honeybook-mcp 1.2.1 → 1.2.2

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "HoneyBook client-portal tools for Claude Code",
-    "version": "1.2.1"
+    "version": "1.2.2"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "HoneyBook",
       "source": "./",
       "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
-      "version": "1.2.1",
+      "version": "1.2.2",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "honeybook",
   "displayName": "HoneyBook",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
   "author": {
     "name": "Chris Chall",

package/README.md

@@ -28,13 +28,13 @@ Ask Claude things like:
 - [Claude Desktop](https://claude.ai/download) or [Claude Code](https://docs.anthropic.com/en/docs/claude-code)
 - [Node.js](https://nodejs.org) 22 or later
 - Magic-link emails from the wedding vendors that use HoneyBook
-- [fetchproxy 0.3.0 browser extension](https://github.com/chrischall/fetchproxy) — installed in Chrome (Web Store) or Safari (.dmg). Used by `use_magic_link` to snapshot the session out of your signed-in vendor portal tab.
+- [ContextMint Bridge](https://github.com/nullnet-app/contextmint-bridge/releases) browser extension — in Chrome, download the chrome zip from the releases page and load it unpacked (`chrome://extensions` → Developer mode → Load unpacked). Safari isn't available yet (it will ship inside the ContextMint app, which has no public download), so use Chrome for now. Used by `use_magic_link` to snapshot the session out of your signed-in vendor portal tab.
 
 ## Acknowledgement of Terms
 
 By using this MCP server, you acknowledge and agree to the following:
 
-**1. This server accesses your own HoneyBook workspace.** Every request is dispatched through your own signed-in browser session via the fetchproxy extension. It does not — and cannot — access anyone else's workspace.
+**1. This server accesses your own HoneyBook workspace.** Every request is dispatched through your own signed-in browser session via the ContextMint Bridge extension. It does not — and cannot — access anyone else's workspace.
 
 **2. [HoneyBook's Terms of Service](https://www.honeybook.com/legal/terms-of-service) govern your use of this server**, just as they govern your direct use of honeybook.com. The clauses most relevant here:
 
@@ -80,17 +80,18 @@ No environment variables are required. The optional ones below tune how writes a
 
 ## Sessions
 
-HoneyBook has no public client-portal API. This MCP reuses the same auth state your browser has after clicking a vendor's magic link, via the [fetchproxy 0.3.0 browser extension](https://github.com/chrischall/fetchproxy).
+HoneyBook has no public client-portal API. This MCP reuses the same auth state your browser has after clicking a vendor's magic link, via the [ContextMint Bridge](https://github.com/nullnet-app/contextmint-bridge/releases) browser extension.
 
 **One-time setup:**
 
-1. Install the fetchproxy 0.3.0 extension in Chrome (Web Store) or Safari (.dmg).
+1. Install ContextMint Bridge from its [releases page](https://github.com/nullnet-app/contextmint-bridge/releases): in Chrome, load the chrome zip unpacked. Safari isn't available yet (it will ship inside the ContextMint app, which has no public download) — use Chrome for now.
+   ContextMint Bridge is the fetchproxy browser extension under its new name, from the same maintainer — fetchproxy's own README ([fetchproxy#extension](https://github.com/chrischall/fetchproxy#extension)) points to it. Its source is public at [nullnet-app/contextmint-bridge](https://github.com/nullnet-app/contextmint-bridge): build it yourself, or check a release zip against the `.sha256` file published beside it (`shasum -a 256 -c contextmint-bridge-chrome-<version>.zip.sha256`).
 2. Click each vendor's magic link in your normal browser. That signs you into their `*.hbportal.co` portal.
 
