ofw-mcp 2.6.7 → 2.7.0

package/dist/tools/messages.js

@@ -1,6 +1,9 @@
 import { z } from 'zod';
 import { syncAll, fetchAttachmentMeta, fetchAttachmentMetaForMessage, getDraftsCacheStatus } from '../sync.js';
+import { buildFreshness } from './freshness.js';
 import { checkDraftFreshness, draftRevision, fetchServerDraft, staleDraftPayload, } from './draft-freshness.js';
+import { getFolderVerifiedAt } from '../sync.js';
+import { isHostRenderableImage, resolveDownloadMime } from './attachments.js';
 import { getAttachmentsDir, getDefaultInlineAttachments, getSyncMaxRequests, getWriteMode } from '../config.js';
 import { basename, join } from 'node:path';
 import { ApiRecipientSchema, expandPath, hasRealView, jsonErrorResponse, jsonResponse, mapRecipients, postMessageAndRefetch, textResponse, verifyWriteLanded, withReadState } from './_shared.js';
@@ -43,6 +46,33 @@ const MessageDetailSchema = z.looseObject({
 });
 // Attachment-backfill detail fetch reads only `files`.
 const DetailFilesSchema = z.looseObject({ files: z.array(z.number()).optional() });
+// ofw_check_freshness' folder probe. `includeFolderCounts=true` returns a
+// per-folder count, but the field name varies across OFW payload versions —
+// accept the known spellings and degrade to a null serverCount rather than
+// guessing, since a wrong count would manufacture a false out-of-sync verdict.
+const FolderCountsSchema = z.looseObject({
+    systemFolders: z.array(z.looseObject({
+        id: z.string(),
+        folderType: z.string(),
+        totalCount: z.number().optional(),
+        messageCount: z.number().optional(),
+        count: z.number().optional(),
+    })).optional(),
+});
+const FOLDER_TYPE = {
+    inbox: 'INBOX',
+    sent: 'SENT_MESSAGES',
+    drafts: 'DRAFTS',
+};
+/**
+ * Cap on per-id probes in one ofw_check_freshness call.
+ *
+ * Each id costs one OFW request, and on the hosted Worker every request counts
+ * against the subrequest cap (see OFW_SYNC_MAX_REQUESTS). The check has to stay
+ * cheap enough that a caller reaches for it freely — that is the entire point
+ * of it existing — so it truncates loudly rather than turning into a sync.
+ */
+const MAX_FRESHNESS_IDS = 25;
 // Upload response — STRICT: fileId is the whole point of the call; caching
 // or returning an undefined/mistyped fileId produces an unusable attachment.
 const UploadedFileSchema = z.looseObject({
@@ -67,6 +97,32 @@ function listDataHintsAtFiles(listData) {
         return ld.files.length > 0;
     return false;
 }
+/**
+ * Freshness for a drafts read, plus the per-draft `serverConfirmed` flag.
+ *
+ * `serverConfirmed` answers the question that triggered this whole mechanism:
+ * "is this draft actually still sitting unsent on OFW?" It is true ONLY when a
+ * completed drafts walk verified the cache against OFW within the freshness
+ * window (getFreshnessTtlSeconds, default 300s) — NOT a claim about this exact
+ * instant, which no cache can make. Anything less — a deferred walk, an aged
+ * stamp, a cache that was never checked — is false, meaning the draft's
+ * existence and unsent status are remembered, not known. On a false, a caller
+ * must not state either as present-tense fact without calling
+ * ofw_check_freshness first.
+ */
+async function draftsFreshness(cache) {
+    const freshness = await buildFreshness(cache, { source: 'cache', folders: ['drafts'] });
+    // Reconcile the two signals so a single response can never contradict
+    // itself (the same rule withReadState applies to read flags). The drafts
+    // meta key says whether the last walk COMPLETED; freshness additionally
+    // knows whether that walk has since aged out or been overtaken by a sync
+    // that skipped drafts. Downgrade only — this can turn 'fresh' off, never on.
