@dynamicsninja/garminconnect-mcp 0.7.1 → 0.8.0

package/README.md

@@ -21,7 +21,19 @@ Unofficial: not made by, or affiliated with, Garmin.
 
 ## Set up
 
-### 1. Install
+### Easiest: the Claude Desktop Extension
+
+1. Download `garminconnect-mcp-<version>.mcpb` from the
+   [latest release](https://github.com/DynamicsNinja/garminconnect-js/releases/latest).
+2. Double-click it (or drag it onto Claude Desktop's Settings → Extensions) and choose **Install**.
+3. Ask Claude something about your Garmin data. The first time, Claude opens a Garmin sign-in page
+   in your browser; sign in there (with your MFA code if you use one) and tell Claude you're done.
+
+Optional settings (tool groups, download folder) are under Settings → Extensions → Garmin Connect.
+
+### Other ways to install: npm
+
+#### 1. Install
 
 ```sh
 npm install -g @dynamicsninja/garminconnect-mcp
@@ -31,7 +43,7 @@ Install it once rather than running it through `npx`: Claude Desktop starts seve
 server at the same moment, and parallel `npx` installs into one cache folder can break each other
 (`ERR_MODULE_NOT_FOUND … ajv/dist/2020.js`).
 
-### 2. Sign in to Garmin
+#### 2. Sign in to Garmin
 
 In a terminal (your password never passes through Claude):
 
@@ -42,7 +54,7 @@ garminconnect-mcp login
 It asks for your Garmin email, password and, if you use it, your MFA code. The session is saved to
 `~/.garminconnect-mcp/tokens` and renews itself as long as it is used at least once every 30 days.
 
-### 3. Add it to Claude Desktop
+#### 3. Add it to Claude Desktop
 
 Settings → Developer → **Edit Config**, and add a `garmin` entry to `claude_desktop_config.json`.
 Point `node` at the installed server. To find the path, run `npm root -g` and append
@@ -76,7 +88,7 @@ Point `node` at the installed server. To find the path, run `npm root -g` and ap
 
 If `node` itself is not found (common with nvm), use its full path from `which node` as `command`.
 
-### 4. Restart Claude Desktop
+#### 4. Restart Claude Desktop
 
 **Quit it completely**: tray / menu-bar icon → Quit. Closing the window leaves it running, and it
 will not read the new config. Start it again, open a new chat, and the Garmin tools appear under
@@ -105,6 +117,8 @@ destructive, and Claude is told to confirm with you before using them.
 
 ## What it can do
 
+- **`sign_in_to_garmin`**: signs you in through a page that opens in your browser, MFA included —
+  no terminal needed. See [Easiest: the Claude Desktop Extension](#easiest-the-claude-desktop-extension) above.
 - **Workouts**: `preview_workout`, `create_workout`, `update_workout`, `search_exercises`, for
   running, cycling, swimming, strength, HIIT, yoga, pilates, mobility, cardio, rucking and
   multi-sport; plus listing, scheduling, sending to your watch and deleting.
@@ -121,7 +135,7 @@ checked `create_workout` replaces them), and the raw GraphQL passthrough unless
 |---|---|---|
 | `GARMIN_MCP_TOKEN_DIR` | `~/.garminconnect-mcp/tokens` | Where the session is saved |
 | `GARMIN_MCP_DOWNLOAD_DIR` | `~/Downloads/garmin` | Where downloaded files (FIT, GPX, …) go |
-| `GARMIN_MCP_GROUPS` | all | Comma-separated tool groups: `wellness`, `activities`, `metrics`, `workouts`, `gear`, `courses`, `devices`, `badges-challenges`, `body-composition-weight`, `womens-health`, `golf`, `profile-and-misc`. The workout-builder tools are always on. Fewer groups means less of Claude's context used. |
+| `GARMIN_MCP_GROUPS` | all | Comma-separated tool groups: `wellness`, `activities`, `metrics`, `workouts`, `gear`, `courses`, `devices`, `badges-challenges`, `body-composition-weight`, `womens-health`, `golf`, `profile-and-misc`. Matched case-insensitively; an unknown name is ignored (and if none you list are valid, everything loads). The workout-builder tools are always on. Fewer groups means less of Claude's context used. |
 | `GARMIN_MCP_ENABLE_GRAPHQL` | off | Set to `1` to expose `query_garmin_graphql` |
 
 Set them under `"env"` in the config entry, for example:
@@ -142,8 +156,11 @@ session.