 **Per-vendor activation:**
 
 1. Make sure the vendor's portal tab is open (the magic link from their email).
-2. In Claude, call `use_magic_link` with the magic-link URL — the tool asks the fetchproxy extension to snapshot the auth fields out of the page's `localStorage["HONEYBOOK_REACT_CURR_USER"]`, then closes the bridge. The tab only has to be open and signed in; nothing is read off a live request. No headless browser is spawned.
+2. In Claude, call `use_magic_link` with the magic-link URL — the tool asks the ContextMint Bridge extension to snapshot the auth fields out of the page's `localStorage["HONEYBOOK_REACT_CURR_USER"]`, then closes the bridge. The tab only has to be open and signed in; nothing is read off a live request. No headless browser is spawned.
 3. All other tools use the most-recently-activated session by default. Pass `origin` explicitly when multiple vendors are active.
 
 Sessions are stored in memory and persisted to `~/.honeybook-mcp/sessions.json` (mode 0600) so they survive MCP restarts. Re-run `use_magic_link` when a session expires.
@@ -172,9 +173,10 @@ Until you confirm it only previews the recipients, subject and body — see [Con
 - **"no auth hash for flow …"** — the link you passed had lost its `?hash=` parameter (the page rewrites the URL after it loads). Re-copy the original link out of the vendor email.
 - **"HoneyBook error 400 … NOT an auth failure"** on `get_flow` — a required input was missing, not your credential. Usually a pinned `HONEYBOOK_API_VERSION` that has gone stale: unset it so the live value is read from `/api/gon`. Re-running `use_flow_link` will not help.
 - **"no context id for flow …"** — HoneyBook's public `/minimal` route did not return the vendor company id the questionnaire read needs. Also not a credential problem.
-- **"fetchproxy capture failed"** — install the [fetchproxy 0.3.0 extension](https://github.com/chrischall/fetchproxy), then open the vendor's magic link in that browser.
+- **"fetchproxy capture failed"** — install [ContextMint Bridge](https://github.com/nullnet-app/contextmint-bridge/releases), then open the vendor's magic link in that browser.
 - **"fetchproxy capture timed out"** — the extension found no signed-in portal tab to read. Open the vendor's magic link, confirm the portal page has loaded, then retry.
-- **"no confirmed browser session"** — the extension is connected but has not approved this MCP. Open the Transporter popup and approve the pair code it shows, then retry.
+- **"no confirmed browser session"** — the extension is connected but has not approved this MCP. Open the ContextMint Bridge popup and approve the pair code it shows, then retry.
+- **"this browser … cannot serve the … capability"** — the browser you paired lacks an API the capture needs. Nothing is wrong with the MCP or your pairing, and retrying or re-approving will not help: run it from a browser that provides the API (for example Chrome).
 - **"localStorage keys not in declared set"** — the MCP now reads a storage key your existing pairing doesn't cover. See [Upgrading from 0.4.4 or earlier](#upgrading-from-044-or-earlier). Retrying will not help, and this is not a version problem.
 
 ## Upgrading from 0.4.4 or earlier
@@ -187,7 +189,7 @@ localStorage keys not in declared set: HONEYBOOK_REACT_CURR_USER
 
 To fix it, once:
 
-1. Open the **Transporter** extension popup.
+1. Open the **ContextMint Bridge** extension popup.
 2. **Revoke** `honeybook-mcp`.
 3. Re-run `use_magic_link` — a fresh pair code appears.
 4. Approve it in the popup. You are approving the new scope.