+    const completed = await getDraftsCacheStatus(cache);
+    const cacheStatus = completed === 'fresh' && freshness.staleness === 'fresh'
+        ? 'fresh'
+        : 'unverified';
+    return { freshness, serverConfirmed: cacheStatus === 'fresh', cacheStatus };
+}
 export function registerMessageTools(server, client, cacheProvider, attachmentIO) {
     // OFW_WRITE_MODE gate (see config.ts). Send lands on the court-visible
     // record, so it is 'all'-only; draft-level writes (save/delete drafts,
@@ -76,11 +132,12 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
     const allowSend = writeMode === 'all';
     const allowDrafts = writeMode !== 'none';
     server.registerTool('ofw_list_message_folders', {
-        description: 'List OurFamilyWizard message folders (inbox, sent, etc.) and their unread counts. Returns folder IDs needed to call ofw_list_messages. Does NOT return message content.',
+        description: 'List OurFamilyWizard message folders (inbox, sent, etc.) and their unread counts. Fetched LIVE from OFW, so the counts are current. Returns folder IDs needed to call ofw_list_messages. Does NOT return message content.',
         annotations: { readOnlyHint: true },
     }, async () => {
         const data = await client.request('GET', '/pub/v1/messageFolders?includeFolderCounts=true');
-        return jsonResponse(data);
+        const freshness = await buildFreshness(cacheProvider(), { source: 'live', folders: [] });
+        return jsonResponse({ folders: data, freshness });
     });
     server.registerTool('ofw_list_messages', {
         description: 'List messages from the local OurFamilyWizard cache. Supports filtering by folder, date range, and a substring query on subject+body. Pagination is offset-based but if you know what you want (a date range, a topic), prefer the filters over walking pages — the cache may have 1000+ messages. Call ofw_sync_messages first if the cache is empty or stale.',
@@ -105,9 +162,16 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
         else if (folderArg === 'both')
             folder = undefined;
         else {
+            // Still carries freshness: `messages: []` with no age label is exactly
+            // the shape this mechanism exists to eliminate, even when the emptiness
+            // is caused by a bad argument rather than an empty cache.
             return jsonResponse({
                 messages: [],
-                note: 'folderId must be "inbox", "sent", or "both". Numeric OFW folder IDs are not supported by the cache.',
+                freshness: await buildFreshness(cacheProvider(), {
+                    source: 'cache',
+                    folders: ['inbox', 'sent'],
+                }),
+                note: 'folderId must be "inbox", "sent", or "both". Numeric OFW folder IDs are not supported by the cache. No lookup was performed — this empty result says nothing about what is in the cache.',
             });
         }
         const cache = cacheProvider();
@@ -118,7 +182,14 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
         // from the record's own `viewedAt`/`fetchedBodyAt` and `listData` is forced
         // to agree — see withReadState.
         const messages = (await cache.listMessages({ ...filter, page, size })).map((m) => withReadState(m));
-        const payload = { messages, total, page, size };
+        // Served from the local cache, so the result must say how old it is and
+        // whether anything vouches for it — a caller cannot state current state
+        // from this payload without either re-reading or surfacing the caveat.
+        const freshness = await buildFreshness(cache, {
+            source: 'cache',
+            folders: folder === undefined ? ['inbox', 'sent'] : [folder],
+        });
+        const payload = { messages, total, page, size, freshness };
         if (total === 0) {
             payload.note = 'No messages match these filters. If you expected results, check ofw_sync_messages was run, or relax the filters.';
         }
@@ -144,6 +215,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
         // up — see syncDrafts, which also evicts these stale rows.
         const draftRow = await cache.getDraft(id);
         if (draftRow !== null) {
+            const { freshness, serverConfirmed, cacheStatus } = await draftsFreshness(cache);
             return jsonResponse({
                 id: draftRow.id,
                 folder: 'drafts',
@@ -163,7 +235,12 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                 // Concurrency token — pass as expectedRevision to ofw_save_draft /
                 // ofw_delete_draft to assert you are editing THIS version.
                 revision: draftRevision(draftRow),
-                cacheStatus: await getDraftsCacheStatus(cache),
+                cacheStatus,
+                // False = this draft's existence and unsent status are remembered from
+                // a cache, not confirmed on OFW. Call ofw_check_freshness before
+                // stating either as current fact.
+                serverConfirmed,
+                freshness,
             });
         }
         const cached = await cache.getMessage(id);
@@ -214,7 +291,11 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                     // Backfill is best-effort. Fall through with whatever we have.
                 }
             }
-            return jsonResponse({ ...withReadState(row), attachments });
+            // Cache-served: the body is whatever the last sync stored. Even though
+            // this call may have re-hit detail for view status, the message content
+            // itself was not re-verified, so report the folder's cache freshness.
