@yawlabs/mcph 0.44.0 → 0.45.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to `@yawlabs/mcph` are documented here. This project uses [semantic versioning](https://semver.org) and a CI-gated release flow: pushing a `vX.Y.Z` tag triggers `.github/workflows/release.yml`, which publishes to npm.
 
+## 0.45.0 — 2026-04-18
+
+- **Clearer 401/403 errors with token fingerprint + actionable fix link** — When the backend rejects a token (`HTTP 401` revoked/malformed, `HTTP 403` accepted but scope-denied), `fetchConfig` now throws an error that names the offending token by its fingerprint (e.g., `mcp_pat_…abcd`), explains what state the token is in, and points directly at the tokens page with a concrete re-install command. Prior wording was "Invalid MCPH_TOKEN — check your token at mcp.hosting" and "Access denied — your token may have expired" — both too vague to action without pinging support. New wording is structured as three lines: cause, fix URL, and the `mcph install … --token mcp_pat_...` re-install command. Messages surface verbatim through `mcph servers`, the top-level `mcph` runtime, and anywhere else `fetchConfig` is awaited, so every user-facing rejection reads the same way.
+
 ## 0.44.0 — 2026-04-18
 
 - **`mcph install --list` + `mcph install --all`** — Two new modes on the install subcommand. `--list` is read-only: it enumerates every client/scope combo for the current OS and shows whether an `mcp.hosting` entry is already wired up, plus a path-per-row and a one-line summary (`N/M client scopes have mcp.hosting configured on linux`). No token, no network, no writes — just a diagnostic view that mirrors the `doctor` CLIENTS section but without the rest of doctor's noise. `--all` walks `INSTALL_TARGETS`, picks the default scope per client (user where supported, else the first non-project-dir scope, else skipped unless `--project-dir` is passed), and calls `runInstall` in a loop — so `--dry-run`, `--force`, `--skip`, and `--token` all propagate as expected. Status is aggregated into a single summary line, and the process exit code is non-zero if any sub-install failed so CI can still gate on one-shot onboarding. Works around the main drop-off during setup ("which client am I supposed to pick?") by offering both the answer (`--list`) and the sledgehammer (`--all`) from the same subcommand.

package/dist/index.js

@@ -464,12 +464,22 @@ async function fetchConfig(apiUrl6, token6, currentVersion) {
   if (res.statusCode === 401) {
     await res.body.text().catch(() => {
     });
-    throw new ConfigError("Invalid MCPH_TOKEN \u2014 check your token at mcp.hosting", true);
+    throw new ConfigError(
+      `Token rejected (HTTP 401) \u2014 the token ${tokenFingerprint(token6)} is invalid or revoked.
+  Generate a new token at https://mcp.hosting/dashboard/settings/tokens,
+  then re-run \`mcph install <client> --token mcp_pat_...\` or set MCPH_TOKEN.`,
+      true
+    );
   }
   if (res.statusCode === 403) {
     await res.body.text().catch(() => {
     });
-    throw new ConfigError("Access denied \u2014 your token may have expired", true);
+    throw new ConfigError(
+      `Access denied (HTTP 403) \u2014 the token ${tokenFingerprint(token6)} was accepted but lacks permission to read this account's servers.
+  The account may be suspended or the token scope reduced \u2014 check
+  https://mcp.hosting/dashboard/settings/tokens, or reach support@mcp.hosting.`,
+      true
+    );
   }
   if (res.statusCode !== 200) {
     const body = await res.body.text().catch(() => "");
@@ -1446,7 +1456,7 @@ function selectFlakyNamespaces(entries, limit) {
 }
 
 // src/doctor-cmd.ts
-var VERSION = true ? "0.44.0" : "dev";
+var VERSION = true ? "0.45.0" : "dev";
 async function runDoctor(opts = {}) {
   if (opts.json) return runDoctorJson(opts);
   const lines = [];
@@ -4734,7 +4744,7 @@ function categorizeSpawnError(err) {
 }
 async function connectToUpstream(config, onDisconnect, onListChanged) {
   const client = new Client(
-    { name: "mcph", version: true ? "0.44.0" : "dev" },
+    { name: "mcph", version: true ? "0.45.0" : "dev" },
     { capabilities: {} }
   );
   let transport;
@@ -5215,7 +5225,7 @@ var ConnectServer = class _ConnectServer {
     this.apiUrl = apiUrl6;
     this.token = token6;
     this.server = new Server(
-      { name: "mcph", version: true ? "0.44.0" : "dev" },
+      { name: "mcph", version: true ? "0.45.0" : "dev" },
       {
         capabilities: {
           tools: { listChanged: true },
@@ -7491,7 +7501,7 @@ ${installBlock}
   );
   process.exit(0);
 } else if (subcommand === "--version" || subcommand === "-V") {
-  process.stdout.write(`mcph ${true ? "0.44.0" : "dev"}
+  process.stdout.write(`mcph ${true ? "0.45.0" : "dev"}
 `);
   process.exit(0);
 } else if (subcommand && !subcommand.startsWith("-")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/mcph",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "mcp.hosting — one install, all your MCP servers, managed from the cloud",
   "license": "UNLICENSED",
   "author": "Yaw Labs <contact@yaw.sh> (https://yaw.sh)",