hevy-mcp 6.1.0 → 6.1.1

package/README.md

@@ -80,7 +80,7 @@ so your client does not need Node.js, Bun, Docker, or a local server process.
 Production URL:
 
 ```text
-https://hevy.chrisdoc.dev/mcp
+https://mcp.hevy-mcp.dev/mcp
 ```
 
 The endpoint uses Streamable HTTP. Send your Hevy API key as a bearer token on
@@ -95,7 +95,7 @@ Codex, then add the hosted server:
 ```bash
 export HEVY_API_KEY=your-hevy-api-key
 codex mcp add hevy \
-  --url https://hevy.chrisdoc.dev/mcp \
+  --url https://mcp.hevy-mcp.dev/mcp \
   --bearer-token-env-var HEVY_API_KEY
 ```
 
@@ -111,7 +111,7 @@ Clients that accept a remote MCP URL and fixed headers commonly use this shape:
 {
 	"mcpServers": {
 		"hevy": {
-			"url": "https://hevy.chrisdoc.dev/mcp",
+			"url": "https://mcp.hevy-mcp.dev/mcp",
 			"headers": {
 				"Authorization": "Bearer your-hevy-api-key"
 			}
@@ -363,7 +363,7 @@ corresponding delete tools.
 The production MCP server is live at:
 
 ```text
-https://hevy.chrisdoc.dev/mcp
+https://mcp.hevy-mcp.dev/mcp
 ```
 
 It is the quickest way to use `hevy-mcp`: there is nothing to install or keep
@@ -377,7 +377,7 @@ Clients must send their Hevy API key as a fixed authorization header:
 {
 	"mcpServers": {
 		"hevy": {
-			"url": "https://hevy.chrisdoc.dev/mcp",
+			"url": "https://mcp.hevy-mcp.dev/mcp",
 			"headers": {
 				"Authorization": "Bearer your-hevy-api-key"
 			}

package/dist/cli.mjs

@@ -8,8 +8,8 @@
 		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "d805d34c-9cce-4622-8b67-728aa0cacb5d", e._sentryDebugIdIdentifier = "sentry-dbid-d805d34c-9cce-4622-8b67-728aa0cacb5d");
 	} catch (e) {}
 })();
-import { i as flushTelemetry, r as MissingHevyApiKeyError, t as runServer } from "./runtime-D_9Jylpe.mjs";
-import { a as createSafeErrorDiagnostic } from "./src-tzdOTpis.mjs";
+import { i as flushTelemetry, r as MissingHevyApiKeyError, t as runServer } from "./runtime-CQ5qda5F.mjs";
+import { a as createSafeErrorDiagnostic } from "./src-c7i9L8Mm.mjs";
 //#region src/cli.ts
 runServer().catch(async (error) => {
 	if (error instanceof MissingHevyApiKeyError) console.error(error.message);

package/dist/index.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Generated with tsdown
 // https://tsdown.dev
-import { o as createHevyClient, t as createHevyMcpServer } from "./src-tzdOTpis.mjs";
+import { o as createHevyClient, t as createHevyMcpServer } from "./src-c7i9L8Mm.mjs";
 import { z } from "zod";
 //#region src/index.ts
 const serverConfigSchema = z.object({ apiKey: z.string().min(1, "Hevy API key is required").describe("Your Hevy API key (available in the Hevy app settings).") });
@@ -32,7 +32,7 @@ function createNodeMcpServer({ apiKey }, _transport = "stdio", lifecycleSignal)
 * does not evaluate the runtime bootstrap; it is loaded only when invoked.
 */
 async function runStdioServer() {
-	const { runStdioServer: run } = await import("./runtime-D_9Jylpe.mjs").then((n) => n.n);
+	const { runStdioServer: run } = await import("./runtime-CQ5qda5F.mjs").then((n) => n.n);
 	return run();
 }
 /**
@@ -40,7 +40,7 @@ async function runStdioServer() {
 * does not evaluate the runtime bootstrap; it is loaded only when invoked.
 */
 async function runServer() {
-	const { runServer: run } = await import("./runtime-D_9Jylpe.mjs").then((n) => n.n);
+	const { runServer: run } = await import("./runtime-CQ5qda5F.mjs").then((n) => n.n);
 	return run();
 }
 //#endregion