+            const freshness = await buildFreshness(cache, { source: 'cache', folders: [row.folder] });
+            return jsonResponse({ ...withReadState(row), attachments, freshness });
         }
         const detail = parseLenient(MessageDetailSchema, await client.request('GET', `/pub/v3/messages/${encodeURIComponent(args.messageId)}`), { label: 'ofw-mcp', context: 'GET /pub/v3/messages/{id} (ofw_get_message)' });
         // Derive the folder for a live-fetched message. A cached row (reached here
@@ -249,7 +330,9 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             await fetchAttachmentMetaForMessage(client, detail.id, detail.files, cache);
         }
         const attachments = await cache.listAttachmentsForMessage(detail.id);
-        return jsonResponse({ ...withReadState(row), attachments });
+        // Fetched live from OFW in this call — current by construction.
+        const freshness = await buildFreshness(cache, { source: 'live', folders: [folder] });
+        return jsonResponse({ ...withReadState(row), attachments, freshness });
     });
     if (allowSend)
         server.registerTool('ofw_send_message', {
@@ -450,17 +533,28 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
         const page = args.page ?? 1;
         const size = args.size ?? 50;
         const cache = cacheProvider();
-        const cacheStatus = await getDraftsCacheStatus(cache);
+        const { freshness, serverConfirmed, cacheStatus } = await draftsFreshness(cache);
         const rows = await cache.listDrafts({ page, size });
         // Every draft carries the concurrency token to echo back on a write, plus
-        // whether the last sync actually compared this cache against OFW.
-        const drafts = rows.map((d) => ({ ...d, revision: draftRevision(d), cacheStatus }));
+        // whether the last sync actually compared this cache against OFW and
+        // whether its presence-on-server is confirmed or merely remembered.
+        const drafts = rows.map((d) => ({
+            ...d,
+            revision: draftRevision(d),
+            cacheStatus,
+            serverConfirmed,
+            asOf: freshness.asOf,
+        }));
         if (drafts.length === 0) {
-            return jsonResponse({ drafts: [], note: 'Cache empty. Call ofw_sync_messages to populate.' });
+            return jsonResponse({
+                drafts: [],
+                freshness,
+                note: 'No drafts in the local cache. That is NOT proof there are no drafts on OurFamilyWizard — call ofw_sync_messages to populate, or ofw_check_freshness to confirm.',
+            });
         }
-        const payload = { drafts };
-        if (cacheStatus !== 'fresh') {
-            payload.note = 'cacheStatus "unverified": the last ofw_sync_messages did not finish checking the drafts folder against OurFamilyWizard, so these bodies may be behind the server (drafts edited in the OFW web app do not bump any timestamp). Run ofw_sync_messages again before relying on them. Writes are guarded regardless — ofw_save_draft and ofw_delete_draft re-check the server and refuse a stale overwrite.';
+        const payload = { drafts, freshness };
+        if (!serverConfirmed) {
+            payload.note = 'serverConfirmed:false — these drafts are remembered from the local cache, NOT confirmed to still exist unsent on OurFamilyWizard right now, and their bodies may be behind the server. Do not state that a draft "is still sitting unsent" on this basis; drafts edited or deleted in the OFW web app bump no timestamp, so the cache cannot detect it on its own. Call ofw_check_freshness (cheap, live) or ofw_sync_messages first. Writes are guarded regardless — ofw_save_draft and ofw_delete_draft re-check the server and refuse a stale overwrite.';
         }
         return jsonResponse(payload);
     });
@@ -554,8 +648,11 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
                     }
                 }
             }
+            // The draft was just re-fetched from OFW by postMessageAndRefetch, so this
+            // one row IS server-confirmed regardless of the drafts folder's overall
+            // cache freshness.
             const responseObj = persisted !== null
-                ? { ...persisted, revision: newRevision, cacheStatus: 'fresh' }
+                ? { ...persisted, revision: newRevision, cacheStatus: 'fresh', serverConfirmed: true }
                 : raw;
             const text = responseObj ? JSON.stringify(responseObj, null, 2) : 'Draft saved.';
             const notes = [forceNote, rewriteNote, verifyNote, replaceNote].filter((n) => n !== null).join('\n\n');
@@ -596,9 +693,18 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
     }, async (args) => {
         const page = args.page ?? 1;
         const size = args.size ?? 50;
-        const sent = await cacheProvider().listMessages({ folder: 'sent', page, size });
+        const cache = cacheProvider();
+        const sent = await cache.listMessages({ folder: 'sent', page, size });
+        // "Nobody has read it yet" is a present-tense claim drawn entirely from
+        // cached view timestamps, which only move when a sync refreshes them —
+        // so it needs the same age label as any other cached read.
