honeybook-mcp 1.1.4 → 1.2.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "HoneyBook client-portal tools for Claude Code",
-    "version": "1.1.4"
+    "version": "1.2.0"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "HoneyBook",
       "source": "./",
       "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
-      "version": "1.1.4",
+      "version": "1.2.0",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "honeybook",
   "displayName": "HoneyBook",
-  "version": "1.1.4",
+  "version": "1.2.0",
   "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
   "author": {
     "name": "Chris Chall",

package/README.md

@@ -76,7 +76,7 @@ Add to Claude Desktop config (`~/Library/Application Support/Claude/claude_deskt
 }
 ```
 
-No environment variables are required.
+No environment variables are required. The optional ones below tune how writes are confirmed — see [Confirmations](#confirmations).
 
 ## Sessions
 
@@ -134,13 +134,13 @@ Tools that touch a vendor accept an optional `origin` argument (e.g. `https://ac
 | `get_workspace_file`   | Full detail for one file                                  | Auto       |
 | `get_workspace`        | Workspace detail + status flags                           | Auto       |
 | `list_payment_methods` | Saved payment methods                                     | Auto       |
-| `sign_contract`        | Deep link to sign in portal (requires `confirm:true`)     | Confirm    |
-| `pay_invoice`          | Deep link to pay in portal (requires `confirm:true`)      | Confirm    |
+| `sign_contract`        | Deep link to sign in portal (after you confirm)           | Confirm    |
+| `pay_invoice`          | Deep link to pay in portal (after you confirm)            | Confirm    |
 | `list_projects`        | Your projects with a vendor + their workspace ids         | Auto       |
 | `get_project`          | Project details: date, location, people, custom fields    | Auto       |
 | `list_messages`        | Messages (or the activity log) in a workspace, newest first | Auto     |
 | `get_message`          | One message in full: body, attachments, delivery status   | Auto       |
-| `send_message`         | Send or reply through the portal (requires `confirm:true`) | Confirm   |
+| `send_message`         | Send or reply through the portal (after you confirm)      | Confirm    |
 | `mark_messages_seen`   | Mark feed items seen (reads never do this on their own)   | Auto       |
 | `list_meetings`        | Scheduled meetings with join links, latest time wins      | Auto       |
 | `list_tasks`           | Tasks the vendor assigned you, with counts                | Auto       |
@@ -151,7 +151,17 @@ Tools that touch a vendor accept an optional `origin` argument (e.g. `https://ac
 `send_message` is the one tool that acts on your behalf: it creates the same
 `send_workspace_message` job the portal's Activity composer creates and waits
 for HoneyBook to finish it, so the vendor receives a normal HoneyBook email.
-Without `confirm:true` it only previews the recipients, subject and body.
+Until you confirm it only previews the recipients, subject and body — see [Confirmations](#confirmations).
+
+## Confirmations
+
+`sign_contract`, `pay_invoice` and `send_message` ask you to confirm before they act. A client that can show an MCP confirmation prompt (Claude Code) shows one. On a client that cannot (claude.ai, Claude Desktop), the first call does nothing and returns a preview plus a `confirmToken`; only a repeat call with the same arguments and that token proceeds. A token works once, and is refused if anything it covers changed between the two calls (the file's title, the message body, the workspace's recipients).
+
+| variable | default | |
+|---|---|---|
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
+| `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
 
 ## Troubleshooting
 
@@ -188,7 +198,7 @@ Nothing else changes: existing sessions in `~/.honeybook-mcp/sessions.json` keep
 
 - Sessions are captured locally — auth tokens never leave your machine
 - `~/.honeybook-mcp/sessions.json` is written with mode 0600; directory with mode 0700
-- Write tools (`sign_contract`, `pay_invoice`) require `confirm:true` and return portal deep links rather than signing/paying headlessly
+- Write tools (`sign_contract`, `pay_invoice`, `send_message`) ask you to confirm first (see [Confirmations](#confirmations)); `sign_contract` and `pay_invoice` return portal deep links rather than signing/paying headlessly
 
 ## Development
 

package/dist/bundle.js

@@ -25547,7 +25547,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes3, createHash } = __require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash4 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -26085,7 +26085,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes3(16).toString("base64");
+      const key = randomBytes5(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -26215,7 +26215,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -26584,7 +26584,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash } = __require("crypto");
+    var { createHash: createHash4 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -26891,7 +26891,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -27011,6 +27011,33 @@ var storage2 = new AsyncLocalStorage2();
 function withCallerCapabilities(capabilities, fn) {
   return capabilities ? storage2.run(capabilities, fn) : fn();
 }
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
 
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
@@ -31409,6 +31436,37 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
@@ -41456,14 +41514,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -61427,6 +61485,11 @@ var MEDIA_QUALIFIER = "(?:primary|secondary|main|default|cover|hero|profile|mast
 var MEDIA_KEY = new RegExp(`^(?:(?:${MEDIA_QUALIFIER}|${MEDIA_NOUN})[_-]?)?${MEDIA_NOUN}s?(?:[_-]?(?:link|uri|url|src)s?)?$`, "i");
 
 // node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 function rawTextResult(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -61437,6 +61500,421 @@ function errorResult(message) {
   };
 }
 
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/server/canonical.js
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`confirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k, v]) => `[${canonicalJson(k)},${canonicalJson(v)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("confirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(escapeKey(k))}:${canonicalJson(v)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+var DEFAULT_REQUEST_KEY = "confirmation";
+var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var STATE_PREFIX = "mcpu.confirm.v1.";
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
+function requireConfirmation(ctx, options) {
+  const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
+  const confirmationSchema = external_exports.object({
+    confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
