impel-cli 0.20.26 → 0.20.28

package/RELEASE_NOTES.md

@@ -1,5 +1,15 @@
 # Release notes
 
+## 0.20.28 — Exact opaque answer resumes
+
+- Aligns generated Claude and Codex direct-answer adapters with the opaque
+  `impel.native-agent-continuation.v1` contract instead of telling them to
+  reconstruct the durable fingerprint-bearing handle.
+- Restricts the answer-only resume tool schema to the exact two-field opaque
+  continuation and regenerates existing managed agent profiles on update.
+- Keeps durable handle integrity checks strict and rejects altered metadata
+  rather than restoring the deprecated direct-answer shape.
+
 ## 0.20.26 — Native task-board navigation
 
 - Embeds Tasks in each managed desktop app's content view instead of a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.26",
+  "version": "0.20.28",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/scripts/analyze-native-codex.mjs

@@ -144,6 +144,27 @@ function rolloutSessionMetadata(events) {
   } : { threadId: null, parentThreadId: null };
 }
 
+function nativeTerminalStatus(output) {
+  if (typeof output !== "string") return null;
+  const objectStart = output.indexOf("{");
+  if (objectStart < 0) return null;
+  let value;
+  try {
+    value = JSON.parse(output.slice(objectStart));
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  if (value.schema === "impel.native-agent-answer.v1" && value.status === "succeeded") {
+    return "succeeded";
+  }
+  if (value.schema === "impel.native-agent-result.v1"
+    && ["succeeded", "failed", "cancelled", "canceled"].includes(value.status)) {
+    return value.status;
+  }
+  return null;
+}
+
 export function summarizeCodexRollouts(rollouts) {
   const toolCounts = {};
   const parentToolCounts = {};
@@ -156,6 +177,10 @@ export function summarizeCodexRollouts(rollouts) {
   let outputTokens = 0;
   let mcpDurationMs = 0;
   let mcpCompletedCalls = 0;
+  let terminalResults = 0;
+  let successfulTerminalResults = 0;
+  let parentSuccessfulTerminalResults = 0;
+  let childSuccessfulTerminalResults = 0;
 
   for (const events of rollouts) {
     eventCount += events.length;
@@ -194,6 +219,17 @@ export function summarizeCodexRollouts(rollouts) {
           mcpStarts.delete(payload.call_id);
         }
       }
+      if (event.type === "response_item" && payload.type === "function_call_output") {
+        const terminalStatus = nativeTerminalStatus(payload.output);
+        if (terminalStatus) {
+          terminalResults += 1;
+          if (terminalStatus === "succeeded") {
+            successfulTerminalResults += 1;
+            if (metadata.parentThreadId) childSuccessfulTerminalResults += 1;
+            else parentSuccessfulTerminalResults += 1;
+          }
+        }
+      }
       if (event.type === "event_msg" && payload.type === "token_count") {
         const usage = payload.info?.total_token_usage;
         if (usage && typeof usage === "object") latestUsage = usage;
@@ -219,6 +255,10 @@ export function summarizeCodexRollouts(rollouts) {
     outputTokens,
     mcpDurationMs,
     mcpCompletedCalls,
+    terminalResults,
+    successfulTerminalResults,
+    parentSuccessfulTerminalResults,
+    childSuccessfulTerminalResults,
   };
 }
 
@@ -281,6 +321,10 @@ export function summarizeRawAttempt({ stdoutText, telemetryText = "", rolloutTex
       outputTokens: rollout.outputTokens,
         mcpDurationMs: rollout.mcpDurationMs,
         mcpCompletedCalls: rollout.mcpCompletedCalls,
+        terminalResults: rollout.terminalResults,
+        successfulTerminalResults: rollout.successfulTerminalResults,
+        parentSuccessfulTerminalResults: rollout.parentSuccessfulTerminalResults,
+        childSuccessfulTerminalResults: rollout.childSuccessfulTerminalResults,
       } : {}),
       parentToolCounts: rollout.parentToolCounts,
       childToolCounts: rollout.childToolCounts,
@@ -336,6 +380,9 @@ function directGate(report) {
     structure: report.structure.maximumThreadCount <= 1
       && report.structure.totalCodeCells === 0
       && report.structure.totalCodeWaits === 0
+      && report.structure.successfulTerminalResults === report.successfulSamples
+      && report.structure.parentSuccessfulTerminalResults === report.successfulSamples
+      && report.structure.childSuccessfulTerminalResults === 0
       && ["spawn_agent", "wait_agent", "send_message", "exec", "wait", "tool_search", "ALL_TOOLS"]
         .every((tool) => !report.structure.allToolCounts[tool])
       && (report.structure.toolCounts.answer_native_agent || 0) === report.successfulSamples
@@ -350,6 +397,8 @@ function compatibleGate(report) {
       && report.timings.durationMs.p50 <= (report.sloClass === "cibi" ? 55_000 : 100_000),
     childStructure: report.structure.totalCodeCells === 0
       && report.structure.totalCodeWaits === 0
+      && report.structure.successfulTerminalResults === report.successfulSamples
+      && report.structure.childSuccessfulTerminalResults === report.successfulSamples
       && ["exec", "wait", "send_message", "tool_search", "ALL_TOOLS"]
         .every((tool) => !report.structure.childToolCounts[tool]),
   };
@@ -405,6 +454,19 @@ export function analyzeAggregates(aggregates) {
         allToolCounts: mergedCounts(attempts, "toolCounts"),
         parentToolCounts: mergedCounts(successful, "parentToolCounts"),
         childToolCounts: mergedCounts(successful, "childToolCounts"),
+        terminalResults: successful.reduce((total, attempt) => total + (attempt.terminalResults || 0), 0),
+        successfulTerminalResults: successful.reduce(
+          (total, attempt) => total + (attempt.successfulTerminalResults || 0),
+          0,
+        ),
+        parentSuccessfulTerminalResults: successful.reduce(
+          (total, attempt) => total + (attempt.parentSuccessfulTerminalResults || 0),
+          0,
+        ),
+        childSuccessfulTerminalResults: successful.reduce(
+          (total, attempt) => total + (attempt.childSuccessfulTerminalResults || 0),
+          0,
+        ),
         maximumThreadCount: successful.reduce((maximum, attempt) => Math.max(maximum, attempt.threadCount || 0), 0),
         totalCodeCells: successful.reduce((total, attempt) => total + (attempt.codeCells || 0), 0),
         totalCodeWaits: successful.reduce((total, attempt) => total + (attempt.codeWaits || 0), 0),

package/scripts/profile-native-codex.mjs

@@ -390,6 +390,7 @@ export function safeAttemptRecord({ options, index, processResult, summary, json
     && jsonValid
     && codex.turnCompleted === true
     && (codex.agentMessages || 0) >= 1
+    && (codex.successfulTerminalResults || 0) === 1
     && (telemetry.localFailures || 0) === 0
     && startCalls === 1;
   return {
@@ -420,6 +421,10 @@ export function safeAttemptRecord({ options, index, processResult, summary, json
     childToolCounts: codex.childToolCounts || {},
     codeCells: codex.codeCells || 0,
     codeWaits: codex.codeWaits || 0,
+    terminalResults: codex.terminalResults || 0,
+    successfulTerminalResults: codex.successfulTerminalResults || 0,
+    parentSuccessfulTerminalResults: codex.parentSuccessfulTerminalResults || 0,
+    childSuccessfulTerminalResults: codex.childSuccessfulTerminalResults || 0,
     inputTokens: codex.inputTokens || 0,
     cachedInputTokens: codex.cachedInputTokens || 0,
     outputTokens: codex.outputTokens || 0,

