ofw-mcp 2.18.0 → 2.19.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.18.0"
+    "version": "2.19.0"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.18.0",
+      "version": "2.19.0",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.18.0",
+  "version": "2.19.0",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"

package/dist/auth-password.js

@@ -9,6 +9,7 @@
 // This file exists as a standalone helper (not a method on `OFWClient`) so
 // `resolveAuth()` in `./auth.ts` can call it without a Client instance, and
 // so tests can mock it at the module boundary.
+import { currentCallSignal } from '@chrischall/mcp-utils';
 import { BASE_URL, OFW_PROTOCOL_HEADERS, OFW_TOKEN_TTL_MS, assertOfwUrl } from './protocol.js';
 export async function loginWithPassword(username, password) {
     // Step 1: get a SESSION cookie (Spring Security refuses the POST without it).
@@ -17,6 +18,10 @@ export async function loginWithPassword(username, password) {
     const initResponse = await fetch(initUrl, {
         headers: { ...OFW_PROTOCOL_HEADERS },
         redirect: 'manual',
+        // Honour a caller who has given up (mcp-utils `cancel`). A sign-in
+        // nobody is waiting for should not keep hitting OFW, which counts
+        // failed attempts against the account.
+        signal: currentCallSignal(),
     });
     // headers.get('set-cookie') folds multiple Set-Cookie headers into one
     // comma-joined string; getSetCookie() preserves them individually. Echo
@@ -30,6 +35,7 @@ export async function loginWithPassword(username, password) {
     assertOfwUrl(loginUrl);
     const response = await fetch(loginUrl, {
         method: 'POST',
+        signal: currentCallSignal(),
         headers: {
             ...OFW_PROTOCOL_HEADERS,
             Accept: 'application/json',

package/dist/bundle.js

@@ -3710,6 +3710,24 @@ var require_websocket_server = __commonJS({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/cancel/index.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+function withCallSignal(signal, fn) {
+  return signal ? storage.run({ signal }, fn) : fn();
+}
+function currentCallSignal() {
+  return storage.getStore()?.signal;
+}
+function withAmbientCancellation(own2) {
+  const ambient = currentCallSignal();
+  if (!ambient)
+    return own2;
+  if (!own2)
+    return ambient;
+  return AbortSignal.any([own2, ambient]);
+}
+
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
 var __defProp2 = Object.defineProperty;
@@ -38155,17 +38173,41 @@ Hint: ${err.hint}`);
   }
   throw err;
 }
+function callSignalFrom(args) {
+  const ctx = args.at(-1);
+  if (typeof ctx !== "object" || ctx === null)
+    return void 0;
+  const req = ctx.mcpReq;
+  if (typeof req !== "object" || req === null)
+    return void 0;
+  const signal = req.signal;
+  return signal instanceof AbortSignal ? signal : void 0;
+}
 function surfaceToolHints(server) {
   const register2 = server.registerTool.bind(server);
-  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => {
-    let result;
-    try {
-      result = cb(...args);
-    } catch (err) {
-      return hintResultOrRethrow(err);
-    }
-    return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
-  });
+  server.registerTool = (name, config2, cb) => register2(name, config2, (...args) => (
+    // THE CALLER'S CANCELLATION, made ambient for the whole handler
+    // (`cancel/index.ts`). The SDK delivers it and the fleet ignored it:
+    // measured against @modelcontextprotocol/server 2.0.0, a cancelled
+    // call aborts `ctx.mcpReq.signal` with the caller's reason and the
+    // handler runs to completion regardless — so the HTTP request stays
+    // in flight, the child keeps burning metered CPU, and the upstream
+    // keeps being hit for somebody who has gone. claude.ai sent 101
+    // cancellations in the week to 2026-09-20.
+    //
+    // Here because this is the one wrapper every tool already passes
+    // through: threading the signal by hand would mean editing several
+    // hundred handlers and missing exactly the ones nobody edits.
+    withCallSignal(callSignalFrom(args), () => {
+      let result;
+      try {
+        result = cb(...args);
+      } catch (err) {
+        return hintResultOrRethrow(err);
+      }
+      return result instanceof Promise ? result.catch(hintResultOrRethrow) : result;
+    })
+  ));
 }
 async function createMcpServer(opts) {
   const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
@@ -43922,13 +43964,18 @@ async function loginWithPassword(username, password) {
   assertOfwUrl(initUrl);
   const initResponse = await fetch(initUrl, {
     headers: { ...OFW_PROTOCOL_HEADERS },
-    redirect: "manual"
+    redirect: "manual",
+    // Honour a caller who has given up (mcp-utils `cancel`). A sign-in
+    // nobody is waiting for should not keep hitting OFW, which counts
+    // failed attempts against the account.
+    signal: currentCallSignal()
   });
   const sessionCookie = initResponse.headers.getSetCookie().map((c) => c.split(";")[0]).join("; ");
   const loginUrl = `${BASE_URL}/ofw/login`;
   assertOfwUrl(loginUrl);
   const response = await fetch(loginUrl, {
     method: "POST",
+    signal: currentCallSignal(),
     headers: {
       ...OFW_PROTOCOL_HEADERS,
       Accept: "application/json",
@@ -43965,7 +44012,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.18.0",
+  version: "2.19.0",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -43999,7 +44046,7 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^1.0.0",
+    "@chrischall/mcp-utils": "^2.0.0",
     "@fetchproxy/bootstrap": "^3.0.1",
     "@modelcontextprotocol/server": "^2.0.0",
     dotenv: "^17.4.2",
@@ -44278,7 +44325,15 @@ var OFWClient = class {
       response = await fetch(url2, {
         method,
         headers,
-        signal: ac.signal,
+        // THE CALLER'S CANCELLATION, folded in with our timeout (mcp-utils
+        // `cancel`). Until this the only thing that could stop an OFW
+        // request was the timeout below, so a cancelled tool call held it
+        // open for the full budget while the child burned the CPU
+        // mcp-host meters it on. The timeout diagnosis below is unaffected
+        // because it asks `ac.signal`, OUR controller — a caller's abort
+        // falls through to the generic path rather than being reported as
+        // OFW being slow.
+        signal: withAmbientCancellation(ac.signal),
         ...body !== void 0 ? { body: isFormData ? body : JSON.stringify(body) } : {}
       });
     } catch (err) {
@@ -48952,7 +49007,7 @@ var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
 await runMcp({
   name: "ofw",
-  version: "2.18.0",
+  version: "2.19.0",
   // x-release-please-version
   deps: client,
   tools: [

package/dist/client.js

@@ -1,4 +1,4 @@
-import { loadDotenvSafely, parseBoolEnv, redactSecrets } from '@chrischall/mcp-utils';
+import { loadDotenvSafely, parseBoolEnv, redactSecrets, withAmbientCancellation } from '@chrischall/mcp-utils';
 import { TokenManager } from '@chrischall/mcp-utils/session';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
@@ -190,7 +190,15 @@ export class OFWClient {
             response = await fetch(url, {
                 method,
                 headers,
-                signal: ac.signal,
+                // THE CALLER'S CANCELLATION, folded in with our timeout (mcp-utils
+                // `cancel`). Until this the only thing that could stop an OFW
+                // request was the timeout below, so a cancelled tool call held it
+                // open for the full budget while the child burned the CPU
+                // mcp-host meters it on. The timeout diagnosis below is unaffected
+                // because it asks `ac.signal`, OUR controller — a caller's abort
+                // falls through to the generic path rather than being reported as
+                // OFW being slow.
+                signal: withAmbientCancellation(ac.signal),
                 ...(body !== undefined ? { body: isFormData ? body : JSON.stringify(body) } : {}),
             });
         }

package/dist/index.js

@@ -36,7 +36,7 @@ const nodeAttachmentIO = new NodeAttachmentIO();
 // always succeeds before any credential check runs.
 await runMcp({
     name: 'ofw',
-    version: '2.18.0', // x-release-please-version
+    version: '2.19.0', // x-release-please-version
     deps: client,
     tools: [
         registerHealthcheckTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.18.0",
+  "version": "2.19.0",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -34,7 +34,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^1.0.0",
+    "@chrischall/mcp-utils": "^2.0.0",
     "@fetchproxy/bootstrap": "^3.0.1",
     "@modelcontextprotocol/server": "^2.0.0",
     "dotenv": "^17.4.2",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.18.0",
+  "version": "2.19.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.18.0",
+      "version": "2.19.0",
       "transport": {
         "type": "stdio"
       },