 
 - **The tools don't appear.** Make sure Claude Desktop was fully quit and restarted (step 4). Then
   Settings → Developer → `garmin` shows the server's status and a link to its log.
-- **"Not logged in to Garmin"** or **"session expired"**: run `garminconnect-mcp login` again. The
-  running server picks up the new session on the next request; no restart needed.
+- **"Not logged in to Garmin"** or **"session expired"**: ask Claude to sign in again (it calls
+  `sign_in_to_garmin`), or run `garminconnect-mcp login` again. The running server picks up the new
+  session on the next request; no restart needed.
+- **Sign-in page didn't open**: Claude's reply includes the link; open it in any browser on this
+  computer. It expires after 15 minutes — ask Claude to sign in again.
 - **`ERR_MODULE_NOT_FOUND`** after trying `npx`: delete the `_npx` folder in your npm cache
   (`npm config get cache` shows where) and use the global install above.
 - **"Garmin is rate limiting requests"**: Garmin throttles bursts of calls. Wait a minute and ask
@@ -175,6 +192,6 @@ claude mcp add garmin -- garminconnect-mcp
 
 - Dates are calendar dates in UTC (`YYYY-MM-DD`).
 - Everything runs on your machine. Your Garmin session stays in your token folder and is sent only
-  to Garmin.
+  to Garmin. See [PRIVACY.md](PRIVACY.md) for the full picture.
 - Garmin Connect's API is unofficial and can change. This server is released in lockstep with
   garminconnect-js, and each release is tested against the library version it contains.

package/dist/cli.js

@@ -1,13 +1,12 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { createRequire } from "module";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // ../src/errors.ts
 var GarminError = class extends Error {
-  constructor(message, options) {
-    super(message, options);
+  constructor(message2, options) {
+    super(message2, options);
     this.name = new.target.name;
     Error.captureStackTrace?.(this, new.target);
   }
@@ -17,15 +16,15 @@ var GarminAuthError = class extends GarminError {
 var GarminConnectionError = class extends GarminError {
 };
 var GarminRateLimitError = class extends GarminError {
-  constructor(message, retryAfter, options) {
-    super(message, options);
+  constructor(message2, retryAfter, options) {
+    super(message2, options);
     this.retryAfter = retryAfter;
   }
   retryAfter;
 };
 var GarminHttpError = class extends GarminError {
-  constructor(message, status, url, body, options) {
-    super(message, options);
+  constructor(message2, status, url, body, options) {
+    super(message2, options);
     this.status = status;
     this.url = url;
     this.body = body;
@@ -354,18 +353,18 @@ var CSRF_RE = /name="_csrf"\s+value="(.+?)"/;
 var TITLE_RE = /<title>([\s\S]*?)<\/title>/i;
 var TICKET_RE = /\?ticket=(ST-[^"&\s]+)/;
 var MFA_VAR_RE = /var\s+(customerGuid|mfaMethod|locale|clientId|codeSentTo)\s*=\s*"([^"]*)"\s*;/g;
-function csrfFrom(html) {
-  return CSRF_RE.exec(html)?.[1] ?? null;
+function csrfFrom(html2) {
+  return CSRF_RE.exec(html2)?.[1] ?? null;
 }
-function titleFrom(html) {
-  return TITLE_RE.exec(html)?.[1]?.trim() ?? "";
+function titleFrom(html2) {
+  return TITLE_RE.exec(html2)?.[1]?.trim() ?? "";
 }
-function ticketFrom(html) {
-  return TICKET_RE.exec(html)?.[1] ?? null;
+function ticketFrom(html2) {
+  return TICKET_RE.exec(html2)?.[1] ?? null;
 }
-function mfaVarsFrom(html) {
+function mfaVarsFrom(html2) {
   const vars = {};
-  for (const [, name, value] of html.matchAll(MFA_VAR_RE)) {
+  for (const [, name, value] of html2.matchAll(MFA_VAR_RE)) {
     if (name !== void 0 && value !== void 0) vars[name] = value;
   }
   return vars;
@@ -428,8 +427,8 @@ async function widgetLogin(email, password, fetcher, domain, opts) {
     body: new URLSearchParams({ username: email, password, embed: "true", _csrf: csrf }).toString(),
     timeoutMs: 3e4
   });
-  const html = await res.text();
