ofw-mcp 2.4.4 → 2.5.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.4.4"
+    "version": "2.5.0"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.4.4",
+      "version": "2.5.0",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.4.4",
+  "version": "2.5.0",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"

package/README.md

@@ -144,9 +144,9 @@ Read-only tools run automatically. Write tools ask for your confirmation first.
 | `ofw_delete_draft` | Delete a draft | Confirm | `drafts` |
 | `ofw_upload_attachment` | Upload a local file to My Files; returns a fileId to attach via `ofw_send_message`/`ofw_save_draft` | Auto | `drafts` |
 | `ofw_list_events` | Calendar events in a date range | Auto | any |
-| `ofw_create_event` | Create a calendar event | Confirm | `all` |
-| `ofw_update_event` | Update a calendar event | Confirm | `all` |
-| `ofw_delete_event` | Delete a calendar event | Confirm | `all` |
+| `ofw_create_event` | Create a calendar event | Confirm | `all` (or `drafts` + `OFW_CALENDAR_WRITES`) |
+| `ofw_update_event` | Update a calendar event | Confirm | `all` (or `drafts` + `OFW_CALENDAR_WRITES`) |
+| `ofw_delete_event` | Delete a calendar event | Confirm | `all` (or `drafts` + `OFW_CALENDAR_WRITES`) |
 | `ofw_get_expense_totals` | Expense summary totals | Auto | any |
 | `ofw_list_expenses` | Expense history | Auto | any |
 | `ofw_create_expense` | Log a new expense | Confirm | `all` |
@@ -165,6 +165,10 @@ The "Confirm" permission above is a *hint* to the MCP host — a host configured
 
 Unrecognized values fail closed to `none`, with a warning on stderr — a typo never silently grants write access.
 
+#### Calendar opt-in (`OFW_CALENDAR_WRITES`)
+
+Calendar events sit between the two message tiers: they have no draft stage (a created event is immediately visible on the shared record), but unlike a sent message they are reversible — an event can be edited or deleted afterward. If you run in `drafts` mode but are comfortable with direct calendar writes, set `OFW_CALENDAR_WRITES=true` to additionally register `ofw_create_event`, `ofw_update_event`, and `ofw_delete_event`. The flag is redundant in `all` mode and never overrides `none`.
+
 ## Troubleshooting
 
 **"0 messages"** — Claude may have read the notification counts rather than the actual messages. Ask explicitly: *"List the messages in my OFW inbox"* or *"Use ofw_list_message_folders then ofw_list_messages"*.

package/dist/bundle.js

@@ -34931,6 +34931,7 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "capture_request_header",
   "capture_redirect",
   "read_indexed_db",
+  "read_dom",
   "download"
 ]);
 
@@ -35232,6 +35233,44 @@ function assertIndexedDbScopesArray(value, label) {
     }
   }
 }
+var DOM_SELECTOR_RE = /^[^-]{1,512}$/;
+var DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
+function assertDomSelectorsArray(value, label) {
+  if (!Array.isArray(value)) {
+    throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    assertObject(entry, `${label}[${i}]`);
+    if (entry.name === void 0) {
+      throw new ProtocolError(`${label}[${i}].name: missing`);
+    }
+    if (entry.selector === void 0) {
+      throw new ProtocolError(`${label}[${i}].selector: missing`);
+    }
+    if (typeof entry.name !== "string" || !SCOPE_KEY_RE.test(entry.name)) {
+      throw new ProtocolError(`${label}[${i}].name: invalid ${JSON.stringify(entry.name)}`);
+    }
+    if (typeof entry.selector !== "string" || !DOM_SELECTOR_RE.test(entry.selector)) {
+      throw new ProtocolError(`${label}[${i}].selector: invalid ${JSON.stringify(entry.selector)}`);
+    }
+    if (entry.attribute !== void 0) {
+      if (typeof entry.attribute !== "string" || !DOM_ATTRIBUTE_RE.test(entry.attribute)) {
+        throw new ProtocolError(`${label}[${i}].attribute: invalid ${JSON.stringify(entry.attribute)}`);
+      }
+    }
+    if (seen.has(entry.name)) {
+      throw new ProtocolError(`${label}: duplicate name ${JSON.stringify(entry.name)}`);
+    }
+    seen.add(entry.name);
+    for (const k of Object.keys(entry)) {
+      if (k !== "name" && k !== "selector" && k !== "attribute") {
+        throw new ProtocolError(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
+      }
+    }
+  }
+}
 function validateFrame(raw) {
   assertObject(raw, "frame");
   const t = raw.type;
@@ -35307,6 +35346,9 @@ function validateHello(raw) {
     if (raw.sessionStoragePointers !== void 0) {
       assertStoragePointersArray(raw.sessionStoragePointers, "hello.sessionStoragePointers", raw.sessionStorageKeys);
     }
+    if (raw.domSelectors !== void 0) {
+      assertDomSelectorsArray(raw.domSelectors, "hello.domSelectors");
+    }
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
@@ -35541,6 +35583,21 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
+  if (raw.op === "read_dom") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.origin === void 0)
+      throw new ProtocolError("inner.init.origin: missing");
+    if (raw.init.names === void 0)
+      throw new ProtocolError("inner.init.names: missing");
+    assertHttpsOriginOnly(raw.init.origin, "inner.init.origin");
+    assertNonEmptyKeyArray(raw.init.names, "inner.init.names");
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "origin" && k !== "names") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on read_dom`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "download") {
     assertObject(raw.init, "inner.init");
     if (raw.init.url === void 0) {
@@ -35566,7 +35623,7 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "download"; got ${JSON.stringify(raw.op)}`);
+  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -35651,6 +35708,13 @@ function validateInnerResponse(raw) {
       assertObject(raw.values, "inner.values");
       return raw;
     }
+    if (op === "read_dom") {
+      if (raw.values === void 0) {
+        throw new ProtocolError("inner.values: missing on read_dom response");
+      }
+      assertStringMap(raw.values, "inner.values");
+      return raw;
+    }
     if (op === "download") {
       assertObject(raw.value, "inner.value");
       assertString(raw.value.path, "inner.value.path");
@@ -35990,6 +36054,13 @@ async function buildServerHello(opts) {
       jsonPointer: d.jsonPointer
     }));
   }
+  if (opts.domSelectors && opts.domSelectors.length > 0) {
+    hello.domSelectors = opts.domSelectors.map((d) => ({
+      name: d.name,
+      selector: d.selector,
+      ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
+    }));
+  }
   return hello;
 }
 
