ofw-mcp 2.19.5 → 2.20.1

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.19.5"
+    "version": "2.20.1"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.19.5",
+      "version": "2.20.1",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.19.5",
+  "version": "2.20.1",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"

package/README.md

@@ -151,7 +151,10 @@ Read-only tools run automatically. Writes that reach your co-parent or the court
 | `ofw_delete_event` | Delete a calendar event | Confirm (server) if shared | `all` (or `drafts` + `OFW_CALENDAR_WRITES`) |
 | `ofw_get_expense_totals` | Expense summary totals | Auto | any |
 | `ofw_list_expenses` | Expense history | Auto | any |
-| `ofw_create_expense` | Log a new expense | Confirm (server) | `all` |
+| `ofw_list_expense_categories` | Expense category ids and split metadata | Auto | any |
+| `ofw_upload_expense_pdf` | Upload a receipt PDF to My Files for an expense (SHARED — the co-parent sees it in My Files at once, even on a private expense) | Confirm (server) | `all` |
+| `ofw_create_expense` | Log a new expense; supports private entries and one receipt PDF | Confirm (server) | `all` |
+| `ofw_update_expense` | Change an expense, e.g. publish a private one. Pass only the fields to change; it reads the expense first so the rest are kept | Confirm (server) | `all` |
 | `ofw_list_journal_entries` | Journal entries | Auto | any |
 | `ofw_create_journal_entry` | Create a journal entry | Confirm | `all` |
 
@@ -232,7 +235,7 @@ Previews name what you are approving — recipients by name, subject and full bo
 |---|---|---|
 | `MCP_CONFIRM_MODE` | `ask-user` | What a gated write does on a client that cannot show a prompt. `ask-user`: two steps, and the model must get your approval in chat before using the token. `auto`: two steps, but the model may use the token after reviewing the preview itself. `refuse`: such writes are refused (do them on ourfamilywizard.com). An unrecognised value is treated as `refuse`. |
 | `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
-| `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
+| `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. On mcp-host the host supplies a stable per-child key (`MCP_HOST_CONFIRM_SECRET`) and spent tokens are recorded under `MCP_DATA_DIR`, so an approval survives an idle restart. |
 
 Private events and `PRIVATE` uploads — which the co-parent never sees — are not gated. `OFW_WRITE_MODE` below stays the structural layer underneath: a tool your write mode excludes does not exist at all.
 
@@ -250,6 +253,26 @@ The host's "Confirm" permission above is a *hint* to the MCP host — a host con
 
 Unrecognized values fail closed to `none`, with a warning on stderr — a typo never silently grants write access.
 
+#### Expense-only deployments
+
+For a dedicated reimbursement integration, you can also structurally remove unrelated OFW capabilities:
+
+| Setting | Registered surface |
+|---|---|
+| `OFW_EXPENSE_ONLY=true` | `ofw_healthcheck` plus the expense tools only. Profile/dashboard, messages, calendar, and journal tools do not exist. |
+| `OFW_EXPENSE_UPLOAD_ONLY=true` | Strictest mode: `ofw_healthcheck`, `ofw_upload_expense_pdf`, `ofw_create_expense`, and `ofw_update_expense` only. Expense totals/listing are removed too. This flag implies `OFW_EXPENSE_ONLY`. |
+
+These flags are registration-time restrictions, not prompt instructions. A host cannot call a tool that was never registered. Unrecognized non-empty flag values fail closed to the restricted state. `OFW_WRITE_MODE` still applies underneath; for the strict upload workflow set `OFW_WRITE_MODE=all` so expense creation is available.
+
+Recommended reimbursement-only deployment:
+
+```env
+OFW_EXPENSE_UPLOAD_ONLY=true
+OFW_WRITE_MODE=all
+OFW_ALLOW_MARK_READ=false
+```
+
+
 ### Reading is a write, too (`OFW_ALLOW_MARK_READ`)
 
 Fetching a message body for the first time marks it read on OurFamilyWizard and stamps a **"First Viewed" timestamp your co-parent can see**. That is part of the record and cannot be undone — and it happens as a side effect of an ordinary read, so `OFW_WRITE_MODE` does not govern it.

package/dist/auth-password.js

@@ -10,7 +10,7 @@
 // `resolveAuth()` in `./auth.ts` can call it without a Client instance, and
 // so tests can mock it at the module boundary.
 import { createHash } from 'node:crypto';
-import { currentCallSignal } from '@chrischall/mcp-utils';
+import { EdgeBlockedError, currentCallSignal, detectEdgeBlock } from '@chrischall/mcp-utils';
 import { BASE_URL, OFW_PROTOCOL_HEADERS, OFW_TOKEN_TTL_MS, assertOfwUrl } from './protocol.js';
 /**
  * OFW definitively refused this username/password (it re-rendered its login
@@ -86,6 +86,22 @@ export async function loginWithPassword(username, password) {
         }).toString(),
     });
     if (!response.ok) {
+        // A CDN/WAF refusal page is not OFW judging the password: name it, so the
+        // healthcheck reports edge_blocked instead of a missing credential, and
+        // nothing is latched as rejected (chrischall/mcp-host#1015). The page
+        // itself stays out of the message.
+        const edge = detectEdgeBlock({
+            body: await response.text().catch(() => ''),
+            headers: response.headers,
+            status: response.status,
+        });
+        if (edge !== null) {
+            throw new EdgeBlockedError(response.status, edge.vendor, {
+                service: 'OurFamilyWizard',
+                method: 'POST',
+                path: '/ofw/login',
+            });
+        }
         throw new Error(`OFW login failed: ${response.status} ${response.statusText}`);
     }
     const contentType = response.headers.get('content-type') ?? '';