catence 0.2.1-beta.20 → 0.2.1-beta.21

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.20";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.21";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.20';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.21';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/interfaces/http/server.js

@@ -2,9 +2,10 @@ import { timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import path from 'node:path';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { LATEST_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS } from '@modelcontextprotocol/sdk/types.js';
 import { addAthlete, addMcpKey, AthleteFileConflictError, AthleteFileTooLargeError, AthleteFileValidationError, catenceRuntimeHealth, countActiveMcpKeys, DashboardSnapshotService, deleteAthleteSecret, describeAthleteSecrets, DetachedSyncBusyError, DETACHED_SYNC_PROVIDERS, filterRosterToScope, jsonSafe, listAthleteFileRevisions, listMcpKeys, loadCatalog, McpKeyNotFoundError, mergeOpenCodeGoConsoleProfiles, openReadOnlyRepository, parseAutoSyncInterval, readAutoSyncSchedule, readAthleteFile, readAthleteFileRevision, readMcpOauthSettings, resolveAccountScope, resolveAthlete, resolveCatalogPaths, resolveKeyPrincipal, revokeMcpKey, rollMcpKey, scopeAllowsAthlete, setAthleteSecret, startDetachedSync, syncProgress, updateAthleteFile, updateAutoSyncSchedule, writeMcpOauthSettings, } from '../../runtime/index.js';
 import { activeBearerToken, ensureBearerToken, disableBearerToken, mcpExposureStatus } from './cli-options.js';
-import { createCatenceMcpServer } from '../mcp/server.js';
+import { CATENCE_MCP_SERVER_INFO, createCatenceMcpServer, MCP_INSTRUCTIONS } from '../mcp/server.js';
 import { generationStatus } from './generation-status.js';
 const MAX_REQUEST_BYTES = 1_000_000;
 /** Endpoints that stay open when bearer authentication is enabled: they carry
@@ -414,11 +415,46 @@ async function lastSyncSummary(paths) {
         return null;
     }
 }
+/**
+ * The MCP revision ChatGPT's hosted connector speaks during setup. The bundled
+ * SDK predates it, but the request shapes the revision uses — server/discover,
+ * then stateless tools/list and tools/call without initialize — are already
+ * handled. Only the protocol header value is rejected, so it is bridged down
+ * and server/discover is answered from the same descriptor initialize reports.
+ */
+const MODERN_MCP_PROTOCOL_VERSION = '2026-07-28';
+/** A single JSON-RPC request (batches are left to the transport). */
+function singleJsonRpcRequest(body) {
+    if (typeof body !== 'object' || body === null || Array.isArray(body))
+        return null;
+    const method = body.method;
+    return typeof method === 'string' ? body : null;
+}
+/**
+ * Server capabilities exactly as the SDK's initialize response reports them.
+ * getCapabilities() is the runtime accessor that builds that response; the
+ * typings mark it private.
+ */
+function mcpServerCapabilities(server) {
+    return server.server.getCapabilities();
+}
 async function handleMcpRequest(request, response, paths, principal) {
     if (request.method !== 'POST') {
         methodNotAllowed(response);
         return;
     }
+    // ChatGPT's discovery probe and the requests that follow it carry the
+    // 2026-07-28 revision; the transport understands only the older list. The
+    // Node adapter rebuilds the web-standard headers from rawHeaders (not the
+    // parsed headers object), so both views are rewritten.
+    if (request.headers['mcp-protocol-version'] === MODERN_MCP_PROTOCOL_VERSION) {
+        request.headers['mcp-protocol-version'] = LATEST_PROTOCOL_VERSION;
+        const rawHeaders = request.rawHeaders;
+        for (let index = 0; index < rawHeaders.length; index += 2) {
+            if (rawHeaders[index]?.toLowerCase() === 'mcp-protocol-version')
+                rawHeaders[index + 1] = LATEST_PROTOCOL_VERSION;
+        }
+    }
     let body;
     try {
         body = await readJsonBody(request);
@@ -431,6 +467,31 @@ async function handleMcpRequest(request, response, paths, principal) {
         });
         return;
     }
+    const jsonRpc = singleJsonRpcRequest(body);
+    if (jsonRpc?.method === 'server/discover') {
+        // Modern clients probe discovery before anything else; answer from the
+        // same descriptor the initialize response reports so the two never drift.
+        const server = createCatenceMcpServer(paths, {}, { scope: { athleteIds: principal.athleteIds } });
+        try {
+            json(response, 200, {
+                jsonrpc: '2.0',
+                id: jsonRpc.id ?? null,
+                result: {
+                    resultType: 'complete',
+                    supportedVersions: [MODERN_MCP_PROTOCOL_VERSION, ...SUPPORTED_PROTOCOL_VERSIONS],
+                    capabilities: mcpServerCapabilities(server),
+                    _meta: { 'io.modelcontextprotocol/serverInfo': CATENCE_MCP_SERVER_INFO },
+                    instructions: MCP_INSTRUCTIONS,
+                    ttlMs: 3_600_000,
+                    cacheScope: 'public',
+                },
+            });
+        }
+        finally {
+            await server.close();
+        }
+        return;
+    }
     // The HTTP gate has already authenticated this request; the MCP server
     // re-enforces the principal's athlete scope on every tool and roster.
     const server = createCatenceMcpServer(paths, {}, { scope: { athleteIds: principal.athleteIds } });

