ofw-mcp 2.20.4 → 2.20.5

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.20.4"
+    "version": "2.20.5"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.20.4",
+      "version": "2.20.5",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.20.4",
+  "version": "2.20.5",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"

package/README.md

@@ -293,7 +293,9 @@ Calendar events sit between the two message tiers: they have no draft stage (a c
 
 ### Egress allowlist
 
-Every outbound request passes its constructed URL through a host check before `fetch` — the server refuses to contact any host other than `ofw.ourfamilywizard.com`. Today it always passes, and that is the point: it makes "this server only ever talks to OFW" a structural invariant rather than a code-review promise, so a later refactor or a compromised dependency that pointed a request elsewhere throws instead of carrying your bearer token or messages off-host. It is a pre-flight check on the URL we build, not a redirect-following egress filter.
+Every request that carries your OFW token or login passes its constructed URL through a host check before `fetch` — the server refuses to send them to any host other than `ofw.ourfamilywizard.com`. Today it always passes, and that is the point: it makes "the credential only ever goes to OFW" a structural invariant rather than a code-review promise, so a later refactor or a compromised dependency that pointed a request elsewhere throws instead of carrying your bearer token or messages off-host. It is a pre-flight check on the URL we build, not a redirect-following egress filter.
+
+The one other host the server contacts is `*.oaiusercontent.com`, and only for `ofw_upload_expense_pdf`'s `url` mode: it downloads the receipt PDF from that signed file URL with no OFW credential attached, re-checking every redirect hop against the same suffix, capping the size and requiring a real PDF. The hosted registration's egress allowlist (`mint.yaml`) names exactly these two hosts.
 
 ## Troubleshooting
 
@@ -317,7 +319,7 @@ Every outbound request passes its constructed URL through a host check before `f
 - They are passed to the server as environment variables and never logged
 - The server authenticates with OFW using the same login flow as the web app
 - Use a strong, unique OFW password
-- Outbound requests are host-allowlisted to `ofw.ourfamilywizard.com` (see [Egress allowlist](#egress-allowlist))
+- Requests carrying your OFW credential are host-allowlisted to `ofw.ourfamilywizard.com`; the only other host contacted is the receipt-download host for `ofw_upload_expense_pdf`'s `url` mode (see [Egress allowlist](#egress-allowlist))
 
 ### Local data, and how to remove it
 
@@ -339,6 +341,8 @@ rm -f  ~/.ofw-mcp/session.json # or your OFW_SESSION_FILE
 
 The next start rebuilds the cache from OurFamilyWizard with `ofw_sync_messages`. A directory you pointed `OFW_ATTACHMENTS_DIR` at yourself keeps its own permissions (it may be shared on purpose); only what the server creates, and the default `~/Downloads/ofw-mcp`, are locked down.
 
