ofw-mcp 2.6.6 → 2.6.7

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "OurFamilyWizard tools for Claude Code",
-    "version": "2.6.6"
+    "version": "2.6.7"
   },
   "plugins": [
     {
@@ -14,7 +14,7 @@
       "displayName": "OurFamilyWizard",
       "source": "./",
       "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
-      "version": "2.6.6",
+      "version": "2.6.7",
       "author": {
         "name": "Chris Chall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ofw",
   "displayName": "OurFamilyWizard",
-  "version": "2.6.6",
+  "version": "2.6.7",
   "description": "OurFamilyWizard co-parenting tools for Claude — messages, calendar, expenses, and journal via MCP",
   "author": {
     "name": "Chris Chall"

package/dist/bundle.js

@@ -38407,7 +38407,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.6.6",
+  version: "2.6.7",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -38692,6 +38692,9 @@ var client = new OFWClient();
 // src/tools/_shared.ts
 var jsonResponse = textResult;
 var textResponse = rawTextResult;
+function jsonErrorResponse(data) {
+  return { ...textResult(data), isError: true };
+}
 var ApiRecipientSchema = external_exports.looseObject({
   // Live OFW payloads key the recipient's id as `userId` (verified against a
   // real /pub/v3/messages record: `recipients[].user.userId === 3039201`). An
@@ -38721,15 +38724,15 @@ function scrapeSaysRead(listData) {
   const ld = listData;
   return ld.read === true || ld.showNeverViewed === false;
 }
-function deriveRead(row, selfUserId) {
+function deriveRead(row) {
+  const viewedByAnyone = row.recipients.some((r) => r.viewedAt !== null);
   if (row.folder === "inbox") {
-    const viewed = selfUserId !== void 0 ? row.recipients.some((r) => r.userId === selfUserId && r.viewedAt !== null) : row.recipients.some((r) => r.viewedAt !== null);
-    return viewed || row.fetchedBodyAt !== null || scrapeSaysRead(row.listData);
+    return viewedByAnyone || row.fetchedBodyAt !== null || scrapeSaysRead(row.listData);
   }
-  return row.recipients.some((r) => r.viewedAt !== null) || scrapeSaysRead(row.listData);
+  return viewedByAnyone || scrapeSaysRead(row.listData);
 }
-function withReadState(row, selfUserId) {
-  const read = deriveRead(row, selfUserId);
+function withReadState(row) {
+  const read = deriveRead(row);
   const listData = typeof row.listData === "object" && row.listData !== null ? { ...row.listData, read, showNeverViewed: !read } : row.listData;
   return { ...row, read, listData };
 }
@@ -39033,12 +39036,20 @@ var DraftDetailSchema = external_exports.looseObject({
   body: external_exports.string().optional(),
   subject: external_exports.string().optional()
 });
+var DRAFTS_CACHE_STATUS_KEY = "drafts_cache_status";
+async function getDraftsCacheStatus(store) {
+  return await store.getMeta(DRAFTS_CACHE_STATUS_KEY) === "fresh" ? "fresh" : "unverified";
+}
 async function syncDrafts(client2, draftsFolderId, store, budget) {
   const b = budget ?? makeBudget(Number.POSITIVE_INFINITY);
+  const defer = async () => {
+    await store.setMeta(DRAFTS_CACHE_STATUS_KEY, "unverified");
+    return { synced: 0, done: false };
+  };
   const items = [];
   let page = 1;
   while (true) {
-    if (!b.take()) return { synced: 0, done: false };
+    if (!b.take()) return defer();
     const path = `/pub/v3/messages?folders=${encodeURIComponent(draftsFolderId)}&page=${page}&size=50&sort=date&sortDirection=desc`;
     const list = parseLenient(
       DraftListResponseSchema,
@@ -39052,7 +39063,7 @@ async function syncDrafts(client2, draftsFolderId, store, budget) {
   }
   const rows = [];
   for (const item of items) {
-    if (!b.take()) return { synced: 0, done: false };
+    if (!b.take()) return defer();
     const detail = parseLenient(
       DraftDetailSchema,
       await client2.request("GET", `/pub/v3/messages/${item.id}`),
@@ -39085,16 +39096,22 @@ async function syncDrafts(client2, draftsFolderId, store, budget) {
   for (const id of await store.listDraftIds()) {
     if (!seenIds.has(id)) await store.deleteDraft(id);
   }
+  await store.setMeta(DRAFTS_CACHE_STATUS_KEY, "fresh");
   return { synced, done: true };
 }
 async function syncAll(client2, opts, store) {
-  const folders = opts.folders ?? ["inbox", "sent", "drafts"];
+  const requested = opts.folders ?? ["inbox", "sent", "drafts"];
+  const folders = [
+    ...requested.filter((f) => f === "drafts"),
+    ...requested.filter((f) => f !== "drafts")
+  ];
   const budget = makeBudget(opts.maxRequests ?? Number.POSITIVE_INFINITY);
   budget.take();
   const ids = await resolveFolderIds(client2, store);
   const synced = {};
   let unreadInbox = [];
   let done = true;
+  let draftsUnverified = false;
   for (const folder of folders) {
     if (folder === "inbox") {
       const r = await syncMessageFolder(client2, "inbox", ids.inbox, {
@@ -39115,11 +39132,17 @@ async function syncAll(client2, opts, store) {
       if (!r.done) done = false;
     } else if (folder === "drafts") {
       const r = await syncDrafts(client2, ids.drafts, store, budget);
-      synced.drafts = r.synced;
-      if (!r.done) done = false;
+      if (r.done) synced.drafts = r.synced;
+      else {
+        draftsUnverified = true;
+        done = false;
+      }
     }
   }
   const notes = [];
+  if (draftsUnverified) {
+    notes.push('The drafts folder was NOT checked against OurFamilyWizard on this call (the request budget ran out first), so no drafts count is reported and the cached drafts are marked "unverified". Cached draft bodies may be behind the server. Call ofw_sync_messages again \u2014 or ofw_sync_messages with folders:["drafts"] \u2014 before editing or deleting a draft.');
+  }
   if (unreadInbox.length > 0) {
     notes.push(`${unreadInbox.length} unread inbox messages cached without bodies. Call ofw_get_message(id) to read them \u2014 this will mark them as read on OFW.`);
   }
@@ -39130,6 +39153,116 @@ async function syncAll(client2, opts, store) {
   return { synced, unreadInbox, done, ...note ? { note } : {} };
 }
 
