@gehlich/calicomp-mcp 1.0.0 → 1.1.0

package/README.md

@@ -41,6 +41,36 @@ CalisthenicsCompanion-MCP/
 | `CALICOMP_KEY` | AES-256 encryption key in raw base64 (no prefix). Exported from the app alongside the PAT. |
 | `CALICOMP_SERVER_URL` | *(Optional)* Override the API base URL. Defaults to `https://api.calicompanion.de`. |
 
+## Credential Storage
+
+The "Copy MCP config" button in the app's PAT settings screen produces the JSON block shown
+under [Usage](#usage) below, with `CALICOMP_PAT` and `CALICOMP_KEY` filled in. That block is not
+an ordinary configuration snippet — **both values are plaintext secrets**. `CALICOMP_KEY` in
+particular is what turns the encrypted payload the server stores back into readable training
+data; the server itself only ever sees ciphertext. Treat the whole block the same way you would
+treat a password.
+
+**Where it must NOT go:** any file your project's version control tracks. Pasting the block into
+a repo-committed config file — even a "local" one that ends up staged by accident — puts a live
+token and decryption key into git history, which is not something a later `git rm` undoes.
+
+**Where it should go instead:** a file outside any repository that only your own user account
+can read (`chmod 600`), or your MCP client's user-scope server registration instead of a
+project-scope one. Concretely, the same approach this project uses for its own recurring MCP
+calls: an env file under your user config directory (e.g. `~/.config/calicomp/mcp.env`, mode
+`600`) that a wrapper script or your client's env-var substitution reads at invocation time — or,
+if your client supports it directly, register the server in its *user* config rather than a
+project's `.mcp.json` (Claude Code, for example, distinguishes `claude mcp add --scope user` from
+a project-scoped registration). Either way, the secret lives in exactly one place your user
+account controls, never in a directory a `git add .` could reach.
+
+**What the snippet leaves out:** `CALICOMP_SERVER_URL`. For the hosted default
+(`https://api.calicompanion.de`, see the table above) this is harmless — the server falls back to
+that same default when the variable is absent, so registration works without it. If you run your
+own server, however, the snippet gives you no hint that this variable exists or that you need to
+add it by hand; without it you will silently talk to the wrong server with no error message
+pointing at the cause. Add `CALICOMP_SERVER_URL` to the `env` block yourself in that case.
+
 ## Transport
 
 Runs as a local stdio MCP server. The LLM client communicates via JSON-RPC 2.0
@@ -64,6 +94,29 @@ exclusive JSON-RPC channel.
 }
 ```
 
+## Exercise Catalog: Curated Entries and Custom Exercises (since 1.1.0)
+
+`get_exercise_catalog` — and every training-state calculation that resolves an exercise id —
+returns two kinds of entries, distinguished by the `origin` field:
+
+- **`"CATALOG"`** — the curated, admin-maintained catalog (`GET /api/exercises`). These carry
+  muscle-group, equipment and capability-axis ratings.
+- **`"CUSTOM"`** — a user's own exercise, created because they cannot write to the curated
+  catalog at all. For the closed test circle this is the normal case, not an exception: a custom
+  exercise is real training data, but it carries **no** muscle, equipment or capability rating —
+  there is nothing to invent, so those fields are always empty. Treat an empty rating as "not
+  rated", never as a measured zero.
+
+**This does not replace curating the catalog.** If you have admin access and can run the
+catalog round trip (`tools/exercise.mjs` in the super-repo), your own exercises still belong in
+the curated catalog — cleanly, with real ratings. The `CUSTOM` read path exists for everyone who
+cannot do that, so their training data is not silently invisible to the coach. Two user groups,
+two answers; this section covers the one that has no other option.
+
+`propose_new_exercise`'s duplicate check only ever matches against `"CATALOG"` entries — a
+proposal for a new catalog exercise can never be blocked by someone else's same-named custom
+exercise.
+
 ## Building
 
