honeybook-mcp 0.5.0 → 0.7.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "HoneyBook client-portal tools for Claude Code",
-    "version": "0.5.0"
+    "version": "0.7.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "HoneyBook",
       "source": "./",
       "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
-      "version": "0.5.0",
+      "version": "0.7.0",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "honeybook",
   "displayName": "HoneyBook",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
   "author": {
     "name": "Chris Chall",

package/dist/bundle.js

@@ -2990,7 +2990,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve.call(this, root, ref);
+      let _sch = resolve2.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -3017,7 +3017,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve(root, ref) {
+    function resolve2(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3313,8 +3313,8 @@ var require_utils = __commonJS({
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-    function reescapeHostDelimiters(host, isIP) {
-      const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    function reescapeHostDelimiters(host, isIP2) {
+      const re = isIP2 ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
       re.lastIndex = 0;
       return host.replace(re, (ch) => HOST_DELIMS[ch]);
     }
@@ -3648,7 +3648,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve(baseURI, relativeURI, options) {
+    function resolve2(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
       const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
@@ -3803,7 +3803,7 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
-      let isIP = false;
+      let isIP2 = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
           uri = options.scheme + ":" + uri;
@@ -3852,9 +3852,9 @@ var require_fast_uri = __commonJS({
           if (ipv4result === false) {
             const ipv6result = normalizeIPv6(parsed.host);
             parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP2 = ipv6result.isIPV6;
           } else {
-            isIP = true;
+            isIP2 = true;
           }
         }
         if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) {
@@ -3871,7 +3871,7 @@ var require_fast_uri = __commonJS({
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP2 === false && nonSimpleDomain(parsed.host)) {
             try {
               parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
@@ -3885,7 +3885,7 @@ var require_fast_uri = __commonJS({
               parsed.scheme = unescape(parsed.scheme);
             }
             if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP2);
             }
           }
           if (parsed.path) {
@@ -3932,7 +3932,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve,
+      resolve: resolve2,
       resolveComponent,
       equal,
       serialize,
@@ -7198,7 +7198,7 @@ var require_permessage_deflate = __commonJS({
       acceptAsServer(offers) {
         const opts = this._options;
         const accepted = offers.find((params) => {
-          if (opts.serverNoContextTakeover === false && params.server_no_context_takeover || params.server_max_window_bits && (opts.serverMaxWindowBits === false || typeof opts.serverMaxWindowBits === "number" && opts.serverMaxWindowBits > params.server_max_window_bits) || typeof opts.clientMaxWindowBits === "number" && !params.client_max_window_bits) {
+          if (opts.serverNoContextTakeover === false && params.server_no_context_takeover || params.server_max_window_bits && (opts.serverMaxWindowBits === false || typeof opts.serverMaxWindowBits === "number" && opts.serverMaxWindowBits > params.server_max_window_bits) || typeof opts.clientMaxWindowBits === "number" && (typeof params.client_max_window_bits === "number" ? opts.clientMaxWindowBits > params.client_max_window_bits : !params.client_max_window_bits)) {
             return false;
           }
           return true;
@@ -10592,7 +10592,7 @@ var require_websocket_server = __commonJS({
 });
 
 // src/index.ts
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/zod/v3/helpers/util.js
@@ -32553,7 +32553,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error51) {
@@ -32570,7 +32570,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -32648,7 +32648,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve(parseResult.data);
+            resolve2(parseResult.data);
           }
         } catch (error51) {
           reject(error51);
@@ -32909,12 +32909,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve, interval);
+      const timeoutId = setTimeout(resolve2, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -34005,7 +34005,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -34669,12 +34669,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve();
+        resolve2();
       } else {
-        this._stdout.once("drain", resolve);
+        this._stdout.once("drain", resolve2);
       }
     });
   }
@@ -34891,11 +34891,11 @@ var pageSchema = {
 
 // src/sessions.ts
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync } from "node:fs";
-import { dirname } from "node:path";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 function normalizeOrigin(input) {
   try {
     return new URL(input).origin.replace(/\/$/, "");
@@ -35031,9 +35031,9 @@ var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
 
