ofw-mcp 2.20.0 → 2.20.1

package/dist/client.js

@@ -1,4 +1,4 @@
-import { loadDotenvSafely, parseBoolEnv, redactSecrets, withAmbientCancellation } from '@chrischall/mcp-utils';
+import { EdgeBlockedError, detectEdgeBlock, loadDotenvSafely, parseContentDispositionFilename, parseBoolEnv, redactSecrets, withAmbientCancellation, } from '@chrischall/mcp-utils';
 import { TokenManager } from '@chrischall/mcp-utils/session';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
@@ -18,22 +18,6 @@ try {
 catch {
     /* v8 ignore next -- only reached in a non-Node runtime: no .env to load */
 }
-// Parse a Content-Disposition header for a filename. Prefers RFC 6266
-// `filename*=UTF-8''…` (percent-decoded) and falls back to `filename="…"`.
-function parseContentDispositionFilename(cd) {
-    const extMatch = /filename\*=(?:UTF-8'')?([^;]+)/i.exec(cd);
-    if (extMatch) {
-        const raw = extMatch[1].trim().replace(/^"|"$/g, '');
-        try {
-            return decodeURIComponent(raw);
-        }
-        catch {
-            return raw;
-        }
-    }
-    const m = /filename="?([^";]+)"?/i.exec(cd);
-    return m ? m[1] : null;
-}
 // Set OFW_DEBUG_LOG=1 (or true/yes/on) to log every OFW request/response to
 // stderr. Authorization is redacted. Bodies are logged in full — set this
 // only when debugging, never in normal use.
@@ -59,6 +43,49 @@ function getRequestTimeoutMs() {
 // refresh when its refresh token is `undefined`, so a non-empty placeholder
 // keeps the single-flight refresh path live; the refresh callback ignores it.
 const OFW_REFRESH_SENTINEL = 'ofw';
+/**
+ * Throw {@link EdgeBlockedError} when `response` is a CDN/WAF refusal.
+ *
+ * Its HEADERS are always judged (Cloudflare's `cf-mitigated`). Its BODY is
+ * judged only for a 429: that response is about to be waited out and replayed,
+ * or turned into "Rate limited", so a challenge page served as 429 without the
+ * header would otherwise never reach the body check below the retry and would
+ * be reported as a rate limit (chrischall/mcp-host#1015). The body is read
+ * from a clone, and never when it is JSON — no refusal page is. Other non-2xx
+ * bodies are judged where the error body is read anyway, in `fetchAuthed`, and
+ * a 2xx body is never consumed here.
+ */
+async function throwIfEdgeBlocked(response, method, path) {
+    if (response.ok)
+        return;
+    let edge = detectEdgeBlock({ headers: response.headers, status: response.status });
+    if (edge === null && response.status === 429 && !/json/i.test(response.headers.get('content-type') ?? '')) {
+        let body = '';
+        try {
+            body = await response.clone().text();
+        }
+        catch {
+            /* unreadable: not shown to be a block */
+        }
+        edge = detectEdgeBlock({ body, headers: response.headers, status: response.status });
+    }
+    if (edge !== null) {
+        await releaseBody(response);
+        throw new EdgeBlockedError(response.status, edge.vendor, { service: 'OurFamilyWizard', method, path });
+    }
+}
+/**
+ * Release a response's connection without reading it. A cancel that fails
+ * changes nothing about the answer, so its failure is swallowed.
+ */
+async function releaseBody(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        /* already settled */
+    }
+}
 export class OFWClient {
     // Bearer-token lifecycle is delegated to the shared, race-safe TokenManager
     // (proactive refresh inside the skew window, single-flight refresh so a burst
@@ -124,7 +151,7 @@ export class OFWClient {
         return {
             body: Buffer.from(await response.arrayBuffer()),
             contentType: response.headers.get('content-type'),
-            suggestedFileName: parseContentDispositionFilename(response.headers.get('content-disposition') ?? ''),
+            suggestedFileName: parseContentDispositionFilename(response.headers.get('content-disposition') ?? '') ?? null,
         };
     }
     // Authenticated fetch for both JSON and binary callers. Auth (proactive
@@ -137,14 +164,30 @@ export class OFWClient {
         // preserving the prior bespoke-loop diagnostic.
         let attempt = 0;
         let response = await this.getTokenManager().withAuth((token) => this.fetchOnce(method, path, body, accept, token, attempt++ > 0));
+        // A CDN/WAF refusal page is not OFW answering: the token was never judged.
+        // `withAuth` already declines to spend a re-login on one; checked again
+        // here BEFORE the 429 replay (a challenge can arrive as 429, and waiting it
+        // out only repeats the block) and before the generic error below, so every
+        // tool sees an `EdgeBlockedError` it can branch on instead of an
+        // "OFW API error" with the page dumped into it (chrischall/mcp-host#1015).
+        await throwIfEdgeBlocked(response, method, path);
         if (response.status === 429) {
+            // The first 429's body is never read: release it before the replay.
+            await releaseBody(response);
             await new Promise((r) => setTimeout(r, 2000));
             response = await this.getTokenManager().withAuth((token) => this.fetchOnce(method, path, body, accept, token, true));
-            if (response.status === 429)
+            await throwIfEdgeBlocked(response, method, path);
+            if (response.status === 429) {
+                await releaseBody(response);
                 throw new Error('Rate limited by OFW API');
+            }
         }
         if (!response.ok) {
             const errorBody = await response.text();
+            const edge = detectEdgeBlock({ body: errorBody, headers: response.headers, status: response.status });
+            if (edge !== null) {
+                throw new EdgeBlockedError(response.status, edge.vendor, { service: 'OurFamilyWizard', method, path });
+            }
             const safeBody = redactSecrets(errorBody).replace(/\s+/g, ' ').trim().slice(0, 4000);
             throw new Error(`OFW API error: ${response.status} ${response.statusText} for ${method} ${path}` +
                 (safeBody ? ` — ${safeBody}` : ''));

package/dist/index.js

@@ -47,7 +47,7 @@ const tools = selectToolRegistrars({
 });
 await runMcp({
     name: 'ofw',
-    version: '2.20.0', // x-release-please-version
+    version: '2.20.1', // x-release-please-version
     deps: client,
     tools,
     banner: '[ofw-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.',

package/dist/tools/attachments.js

@@ -8,10 +8,10 @@
 // disk injects an inline, filesystem-free implementation.
 // Keeping the interface here means src/tools/messages.ts imports nothing from
 // node:fs.
-import { chmodSync, existsSync, readFileSync, realpathSync, statSync, mkdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, readFileSync, realpathSync, statSync, mkdirSync, unlinkSync } from 'node:fs';
 import { basename, dirname, extname, isAbsolute, relative, resolve, sep } from 'node:path';
 import { getDefaultAttachmentsDir, getUploadDir } from '../config.js';
-import { fileBlob, expandPath } from '@chrischall/mcp-utils';
+import { assertPathWithinRoots, expandPath, fileBlob, FileWriteRefusedError, sniffMimeBytes, writeFileSafe, } from '@chrischall/mcp-utils';
 /**
  * True when `candidate` is strictly inside `root` (both absolute). Lexical:
  * resolve symlinks first when that matters.
@@ -20,13 +20,6 @@ export function isWithin(root, candidate) {
     const rel = relative(root, candidate);
     return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
 }
-/** The deepest ancestor of `path` (itself included) that exists on disk. */
-function deepestExisting(path) {
-    let current = path;
-    while (!existsSync(current))
-        current = dirname(current);
-    return current;
-}
 // Lightweight mime sniff from extension. OFW re-derives mime from the filename
 // server-side anyway, so this is just a polite Content-Type for the Blob.
 const MIME_BY_EXT = {
@@ -81,20 +74,11 @@ export function normalizeMimeType(raw) {
  * onto them), so the actual bytes are the authoritative signal. Returns the
  * bare media type, or null when the bytes aren't a PNG/JPEG/GIF/WEBP.
  */
-const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
-const JPEG_MAGIC = Buffer.from([0xff, 0xd8, 0xff]);
 export function sniffImageMime(bytes) {
-    if (bytes.length >= 8 && bytes.subarray(0, 8).equals(PNG_MAGIC))
-        return 'image/png';
-    if (bytes.length >= 3 && bytes.subarray(0, 3).equals(JPEG_MAGIC))
-        return 'image/jpeg';
-    if (bytes.length >= 6 && bytes.toString('ascii', 0, 4) === 'GIF8')
-        return 'image/gif';
-    if (bytes.length >= 12 &&
-        bytes.toString('ascii', 0, 4) === 'RIFF' && bytes.toString('ascii', 8, 12) === 'WEBP') {
-        return 'image/webp';
-    }
-    return null;
+    // mcp-utils' shared magic-byte table, narrowed to what a host renders inline
+    // (it also names PDF, zip, MIDI and HEIC/MP4 — not ImageContent material).
+    const sniffed = sniffMimeBytes(bytes);
+    return sniffed !== undefined && HOST_RENDERABLE_IMAGE_MIMES.has(sniffed) ? sniffed : null;
 }
 /**
  * Resolve the MIME type to report for downloaded bytes, in priority order:
@@ -129,12 +113,18 @@ export class NodeAttachmentIO {
         // against the upload dir instead, and only expand a leading ~.
         const abs = resolve(root, path.startsWith('~') ? expandPath(path) : path);
         const outside = new Error(`Refusing to upload ${abs}: it is outside the upload directory (${root}). Only files placed in that directory can be uploaded — ask the user to copy the file there, or set OFW_UPLOAD_DIR.`);
+        // Lexical check first (a path that merely names somewhere else is refused
+        // even if a symlink there leads back in), then the shared real-path check.
         if (!isWithin(root, abs))
             throw outside;
         const real = realpathSync(abs); // throws if missing
         const realRoot = realpathSync(root);
-        if (!isWithin(realRoot, real))
+        try {
+            assertPathWithinRoots(real, [realRoot]);
+        }
+        catch {
             throw outside;
+        }
         if (relative(realRoot, real).split(sep).some((segment) => segment.startsWith('.'))) {
             throw new Error(`Refusing to upload ${abs}: hidden files and files in hidden directories (dotfiles, credential stores) are never uploaded.`);
         }
@@ -160,7 +150,7 @@ export class NodeAttachmentIO {