@@ -36079,7 +36150,8 @@ async function startHost(opts) {
     captureHeaders: opts.ownCaptureHeaders,
     indexedDbScopes: opts.ownIndexedDbScopes,
     localStoragePointers: opts.ownLocalStoragePointers,
-    sessionStoragePointers: opts.ownSessionStoragePointers
+    sessionStoragePointers: opts.ownSessionStoragePointers,
+    domSelectors: opts.ownDomSelectors
   });
   const ownSessionNonce = fromB64(ownHello.sessionNonce);
   let extensionWs = null;
@@ -36314,6 +36386,7 @@ async function startPeer(opts) {
     sessionStorageKeys: opts.sessionStorageKeys,
     captureHeaders: opts.captureHeaders,
     indexedDbScopes: opts.indexedDbScopes,
+    domSelectors: opts.domSelectors,
     localStoragePointers: opts.localStoragePointers,
     sessionStoragePointers: opts.sessionStoragePointers
   });
@@ -36721,6 +36794,11 @@ var FetchproxyServer = class {
         key: d.key,
         jsonPointer: d.jsonPointer
       })),
+      domSelectors: (opts.domSelectors ?? []).map((d) => ({
+        name: d.name,
+        selector: d.selector,
+        ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
+      })),
       // 0.8.0+: timer + lazy-revive default to ON. Every realty MCP
       // adapter was about to set these to the same numbers anyway; the
       // back-door is `0` (explicit opt-out) if a caller genuinely wants
@@ -36841,6 +36919,7 @@ var FetchproxyServer = class {
         ownIndexedDbScopes: this.opts.indexedDbScopes,
         ownLocalStoragePointers: this.opts.localStoragePointers,
         ownSessionStoragePointers: this.opts.sessionStoragePointers,
+        ownDomSelectors: this.opts.domSelectors,
         onPairCode: this.opts.onPairCode
       });
       this.hostHandle.onOwnInner((inner) => this.onInner(inner));
@@ -36868,7 +36947,8 @@ var FetchproxyServer = class {
         captureHeaders: this.opts.captureHeaders,
         indexedDbScopes: this.opts.indexedDbScopes,
         localStoragePointers: this.opts.localStoragePointers,
-        sessionStoragePointers: this.opts.sessionStoragePointers
+        sessionStoragePointers: this.opts.sessionStoragePointers,
+        domSelectors: this.opts.domSelectors
       });
       this.peerHandle.onInner((inner) => this.onInner(inner));
       this.peerHandle.onRenegotiate(() => {
@@ -37843,6 +37923,46 @@ var FetchproxyServer = class {
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingIdb, id, origin);
   }
+  /**
+   * 1.4.0+: read declared DOM values from the user's signed-in tab.
+   * Requires `'read_dom'` in capabilities AND every requested `name` to
+   * match a declared `domSelectors` entry. The extension reads each
+   * declared selector from the matched tab's DOM (isolated-world
+   * `querySelector`, value or attribute) — no page-JS execution.
+   *
+   * Returns a `Record<string, string>` of `name → value`, with names
+   * whose element (or attribute) was absent omitted. Throws
+   * `FetchproxyProtocolError` on bridge failures and a plain `Error` on
+   * developer mistakes (undeclared capability, undeclared name).
+   */
+  async readDom(opts) {
+    if (!this.opts.capabilities.includes("read_dom")) {
+      throw new Error('FetchproxyServer.readDom(): MCP did not declare "read_dom" in capabilities');
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    if (!Array.isArray(opts.names) || opts.names.length === 0) {
+      throw new Error("FetchproxyServer.readDom: opts.names must be a non-empty array");
+    }
+    this.assertScopeSubset(opts.names, this.opts.domSelectors.map((d) => d.name), "domSelectors");
+    if (opts.subdomain !== void 0)
+      assertSubdomainLabel(opts.subdomain);
+    const baseDomain = this.resolveBaseDomain(opts.domain);
+    const host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
+    const origin = `https://${host}`;
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "read_dom",
+      init: { origin, names: [...opts.names] }
+    };
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingStorage.set(id, { resolve: resolve2, reject });
+    });
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
+  }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
     if (undeclared.length > 0) {
@@ -37914,7 +38034,7 @@ var FetchproxyServer = class {
     if (storageCb) {
       this.pendingStorage.delete(inner.id);
       if (inner.ok) {
-        if ((inner.op === "read_local_storage" || inner.op === "read_session_storage") && inner.values) {
+        if ((inner.op === "read_local_storage" || inner.op === "read_session_storage" || inner.op === "read_dom") && inner.values) {
           storageCb.resolve({ ...inner.values });
         } else {
           storageCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on storage awaiter`));
@@ -38285,7 +38405,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.4.4",
+  version: "2.5.0",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -38317,7 +38437,7 @@ var package_default = {
