Repository navigation
Conversation
Describe how akt selects a Console team and project: the context fields, the flags and environment variables that override them, the x-organization-id and x-project-id headers, the new organization and project commands, project-bound API keys, the team error codes and the MCP project parameter. Update the README, the akt-cli skill and add a changelog fragment. Part of CON-1265.
Contexts store a Console team and project, and flags or environment variables override them per command. The Console client sends the x-organization-id and x-project-id headers only when a value is selected, so accounts without teams see no change. Add organization and project commands, deployment move, project-bound API key creation, team and role in whoami, explained team refusals, deployment-scoped gateway tokens for project-limited keys, and the MCP project parameter. Refresh the vendored Console OpenAPI spec, which already lists the team routes. Part of CON-1265.
When akt mcp starts with a Console project (--console-project, AKT_CONSOLE_PROJECT, or the context), a tool call could name another project the API key reaches and act there, for example close a deployment in it. The operator, not the model, should decide where the server acts. A pinned server now accepts a project argument only when it resolves to the pinned project, and refuses any other with a tool error before any deployment request. Without a pinned project the argument still selects the project for the call. console_list_projects no longer invites a switch on a pinned server. Part of CON-1265.
The refusal printed no next step. It now points at deleting an unused project or reusing an existing one, and says the default project counts toward the limit; SPEC and the agent skill say the same. The OpenAPI snapshot note said the served reference still hides the team and project routes, which stops being true once Console publishes them. It now says the snapshot predates the public reference.
baktun14
marked this pull request as ready for review
October 21, 2026 16:31
baktun14
force-pushed
the
feat/teams-and-projects
branch
from
October 21, 2026 16:31
7eff11b to
32cee7a
Compare
The vendored OpenAPI document was pinned at Console 5037f6c from 2026-10-18. Pin it to 77f1b6c, the console-api/v3.332.0 release, whose openapi.json matches Console main today. Console now publishes name and description patterns written for JavaScript, with lowercase \u escapes that kin-openapi cannot compile. Compile them through a small shim so the contract test enforces them, and add a negative control that a bidi override in a project name is flagged.
Since Console #4581, POST /v1/leases answers 422 provider_manifest_invalid when the provider refuses the manifest itself. The lease already exists and a retry cannot help. akt did not recognize the code: with --manifest the read-back found the active lease and reported success, and on the default sealed path the error came back as an opaque 422. Recognize the code on both paths and fail with a message that the lease exists and is billing, that sending the manifest again cannot help, and that the deployment should be closed and redeployed with a corrected SDL.
Console now refuses an SDL that exposes no port with global: true on create and update (#4581). The SDL library's manifest validation already refuses it locally with "zero global services", so pin that each create and update path, sealed or not, fails before any request.
When a project budget applies, Console prices each deposit before it signs and answers 503 deposit_price_unavailable when it cannot. akt dropped the body of every 5xx, so a create was reconciled against the deployment list and reported as an unknown outcome although nothing was signed. Keep a recognized code on a 5xx, explain deposit_price_unavailable with "nothing was signed, run the same command again", and treat it as a definitive create failure so it is logged as failed and not pending.
Console #4566 refuses project and API key names that carry a control or bidi character or no visible character, and project descriptions with a control character other than a tab or line break. akt sent them and echoed Console's raw validation body. Check the same code point ranges in the existing validators, so the command fails before any request with the offending code point named. The visible-character check is a subset of Console's, so akt never refuses a name Console would accept.
The API key and JWT endpoints exist for every account; only the organization, project, and deployment move endpoints answer 404 until teams are on. Reflow the teams changelog fragment and add a fragment for the Console refusal and contract fixes.
chalabi2
approved these changes
Oct 28, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Console is adding teams and projects. A team member who deploys with
akttoday cannot choose the project a deployment goes into, cannot see which team and project a key acts in, and gets refusalsaktcannot explain.Part of CON-1265. Ships with the Console teams launch.
Merge only once the
organizationsflag is on for every prod user and console-api 3.329.2 or later is live. Both hold today: the flag has been on since 2026-10-27 18:14 UTC, and prod runs console-api 3.331.0.What
akt console project use <project>).--console-organization,--console-project,AKT_CONSOLE_ORGANIZATIONandAKT_CONSOLE_PROJECToverride them for one command. Requests carryx-organization-idandx-project-idonly when a value is selected, so accounts without teams send exactly what they send today.akt console organization list(aliasteam list),akt console project list/get/create/rename/delete/use, andakt console deployment move <dseq> <project>. A project can be named by id, slug or name.akt deployandakt console deployment createfile the deployment in the selected project, anddeployment listfilters by it. Dry runs name the project.akt console apikey create --console-project <project>creates a key limited to one project.apikey listshows each key's team and project, andwhoamishows the active team, role and project.project_required,project_forbidden,organization_mismatch,project_budget_exceeded,project_limit_reachedand the other team codes print the API message and the command that fixes them.akt mcptakes--console-organizationand--console-project, addsconsole_list_organizationsandconsole_list_projects, and the Console deployment tools accept an optionalproject. A server started with a project acts only in it: a tool call naming another project is refused, so a model cannot act outside the project the operator chose.console-api/v3.332.0), whoseopenapi.jsonmatches Console main. Its only addition over 3.331.0 is an optionaltemplateIdthataktdoes not send. Console writes its name patterns for JavaScript, so the contract test compiles them through a small shim and now enforces them.POST /v1/leasesanswers 422provider_manifest_invalid(fix(deployment): refuse an sdl with no public port and stop retrying invalid manifests console#4581),aktfails and says the lease exists, a retry cannot help, and the deployment should be closed and redeployed with a corrected SDL. Before,--manifestreported the lease as created and the default path printed an opaque 422.deposit_price_unavailableon a deployment create is a refusal made before signing.aktnow says nothing was signed and to run the command again, where it used to report an unknown outcome.global: trueport already fails locally in the SDL library. A test pins that no create or update path sends one.Testing
go build,go vet, the unit suite (without e2e),golangci-lintv2.11.4 andmake changelog-check CHANGELOG_BASE=origin/main.