honeybook-mcp 0.8.0 → 0.8.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "HoneyBook client-portal tools for Claude Code",
-    "version": "0.8.0"
+    "version": "0.8.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "HoneyBook",
       "source": "./",
       "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
-      "version": "0.8.0",
+      "version": "0.8.2",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "honeybook",
   "displayName": "HoneyBook",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
   "author": {
     "name": "Chris Chall",

package/dist/bundle.js

@@ -39509,7 +39509,7 @@ function bridgeErrorInfo(err) {
 // package.json
 var package_default = {
   name: "honeybook-mcp",
-  version: "0.8.0",
+  version: "0.8.2",
   mcpName: "io.github.chrischall/honeybook-mcp",
   description: "HoneyBook client-portal MCP server for Claude",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -39822,7 +39822,11 @@ async function captureFlowCredentialViaFetchproxy(opts) {
     const errName = e?.name;
     if (errName === "FetchproxyScopeError" || /not in declared set/i.test(msg)) {
       throw new Error(
-        `HoneyBook flow auth: ${msg} \u2014 the declared scope names ONE key per flow ("${storageKey}"), so the extension asks you to approve each new questionnaire once. Revoke honeybook-mcp in the Transporter popup, re-run this tool, and approve the new scope.`
+        `HoneyBook flow auth: the extension is refusing a scope this questionnaire needs ("${storageKey}"). The declared scope names ONE key per flow, so each new questionnaire is approved once \u2014 and it is one click, not a re-pair: open the Transporter popup, where honeybook-mcp should be offering to "expand its access" with this key, and press Grant. Then re-run this tool. That keeps the existing pairing.
+
+Revoking and re-pairing also works \u2014 it is what the underlying error suggests \u2014 but it discards the pairing and makes you approve every scope again, so try Grant first.
+
+Underlying error: ${msg}`
       );
     }
     if (bridgeError.type === "timeout" || /timeout/i.test(msg)) {
@@ -39902,21 +39906,28 @@ var FlowClient = class {
     }
   }
   /**
-   * Explain a bare 400.
+   * Explain an untyped 400.
+   *
+   * A 400 with no `error_type` says nothing about which input was wrong and
+   * reads exactly like an auth failure; left alone it sends people to
+   * re-capture a credential that is fine, so the auth reading is denied
+   * outright.
    *
-   * A flow read that is missing a required input answers `400` with
-   * `"Unexpected server error"` and no `error_type` — nothing in the body says
-   * which input, and it reads exactly like an auth failure. Left alone it sends
-   * people to re-capture a credential that is fine, so the two known causes are
-   * named here and the auth reading is denied outright.
+   * What can NOT reach here is the client version. Probed live 2026-08-31,
+   * every version failure — stale, garbage, empty, omitted — answers 400 with
+   * `error_type: HBWrongAPIVersionError` and `error_data.server_api_version`,
+   * which `hbApiRequest` intercepts and retries once on the server's own
+   * number, so it self-heals a layer below. `ctxc` cannot reach here either:
+   * the API ignores it entirely (omitted, bogus, and `/client/`-less all return
+   * the same 200, byte-identical), and naming it here only misdirected. So the
+   * version is offered as the input to CHECK rather than as a known cause, and
+   * this is deliberately vaguer than 0.8.0's message: no cause is confirmed.
    */
   badRequestError(err) {
     return new Error(
       `${err.message}
 
