@trainheroic-unofficial/athlete-mcp 1.7.4 → 2.0.1

package/dist/server.mjs

@@ -1,5 +1,5 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { McpServer, acceptedContent, inputRequired, inputResponse } from "@modelcontextprotocol/server";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import process from "node:process";
 import { z } from "zod";
 //#region ../dto/src/common.ts
@@ -338,7 +338,11 @@ const DESTRUCTIVE = {
 	destructiveHint: true,
 	openWorldHint: true
 };
-/** Run a tool body, converting thrown errors into an in-band tool error. */
+/**
+* Run a tool body, converting thrown errors into an in-band tool error. Generic so a caller that
+* only ever produces a `CallToolResult` keeps that narrower type instead of widening to the
+* MRTR union — that is what lets `apiCall` delegate here rather than repeat this catch.
+*/
 async function attempt(fn) {
 	try {
 		return await fn();
@@ -473,32 +477,50 @@ function errorResult(message) {
 }
 //#endregion
 //#region ../core/src/confirm.ts
-const NOT_CONFIRMED = "Not confirmed. Re-run with confirm:true, or connect a client that supports MCP elicitation.";
 /**
-* Confirm a destructive/athlete-facing action. Prefers MCP elicitation (an
-* in-the-moment user prompt); falls back to an explicit confirm:true argument when
-* the client does not support elicitation. Never proceeds without one of the two.
+* Returned when the user was asked and said no. It must not tell the model how to retry: the
+* refusal is the answer. (The `confirm: true` fallback for clients that cannot elicit is
+* advertised in each gated tool's description, which is where a model looks before calling.)
 */
-async function confirmGate(server, requestId, message, confirmArg) {
-	if (confirmArg === true) return true;
-	try {
-		const result = await server.server.elicitInput({
-			message,
-			requestedSchema: {
-				type: "object",
-				properties: { confirm: {
-					type: "boolean",
-					title: "Confirm",
-					description: message
-				} },
-				required: ["confirm"]
-			}
-		}, requestId === void 0 ? void 0 : { relatedRequestId: requestId });
-		return result.action === "accept" && result.content?.confirm === true;
-	} catch (err) {
-		console.warn("MCP elicitation unavailable; treating as not confirmed", err);
-		return false;
-	}
+const NOT_CONFIRMED = "Not confirmed — the user declined. Nothing was changed.";
+/** Appended to the prompt so the fallback survives whichever way a client surfaces the request. */
+const FALLBACK_HINT = " (If you cannot show this prompt, re-run the tool with confirm:true once the user has agreed.)";
+/**
+* Confirm a destructive/athlete-facing action.
+*
+* Prefers MCP multi-round-trip elicitation (`input_required`); falls back to an explicit
+* `confirm:true` argument when the client already confirmed. Never proceeds without one of the two.
+*
+* Returns `undefined` when the action may proceed, otherwise the result to return to the client
+* (`input_required` or an in-band denial).
+*
+* **Call this before any read or write.** MRTR is re-entrant: the client answers by re-sending
+* the whole `tools/call`, and the stateless handler builds a fresh server and runs the handler
+* from the top. Anything above the gate therefore executes twice on a confirmed action. If a
+* confirmation message ever needs data fetched first, that fetch must be idempotent.
+*
+* Written once in the 2026 `inputRequired` style: modern clients retry with `inputResponses`.
+* A client that cannot elicit at all never reaches the denial below — the SDK rejects the
+* request before the retry — so it must pass `confirm: true`, which is why the hint rides inside
+* the prompt text itself.
+*/
+function confirmGate(ctx, message, confirmArg) {
+	if (confirmArg === true) return void 0;
+	if (acceptedContent(ctx.mcpReq.inputResponses, "confirm")?.confirm === true) return void 0;
+	if (inputResponse(ctx.mcpReq.inputResponses, "confirm").kind !== "missing") return errorResult(NOT_CONFIRMED);
+	const prompt = message + FALLBACK_HINT;
+	return inputRequired({ inputRequests: { confirm: inputRequired.elicit({
+		message: prompt,
+		requestedSchema: {
+			type: "object",
+			properties: { confirm: {
+				type: "boolean",
+				title: "Confirm",
+				description: prompt
+			} },
+			required: ["confirm"]
+		}
+	}) } });
 }
 //#endregion
 //#region ../core/src/instructions.ts
@@ -574,20 +596,27 @@ var TrainHeroicAuthError = class extends Error {
 	name = "TrainHeroicAuthError";
 };
 /**
-* Authenticated TrainHeroic API client. Holds the coach credentials (from the grant's
-* encrypted props) and a lazily-acquired session token cached in memory for the life
-* of the Durable Object instance. On a 401/403 it re-logs in once and retries, since
+* Authenticated TrainHeroic API client. Holds the credentials (on the hosted Worker, from the
+* grant's encrypted props) and a lazily-acquired session token cached in memory for the life of
+* *this client instance* — nothing longer. On a 401/403 it re-logs in once and retries, since
 * TrainHeroic has no refresh token and sessions expire after ~1-2h.
+*
+* Anything that wants a session to outlive one client owns that itself: pass a previously
+* acquired token as `sessionId` and keep the new one via `options.onSession`. That matters
+* wherever clients are short-lived — the hosted Worker builds one per HTTP request, and each CLI
+* invocation is a fresh process — because otherwise every operation replays the password.