+  });
+  const ask = () => {
+    const preview = {
+      action: options.action,
+      ...options.details === void 0 ? {} : { details: options.details }
+    };
+    return inputRequired({
+      inputRequests: {
+        [requestKey]: inputRequired.elicit({
+          message: `${options.message}
+${JSON.stringify(preview, null, 2)}`,
+          requestedSchema: confirmationSchema
+        })
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
+    });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
+  }
+  if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
+    return void 0;
+  }
+  return textResult({
+    confirmed: false,
+    cancelled: true,
+    action: options.action,
+    note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
+  });
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-token.js
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+function createSpentTokenStore() {
+  const spent = /* @__PURE__ */ new Map();
+  return {
+    has: (nonce) => spent.has(nonce),
+    add: (nonce, exp) => {
+      spent.set(nonce, exp);
+    },
+    prune: (now) => {
+      for (const [nonce, exp] of spent)
+        if (exp < now)
+          spent.delete(nonce);
+    },
+    clear: () => spent.clear(),
+    get size() {
+      return spent.size;
+    }
+  };
+}
+var PROCESS_SPENT = createSpentTokenStore();
+var PREFIX = "mcpu.token.v1.";
+var DEFAULT_TTL_SECONDS = 600;
+function tokenKey(key) {
+  const bytes = typeof key === "string" ? Buffer.from(key, "utf8") : Buffer.from(key);
+  if (bytes.length < 32)
+    throw new RangeError("confirm token: key must be at least 32 bytes.");
+  return bytes;
+}
+function ttlOf(ttlSeconds) {
+  if (ttlSeconds === void 0)
+    return DEFAULT_TTL_SECONDS;
+  if (!(Number.isFinite(ttlSeconds) && ttlSeconds > 0)) {
+    throw new RangeError("confirm token: ttlSeconds must be a finite number greater than 0.");
+  }
+  return ttlSeconds;
+}
+function sign(key, body) {
+  return createHmac2("sha256", key).update(`${PREFIX}${body}`).digest();
+}
+function hashConfirmPayload(payload) {
+  return createHash2("sha256").update(canonicalJson(payload)).digest("base64url");
+}
+function issueConfirmToken(key, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const exp = now + ttlOf(options.ttlSeconds) * 1e3;
+  const claims = {
+    t: binding.tool,
+    ...binding.account === void 0 ? {} : { a: binding.account },
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}${body}.${sign(k, body).toString("base64url")}`, expiresAt: new Date(exp).toISOString() };
+}
+function parseClaims(body) {
+  try {
+    const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(key, token, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const spent = options.spent ?? PROCESS_SPENT;
+  spent.prune(now);
+  if (!token.startsWith(PREFIX))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const rest = token.slice(PREFIX.length);
+  const dot = rest.indexOf(".");
+  const body = dot < 0 ? "" : rest.slice(0, dot);
+  const mac3 = Buffer.from(dot < 0 ? "" : rest.slice(dot + 1), "base64url");
+  const expected = sign(k, body);
+  if (!body || mac3.length !== expected.length || !timingSafeEqual2(mac3, expected))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims)
+    return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent.has(claims.n))
+    return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp)
+    return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "revision-changed" };
+  if (claims.h !== binding.payloadHash)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent.add(claims.n, claims.exp);
+  return { ok: true };
+}
+var CONFIRM_TOKEN_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+var confirmTokenParam = external_exports.string().optional().describe(`ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`);
+var TOKEN_ERROR_NOTE = {
+  TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+  TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+  TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+};
+var CHANGED_NOTE = {
+  "revision-changed": "Nothing was sent or changed: the target was edited since the user approved it (its version rotated), so what would happen is not what they saw.",
+  "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+};
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(action, fb) {
+  const subject = await fb.subject();
+  if (isToolResult(subject))
+    return subject;
+  const binding = {
+    tool: fb.tool,
+    ...fb.account === void 0 ? {} : { account: fb.account },
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashConfirmPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(fb.key, binding, { ttlSeconds: fb.ttlSeconds });
+    return {
+      action,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: ttlOf(fb.ttlSeconds),
+      instruction: fb.instruction ?? CONFIRM_TOKEN_INSTRUCTION
+    };
+  };
+  if (!fb.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fb.key, fb.confirmToken, binding, { spent: fb.spent });
+  if (verdict.ok)
+    return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+async function requireConfirmationWithFallback(ctx, options) {
+  const { tokenFallback, ...confirmation } = options;
+  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+    return tokenConfirmation(options.action, tokenFallback);
+  }
+  return requireConfirmation(ctx, confirmation);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/config/index.js
+var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
+function readEnvVar(key, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = env[key];
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return opts.default;
+}
+var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+function parseBoolEnv(key, opts = {}) {
+  const fallback = opts.default ?? false;
+  const raw = readEnvVar(key, { env: opts.env });
+  if (raw === void 0)
+    return fallback;
+  const token = raw.toLowerCase();
+  if (TRUE_TOKENS.has(token))
+    return true;
+  if (FALSE_TOKENS.has(token))
+    return false;
+  return fallback;
+}
+async function loadDotenvSafely(opts = {}) {
+  try {
+    const mod = await import(
+      /* @vite-ignore */
+      "dotenv"
+    );
+    const result = mod.config({
+      ...opts.path !== void 0 ? { path: opts.path } : {},
+      override: opts.override ?? false,
+      quiet: true
+    });
+    return result.error === void 0;
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+var MODES = /* @__PURE__ */ new Set(["ask-user", "auto", "refuse"]);
+var DEFAULT_TTL_SECONDS2 = 600;
+var warned = /* @__PURE__ */ new Set();
+function readConfirmMode(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_MODE", { env })?.trim().toLowerCase();
+  if (!raw)
+    return "ask-user";
+  if (MODES.has(raw))
+    return raw;
+  if (!warned.has(raw)) {
+    warned.add(raw);
+    process.stderr.write(`MCP_CONFIRM_MODE="${raw}" is not one of ask-user, auto, refuse; treating it as refuse.
