untappd-mcp 2.2.0 → 2.2.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Untappd — beers, breweries, venues, check-ins, wishlists, and your friend feed",
-    "version": "2.2.0"
+    "version": "2.2.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Untappd",
       "source": "./",
       "description": "MCP server for Untappd — search beers/breweries/venues, read profiles/check-ins/wishlists, and post check-ins, toasts, and comments",
-      "version": "2.2.0",
+      "version": "2.2.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "untappd-mcp",
   "displayName": "Untappd",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "MCP server for Untappd — search beers/breweries/venues, read check-ins and wishlists, and post check-ins, toasts, and comments",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -36,7 +36,7 @@ it goes stale.
 | `UNTAPPD_USER_AGENT` | no | Override the User-Agent (default mimics the app). |
 | `UNTAPPD_TIMEZONE` | no | IANA timezone (e.g. `America/New_York`) that check-ins are stamped with when the call doesn't pass `timezone`. Set it when the server runs somewhere other than the drinker's zone (e.g. a hosted connector, usually UTC). Defaults to the server process's zone. |
 | `UNTAPPD_PHOTO_DIR` | no | Restrict `untappd_checkin`'s `photo_path` to files inside this directory (several allowed, separated by `:`). Recommended wherever the model can be steered by untrusted content. |
-| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`). Local/stdio only. |
+| `UNTAPPD_CACHE_DB` | no | Path to the local check-in cache SQLite file (default `~/.untappd-mcp/checkins.db`; created owner-only — dir `0700`, file `0600`). Local/stdio only. |
 
 Copy `.env.example` to `.env` and fill it in for local use.
 
@@ -86,7 +86,7 @@ Writes (each asks you to confirm first — see [Confirmations](#confirmations)):
 
 Check-in cache: `untappd_sync_checkins`, `untappd_sync_user_beers`,
 `untappd_cache_has_had`, `untappd_cache_has_had_many`, `untappd_cache_not_had`,
-`untappd_cache_query`, `untappd_top_not_had`.
+`untappd_cache_query`, `untappd_top_not_had`, `untappd_cache_forget`.
 
 ## Check-in cache
 
@@ -149,6 +149,15 @@ Syncing **another** user goes through the same authed endpoint as
 account is public or your friend. Otherwise the sync returns a clear error
 telling you to add them as a friend first.
 
+**Retention.** Nothing in the cache expires: synced rows — including another
+user's dated check-ins, comments and venues — stay until you remove them. The
+file is created owner-only (directory `0700`, database `0600`, and older
+installs are tightened on open). `untappd_cache_forget` deletes one user's
+cached check-ins, distinct-beers list and sync state after a confirmation
+(preview shows the username and row counts); it touches only the local cache,
+never Untappd, and a later sync can re-fetch. Deleting the file removes
+everything.
+
 A cache holds only the check-ins the account it belongs to was allowed to
 fetch. `untappd_healthcheck` reports the running version and the exact tool set
 (count + names + a stable hash), so you can confirm which build is serving.

package/dist/bundle.js

@@ -58560,7 +58560,7 @@ function toolAnnotations(opts = {}) {
 }
 
 // src/version.ts
-var VERSION = "2.2.0";
+var VERSION = "2.2.1";
 