-HoneyBook answers a flow read with a bare 400 when a required input is missing, without saying which. The two that do it:
-  1. hb-api-client-version \u2014 sent as ${this.apiVersion}. It is read from /api/gon at startup, so it normally tracks HoneyBook; if HONEYBOOK_API_VERSION is pinned in your environment that value can have rotted, so unset it to re-read the live one.
-  2. ctxc \u2014 the company id from /api/v2/flow/<flowId>/minimal, required on every /api/v2/client/\u2026 read.
+HoneyBook answered this flow read with a 400 carrying no error_type, so nothing in the response says which input it objected to. The input worth checking is hb-api-client-version, sent as ${this.apiVersion}: it is read from /api/gon at startup, so it normally tracks HoneyBook, but a pinned HONEYBOOK_API_VERSION can have rotted \u2014 unset it to re-read the live one. (A version HoneyBook actively rejects answers with error_type HBWrongAPIVersionError and is retried automatically, so it would not surface here.)
 This is NOT an auth failure \u2014 the credential is very likely fine, so re-running \`use_flow_link\` will not help.`
     );
   }
@@ -39960,7 +39971,7 @@ async function fetchFlowMinimal(flowId, opts) {
     const detail = body.slice(0, 300);
     const cause = response.status === 404 ? `no flow ${flowId} \u2014 it may have been deleted, or the id is wrong` : /WrongAPIVersion/i.test(body) ? `HoneyBook rejected hb-api-client-version ${opts.apiVersion}; this package's pinned value needs updating` : "that route is public, so this is a HoneyBook-side problem rather than a credential one";
     throw new Error(
-      `HoneyBook flow: GET /api/v2/flow/${flowId}/minimal answered ${response.status} \u2014 ${cause}. It is where the context id (ctxc) required by the questionnaire read comes from.` + (detail ? ` Response: ${detail}` : "")
+      `HoneyBook flow: GET /api/v2/flow/${flowId}/minimal answered ${response.status} \u2014 ${cause}. It is where the context id (ctxc) the questionnaire read sends comes from.` + (detail ? ` Response: ${detail}` : "")
     );
   }
   return await response.json();
@@ -40003,21 +40014,17 @@ async function getFlow(args) {
     apiVersion: client.getApiVersion()
   });
   const contextId = flowContextId(minimal);
-  if (!contextId) {
-    throw new Error(
-      `HoneyBook flow: no context id for flow ${flowId}. The questionnaire read requires \`ctxc\`, the vendor company id, and GET /api/v2/flow/<flowId>/minimal did not carry one at branding_data.company_id. Calling /active without it answers a bare 400 that reads like an auth failure, so this stops here: it is not an auth problem and re-running \`use_flow_link\` will not help.`
-    );
-  }
-  const query = new URLSearchParams({ ctxc: contextId });
+  const path = `/api/v2/client/flow/${encodeURIComponent(flowId)}/active`;
   const flow = await client.request(
     "GET",
-    `/api/v2/client/flow/${encodeURIComponent(flowId)}/active?${query}`
+    contextId ? `${path}?${new URLSearchParams({ ctxc: contextId })}` : path
   );
   const head = {
     flowId,
     portalOrigin: client.credential.portalOrigin,
-    // Reported because it is a second input the read depends on: when this call
-    // fails, knowing which company id was used is half the diagnosis.
+    // Reported because it is a second input the request carries: when this call
+    // fails, knowing which company id was sent is half the diagnosis. `null` is
+    // a normal outcome, not an error — the read does not require one.
     contextId
   };
   if (args.section === "raw") return textResult({ ...head, flow });
@@ -40040,7 +40047,7 @@ function registerFlowTools(server) {
       description: "Capture a HoneyBook QUESTIONNAIRE (flow) credential via the fetchproxy browser extension. Use this for a link shaped https://<vendor>.hbportal.co/flow/<flowId>?hash=\u2026 \u2014 for a client-portal link (/app/link/resolve/\u2026) use `use_magic_link` instead. Prerequisites: install the fetchproxy extension, open the questionnaire link in that browser and let the page render, then run this tool. It snapshots localStorage[\"HONEYBOOK_REACT_WEAK_AUTH_<flowId>\"] into ~/.honeybook-mcp/flows.json. A flow credential is HoneyBook's 'weak auth': it is scoped to that ONE questionnaire and cannot read portal workspaces, files, invoices or payment methods. Because the storage key contains the flow id, the extension asks you to re-approve the scope once per new questionnaire.",
       inputSchema: {
         flow_link_url: external_exports.string().url().describe(
-          "Full questionnaire link from the vendor email, e.g. https://<vendor>.hbportal.co/flow/<flowId>?hash=\u2026&userId=\u2026 The ?hash= parameter is the credential, so use the original link rather than the URL the page rewrites to."
+          "Questionnaire link, e.g. https://<vendor>.hbportal.co/flow/<flowId>?hash=\u2026&userId=\u2026 Only the /flow/<flowId> segment is required: the credential is read out of the open page's localStorage, so the rewritten step URL (/flow/<flowId>/1-Questions) works too. The URL's ?hash= is used only as a fallback when the page stored none, so prefer the original email link if the capture reports no hash."
         )
       },
       annotations: { readOnlyHint: false }
@@ -40050,7 +40057,7 @@ function registerFlowTools(server) {
   server.registerTool(
     "get_flow",
     {
-      description: 'Read a HoneyBook questionnaire (flow) \u2014 its pages, questions and any answers already submitted \u2014 using a credential captured by `use_flow_link`. Requires a flow credential; a client-portal session will NOT work here, and vice versa. Defaults to the most recently captured flow. Makes two calls: the public /api/v2/flow/<id>/minimal for the vendor company id, then /api/v2/client/flow/<id>/active?ctxc=<companyId>. A questionnaire larger than the default ceiling answers with its size and top-level keys instead; call again with section="raw" for the whole thing.',
+      description: 'Read a HoneyBook questionnaire (flow) \u2014 its pages, questions and any answers already submitted \u2014 using a credential captured by `use_flow_link`. Requires a flow credential; a client-portal session will NOT work here, and vice versa. Defaults to the most recently captured flow. Makes two calls: the public /api/v2/flow/<id>/minimal for the vendor company id, then /api/v2/client/flow/<id>/active, passing that id as ?ctxc= when /minimal supplied one. A questionnaire larger than the default ceiling answers with its size and top-level keys instead; call again with section="raw" for the whole thing.',
       inputSchema: {
         flow_id: external_exports.string().optional().describe(
           "Flow id to read. Omit to use the most recently captured flow credential. Run `list_active_sessions` to see the active flow ids."
@@ -40513,7 +40520,7 @@ var __dirname = dirname2(fileURLToPath(import.meta.url));
 await loadDotenvSafely({ path: join6(__dirname, "..", ".env"), override: false });
 await runMcp({
   name: "honeybook-mcp",
-  version: "0.8.0",
+  version: "0.8.2",
   // x-release-please-version
   tools: [
     registerSessionTools,

