honeybook-mcp 1.2.6 → 1.2.7

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "HoneyBook client-portal tools for Claude Code",
-    "version": "1.2.6"
+    "version": "1.2.7"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "HoneyBook",
       "source": "./",
       "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
-      "version": "1.2.6",
+      "version": "1.2.7",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "honeybook",
   "displayName": "HoneyBook",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "description": "HoneyBook client-portal MCP for Claude — view wedding-vendor contracts and invoices via MCP",
   "author": {
     "name": "Chris Chall",

package/.mcp.json

@@ -1,8 +1,8 @@
 {
   "mcpServers": {
     "honeybook": {
-      "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/bundle.js"]
+      "command": "npx",
+      "args": ["-y", "honeybook-mcp"]
     }
   }
 }

package/dist/bundle.js

@@ -90,6 +90,7 @@ var require_util = __commonJS({
     exports.explicitlyAborted = explicitlyAborted2;
     exports.prefixIssues = prefixIssues2;
     exports.unwrapMessage = unwrapMessage2;
+    exports.sizeCaps = sizeCaps2;
     exports.attachSchema = attachSchema2;
     exports.finalizeIssue = finalizeIssue2;
     exports.getSizableOrigin = getSizableOrigin2;
@@ -624,6 +625,18 @@ var require_util = __commonJS({
     function unwrapMessage2(message) {
       return typeof message === "string" ? message : message?.message;
     }
+    function sizeCaps2(defChecks) {
+      const caps = [];
+      for (const ch of defChecks ?? []) {
+        const d = ch._zod.def;
+        if (!/_(length|size)$|_equals$/.test(d.check))
+          break;
+        const max = d.maximum ?? d.length ?? d.size;
+        if (max >= 0)
+          caps.push([max, ch]);
+      }
+      return caps;
+    }
     function attachSchema2(issues, start, inst) {
       var _a3;
       for (let i = start; i < issues.length; i++) {
@@ -2288,7 +2301,7 @@ var require_versions = __commonJS({
     exports.version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 7
     };
     (function() {
       var keys = Object.getOwnPropertyNames(exports);
@@ -3122,6 +3135,31 @@ var require_schemas = __commonJS({
         return payload;
       };
     });
+    function capSize2(inst, size) {
+      const caps = util.sizeCaps(inst._zod.def.checks);
+      if (!caps.length)
+        return;
+      const cap = Math.min(...caps.map((c) => c[0]));
+      const parse3 = inst._zod.parse;
+      inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+          for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+            if (n > max && ch._zod.def.when(payload)) {
+              const start = payload.issues.length;
+              ch._zod.check(payload);
+              payload.issues[start].continue = false;
+              util.attachSchema(payload.issues, start, inst);
+              return payload;
+            }
+          }
+        }
+        return parse3(payload, ctx);
+      };
+    }
+    var arraySize2 = (input2) => Array.isArray(input2) ? input2.length : -1;
+    var mapSize2 = (input2) => input2 instanceof Map ? input2.size : -1;
+    var setSize2 = (input2) => input2 instanceof Set ? input2.size : -1;
     function handleArrayResult2(result, final, index) {
       if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -3165,6 +3203,7 @@ var require_schemas = __commonJS({
         }
         return payload;
       };
+      capSize2(inst, arraySize2);
     });
     function handlePropertyResult2(result, final, key, input2, optin, optout) {
       const isPresent = key in input2;
@@ -4121,6 +4160,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, mapSize2);
     });
     function handleMapResult2(keyResult, valueResult, final, key, input2, inst, ctx) {
       if (keyResult.issues.length) {
@@ -4187,6 +4227,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, setSize2);
     });
     function handleSetResult2(result, final) {
       if (result.issues.length) {
@@ -16291,9 +16332,15 @@ ${code2}
       doc.write(`}`);
       return outputVar;
     }
+    function generateSizeGate2(doc, schema, size) {
+      for (const [max, check2] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand2(max, check2._zod.def.check)}) return INVALID;`);
+      }
+    }
     function generateArrayCheck2(doc, ctx, schema, accessor, buildsValue = true) {
       const def = schema._zod.def;
       doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.length`);
       const outputVar = buildsValue ? newVar2(ctx) : null;
       const iVar = newVar2(ctx);
       const elemVar = newVar2(ctx);
@@ -16693,6 +16740,7 @@ ${code2}
     function generateMapCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const kVar = newVar2(ctx);
       const valVar = newVar2(ctx);
@@ -16709,6 +16757,7 @@ ${code2}
     function generateSetCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const valVar = newVar2(ctx);
       doc.write(`const ${outputVar} = new Set();`);
@@ -27109,7 +27158,7 @@ function declaredDialect(schema, remedy) {
   throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${schema.$schema.slice(0, 200)}"). The default validator supports JSON Schema 2020-12, 2019-09, draft-07, and draft-06; ${remedy}`);
 }
 