+// src/tools/draft-freshness.ts
+var DraftFreshnessError = class extends Error {
+};
+var FNV_OFFSET = 0xcbf29ce484222325n;
+var FNV_PRIME = 0x100000001b3n;
+var MASK64 = 0xffffffffffffffffn;
+function fnv1a64(s) {
+  let h = FNV_OFFSET;
+  for (let i = 0; i < s.length; i++) {
+    h = (h ^ BigInt(s.charCodeAt(i))) * FNV_PRIME & MASK64;
+  }
+  return h.toString(16).padStart(16, "0");
+}
+function draftRevision(d) {
+  const ids = [...new Set(d.recipients.map((r) => r.userId))].sort((a, b) => a - b);
+  const parts = [d.subject, d.body, String(d.replyToId ?? ""), ids.join(",")];
+  return `r1:${fnv1a64(parts.map((p) => `${p.length}:${p}`).join("|"))}`;
+}
+var ServerDraftSchema = external_exports.looseObject({
+  subject: external_exports.string().optional(),
+  body: external_exports.string().optional(),
+  replyToId: external_exports.number().nullable().optional(),
+  recipients: external_exports.array(ApiRecipientSchema).optional()
+});
+function isNotFound(e) {
+  return e instanceof Error && /OFW API error: 404\b/.test(e.message);
+}
+async function fetchServerDraft(client2, id) {
+  let raw;
+  try {
+    raw = await client2.request("GET", `/pub/v3/messages/${id}`);
+  } catch (e) {
+    if (isNotFound(e)) return null;
+    throw new DraftFreshnessError(
+      `could not read the current state of draft ${id} from OurFamilyWizard: ${e.message}`
+    );
+  }
+  if (raw === null || raw === void 0) return null;
+  const detail = parseLenient(ServerDraftSchema, raw, {
+    label: "ofw-mcp",
+    context: "GET /pub/v3/messages/{id} (draft freshness check)",
+    mode: "strict"
+  });
+  return {
+    subject: detail.subject ?? "",
+    body: detail.body ?? "",
+    replyToId: detail.replyToId ?? null,
+    recipients: mapRecipients(detail.recipients)
+  };
+}
+function diffFields(a, b) {
+  const changed = [];
+  if (a.subject !== b.subject) changed.push("subject");
+  if (a.body !== b.body) changed.push("body");
+  if (a.replyToId !== b.replyToId) changed.push("replyToId");
+  const ids = (d) => [...new Set(d.recipients.map((r) => r.userId))].sort((x, y) => x - y).join(",");
+  if (ids(a) !== ids(b)) changed.push("recipients");
+  return changed;
+}
+function checkDraftFreshness(input) {
+  const { server, cached: cached2, expectedRevision } = input;
+  if (server === null) {
+    return {
+      verdict: "MISSING",
+      reason: "The draft no longer exists on OurFamilyWizard \u2014 it may have been sent or deleted elsewhere.",
+      changedFields: []
+    };
+  }
+  if (expectedRevision !== void 0) {
+    const actual = draftRevision(server);
+    if (expectedRevision === actual) {
+      return { verdict: "FRESH", reason: "expectedRevision matches the live server draft.", changedFields: [] };
+    }
+    return {
+      verdict: "STALE",
+      reason: `expectedRevision ${expectedRevision} does not match the live server draft (${actual}) \u2014 it changed after you read it.`,
+      changedFields: cached2 === null ? [] : diffFields(server, cached2)
+    };
+  }
+  if (cached2 === null) {
+    return {
+      verdict: "STALE",
+      reason: "This draft is not in the local cache, so there is no base to confirm the edit against.",
+      changedFields: []
+    };
+  }
+  const changedFields = diffFields(server, cached2);
+  if (changedFields.length === 0) {
+    return { verdict: "FRESH", reason: "The cached draft matches the live server draft.", changedFields: [] };
+  }
+  return {
+    verdict: "STALE",
+    reason: `The draft on OurFamilyWizard differs from the cached copy (${changedFields.join(", ")}) \u2014 it was edited outside this tool.`,
+    changedFields
+  };
+}
+function staleDraftPayload(input) {
+  const { error: error51, draftId, verdict, server, cached: cached2 } = input;
+  return {
+    error: error51,
+    draftId,
+    verdict: verdict.verdict,
+    reason: verdict.reason,
+    ...verdict.changedFields.length > 0 ? { changedFields: verdict.changedFields } : {},
+    ...server !== null ? { serverBody: server.body, serverSubject: server.subject, serverRevision: draftRevision(server) } : {},
+    ...cached2 !== null ? { cachedBody: cached2.body } : {},
+    recovery: server === null ? "The draft is gone from OurFamilyWizard. Nothing was changed. If you still want this content saved, call ofw_save_draft WITHOUT messageId to create a new draft." : "Nothing was changed. Merge your edit into serverBody above, then retry with expectedRevision set to serverRevision. Pass force:true only if you intend to discard the server copy shown here."
+  };
+}
+
 // src/config.ts
 import { createHash } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
@@ -39298,7 +39431,11 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
         replyToId: draftRow.replyToId,
         chainRootId: null,
         listData: draftRow.listData,
-        attachments: []
+        attachments: [],
+        // Concurrency token — pass as expectedRevision to ofw_save_draft /
+        // ofw_delete_draft to assert you are editing THIS version.
+        revision: draftRevision(draftRow),
+        cacheStatus: await getDraftsCacheStatus(cache)
       });
     }
     const cached2 = await cache.getMessage(id);
@@ -39488,6 +39625,60 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
 