+        const freshness = await buildFreshness(cache, { source: 'cache', folders: ['sent'] });
         if (sent.length === 0) {
-            return jsonResponse({ note: 'Sent cache is empty. Call ofw_sync_messages to populate.' });
+            return jsonResponse({
+                unread: [],
+                freshness,
+                note: 'Sent cache is empty. Call ofw_sync_messages to populate. An empty cache is NOT evidence that no sent messages exist.',
+            });
         }
         const unread = [];
         for (const msg of sent) {
@@ -608,9 +714,13 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             }
         }
         if (unread.length === 0) {
-            return jsonResponse({ message: 'All scanned sent messages have been read.' });
+            return jsonResponse({
+                unread: [],
+                freshness,
+                message: 'All scanned sent messages had been read as of the timestamp in `freshness.asOf`. A recipient may have read a message since without the cache hearing about it.',
+            });
         }
-        return jsonResponse(unread);
+        return jsonResponse({ unread, freshness });
     });
     if (allowDrafts)
         server.registerTool('ofw_upload_attachment', {
@@ -657,18 +767,24 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             });
         });
     server.registerTool('ofw_download_attachment', {
-        description: 'Download an OFW message attachment by fileId. By default, bytes are saved to disk (~/Downloads/ofw-mcp/) and the response carries the absolute path, mime type, and size for the caller to read back. Pass inline:true to skip disk entirely and return the bytes as MCP content blocks — images come back as ImageContent (the model sees them directly); other files come back as an EmbeddedResource blob. Use inline for small files where you want the model to read content immediately and the host is sandboxed; use disk for large files or when you want a persistent local copy. The default for `inline` can be flipped server-side via the OFW_INLINE_ATTACHMENTS env var (set to "true" to make inline the default). fileId comes from attachments[].fileId on ofw_get_message. Override disk destination with OFW_ATTACHMENTS_DIR or saveTo. Re-downloading to the same path is a no-op (disk mode only).',
+        description: 'Download an OFW message attachment by fileId. By default, bytes are saved to disk (~/Downloads/ofw-mcp/) and the response carries the absolute path, mime type, and size for the caller to read back. Pass inline:true to skip disk entirely and return the bytes as MCP content blocks — host-renderable images (PNG/JPEG/GIF/WEBP) come back as ImageContent (the model sees them directly); every other file comes back as an EmbeddedResource blob carrying the bytes. Reported mime types are always normalized to a bare media type (no charset/name parameters). Use inline for small files where you want the model to read content immediately and the host is sandboxed; use disk for large files or when you want a persistent local copy. The default for `inline` can be flipped server-side via the OFW_INLINE_ATTACHMENTS env var (set to "true" to make inline the default). On a hosted deployment with no filesystem, disk mode is unavailable, so inline is forced (the response is marked forcedInline:true) rather than failing. fileId comes from attachments[].fileId on ofw_get_message. Override disk destination with OFW_ATTACHMENTS_DIR or saveTo. Re-downloading to the same path is a no-op (disk mode only).',
         annotations: { readOnlyHint: false },
         inputSchema: {
             fileId: z.number().describe('Attachment file id (from ofw_get_message → attachments[].fileId)'),
-            inline: z.boolean().describe('If true, return bytes inline as MCP content (image for image/*, embedded resource blob otherwise) and skip the disk write. If false, write to disk and return the path. If omitted, falls back to the OFW_INLINE_ATTACHMENTS env var (default: false = disk).').optional(),
-            saveTo: z.string().describe('Absolute path or directory to write to. If a directory, the OFW filename is used. Default: ~/Downloads/ofw-mcp/<fileId>-<filename>. Ignored when inline:true.').optional(),
+            inline: z.boolean().describe('If true, return bytes inline as MCP content (ImageContent for host-renderable images, embedded resource blob otherwise) and skip the disk write. If false, write to disk and return the path — except on a hosted deployment with no filesystem, where inline is forced (forcedInline:true) so the bytes are still returned. If omitted, falls back to the OFW_INLINE_ATTACHMENTS env var (default: false = disk).').optional(),
+            saveTo: z.string().describe('Absolute path or directory to write to. If a directory, the OFW filename is used. Default: ~/Downloads/ofw-mcp/<fileId>-<filename>. Ignored when inline is in effect.').optional(),
             force: z.boolean().describe('Re-download even if already on disk. Default false. Ignored when inline:true (inline always fetches fresh bytes, or reuses an on-disk copy if present).').optional(),
         },
     }, async (args) => {
         const fileId = args.fileId;
         const cache = cacheProvider();
-        const inline = args.inline ?? getDefaultInlineAttachments();
+        const requestedInline = args.inline ?? getDefaultInlineAttachments();
+        // When the deployment has no filesystem (hosted connector), inline is the
+        // ONLY path to the bytes — force it rather than erroring on a disk write.