package/dist/{runtime-D_9Jylpe.mjs → runtime-CQ5qda5F.mjs}

@@ -5,10 +5,10 @@
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
 		var n = new e.Error().stack;
-		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "b2b3cdcb-1211-4999-8f1f-facca1d41d6b", e._sentryDebugIdIdentifier = "sentry-dbid-b2b3cdcb-1211-4999-8f1f-facca1d41d6b");
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "c292bf26-255c-46b3-9cb2-3343afe7b7ce", e._sentryDebugIdIdentifier = "sentry-dbid-c292bf26-255c-46b3-9cb2-3343afe7b7ce");
 	} catch (e) {}
 })();
-import { a as createSafeErrorDiagnostic, c as diagnosticEndpointIdentity, i as bucketCount, l as metricEndpointIdentity, n as createExecutionProjection, o as createHevyClient, r as mergeAbortSignals, s as SAFE_OBSERVATION_CODES, t as createHevyMcpServer, u as isHevyHttpError } from "./src-tzdOTpis.mjs";
+import { a as createSafeErrorDiagnostic, c as diagnosticEndpointIdentity, i as bucketCount, l as metricEndpointIdentity, n as createExecutionProjection, o as createHevyClient, r as mergeAbortSignals, s as SAFE_OBSERVATION_CODES, t as createHevyMcpServer, u as isHevyHttpError } from "./src-c7i9L8Mm.mjs";
 import { ZodError, z } from "zod";
 import { deserializeMessage } from "@modelcontextprotocol/server";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -69,6 +69,7 @@ function removeHomePath(value) {
 	const home = process.env.HOME?.trim();
 	return (home ? value.replace(new RegExp(escapeRegExp(home), "g"), "~") : value).replace(/\/(?:Users|home)\/[^/\s]+/g, "~");
 }
+const EMAIL = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
 function removeControlCharacters(value) {
 	let output = "";
 	let inEscapeSequence = false;
@@ -90,7 +91,7 @@ function removeControlCharacters(value) {
 }
 /** Remove common credentials and URL payloads without inspecting object fields. */
 function sanitizeDiagnosticText(value, maxLength = MAX_MESSAGE_LENGTH) {
-	return truncate(removeHomePath(removeControlCharacters(value).replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [REDACTED]").replace(/\b(api[-_ ]?key|authorization|password|secret|token)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi, "$1=[REDACTED]").replace(/\bhttps?:\/\/[^\s)<>]+/gi, "[URL]")).trim(), maxLength);
+	return truncate(removeHomePath(removeControlCharacters(value).replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [REDACTED]").replace(/\b(api[-_ ]?key|authorization|password|secret|token)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi, "$1=[REDACTED]").replace(EMAIL, "[EMAIL_REDACTED]").replace(/\bhttps?:\/\/[^\s)<>]+/gi, "[URL]")).trim(), maxLength);
 }
 function sanitizeAttributeValue(_key, value) {
 	if (typeof value !== "string") return value;
@@ -162,6 +163,7 @@ function normalizeFailure(error, context) {
 	const text = getExceptionText(error);
 	const message = DIAGNOSTIC_DETAILS_ENABLED && text.message ? sanitizeDiagnosticText(text.message) : void 0;
 	const stack = DIAGNOSTIC_DETAILS_ENABLED && text.stack ? sanitizeDiagnosticText(text.stack, MAX_STACK_LENGTH) : void 0;
+	const responseError = DIAGNOSTIC_DETAILS_ENABLED && isHevyHttpError(error) && error.responseError ? sanitizeDiagnosticText(error.responseError, MAX_ATTRIBUTE_LENGTH) : void 0;
 	attributes["exception.type"] = exceptionType;
 	addErrorAttributes(attributes, diagnostic, context.expected);
 	addHttpAttributes(attributes, diagnostic);
@@ -171,6 +173,7 @@ function normalizeFailure(error, context) {
 		exceptionType,
 		...message ? { message } : {},
 		...stack ? { stack } : {},
+		...responseError ? { responseError } : {},
 		exception: {
 			name: exceptionType,
 			...message ? { message } : {},
@@ -289,13 +292,17 @@ function captureFailure(error, context) {
 			scope.setFingerprint([...record.fingerprint]);
 			scope.setContext("mcp", {
 				kind: context.kind,
-				...record.attributes
+				...record.attributes,
+				...record.responseError ? { "hevy.api.response_error": record.responseError } : {}
 			});
 			return Sentry.captureException(createSentryError(record));
 		});
 	} catch {}
 	if (span) try {