     "test:watch": "vitest"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.12.0",
+    "@chrischall/mcp-utils": "^0.13.0",
     "@fetchproxy/bootstrap": "^1.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
@@ -38327,7 +38447,7 @@ var package_default = {
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^4.1.7",
     esbuild: "^0.28.0",
-    typescript: "^6.0.3",
+    typescript: "^7.0.2",
     vitest: "^4.1.7"
   }
 };
@@ -38553,11 +38673,14 @@ var ApiRecipientSchema = external_exports.looseObject({
   viewed: external_exports.looseObject({ dateTime: external_exports.string() }).nullable().optional()
 });
 function mapRecipients(items) {
-  return (items ?? []).map((r) => ({
-    userId: r.user?.id ?? 0,
-    name: r.user?.name ?? "",
-    viewedAt: r.viewed?.dateTime ?? null
-  }));
+  return (items ?? []).map((r) => {
+    const dt = r.viewed?.dateTime;
+    const viewedAt = typeof dt === "string" && !dt.startsWith("1970-01-01") ? dt : null;
+    return { userId: r.user?.id ?? 0, name: r.user?.name ?? "", viewedAt };
+  });
+}
+function hasRealView(recipients) {
+  return recipients.some((r) => r.viewedAt !== null && !r.viewedAt.startsWith("1970-01-01"));
 }
 var expandPath2 = expandPath;
 function verifyWriteLanded(kind, sent, persisted) {
@@ -38646,6 +38769,11 @@ function getWriteMode() {
   );
   return "none";
 }
+function getCalendarWritesAllowed() {
+  const mode = getWriteMode();
+  if (mode === "all") return true;
+  return mode === "drafts" && parseBoolEnv("OFW_CALENDAR_WRITES");
+}
 function getDefaultInlineAttachments() {
   return parseBoolEnv("OFW_INLINE_ATTACHMENTS");
 }
@@ -39055,7 +39183,10 @@ var ListItemSchema = external_exports.looseObject({
 var ListResponseSchema = external_exports.looseObject({ data: external_exports.array(ListItemSchema).optional() });
 var DetailResponseSchema = external_exports.looseObject({
   body: external_exports.string().optional(),
-  files: external_exports.array(external_exports.number()).optional()
+  files: external_exports.array(external_exports.number()).optional(),
+  // The detail endpoint carries the REAL recipient view timestamps (the list
+  // endpoint only has an epoch placeholder) — used by the view-status refresh.
+  recipients: external_exports.array(ApiRecipientSchema).optional()
 });
 async function syncMessageFolder(client2, folder, folderId, opts) {
   let page = 1;
@@ -39075,7 +39206,18 @@ async function syncMessageFolder(client2, folder, folderId, opts) {
     for (const item of items) {
       if (newestId === null || item.id > newestId) newestId = item.id;
       const existing = getMessage(item.id);
-      if (existing) continue;
+      if (existing) {
+        if (folder === "sent" && item.showNeverViewed === false && !hasRealView(existing.recipients)) {
+          const detail = parseLenient(
+            DetailResponseSchema,
+            await client2.request("GET", `/pub/v3/messages/${item.id}`),
+            { label: "ofw-mcp", context: "GET /pub/v3/messages/{id} (view-status refresh)" }
+          );
+          upsertMessage({ ...existing, recipients: mapRecipients(detail.recipients), listData: item });
+          synced++;
+        }
+        continue;
+      }
       pageHadNewItem = true;
       const isInboxUnread = folder === "inbox" && item.showNeverViewed === true;
       const shouldFetchBody = !isInboxUnread || opts.fetchUnreadBodies;
@@ -39362,8 +39504,26 @@ function registerMessageTools(server, client2) {
     }
     const cached2 = getMessage(id);
     if (cached2 && cached2.body !== null) {
+      let row2 = cached2;
+      if (cached2.folder === "sent" && !hasRealView(cached2.recipients)) {
+        try {
+          const detail2 = parseLenient(
+            MessageDetailSchema,
+            await client2.request("GET", `/pub/v3/messages/${id}`),
+            { label: "ofw-mcp", context: "GET /pub/v3/messages/{id} (view-status refresh)" }
+          );
+          const recipients = mapRecipients(detail2.recipients);
+          row2 = {
+            ...cached2,
+            recipients,
+            listData: { ...cached2.listData, showNeverViewed: !hasRealView(recipients) }
+          };
+          upsertMessage(row2);
+        } catch {
+        }
+      }
       let attachments2 = listAttachmentsForMessage(id);
-      if (attachments2.length === 0 && listDataHintsAtFiles(cached2.listData)) {
+      if (attachments2.length === 0 && listDataHintsAtFiles(row2.listData)) {
         try {
           const detail2 = parseLenient(
             DetailFilesSchema,
@@ -39377,7 +39537,7 @@ function registerMessageTools(server, client2) {
         } catch {
         }
       }
-      return jsonResponse({ ...cached2, attachments: attachments2 });
+      return jsonResponse({ ...row2, attachments: attachments2 });
     }
     const detail = parseLenient(
       MessageDetailSchema,
@@ -39793,8 +39953,87 @@ async function deleteOFWMessages(client2, ids) {
 }
 
