catence 0.2.1-beta.26 → 0.2.1-beta.28

package/dist/contracts/release.d.ts

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.26";
+export declare const CATENCE_RUNTIME_VERSION = "0.2.1-beta.28";
 export declare const CATENCE_PROTOCOL_VERSION = 1;
 export type CatenceRuntimeCapabilities = {
     mcp: true;

package/dist/contracts/release.js

@@ -3,7 +3,7 @@
  * Keep these values synchronized with release/manifest.json; release checks
  * deliberately reject drift before a package can be published.
  */
-export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.26';
+export const CATENCE_RUNTIME_VERSION = '0.2.1-beta.28';
 export const CATENCE_PROTOCOL_VERSION = 1;
 export function catenceRuntimeHealth() {
     return {

package/dist/core/query/activity-discovery.d.ts

@@ -3,7 +3,7 @@ export type FindActivitiesRequest = {
     sports?: string[];
     /** Accepted as a convenience alias for `sports: [sport]`. */
     sport?: string;
-    distanceKm?: [number, number];
+    distanceKm?: number[];
     nameContains?: string[];
     startDate?: string;
     endDate?: string;

package/dist/interfaces/http/server.js

@@ -27,12 +27,15 @@ function bearerTokenFrom(request) {
  * /mcp or /oauth exchange are otherwise invisible in container logs. Routine
  * dashboard polling stays quiet; set CATENCE_HTTP_ACCESS_LOG=0 to disable.
  * Logs method, path, status, latency, user agent, and the MCP protocol hints —
- * never headers carrying credentials.
+ * never headers carrying credentials. When a body tap is supplied, a second
+ * `[mcp-body]` line shows the exchange bodies (set CATENCE_HTTP_BODY_LOG=0 to
+ * keep the access lines but drop bodies).
  */
-function logRequestCompletion(request, response, pathname) {
+function logRequestCompletion(request, response, pathname, bodyTap) {
     if (process.env.CATENCE_HTTP_ACCESS_LOG === '0')
         return;
     const startedAt = Date.now();
+    const requestId = Math.random().toString(36).slice(2, 8);
     // Captured before the compatibility bridge rewrites the header so the log
     // always shows the value the client actually sent.
     const rawProtocolVersion = request.headers['mcp-protocol-version'];
@@ -45,7 +48,7 @@ function logRequestCompletion(request, response, pathname) {
             status >= 400;
         if (!interesting)
             return;
-        const parts = [`[http] ${new Date().toISOString()}`, `${request.method} ${pathname}`, String(status), `${Date.now() - startedAt}ms`];
+        const parts = [`[http] ${new Date().toISOString()}`, `rid=${requestId}`, `${request.method} ${pathname}`, String(status), `${Date.now() - startedAt}ms`];
         const userAgent = request.headers['user-agent'];
         if (typeof userAgent === 'string' && userAgent)
             parts.push(`ua="${userAgent.slice(0, 120)}"`);
@@ -55,11 +58,91 @@ function logRequestCompletion(request, response, pathname) {
         const mcpMethod = request.headers['mcp-method'];
         if (typeof mcpMethod === 'string' && mcpMethod)
             parts.push(`mcp-method=${mcpMethod}`);
+        const mcpName = request.headers['mcp-name'];
+        if (typeof mcpName === 'string' && mcpName)
+            parts.push(`mcp-name=${mcpName}`);
+        const logged = request;
+        if (logged.mcpFraming !== undefined)
+            parts.push(`framing=${logged.mcpFraming}`);
+        if (logged.mcpPrincipal !== undefined)
+            parts.push(`principal=${logged.mcpPrincipal}`);
         if (pathname === '/mcp' || pathname === '/')
             parts.push(`auth=${bearerTokenFrom(request) !== null ? 'bearer' : 'none'}`);
         console.log(parts.join(' '));
+        if (bodyTap === undefined || process.env.CATENCE_HTTP_BODY_LOG === '0')
+            return;
+        // MCP exchanges always, OAuth only when something failed: error bodies
+        // carry no credentials, but token-pair responses do and stay unlogged.
+        const logBodies = pathname === '/mcp' || pathname === '/' || (status >= 400 && pathname.startsWith('/oauth/'));
+        if (!logBodies)
+            return;
+        const inbound = logged.mcpRequestBody;
+        const outbound = bodyTap();
+        if (inbound === undefined && outbound === '')
+            return;
+        const fields = [`[mcp-body] ${new Date().toISOString()}`, `rid=${requestId}`, `${request.method} ${pathname}`, String(status)];
+        if (inbound !== undefined)
+            fields.push(`in=${summarizeBody(inbound)}`);
+        if (outbound !== '')
+            fields.push(`out=${summarizeBody(outbound)}`);
+        console.log(fields.join(' '));
     });
 }
+/** Cap for the request body retained for logging. */
+const MCP_REQUEST_BODY_STASH_CHARS = 8_000;
+/** Cap for the response bytes buffered by the body tap before summarization. */
+const MCP_BODY_CAPTURE_LIMIT = 262_144;
+/** Head and tail kept when a captured body is logged. */
+const MCP_BODY_EDGE_CHARS = 2_000;
+/**
+ * Bodies are logged on one line: whitespace is flattened, and an oversized
+ * body keeps its head and tail (the trailing fields — resultType, cacheScope,
+ * nextCursor — matter for protocol forensics and never fit a head-only cut).
+ */
+function summarizeBody(body) {
+    const flattened = body.replace(/[\r\n\t]+/g, ' ');
+    const budget = MCP_BODY_EDGE_CHARS * 2;
+    if (flattened.length <= budget)
+        return flattened;
+    const omitted = flattened.length - budget;
+    return `${flattened.slice(0, MCP_BODY_EDGE_CHARS)}…(truncated ${omitted} chars)…${flattened.slice(-MCP_BODY_EDGE_CHARS)}`;
+}
+/**
+ * Buffers the bytes a response writes (bounded) so the access log can show the
+ * exact body an MCP or failed-OAuth exchange returned; never alters the
+ * payload. Installed before the request is handled, so the modern framing
+ * layer wraps this tap and the capture always reflects the final bytes.
+ */
+function tapResponseBody(response) {
+    const chunks = [];
+    let size = 0;
+    const append = (chunk, encoding) => {
+        if (size >= MCP_BODY_CAPTURE_LIMIT)
+            return;
+        let buffer;
+        if (typeof chunk === 'string')
+            buffer = Buffer.from(chunk, typeof encoding === 'string' ? encoding : 'utf8');
+        else if (Buffer.isBuffer(chunk))
+            buffer = chunk;
+        else if (chunk instanceof Uint8Array)
+            buffer = Buffer.from(chunk);
+        else
+            return;
