@ateam-ai/mcp 0.4.77 → 0.4.79

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai/mcp",
-  "version": "0.4.77",
+  "version": "0.4.79",
   "mcpName": "io.github.ariekogan/ateam-mcp",
   "description": "A-Team MCP Server — build, validate, and deploy multi-agent solutions from any AI environment",
   "type": "module",
@@ -13,7 +13,7 @@
     "start:http": "node src/index.js --http",
     "dev": "node --watch src/index.js",
     "dev:http": "node --watch src/index.js --http",
-    "test": "node test/session-isolation.test.mjs && node test/widget-protocol.test.mjs"
+    "test": "node test/session-isolation.test.mjs && node test/widget-protocol.test.mjs && node test/actor-binding.test.mjs"
   },
   "keywords": [
     "mcp",

package/src/api.js

@@ -173,6 +173,27 @@ export function isExplicitlyAuthenticated(sessionId) {
  * Record activity on a session — called on every tool call.
  * Keeps the session alive and updates context for smarter UX.
  */
+/**
+ * Forget the session's bound actor.
+ *
+ * A session binds an actor from args or from a run-starting tool's result, and
+ * NOTHING ever unbound it — so a session that bound a bad value ("dev", a
+ * branch name a caller mistook for an actor) sent it on every later request
+ * forever, each one 401-ing with `Actor "dev" not found`. Restricting where a
+ * bind may come from narrows the entrance; it does not open an exit.
+ *
+ * Called when Core tells us the actor does not exist. Self-healing beats a
+ * hint telling a human to re-authenticate a key that was never the problem.
+ */
+export function clearSessionActor(sessionId, reason = "") {
+  const session = sessionId ? sessions.get(sessionId) : null;
+  if (!session?.context?.actorId) return false;
+  const had = session.context.actorId;
+  delete session.context.actorId;
+  console.warn(`[Auth] Unbound session actor "${had}"${reason ? ` — ${reason}` : ""}. Later calls act as the tenant until an actor is passed again.`);
+  return true;
+}
+
 export function touchSession(sessionId, { toolName, solutionId, skillId, actorId } = {}) {
   const session = sessions.get(sessionId);
   if (!session) return;
@@ -487,6 +508,30 @@ function formatError(method, path, status, body, baseUrl) {
     503: "A-Team API is temporarily unavailable. Try again in a minute.",
   };
 
+  // A 401 IS NOT ALWAYS AN AUTH PROBLEM, AND SAYING SO COSTS A RUN.
+  //
+  // The table below attaches "your API key may be invalid or expired — get a
+  // new key and call ateam_auth" to EVERY 401, by status code, never by cause.
+  // Core also returns 401 for `Actor "X" not found`, where the key is perfectly
+  // valid and the actor is the problem. A PROD agent believed that hint this
+  // morning, stopped, and asked the admin to paste an API key — for an error
+  // that had nothing to do with keys. An error naming the wrong remedy does not
+  // just fail; it sends someone competent in the wrong direction.
+  if (status === 401) {
+    const t = typeof body === "string"
+      ? body
+      : (() => { try { return JSON.stringify(body || ""); } catch { return ""; } })();
+    const m = /Actor\s+\\?"([^"\\]+)\\?"\s+not found|unknown actor\s+\\?"?([^"\\,}]+)/i.exec(t);
+    if (m) {
+      const who = (m[1] || m[2] || "").trim();
+      hints[401] =
+        `NOT an auth problem — your key is fine. Core does not recognise the ACTOR "${who}" in this tenant. ` +
+        `Re-authenticating will not help. Either pass a real actor id (the one ateam_conversation returned for the thread), ` +
+        `or omit the actor entirely to act as the tenant. If you never sent an actor, the session is bound to a stale one: ` +
+        `call ateam_auth again to reset the session binding.`;
+    }
+  }
+
   // A 500 THAT NAMES A MISSING CONFIGURATION IS NOT "TRY AGAIN IN A MINUTE".
   //
   // /chat answered 500 {"message":"OPENAI_API_KEY is not set"} and this table
@@ -617,6 +662,15 @@ async function request(method, path, body, sessionId, opts = {}) {
 
       if (!res.ok) {
         const text = await res.text().catch(() => "");
+        // SELF-HEAL A BAD ACTOR BINDING. Core saying `Actor "X" not found` is
+        // proof the session is carrying an actor that does not exist, and every
+        // subsequent request would send it again. Restricting where a bind may
+        // come from narrows the entrance; this is the exit. Unbinding costs
+        // nothing when the actor was genuinely wrong, and the next call simply
+        // acts as the tenant until a real actor is passed.
+        if (res.status === 401 && /Actor\s+\\?"?[^"\\,}]+\\?"?\s+not found|unknown actor/i.test(text)) {
+          clearSessionActor(sessionId, `Core rejected it on ${method} ${path}`);
+        }
         // Attach the HTTP status so callers can distinguish a genuine 404
         // (resource absent) from a transient/5xx failure. ateam_patch relies
         // on this to NOT scaffold-clobber an existing skill on a read error.

package/src/tools.js

@@ -19,6 +19,17 @@ import {
 // (tenant + the app URL to view the change). ateam-mcp is a PUBLIC MCP used
 // from non-desktop clients too, so the location must live IN the tool result
 // — not only in a desktop plugin's SKILL.md. Read-only/global tools skip it.
+// Tools that START a run and therefore MINT the actor that ran it. Only these
+// may rebind the session's actor — see the call site for what accepting it from
+// any result cost.
+const ACTOR_MINTING_TOOLS = new Set([
+  "ateam_conversation",
+  "ateam_test_skill",
+  "ateam_solution_chat",
+  "ateam_test_pipeline",
+  "ateam_test_voice",
+]);
+
 const STAMP_WHERE_TOOLS = new Set([
   "ateam_build_and_run", "ateam_patch", "ateam_upload_connector", "ateam_redeploy",
   "ateam_create_skill", "ateam_create_connector", "ateam_create_plugin",
@@ -6129,7 +6140,19 @@ export async function handleToolCall(name, args, sessionId) {
     // it on the way out so the follow-up ateam_get_execution_logs /
     // ateam_get_metrics on that very job is not refused for not knowing who ran
     // it — the single most common dead end when debugging a run.
-    if (result && typeof result === "object" && result.actor_id) {
+    //
+    // ONLY FROM TOOLS THAT ACTUALLY MINT ONE. This used to accept `actor_id` off
+    // ANY tool's result, so a single unrelated payload carrying that field
+    // silently repointed the whole session — observed on a clean e2e where every
+    // later call 401'd with `Actor "dev" not found`, from an agent that had
+    // never sent an actor at all. A session that binds to a non-existent actor
+    // never recovers on its own, because nothing ever unbinds it.
+    //
+    // The generated-thread-key filter in api.js does not help here: it rejects
+    // test_<ts>_<rand>, and a short literal like "dev" walks straight past it.
+    // An allow-list of minting tools is the honest boundary — "who ran this job"
+    // is knowledge only the tools that START a job possess.
+    if (result && typeof result === "object" && result.actor_id && ACTOR_MINTING_TOOLS.has(name)) {
       touchSession(sessionId, { actorId: result.actor_id });
     }