-  const title = titleFrom(html);
+  const html2 = await res.text();
+  const title = titleFrom(html2);
   const lower2 = title.toLowerCase();
   if (isServerErrorTitle(title)) {
     throw new GarminConnectionError(`Widget login: server error '${title}'`);
@@ -440,9 +439,9 @@ async function widgetLogin(email, password, fetcher, domain, opts) {
   if (RESTRICTED_HINTS.some((h) => lower2.includes(h))) {
     throw new GarminAuthError(`SSO error: ACCOUNT_RESTRICTED: ${title}`);
   }
-  const vars = mfaVarsFrom(html);
+  const vars = mfaVarsFrom(html2);
   if (lower2.includes("mfa") || vars.mfaMethod) {
-    const mfaCsrf = csrfFrom(html);
+    const mfaCsrf = csrfFrom(html2);
     if (!mfaCsrf) throw new GarminConnectionError("Widget login: MFA page has no CSRF token");
     const mfaReferer = fetcher.lastUrl ?? urls.signin;
     await requestMfaCode(fetcher, urls.base, vars, mfaReferer);
@@ -462,7 +461,7 @@ async function widgetLogin(email, password, fetcher, domain, opts) {
   if (title !== "Success") {
     throw new GarminConnectionError(`Widget login: unexpected page '${title}'`);
   }
-  const ticket = ticketFrom(html);
+  const ticket = ticketFrom(html2);
   if (!ticket) throw new GarminAuthError("Widget login: missing service ticket");
   return opts.complete(ticket, urls.embed);
 }
@@ -481,13 +480,13 @@ async function widgetResume(state, code, fetcher, complete) {
     }).toString(),
     timeoutMs: 3e4
   });
-  const html = await res.text();
-  const title = titleFrom(html);
+  const html2 = await res.text();
+  const title = titleFrom(html2);
   if (isServerErrorTitle(title)) {
     throw new GarminConnectionError(`Widget MFA: server error '${title}'`);
   }
   if (title !== "Success") throw new GarminAuthError(`SSO error: INVALID_MFA_CODE: ${title}`);
-  const ticket = ticketFrom(html);
+  const ticket = ticketFrom(html2);
   if (!ticket) throw new GarminAuthError("Widget login: missing service ticket");
   return complete(ticket, urls.embed);
 }
@@ -534,8 +533,8 @@ async function parseJson(res) {
 function requireSuccess(body) {
   const type = body.responseStatus?.type ?? "UNKNOWN";
   if (type !== SSO_SUCCESSFUL) {
-    const message = body.responseStatus?.message;
-    throw new GarminAuthError(`SSO error: ${message ? `${type}: ${message}` : type}`);
+    const message2 = body.responseStatus?.message;
+    throw new GarminAuthError(`SSO error: ${message2 ? `${type}: ${message2}` : type}`);
   }
   return body;
 }
@@ -574,16 +573,16 @@ async function mobileCredentials(email, password, ctx, params) {
 var WIDGET_CONTEXT = "Mobile login rate limited; ";
 function explainWidgetFailure(err) {
   if (!(err instanceof GarminError) || err instanceof GarminRateLimitError) return err;
-  const message = WIDGET_CONTEXT + err.message;
+  const message2 = WIDGET_CONTEXT + err.message;
   const options = { cause: err };
   if (err instanceof GarminAuthError) {
-    return err.message.startsWith("SSO error:") ? err : new GarminAuthError(message, options);
+    return err.message.startsWith("SSO error:") ? err : new GarminAuthError(message2, options);
   }
-  if (err instanceof GarminConnectionError) return new GarminConnectionError(message, options);
+  if (err instanceof GarminConnectionError) return new GarminConnectionError(message2, options);
   if (err instanceof GarminHttpError) {
-    return new GarminHttpError(message, err.status, err.url, err.body, options);
+    return new GarminHttpError(message2, err.status, err.url, err.body, options);
   }
-  return err.constructor === GarminError ? new GarminError(message, options) : err;
+  return err.constructor === GarminError ? new GarminError(message2, options) : err;
 }
 async function login(email, password, ctx) {
   const params = loginParamsFor(ctx.domain);
@@ -4274,8 +4273,8 @@ var REPEAT_HINTS = {
 };
 var SpecError = class extends GarminError {
 };
-function fail(path3, message) {
