wontopos-mcp 1.0.23 → 1.0.25

package/README.md

@@ -59,11 +59,12 @@ Create a key in the [console](https://wontopos.com). Optional env:
 | `WONTOPOS_VERIFY` | Default re-ask passes for `search`, 0-3. Default `0`. Each pass is another engine call, billed for what it delivers; the agent can raise it per call. |
 | `WONTOPOS_MAX_IMAGES` | Default photo results per `search`, 0-5. Default `0` — see below. |
 | `WONTOPOS_BASE_URL` | A different API host. Leave unset for the default. |
+| `WONTOPOS_TIMEOUT_MS` | Per-request timeout in milliseconds. Default `20000`. |
 | `WONTOPOS_HTTP_PORT` | Serve over HTTP instead of stdio, for hosts that cannot spawn a process. Needs `WONTOPOS_HTTP_TOKEN`. |
 | `WONTOPOS_HTTP_TOKEN` | Bearer token every HTTP request must carry. The server refuses to start HTTP mode without one. |
 | `WONTOPOS_HTTP_HOST` | Interface to bind in HTTP mode. Default `127.0.0.1` - this machine only. |
 | `WONTOPOS_HTTP_ALLOWED_HOSTS` | Comma-separated `Host` values to accept in HTTP mode. A tunnel forwards its own name, and an undeclared one is refused 403. |
-| `WONTOPOS_READ_ONLY` | `1` / `true` / `yes` / `on` / `y` / `t` = read tools only, see Security. A value that is none of those (and none of `0` / `false` / `no` / `off`) stops the server rather than being read as off. |
+| `WONTOPOS_READ_ONLY` | `1` / `true` / `yes` / `on` / `y` / `t` = read tools only, see Security. A value that is none of those (and none of `0` / `false` / `no` / `off` / `n` / `f`) stops the server rather than being read as off. |
 | `WONTOPOS_ALLOW_STORE_OVERRIDE` | `1` (same spellings) = multi-store; default = pinned, see Security. |
 
 **Why photos default to none.** Not because the model cannot see them - `view_image`
@@ -224,6 +225,21 @@ advertise different limits.
 
 ## Changelog
 
+- **1.0.25** - replies pass a host that checks them against their schemas. The output
+  schemas were closed to fields they do not name, so a validating client refused most
+  tools whenever the service added one. A reply over the byte cap now loses only what
+  the overflow needs, from its largest list; the model catalogue is read without regard
+  to case and asked again after a failure; an `event_date` with no year, or a day its
+  month does not have, is refused; a `store_turn` or `update` that times out says it
+  may have been applied; and a `WONTOPOS_HTTP_PORT` that is not a port stops the server. Underneath,
+  the `wontopos` SDK pin moves to **2.2.45**.
+
+- **1.0.24** - a retired model is said plainly. At startup the server exits when its
+  model answers `410`, as it does on a rejected key, and names a model that is scheduled
+  to retire together with its date. A tool call answered `410` tells the model to ask
+  the person running the server to set `WONTOPOS_MODEL` to another model. Underneath,
+  the `wontopos` SDK pin moves to **2.2.44**.
+
 - **1.0.23** - on a duplicate, `remember` now says how to find the memory the write
   matched: in `duplicate_of` when the reply has it, otherwise with `search`, before
   combining both facts or updating that memory. Underneath, the `wontopos` SDK pin moves

package/index.mjs

@@ -11,6 +11,7 @@ import { z } from "zod";
 import {
   Client,
   WosError,
+  APIConnectionError,
   SEARCH_LIMIT_MIN,
   SEARCH_LIMIT_MAX,
   CONTEXT_LIMIT_MIN,
@@ -120,6 +121,25 @@ function normalizeEventDate(raw) {
   const s = String(raw).trim();
   if (/^[+-]?\d+$/.test(s) && !/^\d{4}$/.test(s)) return null;
   if (Number.isNaN(Date.parse(s))) return null;
+  // The parser files "March 14" as 2001-03-14 and rolls 2026-02-31 into March, so a date
+  // with no year, or an ISO day its month does not have, is refused rather than moved.
+  if (!/\d{4}/.test(s)) return null;
+  const ymd = /^(\d{4})-(\d{2})-(\d{2})/.exec(s);
+  if (ymd) {
+    const [y, mo, d] = ymd.slice(1).map(Number);
+    const t = new Date(Date.UTC(y, mo - 1, d));
+    if (t.getUTCMonth() !== mo - 1 || t.getUTCDate() !== d) return null;
+  } else {
+    // Any other spelling ("February 30, 2026", "2026/02/30") rolls over the same way: a
+    // written day from 29 to 31 has to come back as that day. The time is taken off first,
+    // so its minutes are not read as a day and its zone cannot move the date.
+    const datePart = s
+      .replace(/T?\d{1,2}:\d{2}(?::\d{2}(?:\.\d+)?)?\s*(?:[ap]\.?m\.?)?\s*(?:Z|(?:GMT|UTC)?\s*[+-]\d{2}:?\d{2}|GMT|UTC)?/gi, " ")
+      .trim();
+    const local = new Date(datePart);
+    for (const n of datePart.match(/\b\d{1,2}\b/g) ?? [])
+      if (Number(n) >= 29 && (Number.isNaN(local.getTime()) || local.getDate() !== Number(n))) return null;
+  }
   if (DATE_ONLY_RE.test(s)) return `${s}T00:00:00Z`;
   // `2026` and `2026-03` are ISO date-only forms too, and the spec parses those as
   // UTC — so the local-parts branch below reads them back a day early on every host
@@ -242,16 +262,24 @@ function registerTool(name, spec, handler) {
     throw new Error(`tool "${name}" does not declare annotations.readOnlyHint.`);
   }
   if (READ_ONLY && !readOnly) return;
-  TOOL_DEFS.push([name, spec, handler]);
+  // A write that is not safe to repeat is told, on a lost answer, that it may have landed.
+  const once = !readOnly && spec.annotations.idempotentHint === false;
+  TOOL_DEFS.push([name, spec, once ? (args, extra) => handler(args, extra, true) : handler]);
 }
 
 function registerPrompt(name, spec, handler) {
   PROMPT_DEFS.push([name, spec, handler]);
 }
 
+// A raw shape is published with additionalProperties: false, and a client that checks
+// structuredContent against it refused every reply carrying a field the shape does not name.
+function openOutput(spec) {
+  return spec.outputSchema ? { ...spec, outputSchema: z.object(spec.outputSchema).passthrough() } : spec;
+}
+
 function createMcpServer() {
   const s = new McpServer({ name: "wontopos", version: VERSION }, { instructions: INSTRUCTIONS });
-  for (const [name, spec, handler] of TOOL_DEFS) s.registerTool(name, spec, handler);
+  for (const [name, spec, handler] of TOOL_DEFS) s.registerTool(name, openOutput(spec), handler);
   for (const [name, spec, handler] of PROMPT_DEFS) s.registerPrompt(name, spec, handler);
   return s;
 }
@@ -276,7 +304,10 @@ const KEEP_TAIL = new Set(["turns"]);
 // exchanges. The service holds thirty; the rest of its reply is dropped here.
 const RECALL_TURNS = 20;
 
-function droppableLists(root) {
+// Paging state, not content: cut, it resumes the next page in the wrong place.
+const PAGE_KEYS = new Set(["next_cursor", "next_before", "next_skip_ids"]);
+
+function droppableLists(root, minLength = 2) {
   const out = [];
   const stack = [["", root, null]];
   let budget = 20000;
@@ -287,7 +318,10 @@ function droppableLists(root) {
       // when the array is cut. Without it the trimmer handed a model 100 memories beside
       // "count": 200 — and the schemas call that field authoritative, so the model reads
       // the JSON as truncated mid-structure and either retries or reports the store wrong.
-      if (node.length > 1 && node.some((e) => e && typeof e === "object")) out.push([name || "items", node, owner]);
+      // A list of strings is cut too: recall's context rows are strings, and leaving them
+      // whole cut the memories and turns down to one each instead.
+      if (node.length >= minLength && !PAGE_KEYS.has(name) && node.some((e) => (e && typeof e === "object") || typeof e === "string"))
+        out.push([name || "items", node, owner]);
       for (const v of node) if (v && typeof v === "object") stack.push([name, v, null]);
       continue;
     }
@@ -305,6 +339,31 @@ function syncCount(owner, arr, before) {
   if (owner && typeof owner.count === "number" && owner.count === before) owner.count = arr.length;
 }
 