+`);
+  }
+  return "refuse";
+}
+function confirmTtlFromEnv(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
+  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+}
+var processKey;
+function confirmKeyFromEnv(env = process.env) {
+  const secret = readEnvVar("MCP_CONFIRM_SECRET", { env });
+  if (secret)
+    return createHash3("sha256").update(secret, "utf8").digest();
+  processKey ??= randomBytes2(32);
+  return processKey;
+}
+var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
+var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+function confirmationFromEnv(options) {
+  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const mode = readConfirmMode(env);
+  if (mode === "refuse") {
+    return {
+      ...confirmation,
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+    };
+  }
+  return {
+    ...confirmation,
+    tokenFallback: {
+      key: confirmKeyFromEnv(env),
+      tool,
+      ...account === void 0 ? {} : { account },
+      ...confirmToken === void 0 ? {} : { confirmToken },
+      subject,
+      ttlSeconds: confirmTtlFromEnv(env),
+      instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
+      ...spent === void 0 ? {} : { spent }
+    }
+  };
+}
+
 // node_modules/@chrischall/mcp-utils/dist/server/index.js
 var SERVER_PROTOCOL_VERSIONS = Object.freeze([
   "2026-07-28",
@@ -61612,50 +62090,6 @@ function runMcp(opts) {
   return handle;
 }
 
-// node_modules/@chrischall/mcp-utils/dist/config/index.js
-var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
-function readEnvVar(key, opts = {}) {
-  const env = opts.env ?? process.env;
-  const raw = env[key];
-  if (typeof raw === "string") {
-    const trimmed = raw.trim();
-    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
-    }
-  }
-  return opts.default;
-}
-var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
-var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
-function parseBoolEnv(key, opts = {}) {
-  const fallback = opts.default ?? false;
-  const raw = readEnvVar(key, { env: opts.env });
-  if (raw === void 0)
-    return fallback;
-  const token = raw.toLowerCase();
-  if (TRUE_TOKENS.has(token))
-    return true;
-  if (FALSE_TOKENS.has(token))
-    return false;
-  return fallback;
-}
-async function loadDotenvSafely(opts = {}) {
-  try {
-    const mod = await import(
-      /* @vite-ignore */
-      "dotenv"
-    );
-    const result = mod.config({
-      ...opts.path !== void 0 ? { path: opts.path } : {},
-      override: opts.override ?? false,
-      quiet: true
-    });
-    return result.error === void 0;
-  } catch {
-    return false;
-  }
-}
-
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
 function formatApiError(status, method, path, errorText, opts = {}) {
   const service = opts.service ?? "API";
@@ -63977,12 +64411,12 @@ async function awaitSessionReady(ready, opts) {
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
 import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { isAbsolute as isAbsolute2, join as join5 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink, link, lstat } from "node:fs/promises";
-import { randomBytes } from "node:crypto";
+import { randomBytes as randomBytes3 } from "node:crypto";
 import { isAbsolute, join as join4 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
@@ -64103,7 +64537,7 @@ var NO_HARD_LINKS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "
 async function publishIdentityIfAbsent(dir, serverName, id) {
   const path = identityFilePath(dir, serverName);
   await sweepStagingFiles(dir, serverName, { olderThanMs: 6e4 });
-  const tmp = `${path}.${randomBytes(STAGING_BYTES).toString("hex")}.tmp`;
+  const tmp = `${path}.${randomBytes3(STAGING_BYTES).toString("hex")}.tmp`;
   try {
     await writeFile(tmp, serializeIdentity(id), { mode: 384, flag: "wx" });
     await chmod(tmp, 384);
@@ -64232,7 +64666,7 @@ async function readExtensionPin(serverName, dir = defaultTrustDir()) {
 async function writeExtensionPin(serverName, pin, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   await mkdir2(dir, { recursive: true, mode: 448 });
-  const tmp = `${path}.${randomBytes2(6).toString("hex")}.tmp`;
+  const tmp = `${path}.${randomBytes4(6).toString("hex")}.tmp`;
   try {
     await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384, flag: "wx" });
     await chmod2(tmp, 384);
@@ -67812,7 +68246,7 @@ function bridgeErrorInfo(err) {
 // package.json
 var package_default = {
   name: "honeybook-mcp",
-  version: "1.1.4",
+  version: "1.2.0",
   mcpName: "io.github.chrischall/honeybook-mcp",
   description: "HoneyBook client-portal MCP server for Claude",
   author: "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -67856,7 +68290,7 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@fetchproxy/bootstrap": "^3.2.0",
     "@fetchproxy/server": "^3.2.0",
     "@modelcontextprotocol/server": "^2.0.0",
@@ -68737,7 +69171,7 @@ function registerPaymentMethodTools(server) {
 }
 
 // src/tools/contracts.ts
-async function signContract(args) {
+async function signContract(args, ctx) {
   const client = await getActiveClient(args.origin);
   const file2 = await client.request(
     "GET",
@@ -68751,12 +69185,28 @@ async function signContract(args) {
   if (file2.is_file_accepted) {
     throw new Error(`Contract ${args.file_id} ("${file2.file_title}") is already signed.`);
   }
-  if (!args.confirm) {
-    return rawTextResult(
-      `About to sign "${file2.file_title}" (${file2.status_name || "not signed"}).
