### Summary When an agent sends a bad Orbit query, the user and the agent do not get an error they can act on. ### Expected behavior - The Duo Chat card shows the Orbit error text. - The Rails MCP endpoint returns the Orbit error text for every command. - Each Orbit error tells the agent how to fix the query. ### Actual behavior In one gitlab.com Duo Chat session, 4 of 11 Orbit calls failed. These are the issues: 1. **The Duo Chat card hides the error.** The user sees only `Tool call failed: ToolException`. The model gets the full text. 1. **The model text has noise.** It ends with ` None` and starts with `raised ToolException: Action error:`. 1. **Rails drops gRPC errors.** Errors from commands other than `query_graph`, such as `NOT_FOUND`, come back as `-32603 "Internal error"`. 1. **The authz error is not actionable.** It does not say that scoping is automatic. The agent sent the same `traversal_path` filter again. 1. **The GQL parse error is not actionable.** `expected EOI` does not name the bad token, or say that `type(r)` is not supported. The agent sent `type(r)` again. 1. **`get_graph_schema` ignores unknown nodes.** `expand_nodes: ["NoSuchNode"]` returns the full schema with no error. What the Duo Chat user sees: ```plaintext Run MCP tool orbit_invoke_command: {...} - Tool call failed: ToolException ``` The model and Rails MCP get this text instead: ```plaintext schema violation: Orbit query syntax at line 1, column 74: expected EOI authorization error: filter on "traversal_path" for WorkItem: path is not within an authorized traversal_path scope for this entity ``` ### Steps to reproduce 1. Send `tools/call` with `invoke_command` and `command_name: query_graph` to `POST /api/v4/orbit/mcp`. Use a query with `type(r)`. Rails returns `isError: true` with the Orbit text. 1. Send the same query through Duo Chat. The card shows `ToolException`. 1. Send `invoke_command` with `command_name: no_such_command`. Rails returns `-32603 "Internal error"`. ### Environment - [x] **Orbit Remote**: the hosted graph on GitLab.com (`glab orbit remote`, MCP, GitLab Duo, or the REST API). - [ ] **Orbit Local**: runs on your machine (the `orbit` binary or `glab orbit local`). **Orbit Remote** - GitLab.com group or project path: `gitlab-org/orbit/knowledge-graph`. - Access method: GitLab Duo Agentic Chat with the Orbit MCP. - Approximate time of the failure: 2026-10-10 (UTC), workflow 9286846. Also reproduced on a GDK VM with Orbit `c7b3f599` and ai-assist `fa650224`. ### Logs <details><summary>Expand logs</summary> This is the Rails MCP response for an unknown command. ```json {"jsonrpc":"2.0","error":{"code":-32603,"message":"Internal error"},"id":3} ``` This is the same request in `log/knowledge_graph.log`. ```plaintext MCP Orbit call_tool connection_error: invoke_agent_command failed: 5:Tool not found: no_such_command ``` This is the `tool_result` that DWS sends to the model. ```plaintext Tool orbit_invoke_command raised ToolException: Action error: schema violation: Orbit query syntax at line 1, column 74: expected EOI Expected one MATCH ... RETURN statement, CALL db.schema(), or CALL db.schema('NodeName'); only AND predicates, named nodes, and bounded paths are supported. None ``` </details> ### Workaround Open the DWS trace (`GET /api/v4/ai/duo_workflows/workflows/<id>/trace.jsonl?full=true`). The `conversation_history` field has the full error text. ### Additional context Related: #1258 and #1311. ### Checklist - [x] Reproduced on the latest available version. - [x] Searched existing issues for duplicates. - [x] Included minimal, reliable reproduction steps. - [x] Attached relevant logs and environment details. - [x] Removed sensitive information from logs/configs. <details> <summary><b>Agent context</b>: extended analysis, hypothesis chains, file walkthroughs</summary> The table shows each hop of a failed query and where the text is lost. | # | Hop | Code | Result | |---|---|---|---| | 1 | DWS UI card | [tools_executor.py#L534-536](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/blob/fa650224c3eca0d2642b699db54721bfb008950f/duo_workflow_service/agents/tools_executor.py#L534-536) | Uses `type(error).__name__`. Adds detail only for `ToolExceptionWithResponse`. | | 2 | DWS model text | [tools_executor.py#L524](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/blob/fa650224c3eca0d2642b699db54721bfb008950f/duo_workflow_service/agents/tools_executor.py#L524) | Formats `{response}` when it is `None`. | | 3 | DWS executor | [action.py#L83-92](https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/blob/fa650224c3eca0d2642b699db54721bfb008950f/duo_workflow_service/executor/action.py#L83-92) | Raises a plain `ToolException("Action error: ...")`. Keeps the text. | | 4 | Rails MCP | [call_tool.rb#L23-31](https://gitlab.com/gitlab-org/gitlab/-/blob/70f446140a95d4e4496d4a185c55f1da79398e7c/ee/lib/api/orbit/mcp_handlers/call_tool.rb#L23-31) | `ConnectionError` and `StreamError` become `InternalError`. The gRPC client classifies `NOT_FOUND` and `INVALID_ARGUMENT` as `ConnectionError`. | | 5 | Orbit authz | [restrict.rs#L187-189](https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/blob/c7b3f599167a58f6ce0f7fd4b9ee8c5afb3cf26c/crates/query-engine/compiler/src/passes/restrict.rs#L187-189) | Does not name the eligible scopes or say that the filter is not needed. | | 6 | Orbit GQL parser | [gql/mod.rs#L143-156](https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/blob/c7b3f599167a58f6ce0f7fd4b9ee8c5afb3cf26c/crates/query-engine/compiler/src/passes/frontend/gql/mod.rs#L143-156) | Gives the pest column and a fixed hint only. | `query_graph` errors keep their text through Orbit, Workhorse, and the DWS executor. Workhorse writes the `isError` MCP result itself (`workhorse/internal/orbit/sendquery.go`), so Rails does not see these errors. </details> <!-- AI-Sessions dir: ~/.claude/projects/-Users-angelo-rivera-labcode-gitlab-com-gitlab-org-orbit-knowledge-graph/ 006151b7-4eb4-42b0-9756-814d31b88f7a.jsonl (2026-10-10) -->