+/** The list holding the most bytes gives up entries from its end (the oldest, for a list
+ *  kept by its tail) until about `over` bytes are gone; the other lists stay whole. Halving
+ *  every list at once dropped half of each for an overflow one list could cover. */
+function cutLargest(lists, over, dropped) {
+  let pick = null;
+  let most = 0;
+  for (const l of lists) {
+    if (l[1].length <= 1) continue;
+    const b = byteLen(JSON.stringify(l[1]));
+    if (b > most) [pick, most] = [l, b];
+  }
+  if (!pick) return false;
+  const [name, arr, owner] = pick;
+  const before = arr.length;
+  const tail = KEEP_TAIL.has(name);
+  let n = 0;
+  for (let freed = 0; n < before - 1 && freed < over; n++)
+    freed += byteLen(JSON.stringify(arr[tail ? n : before - 1 - n])) + 1;
+  if (tail) arr.splice(0, n);
+  else arr.length = before - n;
+  dropped[name || "items"] = (dropped[name || "items"] ?? 0) + n;
+  syncCount(owner, arr, before);
+  return true;
+}
+
 function truncationKey(obj) {
   let k = "_truncated";
   while (Object.prototype.hasOwnProperty.call(obj, k)) k = `_${k}`;
@@ -355,28 +414,15 @@ function fitToCap(result) {
     const clone = structuredClone(result);
     const dropped = {};
     const NOTE_KEY = Array.isArray(clone) ? "_truncated" : truncationKey(clone);
-    const lists = droppableLists(clone);
-    if (lists.length) {
-      let guard = 64;
-      while (byteLen(text) > MAX_RESULT_BYTES && guard-- > 0) {
-        let cutAny = false;
-        for (const [name, arr, owner] of lists) {
-          if (arr.length <= 1) continue;
-          const before = arr.length;
-          const keep = Math.max(1, Math.floor(arr.length / 2));
-          dropped[name || "items"] = (dropped[name || "items"] ?? 0) + (arr.length - keep);
-          if (KEEP_TAIL.has(name)) arr.splice(0, arr.length - keep);
-          else arr.length = keep;
-          syncCount(owner, arr, before);
-          cutAny = true;
-        }
-        if (!cutAny) break;
-        text = ser(Array.isArray(clone) ? clone : { ...clone, [NOTE_KEY]: dropped });
-      }
-      if (byteLen(text) <= MAX_RESULT_BYTES) {
-        const paged = ["next_cursor", "next_before", "next_skip_ids"].some(
-          (k) => !Array.isArray(clone) && clone[k] != null
-        );
+    if (droppableLists(clone).length) {
+      const paged = ["next_cursor", "next_before", "next_skip_ids"].some(
+        (k) => !Array.isArray(clone) && clone[k] != null
+      );
+      // The note is part of what has to fit, so each round is measured with it: measured
+      // without, a reply could pass the loop and then go over once the note was added.
+      const withNote = () => {
+        // Down to one entry a list is no longer cut, but it is still the page that was.
+        const lists = droppableLists(clone, 1);
         // The page's own list, not the longest array anywhere in the reply: `kept` used
         // to be a Math.max over every list, so the advice could name the length of a
         // nested array and send the model back for a page that overflows again.
@@ -389,24 +435,33 @@ function fitToCap(result) {
               `cursor below points PAST them — following it would skip what is missing. Ask for ` +
               `this page again with limit=${kept} instead.`
             : `${MAX_RESULT_BYTES}-byte cap` +
-              (lists.some(([n]) => KEEP_TAIL.has(n) && dropped[n])
+              (Object.keys(dropped).some((n) => KEEP_TAIL.has(n))
                 ? " — the OLDEST turns went, the most recent were kept."
-                : " — narrow the query, lower limit, or page with cursor."));
-        const noted = Array.isArray(clone) ? [...clone, { [NOTE_KEY]: note }] : { ...clone, [NOTE_KEY]: note };
-        const withNote = ser(noted);
-        if (byteLen(withNote) <= MAX_RESULT_BYTES) return { text: withNote, value: noted };
+                : " — narrow the query or ask for fewer results."));
+        return Array.isArray(clone) ? [...clone, { [NOTE_KEY]: note }] : { ...clone, [NOTE_KEY]: note };
+      };
+      let noted = withNote();
+      let guard = 64;
+      while (byteLen((text = ser(noted))) > MAX_RESULT_BYTES && guard-- > 0) {
+        if (!cutLargest(droppableLists(clone), byteLen(text) - MAX_RESULT_BYTES, dropped)) break;
+        noted = withNote();
       }
+      if (Object.keys(dropped).length && byteLen(text) <= MAX_RESULT_BYTES) return { text, value: noted };
     }
 
