@chrischall/myatriumhealth-mcp 0.3.0 → 0.4.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Angi — find home-service pros by trade and city, read ratings, reviews and pro profiles. Angi serves its pages only to a real browser, so requests route through the user's own angi.com tab via the fetchproxy browser extension, reusing their existing session. The trade/city taxonomy is read from Angi's public sitemaps directly.",
-    "version": "0.3.0"
+    "version": "0.4.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "MyAtriumHealth",
       "source": "./",
       "description": "Read MyAtriumHealth (Epic MyChart) records — test results, medications, allergies, immunizations, health issues, visits — by relaying requests through the user's signed-in browser tab via the fetchproxy bridge.",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myatriumhealth-mcp",
   "displayName": "MyAtriumHealth",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "MyAtriumHealth (Epic MyChart) access for Claude — test results, medications, allergies, immunizations, visits",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -137,11 +137,11 @@ stated rather than inferred.
 | `mah_list_care_team` | Care team providers, internal and external |
 | `mah_list_billing_accounts` | Billing accounts and balances (parsed from HTML) |
 | `mah_get_menu` | Which portal features this account exposes |
-| `mah_healthcheck` | Connection health — bridge status, or credential/session status in bridge-less mode |
-| `mah_auth_status` | Whether a session can be resumed and whether a device token is stored *(bridge-less only)* |
-| `mah_sign_in` | Sign in server-side; reports verification channels if a code is needed *(bridge-less only)* |
-| `mah_send_verification_code` | Ask the portal to send a code to the account holder *(bridge-less only)* |
-| `mah_verify_code` | Submit the code the user received *(bridge-less only)* |
+| `mah_healthcheck` | Connection health — bridge status when relaying, credential and session status when signing in server-side |
+| `mah_auth_status` | Whether a session can be resumed and whether a device token is stored |
+| `mah_sign_in` | Sign in server-side; reports verification channels if a code is needed *(needs credentials)* |
+| `mah_send_verification_code` | Ask the portal to send a code to the account holder *(needs credentials)* |
+| `mah_verify_code` | Submit the code the user received *(needs credentials)* |
 | `mah_list_patients` | The patients this login can open — the account holder and any proxy subjects |
 | `mah_get_patient_context` | Which patient the readers are serving, confirmed with the portal |
 | `mah_set_active_patient` | Point every reader at one of those patients; survives restarts |

package/dist/bundle.js

@@ -41365,6 +41365,8 @@ function validateFrame(raw) {
     return validateEncrypted(raw);
   if (t === "pair-pending")
     return validatePairPending(raw);
+  if (t === "hello-rejected")
+    return validateHelloRejected(raw);
   if (t === "extension-disconnected")
     return { type: "extension-disconnected" };
   throw new ProtocolError(`unknown frame type: ${String(t)}`);
@@ -41495,6 +41497,16 @@ function validatePairPending(raw) {
   }
   return { type: "pair-pending", mcpId: raw.mcpId, pairCode: raw.pairCode };
 }
+function validateHelloRejected(raw) {
+  assertString(raw.mcpId, "hello-rejected.mcpId");
+  if (!isValidMcpId(raw.mcpId))
+    throw new ProtocolError("hello-rejected.mcpId: invalid format");
+  assertString(raw.reason, "hello-rejected.reason");
+  if (raw.reason.length > 200) {
+    throw new ProtocolError("hello-rejected.reason: must be at most 200 characters");
+  }
+  return { type: "hello-rejected", mcpId: raw.mcpId, reason: raw.reason };
+}
 function validateInnerFrame(raw) {
   assertObject(raw, "inner");
   const t = raw.type;
@@ -42309,6 +42321,17 @@ var FetchproxySessionNotReadyError = class extends Error {
     Object.setPrototypeOf(this, new.target.prototype);
   }
 };
+var FetchproxyHelloRejectedError = class extends Error {
+  mcpId;
+  reason;
+  constructor(info) {
+    super(`fetchproxy: the extension refused the connection for "${info.mcpId}": ${info.reason}. This is the extension's own reason \u2014 it is not a timeout, and retrying unchanged will be refused the same way.`);
+    this.name = "FetchproxyHelloRejectedError";
+    this.mcpId = info.mcpId;
+    this.reason = info.reason;
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
 async function awaitSessionReady(ready, opts) {
   const ms = opts.timeoutMs ?? SESSION_READY_TIMEOUT_MS;
   if (ms <= 0)
@@ -42334,12 +42357,21 @@ import { join as join3 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { isAbsolute, join as join2 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
 var SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+function envIdentityDir() {
+  const raw = process.env.FETCHPROXY_IDENTITY_DIR;
+  if (raw === void 0)
+    return void 0;
+  const dir = raw.trim();
+  if (dir === "" || !isAbsolute(dir))
+    return void 0;
+  return dir;
+}
 function defaultIdentityDir() {
-  return join2(homedir2(), ".fetchproxy", "identity");
+  return envIdentityDir() ?? join2(homedir2(), ".fetchproxy", "identity");
 }
 function safeIdentityFileBase(serverName) {
   if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
@@ -42347,42 +42379,57 @@ function safeIdentityFileBase(serverName) {
   }
   return serverName.replace(/\//g, "_");
 }
-async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
-  const safeFile = safeIdentityFileBase(serverName);
-  const path = join2(dir, `${safeFile}.json`);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  try {
-    const raw = await readFile(path, "utf8");
-    const j2 = JSON.parse(raw);
-    return {
-      x25519Priv: fromB64(j2.x25519Priv),
-      x25519Pub: fromB64(j2.x25519Pub),
-      ed25519Priv: fromB64(j2.ed25519Priv),
-      ed25519Pub: fromB64(j2.ed25519Pub),
-      createdAt: j2.createdAt
-    };
-  } catch (e) {
-    if (e.code !== "ENOENT")
-      throw e;
-  }
+function identityFilePath(dir, serverName) {
+  return join2(dir, `${safeIdentityFileBase(serverName)}.json`);
+}
+async function generateIdentity() {
   const x = await generateX25519();
   const ed = await generateEd25519();
-  const id = {
+  return {
     x25519Priv: x.privateKey,
     x25519Pub: x.publicKey,
     ed25519Priv: ed.privateKey,
     ed25519Pub: ed.publicKey,
     createdAt: Date.now()
   };
-  const j = {
+}
+function serializeIdentity(id) {
+  return JSON.stringify({
     x25519Priv: toB64(id.x25519Priv),
     x25519Pub: toB64(id.x25519Pub),
     ed25519Priv: toB64(id.ed25519Priv),
     ed25519Pub: toB64(id.ed25519Pub),
     createdAt: id.createdAt
+  }, null, 2);
+}
+function parseIdentity(text2) {
+  const j = JSON.parse(text2);
+  return {
+    x25519Priv: fromB64(j.x25519Priv),
+    x25519Pub: fromB64(j.x25519Pub),
+    ed25519Priv: fromB64(j.ed25519Priv),
+    ed25519Pub: fromB64(j.ed25519Pub),
+    createdAt: j.createdAt
   };
-  await writeFile(path, JSON.stringify(j, null, 2), { mode: 384 });
+}
+async function writeIdentityFile(dir, serverName, id) {
+  const path = identityFilePath(dir, serverName);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await writeFile(path, serializeIdentity(id), { mode: 384 });
   await chmod(path, 384);
+  return path;
+}
+async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
+  const path = identityFilePath(dir, serverName);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  try {
+    return parseIdentity(await readFile(path, "utf8"));
+  } catch (e) {
+    if (e.code !== "ENOENT")
+      throw e;
+  }
+  const id = await generateIdentity();
+  await writeIdentityFile(dir, serverName, id);
   return id;
 }
 
@@ -42486,6 +42533,9 @@ async function startHost(opts) {
     }
   });
   const ownHello = await buildServerHello({
+    // 2.6.0: tell the extension it can say WHY it refused a hello, instead of
+    // leaving us to time out and guess.
+    accepts: ["hello-rejected"],
     identity: opts.ownIdentity,
     mcpId: opts.ownMcpId,
     serverName: opts.ownServerName,
@@ -42697,6 +42747,16 @@ async function startHost(opts) {
               extensionWs.send(JSON.stringify(frame));
           }
         }
+        if (frame.type === "hello-rejected" && identified === "extension") {
+          if (frame.mcpId === opts.ownMcpId) {
+            rejectOwnSession(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+          } else {
+            const slot = peers.get(frame.mcpId);
+            if (slot?.helloFrame.accepts?.includes("hello-rejected")) {
+              slot.ws.send(JSON.stringify(frame));
+            }
+          }
+        }
         if (frame.type === "pair-pending" && identified === "extension") {
           if (frame.mcpId === opts.ownMcpId) {
             ownPendingPairCode = frame.pairCode;
@@ -42808,7 +42868,8 @@ async function startPeer(opts) {
     graphqlOps: opts.graphqlOps,
     // 2.5.0: let a host ≥2.5.0 tell us when the extension leaves, so
     // `extensionConnected()` / `sessionLinked()` can go back to false.
-    accepts: ["extension-disconnected"]
+    // 2.6.0: `hello-rejected` for the same reason, from the extension.
+    accepts: ["extension-disconnected", "hello-rejected"]
   });
   const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
@@ -42923,6 +42984,9 @@ async function startPeer(opts) {
         }
         return;
       }
+      if (frame.type === "hello-rejected" && frame.mcpId === opts.mcpId) {
+        rejectFirstReady(new FetchproxyHelloRejectedError({ mcpId: frame.mcpId, reason: frame.reason }));
+      }
       if (frame.type === "pair-pending" && frame.mcpId === opts.mcpId) {
         pendingPairCode = frame.pairCode;
         pendingPairListeners.forEach((cb) => cb(frame.pairCode));
@@ -43020,6 +43084,8 @@ function classifyFetchError(error61) {
 
 // node_modules/@fetchproxy/server/dist/classify-bridge-error.js
 function classifyBridgeError(err) {
+  if (err instanceof FetchproxyHelloRejectedError)
+    return "hello_rejected";
   if (err instanceof FetchproxySessionNotReadyError)
     return "session_not_ready";
   if (err instanceof FetchproxyTimeoutError)
@@ -43120,11 +43186,20 @@ var FetchproxyNoTabError = class extends FetchproxyHintedError {
     this.name = "FetchproxyNoTabError";
   }
 };
+var FetchproxyTabOpeningError = class extends FetchproxyHintedError {
+  constructor(originalError) {
+    super(originalError, "the extension is opening that tab now \u2014 retry in a few seconds. You do not need to open one yourself, and this is not a version problem.");
+    this.name = "FetchproxyTabOpeningError";
+  }
+};
 var SCOPE_REJECTION = /not in declared/;
-var NO_TAB_REJECTION = /no tab matching (?!.*content script loaded)/;
+var NO_TAB_REJECTION = /no tab matching (?!.*(content script loaded|one is still opening))/;
+var TAB_OPENING_REJECTION = /no tab matching .*one is still opening/;
 function protocolErrorFrom(error61) {
   if (SCOPE_REJECTION.test(error61))
     return new FetchproxyScopeError(error61);
+  if (TAB_OPENING_REJECTION.test(error61))
+    return new FetchproxyTabOpeningError(error61);
   if (NO_TAB_REJECTION.test(error61))
     return new FetchproxyNoTabError(error61);
   return new FetchproxyProtocolError(error61);
@@ -43872,9 +43947,9 @@ var FetchproxyServer = class {
     if (opts.subdomain !== void 0)
       assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
-    const isAbsolute = path.startsWith("http://") || path.startsWith("https://");
+    const isAbsolute2 = path.startsWith("http://") || path.startsWith("https://");
     let host;
-    if (isAbsolute) {
+    if (isAbsolute2) {
       try {
         host = new URL(path).host;
       } catch {
@@ -43883,7 +43958,7 @@ var FetchproxyServer = class {
     } else {
       host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
     }
-    const url2 = isAbsolute ? path : `https://${host}${path}`;
+    const url2 = isAbsolute2 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url2, this.opts.domains);
     let tabUrl = `https://${host}/`;
     if (opts.viaTab !== void 0) {
@@ -44991,6 +45066,8 @@ var CREDENTIAL_ARMS = /* @__PURE__ */ new Set([
   "ok",
   "no_credential",
   "credential_rejected",
+  "session_expired",
+  "verification_pending",
   "timeout",
   "http",
   "transport",
@@ -45007,6 +45084,10 @@ function credentialHint(arm, prefix, hostLabel, source) {
