catence 0.2.1-beta.26 → 0.2.1-beta.27

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.26";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.27";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.26';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.27';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/interfaces/http/server.js

@@ -27,12 +27,15 @@ function bearerTokenFrom(request) {
  * /mcp or /oauth exchange are otherwise invisible in container logs. Routine
  * dashboard polling stays quiet; set CATENCE_HTTP_ACCESS_LOG=0 to disable.
  * Logs method, path, status, latency, user agent, and the MCP protocol hints —
- * never headers carrying credentials.
+ * never headers carrying credentials. When a body tap is supplied, a second
+ * `[mcp-body]` line shows the exchange bodies (set CATENCE_HTTP_BODY_LOG=0 to
+ * keep the access lines but drop bodies).
  */
-function logRequestCompletion(request, response, pathname) {
+function logRequestCompletion(request, response, pathname, bodyTap) {
     if (process.env.CATENCE_HTTP_ACCESS_LOG === '0')
         return;
     const startedAt = Date.now();
+    const requestId = Math.random().toString(36).slice(2, 8);
     // Captured before the compatibility bridge rewrites the header so the log
     // always shows the value the client actually sent.
     const rawProtocolVersion = request.headers['mcp-protocol-version'];
@@ -45,7 +48,7 @@ function logRequestCompletion(request, response, pathname) {
             status >= 400;
         if (!interesting)
             return;
-        const parts = [`[http] ${new Date().toISOString()}`, `${request.method} ${pathname}`, String(status), `${Date.now() - startedAt}ms`];
+        const parts = [`[http] ${new Date().toISOString()}`, `rid=${requestId}`, `${request.method} ${pathname}`, String(status), `${Date.now() - startedAt}ms`];
         const userAgent = request.headers['user-agent'];
         if (typeof userAgent === 'string' && userAgent)
             parts.push(`ua="${userAgent.slice(0, 120)}"`);
@@ -55,10 +58,90 @@ function logRequestCompletion(request, response, pathname) {
         const mcpMethod = request.headers['mcp-method'];
         if (typeof mcpMethod === 'string' && mcpMethod)
             parts.push(`mcp-method=${mcpMethod}`);
+        const mcpName = request.headers['mcp-name'];
+        if (typeof mcpName === 'string' && mcpName)
+            parts.push(`mcp-name=${mcpName}`);
+        const logged = request;
+        if (logged.mcpFraming !== undefined)
+            parts.push(`framing=${logged.mcpFraming}`);
+        if (logged.mcpPrincipal !== undefined)
+            parts.push(`principal=${logged.mcpPrincipal}`);
         if (pathname === '/mcp' || pathname === '/')
             parts.push(`auth=${bearerTokenFrom(request) !== null ? 'bearer' : 'none'}`);
         console.log(parts.join(' '));
+        if (bodyTap === undefined || process.env.CATENCE_HTTP_BODY_LOG === '0')
+            return;
+        // MCP exchanges always, OAuth only when something failed: error bodies
+        // carry no credentials, but token-pair responses do and stay unlogged.
+        const logBodies = pathname === '/mcp' || pathname === '/' || (status >= 400 && pathname.startsWith('/oauth/'));
+        if (!logBodies)
+            return;
+        const inbound = logged.mcpRequestBody;
+        const outbound = bodyTap();
+        if (inbound === undefined && outbound === '')
+            return;
+        const fields = [`[mcp-body] ${new Date().toISOString()}`, `rid=${requestId}`, `${request.method} ${pathname}`, String(status)];
+        if (inbound !== undefined)
+            fields.push(`in=${summarizeBody(inbound)}`);
+        if (outbound !== '')
+            fields.push(`out=${summarizeBody(outbound)}`);
+        console.log(fields.join(' '));
+    });
+}
+/** Cap for the request body retained for logging. */
+const MCP_REQUEST_BODY_STASH_CHARS = 8_000;
+/** Cap for the response bytes buffered by the body tap before summarization. */
+const MCP_BODY_CAPTURE_LIMIT = 262_144;
+/** Head and tail kept when a captured body is logged. */
+const MCP_BODY_EDGE_CHARS = 2_000;
+/**
+ * Bodies are logged on one line: whitespace is flattened, and an oversized
+ * body keeps its head and tail (the trailing fields — resultType, cacheScope,
+ * nextCursor — matter for protocol forensics and never fit a head-only cut).