package/src/agents.js

@@ -16,6 +16,8 @@ import {
   redactSecretText,
 } from "./config.js";
 import {
+  CODEX_NATIVE_AGENT_ATTACHMENT_WINDOW_MS,
+  IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV,
   IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES,
   IMPEL_NATIVE_AGENT_MCP_TARGET,
   impelNativeAgentMcpInvocation,
@@ -51,8 +53,9 @@ export const NATIVE_AGENT_ANSWER_TOOL = "answer_native_agent";
 export const NATIVE_AGENT_RUN_TOOL = "run_native_agent";
 export const NATIVE_AGENT_RESUME_TOOL = "resume_native_agent_run";
 export const NATIVE_AGENT_RECOVER_TOOL = "recover_native_agent_runs";
+export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const MANAGED_AGENT_MCP_SERVER = "impel_agent";
-export const MANAGED_AGENT_MANIFEST_VERSION = 16;
+export const MANAGED_AGENT_MANIFEST_VERSION = 18;
 
 // The host model only selects the fixed MCP tool and faithfully returns its
 // result. Luna preserves deterministic direct-only code-mode routing while the
@@ -618,7 +621,7 @@ function claudeAdapterInstructions(tenantId, agent) {
       `Confirm that the request fits the synchronized capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)}.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an ${JSON.stringify("impel.native-agent-run.v1")} continuation handle, call ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} with exactly that handle until terminal. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
       completionGuidance,
     ].join(" ");
   }
@@ -668,7 +671,7 @@ function codexAdapterInstructions(tenantId, agent) {
       `Confirm that the assigned request fits the cataloged capabilities ${JSON.stringify(agent.capabilities)} and none of the exclusions ${JSON.stringify(agent.exclusions)} before answering.${contextRequirement}`,
       sideEffectInstruction,
       `Call ${nativeToolName(NATIVE_AGENT_ANSWER_TOOL)} exactly once with question set to the complete assigned task, optional context set to one string containing all supplied context, and contextKeys naming the fields present in that string.`,
-      `If the bounded answer returns an ${JSON.stringify("impel.native-agent-run.v1")} continuation handle, call ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} with exactly that handle until terminal. Never call answer_native_agent again for this request.`,
+      `If the bounded answer returns an object whose schema is exactly ${JSON.stringify(NATIVE_AGENT_CONTINUATION_SCHEMA)}, pass that complete object unchanged as the handle to ${nativeToolName(NATIVE_AGENT_RESUME_TOOL)} until terminal. Never change its schema or add handle metadata. Never call answer_native_agent again for this request.`,
       completionGuidance,
     ].join("\n\n");
   }
@@ -748,9 +751,11 @@ function renderClaudeAgent({ tenantId, agent, name, invocation, recoveryOnly = f
 
 function codexInvocationEnvironment(invocation, { durableProfile = false } = {}) {
   const entries = Object.entries(invocation.env || {});
-  if (!durableProfile) return entries;
   const transient = new Set(IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES);
-  return entries.filter(([key]) => !transient.has(key));
+  return [
+    ...(durableProfile ? entries.filter(([key]) => !transient.has(key)) : entries),
+    [IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV, String(CODEX_NATIVE_AGENT_ATTACHMENT_WINDOW_MS)],
+  ];
 }
 
 function renderCodexConfiguration({
@@ -800,6 +805,7 @@ function renderCodexConfiguration({
     `[mcp_servers.${MANAGED_AGENT_MCP_SERVER}]`,
     `command = ${JSON.stringify(invocation.command)}`,
     `args = [${invocation.args.map((argument) => JSON.stringify(argument)).join(", ")}]`,
+    "tool_timeout_sec = 120",
     ...(eager
       ? [`enabled_tools = [${toolNames.map((tool) => JSON.stringify(tool)).join(", ")}]`]
       : []),

package/src/nativeAgentTransport.js

@@ -10,6 +10,7 @@ import {
 } from "./config.js";
 import {
   NATIVE_AGENT_ANSWER_TOOL,
+  NATIVE_AGENT_CONTINUATION_SCHEMA,
   NATIVE_AGENT_GET_TOOL,
   NATIVE_AGENT_READ_TOOL,
   NATIVE_AGENT_RECOVER_TOOL,
@@ -21,17 +22,20 @@ import {
   normalizeNativeAgentCatalog,
 } from "./agents.js";
 import { extractAnswerFinalText } from "./directAnswer.js";
+import {
+  IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV,
+} from "./selfInvocation.js";
 import { normalizeTenantId } from "./tenants.js";
 import { renameWithWindowsRetry } from "./windowsFs.js";
 
