impel-cli 0.20.31 → 0.20.32

package/RELEASE_NOTES.md

@@ -1,5 +1,15 @@
 # Release notes
 
+## 0.20.32 — Recover transient managed access misses
+
+- Retries one exact MCP request when the gateway reports its specific managed
+  virtual-key cache-miss rejection, covering catalog binding and direct-answer
+  calls before they become visible to the host model.
+- Reuses the same native-answer idempotency key and waits only 250ms, so the
+  recovery cannot duplicate an Eve run or add latency to healthy requests.
+- Keeps every nearby authentication and governance rejection definitive and
+  bounds a persistent managed-key miss to exactly two attempts.
+
 ## 0.20.31 — Complete embedded Tasks controls
 
 - Allows the guarded `delete_task` operation through the tenant desktop bridge

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.31",
+  "version": "0.20.32",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/nativeAgentTransport.js

@@ -63,6 +63,8 @@ const STATE_COMMIT_LEASE_MARGIN_MS = 5_000;
 const CIBI_START_IN_PROGRESS_CODE = "eve_run_drain_start_in_progress";
 const CIBI_START_IN_PROGRESS_MESSAGE = "The durable Eve drain workflow is still being enqueued; retry this idempotent start.";
 const CTOS_START_TIMEOUT_MESSAGE = `MCP tool call failed for ${NATIVE_AGENT_START_TOOL}: The operation was aborted due to timeout: mcp tool call failed`;
+const MANAGED_VIRTUAL_KEY_MISS_MESSAGE = "virtual key not found. The provided virtual key does not exist or has been revoked.";
+const MANAGED_VIRTUAL_KEY_MISS_RETRY_DELAY_MS = 250;
 const MCP_TOOL_RESULT_ERROR = Symbol("native-agent MCP tool result error");
 const TERMINAL_STATUSES = new Set(["succeeded", "failed", "cancelled", "canceled"]);
 
@@ -634,6 +636,12 @@ function toolPayload(message) {
   return result;
 }
 
+function retryableManagedVirtualKeyMiss(error) {
+  return error instanceof NativeAgentUpstreamError
+    && (error[MCP_TOOL_RESULT_ERROR] === true || error.code === -32000)
+    && error.message.includes(MANAGED_VIRTUAL_KEY_MISS_MESSAGE);
+}
+
 export class NativeAgentUpstreamSession {
   constructor({
     gatewayUrl,
@@ -756,28 +764,38 @@ export class NativeAgentUpstreamSession {
   }
 
   async call(name, args, { signal } = {}) {
-    const id = this.nextId++;
-    try {
-      const messages = await this.post({
-        jsonrpc: "2.0",
-        id,
-        method: "tools/call",
-        params: { name, arguments: args },
-      }, { signal });
-      return toolPayload(messages.find((message) => message?.id === id));
-    } catch (error) {
-      if ((name === NATIVE_AGENT_START_TOOL || name === NATIVE_AGENT_UPSTREAM_ANSWER_TOOL)
-        && error instanceof NativeAgentUpstreamError
-        && (error.incompleteResponse
-          || error.code === CIBI_START_IN_PROGRESS_CODE
-          || error.data?.code === CIBI_START_IN_PROGRESS_CODE
-          || error.message === CIBI_START_IN_PROGRESS_MESSAGE
-          || (error[MCP_TOOL_RESULT_ERROR] === true
-            && error.message === CTOS_START_TIMEOUT_MESSAGE))) {
-        error.ambiguous = true;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const id = this.nextId++;
+      try {
+        const messages = await this.post({
+          jsonrpc: "2.0",
+          id,
+          method: "tools/call",
+          params: { name, arguments: args },
+        }, { signal });
+        return toolPayload(messages.find((message) => message?.id === id));
+      } catch (error) {
+        if (attempt === 0 && retryableManagedVirtualKeyMiss(error)) {
+          // This gateway-authored miss happens before a native run can exist.
+          // One same-session replay repairs transient per-task governance-cache
+          // drift while leaving every nearby auth/policy rejection definitive.
+          await abortableDelay(MANAGED_VIRTUAL_KEY_MISS_RETRY_DELAY_MS, signal);
+          continue;
+        }
+        if ((name === NATIVE_AGENT_START_TOOL || name === NATIVE_AGENT_UPSTREAM_ANSWER_TOOL)
+          && error instanceof NativeAgentUpstreamError
+          && (error.incompleteResponse
+            || error.code === CIBI_START_IN_PROGRESS_CODE
+            || error.data?.code === CIBI_START_IN_PROGRESS_CODE
+            || error.message === CIBI_START_IN_PROGRESS_MESSAGE
+            || (error[MCP_TOOL_RESULT_ERROR] === true
+              && error.message === CTOS_START_TIMEOUT_MESSAGE))) {
+          error.ambiguous = true;
+        }
+        throw error;
       }
-      throw error;
     }
+    throw new Error("native-agent MCP retry loop exhausted");
   }
 }