@ateam-ai/mcp 0.4.77 → 0.4.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai/mcp",
-  "version": "0.4.77",
+  "version": "0.4.78",
   "mcpName": "io.github.ariekogan/ateam-mcp",
   "description": "A-Team MCP Server — build, validate, and deploy multi-agent solutions from any AI environment",
   "type": "module",

package/src/api.js

@@ -487,6 +487,30 @@ function formatError(method, path, status, body, baseUrl) {
     503: "A-Team API is temporarily unavailable. Try again in a minute.",
   };
 
+  // A 401 IS NOT ALWAYS AN AUTH PROBLEM, AND SAYING SO COSTS A RUN.
+  //
+  // The table below attaches "your API key may be invalid or expired — get a
+  // new key and call ateam_auth" to EVERY 401, by status code, never by cause.
+  // Core also returns 401 for `Actor "X" not found`, where the key is perfectly
+  // valid and the actor is the problem. A PROD agent believed that hint this
+  // morning, stopped, and asked the admin to paste an API key — for an error
+  // that had nothing to do with keys. An error naming the wrong remedy does not
+  // just fail; it sends someone competent in the wrong direction.
+  if (status === 401) {
+    const t = typeof body === "string"
+      ? body
+      : (() => { try { return JSON.stringify(body || ""); } catch { return ""; } })();
+    const m = /Actor\s+\\?"([^"\\]+)\\?"\s+not found|unknown actor\s+\\?"?([^"\\,}]+)/i.exec(t);
+    if (m) {
+      const who = (m[1] || m[2] || "").trim();
+      hints[401] =
+        `NOT an auth problem — your key is fine. Core does not recognise the ACTOR "${who}" in this tenant. ` +
+        `Re-authenticating will not help. Either pass a real actor id (the one ateam_conversation returned for the thread), ` +
+        `or omit the actor entirely to act as the tenant. If you never sent an actor, the session is bound to a stale one: ` +
+        `call ateam_auth again to reset the session binding.`;
+    }
+  }
+
   // A 500 THAT NAMES A MISSING CONFIGURATION IS NOT "TRY AGAIN IN A MINUTE".
   //
   // /chat answered 500 {"message":"OPENAI_API_KEY is not set"} and this table

package/src/tools.js

@@ -19,6 +19,17 @@ import {
 // (tenant + the app URL to view the change). ateam-mcp is a PUBLIC MCP used
 // from non-desktop clients too, so the location must live IN the tool result
 // — not only in a desktop plugin's SKILL.md. Read-only/global tools skip it.
+// Tools that START a run and therefore MINT the actor that ran it. Only these
+// may rebind the session's actor — see the call site for what accepting it from
+// any result cost.
+const ACTOR_MINTING_TOOLS = new Set([
+  "ateam_conversation",
+  "ateam_test_skill",
+  "ateam_solution_chat",
+  "ateam_test_pipeline",
+  "ateam_test_voice",
+]);
+
 const STAMP_WHERE_TOOLS = new Set([
   "ateam_build_and_run", "ateam_patch", "ateam_upload_connector", "ateam_redeploy",
   "ateam_create_skill", "ateam_create_connector", "ateam_create_plugin",
@@ -6129,7 +6140,19 @@ export async function handleToolCall(name, args, sessionId) {
     // it on the way out so the follow-up ateam_get_execution_logs /
     // ateam_get_metrics on that very job is not refused for not knowing who ran
     // it — the single most common dead end when debugging a run.
-    if (result && typeof result === "object" && result.actor_id) {
+    //
+    // ONLY FROM TOOLS THAT ACTUALLY MINT ONE. This used to accept `actor_id` off
+    // ANY tool's result, so a single unrelated payload carrying that field
+    // silently repointed the whole session — observed on a clean e2e where every
+    // later call 401'd with `Actor "dev" not found`, from an agent that had
+    // never sent an actor at all. A session that binds to a non-existent actor
+    // never recovers on its own, because nothing ever unbinds it.
+    //
+    // The generated-thread-key filter in api.js does not help here: it rejects
+    // test_<ts>_<rand>, and a short literal like "dev" walks straight past it.
+    // An allow-list of minting tools is the honest boundary — "who ran this job"
+    // is knowledge only the tools that START a job possess.
+    if (result && typeof result === "object" && result.actor_id && ACTOR_MINTING_TOOLS.has(name)) {
       touchSession(sessionId, { actorId: result.actor_id });
     }