ofw-mcp 2.20.1 → 2.20.2

package/dist/client.js

@@ -47,22 +47,21 @@ const OFW_REFRESH_SENTINEL = 'ofw';
  * Throw {@link EdgeBlockedError} when `response` is a CDN/WAF refusal.
  *
  * Its HEADERS are always judged (Cloudflare's `cf-mitigated`). Its BODY is
- * judged only for a 429: that response is about to be waited out and replayed,
- * or turned into "Rate limited", so a challenge page served as 429 without the
- * header would otherwise never reach the body check below the retry and would
- * be reported as a rate limit (chrischall/mcp-host#1015). The body is read
- * from a clone, and never when it is JSON — no refusal page is. Other non-2xx
- * bodies are judged where the error body is read anyway, in `fetchAuthed`, and
- * a 2xx body is never consumed here.
+ * judged for a 401 or 429 before releasing it for a replay. A challenge page
+ * without the header must not spend a login or be reported as a rate limit.
+ * The 401 body is read from a clone (a final 401 still needs its error body);
+ * the 429 body can be consumed directly since it is always released. JSON is
+ * never probed — no refusal page is. Other non-2xx bodies are judged where
+ * the error body is read anyway; a 2xx body is never consumed here.
  */
 async function throwIfEdgeBlocked(response, method, path) {
     if (response.ok)
         return;
     let edge = detectEdgeBlock({ headers: response.headers, status: response.status });
-    if (edge === null && response.status === 429 && !/json/i.test(response.headers.get('content-type') ?? '')) {
+    if (edge === null && (response.status === 401 || response.status === 429) && !/json/i.test(response.headers.get('content-type') ?? '')) {
         let body = '';
         try {
-            body = await response.clone().text();
+            body = await (response.status === 401 ? response.clone() : response).text();
         }
         catch {
             /* unreadable: not shown to be a block */
@@ -138,68 +137,75 @@ export class OFWClient {
         return this.tokenManager;
     }
     async request(method, path, body) {
-        const response = await this.fetchAuthed(method, path, body, 'application/json');
-        const text = await response.text();
-        if (debugLogEnabled()) {
-            console.error(`[ofw-debug] response body: ${text || '<empty>'}`);
-        }
-        return (text ? JSON.parse(text) : null);
+        return this.fetchAuthed(method, path, body, 'application/json', async (response) => {
+            const text = await response.text();
+            if (debugLogEnabled()) {
+                console.error(`[ofw-debug] response body: ${text || '<empty>'}`);
+            }
+            return (text ? JSON.parse(text) : null);
+        });
     }
     /** Like `request`, but returns the raw bytes plus Content-Type/-Disposition metadata. */
     async requestBinary(method, path) {
-        const response = await this.fetchAuthed(method, path, undefined, 'application/octet-stream');
-        return {
+        return this.fetchAuthed(method, path, undefined, 'application/octet-stream', async (response) => ({
             body: Buffer.from(await response.arrayBuffer()),
             contentType: response.headers.get('content-type'),
             suggestedFileName: parseContentDispositionFilename(response.headers.get('content-disposition') ?? '') ?? null,
-        };
+        }));
     }
     // Authenticated fetch for both JSON and binary callers. Auth (proactive
     // refresh inside the skew window + one 401-replay, guarded against a
     // double-refresh under concurrency) is delegated to the shared TokenManager's
     // `withAuth`. The 429 wait-and-replay and the non-2xx → throw remain here.
-    async fetchAuthed(method, path, body, accept) {
-        // `withAuth` invokes `call` once, and again after a refresh on a 401. The
-        // second invocation is the replay — mark it `(retry)` in the debug log,
-        // preserving the prior bespoke-loop diagnostic.
+    async fetchAuthed(method, path, body, accept, consume) {
         let attempt = 0;
-        let response = await this.getTokenManager().withAuth((token) => this.fetchOnce(method, path, body, accept, token, attempt++ > 0));
-        // A CDN/WAF refusal page is not OFW answering: the token was never judged.