package/dist/interfaces/mcp/server.d.ts

@@ -5,6 +5,15 @@ type McpDependencies = {
     hydrateStravaActivity?: StravaActivityHydrator;
     startDetachedSync?: typeof startDetachedSync;
 };
+export declare const MCP_INSTRUCTIONS: string;
+/**
+ * Server identity shared by the MCP initialize response (stdio and HTTP) and
+ * the HTTP server/discover probe; clients compare the two for consistency.
+ */
+export declare const CATENCE_MCP_SERVER_INFO: {
+    name: string;
+    version: string;
+};
 export type CatenceMcpServerOptions = {
     /**
      * Athlete scope enforced on every tool that selects an athlete, and applied

package/dist/interfaces/mcp/server.js

@@ -22,7 +22,7 @@ const seriesInput = {
 function isCatalogPaths(value) {
     return 'catalog' in value;
 }
-const MCP_INSTRUCTIONS = [
+export const MCP_INSTRUCTIONS = [
     'For a selected activity\'s Strava segments, climb segments, grade by segment, KOM/PR, or per-segment analysis, call get_activity_segments after identifying the activity.',
     'That tool performs the targeted Strava hydration itself. Base segment answers only on what it returns.',
     'For Garmin running VO₂max, call get_vo2max_history with sport: running. Garmin stores the source value as generic; returned rows preserve that source label.',
@@ -39,6 +39,11 @@ const MCP_INSTRUCTIONS = [
     'For running dynamics or running form, use the run_dynamics dataset (vertical_oscillation_cm, ground_contact_time_ms, flight_time_ms, stride_length_cm, vertical_ratio_pct, cadence_spm); values are provider-normalized and a null means the provider did not report that metric.',
     'For durable athlete facts shared between the athlete and the agent, use the athlete file: get_athlete_file before personalizing advice, and update_athlete_file for lasting goals, constraints, preferences, or profile facts. Always pass the hash you read as expectedHash (null when the file does not exist yet); a changed file is rejected so it is never silently overwritten. Never store credentials or provider configuration in it.',
 ].join(' ');
+/**
+ * Server identity shared by the MCP initialize response (stdio and HTTP) and
+ * the HTTP server/discover probe; clients compare the two for consistency.
+ */
+export const CATENCE_MCP_SERVER_INFO = { name: 'catence', version: '0.1.0' };
 function textResult(value) {
     return { content: [{ type: 'text', text: JSON.stringify(jsonSafe(value), null, 2) }] };
 }
@@ -138,7 +143,7 @@ async function activitySegments(repository, activityId, hydratedStravaActivityId
   `, values);
 }
 export function createCatenceMcpServer(paths = resolveCatalogPaths(), dependencies = {}, options = {}) {
-    const server = new McpServer({ name: 'catence', version: '0.1.0' }, { instructions: MCP_INSTRUCTIONS });
+    const server = new McpServer({ ...CATENCE_MCP_SERVER_INFO }, { instructions: MCP_INSTRUCTIONS });
     const hydrateActivity = dependencies.hydrateStravaActivity ?? hydrateStravaActivity;
     const startSync = dependencies.startDetachedSync ?? startDetachedSync;
     const catalogPaths = isCatalogPaths(paths) ? paths : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.20",
+  "version": "0.2.1-beta.21",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {