ofw-mcp 2.19.2 → 2.19.4

package/dist/bundle.js

@@ -2279,7 +2279,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes6, createHash: createHash6 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2817,7 +2817,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes4(16).toString("base64");
+      const key = randomBytes6(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -2947,7 +2947,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3316,7 +3316,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash6 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3623,7 +3623,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3734,6 +3734,33 @@ var storage2 = new AsyncLocalStorage2();
 function withCallerCapabilities(capabilities, fn) {
   return capabilities ? storage2.run(capabilities, fn) : fn();
 }
+function currentCallerCapabilities() {
+  return storage2.getStore();
+}
+var ENVELOPE_CAPABILITIES_KEY = "io.modelcontextprotocol/clientCapabilities";
+var ELICITATION_MODES = ["form", "url"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function callerCapabilities(ctx) {
+  const envelope = isRecord(ctx) && isRecord(ctx.mcpReq) ? ctx.mcpReq.envelope : void 0;
+  if (isRecord(envelope)) {
+    const declared = envelope[ENVELOPE_CAPABILITIES_KEY];
+    if (isRecord(declared))
+      return declared;
+  }
+  return currentCallerCapabilities();
+}
+function callerAcceptsFormElicitation(ctx) {
+  const capabilities = callerCapabilities(ctx);
+  if (!capabilities)
+    return void 0;
+  const elicitation = capabilities.elicitation;
+  if (!isRecord(elicitation))
+    return false;
+  const namedModes = ELICITATION_MODES.filter((mode) => mode in elicitation);
+  return namedModes.length === 0 || namedModes.includes("form");
+}
 
 // node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
@@ -8818,7 +8845,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve4) {
+function isRecursive(inst, stack, resolve6) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -8828,7 +8855,7 @@ function isRecursive(inst, stack, resolve4) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve4);
+      const answer = isRecursive(child, stack, resolve6);
       if (answer > result)
         result = answer;
     }
@@ -8839,7 +8866,7 @@ function isRecursive(inst, stack, resolve4) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve6) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -8903,7 +8930,7 @@ function isRecursive(inst, stack, resolve4) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve6 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -27798,19 +27825,50 @@ var inputRequired = Object.assign(buildInputRequired, {
     return { method: "roots/list" };
   }
 });
+function acceptedContent(responses, key, schema) {
+  const view = inputResponse(responses, key);
+  if (view.kind !== "elicit" || view.action !== "accept" || view.content === void 0) return void 0;
+  if (schema === void 0) return view.content;
+  const outcome = schema["~standard"].validate(view.content);
+  if (outcome instanceof Promise) throw new TypeError("acceptedContent(responses, key, schema) requires a synchronously-validating schema");
+  return outcome.issues === void 0 ? outcome.value : void 0;
+}
+function inputResponse(responses, key) {
+  if (responses === void 0 || typeof responses !== "object" || responses === null) return { kind: "missing" };
+  const entry = responses[key];
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return { kind: "missing" };
+  const candidate = entry;
+  if (candidate["action"] === "accept" || candidate["action"] === "decline" || candidate["action"] === "cancel") {
+    const content = candidate["content"];
+    return {
+      kind: "elicit",
+      action: candidate["action"],
+      ...content !== null && typeof content === "object" && !Array.isArray(content) && { content }
+    };
+  }
+  if (Array.isArray(candidate["roots"])) return {
+    kind: "roots",
+    roots: candidate["roots"]
+  };
+  if (typeof candidate["role"] === "string" && candidate["content"] !== void 0) return {
+    kind: "sampling",
+    result: candidate
+  };
+  return { kind: "missing" };
+}
 var REQUEST_STATE_ONLY_LEG_PACING_MS = 250;
 function inputRequiredRoundsExceededMessage(method, maxRounds) {
   return `Multi-round-trip request '${method}' still required input after ${maxRounds} rounds (inputRequired.maxRounds)`;
 }
 function sleep(ms, signal) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     if (signal?.aborted) {
       reject(signal.reason instanceof SdkError ? signal.reason : new SdkError(SdkErrorCode.RequestTimeout, String(signal.reason)));
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve4();
+      resolve6();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -28604,7 +28662,7 @@ var Protocol = class {
     const flowStartedAt = Date.now();
     let onAbort;
     let cleanupMessageId;
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       const earlyReject = (error62) => {
         reject(error62);
       };
@@ -28672,7 +28730,7 @@ var Protocol = class {
         }
         if (decoded.kind === "invalid") return reject(decoded.error);
         if (decoded.kind === "input_required") {
-          if (options?.allowInputRequired === true) return resolve4(manualInputRequiredValue(decoded));
+          if (options?.allowInputRequired === true) return resolve6(manualInputRequiredValue(decoded));
           const flow = {
             codec: codec2,
             request,
@@ -28684,11 +28742,11 @@ var Protocol = class {
               params
             }, resultSchema, legOptions)
           };
-          return resolve4(this._resolveNonCompleteResult(decoded, flow));
+          return resolve6(this._resolveNonCompleteResult(decoded, flow));
         }
         const result = decoded.result;
         validateStandardSchema(resultSchema, result).then((parseResult) => {
-          if (parseResult.success) resolve4(parseResult.data);
+          if (parseResult.success) resolve6(parseResult.data);
           else reject(new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${request.method}: ${parseResult.error}`));
         }, reject);
       });
@@ -31600,7 +31658,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
     ref = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref);
     const schOrFunc = root.refs[ref];
     if (schOrFunc) return schOrFunc;
-    let _sch = resolve4.call(this, root, ref);
+    let _sch = resolve6.call(this, root, ref);
     if (_sch === void 0) {
       const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
       const { schemaId } = this.opts;
@@ -31626,7 +31684,7 @@ var require_compile = /* @__PURE__ */ __commonJSMin(((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve4(root, ref) {
+  function resolve6(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string") ref = sch;
     return sch || this.schemas[ref] || resolveSchema.call(this, root, ref);
@@ -32076,47 +32134,47 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
     else if (typeof uri === "object") uri = parse3(serialize(uri, options), options);
     return uri;
   }
-  function resolve4(baseURI, relativeURI, options) {
+  function resolve6(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
-  function resolveComponent(base, relative2, options, skipNormalization) {
+  function resolveComponent(base, relative3, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse3(serialize(base, options), options);
-      relative2 = parse3(serialize(relative2, options), options);
+      relative3 = parse3(serialize(relative3, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative2.scheme) {
-      target.scheme = relative2.scheme;
-      target.userinfo = relative2.userinfo;
-      target.host = relative2.host;
-      target.port = relative2.port;
-      target.path = removeDotSegments(relative2.path || "");
-      target.query = relative2.query;
+    if (!options.tolerant && relative3.scheme) {
+      target.scheme = relative3.scheme;
+      target.userinfo = relative3.userinfo;
+      target.host = relative3.host;
+      target.port = relative3.port;
+      target.path = removeDotSegments(relative3.path || "");
+      target.query = relative3.query;
     } else {
-      if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
-        target.userinfo = relative2.userinfo;
-        target.host = relative2.host;
-        target.port = relative2.port;
-        target.path = removeDotSegments(relative2.path || "");
-        target.query = relative2.query;
+      if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
+        target.userinfo = relative3.userinfo;
+        target.host = relative3.host;
+        target.port = relative3.port;
+        target.path = removeDotSegments(relative3.path || "");
+        target.query = relative3.query;
       } else {
-        if (!relative2.path) {
+        if (!relative3.path) {
           target.path = base.path;
-          if (relative2.query !== void 0) target.query = relative2.query;
+          if (relative3.query !== void 0) target.query = relative3.query;
           else target.query = base.query;
         } else {
-          if (relative2.path[0] === "/") target.path = removeDotSegments(relative2.path);
+          if (relative3.path[0] === "/") target.path = removeDotSegments(relative3.path);
           else {
-            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative2.path;
-            else if (!base.path) target.path = relative2.path;
-            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
+            if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative3.path;
+            else if (!base.path) target.path = relative3.path;
+            else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative2.query;
+          target.query = relative3.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -32124,7 +32182,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative2.fragment;
+    target.fragment = relative3.fragment;
     return target;
   }
   function equal(uriA, uriB, options) {
@@ -32250,7 +32308,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
   const fastUri = {
     SCHEMES,
     normalize,
-    resolve: resolve4,
+    resolve: resolve6,
     resolveComponent,
     equal,
     serialize,
@@ -37623,7 +37681,7 @@ var StdioServerTransport = class {
   }
   send(message) {
     if (this._closed) return Promise.reject(/* @__PURE__ */ new Error("StdioServerTransport is closed"));
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       const json2 = serializeMessage(message);
       let settled = false;
       const onError = (error62) => {
@@ -37638,14 +37696,14 @@ var StdioServerTransport = class {
         settled = true;
         this._stdout.off("error", onError);
         this._stdout.off("drain", onDrain);
-        resolve4();
+        resolve6();
       };
       this._stdout.once("error", onError);
       if (this._stdout.write(json2)) {
         if (settled) return;
         settled = true;
         this._stdout.off("error", onError);
-        resolve4();
+        resolve6();
       } else if (!settled) this._stdout.once("drain", onDrain);
     });
   }
@@ -37699,14 +37757,14 @@ var StdioConnectionChannel = class {
   */
   async whenRequestsAnswered(timeoutMs) {
     if (this._closed || this._pendingRequests.size === 0) return true;
-    return await new Promise((resolve4) => {
+    return await new Promise((resolve6) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve4(true);
+        resolve6(true);
       };
       const timer = setTimeout(() => {
         this._drainWaiters = this._drainWaiters.filter((pending) => pending !== waiter);
-        resolve4(false);
+        resolve6(false);
       }, timeoutMs);
       this._drainWaiters.push(waiter);
     });
@@ -37845,14 +37903,14 @@ function serveStdio(factory, options = {}) {
     return false;
   };
   const answerLegacyRejection = (request, reason, requestedVersion) => {
-    const rejection2 = modernOnlyStrictRejection({
+    const rejection3 = modernOnlyStrictRejection({
       kind: "legacy",
       reason,
       ...requestedVersion !== void 0 && { requestedVersion }
     }, SUPPORTED_MODERN_PROTOCOL_VERSIONS);
-    if (rejection2 === void 0) return Promise.resolve();
-    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection2.cell}): ${rejection2.message}`));
-    return writeErrorResponse(request.id, rejection2.code, rejection2.message, rejection2.data);
+    if (rejection3 === void 0) return Promise.resolve();
+    reportError(/* @__PURE__ */ new Error(`Rejected 2025-era request on a modern-only stdio connection (${rejection3.cell}): ${rejection3.message}`));
+    return writeErrorResponse(request.id, rejection3.code, rejection3.message, rejection3.data);
   };
   const onInstanceClosed = (channel) => {
     if (closing || channel === discarding) return;
@@ -38164,6 +38222,11 @@ var MEDIA_QUALIFIER = "(?:primary|secondary|main|default|cover|hero|profile|mast
 var MEDIA_KEY = new RegExp(`^(?:(?:${MEDIA_QUALIFIER}|${MEDIA_NOUN})[_-]?)?${MEDIA_NOUN}s?(?:[_-]?(?:link|uri|url|src)s?)?$`, "i");
 
 // node_modules/@chrischall/mcp-utils/dist/response/index.js
+function textResult(data) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
+  };
+}
 function rawTextResult(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -38182,6 +38245,432 @@ function pruneUndefined(obj) {
   return out;
 }
 
