catence 0.2.1-beta.21 → 0.2.1-beta.23

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.21";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.23";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.21';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.23';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/core/query/repository.js

@@ -1,6 +1,6 @@
 import { existsSync } from 'node:fs';
 import path from 'node:path';
-import { SYNC_STAGES } from '../../contracts/progress.js';
+import { STALE_RUN_TIMEOUT_MS, SYNC_STAGES } from '../../contracts/progress.js';
 import { mergeProgress, readRunningProgress } from '../../elt/storage/progress-sidecar.js';
 import { sqlString } from './sql.js';
 import { DATASET_CATALOG, getDataset } from './catalog.js';
@@ -142,6 +142,11 @@ export class ReadOnlyRepository {
     async progress() {
         // Same sequential-read discipline as status(): the shared native
         // connection must not run these small reads concurrently.
+        // A run killed with its container keeps status='running' in the database;
+        // the heartbeat age filter mirrors the sidecar contract and db.syncProgress
+        // so such a run stops reading as active (and stops blocking new syncs)
+        // after the stale-run window.
+        const cutoff = new Date(Date.now() - STALE_RUN_TIMEOUT_MS).toISOString();
         const running = await this.rows(`
       SELECT runs.run_id, runs.provider, coalesce(progress.stage, 'starting') AS stage,
         progress.current_step,
@@ -154,8 +159,9 @@ export class ReadOnlyRepository {
       FROM sync_runs AS runs
       LEFT JOIN sync_run_progress AS progress USING (run_id)
       WHERE runs.status = 'running'
+        AND coalesce(progress.heartbeat_at, runs.started_at) > $cutoff
       ORDER BY runs.started_at DESC
-    `);
+    `, { cutoff });
         const recent = await this.rows(`
       SELECT run_id, provider, stage, current_step, completed_units, total_units, percent,
         elapsed_seconds, estimated_remaining_seconds,