 ${text}` : text);
   });
+  async function guardDestructiveDraftOp(input) {
+    const { cache, draftId, expectedRevision, force, action } = input;
+    const cachedRow = await cache.getDraft(draftId);
+    const cached2 = cachedRow === null ? null : {
+      subject: cachedRow.subject,
+      body: cachedRow.body,
+      recipients: cachedRow.recipients,
+      replyToId: cachedRow.replyToId
+    };
+    let server2;
+    try {
+      server2 = await fetchServerDraft(client2, draftId);
+    } catch (e) {
+      const reason = e.message;
+      if (force) {
+        return { ok: true, note: `WARNING: force:true \u2014 proceeded with ${action} on draft ${draftId} even though its current state could not be read from OurFamilyWizard (${reason}). Any newer server-side version was destroyed and is NOT recoverable from this response.` };
+      }
+      return {
+        ok: false,
+        response: jsonErrorResponse({
+          error: "FRESHNESS_CHECK_FAILED",
+          draftId,
+          reason,
+          recovery: "Nothing was changed. This is usually transient \u2014 retry. If it persists, verify the draft on ourfamilywizard.com. Pass force:true only if you accept overwriting a version you have not seen."
+        })
+      };
+    }
+    const verdict = checkDraftFreshness({ server: server2, cached: cached2, expectedRevision });
+    if (verdict.verdict === "FRESH") return { ok: true, note: null };
+    if (force) {
+      console.error(`[ofw-mcp] WARNING: force:true overrode a ${verdict.verdict} verdict on draft ${draftId} (${action}). ${verdict.reason}`);
+      const echoed = server2 === null ? "The draft no longer existed on OurFamilyWizard." : `The server version that was overwritten is preserved below under "overwrittenServerDraft".`;
+      return {
+        ok: true,
+        note: `WARNING: force:true overrode a ${verdict.verdict} freshness verdict on draft ${draftId}. ${verdict.reason} ${echoed}
+
+${JSON.stringify(
+          { overwrittenServerDraft: server2 === null ? null : { ...server2, revision: draftRevision(server2) } },
+          null,
+          2
+        )}`
+      };
+    }
+    return {
+      ok: false,
+      response: jsonErrorResponse(staleDraftPayload({
+        error: verdict.verdict === "MISSING" ? "MISSING_DRAFT" : "STALE_DRAFT",
+        draftId,
+        verdict,
+        server: server2,
+        cached: cached2
+      }))
+    };
+  }
   server.registerTool("ofw_list_drafts", {
     description: "List draft messages from the local OurFamilyWizard cache. Call ofw_sync_messages first if the cache is empty.",
     annotations: { readOnlyHint: true },
@@ -39498,12 +39689,21 @@ ${text}` : text);
   }, async (args) => {
     const page = args.page ?? 1;
     const size = args.size ?? 50;
-    const drafts = await cacheProvider().listDrafts({ page, size });
-    const payload = drafts.length === 0 ? { drafts: [], note: "Cache empty. Call ofw_sync_messages to populate." } : { drafts };
+    const cache = cacheProvider();
+    const cacheStatus = await getDraftsCacheStatus(cache);
+    const rows = await cache.listDrafts({ page, size });
+    const drafts = rows.map((d) => ({ ...d, revision: draftRevision(d), cacheStatus }));
+    if (drafts.length === 0) {
+      return jsonResponse({ drafts: [], note: "Cache empty. Call ofw_sync_messages to populate." });
+    }
+    const payload = { drafts };
+    if (cacheStatus !== "fresh") {
+      payload.note = 'cacheStatus "unverified": the last ofw_sync_messages did not finish checking the drafts folder against OurFamilyWizard, so these bodies may be behind the server (drafts edited in the OFW web app do not bump any timestamp). Run ofw_sync_messages again before relying on them. Writes are guarded regardless \u2014 ofw_save_draft and ofw_delete_draft re-check the server and refuse a stale overwrite.';
+    }
     return jsonResponse(payload);
   });
   if (allowDrafts) server.registerTool("ofw_save_draft", {
-    description: "Save a message as a draft in OurFamilyWizard. Recipients are optional. Pass messageId to replace an existing draft \u2014 note that under the hood this creates a NEW draft and deletes the old one (OFW's update-in-place endpoint silently no-ops while echoing the posted body, so we don't use it); the response.id will be the NEW id, not the messageId you passed, and the change is documented in a transparency NOTE in the response. If replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included in response). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After saving, the tool re-fetches the draft from OFW to populate the local cache from authoritative server state.",
+    description: "Save a message as a draft in OurFamilyWizard. Recipients are optional. Pass messageId to replace an existing draft \u2014 note that under the hood this creates a NEW draft and deletes the old one (OFW's update-in-place endpoint silently no-ops while echoing the posted body, so we don't use it); the response.id will be the NEW id, not the messageId you passed, and the change is documented in a transparency NOTE in the response. If replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included in response). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After saving, the tool re-fetches the draft from OFW to populate the local cache from authoritative server state. SAFETY: because replacing DESTROYS the old draft rather than merging, passing messageId first re-reads that draft from OFW and REFUSES the write if it changed since you read it (drafts edited in the OFW web app do not bump any timestamp, so the local cache can be silently behind). The refusal returns the current server body under serverBody \u2014 merge your edit into it and retry with expectedRevision.",
     annotations: { readOnlyHint: false },
     inputSchema: {
       subject: external_exports.string().describe("Message subject"),
@@ -39511,10 +39711,24 @@ ${text}` : text);
       recipientIds: external_exports.array(external_exports.number()).describe("Array of recipient user IDs (optional for drafts)").optional(),
       messageId: external_exports.number().describe("ID of an existing draft to replace (the new draft will have a new id; the old is deleted)").optional(),
       replyToId: external_exports.number().describe("ID of the message this draft replies to").optional(),
-      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment)").optional()
+      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment)").optional(),
+      expectedRevision: external_exports.string().describe('With messageId: the `revision` you got from ofw_list_drafts/ofw_get_message for that draft. Asserts you are replacing THAT version. If the draft changed on OFW since, the write is refused and the current server body is returned. Omit and the tool compares the server against the local cache instead \u2014 omitting never means "overwrite anyway".').optional(),
+      force: external_exports.boolean().describe("Default false. Overwrite even when the draft changed on OurFamilyWizard since you read it. The discarded server version is echoed back in the response. Only use after showing the user the conflict.").optional()
     }
   }, async (args) => {
     const cache = cacheProvider();
+    let forceNote = null;
+    if (args.messageId !== void 0) {
+      const guard = await guardDestructiveDraftOp({
+        cache,
+        draftId: args.messageId,
+        expectedRevision: args.expectedRevision,
+        force: args.force ?? false,
+        action: "replace"
+      });
+      if (!guard.ok) return guard.response;
+      forceNote = guard.note;
+    }
     const requestedReplyTo = args.replyToId ?? null;
     let resolvedReplyTo = requestedReplyTo;
     let rewriteNote = null;
@@ -39543,6 +39757,7 @@ ${text}` : text);
     let persisted = null;
     let replaceNote = null;
     let verifyNote = null;
+    let newRevision = null;
     if (newId !== null) {
       verifyNote = verifyWriteLanded("draft", { subject: args.subject, body: args.body }, detail);
       persisted = {
@@ -39555,33 +39770,48 @@ ${text}` : text);
         listData: detail
       };
       await cache.upsertDraft(persisted);
+      newRevision = draftRevision(persisted);
       if (args.messageId !== void 0 && args.messageId !== newId) {
         try {
           await deleteOFWMessages(client2, [args.messageId]);
           await cache.deleteDraft(args.messageId);
           replaceNote = `NOTE: ofw_save_draft replaced draft ${args.messageId} via create-then-delete. The new draft id is ${newId}; the old draft has been deleted. (OFW's update-in-place endpoint silently no-ops on subsequent updates, so we never use it. If you cached the old id anywhere, replace it with the new one.)`;
         } catch (e) {
-          replaceNote = `WARNING: New draft ${newId} created successfully, but failed to delete the old draft (${args.messageId}): ${e.message}. You may want to clean it up manually with ofw_delete_draft.`;
+          replaceNote = `WARNING: New draft ${newId} was created successfully, but the old draft ${args.messageId} could NOT be deleted: ${e.message}. BOTH drafts now exist on OurFamilyWizard and nothing was lost. Verify ${newId} reads correctly, then remove ${args.messageId} with ofw_delete_draft.`;
         }
       }
     }
-    const responseObj = persisted ?? raw;
+    const responseObj = persisted !== null ? { ...persisted, revision: newRevision, cacheStatus: "fresh" } : raw;
     const text = responseObj ? JSON.stringify(responseObj, null, 2) : "Draft saved.";
-    const notes = [rewriteNote, verifyNote, replaceNote].filter((n) => n !== null).join("\n\n");
+    const notes = [forceNote, rewriteNote, verifyNote, replaceNote].filter((n) => n !== null).join("\n\n");
     return textResponse(notes ? `${notes}
 
