simplepractice-mcp 1.1.2 → 1.1.4

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "SimplePractice Client Portal tools for Claude",
-    "version": "1.1.2"
+    "version": "1.1.4"
   },
   "plugins": [
     {
       "name": "simplepractice",
       "source": "./",
       "description": "Read a SimplePractice Client Portal — appointments, invoices and superbills, documents to sign, and practice announcements. Signs in with the portal's own passwordless emailed link; requests go straight to the portal's JSON:API over your own session.",
-      "version": "1.1.2",
+      "version": "1.1.4",
       "author": {
         "name": "Chris Chall",
         "url": "https://github.com/chrischall"

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "simplepractice",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "SimplePractice Client Portal — appointments, billing, documents, and announcements",
   "author": {
     "name": "Chris Chall",

package/dist/bundle.js

@@ -34362,13 +34362,28 @@ var API_KEY_RE = new RegExp([
   "whsec_[A-Za-z0-9]{16,}\\b"
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
-var QUERY_SECRET_RE = /([?&](?:access_token|refresh_token|client_secret|api_?key|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var QUERY_SECRET_RE = /([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig)=)[^&#\s"'<>`]+/gi;
+var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
+var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
+var HEADER_SECRET_RE = /(\b(?:x[-_][a-z0-9_-]*?(?:api[-_]?key|token|secret|auth)[a-z0-9_-]*|api[-_]?key)\s*:\s*)[^\s,;"'<>`]+/gi;
 var AWS_SIGV4_RE = /([?&]X-Amz-(?:Signature|Security-Token|Credential)=)[^&#\s"'<>`]+/gi;
-var JSON_SECRET_KEYS = "access_token|refresh_token|client_secret|api_?key|password|passwd|secret|token";
-var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")[^"]*(")`, "gi");
-var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')[^']*(')`, "gi");
+var JSON_SECRET_KEYS = [
+  "(?:access|refresh|id|auth|session|bearer|csrf|xsrf)[_-]?token",
+  "client[_-]?secret",
+  "api[_-]?secret",
+  "(?:x[_-])?api[_-]?key",
+  "private[_-]?key",
+  "x[_-][a-z0-9_-]*?(?:api[_-]?key|token|secret|auth)[a-z0-9_-]*",
+  "(?:proxy-)?authorization",
+  "password",
+  "passwd",
+  "secret",
+  "token"
+].join("|");
+var JSON_SECRET_DQ_RE = new RegExp(`("(?:${JSON_SECRET_KEYS})"\\s*:\\s*")(?:[^"\\\\]|\\\\.)*(")`, "gi");
+var JSON_SECRET_SQ_RE = new RegExp(`('(?:${JSON_SECRET_KEYS})'\\s*:\\s*')(?:[^'\\\\]|\\\\.)*(')`, "gi");
 function redactSecrets(text) {
-  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
+  return text.replace(BEARER_RE, "$1[REDACTED]").replace(BASIC_AUTH_RE, "$1[REDACTED]").replace(SET_COOKIE_RE, "$1$2=[REDACTED]").replace(COOKIE_HEADER_RE, (_m, prefix, pairs) => `${prefix}${pairs.replace(/=[^;,\s]*/g, "=[REDACTED]")}`).replace(API_KEY_RE, "[REDACTED]").replace(HEADER_SECRET_RE, "$1[REDACTED]").replace(QUERY_SECRET_RE, "$1[REDACTED]").replace(OAUTH_CODE_RE, "$1[REDACTED]").replace(FORM_PASSWORD_RE, "$1[REDACTED]").replace(AWS_SIGV4_RE, "$1[REDACTED]").replace(JSON_SECRET_DQ_RE, "$1[REDACTED]$2").replace(JSON_SECRET_SQ_RE, "$1[REDACTED]$2").replace(JWT_RE, "[REDACTED]");
 }
 function truncateErrorMessage(text, max = DEFAULT_ERROR_MESSAGE_MAX) {
   const str = text === null || text === void 0 ? "" : String(text);
@@ -34560,13 +34575,47 @@ async function createMcpServer(opts) {
   }
   return server;
 }
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5e3;
+var DEFAULT_REPEAT_SIGNAL_GRACE_MS = 500;
 function withGracefulShutdown(target, opts = {}) {
   const shouldExit = opts.exit ?? true;
+  if (opts.timeoutMs !== void 0 && !(Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0)) {
+    throw new RangeError("withGracefulShutdown: timeoutMs must be a finite number greater than 0.");
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  if (opts.repeatSignalGraceMs !== void 0 && !(Number.isFinite(opts.repeatSignalGraceMs) && opts.repeatSignalGraceMs >= 0)) {
+    throw new RangeError("withGracefulShutdown: repeatSignalGraceMs must be a finite number >= 0.");
+  }
+  const repeatGraceMs = opts.repeatSignalGraceMs ?? DEFAULT_REPEAT_SIGNAL_GRACE_MS;
   let shuttingDown = false;
+  let firstSignalAt = 0;
+  let exited = false;
+  const exitOnce = () => {
+    if (exited)
+      return;
+    exited = true;
+    process.exit(0);
+  };
   const handler = (signal) => {
-    if (shuttingDown)
+    if (shuttingDown) {
+      if (Date.now() - firstSignalAt < repeatGraceMs)
+        return;
+      if (shouldExit) {
+        console.error(`[mcp-utils] second ${signal} during shutdown \u2014 exiting now`);
+        exitOnce();
+      }
       return;
+    }
     shuttingDown = true;
+    firstSignalAt = Date.now();
+    let timer;
+    if (shouldExit) {
+      timer = setTimeout(() => {
+        console.error(`[mcp-utils] graceful shutdown on ${signal} did not finish in ${timeoutMs}ms \u2014 exiting`);
+        exitOnce();
+      }, timeoutMs);
+      timer.unref?.();
+    }
     void (async () => {
       try {
         if (opts.onSignal)
@@ -34575,8 +34624,10 @@ function withGracefulShutdown(target, opts = {}) {
       } catch (err) {
         console.error(`[mcp-utils] error during graceful shutdown on ${signal}: ${err instanceof Error ? err.message : String(err)}`);
       } finally {
+        if (timer !== void 0)
+          clearTimeout(timer);
         if (shouldExit)
-          process.exit(0);
+          exitOnce();
       }
     })();
   };
@@ -34718,9 +34769,12 @@ var pageSchema = {
   page_size: external_exports.number().int().min(1).max(200).default(50).describe("Number of items per page (1-200).")
 };
 function toolAnnotations(opts = {}) {
+  if (opts.readOnly === true && opts.destructive === true) {
+    throw new Error("toolAnnotations: readOnly: true contradicts destructive: true \u2014 a destructive tool is not read-only.");
+  }
   return {
     ...opts.title !== void 0 ? { title: opts.title } : {},
-    readOnlyHint: opts.readOnly ?? true,
+    readOnlyHint: opts.readOnly ?? opts.destructive === void 0,
     ...opts.idempotent !== void 0 ? { idempotentHint: opts.idempotent } : {},
     ...opts.destructive !== void 0 ? { destructiveHint: opts.destructive } : {},
     ...opts.openWorld !== void 0 ? { openWorldHint: opts.openWorld } : {}
@@ -34728,7 +34782,7 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "1.1.2";
+var VERSION = "1.1.4";
 