-// node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var z = __toESM(require_v4(), 1);
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
@@ -41933,7 +41982,7 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+var QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
 var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -41944,6 +41993,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
+  "aws[_-]?secret[_-]?access[_-]?key",
+  // fleet-audit#1297
   "code[_-]?verifier",
   // PKCE; a bare `verifier` key is too generic for JSON
   `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -42641,6 +42692,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -43160,6 +43212,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -44580,7 +44644,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -45336,6 +45400,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -45379,6 +45468,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -46335,6 +46425,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -46401,6 +46492,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -55931,9 +56023,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -56333,6 +56431,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -56349,6 +56448,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -62497,10 +62597,34 @@ import { constants as fsConstants2, realpathSync } from "node:fs";
 var O_NOFOLLOW2 = fsConstants2.O_NOFOLLOW ?? 0;
 var O_NONBLOCK = fsConstants2.O_NONBLOCK ?? 0;
 
+// node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 var NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
+}
+var JUST_A_MOMENT = "just a moment";
+function hasJustAMomentTitle(html) {
+  const lower = asciiLower(html);
+  let i = 0;
+  for (; ; ) {
+    const open2 = lower.indexOf("<title", i);
+    if (open2 < 0)
+      return false;
+    const gt = lower.indexOf(">", open2 + 6);
+    if (gt < 0)
+      return false;
+    let j = gt + 1;
+    while (j < lower.length && /\s/.test(lower[j]))
+      j++;
+    if (lower.startsWith(JUST_A_MOMENT, j))
+      return true;
+    i = gt + 1;
+  }
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
@@ -62607,7 +62731,7 @@ var pageSchema = {
 
 // src/version.ts
 var SERVER_NAME = "honeybook-mcp";
-var VERSION = "1.2.6";
+var VERSION = "1.2.7";
 
 // src/sessions.ts
 import { homedir } from "node:os";
@@ -62859,25 +62983,9 @@ var SessionStore = class {
       this.mostRecentKey = null;
     }
   }
-  /**
-   * Move a corrupt store file to `<filePath>.corrupt` (or `.corrupt-<n>` if a
-   * previous backup exists) so a subsequent save cannot overwrite the only
-   * copy of the prior credentials. Best-effort: returns the backup path, or
-   * `null` if the rename failed.
-   */
+  /** See {@link preserveCorruptFile}. */
   preserveCorruptFile() {
-    try {
-      let candidate = `${this.filePath}.corrupt`;
-      for (let n = 1; existsSync3(candidate) && n <= 100; n++) {
-        candidate = `${this.filePath}.corrupt-${n}`;
-      }
-      if (existsSync3(candidate))
-        return null;
-      renameSync2(this.filePath, candidate);
-      return candidate;
-    } catch {
-      return null;
-    }
+    return preserveCorruptFile(this.filePath);
   }
   /** Serialize the store to its on-disk JSON form (array, insertion order). */
   serialize() {
@@ -62959,6 +63067,20 @@ var SessionStore = class {
     this.mostRecentKey = null;
   }
 };
+function preserveCorruptFile(filePath) {
+  try {
+    let candidate = `${filePath}.corrupt`;
+    for (let n = 1; existsSync3(candidate) && n <= 100; n++) {
+      candidate = `${filePath}.corrupt-${n}`;
+    }
+    if (existsSync3(candidate))
+      return null;
+    renameSync2(filePath, candidate);
+    return candidate;
+  } catch {
+    return null;
+  }
+}
 var TOKEN_REFRESH_SKEW_MS = 5 * 60 * 1e3;
 
 // src/sessions.ts
@@ -63765,6 +63887,17 @@ function isPublicSuffix(host) {
   return false;
 }
 
