health-export-mcp 1.10.0 → 1.10.2

package/README.md

@@ -73,7 +73,7 @@ The companion iOS app **[MetricBridge](https://www.healthexport.dev)** exports y
 |---|---|
 | **iCloud Drive** (default) | Your Mac reads the synced folder automatically |
 | **Local folder** | Any folder that syncs to your Mac (Dropbox, Google Drive, OneDrive, …) |
-| **LAN** (HTTP / WebSocket) | Direct push to the server, great over Tailscale |
+| **LAN** (HTTP / WebSocket) | Direct push to the server, great over Tailscale. Carries the daily summary and, when you switch on Settings > Local network > Strength log, the strength log (written to `health-strength.json`) |
 
 > Using a non-MCP tool (ChatGPT, n8n, Home Assistant)? The app can also POST to a **webhook** those tools read directly, see [Works with](#works-with-claude-cursor-chatgpt-openclaw-hermes).
 
@@ -163,7 +163,7 @@ Full reference with request/response examples: **[healthexport.dev/mcp](https://
 | `get_profile` | Opted-in context fields (conditions, medications, goals, allergies, notes) plus `presentFields`. Absent fields were withheld, never "none". |
 | `get_workouts` | Workouts by activity/date with pagination; includes heart rate, running dynamics, cycling power, intervals and `hasRoute` when exported. |
 | `get_sleep_sessions` | Clustered sleep sessions attributed to the waking day; split nights returned as separate sessions, duplicate copies of one night collapsed (`collapsedDuplicates`). |
-| `get_strength_log` | The strength log typed into the iOS app (`health-strength.json`, opt-in, off by default): each session with every set as entered, `volumeKg`, `workingSets`, an Epley `bestEstimateKg` per exercise, all-time records, and the user's saved routines. Filter by `exercise`, `start`, `end`. Missing file → `available:false`. |
+| `get_strength_log` | The strength log typed into the iOS app (`health-strength.json`, opt-in, off by default, from the iCloud or folder export or from the LAN push): each session with every set as entered, `volumeKg`, `workingSets`, an Epley `bestEstimateKg` per exercise, all-time records, and the user's saved routines. Filter by `exercise`, `start`, `end`. Missing file → `available:false`. |
 | `get_lab_results` | Lab results from Apple Health Records (`health-labs.json`; opt-in, off by default, folder export only, never iCloud Drive): each test with its results oldest first, value, date, institution and the lab's own reference range, exactly as reported. Nothing is flagged or interpreted, and units are never converted. Filter by `test`, `loinc`, `start`, `end`. Missing file → `available:false`. |
 | `get_check_ins` | Morning check-ins the user chose to share (`health-check-ins.json`, off by default in the app): self-rated feeling 1 to 5, note, intention and whether it happened, plus a summary. A self-rating, not a measurement. |
 | `get_cycle_context` | Day-in-cycle and coarse phase derived from logged period starts. Never predictive. |
@@ -175,7 +175,7 @@ Full reference with request/response examples: **[healthexport.dev/mcp](https://
 
 ### Data files
 
-The daily cache (`.health-cache.json`) and workouts cache are joined by optional context files, all optional: `health-events.json` (the logging surface), `health-profile.json` (opt-in context), `health-sessions.json` (sleep sessions), `health-cycles.json` (observed cycle starts), `health-days.json` (timezone change log), `health-readings.json` (individual blood pressure readings), `health-check-ins.json` (morning check-ins, opt-in), `health-strength.json` (the strength log, when its export is switched on), `health-labs.json` (lab results from Apple Health Records, opt-in, folder export only, never iCloud Drive), `health-tags.json` (logged tags with supplements marked, opt-in in the app) and `.health-manifest.json` (what the phone last wrote, for the stale-copy check). The server reads all of them and writes only `health-events-agent.json` (events logged with `add_event`). An absent file is reported as `available:false` with a note, never as "no data". Formats: [docs/SCHEMA-CONTRACTS.md](docs/SCHEMA-CONTRACTS.md).
+The daily cache (`.health-cache.json`) and workouts cache are joined by optional context files, all optional: `health-events.json` (the logging surface), `health-profile.json` (opt-in context), `health-sessions.json` (sleep sessions), `health-cycles.json` (observed cycle starts), `health-days.json` (timezone change log), `health-readings.json` (individual blood pressure readings), `health-check-ins.json` (morning check-ins, opt-in), `health-strength.json` (the strength log, when its export is switched on, or pushed by the app over LAN when Local network > Strength log is on), `health-labs.json` (lab results from Apple Health Records, opt-in, folder export only, never iCloud Drive), `health-tags.json` (logged tags with supplements marked, opt-in in the app) and `.health-manifest.json` (what the phone last wrote, for the stale-copy check). The server reads all of them and writes only `health-events-agent.json` (events logged with `add_event`). An absent file is reported as `available:false` with a note, never as "no data". Formats: [docs/SCHEMA-CONTRACTS.md](docs/SCHEMA-CONTRACTS.md).
 
 Two patterns worth knowing: [query a parent's Apple Health from your own AI](docs/caregiver-setup.md) (consent-first, the parent's phone is the authority) and [logging data into Apple Health via Shortcuts](docs/shortcuts-write-bridge.md) (the server never writes to Apple Health).
 
@@ -283,6 +283,8 @@ exports keep working either way. A missing or wrong passphrase, or a file that f
 check, is reported as such (`get_mcp_status` says `encrypted: true` plus the reason, `--doctor` prints
 an `encryption:` line), never as "no data". The passphrase is never logged or echoed.
 
+**LAN receiver and the strength log.** `POST /health-cache` (and the single text frame of `/health-cache-ws`) takes two bodies. The daily summary is merged into `.health-cache.json` as before. A document with `"type": "strength.log"` (the app's opt-in, off-by-default Local network > Strength log switch; same body as the webhook's `strength.log`, see [docs/SCHEMA-CONTRACTS.md](docs/SCHEMA-CONTRACTS.md) sections 10 and 14) is validated, rebuilt from an allowlist and written whole to `health-strength.json` in `HEALTH_DATA_DIR`, which `get_strength_log` already reads. It is a replace, never a merge, so a session deleted in the app disappears on the next push. The reply is `200 {"ok":true,"type":"strength.log","sessions":N}`, or `400` for a document with no `data.strengthLog.sessions`. Tokens, the Host/Origin checks, `HEALTH_EXPORT_PASSPHRASE` and `HEALTH_REQUIRE_ENCRYPTED=1` apply exactly as for the summary. No new tool and no new endpoint; an older receiver ignores the document.
+
 The LAN receiver (`HEALTH_LISTEN=1`) decrypts encrypted pushes with the same variable and answers
 `422` with a machine `reason` (`passphrase_missing`, `passphrase_mismatch`, `tampered`, `malformed`,
 `unsupported_version`, `passphrase_file_unreadable`, `encryption_required`). The pairing token rides

package/events.mjs

@@ -609,7 +609,7 @@ export async function getStrengthLog({ exercise, start, end } = {}) {
   const wanted = exercise?.trim() ? exercise.trim().toLocaleLowerCase('en') : null;
   const file = loadStrengthFile();
   if (!file) {
-    return absent(STRENGTH_FILE, 'The strength log appears when the user switches on Training > Include in exports in the iOS app and exports to iCloud Drive or a folder. It is off by default.');
+    return absent(STRENGTH_FILE, 'The strength log appears when the user switches on Training > Include in exports in the iOS app and exports to iCloud Drive or a folder, or switches on Strength log for the local network destination (Settings > Local network). It is off by default.');
   }
   const all = file.sessions.filter((s) => s && typeof s.day === 'string' && Array.isArray(s.exercises));
   let sessions = all;

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "health-export-ai",
   "display_name": "MetricBridge",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "Query your Apple Health data, exported by the MetricBridge iOS app to iCloud Drive, from any MCP agent. Local-first, read-only, zero dependencies.",
   "long_description": "A zero-dependency MCP server that exposes 194 Apple Health metrics (exported by the MetricBridge iOS app into an iCloud Drive folder) to any MCP-compatible agent: Claude Desktop, opencode, Cursor, OpenClaw, Hermes. No bridge, no Docker, no HTTP receiver: the server reads the synced cache file directly over stdio. 22 tools: get_mcp_status, get_freshness, list_metrics, get_health_metrics, get_trends, compare_periods, get_structured_export, get_intraday, query_health_data, list_events, add_event, remove_event, get_profile, get_check_ins, get_workouts, get_sleep_sessions, get_strength_log, get_lab_results, get_cycle_context, list_tags, correlate_metrics, resolve_metric. Every tool is read-only except add_event and remove_event, which write only health-events-agent.json in the export folder (never Apple Health, never a file the app writes). Plus 23 MCP prompts and a --demo mode with a synthetic dataset. Get the companion iOS app on the App Store: https://apps.apple.com/app/apple-store/id6784185201?pt=129083290&ct=githubreadme&mt=8&ppid=2c28f88a-d94f-48f9-8e6a-74a8d89ce66e",
   "author": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "health-export-mcp",
   "mcpName": "io.github.PhilipAD/health-export-mcp",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "type": "module",
   "description": "MCP server for your own Apple Health data: 194 metrics, 22 tools (20 read-only), 23 prompts. Zero dependencies, local stdio, no account. Try it: npx -y health-export-mcp --demo",
   "keywords": [

package/receiver.mjs

@@ -8,6 +8,11 @@
 //   POST /health-cache          (HTTP — reliable, works from iOS background uploads)
 //   GET  /health-cache-ws       (WebSocket upgrade — foreground real-time push)
 //   Both write <HEALTH_DATA_DIR>/.health-cache.json, which the MCP server then reads.
+//   Both also accept ONE typed document, `strength.log` (the app's opt-in "Strength log" switch for
+//   this destination): it is validated and written whole to <HEALTH_DATA_DIR>/health-strength.json,
+//   the file `get_strength_log` reads. Any other `type` is still treated as the daily summary (an
+//   unknown key is not a metric and is skipped), so a newer app never breaks an older receiver and
+//   the other way round.
 //
 // Security:
 //   - Binds 127.0.0.1 by default; HEALTH_LISTEN_HOST=0.0.0.0 for LAN.
@@ -59,6 +64,33 @@ const isLoopback = (h) => h === '127.0.0.1' || h === '::1' || h === 'localhost';
 
 const ISO_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
 
+// Source attribution (cache schema minor 2, whole-person reconciliation layer 1): `src` is the
+// label of the source the day's value came from; `by` maps every source that recorded that day to
+// its value. The app stamps these onto daily points and the MCP server reads them back verbatim
+// (healthstore.mjs rollUp → `src`/`by`), so a LAN push MUST carry them through untouched — dropping
+// them here silently strips the provenance every agent answer cites. They are still untrusted from a
+// client and validated like everything else: a short non-empty label, and a flat map of short
+// non-empty labels to finite numbers.
+const SRC_LABEL_MAX = 64, BY_SOURCES_MAX = 64;
+function sanitizeSrc(src) {
+  if (typeof src !== 'string') return null;
+  if (src.length === 0 || src.length > SRC_LABEL_MAX) return null;
+  return src;
+}
+function sanitizeBy(by) {
+  if (!by || typeof by !== 'object' || Array.isArray(by)) return null;
+  const entries = Object.entries(by);
+  if (entries.length === 0 || entries.length > BY_SOURCES_MAX) return null;
+  const out = {};
+  for (const [label, v] of entries) {
+    if (typeof label !== 'string' || label.length === 0 || label.length > SRC_LABEL_MAX) return null;
+    const n = Number(v);
+    if (!Number.isFinite(n)) return null;
+    out[label] = n;
+  }
+  return out;
+}
+
 // Validate/sanitise a pushed summary so a malicious LAN client can't poison the agent's context.
 function sanitize(incoming) {
   const out = {};
@@ -77,7 +109,13 @@ function sanitize(incoming) {
       // Kept only when it is a plain ISO 8601 instant, so a pushed payload cannot smuggle anything
       // else through to what the MCP server reads.
       const r = typeof p.r === 'string' && ISO_INSTANT.test(p.r) ? p.r : null;
-      daily.push(r ? { d: p.d, v, r } : { d: p.d, v });
+      const point = { d: p.d, v };
+      if (r) point.r = r;
+      const src = sanitizeSrc(p.src);
+      if (src !== null) point.src = src;
+      const by = sanitizeBy(p.by);
+      if (by !== null) point.by = by;
+      daily.push(point);
     }
     if (!daily.length) continue;
     out[name] = { unit: typeof m.unit === 'string' ? m.unit.slice(0, 32) : '', cumulative: !!m.cumulative, daily };
@@ -134,19 +172,135 @@ export function mergeCache(existing, incoming) {
     }
     for (const p of m.daily) {
       const prev = byDay.get(p.d);
-      const keep = !p.r && typeof prev?.r === 'string' && prev.v === p.v;
-      byDay.set(p.d, keep ? { ...p, r: prev.r } : p);
+      // A day keeps its recompute stamp (`r`) and source attribution (`src`/`by`) across a later
+      // push that re-sends the same value without them, matching HealthCache.merge on the app side;
+      // a changed value makes both stale, so they are replaced by the incoming point's own (or none).
+      const same = prev && prev.v === p.v;
+      const keep = same && !p.r && typeof prev.r === 'string';
+      const mergedPoint = { ...p };
+      if (keep) mergedPoint.r = prev.r;
+      if (same && !('src' in mergedPoint) && typeof prev.src === 'string') mergedPoint.src = prev.src;
+      if (same && !('by' in mergedPoint) && prev.by && typeof prev.by === 'object' && !Array.isArray(prev.by)) mergedPoint.by = prev.by;
+      byDay.set(p.d, mergedPoint);
     }
     merged[name] = { unit: m.unit || merged[name]?.unit || '', cumulative: !!m.cumulative,
       daily: [...byDay.entries()].sort((a, b) => a[0].localeCompare(b[0]))
-        .map(([d, p]) => (typeof p.r === 'string' ? { d, v: p.v, r: p.r } : { d, v: p.v })) };
+        .map(([d, p]) => {
+          const out = { d, v: p.v };
+          if (typeof p.r === 'string') out.r = p.r;
+          if (typeof p.src === 'string') out.src = p.src;
+          if (p.by && typeof p.by === 'object' && !Array.isArray(p.by)) out.by = p.by;
+          return out;
+        }) };
   }
   return merged;
 }
 
+
+// ---- strength.log (typed document, docs/SCHEMA-CONTRACTS.md sections 10 and 14) ----------------
+//
+// The app sends the SAME body the webhook gets: {type:"strength.log", schema:1, id, app, sentAt,
+// data:{metrics:[], strengthLog:{mode:"replace", unit, formula, sessions, records, routines}}}.
+// It is a whole-state replace, so this writes health-strength.json (the exact shape the file export
+// writes: schema, app, writtenAt, unit, formula, sessions, records, routines) and never merges.
+// Everything is rebuilt field by field from an allowlist: the body comes from a LAN client and ends
+// up in an agent's context, so unknown keys are dropped, strings are length-capped, numbers must be
+// finite and the sizes are bounded.
+export const STRENGTH_TYPE = 'strength.log';
+export const STRENGTH_FILE = 'health-strength.json';
+const MAX_SESSIONS = 20000, MAX_EXERCISES = 100, MAX_SETS = 300, MAX_RECORDS = 2000, MAX_ROUTINES = 500, MAX_REP_BESTS = 10;
+const str = (v, max) => (typeof v === 'string' && v.length > 0 ? v.slice(0, max) : undefined);
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : undefined);
+const dayStr = (v) => (typeof v === 'string' && DAY_RE.test(v) ? v : undefined);
+const pick = (src, spec) => {
+  const out = {};
+  for (const [k, f] of Object.entries(spec)) { const v = f(src?.[k]); if (v !== undefined) out[k] = v; }
+  return out;
+};
+const sName = (v) => str(v, 120);
+const setSpec = {
+  reps: num, kg: num, rpe: num,
+  kind: (v) => (v === 'warmup' || v === 'working' ? v : undefined),
+};
+const cleanSets = (a) => (Array.isArray(a) ? a.slice(0, MAX_SETS).filter((x) => x && typeof x === 'object')
+  .map((x) => pick(x, setSpec)).filter((x) => x.reps !== undefined && x.kind) : []);
+const cleanExercises = (a, extra) => (Array.isArray(a) ? a.slice(0, MAX_EXERCISES).map((e) => {
+  const name = sName(e?.name);
+  return name ? { name, ...pick(e, extra), sets: cleanSets(e.sets) } : null;
+}).filter(Boolean) : []);
+const sessionSpec = {
+  id: (v) => str(v, 64), start: (v) => str(v, 40), day: dayStr, minutes: num, effort: num,
+  workoutId: (v) => str(v, 64), routineId: (v) => str(v, 64), notes: (v) => str(v, 2000),
+  volumeKg: num, workingSets: num,
+};
+const recordSpec = {
+  exercise: sName, bestEstimateKg: num, bestEstimateDay: dayStr, heaviestKg: num, sessions: num, lastDay: dayStr,
+  bestSetVolumeKg: num, bestSetVolumeDay: dayStr, bestSessionVolumeKg: num, bestSessionVolumeDay: dayStr,
+};
+const routineSpec = { id: (v) => str(v, 64), name: (v) => str(v, 120), createdAt: (v) => str(v, 40), lastUsedDay: dayStr };
+
+/// Rebuild the strength log from a pushed `strength.log` document, or throw if it has no sessions list.
+export function sanitizeStrengthLog(doc, now = new Date()) {
+  const log = doc?.data?.strengthLog;
+  if (!log || typeof log !== 'object' || !Array.isArray(log.sessions)) {
+    throw Object.assign(new Error('strength.log without data.strengthLog.sessions'), { status: 400 });
+  }
+  const sessions = log.sessions.slice(0, MAX_SESSIONS).filter((s) => s && typeof s === 'object' && dayStr(s.day)).map((s) => ({
+    ...pick(s, sessionSpec),
+    exercises: cleanExercises(s.exercises, { volumeKg: num, bestEstimateKg: num }),
+  }));
+  const records = (Array.isArray(log.records) ? log.records.slice(0, MAX_RECORDS) : []).filter((r) => r && sName(r.exercise)).map((r) => {
+    const o = pick(r, recordSpec);
+    const reps = (Array.isArray(r.repBests) ? r.repBests.slice(0, MAX_REP_BESTS) : [])
+      .map((b) => pick(b, { reps: num, kg: num, day: dayStr })).filter((b) => b.reps !== undefined && b.kg !== undefined && b.day);
+    if (reps.length) o.repBests = reps;
+    return o;
+  });
+  const routines = (Array.isArray(log.routines) ? log.routines.slice(0, MAX_ROUTINES) : []).filter((r) => r && sName(r.name)).map((r) => ({
+    ...pick(r, routineSpec), exercises: cleanExercises(r.exercises, {}),
+  }));
+  const sent = typeof doc.sentAt === 'string' && ISO_INSTANT.test(doc.sentAt) ? doc.sentAt : null;
+  return {
+    schema: 1,
+    app: str(doc.app, 32) ?? '',
+    writtenAt: sent ?? now.toISOString().replace(/\.\d+Z$/, 'Z'),
+    unit: 'kg',
+    ...(str(log.formula, 32) && { formula: str(log.formula, 32) }),
+    sessions, records, routines,
+  };
+}
+
+function writeStrength(dir, doc, passphrase = configuredPassphrase(), sealFresh = false) {
+  const file = path.join(dir, STRENGTH_FILE);
+  const clean = sanitizeStrengthLog(doc);
+  fs.mkdirSync(dir, { recursive: true });
+  // Same at-rest rule as the cache: an existing envelope keeps its salt (the app and this server
+  // hold the key for that salt), a fresh file is sealed when encryption is required.
+  const base = readMergeBase(file, null, passphrase);
+  const text = JSON.stringify(clean, null, 2);
+  const out = sealOutput(base.sealedLike, text, passphrase, sealFresh);
+  if (Buffer.byteLength(out) > MAX_CACHE_FILE) throw new Error('strength log would exceed the size ceiling');
+  atomicWrite(file, out);
+  log(`strength.log -> ${clean.sessions.length} sessions in ${file}`);
+  return clean.sessions.length;
+}
+
+function sealOutput(sealedLike, text, passphrase, sealFresh) {
+  if (sealedLike || (sealFresh && passphrase)) {
+    return JSON.stringify(sealEnvelope(text, passphrase, { salt: sealedLike?.salt, iter: sealedLike?.iter }));
+  }
+  if (sealFresh) throw new Error('encryption required but no passphrase configured - refusing to store plaintext');
+  return text;
+}
+
+function atomicWrite(file, out) {
+  const tmp = `${file}.tmp-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;  // unique → no concurrent-write race
+  fs.writeFileSync(tmp, out, { mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
 function writeCache(dir, json, passphrase = configuredPassphrase(), sealFresh = false) {
   const file = path.join(dir, '.health-cache.json');
-  const tmp = `${file}.tmp-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;  // unique → no concurrent-write race
   fs.mkdirSync(dir, { recursive: true });
   const base = readMergeBase(file, {}, passphrase);
   const merged = mergeCache(base.value, json);
@@ -157,19 +311,11 @@ function writeCache(dir, json, passphrase = configuredPassphrase(), sealFresh =
   // every incoming push was encrypted — the flag promised full at-rest encryption and silently
   // delivered plaintext. Refuse to store plaintext when encryption is required but no passphrase
   // is configured: a misconfiguration, not a downgrade path.
-  let out;
-  if (base.sealedLike || (sealFresh && passphrase)) {
-    out = JSON.stringify(sealEnvelope(text, passphrase, { salt: base.sealedLike?.salt, iter: base.sealedLike?.iter }));
-  } else if (sealFresh) {
-    throw new Error('encryption required but no passphrase configured - refusing to store plaintext');
-  } else {
-    out = text;
-  }
+  const out = sealOutput(base.sealedLike, text, passphrase, sealFresh);
   if (Buffer.byteLength(out) > MAX_CACHE_FILE) {
     throw new Error('cache would exceed the size ceiling; refusing to grow it further');
   }
-  fs.writeFileSync(tmp, out, { mode: 0o600 });
-  fs.renameSync(tmp, file);
+  atomicWrite(file, out);
   log(`merged ${Object.keys(sanitize(json)).length} -> ${Object.keys(merged).length} metrics in ${file}`);
   return Object.keys(merged).length;
 }
@@ -185,6 +331,8 @@ export function startReceiver({
   // passes HEALTH_REQUIRE_ENCRYPTED through to first-write sealing, closing the fresh-dir
   // plaintext-at-rest gap.
   onCache = (json) => writeCache(dir, json, passphrase(), requireEncrypted()),
+  // The `strength.log` typed document (whole-state replace into health-strength.json). Tests inject one.
+  onStrength = (doc) => writeStrength(dir, doc, passphrase(), requireEncrypted()),
   // A function, read per request: the environment is the source in production, tests inject one.
   passphrase = () => configuredPassphrase(),
   requireEncrypted = () => process.env.HEALTH_REQUIRE_ENCRYPTED === '1',
@@ -260,6 +408,11 @@ export function startReceiver({
             return finish(422, { ok: false, hae: true, reason, error: e instanceof EnvelopeError ? e.message : 'could not decrypt' });
           }
         }
+        if (parsed?.type === STRENGTH_TYPE) {
+          try { const n = onStrength(parsed); finish(200, { ok: true, hae: true, type: STRENGTH_TYPE, sessions: n }); }
+          catch (e) { log('strength.log refused', e.message); finish(e.status || 500, { ok: false, hae: true, error: 'strength.log: ' + (e.code || e.message) }); }
+          return;
+        }
         try { const n = onCache(parsed); finish(200, { ok: true, hae: true, metrics: n }); }
         catch (e) { log('write failed', e.message); finish(500, { ok: false, hae: true, error: 'write failed: ' + (e.code || e.message) }); } // 500 = disk/write
       });
@@ -297,8 +450,13 @@ export function startReceiver({
         let parsedMsg = JSON.parse(msg);
         if (requireEncrypted() && !isEnvelope(parsedMsg)) throw new Error('plaintext push refused (HEALTH_REQUIRE_ENCRYPTED)');
         if (isEnvelope(parsedMsg)) parsedMsg = openEnvelopeJSON(parsedMsg, passphrase());
-        const n = onCache(parsedMsg);
-        socket.write(encodeTextFrame(JSON.stringify({ ok: true, metrics: n })));
+        if (parsedMsg?.type === STRENGTH_TYPE) {
+          const n = onStrength(parsedMsg);
+          socket.write(encodeTextFrame(JSON.stringify({ ok: true, type: STRENGTH_TYPE, sessions: n })));
+        } else {
+          const n = onCache(parsedMsg);
+          socket.write(encodeTextFrame(JSON.stringify({ ok: true, metrics: n })));
+        }
       }
       catch (e) { log('bad WS json', e.message); socket.write(encodeTextFrame(JSON.stringify({ ok: false }))); }
       socket.end();

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/PhilipAD/health-export-mcp",
     "source": "github"
   },
-  "version": "1.10.0",
+  "version": "1.10.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "health-export-mcp",
-      "version": "1.10.0",
+      "version": "1.10.2",
       "transport": {
         "type": "stdio"
       },
@@ -41,9 +41,9 @@
     },
     {
       "registryType": "mcpb",
-      "identifier": "https://github.com/PhilipAD/health-export-mcp/releases/download/v1.10.0/health-export.mcpb",
-      "version": "1.10.0",
-      "fileSha256": "85cb4acc408ee1f9ba35150c7cf397a970c53fbeb2f58b2886faf6e74d1e28a9",
+      "identifier": "https://github.com/PhilipAD/health-export-mcp/releases/download/v1.10.2/health-export.mcpb",
+      "version": "1.10.2",
+      "fileSha256": "ed575969205de53d77611fd674ced59bc48023e5e34d6230f120bec46e1e0b94",
       "transport": {
         "type": "stdio"
       },

package/server.mjs

@@ -21,7 +21,7 @@ import * as ev from './events.mjs';
 import { PROMPTS } from './prompts.mjs';
 import { DEMO } from './demo.mjs';
 
-const SERVER = { name: 'health-export-ai', version: '1.10.0' };
+const SERVER = { name: 'health-export-ai', version: '1.10.2' };
 const DEFAULT_PROTOCOL = '2025-06-18';
 const log = (...a) => process.stderr.write('[mcp] ' + a.join(' ') + '\n');