-        // `withAuth` already declines to spend a re-login on one; checked again
-        // here BEFORE the 429 replay (a challenge can arrive as 429, and waiting it
-        // out only repeats the block) and before the generic error below, so every
-        // tool sees an `EdgeBlockedError` it can branch on instead of an
-        // "OFW API error" with the page dumped into it (chrischall/mcp-host#1015).
-        await throwIfEdgeBlocked(response, method, path);
+        let result;
+        // Keep all response I/O inside fetchOnce's per-attempt deadline. Returning
+        // the Response still lets TokenManager own its one 401 refresh/replay.
+        const call = async (retry) => {
+            let authAttempt = 0;
+            return this.getTokenManager().withAuth((token) => {
+                const firstAuthAttempt = authAttempt++ === 0;
+                return this.fetchOnce(method, path, body, accept, token, async (response) => {
+                    await throwIfEdgeBlocked(response, method, path);
+                    if (response.status === 401 && firstAuthAttempt) {
+                        await releaseBody(response);
+                        return;
+                    }
+                    if (response.status === 429) {
+                        await releaseBody(response);
+                        return;
+                    }
+                    if (!response.ok) {
+                        const errorBody = await response.text();
+                        const edge = detectEdgeBlock({ body: errorBody, headers: response.headers, status: response.status });
+                        if (edge !== null) {
+                            throw new EdgeBlockedError(response.status, edge.vendor, { service: 'OurFamilyWizard', method, path });
+                        }
+                        const safeBody = redactSecrets(errorBody).replace(/\s+/g, ' ').trim().slice(0, 4000);
+                        throw new Error(`OFW API error: ${response.status} ${response.statusText} for ${method} ${path}` +
+                            (safeBody ? ` — ${safeBody}` : ''));
+                    }
+                    result = await consume(response);
+                }, retry || attempt++ > 0);
+            });
+        };
+        const response = await call(false);
         if (response.status === 429) {
-            // The first 429's body is never read: release it before the replay.
-            await releaseBody(response);
+            // The attempt is released and its timer cleared before the backoff.
             await new Promise((r) => setTimeout(r, 2000));
-            response = await this.getTokenManager().withAuth((token) => this.fetchOnce(method, path, body, accept, token, true));
-            await throwIfEdgeBlocked(response, method, path);
-            if (response.status === 429) {
-                await releaseBody(response);
+            if ((await call(true)).status === 429) {
                 throw new Error('Rate limited by OFW API');
             }
         }
-        if (!response.ok) {
-            const errorBody = await response.text();
-            const edge = detectEdgeBlock({ body: errorBody, headers: response.headers, status: response.status });
-            if (edge !== null) {
-                throw new EdgeBlockedError(response.status, edge.vendor, { service: 'OurFamilyWizard', method, path });
-            }
-            const safeBody = redactSecrets(errorBody).replace(/\s+/g, ' ').trim().slice(0, 4000);
-            throw new Error(`OFW API error: ${response.status} ${response.statusText} for ${method} ${path}` +
-                (safeBody ? ` — ${safeBody}` : ''));
-        }
-        return response;
+        return result;
     }
     // A single OFW API fetch with the bearer token supplied by `withAuth`.
     // Carries the per-request timeout (AbortController + setTimeout so vitest
     // fake timers can drive it and we attach a clear error message) and the
-    // OFW_DEBUG_LOG instrumentation. Returns the raw Response — 401/429/non-2xx
-    // handling lives in the callers (`withAuth` and `fetchAuthed`).
-    async fetchOnce(method, path, body, accept, token, isRetry = false) {
+    // OFW_DEBUG_LOG instrumentation. The handler completes body consumption or
+    // release before this attempt returns its Response to `withAuth`.
+    async fetchOnce(method, path, body, accept, token, handleResponse, isRetry = false) {
         const isFormData = body instanceof FormData;
         const headers = {
             ...OFW_PROTOCOL_HEADERS,
@@ -231,22 +237,36 @@ export class OFWClient {
         const ac = new AbortController();
         const timer = setTimeout(() => ac.abort(), timeoutMs);
         const startedAt = Date.now();
-        let response;
+        // Passing our own signal guarantees a signal even without an ambient caller.