-Re-run sign_contract with { confirm: true } to proceed.`
-    );
-  }
+  const preview = {
+    file_id: file2._id,
+    file_title: file2.file_title,
+    status: file2.status_name || "not signed"
+  };
+  const gate = await requireConfirmationWithFallback(
+    ctx,
+    confirmationFromEnv({
+      action: "contract.sign",
+      message: "Review and confirm signing this contract:",
+      details: preview,
+      tool: "sign_contract",
+      account: client.scope.portalOrigin,
+      confirmToken: args.confirmToken,
+      subject: () => ({
+        target: String(file2._id),
+        payload: { file_id: file2._id, file_title: file2.file_title },
+        preview
+      })
+    })
+  );
+  if (gate) return gate;
   vendorPortalSubdomain(client.scope.portalOrigin);
   const url4 = `${client.scope.portalOrigin}/app/workspace_file/${encodeURIComponent(String(file2._id))}/agreement`;
   return rawTextResult(
@@ -68773,15 +69223,13 @@ function registerContractTools(server) {
   server.registerTool(
     "sign_contract",
     {
-      description: "Sign a contract you received from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of signing headlessly. Requires confirm:true.",
+      description: "Sign a contract you received from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of signing headlessly. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).",
       inputSchema: external_exports.object({
         file_id: external_exports.string().describe("The agreement file _id from list_workspace_files (file_type=agreement)."),
         origin: schemaOrigin.describe(
           "Portal origin (e.g. https://<vendor>.hbportal.co). Optional when only one session is active."
         ),
-        confirm: schemaConfirm.describe(
-          "Must be true to proceed. Without this, tool returns a preview."
-        )
+        confirmToken: confirmTokenParam
       }),
       annotations: { destructiveHint: true }
     },
@@ -68790,7 +69238,7 @@ function registerContractTools(server) {
 }
 
 // src/tools/invoices.ts
-async function payInvoice(args) {
+async function payInvoice(args, ctx) {
   const client = await getActiveClient(args.origin);
   const file2 = await client.request("GET", apiPath`/api/v2/workspace_files/${args.file_id}`);
   if (file2.file_type !== "invoice") {
@@ -68798,12 +69246,29 @@ async function payInvoice(args) {
       `File ${args.file_id} is not an invoice (file_type=${file2.file_type}). Only invoices can be paid.`
     );
   }
-  if (!args.confirm) {
-    return rawTextResult(
-      `About to pay "${file2.file_title}" (${file2.status_name || "open"}).
-Re-run pay_invoice with { confirm: true } to proceed.`
-    );
-  }
+  const preview = {
+    file_id: file2._id,
+    file_title: file2.file_title,
+    status: file2.status_name || "open",
+    has_pending_payment: Boolean(file2.has_pending_payment)
+  };
+  const gate = await requireConfirmationWithFallback(
+    ctx,
+    confirmationFromEnv({
+      action: "invoice.pay",
+      message: "Review and confirm paying this invoice:",
+      details: preview,
+      tool: "pay_invoice",
+      account: client.scope.portalOrigin,
+      confirmToken: args.confirmToken,
+      subject: () => ({
+        target: String(file2._id),
+        payload: { file_id: file2._id, file_title: file2.file_title, has_pending_payment: preview.has_pending_payment },
+        preview
+      })
+    })
+  );
+  if (gate) return gate;
   vendorPortalSubdomain(client.scope.portalOrigin);
   const url4 = `${client.scope.portalOrigin}/app/workspace_file/${encodeURIComponent(String(file2._id))}/invoice`;
   const pendingNote = file2.has_pending_payment ? "\n\nNote: this invoice already has a pending payment \u2014 check the status before re-paying." : "";
@@ -68819,15 +69284,13 @@ function registerInvoiceTools(server) {
   server.registerTool(
     "pay_invoice",
     {
-      description: "Pay an invoice from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of paying headlessly. Requires confirm:true.",
+      description: "Pay an invoice from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of paying headlessly. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).",
       inputSchema: external_exports.object({
         file_id: external_exports.string().describe("The invoice file _id from list_workspace_files (file_type=invoice)."),
         origin: schemaOrigin.describe(
           "Portal origin (e.g. https://<vendor>.hbportal.co). Optional when only one session is active."