package/dist/flow-auth.js

@@ -85,10 +85,30 @@ export async function captureFlowCredentialViaFetchproxy(opts) {
         // same reasoning as `auth.ts`.
         const errName = e?.name;
         if (errName === 'FetchproxyScopeError' || /not in declared set/i.test(msg)) {
-            throw new Error(`HoneyBook flow auth: ${msg} — the declared scope names ONE key per flow ` +
-                `("${storageKey}"), so the extension asks you to approve each new questionnaire ` +
-                'once. Revoke honeybook-mcp in the Transporter popup, re-run this tool, and approve ' +
-                'the new scope.');
+            // Lead with GRANT, and put the upstream text LAST.
+            //
+            // A GROWING scope does not block the session: the extension serves the
+            // intersection of approved and declared, stays connected, and queues a
+            // non-blocking "<serverName> wants to expand its access" offer carrying a
+            // Grant button. Only a domains/serverName change forces a re-pair.
+            //
+            // Ordering is the whole point and is easy to get wrong. `msg` is the
+            // upstream FetchproxyScopeError, and it ends with its OWN remedy —
+            // "Revoke this MCP in the Transporter extension popup, then re-run".
+            // Interpolating it first (as this did when the Grant advice was added)
+            // puts "Revoke" ahead of "Grant" no matter what we append, so a reader
+            // still does the expensive thing. It therefore goes at the END, behind an
+            // "Underlying error:" label, where it stays available for diagnosis
+            // without being the first instruction anyone reads.
+            throw new Error('HoneyBook flow auth: the extension is refusing a scope this questionnaire needs ' +
+                `("${storageKey}"). The declared scope names ONE key per flow, so each new ` +
+                'questionnaire is approved once — and it is one click, not a re-pair: open the ' +
+                'Transporter popup, where honeybook-mcp should be offering to "expand its access" ' +
+                'with this key, and press Grant. Then re-run this tool. That keeps the existing ' +
+                'pairing.\n\n' +
+                'Revoking and re-pairing also works — it is what the underlying error suggests — but ' +
+                'it discards the pairing and makes you approve every scope again, so try Grant ' +
+                `first.\n\nUnderlying error: ${msg}`);
         }
         if (bridgeError.type === 'timeout' || /timeout/i.test(msg)) {
             throw new Error('HoneyBook flow auth: fetchproxy capture timed out. The extension never returned ' +