       return `No credential resolved. Nothing was available to authenticate with \u2014 sign in and reconnect the connector so ${prefix} receives a token, or set the documented environment variable.`;
     case "credential_rejected":
       return `${hostLabel} rejected the credential from '${source}'. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
+    case "session_expired":
+      return `The credential from '${source}' is configured, but no session is live \u2014 ${hostLabel} served a sign-in page rather than the data. Sign in again; a cookie-session portal expires these on its own, so this recurs between uses.`;
+    case "verification_pending":
+      return `${hostLabel} is holding the sign-in on a second factor rather than refusing it. Supply the verification code the ACCOUNT HOLDER received \u2014 the credential itself is not the problem, so changing it will not help.`;
     case "timeout":
       return `The credential from '${source}' resolved, but ${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
     case "http":
@@ -45017,105 +45098,161 @@ function credentialHint(arm, prefix, hostLabel, source) {
       return `Unexpected failure \u2014 see error.message.`;
   }
 }
-function registerCredentialHealthcheckTool(args) {
-  const { server, prefix, hostLabel, probePath, resolveCredential, probeFn, classifyThrown, hints } = args;
-  const probeUrl = probePath ? `https://${hostLabel}${probePath}` : void 0;
-  server.registerTool(`${prefix}_healthcheck`, {
-    title: "Verify credentials and upstream reachability",
-    description: `Resolves the credential the way real tools do, then makes one authenticated request to ${hostLabel}. Reports which source supplied the credential, whether ${hostLabel} accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a ${hostLabel}-side problem'. Call this when a real tool fails and you want to know which hop broke. Read-only; never returns the credential itself.`,
-    annotations: {
-      title: "Verify credentials and upstream reachability",
-      readOnlyHint: true,
-      idempotentHint: true,
-      openWorldHint: true
+function credentialHealthcheckDescription(hostLabel) {
+  return `Resolves the credential the way real tools do, then makes one authenticated request to ${hostLabel}. Reports which source supplied the credential, whether ${hostLabel} accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a ${hostLabel}-side problem'. Read-only; never returns the credential itself.`;
+}
+async function runCredentialHealthcheck(args) {
+  const { prefix, hostLabel, probePath, resolveCredential, probeFn, classifyThrown, hints } = args;
+  const probeUrl = probePath ? `https://${hostLabel}${probePath.startsWith("/") ? "" : "/"}${probePath}` : void 0;
+  let probeStarted = 0;
+  let state;
+  try {
+    state = await resolveCredential();
+  } catch (e) {
+    const classified = classifyThrown?.(e);
+    const result2 = {
+      ok: false,
+      // Still false, and still no source: a classification explains WHY
+      // nothing resolved, it does not invent a credential that did.
+      credential: { source: null, resolved: false },
+      // No `url`: nothing was probed, and naming one implies it was tried.
+      probe: { elapsed_ms: 0 },
+      error: {
+        kind: classified?.kind ?? "no_credential",
+        message: truncateErrorMessage(messageOf(e)),
+        ...classified?.detail !== void 0 ? { detail: classified.detail } : {}
+      },
+      // The hint must follow the KIND beside it. Falling back to
+      // `no_credential`'s copy under a classified kind would state a cause
+      // the kind contradicts — the same disagreement this path exists to
+      // remove. So: an inline hint wins; else the classified arm's own
+      // copy (consumer override first); else, for a kind this module has
+      // no copy for, the neutral `unknown` text rather than one that
+      // asserts a cause; else the unclassified `no_credential` default.
+      hint: classified?.hint ?? (isArm(classified?.kind) ? hints?.[classified.kind] ?? credentialHint(classified.kind, prefix, hostLabel, null) : classified !== void 0 ? credentialHint("unknown", prefix, hostLabel, null) : hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null))
+    };
+    return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+  }
+  const credential = {
+    source: state.source,
+    resolved: state.source !== null,
+    ...state.detail !== void 0 ? { detail: state.detail } : {}
+  };
+  if (!credential.resolved) {
+    const result2 = {
+      ok: false,
+      credential,
+      probe: { elapsed_ms: 0 },
+      error: { kind: "no_credential", message: "no credential source resolved" },
+      hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
+    };
+    return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+  }
+  let arm = "ok";
+  let error61;
+  let status;
+  let customHint;
+  probeStarted = Date.now();
+  try {
+    await probeFn();
+  } catch (e) {
+    status = statusOf(e);
+    const aborted2 = e instanceof Error && e.name === "AbortError";
+    arm = status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
+    let kind = arm;
+    let detail;
+    const custom2 = classifyThrown?.(e);
+    if (custom2) {
+      kind = custom2.kind;
+      customHint = custom2.hint;
+      detail = custom2.detail;
+    }
+    error61 = {
+      kind,
+      // Redacted AND bounded before it reaches the result: an upstream
+      // failure routinely quotes what it was sent, and a healthcheck is
+      // the tool people paste into a chat when something is broken.
+      message: truncateErrorMessage(messageOf(e)),
+      ...detail !== void 0 ? { detail } : {}
+    };
+  }
+  const result = {
+    ok: error61 === void 0,
+    credential,
+    probe: {
+      ...probeUrl ? { url: probeUrl } : {},
+      elapsed_ms: Date.now() - probeStarted,
+      ...status !== void 0 ? { status } : {}
     },
-    inputSchema: {}
-  }, async () => {
-    let probeStarted = 0;
-    let state;
-    try {
-      state = await resolveCredential();
-    } catch (e) {
-      const classified = classifyThrown?.(e);
-      const result2 = {
-        ok: false,
-        // Still false, and still no source: a classification explains WHY
-        // nothing resolved, it does not invent a credential that did.