 // src/tools/calendar.ts
+var ofwDate = external_exports.looseObject({ dateTime: external_exports.string() });
+var userRef = external_exports.looseObject({ userId: external_exports.number() });
+var eventDetailSchema = external_exports.looseObject({
+  eventRecurrenceId: external_exports.number(),
+  title: external_exports.string(),
+  allDay: external_exports.boolean(),
+  publicFlag: external_exports.boolean(),
+  startDate: ofwDate,
+  endDate: ofwDate,
+  location: external_exports.string().nullish(),
+  notes: external_exports.string().nullish(),
+  reminderMinutes: external_exports.number().nullish(),
+  children: external_exports.array(userRef).nullish(),
+  eventParent: userRef.nullish(),
+  dropOffParent: userRef.nullish(),
+  pickUpParent: userRef.nullish()
+});
+var eventWriteFields = {
+  startDate: external_exports.string().describe("Start date YYYY-MM-DD"),
+  endDate: external_exports.string().describe("End date YYYY-MM-DD (default: startDate)").optional(),
+  startTime: external_exports.string().describe("Start time HH:mm, 24-hour (required unless allDay)").optional(),
+  endTime: external_exports.string().describe("End time HH:mm, 24-hour (required unless allDay)").optional(),
+  allDay: external_exports.boolean().optional(),
+  privateEvent: external_exports.boolean().describe("true = visible only to you; default false = shared with co-parent").optional(),
+  location: external_exports.string().optional(),
+  notes: external_exports.string().optional(),
+  reminderMinutes: external_exports.number().int().min(0).optional(),
+  children: external_exports.array(external_exports.number()).describe("Child userIds to tag (see ofw_get_profile)").optional(),
+  eventParentId: external_exports.number().describe("userId of the parent the event is 'for'").optional(),
+  dropOffParentId: external_exports.number().describe("userId of the drop-off parent").optional(),
+  pickUpParentId: external_exports.number().describe("userId of the pick-up parent").optional()
+};
+function buildEventPayload(a) {
+  const allDay = a.allDay ?? false;
+  if (!allDay && (!a.startTime || !a.endTime)) {
+    throw new Error("startTime and endTime (HH:mm) are required unless allDay is true");
+  }
+  const payload = {
+    title: a.title,
+    startDate: a.startDate,
+    endDate: a.endDate ?? a.startDate,
+    // The web form always sends times; for all-day events it uses 01:00/02:00
+    // placeholders that OFW ignores.
+    startTime: a.startTime ?? "01:00",
+    endTime: a.endTime ?? "02:00",
+    allDay,
+    publicFlag: !(a.privateEvent ?? false)
+  };
+  if (a.location) payload.location = a.location;
+  if (a.notes) payload.notes = a.notes;
+  if (a.reminderMinutes !== void 0) payload.reminderMinutes = String(a.reminderMinutes);
+  if (a.children !== void 0) payload.children = a.children;
+  if (a.eventParentId !== void 0) payload.eventParentId = String(a.eventParentId);
+  if (a.dropOffParentId !== void 0) payload.dropOffParentId = String(a.dropOffParentId);
+  if (a.pickUpParentId !== void 0) payload.pickUpParentId = String(a.pickUpParentId);
+  return payload;
+}
+function detailToWriteArgs(d) {
+  const [startDate, startClock] = d.startDate.dateTime.split("T");
+  const [endDate, endClock] = d.endDate.dateTime.split("T");
+  return {
+    title: d.title,
+    startDate,
+    endDate,
+    startTime: (startClock ?? "01:00:00").slice(0, 5),
+    endTime: (endClock ?? "02:00:00").slice(0, 5),
+    allDay: d.allDay,
+    privateEvent: !d.publicFlag,
+    location: d.location ?? void 0,
+    notes: d.notes ?? void 0,
+    reminderMinutes: d.reminderMinutes ?? void 0,
+    // Untagged (nullish or empty) → undefined, so the merged PUT omits the
+    // field (omission preserves; only a CALLER-supplied [] should clear).
+    children: d.children?.length ? d.children.map((c) => c.userId) : void 0,
+    eventParentId: d.eventParent?.userId,
+    dropOffParentId: d.dropOffParent?.userId,
+    pickUpParentId: d.pickUpParent?.userId
+  };
+}
 function registerCalendarTools(server, client2) {
-  const allowWrites = getWriteMode() === "all";
+  const allowWrites = getCalendarWritesAllowed();
   server.registerTool("ofw_list_events", {
     description: "List OurFamilyWizard calendar events in a date range",
     annotations: { readOnlyHint: true },
@@ -39812,51 +40051,62 @@ function registerCalendarTools(server, client2) {
     return jsonResponse(data);
   });
   if (allowWrites) server.registerTool("ofw_create_event", {
-    description: "Create a calendar event in OurFamilyWizard",
+    description: "Create a calendar event in OurFamilyWizard. Unless privateEvent is true, the event is immediately visible to the co-parent \u2014 there is no draft stage.",
     annotations: { destructiveHint: false },
     inputSchema: {
       title: external_exports.string(),
-      startDate: external_exports.string().describe("ISO datetime string"),
-      endDate: external_exports.string().describe("ISO datetime string"),
-      allDay: external_exports.boolean().optional(),