 // src/client.ts
 import { dirname as dirname2, join as join2 } from "path";
@@ -59378,6 +59378,22 @@ var CheckinStoreCore = class {
       [...params, limit]
     );
   }
+  /** Delete one user's cached rows (case-insensitive) in a single transaction. */
+  forgetUser(username) {
+    const key = username.toLowerCase();
+    const count2 = (table) => Number(this.db.get(`SELECT COUNT(*) AS n FROM ${table} WHERE username = ?`, [key])?.n ?? 0);
+    const removed = {
+      checkins: count2("checkins"),
+      distinct_beers: count2("distinct_beers"),
+      sync_state: count2("sync_state")
+    };
+    this.db.transaction(() => {
+      this.db.run("DELETE FROM checkins WHERE username = ?", [key]);
+      this.db.run("DELETE FROM distinct_beers WHERE username = ?", [key]);
+      this.db.run("DELETE FROM sync_state WHERE username = ?", [key]);
+    });
+    return removed;
+  }
   getBeerMeta(bids) {
     if (bids.length === 0) return [];
     const placeholders = bids.map(() => "?").join(", ");
@@ -59458,6 +59474,9 @@ var LocalCacheStore = class {
   async upsertBeerMeta(rows) {
     this.core.upsertBeerMeta(rows);
   }
+  async forgetUser(username) {
+    return this.core.forgetUser(username);
+  }
 };
 function escapeLike(s) {
   return s.replace(/[%_]/g, " ");
@@ -60293,7 +60312,13 @@ async function checkPhoto(photoPath) {
       hint: "Attach a normal-sized JPEG or PNG photo."
     });
   }
-  const sniffed = sniffMimeBytes(await readFileHead(real, 16));
+  let head;
+  try {
+    head = await readFileHead(real, 16, { allowedRoots: roots });
+  } catch {
+    throw new McpToolError("Photo file not found or not readable.");
+  }
+  const sniffed = sniffMimeBytes(head);
   if (sniffed !== PHOTO_CONTENT_TYPES[ext]) {
     throw createHelpfulError(
       sniffed === "image/jpeg" || sniffed === "image/png" ? `Photo content (${sniffed}) does not match its .${ext} extension.` : "The file is not a JPEG or PNG image.",
@@ -61288,11 +61313,48 @@ function registerCacheTools(server, client2, cacheProvider) {
       });
     }
   );
+  server.registerTool(
+    "untappd_cache_forget",
+    {
+      title: "Forget a user's cached check-ins",
+      description: `Delete everything the LOCAL cache holds for one user \u2014 their cached check-ins (beer, rating, comment, venue, date), distinct-beers list and sync state \u2014 e.g. after syncing a friend you no longer want a history of. Only the local cache is touched; nothing on Untappd changes, and a later sync can re-fetch it. Shared beer metadata is kept. The preview shows the username and exactly how many rows will be removed. Omit username for your own account. ${CONFIRM_FLOW}`,
+      annotations: toolAnnotations({ title: "Forget a user's cached check-ins", readOnly: false, idempotent: true, openWorld: false, destructive: true }),
+      inputSchema: external_exports.object({
+        username: UsernameArg2,
+        confirmToken: confirmTokenParam
+      })
+    },
+    async ({ username, confirmToken }, ctx) => {
+      const user = resolveUser2(username, client2.loginName);
+      const cache = cacheProvider();
+      const counts = {
+        checkins: await cache.cachedCount(user),
+        distinct_beers: await cache.distinctBeersCount(user)
+      };
+      const gate = await confirmWrite(ctx, {
+        tool: "untappd_cache_forget",
+        action: "untappd.cache_forget",
+        message: `Review and confirm deleting ${user}'s data from the local Untappd cache:`,
+        confirmToken,
+        target: user.toLowerCase(),
+        payload: { username: user.toLowerCase(), ...counts },
+        preview: {
+          action: "cache_forget",
+          username: user,
+          ...counts,
+          note: "Deletes these rows from the LOCAL cache only; Untappd itself is unchanged and a re-sync can restore them."
+        }
+      });
+      if (gate) return gate;
+      const removed = await cache.forgetUser(user);
+      return minifiedResult({ forgotten: true, username: user, removed });
+    }
+  );
 }
 
 // src/cache/db.ts
 import { DatabaseSync } from "node:sqlite";
-import { mkdirSync } from "node:fs";
+import { chmodSync, closeSync, existsSync as existsSync2, mkdirSync, openSync } from "node:fs";
 import { dirname as dirname3, join as join3 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 var NodeSqlDriver = class {
@@ -61329,15 +61391,39 @@ var CheckinCache = class _CheckinCache extends LocalCacheStore {
     this.db = db;
   }
   db;
-  /** Open (creating parent dirs) a file-backed cache, or `:memory:` for tests. */
+  /**
+   * Open (creating parent dirs) a file-backed cache, or `:memory:` for tests.
+   * The file holds other people's dated check-in and venue history, so it is
+   * kept owner-only: dirs 0700, the db (and any -wal/-shm/-journal) 0600.
+   */
   static open(path) {
-    if (path !== ":memory:") mkdirSync(dirname3(path), { recursive: true });
-    return new _CheckinCache(new DatabaseSync(path));
+    if (path !== ":memory:") preparePrivateFile(path);
+    const cache = new _CheckinCache(new DatabaseSync(path));
+    if (path !== ":memory:") tightenSidecars(path);
+    return cache;
   }
   close() {
     this.db.close();
   }
 };
+function preparePrivateFile(path) {
+  const dir = dirname3(path);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  bestEffortChmod(dir, 448);
+  if (!existsSync2(path)) closeSync(openSync(path, "a", 384));
+  bestEffortChmod(path, 384);
+}
+function tightenSidecars(path) {
+  for (const suffix of ["-wal", "-shm", "-journal"]) {
+    if (existsSync2(path + suffix)) bestEffortChmod(path + suffix, 384);
+  }
+}
+function bestEffortChmod(path, mode) {
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
+}
 function defaultCachePath() {
   return readEnvVar("UNTAPPD_CACHE_DB") ?? join3(homedir2(), ".untappd-mcp", "checkins.db");
 }

package/dist/cache/db.js

@@ -1,5 +1,5 @@
 import { DatabaseSync } from 'node:sqlite';
-import { mkdirSync } from 'node:fs';
+import { chmodSync, closeSync, existsSync, mkdirSync, openSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { readEnvVar } from '@chrischall/mcp-utils';
@@ -46,16 +46,53 @@ export class CheckinCache extends LocalCacheStore {
         super(new CheckinStoreCore(new NodeSqlDriver(db)));
         this.db = db;
     }
-    /** Open (creating parent dirs) a file-backed cache, or `:memory:` for tests. */
+    /**
+     * Open (creating parent dirs) a file-backed cache, or `:memory:` for tests.
+     * The file holds other people's dated check-in and venue history, so it is
+     * kept owner-only: dirs 0700, the db (and any -wal/-shm/-journal) 0600.
+     */
     static open(path) {
         if (path !== ':memory:')
-            mkdirSync(dirname(path), { recursive: true });
-        return new CheckinCache(new DatabaseSync(path));
+            preparePrivateFile(path);
+        const cache = new CheckinCache(new DatabaseSync(path));
+        if (path !== ':memory:')
+            tightenSidecars(path);
+        return cache;
     }
     close() {
         this.db.close();
     }
 }
+/**
+ * Create the cache's directory (0700 — `mode` applies to every dir mkdir
+ * creates) and the db file itself (0600) BEFORE SQLite opens it, so the file is
+ * never briefly umask-readable. Pre-existing loose entries from older versions
+ * are tightened too; chmod failures (e.g. a shared dir the user doesn't own)
+ * are best-effort, never fatal.
+ */
+function preparePrivateFile(path) {
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    bestEffortChmod(dir, 0o700);
+    if (!existsSync(path))
+        closeSync(openSync(path, 'a', 0o600));
+    bestEffortChmod(path, 0o600);
+}
+/** SQLite side files inherit the db's mode, but re-assert in case a loose one lingers. */
+function tightenSidecars(path) {
+    for (const suffix of ['-wal', '-shm', '-journal']) {
+        if (existsSync(path + suffix))
+            bestEffortChmod(path + suffix, 0o600);
+    }
+}
+function bestEffortChmod(path, mode) {
+    try {
+        chmodSync(path, mode);
+    }
+    catch {
+        /* best-effort — not every filesystem supports POSIX modes */
+    }
+}
 /** Default on-disk cache path: `$UNTAPPD_CACHE_DB` or `~/.untappd-mcp/checkins.db`. */
 export function defaultCachePath() {
     return readEnvVar('UNTAPPD_CACHE_DB') ?? join(homedir(), '.untappd-mcp', 'checkins.db');

package/dist/cache/store.js

@@ -466,6 +466,22 @@ export class CheckinStoreCore {
         const limit = Math.min(Math.max(filters.limit ?? 25, 1), 200);
         return this.db.all(`SELECT * FROM checkins WHERE ${where.join(' AND ')} ORDER BY ${order} LIMIT ?`, [...params, limit]);
     }
+    /** Delete one user's cached rows (case-insensitive) in a single transaction. */
+    forgetUser(username) {
+        const key = username.toLowerCase();
+        const count = (table) => Number(this.db.get(`SELECT COUNT(*) AS n FROM ${table} WHERE username = ?`, [key])?.n ?? 0);
+        const removed = {
+            checkins: count('checkins'),
+            distinct_beers: count('distinct_beers'),
+            sync_state: count('sync_state'),
+        };
+        this.db.transaction(() => {
+            this.db.run('DELETE FROM checkins WHERE username = ?', [key]);
+            this.db.run('DELETE FROM distinct_beers WHERE username = ?', [key]);
+            this.db.run('DELETE FROM sync_state WHERE username = ?', [key]);
+        });
+        return removed;
+    }
     getBeerMeta(bids) {
         if (bids.length === 0)
             return [];
@@ -540,6 +556,9 @@ export class LocalCacheStore {
     async upsertBeerMeta(rows) {
         this.core.upsertBeerMeta(rows);
     }
+    async forgetUser(username) {
+        return this.core.forgetUser(username);
+    }
 }
 // Escape LIKE wildcards in user input so a literal % or _ isn't treated as a
 // wildcard. Our LIKE patterns don't set an ESCAPE clause, so we simply strip the

package/dist/tools/cache.js

@@ -1,8 +1,9 @@
 import { z } from 'zod';
-import { RateLimitError, createHelpfulError, minifiedResult, toolAnnotations } from '@chrischall/mcp-utils';
+import { RateLimitError, confirmTokenParam, createHelpfulError, minifiedResult, toolAnnotations } from '@chrischall/mcp-utils';
 import { beerMetaFrom } from '../cache/store.js';
 import { syncCheckins } from '../cache/sync.js';
 import { syncUserBeers } from '../cache/sync-beers.js';
+import { CONFIRM_FLOW, confirmWrite } from './confirm.js';
 // Re-fetch cached beer metadata at most this often; a hit newer than this skips
 // the beer/info API call.
 const BEER_META_TTL_MS = 30 * 24 * 60 * 60 * 1000;
@@ -386,4 +387,44 @@ export function registerCacheTools(server, client, cacheProvider) {
             freshness: await freshness(cache, user),
         });
     });
+    server.registerTool('untappd_cache_forget', {
+        title: "Forget a user's cached check-ins",
+        description: "Delete everything the LOCAL cache holds for one user — their cached check-ins (beer, rating, comment, venue, " +
+            'date), distinct-beers list and sync state — e.g. after syncing a friend you no longer want a history of. Only ' +
+            'the local cache is touched; nothing on Untappd changes, and a later sync can re-fetch it. Shared beer ' +
+            'metadata is kept. The preview shows the username and exactly how many rows will be removed. Omit username ' +
+            `for your own account. ${CONFIRM_FLOW}`,
+        annotations: toolAnnotations({ title: "Forget a user's cached check-ins", readOnly: false, idempotent: true, openWorld: false, destructive: true }),
+        inputSchema: z.object({
+            username: UsernameArg,
+            confirmToken: confirmTokenParam,
+        }),
+    }, async ({ username, confirmToken }, ctx) => {
+        const user = resolveUser(username, client.loginName);
+        const cache = cacheProvider();
+        // Bound into the token: if a sync adds rows after the preview, the
+        // token no longer matches and the user re-confirms the real counts.
+        const counts = {
+            checkins: await cache.cachedCount(user),
+            distinct_beers: await cache.distinctBeersCount(user),
+        };
+        const gate = await confirmWrite(ctx, {
+            tool: 'untappd_cache_forget',
+            action: 'untappd.cache_forget',
+            message: `Review and confirm deleting ${user}'s data from the local Untappd cache:`,
+            confirmToken,
+            target: user.toLowerCase(),
+            payload: { username: user.toLowerCase(), ...counts },
+            preview: {
+                action: 'cache_forget',
+                username: user,
+                ...counts,
+                note: 'Deletes these rows from the LOCAL cache only; Untappd itself is unchanged and a re-sync can restore them.',
+            },
+        });
+        if (gate)
+            return gate;
+        const removed = await cache.forgetUser(user);
+        return minifiedResult({ forgotten: true, username: user, removed });
+    });
 }