         ),
-        confirm: schemaConfirm.describe(
-          "Must be true to proceed. Without this, tool returns a preview."
-        )
+        confirmToken: confirmTokenParam
       }),
       annotations: { destructiveHint: true }
     },
@@ -69298,7 +69761,7 @@ function bodyToHtml(body) {
   if (HTML_TAG.test(body)) return body;
   return body.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\r?\n/g, "<br>");
 }
-async function sendMessage(args) {
+async function sendMessage(args, ctx) {
   const client = await getActiveClient(args.origin);
   const meId = client.scope.userId;
   const feed = await fetchWorkspaceFeed(client, args.workspace_id);
@@ -69321,18 +69784,7 @@ async function sendMessage(args) {
   }
   if (!args.body.trim()) throw new Error("The message body is empty.");
   const recipients = Object.values(feed.users).filter((u) => u._id !== meId);
-  const recipientLine = recipients.map((u) => `${u.name}${u.email ? ` <${u.email}>` : ""}`).join(", ");
-  if (!args.confirm) {
-    return rawTextResult(
-      `About to send a message in workspace ${args.workspace_id} via the HoneyBook portal.
-To: ${recipientLine || "(everyone in the workspace)"}
-Subject: ${subject}${replyTo ? ` (reply to "${String(replyTo._id)}")` : ""}
-
-${args.body}
-
-Re-run send_message with { confirm: true } to send it.`
-    );
-  }
+  const to = recipients.map((u) => `${u.name}${u.email ? ` <${u.email}>` : ""}`);
   const taskData = {
     ws_id: args.workspace_id,
     subject,
@@ -69343,6 +69795,33 @@ Re-run send_message with { confirm: true } to send it.`
     flow_attachments: []
   };
   if (replyTo) taskData.feed_to_reply_id = replyTo._id;
+  const preview = {
+    workspace_id: args.workspace_id,
+    via: "HoneyBook portal",
+    to: to.length ? to : ["(everyone in the workspace)"],
+    subject,
+    reply_to: replyTo ? replyTo._id : null,
+    body: args.body
+  };
+  const gate = await requireConfirmationWithFallback(
+    ctx,
+    confirmationFromEnv({
+      action: "message.send",
+      message: "Review and confirm sending this message:",
+      details: preview,
+      tool: "send_message",
+      account: client.scope.portalOrigin,
+      confirmToken: args.confirmToken,
+      subject: () => ({
+        target: args.workspace_id,
+        // What goes out, and who HoneyBook emails it to: a membership change
+        // between the two calls changes the recipients, so it must be re-approved.
+        payload: { task: taskData, recipients: recipients.map((u) => u._id) },
+        preview
+      })
+    })
+  );
+  if (gate) return gate;
   let outcome;
   try {
     outcome = await runClientPendingTask(client, "send_workspace_message", taskData);
@@ -69417,16 +69896,14 @@ function registerMessageTools(server) {
   server.registerTool(
     "send_message",
     {
-      description: 'Send a message to the vendor (and the other members of the workspace) through the HoneyBook portal, exactly as the Activity tab composer does. HoneyBook emails it to every recipient. Pass reply_to_message_id to reply in-thread (the subject is inherited). Requires confirm:true. If HoneyBook has not finished sending within about a minute the result has status "pending" and a task_id: the message may still be delivered, so check list_messages before resending.',
+      description: 'Send a message to the vendor (and the other members of the workspace) through the HoneyBook portal, exactly as the Activity tab composer does. HoneyBook emails it to every recipient. Pass reply_to_message_id to reply in-thread (the subject is inherited). Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE). If HoneyBook has not finished sending within about a minute the result has status "pending" and a task_id: the message may still be delivered, so check list_messages before resending.',
       inputSchema: external_exports.object({
         workspace_id: external_exports.string().describe(WORKSPACE_DESC),
         body: external_exports.string().describe("Message text. Plain text is sent as-is (line breaks preserved); HTML is passed through."),
         subject: external_exports.string().optional().describe("Required for a new message; optional on a reply."),
         reply_to_message_id: external_exports.string().optional().describe("A message _id from list_messages to reply to."),
         origin: schemaOrigin.describe(ORIGIN_DESC),
-        confirm: schemaConfirm.describe(
-          "Must be true to actually send. Without it the tool returns a preview of what would go out."
