ofw-mcp 2.10.0 → 2.10.2

package/dist/cache/node.js

@@ -5,8 +5,8 @@ import { OFWCacheCore, LocalCacheStore } from './store.js';
 // The `node:sqlite` backend for the OFW message cache — a local on-disk SQLite
 // file used by the stdio/desktop server. The query logic lives in OFWCacheCore
 // (src/cache/store.ts); this file only adapts `node:sqlite` to the SqlDriver
-// surface and manages the file handle + permissions. (The hosted Cloudflare
-// connector uses a Durable Object backend instead — a later task.)
+// surface and manages the file handle + permissions. Another deployment can
+// adapt a different driver to the same surface.
 /** Adapts a `node:sqlite` DatabaseSync to the driver surface the core needs. */
 export class NodeSqlDriver {
     db;

package/dist/cache/store.js

@@ -3,9 +3,9 @@
 // All message reads (list/get/drafts/unread-sent) are served from this cache;
 // only ofw_sync_messages walks OFW for new content. The SQL lives here ONCE,
 // over a tiny synchronous {@link SqlDriver}, so the same schema/queries back
-// both engines: `node:sqlite` on the stdio/desktop server (src/cache/node.ts)
-// and a Durable Object's SQLite on the hosted Cloudflare connector (a later
-// task). This module imports nothing platform-specific.
+// any engine: `node:sqlite` is the one that ships (src/cache/node.ts), and
+// another deployment can adapt a different driver to the same surface. This
+// module imports nothing platform-specific.
 function rowFromDb(r) {
     return {
         id: r.id,
@@ -131,7 +131,7 @@ export const SCHEMA_STATEMENTS = [
  * every open. SQLite has no `ADD COLUMN IF NOT EXISTS`, so each statement runs
  * inside a try/catch — re-running against an already-migrated DB throws
  * "duplicate column name", which is swallowed. Driver-agnostic: both
- * `node:sqlite` and the Durable Object's SQLite raise synchronously.
+ * `node:sqlite` raises synchronously, as any conforming driver must.
  */
 export const MIGRATIONS = [
     // Resumable deep-sync cursor. Absent/NULL → SyncState.resumePage null.
@@ -222,7 +222,7 @@ export class OFWCacheCore {
     }
     /**
      * Batch upsert every row in a single transaction — one round-trip's worth of
-     * work (crucial on the Durable Object backend, where each RPC is a subrequest).
+     * work (crucial where each round trip is a billed request).
      * Empty array is a no-op (no transaction opened).
      */
     upsertMessages(rows) {
@@ -351,8 +351,8 @@ export class OFWCacheCore {
         return r ? lineageFromDb(r) : null;
     }
     /**
-     * Batch read — one query for a whole page of drafts. On the Durable Object
-     * backend each cache call is a subrequest, so a per-draft lookup would spend
+     * Batch read — one query for a whole page of drafts. Where the cache is
+     * remote each cache call is a subrequest, so a per-draft lookup would spend
      * the caller's sync budget on bookkeeping.
      */
     getDraftLineageByIds(ids) {
@@ -463,7 +463,7 @@ export class OFWCacheCore {
 }
 /**
  * Adapts a synchronous {@link OFWCacheCore} to the async {@link CacheStore}
- * interface. Used by the in-process node backend; the Durable Object backend
+ * interface. Used by the in-process node backend; a remote backend
  * implements CacheStore over a real RPC boundary instead.
  */
 export class LocalCacheStore {