-        credential: { source: null, resolved: false },
-        // No `url`: nothing was probed, and naming one implies it was tried.
-        probe: { elapsed_ms: 0 },
-        error: {
-          kind: classified?.kind ?? "no_credential",
-          message: truncateErrorMessage(messageOf(e)),
-          ...classified?.detail !== void 0 ? { detail: classified.detail } : {}
-        },
-        // The hint must follow the KIND beside it. Falling back to
-        // `no_credential`'s copy under a classified kind would state a cause
-        // the kind contradicts — the same disagreement this path exists to
-        // remove. So: an inline hint wins; else the classified arm's own
-        // copy (consumer override first); else, for a kind this module has
-        // no copy for, the neutral `unknown` text rather than one that
-        // asserts a cause; else the unclassified `no_credential` default.
-        hint: classified?.hint ?? (isArm(classified?.kind) ? hints?.[classified.kind] ?? credentialHint(classified.kind, prefix, hostLabel, null) : classified !== void 0 ? credentialHint("unknown", prefix, hostLabel, null) : hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null))
+    ...error61 ? { error: error61 } : {},
+    hint: customHint ?? hints?.[arm] ?? credentialHint(arm, prefix, hostLabel, state.source)
+  };
+  return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+}
+var SessionNotLiveError = class extends Error {
+  hostLabel;
+  detail;
+  constructor(hostLabel, detail) {
+    super(`${hostLabel} served a sign-in page rather than the data (${detail}).`);
+    this.hostLabel = hostLabel;
+    this.detail = detail;
+    this.name = "SessionNotLiveError";
+  }
+};
+var ProbeHttpError = class extends Error {
+  hostLabel;
+  status;
+  constructor(hostLabel, status) {
+    super(`${hostLabel} answered ${status}.`);
+    this.hostLabel = hostLabel;
+    this.status = status;
+    this.name = "ProbeHttpError";
+  }
+};
+function sessionProbe(opts) {
+  const host = opts.hostLabel ?? "the upstream";
+  return async () => {
+    const { status, body } = await opts.request();
+    if (status >= 300 && status < 400) {
+      throw new SessionNotLiveError(host, `redirected with ${status}`);
+    }
+    if (status < 200 || status >= 300)
+      throw new ProbeHttpError(host, status);
+    if (opts.signedOut(body))
+      throw new SessionNotLiveError(host, "sign-in or verification page");
+    return body;
+  };
+}
+function sessionClassifier(opts) {
+  const { hostLabel, hints } = opts;
+  const remedies = opts.remedies ?? {};
+  const call = (tool, fallback) => tool !== void 0 ? `Call ${tool}.` : fallback;
+  return (err) => {
+    if (err instanceof ProbeHttpError) {
+      return {
+        kind: "http",
+        hint: hints?.http ?? `${hostLabel} answered ${err.status}. The credential was never judged \u2014 that is an upstream problem, so retry, and if it persists the far side is down.`
       };
-      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
     }
-    const credential = {
-      source: state.source,
-      resolved: state.source !== null,
-      ...state.detail !== void 0 ? { detail: state.detail } : {}
-    };
-    if (!credential.resolved) {
-      const result2 = {
-        ok: false,
-        credential,
-        probe: { elapsed_ms: 0 },
-        error: { kind: "no_credential", message: "no credential source resolved" },
-        hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
+    if (!(err instanceof SessionNotLiveError))
+      return void 0;
+    if (opts.credentialsRejected?.() === true) {
+      return {
+        kind: "credential_rejected",
+        hint: hints?.credential_rejected ?? `${hostLabel} refused this username and password. Correct them, then sign in ` + `again. ${call(remedies.signIn, "")}`.trim() + " Nothing retries for you: repeated failures escalate to a captcha or a lockout."
       };
-      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
     }
-    let arm = "ok";
-    let error61;
-    let status;
-    let customHint;
-    probeStarted = Date.now();
-    try {
-      await probeFn();
-    } catch (e) {
-      status = statusOf(e);
-      const aborted2 = e instanceof Error && e.name === "AbortError";
-      arm = status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
-      let kind = arm;
-      let detail;
-      const custom2 = classifyThrown?.(e);
-      if (custom2) {
-        kind = custom2.kind;
-        customHint = custom2.hint;
-        detail = custom2.detail;
-      }
-      error61 = {
-        kind,
-        // Redacted AND bounded before it reaches the result: an upstream
-        // failure routinely quotes what it was sent, and a healthcheck is
-        // the tool people paste into a chat when something is broken.
-        message: truncateErrorMessage(messageOf(e)),
-        ...detail !== void 0 ? { detail } : {}
+    if (opts.verificationPending?.() === true) {
+      return {
+        kind: "verification_pending",
+        hint: hints?.verification_pending ?? `A verification code is outstanding, so ${hostLabel} is holding the sign-in rather than refusing it. ` + (remedies.sendCode !== void 0 && remedies.verifyCode !== void 0 ? `Call ${remedies.sendCode}, then pass the code the ACCOUNT HOLDER receives to ${remedies.verifyCode}.` : "Supply the verification code the ACCOUNT HOLDER received; the credential itself is not the problem, so changing it will not help.")
       };
     }
-    const result = {
-      ok: error61 === void 0,
-      credential,
-      probe: {
-        ...probeUrl ? { url: probeUrl } : {},
-        elapsed_ms: Date.now() - probeStarted,
-        ...status !== void 0 ? { status } : {}
-      },
-      ...error61 ? { error: error61 } : {},
-      hint: customHint ?? hints?.[arm] ?? credentialHint(arm, prefix, hostLabel, state.source)
+    return {
+      kind: "session_expired",
+      hint: hints?.session_expired ?? `The credentials are configured but no session is live \u2014 ${hostLabel} sessions are short-lived, so this recurs between uses. ` + call(remedies.signIn, "Sign in again.") + " Expect a verification code, which goes to the account holder."
     };
-    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
-  });
+  };
 }
 
 // node_modules/@chrischall/mcp-utils/dist/fetchproxy/index.js
@@ -45152,9 +45289,9 @@ function createFetchproxyTransport(opts) {
     async start() {
       await server.listen();
       if (logListening) {
-        console.error(`[${serverOpts.serverName}:bridge] listening on 127.0.0.1:${server.bridgeHealth().port} (role=${server.role ?? "unknown"}, version=${serverOpts.version})`);
+        console.error(`[${serverOpts.serverName}:bridge] ready \u2014 127.0.0.1:${server.bridgeHealth().port} binds on the first request (version=${serverOpts.version})`);
       } else if (debug) {
-        console.error(`[${serverOpts.serverName}:bridge] listening (role=${server.role ?? "unknown"}, version=${serverOpts.version})`);
+        console.error(`[${serverOpts.serverName}:bridge] ready \u2014 binds on the first request (version=${serverOpts.version})`);
       }
     },
     async close() {
@@ -45246,123 +45383,131 @@ function projectBridgeStatus(health) {
     } : {}
   };
 }
-function registerBridgeHealthcheckTool(args) {
-  const { server, prefix, probePath, hostLabel, probeFn, classifyThrown, hints, path } = args;
-  const probeUrl = `https://${hostLabel}${probePath}`;
+function probeDisplayUrl(hostLabel, probePath) {
+  return `https://${hostLabel}${probePath.startsWith("/") ? "" : "/"}${probePath}`;
+}
+function bridgeHealthcheckDescription(hostLabel, probePath) {
+  return `Round-trips a small public ${hostLabel} URL (${probePath}) through the fetchproxy bridge and returns diagnostics: the bridge's role (host/peer/null), port, version, the extension link (linked / pair pending / not attached / never answered), the elapsed round-trip time, and a plain-English hint distinguishing 'bridge never came up' from 'extension not connected' from 'real ${hostLabel}-side problem'. Read-only, no auth required.`;
+}
+async function runBridgeHealthcheck(args) {
+  const { prefix, probePath, hostLabel, probeFn, classifyThrown, hints, path } = args;
+  const probeUrl = probeDisplayUrl(hostLabel, probePath);
   const resolveTransport = () => typeof args.transport === "function" ? args.transport() : args.transport;
+  let probeBody = "";
+  let thrown;
+  const wrappedProbe = async (p) => {
+    try {
+      probeBody = await probeFn(p);
+      return probeBody;
+    } catch (e) {
+      thrown = e;
+      throw e;
+    }
+  };
+  let ok;
+  let elapsedMs;
+  let bridge2;
+  let rawError;
+  let pathNow;
+  if (path) {
+    const start = Date.now();
+    try {
+      await wrappedProbe(probePath);
+      ok = true;
+    } catch (e) {
+      ok = false;
+      rawError = { kind: classifyBridgeError(e), message: truncateErrorMessage(messageOf(e)) };
+    }
+    elapsedMs = Date.now() - start;
+    pathNow = path();
+    const transport2 = resolveTransport();
+    bridge2 = transport2 ? projectBridgeStatus(transport2.status()) : void 0;
+  } else {
+    const transport2 = resolveTransport();
+    if (!transport2) {
+      throw new Error("bridge healthcheck: transport() returned nothing and no `path` was supplied \u2014 a bridge-only healthcheck needs its bridge.");
+    }
+    const probeResult = await transport2.runProbe(wrappedProbe, probePath);
+    ok = probeResult.ok;
+    elapsedMs = probeResult.elapsed_ms;
+    bridge2 = {
+      ...probeResult.bridge,
+      last_extension_message_at: transport2.status().lastExtensionMessageAt
+    };
+    rawError = probeResult.error;
+  }
+  const probe = ok ? { url: probeUrl, elapsed_ms: elapsedMs, status: 200, body_length: probeBody.length } : { url: probeUrl, elapsed_ms: elapsedMs };
+  let error61;
+  let bridgeHint;
+  let customHint;
+  let customDetail;
+  if (rawError) {
+    let kind = rawError.kind === "other" ? "unknown" : rawError.kind;
+    if (thrown instanceof FetchproxySessionNotReadyError) {
+      kind = "session_not_ready";
+      bridgeHint = thrown.hint;
+    } else if (thrown instanceof FetchproxyBridgeDownError) {
+      bridgeHint = thrown.hint;
+    }
+    if (thrown !== void 0 && classifyThrown) {
+      const custom2 = classifyThrown(thrown);
+      if (custom2) {
+        kind = custom2.kind;
+        customHint = custom2.hint;
+        customDetail = custom2.detail;
+      }
+    }
+    error61 = {
+      kind,
+      message: rawError.message,
+      ...bridgeHint !== void 0 ? { bridge_hint: bridgeHint } : {},
+      ...customDetail !== void 0 ? { detail: customDetail } : {}
+    };
+  }
+  const direct = pathNow ? pathNow.transport === "direct" : bridge2 === void 0;
+  const arm = ok ? "ok" : error61?.kind === "session_not_ready" ? "session_not_ready" : error61?.kind === "bridge_down" ? "bridge_down" : direct ? "direct" : bridge2 === void 0 || bridge2.role === null ? "no_role" : error61?.kind === "timeout" ? "timeout" : error61?.kind === "protocol" || error61?.kind === "http" ? "protocol" : "unknown";
+  const defaultHint = healthcheckHint({
+    ok,
+    role: bridge2?.role ?? null,
+    // The real configured port from bridgeHealth(), never a literal 37149.
+    port: bridge2?.port ?? null,
+    hostLabel,
+    prefix,
+    probePath,
+    errorKind: error61?.kind,
+    bridgeHint: error61?.kind === "bridge_down" ? bridgeHint : void 0,
+    session: {
+      ...bridge2?.session_state !== void 0 ? { state: bridge2.session_state } : {},
+      pairCode: bridge2?.pending_pair_code ?? (thrown instanceof FetchproxySessionNotReadyError ? thrown.pairCode : null)
+    },
+    direct
+  });
+  const result = {
+    ok,
+    ...bridge2 ? { bridge: bridge2 } : {},
+    ...pathNow ? { transport: pathNow } : {},
+    probe,
+    ...error61 ? { error: error61 } : {},
+    // Precedence: classifyThrown's hint > per-arm override > default ladder.