+**On a hosted connector (mcp-host)** the same data lives in the registration's persistent data directory instead of on your machine: the message cache under `$HOME/.cache/ofw-mcp/`, the session token at `$MCP_DATA_DIR/.ofw-mcp/session.json`, the browser-bridge identity under `$HOME/.fetchproxy/identity/`, and spent confirm-token nonces under `$MCP_DATA_DIR/.mcp-confirm/`. Downloads are returned inline and never written to disk. The commands above do not reach it — how long that directory is kept, and whether disconnecting or deleting the registration removes it, is the host's retention policy, not this server's.
+
 ## Development
 
 ```bash

package/dist/bundle.js

@@ -4483,6 +4483,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -5002,6 +5003,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -6422,7 +6435,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -7178,6 +7191,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -7221,6 +7259,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -8177,6 +8216,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -8243,6 +8283,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -17773,9 +17814,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -18175,6 +18222,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -18191,6 +18239,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -23500,7 +23549,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
+// node_modules/@modelcontextprotocol/server/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -38325,7 +38374,7 @@ var API_KEY_RE = new RegExp([
   // webhook signing secret (Stripe-style)
 ].map((p) => `\\b${p}`).join("|"), "g");
 var GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-var QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+var QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
 var OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
 var FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
 var HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -38336,6 +38385,8 @@ var JSON_SECRET_KEYS = [
   "api[_-]?secret",
   "(?:x[_-])?api[_-]?key",
   "private[_-]?key",
+  "aws[_-]?secret[_-]?access[_-]?key",
+  // fleet-audit#1297
   "code[_-]?verifier",
   // PKCE; a bare `verifier` key is too generic for JSON
   `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -39423,10 +39474,34 @@ async function fileBlob(path, opts = {}) {
   return blob;
 }
 
+// node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 var NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
+}
+var JUST_A_MOMENT = "just a moment";
+function hasJustAMomentTitle(html) {
+  const lower = asciiLower(html);
+  let i = 0;
+  for (; ; ) {
+    const open3 = lower.indexOf("<title", i);
+    if (open3 < 0)
+      return false;
+    const gt = lower.indexOf(">", open3 + 6);
+    if (gt < 0)
+      return false;
+    let j = gt + 1;
+    while (j < lower.length && /\s/.test(lower[j]))
+      j++;
+    if (lower.startsWith(JUST_A_MOMENT, j))
+      return true;
+    i = gt + 1;
+  }
 }
 
 // node_modules/@chrischall/mcp-utils/dist/http/net-atoms.js
@@ -40724,6 +40799,17 @@ function isPublicSuffix(host) {
   return false;
 }
 
+// node_modules/@fetchproxy/protocol/dist/ip-literal.js
+function isIpLiteralHost(host) {
+  if (host.includes(":") || host.startsWith("["))
+    return true;
+  const labels = host.split(".");
+  if (labels.length > 1 && labels[labels.length - 1] === "")
+    labels.pop();
+  const last = labels[labels.length - 1] ?? "";
+  return /^[0-9]+$/.test(last) || /^0x[0-9a-f]*$/i.test(last);
+}
+
 // node_modules/@fetchproxy/protocol/dist/validate.js
 var ProtocolError3 = class extends Error {
   constructor(message) {
@@ -41189,6 +41275,9 @@ function validateHello(raw) {
       if (!HOSTNAME_RE.test(d)) {
         throw new ProtocolError3(`hello.domains: invalid hostname ${JSON.stringify(d)}`);
       }
+      if (isIpLiteralHost(d)) {
+        throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (isPublicSuffix(d)) {
         throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -43314,7 +43403,7 @@ async function startHost(opts) {
             if (ownRetryableRefusal)
               resetSessionPromise();
             resolveOwnSession(ownSession);
-          } else {
+          } else if (identified === "extension" && extensionWs === ws) {
             const slot = peers.get(frame.mcpId);
             if (slot)
               slot.ws.send(JSON.stringify(frame));
@@ -44340,6 +44429,9 @@ var FetchproxyServer = class {
       throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
     }
     for (const d of opts.domains) {
+      if (typeof d === "string" && isIpLiteralHost(d)) {
+        throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (typeof d === "string" && isPublicSuffix(d)) {
         throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -46274,6 +46366,9 @@ var FetchproxyServer = class {
   }
 };
 
+// node_modules/@fetchproxy/server/dist/bot-wall.js
+var CLOUDFLARE_TITLE_SCAN_MAX = 64 * 1024;
+