+        const signal = withAmbientCancellation(ac.signal);
+        let onAbort;
+        // Race the complete attempt, not just fetch: body.cancel() may not settle
+        // on abort, and edge-probe/release helpers deliberately swallow I/O errors.
+        const aborted = new Promise((_resolve, reject) => {
+            onAbort = () => reject(signal.reason);
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        });
         try {
-            response = await fetch(url, {
-                method,
-                headers,
-                // THE CALLER'S CANCELLATION, folded in with our timeout (mcp-utils
-                // `cancel`). Until this the only thing that could stop an OFW
-                // request was the timeout below, so a cancelled tool call held it
-                // open for the full budget while the child burned the CPU
-                // mcp-host meters it on. The timeout diagnosis below is unaffected
-                // because it asks `ac.signal`, OUR controller — a caller's abort
-                // falls through to the generic path rather than being reported as
-                // OFW being slow.
-                signal: withAmbientCancellation(ac.signal),
-                ...(body !== undefined ? { body: isFormData ? body : JSON.stringify(body) } : {}),
-            });
+            return await Promise.race([aborted, (async () => {
+                    signal.throwIfAborted();
+                    const response = await fetch(url, {
+                        method,
+                        headers,
+                        // The caller's cancellation and our timeout both cover headers,
+                        // body reads and releases; only our controller diagnoses slowness.
+                        signal,
+                        ...(body !== undefined ? { body: isFormData ? body : JSON.stringify(body) } : {}),
+                    });
+                    if (debugLogEnabled()) {
+                        console.error(`[ofw-debug] ← ${response.status} ${response.statusText} (${Date.now() - startedAt}ms)`);
+                    }
+                    await handleResponse(response);
+                    signal.throwIfAborted();
+                    return response;
+                })()]);
         }
         catch (err) {
             const elapsed = Date.now() - startedAt;
@@ -263,11 +283,8 @@ export class OFWClient {
         }
         finally {
             clearTimeout(timer);
+            signal.removeEventListener('abort', onAbort);
         }
-        if (debugLogEnabled()) {
-            console.error(`[ofw-debug] ← ${response.status} ${response.statusText} (${Date.now() - startedAt}ms)`);
-        }
-        return response;
     }
 }
 export const client = new OFWClient();

package/dist/index.js

@@ -47,7 +47,7 @@ const tools = selectToolRegistrars({
 });
 await runMcp({
     name: 'ofw',
-    version: '2.20.1', // x-release-please-version
+    version: '2.20.2', // x-release-please-version
     deps: client,
     tools,
     banner: '[ofw-mcp] This project was developed and is maintained by AI (Claude Sonnet 4.6). Use at your own discretion.',

package/dist/tools/calendar.js

@@ -215,7 +215,7 @@ export function registerCalendarTools(server, client) {
         });
     if (allowWrites)
         server.registerTool('ofw_update_event', {
-            description: 'Update an existing OurFamilyWizard calendar event. Fetches the event, applies the given changes, and writes the merged result back (OFW has no partial update). A change to an event the co-parent can see (shared before or after the change) is confirmed first; the confirmation is bound to the event exactly as read, so if it changes on OFW in between (say the co-parent edited it) the update is refused instead of overwriting their edit. ' + CONFIRM_NOTE,
+            description: 'Update an existing OurFamilyWizard calendar event. Fetches the event, applies the given changes, and writes the merged result back (OFW has no partial update). A change to an event the co-parent can see (shared before or after the change) is confirmed first; the confirmation is bound to the event exactly as read, so if it changes on OFW in between (say the co-parent edited it) the update is refused instead of overwriting their edit. If the write fails without a definitive answer, or lands but cannot be re-read to confirm it, the result is EVENT_UNCONFIRMED: the change may already be on OFW, so do NOT retry until ofw_list_events shows whether it landed. ' + CONFIRM_NOTE,
             annotations: { destructiveHint: true },
             inputSchema: z.object({
                 eventId: z.string().describe('Event id — the `id` from ofw_list_events / eventRecurrenceId from ofw_create_event'),
@@ -267,15 +267,37 @@ export function registerCalendarTools(server, client) {
                 if (gate)
                     return gate;
             }
-            await client.request('PUT', `/pub/v3/events/${id}`, payload);
+            try {
+                await requestWrite(client, 'PUT', `/pub/v3/events/${id}`, payload);
+            }
+            catch (e) {
+                if (!(e instanceof UnconfirmedWriteError))
+                    throw e;
+                return unconfirmedWriteResponse(e, {
+                    result: 'EVENT_UNCONFIRMED',
+                    what: `update event ${eventId}`,
+                    checkWith: 'ofw_list_events for this event and date range',
+                });
+            }
             // PUT responses aren't documented — re-fetch the detail as authoritative state.
-            const rawAfter = await client.request('GET', `/pub/v3/events/${id}`);
-            const event = parseLenient(eventDetailSchema, rawAfter, { label: 'ofw-mcp', context: `GET /pub/v3/events/${eventId} (post-update)`, mode: 'strict' });
-            return jsonResponse({ note: 'Event updated; returning re-fetched event state.', event });
+            // Once PUT succeeded, even a definitive rejection of this GET is not a
+            // rejection of the write. Do not present a failed verification as a safe retry.
+            try {
+                const rawAfter = await client.request('GET', `/pub/v3/events/${id}`);
+                const event = parseLenient(eventDetailSchema, rawAfter, { label: 'ofw-mcp', context: `GET /pub/v3/events/${eventId} (post-update)`, mode: 'strict' });
+                return jsonResponse({ note: 'Event updated; returning re-fetched event state.', event });
+            }
+            catch (e) {
+                return unconfirmedWriteResponse(new UnconfirmedWriteError(null, e), {
+                    result: 'EVENT_UNCONFIRMED',
+                    what: `verify the update to event ${eventId}`,
+                    checkWith: 'ofw_list_events for this event and date range',
+                });
+            }
         });
     if (allowWrites)
         server.registerTool('ofw_delete_event', {
-            description: 'Delete an OurFamilyWizard calendar event. Reads the event first; deleting one the co-parent can see is confirmed first, with a preview of exactly which event (title, date, time) is removed, and is refused if the event changed on OFW after that preview. ' + CONFIRM_NOTE,
+            description: 'Delete an OurFamilyWizard calendar event. Reads the event first; deleting one the co-parent can see is confirmed first, with a preview of exactly which event (title, date, time) is removed, and is refused if the event changed on OFW after that preview. If the request fails without a definitive answer the result is EVENT_UNCONFIRMED: the event may already be gone, so do NOT retry until ofw_list_events shows whether it is still there. ' + CONFIRM_NOTE,
             annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
             inputSchema: z.object({
                 eventId: z.string().describe('Event id — the `id` from ofw_list_events / eventRecurrenceId from ofw_create_event'),
@@ -309,7 +331,18 @@ export function registerCalendarTools(server, client) {
                 if (gate)
                     return gate;
             }
-            await client.request('DELETE', `/pub/v3/events/${id}?includeFuture=${includeFuture}`);
+            try {
+                await requestWrite(client, 'DELETE', `/pub/v3/events/${id}?includeFuture=${includeFuture}`);
+            }
+            catch (e) {
+                if (!(e instanceof UnconfirmedWriteError))
+                    throw e;
+                return unconfirmedWriteResponse(e, {
+                    result: 'EVENT_UNCONFIRMED',
+                    what: `delete event ${args.eventId}${includeFuture ? ' and its future occurrences' : ''}`,
+                    checkWith: 'ofw_list_events for this event and date range (including future occurrences if requested)',
+                });
+            }
             return textResponse(`Event ${args.eventId} ("${current.title}") deleted`);
         });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.20.1",
+  "version": "2.20.2",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -34,14 +34,14 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.13.0",
+    "@chrischall/mcp-utils": "^2.14.0",
     "@fetchproxy/bootstrap": "^3.4.1",
-    "@modelcontextprotocol/server": "^2.2.0",
+    "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/client": "^2.3.0",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^5.0.0",
     "esbuild": "^0.28.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.20.1",
+  "version": "2.20.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.20.1",
+      "version": "2.20.2",
       "transport": {
         "type": "stdio"
       },