+    hint: customHint ?? hints?.[arm] ?? defaultHint
+  };
+  return {
+    content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+  };
+}
+function registerAdaptiveHealthcheckTool(args) {
+  const { server, prefix, hostLabel, usingBridge, bridge: bridge2, credential } = args;
   server.registerTool(`${prefix}_healthcheck`, {
-    title: "Verify the fetchproxy bridge end-to-end",
-    description: `Round-trips a small public ${hostLabel} URL (${probePath}) through the fetchproxy bridge and returns diagnostics: the bridge's role (host/peer/null), port, version, the extension link (linked / pair pending / not attached / never answered), the elapsed round-trip time, and a plain-English hint distinguishing 'bridge never came up' from 'extension not connected' from 'real ${hostLabel}-side problem'. Call this when a real tool fails and you want to know which hop broke. Read-only, no auth required.`,
+    title: "Verify this server can reach its upstream",
+    description: `Reports which hop is broken when a real tool fails, for whichever path this server is actually using. Relaying through your signed-in browser tab: ${bridgeHealthcheckDescription(hostLabel, bridge2.probePath)} Signing in server-side with configured credentials: ${credentialHealthcheckDescription(hostLabel)}`,
     annotations: {
-      title: "Verify the fetchproxy bridge end-to-end",
+      title: "Verify this server can reach its upstream",
       readOnlyHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
     inputSchema: {}
-  }, async () => {
-    let probeBody = "";
-    let thrown;
-    const wrappedProbe = async (p) => {
-      try {
-        probeBody = await probeFn(p);
-        return probeBody;
-      } catch (e) {
-        thrown = e;
-        throw e;
-      }
-    };
-    let ok;
-    let elapsedMs;
-    let bridge2;
-    let rawError;
-    let pathNow;
-    if (path) {
-      const start = Date.now();
-      try {
-        await wrappedProbe(probePath);
-        ok = true;
-      } catch (e) {
-        ok = false;
-        rawError = { kind: classifyBridgeError(e), message: truncateErrorMessage(messageOf(e)) };
-      }
-      elapsedMs = Date.now() - start;
-      pathNow = path();
-      const transport2 = resolveTransport();
-      bridge2 = transport2 ? projectBridgeStatus(transport2.status()) : void 0;
-    } else {
-      const transport2 = resolveTransport();
-      if (!transport2) {
-        throw new Error("registerBridgeHealthcheckTool: transport() returned nothing and no `path` was supplied \u2014 a bridge-only healthcheck needs its bridge.");
-      }
-      const probeResult = await transport2.runProbe(wrappedProbe, probePath);
-      ok = probeResult.ok;
-      elapsedMs = probeResult.elapsed_ms;
-      bridge2 = {
-        ...probeResult.bridge,
-        last_extension_message_at: transport2.status().lastExtensionMessageAt
-      };
-      rawError = probeResult.error;
-    }
-    const probe = ok ? { url: probeUrl, elapsed_ms: elapsedMs, status: 200, body_length: probeBody.length } : { url: probeUrl, elapsed_ms: elapsedMs };
-    let error61;
-    let bridgeHint;
-    let customHint;
-    let customDetail;
-    if (rawError) {
-      let kind = rawError.kind === "other" ? "unknown" : rawError.kind;
-      if (thrown instanceof FetchproxySessionNotReadyError) {
-        kind = "session_not_ready";
-        bridgeHint = thrown.hint;
-      } else if (thrown instanceof FetchproxyBridgeDownError) {
-        bridgeHint = thrown.hint;
-      }
-      if (thrown !== void 0 && classifyThrown) {
-        const custom2 = classifyThrown(thrown);
-        if (custom2) {
-          kind = custom2.kind;
-          customHint = custom2.hint;
-          customDetail = custom2.detail;
-        }
-      }
-      error61 = {
-        kind,
-        message: rawError.message,
-        ...bridgeHint !== void 0 ? { bridge_hint: bridgeHint } : {},
-        ...customDetail !== void 0 ? { detail: customDetail } : {}
-      };
-    }
-    const direct = pathNow ? pathNow.transport === "direct" : bridge2 === void 0;
-    const arm = ok ? "ok" : error61?.kind === "session_not_ready" ? "session_not_ready" : error61?.kind === "bridge_down" ? "bridge_down" : direct ? "direct" : bridge2 === void 0 || bridge2.role === null ? "no_role" : error61?.kind === "timeout" ? "timeout" : error61?.kind === "protocol" || error61?.kind === "http" ? "protocol" : "unknown";
-    const defaultHint = healthcheckHint({
-      ok,
-      role: bridge2?.role ?? null,
-      // The real configured port from bridgeHealth(), never a literal 37149.
-      port: bridge2?.port ?? null,
-      hostLabel,
-      prefix,
-      probePath,
-      errorKind: error61?.kind,
-      bridgeHint: error61?.kind === "bridge_down" ? bridgeHint : void 0,
-      session: {
-        ...bridge2?.session_state !== void 0 ? { state: bridge2.session_state } : {},
-        pairCode: bridge2?.pending_pair_code ?? (thrown instanceof FetchproxySessionNotReadyError ? thrown.pairCode : null)
-      },
-      direct
-    });
-    const result = {
-      ok,
-      ...bridge2 ? { bridge: bridge2 } : {},
-      ...pathNow ? { transport: pathNow } : {},
-      probe,
-      ...error61 ? { error: error61 } : {},
-      // Precedence: classifyThrown's hint > per-arm override > default ladder.
