honeybook-mcp 1.1.2 → 1.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +2 -2
- package/.claude-plugin/plugin.json +1 -1
- package/dist/auth.js +7 -1
- package/dist/bundle.js +1066 -339
- package/dist/client.js +119 -19
- package/dist/feed.js +2 -1
- package/dist/flow-auth.js +4 -0
- package/dist/flow-client.js +11 -8
- package/dist/index.js +1 -1
- package/dist/pending-tasks.js +39 -3
- package/dist/sessions.js +29 -0
- package/dist/tools/attachments.js +2 -2
- package/dist/tools/contracts.js +7 -3
- package/dist/tools/healthcheck.js +2 -2
- package/dist/tools/invoices.js +7 -3
- package/dist/tools/messages.js +29 -5
- package/dist/tools/notes.js +2 -2
- package/dist/tools/payment_methods.js +2 -2
- package/dist/tools/payments.js +2 -2
- package/dist/tools/projects.js +2 -2
- package/dist/tools/tasks.js +3 -3
- package/dist/tools/workspace_files.js +3 -3
- package/dist/tools/workspaces.js +2 -2
- package/package.json +5 -5
- package/server.json +2 -2
|
@@ -7,7 +7,7 @@
|
|
|
7
7
|
},
|
|
8
8
|
"metadata": {
|
|
9
9
|
"description": "HoneyBook client-portal tools for Claude Code",
|
|
10
|
-
"version": "1.1.
|
|
10
|
+
"version": "1.1.4"
|
|
11
11
|
},
|
|
12
12
|
"plugins": [
|
|
13
13
|
{
|
|
@@ -15,7 +15,7 @@
|
|
|
15
15
|
"displayName": "HoneyBook",
|
|
16
16
|
"source": "./",
|
|
17
17
|
"description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
|
|
18
|
-
"version": "1.1.
|
|
18
|
+
"version": "1.1.4",
|
|
19
19
|
"author": {
|
|
20
20
|
"name": "Chris Chall"
|
|
21
21
|
},
|
package/dist/auth.js
CHANGED
|
@@ -67,7 +67,7 @@ import { bootstrap } from '@fetchproxy/bootstrap';
|
|
|
67
67
|
import { bridgeErrorInfo } from '@chrischall/mcp-utils/fetchproxy';
|
|
68
68
|
import { parseBoolEnv } from '@chrischall/mcp-utils';
|
|
69
69
|
import pkg from '../package.json' with { type: 'json' };
|
|
70
|
-
import { sessionStore, normalizeOrigin } from './sessions.js';
|
|
70
|
+
import { sessionStore, normalizeOrigin, vendorPortalSubdomain } from './sessions.js';
|
|
71
71
|
/** True if the user has explicitly disabled the fetchproxy capture path. */
|
|
72
72
|
function fetchproxyDisabled() {
|
|
73
73
|
return parseBoolEnv('HONEYBOOK_DISABLE_FETCHPROXY');
|
|
@@ -87,6 +87,8 @@ function fetchproxyDisabled() {
|
|
|
87
87
|
* subsequent tool call without an explicit `origin` will use it.
|
|
88
88
|
*/
|
|
89
89
|
export async function captureSessionViaFetchproxy(opts) {
|
|
90
|
+
// Refuse a foreign host before the bridge opens (fleet-audit#139).
|
|
91
|
+
const vendorSubdomain = vendorPortalSubdomain(opts.portalOrigin);
|
|
90
92
|
if (fetchproxyDisabled()) {
|
|
91
93
|
throw new Error('HoneyBook auth: fetchproxy capture is disabled by HONEYBOOK_DISABLE_FETCHPROXY. ' +
|
|
92
94
|
'Unset that env var to enable session capture via the browser extension.');
|
|
@@ -111,6 +113,10 @@ export async function captureSessionViaFetchproxy(opts) {
|
|
|
111
113
|
// know which tab to target.
|
|
112
114
|
domains: ['honeybook.com', 'hbportal.co'],
|
|
113
115
|
storageDomain: 'hbportal.co',
|
|
116
|
+
// Pin the read to the vendor's own tab. Without it the extension reads
|
|
117
|
+
// whichever hbportal.co tab is open, so vendor A's token could be
|
|
118
|
+
// stored under vendor B's origin (fleet-audit#139).
|
|
119
|
+
storageSubdomain: vendorSubdomain,
|
|
114
120
|
declare: {
|
|
115
121
|
cookies: [],
|
|
116
122
|
// `HONEYBOOK_REACT_CURR_USER` is ~6.5KB of mostly unused user
|