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/server/canonical.js
+function canonicalJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return JSON.stringify(value);
+  if (value === void 0)
+    return "null";
+  if (typeof value === "number")
+    return Number.isFinite(value) ? JSON.stringify(value) : `{"$num":"${String(value)}"}`;
+  if (typeof value === "bigint")
+    return `{"$bigint":"${value.toString()}"}`;
+  if (typeof value === "function" || typeof value === "symbol") {
+    throw new TypeError(`confirmation: cannot bind a ${typeof value} argument value.`);
+  }
+  if (Array.isArray(value))
+    return `[${value.map(canonicalJson).join(",")}]`;
+  if (value instanceof Date) {
+    return `{"$date":${JSON.stringify(Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString())}}`;
+  }
+  if (ArrayBuffer.isView(value)) {
+    const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    return `{"$bytes":${JSON.stringify(bytes.toString("base64"))}}`;
+  }
+  if (value instanceof ArrayBuffer)
+    return `{"$bytes":${JSON.stringify(Buffer.from(value).toString("base64"))}}`;
+  if (value instanceof Map) {
+    const entries2 = [...value.entries()].map(([k, v]) => `[${canonicalJson(k)},${canonicalJson(v)}]`).sort();
+    return `{"$map":[${entries2.join(",")}]}`;
+  }
+  if (value instanceof Set) {
+    return `{"$set":[${[...value].map(canonicalJson).sort().join(",")}]}`;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) {
+    throw new TypeError("confirmation: cannot bind a non-plain object argument value (class instance).");
+  }
+  const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+  return `{${entries.map(([k, v]) => `${JSON.stringify(escapeKey(k))}:${canonicalJson(v)}`).join(",")}}`;
+}
+function escapeKey(key) {
+  return key.startsWith("$") ? `$${key}` : key;
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirmation.js
+var DEFAULT_REQUEST_KEY = "confirmation";
+var DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
+var UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+var STATE_PREFIX = "mcpu.confirm.v1.";
+function bindingKey(binding) {
+  if (binding.ttlSeconds !== void 0 && !(Number.isFinite(binding.ttlSeconds) && binding.ttlSeconds > 0)) {
+    throw new RangeError("requireConfirmation: binding.ttlSeconds must be a finite number greater than 0.");
+  }
+  const key = typeof binding.key === "string" ? Buffer.from(binding.key, "utf8") : Buffer.from(binding.key);
+  if (key.length < 32) {
+    throw new RangeError("requireConfirmation: binding.key must be at least 32 bytes.");
+  }
+  return key;
+}
+function commitment(action, args) {
+  return createHash("sha256").update(`${action}\0${canonicalJson(args)}`).digest("base64url");
+}
+function mintState(key, action, binding) {
+  const exp = Math.floor(Date.now() / 1e3) + (binding.ttlSeconds ?? 600);
+  const body = Buffer.from(JSON.stringify({ c: commitment(action, binding.args), exp })).toString("base64url");
+  const mac3 = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest("base64url");
+  return `${STATE_PREFIX}${body}.${mac3}`;
+}
+function verifyState(key, action, binding, state) {
+  if (typeof state !== "string" || !state.startsWith(STATE_PREFIX))
+    return false;
+  const rest = state.slice(STATE_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot < 0)
+    return false;
+  const body = rest.slice(0, dot);
+  const mac3 = Buffer.from(rest.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", key).update(`${STATE_PREFIX}${body}`).digest();
+  if (mac3.length !== expected.length || !timingSafeEqual(mac3, expected))
+    return false;
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return false;
+  }
+  if (typeof payload.exp !== "number" || payload.exp * 1e3 <= Date.now())
+    return false;
+  const want = Buffer.from(commitment(action, binding.args));
+  const got = Buffer.from(typeof payload.c === "string" ? payload.c : "");
+  return got.length === want.length && timingSafeEqual(got, want);
+}
+function echoedState(ctx) {
+  const accessor = ctx.mcpReq.requestState;
+  return typeof accessor === "function" ? accessor() : void 0;
+}
+function requireConfirmation(ctx, options) {
+  const requestKey = options.requestKey ?? DEFAULT_REQUEST_KEY;
+  const key = options.binding ? bindingKey(options.binding) : void 0;
+  const confirmationSchema = external_exports.object({
+    confirmed: external_exports.boolean().describe(options.confirmationLabel ?? DEFAULT_CONFIRMATION_LABEL)
+  });
+  const ask = () => {
+    const preview = {
+      action: options.action,
+      ...options.details === void 0 ? {} : { details: options.details }
+    };
+    return inputRequired({
+      inputRequests: {
+        [requestKey]: inputRequired.elicit({
+          message: `${options.message}
+${JSON.stringify(preview, null, 2)}`,
+          requestedSchema: confirmationSchema
+        })
+      },
+      ...key && options.binding ? { requestState: mintState(key, options.action, options.binding) } : {}
+    });
+  };
+  const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
+  const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (response.kind === "missing") {
+    if (callerAcceptsFormElicitation(ctx) === false) {
+      return textResult({
+        confirmed: false,
+        dispatched: false,
+        action: options.action,
+        reason: "confirmation-unsupported",
+        note: options.unsupportedNote ? `${UNSUPPORTED_NOTE}. ${options.unsupportedNote}` : `${UNSUPPORTED_NOTE}.`
+      });
+    }
+    return ask();
+  }
+  if (response.kind === "elicit" && response.action === "accept" && accepted?.confirmed === true) {
+    if (key && options.binding) {
+      const state = echoedState(ctx);
+      if (state === void 0 || state === null) {
+        return errorResult(`Confirmation for ${options.action} was accepted, but the retry carried no requestState, so it cannot be checked against the prompt that was shown. Nothing was done. The likely cause is that the MCP client or host does not round-trip requestState (it must echo the requestState from the input_required result back on the retry); asking again would loop.`);
+      }
+      if (!verifyState(key, options.action, options.binding, state))
+        return ask();
+    }
+    return void 0;
+  }
+  return textResult({
+    confirmed: false,
+    cancelled: true,
+    action: options.action,
+    note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
+  });
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-token.js
+import { createHash as createHash2, createHmac as createHmac2, randomBytes, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+function createSpentTokenStore() {
+  const spent = /* @__PURE__ */ new Map();
+  return {
+    has: (nonce) => spent.has(nonce),
+    add: (nonce, exp) => {
+      spent.set(nonce, exp);
+    },
+    prune: (now) => {
+      for (const [nonce, exp] of spent)
+        if (exp < now)
+          spent.delete(nonce);
+    },
+    clear: () => spent.clear(),
+    get size() {
+      return spent.size;
+    }
+  };
+}
+var PROCESS_SPENT = createSpentTokenStore();
+var PREFIX = "mcpu.token.v1.";
+var DEFAULT_TTL_SECONDS = 600;
+function tokenKey(key) {
+  const bytes = typeof key === "string" ? Buffer.from(key, "utf8") : Buffer.from(key);
+  if (bytes.length < 32)
+    throw new RangeError("confirm token: key must be at least 32 bytes.");
+  return bytes;
+}
+function ttlOf(ttlSeconds) {
+  if (ttlSeconds === void 0)
+    return DEFAULT_TTL_SECONDS;
+  if (!(Number.isFinite(ttlSeconds) && ttlSeconds > 0)) {
+    throw new RangeError("confirm token: ttlSeconds must be a finite number greater than 0.");
+  }
+  return ttlSeconds;
+}
+function sign(key, body) {
+  return createHmac2("sha256", key).update(`${PREFIX}${body}`).digest();
+}
+function hashConfirmPayload(payload) {
+  return createHash2("sha256").update(canonicalJson(payload)).digest("base64url");
+}
+function issueConfirmToken(key, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const exp = now + ttlOf(options.ttlSeconds) * 1e3;
+  const claims = {
+    t: binding.tool,
+    ...binding.account === void 0 ? {} : { a: binding.account },
+    g: binding.target,
+    ...binding.revision === void 0 ? {} : { r: binding.revision },
+    h: binding.payloadHash,
+    exp,
+    n: randomBytes(16).toString("base64url")
+  };
+  const body = Buffer.from(JSON.stringify(claims), "utf8").toString("base64url");
+  return { token: `${PREFIX}${body}.${sign(k, body).toString("base64url")}`, expiresAt: new Date(exp).toISOString() };
+}
+function parseClaims(body) {
+  try {
+    const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function verifyConfirmToken(key, token, binding, options = {}) {
+  const k = tokenKey(key);
+  const now = options.now ?? Date.now();
+  const spent = options.spent ?? PROCESS_SPENT;
+  spent.prune(now);
+  if (!token.startsWith(PREFIX))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const rest = token.slice(PREFIX.length);
+  const dot = rest.indexOf(".");
+  const body = dot < 0 ? "" : rest.slice(0, dot);
+  const mac3 = Buffer.from(dot < 0 ? "" : rest.slice(dot + 1), "base64url");
+  const expected = sign(k, body);
+  if (!body || mac3.length !== expected.length || !timingSafeEqual2(mac3, expected))
+    return { ok: false, error: "TOKEN_INVALID" };
+  const claims = parseClaims(body);
+  if (!claims)
+    return { ok: false, error: "TOKEN_INVALID" };
+  if (claims.t !== binding.tool || claims.a !== binding.account || claims.g !== binding.target) {
+    return { ok: false, error: "TOKEN_INVALID" };
+  }
+  if (spent.has(claims.n))
+    return { ok: false, error: "TOKEN_REUSED" };
+  if (now > claims.exp)
+    return { ok: false, error: "TOKEN_EXPIRED" };
+  if (claims.r !== binding.revision)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "revision-changed" };
+  if (claims.h !== binding.payloadHash)
+    return { ok: false, error: "DRAFT_CHANGED", reason: "payload-changed" };
+  spent.add(claims.n, claims.exp);
+  return { ok: true };
+}
+var CONFIRM_TOKEN_INSTRUCTION = "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken.";
+var confirmTokenParam = external_exports.string().optional().describe(`ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat \u2014 never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.`);
+var TOKEN_ERROR_NOTE = {
+  TOKEN_EXPIRED: "Nothing was sent or changed: the confirmToken expired. Call again WITHOUT confirmToken for a fresh preview, and ask the user to approve it again.",
+  TOKEN_REUSED: "Nothing was sent or changed by this call: this confirmToken was already used, and one approval acts once. If doing it again is really intended, call again WITHOUT confirmToken and get a new approval.",
+  TOKEN_INVALID: "Nothing was sent or changed: this confirmToken was not issued by this server for this tool, account and target (or the server has restarted since). Call again WITHOUT confirmToken for a fresh preview and approval."
+};
+var CHANGED_NOTE = {
+  "revision-changed": "Nothing was sent or changed: the target was edited since the user approved it (its version rotated), so what would happen is not what they saw.",
+  "payload-changed": "Nothing was sent or changed: what would happen no longer matches what the user approved."
+};
+function isToolResult(value) {
+  return Array.isArray(value.content);
+}
+function rejection2(data) {
+  return { ...textResult({ status: "confirmation-rejected", confirmed: false, dispatched: false, ...data }), isError: true };
+}
+async function tokenConfirmation(action, fb) {
+  const subject = await fb.subject();
+  if (isToolResult(subject))
+    return subject;
+  const binding = {
+    tool: fb.tool,
+    ...fb.account === void 0 ? {} : { account: fb.account },
+    target: subject.target,
+    ...subject.revision === void 0 ? {} : { revision: subject.revision },
+    payloadHash: hashConfirmPayload(subject.payload)
+  };
+  const phaseOne = () => {
+    const { token, expiresAt } = issueConfirmToken(fb.key, binding, { ttlSeconds: fb.ttlSeconds });
+    return {
+      action,
+      preview: subject.preview,
+      confirmToken: token,
+      expiresAt,
+      ttlSeconds: ttlOf(fb.ttlSeconds),
+      instruction: fb.instruction ?? CONFIRM_TOKEN_INSTRUCTION
+    };
+  };
+  if (!fb.confirmToken) {
+    return textResult({ status: "confirmation-required", confirmed: false, dispatched: false, ...phaseOne() });
+  }
+  const verdict = verifyConfirmToken(fb.key, fb.confirmToken, binding, { spent: fb.spent });
+  if (verdict.ok)
+    return void 0;
+  if (verdict.error === "DRAFT_CHANGED") {
+    return rejection2({
+      error: "DRAFT_CHANGED",
+      reason: verdict.reason,
+      note: `${CHANGED_NOTE[verdict.reason]} The current preview and a fresh confirmToken are below.`,
+      ...phaseOne()
+    });
+  }
+  return rejection2({ error: verdict.error, action, note: TOKEN_ERROR_NOTE[verdict.error] });
+}
+async function requireConfirmationWithFallback(ctx, options) {
+  const { tokenFallback, ...confirmation } = options;
+  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+    return tokenConfirmation(options.action, tokenFallback);
+  }
+  return requireConfirmation(ctx, confirmation);
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+
+// node_modules/@chrischall/mcp-utils/dist/config/index.js
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
+function readEnvVar(key, opts = {}) {
+  const env = opts.env ?? process.env;
+  const raw = env[key];
+  if (typeof raw === "string") {
+    const trimmed = raw.trim();
+    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
+      return trimmed;
+    }
+  }
+  return opts.default;
+}
+var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
+function parseBoolEnv(key, opts = {}) {
+  const fallback = opts.default ?? false;
+  const raw = readEnvVar(key, { env: opts.env });
+  if (raw === void 0)
+    return fallback;
+  const token = raw.toLowerCase();
+  if (TRUE_TOKENS.has(token))
+    return true;
+  if (FALSE_TOKENS.has(token))
+    return false;
+  return fallback;
+}
+function expandPath(p) {
+  let expanded = p;
+  if (p === "~") {
+    expanded = homedir();
+  } else if (p.startsWith("~/")) {
+    expanded = join(homedir(), p.slice(2));
+  }
+  return isAbsolute(expanded) ? expanded : resolve(expanded);
+}
+async function loadDotenvSafely(opts = {}) {
+  try {
+    const mod = await import(
+      /* @vite-ignore */
+      "dotenv"
+    );
+    const result = mod.config({
+      ...opts.path !== void 0 ? { path: opts.path } : {},
+      override: opts.override ?? false,
+      quiet: true
+    });
+    return result.error === void 0;
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js
+var MODES = /* @__PURE__ */ new Set(["ask-user", "auto", "refuse"]);
+var DEFAULT_TTL_SECONDS2 = 600;
+var warned = /* @__PURE__ */ new Set();
+function readConfirmMode(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_MODE", { env })?.trim().toLowerCase();
+  if (!raw)
+    return "ask-user";
+  if (MODES.has(raw))
+    return raw;
+  if (!warned.has(raw)) {
+    warned.add(raw);
+    process.stderr.write(`MCP_CONFIRM_MODE="${raw}" is not one of ask-user, auto, refuse; treating it as refuse.
+`);
+  }
+  return "refuse";
+}
+function confirmTtlFromEnv(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
+  return raw && /^[1-9]\d*$/.test(raw) ? Number(raw) : DEFAULT_TTL_SECONDS2;
+}
+var processKey;
+function confirmKeyFromEnv(env = process.env) {
+  const secret = readEnvVar("MCP_CONFIRM_SECRET", { env });
+  if (secret)
+    return createHash3("sha256").update(secret, "utf8").digest();
+  processKey ??= randomBytes2(32);
+  return processKey;
+}
+var CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
+var REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+function confirmationFromEnv(options) {
+  const { tool, account, confirmToken, subject, instruction, spent, env = process.env, ...confirmation } = options;
+  const mode = readConfirmMode(env);
+  if (mode === "refuse") {
+    return {
+      ...confirmation,
+      unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${REFUSE_HINT}` : REFUSE_HINT
+    };
+  }
+  return {
+    ...confirmation,
+    tokenFallback: {
+      key: confirmKeyFromEnv(env),
+      tool,
+      ...account === void 0 ? {} : { account },
+      ...confirmToken === void 0 ? {} : { confirmToken },
+      subject,
+      ttlSeconds: confirmTtlFromEnv(env),
+      instruction: mode === "auto" ? CONFIRM_TOKEN_AUTO_INSTRUCTION : instruction ?? CONFIRM_TOKEN_INSTRUCTION,
+      ...spent === void 0 ? {} : { spent }
+    }
+  };
+}
+
 // node_modules/@chrischall/mcp-utils/dist/server/index.js
 var SERVER_PROTOCOL_VERSIONS = Object.freeze([
   "2026-07-28",
@@ -38357,61 +38846,6 @@ function runMcp(opts) {
   return handle;
 }
 
-// node_modules/@chrischall/mcp-utils/dist/config/index.js
-import { homedir } from "node:os";
-import { isAbsolute, join, resolve } from "node:path";
-var PLACEHOLDER_RE = /^\$\{[^}]*\}$/;
-function readEnvVar(key, opts = {}) {
-  const env = opts.env ?? process.env;
-  const raw = env[key];
-  if (typeof raw === "string") {
-    const trimmed = raw.trim();
-    if (trimmed.length > 0 && trimmed !== "undefined" && trimmed !== "null" && !PLACEHOLDER_RE.test(trimmed)) {
-      return trimmed;
-    }
-  }
-  return opts.default;
-}
-var TRUE_TOKENS = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
-var FALSE_TOKENS = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
-function parseBoolEnv(key, opts = {}) {
-  const fallback = opts.default ?? false;
-  const raw = readEnvVar(key, { env: opts.env });
-  if (raw === void 0)
-    return fallback;
-  const token = raw.toLowerCase();
-  if (TRUE_TOKENS.has(token))
-    return true;
-  if (FALSE_TOKENS.has(token))
-    return false;
-  return fallback;
-}
-function expandPath(p) {
-  let expanded = p;
-  if (p === "~") {
-    expanded = homedir();
-  } else if (p.startsWith("~/")) {
-    expanded = join(homedir(), p.slice(2));
-  }
-  return isAbsolute(expanded) ? expanded : resolve(expanded);
-}
-async function loadDotenvSafely(opts = {}) {
-  try {
-    const mod = await import(
-      /* @vite-ignore */
-      "dotenv"
-    );
-    const result = mod.config({
-      ...opts.path !== void 0 ? { path: opts.path } : {},
-      override: opts.override ?? false,
-      quiet: true
-    });
-    return result.error === void 0;
-  } catch {
-    return false;
-  }
-}
-
 // node_modules/@chrischall/mcp-utils/dist/fs/index.js
 import { openAsBlob } from "node:fs";
 
@@ -38546,9 +38980,9 @@ async function resolveAuthPattern(pattern) {
 import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync, unlinkSync } from "node:fs";
 import { dirname as dirname2, join as join2, resolve as resolve3 } from "node:path";
 import { homedir as homedir2 } from "node:os";
-import { randomBytes, createHmac } from "node:crypto";
+import { randomBytes as randomBytes3, createHmac as createHmac3 } from "node:crypto";
 function bindingDigest(secret, salt) {
-  return createHmac("sha256", salt).update(secret).digest("hex").slice(0, 32);
+  return createHmac3("sha256", salt).update(secret).digest("hex").slice(0, 32);
 }
 function isEnvelope(raw) {
   return raw !== null && typeof raw === "object" && raw.v === 1 && "state" in raw;
@@ -38598,7 +39032,7 @@ function createFileStatePersistence(opts) {
     },
     save(state) {
       const dir = dirname2(filePath);
-      const tmp = `${filePath}.tmp-${randomBytes(6).toString("hex")}`;
+      const tmp = `${filePath}.tmp-${randomBytes3(6).toString("hex")}`;
       const dirExisted = existsSync2(dir);
       try {
         mkdirSync(dir, { recursive: true, mode: 448 });
@@ -38606,7 +39040,7 @@ function createFileStatePersistence(opts) {
           chmodSync(dir, 448);
         let boundTo;
         if (secret !== void 0) {
-          const salt = randomBytes(16).toString("hex");
+          const salt = randomBytes3(16).toString("hex");
           boundTo = { salt, digest: bindingDigest(secret, salt) };
         }
         const envelope = { v: 1, ...boundTo !== void 0 ? { boundTo } : {}, state };
@@ -40480,7 +40914,7 @@ var DEFAULT_BIND_TIMEOUT_MS = 5e3;
 async function electRole(opts) {
   const server = createServer();
   const bindTimeoutMs = opts.bindTimeoutMs ?? DEFAULT_BIND_TIMEOUT_MS;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     let timer;
     const clearBindTimer = () => {
       if (timer) {
@@ -40496,7 +40930,7 @@ async function electRole(opts) {
           server.close();
         } catch {
         }
-        resolve4({ role: "peer" });
+        resolve6({ role: "peer" });
       } else {
         reject(e);
       }
@@ -40504,7 +40938,7 @@ async function electRole(opts) {
     const onListening = () => {
       clearBindTimer();
       server.removeListener("error", onError);
-      resolve4({ role: "host", server });
+      resolve6({ role: "host", server });
     };
     server.once("error", onError);
     server.once("listening", onListening);
@@ -40782,12 +41216,12 @@ async function awaitSessionReady(ready, opts) {
 
 // node_modules/@fetchproxy/server/dist/extension-trust.js
 import { readFile as readFile2, writeFile as writeFile2, rename as rename2, unlink as unlink2, mkdir as mkdir2, chmod as chmod2, rm as rm2 } from "node:fs/promises";
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 import { isAbsolute as isAbsolute4, join as join4 } from "node:path";
 
 // node_modules/@fetchproxy/server/dist/identity.js
 import { readFile, readdir, writeFile, mkdir, chmod, rename, rm, unlink, link, lstat } from "node:fs/promises";
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { isAbsolute as isAbsolute3, join as join3 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
@@ -40908,7 +41342,7 @@ var NO_HARD_LINKS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "
 async function publishIdentityIfAbsent(dir, serverName, id) {
   const path = identityFilePath(dir, serverName);
   await sweepStagingFiles(dir, serverName, { olderThanMs: 6e4 });
-  const tmp = `${path}.${randomBytes2(STAGING_BYTES).toString("hex")}.tmp`;
+  const tmp = `${path}.${randomBytes4(STAGING_BYTES).toString("hex")}.tmp`;
   try {
     await writeFile(tmp, serializeIdentity(id), { mode: 384, flag: "wx" });
     await chmod(tmp, 384);
@@ -41037,7 +41471,7 @@ async function readExtensionPin(serverName, dir = defaultTrustDir()) {
 async function writeExtensionPin(serverName, pin, dir = defaultTrustDir()) {
   const path = extensionTrustPath(serverName, dir);
   await mkdir2(dir, { recursive: true, mode: 448 });
-  const tmp = `${path}.${randomBytes3(6).toString("hex")}.tmp`;
+  const tmp = `${path}.${randomBytes5(6).toString("hex")}.tmp`;
   try {
     await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384, flag: "wx" });
     await chmod2(tmp, 384);
@@ -41153,8 +41587,8 @@ async function startHost(opts) {
   let rejectOwnSession;
   let ownSessionReady;
   function resetSessionPromise() {
-    ownSessionReady = new Promise((resolve4, reject) => {
-      resolveOwnSession = resolve4;
+    ownSessionReady = new Promise((resolve6, reject) => {
+      resolveOwnSession = resolve6;
       rejectOwnSession = reject;
     });
     ownSessionReady.catch(() => {
@@ -41556,7 +41990,7 @@ async function startHost(opts) {
     });
   });
   return {
-    close: () => new Promise((resolve4) => {
+    close: () => new Promise((resolve6) => {
       for (const client2 of wss.clients) {
         try {
           client2.terminate();
@@ -41564,7 +41998,7 @@ async function startHost(opts) {
         }
       }
       wss.close(() => {
-        opts.httpServer.close(() => resolve4());
+        opts.httpServer.close(() => resolve6());
       });
     }),
     sendOwnInner: async (inner) => {
@@ -41604,11 +42038,11 @@ async function startPeer(opts) {
     maxPayload: opts.maxPayloadBytes ?? MAX_PAYLOAD_BYTES
   });
   const dialTimeoutMs = opts.dialTimeoutMs ?? PEER_DIAL_TIMEOUT_MS;
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve6, reject) => {
     let timer;
     const onOpen = () => {
       cleanup();
-      resolve4();
+      resolve6();
     };
     const onError = (e) => {
       cleanup();
@@ -41696,10 +42130,10 @@ async function startPeer(opts) {
   let sessionPromiseSettled = false;
   function resetSessionPromise() {
     sessionPromiseSettled = false;
-    sessionPromise = new Promise((resolve4, reject) => {
+    sessionPromise = new Promise((resolve6, reject) => {
       resolveFirstReady = (st) => {
         sessionPromiseSettled = true;
-        resolve4(st);
+        resolve6(st);
       };
       rejectFirstReady = (e) => {
         sessionPromiseSettled = true;
@@ -42849,8 +43283,8 @@ var FetchproxyServer = class {
   async _fetchOnceWithTimeout(init, fetchOpts = {}) {
     const id = this.nextRequestId++;
     const inner = { type: "request", id, op: "fetch", init };
-    const pending = this.guardPending(new Promise((resolve4) => {
-      this.pending.set(id, resolve4);
+    const pending = this.guardPending(new Promise((resolve6) => {
+      this.pending.set(id, resolve6);
     }));
     try {
       await this.sendInnerFrame(inner, {
@@ -42873,12 +43307,12 @@ var FetchproxyServer = class {
     try {
       return await Promise.race([
         pending,
-        new Promise((resolve4) => {
+        new Promise((resolve6) => {
           timer = setTimeout(() => {
             this.pending.delete(id);
             const elapsedMs = Date.now() - start;
             const error62 = `fetchproxy: ${init.url} did not respond within ${timeoutMs}ms`;
-            resolve4({
+            resolve6({
               ok: false,
               error: error62,
               kind: "timeout",
@@ -43022,9 +43456,9 @@ var FetchproxyServer = class {
     if (opts.subdomain !== void 0)
       assertSubdomainLabel(opts.subdomain);
     const baseDomain = this.resolveBaseDomain(opts.domain);
-    const isAbsolute5 = path.startsWith("http://") || path.startsWith("https://");
+    const isAbsolute6 = path.startsWith("http://") || path.startsWith("https://");
     let host;
-    if (isAbsolute5) {
+    if (isAbsolute6) {
       try {
         host = new URL(path).host;
       } catch {
@@ -43033,7 +43467,7 @@ var FetchproxyServer = class {
     } else {
       host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
     }
-    const url2 = isAbsolute5 ? path : `https://${host}${path}`;
+    const url2 = isAbsolute6 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url2, this.opts.domains);
     let tabUrl = `https://${host}/`;
     if (opts.viaTab !== void 0) {
@@ -43298,8 +43732,8 @@ var FetchproxyServer = class {
       const tabUrl = `https://${host}/`;
       inner = { type: "request", id, op: "read_cookies", init: { tabUrl } };
     }
-    const pending = this.guardPending(new Promise((resolve4) => {
-      this.pendingReadCookies.set(id, resolve4);
+    const pending = this.guardPending(new Promise((resolve6) => {
+      this.pendingReadCookies.set(id, resolve6);
     }));
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
@@ -43357,8 +43791,8 @@ var FetchproxyServer = class {
         ...cookiePath !== void 0 ? { path: cookiePath } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingWriteCookies.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingWriteCookies.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -43428,8 +43862,8 @@ var FetchproxyServer = class {
         ...opts.pointers ? { pointers: { ...opts.pointers } } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, `https://${host}`);
@@ -43487,8 +43921,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingCapture.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingCapture.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -43535,8 +43969,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingRedirect.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingRedirect.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -43631,8 +44065,8 @@ var FetchproxyServer = class {
         ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingDownload.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingDownload.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(
@@ -43692,8 +44126,8 @@ var FetchproxyServer = class {
         keys: [...opts.keys]
       }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingIdb.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingIdb.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
@@ -43732,8 +44166,8 @@ var FetchproxyServer = class {
       op: "read_dom",
       init: { origin, names: [...opts.names] }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingStorage.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
@@ -43778,8 +44212,8 @@ var FetchproxyServer = class {
       op: "read_dom_list",
       init: { origin, name: opts.name }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingDomList.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingDomList.set(id, { resolve: resolve6, reject });
     }));
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingDomList, id, origin);
@@ -43824,8 +44258,8 @@ var FetchproxyServer = class {
         ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
       }
     };
-    const pending = this.guardPending(new Promise((resolve4, reject) => {
-      this.pendingGraphql.set(id, { resolve: resolve4, reject });
+    const pending = this.guardPending(new Promise((resolve6, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve6, reject });
     }));
     const retrySafe = opts.retryOnTimeout === true;
     await this.sendInnerFrame(inner, { resendable: retrySafe });
@@ -44574,6 +45008,9 @@ function registerCredentialHealthcheckTool(args) {
   }, async () => runCredentialHealthcheck(args));
 }
 
+// src/auth-password.ts
+import { createHash as createHash4 } from "node:crypto";
+
 // src/protocol.ts
 var BASE_URL = "https://ofw.ourfamilywizard.com";
 var OFW_PROTOCOL_HEADERS = {
@@ -44598,7 +45035,23 @@ function assertOfwUrl(rawUrl) {
 }
 
 // src/auth-password.ts
+var CredentialsRejectedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialsRejectedError";
+  }
+};
+var rejectedPairs = /* @__PURE__ */ new Set();
+function pairDigest(username, password) {
+  return createHash4("sha256").update(`${username.length}:${username}\0${password}`).digest("hex");
+}
 async function loginWithPassword(username, password) {
+  const digest = pairDigest(username, password);
+  if (rejectedPairs.has(digest)) {
+    throw new CredentialsRejectedError(
+      "OFW login not attempted \u2014 this OurFamilyWizard email and password were already rejected by OFW earlier in this session, and OFW counts failed sign-ins against the account, so they are not re-sent. Update OFW_USERNAME / OFW_PASSWORD to the current values (or restart the server) and try again."
+    );
+  }
   const initUrl = `${BASE_URL}/ofw/login.form`;
   assertOfwUrl(initUrl);
   const initResponse = await fetch(initUrl, {
@@ -44634,8 +45087,9 @@ async function loginWithPassword(username, password) {
   const contentType = response.headers.get("content-type") ?? "";
   if (!contentType.includes("application/json")) {
     if (contentType.includes("text/html")) {
-      throw new Error(
-        "OFW login failed \u2014 your OurFamilyWizard email or password was not accepted. Check them and try again."
+      rejectedPairs.add(digest);
+      throw new CredentialsRejectedError(
+        "OFW login failed \u2014 your OurFamilyWizard email or password was not accepted. Check them and try again. They will not be re-sent until OFW_USERNAME / OFW_PASSWORD change or the server restarts."
       );
     }
     const body = await response.text();
@@ -44651,7 +45105,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.19.2",
+  version: "2.19.4",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -44685,7 +45139,7 @@ var package_default = {
     typecheck: "tsc -p tsconfig.json --noEmit"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^2.4.0",
+    "@chrischall/mcp-utils": "^2.6.0",
     "@fetchproxy/bootstrap": "^3.2.0",
     "@modelcontextprotocol/server": "^2.0.0",
     dotenv: "^18.0.0",
@@ -45019,9 +45473,9 @@ function offsetAt(instant, tz) {
   const w = wallPartsIn(instant, tz);
   const asUTC = Date.UTC(w.year, w.month - 1, w.day, w.hour, w.minute, w.second, instant.getUTCMilliseconds());
   const minutes = Math.round((asUTC - instant.getTime()) / 6e4);
-  const sign = minutes < 0 ? "-" : "+";
+  const sign2 = minutes < 0 ? "-" : "+";
   const abs = Math.abs(minutes);
-  return `${sign}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
+  return `${sign2}${pad(Math.floor(abs / 60))}:${pad(abs % 60)}`;
 }
 var wallPartsFormatters = /* @__PURE__ */ new Map();
 var displayFormatters = /* @__PURE__ */ new Map();
@@ -45168,6 +45622,34 @@ function parseTimestampValue(key, value, assumeNaiveIn) {
   }
   return null;
 }
+function naiveWallClockOf(instant, tz) {
+  return isoWithOffset(instant, tz, "");
+}
+function nowNaiveWallClock(tz = displayTimeZone()) {
+  return naiveWallClockOf(/* @__PURE__ */ new Date(), tz);
+}
+function toNaiveWallClock(value, tz = displayTimeZone()) {
+  const raw = value.trim();
+  if (DATE_ONLY.test(raw)) return raw;
+  if (RFC3339_WITH_OFFSET.test(raw)) {
+    const instant = parseTimestampValue("", raw, tz);
+    return instant ? naiveWallClockOf(instant, tz) : null;
+  }
+  const naive = NAIVE_DATE_TIME.exec(raw);
+  if (!naive) return null;
+  const [, y, mo, d, h, mi, s, frac] = naive;
+  const parts = {
+    year: Number(y),
+    month: Number(mo),
+    day: Number(d),
+    hour: Number(h),
+    minute: Number(mi),
+    second: Number(s ?? "0")
+  };
+  if (!isRealCalendarDate(parts)) return null;
+  const ms = frac ? `.${frac.padEnd(3, "0").slice(0, 3)}` : "";
+  return `${y}-${mo}-${d}T${h}:${mi}:${pad(parts.second)}${ms}`;
+}
 function walk(node2, tz) {
   if (Array.isArray(node2)) {
     for (const item of node2) walk(item, tz);
@@ -45270,17 +45752,58 @@ var PostMessagesResponseSchema = external_exports.looseObject({
   id: external_exports.number().optional(),
   entityId: external_exports.number().optional()
 }).nullable();
+var UnconfirmedWriteError = class extends Error {
+  constructor(postedId, cause) {
+    super(cause instanceof Error ? cause.message : String(cause), { cause });
+    this.postedId = postedId;
+    this.name = "UnconfirmedWriteError";
+  }
+  postedId;
+};
+function isDefinitiveRejection(e) {
+  if (!(e instanceof Error)) return false;
+  if (/^Rate limited by OFW API/.test(e.message)) return true;
+  const m = /OFW API error: (4\d\d)\b/.exec(e.message);
+  return m !== null && m[1] !== "408";
+}
+async function requestWrite(client2, method, path, body) {
+  try {
+    return await client2.request(method, path, body);
+  } catch (e) {
+    throw isDefinitiveRejection(e) ? e : new UnconfirmedWriteError(null, e);
+  }
+}
+function unconfirmedWriteResponse(e, opts) {
+  return jsonErrorResponse({
+    result: opts.result,
+    mayHaveLanded: true,
+    reason: `The request to ${opts.what} failed without a definitive answer from OFW: ${e.message}. It MAY HAVE BEEN APPLIED on OurFamilyWizard.`,
+    remedy: `Do NOT retry blindly \u2014 a second attempt can put a duplicate on the co-parent-visible record. First check with ${opts.checkWith} (or on ourfamilywizard.com), and retry only once you have confirmed it did not land.`
+  });
+}
 async function postMessageAndRefetch(client2, payload, detailSchema, ctx) {
+  let posted;
+  try {
+    posted = await client2.request("POST", "/pub/v3/messages", payload);
+  } catch (e) {
+    throw isDefinitiveRejection(e) ? e : new UnconfirmedWriteError(null, e);
+  }
   const raw = parseLenient(
     PostMessagesResponseSchema,
-    await client2.request("POST", "/pub/v3/messages", payload),
+    posted,
     { label: "ofw-mcp", context: `POST /pub/v3/messages (${ctx})`, mode: "strict" }
   );
   const id = typeof raw?.id === "number" ? raw.id : typeof raw?.entityId === "number" ? raw.entityId : null;
   if (id === null) return { id: null, detail: null, raw };
+  let fetched;
+  try {
+    fetched = await client2.request("GET", `/pub/v3/messages/${id}`);
+  } catch (e) {
+    throw new UnconfirmedWriteError(id, e);
+  }
   const detail = parseLenient(
     detailSchema,
-    await client2.request("GET", `/pub/v3/messages/${id}`),
+    fetched,
     { label: "ofw-mcp", context: `GET /pub/v3/messages/{id} (${ctx})`, mode: "strict" }
   );
   return { id, detail, raw };
@@ -45305,7 +45828,7 @@ function registerUserTools(server, client2) {
 }
 
 // src/tools/healthcheck.ts
-function registerHealthcheckTools(server, client2, resolve4 = resolveAuth) {
+function registerHealthcheckTools(server, client2, resolve6 = resolveAuth) {
   registerCredentialHealthcheckTool({
     server,
     prefix: "ofw",
@@ -45316,7 +45839,7 @@ function registerHealthcheckTools(server, client2, resolve4 = resolveAuth) {
     probePath: "/pub/v2/profiles",
     resolveCredential: async () => {
       try {
-        const auth = await resolve4();
+        const auth = await resolve6();
         return {
           source: auth.source,
           // Never the token. Expiry is the fact that explains a connector
@@ -45522,7 +46045,7 @@ async function walkPages(client2, folder, folderId, opts, store) {
         folder,
         subject: item.subject ?? "(no subject)",
         fromUser: item.from?.name ?? "",
-        sentAt: item.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
+        sentAt: item.date?.dateTime ?? nowNaiveWallClock(),
         recipients: mapRecipients(detailRecipients ?? item.recipients),
         body,
         fetchedBodyAt,
@@ -45665,7 +46188,7 @@ async function syncDrafts(client2, draftsFolderId, store, budget) {
       body: detail.body ?? "",
       recipients: mapRecipients(item.recipients),
       replyToId: threadedReplyTo(item),
-      modifiedAt: item.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
+      modifiedAt: item.date?.dateTime ?? nowNaiveWallClock(),
       listData: item
     });
   }
@@ -45768,7 +46291,7 @@ async function syncAll(client2, opts, store) {
 }
 
 // src/config.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
 import { join as join6 } from "node:path";
 function readCacheIdentity() {
@@ -45781,14 +46304,22 @@ function getCacheDir() {
 }
 function getCacheDbPath() {
   const identity = readCacheIdentity();
-  const hash2 = createHash("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash2 = createHash5("sha256").update(identity).digest("hex").slice(0, 16);
   return join6(getCacheDir(), `${hash2}.db`);
 }
 function getAttachmentsDir() {
   const override = process.env.OFW_ATTACHMENTS_DIR;
   if (override && override.trim().length > 0) return override.trim();
+  return getDefaultAttachmentsDir();
+}
+function getDefaultAttachmentsDir() {
   return join6(homedir4(), "Downloads", "ofw-mcp");
 }
+function getUploadDir() {
+  const override = process.env.OFW_UPLOAD_DIR;
+  if (override && override.trim().length > 0) return override.trim();
+  return getAttachmentsDir();
+}
 function getWriteMode() {
   const raw = process.env.OFW_WRITE_MODE;
   if (typeof raw !== "string" || raw.trim().length === 0) return "all";
@@ -46290,6 +46821,31 @@ function newDraftKey() {
   return `dk_${crypto.randomUUID()}`;
 }
 
+// src/tools/_confirm.ts
+var CONFIRM_NOTE = "Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call performs NO write and returns a preview of exactly what would happen plus a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).";
+function confirmWrite(ctx, opts) {
+  return requireConfirmationWithFallback(
+    ctx,
+    confirmationFromEnv({
+      action: opts.action,
+      message: opts.message,
+      details: opts.preview,
+      unsupportedNote: "Complete this action on ourfamilywizard.com instead.",
+      tool: opts.tool,
+      confirmToken: opts.confirmToken,
+      subject: () => ({
+        target: opts.target,
+        ...opts.revision !== void 0 ? { revision: opts.revision } : {},
+        payload: opts.payload,
+        preview: opts.preview
+      })
+    })
+  );
+}
+function stateRevision(value) {
+  return `s1:${fnv1a64(JSON.stringify(value))}`;
+}
+
 // src/extract/inflate.ts
 var MAX_DECOMPRESSED_BYTES = 32 * 1024 * 1024;
 var DecompressionLimitError = class extends Error {
@@ -46465,6 +47021,8 @@ function findPart(zip, conventional, fileName) {
 
 // src/extract/spreadsheet.ts
 var DEFAULT_MAX_CELLS = 2e5;
+var DEFAULT_MAX_GRID_CELLS = 2e6;
+var MAX_COLUMNS = 16384;
 var BUILTIN_DATE_FORMATS = /* @__PURE__ */ new Set([14, 15, 16, 17, 18, 19, 20, 21, 22, 45, 46, 47]);
 var SERIAL_EPOCH_OFFSET = 25569;
 function excelSerialToIso(serial, date1904) {
@@ -46483,11 +47041,11 @@ function isDateFormat(numFmtId, formatCode) {
   return /[ymdhs]/i.test(bare);
 }
 function columnIndex(ref) {
-  const m = /^([A-Z]+)/.exec(ref);
+  const m = /^([A-Z]{1,3})(?![A-Z])/.exec(ref);
   if (!m) return null;
   let index = 0;
   for (const ch of m[1]) index = index * 26 + (ch.charCodeAt(0) - 64);
-  return index - 1;
+  return index > MAX_COLUMNS ? null : index - 1;
 }
 function csvField(value) {
   return /[",\r\n]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
@@ -46542,7 +47100,7 @@ function cellValue(attrs, inner, ctx) {
     }
   }
 }
-function parseSheet(xml, name, ctx, maxCells) {
+function parseSheet(xml, name, ctx, maxCells, maxGridCells) {
   const rows = [];
   let cols = 0;
   let cells = 0;
@@ -46553,14 +47111,20 @@ function parseSheet(xml, name, ctx, maxCells) {
       break;
     }
     const values = [];
+    let rowCols = cols;
     for (const cell of elements(row.inner, "c")) {
       const ref = attr(cell.attrs, "r");
       const index = ref === null ? null : columnIndex(ref);
       if (index === null) continue;
       values[index] = cellValue(cell.attrs, cell.inner, ctx);
       cells++;
-      if (index + 1 > cols) cols = index + 1;
+      if (index + 1 > rowCols) rowCols = index + 1;
+    }
+    if ((rows.length + 1) * rowCols > maxGridCells) {
+      truncated = true;
+      break;
     }
+    cols = rowCols;
     rows.push(values);
   }
   return { name, rows: rows.length, cols, csv: toCsv(rows, cols), ...truncated ? { truncated } : {} };
@@ -46579,6 +47143,7 @@ async function extractXlsx(bytes, opts = {}) {
     date1904: /<workbookPr[^>]*date1904="(1|true)"/i.test(workbookXml)
   };
   const maxCells = opts.maxCells ?? DEFAULT_MAX_CELLS;
+  const maxGridCells = opts.maxGridCells ?? DEFAULT_MAX_GRID_CELLS;
   const sheets = [];
   const omitted = [];
   let index = 0;
@@ -46596,7 +47161,7 @@ async function extractXlsx(bytes, opts = {}) {
       omitted.push(`${name} (sheet part not found in the workbook)`);
       continue;
     }
-    sheets.push(parseSheet(xml, name, ctx, maxCells));
+    sheets.push(parseSheet(xml, name, ctx, maxCells, maxGridCells));
   }
   const truncated = sheets.some((s) => s.truncated);
   return {
@@ -46656,12 +47221,16 @@ function parseDelimitedRows(text, delimiter) {
   }
   return rows;
 }
-function extractDelimited(text, name, delimiter) {
-  const rows = parseDelimitedRows(text, delimiter);
+function extractDelimited(text, name, delimiter, maxGridCells = DEFAULT_MAX_GRID_CELLS) {
+  let rows = parseDelimitedRows(text, delimiter);
   const cols = rows.reduce((max, r) => Math.max(max, r.length), 0);
+  const keep = cols === 0 ? rows.length : Math.floor(maxGridCells / cols);
+  const truncated = rows.length > keep;
+  if (truncated) rows = rows.slice(0, keep);
   return {
     kind: "spreadsheet",
-    sheets: [{ name, rows: rows.length, cols, csv: toCsv(rows, cols) }]
+    sheets: [{ name, rows: rows.length, cols, csv: toCsv(rows, cols), ...truncated ? { truncated } : {} }],
+    ...truncated ? { truncated } : {}
   };
 }
 
@@ -47157,8 +47726,17 @@ async function extractAttachment(bytes, mimeType, fileName, opts = {}) {
 }
 
 // src/tools/attachments.ts
-import { readFileSync as readFileSync2, statSync, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename, dirname as dirname4, extname } from "node:path";
+import { chmodSync as chmodSync2, existsSync as existsSync3, readFileSync as readFileSync2, realpathSync as realpathSync2, statSync, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename, dirname as dirname4, extname, isAbsolute as isAbsolute5, relative as relative2, resolve as resolve4, sep as sep2 } from "node:path";
+function isWithin(root, candidate) {
+  const rel = relative2(root, candidate);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute5(rel);
+}
+function deepestExisting(path) {
+  let current = path;
+  while (!existsSync3(current)) current = dirname4(current);
+  return current;
+}
 var MIME_BY_EXT = {
   ".pdf": "application/pdf",
   ".png": "image/png",
@@ -47219,15 +47797,28 @@ function resolveDownloadMime(bytes, headerMime, fileName) {
 function isHostRenderableImage(mime) {
   return HOST_RENDERABLE_IMAGE_MIMES.has(mime);
 }
+var MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 var NodeAttachmentIO = class {
   supportsDisk = true;
   async resolveUpload(path) {
-    const abs = expandPath(path);
-    const stat = statSync(abs);
+    const root = resolve4(getUploadDir());
+    const abs = resolve4(root, path.startsWith("~") ? expandPath(path) : path);
+    const outside = new Error(`Refusing to upload ${abs}: it is outside the upload directory (${root}). Only files placed in that directory can be uploaded \u2014 ask the user to copy the file there, or set OFW_UPLOAD_DIR.`);
+    if (!isWithin(root, abs)) throw outside;
+    const real = realpathSync2(abs);
+    const realRoot = realpathSync2(root);
+    if (!isWithin(realRoot, real)) throw outside;
+    if (relative2(realRoot, real).split(sep2).some((segment) => segment.startsWith("."))) {
+      throw new Error(`Refusing to upload ${abs}: hidden files and files in hidden directories (dotfiles, credential stores) are never uploaded.`);
+    }
+    const stat = statSync(real);
     if (!stat.isFile()) throw new Error(`Not a file: ${abs}`);
+    if (stat.size > MAX_UPLOAD_BYTES) {
+      throw new Error(`Refusing to upload ${abs}: it is too large (${stat.size} bytes; the limit is ${MAX_UPLOAD_BYTES}).`);
+    }
     const fileName = basename(abs);
     const mimeType = mimeFromName(fileName);
-    const blob = await fileBlob(abs, { type: mimeType });
+    const blob = await fileBlob(real, { type: mimeType, allowedRoots: [realRoot] });
     return { blob, fileName, mimeType, sizeBytes: stat.size };
   }
   readDownloaded(path) {
@@ -47237,9 +47828,30 @@ var NodeAttachmentIO = class {
       return null;
     }
   }
-  writeDownload(dest, bytes) {
-    mkdirSync2(dirname4(dest), { recursive: true });
-    writeFileSync2(dest, bytes);
+  writeDownload(dest, bytes, { root, overwrite }) {
+    mkdirSync2(root, { recursive: true, mode: 448 });
+    if (resolve4(root) === resolve4(getDefaultAttachmentsDir())) chmodSync2(root, 448);
+    const realRoot = realpathSync2(root);
+    const parent = dirname4(dest);
+    const anchor2 = realpathSync2(deepestExisting(parent));
+    if (anchor2 !== realRoot && !isWithin(realRoot, anchor2)) {
+      throw new Error(`Refusing to write ${dest}: it resolves outside the attachments directory (${root}).`);
+    }
+    mkdirSync2(parent, { recursive: true, mode: 448 });
+    if (overwrite) {
+      try {
+        unlinkSync2(dest);
+      } catch {
+      }
+    }
+    try {
+      writeFileSync2(dest, bytes, { flag: "wx", mode: 384 });
+    } catch (e) {
+      if (e.code === "EEXIST") {
+        throw new Error(`Refusing to overwrite ${dest}: a file already exists there. Pass force:true to replace it, or choose another saveTo.`);
+      }
+      throw e;
+    }
   }
 };
 
@@ -47303,7 +47915,7 @@ async function buildInlineDelivery(input2) {
 }
 
 // src/tools/messages.ts
-import { basename as basename2, join as join7 } from "node:path";
+import { basename as basename2, join as join7, resolve as resolve5 } from "node:path";
 
 // src/tools/pagination.ts
 function pageState(input2) {
@@ -47568,6 +48180,19 @@ function markReadVerdict(cached2, requested) {
     ...cached2 === null ? { hint: "Run ofw_sync_messages first: it walks list pages, not bodies, so it can tell you what this id is without stamping anything." } : { subject: cached2.subject, fromUser: cached2.fromUser, sentAt: cached2.sentAt }
   });
 }
+async function describeRecipients(cache, recipientIds, known) {
+  const names = /* @__PURE__ */ new Map();
+  const learn = (rs) => {
+    for (const r of rs ?? []) {
+      if (r.userId !== 0 && r.name && !names.has(r.userId)) names.set(r.userId, r.name);
+    }
+  };
+  known.forEach(learn);
+  if (recipientIds.some((id) => !names.has(id))) {
+    for (const row of await cache.listMessages({ page: 1, size: 200 })) learn(row.recipients);
+  }
+  return recipientIds.map((userId) => ({ userId, name: names.get(userId) ?? null }));
+}
 function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
   const writeMode = getWriteMode();
   const allowSend = writeMode === "all";
@@ -47587,8 +48212,8 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
       folderId: external_exports.string().describe('Folder name: "inbox", "sent", or "both" (default "both")').optional(),
       page: external_exports.number().int().min(1).describe("Page number (default 1)").optional(),
       size: external_exports.number().int().min(1).describe("Messages per page (default 50)").optional(),
-      since: external_exports.string().describe("ISO date or datetime \u2014 only messages with sent_at >= since (inclusive)").optional(),
-      until: external_exports.string().describe("ISO date or datetime \u2014 only messages with sent_at < until (exclusive)").optional(),
+      since: external_exports.string().describe("ISO date or datetime \u2014 only messages with sent_at >= since (inclusive). A value with an offset or Z is compared as that instant; a naive value is read as the account's local time (DISPLAY_TZ)").optional(),
+      until: external_exports.string().describe("ISO date or datetime \u2014 only messages with sent_at < until (exclusive). A value with an offset or Z is compared as that instant; a naive value is read as the account's local time (DISPLAY_TZ)").optional(),
       q: external_exports.string().describe("Substring match on subject AND body (case-insensitive). Use to find messages on a specific topic.").optional(),
       sort: external_exports.enum(["newest", "oldest"]).describe('Result order: "newest" (default, newest first) or "oldest" (oldest first). This decides which end a truncated page keeps \u2014 with "newest" page 1 of a wide date range holds its most RECENT slice, with "oldest" its earliest. Use "oldest" to start at the old end of a range instead of paging to it.').optional(),
       autoRefresh: external_exports.boolean().describe(AUTO_REFRESH_DESC).optional(),
@@ -47615,9 +48240,25 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
         note: 'No lookup was performed. This says NOTHING about what is in the cache \u2014 do not read it as "no messages".'
       });
     }
+    const bounds = {};
+    for (const key of ["since", "until"]) {
+      const value2 = args[key];
+      if (value2 === void 0) continue;
+      const converted = toNaiveWallClock(value2);
+      if (converted === null) {
+        return jsonErrorResponse({
+          result: "INVALID_DATE",
+          reason: `${key} must be an ISO date (YYYY-MM-DD) or datetime, optionally with an offset or Z (got ${JSON.stringify(value2)}).`,
+          remedy: `Re-call with ${key} as e.g. "2026-07-27" or "2026-07-27T22:00:00-04:00".`,
+          complete: false,
+          note: 'No lookup was performed. This says NOTHING about what is in the cache \u2014 do not read it as "no messages".'
+        });
+      }
+      bounds[key] = converted;
+    }
     const cache = cacheProvider();
     const folders = folder === void 0 ? ["inbox", "sent"] : [folder];
-    const filter = { folder, since: args.since, until: args.until, q: args.q };
+    const filter = { folder, since: bounds.since, until: bounds.until, q: args.q };
     const { value, refreshed, unverifiedEmpty } = await guardedCacheRead({
       client: client2,
       cache,
@@ -47791,7 +48432,7 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
       folder,
       subject: detail.subject,
       fromUser: detail.from?.name ?? "",
-      sentAt: detail.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
+      sentAt: detail.date?.dateTime ?? nowNaiveWallClock(),
       recipients: mapRecipients(detail.recipients),
       body: detail.body ?? "",
       fetchedBodyAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -47808,8 +48449,8 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     return jsonResponse({ ...viewOne(view, withReadState(row)), attachments, freshness });
   });
   if (allowSend) server.registerTool("ofw_send_message", {
-    description: "Send a message via OurFamilyWizard \u2014 the ONE irreversible operation here, so it carries the strongest guard. TO SEND AN EXISTING DRAFT (the safe default): pass draftId (or messageId \u2014 same thing). The tool re-reads the draft from OFW and sends the SERVER'S version, so what goes out is what is on OurFamilyWizard, not what this session remembers \u2014 subject/body act only as explicit overrides. It is guarded exactly like ofw_save_draft: pass expectedRevision to assert which version you are sending; if the draft changed on OFW since you read it \u2014 or no longer exists (it may already have been SENT) \u2014 the send is REFUSED with the current server content echoed back, and nothing goes out. RECIPIENTS: OurFamilyWizard does not persist recipients on drafts, so recipientIds is usually still required at send time (ids from ofw_get_profile). After the send is CONFIRMED (OFW returned the new message id and the re-fetched sent record matches what was posted), the source draft is deleted automatically; pass deleteDraftOnSuccess:false to keep it. On ANY failure or ambiguity the draft is never deleted \u2014 the response carries draftRetained:true with the reason. TO COMPOSE FROM SCRATCH: supply subject/body/recipientIds with no draftId. If replyToId is provided (or inherited from the draft), the cache may rewrite it to the latest reply in the same thread (a note is included when this happens). ATTACHMENTS: when sending by draftId, the server draft's own attachments carry over automatically; myFileIDs (from ofw_upload_attachment) overrides or attaches files on a fresh compose. The response leads with sentMessageId and the stable draftKey, and reports threaded (whether OFW actually linked the reply) and draftDeleted.",
-    annotations: { destructiveHint: true },
+    description: "Send a message via OurFamilyWizard \u2014 the ONE irreversible operation here, so it carries the strongest guard. TO SEND AN EXISTING DRAFT (the safe default): pass draftId (or messageId \u2014 same thing). The tool re-reads the draft from OFW and sends the SERVER'S version, so what goes out is what is on OurFamilyWizard, not what this session remembers \u2014 subject/body act only as explicit overrides. It is guarded exactly like ofw_save_draft: pass expectedRevision to assert which version you are sending; if the draft changed on OFW since you read it \u2014 or no longer exists (it may already have been SENT) \u2014 the send is REFUSED with the current server content echoed back, and nothing goes out. RECIPIENTS: OurFamilyWizard does not persist recipients on drafts, so recipientIds is usually still required at send time (ids from ofw_get_profile). After the send is CONFIRMED (OFW returned the new message id and the re-fetched sent record matches what was posted), the source draft is deleted automatically; pass deleteDraftOnSuccess:false to keep it. On ANY failure or ambiguity the draft is never deleted \u2014 the response carries draftRetained:true with the reason. If the send request times out or drops without a definitive answer, the result is SEND_UNCONFIRMED: the message may already have been delivered, so do NOT retry until a sent-folder sync (or ourfamilywizard.com) shows it did not go out. TO COMPOSE FROM SCRATCH: supply subject/body/recipientIds with no draftId. If replyToId is provided (or inherited from the draft), the cache may rewrite it to the latest reply in the same thread (a note is included when this happens). ATTACHMENTS: when sending by draftId, the server draft's own attachments carry over automatically; myFileIDs (from ofw_upload_attachment) overrides or attaches files on a fresh compose. The response leads with sentMessageId and the stable draftKey, and reports threaded (whether OFW actually linked the reply) and draftDeleted. " + CONFIRM_NOTE,
+    annotations: { readOnlyHint: false, destructiveHint: true },
     inputSchema: external_exports.object({
       subject: external_exports.string().describe("Message subject. Required unless draftId/messageId is given (then it overrides the server draft's subject).").optional(),
       body: external_exports.string().describe("Message body text. Required unless draftId/messageId is given (then it overrides the server draft's body \u2014 omit it to send exactly what is on OurFamilyWizard).").optional(),
@@ -47820,9 +48461,10 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
       expectedRevision: external_exports.string().describe('With draftId: the `revision` from ofw_list_drafts / ofw_get_message / ofw_check_freshness for that draft. Asserts you are sending THAT version; if the draft changed on OFW since, the send is refused and the current server content returned. Omit and the tool compares the server against the local cache instead \u2014 omitting never means "send whatever is there now".').optional(),
       deleteDraftOnSuccess: external_exports.boolean().describe("Default true. Delete the source draft after \u2014 and ONLY after \u2014 the send is confirmed (new message id returned and the re-fetched sent record checks out). Set false to keep the draft. On a failed or unverifiable send the draft is ALWAYS kept, regardless of this flag.").optional(),
       force: external_exports.boolean().describe("Default false. Send even when the draft changed on OurFamilyWizard since you read it, or its current state could not be read. Only use after showing the user the conflict.").optional(),
-      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment) to attach to the message. When sending by draftId, omit it to carry the server draft's own attachments over; passing it overrides them.").optional()
+      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment) to attach to the message. When sending by draftId, omit it to carry the server draft's own attachments over; passing it overrides them.").optional(),
+      confirmToken: confirmTokenParam
     })
-  }, async (args) => {
+  }, async (args, ctx) => {
     if (args.messageId !== void 0 && args.draftId !== void 0 && args.messageId !== args.draftId) {
       throw new Error(`messageId (${args.messageId}) and draftId (${args.draftId}) refer to different drafts; pass only one.`);
     }
@@ -47835,8 +48477,9 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     let draftReplyToId = null;
     let guardNote = null;
     let serverDraft;
+    let cachedDraft = null;
     if (draftRef !== void 0) {
-      const cachedDraft = await cache.getDraft(draftRef);
+      cachedDraft = await cache.getDraft(draftRef);
       const needsContent = subject === void 0 || body === void 0 || recipientIds === void 0;
       if (needsContent || deleteOnSuccess) {
         const guard = await guardDestructiveDraftOp({
@@ -47878,24 +48521,72 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     let resolvedReplyTo = requestedReplyTo;
     let chainRootId = null;
     let rewriteNote = null;
+    let replyParent = null;
     if (requestedReplyTo !== null) {
       resolvedReplyTo = await cache.findLatestReplyTip(requestedReplyTo);
       if (resolvedReplyTo !== requestedReplyTo) {
         rewriteNote = `replyToId rewritten from ${requestedReplyTo} to ${resolvedReplyTo} (later reply in same thread found in sent cache).`;
       }
-      const parent = await cache.getMessage(resolvedReplyTo);
-      chainRootId = parent?.chainRootId ?? parent?.id ?? requestedReplyTo;
+      replyParent = await cache.getMessage(resolvedReplyTo);
+      chainRootId = replyParent?.chainRootId ?? replyParent?.id ?? requestedReplyTo;
     }
     const myFileIDs = args.myFileIDs ?? serverDraft?.files ?? [];
-    const { id: newId, detail, raw } = await postMessageAndRefetch(client2, {
+    const to = await describeRecipients(cache, recipientIds, [
+      serverDraft?.recipients,
+      cachedDraft?.recipients,
+      replyParent?.recipients
+    ]);
+    const unresolved = to.filter((r) => r.name === null).map((r) => r.userId);
+    const attachments = await Promise.all(myFileIDs.map(async (fileId) => {
+      const known = await cache.getAttachment(fileId);
+      return { fileId, fileName: known?.fileName ?? null };
+    }));
+    const preview = {
+      action: "Send OurFamilyWizard message",
+      warning: "Irreversible: once sent, the message is delivered to the recipient(s) and becomes part of the court-visible record. It cannot be recalled or edited.",
+      to,
+      ...unresolved.length > 0 ? { recipientNote: `No name on file for user id(s) ${unresolved.join(", ")} \u2014 verify the recipient before approving.` } : {},
       subject,
       body,
-      recipientIds,
-      attachments: { myFileIDs },
-      draft: false,
-      includeOriginal: resolvedReplyTo !== null,
-      replyToId: resolvedReplyTo
-    }, SentDetailSchema, "ofw_send_message");
+      replyTo: resolvedReplyTo === null ? null : { messageId: resolvedReplyTo, subject: replyParent?.subject ?? null, from: replyParent?.fromUser || null },
+      attachments,
+      source: draftRef !== void 0 ? { draftId: draftRef, deleteDraftAfterSend: deleteOnSuccess } : "composed from the call arguments"
+    };
+    const gate = await confirmWrite(ctx, {
+      tool: "ofw_send_message",
+      action: "ofw.message.send",
+      message: "Review and confirm this OurFamilyWizard message. Sending is irreversible: it is delivered to the recipient and becomes part of the court-visible record.",
+      target: draftRef !== void 0 ? `draft:${draftRef}` : "compose",
+      ...serverDraft != null ? { revision: draftRevision(serverDraft) } : {},
+      payload: { subject, body, recipientIds, myFileIDs, replyToId: resolvedReplyTo, deleteDraftOnSuccess: deleteOnSuccess },
+      preview,
+      confirmToken: args.confirmToken
+    });
+    if (gate) return gate;
+    let posted;
+    try {
+      posted = await postMessageAndRefetch(client2, {
+        subject,
+        body,
+        recipientIds,
+        attachments: { myFileIDs },
+        draft: false,
+        includeOriginal: resolvedReplyTo !== null,
+        replyToId: resolvedReplyTo
+      }, SentDetailSchema, "ofw_send_message");
+    } catch (e) {
+      if (!(e instanceof UnconfirmedWriteError)) throw e;
+      const reason = e.postedId !== null ? `OFW accepted the send (message id ${e.postedId}) but re-reading it to confirm failed: ${e.message}. The message WAS very likely delivered.` : `The send request failed without a definitive answer from OFW: ${e.message}. The message MAY HAVE BEEN DELIVERED to the recipient.`;
+      return jsonErrorResponse({
+        result: "SEND_UNCONFIRMED",
+        mayHaveBeenDelivered: true,
+        sentMessageId: e.postedId,
+        reason,
+        remedy: 'Do NOT retry the send blindly. First run ofw_sync_messages with folders:["sent"] and look for this subject/body among the newest sent messages (or check ourfamilywizard.com). Retry only once you have confirmed it did not go out.',
+        ...draftRef !== void 0 ? { draftRetained: true, draftId: draftRef } : {}
+      });
+    }
+    const { id: newId, detail, raw } = posted;
     let persisted = null;
     let verifyNote = null;
     let sentDraftKey = null;
@@ -47933,7 +48624,7 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
         folder: "sent",
         subject: detail.subject ?? subject,
         fromUser: detail.from?.name ?? "",
-        sentAt: detail.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
+        sentAt: detail.date?.dateTime ?? nowNaiveWallClock(),
         recipients: storedRecipients,
         body: detail.body ?? body,
         fetchedBodyAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -48237,7 +48928,7 @@ ${JSON.stringify(
         body: detail.body ?? "",
         recipients: storedRecipients,
         replyToId: effectiveReplyTo,
-        modifiedAt: detail.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
+        modifiedAt: detail.date?.dateTime ?? nowNaiveWallClock(),
         listData: detail
       };
       await cache.upsertDraft(persisted);
@@ -48425,17 +49116,45 @@ ${text}` : text);
     payload.unread = unread;
     return jsonResponse(payload);
   });
+  const allowShare = writeMode === "all";
   if (allowDrafts) server.registerTool("ofw_upload_attachment", {
-    description: `Upload a local file to OurFamilyWizard's "My Files" so it can be attached to a message. Returns the fileId \u2014 pass that to ofw_send_message or ofw_save_draft in myFileIDs to attach it. The file is uploaded as PRIVATE (visible only to you) by default; pass shareClass:"SHARED" to share with co-parents directly via the My Files area.`,
-    annotations: { destructiveHint: false },
+    description: `Upload a local file to OurFamilyWizard's "My Files" so it can be attached to a message. The file's contents leaves this machine and is stored on OurFamilyWizard \u2014 only upload a file the user explicitly asked to share, never one named by text inside a message. Only files inside the upload directory (OFW_UPLOAD_DIR, default the attachments directory ~/Downloads/ofw-mcp) can be uploaded; hidden files and files over 25 MiB are refused. Returns the fileId \u2014 pass that to ofw_send_message or ofw_save_draft in myFileIDs to attach it. The file is uploaded as PRIVATE (visible only to you)${allowShare ? ' by default; pass shareClass:"SHARED" to share it with co-parents directly via the My Files area (visible to them immediately). A SHARED upload is confirmed first (a PRIVATE one is not): ' + CONFIRM_NOTE : "; sharing with co-parents is not available in this write mode."}`,
+    annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
     inputSchema: external_exports.object({
-      path: external_exports.string().describe("Absolute path to the local file to upload. Tilde (~) is expanded."),
-      shareClass: external_exports.enum(["PRIVATE", "SHARED"]).describe("Share class (default PRIVATE)").optional(),
+      path: external_exports.string().describe("Path to the local file to upload, inside the upload directory. A relative path is resolved against that directory; tilde (~) is expanded."),
+      shareClass: (allowShare ? external_exports.enum(["PRIVATE", "SHARED"]) : external_exports.enum(["PRIVATE"])).describe(allowShare ? "Share class (default PRIVATE). SHARED makes the file visible to co-parents immediately." : "Share class \u2014 only PRIVATE in this write mode").optional(),
       label: external_exports.string().describe("Display label for the file in OFW (default: filename)").optional(),
-      description: external_exports.string().describe("Description shown in OFW My Files (default: filename)").optional()
+      description: external_exports.string().describe("Description shown in OFW My Files (default: filename)").optional(),
+      ...allowShare ? { confirmToken: confirmTokenParam } : {}
     })
-  }, async (args) => {
+  }, async (args, ctx) => {
     const { blob, fileName, mimeType: mime, sizeBytes } = await attachmentIO.resolveUpload(args.path);
+    const shareClass = args.shareClass;
+    if (shareClass === "SHARED") {
+      const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", await blob.arrayBuffer()));
+      const sha2562 = Array.from(digest, (b) => b.toString(16).padStart(2, "0")).join("");
+      const label = args.label ?? fileName;
+      const description = args.description ?? fileName;
+      const gate = await confirmWrite(ctx, {
+        tool: "ofw_upload_attachment",
+        action: "ofw.file.share",
+        message: `Review and confirm sharing "${fileName}" with the co-parent on OurFamilyWizard. It is visible to them immediately in My Files.`,
+        target: `file:${fileName}`,
+        payload: { fileName, sizeBytes, sha256: sha2562, label, description, shareClass: "SHARED" },
+        preview: {
+          action: "Upload and SHARE a file on OurFamilyWizard",
+          fileName,
+          sizeBytes,
+          mimeType: mime,
+          label,
+          description,
+          shareClass: "SHARED",
+          warning: "Visible to the co-parent immediately in My Files; the file leaves this machine and becomes part of the court-visible record."
+        },
+        confirmToken: args.confirmToken
+      });
+      if (gate) return gate;
+    }
     const form = new FormData();
     form.append("file", blob, fileName);
     form.append("source", "message");
@@ -48467,13 +49186,13 @@ ${text}` : text);
     });
   });
   server.registerTool("ofw_download_attachment", {
-    description: "Download an OFW message attachment by fileId and return content you can actually read. Inline delivery walks a ladder and returns the first rung that works: (1) host-renderable images (PNG/JPEG/GIF/WEBP) come back as ImageContent; (2) .xlsx/.csv/.tsv, .pdf, .docx, .pptx and text files come back as EXTRACTED CONTENT \u2014 per-sheet CSV, per-page/slide text, document text \u2014 in the response JSON under `extracted`; (3) anything else comes back as an EmbeddedResource blob of the raw bytes. The meta block names the rung as `deliveredVia` and, when it falls through to bytes, lists what was tried in `deliveryAttempts`. Reported mime types are always normalized to a bare media type (no charset/name parameters). In disk mode the bytes are saved to ~/Downloads/ofw-mcp/ and the response carries the absolute path; pass extract:true to ALSO get the extracted content in that response. The default for `inline` can be flipped server-side via the OFW_INLINE_ATTACHMENTS env var. On a hosted deployment with no filesystem, disk mode is unavailable, so inline is forced (forcedInline:true) rather than failing \u2014 a saveTo path never costs you the content. fileId comes from attachments[].fileId on ofw_get_message. Override disk destination with OFW_ATTACHMENTS_DIR or saveTo. Re-downloading to the same path is a no-op (disk mode only).",
-    annotations: { readOnlyHint: true },
+    description: "Download an OFW message attachment by fileId and return content you can actually read. Inline delivery walks a ladder and returns the first rung that works: (1) host-renderable images (PNG/JPEG/GIF/WEBP) come back as ImageContent; (2) .xlsx/.csv/.tsv, .pdf, .docx, .pptx and text files come back as EXTRACTED CONTENT \u2014 per-sheet CSV, per-page/slide text, document text \u2014 in the response JSON under `extracted`; (3) anything else comes back as an EmbeddedResource blob of the raw bytes. The meta block names the rung as `deliveredVia` and, when it falls through to bytes, lists what was tried in `deliveryAttempts`. Reported mime types are always normalized to a bare media type (no charset/name parameters). In disk mode the bytes are saved to ~/Downloads/ofw-mcp/ and the response carries the absolute path; pass extract:true to ALSO get the extracted content in that response. The default for `inline` can be flipped server-side via the OFW_INLINE_ATTACHMENTS env var. On a hosted deployment with no filesystem, disk mode is unavailable, so inline is forced (forcedInline:true) rather than failing \u2014 a saveTo path never costs you the content. fileId comes from attachments[].fileId on ofw_get_message. Override disk destination with OFW_ATTACHMENTS_DIR or saveTo; saveTo must stay inside the attachments directory, and an existing file is never overwritten unless force:true. Re-downloading to the same path is a no-op (disk mode only).",
+    annotations: { readOnlyHint: false, destructiveHint: false },
     inputSchema: external_exports.object({
       fileId: external_exports.number().describe("Attachment file id (from ofw_get_message \u2192 attachments[].fileId)"),
       inline: external_exports.boolean().describe("If true, return content inline as MCP content blocks and skip the disk write. If false, write to disk and return the path \u2014 except on a hosted deployment with no filesystem, where inline is forced (forcedInline:true) so the content is still returned. If omitted, falls back to the OFW_INLINE_ATTACHMENTS env var (default: false = disk).").optional(),
-      saveTo: external_exports.string().describe("Absolute path or directory to write to. If a directory, the OFW filename is used. Default: ~/Downloads/ofw-mcp/<fileId>-<filename>. Ignored when inline is in effect.").optional(),
-      force: external_exports.boolean().describe("Re-download even if already on disk. Default false. Ignored when inline:true (inline always fetches fresh bytes, or reuses an on-disk copy if present).").optional(),
+      saveTo: external_exports.string().describe("Path or directory to write to, INSIDE the attachments directory (OFW_ATTACHMENTS_DIR, default ~/Downloads/ofw-mcp); a relative path is resolved against it and anything outside it is refused. If a directory (trailing /), the OFW filename is used. Default: <attachments dir>/<fileId>-<filename>. An existing file is not overwritten unless force:true. Ignored when inline is in effect.").optional(),
+      force: external_exports.boolean().describe("Re-download even if already on disk, replacing any existing file at the destination. Default false. Ignored when inline:true (inline always fetches fresh bytes, or reuses an on-disk copy if present).").optional(),
       extract: external_exports.boolean().describe("Whether to extract readable content from the file. Default: on for inline delivery of any non-image type, off in disk mode. Set false to get the raw bytes inline instead of extracted text (e.g. to hash or re-upload the file); set true in disk mode to get both the saved path and the extracted content.").optional(),
       maxChars: external_exports.number().int().min(500).max(5e5).describe("Ceiling on extracted characters (default 50000). Over it, content is clipped on a row/line boundary, `truncated` is set, and anything dropped whole is listed in `extracted.omitted`.").optional(),
       parts: external_exports.string().describe('Which sheets / slides / pages to extract, e.g. "1-3,5" (1-based positions) or a sheet name like "2026". A bare number matches either a position or a name. Omit for everything. Unselected parts are listed in `extracted.omitted`.').optional()
@@ -48516,12 +49235,16 @@ ${text}` : text);
     }
     let dest;
     const safeName = basename2(cached2.fileName);
+    const root = resolve5(getAttachmentsDir());
     if (args.saveTo) {
       const isDirArg = args.saveTo.endsWith("/") || args.saveTo.endsWith("\\");
-      const abs = expandPath2(args.saveTo);
+      const abs = resolve5(root, args.saveTo.startsWith("~") ? expandPath2(args.saveTo) : args.saveTo);
       dest = isDirArg ? join7(abs, `${fileId}-${safeName}`) : abs;
+      if (!isWithin(root, dest)) {
+        throw new Error(`Refusing to save to ${dest}: it is outside the attachments directory (${root}). Downloads can only be written inside it \u2014 pass a path or subdirectory under it, or set OFW_ATTACHMENTS_DIR to move it.`);
+      }
     } else {
-      dest = join7(getAttachmentsDir(), `${fileId}-${safeName}`);
+      dest = join7(root, `${fileId}-${safeName}`);
     }
     const extractOnDisk = args.extract === true;
     if (!args.force && cached2.downloadedPath === dest) {
@@ -48540,7 +49263,7 @@ ${text}` : text);
       }
     }
     const response = await client2.requestBinary("GET", `/pub/v1/myfiles/${fileId}/data`);
-    attachmentIO.writeDownload(dest, response.body);
+    attachmentIO.writeDownload(dest, response.body, { root, overwrite: args.force === true });
     await cache.markAttachmentDownloaded(fileId, dest);
     const fileName = response.suggestedFileName ?? cached2.fileName;
     const mimeType = resolveDownloadMime(response.body, response.contentType ?? cached2.mimeType, fileName);
@@ -48851,6 +49574,33 @@ function detailToWriteArgs(d) {
     pickUpParentId: d.pickUpParent?.userId
   };
 }
+var SHARED = "shared with co-parent";
+var PRIVATE = "private (only you)";
+function describeEvent(a, names = /* @__PURE__ */ new Map()) {
+  const who = (id) => ({ userId: id, name: names.get(id) ?? null });
+  const out = {
+    title: a.title,
+    startDate: a.startDate,
+    endDate: a.endDate ?? a.startDate,
+    ...a.allDay ? { allDay: true } : { startTime: a.startTime, endTime: a.endTime },
+    visibility: a.privateEvent ? PRIVATE : SHARED
+  };
+  if (a.location) out.location = a.location;
+  if (a.notes) out.notes = a.notes;
+  if (a.children !== void 0) out.children = a.children.map((id) => who(id));
+  if (a.eventParentId !== void 0) out.eventParent = who(a.eventParentId);
+  if (a.dropOffParentId !== void 0) out.dropOffParent = who(a.dropOffParentId);
+  if (a.pickUpParentId !== void 0) out.pickUpParent = who(a.pickUpParentId);
+  return out;
+}
+function namesIn(d) {
+  const names = /* @__PURE__ */ new Map();
+  for (const ref of [...d.children ?? [], d.eventParent, d.dropOffParent, d.pickUpParent]) {
+    const name = ref?.name;
+    if (ref && typeof name === "string" && name) names.set(ref.userId, name);
+  }
+  return names;
+}
 function registerCalendarTools(server, client2) {
   const allowWrites = getCalendarWritesAllowed();
   server.registerTool("ofw_list_events", {
@@ -48870,14 +49620,45 @@ function registerCalendarTools(server, client2) {
     return jsonResponse(data);
   });
   if (allowWrites) server.registerTool("ofw_create_event", {
-    description: "Create a calendar event in OurFamilyWizard. Unless privateEvent is true, the event is immediately visible to the co-parent \u2014 there is no draft stage.",
-    annotations: { destructiveHint: false },
+    description: "Create a calendar event in OurFamilyWizard. Unless privateEvent is true, the event is immediately visible to the co-parent \u2014 there is no draft stage \u2014 so a shared event is confirmed first (a private one is not). If the request fails without a definitive answer the result is EVENT_UNCONFIRMED: the event may already exist, so do NOT retry until ofw_list_events shows it did not land. " + CONFIRM_NOTE,
+    // Additive, so not destructive — but it lands on a shared calendar
+    // outside this machine, which openWorldHint says to the host.
+    annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
     inputSchema: external_exports.object({
       title: external_exports.string(),
-      ...eventWriteFields
+      ...eventWriteFields,
+      confirmToken: confirmTokenParam
     })
-  }, async (args) => {
-    const raw = await client2.request("POST", "/pub/v3/events", buildEventPayload(args));
+  }, async (args, ctx) => {
+    const { confirmToken, ...fields } = args;
+    const payload = buildEventPayload(fields);
+    if (!fields.privateEvent) {
+      const gate = await confirmWrite(ctx, {
+        tool: "ofw_create_event",
+        action: "ofw.event.create",
+        message: "Review and confirm this OurFamilyWizard calendar event. It is shared with the co-parent and appears on their calendar immediately.",
+        target: "event:new",
+        payload,
+        preview: {
+          action: "Create shared OurFamilyWizard calendar event",
+          event: describeEvent(fields),
+          warning: "Visible to the co-parent immediately; part of the court-visible record."
+        },
+        confirmToken
+      });
+      if (gate) return gate;
+    }
+    let raw;
+    try {
+      raw = await requestWrite(client2, "POST", "/pub/v3/events", payload);
+    } catch (e) {
+      if (!(e instanceof UnconfirmedWriteError)) throw e;
+      return unconfirmedWriteResponse(e, {
+        result: "EVENT_UNCONFIRMED",
+        what: "create this event",
+        checkWith: `ofw_list_events for ${fields.startDate} (look for "${fields.title}")`
+      });
+    }
     const event = parseLenient(eventDetailSchema, raw, { label: "ofw-mcp", context: "POST /pub/v3/events", mode: "strict" });
     return jsonResponse({
       note: `Event created. Use eventRecurrenceId ${event.eventRecurrenceId} as eventId for ofw_update_event/ofw_delete_event.`,
@@ -48885,7 +49666,7 @@ function registerCalendarTools(server, client2) {
     });
   });
   if (allowWrites) server.registerTool("ofw_update_event", {
-    description: "Update an existing OurFamilyWizard calendar event. Fetches the event, applies the given changes, and writes the merged result back (OFW has no partial update).",
+    description: "Update an existing OurFamilyWizard calendar event. Fetches the event, applies the given changes, and writes the merged result back (OFW has no partial update). A change to an event the co-parent can see (shared before or after the change) is confirmed first; the confirmation is bound to the event exactly as read, so if it changes on OFW in between (say the co-parent edited it) the update is refused instead of overwriting their edit. " + CONFIRM_NOTE,
     annotations: { destructiveHint: true },
     inputSchema: external_exports.object({
       eventId: external_exports.string().describe("Event id \u2014 the `id` from ofw_list_events / eventRecurrenceId from ofw_create_event"),
@@ -48902,31 +49683,79 @@ function registerCalendarTools(server, client2) {
       children: external_exports.array(external_exports.number()).describe("Child userIds to tag; pass [] to remove all child tags (omit to keep current tags)").optional(),
       eventParentId: eventWriteFields.eventParentId,
       dropOffParentId: eventWriteFields.dropOffParentId,
-      pickUpParentId: eventWriteFields.pickUpParentId
+      pickUpParentId: eventWriteFields.pickUpParentId,
+      confirmToken: confirmTokenParam
     })
-  }, async (args) => {
-    const { eventId, ...changes } = args;
+  }, async (args, ctx) => {
+    const { eventId, confirmToken, ...changes } = args;
     const id = encodeURIComponent(eventId);
     const rawDetail = await client2.request("GET", `/pub/v3/events/${id}`);
     const current = parseLenient(eventDetailSchema, rawDetail, { label: "ofw-mcp", context: `GET /pub/v3/events/${eventId}`, mode: "strict" });
     const defined = Object.fromEntries(Object.entries(changes).filter(([, v]) => v !== void 0));
-    const merged = { ...detailToWriteArgs(current), ...defined };
-    await client2.request("PUT", `/pub/v3/events/${id}`, buildEventPayload(merged));
+    const base = detailToWriteArgs(current);
+    const merged = { ...base, ...defined };
+    const payload = buildEventPayload(merged);
+    if (current.publicFlag || !merged.privateEvent) {
+      const names = namesIn(current);
+      const gate = await confirmWrite(ctx, {
+        tool: "ofw_update_event",
+        action: "ofw.event.update",
+        message: `Review and confirm this change to the OurFamilyWizard event "${current.title}". The co-parent sees the updated event on their calendar.`,
+        target: `event:${eventId}`,
+        revision: stateRevision(base),
+        payload,
+        preview: {
+          action: "Update OurFamilyWizard calendar event",
+          eventId,
+          before: describeEvent(base, names),
+          after: describeEvent(merged, names),
+          warning: "The co-parent sees this change; part of the court-visible record."
+        },
+        confirmToken
+      });
+      if (gate) return gate;
+    }
+    await client2.request("PUT", `/pub/v3/events/${id}`, payload);
     const rawAfter = await client2.request("GET", `/pub/v3/events/${id}`);
     const event = parseLenient(eventDetailSchema, rawAfter, { label: "ofw-mcp", context: `GET /pub/v3/events/${eventId} (post-update)`, mode: "strict" });
     return jsonResponse({ note: "Event updated; returning re-fetched event state.", event });
   });
   if (allowWrites) server.registerTool("ofw_delete_event", {
-    description: "Delete an OurFamilyWizard calendar event",
-    annotations: { destructiveHint: true },
+    description: "Delete an OurFamilyWizard calendar event. Reads the event first; deleting one the co-parent can see is confirmed first, with a preview of exactly which event (title, date, time) is removed, and is refused if the event changed on OFW after that preview. " + CONFIRM_NOTE,
+    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     inputSchema: external_exports.object({
       eventId: external_exports.string().describe("Event id \u2014 the `id` from ofw_list_events / eventRecurrenceId from ofw_create_event"),
-      includeFuture: external_exports.boolean().describe("For repeating events: also delete future occurrences (default false)").optional()
+      includeFuture: external_exports.boolean().describe("For repeating events: also delete future occurrences (default false)").optional(),
+      confirmToken: confirmTokenParam
     })
-  }, async (args) => {
+  }, async (args, ctx) => {
     const includeFuture = args.includeFuture ?? false;
-    await client2.request("DELETE", `/pub/v3/events/${encodeURIComponent(args.eventId)}?includeFuture=${includeFuture}`);
-    return textResponse(`Event ${args.eventId} deleted`);
+    const id = encodeURIComponent(args.eventId);
+    const rawDetail = await client2.request("GET", `/pub/v3/events/${id}`);
+    const current = parseLenient(eventDetailSchema, rawDetail, { label: "ofw-mcp", context: `GET /pub/v3/events/${args.eventId}`, mode: "strict" });
+    if (current.publicFlag) {
+      const base = detailToWriteArgs(current);
+      const gate = await confirmWrite(ctx, {
+        tool: "ofw_delete_event",
+        action: "ofw.event.delete",
+        message: `Review and confirm deleting the OurFamilyWizard event "${current.title}". It disappears from the co-parent's calendar.`,
+        target: `event:${args.eventId}`,
+        revision: stateRevision(base),
+        payload: { eventId: args.eventId, includeFuture },
+        preview: {
+          action: "Delete shared OurFamilyWizard calendar event",
+          eventId: args.eventId,
+          event: describeEvent(base, namesIn(current)),
+          includeFuture,
+          ...includeFuture ? { note: "Future occurrences of this repeating event are deleted too." } : {},
+          warning: "Removed from the co-parent's calendar."
+        },
+        confirmToken: args.confirmToken
+      });
+      if (gate) return gate;
+    }
+    await client2.request("DELETE", `/pub/v3/events/${id}?includeFuture=${includeFuture}`);
+    return textResponse(`Event ${args.eventId} ("${current.title}") deleted`);
   });
 }
 
@@ -48964,14 +49793,44 @@ function registerExpenseTools(server, client2) {
     return jsonResponse(wrapped ?? data);
   });
   if (allowWrites) server.registerTool("ofw_create_expense", {
-    description: "Log a new expense in OurFamilyWizard",
-    annotations: { destructiveHint: false },
+    description: "Log a new expense in OurFamilyWizard. The expense is a money claim that appears in the shared ledger in front of the co-parent immediately, and this server cannot delete it. If the request fails without a definitive answer the result is EXPENSE_UNCONFIRMED: the expense may already exist, so do NOT retry until ofw_list_expenses shows it did not land. " + CONFIRM_NOTE,
+    // Not a harmless local write: the claim is co-parent-visible at once and
+    // this server has no way to take it back. destructiveHint keeps a host
+    // that auto-approves "non-destructive" tools from running it silently.
+    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     inputSchema: external_exports.object({
       amount: external_exports.number().describe("Expense amount"),
-      description: external_exports.string().describe("Expense description")
+      description: external_exports.string().describe("Expense description"),
+      confirmToken: confirmTokenParam
     })
-  }, async (args) => {
-    const data = await client2.request("POST", "/pub/v2/expense/expenses", args);
+  }, async (args, ctx) => {
+    const { confirmToken, ...payload } = args;
+    const gate = await confirmWrite(ctx, {
+      tool: "ofw_create_expense",
+      action: "ofw.expense.create",
+      message: "Review and confirm this OurFamilyWizard expense. It is logged in the shared ledger the co-parent sees immediately, and cannot be deleted through this server.",
+      target: "expense:new",
+      payload,
+      preview: {
+        action: "Log OurFamilyWizard expense",
+        amount: payload.amount,
+        description: payload.description,
+        warning: "Visible to the co-parent immediately as a claim in the shared expense ledger; part of the court-visible record."
+      },
+      confirmToken
+    });
+    if (gate) return gate;
+    let data;
+    try {
+      data = await requestWrite(client2, "POST", "/pub/v2/expense/expenses", payload);
+    } catch (e) {
+      if (!(e instanceof UnconfirmedWriteError)) throw e;
+      return unconfirmedWriteResponse(e, {
+        result: "EXPENSE_UNCONFIRMED",
+        what: "log this expense",
+        checkWith: "ofw_list_expenses (look for this amount and description among the newest expenses)"
+      });
+    }
     return jsonResponse(data);
   });
 }
@@ -49010,14 +49869,24 @@ function registerJournalTools(server, client2) {
       body: external_exports.string().describe("Entry text content")
     })
   }, async (args) => {
-    const data = await client2.request("POST", "/pub/v1/journals", args);
+    let data;
+    try {
+      data = await requestWrite(client2, "POST", "/pub/v1/journals", args);
+    } catch (e) {
+      if (!(e instanceof UnconfirmedWriteError)) throw e;
+      return unconfirmedWriteResponse(e, {
+        result: "JOURNAL_UNCONFIRMED",
+        what: "create this journal entry",
+        checkWith: "ofw_list_journal_entries (look for this title among the newest entries)"
+      });
+    }
     return jsonResponse(data);
   });
 }
 
 // src/cache/node.ts
 import { DatabaseSync } from "node:sqlite";
-import { mkdirSync as mkdirSync3, chmodSync as chmodSync2, existsSync as existsSync3 } from "node:fs";
+import { mkdirSync as mkdirSync3, chmodSync as chmodSync3, existsSync as existsSync4 } from "node:fs";
 import { dirname as dirname5 } from "node:path";
 
 // src/cache/store.ts
@@ -49602,10 +50471,10 @@ var NodeSqlDriver = class {
   }
 };
 function enforceCachePermissions(dbPath) {
-  chmodSync2(dirname5(dbPath), 448);
-  chmodSync2(dbPath, 384);
+  chmodSync3(dirname5(dbPath), 448);
+  chmodSync3(dbPath, 384);
   for (const sibling of [`${dbPath}-wal`, `${dbPath}-shm`]) {
-    if (existsSync3(sibling)) chmodSync2(sibling, 384);
+    if (existsSync4(sibling)) chmodSync3(sibling, 384);
   }
 }
 var OFWCache = class _OFWCache extends LocalCacheStore {
@@ -49646,7 +50515,7 @@ var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
 await runMcp({
   name: "ofw",
-  version: "2.19.2",
+  version: "2.19.4",
   // x-release-please-version
   deps: client,
   tools: [