-        )
+        confirmToken: confirmTokenParam
       }),
       annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false }
     },
@@ -69675,7 +70152,7 @@ var __dirname = dirname2(fileURLToPath(import.meta.url));
 await loadDotenvSafely({ path: join6(__dirname, "..", ".env"), override: false });
 await runMcp({
   name: "honeybook-mcp",
-  version: "1.1.4",
+  version: "1.2.0",
   // x-release-please-version
   tools: [
     registerSessionTools,

package/dist/index.js

@@ -20,7 +20,7 @@ import { registerAttachmentTools } from './tools/attachments.js';
 import { registerPaymentTools } from './tools/payments.js';
 await runMcp({
     name: 'honeybook-mcp',
-    version: '1.1.4', // x-release-please-version
+    version: '1.2.0', // x-release-please-version
     tools: [
         registerSessionTools,
         registerFlowTools,

package/dist/tools/contracts.js

@@ -1,8 +1,8 @@
 import { z } from 'zod';
-import { rawTextResult, schemaOrigin, schemaConfirm } from '@chrischall/mcp-utils';
+import { confirmationFromEnv, confirmTokenParam, rawTextResult, requireConfirmationWithFallback, schemaOrigin, } from '@chrischall/mcp-utils';
 import { apiPath, getActiveClient } from '../client.js';
 import { vendorPortalSubdomain } from '../sessions.js';
-export async function signContract(args) {
+export async function signContract(args, ctx) {
     const client = await getActiveClient(args.origin);
     const file = await client.request('GET', apiPath `/api/v2/workspace_files/${args.file_id}`);
     if (file.file_type !== 'agreement') {
@@ -11,10 +11,26 @@ export async function signContract(args) {
     if (file.is_file_accepted) {
         throw new Error(`Contract ${args.file_id} ("${file.file_title}") is already signed.`);
     }
-    if (!args.confirm) {
-        return rawTextResult(`About to sign "${file.file_title}" (${file.status_name || 'not signed'}).\n` +
-            `Re-run sign_contract with { confirm: true } to proceed.`);
-    }
+    const preview = {
+        file_id: file._id,
+        file_title: file.file_title,
+        status: file.status_name || 'not signed',
+    };
+    const gate = await requireConfirmationWithFallback(ctx, confirmationFromEnv({
+        action: 'contract.sign',
+        message: 'Review and confirm signing this contract:',
+        details: preview,
+        tool: 'sign_contract',
+        account: client.scope.portalOrigin,
+        confirmToken: args.confirmToken,
+        subject: () => ({
+            target: String(file._id),
+            payload: { file_id: file._id, file_title: file.file_title },
+            preview,
+        }),
+    }));
+    if (gate)
+        return gate;
     // Re-checked here, not only at capture: a sessions.json written before the
     // host rule existed can still hold a foreign origin (fleet-audit#139).
     vendorPortalSubdomain(client.scope.portalOrigin);
@@ -25,13 +41,14 @@ export async function signContract(args) {
 }
 export function registerContractTools(server) {
     server.registerTool('sign_contract', {
-        description: 'Sign a contract you received from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of signing headlessly. Requires confirm:true.',
+        description: 'Sign a contract you received from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of signing headlessly. ' +
+            'Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).',
         inputSchema: z.object({
             file_id: z
                 .string()
                 .describe('The agreement file _id from list_workspace_files (file_type=agreement).'),
             origin: schemaOrigin.describe('Portal origin (e.g. https://<vendor>.hbportal.co). Optional when only one session is active.'),
-            confirm: schemaConfirm.describe('Must be true to proceed. Without this, tool returns a preview.'),
+            confirmToken: confirmTokenParam,
         }),
         annotations: { destructiveHint: true },
     }, signContract);

package/dist/tools/invoices.js

@@ -1,17 +1,34 @@
 import { z } from 'zod';
-import { rawTextResult, schemaOrigin, schemaConfirm } from '@chrischall/mcp-utils';
+import { confirmationFromEnv, confirmTokenParam, rawTextResult, requireConfirmationWithFallback, schemaOrigin, } from '@chrischall/mcp-utils';
 import { apiPath, getActiveClient } from '../client.js';
 import { vendorPortalSubdomain } from '../sessions.js';
-export async function payInvoice(args) {
+export async function payInvoice(args, ctx) {
     const client = await getActiveClient(args.origin);
     const file = await client.request('GET', apiPath `/api/v2/workspace_files/${args.file_id}`);
     if (file.file_type !== 'invoice') {
         throw new Error(`File ${args.file_id} is not an invoice (file_type=${file.file_type}). Only invoices can be paid.`);
     }
-    if (!args.confirm) {
-        return rawTextResult(`About to pay "${file.file_title}" (${file.status_name || 'open'}).\n` +
-            `Re-run pay_invoice with { confirm: true } to proceed.`);
-    }
+    const preview = {
+        file_id: file._id,
+        file_title: file.file_title,
+        status: file.status_name || 'open',
+        has_pending_payment: Boolean(file.has_pending_payment),
+    };
+    const gate = await requireConfirmationWithFallback(ctx, confirmationFromEnv({
+        action: 'invoice.pay',
+        message: 'Review and confirm paying this invoice:',
+        details: preview,
+        tool: 'pay_invoice',
+        account: client.scope.portalOrigin,
+        confirmToken: args.confirmToken,
+        subject: () => ({
+            target: String(file._id),
+            payload: { file_id: file._id, file_title: file.file_title, has_pending_payment: preview.has_pending_payment },
+            preview,
+        }),
+    }));
+    if (gate)
+        return gate;
     // Re-checked here, not only at capture: a sessions.json written before the
     // host rule existed can still hold a foreign origin (fleet-audit#139).