package/dist/tools/checkin.js

@@ -64,7 +64,15 @@ async function checkPhoto(photoPath) {
             hint: 'Attach a normal-sized JPEG or PNG photo.',
         });
     }
-    const sniffed = sniffMimeBytes(await readFileHead(real, 16));
+    // Re-check UNTAPPD_PHOTO_DIR at open time, so a swap after the check above can't escape it.
+    let head;
+    try {
+        head = await readFileHead(real, 16, { allowedRoots: roots });
+    }
+    catch {
+        throw new McpToolError('Photo file not found or not readable.');
+    }
+    const sniffed = sniffMimeBytes(head);
     if (sniffed !== PHOTO_CONTENT_TYPES[ext]) {
         throw createHelpfulError(sniffed === 'image/jpeg' || sniffed === 'image/png'
             ? `Photo content (${sniffed}) does not match its .${ext} extension.`

package/dist/version.js

@@ -3,4 +3,4 @@
 // json's `extra-files`), and `versionSyncTest` guards that it stays equal to
 // package.json. Import VERSION wherever the version is needed rather than
 // re-declaring it.
-export const VERSION = '2.2.0'; // x-release-please-version
+export const VERSION = '2.2.1'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "untappd-mcp",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "mcpName": "io.github.chrischall/untappd-mcp",
   "description": "Untappd MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/untappd-mcp",
     "source": "github"
   },
-  "version": "2.2.0",
+  "version": "2.2.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "untappd-mcp",
-      "version": "2.2.0",
+      "version": "2.2.1",
       "transport": {
         "type": "stdio"
       },

package/skills/untappd-mcp/SKILL.md

@@ -42,7 +42,7 @@ Most user tools default `username` to your configured account when omitted.
 
 ## Response shape (`view`)
 
-Thirteen of this server's 45 tools take `view: "compact" | "full"`, and
+Thirteen of this server's 46 tools take `view: "compact" | "full"`, and
 **`compact` is the DEFAULT** — the slim rung is what you get without asking
 for it.
 
@@ -104,14 +104,14 @@ silently manufactured.
 `full` already IS the upstream response and a third value would silently alias
 one that exists.
 
-### The 32 tools without `view`
+### The 33 tools without `view`
 
 Each for its own reason — and none of them will tell you it ignored the
 parameter, because an undeclared key is dropped by zod without a warning:
 
-- **The 11 confirmation-gated writes** (`untappd_checkin`, `untappd_toast`,
+- **The 12 confirmation-gated writes** (`untappd_checkin`, `untappd_toast`,
   `untappd_add_comment`, the two deletes, the wishlist pair, the four friend
-  actions) answer with a confirmation preview or a receipt. Nothing in a receipt is
+  actions, and the local `untappd_cache_forget`) answer with a confirmation preview or a receipt. Nothing in a receipt is
   decoration.
 - **`untappd_sync_checkins` / `untappd_sync_user_beers`** answer with sync
   PROGRESS — pages walked, `another_run_needed`, `backfill_complete`. Slimming
@@ -190,6 +190,12 @@ Query tools (has-had ones consult BOTH sources — a hit in either = had):
 - `untappd_cache_query` — filter cached check-ins by brewery, style, `min_rating`,
   venue, and date range.
 
+**Retention.** The cache keeps what you sync until you remove it — including
+friends' dated check-ins, comments and venues. `untappd_cache_forget` (confirmation-gated)
+deletes one user's check-ins, distinct beers and sync state from the LOCAL cache
+only; Untappd is untouched and a later sync can re-fetch. The file is created
+owner-only (dir `0700`, file `0600`).
+
 Every cache read returns a `freshness` block reporting each source's completeness
 separately (plus `coverage_complete` and a `caveat` when incomplete), so you can
 flag a "not found" as possibly a false negative until the relevant sync finishes.