impel-cli 0.20.30 → 0.20.32

package/RELEASE_NOTES.md

@@ -1,5 +1,25 @@
 # Release notes
 
+## 0.20.32 — Recover transient managed access misses
+
+- Retries one exact MCP request when the gateway reports its specific managed
+  virtual-key cache-miss rejection, covering catalog binding and direct-answer
+  calls before they become visible to the host model.
+- Reuses the same native-answer idempotency key and waits only 250ms, so the
+  recovery cannot duplicate an Eve run or add latency to healthy requests.
+- Keeps every nearby authentication and governance rejection definitive and
+  bounds a persistent managed-key miss to exactly two attempts.
+
+## 0.20.31 — Complete embedded Tasks controls
+
+- Allows the guarded `delete_task` operation through the tenant desktop bridge
+  so the MCP App can complete the full task CRUD lifecycle.
+- Keeps the embedded board below the macOS title-bar drag region so Board,
+  List, scope, refresh, create, and external-link controls receive pointer
+  input normally.
+- Rebuilds managed Claude and ChatGPT bundles onto the corrected Tasks host
+  contract while preserving tenant profiles and app state.
+
 ## 0.20.30 — Stable Claude and Codex upgrades
 
 - Updates the reviewed native CLI pins to Claude Code 2.1.220 and Codex

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.30",
+  "version": "0.20.32",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -299,7 +299,7 @@ export const CURRENT_CONFIG_VERSION = 32;
 // — which is what made every `impel update` re-trigger macOS permission
 // prompts. Bump this ONLY when a code change alters the bytes of a built
 // bundle; leave it alone for changes that don't touch bundle contents.
-export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-08.3";
+export const BUNDLE_BUILD_FINGERPRINT = "bundle-2026-08-08.4";
 
 /** Parse the tenant's install manifest, or null when absent/corrupt. */
 export function readTenantManifest(homeDir = os.homedir(), tenantId = null) {

package/src/desktopTasks.js

@@ -509,12 +509,16 @@ if (
     const parseBounds = (url, window) => {
       const parsed = new URL(url);
       const content = window.getContentBounds();
+      const interactiveTop = process.platform === "darwin" ? 48 : 0;
       const number = (name, fallback) => {
         const value = Number.parseInt(parsed.searchParams.get(name) || "", 10);
         return Number.isFinite(value) ? value : fallback;
       };
       const x = Math.max(0, Math.min(content.width - 240, number("x", 0)));
-      const y = Math.max(0, Math.min(content.height - 240, number("y", 0)));
+      const y = Math.max(
+        interactiveTop,
+        Math.min(content.height - 240, number("y", 0)),
+      );
       return {
         x,
         y,
@@ -606,7 +610,13 @@ if (
     const nativeBoardBounds = (window) => {
       const content = window.getContentBounds();
       const x = Math.min(296, Math.max(0, content.width - 240));
-      return { x, y: 0, width: Math.max(240, content.width - x), height: Math.max(240, content.height) };
+      const interactiveTop = process.platform === "darwin" ? 48 : 0;
+      return {
+        x,
+        y: interactiveTop,
+        width: Math.max(240, content.width - x),
+        height: Math.max(240, content.height - interactiveTop),
+      };
     };
 
     const layoutNativeNav = (window) => {
@@ -825,7 +835,15 @@ if (
       }
       if (request?.method === "tools/call") {
         const name = request?.params?.name;
-        const allowed = new Set(["show_tasks", "list_tasks", "get_task", "list_members", "create_task", "update_task"]);
+        const allowed = new Set([
+          "show_tasks",
+          "list_tasks",
+          "get_task",
+          "list_members",
+          "create_task",
+          "update_task",
+          "delete_task",
+        ]);
         if (!allowed.has(name)) throw new Error("Unsupported Tasks tool.");
         const args = request?.params?.arguments;
         if (args != null && (typeof args !== "object" || Array.isArray(args))) {

package/src/nativeAgentTransport.js

@@ -63,6 +63,8 @@ const STATE_COMMIT_LEASE_MARGIN_MS = 5_000;
 const CIBI_START_IN_PROGRESS_CODE = "eve_run_drain_start_in_progress";
 const CIBI_START_IN_PROGRESS_MESSAGE = "The durable Eve drain workflow is still being enqueued; retry this idempotent start.";
 const CTOS_START_TIMEOUT_MESSAGE = `MCP tool call failed for ${NATIVE_AGENT_START_TOOL}: The operation was aborted due to timeout: mcp tool call failed`;
+const MANAGED_VIRTUAL_KEY_MISS_MESSAGE = "virtual key not found. The provided virtual key does not exist or has been revoked.";
+const MANAGED_VIRTUAL_KEY_MISS_RETRY_DELAY_MS = 250;
 const MCP_TOOL_RESULT_ERROR = Symbol("native-agent MCP tool result error");
 const TERMINAL_STATUSES = new Set(["succeeded", "failed", "cancelled", "canceled"]);
 
@@ -634,6 +636,12 @@ function toolPayload(message) {
   return result;
 }
 
+function retryableManagedVirtualKeyMiss(error) {
+  return error instanceof NativeAgentUpstreamError
+    && (error[MCP_TOOL_RESULT_ERROR] === true || error.code === -32000)
+    && error.message.includes(MANAGED_VIRTUAL_KEY_MISS_MESSAGE);
+}
+
 export class NativeAgentUpstreamSession {
   constructor({
     gatewayUrl,
@@ -756,28 +764,38 @@ export class NativeAgentUpstreamSession {
   }
 
   async call(name, args, { signal } = {}) {
-    const id = this.nextId++;
-    try {
-      const messages = await this.post({
-        jsonrpc: "2.0",
-        id,
-        method: "tools/call",
-        params: { name, arguments: args },
-      }, { signal });
-      return toolPayload(messages.find((message) => message?.id === id));
-    } catch (error) {
-      if ((name === NATIVE_AGENT_START_TOOL || name === NATIVE_AGENT_UPSTREAM_ANSWER_TOOL)
-        && error instanceof NativeAgentUpstreamError
-        && (error.incompleteResponse
-          || error.code === CIBI_START_IN_PROGRESS_CODE
-          || error.data?.code === CIBI_START_IN_PROGRESS_CODE
-          || error.message === CIBI_START_IN_PROGRESS_MESSAGE
-          || (error[MCP_TOOL_RESULT_ERROR] === true
-            && error.message === CTOS_START_TIMEOUT_MESSAGE))) {
-        error.ambiguous = true;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const id = this.nextId++;
+      try {
+        const messages = await this.post({
+          jsonrpc: "2.0",
+          id,
+          method: "tools/call",
+          params: { name, arguments: args },
+        }, { signal });
+        return toolPayload(messages.find((message) => message?.id === id));
+      } catch (error) {
+        if (attempt === 0 && retryableManagedVirtualKeyMiss(error)) {
+          // This gateway-authored miss happens before a native run can exist.
+          // One same-session replay repairs transient per-task governance-cache
+          // drift while leaving every nearby auth/policy rejection definitive.
+          await abortableDelay(MANAGED_VIRTUAL_KEY_MISS_RETRY_DELAY_MS, signal);
+          continue;
+        }
+        if ((name === NATIVE_AGENT_START_TOOL || name === NATIVE_AGENT_UPSTREAM_ANSWER_TOOL)
+          && error instanceof NativeAgentUpstreamError
+          && (error.incompleteResponse
+            || error.code === CIBI_START_IN_PROGRESS_CODE
+            || error.data?.code === CIBI_START_IN_PROGRESS_CODE
+            || error.message === CIBI_START_IN_PROGRESS_MESSAGE
+            || (error[MCP_TOOL_RESULT_ERROR] === true
+              && error.message === CTOS_START_TIMEOUT_MESSAGE))) {
+          error.ambiguous = true;
+        }
+        throw error;
       }
-      throw error;
     }
+    throw new Error("native-agent MCP retry loop exhausted");
   }
 }