+    // Without the note the reply can already fit; then it is the note that does not.
     const oversize = byteLen(ser(clone)) - MAX_RESULT_BYTES;
     // Name whatever the loop above dropped. It may have dropped nothing — a reply with
     // one oversized entry never enters that branch — so the count is conditional. What
     // it must never do is claim nothing went when something did.
     const cut = Object.entries(dropped).map(([k, n]) => `${n} ${k}`).join(", ");
     const note =
-      (cut ? `dropped ${cut}, and after that still ` : "") +
-      `${oversize} bytes over the ${MAX_RESULT_BYTES}-byte cap, so the long text left in this reply ` +
-      "was cut at the end and marked. Narrow the query, lower limit, or page with cursor to see it whole.";
+      (cut ? `dropped ${cut}, and after that ` : "") +
+      (oversize > 0
+        ? `${cut ? "still " : ""}${oversize} bytes over the ${MAX_RESULT_BYTES}-byte cap`
+        : `at the ${MAX_RESULT_BYTES}-byte cap`) +
+      ", so the long text left in this reply was cut at the end and marked. Narrow the query or ask " +
+      "for fewer results to see it whole.";
     const noted = Array.isArray(clone) ? [...clone, { [NOTE_KEY]: note }] : { ...clone, [NOTE_KEY]: note };
     if (shrinkStrings(noted, ser)) return { text: ser(noted), value: noted };
   }
@@ -414,7 +469,7 @@ function fitToCap(result) {
   const value = {
     _truncated:
       `the reply was ${byteLen(text)} bytes, over the ${MAX_RESULT_BYTES}-byte cap, and could not be ` +
-      "shortened into a readable form. Narrow the query, lower limit, or page with cursor.",
+      "shortened into a readable form. Narrow the query or ask for fewer results.",
   };
   return { text: ser(value), value };
 }
@@ -470,13 +525,43 @@ function run(fn) {
   });
 }
 
