fix(native): register reflection/resource metadata so the binary works

The root cause of `auth() failed: HTTP 0` was never TLS. GraalVM native
images need reflection metadata for every Jackson-(de)serialized type;
without it, deserializing the auth response throws InvalidDefinitionException
(an IOException), which the OpenAPI client wraps as ApiException code 0. The
MCP layer was equally broken: McpSchema record components were unregistered,
so even a stdio `initialize` crashed with UnsupportedFeatureError.

- Add reflect-config.json generated with the GraalVM tracing agent across
  full MCP sessions (stub + live API), plus wholesale registration of all
  McpSchema$*, api.client.model.* and mcp.model.* types.
- Replace reachability-metadata.json (unified format, ignored by GraalVM for
  JDK 21) with classic reflect-config.json / resource-config.json, processed
  by every GraalVM version.
- Include logback.xml in the image: native logs were going to stdout with the
  default pattern, corrupting the MCP stdio protocol; they now go to stderr.
- Drop the obsolete "Sync OS CA certificates" CI step; the WE1 intermediate is
  now bundled in-image (see previous commit), making the cacerts surgery moot.

Verified end-to-end on macOS arm64: --help, tools/list and live tool calls.
Bumps version to 0.3.3.

Author: mrmx

.github/workflows/ci.yml

@@ -47,53 +47,6 @@ jobs:
           java-version: '21'
           distribution: 'graalvm'
           cache: 'maven'
-      - name: Sync OS CA certificates into GraalVM JDK
-        shell: bash
-        run: |
-          CACERTS="$JAVA_HOME/lib/security/cacerts"
-
-          # 1. Import root CAs from the OS trust store
-          if [[ "$RUNNER_OS" == "macOS" ]]; then
-            security export -t certs -f pemseq \
-              -k /System/Library/Keychains/SystemRootCertificates.keychain \
-              > /tmp/os-roots.pem
-          elif [[ "$RUNNER_OS" == "Linux" ]]; then
-            cat /etc/ssl/certs/*.pem > /tmp/os-roots.pem 2>/dev/null || true
-          fi
-          if [[ -f /tmp/os-roots.pem ]]; then
-            awk '/-----BEGIN CERTIFICATE-----/{n++; close(f); f="/tmp/ca-"n".pem"} {print > f}' \
-              /tmp/os-roots.pem
-            imported=0
-            for f in /tmp/ca-*.pem; do
-              [[ -s "$f" ]] || continue
-              hash=$(openssl x509 -noout -hash -in "$f" 2>/dev/null) || continue
-              keytool -importcert -noprompt -trustcacerts \
-                -alias "os-root-${hash}" \
-                -keystore "$CACERTS" -storepass changeit \
-                -file "$f" 2>/dev/null && ((imported++)) || true
-            done
-            echo "Imported $imported root CAs from OS"
-          fi
-
-          # 2. Fetch any intermediate CAs the server omits from its TLS chain (via AIA).
-          #    GraalVM native images cannot chase AIA at runtime; bake the intermediates in.
-          AIA_URL=$(echo | openssl s_client -connect api.qtsurfer.net:443 \
-            -servername api.qtsurfer.net 2>/dev/null \
-            | openssl x509 -noout -text 2>/dev/null \
-            | grep "CA Issuers" | grep -o 'http[^ ]*' | head -1)
-          if [[ -n "$AIA_URL" ]]; then
-            curl -sf "$AIA_URL" -o /tmp/intermediate.der
-            openssl x509 -inform der -in /tmp/intermediate.der -out /tmp/intermediate.pem 2>/dev/null \
-              || cp /tmp/intermediate.der /tmp/intermediate.pem
-            hash=$(openssl x509 -noout -hash -in /tmp/intermediate.pem 2>/dev/null)
-            subj=$(openssl x509 -noout -subject -in /tmp/intermediate.pem 2>/dev/null)
-            keytool -importcert -noprompt -trustcacerts \
-              -alias "intermediate-${hash}" \
-              -keystore "$CACERTS" -storepass changeit \
-              -file /tmp/intermediate.pem 2>/dev/null \
-              && echo "Imported intermediate CA: ${subj}" \
-              || echo "Intermediate already trusted: ${subj}"
-          fi
       - name: Set up MSVC (required by GraalVM native-image on Windows)
         if: matrix.os == 'windows-latest'
         uses: ilammy/msvc-dev-cmd@v1

CHANGELOG.md

@@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.3.3] — 2026-06-13
+
+### Fixed 🐛
+
+- **Native binary was non-functional beyond `--help`** — root cause of the `auth() failed: HTTP 0` errors finally identified: it was never TLS. GraalVM native images need reflection metadata for every Jackson-(de)serialized type; without it, deserializing the auth response throws `InvalidDefinitionException` (an `IOException` subclass), which the OpenAPI client wraps as `ApiException` with code 0. The MCP layer was equally broken: `McpSchema` record components were not registered, so even a stdio `initialize` crashed with `UnsupportedFeatureError`.
+  - Added `reflect-config.json` generated with the GraalVM tracing agent across full MCP sessions (stub + live API), plus wholesale registration of all `McpSchema$*`, `api.client.model.*`, and `mcp.model.*` types.
+  - Replaced `reachability-metadata.json` (the unified format, ignored by GraalVM for JDK 21) with classic-format `reflect-config.json`/`resource-config.json`, which all GraalVM versions process.
+  - `logback.xml` is now included in the image: native binary logs went to **stdout** with the default pattern, corrupting the MCP stdio protocol; they now go to stderr as configured.
+- Verified end-to-end on macOS arm64: authentication, `tools/list`, and live tool calls against the production API.
+
 ## [0.3.2] — 2026-06-13
 
 ### Fixed 🐛

README.md

@@ -41,7 +41,7 @@ The installer detects your platform and picks the right delivery:
 Pin a version or override the destination:
 
 ```bash
-VERSION=0.3.2 INSTALL_DIR=~/.local/bin \
+VERSION=0.3.3 INSTALL_DIR=~/.local/bin \
   curl -fsSL https://raw.githubusercontent.com/QTSurfer/mcp-java/main/install.sh | bash
 ```
 

pom.xml

@@ -5,7 +5,7 @@
 
     <groupId>com.qtsurfer</groupId>
     <artifactId>mcp-java</artifactId>
-    <version>0.3.2</version>
+    <version>0.3.3</version>
     <packaging>jar</packaging>
     <name>qtsurfer-mcp-java</name>