@zvndev/circular-mcp 0.1.1 → 0.1.2

package/lib/server.mjs

@@ -21,7 +21,7 @@ const SUPPORTED_PROTOCOL_VERSIONS = new Set([
   "2024-11-05",
 ]);
 
-export const SERVER_INFO = { name: "circular-mcp", version: "0.1.1" };
+export const SERVER_INFO = { name: "circular-mcp", version: "0.1.2" };
 
 /**
  * The briefing every client sees on connect. This is the only onboarding an

package/lib/vendor/client.mjs

@@ -99,11 +99,13 @@ export async function apiRequest(
 
   let response = await send(config, method, url, body);
 
-  // One retry, and only when the file genuinely holds a different key. The
-  // config object is mutated so the rest of the session uses the live key too:
+  // Legacy unbound sessions get one retry when the file holds a different key.
+  // Bound sessions cannot prove that a global key represents the same agent
+  // and human, so they must reconnect instead of silently changing identity.
+  // The config object is mutated so the session uses the live key afterward:
   // recovering one request and leaving the next twenty to fail would be worse
   // than not recovering at all, because the failure would look intermittent.
-  if (response.status === 401) {
+  if (response.status === 401 && !config.agentParticipantId) {
     const rotated = rotatedKey(config.apiKey, readFile);
     if (rotated) {
       config.apiKey = rotated;
@@ -120,6 +122,13 @@ export async function apiRequest(
   }
 
   if (!response.ok) {
+    if (response.status === 401 && config.agentParticipantId) {
+      throw new ApiError(
+        `${method} ${path} failed (401): This agent session credential expired or was revoked. Reconnect the session in Circular to authorize the same agent again; the global account key was not used.`,
+        response.status,
+        parsed,
+      );
+    }
     const detail =
       parsed && typeof parsed === "object" && parsed.error ? parsed.error : response.statusText;
     throw new ApiError(`${method} ${path} failed (${response.status}): ${detail}`, response.status, parsed);

package/lib/vendor/config.mjs

@@ -42,20 +42,25 @@ export function readConfigFile(path = configFilePath()) {
  * CLI flags; `env` defaults to process.env; `file` is the parsed config file.
  */
 export function resolveConfig(flags = {}, env = process.env, file = {}) {
+  const agentParticipantId = env.CIRCULAR_AGENT_PARTICIPANT_ID?.trim();
+  const authorizingUserId = env.CIRCULAR_AUTHORIZING_USER_ID?.trim();
   const pick = (flagKey, envKey, fileKey, fallback) => {
     if (flags[flagKey] !== undefined && flags[flagKey] !== true) return flags[flagKey];
     if (env[envKey]) return env[envKey];
-    if (file[fileKey]) return file[fileKey];
+    if (file[fileKey] && !(agentParticipantId && fileKey === "apiKey")) return file[fileKey];
     return fallback;
   };
 
   return {
+    // A bound session cannot borrow the operator's global credential, including
+    // when its delegated key is missing rather than rejected by the server.
     apiKey: pick("api-key", "CIRCULAR_API_KEY", "apiKey", undefined),
     baseUrl: stripTrailingSlash(
       pick("base-url", "CIRCULAR_BASE_URL", "baseUrl", DEFAULT_BASE_URL)
     ),
     workspaceId: pick("workspace", "CIRCULAR_WORKSPACE_ID", "workspaceId", undefined),
     teamId: pick("team", "CIRCULAR_TEAM_ID", "teamId", undefined),
+    ...(agentParticipantId ? { agentParticipantId, ...(authorizingUserId ? { authorizingUserId } : {}) } : {}),
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zvndev/circular-mcp",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Dependency-free stdio MCP server for the Circular Agent API — plan work into Circular as tracked tasks and subtasks.",
   "keywords": [
     "circular",