package/dist/auth.js

@@ -19,7 +19,7 @@
 //
 //   2. fetchproxy bootstrap (this module).
 //      The user has signed into their vendor portal via a magic link in
-//      their real Chrome (the fetchproxy 0.3.0 extension is installed).
+//      their real Chrome (the ContextMint Bridge extension is installed).
 //      We call `@fetchproxy/bootstrap` once to read the auth fields out
 //      of localStorage["HONEYBOOK_REACT_CURR_USER"], then close the
 //      bridge and operate from Node thereafter.
@@ -66,6 +66,7 @@
 import { bootstrap } from '@fetchproxy/bootstrap';
 import { bridgeErrorInfo } from '@chrischall/mcp-utils/fetchproxy';
 import { parseBoolEnv } from '@chrischall/mcp-utils';
+import { isBrowserCapabilityGap } from './bridge-errors.js';
 import pkg from '../package.json' with { type: 'json' };
 import { sessionStore, normalizeOrigin, vendorPortalSubdomain } from './sessions.js';
 /** True if the user has explicitly disabled the fetchproxy capture path. */
@@ -77,7 +78,7 @@ function fetchproxyDisabled() {
  * browser tab via `@fetchproxy/bootstrap`. Persists the result through
  * `sessionStore` and returns it.
  *
- * Preconditions: the user has the fetchproxy 0.3.0 Chrome / Safari
+ * Preconditions: the user has the ContextMint Bridge Chrome
  * extension installed and is signed into the vendor's HoneyBook portal
  * (typically by clicking the magic link in their vendor email). If
  * either is missing, this throws with an actionable error message.
@@ -174,9 +175,18 @@ export async function captureSessionViaFetchproxy(opts) {
         // SW eviction retry exhausted — surface library's typed `.hint` instead of the generic "open magic link" message.
         const bridgeError = bridgeErrorInfo(e);
         if (bridgeError.type === 'bridge_down') {
-            throw new Error(`HoneyBook auth: fetchproxy bridge is down (extension service worker unreachable after retry). ${bridgeError.hint ?? ''}`.trimEnd());
+            throw new Error(`HoneyBook auth: ContextMint Bridge is down (its service worker was unreachable after retry). ${bridgeError.hint ?? ''}`.trimEnd());
         }
         const msg = e instanceof Error ? e.message : String(e);
+        // The paired browser lacks a capability we declared; the message carries the remedy.
+        if (bridgeError.type === 'capability_unavailable' || isBrowserCapabilityGap(e)) {
+            throw new Error(`HoneyBook auth: ${msg}`);
+        }
+        // We asked for a capability we never declared — our bug, not the user's
+        // browser or pairing, so retrying the link would not help.
+        if (bridgeError.type === 'capability_denied') {
+            throw new Error(`HoneyBook auth: ${bridgeError.hint} (${bridgeError.message})`);
+        }
         // The extension gates on the scope approved at pair time, so widening the
         // declaration — as the HONEYBOOK_REACT_CURR_USER migration did — is refused
         // until the user re-approves. Every user paired before that upgrade hits
@@ -198,11 +208,11 @@ export async function captureSessionViaFetchproxy(opts) {
         if (bridgeError.type === 'timeout' || /timeout/i.test(msg)) {
             throw new Error('HoneyBook auth: fetchproxy capture timed out. The extension never returned the vendor ' +
                 "portal's stored session, which usually means no tab is open and signed in on that portal. " +
-                'Open the vendor magic-link URL in Chrome (with the fetchproxy extension installed), confirm ' +
+                'Open the vendor magic-link URL in Chrome (with the ContextMint Bridge extension installed), confirm ' +
                 'the portal page has loaded, then re-run use_magic_link.');
         }
         throw new Error(`HoneyBook auth: fetchproxy capture failed: ${msg} — ` +
-            'open the vendor magic-link URL in Chrome (with the fetchproxy 0.3.0 extension installed), ' +
+            'open the vendor magic-link URL in Chrome (with the ContextMint Bridge extension installed), ' +
             'then retry.');
     }
     // 0.4.0: pointer extractions land in `session.localStorage` keyed by

package/dist/bridge-errors.js

@@ -0,0 +1,16 @@
+// fetchproxy 3.3+ distinguishes "this browser cannot serve a capability"
+// (e.g. Safari lacking a WebExtension API) from a scope/pairing problem. That
+// is the browser's limitation — not the MCP's fault, and not fixed by
+// re-approving or retrying — so callers surface the library's own message
+// verbatim instead of appending their generic "open the link, then retry".
+//
+// Matched on the class NAME rather than `instanceof` so a duplicated
+// @fetchproxy/server copy in the dependency tree cannot defeat the check.
+export function isBrowserCapabilityGap(e) {
+    const err = e;
+    if (err?.name === 'FetchproxyCapabilityUnavailableError')
+        return true;
+    return (err?.name === 'FetchproxyHelloRejectedError' &&
+        Array.isArray(err.unavailableCapabilities) &&
+        err.unavailableCapabilities.length > 0);
+}