@trainheroic-unofficial/athlete-mcp 3.5.2 → 3.6.0

package/dist/server.mjs

@@ -1001,30 +1001,200 @@ function confirmGate(ctx, message, confirmArg) {
 const SERVER_INSTRUCTIONS = "Speak to the user in plain, everyday language about their training. Describe what you are doing in the TrainHeroic app's own terms (for example, say you are creating a workout rather than naming a tool). Do not surface internal tool names (the snake_case identifiers such as athlete_session_create), raw parameter names, or numeric ids in your replies unless the user explicitly asks for them; they are implementation details. The tool descriptions cross-reference each other by name only so you can chain them correctly. Keep that wiring to yourself.";
 //#endregion
 //#region ../js/src/http-error.ts
-/**
-* A final non-2xx response from TrainHeroic. The error deliberately carries only request
-* metadata that is safe to send to telemetry: never the path, query string, request body,
-* response body, credentials, or session token.
-*/
+const MAX_REQUEST_KEYS = 50;
+const MAX_RESPONSE_DEPTH = 4;
+const MAX_RESPONSE_KEYS = 20;
+const MAX_RESPONSE_ITEMS = 10;
+const MAX_RESPONSE_NODES = 50;
+const RESPONSE_DIAGNOSTIC_KEYS = /* @__PURE__ */ new Set([
+	"code",
+	"detail",
+	"details",
+	"error",
+	"error_code",
+	"errors",
+	"message",
+	"reason",
+	"status",
+	"status_code",
+	"success"
+]);
+const RESPONSE_CONTAINER_KEYS = /* @__PURE__ */ new Set([
+	"data",
+	"received",
+	"response",
+	"result"
+]);
+const RESPONSE_STATUS_KEYS = /* @__PURE__ */ new Set(["status", "status_code"]);
+const RESPONSE_BOOLEAN_KEYS = /* @__PURE__ */ new Set(["success"]);
+const PARAMETER_TYPES = /* @__PURE__ */ new Set([
+	0,
+	1,
+	2,
+	3,
+	4,
+	5,
+	6,
+	7,
+	10,
+	11,
+	12,
+	13,
+	14,
+	18
+]);
+function safeFieldName(key) {
+	if (key === "__proto__" || key === "constructor" || key === "prototype") return "[Redacted key]";
+	if (!/^[A-Za-z_][A-Za-z0-9_.-]{0,79}$/.test(key)) return "[Redacted key]";
+	return key;
+}
+function boundedEntries(object, limit) {
+	const entries = [];
+	for (const key of Object.keys(object)) {
+		const descriptor = Object.getOwnPropertyDescriptor(object, key);
+		entries.push([key, descriptor && "value" in descriptor ? descriptor.value : void 0]);
+		if (entries.length >= limit) break;
+	}
+	return entries;
+}
+function safeRequestValue(key, value) {
+	if (key === "is_circuit" && typeof value === "boolean") return value;
+	if (["param_1_type", "param_2_type"].includes(key) && typeof value === "number" && PARAMETER_TYPES.has(value)) return value;
+}
+function requestBodySummary(body) {
+	if (Array.isArray(body)) return {
+		type: "array",
+		length: body.length
+	};
+	if (body && typeof body === "object") {
+		const entries = boundedEntries(body, MAX_REQUEST_KEYS).sort(([left], [right]) => left.localeCompare(right));
+		const keys = entries.map(([key]) => safeFieldName(key));
+		const values = {};
+		for (const [key, value] of entries) {
+			const safeValue = safeRequestValue(key, value);
+			if (safeValue !== void 0) values[safeFieldName(key)] = safeValue;
+		}
+		return Object.keys(values).length > 0 ? {
+			type: "object",
+			keys,
+			values
+		} : {
+			type: "object",
+			keys
+		};
+	}
+	const primitive = typeof body;
+	return primitive === "boolean" || primitive === "number" || primitive === "string" ? { type: primitive } : { type: "other" };
+}
+function sanitizedDiagnosticValue(value, depth, budget, field) {
+	if (budget.nodes <= 0) return "[Truncated]";
+	budget.nodes -= 1;
+	if (value === null) return null;
+	if (typeof value === "boolean") return field && RESPONSE_BOOLEAN_KEYS.has(field) ? value : "[Redacted]";
+	if (typeof value === "number") return field && RESPONSE_STATUS_KEYS.has(field) && Number.isInteger(value) && value >= 100 && value <= 599 ? value : "[Redacted]";
+	if (typeof value === "string") return "[Redacted]";
+	if (depth >= MAX_RESPONSE_DEPTH) return "[Truncated]";
+	if (Array.isArray(value)) {
+		const result = [];
+		for (const item of value.slice(0, MAX_RESPONSE_ITEMS)) {
+			if (budget.nodes <= 0) {
+				result.push("[Truncated]");
+				break;
+			}
+			result.push(sanitizedDiagnosticValue(item, depth + 1, budget));
+		}
+		return result;
+	}
+	if (value && typeof value === "object") {
+		const result = {};
+		for (const [key, item] of boundedEntries(value, MAX_RESPONSE_KEYS)) {
+			if (budget.nodes <= 0) {
+				result.truncated = "[Truncated]";
+				break;
+			}
+			const safeKey = safeFieldName(key);
+			const safeValue = safeRequestValue(key, item);
+			if (RESPONSE_DIAGNOSTIC_KEYS.has(key)) result[safeKey] = sanitizedDiagnosticValue(item, depth + 1, budget, key);
+			else if (RESPONSE_CONTAINER_KEYS.has(key) && item && typeof item === "object") result[safeKey] = sanitizedDiagnosticValue(item, depth + 1, budget);