 // node_modules/@chrischall/mcp-utils/dist/session/index.js
 import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
@@ -34973,14 +35027,27 @@ function buildQuery(params) {
   return pairs.join("&");
 }
 var SimplePracticeClient = class {
-  store;
+  /**
+   * The session store, as it is on disk NOW.
+   *
+   * Another server process (Claude Desktop beside Claude Code) shares the
+   * session file, and `SessionStore` reads it only in its constructor, then
+   * rewrites the whole file from its in-memory Map on every add/remove. Held
+   * for the life of the process, that snapshot would write a session another
+   * process signed out of straight back to disk, or drop one it just created.
+   * So by default every access opens the store afresh; an injected store
+   * (tests) is used as given.
+   */
+  openStore;
   fetchImpl;
   /** A practice learned at runtime — from a sign-in link, or named on a tool call. */
   adoptedHost = null;
   constructor(opts = {}) {
     this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-    this.store = opts.store ?? new SessionStore({
-      filePath: sessionFilePath(),
+    const injected = opts.store;
+    const filePath = sessionFilePath();
+    this.openStore = injected ? () => injected : () => new SessionStore({
+      filePath,
       keyOf: (session) => session.host,
       normalizeKey: (key) => key.toLowerCase()
     });
@@ -35025,7 +35092,7 @@ var SimplePracticeClient = class {
    */
   mostRecentSessionHost() {
     let newest = null;
-    for (const session of this.store.list()) {
+    for (const session of this.openStore().list()) {
       if (!newest || session.createdAt > newest.createdAt) newest = session;
     }
     return newest?.host ?? null;
@@ -35106,17 +35173,17 @@ var SimplePracticeClient = class {
   }
   getSession() {
     const host = this.knownPortalHost();
-    return host ? this.store.get(host) : null;
+    return host ? this.openStore().get(host) : null;
   }
   saveSession(cookie) {
     const host = this.requireConfig();
     const session = { host, cookie, createdAt: (/* @__PURE__ */ new Date()).toISOString() };
-    this.store.add(session);
+    this.openStore().add(session);
     return session;
   }
   clearSession() {
     const host = this.knownPortalHost();
-    return host ? this.store.remove(host) : false;
+    return host ? this.openStore().remove(host) : false;
   }
   requireSession() {
     const session = this.getSession();