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
 var CAPTURE_BOOTSTRAP_DEADLINE_MS = 45e3;
@@ -46629,6 +46724,7 @@ var OFW_PROTOCOL_HEADERS = {
 var OFW_TOKEN_TTL_MS = 6 * 60 * 60 * 1e3;
 var OFW_TOKEN_EXPIRY_SKEW_MS = 5 * 60 * 1e3;
 var ALLOWED_HOST = new URL(BASE_URL).host;
+var RECEIPT_HOST_SUFFIX = ".oaiusercontent.com";
 function assertOfwUrl(rawUrl) {
   let host;
   try {
@@ -46739,7 +46835,7 @@ function describeTokenlessLogin(record2) {
 
 // src/version.ts
 var SERVER_NAME = "ofw-mcp";
-var VERSION = "2.20.4";
+var VERSION = "2.20.5";
 
 // src/auth.ts
 function fetchproxyDisabled() {
@@ -46869,6 +46965,10 @@ try {
 function debugLogEnabled() {
   return parseBoolEnv("OFW_DEBUG_LOG");
 }
+function debugBody(text) {
+  if (process.env.MCP_DATA_DIR) return `<${text.length} chars, elided on a hosted server>`;
+  return text;
+}
 var DEFAULT_REQUEST_TIMEOUT_MS2 = 3e4;
 function getRequestTimeoutMs() {
   const raw = process.env.OFW_REQUEST_TIMEOUT_MS;
@@ -46969,7 +47069,7 @@ var OFWClient = class {
     return this.fetchAuthed(method, path, body, "application/json", async (response) => {
       const text = await response.text();
       if (debugLogEnabled()) {
-        console.error(`[ofw-debug] response body: ${text || "<empty>"}`);
+        console.error(`[ofw-debug] response body: ${text ? debugBody(text) : "<empty>"}`);
       }
       return text ? JSON.parse(text) : null;
     });
@@ -47043,7 +47143,7 @@ var OFWClient = class {
     const url2 = `${BASE_URL}${path}`;
     assertOfwUrl(url2);
     if (debugLogEnabled()) {
-      const bodyPreview = body === void 0 ? "<none>" : isFormData ? `<FormData entries=${Array.from(body.keys()).join(",")}>` : JSON.stringify(body);
+      const bodyPreview = body === void 0 ? "<none>" : isFormData ? `<FormData entries=${Array.from(body.keys()).join(",")}>` : debugBody(JSON.stringify(body));
       console.error(`[ofw-debug] \u2192 ${method} ${url2}${isRetry ? " (retry)" : ""}`);
       console.error(`[ofw-debug]   headers: ${redactSecrets(JSON.stringify(headers))}`);
       console.error(`[ofw-debug]   body: ${bodyPreview}`);
@@ -51542,7 +51642,7 @@ function assertReceiptUrl(url2) {
   if (url2.protocol !== "https:") {
     throw new Error("Remote expense receipt URLs must use HTTPS.");
   }
-  if (!url2.hostname.toLowerCase().endsWith(".oaiusercontent.com")) {
+  if (!url2.hostname.toLowerCase().endsWith(RECEIPT_HOST_SUFFIX)) {
     throw new Error("Remote expense receipt URLs must be signed oaiusercontent.com file URLs.");
   }
 }

package/dist/client.js

@@ -19,11 +19,20 @@ catch {
     /* v8 ignore next -- only reached in a non-Node runtime: no .env to load */
 }
 // Set OFW_DEBUG_LOG=1 (or true/yes/on) to log every OFW request/response to
-// stderr. Authorization is redacted. Bodies are logged in full — set this
-// only when debugging, never in normal use.
+// stderr. Authorization is redacted. Locally, bodies are logged in full — set
+// this only when debugging, never in normal use.
 function debugLogEnabled() {
     return parseBoolEnv('OFW_DEBUG_LOG');
 }
+// On a hosted server (mcp-host injects MCP_DATA_DIR) stderr is captured by the
+// host's log pipeline, which the operator can read — so request and response
+// bodies (message text, drafts, expense ledgers) are replaced by their size.
+// Locally stderr is the user's own terminal and bodies stay visible.
+function debugBody(text) {
+    if (process.env.MCP_DATA_DIR)
+        return `<${text.length} chars, elided on a hosted server>`;
+    return text;
+}
 // Per-request timeout. Overridable via OFW_REQUEST_TIMEOUT_MS. The default
 // (30s) is comfortably above OFW's typical p99 but low enough that a stuck
 // upstream fails fast instead of burning the MCP client-side budget — which
@@ -160,7 +169,7 @@ export class OFWClient {
         return this.fetchAuthed(method, path, body, 'application/json', async (response) => {
             const text = await response.text();
             if (debugLogEnabled()) {
-                console.error(`[ofw-debug] response body: ${text || '<empty>'}`);
+                console.error(`[ofw-debug] response body: ${text ? debugBody(text) : '<empty>'}`);
             }
             return (text ? JSON.parse(text) : null);
         });
@@ -243,7 +252,7 @@ export class OFWClient {
                 ? '<none>'
                 : isFormData
                     ? `<FormData entries=${Array.from(body.keys()).join(',')}>`
-                    : JSON.stringify(body);
+                    : debugBody(JSON.stringify(body));
             console.error(`[ofw-debug] → ${method} ${url}${isRetry ? ' (retry)' : ''}`);
             // redactSecrets scrubs the Bearer token (and any other secret shapes)
             // from the serialized header map — shared fleet redaction, never bespoke.

package/dist/protocol.js

@@ -15,13 +15,23 @@ export const OFW_TOKEN_TTL_MS = 6 * 60 * 60 * 1000;
 // How early we treat a token as expiring. Re-auth before this skew so a
 // long-running request doesn't get a stale token mid-flight.