+// node_modules/@fetchproxy/protocol/dist/ip-literal.js
+function isIpLiteralHost(host) {
+  if (host.includes(":") || host.startsWith("["))
+    return true;
+  const labels = host.split(".");
+  if (labels.length > 1 && labels[labels.length - 1] === "")
+    labels.pop();
+  const last = labels[labels.length - 1] ?? "";
+  return /^[0-9]+$/.test(last) || /^0x[0-9a-f]*$/i.test(last);
+}
+
 // node_modules/@fetchproxy/protocol/dist/validate.js
 var ProtocolError3 = class extends Error {
   constructor(message) {
@@ -64230,6 +64363,9 @@ function validateHello(raw) {
       if (!HOSTNAME_RE.test(d)) {
         throw new ProtocolError3(`hello.domains: invalid hostname ${JSON.stringify(d)}`);
       }
+      if (isIpLiteralHost(d)) {
+        throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (isPublicSuffix(d)) {
         throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -66355,7 +66491,7 @@ async function startHost(opts) {
             if (ownRetryableRefusal)
               resetSessionPromise();
             resolveOwnSession(ownSession);
-          } else {
+          } else if (identified === "extension" && extensionWs === ws) {
             const slot = peers.get(frame.mcpId);
             if (slot)
               slot.ws.send(JSON.stringify(frame));
@@ -67381,6 +67517,9 @@ var FetchproxyServer = class {
       throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
     }
     for (const d of opts.domains) {
+      if (typeof d === "string" && isIpLiteralHost(d)) {
+        throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (typeof d === "string" && isPublicSuffix(d)) {
         throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -69315,6 +69454,9 @@ var FetchproxyServer = class {
   }
 };
 
+// node_modules/@fetchproxy/server/dist/bot-wall.js
+var CLOUDFLARE_TITLE_SCAN_MAX = 64 * 1024;
+
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
 var CAPTURE_BOOTSTRAP_DEADLINE_MS = 45e3;
@@ -70531,6 +70673,22 @@ function extractPayments(file2) {
   };
 }
 var MAX_WORKSPACE_FILE_PAGES = 20;
+var WORKSPACE_FILE_LIST_VIEWS = ["summary", "all"];
+function listRow(file2) {
+  return {
+    _id: file2._id,
+    file_title: file2.file_title,
+    file_type: file2.file_type,
+    status_name: file2.status_name,
+    sent_on: file2.sent_on,
+    created_at: file2.created_at,
+    workspace_id: getStr(getObj(file2, "workspace"), "_id"),
+    workspace_name: getStr(file2, "workspace_name"),
+    has_pending_payment: file2.has_pending_payment,
+    is_file_accepted: file2.is_file_accepted,
+    is_canceled: file2.is_canceled
+  };
+}
 async function listWorkspaceFiles(args) {
   const client = await getActiveClient(args.origin);
   const base = apiPath`/api/v2/users/${client.scope.userId}/workspace_files`;
@@ -70554,8 +70712,9 @@ async function listWorkspaceFiles(args) {
     if (fresh.length === 0) break;
   }
   const filtered = args.file_type ? files.filter((f) => f.file_type === args.file_type) : files;
+  const project = (args.view ?? "summary") === "all" ? pruneWorkspaceFile : listRow;
   return minifiedResult({
-    files: filtered,
+    files: filtered.map(project),
     complete,
     ...complete ? {} : {
       note: "This list is incomplete: HoneyBook reports more files than could be fetched. Files (including ones matching file_type) may be missing."
@@ -70594,12 +70753,15 @@ function registerWorkspaceFileTools(server) {
   server.registerTool(
     "list_workspace_files",
     {
-      description: "List all files a vendor has shared with you (contracts, invoices, brochures, proposals). Optionally filter by file_type. Follows every page; returns { files, complete } \u2014 complete:false means some files could not be fetched.",
+      description: 'List all files a vendor has shared with you (contracts, invoices, brochures, proposals). Optionally filter by file_type. Follows every page; returns { files, complete } \u2014 complete:false means some files could not be fetched. Each file is a light summary row by default (id, title, type, status, sent date, workspace, payment/acceptance flags); call get_workspace_file with its _id for pricing, contract or payments, or pass view="all" for every pruned file object (large).',
       inputSchema: external_exports.object({
         origin: schemaOrigin.describe(
           "Portal origin (e.g. https://<vendor>.hbportal.co) to target. Optional \u2014 defaults to the most recently activated session."
         ),
-        file_type: external_exports.enum(FILE_TYPES).optional().describe("Filter to one file type. Omit to return all.")
+        file_type: external_exports.enum(FILE_TYPES).optional().describe("Filter to one file type. Omit to return all."),
+        view: external_exports.enum(WORKSPACE_FILE_LIST_VIEWS).optional().describe(
+          'Default "summary": one light row per file. "all": each file object with the heavy vendor-side company fields pruned (can be hundreds of kB per proposal).'
+        )
       }),
       annotations: { readOnlyHint: true, openWorldHint: true }
     },