+			else if (safeValue !== void 0) {
+				budget.nodes -= 1;
+				result[safeKey] = safeValue;
+			}
+		}
+		return result;
+	}
+	return `[${typeof value}]`;
+}
+function responseBodyDiagnostics(body, budget, depth = 0) {
+	const activeBudget = budget ?? { nodes: MAX_RESPONSE_NODES };
+	if (activeBudget.nodes <= 0 || depth >= MAX_RESPONSE_DEPTH) return "[Truncated]";
+	if (!body || typeof body !== "object" || Array.isArray(body)) return sanitizedDiagnosticValue(body, depth, activeBudget);
+	const object = body;
+	const result = {};
+	for (const [key, value] of boundedEntries(object, MAX_RESPONSE_KEYS)) {
+		if (activeBudget.nodes <= 0) {
+			result.truncated = "[Truncated]";
+			break;
+		}
+		if (RESPONSE_DIAGNOSTIC_KEYS.has(key)) {
+			result[safeFieldName(key)] = sanitizedDiagnosticValue(value, depth + 1, activeBudget, key);
+			continue;
+		}
+		if (RESPONSE_CONTAINER_KEYS.has(key) && value && typeof value === "object") {
+			activeBudget.nodes -= 1;
+			const nested = responseBodyDiagnostics(value, activeBudget, depth + 1);
+			if (nested === "[Truncated]" || nested && typeof nested === "object" && Object.keys(nested).length > 0) result[safeFieldName(key)] = nested;
+		}
+	}
+	if (Object.keys(result).length > 0) return result;
+	return { type: "object" };
+}
+function parseResponseText(text) {
+	if (text.length === 0) return text;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return text;
+	}
+}
+function safeRequestBodySummary(body) {
+	try {
+		return requestBodySummary(body);
+	} catch {
+		return { type: "other" };
+	}
+}
+function safeResponseBodyDiagnostics(body) {
+	try {
+		return responseBodyDiagnostics(body);
+	} catch {
+		return "[Unavailable]";
+	}
+}
+/** A final non-2xx response plus bounded, telemetry-safe request and response diagnostics. */
 var TrainHeroicHttpError = class extends Error {
 	name = "TrainHeroicHttpError";
 	method;
 	status;
 	host;
-	constructor(method, url, status) {
+	requestBody;
+	responseBody;
+	constructor(method, url, status, diagnostics = {}) {
 		const parsed = new URL(url);
 		const normalizedMethod = method.toUpperCase();
 		super(`TrainHeroic ${normalizedMethod} request failed with HTTP ${status}`);
 		this.method = normalizedMethod;
 		this.status = status;
 		this.host = parsed.host;
+		this.requestBody = diagnostics.requestBody === void 0 ? void 0 : safeRequestBodySummary(diagnostics.requestBody);
+		this.responseBody = diagnostics.responseBody === void 0 ? void 0 : safeResponseBodyDiagnostics(diagnostics.responseBody);
 	}
 };
 /** Call observability hooks without allowing them to change SDK behavior. */
-function notifyHttpError(handler, method, url, status) {
+function notifyHttpError(handler, method, url, status, diagnostics = {}) {
 	if (!handler) return;
 	try {
-		Promise.resolve(handler(new TrainHeroicHttpError(method, url, status))).catch(() => {});
+		Promise.resolve(handler(new TrainHeroicHttpError(method, url, status, diagnostics))).catch(() => {});
 	} catch {}
 }
 //#endregion
@@ -1148,14 +1318,19 @@ var TrainHeroicClient = class {
 			session = await this.#ensureSession();
 			res = await this.#send(method, url, session, options.body);
 		}
-		if (!res.ok && !options.expectedStatuses?.includes(res.status)) notifyHttpError(this.#onHttpError, method, url, res.status);
-		const text = await res.text();
-		let data = text;
-		if (text.length > 0) try {
-			data = JSON.parse(text);
-		} catch {
-			data = text;
+		const shouldReport = !res.ok && !options.expectedStatuses?.includes(res.status);
+		let text;
+		try {
+			text = await res.text();
+		} catch (error) {
+			if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, { requestBody: options.body });
+			throw error;
 		}
+		const data = parseResponseText(text);
+		if (shouldReport) notifyHttpError(this.#onHttpError, method, url, res.status, {
+			requestBody: options.body,
+			responseBody: data
+		});
 		return {
 			status: res.status,
 			ok: res.ok,
@@ -2960,7 +3135,7 @@ function registerAthleteTrainingTools(server, ctx) {
 }
 //#endregion
 //#region package.json
-var version = "3.5.2";
+var version = "3.6.0";
 //#endregion
 //#region src/server.ts
 function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trainheroic-unofficial/athlete-mcp",
-  "version": "3.5.2",
+  "version": "3.6.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -21,8 +21,8 @@
   "dependencies": {
     "@modelcontextprotocol/server": "2.0.0",
     "zod": "^4.4.3",
-    "@trainheroic-unofficial/core": "3.5.2",
-    "@trainheroic-unofficial/js": "3.5.2"
+    "@trainheroic-unofficial/core": "3.6.0",
+    "@trainheroic-unofficial/js": "3.6.0"
   },
   "devDependencies": {
     "@types/node": "^26.3.0",