     vendorPortalSubdomain(client.scope.portalOrigin);
@@ -24,13 +41,14 @@ export async function payInvoice(args) {
 }
 export function registerInvoiceTools(server) {
     server.registerTool('pay_invoice', {
-        description: 'Pay an invoice from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of paying headlessly. Requires confirm:true.',
+        description: 'Pay an invoice from a vendor. In v1 this returns a deep link to the HoneyBook portal instead of paying headlessly. ' +
+            'Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).',
         inputSchema: z.object({
             file_id: z
                 .string()
                 .describe('The invoice file _id from list_workspace_files (file_type=invoice).'),
             origin: schemaOrigin.describe('Portal origin (e.g. https://<vendor>.hbportal.co). Optional when only one session is active.'),
-            confirm: schemaConfirm.describe('Must be true to proceed. Without this, tool returns a preview.'),
+            confirmToken: confirmTokenParam,
         }),
         annotations: { destructiveHint: true },
     }, payInvoice);

package/dist/tools/messages.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { minifiedResult, rawTextResult, schemaConfirm, schemaOrigin } from '@chrischall/mcp-utils';
+import { confirmationFromEnv, confirmTokenParam, minifiedResult, requireConfirmationWithFallback, schemaOrigin, } from '@chrischall/mcp-utils';
 import { apiPath, getActiveClient } from '../client.js';
 import { fetchWorkspaceFeed, isMessageItem, itemDate, summarizeMessage, summarizeActivity, expandMessage, } from '../feed.js';
 import { runClientPendingTask, isPendingTaskTimeoutError } from '../pending-tasks.js';
@@ -79,7 +79,7 @@ export function bodyToHtml(body) {
         .replace(/>/g, '>')
         .replace(/\r?\n/g, '<br>');
 }
-export async function sendMessage(args) {
+export async function sendMessage(args, ctx) {
     const client = await getActiveClient(args.origin);
     const meId = client.scope.userId;
     const feed = await fetchWorkspaceFeed(client, args.workspace_id);
@@ -101,14 +101,7 @@ export async function sendMessage(args) {
     if (!args.body.trim())
         throw new Error('The message body is empty.');
     const recipients = Object.values(feed.users).filter((u) => u._id !== meId);
-    const recipientLine = recipients.map((u) => `${u.name}${u.email ? ` <${u.email}>` : ''}`).join(', ');
-    if (!args.confirm) {
-        return rawTextResult(`About to send a message in workspace ${args.workspace_id} via the HoneyBook portal.\n` +
-            `To: ${recipientLine || '(everyone in the workspace)'}\n` +
-            `Subject: ${subject}${replyTo ? ` (reply to "${String(replyTo._id)}")` : ''}\n\n` +
-            `${args.body}\n\n` +
-            `Re-run send_message with { confirm: true } to send it.`);
-    }
+    const to = recipients.map((u) => `${u.name}${u.email ? ` <${u.email}>` : ''}`);
     const taskData = {
         ws_id: args.workspace_id,
         subject,
@@ -120,6 +113,31 @@ export async function sendMessage(args) {
     };
     if (replyTo)
         taskData.feed_to_reply_id = replyTo._id;
+    const preview = {
+        workspace_id: args.workspace_id,
+        via: 'HoneyBook portal',
+        to: to.length ? to : ['(everyone in the workspace)'],
+        subject,
+        reply_to: replyTo ? replyTo._id : null,
+        body: args.body,
+    };
+    const gate = await requireConfirmationWithFallback(ctx, confirmationFromEnv({
+        action: 'message.send',
+        message: 'Review and confirm sending this message:',
+        details: preview,
+        tool: 'send_message',
+        account: client.scope.portalOrigin,
+        confirmToken: args.confirmToken,
+        subject: () => ({
+            target: args.workspace_id,
+            // What goes out, and who HoneyBook emails it to: a membership change
+            // between the two calls changes the recipients, so it must be re-approved.
