cronometer-mcp 2.4.0__tar.gz → 2.4.2__tar.gz

cronometer_mcp-2.4.2/.github/workflows/drift.yml

@@ -0,0 +1,56 @@
+name: Cronometer drift check
+
+# Daily check that the RPC templates still match Cronometer's live
+# serialization policy (tests marked drift; no login, no credentials).
+on:
+  schedule:
+    - cron: "0 11 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  actions: write
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install
+        run: pip install -e . pytest
+
+      - name: Run drift check
+        id: drift
+        shell: bash  # implies pipefail, so tee keeps pytest's exit code
+        run: python -m pytest -m drift -q 2>&1 | tee drift.log
+
+      - name: Open or update the drift issue
+        if: failure() && steps.drift.outcome == 'failure'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh label create drift --color B60205 --description "Cronometer API drift" 2>/dev/null || true
+          { echo "Drift check failed: $RUN_URL"; echo; echo '```'; tail -40 drift.log; echo '```'; } > body.md
+          open=$(gh issue list --label drift --state open --json number --jq '.[0].number')
+          if [ -n "$open" ]; then
+            gh issue comment "$open" --body-file body.md
+          else
+            gh issue create --title "Cronometer drift check failed" --label drift --body-file body.md
+          fi
+
+      # Scheduled workflows in public repos stop after 60 days without
+      # repository activity. Re-enabling each run may reset that clock, though
+      # GitHub doesn't document it, so a failure here must not fail the job.
+      - name: Keep the schedule alive
+        if: always()
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow enable drift.yml

cronometer_mcp-2.4.2/AGENTS.md

@@ -0,0 +1,37 @@
+# AGENTS.md
+
+Instructions for coding agents working in this repo.
+
+## Releasing
+
+- Always release with `./release.sh <version>`. Never bump `pyproject.toml`,
+  `cronometer_mcp/__init__.py` or `server.json` by hand, and never hand-roll the bump commit, tag
+  or push. The script checks for a clean tree and an unused tag, bumps all three files, commits,
+  tags `v<version>` and pushes `main` with tags.
+- Before running it: the working tree is clean and `python -m pytest` passes.
+- Before running it: an adversarial Codex review of the unreleased diff has said ship. From Bash:
+  `codex exec -c 'model_reasoning_effort="high"' -s read-only --skip-git-repo-check -o <out.md>
+  "<prompt>" < /dev/null` (the `< /dev/null` stops it hanging on stdin). Ask it to attack named
+  risks and reproduce, fix real findings with a failing test first, rerun until the verdict is
+  SHIP. `codex mcp-server` no longer exists, so there is no MCP tool for this.
+- Keep pushes to one per release: commit feature work locally without pushing and let
+  `release.sh` make the only push (feature commits plus the bump commit and tag). Create the
+  GitHub release with `gh release create v<version> --notes-file -`; that is an API call, not a
+  push.
+- The tag alone does not publish. Create a GitHub release from the tag; that triggers
+  `.github/workflows/publish.yml`, which publishes to PyPI and then publishes `server.json` to the
+  MCP Registry (GitHub OIDC, no secrets). Never publish to the registry by hand; if that job
+  fails, re-run it with a manual `workflow_dispatch` of the same workflow, which skips PyPI.
+
+## Drift and live tests
+
+- `python -m pytest` stays offline: tests marked `drift` or `live` are deselected by default.
+- `pytest -m drift` fetches Cronometer's live GWT serialization policy (no login) and fails if
+  any RPC template sends a type signature the policy no longer lists. `.github/workflows/drift.yml`
+  runs it daily and opens or comments on an issue labelled `drift`.
+- `pytest -m live` logs in with `CRONOMETER_USERNAME` / `CRONOMETER_PASSWORD` and writes to the
+  real account. Don't run it casually. Writes go only to 2000-01-01 and are refused if that day
+  already has servings or biometrics (notes and exercises aren't checked).
+- Cronometer rations CSV exports per account; going over returns HTTP 429 for hours and breaks the
+  MCP's own reads too. The live tests make exactly two exports per run. Don't add more, and don't
+  loop export calls while debugging.

{cronometer_mcp-2.4.0 → cronometer_mcp-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cronometer-mcp
-Version: 2.4.0
+Version: 2.4.2
 Summary: MCP server for Cronometer nutrition data — pull food logs, macros, and micronutrients via the Model Context Protocol
 Project-URL: Homepage, https://github.com/cphoskins/cronometer-mcp
 Project-URL: Repository, https://github.com/cphoskins/cronometer-mcp

{cronometer_mcp-2.4.0 → cronometer_mcp-2.4.2}/cronometer_mcp/__init__.py

@@ -1,6 +1,6 @@
 """Cronometer MCP Server — nutrition data from Cronometer via MCP."""
 
-__version__ = "2.4.0"
+__version__ = "2.4.2"
 
 from .client import CronometerClient
 from .markdown import generate_food_log_md

{cronometer_mcp-2.4.0 → cronometer_mcp-2.4.2}/cronometer_mcp/client.py

@@ -94,11 +94,11 @@ GWT_UPDATE_DIARY = (
     "I|java.util.List|{nonce}|"
     "java.util.Collections$SingletonList/1586180994|"
     "com.cronometer.shared.entries.changes.AddEntryChange/3949104564|"
-    "com.cronometer.shared.entries.models.Serving/2553599101|"
+    "com.cronometer.shared.entries.models.Serving/2895043750|"
     "com.cronometer.shared.entries.models.Day/782579793|"
     "1|2|3|4|3|5|6|7|8|{user_id}|9|10|1|1|11|12|"
     "{day}|{month}|{year}|{quantity}|{diary_group}|0|{measure_id}|0|0|"
-    "{weight_grams}|{food_source_id}|A|{food_id}|0|1|"
+    "{weight_grams}|{food_source_id}|A|{food_id}|0|"
 )
 
 GWT_REMOVE_SERVING = (
@@ -1425,13 +1425,13 @@ class CronometerClient:
 
         raw = self._gwt_post(body)
 
-        # Response format (example):
-        # //OK[0,0,1072101,"D80lp$",464674,50.0,2107848,0,65541,0,1,1,2026,3,4,
+        # Response format (example, live since 2026-10-30, issue #13):
+        # //OK[0,1072101,"FAoVo9",464674,50.0,2107848,0,321007,0,1,1,2026,10,30,
         #      4,3,2,1,1,["java.util.ArrayList/...","com.cronometer..."],0,7]
         # Positional layout (0-indexed from the inner array start):
-        #   index 3 → serving_id (quoted string)
-        #   index 2 → food_id
-        #   index 4 → food_source_id
+        #   index 2 → serving_id (quoted string)
+        #   index 1 → food_id
+        #   index 3 → food_source_id
         inner_match = re.search(r"//OK\[(.+),\d+,7\]$", raw, re.DOTALL)
         if not inner_match:
             raise RuntimeError(
@@ -1440,10 +1440,10 @@ class CronometerClient:
 
         inner = inner_match.group(1)
         # The response layout is:
-        #   0,0,{food_id},"{serving_id}",{food_source_id},{weight},... ,[string_table],0,7
-        # Match the first five meaningful fields directly from the full inner string.
+        #   0,{food_id},"{serving_id}",{food_source_id},{weight},... ,[string_table],0,7
+        # Match the first four meaningful fields directly from the full inner string.
         fields_match = re.match(
-            r"\d+,\d+,(\d+),\"([^\"]+)\",(\d+),",
+            r"\d+,(\d+),\"([^\"]+)\",(\d+),",
             inner,
         )
         if not fields_match:
@@ -2300,7 +2300,7 @@ class CronometerClient:
         biometric_id = ""
         if raw.startswith("//OK["):
             import re
-            match = re.search(r'"([A-Za-z0-9]+)"', raw)
+            match = re.search(r'"([A-Za-z0-9$_]+)"', raw)
             if match:
                 biometric_id = match.group(1)
 

{cronometer_mcp-2.4.0 → cronometer_mcp-2.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cronometer-mcp"
-version = "2.4.0"
+version = "2.4.2"
 description = "MCP server for Cronometer nutrition data — pull food logs, macros, and micronutrients via the Model Context Protocol"
 readme = "README.md"
 license = "MIT"
@@ -40,3 +40,12 @@ cronometer-mcp = "cronometer_mcp.server:main"
 
 [tool.hatch.build.targets.wheel]
 packages = ["cronometer_mcp"]
+
+[tool.pytest.ini_options]
+# drift and live tests hit cronometer.com; a plain run stays offline.
+# Select them with -m drift or -m live (a later -m overrides this one).
+addopts = "-m 'not drift and not live'"
+markers = [
+    "drift: checks Cronometer's live GWT policy; network, no login",
+    "live: logs in to a real Cronometer account and writes to 2000-01-01",
+]

{cronometer_mcp-2.4.0 → cronometer_mcp-2.4.2}/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/cphoskins/cronometer-mcp",
     "source": "github"
   },
-  "version": "2.4.0",
+  "version": "2.4.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "cronometer-mcp",
-      "version": "2.4.0",
+      "version": "2.4.2",
       "transport": {
         "type": "stdio"
       },

{cronometer_mcp-2.4.0 → cronometer_mcp-2.4.2}/tests/test_client.py

@@ -897,8 +897,9 @@ class TestAddServing:
         return c
 
     def _mock_update_response(self, serving_id="D9TEST", food_id=502518, fsid=55985):
+        # Live layout since issue #13: one leading field fewer than before.
         return (
-            f'//OK[0,0,{food_id},"{serving_id}",{fsid},170.0,2107848,0,'
+            f'//OK[0,{food_id},"{serving_id}",{fsid},170.0,2107848,0,'
             f'124399,0,1,1,2026,3,5,4,3,2,1,1,'
             f'["java.util.ArrayList/4159755760"],0,7]'
         )
@@ -993,6 +994,32 @@ class TestAddServing:
         # Should contain "170|" not "170.0|"
         assert "170|" in call_body
 
+    def test_serving_matches_live_serialization_policy(self):
+        """Serving uses the current type signature and field layout (issue #13).
+
+        Cronometer's Oct 2026 deploy changed Serving to signature 2895043750
+        and dropped its last serialized field: after the Day it writes
+        bool, bool, obj, int, obj, int, double, int, long, int, int.
+        """
+        c = self._make_client()
+        c.session.post = MagicMock(
+            return_value=MagicMock(
+                text=self._mock_update_response(), raise_for_status=lambda: None
+            )
+        )
+
+        c.add_serving(
+            food_id=1072101, food_source_id=464674,
+            measure_id=5, quantity=1, weight_grams=50,
+            day=date(2026, 3, 4), diary_group=1,
+        )
+
+        call_body = c.session.post.call_args[1].get("data") or c.session.post.call_args[0][1]
+        assert "com.cronometer.shared.entries.models.Serving/2895043750|" in call_body
+        assert call_body.endswith(
+            "|11|12|4|3|2026|1|1|0|65541|0|0|50|464674|A|1072101|0|"
+        )
+
 
 class TestRemoveServing:
     def test_remove_success(self):
@@ -2015,3 +2042,16 @@ class TestDeleteRepeatItem:
         )
         with pytest.raises(RuntimeError, match="GWT-RPC call failed"):
             c.delete_repeat_item(999999)
+
+
+class TestAddBiometric:
+    def test_id_with_gwt_long_chars(self):
+        """GWT long ids use A-Z a-z 0-9 $ _; all must survive parsing."""
+        c = CronometerClient(username="test@x.com", password="pw")
+        c._authenticated = True
+        c.nonce = "n"
+        c.user_id = "42"
+        c.session.post = MagicMock(return_value=MagicMock(
+            text='//OK["B$x_9P",[],0,7]', raise_for_status=lambda: None,
+        ))
+        assert c.add_biometric("weight", 150, date(2000, 1, 1)) == "B$x_9P"