+// Codes the SDK counts as the connection never opening, from connect or a DNS lookup.
+// It retries a write on those, since nothing was sent, and throws only after the last try.
+const CONNECT_ONLY_CODES = new Set(["ENOTFOUND", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"]);
+const CONNECT_CODES = new Set([
+  ...CONNECT_ONLY_CODES, "ECONNREFUSED", "EHOSTUNREACH", "ENETUNREACH", "ENETDOWN", "EADDRNOTAVAIL",
+]);
+
+/** Whether a write that failed without an answer may still have been applied: a timeout
+ *  or a connection lost after sending, not one that never opened. */
+function mayHaveLanded(e) {
+  if (!(e instanceof APIConnectionError)) return false;
+  const stack = [e.cause];
+  for (let steps = 0; stack.length && steps < 24; steps++) {
+    const cur = stack.pop();
+    if (!cur || typeof cur !== "object") continue;
+    const atConnect = ["connect", "getaddrinfo"].includes(cur.syscall);
+    if (typeof cur.code === "string" && (CONNECT_ONLY_CODES.has(cur.code) || (CONNECT_CODES.has(cur.code) && atConnect)))
+      return false;
+    if (cur.cause) stack.push(cur.cause);
+    if (Array.isArray(cur.errors)) stack.push(...cur.errors.slice(0, 8));
+  }
+  return true;
+}
+
 function runContent(fn) {
-  return async (args, extra) => {
+  return async (args, extra, notRepeatable = false) => {
     const mem = extra?.signal ? base.withSignal(extra.signal) : base;
     try {
       return await fn(args ?? {}, mem);
     } catch (e) {
       let msg = e instanceof WosError ? e.message : String(e?.message ?? e);
+      if (e instanceof WosError && e.status === 410)
+        msg = `Model "${MODEL}" is retired, so every tool call is refused. Ask the person running this ` +
+          "server to set WONTOPOS_MODEL to another model.";
+      if (notRepeatable && mayHaveLanded(e))
+        msg = msg.replace(/[.\s]*$/, ".") + " The write may have been applied before the connection ended; " +
+          "check with search or list_memories before calling again, or it may be applied twice.";
       if (byteLen(msg) > 2000) msg = truncateToBytes(msg, 2000) + "…[error truncated]";
       return { content: [{ type: "text", text: msg }], isError: true };
     }
@@ -520,7 +605,7 @@ const filtersArg = z
   })
   .strict()
   .nullish()
-  .describe("Search a time range or categories: 'in June', 'last year', 'about work'. Filters choose what is searched, not what is kept, so a narrow one still fills `limit`.");
+  .describe("Search a time range or categories: 'in June', 'last year', 'about work'.");
 
 function cleanFilters(f) {
   if (!f || typeof f !== "object") return undefined;
@@ -533,25 +618,40 @@ function cleanFilters(f) {
   return Object.keys(out).length ? out : undefined;
 }
 
-let capsPromise = null;
-let capsAttempts = 0;
-const CAPS_ATTEMPTS_MAX = 3;
-function modelCaps() {
-  if (!capsPromise) {
-    capsAttempts++;
-    capsPromise = base.listModels().then(
+// The catalogue's row for MODEL: { listed, caps, retiresAt }, or null while the catalogue
+// does not answer. `caps` is null when the row carries none. After a failure the next call
+// asks again; after two in a row, a minute later, so a catalogue that hangs does not hold
+// every search for a full timeout. Three failures used to stick for the life of the
+// process, and with them the install defaults for photos and re-ask.
+let catalogue = null;
+let catalogueFailures = 0;
+let catalogueFailedAt = 0;
+const CATALOGUE_RETRY_MS = 60_000;
+function modelRow() {
+  if (!catalogue && (catalogueFailures < 2 || Date.now() - catalogueFailedAt >= CATALOGUE_RETRY_MS)) {
+    catalogue = base.listModels().then(
       (models) => {
-        const c = models.find((m) => m?.id === MODEL)?.capabilities;
-        return c ? { images: c.images === true, reAsk: c.re_ask === true } : null;
+        // The service reads the model name without regard to case, so this does too.
+        const want = MODEL.toLowerCase();
+        const m = models.find((x) => typeof x?.id === "string" && x.id.toLowerCase() === want);
+        const c = m?.capabilities;
+        return {
+          listed: Boolean(m),
+          caps: c ? { images: c.images === true, reAsk: c.re_ask === true } : null,
+          retiresAt: typeof m?.retires_at === "string" ? m.retires_at : undefined,
+        };
       },
       () => {
-        if (capsAttempts < CAPS_ATTEMPTS_MAX) capsPromise = null;
+        catalogue = null;
+        catalogueFailures++;
+        catalogueFailedAt = Date.now();
         return null;
       },
     );
   }
-  return capsPromise;
+  return catalogue ?? Promise.resolve(null);
 }
+const modelCaps = async () => (await modelRow())?.caps ?? null;
 