 // src/sessions.ts
 var sessionsDir = readEnvVar("HONEYBOOK_SESSIONS_DIR", {
-  default: join(homedir(), ".honeybook-mcp")
+  default: join2(homedir(), ".honeybook-mcp")
 });
-var sessionsFilePath = join(sessionsDir, "sessions.json");
+var sessionsFilePath = join2(sessionsDir, "sessions.json");
 var sessionStore = new SessionStore({
   filePath: sessionsFilePath,
   keyOf: (session) => session.portalOrigin,
@@ -35116,14 +35116,13 @@ var HoneyBookClient = class {
 function clearClientCache() {
   clientCache.clear();
 }
+var NO_ACTIVE_SESSION_MESSAGE = "No active HoneyBook session. Use the `use_magic_link` tool with a magic-link URL from a vendor's email to activate one.";
 async function getActiveClient(origin) {
   const session = sessionStore.get(origin);
   if (!session) {
     const active = sessionStore.list();
     if (active.length === 0) {
-      throw new Error(
-        "No active HoneyBook session. Use the `use_magic_link` tool with a magic-link URL from a vendor's email to activate one."
-      );
+      throw new Error(NO_ACTIVE_SESSION_MESSAGE);
     }
     throw new Error(
       `No active session for origin "${origin}". Active origins: ${active.map((s) => s.portalOrigin).join(", ")}`
@@ -36317,7 +36316,7 @@ var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
   const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let timer;
     const clearBindTimer = () => {
       if (timer) {
@@ -36333,7 +36332,7 @@ async function electRole(opts) {
           server.close();
         } catch {
         }
-        resolve({ role: "peer" });
+        resolve2({ role: "peer" });
       } else {
         reject(e);
       }
@@ -36341,7 +36340,7 @@ async function electRole(opts) {
     const onListening = () => {
       clearBindTimer();
       server.removeListener("error", onError);
-      resolve({ role: "host", server });
+      resolve2({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -36503,16 +36502,16 @@ async function awaitSessionReady(ready, opts) {
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
 import { readFile as readFile2, writeFile as writeFile2, rename, unlink, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
 var SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 function defaultIdentityDir() {
-  return join2(homedir2(), ".fetchproxy", "identity");
+  return join3(homedir2(), ".fetchproxy", "identity");
 }
 function safeIdentityFileBase(serverName) {
   if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
@@ -36522,7 +36521,7 @@ function safeIdentityFileBase(serverName) {
 }
 async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
   const safeFile = safeIdentityFileBase(serverName);
-  const path = join2(dir, `${safeFile}.json`);
+  const path = join3(dir, `${safeFile}.json`);
   await mkdir(dir, { recursive: true, mode: 448 });
   try {
     const raw = await readFile(path, "utf8");
@@ -36594,13 +36593,13 @@ function decideExtensionTrust(args) {
   };
 }
 function extensionTrustPath(serverName, dir = defaultIdentityDir()) {
-  return join3(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
+  return join4(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
 }
 function extensionTrustPathHint(serverName) {
   try {
     return extensionTrustPath(serverName);
   } catch {
-    return join3(defaultIdentityDir(), "<server-name>.extension-trust.json");
+    return join4(defaultIdentityDir(), "<server-name>.extension-trust.json");
   }
 }
 function isPin(x) {
@@ -36687,8 +36686,8 @@ async function startHost(opts) {
   let rejectOwnSession;
   let ownSessionReady;
   function resetSessionPromise() {
-    ownSessionReady = new Promise((resolve, reject) => {
-      resolveOwnSession = resolve;
+    ownSessionReady = new Promise((resolve2, reject) => {
+      resolveOwnSession = resolve2;
       rejectOwnSession = reject;
     });
     ownSessionReady.catch(() => {
@@ -36909,7 +36908,7 @@ async function startHost(opts) {
     });
   });
   return {
-    close: () => new Promise((resolve) => {
+    close: () => new Promise((resolve2) => {
       for (const client of wss.clients) {
         try {
           client.terminate();
@@ -36917,7 +36916,7 @@ async function startHost(opts) {
         }
       }
       wss.close(() => {
-        opts.httpServer.close(() => resolve());
+        opts.httpServer.close(() => resolve2());
       });
     }),
     sendOwnInner: async (inner) => {
@@ -36947,8 +36946,8 @@ async function startHost(opts) {
 var enc3 = new TextEncoder();
 async function startPeer(opts) {
   const ws = new import_websocket.default(`ws://${opts.host}:${opts.port}`);
-  await new Promise((resolve, reject) => {
-    ws.once("open", () => resolve());
+  await new Promise((resolve2, reject) => {
+    ws.once("open", () => resolve2());
     ws.once("error", reject);
   });
   const hello = await buildServerHello({
@@ -36978,8 +36977,8 @@ async function startPeer(opts) {
   let pendingPairCode = null;
   let resolveFirstReady;
   let rejectFirstReady;
-  const sessionPromise = new Promise((resolve, reject) => {
-    resolveFirstReady = resolve;
+  const sessionPromise = new Promise((resolve2, reject) => {
+    resolveFirstReady = resolve2;
     rejectFirstReady = reject;
   });
   let extensionHello = null;
@@ -37180,6 +37179,7 @@ function classifyBridgeError(err) {
 }
 
 // node_modules/@fetchproxy/server/dist/ws-server.js
+import { isIP } from "node:net";
 function envWsPort() {
   const raw = process.env.FETCHPROXY_WS_PORT;
   if (raw === void 0 || raw.trim() === "")
@@ -37191,6 +37191,15 @@ function envWsPort() {
     return void 0;
   return port;
 }
+function envWsHost() {
+  const raw = process.env.FETCHPROXY_WS_HOST;
+  if (raw === void 0)
+    return void 0;
+  const host = raw.trim();
+  if (host === "" || isIP(host) === 0)
+    return void 0;
+  return host;
+}
 var FetchproxyProtocolError = class extends Error {
   constructor(message) {
     super(message);
@@ -37439,7 +37448,7 @@ var FetchproxyServer = class {
     }
     this.opts = {
       port: opts.port ?? envWsPort() ?? 37149,
-      host: opts.host ?? "127.0.0.1",
+      host: opts.host ?? envWsHost() ?? "127.0.0.1",
       serverName: opts.serverName,
       version: opts.version,
       domains: [...opts.domains],
@@ -37725,6 +37734,7 @@ var FetchproxyServer = class {
     return {
       role: this.role,
       port: this.opts.port,
+      host: this.opts.host,
       serverVersion: this.opts.version,
       fetchTimeoutMs: this.opts.fetchTimeoutMs ?? 0,
       bridgeReviveDelayMs: this.opts.bridgeReviveDelayMs ?? 0,
@@ -37868,8 +37878,8 @@ var FetchproxyServer = class {
   async _fetchOnceWithTimeout(init) {
     const id = this.nextRequestId++;
     const inner = { type: "request", id, op: "fetch", init };
-    const pending = new Promise((resolve) => {
-      this.pending.set(id, resolve);
+    const pending = new Promise((resolve2) => {
+      this.pending.set(id, resolve2);
     });
     await this.sendInnerFrame(inner);
     const timeoutMs = this.opts.fetchTimeoutMs;
@@ -37880,12 +37890,12 @@ var FetchproxyServer = class {
     try {
       return await Promise.race([
         pending,
-        new Promise((resolve) => {
+        new Promise((resolve2) => {
           timer = setTimeout(() => {
             this.pending.delete(id);
             const elapsedMs = Date.now() - start;
             const error51 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
-            resolve({
+            resolve2({
               ok: false,
               error: error51,
               kind: "timeout",
@@ -38247,8 +38257,8 @@ var FetchproxyServer = class {
       const tabUrl = `https://${host}/`;
       inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
     }
-    const pending = new Promise((resolve) => {
-      this.pendingReadCookies.set(id, resolve);
+    const pending = new Promise((resolve2) => {
+      this.pendingReadCookies.set(id, resolve2);
     });
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
@@ -38306,8 +38316,8 @@ var FetchproxyServer = class {
         ...cookiePath !== void 0 ? { path: cookiePath } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingWriteCookies.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingWriteCookies.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingWriteCookies, id, `https://${host}`);
@@ -38369,8 +38379,8 @@ var FetchproxyServer = class {
         ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingStorage.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
@@ -38474,8 +38484,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingCapture.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingCapture.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingCapture, id, `https://${opts.host}${opts.path ?? "/*"}`);
@@ -38559,8 +38569,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingRedirect.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingRedirect.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingRedirect, id, `https://${opts.host}${opts.path ?? "/*"}`);
@@ -38641,8 +38651,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingDownload.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingDownload.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingDownload, id, opts.url);
@@ -38689,8 +38699,8 @@ var FetchproxyServer = class {
         keys: [...opts.keys]
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingIdb.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingIdb.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
@@ -38729,8 +38739,8 @@ var FetchproxyServer = class {
       op: "read_dom",
       init: { origin, names: [...opts.names] }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingStorage.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
@@ -38775,8 +38785,8 @@ var FetchproxyServer = class {
         ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
       }
     };
-    const pending = new Promise((resolve, reject) => {
-      this.pendingGraphql.set(id, { resolve, reject });
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve2, reject });
     });
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
@@ -39215,6 +39225,118 @@ var BootstrapDisabledError = class extends Error {
   }
 };
 
+// node_modules/@chrischall/mcp-utils/dist/healthcheck/index.js
+function statusOf(err) {
+  if (typeof err !== "object" || err === null)
+    return void 0;
+  const s = err.status ?? err.statusCode;
+  return typeof s === "number" ? s : void 0;
+}
+function credentialHint(arm, prefix, hostLabel, source) {
+  switch (arm) {
+    case "ok":
+      return `Credential from '${source}' works: ${hostLabel} accepted an authenticated request. If a real tool still fails, the problem is that tool, not auth.`;
+    case "no_credential":
+      return `No credential resolved. Nothing was available to authenticate with \u2014 sign in and reconnect the connector so ${prefix} receives a token, or set the documented environment variable.`;
+    case "credential_rejected":
+      return `${hostLabel} rejected the credential from '${source}'. It is present but no longer valid \u2014 most often expired or revoked upstream. Re-authenticate and reconnect; retrying will not fix it.`;
+    case "timeout":
+      return `The credential from '${source}' resolved, but ${hostLabel} did not answer in time. Usually transient \u2014 retry. If it persists, ${hostLabel} is slow or unreachable from here.`;
+    case "http":
+      return `${hostLabel} answered with an error status that is not an auth rejection. That is USUALLY a ${hostLabel}-side problem rather than an auth one \u2014 but a 404 here more often means the probe path is wrong than that ${hostLabel} is broken, so check error.message and probe.url before concluding anything about the credential.`;
+    case "transport":
+      return `Could not reach ${hostLabel} at all. Check network egress; the credential itself was never judged.`;
+    default:
+      return `Unexpected failure \u2014 see error.message.`;
+  }
+}
+function registerCredentialHealthcheckTool(args) {
+  const { server, prefix, hostLabel, probePath, resolveCredential, probeFn, classifyThrown, hints } = args;
+  const probeUrl = probePath ? `https://${hostLabel}${probePath}` : void 0;
+  server.registerTool(`${prefix}_healthcheck`, {
+    title: "Verify credentials and upstream reachability",
+    description: `Resolves the credential the way real tools do, then makes one authenticated request to ${hostLabel}. Reports which source supplied the credential, whether ${hostLabel} accepted it, the round-trip time, and a plain-English hint distinguishing 'no credential' from 'credential rejected' from 'a ${hostLabel}-side problem'. Call this when a real tool fails and you want to know which hop broke. Read-only; never returns the credential itself.`,
+    annotations: {
+      title: "Verify credentials and upstream reachability",
+      readOnlyHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    inputSchema: {}
+  }, async () => {
+    let probeStarted = 0;
+    let state;
+    try {
+      state = await resolveCredential();
+    } catch (e) {
+      const result2 = {
+        ok: false,
+        credential: { source: null, resolved: false },
+        // No `url`: nothing was probed, and naming one implies it was tried.
+        probe: { elapsed_ms: 0 },
+        error: { kind: "no_credential", message: truncateErrorMessage(messageOf(e)) },
+        hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
+      };
+      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+    }
+    const credential = {
+      source: state.source,
+      resolved: state.source !== null,
+      ...state.detail !== void 0 ? { detail: state.detail } : {}
+    };
+    if (!credential.resolved) {
+      const result2 = {
+        ok: false,
+        credential,
+        probe: { elapsed_ms: 0 },
+        error: { kind: "no_credential", message: "no credential source resolved" },
+        hint: hints?.no_credential ?? credentialHint("no_credential", prefix, hostLabel, null)
+      };
+      return { content: [{ type: "text", text: JSON.stringify(result2, null, 2) }] };
+    }
+    let arm = "ok";
+    let error51;
+    let status;
+    let customHint;
+    probeStarted = Date.now();
+    try {
+      await probeFn();
+    } catch (e) {
+      status = statusOf(e);
+      const aborted2 = e instanceof Error && e.name === "AbortError";
+      arm = status === 401 || status === 403 ? "credential_rejected" : status !== void 0 ? "http" : aborted2 || /timeout|timed out|ETIMEDOUT/i.test(messageOf(e)) ? "timeout" : /fetch failed|ENOTFOUND|ECONNREFUSED|ECONNRESET|network/i.test(messageOf(e)) ? "transport" : "unknown";
+      let kind = arm;
+      let detail;
+      const custom2 = classifyThrown?.(e);
+      if (custom2) {
+        kind = custom2.kind;
+        customHint = custom2.hint;
+        detail = custom2.detail;
+      }
+      error51 = {
+        kind,
+        // Redacted AND bounded before it reaches the result: an upstream
+        // failure routinely quotes what it was sent, and a healthcheck is
+        // the tool people paste into a chat when something is broken.
+        message: truncateErrorMessage(messageOf(e)),
+        ...detail !== void 0 ? { detail } : {}
+      };
+    }
+    const result = {
+      ok: error51 === void 0,
+      credential,
+      probe: {
+        ...probeUrl ? { url: probeUrl } : {},
+        elapsed_ms: Date.now() - probeStarted,
+        ...status !== void 0 ? { status } : {}
+      },
+      ...error51 ? { error: error51 } : {},
+      hint: customHint ?? hints?.[arm] ?? credentialHint(arm, prefix, hostLabel, state.source)
+    };
+    return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+  });
+}
+
 // node_modules/@chrischall/mcp-utils/dist/fetchproxy/index.js
 function bridgeErrorInfo(err) {
   const kind = classifyBridgeError(err);
@@ -39251,7 +39373,7 @@ function bridgeErrorInfo(err) {
 // package.json
 var package_default = {
   name: "honeybook-mcp",
-  version: "0.5.0",
+  version: "0.7.0",
   mcpName: "io.github.chrischall/honeybook-mcp",
   description: "HoneyBook client-portal MCP server for Claude",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -39293,9 +39415,9 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.15.0",
-    "@fetchproxy/bootstrap": "^2.0.0",
-    "@fetchproxy/server": "^2.0.0",
+    "@chrischall/mcp-utils": "^0.19.2",
+    "@fetchproxy/bootstrap": "^2.2.0",
+    "@fetchproxy/server": "^2.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
     zod: "^4.4.3"
@@ -39490,6 +39612,40 @@ function registerSessionTools(server) {
   );
 }
 
+// src/tools/healthcheck.ts
+function registerHealthcheckTools(server) {
+  registerCredentialHealthcheckTool({
+    server,
+    prefix: "honeybook",
+    hostLabel: "api.honeybook.com",
+    probePath: "/api/v2/users/{id}/payment_methods",
+    resolveCredential: async () => {
+      const active = sessionStore.list();
+      if (active.length === 0) {
+        throw new Error(NO_ACTIVE_SESSION_MESSAGE);
+      }
+      return {
+        source: "magic-link session",
+        detail: { origins: active.map((s) => s.portalOrigin) }
+      };
+    },
+    probeFn: async () => {
+      const client = await getActiveClient();
+      return client.request("GET", `/api/v2/users/${client.scope.userId}/payment_methods`);
+    },
+    classifyThrown: (err) => {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/auth expired|use_magic_link|HBUnauthorizedError/.test(msg)) {
+        return {
+          kind: "credential_rejected",
+          hint: "HoneyBook rejected the session \u2014 it has expired. Re-run `use_magic_link` with a fresh link from a vendor email. (HoneyBook signals this with 404 + HBUnauthorizedError rather than 401; the client normalises both.)"
+        };
+      }
+      return void 0;
+    }
+  });
+}
+
 // src/types.ts
 var FILE_TYPES = ["agreement", "invoice", "brochure", "proposal"];
 
