@josephyan/qingflow-cli 0.2.0-beta.59 → 0.2.0-beta.60

package/src/qingflow_mcp/solution/executor.py

@@ -236,8 +236,14 @@ class SolutionExecutor:
         existing_role_id = existing.get("role_id")
         if existing_role_id:
             return
-        page = self.role_tools.role_search(profile=profile, keyword=role.name, page_num=1, page_size=50).get("page") or {}
-        role_list = page.get("list") if isinstance(page, dict) else []
+        try:
+            page = self.role_tools.role_search(profile=profile, keyword=role.name, page_num=1, page_size=50).get("page") or {}
+            role_list = page.get("list") if isinstance(page, dict) else []
+        except Exception as exc:  # noqa: BLE001
+            api_error = _coerce_qingflow_error(exc)
+            if api_error is None or not _is_permission_restricted_error(api_error):
+                raise
+            role_list = []
         matched_role = next(
             (
                 item
@@ -312,7 +318,18 @@ class SolutionExecutor:
         if not isinstance(app_key, str) or not app_key:
             raise ValueError(f"missing app_key for package attach on entity '{entity.entity_id}'")
 
-        package_detail = self.package_tools.package_get(profile=profile, tag_id=tag_id, include_raw=True)
+        try:
+            package_detail = self.package_tools.package_get(profile=profile, tag_id=tag_id, include_raw=True)
+        except Exception as exc:  # noqa: BLE001
+            api_error = _coerce_qingflow_error(exc)
+            if api_error is None or not _is_permission_restricted_error(api_error):
+                raise
+            raise _required_state_read_blocked_error(
+                resource="package_attach",
+                message=f"package attach requires readable package state before sorting items for tag '{tag_id}'",
+                error=api_error,
+                details={"tag_id": tag_id, "app_key": app_key},
+            ) from exc
         package_result = package_detail.get("result") if isinstance(package_detail.get("result"), dict) else {}
         tag_items = [deepcopy(item) for item in package_result.get("tagItems", []) if isinstance(item, dict)]
         if any(_package_item_app_key(item) == app_key for item in tag_items):
@@ -675,7 +692,18 @@ class SolutionExecutor:
             if dash_key:
                 store.set_artifact("portal", "dash_key", dash_key)
         if dash_key:
-            base_payload = self.portal_tools.portal_get(profile=profile, dash_key=dash_key, being_draft=True).get("result") or {}
+            try:
+                base_payload = self.portal_tools.portal_get(profile=profile, dash_key=dash_key, being_draft=True).get("result") or {}
+            except Exception as exc:  # noqa: BLE001
+                api_error = _coerce_qingflow_error(exc)
+                if api_error is None or not _is_permission_restricted_error(api_error):
+                    raise
+                raise _required_state_read_blocked_error(
+                    resource="portal",
+                    message=f"portal update requires readable draft state for dash '{dash_key}'",
+                    error=api_error,
+                    details={"dash_key": dash_key},
+                ) from exc
             update_payload = self._resolve_portal_payload(compiled.portal_plan["update_payload"], store, base_payload=base_payload)
             self.portal_tools.portal_update(profile=profile, dash_key=dash_key, payload=update_payload)
             self._refresh_portal_artifact(profile=profile, store=store, being_draft=True, artifact_key="draft_result")
@@ -2123,6 +2151,37 @@ def _coerce_qingflow_error(error: Exception) -> QingflowApiError | None:
     )
 
 
+def _is_permission_restricted_error(error: QingflowApiError) -> bool:
+    return error.backend_code in {40002, 40027}
+
+
+def _required_state_read_blocked_error(
+    *,
+    resource: str,
+    message: str,
+    error: QingflowApiError,
+    details: dict[str, Any] | None = None,
+) -> QingflowApiError:
+    merged_details = deepcopy(details) if isinstance(details, dict) else {}
+    merged_details["state_read_blocked"] = {
+        "resource": resource,
+        "transport_error": {
+            "http_status": error.http_status,
+            "backend_code": error.backend_code,
+            "category": error.category,
+            "request_id": error.request_id,
+        },
+    }
+    return QingflowApiError(
+        category=error.category,
+        message=message,
+        backend_code=error.backend_code,
+        request_id=error.request_id,
+        http_status=error.http_status,
+        details=merged_details,
+    )
+
+
 def _portal_component_position(
     source_type: Any,
     *,

package/src/qingflow_mcp/tools/solution_tools.py

@@ -1855,10 +1855,30 @@ class SolutionTools(ToolBase):
             try:
                 result = packages.package_get(profile=profile, tag_id=package_tag_id, include_raw=False)
             except (QingflowApiError, RuntimeError) as exc:
+                error = _coerce_solution_api_error(exc)
+                if error.backend_code in {40002, 40027}:
+                    return {
+                        "status": "resolved",
+                        "matched_via": "tag_id",
+                        "tag_id": package_tag_id,
+                        "tag_name": None,
+                        "candidates": [],
+                        "metadata_unverified": True,
+                        "lookup_permission_blocked": {
+                            "scope": "package",
+                            "target": {"tag_id": package_tag_id},
+                            "transport_error": {
+                                "http_status": error.http_status,
+                                "backend_code": error.backend_code,
+                                "category": error.category,
+                                "request_id": error.request_id,
+                            },
+                        },
+                    }
                 return _builder_package_resolution_failed(
                     package_name=normalized_name,
                     package_tag_id=package_tag_id,
-                    error=_coerce_solution_api_error(exc),
+                    error=error,
                     retried=False,
                 )
             summary = result.get("result") if isinstance(result.get("result"), dict) else {}