ofw-mcp 2.20.3 → 2.20.5

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.20.3"
+    "version": "2.20.5"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.20.3",
+      "version": "2.20.5",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.20.3",
+  "version": "2.20.5",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"
@@ -17,5 +17,5 @@
     "family"
   ],
   "skills": "./skills/",
-  "mcp": "./.mcp.json"
+  "mcpServers": "./.mcp.json"
 }

package/README.md

@@ -131,7 +131,7 @@ Read-only tools run automatically. Writes that reach your co-parent or the court
 | Tool | What it does | Permission | Write mode |
 |------|-------------|------------|------------|
 | `ofw_get_profile` | Your profile and co-parent info | Auto | any |
-| `ofw_get_notifications` | Dashboard counts (unread messages, upcoming events, outstanding expenses) | Auto | any |
+| `ofw_get_notifications` | Dashboard counts (unread messages, upcoming events, outstanding expenses). Updates your co-parent-visible last-seen status, so it is not marked read-only | Confirm | any |
 | `ofw_list_message_folders` | Folders with unread counts — **get folder IDs here before listing messages** | Auto | any |
 | `ofw_list_messages` | Messages in a folder | Auto | any |
 | `ofw_get_message` | Full content of a single message | Auto | any |
@@ -293,7 +293,9 @@ Calendar events sit between the two message tiers: they have no draft stage (a c
 
 ### Egress allowlist
 
-Every outbound request passes its constructed URL through a host check before `fetch` — the server refuses to contact any host other than `ofw.ourfamilywizard.com`. Today it always passes, and that is the point: it makes "this server only ever talks to OFW" a structural invariant rather than a code-review promise, so a later refactor or a compromised dependency that pointed a request elsewhere throws instead of carrying your bearer token or messages off-host. It is a pre-flight check on the URL we build, not a redirect-following egress filter.
+Every request that carries your OFW token or login passes its constructed URL through a host check before `fetch` — the server refuses to send them to any host other than `ofw.ourfamilywizard.com`. Today it always passes, and that is the point: it makes "the credential only ever goes to OFW" a structural invariant rather than a code-review promise, so a later refactor or a compromised dependency that pointed a request elsewhere throws instead of carrying your bearer token or messages off-host. It is a pre-flight check on the URL we build, not a redirect-following egress filter.
+
+The one other host the server contacts is `*.oaiusercontent.com`, and only for `ofw_upload_expense_pdf`'s `url` mode: it downloads the receipt PDF from that signed file URL with no OFW credential attached, re-checking every redirect hop against the same suffix, capping the size and requiring a real PDF. The hosted registration's egress allowlist (`mint.yaml`) names exactly these two hosts.
 
 ## Troubleshooting
 
@@ -317,7 +319,7 @@ Every outbound request passes its constructed URL through a host check before `f
 - They are passed to the server as environment variables and never logged
 - The server authenticates with OFW using the same login flow as the web app
 - Use a strong, unique OFW password
-- Outbound requests are host-allowlisted to `ofw.ourfamilywizard.com` (see [Egress allowlist](#egress-allowlist))
+- Requests carrying your OFW credential are host-allowlisted to `ofw.ourfamilywizard.com`; the only other host contacted is the receipt-download host for `ofw_upload_expense_pdf`'s `url` mode (see [Egress allowlist](#egress-allowlist))
 
 ### Local data, and how to remove it
 
@@ -339,6 +341,8 @@ rm -f  ~/.ofw-mcp/session.json # or your OFW_SESSION_FILE
 
 The next start rebuilds the cache from OurFamilyWizard with `ofw_sync_messages`. A directory you pointed `OFW_ATTACHMENTS_DIR` at yourself keeps its own permissions (it may be shared on purpose); only what the server creates, and the default `~/Downloads/ofw-mcp`, are locked down.
 
+**On a hosted connector (mcp-host)** the same data lives in the registration's persistent data directory instead of on your machine: the message cache under `$HOME/.cache/ofw-mcp/`, the session token at `$MCP_DATA_DIR/.ofw-mcp/session.json`, the browser-bridge identity under `$HOME/.fetchproxy/identity/`, and spent confirm-token nonces under `$MCP_DATA_DIR/.mcp-confirm/`. Downloads are returned inline and never written to disk. The commands above do not reach it — how long that directory is kept, and whether disconnecting or deleting the registration removes it, is the host's retention policy, not this server's.
+
 ## Development
 
 ```bash

package/dist/auth-password.js

@@ -118,9 +118,34 @@ export async function loginWithPassword(username, password) {
         const body = await response.text();
         throw new Error(`OFW login returned unexpected response (${contentType || 'no content-type'}): ${body.substring(0, 200)}`);
     }
-    const data = (await response.json());
+    // A 200 JSON answer is not proof of a token: a lockout, MFA or captcha
+    // challenge can arrive the same way. Without this check the token would be
+    // the string "undefined", every request would 401, and the TokenManager
+    // would re-mint through another password POST — one OFW counts against the
+    // account. Not latched: this is not OFW judging the password.
+    const data = await response.json();
+    const record = typeof data === 'object' && data !== null ? data : null;
+    const token = record?.auth;
+    if (typeof token !== 'string' || token === '') {
+        throw new Error(describeTokenlessLogin(record));
+    }
     return {
-        token: data.auth,
+        token,
         expiresAt: new Date(Date.now() + OFW_TOKEN_TTL_MS),
     };
 }
+/**
+ * An actionable message for a login answer that carried no token. It names
+ * the response's KEYS and OFW's own `message` text, never any other value —
+ * a challenge payload can carry ids or tokens that do not belong in an error.
+ */
+function describeTokenlessLogin(record) {
+    const base = 'OFW login returned no token, so it did not sign in';
+    if (record === null) {
+        return `${base} (the response was not a JSON object). Sign in to OurFamilyWizard in a browser to check the account, then try again.`;
+    }
+    const keys = Object.keys(record);
+    const said = typeof record.message === 'string' ? ` OFW said: "${record.message.substring(0, 200)}".` : '';
+    return `${base} (response fields: ${keys.length > 0 ? keys.join(', ') : 'none'}).${said} `
+        + 'The account may be locked or need a verification step: sign in to OurFamilyWizard in a browser to clear it, then try again.';
+}

package/dist/auth.js

@@ -56,7 +56,7 @@ import { parseBoolEnv, readEnvVar, resolveAuthPattern } from '@chrischall/mcp-ut
 import { bootstrap } from '@fetchproxy/bootstrap';
 import { classifyBridgeError } from '@chrischall/mcp-utils/fetchproxy';
 import { loginWithPassword } from './auth-password.js';
-import pkg from '../package.json' with { type: 'json' };
+import { SERVER_NAME, VERSION } from './version.js';
 /** True if the user has explicitly disabled the fetchproxy fallback. */
 function fetchproxyDisabled() {
     return parseBoolEnv('OFW_DISABLE_FETCHPROXY');
@@ -124,8 +124,8 @@ export async function resolveAuth() {
         pattern.fetchproxy = async () => {
             try {
                 const session = await bootstrap({
-                    serverName: pkg.name,
-                    version: pkg.version,
+                    serverName: SERVER_NAME,
+                    version: VERSION,
                     // OFW serves both ofw.ourfamilywizard.com and www.ourfamilywizard.com;
                     // the API + auth token live on the apex. The extension matches on
                     // suffix, so listing the apex covers both.