@@ -39890,10 +40046,10 @@ function registerInvoiceTools(server) {
 
 // src/index.ts
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-await loadDotenvSafely({ path: join4(__dirname, "..", ".env"), override: false });
+await loadDotenvSafely({ path: join5(__dirname, "..", ".env"), override: false });
 await runMcp({
   name: "honeybook-mcp",
-  version: "0.5.0",
+  version: "0.7.0",
   // x-release-please-version
   tools: [
     registerSessionTools,
@@ -39901,6 +40057,7 @@ await runMcp({
     registerWorkspaceTools,
     registerPaymentMethodTools,
     registerContractTools,
-    registerInvoiceTools
+    registerInvoiceTools,
+    registerHealthcheckTools
   ]
 });

package/dist/client.js

@@ -96,12 +96,18 @@ export function resetClientsForTest() {
     clientCache.clear();
     moduleState.apiVersionPromise = null;
 }
+/**
+ * The one "no session yet" message, shared with `honeybook_healthcheck` so the
+ * two cannot drift into telling the user different things about the same
+ * state.
+ */
+export const NO_ACTIVE_SESSION_MESSAGE = 'No active HoneyBook session. Use the `use_magic_link` tool with a magic-link URL from a vendor\'s email to activate one.';
 export async function getActiveClient(origin) {
     const session = sessionStore.get(origin);
     if (!session) {
         const active = sessionStore.list();
         if (active.length === 0) {
-            throw new Error('No active HoneyBook session. Use the `use_magic_link` tool with a magic-link URL from a vendor\'s email to activate one.');
+            throw new Error(NO_ACTIVE_SESSION_MESSAGE);
         }
         throw new Error(`No active session for origin "${origin}". Active origins: ${active.map((s) => s.portalOrigin).join(', ')}`);
     }

package/dist/index.js

@@ -4,6 +4,7 @@ import { runMcp, loadDotenvSafely } from '@chrischall/mcp-utils';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 await loadDotenvSafely({ path: join(__dirname, '..', '.env'), override: false });
 import { registerSessionTools } from './tools/sessions.js';
+import { registerHealthcheckTools } from './tools/healthcheck.js';
 import { registerWorkspaceFileTools } from './tools/workspace_files.js';
 import { registerWorkspaceTools } from './tools/workspaces.js';
 import { registerPaymentMethodTools } from './tools/payment_methods.js';
@@ -11,7 +12,7 @@ import { registerContractTools } from './tools/contracts.js';
 import { registerInvoiceTools } from './tools/invoices.js';
 await runMcp({
     name: 'honeybook-mcp',
-    version: '0.5.0', // x-release-please-version
+    version: '0.7.0', // x-release-please-version
     tools: [
         registerSessionTools,
         registerWorkspaceFileTools,
@@ -19,5 +20,6 @@ await runMcp({
         registerPaymentMethodTools,
         registerContractTools,
         registerInvoiceTools,
+        registerHealthcheckTools,
     ],
 });