-  throw new SpecError(`${path3}: ${message}`);
+function fail(path3, message2) {
+  throw new SpecError(`${path3}: ${message2}`);
 }
 function show(v) {
   if (v === void 0) return "nothing";
@@ -4620,14 +4619,20 @@ var WORKOUT_SPEC_JSON_SCHEMA = {
 // src/session.ts
 import os from "os";
 import path from "path";
+var setting = (value) => {
+  const v = value?.trim();
+  return v && !v.includes("${") ? v : void 0;
+};
 function loadConfig(env = process.env) {
   const home = os.homedir();
-  const groups = (env["GARMIN_MCP_GROUPS"] ?? "").split(",").map((g) => g.trim()).filter(Boolean);
+  const groups = (setting(env["GARMIN_MCP_GROUPS"]) ?? "").split(",").map((g) => g.trim()).filter(Boolean);
+  const graphql = (setting(env["GARMIN_MCP_ENABLE_GRAPHQL"]) ?? "").toLowerCase();
+  const downloadDir = setting(env["GARMIN_MCP_DOWNLOAD_DIR"]);
   return {
-    tokenDir: env["GARMIN_MCP_TOKEN_DIR"] || path.join(home, ".garminconnect-mcp", "tokens"),
-    downloadDir: env["GARMIN_MCP_DOWNLOAD_DIR"] || path.join(home, "Downloads", "garmin"),
+    tokenDir: setting(env["GARMIN_MCP_TOKEN_DIR"]) ?? path.join(home, ".garminconnect-mcp", "tokens"),
+    downloadDir: downloadDir && path.isAbsolute(downloadDir) ? downloadDir : path.join(home, "Downloads", "garmin"),
     groups: groups.length > 0 ? new Set(groups) : null,
-    enableGraphql: env["GARMIN_MCP_ENABLE_GRAPHQL"] === "1"
+    enableGraphql: graphql === "1" || graphql === "true"
   };
 }
 var NotLoggedInError = class extends GarminAuthError {
@@ -4653,7 +4658,7 @@ function fileSession(tokenDir, options = {}) {
 }
 
 // src/errors.ts
-var LOGIN_HINT = "run `garminconnect-mcp login` in a terminal, then try again";
+var LOGIN_HINT = "call the `sign_in_to_garmin` tool to sign in, then try again";
 function describeError(error) {
   if (error instanceof NotLoggedInError) return `Not logged in to Garmin: ${LOGIN_HINT}.`;
   if (error instanceof GarminAuthError) {
@@ -4733,9 +4738,9 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 
 // src/icon.ts
-var SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect x="22" y="2" width="20" height="60" rx="6" fill="#1f2937"/><circle cx="32" cy="32" r="20" fill="#0f766e"/><circle cx="32" cy="32" r="15" fill="#f8fafc"/><path d="M32 21v11l7 5" fill="none" stroke="#0f766e" stroke-width="3.5" stroke-linecap="round" stroke-linejoin="round"/><rect x="51" y="27" width="5" height="10" rx="2" fill="#1f2937"/></svg>';
+var SERVER_ICON_SVG = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"><rect x="22" y="2" width="20" height="60" rx="6" fill="#1f2937"/><circle cx="32" cy="32" r="20" fill="#0f766e"/><circle cx="32" cy="32" r="15" fill="#f8fafc"/><path d="M32 21v11l7 5" fill="none" stroke="#0f766e" stroke-width="3.5" stroke-linecap="round" stroke-linejoin="round"/><rect x="51" y="27" width="5" height="10" rx="2" fill="#1f2937"/></svg>';
 var SERVER_ICON = {
-  src: `data:image/svg+xml;base64,${Buffer.from(SVG, "utf8").toString("base64")}`,
+  src: `data:image/svg+xml;base64,${Buffer.from(SERVER_ICON_SVG, "utf8").toString("base64")}`,
   mimeType: "image/svg+xml",
   sizes: ["any"]
 };
@@ -9571,16 +9576,296 @@ function toolFor(m, deps) {
     }
   };
 }
+var KNOWN_GROUPS = new Set(GARMIN_METHODS.map((m) => m.category));
+function resolveGroups(requested) {
+  if (requested === null) return null;
+  const byLower = new Map([...KNOWN_GROUPS].map((g) => [g.toLowerCase(), g]));
+  const resolved = /* @__PURE__ */ new Set();
+  const unknown = [];
+  for (const raw of requested) {
+    const match = byLower.get(raw.trim().toLowerCase());
+    if (match) resolved.add(match);
+    else unknown.push(raw);
+  }
+  if (unknown.length > 0) {
+    process.stderr.write(
+      `garminconnect-mcp: ignoring unknown GARMIN_MCP_GROUPS value(s): ${unknown.join(", ")}. Valid: ${[...KNOWN_GROUPS].sort().join(", ")}
+`
+    );
+  }
+  if (resolved.size === 0) {
+    process.stderr.write("garminconnect-mcp: no valid GARMIN_MCP_GROUPS value remained; loading all tool groups.\n");