package/dist/client.js

@@ -20,19 +20,32 @@ export function buildQuery(params) {
     return pairs.join('&');
 }
 export class SimplePracticeClient {
-    store;
+    /**
+     * The session store, as it is on disk NOW.
+     *
+     * Another server process (Claude Desktop beside Claude Code) shares the
+     * session file, and `SessionStore` reads it only in its constructor, then
+     * rewrites the whole file from its in-memory Map on every add/remove. Held
+     * for the life of the process, that snapshot would write a session another
+     * process signed out of straight back to disk, or drop one it just created.
+     * So by default every access opens the store afresh; an injected store
+     * (tests) is used as given.
+     */
+    openStore;
     fetchImpl;
     /** A practice learned at runtime — from a sign-in link, or named on a tool call. */
     adoptedHost = null;
     constructor(opts = {}) {
         this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
-        this.store =
-            opts.store ??
-                new SessionStore({
-                    filePath: sessionFilePath(),
-                    keyOf: (session) => session.host,
-                    normalizeKey: (key) => key.toLowerCase(),
-                });
+        const injected = opts.store;
+        const filePath = sessionFilePath();
+        this.openStore = injected
+            ? () => injected
+            : () => new SessionStore({
+                filePath,
+                keyOf: (session) => session.host,
+                normalizeKey: (key) => key.toLowerCase(),
+            });
     }
     /**
      * Which practice this server is talking to, and how it found out.
@@ -76,7 +89,7 @@ export class SimplePracticeClient {
      */
     mostRecentSessionHost() {
         let newest = null;
-        for (const session of this.store.list()) {
+        for (const session of this.openStore().list()) {
             if (!newest || session.createdAt > newest.createdAt)
                 newest = session;
         }
@@ -159,12 +172,12 @@ export class SimplePracticeClient {
     }
     getSession() {
         const host = this.knownPortalHost();
-        return host ? this.store.get(host) : null;
+        return host ? this.openStore().get(host) : null;
     }
     saveSession(cookie) {
         const host = this.requireConfig();
         const session = { host, cookie, createdAt: new Date().toISOString() };
-        this.store.add(session);
+        this.openStore().add(session);
         return session;
     }
     clearSession() {
@@ -172,7 +185,7 @@ export class SimplePracticeClient {
         // Not knowing the practice is the same outcome as having no session for
         // it: nothing to sign out of. Throwing would make sign-out the one tool
         // that fails when it has nothing to do.
-        return host ? this.store.remove(host) : false;
+        return host ? this.openStore().remove(host) : false;
     }
     requireSession() {
         const session = this.getSession();

package/dist/version.js

@@ -2,4 +2,4 @@
  * Single source of truth for the server version. release-please rewrites the
  * literal below; every other file imports VERSION rather than repeating it.
  */
-export const VERSION = '1.1.2'; // x-release-please-version
+export const VERSION = '1.1.4'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simplepractice-mcp",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "license": "MIT",
   "mcpName": "io.github.chrischall/simplepractice-mcp",
   "description": "SimplePractice Client Portal MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -34,10 +34,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.2.0",
+    "@chrischall/mcp-utils": "^2.4.0",
     "@modelcontextprotocol/server": "^2.0.0",
     "dotenv": "^18.0.0",
-    "zod": "^4.6.2"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/simplepractice-mcp",
     "source": "github"
   },
-  "version": "1.1.2",
+  "version": "1.1.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "simplepractice-mcp",
-      "version": "1.1.2",
+      "version": "1.1.4",
       "transport": {
         "type": "stdio"
       },