 export const OFW_TOKEN_EXPIRY_SKEW_MS = 5 * 60 * 1000;
-// The only host this server is ever allowed to contact. Derived from BASE_URL
-// so the two cannot drift.
+// The only host the authenticated API path is ever allowed to contact.
+// Derived from BASE_URL so the two cannot drift.
 const ALLOWED_HOST = new URL(BASE_URL).host;
 /**
- * Enforced egress allowlist: every outbound request passes its
- * fully-constructed URL through here before `fetch` (API calls in client.ts,
- * the form login in auth-password.ts).
+ * The one OTHER host family this server fetches: signed `*.oaiusercontent.com`
+ * file URLs that `ofw_upload_expense_pdf` downloads a receipt from (its `url`
+ * mode). That fetch carries no OFW credential and is checked per redirect hop
+ * by `assertReceiptUrl` in tools/expenses.ts, not by `assertOfwUrl`. mint.yaml's
+ * hosted egress allowlist names exactly these two hosts — tests pin it.
+ */
+export const RECEIPT_HOST_SUFFIX = '.oaiusercontent.com';
+/**
+ * Enforced egress allowlist for every request that carries the OFW bearer
+ * token or a login: its fully-constructed URL passes through here before
+ * `fetch` (API calls in client.ts, the form login in auth-password.ts). The
+ * credential-free remote-receipt download is the one exception, held to
+ * `RECEIPT_HOST_SUFFIX` instead.
  *
  * Today this always passes, and that is the point. Every URL is
  * `${BASE_URL}${path}` with a path that begins with '/', so no id or query
@@ -29,9 +39,9 @@ const ALLOWED_HOST = new URL(BASE_URL).host;
  * the authority component when a '/' already precedes it. The check exists so
  * that stays true after a future refactor: a code change (or a compromised
  * dependency) that pointed `fetch` somewhere else would throw here instead of
- * carrying the bearer token or a message body off-host. It makes "this server
- * only ever talks to OFW" a structural invariant rather than a code-review
- * promise.
+ * carrying the bearer token or a message body off-host. It makes "the
+ * credential only ever goes to OFW" a structural invariant rather than a
+ * code-review promise.
  *
  * Scope, stated honestly: this is a PRE-FLIGHT check on the URL we construct.
  * It does not follow redirects, so it is not a complete egress control — an

package/dist/tools/expenses.js

@@ -5,6 +5,7 @@ import { CONFIRM_NOTE, confirmTokenParam, confirmWrite, stateRevision } from './
 import { readUpstreamPaging } from './pagination.js';
 import { getExpenseUploadOnly, getWriteMode } from '../config.js';
 import { parseLenient } from '@chrischall/mcp-utils';
+import { RECEIPT_HOST_SUFFIX } from '../protocol.js';
 const UploadedExpenseFileSchema = z.looseObject({
     fileId: z.number(),
     fileName: z.string().optional(),
@@ -32,7 +33,7 @@ function assertReceiptUrl(url) {
     if (url.protocol !== 'https:') {
         throw new Error('Remote expense receipt URLs must use HTTPS.');
     }
-    if (!url.hostname.toLowerCase().endsWith('.oaiusercontent.com')) {
+    if (!url.hostname.toLowerCase().endsWith(RECEIPT_HOST_SUFFIX)) {
         throw new Error('Remote expense receipt URLs must be signed oaiusercontent.com file URLs.');
     }
 }

package/dist/version.js

@@ -4,4 +4,4 @@
 // package.json drift. Importing these instead of package.json keeps the whole
 // manifest — npm scripts included — out of dist/bundle.js.
 export const SERVER_NAME = 'ofw-mcp';
-export const VERSION = '2.20.4'; // x-release-please-version
+export const VERSION = '2.20.5'; // x-release-please-version

package/mint.yaml

@@ -107,7 +107,8 @@ env:
     help: >-
       Set to 1 to write verbose request/response diagnostics to stderr. Off by
       default; useful when a read is failing and you need to see the upstream
-      exchange.
+      exchange. On a hosted server only method, path, status and timing are
+      logged — request and response bodies are replaced by their size.
   - name: OFW_AUTO_REFRESH
     required: false
     help: >-
@@ -174,3 +175,7 @@ egress:
     # Only hosts the SERVER process actually fetches. Hosts that appear
     # solely in a URL this server BUILDS and returns are excluded.
     - ofw.ourfamilywizard.com
+    # ofw_upload_expense_pdf `url` mode downloads a receipt from a signed
+    # file URL (no OFW credential is sent there; every redirect hop is
+    # re-checked against this suffix in src/tools/expenses.ts).
+    - "*.oaiusercontent.com"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.20.4",
+  "version": "2.20.5",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",
@@ -34,8 +34,8 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.0",
-    "@fetchproxy/bootstrap": "^3.6.0",
+    "@chrischall/mcp-utils": "^3.0.3",
+    "@fetchproxy/bootstrap": "^3.6.2",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.0",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.20.4",
+  "version": "2.20.5",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.20.4",
+      "version": "2.20.5",
       "transport": {
         "type": "stdio"
       },