 function checkQuery(q, verb) {
   if (!q?.trim()) throw new Error(`query is blank — say what you want to ${verb}.`);
@@ -655,7 +755,9 @@ registerTool(
       throw new Error("speaker must be 'me' (something the agent itself said) or omitted (the user's fact).");
     const eventDate = event_date ? normalizeEventDate(event_date) : null;
     if (event_date && !eventDate)
-      throw new Error("event_date is not a parseable date — use a date (2026-07-01) or RFC3339 (2026-07-01T09:00:00Z).");
+      throw new Error(
+        "event_date is not a calendar date with a year — use a date (2026-07-01) or RFC3339 (2026-07-01T09:00:00Z)."
+      );
     const metadata = {};
     if (speaker) metadata.speaker = speaker;
     if (eventDate) metadata.event_date = eventDate;
@@ -709,7 +811,10 @@ registerTool(
     inputSchema: {
       query: z.string(),
       limit: z.coerce.number().int().min(SEARCH_LIMIT_MIN).max(SEARCH_LIMIT_MAX).nullish()
-        .describe(`Memories to return, ${SEARCH_LIMIT_MIN}-${SEARCH_LIMIT_MAX} (default 10). Out of range is refused.`),
+        .describe(
+          `Memories to return, ${SEARCH_LIMIT_MIN}-${SEARCH_LIMIT_MAX} (default 10); each verify pass can add up to as ` +
+            "many more. Out of range is refused."
+        ),
       speaker: z.string().nullish().describe("Only this speaker's words: 'me' or a registered name; other names return 404."),
       filters: filtersArg,
       verify: z.coerce
@@ -1024,7 +1129,7 @@ registerTool(
     annotations: { readOnlyHint: true, openWorldHint: false },
     description:
       "This key's spend and the account's remaining balance, in cents. Free; check it before a long run. " +
-      "If the balance is negative, calls are refused: tell the user instead of retrying." +
+      "When the balance runs out, calls are refused with 402: tell the user instead of retrying." +
       (ALLOW_STORE_OVERRIDE
         ? " `stores` is at most 50 rows, so it need not add up to `workspace`; a row named 'other' is not a store."
         : ""),
@@ -1108,7 +1213,16 @@ registerPrompt(
 // URL, not a command. It is off unless a port is named, and it will not start without
 // a token: the reason to run it is to put it behind a tunnel, and a tunnel makes an
 // unauthenticated listener a public door to the memory store.
-const HTTP_PORT = intEnv("WONTOPOS_HTTP_PORT", 0, 1, 65535);
+// Named but unusable stops the server: falling back to stdio left one that never
+// listened and, with stdin closed under a supervisor, exited 0 as if asked to.
+const HTTP_PORT = (() => {
+  const raw = process.env.WONTOPOS_HTTP_PORT?.trim();
+  if (!raw) return 0;
+  const n = Number(raw);
+  if (Number.isInteger(n) && n >= 1 && n <= 65535) return n;
+  console.error(`wontopos-mcp: WONTOPOS_HTTP_PORT=${JSON.stringify(raw)} is not a port from 1 to 65535. Exiting.`);
+  process.exit(1);
+})();
 // An IPv6 literal may be written bracketed; it is bound without the brackets.
 const HTTP_HOST = (process.env.WONTOPOS_HTTP_HOST?.trim() || "127.0.0.1").replace(/^\[(.*)\]$/, "$1");
 const HTTP_TOKEN = process.env.WONTOPOS_HTTP_TOKEN?.trim() || "";
@@ -1134,7 +1248,9 @@ function canonicalHost(value) {
     name = name.replace(/\.$/, "");
     if (!name) return null;
   }
-  return m[2] === undefined ? name : `${name}:${Number(m[2])}`;
+  // A client leaves out the port its scheme implies, so :80 and :443 compare as none.
+  const port = m[2] === undefined ? null : Number(m[2]);
+  return port === null || port === 80 || port === 443 ? name : `${name}:${port}`;
 }
 
 // The bind address as a client writes it in Host: an IPv6 literal goes in brackets.
@@ -1150,10 +1266,7 @@ const HTTP_ALLOWED_UNUSABLE = HTTP_ALLOWED_HOSTS.filter((h) => !canonicalHost(h)
 const ALLOWED_HOSTS = [
   ...new Set(
     [
-      `${HTTP_HOST_NAME}:${HTTP_PORT}`,
-      `localhost:${HTTP_PORT}`,
-      `127.0.0.1:${HTTP_PORT}`,
-      `[::1]:${HTTP_PORT}`,
+      ...[HTTP_HOST_NAME, "localhost", "127.0.0.1", "[::1]"].flatMap((h) => [`${h}:${HTTP_PORT}`, h]),
       ...HTTP_ALLOWED_HOSTS,
     ]
       .map(canonicalHost)
@@ -1225,9 +1338,9 @@ function httpRefuse(req, res, status, code, message, { id = null, headers } = {}
 }
 
