fix: pre-PR review fixes — token error routing, health check crash, Dockerfile

Three bugs found in code review:

1. Missing token now raises WebexTokenMissingError (common.py) instead of
   bare RuntimeError. Each tool's _map_exception_to_error checks isinstance
   first and returns E401 (non-retryable) rather than the catch-all E600
   with temporary=True, which was incorrectly suggesting callers should retry
   a permanent configuration error.

2. health_check.py check_api_connectivity() and check_room_access() called
   webex_api.people.me() / webex_api.rooms.list() on the module-level value
   which is now None when WEBEX_ACCESS_TOKEN is unset (HTTP-transport mode).
   Both functions now return status="skipped" instead of crashing with
   AttributeError. Docker HEALTHCHECK (--skip-api) was already safe; this
   fixes direct script invocation.

3. Dockerfile COPY included uv.lock but the builder uses pip which ignores
   it entirely, giving false confidence in build reproducibility. Removed.

https://claude.ai/code/session_01UBF6bZJi742Y4CNg7KdU6N

Author: claude

Dockerfile

@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y \
 WORKDIR /app
 
 # Copy everything needed for a PEP 517 build
-COPY pyproject.toml uv.lock README.md ./
+COPY pyproject.toml README.md ./
 COPY src/ ./src/
 
 # Non-editable install so the package lands fully in site-packages

src/webex_bot_mcp/health_check.py

@@ -18,6 +18,11 @@
 
 def check_api_connectivity() -> Dict[str, Any]:
     """Test basic API connectivity and authentication"""
+    if webex_api is None:
+        return {
+            "status": "skipped",
+            "note": "WEBEX_ACCESS_TOKEN not set; API checks require a token (HTTP transport uses per-request tokens)"
+        }
     try:
         me = webex_api.people.me()
         return {
@@ -26,7 +31,7 @@ def check_api_connectivity() -> Dict[str, Any]:
             "bot_name": me.displayName,
             "bot_email": me.emails[0] if me.emails else "unknown",
             "org_id": me.orgId,
-            "response_time_ms": 0  # Would need timing logic
+            "response_time_ms": 0
         }
     except Exception as e:
         return {
@@ -38,8 +43,13 @@ def check_api_connectivity() -> Dict[str, Any]:
 
 def check_room_access() -> Dict[str, Any]:
     """Check bot's access to rooms"""
+    if webex_api is None:
+        return {
+            "status": "skipped",
+            "note": "WEBEX_ACCESS_TOKEN not set; room checks require a token"
+        }
     try:
-        rooms = list(webex_api.rooms.list(max=10))  # Limit to 10 for health check
+        rooms = list(webex_api.rooms.list(max=10))
 
         room_types = {}
         for room in rooms:

src/webex_bot_mcp/tools/common.py

@@ -35,6 +35,10 @@ class WebexErrorCodes:
     TOKEN_EXPIRED = "E602"
 
 
+class WebexTokenMissingError(RuntimeError):
+    """Raised when no Webex token is available for the current request."""
+
+
 def create_error_response(
     error_code: str,
     message: str,
@@ -120,7 +124,7 @@ def get_webex_api() -> WebexAPI:
     env_token = os.getenv("WEBEX_ACCESS_TOKEN")
     if env_token:
         return _cached_webex_api(env_token)
-    raise RuntimeError(
+    raise WebexTokenMissingError(
         "No Webex token available. Provide an 'Authorization: Bearer <token>' "
         "header (HTTP transport) or set WEBEX_ACCESS_TOKEN (stdio transport)."
     )

src/webex_bot_mcp/tools/memberships.py

@@ -2,10 +2,12 @@
 Webex Membership management tools.
 """
 from typing import Optional, Dict, Any
-from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes
+from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes, WebexTokenMissingError
 
 
 def _map_exception_to_error(e: Exception) -> Dict[str, Any]:
+    if isinstance(e, WebexTokenMissingError):
+        return create_error_response(WebexErrorCodes.UNAUTHORIZED, str(e))
     error_str = str(e).lower()
     if 'unauthorized' in error_str or 'invalid token' in error_str:
         return create_error_response(WebexErrorCodes.UNAUTHORIZED,

src/webex_bot_mcp/tools/messages.py

@@ -2,7 +2,7 @@
 Webex Message management tools.
 """
 from typing import Optional, Dict, Any, List
-from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes
+from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes, WebexTokenMissingError
 
 
 def format_mention_by_email(email: str, display_name: Optional[str] = None) -> str:
@@ -67,6 +67,8 @@ def create_message_with_mentions(
 
 def _map_exception_to_error(e: Exception) -> Dict[str, Any]:
     """Map a caught exception to a structured error response."""
+    if isinstance(e, WebexTokenMissingError):
+        return create_error_response(WebexErrorCodes.UNAUTHORIZED, str(e))
     error_str = str(e).lower()
     if 'rate limit' in error_str or 'too many requests' in error_str:
         return create_error_response(

src/webex_bot_mcp/tools/people.py

@@ -2,10 +2,12 @@
 Webex People management tools.
 """
 from typing import Optional, Dict, Any
-from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes
+from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes, WebexTokenMissingError
 
 
 def _map_exception_to_error(e: Exception) -> Dict[str, Any]:
+    if isinstance(e, WebexTokenMissingError):
+        return create_error_response(WebexErrorCodes.UNAUTHORIZED, str(e))
     error_str = str(e).lower()
     if 'unauthorized' in error_str or 'invalid token' in error_str:
         return create_error_response(WebexErrorCodes.UNAUTHORIZED,

src/webex_bot_mcp/tools/rooms.py

@@ -2,10 +2,12 @@
 Webex Room/Space management tools.
 """
 from typing import Optional, Dict, Any
-from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes
+from .common import get_webex_api, create_error_response, create_success_response, WebexErrorCodes, WebexTokenMissingError
 
 
 def _map_exception_to_error(e: Exception) -> Dict[str, Any]:
+    if isinstance(e, WebexTokenMissingError):
+        return create_error_response(WebexErrorCodes.UNAUTHORIZED, str(e))
     error_str = str(e).lower()
     if 'unauthorized' in error_str or 'invalid token' in error_str:
         return create_error_response(WebexErrorCodes.UNAUTHORIZED,