-      hint: customHint ?? hints?.[arm] ?? defaultHint
-    };
-    return {
-      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
-    };
-  });
+  }, async () => usingBridge() ? runBridgeHealthcheck({ server, prefix, hostLabel, ...bridge2 }) : runCredentialHealthcheck({ server, prefix, hostLabel, ...credential }));
 }
 
 // src/transport-fetchproxy.ts
@@ -45608,6 +45753,15 @@ function registerAccountTools(server, client2, patients2) {
 
 // src/tools/auth.ts
 function registerAuthTools(server, auth2) {
+  const configured = () => {
+    if (auth2 !== void 0) return auth2;
+    throw new McpToolError(
+      "This server is relaying through your signed-in my.atriumhealth.org browser tab, so there is nothing here to sign in to.",
+      {
+        hint: "Sign in to my.atriumhealth.org in the browser instead. To have this server sign in on its own \u2014 no tab, no extension \u2014 set MAH_USERNAME and MAH_PASSWORD and restart it; verification stays with the account holder either way."
+      }
+    );
+  };
   server.registerTool(
     "mah_auth_status",
     {
@@ -45616,6 +45770,14 @@ function registerAuthTools(server, auth2) {
       inputSchema: {}
     },
     async () => {
+      if (auth2 === void 0) {
+        return minifiedResult({
+          sessionResumable: false,
+          verificationPending: false,
+          trustedDeviceStored: false,
+          nextStep: "This server holds no credentials and signs in to nothing \u2014 requests relay through your signed-in my.atriumhealth.org tab. Run mah_healthcheck to check that path."
+        });
+      }
       const hasDevice = auth2.deviceId() !== void 0;
       const resumable = await auth2.isSignedIn();
       return minifiedResult({
@@ -45635,7 +45797,7 @@ function registerAuthTools(server, auth2) {
     },
     async () => {
       try {
-        await auth2.login();
+        await configured().login();
         return minifiedResult({ signedIn: true });
       } catch (e) {
         if (e instanceof MfaRequiredError) {
@@ -45663,7 +45825,7 @@ function registerAuthTools(server, auth2) {
       }
     },
     async ({ channel, resend }) => {
-      await auth2.sendCode(channel, resend);
+      await configured().sendCode(channel, resend);
       return minifiedResult({
         sent: true,
         channel,
@@ -45684,7 +45846,7 @@ function registerAuthTools(server, auth2) {
       }
     },
     async ({ code, rememberDevice }) => {
-      const r = await auth2.verifyCode(code, rememberDevice);
+      const r = await configured().verifyCode(code, rememberDevice);
       return minifiedResult({
         verified: true,
         trustedDeviceStored: r.remembered,
@@ -49519,6 +49681,30 @@ var kElementsClosedByOpening = {
   H6: {
     h6: true,
     H6: true
+  },
+  dt: {
+    dt: true,
+    dd: true,
+    DT: true,
+    DD: true
+  },
+  DT: {
+    dt: true,
+    dd: true,
+    DT: true,
+    DD: true
+  },
+  dd: {
+    dt: true,
+    dd: true,
+    DT: true,
+    DD: true
+  },
+  DD: {
+    dt: true,
+    dd: true,
+    DT: true,
+    DD: true
   }
 };
 var kElementsClosedByClosing = {
@@ -49589,6 +49775,38 @@ var kElementsClosedByClosing = {
     table: true,
     TR: true,
     TABLE: true
+  },
+  dt: {
+    dl: true,
+    body: true,
+    html: true,
+    DL: true,
+    BODY: true,
+    HTML: true
+  },
+  DT: {
+    dl: true,
+    body: true,
+    html: true,
+    DL: true,
+    BODY: true,
+    HTML: true
+  },
+  dd: {
+    dl: true,
+    body: true,
+    html: true,
+    DL: true,
+    BODY: true,
+    HTML: true
+  },
+  DD: {
+    dl: true,
+    body: true,
+    html: true,
+    DL: true,
+    BODY: true,
+    HTML: true
   }
 };
 var kElementsClosedByClosingExcept = { p: {
@@ -49869,46 +50087,79 @@ function registerBillingTools(server, client2, patients2) {
 }
 
 // src/tools/healthcheck.ts
-function registerHealthcheckTools(server, client2, transport2) {
-  registerBridgeHealthcheckTool({
-    server,
-    prefix: "mah",
-    // The app root renders for a signed-in user and redirects to the login
-    // page otherwise, so this probe distinguishes "bridge down" from
-    // "signed out" — the two failures users actually hit.
-    probePath: "Home",
-    hostLabel: "my.atriumhealth.org",
-    transport: transport2,
-    probeFn: (path) => client2.page(path)
-  });
-}
-function registerBridgelessHealthcheckTools(server, auth2) {
-  registerCredentialHealthcheckTool({
+var HOST = "my.atriumhealth.org";
+function registerMahHealthcheckTool(server, client2, arms) {
+  const { auth: auth2, bridge: bridge2 } = arms;
+  registerAdaptiveHealthcheckTool({
     server,
     prefix: "mah",
-    hostLabel: "my.atriumhealth.org",
-    // Leading slash + app root: this string is only for display, and the
-    // factory concatenates it onto hostLabel — without them it renders as
-    // 'my.atriumhealth.orgHome', which reads like a broken URL in a bug report.
-    probePath: "/myatriumhealth/Home",
-    // Report the SOURCE and non-secret facts only — never the password, the
-    // device token, or any cookie. This is the output people paste into a chat
-    // when something is broken.
-    resolveCredential: async () => {
-      const resumable = await auth2.isSignedIn();
-      const detail = {
-        sessionResumable: resumable,
-        trustedDeviceStored: auth2.deviceId() !== void 0,
-        verificationPending: auth2.mfaPending
-      };
-      return { source: "env", detail };
+    hostLabel: HOST,
+    usingBridge: () => bridge2 !== void 0,
+    bridge: {
+      // The app root renders for a signed-in user and redirects to the login
+      // page otherwise, so this probe distinguishes "bridge down" from
+      // "signed out" — the two failures users actually hit.
+      probePath: "Home",
+      // Only consulted on the bridge arm, which only runs when `bridge` is set.