package/dist/tools/workspace_files.js

@@ -203,6 +203,29 @@ function extractPayments(file) {
  * file list is a handful of documents per vendor; this only stops a runaway.
  */
 export const MAX_WORKSPACE_FILE_PAGES = 20;
+/** The rungs list_workspace_files offers — the names get_workspace_file uses. */
+export const WORKSPACE_FILE_LIST_VIEWS = ['summary', 'all'];
+/**
+ * One row of the list: enough to pick a file and call get_workspace_file.
+ * The raw object carries `company` (vendor_emails alone measured ~1.3 MB on
+ * one proposal) and the whole `vendor_proposal`, so returning it per file let
+ * a handful of proposals exceed the host's result-size limit (fleet-audit#1264).
+ */
+export function listRow(file) {
+    return {
+        _id: file._id,
+        file_title: file.file_title,
+        file_type: file.file_type,
+        status_name: file.status_name,
+        sent_on: file.sent_on,
+        created_at: file.created_at,
+        workspace_id: getStr(getObj(file, 'workspace'), '_id'),
+        workspace_name: getStr(file, 'workspace_name'),
+        has_pending_payment: file.has_pending_payment,
+        is_file_accepted: file.is_file_accepted,
+        is_canceled: file.is_canceled,
+    };
+}
 /**
  * Every page of the user's workspace files (fleet-audit#502). Page 1 alone
  * hid later files entirely — and `file_type` filtering ran on page 1 only, so
@@ -232,8 +255,9 @@ export async function listWorkspaceFiles(args) {
             break;
     }
     const filtered = args.file_type ? files.filter((f) => f.file_type === args.file_type) : files;
+    const project = (args.view ?? 'summary') === 'all' ? pruneWorkspaceFile : listRow;
     return minifiedResult({
-        files: filtered,
+        files: filtered.map(project),
         complete,
         ...(complete
             ? {}
@@ -274,13 +298,19 @@ export async function getWorkspaceFile(args) {
 export function registerWorkspaceFileTools(server) {
     server.registerTool('list_workspace_files', {
         description: 'List all files a vendor has shared with you (contracts, invoices, brochures, proposals). Optionally filter by file_type. ' +
-            'Follows every page; returns { files, complete } — complete:false means some files could not be fetched.',
+            'Follows every page; returns { files, complete } — complete:false means some files could not be fetched. ' +
+            'Each file is a light summary row by default (id, title, type, status, sent date, workspace, payment/acceptance flags); ' +
+            'call get_workspace_file with its _id for pricing, contract or payments, or pass view="all" for every pruned file object (large).',
         inputSchema: z.object({
             origin: schemaOrigin.describe('Portal origin (e.g. https://<vendor>.hbportal.co) to target. Optional — defaults to the most recently activated session.'),
             file_type: z
                 .enum(FILE_TYPES)
                 .optional()
                 .describe('Filter to one file type. Omit to return all.'),
+            view: z
+                .enum(WORKSPACE_FILE_LIST_VIEWS)
+                .optional()
+                .describe('Default "summary": one light row per file. "all": each file object with the heavy vendor-side company fields pruned (can be hundreds of kB per proposal).'),
         }),
         annotations: { readOnlyHint: true, openWorldHint: true },
     }, listWorkspaceFiles);

package/dist/version.js

@@ -4,4 +4,4 @@
 // package.json drift. Importing these instead of package.json keeps the
 // whole manifest — npm scripts included — out of dist/bundle.js.
 export const SERVER_NAME = 'honeybook-mcp';
-export const VERSION = '1.2.6'; // x-release-please-version
+export const VERSION = '1.2.7'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeybook-mcp",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "mcpName": "io.github.chrischall/honeybook-mcp",
   "description": "HoneyBook client-portal MCP server for Claude",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -41,12 +41,12 @@
     "dev": "node --env-file=.env dist/index.js",
     "test": "npm run typecheck && vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.0",
-    "@fetchproxy/bootstrap": "^3.6.0",
-    "@fetchproxy/server": "^3.6.0",
+    "@chrischall/mcp-utils": "^3.0.3",
+    "@fetchproxy/bootstrap": "^3.6.2",
+    "@fetchproxy/server": "^3.6.2",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.2",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/honeybook-mcp",
     "source": "github"
   },
-  "version": "1.2.6",
+  "version": "1.2.7",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "honeybook-mcp",
-      "version": "1.2.6",
+      "version": "1.2.7",
       "transport": {
         "type": "stdio"
       },