cronometer_mcp-2.4.2/tests/test_drift.py

@@ -0,0 +1,117 @@
+"""Drift check: do the RPC templates still match Cronometer's live policy?
+
+A GWT type signature is a checksum of the class's serialized fields, so a
+field change on Cronometer's side (issue #13) shows up here as a missing
+signature before any user hits it. Run with ``pytest -m drift``.
+"""
+
+import re
+
+import pytest
+import requests
+
+from cronometer_mcp import client
+
+# Templates nothing calls any more; their stale types are expected.
+DEAD_TEMPLATES = {"GWT_FIND_FOODS"}
+
+SIGNATURE_RE = re.compile(r"[\w.$\[;]+/\d{6,}")
+
+
+def template_signatures() -> dict[str, set[str]]:
+    """Type signatures used by each live GWT_* RPC template in client.py."""
+    return {
+        name: set(SIGNATURE_RE.findall(value))
+        for name, value in vars(client).items()
+        if name.startswith("GWT_")
+        and isinstance(value, str)
+        and name not in DEAD_TEMPLATES
+        and SIGNATURE_RE.search(value)
+    }
+
+
+def policy_signatures(policy_text: str) -> set[str]:
+    """Signatures listed in a GWT .gwt.rpc serialization policy file."""
+    sigs = set()
+    for line in policy_text.splitlines():
+        cols = [c.strip() for c in line.split(",")]
+        if len(cols) >= 7:
+            sigs.add(cols[5])
+    return sigs
+
+
+def missing_signatures(
+    templates: dict[str, set[str]], policy: set[str]
+) -> dict[str, set[str]]:
+    """Template name -> signatures the policy no longer accepts."""
+    assert templates and policy, "empty scan: the check would pass without checking"
+    return {
+        name: sigs - policy for name, sigs in templates.items() if sigs - policy
+    }
+
+
+def fetch_live_policy() -> str:
+    """Fetch the policy the same way the client discovers its hashes."""
+    s = requests.Session()
+    s.headers.update({"User-Agent": "cronometer-mcp/0.1"})
+    nocache = s.get(client.GWT_NOCACHE_JS_URL, timeout=30)
+    nocache.raise_for_status()
+    perm = re.search(r"='([A-F0-9]{32})'", nocache.text)
+    assert perm, "permutation hash not found in nocache.js: discovery is broken"
+
+    cache = s.get(
+        client.GWT_CACHE_JS_URL.replace("{permutation}", perm.group(1)), timeout=60
+    )
+    cache.raise_for_status()
+    header = re.search(r"'app','([A-F0-9]{32})'", cache.text)
+    assert header, "GWT header not found in cache.js: discovery is broken"
+
+    policy = s.get(f"{client.DEFAULT_GWT_MODULE_BASE}{header.group(1)}.gwt.rpc",
+                   timeout=30)
+    policy.raise_for_status()
+    return policy.text
+
+
+def test_missing_signatures_names_changed_type():
+    """Offline: the old Serving signature from issue #13 is reported by name."""
+    templates = {"GWT_UPDATE_DIARY": {
+        "com.cronometer.shared.entries.models.Serving/2553599101",
+        "com.cronometer.shared.entries.models.Day/782579793",
+    }}
+    policy = policy_signatures(
+        "com.cronometer.shared.entries.models.Serving, true, true, true, true, "
+        "com.cronometer.shared.entries.models.Serving/2895043750, 2895043750\n"
+        "com.cronometer.shared.entries.models.Day, true, true, true, true, "
+        "com.cronometer.shared.entries.models.Day/782579793, 782579793\n"
+    )
+    assert missing_signatures(templates, policy) == {
+        "GWT_UPDATE_DIARY": {"com.cronometer.shared.entries.models.Serving/2553599101"}
+    }
+
+
+def test_empty_scan_cannot_pass():
+    """Offline: an empty template or policy scan is an error, not a clean result."""
+    with pytest.raises(AssertionError):
+        missing_signatures({}, set())
+    with pytest.raises(AssertionError):
+        missing_signatures({}, {"a.B/123456"})
+    with pytest.raises(AssertionError):
+        missing_signatures({"GWT_X": {"a.B/123456"}}, set())
+
+
+def test_templates_found():
+    """Offline: the scan sees the write templates, so a pass means something."""
+    names = template_signatures()
+    assert "GWT_UPDATE_DIARY" in names
+    assert "GWT_FIND_FOODS" not in names
+
+
+@pytest.mark.drift
+def test_templates_match_live_policy():
+    missing = missing_signatures(
+        template_signatures(), policy_signatures(fetch_live_policy())
+    )
+    assert not missing, (
+        "Cronometer's serialization policy no longer accepts these types; "
+        f"the class changed and the template needs re-deriving: {missing}"
+    )

