@ateam-ai/mcp 0.4.53 → 0.4.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai/mcp",
-  "version": "0.4.53",
+  "version": "0.4.58",
   "mcpName": "io.github.ariekogan/ateam-mcp",
   "description": "A-Team MCP Server — build, validate, and deploy multi-agent solutions from any AI environment",
   "type": "module",

package/src/tools.js

@@ -512,6 +512,19 @@ export const tools = [
   {
     name: "ateam_design_advisor",
     core: true,
+    // MEASURED, not estimated. 6 successful calls against dev on 2026-08-21,
+    // distinct goals, spaced to avoid provider rate-limiting:
+    //   19048 21123 23359 23739 24462 24699 ms  (median 23.7s, max 24.7s)
+    // It is ONE LLM call over the capability catalog, so the cost is provider
+    // latency and there is no meaningful warm path to under-report.
+    //
+    // WHY IT MATTERS: Core derives its timeout from this (p95 x 4, floored at
+    // 30s). Undeclared, the advisor sat under a 30s default while taking ~25s —
+    // one bad provider spike from failing, and it failed exactly that way on
+    // 2026-08-21 ("HTTP connector timeout after 30000ms"). It is also the FIRST
+    // call a building agent makes and it carries the storage decision, so when
+    // it times out the run proceeds with no capability guidance at all.
+    monitoring: { safe: true, cost: "normal", latency_ms_p95: 25000, output: "bounded" },
     description:
       "CONSULT THIS DURING DESIGN — before and while you design a skill/solution. Describe what you're building; it returns POINTERS to the platform capabilities that fit (per-actor storage, widgets, triggers, sub-agents, mobile data, run-scripts, multi-skill, GitHub, …), each with the /spec topic to read next (via ateam_get_spec) and the tool to wire it. Also returns 'missing' hints (capabilities your goal implies but the design hasn't wired) and lifecycle hints (e.g. connect GitHub when the project will iterate). ADVISORY ONLY — you decide and own the design. Stateless: pass the current design_state each call; consult it as often as you like as the design evolves.",
     inputSchema: {
@@ -1017,6 +1030,59 @@ export const tools = [
     },
   },
 
+  {
+    name: "ateam_log_lesson",
+    core: true,
+    description:
+      "Record ONE lesson this run learned, so the NEXT run does not relearn it. " +
+      "A building agent starts every run empty — it does not know which tool " +
+      "misled the last run or the workaround that got past it. Log a lesson the " +
+      "moment a tool misleads you AND you find a way through.\n\n" +
+      "APPEND-ONLY. You cannot edit or delete earlier lessons, and you do not " +
+      "supply the timestamp, job or actor — the server stamps those.\n\n" +
+      "LOG ONLY WHAT YOU OBSERVED. Quote the error VERBATIM; never paraphrase it " +
+      "and never write a theory about platform internals. A wrong lesson is worse " +
+      "than no lesson, because the next run cannot check it and will act on it.\n\n" +
+      "Use kind='misleading_success' when a call REPORTED success while the thing " +
+      "you wanted did not happen — that class is the most expensive to rediscover " +
+      "and it is invisible to a failures-only log.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        solution_id: { type: "string", description: "The solution this lesson belongs to" },
+        tool: { type: "string", description: "The tool that misled you, e.g. \"ateam_build_and_run\"" },
+        error: { type: "string", description: "The VERBATIM error or failed_steps fragment. Not a paraphrase." },
+        workaround: { type: "string", description: "What you did instead (optional)" },
+        worked: { type: "boolean", description: "Did the workaround work? Omit if you never found out — 'unknown' is a real answer" },
+        kind: {
+          type: "string",
+          enum: ["failure", "surprise", "misleading_success"],
+          description: "failure = it errored; surprise = it worked but not as documented; misleading_success = it REPORTED success while the intended effect did not happen",
+        },
+      },
+      required: ["solution_id", "tool", "error"],
+    },
+  },
+
+  {
+    name: "ateam_get_lessons",
+    core: true,
+    description:
+      "Read what EARLIER runs on this solution learned — newest first, bounded. " +
+      "Call this during orientation, BEFORE planning: it is the only thing that " +
+      "carries context across runs, and it is cheap. Each entry says which tool " +
+      "misled a previous run, the verbatim error, what was tried instead, and " +
+      "whether that worked. An empty list is a real answer (nothing learned yet).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        solution_id: { type: "string", description: "The solution ID" },
+        limit: { type: "number", description: "Max entries, newest first (default 20)" },
+      },
+      required: ["solution_id"],
+    },
+  },
+
   {
     name: "ateam_create_connector",
     core: true,
@@ -2287,7 +2353,22 @@ function toText(data) { return { content: [{ type: "text", text: JSON.stringify(
 // into the call args; refuse to operate without it (prevents cross-actor leaks).
 function getActorId(args) {
   const id = args?._adas_actor;
-  if (!id) throw new Error("${connectorId}: no actor context — _adas_actor missing.");
+  // Name BOTH causes. "actor context missing" reads as "Core did not send it",
+  // and that misreading cost a full day on 2026-08-20: Core HAD injected it and
+  // the connector's own schema validation stripped it, because that one tool's
+  // inputSchema omitted _adas_actor. An MCP server drops arguments a tool did
+  // not declare, so the field vanishes silently — and only on the tools that
+  // forgot it, which is why read tools kept working and the first write failed.
+  if (!id) {
+    throw new Error(
+      "${connectorId}: no actor context — _adas_actor missing. TWO possible causes: " +
+      "(1) this tool's inputSchema does not DECLARE _adas_actor, so MCP stripped it " +
+      "before your handler ran — add it to inputSchema.properties (see toolSchemas() " +
+      "below, every data tool must spread ...actor); or " +
+      "(2) the caller is not actor-scoped — ateam_test_connector runs as _system_service, " +
+      "so use ateam_test_skill or a real conversation to exercise per-user tools."
+    );
+  }
   return id;
 }
 ${uiCapable ? `
@@ -2317,6 +2398,13 @@ function discoverPlugins() {
 // ── Tool definitions ── Core reads this list. A tool named "ui.listPlugins"
 // is how Core knows this connector is UI-capable.
 function toolSchemas() {
+  // MUST be spread into the inputSchema.properties of EVERY per-actor tool.
+  // Not decoration: MCP strips arguments a tool did not declare, so a tool that
+  // omits these gets them removed before the handler runs and getActorId()
+  // throws — while the tools that DID declare them keep working. The result is
+  // a connector that looks healthy (deploys, lists tools, answers reads) and
+  // fails on the first write. Do not "fix" that with a default actor id: one
+  // shared actor pools every user's data.
   const actor = { _adas_actor: { type: "string" }, _adas_tenant: { type: "string" } };
   return [
     {
@@ -2340,7 +2428,33 @@ async function handle(req) {
 