package/dist/interfaces/http/server.js

@@ -22,6 +22,41 @@ function bearerTokenFrom(request) {
         return null;
     return header.slice('Bearer '.length);
 }
+/**
+ * One-line diagnostics for the auth and MCP surfaces: gate outcomes and every
+ * /mcp or /oauth exchange are otherwise invisible in container logs. Routine
+ * dashboard polling stays quiet; set CATENCE_HTTP_ACCESS_LOG=0 to disable.
+ * Logs method, path, status, latency, user agent, and the MCP protocol hints —
+ * never headers carrying credentials.
+ */
+function logRequestCompletion(request, response, pathname) {
+    if (process.env.CATENCE_HTTP_ACCESS_LOG === '0')
+        return;
+    const startedAt = Date.now();
+    response.once('finish', () => {
+        const status = response.statusCode;
+        const interesting = pathname === '/mcp' ||
+            pathname === '/' ||
+            pathname.startsWith('/oauth/') ||
+            pathname.startsWith('/.well-known/oauth-') ||
+            status >= 400;
+        if (!interesting)
+            return;
+        const parts = [`[http] ${new Date().toISOString()}`, `${request.method} ${pathname}`, String(status), `${Date.now() - startedAt}ms`];
+        const userAgent = request.headers['user-agent'];
+        if (typeof userAgent === 'string' && userAgent)
+            parts.push(`ua="${userAgent.slice(0, 120)}"`);
+        const protocolVersion = request.headers['mcp-protocol-version'];
+        if (typeof protocolVersion === 'string' && protocolVersion)
+            parts.push(`mcp-protocol-version=${protocolVersion}`);
+        const mcpMethod = request.headers['mcp-method'];
+        if (typeof mcpMethod === 'string' && mcpMethod)
+            parts.push(`mcp-method=${mcpMethod}`);
+        if (pathname === '/mcp' || pathname === '/')
+            parts.push(`auth=${bearerTokenFrom(request) !== null ? 'bearer' : 'none'}`);
+        console.log(parts.join(' '));
+    });
+}
 function matchesLegacyToken(rawToken, expected) {
     const received = Buffer.from(rawToken);
     const expectedBuffer = Buffer.from(expected);
@@ -438,16 +473,66 @@ function singleJsonRpcRequest(body) {
 function mcpServerCapabilities(server) {
     return server.server.getCapabilities();
 }
+/**
+ * Answer server/discover from a throwaway scoped server so the descriptor
+ * (capabilities, server identity, instructions) can never drift from what the
+ * initialize response reports. See MODERN_MCP_PROTOCOL_VERSION.
+ */
+async function writeDiscoveryResult(response, paths, scope, id) {
+    const server = createCatenceMcpServer(paths, {}, { scope });
+    try {
+        json(response, 200, {
+            jsonrpc: '2.0',
+            id: id ?? null,
+            result: {
+                resultType: 'complete',
+                supportedVersions: [MODERN_MCP_PROTOCOL_VERSION, ...SUPPORTED_PROTOCOL_VERSIONS],
+                capabilities: mcpServerCapabilities(server),
+                _meta: { 'io.modelcontextprotocol/serverInfo': CATENCE_MCP_SERVER_INFO },
+                instructions: MCP_INSTRUCTIONS,
+                ttlMs: 3_600_000,
+                cacheScope: 'public',
+            },
+        });
+    }
+    finally {
+        await server.close();
+    }
+}
+/**
+ * Hosted connectors may probe server/discover before attaching the bearer
+ * token; the result exposes nothing athlete-scoped, so it is answered ahead
+ * of the 401. Every other unauthenticated /mcp request stays behind the gate.
+ * Returns true when the response was written.
+ */
+async function handleUnauthenticatedDiscovery(request, response, paths) {
+    let body;
+    try {
+        body = await readJsonBody(request);
+    }
+    catch {
+        return false;
+    }
+    const jsonRpc = singleJsonRpcRequest(body);
+    if (jsonRpc?.method !== 'server/discover')
+        return false;
+    await writeDiscoveryResult(response, paths, { athleteIds: 'all' }, jsonRpc.id);
+    return true;
+}
 async function handleMcpRequest(request, response, paths, principal) {
     if (request.method !== 'POST') {
         methodNotAllowed(response);
         return;
     }
-    // ChatGPT's discovery probe and the requests that follow it carry the
-    // 2026-07-28 revision; the transport understands only the older list. The
-    // Node adapter rebuilds the web-standard headers from rawHeaders (not the
-    // parsed headers object), so both views are rewritten.
-    if (request.headers['mcp-protocol-version'] === MODERN_MCP_PROTOCOL_VERSION) {
+    // ChatGPT's discovery probe and the requests that follow it carry a dated
+    // 2026 MCP revision (2026-07-28 as of today, later revisions as they ship);
+    // the SDK transport understands only its own older list, and the surface
+    // here is stateless either way, so any dated 2026 revision is bridged down
+    // while still-unknown values keep failing closed. The Node adapter rebuilds
+    // the web-standard headers from rawHeaders (not the parsed headers object),
+    // so both views are rewritten.
+    const requestedVersion = request.headers['mcp-protocol-version'];
+    if (typeof requestedVersion === 'string' && /^2026-\d{2}-\d{2}$/.test(requestedVersion)) {
         request.headers['mcp-protocol-version'] = LATEST_PROTOCOL_VERSION;
         const rawHeaders = request.rawHeaders;
         for (let index = 0; index < rawHeaders.length; index += 2) {
@@ -471,25 +556,7 @@ async function handleMcpRequest(request, response, paths, principal) {
     if (jsonRpc?.method === 'server/discover') {
         // Modern clients probe discovery before anything else; answer from the
         // same descriptor the initialize response reports so the two never drift.
-        const server = createCatenceMcpServer(paths, {}, { scope: { athleteIds: principal.athleteIds } });
-        try {
-            json(response, 200, {
-                jsonrpc: '2.0',
-                id: jsonRpc.id ?? null,
-                result: {
-                    resultType: 'complete',
-                    supportedVersions: [MODERN_MCP_PROTOCOL_VERSION, ...SUPPORTED_PROTOCOL_VERSIONS],
-                    capabilities: mcpServerCapabilities(server),
-                    _meta: { 'io.modelcontextprotocol/serverInfo': CATENCE_MCP_SERVER_INFO },
-                    instructions: MCP_INSTRUCTIONS,
-                    ttlMs: 3_600_000,
-                    cacheScope: 'public',
-                },
-            });
-        }
-        finally {
-            await server.close();
-        }
+        await writeDiscoveryResult(response, paths, { athleteIds: principal.athleteIds }, jsonRpc.id);
         return;
     }
     // The HTTP gate has already authenticated this request; the MCP server
@@ -599,6 +666,7 @@ export function createCatenceHttpServer(options = {}) {
     return createServer((request, response) => {
         void (async () => {
             const pathname = new URL(request.url ?? '/', 'http://localhost').pathname;
+            logRequestCompletion(request, response, pathname);
             // The OAuth endpoints are the auth surface itself: they bypass the gate
             // and CORS entirely and are delegated to the Express sub-app. When OAuth
             // is effectively disabled they answer 404 — no metadata is advertised.
@@ -626,6 +694,14 @@ export function createCatenceHttpServer(options = {}) {
                 ? FULL_ACCESS_PRINCIPAL
                 : await resolvePrincipal(request, effectiveOptions, accountPaths);
             if (principal === null) {
+                // A hosted connector may probe server/discover before attaching the
+                // bearer token. The discovery result exposes nothing athlete-scoped,
+                // so that one probe is answered ahead of the 401; every other
+                // unauthenticated MCP request stays behind the gate. The root alias
+                // mirrors /mcp here too so bare-domain connectors see the same gate.
+                if ((pathname === '/mcp' || pathname === '/') && request.method === 'POST' && await handleUnauthenticatedDiscovery(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths())) {
+                    return;
+                }
                 // A presented-but-rejected token is a bearer problem, not an OAuth
                 // discovery problem: answer RFC 6750 invalid_token without
                 // resource_metadata, so static-key clients get a clear "your token is
@@ -1159,7 +1235,11 @@ export function createCatenceHttpServer(options = {}) {
                 }
                 return;
             }
-            if (pathname === '/mcp') {
+            // Hosted connectors probe the URL exactly as the operator typed it, and
+            // a bare-domain connector has no /mcp path to append. Root requests are
+            // served exactly like /mcp; the protected-resource metadata still
+            // advertises /mcp, so issued tokens keep their /mcp audience.
+            if (pathname === '/mcp' || pathname === '/') {
                 await handleMcpRequest(request, response, catalogPaths ?? staticPaths ?? resolveCatalogPaths(), principal);
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.21",
+  "version": "0.2.1-beta.23",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {