myhotlunchbox-mcp 1.2.4 → 1.2.6

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
-    "version": "1.2.4"
+    "version": "1.2.6"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "My Hot Lunchbox",
       "source": "./",
       "description": "MCP server for My Hot Lunchbox — school lunch calendar, ordering, and payments. Signs in server-side with the parent account credentials.",
-      "version": "1.2.4",
+      "version": "1.2.6",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myhotlunchbox-mcp",
   "displayName": "My Hot Lunchbox",
-  "version": "1.2.4",
+  "version": "1.2.6",
   "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
   "author": {
     "name": "Chris Hall",
@@ -18,5 +18,5 @@
     "parent"
   ],
   "skills": "./skills/",
-  "mcp": "./.mcp.json"
+  "mcpServers": "./.mcp.json"
 }

package/README.md

@@ -31,7 +31,7 @@ That is the whole setup. The server performs a real server-side sign-in against
 the refresh token it receives — **no browser extension, no signed-in tab, no
 captured cookie**. Nothing is written to disk.
 
-`MYHOTLUNCHBOX_BASE_URL` overrides the app origin if it ever moves.
+`MYHOTLUNCHBOX_BASE_URL` overrides the app origin if it ever moves. It must be `https://` (plain `http://` is accepted only for `localhost`), and the token cache is bound to it, so changing it signs in again.
 
 The server boots without credentials so a host's install-time `tools/list` probe
 still works; the configuration error surfaces on the first tool call.
@@ -72,8 +72,9 @@ the full code.
 **Reports** — `mhlb_print_calendar`, `mhlb_print_orders`,
 `mhlb_print_transaction`. These return real PDFs; each writes the file and
 returns its path, or the bytes inline with `inline: true`. Set
-`MYHOTLUNCHBOX_OUTPUT_DIR` to choose where they land (defaults to the working
-directory); existing files are never overwritten.
+`MYHOTLUNCHBOX_OUTPUT_DIR` (the "Report folder" setting in the `.mcpb`) to
+choose where they land; it defaults to `reports/` under `MCP_DATA_DIR` when the
+host sets one, else `~/Downloads`. Existing files are never overwritten.
 
 ## Confirmations
 
@@ -87,7 +88,8 @@ changing any argument between the two calls is refused (`DRAFT_CHANGED`).
 
 | variable | default | |
 |---|---|---|
-| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt, unless `MCP_CONFIRM_ELICITATION=off`. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_ELICITATION` | `on` | `off` never sends a confirmation prompt, so every client gets the `MCP_CONFIRM_MODE` path. Set it for a client that declares it can show prompts but never does (the gated call hangs — opencode 2.0.x). Any other value stays `on`, with a stderr warning. |
 | `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
 | `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
 
@@ -131,12 +133,17 @@ Two limits on `mhlb_checkout` specifically:
 There is no "add item X" call. Fetch the model, edit it, send it back whole:
 
 1. `mhlb_get_menu` — what is orderable for a student on a date
-2. `mhlb_get_order_form` — the order model to fill in
-3. `mhlb_create_order` — send it back (and confirm the preview)
+2. `mhlb_get_order_form` — the order model to fill in (its `data` field)
+3. `mhlb_create_order` — send that `data` back (and confirm the preview)
 4. `mhlb_init_checkout` → `mhlb_checkout` — price, then pay
 
 Fields omitted from the payload are **cleared**, not preserved.
 
+Reads that carry school-, vendor- or menu-authored text (calendar, menus, cart,
+orders, students, transactions, subscriptions, coupon) return
+`{"untrusted_content":true,"note":…,"data":…}`: the payload sits under `data`,
+and the note tells the model to treat that text as data, never as instructions.
+
 ## Shell skill
 
 `skills/myhotlunchbox` covers the same account from a shell with `curl` — no MCP

package/dist/auth.js

@@ -1,9 +1,24 @@
-import { EdgeBlockedError, McpToolError, detectEdgeBlock, truncateErrorMessage } from '@chrischall/mcp-utils';
+import { EdgeBlockedError, McpToolError, RateLimitError, UnreachableError, detectEdgeBlock, truncateErrorMessage, withAmbientCancellation, } from '@chrischall/mcp-utils';
 import { TokenManager } from '@chrischall/mcp-utils/session';
 import { API_PREFIX, OAUTH_SCOPE } from './config.js';
 import { createTokenCache, reportCacheWriteFailure } from './token-cache.js';
 /** Fallback lifetime when the server omits `expires_in`. */
 const DEFAULT_TOKEN_LIFETIME_S = 3600;
+/** Default per-request timeout for the API and the token endpoint. */
+export const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * The signal every upstream fetch carries: a timeout of its own, combined with
+ * the running tool call's cancellation (made ambient by mcp-utils' server
+ * wrapper), so a hung upstream cannot hang the tool call and a cancelled call
+ * stops waiting.
+ */
+export function requestSignal(timeoutMs) {
+    // withAmbientCancellation returns `own` unchanged when there is no ambient
+    // signal, so with an own signal in hand it is never undefined.
+    return withAmbientCancellation(AbortSignal.timeout(timeoutMs));
+}
+/** Whether a fetch rejection was our own timeout firing (not the caller cancelling). */
+export const isTimeout = (err) => typeof err === 'object' && err !== null && err.name === 'TimeoutError';
 /**
  * The token endpoint answered with an error. Carries the OAuth `error` code so
  * callers can tell a rejected credential (`invalid_grant`) apart from a
@@ -48,6 +63,7 @@ export function scrubCredentials(text, secrets) {
 export class MhlbAuth {
     config;
     fetchImpl;
+    timeoutMs;
     manager = null;
     loginInFlight = null;
     /**
@@ -57,9 +73,17 @@ export class MhlbAuth {
      * {@link reset} (mhlb_session_reset) or a restart.
      */
     credentialRejected = null;
-    constructor(config, fetchImpl = fetch) {
+    /**
+     * Set once the API has accepted an access token (from the cache, a login or
+     * a refresh) — i.e. answered something other than 401. The manager itself
+     * exists before any sign-in has run, so its presence says nothing about a
+     * session.
+     */
+    sessionEstablished = false;
+    constructor(config, fetchImpl = fetch, timeoutMs = DEFAULT_TIMEOUT_MS) {
         this.config = config;
         this.fetchImpl = fetchImpl;
+        this.timeoutMs = timeoutMs;
     }
     /** Credentials are checked lazily so the server still boots without them. */
     requireCredentials() {
@@ -72,6 +96,30 @@ export class MhlbAuth {
         }
         return { username, password };
     }
+    /**
+     * Refuse to send anything — the password included — to an origin that is
+     * not https. Plain http is allowed only to loopback, which is what
+     * scripts/capture-writes.mjs points MYHOTLUNCHBOX_BASE_URL at. Checked per
+     * call rather than at boot so a bad value still lets the server start and
+     * surfaces as a tool error.
+     */
+    requireSafeOrigin() {
+        const { baseUrl } = this.config;
+        let url = null;
+        try {
+            url = new URL(baseUrl);
+        }
+        catch {
+            /* reported below */
+        }
+        const loopback = url !== null && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+        if (url?.protocol === 'https:' || (url?.protocol === 'http:' && loopback))
+            return;
+        throw new McpToolError(`MYHOTLUNCHBOX_BASE_URL (${baseUrl}) is not an https:// origin; refusing to sign in.`, {
+            hint: 'MYHOTLUNCHBOX_BASE_URL must be https:// (plain http is allowed only for localhost). ' +
+                'Unset it to use https://ordernow.myhotlunchbox.com.',
+        });
+    }
     tokenUrl() {
         return `${this.config.baseUrl}${API_PREFIX}/auth/login`;
     }
@@ -81,6 +129,7 @@ export class MhlbAuth {
      */
     async postGrant(form) {
         const { password } = this.config;
+        const signal = requestSignal(this.timeoutMs);
         let res;
         try {
             res = await this.fetchImpl(this.tokenUrl(), {
@@ -90,9 +139,17 @@ export class MhlbAuth {
                     accept: 'application/json',
                 },
                 body: new URLSearchParams(form).toString(),
+                signal,
             });
         }
         catch (cause) {
+            if (isTimeout(cause)) {
+                throw new McpToolError(`My Hot Lunchbox sign-in timed out after ${Math.round(this.timeoutMs / 1000)}s.`, { hint: 'The sign-in endpoint is slow or down; the credential was never judged. Try again later.', cause });
+            }
+            // The caller cancelled: let its own reason through rather than calling
+            // it a connectivity problem.
+            if (signal.aborted)
+                throw cause;
             throw new McpToolError(`Could not reach My Hot Lunchbox at ${this.config.baseUrl}.`, { hint: 'Check network connectivity, or override MYHOTLUNCHBOX_BASE_URL if the app has moved.', cause });
         }
         const raw = await res.text();
@@ -110,6 +167,16 @@ export class MhlbAuth {
                     path: `${API_PREFIX}/auth/login`,
                 });
             }
+            // A throttle or an outage never judged the password either. Only a 4xx
+            // from the token endpoint itself is a verdict on the credential; a 429,
+            // a 5xx or a gateway page must not read as "rejected the sign-in",
+            // which tells the parent to change a working password and not retry.
+            if (res.status === 429) {
+                const retryAfter = Number(res.headers.get('retry-after'));
+                throw new RateLimitError('My Hot Lunchbox', Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : undefined);
+            }
+            if (res.status >= 500)
+                throw new UnreachableError('My Hot Lunchbox', res.status);
             let parsed = null;
             try {
                 parsed = JSON.parse(raw);
@@ -171,6 +238,7 @@ export class MhlbAuth {
      * Single-flight: concurrent first-callers share one login.
      */
     async ensureManager() {
+        this.requireSafeOrigin();
         if (this.manager)
             return this.manager;
         if (this.loginInFlight)
@@ -234,7 +302,14 @@ export class MhlbAuth {
      */
     async withAuth(call) {
         const manager = await this.ensureManager();
-        return manager.withAuth(call);
+        return manager.withAuth(async (accessToken) => {
+            const res = await call(accessToken);
+            // Only a token the API accepted proves a session; a 401 (even after the
+            // one refresh) means the sign-in produced nothing usable.
+            if (res.status !== 401)
+                this.sessionEstablished = true;
+            return res;
+        });
     }
     /**
      * Drop the session — in memory AND on disk — and lift a rejected-credential
@@ -249,14 +324,15 @@ export class MhlbAuth {
         this.manager = null;
         this.loginInFlight = null;
         this.credentialRejected = null;
+        this.sessionEstablished = false;
         createTokenCache()?.clear();
     }
     /** Raw fetch through the injected implementation (no auth attached). */
     fetch(url, init) {
         return this.fetchImpl(url, init);
     }
-    /** Whether a session has been established in this process. */
+    /** Whether a sign-in has actually produced an access token in this process. */
     get isAuthenticated() {
-        return this.manager !== null;
+        return this.sessionEstablished;
     }
 }