ofw-mcp 2.20.3 → 2.20.4

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.20.3"
+    "version": "2.20.4"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.20.3",
+      "version": "2.20.4",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.20.3",
+  "version": "2.20.4",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"
@@ -17,5 +17,5 @@
     "family"
   ],
   "skills": "./skills/",
-  "mcp": "./.mcp.json"
+  "mcpServers": "./.mcp.json"
 }

package/README.md

@@ -131,7 +131,7 @@ Read-only tools run automatically. Writes that reach your co-parent or the court
 | Tool | What it does | Permission | Write mode |
 |------|-------------|------------|------------|
 | `ofw_get_profile` | Your profile and co-parent info | Auto | any |
-| `ofw_get_notifications` | Dashboard counts (unread messages, upcoming events, outstanding expenses) | Auto | any |
+| `ofw_get_notifications` | Dashboard counts (unread messages, upcoming events, outstanding expenses). Updates your co-parent-visible last-seen status, so it is not marked read-only | Confirm | any |
 | `ofw_list_message_folders` | Folders with unread counts — **get folder IDs here before listing messages** | Auto | any |
 | `ofw_list_messages` | Messages in a folder | Auto | any |
 | `ofw_get_message` | Full content of a single message | Auto | any |

package/dist/auth-password.js

@@ -118,9 +118,34 @@ export async function loginWithPassword(username, password) {
         const body = await response.text();
         throw new Error(`OFW login returned unexpected response (${contentType || 'no content-type'}): ${body.substring(0, 200)}`);
     }
-    const data = (await response.json());
+    // A 200 JSON answer is not proof of a token: a lockout, MFA or captcha
+    // challenge can arrive the same way. Without this check the token would be
+    // the string "undefined", every request would 401, and the TokenManager
+    // would re-mint through another password POST — one OFW counts against the
+    // account. Not latched: this is not OFW judging the password.
+    const data = await response.json();
+    const record = typeof data === 'object' && data !== null ? data : null;
+    const token = record?.auth;
+    if (typeof token !== 'string' || token === '') {
+        throw new Error(describeTokenlessLogin(record));
+    }
     return {
-        token: data.auth,
+        token,
         expiresAt: new Date(Date.now() + OFW_TOKEN_TTL_MS),
     };
 }
+/**
+ * An actionable message for a login answer that carried no token. It names
+ * the response's KEYS and OFW's own `message` text, never any other value —
+ * a challenge payload can carry ids or tokens that do not belong in an error.
+ */
+function describeTokenlessLogin(record) {
+    const base = 'OFW login returned no token, so it did not sign in';
+    if (record === null) {
+        return `${base} (the response was not a JSON object). Sign in to OurFamilyWizard in a browser to check the account, then try again.`;
+    }
+    const keys = Object.keys(record);
+    const said = typeof record.message === 'string' ? ` OFW said: "${record.message.substring(0, 200)}".` : '';
+    return `${base} (response fields: ${keys.length > 0 ? keys.join(', ') : 'none'}).${said} `
+        + 'The account may be locked or need a verification step: sign in to OurFamilyWizard in a browser to clear it, then try again.';
+}

package/dist/auth.js

@@ -56,7 +56,7 @@ import { parseBoolEnv, readEnvVar, resolveAuthPattern } from '@chrischall/mcp-ut
 import { bootstrap } from '@fetchproxy/bootstrap';
 import { classifyBridgeError } from '@chrischall/mcp-utils/fetchproxy';
 import { loginWithPassword } from './auth-password.js';
-import pkg from '../package.json' with { type: 'json' };
+import { SERVER_NAME, VERSION } from './version.js';
 /** True if the user has explicitly disabled the fetchproxy fallback. */
 function fetchproxyDisabled() {
     return parseBoolEnv('OFW_DISABLE_FETCHPROXY');
@@ -124,8 +124,8 @@ export async function resolveAuth() {
         pattern.fetchproxy = async () => {
             try {
                 const session = await bootstrap({
-                    serverName: pkg.name,
-                    version: pkg.version,
+                    serverName: SERVER_NAME,
+                    version: VERSION,
                     // OFW serves both ofw.ourfamilywizard.com and www.ourfamilywizard.com;
                     // the API + auth token live on the apex. The extension matches on
                     // suffix, so listing the apex covers both.