impel-cli 0.18.8 → 0.18.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.8",
+  "version": "0.18.9",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/commands/pat.js

@@ -12,6 +12,7 @@ import {
   PAT_SCOPE_CODEX,
   PAT_SCOPE_TASKS,
 } from "../tenants.js";
+import { fetchHttp1 } from "../http1.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
 const AGENT_PAT_LABEL_PREFIX = "Agent · ";
@@ -267,7 +268,7 @@ async function requestControlPlane({ appUrl, currentPat, path, method, body, fea
   const timeout = setTimeout(() => controller.abort(), 10_000);
   let response;
   try {
-    response = await fetch(new URL(path, appUrl), {
+    response = await fetchHttp1(new URL(path, appUrl), {
       method,
       headers: {
         accept: "application/json",

package/src/http1.js

@@ -0,0 +1,52 @@
+import http from "node:http";
+import https from "node:https";
+
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+
+// Node 26's bundled Undici negotiates HTTP/2 automatically. Some ALB/Lambda
+// response paths reject that stream before an HTTP status is delivered. CLI
+// control-plane calls are small JSON exchanges, so use the stable HTTP/1.1
+// transport explicitly without changing inference or streaming traffic.
+export function fetchHttp1(input, init = {}) {
+  const url = input instanceof URL ? input : new URL(input);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return Promise.reject(new TypeError(`unsupported protocol ${url.protocol}`));
+  }
+  const transport = url.protocol === "https:" ? https : http;
+
+  return new Promise((resolve, reject) => {
+    const request = transport.request(url, {
+      method: init.method || "GET",
+      headers: { "user-agent": "impel-cli", ...init.headers },
+      signal: init.signal,
+      ...(url.protocol === "https:" ? { ALPNProtocols: ["http/1.1"] } : {}),
+    }, (response) => {
+      const chunks = [];
+      let size = 0;
+      response.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_RESPONSE_BYTES) {
+          request.destroy(new Error("control-plane response exceeded 2 MiB"));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.on("error", reject);
+      response.on("end", () => {
+        const body = Buffer.concat(chunks).toString("utf8");
+        const status = response.statusCode || 0;
+        resolve({
+          ok: status >= 200 && status < 300,
+          status,
+          statusText: response.statusMessage || "",
+          headers: response.headers,
+          async json() { return JSON.parse(body); },
+          async text() { return body; },
+        });
+      });
+    });
+    request.on("error", reject);
+    if (init.body !== undefined) request.write(init.body);
+    request.end();
+  });
+}

package/src/tenants.js

@@ -4,6 +4,7 @@ import {
   resolveDefaultAppUrl,
   saveConfig,
 } from "./config.js";
+import { fetchHttp1 } from "./http1.js";
 import { RUNTIME_BRAND } from "./runtimeBrand.js";
 
 export const TENANT_CREDENTIAL_PREFIX = RUNTIME_BRAND.auth.tenantPrefix;
@@ -93,7 +94,7 @@ export function tenantCredential(pat, tenantId) {
   return `${TENANT_CREDENTIAL_PREFIX}${encodedTenant}.${pat}`;
 }
 
-export async function fetchTenants(config, fetchImpl = fetch) {
+export async function fetchTenants(config, fetchImpl = fetchHttp1) {
   if (!config?.pat) throw new Error(`not authenticated; run \`${RUNTIME_BRAND.cli.command} setup\` (or \`${RUNTIME_BRAND.cli.command} auth\`) first`);
   const appUrl = normalizeGatewayUrl(config.appUrl || resolveDefaultAppUrl());
   const controller = new AbortController();