-		if (!duplicate && !context.expected) span.recordException(record.exception);
+		if (!duplicate && !context.expected) {
+			span.recordException(record.exception);
+			if (record.responseError) span.addEvent("mcp.failure.detail", { "hevy.api.response_error": record.responseError });
+		}
 		setSpanAttributes(span, record.attributes);
 		if (!context.expected) span.setStatus({ code: SpanStatusCode.ERROR });
 		if (eventId) span.setAttribute("sentry.event_id", eventId);
@@ -358,7 +365,7 @@ function installProcessExceptionTracking(processLike = process) {
 	};
 }
 const name$1 = "hevy-mcp";
-const version$1 = "6.1.0";
+const version$1 = "6.1.1";
 const telemetryEnabled = process.env.HEVY_MCP_TELEMETRY !== "0";
 const collectorToken = "NH9vOela-HYreQxAbJa68cjEmORoEKM57EvneUDVcOo";
 const COLLECTOR_ENDPOINT = "https://otel.chrisdoc.dev/v1";
@@ -1237,6 +1244,9 @@ function safeErrorAttributes(observation) {
 		...code && SAFE_OBSERVATION_CODES.has(code) ? { error_code: code } : {}
 	};
 }
+function getDiagnosticResponseError(observation) {
+	return process.env.HEVY_MCP_TELEMETRY_DIAGNOSTICS === "0" ? void 0 : observation.error?.response_error;
+}
 function startApiSpan(start) {
 	const sessionId = getCurrentMcpSessionId();
 	const diagnosticEndpoint = diagnosticEndpointIdentity(start.endpoint);
@@ -1256,10 +1266,14 @@ function finishApiSpan(span, observation) {
 	if (observation.expectedReason) span.setAttribute("hevy.api.expected_reason", observation.expectedReason);
 	for (const [key, value] of Object.entries(errorAttributes)) span.setAttribute(key, value);
 	span.setStatus({ code: observation.outcome === "success" || observation.outcome === "expected" ? SpanStatusCode.OK : SpanStatusCode.ERROR });
-	if (observation.outcome !== "success" && observation.outcome !== "expected") span.addEvent("hevy.api.failure", {
-		"error.category": errorAttributes.error_category ?? "HevyHttpError",
-		...errorAttributes.error_code ? { "error.code": errorAttributes.error_code } : {}
-	});
+	if (observation.outcome !== "success" && observation.outcome !== "expected") {
+		const responseError = getDiagnosticResponseError(observation);
+		span.addEvent("hevy.api.failure", {
+			"error.category": errorAttributes.error_category ?? "HevyHttpError",
+			...errorAttributes.error_code ? { "error.code": errorAttributes.error_code } : {},
+			...responseError ? { "hevy.api.response_error": responseError } : {}
+		});
+	}
 	span.end();
 }
 /** Node-only adapter; the Worker graph never imports telemetry or metrics. */
@@ -1283,6 +1297,7 @@ function createNodeHevyClientOptions() {
 		onRequestComplete(observation) {
 			const retryCountBucket = bucketCount(observation.retryCount);
 			const errorAttributes = safeErrorAttributes(observation);
+			const responseError = getDiagnosticResponseError(observation);
 			const metricEndpoint = metricEndpointIdentity(observation.endpoint);
 			const diagnosticEndpoint = diagnosticEndpointIdentity(observation.endpoint);
 			const metricExecutionAttributes = projectExecutionAttributes(observation, "metric");
@@ -1312,6 +1327,7 @@ function createNodeHevyClientOptions() {
 				status: observation.status || null,
 				retryCountBucket,
 				outcome: observation.outcome,
+				...responseError ? { response_error: responseError } : {},
 				...errorAttributes
 			});
 		},
@@ -1905,7 +1921,15 @@ function installToolCallTracking(handlers, transport) {
 				} else span.setStatus({ code: SpanStatusCode.OK });
 				return result;
 			} catch (error) {
-				markSdkToolFailure(span, error, toolName);
+				const validation = error instanceof Error ? classifySdkValidation(error.message) : {
+					kind: "unknown",
+					expected: false
+				};
+				if (validation.kind === "tool_not_found") markSdkToolFailure(span, error, toolName, "validation", {
+					expected: true,
+					validationKind: validation.kind
+				});
+				else markSdkToolFailure(span, error, toolName);
 				throw error;
 			} finally {
 				span.end();
@@ -2503,4 +2527,4 @@ async function runServer() {
 //#endregion
 export { flushTelemetry as i, runtime_exports as n, MissingHevyApiKeyError as r, runServer as t };
 
