ofw-mcp 2.19.4 → 2.20.0

package/dist/client.js

@@ -144,7 +144,10 @@ export class OFWClient {
                 throw new Error('Rate limited by OFW API');
         }
         if (!response.ok) {
-            throw new Error(`OFW API error: ${response.status} ${response.statusText} for ${method} ${path}`);
+            const errorBody = await response.text();
+            const safeBody = redactSecrets(errorBody).replace(/\s+/g, ' ').trim().slice(0, 4000);
+            throw new Error(`OFW API error: ${response.status} ${response.statusText} for ${method} ${path}` +
+                (safeBody ? ` — ${safeBody}` : ''));
         }
         return response;
     }

package/dist/config.js

@@ -51,6 +51,43 @@ export function getUploadDir() {
         return override.trim();
     return getAttachmentsDir();
 }
+/**
+ * Structural surface restrictions for deployments dedicated to reimbursement
+ * automation.
+ *
+ * OFW_EXPENSE_ONLY=true removes every non-expense registrar except the
+ * healthcheck. Message, calendar, journal and profile/dashboard tools simply do
+ * not exist in the server's tools/list response.
+ *
+ * OFW_EXPENSE_UPLOAD_ONLY=true is stricter and implies OFW_EXPENSE_ONLY: only
+ * ofw_upload_expense_pdf + ofw_create_expense + ofw_update_expense (plus
+ * ofw_healthcheck) register.
+ * Expense reads such as totals/list are omitted as well.
+ *
+ * These are startup-time structural controls. They cannot be raised by a tool
+ * argument, prompt injection, or host permission setting.
+ *
+ * Unrecognized non-empty values fail CLOSED to true. A typo in a restriction
+ * flag must never silently widen the server surface.
+ */
+function restrictiveBoolEnv(name) {
+    const raw = process.env[name];
+    if (typeof raw !== 'string' || raw.trim().length === 0)
+        return false;
+    const value = raw.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'on'].includes(value))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(value))
+        return false;
+    console.error(`[ofw-mcp] Unrecognized ${name} "${raw.trim()}" — failing closed to "true" (restriction enabled). Valid values: true, false.`);
+    return true;
+}
+export function getExpenseUploadOnly() {
+    return restrictiveBoolEnv('OFW_EXPENSE_UPLOAD_ONLY');
+}
+export function getExpenseOnly() {
+    return getExpenseUploadOnly() || restrictiveBoolEnv('OFW_EXPENSE_ONLY');
+}
 /**
  * Gate for write-tool registration, read at registration time (startup).
  *

package/dist/index.js

@@ -19,6 +19,7 @@ import { registerExpenseTools } from './tools/expenses.js';
 import { registerJournalTools } from './tools/journal.js';
 import { OFWCache } from './cache/node.js';
 import { getCacheDbPath } from './config.js';
+import { selectToolRegistrars } from './tool-surface.js';
 import { NodeAttachmentIO } from './tools/attachments.js';
 // The stdio server backs the message cache with a local `node:sqlite` file,
 // opened lazily on first use (so the server still boots and answers the host's
@@ -34,17 +35,20 @@ const nodeAttachmentIO = new NodeAttachmentIO();
 // is preserved: `client` is constructed at module load in ./client.js (auth is
 // resolved lazily on the first tool call), so the host's initial tools/list
 // always succeeds before any credential check runs.
+const expenseRegistrar = (server, deps) => registerExpenseTools(server, deps, nodeAttachmentIO);
+const messageRegistrar = (server, deps) => registerMessageTools(server, deps, nodeCacheProvider, nodeAttachmentIO);
+const tools = selectToolRegistrars({
+    healthcheck: registerHealthcheckTools,
+    user: registerUserTools,
+    messages: messageRegistrar,
+    calendar: registerCalendarTools,
+    expenses: expenseRegistrar,
+    journal: registerJournalTools,
+});
 await runMcp({
     name: 'ofw',
-    version: '2.19.4', // x-release-please-version
+    version: '2.20.0', // x-release-please-version
     deps: client,
-    tools: [
-        registerHealthcheckTools,
-        registerUserTools,
-        (server, deps) => registerMessageTools(server, deps, nodeCacheProvider, nodeAttachmentIO),
-        registerCalendarTools,
-        registerExpenseTools,
-        registerJournalTools,
-    ],
+    tools,
     banner: '[ofw-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.',
 });

package/dist/tool-surface.js

@@ -0,0 +1,14 @@
+import { getExpenseOnly } from './config.js';
+/**
+ * Select the registrars exposed by this deployment.
+ *
+ * Expense-only mode is structural: omitted registrars are never handed to
+ * runMcp, so their tools cannot appear in tools/list or be invoked by name.
+ * OFW_EXPENSE_UPLOAD_ONLY implies this same registrar restriction and the
+ * expense registrar itself removes its read tools.
+ */
+export function selectToolRegistrars(r) {
+    if (getExpenseOnly())
+        return [r.healthcheck, r.expenses];
+    return [r.healthcheck, r.user, r.messages, r.calendar, r.expenses, r.journal];
+}

package/dist/tools/_shared.js

@@ -292,11 +292,15 @@ export async function requestWrite(client, method, path, body) {
  * may have landed and names how to check before any retry.
  */
 export function unconfirmedWriteResponse(e, opts) {
+    // The web app is the fallback for a checkWith that names a tool. A checkWith
+    // that already sends the caller to the web app (a deployment where the list
+    // tool is not registered) needs no second mention of it.
+    const fallback = /ourfamilywizard\.com/i.test(opts.checkWith) ? '' : ' (or on ourfamilywizard.com)';
     return jsonErrorResponse({
         result: opts.result,
         mayHaveLanded: true,
         reason: `The request to ${opts.what} failed without a definitive answer from OFW: ${e.message}. It MAY HAVE BEEN APPLIED on OurFamilyWizard.`,
-        remedy: `Do NOT retry blindly — a second attempt can put a duplicate on the co-parent-visible record. First check with ${opts.checkWith} (or on ourfamilywizard.com), and retry only once you have confirmed it did not land.`,
+        remedy: `Do NOT retry blindly — a second attempt can put a duplicate on the co-parent-visible record. First check with ${opts.checkWith}${fallback}, and retry only once you have confirmed it did not land.`,
     });
 }
 export async function postMessageAndRefetch(client, payload, detailSchema, ctx) {

package/dist/tools/delivery.js

@@ -14,12 +14,29 @@
 //   2. extractable document   → the FILE'S TEXT, as text (see src/extract)
 //   3. raw bytes              → base64 EmbeddedResource, as before
 //
+// Rungs 1 and 3 are bounded by MAX_INLINE_BYTES (10 MiB raw; see below).
 // Rung 3 never disappears, so nothing regresses; rung 2 is what makes a
 // spreadsheet, PDF, Word or PowerPoint attachment readable at all. When a rung
 // is skipped or fails, the response says so by name in `deliveryAttempts` —
 // a caller must never be left guessing why it got bytes instead of content.
 import { extractAttachment } from '../extract/index.js';
 import { isHostRenderableImage } from './attachments.js';
+/**
+ * Upper bound on the RAW bytes this tool will return inline (as ImageContent
+ * or a base64 EmbeddedResource). Extracted text is not subject to it — that is
+ * already bounded by `maxChars`.
+ *
+ * Why 10 MiB: mcp-host, the hosted runtime that runs this MCP for claude.ai,
+ * caps any single child result at 14 MiB of serialized JSON-RPC
+ * (`CHILD_RESULT_MAX_BYTES`, chrischall/mcp-host#952) and replaces anything
+ * larger with a generic "result too large" tool error. 10 MiB raw is ~13.3 MiB
+ * as base64, which with the JSON-RPC envelope still fits under 14 MiB — so this
+ * bound fires first, with a message that says what to do instead. claude.ai
+ * itself accepts images up to 10 MB each (measured 2026-09-27), and before
+ * #952 anything over 10 MiB killed the child process outright. Real traffic
+ * for this tool has peaked at ~3 MB, so normal use never reaches it.
+ */
+export const MAX_INLINE_BYTES = 10 * 1024 * 1024;
 /**
  * Attempt extraction, converting every failure into a REASON rather than an
  * exception: a format we cannot read must still be delivered as bytes, and the
@@ -42,6 +59,26 @@ export async function tryExtract(bytes, mimeType, fileName, opts) {
         return { reason: `extraction failed: ${err instanceof Error ? err.message : String(err)}` };
     }
 }
+/**
+ * Refuse to inline more than {@link MAX_INLINE_BYTES}. This is a tool error
+ * rather than a fallback: the only non-inline channel is disk mode, which the
+ * hosted runtime (the one the cap protects) does not have, and silently
+ * writing to disk when the caller asked for content would not be honest.
+ */
+function assertInlineSize(input, rawRequested) {
+    const { bytes, fileName, fileId, diskAvailable } = input;
+    if (bytes.length <= MAX_INLINE_BYTES)
+        return;
+    const hints = [];
+    if (rawRequested)
+        hints.push('omit extract:false to get the file\'s extracted text instead, if it is a readable document type');
+    if (diskAvailable)
+        hints.push('pass inline:false to save it to disk and get the path');
+    hints.push('or open it directly in OurFamilyWizard');
+    throw new Error(`Attachment ${fileId} (${fileName}) is ${bytes.length} bytes, over the ${MAX_INLINE_BYTES / (1024 * 1024)} MiB `
+        + `limit for returning a file inline (a larger result would exceed the host's response size limit). `
+        + `To get it: ${hints.join('; ')}.`);
+}
 /**
  * Build the content blocks for an inline download by walking the ladder.
  * The first block is always a JSON meta block naming `deliveredVia`, so the
@@ -57,6 +94,7 @@ export async function buildInlineDelivery(input) {
     const block = () => ({ type: 'text', text: JSON.stringify(meta, null, 2) });
     // Rung 1 — the host renders these itself, and a picture beats a description.
     if (isHostRenderableImage(mimeType)) {
+        assertInlineSize(input, false);
         meta.deliveredVia = 'image';
         return { content: [block(), { type: 'image', data: bytes.toString('base64'), mimeType }] };
     }
@@ -80,8 +118,10 @@ export async function buildInlineDelivery(input) {
         /* v8 ignore next -- tryExtract always sets `reason` when it returns no extraction */
         attempts.push(outcome.reason ?? 'extraction produced no content');
     }
-    // Rung 3 — the bytes themselves. Always available, so a fetch that succeeded
-    // never ends with the caller holding nothing.
+    // Rung 3 — the bytes themselves. Always available up to MAX_INLINE_BYTES, so
+    // a fetch that succeeded never ends with the caller holding nothing; beyond
+    // it the caller gets a tool error that says how to reach the file instead.
+    assertInlineSize(input, options.extract === false);
     meta.deliveredVia = 'blob';
     meta.deliveryAttempts = attempts;
     meta.note = 'Returned as raw bytes. Some hosts cannot render an embedded resource of this type; '