             return null;
         }
     }
-    writeDownload(dest, bytes, { root, overwrite }) {
+    async writeDownload(dest, bytes, { root, overwrite }) {
         // The bytes are co-parent-supplied, so where they land is the security
         // boundary. Check the REAL path of the nearest existing ancestor before
         // creating anything, so a symlinked directory inside the root cannot carry
@@ -177,25 +167,35 @@ export class NodeAttachmentIO {
             chmodSync(root, 0o700);
         const realRoot = realpathSync(root);
         const parent = dirname(dest);
-        const anchor = realpathSync(deepestExisting(parent));
-        if (anchor !== realRoot && !isWithin(realRoot, anchor)) {
-            throw new Error(`Refusing to write ${dest}: it resolves outside the attachments directory (${root}).`);
+        const outside = () => new Error(`Refusing to write ${dest}: it resolves outside the attachments directory (${root}).`);
+        // Real path of the nearest existing ancestor (mcp-utils assertPathWithinRoots).
+        try {
+            assertPathWithinRoots(parent, [realRoot]);
+        }
+        catch {
+            throw outside();
         }
         mkdirSync(parent, { recursive: true, mode: 0o700 });
         if (overwrite) {
-            // unlink removes a symlink itself, never its target.
+            // Replace by unlink + exclusive create, NOT an O_TRUNC overwrite: unlink
+            // removes a symlink (or a hard link) itself, never its target, so a link
+            // planted at `dest` can't make "replace" rewrite a file elsewhere.
             try {
                 unlinkSync(dest);
             }
             catch { /* nothing there to replace */ }
         }
         try {
-            // 'wx' fails on ANY existing entry, a symlink (even dangling) included,
-            // so nothing already at `dest` is ever clobbered or followed.
-            writeFileSync(dest, bytes, { flag: 'wx', mode: 0o600 });
+            // writeFileSafe: an O_CREAT|O_EXCL|O_NOFOLLOW open, so ANY existing
+            // entry — a symlink (even dangling) included — is refused, never
+            // clobbered or followed. allowedRoots re-confines the parent at write
+            // time, closing the window since the check above (and the mkdir).
+            await writeFileSafe(dest, bytes, { mode: 0o600, allowedRoots: [realRoot] });
         }
         catch (e) {
-            if (e.code === 'EEXIST') {
+            if (e instanceof FileWriteRefusedError) {
+                if (e.reason === 'outside-roots')
+                    throw outside();
                 throw new Error(`Refusing to overwrite ${dest}: a file already exists there. Pass force:true to replace it, or choose another saveTo.`);
             }
             throw e;

package/dist/tools/messages.js

@@ -1630,7 +1630,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             }
         }
         const response = await client.requestBinary('GET', `/pub/v1/myfiles/${fileId}/data`);
-        attachmentIO.writeDownload(dest, response.body, { root, overwrite: args.force === true });
+        await attachmentIO.writeDownload(dest, response.body, { root, overwrite: args.force === true });
         await cache.markAttachmentDownloaded(fileId, dest);
         const fileName = response.suggestedFileName ?? cached.fileName;
         const mimeType = resolveDownloadMime(response.body, response.contentType ?? cached.mimeType, fileName);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.20.0",
+  "version": "2.20.1",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -34,14 +34,14 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.8.0",
+    "@chrischall/mcp-utils": "^2.13.0",
     "@fetchproxy/bootstrap": "^3.4.1",
-    "@modelcontextprotocol/server": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.2.0",
     "dotenv": "^18.0.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@modelcontextprotocol/client": "^2.0.0",
+    "@modelcontextprotocol/client": "^2.2.0",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^5.0.0",
     "esbuild": "^0.28.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.20.0",
+  "version": "2.20.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.20.0",
+      "version": "2.20.1",
       "transport": {
         "type": "stdio"
       },