cronometer_mcp-2.4.2/tests/test_live.py

@@ -0,0 +1,136 @@
+"""Live smoke tests against a real Cronometer account.
+
+Run with ``pytest -m live``; needs CRONOMETER_USERNAME and CRONOMETER_PASSWORD.
+
+Cronometer rations its CSV export per account (HTTP 429 for hours once
+exceeded, which also breaks the MCP's own reads), so a run makes exactly two
+export calls, both for TEST_DAY: servings and biometrics. Both must be real
+CSVs with no rows before anything is written; other entry types (notes,
+exercises) aren't checked, since that would take more exports and the writes
+only remove the ids they added. Writes touch TEST_DAY only and are checked by
+add-then-remove of the returned id, without further exports. The first failure
+stops the writes. A failed remove is never cleaned up automatically; the next
+run's empty check refuses to write until a person has looked.
+"""
+
+import csv
+import io
+import os
+from datetime import date, timedelta
+
+import pytest
+
+from cronometer_mcp.client import CronometerClient
+
+pytestmark = pytest.mark.live
+
+TEST_DAY = date(2000, 1, 1)
+SERVINGS_COLUMNS = {"Day", "Group", "Food Name", "Amount"}
+BIOMETRICS_COLUMNS = {"Day", "Metric", "Unit", "Amount"}
+TODAY = date.today()
+WEEK_AGO = TODAY - timedelta(days=7)
+
+
+@pytest.fixture(scope="module")
+def c():
+    client = CronometerClient()
+    client.authenticate()
+    return client
+
+
+def refuse_parallel_run():
+    # Each xdist worker would make its own two exports.
+    if os.environ.get("PYTEST_XDIST_WORKER"):
+        pytest.fail("Live tests must not run in parallel: export budget is per run.")
+
+
+@pytest.fixture(scope="module")
+def test_day_exports(c):
+    """The run's only two exports: (servings CSV text, biometrics CSV text)."""
+    refuse_parallel_run()
+    return (
+        c.export_raw("servings", TEST_DAY, TEST_DAY),
+        c.export_raw("biometrics", TEST_DAY, TEST_DAY),
+    )
+
+
+def require_clean_day(servings_csv: str, biometrics_csv: str) -> None:
+    """Fail unless both exports are well-formed CSVs with no rows."""
+    exports = (
+        ("servings", servings_csv, SERVINGS_COLUMNS),
+        ("biometrics", biometrics_csv, BIOMETRICS_COLUMNS),
+    )
+    for name, text, columns in exports:
+        try:
+            rows = list(csv.reader(io.StringIO(text), strict=True))
+        except csv.Error as e:
+            pytest.fail(f"The {name} export is not valid CSV ({e}). Not writing.")
+        if not rows or not columns <= set(rows[0]):
+            pytest.fail(f"The {name} export is missing columns. Not writing.")
+        if rows[1:]:
+            pytest.fail(
+                f"{len(rows) - 1} leftover {name} rows on {TEST_DAY}; "
+                "clean up first. Not writing."
+            )
+
+
+def write_round_trips(c) -> None:
+    """Add then remove one serving, then one biometric. Stops at the first failure."""
+    food = c.find_foods("egg")[0]
+    added = c.add_serving(
+        food_id=food["food_id"], food_source_id=food["food_source_id"],
+        measure_id=0, quantity=50, weight_grams=50, day=TEST_DAY,
+    )
+    assert added["serving_id"]
+    assert c.remove_serving(added["serving_id"])
+
+    biometric_id = c.add_biometric("weight", 150, TEST_DAY)
+    assert biometric_id, "addBiometric succeeded but its id could not be parsed"
+    assert c.remove_biometric(biometric_id)
+
+
+# ── Reads ─────────────────────────────────────────────────────────────
+
+
+def test_servings_export_columns(test_day_exports):
+    header = next(csv.reader(io.StringIO(test_day_exports[0])), [])
+    assert SERVINGS_COLUMNS <= set(header)
+
+
+def test_food_search_and_details(c):
+    hits = c.find_foods("egg")
+    assert hits and {"food_id", "food_source_id", "name"} <= hits[0].keys()
+    assert c.get_food(hits[0]["food_source_id"])
+
+
+def test_diary_groups_parse(c):
+    # diary_groups() falls back to defaults on a parse failure; catch that here.
+    groups = c._fetch_diary_groups()
+    assert groups and all("name" in g and "wire_index" in g for g in groups)
+
+
+def test_recent_biometrics(c):
+    assert isinstance(c.get_recent_biometrics(), list)
+
+
+def test_macro_targets(c):
+    assert isinstance(c.get_all_macro_schedules(), list)
+    assert c.get_daily_macro_targets(TODAY)
+    assert isinstance(c.get_macro_target_templates(), list)
+
+
+def test_fasting(c):
+    assert isinstance(c.get_user_fasts_for_range(WEEK_AGO, TODAY), list)
+    assert isinstance(c.get_fasting_stats(), dict)
+
+
+def test_repeated_items(c):
+    assert isinstance(c.get_repeated_items(), list)
+
+
+# ── Writes (TEST_DAY only) ────────────────────────────────────────────
+
+
+def test_write_round_trips(c, test_day_exports):
+    require_clean_day(*test_day_exports)
+    write_round_trips(c)