   if (method === "tools/call") {
     const name = params?.name;
-    const args = params?.arguments || {};
+    // CALLER CONTEXT COMES FROM THE ENVELOPE FIRST.
+    //
+    // Core sends identity two ways: as _adas_* ARGUMENTS, and on params._meta
+    // beside the arguments object. The argument channel is fragile — a server drops
+    // arguments a tool did not declare, so a tool whose inputSchema omits
+    // _adas_actor loses it silently and only per-user WRITES fail, while reads
+    // keep working. The envelope cannot be stripped: it is not part of the
+    // validated argument object.
+    //
+    // This server reads params directly (no SDK zod validation), so _meta is
+    // simply available — no wrapper, no callback plumbing. Merge it UNDER args
+    // so an explicitly declared argument still wins, which keeps a delegation
+    // tool's own actor_id PARAMETER untouched: caller identity is transport,
+    // subject identity is payload, and they must not collide.
+    //
+    // ONLY the _adas_ prefix. _meta is the MCP envelope's OWN namespace, not
+    // ours — the spec puts progressToken in there, and clients that request
+    // progress send it on every call. Spreading the whole envelope would hand a
+    // transport token to tools as a user argument: schemas with
+    // additionalProperties:false would start rejecting previously-valid calls,
+    // tools that log or persist their arguments would record it as user data,
+    // and a future _meta key colliding with a real parameter name would
+    // overwrite it. Read the namespace we own; do not treat the envelope as input.
+    const ctx = Object.fromEntries(
+      Object.entries(params?._meta || {}).filter(([k]) => k.startsWith("_adas_")),
+    );
+    const args = { ...ctx, ...(params?.arguments || {}) };
     try {
 ${uiCapable ? `      // ── UI registry plumbing (no actor required) ──
       if (name === "ui.listPlugins") {
@@ -4954,6 +5068,23 @@ const handlers = {
     };
   },
 
+  ateam_log_lesson: async ({ solution_id, tool, error, workaround, worked, kind }, sid) => {
+    if (!solution_id) throw new Error("solution_id required");
+    if (!tool) throw new Error("tool required — the tool that misled you");
+    if (!error) throw new Error("error required — quote it VERBATIM, do not paraphrase");
+    return await post(
+      `/deploy/solutions/${solution_id}/lessons`,
+      { tool, error, workaround, worked, kind },
+      sid,
+    );
+  },
+
+  ateam_get_lessons: async ({ solution_id, limit }, sid) => {
+    if (!solution_id) throw new Error("solution_id required");
+    const qs = Number.isFinite(limit) ? `?limit=${limit}` : "";
+    return await get(`/deploy/solutions/${solution_id}/lessons${qs}`, sid);
+  },
+
   ateam_show_solution_minimal: async ({ solution_id }, sid) => {
     if (!solution_id) throw new Error("solution_id required");
     const full = await get(`/deploy/solutions/${solution_id}/definition`, sid);