 ```bash

package/dist/index.js

@@ -848,9 +848,34 @@ function normalizeCatalog(wireCatalog) {
     ...ex,
     capabilities: ex.capabilities ?? [],
     equipment: ex.equipment ?? [],
-    isSkill: ex.isSkill ?? false
+    isSkill: ex.isSkill ?? false,
+    origin: "CATALOG"
   }));
 }
+function projectUserExerciseToCatalog(ex, allTranslations) {
+  const translations = allTranslations.filter((t) => t.exerciseId === ex.id).map((t) => ({
+    languageCode: t.languageCode,
+    name: t.name,
+    description: t.description
+  }));
+  return {
+    id: ex.id,
+    key: `user_exercise:${ex.id}`,
+    nameEn: ex.name,
+    mode: ex.mode,
+    usesWeight: ex.usesWeight,
+    description: ex.description,
+    lastModifiedAt: ex.updatedAt,
+    translations,
+    // Never invented — an unrated exercise contributes nothing to a weighted evaluation, and a
+    // fabricated non-empty value here would look like a real measurement (T-141-80).
+    muscleGroups: [],
+    equipment: [],
+    isSkill: false,
+    capabilities: [],
+    origin: "CUSTOM"
+  };
+}
 async function doFetch(pat2, keyB642, serverUrl2) {
   const [rawSnapshot, profile, rawCatalog] = await Promise.all([
     fetchSnapshot(pat2, serverUrl2),
@@ -858,7 +883,10 @@ async function doFetch(pat2, keyB642, serverUrl2) {
     fetchCatalog(serverUrl2)
   ]);
   const snapshot = decryptMerge(rawSnapshot, keyB642);
-  const catalog = normalizeCatalog(rawCatalog);
+  const curatedCatalog = normalizeCatalog(rawCatalog);
+  const curatedIds = new Set(curatedCatalog.map((ex) => ex.id));
+  const projectedUserExercises = snapshot.exercises.filter((ex) => !ex.deletedAt && !curatedIds.has(ex.id)).map((ex) => projectUserExerciseToCatalog(ex, snapshot.exerciseTranslations));
+  const catalog = [...curatedCatalog, ...projectedUserExercises];
   return { snapshot, catalog, profile, fetchedAt: Date.now() };
 }
 async function getSnapshot(pat2, keyB642, serverUrl2) {
@@ -1437,7 +1465,7 @@ function registerToolGetExerciseCatalog(server2, cfg) {
     "get_exercise_catalog",
     {
       title: "Get Exercise Catalog",
-      description: 'Return the full exercise catalog with muscle groups, equipment, and optional localized names. Provide `lang` (e.g. "de", "fr") to add a `localizedName` field (falls back to `nameEn` when no translation exists). Use `muscleGroups[].key` with `get_stats { by: "muscle" }` to query aggregates by muscle group.',
+      description: 'Return the full exercise catalog with muscle groups, equipment, and optional localized names. Provide `lang` (e.g. "de", "fr") to add a `localizedName` field (falls back to `nameEn` when no translation exists). Use `muscleGroups[].key` with `get_stats { by: "muscle" }` to query aggregates by muscle group. The result includes both curated catalog entries AND the user\'s own custom exercises \u2014 check `origin` ("CATALOG" vs "CUSTOM") to tell them apart. A "CUSTOM" entry carries no muscle-group, equipment or capability-axis rating, so it never contributes to a weighted evaluation (muscle balance, capability balance) \u2014 treat that absence as "not rated", never as a real zero.',
       inputSchema: GetExerciseCatalogSchema,
       annotations: { readOnlyHint: true }
     },
@@ -2534,7 +2562,7 @@ function findCatalogMatch(proposedName, catalog) {
   const key = normalizeExerciseName(proposedName);
   if (!key) return void 0;
   return catalog.find(
-    (ex) => normalizeExerciseName(ex.nameEn) === key || ex.translations.some((t) => normalizeExerciseName(t.name) === key)
+    (ex) => ex.origin === "CATALOG" && (normalizeExerciseName(ex.nameEn) === key || ex.translations.some((t) => normalizeExerciseName(t.name) === key))
   );
 }
 

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@gehlich/calicomp-mcp",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Local stdio MCP for CalisthenicsCompanion",
   "type": "module",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/Packi1992/calicomp-mcp"
+    "url": "git+https://github.com/Packi1992/calicomp-mcp.git"
   },
   "bin": {
     "calicomp-mcp": "dist/index.js"