package/dist/client.js

@@ -6,16 +6,16 @@ import { resolveAuth } from './auth.js';
 import { BASE_URL, OFW_PROTOCOL_HEADERS, OFW_TOKEN_TTL_MS, OFW_TOKEN_EXPIRY_SKEW_MS } from './protocol.js';
 // Load .env for local dev; silently skip if dotenv is unavailable (e.g. mcpb
 // bundle). loadDotenvSafely applies override:false + quiet:true and swallows a
-// missing dotenv module. The try/catch additionally guards the Cloudflare
-// Worker runtime, where `import.meta.url` is undefined and
-// `fileURLToPath(undefined)` would otherwise throw at module init (Worker
+// missing dotenv module. The try/catch additionally guards a runtime where
+// `import.meta.url` is undefined and `fileURLToPath(undefined)` would
+// otherwise throw at module init (a failure at
 // startup validation) — there is no filesystem / .env to load there anyway.
 try {
     const dir = dirname(fileURLToPath(import.meta.url));
     await loadDotenvSafely({ path: join(dir, '..', '.env') });
 }
 catch {
-    /* v8 ignore next -- only reached in a non-Node runtime (Workers): no .env to load */
+    /* v8 ignore next -- only reached in a non-Node runtime: no .env to load */
 }
 // Parse a Content-Disposition header for a filename. Prefers RFC 6266
 // `filename*=UTF-8''…` (percent-decoded) and falls back to `filename="…"`.
@@ -69,7 +69,7 @@ export class OFWClient {
     // Optional injected auth resolver. When set, the refresh callback uses it
     // instead of the module-level global `resolveAuth` (env-var → fetchproxy
     // priority). A hosted per-user deployment injects its own resolver so each
-    // request carries that user's credentials — see the Cloudflare Worker
+    // request carries that user's credentials — see the per-user
     // deployment. Left undefined by the stdio path, which falls back to the
     // global resolver, keeping that behaviour byte-for-byte identical.
     authResolver;

package/dist/config.js

@@ -144,16 +144,16 @@ export function getAutoRefreshStaleReads() {
 }
 // Default for ofw_download_attachment's `inline` arg when the caller doesn't
 // pass one. Set OFW_INLINE_ATTACHMENTS=true to have attachments returned as
-// MCP content blocks by default (skipping disk) — useful on sandboxed MCP
-// hosts where filesystem reads back to the model aren't available.
+// MCP content blocks by default (skipping disk) — necessary wherever the
+// caller cannot read the server's filesystem.
 export function getDefaultInlineAttachments() {
     return parseBoolEnv('OFW_INLINE_ATTACHMENTS');
 }
 /**
  * Per-invocation OFW-request budget for ofw_sync_messages.
  *
- * The hosted Cloudflare Worker connector enforces a subrequest cap per request
- * (every OFW API fetch and every Durable-Object cache RPC counts), so a deep
+ * A hosted deployment may enforce a request cap per call
+ * (every OFW API fetch and every cache round trip counts), so a deep
  * backfill must be bounded and resumable there. Set OFW_SYNC_MAX_REQUESTS to a
  * positive integer to cap the number of OFW requests one sync call may make
  * before pausing; the next call resumes the walk (deep or not) where it left off.

package/dist/extract/inflate.js

@@ -12,7 +12,7 @@
 // decompressed stream chunk by chunk, and abort the moment the running total
 // passes the limit. Peak memory is then bounded by the limit rather than by
 // whatever the file felt like claiming.
-/** 32 MiB. Sized to fit comfortably inside the Worker's memory budget. */
+/** 32 MiB. Sized to fit comfortably inside a constrained memory budget. */
 export const MAX_DECOMPRESSED_BYTES = 32 * 1024 * 1024;
 /**
  * Thrown when decompression is aborted for exceeding its cap. Distinct from a
@@ -31,7 +31,7 @@ export class DecompressionLimitError extends Error {
  *
  * `deflate-raw` is the ZIP member format; `deflate` is the zlib-wrapped form a
  * PDF `/FlateDecode` stream uses. Both go through the WHATWG
- * `DecompressionStream` so this runs unchanged on Node and workerd.
+ * `DecompressionStream` so this runs unchanged wherever the standard exists.
  */
 export async function inflateBounded(data, format, limit, label) {
     const stream = new Blob([data]).stream()

package/dist/extract/xml.js

@@ -2,7 +2,7 @@
 //
 // The office formats are machine-generated XML with a known, flat shape per
 // part (rows of cells, runs of text), so a scanning reader beats pulling in a
-// DOM parser that has to run in both Node and workerd. The one rule this file
+// DOM parser that has to run anywhere. The one rule this file
 // exists to enforce is that a tag match is anchored on the FULL tag name:
 // naively scanning for `<w:p` also matches `<w:pPr>`, which silently turns
 // paragraph properties into paragraphs.