package/dist/tools/healthcheck.js

@@ -0,0 +1,61 @@
+import { registerCredentialHealthcheckTool } from '@chrischall/mcp-utils/healthcheck';
+import { getActiveClient, NO_ACTIVE_SESSION_MESSAGE } from '../client.js';
+import { sessionStore } from '../sessions.js';
+/**
+ * Register `honeybook_healthcheck` — checks for an active portal session, then
+ * makes one authenticated call.
+ *
+ * HoneyBook's credential is a session captured from a magic link, so its
+ * failures are: no session was ever activated, the session has lapsed and
+ * HoneyBook rejects it, or HoneyBook is down. Those need different responses
+ * and all three previously surfaced as the same opaque tool error.
+ *
+ * HoneyBook answers a revoked token with **404 + HBUnauthorizedError**, not
+ * 401, so `classifyThrown` re-kinds that as a rejection. Without it a lapsed
+ * session reads as "that resource does not exist", which sends people looking
+ * for a missing workspace instead of re-activating their link.
+ */
+export function registerHealthcheckTools(server) {
+    registerCredentialHealthcheckTool({
+        server,
+        prefix: 'honeybook',
+        hostLabel: 'api.honeybook.com',
+        probePath: '/api/v2/users/{id}/payment_methods',
+        resolveCredential: async () => {
+            const active = sessionStore.list();
+            if (active.length === 0) {
+                // The SAME constant getActiveClient throws, so the two cannot drift.
+                throw new Error(NO_ACTIVE_SESSION_MESSAGE);
+            }
+            return {
+                source: 'magic-link session',
+                detail: { origins: active.map((s) => s.portalOrigin) },
+            };
+        },
+        probeFn: async () => {
+            const client = await getActiveClient();
+            return client.request('GET', `/api/v2/users/${client.scope.userId}/payment_methods`);
+        },
+        classifyThrown: (err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            // Match the message the CLIENT throws, not HoneyBook's wire error.
+            //
+            // `HoneyBookClient.request()` already converts both 401 and
+            // 404+`HBUnauthorizedError` into one "auth expired … use_magic_link"
+            // error (`authExpiredError`), so nothing carrying the literal
+            // `HBUnauthorizedError` ever reaches here. An earlier version matched
+            // that literal and therefore never fired in production — the mock in its
+            // test bypassed the very transformation that made it dead.
+            //
+            // `HBUnauthorizedError` is kept as a second alternative only for a raw
+            // error that has not been through `request()`.
+            if (/auth expired|use_magic_link|HBUnauthorizedError/.test(msg)) {
+                return {
+                    kind: 'credential_rejected',
+                    hint: 'HoneyBook rejected the session — it has expired. Re-run `use_magic_link` with a fresh link from a vendor email. (HoneyBook signals this with 404 + HBUnauthorizedError rather than 401; the client normalises both.)',
+                };
+            }
+            return undefined;
+        },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeybook-mcp",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "mcpName": "io.github.chrischall/honeybook-mcp",
   "description": "HoneyBook client-portal MCP server for Claude",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -42,9 +42,9 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^0.15.0",
-    "@fetchproxy/bootstrap": "^2.0.0",
-    "@fetchproxy/server": "^2.0.0",
+    "@chrischall/mcp-utils": "^0.19.2",
+    "@fetchproxy/bootstrap": "^2.2.0",
+    "@fetchproxy/server": "^2.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
     "zod": "^4.4.3"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/honeybook-mcp",
     "source": "github"
   },
-  "version": "0.5.0",
+  "version": "0.7.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "honeybook-mcp",
-      "version": "0.5.0",
+      "version": "0.7.0",
       "transport": {
         "type": "stdio"
       },