+    return null;
+  }
+  return resolved;
+}
 var methodTools = (deps) => {
-  const known = new Set(GARMIN_METHODS.map((m) => m.category));
-  if (deps.config.groups) {
-    const unknown = [...deps.config.groups].filter((g) => !known.has(g));
-    if (unknown.length > 0) {
-      throw new Error(`Unknown GARMIN_MCP_GROUPS value(s): ${unknown.join(", ")}. Valid: ${[...known].sort().join(", ")}`);
+  const groups = resolveGroups(deps.config.groups);
+  return GARMIN_METHODS.filter((m) => !Object.hasOwn(EXCLUDED, m.name)).filter((m) => !Object.hasOwn(OPT_IN, m.name) || deps.config[OPT_IN[m.name]]).filter((m) => groups === null || groups.has(m.category)).map((m) => toolFor(m, deps));
+};
+
+// src/signin-tool.ts
+import { spawn } from "child_process";
+
+// src/signin-page.ts
+import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import http from "http";
+var HEADERS = {
+  "content-type": "text/html; charset=utf-8",
+  "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'",
+  "cache-control": "no-store",
+  "x-frame-options": "DENY",
+  "referrer-policy": "no-referrer"
+};
+var MAX_BODY = 16 * 1024;
+var ENTITIES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
+var escape = (s) => s.replace(/[&<>"']/g, (c) => ENTITIES[c] ?? c);
+function html(title, body) {
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escape(title)}</title><style>
+body{font-family:system-ui,sans-serif;background:#f8fafc;color:#0f172a;display:grid;place-items:center;min-height:100vh;margin:0}
+main{background:#fff;border:1px solid #e2e8f0;border-radius:12px;padding:28px;width:min(360px,90vw)}
+h1{font-size:1.25rem;margin:0 0 4px}p{color:#475569;margin:0 0 16px}
+label{display:block;font-size:.9rem;margin:12px 0 4px}input{width:100%;box-sizing:border-box;padding:10px;border:1px solid #cbd5e1;border-radius:8px;font-size:1rem}
+button{margin-top:18px;width:100%;padding:10px;border:0;border-radius:8px;background:#0f766e;color:#fff;font-size:1rem;cursor:pointer}
+.error{background:#fef2f2;color:#991b1b;border-radius:8px;padding:10px;margin-bottom:8px}
+</style></head><body><main>${body}</main></body></html>`;
+}
+function credentialsForm(key2, error, email = "") {
+  return html(
+    "Sign in to Garmin",
+    `<h1>Sign in to Garmin Connect</h1><p>For the Garmin tools in Claude. Your password goes only to Garmin.</p>
+${error ? `<div class="error">${escape(error)}</div>` : ""}
+<form method="post"><input type="hidden" name="key" value="${escape(key2)}"><input type="hidden" name="step" value="credentials">
+<label for="email">Email</label><input id="email" name="email" type="email" autocomplete="username" required value="${escape(email)}">
+<label for="password">Password</label><input id="password" name="password" type="password" autocomplete="current-password" required>
+<button type="submit">Sign in</button></form>`
+  );
+}
+function mfaForm(key2, error) {
+  return html(
+    "Garmin verification code",
+    `<h1>Enter your verification code</h1><p>Garmin sent a code to your email or phone.</p>
+${error ? `<div class="error">${escape(error)}</div>` : ""}
+<form method="post"><input type="hidden" name="key" value="${escape(key2)}"><input type="hidden" name="step" value="mfa">
+<label for="code">Code</label><input id="code" name="code" inputmode="numeric" autocomplete="one-time-code" required>
+<button type="submit">Verify</button></form>`
+  );
+}
+var donePage = (name) => html("Signed in", `<h1>Signed in as ${escape(name)}</h1><p>You can close this tab and go back to Claude.</p>`);
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > MAX_BODY) {
+        reject(new Error("Request too large"));
+        req.destroy();
+      } else chunks.push(c);
+    });
+    req.on("end", () => resolve(new URLSearchParams(Buffer.concat(chunks).toString("utf8"))));
+    req.on("error", reject);
+    req.on("close", () => reject(new Error("Request aborted")));
