@ateam-ai/mcp 0.4.36 → 0.4.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai/mcp",
-  "version": "0.4.36",
+  "version": "0.4.38",
   "mcpName": "io.github.ariekogan/ateam-mcp",
   "description": "A-Team MCP Server — build, validate, and deploy multi-agent solutions from any AI environment",
   "type": "module",

package/src/api.js

@@ -520,7 +520,12 @@ async function request(method, path, body, sessionId, opts = {}) {
 
       if (!res.ok) {
         const text = await res.text().catch(() => "");
-        throw new Error(formatError(method, path, res.status, text, baseUrl));
+        // Attach the HTTP status so callers can distinguish a genuine 404
+        // (resource absent) from a transient/5xx failure. ateam_patch relies
+        // on this to NOT scaffold-clobber an existing skill on a read error.
+        const e = new Error(formatError(method, path, res.status, text, baseUrl));
+        e.status = res.status;
+        throw e;
       }
 
       return res.json();

package/src/tools.js

@@ -1026,6 +1026,7 @@ export const tools = [
       "  • github:true + files:[]        — GitHub state at `ref` as BASE, your files overlay on top (incoming wins).\n" +
       "  • files:[] (no github)          — default MERGE with GitHub state at `ref`. Refuses if no GitHub base exists (no silent nuke).\n" +
       "  • files:[] + replace:true       — full replace. Wipes connector dir + writes only the provided files. Use deliberately.\n\n" +
+      "Multi-file connectors (server.js + dashboard HTML + RN bundle + package/manifest): pass each file with content_base64 (a single-line, escape-safe base64 string) instead of content — so you don't hand-escape ~90KB of HTML/JS/JSON inside one tool call. This is the CANONICAL agent path for a full connector; do NOT hand-roll `curl` against the raw endpoint (that skips connector registration / PAT provisioning).\n\n" +
       "Common traps this design prevents:\n" +
       "  • Pre-fix bug (2026-06-06): sending just ui-dist HTML wiped server.js + node_modules — connector broke until a full re-upload. Now: those files merge with the GitHub base.\n" +
       "  • Pre-fix bug: github:true silently read from `main` even when patches were on `dev`. Now: defaults to dev; pass ref:'main' to opt into the legacy path.",
@@ -1054,11 +1055,12 @@ export const tools = [
             type: "object",
             properties: {
               path: { type: "string", description: "Relative file path (e.g. 'server.js', 'ui-dist/panel/index.html')" },
-              content: { type: "string", description: "File content" },
+              content: { type: "string", description: "File content as an inline string. Prefer content_base64 when the content has complex escaping (HTML/JS/JSON)." },
+              content_base64: { type: "string", description: "File content as a single-line base64 string — escape-safe. PREFERRED for a multi-file connector so large HTML/JS/bundles don't need hand-escaping in the tool call. Provide exactly ONE of content / content_base64 per file." },
             },
-            required: ["path", "content"],
+            required: ["path"],
           },
-          description: "Files to upload. By default merges with the GitHub state at `ref`. Set replace:true to wipe the connector dir and write only these files.",
+          description: "Files to upload — each needs 'path' plus ONE of content (inline string) or content_base64 (escape-safe base64; preferred for multi-file connectors). By default merges with the GitHub state at `ref`. Set replace:true to wipe the connector dir and write only these files.",
         },
         replace: {
           type: "boolean",
@@ -3261,11 +3263,51 @@ const handlers = {
         current = JSON.parse(readResult.content);
       }
     } catch (err) {
-      // If it's a skill that doesn't exist yet, create a default scaffold.
-      // This lets agents use ateam_patch to both CREATE and UPDATE skills —
-      // no separate "create" step needed.
+      // OPEN-31 guard: only scaffold-create when the skill is GENUINELY ABSENT.
+      // The old code scaffolded on ANY read error, so a transient github/read
+      // failure (fetch failed, 5xx, parse error) silently OVERWROTE a full
+      // deployed skill with a bare scaffold on the next write — total data loss.
+      //
+      // A genuine "doesn't exist" is a 404 (or the local empty-definition throw).
+      // Anything else = the store is unreachable/broken → FAIL LOUD, never write.
+      const notFound = err.status === 404 || /not found \(empty definition\)/i.test(err.message || "");
+      if (target === "skill" && skill_id && !notFound) {
+        return {
+          ok: false, phase: "read",
+          error: `Refusing to patch "${skill_id}": could not read its current definition from ${isLocal ? "the Builder store" : "GitHub"} (${err.message}). This is NOT a "skill doesn't exist" error (that would be a 404) — scaffolding now could DESTROY the existing definition. Retry once the store is reachable, or check ateam_get_solution(solution_id, skill_id).`,
+          phases,
+        };
+      }
+      // Even on a real 404, the skill may exist in the OTHER source (deployed to
+      // the Builder store but not pushed to GitHub, or vice versa). Scaffolding
+      // then would destroy/diverge that real def — cross-check before creating.
+      if (target === "skill" && skill_id) {
+        let otherDef = null;
+        try {
+          const other = isLocal
+            ? JSON.parse((await get(`/deploy/solutions/${solution_id}/github/read?path=${encodeURIComponent(filePath)}`, sid)).content)
+            : await get(`/deploy/solutions/${solution_id}/skills/${encodeURIComponent(skill_id)}`, sid);
+          otherDef = other?.skill || other?.definition || other;
+        } catch { otherDef = null; /* absent in the other source too → truly new */ }
+        const otherIsReal = otherDef && typeof otherDef === "object" && (
+          (Array.isArray(otherDef.tools) && otherDef.tools.length > 0) ||
+          (Array.isArray(otherDef.connectors) && otherDef.connectors.length > 0) ||
+          otherDef.voice_native || otherDef.ui_plugins ||
+          (otherDef.role && otherDef.role.persona)
+        );
+        if (otherIsReal) {
+          return {
+            ok: false, phase: "read",
+            error: `Refusing to patch "${skill_id}": it was not found in ${isLocal ? "the Builder store" : "GitHub"}, but a full definition EXISTS in ${isLocal ? "GitHub" : "the Builder store"}. Scaffold-creating here would destroy/diverge it. Sync the two first (ateam_redeploy / ateam_verify_consistency), then retry — do NOT patch-create over an existing skill.`,
+            phases,
+          };
+        }
+      }
+      // If it's a skill that GENUINELY doesn't exist (404 in the primary source
+      // AND absent from the other), create a default scaffold. This lets agents
+      // use ateam_patch to both CREATE and UPDATE skills — no separate step.
       if (target === "skill" && skill_id) {
-        console.log(`[ateam_patch] Skill "${skill_id}" not found on GitHub — creating new skill scaffold`);
+        console.log(`[ateam_patch] Skill "${skill_id}" genuinely absent (404, both sources) — creating new skill scaffold`);
         isNewSkill = true;
         current = {
           id: skill_id,
@@ -4423,12 +4465,40 @@ const handlers = {
   },
 