-//# sourceMappingURL=runtime-D_9Jylpe.mjs.map
+//# sourceMappingURL=runtime-CQ5qda5F.mjs.map

package/dist/{src-tzdOTpis.mjs → src-c7i9L8Mm.mjs}

@@ -291,6 +291,70 @@ const getV1WorkoutsWorkoutid200Schema = z$1.lazy(() => workoutSchema);
 z$1.any();
 z$1.lazy(() => getV1WorkoutsWorkoutid200Schema);
 //#endregion
+//#region ../hevy-client/src/response-error.ts
+const MAX_RESPONSE_ERROR_INPUT_LENGTH = 4096;
+const MAX_RESPONSE_ERROR_LENGTH = 256;
+const RESPONSE_ERROR_KEYS = [
+	"error",
+	"message",
+	"detail"
+];
+const COOKIE_ASSIGNMENT = /(\b(?:cookie|set-cookie)\s*[:=]\s*)[^;\s]+/gi;
+const SECRET_ASSIGNMENT = /(\b(?:authorization|proxy-authorization|api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|id[-_ ]?token|token|client[-_ ]?secret|password|passwd|secret|credential|signature)\b\s*[:=]\s*)(?:"[^"]*"|'[^']*'|(?:Bearer\s+)?[^\s,;}"]+)/gi;
+const BEARER_TOKEN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+const JSON_WEB_TOKEN = /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g;
+const SECRET_QUERY_PARAMETER = /([?&](?:api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|token|signature|password|secret)=)[^&#\s]+/gi;
+const HTTP_URL = /\bhttps?:\/\/[^\s<>"']+/gi;
+const EMAIL = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+const UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/gi;
+function isResponseErrorBody(value) {
+	return typeof value === "object" && value !== null;
+}
+function ownValue(value, key) {
+	const descriptor = Object.getOwnPropertyDescriptor(value, key);
+	return descriptor && "value" in descriptor ? descriptor.value : void 0;
+}
+function responseErrorText(value) {
+	if (!isResponseErrorBody(value)) return void 0;
+	for (const key of RESPONSE_ERROR_KEYS) {
+		const candidate = ownValue(value, key);
+		if (typeof candidate === "string") return candidate;
+		if (!isResponseErrorBody(candidate)) continue;
+		const nestedMessage = ownValue(candidate, "message");
+		if (typeof nestedMessage === "string") return nestedMessage;
+		const nestedDetail = ownValue(candidate, "detail");
+		if (typeof nestedDetail === "string") return nestedDetail;
+	}
+}
+function removeControlCharacters(value) {
+	let output = "";
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		if (codePoint <= 31 || codePoint === 127) {
+			if (codePoint === 9 || codePoint === 10 || codePoint === 13) output += " ";
+			continue;
+		}
+		output += character;
+	}
+	return output;
+}
+function truncate(value) {
+	return value.length > MAX_RESPONSE_ERROR_LENGTH ? `${value.slice(0, MAX_RESPONSE_ERROR_LENGTH - 1)}…` : value;
+}
+function sanitizeResponseErrorText(value) {
+	return truncate(removeControlCharacters(value.slice(0, MAX_RESPONSE_ERROR_INPUT_LENGTH)).replace(COOKIE_ASSIGNMENT, "$1[REDACTED]").replace(SECRET_ASSIGNMENT, "$1[REDACTED]").replace(BEARER_TOKEN, "Bearer [REDACTED]").replace(JSON_WEB_TOKEN, "[JWT_REDACTED]").replace(SECRET_QUERY_PARAMETER, "$1[REDACTED]").replace(HTTP_URL, "[URL_REDACTED]").replace(EMAIL, "[EMAIL_REDACTED]").replace(UUID, "[ID_REDACTED]").replace(/\s+/g, " ").trim());
+}
+/** Extract one bounded, sanitized diagnostic string from an upstream error body. */
