myhotlunchbox-mcp 1.2.2 → 1.2.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
-    "version": "1.2.2"
+    "version": "1.2.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "My Hot Lunchbox",
       "source": "./",
       "description": "MCP server for My Hot Lunchbox — school lunch calendar, ordering, and payments. Signs in server-side with the parent account credentials.",
-      "version": "1.2.2",
+      "version": "1.2.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myhotlunchbox-mcp",
   "displayName": "My Hot Lunchbox",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
   "author": {
     "name": "Chris Hall",

package/dist/auth.js

@@ -1,4 +1,4 @@
-import { McpToolError, truncateErrorMessage } from '@chrischall/mcp-utils';
+import { EdgeBlockedError, McpToolError, detectEdgeBlock, truncateErrorMessage } from '@chrischall/mcp-utils';
 import { TokenManager } from '@chrischall/mcp-utils/session';
 import { API_PREFIX, OAUTH_SCOPE } from './config.js';
 import { createTokenCache, reportCacheWriteFailure } from './token-cache.js';
@@ -97,6 +97,19 @@ export class MhlbAuth {
         }
         const raw = await res.text();
         if (!res.ok) {
+            // A CDN/WAF refused the sign-in before the token endpoint saw it, so the
+            // password was never judged. Reporting it as "rejected the sign-in"
+            // points at a credential on an account that locks on failed attempts.
+            // Not an invalid_grant, so it latches nothing and triggers no fallback
+            // password grant (chrischall/mcp-host#1015).
+            const edge = detectEdgeBlock({ body: raw, headers: res.headers, status: res.status });
+            if (edge !== null) {
+                throw new EdgeBlockedError(res.status, edge.vendor, {
+                    service: 'My Hot Lunchbox',
+                    method: 'POST',
+                    path: `${API_PREFIX}/auth/login`,
+                });
+            }
             let parsed = null;
             try {
                 parsed = JSON.parse(raw);