+ */
+function summarizeBody(body) {
+    const flattened = body.replace(/[\r\n\t]+/g, ' ');
+    const budget = MCP_BODY_EDGE_CHARS * 2;
+    if (flattened.length <= budget)
+        return flattened;
+    const omitted = flattened.length - budget;
+    return `${flattened.slice(0, MCP_BODY_EDGE_CHARS)}…(truncated ${omitted} chars)…${flattened.slice(-MCP_BODY_EDGE_CHARS)}`;
+}
+/**
+ * Buffers the bytes a response writes (bounded) so the access log can show the
+ * exact body an MCP or failed-OAuth exchange returned; never alters the
+ * payload. Installed before the request is handled, so the modern framing
+ * layer wraps this tap and the capture always reflects the final bytes.
+ */
+function tapResponseBody(response) {
+    const chunks = [];
+    let size = 0;
+    const append = (chunk, encoding) => {
+        if (size >= MCP_BODY_CAPTURE_LIMIT)
+            return;
+        let buffer;
+        if (typeof chunk === 'string')
+            buffer = Buffer.from(chunk, typeof encoding === 'string' ? encoding : 'utf8');
+        else if (Buffer.isBuffer(chunk))
+            buffer = chunk;
+        else if (chunk instanceof Uint8Array)
+            buffer = Buffer.from(chunk);
+        else
+            return;
+        chunks.push(buffer);
+        size += buffer.length;
+    };
+    const originalWrite = response.write.bind(response);
+    const originalEnd = response.end.bind(response);
+    response.write = ((chunk, encodingOrCallback, callback) => {
+        append(chunk, encodingOrCallback);
+        return originalWrite(chunk, encodingOrCallback, callback);
     });
+    response.end = ((chunk, encodingOrCallback, callback) => {
+        append(chunk, encodingOrCallback);
+        return originalEnd(chunk, encodingOrCallback, callback);
+    });
+    return () => Buffer.concat(chunks).toString('utf8');
 }
 function matchesLegacyToken(rawToken, expected) {
     const received = Buffer.from(rawToken);
@@ -517,6 +600,9 @@ async function handleUnauthenticatedDiscovery(request, response, paths) {
         return false;
     }
     const jsonRpc = singleJsonRpcRequest(body);
+    const serializedBody = JSON.stringify(body);
+    if (serializedBody !== undefined)
+        request.mcpRequestBody = serializedBody.slice(0, MCP_REQUEST_BODY_STASH_CHARS);
     if (jsonRpc?.method !== 'server/discover')
         return false;
     await writeDiscoveryResult(response, paths, { athleteIds: 'all' }, jsonRpc.id);
@@ -715,6 +801,10 @@ async function handleMcpRequest(request, response, paths, principal) {
         return;
     }
     const jsonRpc = singleJsonRpcRequest(body);
+    const serializedBody = JSON.stringify(body);
+    if (serializedBody !== undefined)
+        request.mcpRequestBody = serializedBody.slice(0, MCP_REQUEST_BODY_STASH_CHARS);
+    request.mcpFraming = modernRequest ? (jsonRpc?.method ?? 'modern') : 'legacy';
     if (jsonRpc?.method === 'server/discover') {
         // Modern clients probe discovery before anything else; answer from the
         // same descriptor the initialize response reports so the two never drift.
@@ -836,7 +926,10 @@ export function createCatenceHttpServer(options = {}) {
     return createServer((request, response) => {
         void (async () => {
             const pathname = new URL(request.url ?? '/', 'http://localhost').pathname;
-            logRequestCompletion(request, response, pathname);
+            // Body capture covers the MCP surface and OAuth failures; every other
+            // route keeps the plain access line.
+            const tapped = pathname === '/mcp' || pathname === '/' || pathname.startsWith('/oauth/');
+            logRequestCompletion(request, response, pathname, tapped ? tapResponseBody(response) : undefined);
             // The OAuth endpoints are the auth surface itself: they bypass the gate
             // and CORS entirely and are delegated to the Express sub-app. When OAuth
             // is effectively disabled they answer 404 — no metadata is advertised.
@@ -863,6 +956,9 @@ export function createCatenceHttpServer(options = {}) {
             const principal = UNAUTHENTICATED_PATHS.has(pathname)
                 ? FULL_ACCESS_PRINCIPAL
                 : await resolvePrincipal(request, effectiveOptions, accountPaths);
+            if (principal !== null && (pathname === '/mcp' || pathname === '/')) {
+                request.mcpPrincipal = `${principal.kind}${principal.username === undefined ? '' : `:${principal.username}`}`;
+            }
             if (principal === null) {
                 // A hosted connector may probe server/discover before attaching the
                 // bearer token. The discovery result exposes nothing athlete-scoped,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.26",
+  "version": "0.2.1-beta.27",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {