myhotlunchbox-mcp 1.2.6 → 1.2.7

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
-    "version": "1.2.6"
+    "version": "1.2.7"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "My Hot Lunchbox",
       "source": "./",
       "description": "MCP server for My Hot Lunchbox — school lunch calendar, ordering, and payments. Signs in server-side with the parent account credentials.",
-      "version": "1.2.6",
+      "version": "1.2.7",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "myhotlunchbox-mcp",
   "displayName": "My Hot Lunchbox",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "description": "MCP server for My Hot Lunchbox — order school lunches, manage students, and track payments via natural language",
   "author": {
     "name": "Chris Hall",

package/.mcp.json

@@ -1,9 +1,10 @@
 {
   "mcpServers": {
     "myhotlunchbox": {
-      "command": "node",
+      "command": "npx",
       "args": [
-        "${CLAUDE_PLUGIN_ROOT}/dist/index.js"
+        "-y",
+        "myhotlunchbox-mcp"
       ],
       "env": {
         "MYHOTLUNCHBOX_USERNAME": "${MYHOTLUNCHBOX_USERNAME}",

package/dist/bundle.js

@@ -84,6 +84,7 @@ var require_util = __commonJS({
     exports.explicitlyAborted = explicitlyAborted2;
     exports.prefixIssues = prefixIssues2;
     exports.unwrapMessage = unwrapMessage2;
+    exports.sizeCaps = sizeCaps2;
     exports.attachSchema = attachSchema2;
     exports.finalizeIssue = finalizeIssue2;
     exports.getSizableOrigin = getSizableOrigin2;
@@ -618,6 +619,18 @@ var require_util = __commonJS({
     function unwrapMessage2(message) {
       return typeof message === "string" ? message : message?.message;
     }
+    function sizeCaps2(defChecks) {
+      const caps = [];
+      for (const ch of defChecks ?? []) {
+        const d = ch._zod.def;
+        if (!/_(length|size)$|_equals$/.test(d.check))
+          break;
+        const max = d.maximum ?? d.length ?? d.size;
+        if (max >= 0)
+          caps.push([max, ch]);
+      }
+      return caps;
+    }
     function attachSchema2(issues, start, inst) {
       var _a3;
       for (let i = start; i < issues.length; i++) {
@@ -2282,7 +2295,7 @@ var require_versions = __commonJS({
     exports.version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 7
     };
     (function() {
       var keys = Object.getOwnPropertyNames(exports);
@@ -3116,6 +3129,31 @@ var require_schemas = __commonJS({
         return payload;
       };
     });
+    function capSize2(inst, size) {
+      const caps = util.sizeCaps(inst._zod.def.checks);
+      if (!caps.length)
+        return;
+      const cap = Math.min(...caps.map((c) => c[0]));
+      const parse3 = inst._zod.parse;
+      inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+          for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+            if (n > max && ch._zod.def.when(payload)) {
+              const start = payload.issues.length;
+              ch._zod.check(payload);
+              payload.issues[start].continue = false;
+              util.attachSchema(payload.issues, start, inst);
+              return payload;
+            }
+          }
+        }
+        return parse3(payload, ctx);
+      };
+    }
+    var arraySize2 = (input2) => Array.isArray(input2) ? input2.length : -1;
+    var mapSize2 = (input2) => input2 instanceof Map ? input2.size : -1;
+    var setSize2 = (input2) => input2 instanceof Set ? input2.size : -1;
     function handleArrayResult2(result, final, index) {
       if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -3159,6 +3197,7 @@ var require_schemas = __commonJS({
         }
         return payload;
       };
+      capSize2(inst, arraySize2);
     });
     function handlePropertyResult2(result, final, key, input2, optin, optout) {
       const isPresent = key in input2;
@@ -4115,6 +4154,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, mapSize2);
     });
     function handleMapResult2(keyResult, valueResult, final, key, input2, inst, ctx) {
       if (keyResult.issues.length) {
@@ -4181,6 +4221,7 @@ var require_schemas = __commonJS({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize2(inst, setSize2);
     });
     function handleSetResult2(result, final) {
       if (result.issues.length) {
@@ -16285,9 +16326,15 @@ ${code2}
       doc.write(`}`);
       return outputVar;
     }
+    function generateSizeGate2(doc, schema, size) {
+      for (const [max, check2] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand2(max, check2._zod.def.check)}) return INVALID;`);
+      }
+    }
     function generateArrayCheck2(doc, ctx, schema, accessor, buildsValue = true) {
       const def = schema._zod.def;
       doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.length`);
       const outputVar = buildsValue ? newVar2(ctx) : null;
       const iVar = newVar2(ctx);
       const elemVar = newVar2(ctx);
@@ -16687,6 +16734,7 @@ ${code2}
     function generateMapCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const kVar = newVar2(ctx);
       const valVar = newVar2(ctx);
@@ -16703,6 +16751,7 @@ ${code2}
     function generateSetCheck2(doc, ctx, schema, accessor) {
       const def = schema._zod.def;
       doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+      generateSizeGate2(doc, schema, `${accessor}.size`);
       const outputVar = newVar2(ctx);
       const valVar = newVar2(ctx);
       doc.write(`const ${outputVar} = new Set();`);
@@ -23411,7 +23460,7 @@ function declaredDialect(schema, remedy) {
   throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${schema.$schema.slice(0, 200)}"). The default validator supports JSON Schema 2020-12, 2019-09, draft-07, and draft-06; ${remedy}`);
 }
 
-// node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var z = __toESM(require_v4(), 1);
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
@@ -38261,7 +38310,7 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+var QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
 var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -38272,6 +38321,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
+  "aws[_-]?secret[_-]?access[_-]?key",
+  // fleet-audit#1297
   "code[_-]?verifier",
   // PKCE; a bare `verifier` key is too generic for JSON
   `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -38969,6 +39020,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -39488,6 +39540,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -40908,7 +40972,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -41664,6 +41728,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -41707,6 +41796,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -42663,6 +42753,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -42729,6 +42820,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -52259,9 +52351,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -52661,6 +52759,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -52677,6 +52776,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -58881,10 +58981,34 @@ import { constants as fsConstants2, realpathSync } from "node:fs";
 var O_NOFOLLOW2 = fsConstants2.O_NOFOLLOW ?? 0;
 var O_NONBLOCK = fsConstants2.O_NONBLOCK ?? 0;
 
+// node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 var NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
+}
+var JUST_A_MOMENT = "just a moment";
+function hasJustAMomentTitle(html) {
+  const lower = asciiLower(html);
+  let i = 0;
+  for (; ; ) {
+    const open2 = lower.indexOf("<title", i);
+    if (open2 < 0)
+      return false;
+    const gt = lower.indexOf(">", open2 + 6);
+    if (gt < 0)
+      return false;
+    let j = gt + 1;
+    while (j < lower.length && /\s/.test(lower[j]))
+      j++;
+    if (lower.startsWith(JUST_A_MOMENT, j))
+      return true;
+    i = gt + 1;
+  }
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
@@ -60163,7 +60287,7 @@ var MhlbClient = class {
 };
 
 // src/version.ts
-var VERSION = "1.2.6";
+var VERSION = "1.2.7";
 
 // src/tools/_shared.ts
 var CONFIRMS = ` ${CONFIRM_FLOW_SENTENCE}`;
@@ -60843,6 +60967,8 @@ function* candidateNames(filename) {
   for (let n = 2; ; n += 1) yield `${stem} (${n})${ext}`;
 }
 var MAX_NAME_ATTEMPTS = 1e3;
+var REPORT_FILE_MODE = 384;
+var REPORT_DIR_MODE = 448;
 function writeWithoutClobbering(dir, filename, bytes) {
   let attempts = 0;
   for (const name of candidateNames(filename)) {
@@ -60850,7 +60976,7 @@ function writeWithoutClobbering(dir, filename, bytes) {
     attempts += 1;
     const candidate = join4(dir, name);
     try {
-      writeFileSync3(candidate, bytes, { flag: "wx" });
+      writeFileSync3(candidate, bytes, { flag: "wx", mode: REPORT_FILE_MODE });
       return candidate;
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
@@ -60892,7 +61018,7 @@ function deliver(bytes, contentType, filename, inline) {
   const dir = outputDir();
   let path;
   try {
-    mkdirSync5(dir, { recursive: true });
+    mkdirSync5(dir, { recursive: true, mode: REPORT_DIR_MODE });
     path = writeWithoutClobbering(dir, filename, bytes);
   } catch (cause) {
     if (cause instanceof McpToolError) throw cause;

package/dist/tools/reports.js

@@ -41,6 +41,9 @@ export function* candidateNames(filename) {
 /** How many suffixed names to try before giving up. Exported so tests track
  * the real limit rather than hardcoding a copy of it. */
 export const MAX_NAME_ATTEMPTS = 1000;
+/** Report PDFs and any directory created for them are owner-only. */
+export const REPORT_FILE_MODE = 0o600;
+export const REPORT_DIR_MODE = 0o700;
 /**
  * Write the report without ever overwriting an existing file.
  *
@@ -57,7 +60,10 @@ export function writeWithoutClobbering(dir, filename, bytes) {
         attempts += 1;
         const candidate = join(dir, name);
         try {
-            writeFileSync(candidate, bytes, { flag: 'wx' });
+            // Owner-only: these PDFs carry children's names, lunch orders and
+            // receipts. `wx` (O_CREAT|O_EXCL) also never follows a symlink planted
+            // at the name — it fails EEXIST and the walk moves on.
+            writeFileSync(candidate, bytes, { flag: 'wx', mode: REPORT_FILE_MODE });
             return candidate;
         }
         catch (err) {
@@ -96,7 +102,9 @@ function deliver(bytes, contentType, filename, inline) {
     const dir = outputDir();
     let path;
     try {
-        mkdirSync(dir, { recursive: true });
+        // A directory created here is owner-only too; an existing one (e.g.
+        // ~/Downloads) is left as the user set it.
+        mkdirSync(dir, { recursive: true, mode: REPORT_DIR_MODE });
         path = writeWithoutClobbering(dir, filename, bytes);
     }
     catch (cause) {

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Single source of truth for the server version; release-please rewrites it. */
-export const VERSION = '1.2.6'; // x-release-please-version
+export const VERSION = '1.2.7'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "myhotlunchbox-mcp",
-  "version": "1.2.6",
+  "version": "1.2.7",
   "mcpName": "io.github.chrischall/myhotlunchbox-mcp",
   "description": "My Hot Lunchbox MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,7 +45,7 @@
     "capture:writes": "node scripts/capture-writes.mjs"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.0",
+    "@chrischall/mcp-utils": "^3.0.3",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.0",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/myhotlunchbox-mcp",
     "source": "github"
   },
-  "version": "1.2.6",
+  "version": "1.2.7",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "myhotlunchbox-mcp",
-      "version": "1.2.6",
+      "version": "1.2.7",
       "transport": {
         "type": "stdio"
       },