+        chunks.push(buffer);
+        size += buffer.length;
+    };
+    const originalWrite = response.write.bind(response);
+    const originalEnd = response.end.bind(response);
+    response.write = ((chunk, encodingOrCallback, callback) => {
+        append(chunk, encodingOrCallback);
+        return originalWrite(chunk, encodingOrCallback, callback);
+    });
+    response.end = ((chunk, encodingOrCallback, callback) => {
+        append(chunk, encodingOrCallback);
+        return originalEnd(chunk, encodingOrCallback, callback);
+    });
+    return () => Buffer.concat(chunks).toString('utf8');
+}
 function matchesLegacyToken(rawToken, expected) {
     const received = Buffer.from(rawToken);
     const expectedBuffer = Buffer.from(expected);
@@ -517,6 +600,9 @@ async function handleUnauthenticatedDiscovery(request, response, paths) {
         return false;
     }
     const jsonRpc = singleJsonRpcRequest(body);
+    const serializedBody = JSON.stringify(body);
+    if (serializedBody !== undefined)
+        request.mcpRequestBody = serializedBody.slice(0, MCP_REQUEST_BODY_STASH_CHARS);
     if (jsonRpc?.method !== 'server/discover')
         return false;
     await writeDiscoveryResult(response, paths, { athleteIds: 'all' }, jsonRpc.id);
@@ -533,10 +619,40 @@ async function handleUnauthenticatedDiscovery(request, response, paths) {
  * tool definitions drop the SDK's `execution` field — neither the per-result
  * `_meta.serverInfo` nor `execution` appeared in the revision's schemas for
  * earlier SDKs, but the revision asks for the former and omits the latter.
+ * Tool schemas also drop `propertyNames`, which strict validators reject and
+ * whose only instance merely restates JSON's string-key rule.
  * Errors and notifications carry no result and pass through.
  */
 const MODERN_CACHEABLE_METHODS = new Set(['server/discover', 'tools/list', 'prompts/list', 'resources/list', 'resources/templates/list', 'resources/read']);
 const MODERN_RESULT_TTL_MS = 300_000;
+/** Copy a JSON schema without `propertyNames` keywords; returns the original when nothing was removed. */
+function stripPropertyNames(value) {
+    if (Array.isArray(value)) {
+        let changed = false;
+        const copy = value.map((item) => {
+            const next = stripPropertyNames(item);
+            if (next !== item)
+                changed = true;
+            return next;
+        });
+        return changed ? copy : value;
+    }
+    if (typeof value !== 'object' || value === null)
+        return value;
+    let changed = false;
+    const copy = {};
+    for (const [key, item] of Object.entries(value)) {
+        if (key === 'propertyNames') {
+            changed = true;
+            continue;
+        }
+        const next = stripPropertyNames(item);
+        if (next !== item)
+            changed = true;
+        copy[key] = next;
+    }
+    return changed ? copy : value;
+}
 /** Rewrite one JSON-RPC payload; null when it carries nothing to change. */
 function frameModernRpcPayload(payload, method) {
     let envelope;
@@ -565,10 +681,23 @@ function frameModernRpcPayload(payload, method) {
     if (method === 'tools/list' && Array.isArray(framed.tools)) {
         let stripped = false;
         const tools = framed.tools.map((tool) => {
-            if (typeof tool !== 'object' || tool === null || Array.isArray(tool) || !('execution' in tool))
+            if (typeof tool !== 'object' || tool === null || Array.isArray(tool))
                 return tool;
             const copy = { ...tool };
-            delete copy.execution;
+            let edited = false;
+            if ('execution' in copy) {
+                delete copy.execution;
+                edited = true;
+            }
+            if ('inputSchema' in copy) {
+                const schema = stripPropertyNames(copy.inputSchema);
+                if (schema !== copy.inputSchema) {
+                    copy.inputSchema = schema;
+                    edited = true;
+                }
+            }
+            if (!edited)
+                return tool;
             stripped = true;
             return copy;
         });
@@ -715,6 +844,10 @@ async function handleMcpRequest(request, response, paths, principal) {
         return;
     }
     const jsonRpc = singleJsonRpcRequest(body);
+    const serializedBody = JSON.stringify(body);
+    if (serializedBody !== undefined)
+        request.mcpRequestBody = serializedBody.slice(0, MCP_REQUEST_BODY_STASH_CHARS);
+    request.mcpFraming = modernRequest ? (jsonRpc?.method ?? 'modern') : 'legacy';
     if (jsonRpc?.method === 'server/discover') {
         // Modern clients probe discovery before anything else; answer from the
         // same descriptor the initialize response reports so the two never drift.
@@ -836,7 +969,10 @@ export function createCatenceHttpServer(options = {}) {
     return createServer((request, response) => {
         void (async () => {
             const pathname = new URL(request.url ?? '/', 'http://localhost').pathname;
-            logRequestCompletion(request, response, pathname);
+            // Body capture covers the MCP surface and OAuth failures; every other
+            // route keeps the plain access line.
+            const tapped = pathname === '/mcp' || pathname === '/' || pathname.startsWith('/oauth/');
+            logRequestCompletion(request, response, pathname, tapped ? tapResponseBody(response) : undefined);
             // The OAuth endpoints are the auth surface itself: they bypass the gate
             // and CORS entirely and are delegated to the Express sub-app. When OAuth
             // is effectively disabled they answer 404 — no metadata is advertised.
@@ -863,6 +999,9 @@ export function createCatenceHttpServer(options = {}) {
             const principal = UNAUTHENTICATED_PATHS.has(pathname)
                 ? FULL_ACCESS_PRINCIPAL
                 : await resolvePrincipal(request, effectiveOptions, accountPaths);
+            if (principal !== null && (pathname === '/mcp' || pathname === '/')) {
+                request.mcpPrincipal = `${principal.kind}${principal.username === undefined ? '' : `:${principal.username}`}`;
+            }
             if (principal === null) {
                 // A hosted connector may probe server/discover before attaching the
                 // bearer token. The discovery result exposes nothing athlete-scoped,