package/dist/extract/zip.js

@@ -4,9 +4,10 @@
 // reading one is the first step of every office-document extractor. This is
 // deliberately not a general ZIP library: it reads the central directory,
 // slices an entry's bytes, and inflates DEFLATE members via the WHATWG
-// `DecompressionStream` — which exists in BOTH Node ≥18 and workerd, so the
-// same code runs on the stdio server and the hosted connector. Using
-// `node:zlib` here would break the Worker build; adding a userland inflate
+// `DecompressionStream` — a web standard available in Node ≥18 and in
+// sandboxed runtimes alike, so the
+// same code runs on the stdio server and a hosted deployment. Using
+// `node:zlib` here would tie this to Node; adding a userland inflate
 // dependency would bloat it. Neither is necessary.
 import { inflateBounded, MAX_DECOMPRESSED_BYTES } from './inflate.js';
 const EOCD_SIG = 0x06054b50;
@@ -16,7 +17,7 @@ const ZIP64_SENTINEL = 0xffffffff;
 /**
  * Hard ceiling on a single decompressed member (32 MiB). An attachment is a
  * co-parent-supplied file, so a zip bomb is a real (if unlikely) input, and the
- * Worker's memory budget is what is being protected.
+ * memory budget of a constrained runtime is what is being protected.
  *
  * The cap is enforced on the bytes as they arrive ({@link inflateBounded}), NOT
  * on the size the archive declares for itself. The declared size is checked too

package/dist/index.js

@@ -21,9 +21,9 @@ import { getCacheDbPath } from './config.js';
 import { NodeAttachmentIO } from './tools/attachments.js';
 // The stdio server backs the message cache with a local `node:sqlite` file,
 // opened lazily on first use (so the server still boots and answers the host's
-// install-time tools/list probe when no cache path is configured). The hosted
-// Cloudflare connector (a later task) injects a Durable-Object-backed
-// CacheStore + a filesystem-free AttachmentIO into the same registrar instead.
+// install-time tools/list probe when no cache path is configured). Both the
+// CacheStore and the AttachmentIO are injected, so a deployment with no usable
+// disk supplies its own implementations to the same registrar instead.
 let nodeCache;
 const nodeCacheProvider = () => (nodeCache ??= OFWCache.open(getCacheDbPath()));
 const nodeAttachmentIO = new NodeAttachmentIO();
@@ -35,7 +35,7 @@ const nodeAttachmentIO = new NodeAttachmentIO();
 // always succeeds before any credential check runs.
 await runMcp({
     name: 'ofw',
-    version: '2.10.0', // x-release-please-version
+    version: '2.10.2', // x-release-please-version
     deps: client,
     tools: [
         registerUserTools,

package/dist/sync.js

@@ -227,8 +227,8 @@ async function walkPages(client, folder, folderId, opts, store) {
             }
         }
         // Flush the page's rows in one transaction/RPC. Skipped entirely when the
-        // page held nothing new: on the Worker this call is a Durable-Object RPC,
-        // and a DO RPC counts against the same subrequest budget as an OFW fetch.
+        // page held nothing new: where the cache is remote this call is a round
+        // trip, counting against the same subrequest budget as an OFW fetch.
         // A deep re-walk crosses page after page of already-cached messages, so an
         // unconditional "no-op" write spends the caller's budget to store nothing.
         if (toUpsert.length > 0)
@@ -294,7 +294,7 @@ export async function syncMessageFolder(client, folder, folderId, opts, store) {
             // This was a real starvation bug. `fwd.nextPage` is just the start page
             // (1) when nothing was fetched, so the `Math.min` below would silently
             // reset a deep backfill — e.g. resumePage 87 → 1 — discarding 86 pages
-            // of progress. On the hosted Worker (OFW_SYNC_MAX_REQUESTS=40) a user
+            // of progress. Under a request budget (OFW_SYNC_MAX_REQUESTS) a user
             // with enough drafts to consume the whole budget, with drafts running
             // first, hit this on EVERY call: inbox/sent never got budget, their
             // cursor was reset every time, and the backfill could never advance.
@@ -502,7 +502,7 @@ export async function syncAll(client, opts, store) {
     // Drafts go FIRST. They are the only folder a destructive tool
     // (ofw_save_draft / ofw_delete_draft) reads as its base, and they are cheap
     // and bounded — one list page plus one detail per draft. Running them last,
-    // behind inbox and sent, meant a bounded call (the Worker's
+    // behind inbox and sent, meant a bounded call (the
     // OFW_SYNC_MAX_REQUESTS=40) spent its whole budget backfilling history and
     // deferred drafts on every single call, so server-side draft edits stayed
     // invisible indefinitely while the response reported `drafts: 0`.

package/dist/tools/attachments.js

@@ -4,8 +4,8 @@
 // writes downloaded bytes to disk (and reads them back for the inline-reuse
 // path). Those are the ONLY node:fs touch points in the message tools — they
 // live behind this {@link AttachmentIO} interface so the stdio server can use
-// the disk-backed {@link NodeAttachmentIO} while the hosted Cloudflare
-// connector (a later task) injects an inline, filesystem-free implementation.
+// the disk-backed {@link NodeAttachmentIO} while a deployment with no usable
+// disk injects an inline, filesystem-free implementation.
 // Keeping the interface here means src/tools/messages.ts imports nothing from
 // node:fs.
 import { readFileSync, statSync, mkdirSync, writeFileSync } from 'node:fs';

package/dist/tools/draft-freshness.js

@@ -7,7 +7,7 @@ export class DraftFreshnessError extends Error {
 // FNV-1a (64-bit) over a canonical encoding. Not cryptographic — this is a
 // change detector, and it is never the sole guard: an unsupplied token falls
 // back to a full field-by-field comparison against the cached base.
-// BigInt keeps it byte-identical on node and on the Workers runtime.
+// BigInt keeps it byte-identical across runtimes.
 const FNV_OFFSET = 0xcbf29ce484222325n;
 const FNV_PRIME = 0x100000001b3n;
 const MASK64 = 0xffffffffffffffffn;

package/dist/tools/lifecycle.js

@@ -164,10 +164,10 @@ function stateNote(state, cachedAsDraft, folderName) {
  * request for the map plus one per probed id.
  */
 export async function probeIds(client, store, ids, opts) {
-    // THREE cache reads for the whole batch, not three per id. On the Durable
-    // Object backend every cache call is a subrequest counting against the same
-    // hosting cap as the OFW fetches, so a per-id lookup would spend the caller's
-    // budget on bookkeeping before a single probe ran.
+    // THREE cache reads for the whole batch, not three per id. Where the cache
+    // is remote every call is a subrequest counting against the same hosting cap
+    // as the OFW fetches, so a per-id lookup would spend the caller's budget on
+    // bookkeeping before a single probe ran.
     const draftsById = new Map((await store.getDrafts(ids)).map((d) => [d.id, d]));
     const messagesById = new Map((await store.getMessages(ids)).map((m) => [m.id, m]));
     const prepared = ids.map((id) => {
@@ -294,9 +294,9 @@ export async function resolveDraftKey(store, draftKey) {
     return { currentId: chain[chain.length - 1].id, ids: chain.map((r) => r.id) };
 }
 /**
- * Mint a new stable draft identity. Uses the Web Crypto global, which both
- * Node ≥19 and the Workers runtime provide — a `node:crypto` import would not
- * bundle for the hosted connector.
+ * Mint a new stable draft identity. Uses the Web Crypto global, which Node ≥19
+ * provides natively — a `node:crypto` import would not bundle for a hosted
+ * deployment.
  */
 export function newDraftKey() {
     return `dk_${crypto.randomUUID()}`;

package/dist/tools/messages.js

@@ -81,7 +81,7 @@ const FolderCountsSchema = z.looseObject({
 /**
  * Cap on per-id probes in one ofw_check_freshness call.
  *
- * Each id costs one OFW request, and on the hosted Worker every request counts
+ * Each id costs one OFW request, and under a request budget every one counts
  * against the subrequest cap (see OFW_SYNC_MAX_REQUESTS). The check has to stay
  * cheap enough that a caller reaches for it freely — that is the entire point
  * of it existing — so it truncates loudly rather than turning into a sync.
@@ -885,7 +885,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                 const { freshness, serverConfirmed, cacheStatus } = await draftsFreshness(cache);
                 const rows = await cache.listDrafts({ page, size });
                 const total = await cache.countDrafts();
-                // One batch lookup for the whole page — on the Durable Object backend a
+                // One batch lookup for the whole page — where the cache is remote a
                 // per-draft lineage read would be a subrequest each.
                 const keyById = new Map((await cache.getDraftLineageByIds(rows.map((d) => d.id))).map((l) => [l.id, l.draftKey]));
                 // Every draft carries the concurrency token to echo back on a write, its
@@ -1250,7 +1250,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             },
         }, async (args) => {
             // Resolve the upload source through the injected attachment-I/O boundary
-            // (disk read on node; an in-memory source on the hosted connector).
+            // (disk read on node; an in-memory source on a hosted deployment).
             const { blob, fileName, mimeType: mime, sizeBytes } = await attachmentIO.resolveUpload(args.path);
             // Build the multipart payload matching the OFW web UI's request shape.
             const form = new FormData();
@@ -1298,7 +1298,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
         const fileId = args.fileId;
         const cache = cacheProvider();
         const requestedInline = args.inline ?? getDefaultInlineAttachments();
-        // When the deployment has no filesystem (hosted connector), inline is the
+        // When the deployment has no filesystem, inline is the
         // ONLY path to the bytes — force it rather than erroring on a disk write.
         // `forcedInline` records that we overrode an explicit `inline:false` so the
         // response is honest about it instead of silently ignoring the argument.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.10.0",
+  "version": "2.10.2",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -29,29 +29,20 @@
     "dev": "node --env-file=.env dist/index.js",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
-    "test:watch": "vitest",
-    "worker:dev": "wrangler dev",
-    "worker:deploy": "wrangler deploy",
-    "worker:test": "vitest run --config vitest.workers.config.ts"
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@chrischall/mcp-utils": "^0.14.0",
-    "@fetchproxy/bootstrap": "^1.7.0",
+    "@fetchproxy/bootstrap": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@chrischall/mcp-connector": "^1.1.1",
-    "@cloudflare/vitest-pool-workers": "^0.18.4",
-    "@cloudflare/workers-oauth-provider": "^0.8.1",
-    "@cloudflare/workers-types": "^5.20260708.1",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
-    "agents": "^0.19.0",
     "esbuild": "^0.28.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.7",
-    "wrangler": "^4.110.0"
+    "vitest": "^4.1.7"
   }
 }

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.10.0",
+  "version": "2.10.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.10.0",
+      "version": "2.10.2",
       "transport": {
         "type": "stdio"
       },

package/skills/ofw/SKILL.md

@@ -10,7 +10,6 @@ MCP server for OurFamilyWizard — provides read/write access to messages, calen
 - **npm:** [npmjs.com/package/ofw-mcp](https://www.npmjs.com/package/ofw-mcp)
 - **Source:** [github.com/chrischall/ofw-mcp](https://github.com/chrischall/ofw-mcp)
 
-> These tools are also available via the hosted [claude.ai](https://claude.ai) remote connector (a Cloudflare Worker) — the tool set and behaviour are identical to the local stdio install. See the repo's `docs/DEPLOY-CONNECTOR.md`.
 
 ## Setup
 

package/dist/ofw-auth.js

@@ -1,26 +0,0 @@
-import { loginWithPassword } from './auth-password.js';
-/**
- * `ConnectorAuth` for the OurFamilyWizard remote connector: the login page
- * collects the user's own OFW email/username + password, verifies them via the
- * same Spring Security form login the stdio server uses (`loginWithPassword` in
- * `auth-password.js`), and stores `{ username, password }` as the OAuth props
- * that `worker.ts`'s `buildClient` turns into a per-user `OFWClient` capable of
- * re-authenticating when its 6h token expires.
- */
-export const ofwAuth = {
-    service: 'OurFamilyWizard',
-    accent: '#00A9A5',
-    privacyNote: 'Your OFW email and password are stored encrypted and used only to sign in to OurFamilyWizard on your behalf ' +
-        '(OFW sign-in tokens expire every few hours, so your password is needed to renew them).',
-    fields: [
-        { name: 'username', label: 'OFW email or username' },
-        { name: 'password', label: 'OFW password', type: 'password' },
-    ],
-    async login(fields) {
-        // Verify the credentials up front — a bad password throws here, which the
-        // connector surfaces back on the login page. We deliberately discard the
-        // returned token: the per-user client logs in again from the stored creds.
-        await loginWithPassword(fields.username, fields.password);
-        return { username: fields.username, password: fields.password };
-    },
-};