 /** 401 and 403 answer a plain `{ error }` body. */
-function httpDeny(req, res, status, error, why) {
+function httpDeny(req, res, status, error, why, headers = {}) {
   console.error(`wontopos-mcp: HTTP ${status} to ${req.method} — ${logText(why)}`);
-  sendRefusal(req, res, status, {}, JSON.stringify({ error }));
+  sendRefusal(req, res, status, headers, JSON.stringify({ error }));
 }
 
 /** The body as text, or null past HTTP_MAX_BODY_BYTES (the rest is read and dropped). */
@@ -1460,7 +1573,8 @@ async function serveRequests(s, req, res, body) {
 }
 
 async function routeHttp(req, res) {
-  if (!tokenOk(req)) return httpDeny(req, res, 401, "unauthorized", "missing or wrong bearer token");
+  if (!tokenOk(req))
+    return httpDeny(req, res, 401, "unauthorized", "missing or wrong bearer token", { "WWW-Authenticate": "Bearer" });
   const host = String(req.headers.host ?? "");
   if (headerCount(req, "host") !== 1) {
     return httpRefuse(req, res, 400, -32000, "Bad Request: send exactly one Host header");
@@ -1547,13 +1661,23 @@ if (HTTP_PORT) {
 console.error(
   `wontopos-mcp ${VERSION} ready (store: ${STORE_SHOWN}${STORE_FROM_ENV ? "" : " — FALLBACK: WONTOPOS_USER_ID is not set"}, model: ${MODEL}${READ_ONLY ? ", read-only" : ""})`
 );
-modelCaps().then((caps) => {
-  if (!caps) {
+modelRow().then((row) => {
+  if (!row?.caps) {
+    const why = !row
+      ? ": the model catalogue did not answer"
+      : row.listed
+        ? " is in the catalogue without capabilities"
+        : " is not in the catalogue";
+    console.error(`wontopos-mcp: model "${MODEL}"${why} — photos and re-ask are sent only when asked for.`);
+  }
+  if (row?.retiresAt) {
     console.error(
-      `wontopos-mcp: model "${MODEL}" is not in the catalogue — photos and re-ask are sent only when asked for.`
+      `wontopos-mcp: model "${MODEL}" retires at ${logText(row.retiresAt)}; from then on every tool ` +
+        "call is refused. Set WONTOPOS_MODEL to another model before then."
     );
-    return;
   }
+  const caps = row?.caps;
+  if (!caps) return;
   const has = [caps.images ? "photos" : null, caps.reAsk ? "re-ask" : null].filter(Boolean);
   console.error(
     `wontopos-mcp: model "${MODEL}" serves ${has.length ? has.join(" + ") : "neither photos nor re-ask"}` +
@@ -1582,6 +1706,12 @@ base.stats().then(
     if (status === 401) {
       console.error("wontopos-mcp: the API key was rejected (401) — check WONTOPOS_API_KEY. Exiting.");
       process.exit(1);
+    } else if (status === 410) {
+      console.error(
+        `wontopos-mcp: model "${MODEL}" is retired (410), so every tool call would be refused — ` +
+          "set WONTOPOS_MODEL to another model. Exiting."
+      );
+      process.exit(1);
     } else if (status === 404) {
       console.error(
         `wontopos-mcp: store "${STORE_SHOWN}" does not exist — ` +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wontopos-mcp",
-  "version": "1.0.23",
+  "version": "1.0.25",
   "mcpName": "com.wontopos/mcp",
   "description": "(beta) Wontopos (WOS) long-term memory as an MCP server — one memory across Claude Code, Claude Desktop, Cursor, ChatGPT, and your own agents.",
   "keywords": [
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "wontopos": "2.2.43",
+    "wontopos": "2.2.45",
     "zod": "^3.23.0"
   },
   "overrides": {