+      transport: () => bridge2,
+      probeFn: (path) => client2.page(path)
     },
-    // Deliberately NOT routed through the client/transport: that would run
-    // ensureSession(), so a healthcheck on a signed-out session would silently
-    // submit credentials. A healthcheck must observe state, never change it —
-    // and on an account whose login controller can switch on a captcha, a
-    // diagnostic that logs in is actively harmful.
-    probeFn: () => auth2.request("Home")
+    credential: {
+      // Leading slash + app root: this string is only for display, and the
+      // factory concatenates it onto hostLabel.
+      probePath: "/myatriumhealth/Home",
+      // Report the SOURCE and non-secret facts only — never the password, the
+      // device token, or any cookie. This is the output people paste into a chat
+      // when something is broken.
+      resolveCredential: async () => {
+        if (auth2 === void 0) return { source: null };
+        const resumable = await auth2.isSignedIn();
+        const detail = {
+          sessionResumable: resumable,
+          trustedDeviceStored: auth2.deviceId() !== void 0,
+          verificationPending: auth2.mfaPending
+        };
+        return { source: "env", detail };
+      },
+      // The status/redirect/auth-wall ladder and the three signed-out arms now
+      // live in mcp-utils. What stays here is the part a library cannot write.
+      probeFn: sessionProbe({
+        // Deliberately `auth.request`, NOT the client or transport: those run
+        // ensureSession(), so a healthcheck on a signed-out session would
+        // silently submit credentials. A diagnostic must observe state, never
+        // change it — and on an account whose login controller can switch on a
+        // captcha, one that logs in is actively harmful.
+        request: async () => {
+          const { res, body } = await auth2.request("Home");
+          return { status: res.status, body };
+        },
+        // THE site-specific closure, and the readers' own test rather than a
+        // second copy that could drift: it is title-scoped because every
+        // signed-in page links to two-factor setup, so a body-wide match
+        // reports "signed out" for every request.
+        signedOut: isAuthWall,
+        hostLabel: HOST
+      }),
+      classifyThrown: sessionClassifier({
+        hostLabel: HOST,
+        // Named, never derived. The library used to build these from the tool
+        // prefix, which happened to be right here and wrong everywhere else —
+        // simplepractice signs in with simplepractice_request_sign_in_link,
+        // kiaaccess with kia_start_login.
+        remedies: {
+          signIn: "mah_sign_in",
+          sendCode: "mah_send_verification_code",
+          verifyCode: "mah_verify_code"
+        },
+        verificationPending: () => auth2?.mfaPending === true,
+        credentialsRejected: () => auth2?.credentialsRejected === true,
+        hints: {
+          // The one default worth overriding: naming the two variables beats
+          // "correct them", and this portal's escalation is worth stating.
+          credential_rejected: `${HOST} refused this username and password. Check MAH_USERNAME and MAH_PASSWORD, then call mah_sign_in \u2014 nothing retries for you, because the portal counts failed sign-ins and escalates to a captcha.`
+        }
+      })
+    }
   });
 }
 
@@ -50211,7 +50462,7 @@ function registerVisitTools(server, client2, patients2) {
 }
 
 // src/version.ts
-var VERSION = "0.3.0";
+var VERSION = "0.4.0";
 
 // src/index.ts
 var dotenvCandidates = [
@@ -50235,7 +50486,7 @@ if (!bridgeless && (username !== void 0 || password !== void 0)) {
   );
 } else if (!bridgeless) {
   console.error(
-    "[myatriumhealth-mcp] No MAH_USERNAME / MAH_PASSWORD found, so the browser bridge is starting. Set both (env, or a .env beside the server / MAH_DOTENV) for bridge-less sign-in, which binds no port and needs no tab."
+    "[myatriumhealth-mcp] No MAH_USERNAME / MAH_PASSWORD found, so requests will relay through your signed-in my.atriumhealth.org tab. Set both (env, or a .env beside the server / MAH_DOTENV) for bridge-less sign-in, which needs no tab."
   );
 }
 var port = readPortEnv("MAH_WS_PORT", DEFAULT_PORT);
@@ -50281,10 +50532,10 @@ await runMcp({
     (server) => registerAccountTools(server, client, patients),
     (server) => registerBillingTools(server, client, patients),
     (server) => registerPatientTools(server, client, patients),
-    ...auth !== void 0 ? [
-      (server) => registerAuthTools(server, auth),
-      (server) => registerBridgelessHealthcheckTools(server, auth)
-    ] : [],
-    ...bridge !== void 0 ? [(server) => registerHealthcheckTools(server, client, bridge)] : []
+    // Unconditional, in both modes. What varies is what they DO, not whether
+    // they exist — see registerAuthTools for why a tool surface that follows
+    // the environment is a bug rather than a tidiness.
+    (server) => registerAuthTools(server, auth),
+    (server) => registerMahHealthcheckTool(server, client, { auth, bridge })
   ]
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/myatriumhealth-mcp",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "MCP server for MyAtriumHealth (Atrium Health's Epic MyChart patient portal) via the fetchproxy browser bridge.",
   "type": "module",
   "bin": {
@@ -42,8 +42,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.23.1",
-    "@fetchproxy/server": "^2.1.0",
+    "@chrischall/mcp-utils": "^0.26.0",
+    "@fetchproxy/server": "^2.9.0",
     "@modelcontextprotocol/sdk": "^1.22.0",
     "dotenv": "^17.4.2",
     "node-html-parser": "^9.0.3",
@@ -51,10 +51,10 @@
   },
   "devDependencies": {
     "@types/node": "^26.0.0",
-    "@vitest/coverage-v8": "^4.1.7",
+    "@vitest/coverage-v8": "^5.0.0",
     "esbuild": "^0.28.1",
     "tsx": "^4.19.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.7"
+    "vitest": "^5.0.0"
   }
 }

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/myatriumhealth-mcp",
     "source": "github"
   },
-  "version": "0.3.0",
+  "version": "0.4.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/myatriumhealth-mcp",
-      "version": "0.3.0",
+      "version": "0.4.0",
       "transport": {
         "type": "stdio"
       },