+            payload: { task: taskData, recipients: recipients.map((u) => u._id) },
+            preview,
+        }),
+    }));
+    if (gate)
+        return gate;
     let outcome;
     try {
         outcome = await runClientPendingTask(client, 'send_workspace_message', taskData);
@@ -196,7 +214,8 @@ export function registerMessageTools(server) {
     server.registerTool('send_message', {
         description: 'Send a message to the vendor (and the other members of the workspace) through the HoneyBook portal, ' +
             'exactly as the Activity tab composer does. HoneyBook emails it to every recipient. ' +
-            'Pass reply_to_message_id to reply in-thread (the subject is inherited). Requires confirm:true. ' +
+            'Pass reply_to_message_id to reply in-thread (the subject is inherited). ' +
+            'Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE). ' +
             'If HoneyBook has not finished sending within about a minute the result has status "pending" and a ' +
             'task_id: the message may still be delivered, so check list_messages before resending.',
         inputSchema: z.object({
@@ -210,7 +229,7 @@ export function registerMessageTools(server) {
                 .optional()
                 .describe('A message _id from list_messages to reply to.'),
             origin: schemaOrigin.describe(ORIGIN_DESC),
-            confirm: schemaConfirm.describe('Must be true to actually send. Without it the tool returns a preview of what would go out.'),
+            confirmToken: confirmTokenParam,
         }),
         annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false },
     }, sendMessage);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeybook-mcp",
-  "version": "1.1.4",
+  "version": "1.2.0",
   "mcpName": "io.github.chrischall/honeybook-mcp",
   "description": "HoneyBook client-portal MCP server for Claude",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -44,7 +44,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@fetchproxy/bootstrap": "^3.2.0",
     "@fetchproxy/server": "^3.2.0",
     "@modelcontextprotocol/server": "^2.0.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/honeybook-mcp",
     "source": "github"
   },
-  "version": "1.1.4",
+  "version": "1.2.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "honeybook-mcp",
-      "version": "1.1.4",
+      "version": "1.2.0",
       "transport": {
         "type": "stdio"
       },

package/skills/honeybook/SKILL.md

@@ -17,13 +17,13 @@ MCP server for HoneyBook's client portal — contracts, invoices, questionnaires
 - `get_workspace_file(file_id, section?)` — Full detail for one file. Takes `section`, **not** `view` — see below
 - `get_workspace` — Workspace detail + status flags
 - `list_payment_methods` — Saved payment methods
-- `sign_contract` — Deep link to sign in portal (requires `confirm:true`)
-- `pay_invoice` — Deep link to pay in portal (requires `confirm:true`)
+- `sign_contract` — Deep link to sign in portal (asks the user to confirm first)
+- `pay_invoice` — Deep link to pay in portal (asks the user to confirm first)
 - `list_projects` — Your projects (HoneyBook "events") with a vendor, each with the `workspace_id` the tools below take
 - `get_project(project_id, view?)` — Project details: date, time, location, guests, custom fields, people (name/email/phone/role)
 - `list_messages` — Messages in a workspace (`kind=activity` for the activity log, `kind=all` for both): compact cards, newest first; never marks anything seen
 - `get_message` — One message in full (`format=text` default, or `html`) with attachments and delivery status
-- `send_message` — Send a new message (`subject` + `body`) or reply (`reply_to_message_id`, subject inherited) through the portal; requires `confirm:true`
+- `send_message` — Send a new message (`subject` + `body`) or reply (`reply_to_message_id`, subject inherited) through the portal; asks the user to confirm first
 - `mark_messages_seen` — Mark feed items seen, the way opening the Activity tab does
 - `list_meetings` — Meetings the vendor scheduled (consultations, Zoom calls): time, join link, password; rescheduled meetings show their latest time
 - `list_tasks` — Tasks assigned to you with today/this-week/overdue counts and task groups
@@ -96,10 +96,10 @@ shape legible.
 - **"Fill in / read the vendor's questionnaire"** → user pastes the `/flow/<id>?hash=…` link → `use_flow_link` → `get_flow`
 - **"What contracts haven't I signed?"** → `list_workspace_files` with `file_type=agreement`, filter by `is_file_accepted=false`
 - **"Summarize my HB status with Silk Veil"** → `get_workspace` (status flags) + `list_workspace_files`
-- **"Send me a link to sign the photographer's contract"** → `list_workspace_files` → `sign_contract` with `confirm:true`
+- **"Send me a link to sign the photographer's contract"** → `list_workspace_files` → `sign_contract` (confirm when prompted)
 - **"Which invoices are overdue?"** → `list_workspace_files` with `file_type=invoice`, sort by due date
 - **"What did the planner send me?" / "Read me the latest checklist"** → `list_projects` → `list_messages` → `get_message`
-- **"Reply to Ivy and ask about the rehearsal"** → `list_messages` (find the message) → `send_message` with `reply_to_message_id` and no `confirm` (preview) → re-run with `confirm:true`
+- **"Reply to Ivy and ask about the rehearsal"** → `list_messages` (find the message) → `send_message` with `reply_to_message_id` → show the user the preview → once they approve, re-run with the same arguments plus the returned `confirmToken` (on a client that shows a confirmation prompt, the prompt replaces these two steps)
 - **"When is my next Zoom with the planner?"** → `list_meetings`; the join link and password are in the row
 - **"What have I paid and what's left?"** → `list_payments` (`totals.paid` / `totals.unpaid`); to pay one, `pay_invoice`
 - **"Do I have anything to do?"** → `list_tasks` (`counts.overdue`, `counts.today`)
@@ -112,5 +112,5 @@ shape legible.
 - The flow storage key contains the flow id, so the fetchproxy extension asks to re-approve the scope once per new questionnaire
 - Write tools (`sign_contract`, `pay_invoice`) return deep links in v2
 - Session expires → re-run `use_magic_link` with a fresh URL from the vendor's email
-- `send_message` goes out as a real HoneyBook email to everyone in the workspace (the vendor and any co-clients). Always show the preview (no `confirm`) before sending
+- `send_message` goes out as a real HoneyBook email to everyone in the workspace (the vendor and any co-clients). Always show the user the preview and get their explicit approval before passing the `confirmToken` back — never reuse or invent a token
 - `list_messages` / `get_message` read the same feed the Activity tab renders and do not mark items seen; `unseen_count` counts messages from other people you have not opened