simplepractice-mcp 1.1.0 → 1.1.1

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "SimplePractice Client Portal tools for Claude",
-    "version": "1.1.0"
+    "version": "1.1.1"
   },
   "plugins": [
     {
       "name": "simplepractice",
       "source": "./",
       "description": "Read a SimplePractice Client Portal — appointments, invoices and superbills, documents to sign, and practice announcements. Signs in with the portal's own passwordless emailed link; requests go straight to the portal's JSON:API over your own session.",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "author": {
         "name": "Chris Chall",
         "url": "https://github.com/chrischall"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "simplepractice",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "SimplePractice Client Portal — appointments, billing, documents, and announcements",
   "author": {
     "name": "Chris Chall",

package/dist/bundle.js

@@ -6,6 +6,20 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function withCallSignal(signal, fn, request) {
+  return signal ? storage.run({ signal, ...request ? { request } : {} }, fn) : fn();
+}
+
+// node_modules/@chrischall/mcp-utils/dist/caller/index.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2 = new AsyncLocalStorage2();
+function withCallerCapabilities(capabilities, fn) {
+  return capabilities ? storage2.run(capabilities, fn) : fn();
+}
+
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -34472,17 +34486,73 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function mcpRequestFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  return typeof req.notify === "function" ? req : void 0;
+}
+function callSignalFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  const signal = req.signal;
+  return signal instanceof AbortSignal ? signal : void 0;
+}
+function declaredCapabilitiesFrom(server) {
+  const inner = server.server;
+  if (typeof inner !== "object" || inner === null)
+    return void 0;
+  const read = inner.getClientCapabilities;
+  if (typeof read !== "function")
+    return void 0;
+  try {
+    const declared = read.call(inner);
+    return typeof declared === "object" && declared !== null ? declared : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
-  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => {
-    let result;
-    try {
-      result = cb(...args);
-    } catch (err) {
-      return hintResultOrRethrow(err);
-    }
-    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-  });
+  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
+    // THE CALLER'S CANCELLATION, made ambient for the whole handler
+    // (`cancel/index.ts`). The SDK delivers it and the fleet ignored it:
+    // measured against @modelcontextprotocol/server 2.0.0, a cancelled
+    // call aborts `ctx.mcpReq.signal` with the caller's reason and the
+    // handler runs to completion regardless — so the HTTP request stays
+    // in flight, the child keeps burning metered CPU, and the upstream
+    // keeps being hit for somebody who has gone. claude.ai sent 101
+    // cancellations in the week to 2026-09-20.
+    //
+    // Here because this is the one wrapper every tool already passes
+    // through: threading the signal by hand would mean editing several
+    // hundred handlers and missing exactly the ones nobody edits.
+    withCallSignal(callSignalFrom(args), () => (
+      // WHAT THE CALLER CAN DO, made ambient for the same reason and in
+      // the same place (`caller/index.ts`). Only the 2025-era half needs
+      // the wrapper — a 2026-07-28 request answers for itself off its own
+      // envelope — but a guarded tool that cannot tell whether the caller
+      // can be shown a prompt returns one the SDK then refuses to deliver,
+      // and that refusal reaches the caller as an unexplained protocol
+      // error it had no chance to catch.
+      withCallerCapabilities(declaredCapabilitiesFrom(server), () => {
+        let result;
+        try {
+          result = cb(...args);
+        } catch (err) {
+          return hintResultOrRethrow(err);
+        }
+        return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+      })
+    ), mcpRequestFrom(args))
+  ));
 }
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
@@ -34659,12 +34729,13 @@ function toolAnnotations(opts = {}) {
     ...opts.title !== void 0 ? { title: opts.title } : {},
     readOnlyHint: opts.readOnly ?? true,
     ...opts.idempotent !== void 0 ? { idempotentHint: opts.idempotent } : {},
+    ...opts.destructive !== void 0 ? { destructiveHint: opts.destructive } : {},
     ...opts.openWorld !== void 0 ? { openWorldHint: opts.openWorld } : {}
   };
 }
 