 */
 var TrainHeroicClient = class {
 	#email;
 	#password;
+	#onSession;
 	#sessionId;
 	#loginInFlight = null;
-	constructor(email, password, sessionId = null) {
+	constructor(email, password, sessionId = null, options = {}) {
 		this.#email = email;
 		this.#password = password;
 		this.#sessionId = sessionId;
+		this.#onSession = options.onSession;
 	}
 	get sessionId() {
 		return this.#sessionId;
@@ -605,6 +634,9 @@ var TrainHeroicClient = class {
 		const session = await loginTrainHeroic(this.#email, this.#password);
 		if (!session) throw new TrainHeroicAuthError("TrainHeroic login failed");
 		this.#sessionId = session.sessionId;
+		try {
+			this.#onSession?.(this.#sessionId);
+		} catch {}
 		return this.#sessionId;
 	}
 	async request(method, path, options = {}) {
@@ -1942,7 +1974,8 @@ function registerSessionTools(server, ctx) {
 		annotations: DESTRUCTIVE
 	}, ({ programWorkoutId, date, confirm }, extra) => attempt(async () => {
 		const id = toId(programWorkoutId);
-		if (!await confirmGate(server, extra.requestId, `Permanently remove personal session ${id} on ${date}? This deletes the session and anything logged in it.`, confirm)) return errorResult(NOT_CONFIRMED);
+		const blocked = confirmGate(extra, `Permanently remove personal session ${id} on ${date}? This deletes the session and anything logged in it.`, confirm);
+		if (blocked) return blocked;
 		await removePersonalWorkout(ctx.client, {
 			programWorkoutId: id,
 			date
@@ -1982,7 +2015,8 @@ function registerLogTool(server, ctx) {
 		},
 		annotations: DESTRUCTIVE
 	}, ({ date, exercises, confirm }, extra) => attempt(async () => {
-		if (!await confirmGate(server, extra.requestId, `Log a session of ${exercises.length} exercise(s) on ${date}? This writes to your coach-visible training log.`, confirm)) return errorResult(NOT_CONFIRMED);
+		const blocked = confirmGate(extra, `Log a session of ${exercises.length} exercise(s) on ${date}? This writes to your coach-visible training log.`, confirm);
+		if (blocked) return blocked;
 		const res = await logAdHocSession(ctx.client, {
 			date,
 			exercises: mapSessionExercises(exercises)
@@ -1999,7 +2033,8 @@ function registerLogTool(server, ctx) {
 		},
 		annotations: DESTRUCTIVE
 	}, ({ date, savedWorkoutSetId, results, confirm }, extra) => attempt(async () => {
-		if (!await confirmGate(server, extra.requestId, `Log results to saved workout set ${toId(savedWorkoutSetId)} on ${date}? This writes to your coach-visible training log.`, confirm)) return errorResult(NOT_CONFIRMED);
+		const blocked = confirmGate(extra, `Log results to saved workout set ${toId(savedWorkoutSetId)} on ${date}? This writes to your coach-visible training log.`, confirm);
+		if (blocked) return blocked;
 		return jsonResult(await logAthleteSet(ctx.client, {
 			date,
 			savedWorkoutSetId: toId(savedWorkoutSetId),
@@ -2025,7 +2060,8 @@ function registerSwapTool(server, ctx) {
 	}, ({ savedWorkoutSetExerciseId, exerciseId, confirm }, extra) => attempt(async () => {
 		const sweId = toId(savedWorkoutSetExerciseId);
 		const exId = toId(exerciseId);
-		if (!await confirmGate(server, extra.requestId, `Swap the exercise in your saved workout slot ${sweId} to exercise ${exId}? This changes what that slot is prescribed (your copy only).`, confirm)) return errorResult(NOT_CONFIRMED);
+		const blocked = confirmGate(extra, `Swap the exercise in your saved workout slot ${sweId} to exercise ${exId}? This changes what that slot is prescribed (your copy only).`, confirm);
+		if (blocked) return blocked;
 		return jsonResult(await swapAthleteExercise(ctx.client, {
 			savedWorkoutSetExerciseId: sweId,
 			exerciseId: exId
@@ -2061,10 +2097,10 @@ function registerAthleteTrainingTools(server, ctx) {
 }
 //#endregion
 //#region package.json
-var version = "1.7.4";
+var version = "2.0.1";
 //#endregion
 //#region src/server.ts
-async function main() {
+function main() {
 	const email = process.env.TRAINHEROIC_EMAIL;
 	const password = process.env.TRAINHEROIC_PASSWORD;
 	if (!email || !password) {
@@ -2072,13 +2108,15 @@ async function main() {
 		process.exit(1);
 	}
 	const client = new TrainHeroicClient(email, password);
-	const server = new McpServer({
-		name: "trainheroic-athlete",
-		version
-	}, { instructions: SERVER_INSTRUCTIONS });
-	registerAthleteTrainingTools(server, { client });
-	await server.connect(new StdioServerTransport());
-}
-await main();
+	serveStdio(() => {
+		const server = new McpServer({
+			name: "trainheroic-athlete",
+			version
+		}, { instructions: SERVER_INSTRUCTIONS });
+		registerAthleteTrainingTools(server, { client });
+		return server;
+	});
+}
+main();
 //#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trainheroic-unofficial/athlete-mcp",
-  "version": "1.7.4",
+  "version": "2.0.1",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -19,16 +19,16 @@
     "dist"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "zod": "^4.4.3",
-    "@trainheroic-unofficial/core": "1.7.4",
-    "@trainheroic-unofficial/js": "1.7.4"
+    "@trainheroic-unofficial/core": "2.0.1",
+    "@trainheroic-unofficial/js": "2.0.1"
   },
   "devDependencies": {
-    "@types/node": "^26.1.0",
-    "tsdown": "^0.22.3",
-    "tsx": "^4.23.0",
-    "typescript": "^6.0.3",
+    "@types/node": "^26.1.2",
+    "tsdown": "^0.22.14",
+    "tsx": "^4.23.4",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.10"
   },
   "scripts": {