-      location: external_exports.string().optional(),
-      reminder: external_exports.string().describe('Reminder setting (e.g. "1 hour before")').optional(),
-      privateEvent: external_exports.boolean().optional(),
-      eventFor: external_exports.string().describe("neither | parent1 | parent2").optional(),
-      dropOffParent: external_exports.string().optional(),
-      pickUpParent: external_exports.string().optional(),
-      children: external_exports.array(external_exports.number()).describe("Array of child IDs").optional()
+      ...eventWriteFields
     }
   }, async (args) => {
-    const data = await client2.request("POST", "/pub/v1/calendar/events", args);
-    return jsonResponse(data);
+    const raw = await client2.request("POST", "/pub/v3/events", buildEventPayload(args));
+    const event = parseLenient(eventDetailSchema, raw, { label: "ofw-mcp", context: "POST /pub/v3/events", mode: "strict" });
+    return jsonResponse({
+      note: `Event created. Use eventRecurrenceId ${event.eventRecurrenceId} as eventId for ofw_update_event/ofw_delete_event.`,
+      event
+    });
   });
   if (allowWrites) server.registerTool("ofw_update_event", {
-    description: "Update an existing OurFamilyWizard calendar event",
+    description: "Update an existing OurFamilyWizard calendar event. Fetches the event, applies the given changes, and writes the merged result back (OFW has no partial update).",
     annotations: { destructiveHint: true },
     inputSchema: {
-      eventId: external_exports.string(),
+      eventId: external_exports.string().describe("Event id \u2014 the `id` from ofw_list_events / eventRecurrenceId from ofw_create_event"),
       title: external_exports.string().optional(),
-      startDate: external_exports.string().optional(),
-      endDate: external_exports.string().optional(),
-      allDay: external_exports.boolean().optional(),
-      location: external_exports.string().optional(),
-      reminder: external_exports.string().optional(),
-      privateEvent: external_exports.boolean().optional()
+      startDate: eventWriteFields.startDate.optional(),
+      endDate: eventWriteFields.endDate,
+      startTime: eventWriteFields.startTime,
+      endTime: eventWriteFields.endTime,
+      allDay: eventWriteFields.allDay,
+      privateEvent: eventWriteFields.privateEvent,
+      location: eventWriteFields.location,
+      notes: eventWriteFields.notes,
+      reminderMinutes: eventWriteFields.reminderMinutes,
+      children: external_exports.array(external_exports.number()).describe("Child userIds to tag; pass [] to remove all child tags (omit to keep current tags)").optional(),
+      eventParentId: eventWriteFields.eventParentId,
+      dropOffParentId: eventWriteFields.dropOffParentId,
+      pickUpParentId: eventWriteFields.pickUpParentId
     }
   }, async (args) => {
-    const { eventId, ...updateData } = args;
-    const data = await client2.request("PUT", `/pub/v1/calendar/events/${encodeURIComponent(eventId)}`, updateData);
-    return jsonResponse(data);
+    const { eventId, ...changes } = args;
+    const id = encodeURIComponent(eventId);
+    const rawDetail = await client2.request("GET", `/pub/v3/events/${id}`);
+    const current = parseLenient(eventDetailSchema, rawDetail, { label: "ofw-mcp", context: `GET /pub/v3/events/${eventId}`, mode: "strict" });
+    const defined = Object.fromEntries(Object.entries(changes).filter(([, v]) => v !== void 0));
+    const merged = { ...detailToWriteArgs(current), ...defined };
+    await client2.request("PUT", `/pub/v3/events/${id}`, buildEventPayload(merged));
+    const rawAfter = await client2.request("GET", `/pub/v3/events/${id}`);
+    const event = parseLenient(eventDetailSchema, rawAfter, { label: "ofw-mcp", context: `GET /pub/v3/events/${eventId} (post-update)`, mode: "strict" });
+    return jsonResponse({ note: "Event updated; returning re-fetched event state.", event });
   });
   if (allowWrites) server.registerTool("ofw_delete_event", {
     description: "Delete an OurFamilyWizard calendar event",
     annotations: { destructiveHint: true },
     inputSchema: {
-      eventId: external_exports.string().describe("Event ID to delete")
+      eventId: external_exports.string().describe("Event id \u2014 the `id` from ofw_list_events / eventRecurrenceId from ofw_create_event"),
+      includeFuture: external_exports.boolean().describe("For repeating events: also delete future occurrences (default false)").optional()
     }
   }, async (args) => {
-    await client2.request("DELETE", `/pub/v1/calendar/events/${encodeURIComponent(args.eventId)}`);
+    const includeFuture = args.includeFuture ?? false;
+    await client2.request("DELETE", `/pub/v3/events/${encodeURIComponent(args.eventId)}?includeFuture=${includeFuture}`);
     return textResponse(`Event ${args.eventId} deleted`);
   });
 }
@@ -39939,7 +40189,7 @@ process.emit = function(event, ...args) {
 };
 await runMcp({
   name: "ofw",
-  version: "2.4.4",
+  version: "2.5.0",
   // x-release-please-version
   deps: client,
   tools: [

package/dist/config.js

@@ -61,6 +61,27 @@ export function getWriteMode() {
     console.error(`[ofw-mcp] Unrecognized OFW_WRITE_MODE "${raw.trim()}" — failing closed to "none" (no write tools registered). Valid values: none, drafts, all.`);
     return 'none';
 }
+/**
+ * Calendar-write opt-in for 'drafts' deployments.
+ *
+ * Messages have a draft stage (the human sends from the web UI), so 'drafts'
+ * mode keeps a human between model output and the court-visible record.
+ * Calendar events have no draft stage — but unlike a sent message they are
+ * fully reversible (editable and deletable), so a drafts-mode user may accept
+ * direct calendar writes without accepting sends. Setting
+ * OFW_CALENDAR_WRITES=true registers the calendar write tools
+ * (ofw_create_event, ofw_update_event, ofw_delete_event) alongside the
+ * draft-level message writes.
+ *
+ * The flag never overrides 'none': that mode is the hard read-only guarantee,
+ * including the fail-closed result of an unrecognized OFW_WRITE_MODE.
+ */
+export function getCalendarWritesAllowed() {
+    const mode = getWriteMode();
+    if (mode === 'all')
+        return true;
+    return mode === 'drafts' && parseBoolEnv('OFW_CALENDAR_WRITES');
+}
 // Default for ofw_download_attachment's `inline` arg when the caller doesn't
 // pass one. Set OFW_INLINE_ATTACHMENTS=true to have attachments returned as
 // MCP content blocks by default (skipping disk) — useful on sandboxed MCP

package/dist/index.js

@@ -24,7 +24,7 @@ import { registerJournalTools } from './tools/journal.js';
 // always succeeds before any credential check runs.
 await runMcp({
     name: 'ofw',
-    version: '2.4.4', // x-release-please-version
+    version: '2.5.0', // x-release-please-version
     deps: client,
     tools: [
         registerUserTools,