package/dist/flow-client.js

@@ -73,23 +73,32 @@ export class FlowClient {
         }
     }
     /**
-     * Explain a bare 400.
+     * Explain an untyped 400.
      *
-     * A flow read that is missing a required input answers `400` with
-     * `"Unexpected server error"` and no `error_type` — nothing in the body says
-     * which input, and it reads exactly like an auth failure. Left alone it sends
-     * people to re-capture a credential that is fine, so the two known causes are
-     * named here and the auth reading is denied outright.
+     * A 400 with no `error_type` says nothing about which input was wrong and
+     * reads exactly like an auth failure; left alone it sends people to
+     * re-capture a credential that is fine, so the auth reading is denied
+     * outright.
+     *
+     * What can NOT reach here is the client version. Probed live 2026-08-31,
+     * every version failure — stale, garbage, empty, omitted — answers 400 with
+     * `error_type: HBWrongAPIVersionError` and `error_data.server_api_version`,
+     * which `hbApiRequest` intercepts and retries once on the server's own
+     * number, so it self-heals a layer below. `ctxc` cannot reach here either:
+     * the API ignores it entirely (omitted, bogus, and `/client/`-less all return
+     * the same 200, byte-identical), and naming it here only misdirected. So the
+     * version is offered as the input to CHECK rather than as a known cause, and
+     * this is deliberately vaguer than 0.8.0's message: no cause is confirmed.
      */
     badRequestError(err) {
         return new Error(`${err.message}\n\n` +
-            'HoneyBook answers a flow read with a bare 400 when a required input is missing, without ' +
-            'saying which. The two that do it:\n' +
-            `  1. hb-api-client-version — sent as ${this.apiVersion}. It is read from /api/gon at ` +
-            'startup, so it normally tracks HoneyBook; if HONEYBOOK_API_VERSION is pinned in your ' +
-            'environment that value can have rotted, so unset it to re-read the live one.\n' +
-            '  2. ctxc — the company id from /api/v2/flow/<flowId>/minimal, required on every ' +
-            '/api/v2/client/… read.\n' +
+            'HoneyBook answered this flow read with a 400 carrying no error_type, so nothing in the ' +
+            'response says which input it objected to. The input worth checking is ' +
+            `hb-api-client-version, sent as ${this.apiVersion}: it is read from /api/gon at startup, ` +
+            'so it normally tracks HoneyBook, but a pinned HONEYBOOK_API_VERSION can have rotted — ' +
+            'unset it to re-read the live one. (A version HoneyBook actively rejects answers with ' +
+            'error_type HBWrongAPIVersionError and is retried automatically, so it would not surface ' +
+            'here.)\n' +
             'This is NOT an auth failure — the credential is very likely fine, so re-running ' +
             '`use_flow_link` will not help.');
     }
@@ -167,7 +176,7 @@ export async function fetchFlowMinimal(flowId, opts) {
                 ? `HoneyBook rejected hb-api-client-version ${opts.apiVersion}; this package's pinned value needs updating`
                 : 'that route is public, so this is a HoneyBook-side problem rather than a credential one';
         throw new Error(`HoneyBook flow: GET /api/v2/flow/${flowId}/minimal answered ${response.status} — ${cause}. ` +
-            `It is where the context id (ctxc) required by the questionnaire read comes from.` +
+            `It is where the context id (ctxc) the questionnaire read sends comes from.` +
             (detail ? ` Response: ${detail}` : ''));
     }
     return (await response.json());
@@ -176,12 +185,14 @@ export async function fetchFlowMinimal(flowId, opts) {
  * The `ctxc` value: the vendor's company id.
  *
  * The app sets `params.ctxc` from `clientPortalConfigStore.clientPortalCompanyId`
- * in its request interceptor, and `branding_data.company_id` is that same id —
- * verified live as the only 24-hex value the `/minimal` response carries.
+ * in its request interceptor, and `branding_data.company_id` is that same id.
+ * (0.8.0's docblock called it the only 24-hex value in `/minimal`; it is not —
+ * `theme._id` is another — so this reads the field by name, as it always did.)
  *
- * Returns `null` rather than guessing: a wrong `ctxc` is the same bare 400 as a
- * missing one, so a fabricated value would be indistinguishable from a genuine
- * failure.
+ * Returns `null` rather than guessing, and `null` is a normal outcome: the read
+ * omits `ctxc` entirely in that case. The API ignores the value regardless —
+ * verified live 2026-08-31 that a bogus one returns the same 200 — so a
+ * fabricated id would be neither safer nor more honest than sending none.
  */
 export function flowContextId(minimal) {
     return minimal.branding_data?.company_id ?? null;

package/dist/index.js

@@ -13,7 +13,7 @@ import { registerContractTools } from './tools/contracts.js';
 import { registerInvoiceTools } from './tools/invoices.js';
 await runMcp({
     name: 'honeybook-mcp',
-    version: '0.8.0', // x-release-please-version
+    version: '0.8.2', // x-release-please-version
     tools: [
         registerSessionTools,
         registerFlowTools,