 ${text}` : text);
   });
   if (allowDrafts) server.registerTool("ofw_delete_draft", {
-    description: "Delete a draft message from OurFamilyWizard. Also removes the draft from the local cache.",
+    description: "Delete a draft message from OurFamilyWizard. Also removes the draft from the local cache. Before deleting, the draft is re-read from OFW and the delete is REFUSED if it changed since you last read it (the current server body is returned so nothing is lost) \u2014 pass expectedRevision to assert which version you mean, or force:true to delete regardless.",
     annotations: { destructiveHint: true },
     inputSchema: {
-      messageId: external_exports.number().describe("Draft message ID to delete")
+      messageId: external_exports.number().describe("Draft message ID to delete"),
+      expectedRevision: external_exports.string().describe("The `revision` you got from ofw_list_drafts/ofw_get_message. Asserts you are deleting THAT version; if the draft changed on OFW since, the delete is refused and the current server body returned.").optional(),
+      force: external_exports.boolean().describe("Default false. Delete even if the draft changed on OurFamilyWizard since you read it. The discarded server version is echoed back in the response.").optional()
     }
   }, async (args) => {
+    const cache = cacheProvider();
+    const guard = await guardDestructiveDraftOp({
+      cache,
+      draftId: args.messageId,
+      expectedRevision: args.expectedRevision,
+      force: args.force ?? false,
+      action: "delete"
+    });
+    if (!guard.ok) return guard.response;
     const data = await deleteOFWMessages(client2, [args.messageId]);
-    await cacheProvider().deleteDraft(args.messageId);
-    return data ? jsonResponse(data) : textResponse("Draft deleted.");
+    await cache.deleteDraft(args.messageId);
+    const text = data ? JSON.stringify(data, null, 2) : "Draft deleted.";
+    return textResponse(guard.note ? `${guard.note}
+
+${text}` : text);
   });
   server.registerTool("ofw_get_unread_sent", {
     description: "List sent messages that have not been read by one or more recipients. Reads from local cache; call ofw_sync_messages first if cache is stale.",
@@ -40572,7 +40802,7 @@ var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
 await runMcp({
   name: "ofw",
-  version: "2.6.6",
+  version: "2.6.7",
   // x-release-please-version
   deps: client,
   tools: [

package/dist/index.js

@@ -35,7 +35,7 @@ const nodeAttachmentIO = new NodeAttachmentIO();
 // always succeeds before any credential check runs.
 await runMcp({
     name: 'ofw',
-    version: '2.6.6', // x-release-please-version
+    version: '2.6.7', // x-release-please-version
     deps: client,
     tools: [
         registerUserTools,

package/dist/sync.js

@@ -323,9 +323,28 @@ const DraftDetailSchema = z.looseObject({
     body: z.string().optional(),
     subject: z.string().optional(),
 });
+/**
+ * Meta key holding whether the drafts cache has been compared against OFW.
+ * `'fresh'` only after a COMPLETE drafts walk; `'unverified'` whenever a walk
+ * was deferred for budget. Read by ofw_list_drafts / ofw_get_message to stamp
+ * each draft's `cacheStatus`, and by the destructive draft tools to decide how
+ * loudly to warn. Absent (never synced) reads as unverified.
+ */
+export const DRAFTS_CACHE_STATUS_KEY = 'drafts_cache_status';
+export async function getDraftsCacheStatus(store) {
+    return (await store.getMeta(DRAFTS_CACHE_STATUS_KEY)) === 'fresh' ? 'fresh' : 'unverified';
+}
 export async function syncDrafts(client, draftsFolderId, store, budget) {
     // No budget → unbounded (local stdio): identical to the original walk.
     const b = budget ?? makeBudget(Number.POSITIVE_INFINITY);
+    // Deferring means we never compared the drafts cache to OFW on this call.
+    // Mark it unverified so reads can say so and the destructive draft tools
+    // know the cache is not a trustworthy base — the count we return here is
+    // "nothing applied", NOT "nothing changed on the server".
+    const defer = async () => {
+        await store.setMeta(DRAFTS_CACHE_STATUS_KEY, 'unverified');
+        return { synced: 0, done: false };
+    };
     // The reconciliation step below DELETES any cached draft not seen in the
     // listing, so a partial walk must apply NOTHING. We therefore buffer the
     // entire walk (all list pages + every detail) BEFORE touching the cache: if
@@ -337,7 +356,7 @@ export async function syncDrafts(client, draftsFolderId, store, budget) {
     let page = 1;
     while (true) {
         if (!b.take())
-            return { synced: 0, done: false };
+            return defer();
         const path = `/pub/v3/messages?folders=${encodeURIComponent(draftsFolderId)}&page=${page}&size=50&sort=date&sortDirection=desc`;
         const list = parseLenient(DraftListResponseSchema, await client.request('GET', path), { label: 'ofw-mcp', context: 'GET /pub/v3/messages?folders={drafts}' });
         const pageItems = list.data ?? [];
@@ -352,7 +371,7 @@ export async function syncDrafts(client, draftsFolderId, store, budget) {
     const rows = [];
     for (const item of items) {
         if (!b.take())
-            return { synced: 0, done: false };
+            return defer();
         const detail = parseLenient(DraftDetailSchema, await client.request('GET', `/pub/v3/messages/${item.id}`), { label: 'ofw-mcp', context: 'GET /pub/v3/messages/{id} (drafts sync)' });
         rows.push({
             id: item.id,
@@ -390,10 +409,25 @@ export async function syncDrafts(client, draftsFolderId, store, budget) {
         if (!seenIds.has(id))
             await store.deleteDraft(id);
     }
+    // The complete walk fetched every draft's DETAIL and reconciled deletions, so
+    // the cache is now known-equal to the server. Only here is `synced: 0`
+    // truthful as "verified no changes".
+    await store.setMeta(DRAFTS_CACHE_STATUS_KEY, 'fresh');
     return { synced, done: true };
 }
 export async function syncAll(client, opts, store) {
-    const folders = opts.folders ?? ['inbox', 'sent', 'drafts'];
+    const requested = opts.folders ?? ['inbox', 'sent', 'drafts'];
+    // Drafts go FIRST. They are the only folder a destructive tool
+    // (ofw_save_draft / ofw_delete_draft) reads as its base, and they are cheap
+    // and bounded — one list page plus one detail per draft. Running them last,
+    // behind inbox and sent, meant a bounded call (the Worker's
+    // OFW_SYNC_MAX_REQUESTS=40) spent its whole budget backfilling history and
+    // deferred drafts on every single call, so server-side draft edits stayed
+    // invisible indefinitely while the response reported `drafts: 0`.
+    const folders = [
+        ...requested.filter((f) => f === 'drafts'),
+        ...requested.filter((f) => f !== 'drafts'),
+    ];
     // ONE budget shared across resolveFolderIds and every requested folder, in
     // order — so the whole invocation stays under the hosting subrequest cap.
     const budget = makeBudget(opts.maxRequests ?? Number.POSITIVE_INFINITY);
@@ -405,6 +439,7 @@ export async function syncAll(client, opts, store) {
     const synced = {};
     let unreadInbox = [];
     let done = true;
+    let draftsUnverified = false;
     for (const folder of folders) {
         if (folder === 'inbox') {
             const r = await syncMessageFolder(client, 'inbox', ids.inbox, {
@@ -429,12 +464,22 @@ export async function syncAll(client, opts, store) {
         }
         else if (folder === 'drafts') {
             const r = await syncDrafts(client, ids.drafts, store, budget);
-            synced.drafts = r.synced;
-            if (!r.done)
+            // Only report a drafts count when the walk actually compared against
+            // OFW. A deferred walk applied nothing, and reporting its `0` as
+            // `drafts: 0` reads as "verified, no changes" — the exact lie that let a
+            // server-side draft edit be overwritten. Omit the number instead.
+            if (r.done)
+                synced.drafts = r.synced;
+            else {
+                draftsUnverified = true;
                 done = false;
+            }
         }
     }
     const notes = [];
+    if (draftsUnverified) {
+        notes.push('The drafts folder was NOT checked against OurFamilyWizard on this call (the request budget ran out first), so no drafts count is reported and the cached drafts are marked "unverified". Cached draft bodies may be behind the server. Call ofw_sync_messages again — or ofw_sync_messages with folders:["drafts"] — before editing or deleting a draft.');
+    }
     if (unreadInbox.length > 0) {
         notes.push(`${unreadInbox.length} unread inbox messages cached without bodies. Call ofw_get_message(id) to read them — this will mark them as read on OFW.`);
     }

package/dist/tools/_shared.js

@@ -6,6 +6,13 @@ import { parseLenient } from '@chrischall/mcp-utils';
 export const jsonResponse = textResult;
 // Raw-string tool result. Wrapper over @chrischall/mcp-utils' `rawTextResult`.
 export const textResponse = rawTextResult;
+// A STRUCTURED failure: the machine-readable payload of `jsonResponse` plus
+// `isError`, so a refusal can carry recovery data (e.g. the server draft body
+// we declined to overwrite) without being mistaken for a successful write.
+// mcp-utils' `errorResult` only carries a string.
+export function jsonErrorResponse(data) {
+    return { ...textResult(data), isError: true };
+}
 // OFW API shape for `recipients[]` on message/draft list and detail
 // responses. Used wherever we validate the response of a `/pub/v3/messages*`
 // call. Loose: unknown keys pass through (and survive into cached listData).
@@ -74,23 +81,35 @@ function scrapeSaysRead(listData) {
  * resync (which re-scrapes the list flags) can never flip a read message back
  * to unread:
  *
- *  - INBOX: the account holder is the recipient. When we know our own id
- *    (`selfUserId`), that recipient's `viewedAt` is authoritative; otherwise any
- *    recipient's `viewedAt` stands in (1:1 co-parent messaging). Fetching the
- *    body marks the message read on OFW, so a non-null `fetchedBodyAt` is also
- *    read=true. The stale scrape flag is only a last-resort fallback.
+ *  - INBOX: the account holder is the recipient, so ANY recipient's `viewedAt`
+ *    counts. OFW co-parent threads are 1:1 — the sole inbox recipient is us —
+ *    so this is exact, not an approximation. Fetching the body marks the message
+ *    read on OFW, so a non-null `fetchedBodyAt` is also read=true. The stale
+ *    scrape flag is only a last-resort fallback.
  *  - SENT: "read" means a *recipient* has opened it — tracked via their
  *    `viewedAt` (the detail endpoint's real timestamp) — never our own body
  *    fetch, which is always set for sent messages.
+ *
+ * This deliberately does NOT discriminate by the account holder's own userId.
+ * An earlier `selfUserId` parameter did, but nothing ever passed it, so the
+ * branch was dead in production. Reviving it is not as simple as threading the
+ * argument through, for two reasons:
+ *   1. No non-mutating endpoint exposes our numeric id. /pub/v2/profiles returns
+ *      name/address/contact and no id at all; /pub/v1/users/useraccountstatus
+ *      updates last-seen status as a side effect, and view timestamps are
+ *      evidentiary in custody matters — not something to touch for a read flag.
+ *   2. Rows cached before the `user.userId` parse fix (see ApiRecipientSchema)
+ *      normalized every recipient to `userId: 0`, so an id match would silently
+ *      fail on historical data until a full re-sync.
+ * If OFW ever adds third-party recipients (lawyer, parenting coordinator), both
+ * problems need solving together — a bare parameter would regress to dead code.
  */
-export function deriveRead(row, selfUserId) {
+export function deriveRead(row) {
+    const viewedByAnyone = row.recipients.some((r) => r.viewedAt !== null);
     if (row.folder === 'inbox') {
-        const viewed = selfUserId !== undefined
-            ? row.recipients.some((r) => r.userId === selfUserId && r.viewedAt !== null)
-            : row.recipients.some((r) => r.viewedAt !== null);
-        return viewed || row.fetchedBodyAt !== null || scrapeSaysRead(row.listData);
+        return viewedByAnyone || row.fetchedBodyAt !== null || scrapeSaysRead(row.listData);
     }
-    return row.recipients.some((r) => r.viewedAt !== null) || scrapeSaysRead(row.listData);
+    return viewedByAnyone || scrapeSaysRead(row.listData);
 }
 /**
  * Return the row augmented with an authoritative top-level `read` boolean and a
@@ -99,8 +118,8 @@ export function deriveRead(row, selfUserId) {
  * carrying `listData.read: false` alongside a populated recipient `viewedAt`).
  * A non-object `listData` (null / legacy string) is passed through untouched.
  */
-export function withReadState(row, selfUserId) {
-    const read = deriveRead(row, selfUserId);
+export function withReadState(row) {
+    const read = deriveRead(row);
     const listData = (typeof row.listData === 'object' && row.listData !== null)
         ? { ...row.listData, read, showNeverViewed: !read }
         : row.listData;

package/dist/tools/draft-freshness.js

@@ -0,0 +1,166 @@
+import { z } from 'zod';
+import { parseLenient } from '@chrischall/mcp-utils';
+import { ApiRecipientSchema, mapRecipients } from './_shared.js';
+/** Thrown when the freshness check itself could not be completed. */
+export class DraftFreshnessError extends Error {
+}
+// FNV-1a (64-bit) over a canonical encoding. Not cryptographic — this is a
+// change detector, and it is never the sole guard: an unsupplied token falls
+// back to a full field-by-field comparison against the cached base.
+// BigInt keeps it byte-identical on node and on the Workers runtime.
+const FNV_OFFSET = 0xcbf29ce484222325n;
+const FNV_PRIME = 0x100000001b3n;
+const MASK64 = 0xffffffffffffffffn;
+function fnv1a64(s) {
+    let h = FNV_OFFSET;
+    for (let i = 0; i < s.length; i++) {
+        h = (h ^ BigInt(s.charCodeAt(i))) * FNV_PRIME & MASK64;
+    }
+    return h.toString(16).padStart(16, '0');
+}
+/**
+ * A stable content revision for a draft. Callers get this back from
+ * `ofw_list_drafts` / `ofw_get_message` and pass it to `ofw_save_draft` /
+ * `ofw_delete_draft` as `expectedRevision`.
+ *
+ * Recipients reduce to a SORTED set of user ids: their display names and
+ * `viewedAt` are presentation detail that differs between a list-sourced and a
+ * detail-sourced copy of the same draft, and would otherwise produce a false
+ * STALE. Fields are length-prefixed so content cannot shift across a field
+ * boundary without changing the hash.
+ */
+export function draftRevision(d) {
+    const ids = [...new Set(d.recipients.map((r) => r.userId))].sort((a, b) => a - b);
+    const parts = [d.subject, d.body, String(d.replyToId ?? ''), ids.join(',')];
+    return `r1:${fnv1a64(parts.map((p) => `${p.length}:${p}`).join('|'))}`;
+}
+const ServerDraftSchema = z.looseObject({
+    subject: z.string().optional(),
+    body: z.string().optional(),
+    replyToId: z.number().nullable().optional(),
+    recipients: z.array(ApiRecipientSchema).optional(),
+});
+function isNotFound(e) {
+    return e instanceof Error && /OFW API error: 404\b/.test(e.message);
+}
+/**
+ * Read a draft's AUTHORITATIVE state straight from OFW, bypassing the cache.
+ *
+ * Returns `null` when the draft no longer exists (404). Any other failure
+ * throws `DraftFreshnessError`: a freshness check that could not run must
+ * abort the write, never wave it through — see the callers in messages.ts.
+ */
+export async function fetchServerDraft(client, id) {
+    let raw;
+    try {
+        raw = await client.request('GET', `/pub/v3/messages/${id}`);
+    }
+    catch (e) {
+        if (isNotFound(e))
+            return null;
+        throw new DraftFreshnessError(`could not read the current state of draft ${id} from OurFamilyWizard: ${e.message}`);
+    }
+    // An empty/null body is OFW's other way of saying "no such message". Treat
+    // it as MISSING — which still ABORTS the write — rather than letting the
+    // strict parse throw an opaque shape error.
+    if (raw === null || raw === undefined)
+        return null;
+    const detail = parseLenient(ServerDraftSchema, raw, {
+        label: 'ofw-mcp',
+        context: 'GET /pub/v3/messages/{id} (draft freshness check)',
+        mode: 'strict',
+    });
+    return {
+        subject: detail.subject ?? '',
+        body: detail.body ?? '',
+        replyToId: detail.replyToId ?? null,
+        recipients: mapRecipients(detail.recipients),
+    };
+}
+function diffFields(a, b) {
+    const changed = [];
+    if (a.subject !== b.subject)
+        changed.push('subject');
+    if (a.body !== b.body)
+        changed.push('body');
+    if (a.replyToId !== b.replyToId)
+        changed.push('replyToId');
+    const ids = (d) => [...new Set(d.recipients.map((r) => r.userId))].sort((x, y) => x - y).join(',');
+    if (ids(a) !== ids(b))
+        changed.push('recipients');
+    return changed;
+}
+/**
+ * Decide whether it is safe to destroy the server's copy of a draft.
+ *
+ * Two independent ways to earn FRESH, in priority order:
+ *
+ *  1. `expectedRevision` matches the live server revision. The caller has named
+ *     the exact server state it edited from, which is what optimistic
+ *     concurrency asserts. A stale cached copy alongside a matching token is
+ *     not evidence of a conflict, so the token wins.
+ *  2. No token supplied → the cached base must match the server EXACTLY. This
+ *     is the safe default: "no token" never means "force".
+ *
+ * Everything else — server ahead of cache, no cached base to compare, draft
+ * gone from the server — refuses.
+ */
+export function checkDraftFreshness(input) {
+    const { server, cached, expectedRevision } = input;
+    if (server === null) {
+        return {
+            verdict: 'MISSING',
+            reason: 'The draft no longer exists on OurFamilyWizard — it may have been sent or deleted elsewhere.',
+            changedFields: [],
+        };
+    }
+    if (expectedRevision !== undefined) {
+        const actual = draftRevision(server);
+        if (expectedRevision === actual) {
+            return { verdict: 'FRESH', reason: 'expectedRevision matches the live server draft.', changedFields: [] };
+        }
+        return {
+            verdict: 'STALE',
+            reason: `expectedRevision ${expectedRevision} does not match the live server draft (${actual}) — it changed after you read it.`,
+            changedFields: cached === null ? [] : diffFields(server, cached),
+        };
+    }
+    if (cached === null) {
+        return {
+            verdict: 'STALE',
+            reason: 'This draft is not in the local cache, so there is no base to confirm the edit against.',
+            changedFields: [],
+        };
+    }
+    const changedFields = diffFields(server, cached);
+    if (changedFields.length === 0) {
+        return { verdict: 'FRESH', reason: 'The cached draft matches the live server draft.', changedFields: [] };
+    }
+    return {
+        verdict: 'STALE',
+        reason: `The draft on OurFamilyWizard differs from the cached copy (${changedFields.join(', ')}) — it was edited outside this tool.`,
+        changedFields,
+    };
+}
+/**
+ * Build the structured refusal returned when a destructive draft op is blocked.
+ * ALWAYS carries the current server body when there is one, so the content we
+ * declined to overwrite is recoverable from the tool result itself.
+ */
+export function staleDraftPayload(input) {
+    const { error, draftId, verdict, server, cached } = input;
+    return {
+        error,
+        draftId,
+        verdict: verdict.verdict,
+        reason: verdict.reason,
+        ...(verdict.changedFields.length > 0 ? { changedFields: verdict.changedFields } : {}),
+        ...(server !== null
+            ? { serverBody: server.body, serverSubject: server.subject, serverRevision: draftRevision(server) }
+            : {}),
+        ...(cached !== null ? { cachedBody: cached.body } : {}),
+        recovery: server === null
+            ? 'The draft is gone from OurFamilyWizard. Nothing was changed. If you still want this content saved, call ofw_save_draft WITHOUT messageId to create a new draft.'
+            : 'Nothing was changed. Merge your edit into serverBody above, then retry with expectedRevision set to serverRevision. Pass force:true only if you intend to discard the server copy shown here.',
+    };
+}

package/dist/tools/messages.js

@@ -1,8 +1,9 @@
 import { z } from 'zod';
-import { syncAll, fetchAttachmentMeta, fetchAttachmentMetaForMessage } from '../sync.js';
+import { syncAll, fetchAttachmentMeta, fetchAttachmentMetaForMessage, getDraftsCacheStatus } from '../sync.js';
+import { checkDraftFreshness, draftRevision, fetchServerDraft, staleDraftPayload, } from './draft-freshness.js';
 import { getAttachmentsDir, getDefaultInlineAttachments, getSyncMaxRequests, getWriteMode } from '../config.js';
 import { basename, join } from 'node:path';
-import { ApiRecipientSchema, expandPath, hasRealView, jsonResponse, mapRecipients, postMessageAndRefetch, textResponse, verifyWriteLanded, withReadState } from './_shared.js';
+import { ApiRecipientSchema, expandPath, hasRealView, jsonErrorResponse, jsonResponse, mapRecipients, postMessageAndRefetch, textResponse, verifyWriteLanded, withReadState } from './_shared.js';
 import { parseLenient } from '@chrischall/mcp-utils';
 // Schemas for the load-bearing fields of each /pub/v3 response this file
 // reads (issue #83). Loose: unknown keys pass through into cached listData.
@@ -159,6 +160,10 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                 chainRootId: null,
                 listData: draftRow.listData,
                 attachments: [],
+                // Concurrency token — pass as expectedRevision to ofw_save_draft /
+                // ofw_delete_draft to assert you are editing THIS version.
+                revision: draftRevision(draftRow),
+                cacheStatus: await getDraftsCacheStatus(cache),
             });
         }
         const cached = await cache.getMessage(id);
@@ -376,6 +381,64 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             const notes = [rewriteNote, verifyNote, unconfirmedNote].filter((n) => n !== null).join('\n\n');
             return textResponse(notes ? `${notes}\n\n${text}` : text);
         });
+    async function guardDestructiveDraftOp(input) {
+        const { cache, draftId, expectedRevision, force, action } = input;
+        const cachedRow = await cache.getDraft(draftId);
+        const cached = cachedRow === null ? null : {
+            subject: cachedRow.subject,
+            body: cachedRow.body,
+            recipients: cachedRow.recipients,
+            replyToId: cachedRow.replyToId,
+        };
+        let server;
+        try {
+            server = await fetchServerDraft(client, draftId);
+        }
+        catch (e) {
+            // fetchServerDraft funnels every non-404 failure into DraftFreshnessError,
+            // so anything landing here means the check could not RUN. That is not
+            // permission to proceed: a transient 5xx must not degrade into a blind
+            // overwrite.
+            const reason = e.message;
+            if (force) {
+                return { ok: true, note: `WARNING: force:true — proceeded with ${action} on draft ${draftId} even though its current state could not be read from OurFamilyWizard (${reason}). Any newer server-side version was destroyed and is NOT recoverable from this response.` };
+            }
+            return {
+                ok: false,
+                response: jsonErrorResponse({
+                    error: 'FRESHNESS_CHECK_FAILED',
+                    draftId,
+                    reason,
+                    recovery: 'Nothing was changed. This is usually transient — retry. If it persists, verify the draft on ourfamilywizard.com. Pass force:true only if you accept overwriting a version you have not seen.',
+                }),
+            };
+        }
+        const verdict = checkDraftFreshness({ server, cached, expectedRevision });
+        if (verdict.verdict === 'FRESH')
+            return { ok: true, note: null };
+        if (force) {
+            // Loud, and the overwritten content rides along in the response so it is
+            // recoverable from the tool result itself.
+            console.error(`[ofw-mcp] WARNING: force:true overrode a ${verdict.verdict} verdict on draft ${draftId} (${action}). ${verdict.reason}`);
+            const echoed = server === null
+                ? 'The draft no longer existed on OurFamilyWizard.'
+                : `The server version that was overwritten is preserved below under "overwrittenServerDraft".`;
+            return {
+                ok: true,
+                note: `WARNING: force:true overrode a ${verdict.verdict} freshness verdict on draft ${draftId}. ${verdict.reason} ${echoed}\n\n${JSON.stringify({ overwrittenServerDraft: server === null ? null : { ...server, revision: draftRevision(server) } }, null, 2)}`,
+            };
+        }
+        return {
+            ok: false,
+            response: jsonErrorResponse(staleDraftPayload({
+                error: verdict.verdict === 'MISSING' ? 'MISSING_DRAFT' : 'STALE_DRAFT',
+                draftId,
+                verdict,
+                server,
+                cached,
+            })),
+        };
+    }
     server.registerTool('ofw_list_drafts', {
         description: 'List draft messages from the local OurFamilyWizard cache. Call ofw_sync_messages first if the cache is empty.',
         annotations: { readOnlyHint: true },
@@ -386,15 +449,24 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
     }, async (args) => {
         const page = args.page ?? 1;
         const size = args.size ?? 50;
-        const drafts = await cacheProvider().listDrafts({ page, size });
-        const payload = drafts.length === 0
-            ? { drafts: [], note: 'Cache empty. Call ofw_sync_messages to populate.' }
-            : { drafts };
+        const cache = cacheProvider();
+        const cacheStatus = await getDraftsCacheStatus(cache);
+        const rows = await cache.listDrafts({ page, size });
+        // Every draft carries the concurrency token to echo back on a write, plus
+        // whether the last sync actually compared this cache against OFW.
+        const drafts = rows.map((d) => ({ ...d, revision: draftRevision(d), cacheStatus }));
+        if (drafts.length === 0) {
+            return jsonResponse({ drafts: [], note: 'Cache empty. Call ofw_sync_messages to populate.' });
+        }
+        const payload = { drafts };
+        if (cacheStatus !== 'fresh') {
+            payload.note = 'cacheStatus "unverified": the last ofw_sync_messages did not finish checking the drafts folder against OurFamilyWizard, so these bodies may be behind the server (drafts edited in the OFW web app do not bump any timestamp). Run ofw_sync_messages again before relying on them. Writes are guarded regardless — ofw_save_draft and ofw_delete_draft re-check the server and refuse a stale overwrite.';
+        }
         return jsonResponse(payload);
     });
     if (allowDrafts)
         server.registerTool('ofw_save_draft', {
-            description: 'Save a message as a draft in OurFamilyWizard. Recipients are optional. Pass messageId to replace an existing draft — note that under the hood this creates a NEW draft and deletes the old one (OFW\'s update-in-place endpoint silently no-ops while echoing the posted body, so we don\'t use it); the response.id will be the NEW id, not the messageId you passed, and the change is documented in a transparency NOTE in the response. If replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included in response). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After saving, the tool re-fetches the draft from OFW to populate the local cache from authoritative server state.',
+            description: 'Save a message as a draft in OurFamilyWizard. Recipients are optional. Pass messageId to replace an existing draft — note that under the hood this creates a NEW draft and deletes the old one (OFW\'s update-in-place endpoint silently no-ops while echoing the posted body, so we don\'t use it); the response.id will be the NEW id, not the messageId you passed, and the change is documented in a transparency NOTE in the response. If replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included in response). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After saving, the tool re-fetches the draft from OFW to populate the local cache from authoritative server state. SAFETY: because replacing DESTROYS the old draft rather than merging, passing messageId first re-reads that draft from OFW and REFUSES the write if it changed since you read it (drafts edited in the OFW web app do not bump any timestamp, so the local cache can be silently behind). The refusal returns the current server body under serverBody — merge your edit into it and retry with expectedRevision.',
             annotations: { readOnlyHint: false },
             inputSchema: {
                 subject: z.string().describe('Message subject'),
@@ -403,9 +475,26 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                 messageId: z.number().describe('ID of an existing draft to replace (the new draft will have a new id; the old is deleted)').optional(),
                 replyToId: z.number().describe('ID of the message this draft replies to').optional(),
                 myFileIDs: z.array(z.number()).describe('Attachment file ids (from ofw_upload_attachment)').optional(),
+                expectedRevision: z.string().describe('With messageId: the `revision` you got from ofw_list_drafts/ofw_get_message for that draft. Asserts you are replacing THAT version. If the draft changed on OFW since, the write is refused and the current server body is returned. Omit and the tool compares the server against the local cache instead — omitting never means "overwrite anyway".').optional(),
+                force: z.boolean().describe('Default false. Overwrite even when the draft changed on OurFamilyWizard since you read it. The discarded server version is echoed back in the response. Only use after showing the user the conflict.').optional(),
             },
         }, async (args) => {
             const cache = cacheProvider();
+            // Guard BEFORE the POST: refusing after creating a replacement would leave
+            // a stray draft behind for a write we then decline to finish.
+            let forceNote = null;
+            if (args.messageId !== undefined) {
+                const guard = await guardDestructiveDraftOp({
+                    cache,
+                    draftId: args.messageId,
+                    expectedRevision: args.expectedRevision,
+                    force: args.force ?? false,
+                    action: 'replace',
+                });
+                if (!guard.ok)
+                    return guard.response;
+                forceNote = guard.note;
+            }
             const requestedReplyTo = args.replyToId ?? null;
             let resolvedReplyTo = requestedReplyTo;
             let rewriteNote = null;
@@ -435,6 +524,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             let persisted = null;
             let replaceNote = null;
             let verifyNote = null;
+            let newRevision = null;
             if (newId !== null) {
                 verifyNote = verifyWriteLanded('draft', { subject: args.subject, body: args.body }, detail);
                 persisted = {
@@ -447,6 +537,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                     listData: detail,
                 };
                 await cache.upsertDraft(persisted);
+                newRevision = draftRevision(persisted);
                 // Replace-path: caller passed messageId, so they want the old draft
                 // gone. Delete it after the new one is safely created+cached.
                 if (args.messageId !== undefined && args.messageId !== newId) {
@@ -456,26 +547,44 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                         replaceNote = `NOTE: ofw_save_draft replaced draft ${args.messageId} via create-then-delete. The new draft id is ${newId}; the old draft has been deleted. (OFW's update-in-place endpoint silently no-ops on subsequent updates, so we never use it. If you cached the old id anywhere, replace it with the new one.)`;
                     }
                     catch (e) {
-                        replaceNote = `WARNING: New draft ${newId} created successfully, but failed to delete the old draft (${args.messageId}): ${e.message}. You may want to clean it up manually with ofw_delete_draft.`;
+                        // Partial-failure safety: the new draft is already created and
+                        // cached, so BOTH drafts now exist. That is the correct end state —
+                        // deleting first and failing to create would have lost the content.
+                        replaceNote = `WARNING: New draft ${newId} was created successfully, but the old draft ${args.messageId} could NOT be deleted: ${e.message}. BOTH drafts now exist on OurFamilyWizard and nothing was lost. Verify ${newId} reads correctly, then remove ${args.messageId} with ofw_delete_draft.`;
                     }
                 }
             }
-            const responseObj = persisted ?? raw;
+            const responseObj = persisted !== null
+                ? { ...persisted, revision: newRevision, cacheStatus: 'fresh' }
+                : raw;
             const text = responseObj ? JSON.stringify(responseObj, null, 2) : 'Draft saved.';
-            const notes = [rewriteNote, verifyNote, replaceNote].filter((n) => n !== null).join('\n\n');
+            const notes = [forceNote, rewriteNote, verifyNote, replaceNote].filter((n) => n !== null).join('\n\n');
             return textResponse(notes ? `${notes}\n\n${text}` : text);
         });
     if (allowDrafts)
         server.registerTool('ofw_delete_draft', {
-            description: 'Delete a draft message from OurFamilyWizard. Also removes the draft from the local cache.',
+            description: 'Delete a draft message from OurFamilyWizard. Also removes the draft from the local cache. Before deleting, the draft is re-read from OFW and the delete is REFUSED if it changed since you last read it (the current server body is returned so nothing is lost) — pass expectedRevision to assert which version you mean, or force:true to delete regardless.',
             annotations: { destructiveHint: true },
             inputSchema: {
                 messageId: z.number().describe('Draft message ID to delete'),
+                expectedRevision: z.string().describe('The `revision` you got from ofw_list_drafts/ofw_get_message. Asserts you are deleting THAT version; if the draft changed on OFW since, the delete is refused and the current server body returned.').optional(),
+                force: z.boolean().describe('Default false. Delete even if the draft changed on OurFamilyWizard since you read it. The discarded server version is echoed back in the response.').optional(),
             },
         }, async (args) => {
+            const cache = cacheProvider();
+            const guard = await guardDestructiveDraftOp({
+                cache,
+                draftId: args.messageId,
+                expectedRevision: args.expectedRevision,
+                force: args.force ?? false,
+                action: 'delete',
+            });
+            if (!guard.ok)
+                return guard.response;
             const data = await deleteOFWMessages(client, [args.messageId]);
-            await cacheProvider().deleteDraft(args.messageId);
-            return data ? jsonResponse(data) : textResponse('Draft deleted.');
+            await cache.deleteDraft(args.messageId);
+            const text = data ? JSON.stringify(data, null, 2) : 'Draft deleted.';
+            return textResponse(guard.note ? `${guard.note}\n\n${text}` : text);
         });
     server.registerTool('ofw_get_unread_sent', {
         description: 'List sent messages that have not been read by one or more recipients. Reads from local cache; call ofw_sync_messages first if cache is stale.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.6.6",
+  "version": "2.6.7",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.6.6",
+  "version": "2.6.7",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.6.6",
+      "version": "2.6.7",
       "transport": {
         "type": "stdio"
       },