@ateam-ai/mcp 0.4.71 → 0.4.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai/mcp",
-  "version": "0.4.71",
+  "version": "0.4.73",
   "mcpName": "io.github.ariekogan/ateam-mcp",
   "description": "A-Team MCP Server — build, validate, and deploy multi-agent solutions from any AI environment",
   "type": "module",

package/src/tools.js

@@ -223,6 +223,37 @@ function _widgetHasRender(r) {
   return true; // unknown mode — don't false-positive on a custom render
 }
 
+
+// ── WIDGET POSTMESSAGE PROTOCOL: the failure that RENDERS FINE ────────────────
+//
+// A widget using the wrong postMessage shape draws its chrome, calls the host,
+// and hangs until its own timeout. Nothing errors: the connector is healthy,
+// tools/list is correct, the plugin "renders", and only the DATA is missing.
+// A clinic dashboard shipped that way and was reported as working (2026-08-29).
+//
+// The host matches action === "mcp-call" with payload.requestId. Three shapes
+// are fatal on their own, and a widget can get two right and still hang:
+//   type:"tool.call"        — never existed in the host, at any version
+//   correlationId           — the host echoes requestId; the pending map misses
+//   type:"mcp-call" on SEND — send is matched on message.action, not .type
+//
+// Detected here rather than left to a person noticing an empty panel, and
+// reported with the repair attached — a signal the reasoning engine can act on.
+function _widgetProtocolProblems(html) {
+  if (typeof html !== "string" || !html.includes("postMessage")) return [];
+  const problems = [];
+  if (/["']tool\.call["']/.test(html)) {
+    problems.push('sends type:"tool.call" — the host has NEVER accepted it (silent 15s timeout, no error). Send message:{action:"mcp-call",payload:{requestId,connectorId,tool,args}}.');
+  }
+  if (/correlationId/.test(html)) {
+    problems.push('keys responses on correlationId — the host echoes payload.requestId, so the pending request is never matched and every call times out even when the host answered.');
+  }
+  if (/postMessage/.test(html) && !/["']mcp-call["']/.test(html)) {
+    problems.push('never sends action:"mcp-call" — the host ignores the message entirely.');
+  }
+  return problems;
+}
+
 async function verifyWidgetHealth(solution_id, sid) {
   // 1. Declared plugins — solution.ui_plugins[]
   let declared = [];
@@ -290,6 +321,36 @@ async function verifyWidgetHealth(solution_id, sid) {
     return { id: id || "(missing)", discovered: !!found, render_ok, problems };
   });
 
+  // 4. PROTOCOL CHECK on the served HTML. Steps 1-3 prove a widget is declared,
+  //    discovered and renderable — none of which catches a widget that renders
+  //    and then silently times out on every call.
+  //    Read the SOURCE we serve rather than fetching the rendered iframe: the
+  //    source is what a fix would edit, and it needs no browser or signed URL.
+  //    Plugin ids are `mcp:<connector>:<name>`, so one source read per connector
+  //    covers all of its widgets.
+  const connectorsSeen = new Map();   // connectorId -> [{path, content}]
+  for (const p of plugins) {
+    const connectorId = String(p.id || "").startsWith("mcp:") ? String(p.id).split(":")[1] : null;
+    if (!connectorId) continue;
+    if (!connectorsSeen.has(connectorId)) {
+      try {
+        const src = await get(`/deploy/solutions/${solution_id}/connectors/${connectorId}/source`, sid);
+        connectorsSeen.set(connectorId, Array.isArray(src?.files) ? src.files : []);
+      } catch {
+        connectorsSeen.set(connectorId, []);   // unreadable source is not a verdict
+      }
+    }
+    const html = (connectorsSeen.get(connectorId) || [])
+      .filter((f) => /ui-dist\/.*\.html$/.test(f?.path || ""))
+      .map((f) => f?.content || "")
+      .join("\n");
+    const protoProblems = _widgetProtocolProblems(html);
+    if (protoProblems.length) {
+      p.problems.push(...protoProblems);
+      p.fix_with = `Fix the widget's postMessage code and redeploy: ateam_github_patch(solution_id, "connectors/${connectorId}/ui-dist/<widget>/index.html", ...) then ateam_upload_connector(solution_id, "${connectorId}", github:true). The exact working shape is in ateam_get_examples(type:"ui-plugin-iframe").`;
+    }
+  }
+
   const unhealthy = plugins.filter((p) => p.problems.length);
   return {
     ok: unhealthy.length === 0,
@@ -1031,6 +1092,57 @@ export const tools = [
     },
   },
 