 // src/version.ts
-var VERSION = "1.1.0";
+var VERSION = "1.1.1";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
@@ -35251,7 +35322,7 @@ function registerAuthTools(server, client2) {
     "simplepractice_request_sign_in_link",
     {
       description: "Ask SimplePractice to email a sign-in link to a Client Portal address. The portal has no password \u2014 this is how you sign in. Sends a real email and is rate-limited per email address AND per IP, so it requires confirm:true. A success does not prove the address has an account: the API answers identically for unknown addresses by design.",
-      annotations: toolAnnotations({ readOnly: false, idempotent: false }),
+      annotations: toolAnnotations({ readOnly: false, idempotent: false, destructive: true }),
       inputSchema: external_exports.object({
         email: external_exports.string().email().describe("The email address the Client Portal is registered to."),
         practice: external_exports.string().min(1).optional().describe(
@@ -35291,7 +35362,7 @@ function registerAuthTools(server, client2) {
     "simplepractice_verify_sign_in_token",
     {
       description: 'Exchange an emailed sign-in link (or the token in it) for a Client Portal session. Accepts the whole link or just the part after the "#". Prefer passing the WHOLE link: its address names the practice, so no practice has to be configured, and this server remembers it afterwards. Tokens are single-use and last 24 hours.',
-      annotations: toolAnnotations({ readOnly: false, idempotent: false }),
+      annotations: toolAnnotations({ readOnly: false, idempotent: false, destructive: true }),
       inputSchema: external_exports.object({
         link: external_exports.string().min(1).describe('The sign-in link from the email, or just the token after the "#".')
       })
@@ -35302,7 +35373,7 @@ function registerAuthTools(server, client2) {
     "simplepractice_verify_sign_in_pin",
     {
       description: "Exchange a 6-digit Client Portal sign-in PIN for a session, for practices that email a code instead of a link. Single-use.",
-      annotations: toolAnnotations({ readOnly: false, idempotent: false }),
+      annotations: toolAnnotations({ readOnly: false, idempotent: false, destructive: true }),
       inputSchema: external_exports.object({
         email: external_exports.string().email().describe("The address the PIN was sent to."),
         pin: external_exports.string().regex(/^\d{6}$/, "The PIN is exactly 6 digits.")
@@ -35314,7 +35385,7 @@ function registerAuthTools(server, client2) {
     "simplepractice_sign_out",
     {
       description: "Discard the stored Client Portal session from local state.",
-      annotations: toolAnnotations({ readOnly: false, idempotent: true }),
+      annotations: toolAnnotations({ readOnly: false, idempotent: true, destructive: false }),
       inputSchema: external_exports.object({})
     },
     async () => minifiedResult({ signedOut: client2.clearSession() })

package/dist/tools/auth.js

@@ -34,7 +34,7 @@ export function registerAuthTools(server, client) {
     });
     server.registerTool('simplepractice_request_sign_in_link', {
         description: 'Ask SimplePractice to email a sign-in link to a Client Portal address. The portal has no password — this is how you sign in. Sends a real email and is rate-limited per email address AND per IP, so it requires confirm:true. A success does not prove the address has an account: the API answers identically for unknown addresses by design.',
-        annotations: toolAnnotations({ readOnly: false, idempotent: false }),
+        annotations: toolAnnotations({ readOnly: false, idempotent: false, destructive: true }),
         inputSchema: z.object({
             email: z.string().email().describe('The email address the Client Portal is registered to.'),
             practice: z
@@ -74,7 +74,7 @@ export function registerAuthTools(server, client) {
     });
     server.registerTool('simplepractice_verify_sign_in_token', {
         description: 'Exchange an emailed sign-in link (or the token in it) for a Client Portal session. Accepts the whole link or just the part after the "#". Prefer passing the WHOLE link: its address names the practice, so no practice has to be configured, and this server remembers it afterwards. Tokens are single-use and last 24 hours.',
-        annotations: toolAnnotations({ readOnly: false, idempotent: false }),
+        annotations: toolAnnotations({ readOnly: false, idempotent: false, destructive: true }),
         inputSchema: z.object({
             link: z
                 .string()
@@ -84,7 +84,7 @@ export function registerAuthTools(server, client) {
     }, async ({ link }) => minifiedResult(await verifySignInToken(client, link)));
     server.registerTool('simplepractice_verify_sign_in_pin', {
         description: 'Exchange a 6-digit Client Portal sign-in PIN for a session, for practices that email a code instead of a link. Single-use.',
-        annotations: toolAnnotations({ readOnly: false, idempotent: false }),
+        annotations: toolAnnotations({ readOnly: false, idempotent: false, destructive: true }),
         inputSchema: z.object({
             email: z.string().email().describe('The address the PIN was sent to.'),
             pin: z.string().regex(/^\d{6}$/, 'The PIN is exactly 6 digits.'),
@@ -92,7 +92,7 @@ export function registerAuthTools(server, client) {
     }, async ({ email, pin }) => minifiedResult(await verifySignInPin(client, email, pin)));
     server.registerTool('simplepractice_sign_out', {
         description: 'Discard the stored Client Portal session from local state.',
-        annotations: toolAnnotations({ readOnly: false, idempotent: true }),
+        annotations: toolAnnotations({ readOnly: false, idempotent: true, destructive: false }),
         inputSchema: z.object({}),
     }, async () => minifiedResult({ signedOut: client.clearSession() }));
 }

package/dist/version.js

@@ -2,4 +2,4 @@
  * Single source of truth for the server version. release-please rewrites the
  * literal below; every other file imports VERSION rather than repeating it.
  */
-export const VERSION = '1.1.0'; // x-release-please-version
+export const VERSION = '1.1.1'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simplepractice-mcp",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "license": "MIT",
   "mcpName": "io.github.chrischall/simplepractice-mcp",
   "description": "SimplePractice Client Portal MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -34,7 +34,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^1.0.0",
+    "@chrischall/mcp-utils": "^2.2.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "dotenv": "^17.4.2",
     "zod": "^4.6.2"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/simplepractice-mcp",
     "source": "github"
   },
-  "version": "1.1.0",
+  "version": "1.1.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "simplepractice-mcp",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "transport": {
         "type": "stdio"
       },