package/dist/tools/flows.js

@@ -82,24 +82,22 @@ export async function getFlow(args) {
         apiVersion: client.getApiVersion(),
     });
     const contextId = flowContextId(minimal);
-    // Refuse rather than calling /active without it. A missing ctxc produces the
-    // same bare 400 as a stale client version, and a 400 here reads as an auth
-    // failure — so falling through would send someone to re-capture a credential
-    // that is perfectly good.
-    if (!contextId) {
-        throw new Error(`HoneyBook flow: no context id for flow ${flowId}. The questionnaire read requires ` +
-            '`ctxc`, the vendor company id, and GET /api/v2/flow/<flowId>/minimal did not carry one ' +
-            'at branding_data.company_id. Calling /active without it answers a bare 400 that reads ' +
-            'like an auth failure, so this stops here: it is not an auth problem and re-running ' +
-            '`use_flow_link` will not help.');
-    }
-    const query = new URLSearchParams({ ctxc: contextId });
-    const flow = await client.request('GET', `/api/v2/client/flow/${encodeURIComponent(flowId)}/active?${query}`);
+    // `ctxc` is sent when /minimal carries one and simply omitted when it does
+    // not. It is NOT required: probed live on 2026-08-31 with a real credential,
+    // omitting it — and sending a bogus one, and dropping `/client/` — returns
+    // the same 200 with a byte-identical body. 0.8.0 refused here instead, which
+    // could only ever invent a failure for a flow whose /minimal lacks
+    // branding_data.company_id. The URL still matches the app's own request,
+    // because matching the shipped client is the cheap way to stay right if the
+    // server ever does start enforcing it.
+    const path = `/api/v2/client/flow/${encodeURIComponent(flowId)}/active`;
+    const flow = await client.request('GET', contextId ? `${path}?${new URLSearchParams({ ctxc: contextId })}` : path);
     const head = {
         flowId,
         portalOrigin: client.credential.portalOrigin,
-        // Reported because it is a second input the read depends on: when this call
-        // fails, knowing which company id was used is half the diagnosis.
+        // Reported because it is a second input the request carries: when this call
+        // fails, knowing which company id was sent is half the diagnosis. `null` is
+        // a normal outcome, not an error — the read does not require one.
         contextId,
     };
     if (args.section === 'raw')
@@ -126,12 +124,12 @@ export function registerFlowTools(server) {
             flow_link_url: z
                 .string()
                 .url()
-                .describe('Full questionnaire link from the vendor email, e.g. https://<vendor>.hbportal.co/flow/<flowId>?hash=…&userId=… The ?hash= parameter is the credential, so use the original link rather than the URL the page rewrites to.'),
+                .describe('Questionnaire link, e.g. https://<vendor>.hbportal.co/flow/<flowId>?hash=…&userId=… Only the /flow/<flowId> segment is required: the credential is read out of the open page\'s localStorage, so the rewritten step URL (/flow/<flowId>/1-Questions) works too. The URL\'s ?hash= is used only as a fallback when the page stored none, so prefer the original email link if the capture reports no hash.'),
         },
         annotations: { readOnlyHint: false },
     }, useFlowLink);
     server.registerTool('get_flow', {
-        description: 'Read a HoneyBook questionnaire (flow) — its pages, questions and any answers already submitted — using a credential captured by `use_flow_link`. Requires a flow credential; a client-portal session will NOT work here, and vice versa. Defaults to the most recently captured flow. Makes two calls: the public /api/v2/flow/<id>/minimal for the vendor company id, then /api/v2/client/flow/<id>/active?ctxc=<companyId>. A questionnaire larger than the default ceiling answers with its size and top-level keys instead; call again with section="raw" for the whole thing.',
+        description: 'Read a HoneyBook questionnaire (flow) — its pages, questions and any answers already submitted — using a credential captured by `use_flow_link`. Requires a flow credential; a client-portal session will NOT work here, and vice versa. Defaults to the most recently captured flow. Makes two calls: the public /api/v2/flow/<id>/minimal for the vendor company id, then /api/v2/client/flow/<id>/active, passing that id as ?ctxc= when /minimal supplied one. A questionnaire larger than the default ceiling answers with its size and top-level keys instead; call again with section="raw" for the whole thing.',
         inputSchema: {
             flow_id: z
                 .string()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeybook-mcp",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "mcpName": "io.github.chrischall/honeybook-mcp",
   "description": "HoneyBook client-portal MCP server for Claude",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/honeybook-mcp",
     "source": "github"
   },
-  "version": "0.8.0",
+  "version": "0.8.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "honeybook-mcp",
-      "version": "0.8.0",
+      "version": "0.8.2",
       "transport": {
         "type": "stdio"
       },