+  {
+    name: "ateam_log_progress",
+    core: true,
+    description:
+      "Record that a build STEP is done, so a later run does not redo it. Write it AS IT HAPPENS, never at the end — the runs that most need a journal are the ones the clock kills.\n\n" +
+      "WHY: a continuation cannot otherwise tell what the previous run achieved, so it re-runs the whole orientation (bootstrap, get_workflows, list_solutions, get_solution, get_spec, get_examples, github_read) to re-derive from documents what was already established — and re-inflates its prompt into the region where provider latency collapses. Measured across 13 runs: stalls track PROMPT SIZE (~60k), not turn count. ateam_get_progress is ONE call instead of nine.\n\n" +
+      "status — three values, and the third is the point:\n" +
+      "  built     — the artefact exists (files written, committed)\n" +
+      "  deployed  — the platform accepted it\n" +
+      "  verified  — YOU CALLED IT AND GOT REAL DATA BACK\n\n" +
+      "`verified` REQUIRES verified_by, and a deploy response is not verification. `connected` and `tools > 0` are tools/list facts: a clinic connector showed 9 tools while every storage call returned 401. A journal that stops at `deployed` records that build as finished.\n\n" +
+      "Re-log the same step as it advances (built → deployed → verified) — latest wins, no update path. If a step REGRESSES, re-log it at the lower status: silence must not read as \"still fine\".",
+    inputSchema: {
+      type: "object",
+      properties: {
+        solution_id: { type: "string", description: "The solution ID" },
+        step: {
+          type: "string",
+          description: "STABLE slug a later run can MATCH rather than enumerate: 'connector:<id>', 'skill:<id>', 'widget:<name>', 'seed:<what>'. Keep it identical across runs — a renamed step reads as a new one.",
+        },
+        status: {
+          type: "string",
+          enum: ["built", "deployed", "verified"],
+          description: "built = artefact exists · deployed = platform accepted it · verified = you called it and got real data back",
+        },
+        detail: { type: "string", description: "One line of what exists — e.g. '10 tools, 8 seeded appointments'." },
+        verified_by: {
+          type: "string",
+          description: "REQUIRED when status is 'verified': the literal call that proved it and what came back, e.g. 'ateam_test_connector(clinic-data-mcp, appointments.list_all) → 23 rows'. Storing the evidence beside the claim is what makes the journal auditable instead of self-reported.",
+        },
+      },
+      required: ["solution_id", "step", "status"],
+    },
+  },
+  {
+    name: "ateam_get_progress",
+    core: true,
+    description:
+      "What this build has already ACHIEVED — read it FIRST when continuing a run, before any orientation call. Returns the CURRENT status per step (latest entry wins) plus recent history.\n\n" +
+      "Then build only the steps that are ABSENT or not yet `verified`.\n\n" +
+      "ABSENT IS NOT \"NOTHING WAS DONE\" — the journal may predate a step, or a run may have died before writing. It is a fast path, not a new source of truth: check before rebuilding something expensive.\n\n" +
+      "Complements ateam_get_lessons, which records what BROKE. This records what WORKS.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        solution_id: { type: "string", description: "The solution ID" },
+        limit: { type: "number", description: "History entries to return (default 60). `steps` is always complete." },
+      },
+      required: ["solution_id"],
+    },
+  },
   {
     name: "ateam_log_lesson",
     core: true,
@@ -2321,6 +2433,8 @@ const TENANT_TOOLS = new Set([
   // tenant's lessons. Tenant isolation is the one boundary this platform
   // treats as absolute.
   "ateam_log_lesson",
+  "ateam_log_progress",
+  "ateam_get_progress",
   "ateam_get_lessons",
 
   // Write operations
@@ -5376,6 +5490,23 @@ const handlers = {
     );
   },
 
+  ateam_log_progress: async ({ solution_id, step, status, detail, verified_by }, sid) => {
+    if (!solution_id) throw new Error("solution_id required");
+    if (!step) throw new Error("step required — a STABLE slug a later run can match on, e.g. \"connector:clinic-data-mcp\"");
+    if (!status) throw new Error("status required — built | deployed | verified");
+    return await post(
+      `/deploy/solutions/${solution_id}/progress`,
+      { step, status, detail, verified_by },
+      sid,
+    );
+  },
+
+  ateam_get_progress: async ({ solution_id, limit }, sid) => {
+    if (!solution_id) throw new Error("solution_id required");
+    const qs = Number.isFinite(limit) ? `?limit=${limit}` : "";
+    return await get(`/deploy/solutions/${solution_id}/progress${qs}`, sid);
+  },
+
   ateam_get_lessons: async ({ solution_id, limit }, sid) => {
     if (!solution_id) throw new Error("solution_id required");
     const qs = Number.isFinite(limit) ? `?limit=${limit}` : "";