health-export-mcp 1.4.3 → 1.4.4

package/apply-mcp-config.mjs

@@ -173,11 +173,11 @@ if (spec.shape === 'vscode') {
     const m = typeof v === 'string' && v.match(/^\$\{input:([A-Za-z0-9_]+)\}$/);
     if (m) used.add(m[1]);
   }
-  const DESC = { health_pairing_secret: 'Health Export pairing code', health_listen_token: 'Health Export LAN token (iOS pairing code)' };
+  const DESC = { health_pairing_secret: 'MetricBridge pairing code', health_listen_token: 'MetricBridge LAN token (iOS pairing code)' };
   root.inputs = Array.isArray(root.inputs) ? root.inputs : [];
   for (const id of used) {
     if (!root.inputs.some((i) => i && i.id === id)) {
-      root.inputs.push({ type: 'promptString', id, description: DESC[id] || 'Health Export secret', password: true });
+      root.inputs.push({ type: 'promptString', id, description: DESC[id] || 'MetricBridge secret', password: true });
     }
   }
   root.inputs = root.inputs.filter((i) => !(i && /^health_(pairing_secret|listen_token)$/.test(i.id) && !used.has(i.id)));

package/healthstore.mjs

@@ -121,11 +121,11 @@ export async function loadMetrics() {
   const meta = raw._meta;
   if (meta && Number(meta.schema) > SUPPORTED_SCHEMA) {
     throw new Error(
-      `This health cache was written by Health Export ${meta.app ?? 'a newer version'} using ` +
+      `This health cache was written by MetricBridge ${meta.app ?? 'a newer version'} using ` +
       `cache schema ${meta.schema}, but this MCP server only understands ${SUPPORTED_SCHEMA}. ` +
       // These are the two channels the site and SKILL.md actually document. (npm publishes
       // health-export-mcp too, but the pinned artifacts below are the checksum-verified path.)
-      `Update the Health Export MCP server: reinstall the bundle from https://www.healthexport.dev/health-export.mcpb, or re-download https://www.healthexport.dev/mcp/healthstore.mjs. Reading it anyway ` +
+      `Update the health-export-mcp server: reinstall the bundle from https://www.healthexport.dev/health-export.mcpb, or re-download https://www.healthexport.dev/mcp/healthstore.mjs. Reading it anyway ` +
       `could report wrong numbers.`);
   }
   // NULL PROTOTYPE. Every existence check here is `metrics[name]`, so inherited keys answered for

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "health-export-ai",
   "display_name": "MetricBridge",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "Query your Apple Health data, exported by the MetricBridge iOS app to iCloud Drive, from any MCP agent. Local-first, read-only, zero dependencies.",
   "long_description": "A zero-dependency MCP server that exposes 190 Apple Health metrics (exported by the MetricBridge iOS app into an iCloud Drive folder) to any MCP-compatible agent: Claude Desktop, opencode, Cursor, OpenClaw, Hermes. No bridge, no Docker, no HTTP receiver: the server reads the synced cache file directly over stdio. 14 tools: get_mcp_status, list_metrics, get_health_metrics, get_trends, compare_periods, get_structured_export, get_intraday, query_health_data, list_events, get_profile, get_workouts, get_sleep_sessions, get_cycle_context, correlate_metrics. Plus 22 MCP prompts and a --demo mode with a synthetic dataset. Get the companion iOS app on the App Store: https://apps.apple.com/app/id6784185201",
   "author": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "health-export-mcp",
   "mcpName": "io.github.PhilipAD/health-export-mcp",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "type": "module",
   "description": "Open-source, zero-dependency Model Context Protocol (MCP) server to query Apple Health / HealthKit data (190 metrics) from Claude, ChatGPT, Cursor, OpenClaw, Hermes and any MCP agent.",
   "keywords": [
@@ -42,7 +42,6 @@
     "gen-deeplinks.mjs",
     "manifest.json",
     "server.json",
-    "smithery.yaml",
     "glama.json",
     ".mcp.json",
     "health-export.mcpb",

package/receiver.mjs

@@ -67,11 +67,50 @@ function sanitize(incoming) {
   return out;
 }
 
+// Validate the `_authoritative` window the app sends alongside a push (AppModel LAN branch).
+// Same distrust as `sanitize`: strict day format, ordered range, allowlisted metric names.
+const DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
+function sanitizeAuthoritative(incoming) {
+  const a = incoming && typeof incoming === 'object' ? incoming._authoritative : null;
+  if (!a || typeof a !== 'object') return null;
+  const { start, end } = a;
+  if (typeof start !== 'string' || typeof end !== 'string' || !DAY_RE.test(start) || !DAY_RE.test(end) || start > end) return null;
+  if (!Array.isArray(a.metrics)) return null;
+  const metrics = new Set(a.metrics.slice(0, MAX_METRICS).filter((n) => typeof n === 'string' && /^[A-Za-z0-9_]{1,64}$/.test(n)));
+  return { start, end, metrics };
+}
+
 // Merge a pushed (sanitised) summary into the cache — union by metric+day, last-write-wins.
+// When the push carries `_authoritative` {start, end, metrics}, the app just re-read those days for
+// those metrics, so inside that window the push IS the truth: any cached day it did not produce was
+// deleted in Apple Health (or is a ghost key from a previous time zone) and is pruned. Mirrors
+// `HealthCache.merge(_:_:authoritativeDays:authoritativeMetrics:)`; without it a LAN-only cache
+// kept deletions and TZ ghost days forever. Metrics not listed (e.g. sensitive types excluded from
+// the run) are never pruned. `yyyy-MM-dd` is fixed-width, so string order IS chronological.
 function mergeCache(existing, incoming) {
   const merged = { ...(existing || {}) };
-  for (const [name, m] of Object.entries(sanitize(incoming))) {
+  const cleaned = sanitize(incoming);
+  const auth = sanitizeAuthoritative(incoming);
+  const inRange = (d) => !!auth && d >= auth.start && d <= auth.end;
+
+  if (auth) {
+    for (const name of auth.metrics) {
+      if (cleaned[name] || !Object.hasOwn(merged, name)) continue;
+      const prev = Array.isArray(merged[name]?.daily) ? merged[name].daily : [];
+      const kept = prev.filter((p) => !inRange(p?.d));
+      if (kept.length === prev.length) continue;
+      // A full wipe removes the metric, not a present-but-empty shell agents read as "known".
+      if (kept.length === 0) delete merged[name];
+      else merged[name] = { ...merged[name], daily: kept };
+    }
+  }
+
+  for (const [name, m] of Object.entries(cleaned)) {
     const byDay = new Map((merged[name]?.daily || []).map((p) => [p.d, p.v]));
+    if (auth && auth.metrics.has(name)) {
+      const incomingDays = new Set(m.daily.map((p) => p.d));
+      for (const d of [...byDay.keys()]) if (inRange(d) && !incomingDays.has(d)) byDay.delete(d);
+    }
     for (const p of m.daily) byDay.set(p.d, p.v);
     merged[name] = { unit: m.unit || merged[name]?.unit || '', cumulative: !!m.cumulative,
       daily: [...byDay.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([d, v]) => ({ d, v })) };

package/server.json

@@ -6,13 +6,13 @@
     "url": "https://github.com/PhilipAD/health-export-mcp",
     "source": "github"
   },
-  "version": "1.4.3",
+  "version": "1.4.4",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "health-export-mcp",
-      "version": "1.4.3",
+      "version": "1.4.4",
       "transport": {
         "type": "stdio"
       }

package/server.mjs

@@ -21,7 +21,7 @@ import * as ev from './events.mjs';
 import { PROMPTS } from './prompts.mjs';
 import { DEMO } from './demo.mjs';
 
-const SERVER = { name: 'health-export-ai', version: '1.4.3' };
+const SERVER = { name: 'health-export-ai', version: '1.4.4' };
 const DEFAULT_PROTOCOL = '2025-06-18';
 const log = (...a) => process.stderr.write('[mcp] ' + a.join(' ') + '\n');
 

package/smithery.yaml

@@ -1,29 +0,0 @@
-# Smithery deployment configuration for health-export-mcp
-# https://smithery.ai/docs/deploy
-build:
-  dockerfile: Dockerfile
-  dockerBuildPath: .
-startCommand:
-  type: stdio
-  configSchema:
-    type: object
-    properties:
-      healthDataDir:
-        type: string
-        description: "Path to Apple Health export directory containing export.xml (local path on user machine)"
-        default: ""
-      healthListen:
-        type: string
-        description: "Set to '1' to enable LAN push from iOS Health Export app"
-        default: ""
-    required: []
-  commandFunction:
-    |-
-      (config) => ({
-        command: 'node',
-        args: ['server.mjs'],
-        env: {
-          HEALTH_DATA_DIR: config.healthDataDir || '',
-          HEALTH_LISTEN: config.healthListen || ''
-        }
-      })