@ateam-ai/mcp 0.4.72 → 0.4.74

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai/mcp",
-  "version": "0.4.72",
+  "version": "0.4.74",
   "mcpName": "io.github.ariekogan/ateam-mcp",
   "description": "A-Team MCP Server — build, validate, and deploy multi-agent solutions from any AI environment",
   "type": "module",
@@ -13,7 +13,7 @@
     "start:http": "node src/index.js --http",
     "dev": "node --watch src/index.js",
     "dev:http": "node --watch src/index.js --http",
-    "test": "node test/session-isolation.test.mjs"
+    "test": "node test/session-isolation.test.mjs && node test/widget-protocol.test.mjs"
   },
   "keywords": [
     "mcp",

package/src/tools.js

@@ -223,6 +223,69 @@ function _widgetHasRender(r) {
   return true; // unknown mode — don't false-positive on a custom render
 }
 
+
+// ── WIDGET POSTMESSAGE PROTOCOL: the failure that RENDERS FINE ────────────────
+//
+// A widget using the wrong postMessage shape draws its chrome, calls the host,
+// and hangs until its own timeout. Nothing errors: the connector is healthy,
+// tools/list is correct, the plugin "renders", and only the DATA is missing.
+// A clinic dashboard shipped that way and was reported as working (2026-08-29).
+//
+// The host matches action === "mcp-call" with payload.requestId. Three shapes
+// are fatal on their own, and a widget can get two right and still hang:
+//   type:"tool.call"        — never existed in the host, at any version
+//   correlationId           — the host echoes requestId; the pending map misses
+//   type:"mcp-call" on SEND — send is matched on message.action, not .type
+//
+// Detected here rather than left to a person noticing an empty panel, and
+// reported with the repair attached — a signal the reasoning engine can act on.
+export function _widgetProtocolProblems(html) {
+  if (typeof html !== "string" || !html.includes("postMessage")) return [];
+
+  // STRUCTURE, NOT TOKENS. The first version matched /correlationId/ anywhere in
+  // the file, so a correct widget with an unrelated local named correlationId was
+  // reported broken — and `fix_with` would then steer an agent into editing
+  // working code. Reviewer was right to reject it. Each check below anchors to
+  // the actual send or receive shape.
+  const problems = [];
+
+  // Only look at what is POSTED to the host: postMessage(...) argument objects.
+  const sends = [...html.matchAll(/postMessage\s*\(\s*\{[\s\S]{0,400}/g)].map((m) => m[0]);
+  const sendBlob = sends.join("\n");
+  const isPluginSend = /source\s*:\s*["']adas-plugin["']/.test(sendBlob);
+
+  if (isPluginSend) {
+    if (/type\s*:\s*["']tool\.call["']/.test(sendBlob)) {
+      problems.push('sends message.type:"tool.call" — the host has NEVER accepted it, at any version (silent timeout, no error). Send message:{action:"mcp-call",payload:{requestId,connectorId,tool,args}}.');
+    } else if (!/action\s*:\s*["']mcp-call["']/.test(sendBlob)) {
+      // type:"mcp-call" is the near-miss worth naming separately: right name,
+      // wrong key. The host matches on message.action and ignores message.type.
+      if (/type\s*:\s*["']mcp-call["']/.test(sendBlob)) {
+        problems.push('sends message.TYPE:"mcp-call" — the host matches on message.ACTION for sends, so this is ignored. Use message:{action:"mcp-call",payload:{...}}.');
+      } else {
+        problems.push('never sends action:"mcp-call" — the host ignores the message entirely.');
+      }
+    }
+    // correlationId only counts as a defect where it carries the request id.
+    if (/payload\s*:\s*\{[^}]*correlationId/.test(sendBlob) || /correlationId\s*:\s*correlationId/.test(sendBlob)) {
+      problems.push('sends the request id as correlationId — the host echoes payload.requestId, so responses never match the pending request and every call times out even when the host answered.');
+    }
+  }
+
+  // RECEIVE side: only flag reading correlationId OFF THE HOST PAYLOAD.
+  if (/payload\s*(\?\.|\.)\s*correlationId/.test(html) ||
+      /payload\s*&&\s*[\w$.]*payload\.correlationId/.test(html) ||
+      /\{\s*correlationId[^}]*\}\s*=\s*[\w$.]*payload/.test(html)) {
+    problems.push('reads payload.correlationId from the host response — the host sends payload.requestId, so the pending request is never matched.');
+  }
+  if (/type\s*===?\s*["']tool\.response["']/.test(html)) {
+    problems.push('listens for message.type:"tool.response" — the host replies with "mcp-result".');
+  }
+
+  return problems;
+}
+
+
 async function verifyWidgetHealth(solution_id, sid) {
   // 1. Declared plugins — solution.ui_plugins[]
   let declared = [];
@@ -290,6 +353,36 @@ async function verifyWidgetHealth(solution_id, sid) {
     return { id: id || "(missing)", discovered: !!found, render_ok, problems };
   });
 
+  // 4. PROTOCOL CHECK on the served HTML. Steps 1-3 prove a widget is declared,
+  //    discovered and renderable — none of which catches a widget that renders
+  //    and then silently times out on every call.
+  //    Read the SOURCE we serve rather than fetching the rendered iframe: the
+  //    source is what a fix would edit, and it needs no browser or signed URL.
+  //    Plugin ids are `mcp:<connector>:<name>`, so one source read per connector
+  //    covers all of its widgets.
+  const connectorsSeen = new Map();   // connectorId -> [{path, content}]
+  for (const p of plugins) {
+    const connectorId = String(p.id || "").startsWith("mcp:") ? String(p.id).split(":")[1] : null;
+    if (!connectorId) continue;
+    if (!connectorsSeen.has(connectorId)) {
+      try {
+        const src = await get(`/deploy/solutions/${solution_id}/connectors/${connectorId}/source`, sid);
+        connectorsSeen.set(connectorId, Array.isArray(src?.files) ? src.files : []);
+      } catch {
+        connectorsSeen.set(connectorId, []);   // unreadable source is not a verdict
+      }
+    }
+    const html = (connectorsSeen.get(connectorId) || [])
+      .filter((f) => /ui-dist\/.*\.html$/.test(f?.path || ""))
+      .map((f) => f?.content || "")
+      .join("\n");
+    const protoProblems = _widgetProtocolProblems(html);
+    if (protoProblems.length) {
+      p.problems.push(...protoProblems);
+      p.fix_with = `Fix the widget's postMessage code and redeploy: ateam_github_patch(solution_id, "connectors/${connectorId}/ui-dist/<widget>/index.html", ...) then ateam_upload_connector(solution_id, "${connectorId}", github:true). The exact working shape is in ateam_get_examples(type:"ui-plugin-iframe").`;
+    }
+  }
+
   const unhealthy = plugins.filter((p) => p.problems.length);
   return {
     ok: unhealthy.length === 0,