_AGAIN"]);
 
 export function normalizeProductAccess(value, { allowMissing = false } = {}) {
   if ((value === undefined || value === null || value === "") && allowMissing) return null;
@@ -136,7 +140,15 @@ export async function fetchTenants(config, fetchImpl = fetchHttp1) {
       signal: controller.signal,
     });
   } catch (error) {
-    const message = error?.name === "AbortError" ? "request timed out" : error?.message || error;
+    // A resolver failure is not a control-plane outage, and the raw
+    // `getaddrinfo ENOTFOUND` reads like one. Name the machine's own DNS so the
+    // remedy is looked for locally. The `could not reach` prefix is preserved
+    // because `cmdConverge` matches on it to decide the failure is retryable.
+    const message = error?.name === "AbortError"
+      ? "request timed out"
+      : DNS_FAILURE_CODES.has(error?.code)
+        ? `${error.code}; this machine could not resolve the hostname. Check its DNS resolver or VPN`
+        : error?.message || error;
     throw new Error(`could not reach ${appUrl}: ${redactSecretText(message)}`);
   } finally {
     clearTimeout(timeout);