+  });
+}
+var message = (e) => e instanceof Error ? e.message : String(e);
+async function startSignInPage(options) {
+  const key2 = randomBytes2(32).toString("base64url");
+  const keyBytes = Buffer.from(key2);
+  const isKey = (candidate) => {
+    if (candidate == null) return false;
+    const bytes = Buffer.from(candidate);
+    return bytes.length === keyBytes.length && timingSafeEqual(bytes, keyBytes);
+  };
+  const idleMs = options.idleMs ?? 15 * 6e4;
+  let client = null;
+  let mfaState = null;
+  let finished = false;
+  let signedInName = "your Garmin account";
+  let isClosed = false;
+  let idle;
+  let port = 0;
+  let queue = Promise.resolve();
+  const serialized = (step2) => {
+    const run = queue.then(step2);
+    queue = run.catch(() => {
+    });
+    return run;
+  };
+  let resolveClosed;
+  const closed = new Promise((r) => resolveClosed = r);
+  const server = http.createServer((req, res) => {
+    void handle(req, res).catch(() => {
+      if (!res.headersSent) res.writeHead(500, HEADERS);
+      res.end(html("Error", "<h1>Something went wrong</h1><p>Close this tab and ask Claude to sign in again.</p>"));
+    });
+  });
+  let closing;
+  const close = () => closing ??= new Promise((resolve) => {
+    isClosed = true;
+    clearTimeout(idle);
+    server.close(() => resolve());
+    server.closeAllConnections?.();
+  }).then(resolveClosed);
+  const touch = () => {
+    if (isClosed) return;
+    clearTimeout(idle);
+    idle = setTimeout(() => void close(), idleMs);
+    idle.unref();
+  };
+  const closeAfter = (res) => {
+    if (res.destroyed || res.writableFinished) void close();
+    else res.once("close", () => void close());
+  };
+  const sendDone = (res, name = "your Garmin account") => {
+    closeAfter(res);
+    if (res.destroyed) return;
+    res.writeHead(200, HEADERS);
+    res.end(donePage(name));
+  };
+  const notFound = (res) => {
+    res.writeHead(404, { "cache-control": "no-store" });
+    res.end();
+  };
+  async function handle(req, res) {
+    const path3 = req.url ?? "";
+    if (req.headers.host !== `127.0.0.1:${port}` || !path3.startsWith("/") || !isKey(path3.slice(1))) return notFound(res);
+    touch();
+    const send = (body) => {
+      res.writeHead(200, HEADERS);
+      res.end(body);
+    };
+    if (finished) return sendDone(res, signedInName);
+    if (req.method === "GET") return send(mfaState ? mfaForm(key2) : credentialsForm(key2));
+    if (req.method !== "POST") return notFound(res);
+    const form = await readBody(req);
+    if (!isKey(form.get("key"))) return notFound(res);
+    return serialized(() => step(form, res, send));
+  }
+  async function step(form, res, send) {
+    if (finished) return sendDone(res, signedInName);
+    if (res.destroyed) return;
+    if (isClosed) return notFound(res);
+    if (form.get("step") === "mfa") {
+      if (!client || !mfaState) return send(credentialsForm(key2, "Please sign in again."));
+      const code = (form.get("code") ?? "").replace(/\s+/g, "");
+      try {
+        await client.resumeLogin(mfaState, code);
+      } catch (e) {
+        return send(mfaForm(key2, message(e)));
+      }
+      return finish(res, client);
+    }
+    const email = (form.get("email") ?? "").trim();
+    const password = form.get("password") ?? "";
+    client = null;
+    mfaState = null;
+    const attempt = options.createClient();
+    let result;
+    try {
+      result = await attempt.login(email, password);
+    } catch (e) {
+      return send(credentialsForm(key2, message(e), email));
+    }
+    client = attempt;
+    if (result.state === "mfa_required") {
+      mfaState = result.mfaState;
+      return send(mfaForm(key2));
     }
+    return finish(res, attempt);
   }
-  return GARMIN_METHODS.filter((m) => !Object.hasOwn(EXCLUDED, m.name)).filter((m) => !Object.hasOwn(OPT_IN, m.name) || deps.config[OPT_IN[m.name]]).filter((m) => deps.config.groups === null || deps.config.groups.has(m.category)).map((m) => toolFor(m, deps));