package/dist/interfaces/mcp/server.js

@@ -583,7 +583,11 @@ export function createCatenceMcpServer(paths = resolveCatalogPaths(), dependenci
         inputSchema: {
             sport: z.string().min(1).optional(),
             sports: z.array(z.string().min(1)).min(1).max(12).optional(),
-            distanceKm: z.tuple([z.number().min(0), z.number().min(0)]).optional(),
+            // Tuple-form `items` is valid draft-07 but strict clients reject it
+            // (ChatGPT's connector validator flagged exactly this as "Invalid MCP
+            // tool schema"). A bounded two-number array keeps the same contract; the
+            // service still enforces the ascending [minimum, maximum] order.
+            distanceKm: z.array(z.number().min(0)).min(2).max(2).optional(),
             nameContains: z.array(z.string().min(1)).min(1).max(12).optional(),
             startDate: z.string().date().optional(), endDate: z.string().date().optional(),
             sort: z.enum(['date_desc', 'date_asc']).optional(), limit: z.number().int().min(1).max(100).optional(), cursor: z.string().min(1).optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "catence",
-  "version": "0.2.1-beta.26",
+  "version": "0.2.1-beta.28",
   "description": "Local MCP access to normalized Garmin, Intervals.icu, and targeted Strava fitness data.",
   "license": "AGPL-3.0-or-later",
   "repository": {