+function extractSafeResponseError(data) {
+	try {
+		const text = responseErrorText(data);
+		if (!text) return void 0;
+		return sanitizeResponseErrorText(text) || void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
 //#region ../hevy-client/src/hevy-http-error.ts
 const HEVY_RETRY_EXHAUSTED_ERROR_CODE = "HEVY_RETRY_EXHAUSTED";
 const HEVY_REQUEST_ABORTED_ERROR_CODE = "HEVY_REQUEST_ABORTED";
@@ -300,6 +364,7 @@ var HevyHttpError = class extends Error {
 	status;
 	statusText;
 	data;
+	responseError;
 	headers;
 	method;
 	endpoint;
@@ -322,6 +387,7 @@ var HevyHttpError = class extends Error {
 		this.status = options.status;
 		this.statusText = options.statusText;
 		this.data = options.data;
+		this.responseError = extractSafeResponseError(options.data);
 		this.headers = options.headers;
 		this.method = options.method;
 		this.endpoint = options.endpoint;
@@ -1530,7 +1596,8 @@ function createFailureObservation(options, failure, error, commitState, safeToRe
 		error: {
 			status: error.status,
 			code: typeof error.code === "string" && SAFE_OBSERVATION_CODES.has(error.code) ? error.code : void 0,
-			category: error.status === void 0 ? "NetworkError" : "HevyHttpError"
+			category: error.status === void 0 ? "NetworkError" : "HevyHttpError",
+			...error.responseError ? { response_error: error.responseError } : {}
 		}
 	};
 }
@@ -4445,7 +4512,7 @@ function registerHevyResources(server, runtime) {
 //#endregion
 //#region ../core/src/server-metadata.ts
 const SERVER_NAME = "hevy-mcp";
-const SERVER_VERSION = "6.1.0";
+const SERVER_VERSION = "6.1.1";
 const SERVER_INSTRUCTIONS = [
 	"Hevy MCP connects clients to the authenticated user's Hevy workout-tracking data, including workouts, routines, exercise templates, routine folders, body measurements, and profile information. HEVY_API_KEY must contain a valid Hevy API key for local stdio use.",
 	"Safety: all get-* and search-* tools are read-only. create-* and update-* tools mutate Hevy data. Creates are additive and non-idempotent, so repeating one can create duplicates. Updates can overwrite existing data. Delete operations are not available.",
@@ -5023,4 +5090,4 @@ function createHevyMcpServer(options) {
 //#endregion
 export { createSafeErrorDiagnostic as a, diagnosticEndpointIdentity as c, bucketCount as i, metricEndpointIdentity as l, createExecutionProjection as n, createHevyClient as o, mergeAbortSignals as r, SAFE_OBSERVATION_CODES as s, createHevyMcpServer as t, isHevyHttpError as u };
 
-//# sourceMappingURL=src-tzdOTpis.mjs.map
+//# sourceMappingURL=src-c7i9L8Mm.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hevy-mcp",
-	"version": "6.1.0",
+	"version": "6.1.1",
 	"private": false,
 	"description": "A Model Context Protocol (MCP) server implementation that interfaces with the Hevy fitness tracking app and its API.",
 	"repository": {

package/server.json

@@ -7,12 +7,12 @@
 		"url": "https://github.com/chrisdoc/hevy-mcp",
 		"source": "github"
 	},
-	"version": "6.1.0",
+	"version": "6.1.1",
 	"packages": [
 		{
 			"registryType": "npm",
 			"identifier": "hevy-mcp",
-			"version": "6.1.0",
+			"version": "6.1.1",
 			"transport": {
 				"type": "stdio"
 			},