-};
+  async function finish(res, signedIn) {
+    finished = true;
+    mfaState = null;
+    options.onSignedIn();
+    const name = await signedIn.displayName().catch(() => "your Garmin account");
+    signedInName = name;
+    sendDone(res, name);
+  }
+  let onListenError = () => {
+  };
+  await new Promise((resolve, reject) => {
+    onListenError = reject;
+    server.once("error", onListenError);
+    server.listen(0, "127.0.0.1", () => resolve());
+  });
+  server.off("error", onListenError);
+  server.on("error", () => void close());
+  server.unref();
+  server.on("connection", (socket) => socket.unref());
+  port = server.address().port;
+  touch();
+  return { url: `http://127.0.0.1:${port}/${key2}`, closed, close };
+}
+
+// src/signin-tool.ts
+var SAFE_SIGNIN_URL = /^http:\/\/127\.0\.0\.1:\d+\/[A-Za-z0-9_-]+$/;
+function openInBrowser(url) {
+  if (!SAFE_SIGNIN_URL.test(url)) return;
+  const [command2, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(command2, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function tokenStoreClient(tokenDir) {
+  const client = new GarminClient({ tokenStore: new FileTokenStore(tokenDir) });
+  return {
+    login: (email, password) => client.login(email, password),
+    resumeLogin: (state, code) => client.resumeLogin(state, code),
+    displayName: async () => (await new Garmin(client).getUserProfile()).displayName
+  };
+}
+function signInTools(options = {}) {
+  const openUrl = options.openUrl ?? openInBrowser;
+  const createClient = options.createClient ?? tokenStoreClient;
+  const startPage = options.startPage ?? startSignInPage;
+  let page = null;
+  let starting = null;
+  return ({ config: config2, session }) => [
+    {
+      tool: {
+        name: "sign_in_to_garmin",
+        description: "Sign in to Garmin Connect. Call this when another Garmin tool says you are not logged in or the session expired. It opens a sign-in page in the user's browser; the password and MFA code are entered there, never in the chat. Afterwards, ask the user to tell you when they have finished, then retry.",
+        inputSchema: { type: "object", properties: {}, additionalProperties: false },
+        annotations: { title: "Sign in to Garmin", readOnlyHint: false, destructiveHint: false, openWorldHint: true }
+      },
+      async run() {
+        try {
+          const profile = await (await session.get()).getUserProfile();
+          return textResult(`Already signed in to Garmin as ${profile.displayName}.`);
+        } catch (error) {
+          if (!(error instanceof GarminAuthError)) throw error;
+        }
+        if (!page) {
+          starting ??= startPage({
+            createClient: () => createClient(config2.tokenDir),
+            onSignedIn: () => session.reset(),
+            idleMs: options.idleMs
+          });
+          let started;
+          try {
+            started = await starting;
+          } finally {
+            starting = null;
+          }
+          page = started;
+          void started.closed.then(() => {
+            if (page === started) page = null;
+          });
+        }
+        openUrl(page.url);
+        return textResult(
+          `A Garmin sign-in page opened in your browser: ${page.url}
+Sign in there (including any MFA code), then tell me when you're done.`
+        );
+      }
+    }
+  ];
+}
 
 // ../src/exercises.ts
 var EXERCISES = {
@@ -11775,10 +12060,10 @@ ${summarizeWorkout(workout)}`);
 ];
 
 // src/tools.ts
-var TOOL_FACTORIES = [workoutTools, methodTools];
+var TOOL_FACTORIES = [signInTools(), workoutTools, methodTools];
 
 // src/cli.ts
-var { version } = createRequire(import.meta.url)("../package.json");
+var version = "0.8.0";
 var USAGE = `garminconnect-mcp ${version}
 
   garminconnect-mcp          start the MCP server (stdio); Claude Desktop runs this