cronometer_mcp-2.4.2/tests/test_live_gate.py

@@ -0,0 +1,73 @@
+"""Offline: the safety checks that guard the live tests' writes."""
+
+import pytest
+
+from tests.test_live import TEST_DAY, refuse_parallel_run, require_clean_day, write_round_trips
+
+SERVINGS_HEADER = "Day,Time,Group,Food Name,Amount\n"
+BIOMETRICS_HEADER = "Day,Group,Metric,Unit,Amount\n"
+
+
+class FakeClient:
+    def __init__(self, serving_removed=True):
+        self.serving_removed = serving_removed
+        self.biometric_added = False
+
+    def find_foods(self, query):
+        return [{"food_id": 1, "food_source_id": 2}]
+
+    def add_serving(self, **kwargs):
+        assert kwargs["day"] == TEST_DAY
+        return {"serving_id": "S1"}
+
+    def remove_serving(self, serving_id):
+        return self.serving_removed
+
+    def add_biometric(self, metric, amount, day):
+        assert day == TEST_DAY
+        self.biometric_added = True
+        return "B1"
+
+    def remove_biometric(self, biometric_id):
+        return True
+
+
+def test_clean_day_passes():
+    require_clean_day(SERVINGS_HEADER, BIOMETRICS_HEADER)
+
+
+@pytest.mark.parametrize("servings,biometrics", [
+    ("", BIOMETRICS_HEADER),
+    (SERVINGS_HEADER, ""),
+    ("<html>error</html>\n", BIOMETRICS_HEADER),
+    ("Day\n", BIOMETRICS_HEADER),
+    (SERVINGS_HEADER, "Day,Unexpected\n"),
+    ('Day,"unterminated\n', BIOMETRICS_HEADER),
+    (SERVINGS_HEADER, 'Day,"unterminated\n'),
+    (SERVINGS_HEADER, BIOMETRICS_HEADER + '2000-01-01,"unterminated\n'),
+    (SERVINGS_HEADER, "<html>error</html>\n"),
+    (SERVINGS_HEADER + "2000-01-01,,Breakfast,Egg,50\n", BIOMETRICS_HEADER),
+    (SERVINGS_HEADER, BIOMETRICS_HEADER + "2000-01-01,,Weight,lbs,150\n"),
+])
+def test_unclean_or_malformed_day_refuses_writes(servings, biometrics):
+    with pytest.raises(pytest.fail.Exception):
+        require_clean_day(servings, biometrics)
+
+
+def test_failed_serving_remove_stops_further_writes():
+    fake = FakeClient(serving_removed=False)
+    with pytest.raises(AssertionError):
+        write_round_trips(fake)
+    assert not fake.biometric_added
+
+
+def test_round_trips_run_both_writes():
+    fake = FakeClient()
+    write_round_trips(fake)
+    assert fake.biometric_added
+
+
+def test_parallel_run_refused(monkeypatch):
+    monkeypatch.setenv("PYTEST_XDIST_WORKER", "gw0")
+    with pytest.raises(pytest.fail.Exception):
+        refuse_parallel_run()

cronometer_mcp-2.4.0/AGENTS.md

@@ -1,15 +0,0 @@
-# AGENTS.md
-
-Instructions for coding agents working in this repo.
-
-## Releasing
-
-- Always release with `./release.sh <version>`. Never bump `pyproject.toml`,
-  `cronometer_mcp/__init__.py` or `server.json` by hand, and never hand-roll the bump commit, tag
-  or push. The script checks for a clean tree and an unused tag, bumps all three files, commits,
-  tags `v<version>` and pushes `main` with tags.
-- Before running it: the working tree is clean and `python -m pytest` passes.
-- The tag alone does not publish. Create a GitHub release from the tag; that triggers
-  `.github/workflows/publish.yml`, which publishes to PyPI and then publishes `server.json` to the
-  MCP Registry (GitHub OIDC, no secrets). Never publish to the registry by hand; if that job
-  fails, re-run it with a manual `workflow_dispatch` of the same workflow, which skips PyPI.