 export {
   NATIVE_AGENT_ANSWER_TOOL,
+  NATIVE_AGENT_CONTINUATION_SCHEMA,
   NATIVE_AGENT_RECOVER_TOOL,
   NATIVE_AGENT_RESUME_TOOL,
   NATIVE_AGENT_RUN_TOOL,
 };
 export const NATIVE_AGENT_HANDLE_SCHEMA = "impel.native-agent-run.v1";
-export const NATIVE_AGENT_CONTINUATION_SCHEMA = "impel.native-agent-continuation.v1";
 export const NATIVE_AGENT_RESULT_SCHEMA = "impel.native-agent-result.v1";
 export const NATIVE_AGENT_RECOVERY_SCHEMA = "impel.native-agent-recovery.v1";
 
@@ -62,6 +66,19 @@ const CTOS_START_TIMEOUT_MESSAGE = `MCP tool call failed for ${NATIVE_AGENT_STAR
 const MCP_TOOL_RESULT_ERROR = Symbol("native-agent MCP tool result error");
 const TERMINAL_STATUSES = new Set(["succeeded", "failed", "cancelled", "canceled"]);
 
+export function nativeAgentAttachmentWindowMs(environment = process.env) {
+  const configured = environment?.[IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV];
+  if (configured === undefined) return DEFAULT_ATTACHMENT_WINDOW_MS;
+  if (!/^\d{1,6}$/u.test(configured)) {
+    throw new Error(`${IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV} must be an integer from 1000 through 300000`);
+  }
+  const parsed = Number(configured);
+  if (!Number.isSafeInteger(parsed) || parsed < 1_000 || parsed > 300_000) {
+    throw new Error(`${IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV} must be an integer from 1000 through 300000`);
+  }
+  return parsed;
+}
+
 function stableValue(value) {
   if (Array.isArray(value)) return value.map(stableValue);
   if (!value || typeof value !== "object") return value;
@@ -773,7 +790,7 @@ export class NativeAgentCompositeTransport {
     gatewayUrl,
     credential,
     runsRoot = path.join(CONFIG_DIR, "native-agent-runs"),
-    attachmentWindowMs = DEFAULT_ATTACHMENT_WINDOW_MS,
+    attachmentWindowMs = nativeAgentAttachmentWindowMs(),
     maxPolls = DEFAULT_MAX_POLLS,
     now = Date.now,
     randomUUID = crypto.randomUUID,
@@ -2204,11 +2221,8 @@ const ANSWER_RESUME_SCHEMA = {
   additionalProperties: false,
   required: ["schema", "invocationId"],
   properties: {
-    ...HANDLE_SCHEMA.properties,
-    schema: {
-      type: "string",
-      enum: [NATIVE_AGENT_CONTINUATION_SCHEMA, NATIVE_AGENT_HANDLE_SCHEMA],
-    },
+    schema: { type: "string", const: NATIVE_AGENT_CONTINUATION_SCHEMA },
+    invocationId: { type: "string" },
   },
 };
 

package/src/selfInvocation.js

@@ -72,6 +72,8 @@ export const IMPEL_NATIVE_AGENT_TELEMETRY_ENV_NAMES = [
   "IMPEL_NATIVE_HOST",
   "IMPEL_NATIVE_HOST_BUILD",
 ];
+export const IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_ENV = "IMPEL_NATIVE_AGENT_ATTACHMENT_WINDOW_MS";
+export const CODEX_NATIVE_AGENT_ATTACHMENT_WINDOW_MS = 100_000;
 
 function managedMcpEnvironment(environment = process.env) {
   const telemetry = Object.fromEntries(