   ateam_upload_connector: async ({ solution_id, connector_id, github, files, ref, replace }, sid) => {
+    // OPEN-32: accept content_base64 per file (single-line, escape-safe) and
+    // decode it to plain content here, so an agent can upload a multi-file
+    // connector without hand-escaping ~90KB of HTML/JS/JSON in one tool call —
+    // and via THIS registered path (not a raw curl that skips PAT provisioning).
+    let normFiles = files;
+    if (Array.isArray(files)) {
+      normFiles = files.map((f, i) => {
+        if (!f || typeof f !== "object" || !f.path) {
+          throw new Error(`ateam_upload_connector: files[${i}] must be an object with a 'path'.`);
+        }
+        const hasContent = typeof f.content === "string";
+        const hasB64 = typeof f.content_base64 === "string";
+        if (hasContent && hasB64) {
+          throw new Error(`ateam_upload_connector: files[${i}] ("${f.path}") has BOTH content and content_base64 — provide exactly one.`);
+        }
+        if (!hasContent && !hasB64) {
+          throw new Error(`ateam_upload_connector: files[${i}] ("${f.path}") needs 'content' (inline string) or 'content_base64' (escape-safe base64).`);
+        }
+        if (hasB64) {
+          const decoded = Buffer.from(f.content_base64, "base64").toString("utf8");
+          if (!decoded && f.content_base64.trim()) {
+            throw new Error(`ateam_upload_connector: files[${i}] ("${f.path}") content_base64 did not decode to any content — check the encoding.`);
+          }
+          return { path: f.path, content: decoded };
+        }
+        return { path: f.path, content: f.content };
+      });
+    }
     // Async-first: this runs npm install + build in Core (up to ~7min) and is a
     // prime Cloudflare-524 culprit. Kick async → poll /deploy/jobs; fall back to
     // sync for older backends that don't honor async. Mirrors ateam_github_pull.
     const body = {
       github,
-      files,
+      files: normFiles,
       ...(ref ? { ref } : {}),
       ...(replace === true ? { replace: true } : {}),
     };