+        // `forcedInline` records that we overrode an explicit `inline:false` so the
+        // response is honest about it instead of silently ignoring the argument.
+        const inline = requestedInline || !attachmentIO.supportsDisk;
+        const forcedInline = inline && !requestedInline;
         let cached = await cache.getAttachment(fileId);
         if (!cached) {
             // Not in cache. Fetch metadata and store under the messageId=0
@@ -682,7 +798,7 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
         if (inline) {
             // Reuse on-disk bytes if we already have them; otherwise fetch fresh.
             let bytes = null;
-            let mimeType = cached.mimeType;
+            let headerMime = cached.mimeType;
             let fileName = cached.fileName;
             if (cached.downloadedPath) {
                 bytes = attachmentIO.readDownloaded(cached.downloadedPath);
@@ -690,14 +806,25 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
             if (bytes === null) {
                 const response = await client.requestBinary('GET', `/pub/v1/myfiles/${fileId}/data`);
                 bytes = response.body;
-                mimeType = response.contentType ?? cached.mimeType;
+                headerMime = response.contentType ?? cached.mimeType;
                 fileName = response.suggestedFileName ?? cached.fileName;
             }
+            // Normalize to a bare media type: sniff the bytes first (OFW tacks a bogus
+            // charset onto binaries), then fall back to the stripped header, then the
+            // extension. A parameter suffix would make the host reject an image.
+            const mimeType = resolveDownloadMime(bytes, headerMime, fileName);
             const base64 = bytes.toString('base64');
-            const metaBlock = { type: 'text', text: JSON.stringify({
-                    fileId, fileName, mimeType, sizeBytes: bytes.length, mode: 'inline',
-                }, null, 2) };
-            if (mimeType.startsWith('image/')) {
+            const meta = {
+                fileId, fileName, mimeType, sizeBytes: bytes.length, mode: 'inline',
+            };
+            if (forcedInline)
+                meta.forcedInline = true;
+            const metaBlock = { type: 'text', text: JSON.stringify(meta, null, 2) };
+            // Only host-renderable image types go back as ImageContent (with the bare
+            // media type the renderer accepts); everything else — non-renderable
+            // images included — goes back as an EmbeddedResource so the caller always
+            // gets the bytes.
+            if (isHostRenderableImage(mimeType)) {
                 return { content: [metaBlock, { type: 'image', data: base64, mimeType }] };
             }
             return { content: [metaBlock, { type: 'resource', resource: {
@@ -723,38 +850,172 @@ export function registerMessageTools(server, client, cacheProvider, attachmentIO
         }
         if (!args.force && cached.downloadedPath === dest) {
             return jsonResponse({
-                fileId, path: dest, mimeType: cached.mimeType, sizeBytes: cached.sizeBytes,
-                fileName: cached.fileName, note: 'already downloaded',
+                // No bytes on hand for the no-op case: normalize the cached/extension
+                // MIME (empty buffer sniffs nothing) so a stored `image/png;charset=…`
+                // still reports bare.
+                fileId, path: dest, mimeType: resolveDownloadMime(Buffer.alloc(0), cached.mimeType, cached.fileName),
+                sizeBytes: cached.sizeBytes, fileName: cached.fileName, note: 'already downloaded',
             });
         }
         const response = await client.requestBinary('GET', `/pub/v1/myfiles/${fileId}/data`);
         attachmentIO.writeDownload(dest, response.body);
         await cache.markAttachmentDownloaded(fileId, dest);
+        const fileName = response.suggestedFileName ?? cached.fileName;
         return jsonResponse({
             fileId,
             path: dest,
-            mimeType: response.contentType ?? cached.mimeType,
+            mimeType: resolveDownloadMime(response.body, response.contentType ?? cached.mimeType, fileName),
             sizeBytes: response.body.length,
-            fileName: response.suggestedFileName ?? cached.fileName,
+            fileName,
         });
     });
     server.registerTool('ofw_sync_messages', {
         description: 'Sync messages from OurFamilyWizard into the local cache. Returns counts per folder and a list of unread inbox messages whose bodies were NOT fetched (to avoid mark-as-read on OFW). Call ofw_get_message(id) on those to read them. EVERY call re-checks the newest page first, so new messages are picked up promptly even while an old-history backfill is still running; only then does it spend what is left of its budget advancing that backfill. Pass deep:true to walk all OFW pages instead of stopping at the first all-cached page (use to backfill suspected gaps). Sync is BOUNDED and RESUMABLE: on hosted deployments a per-call OFW-request budget (env OFW_SYNC_MAX_REQUESTS, or the maxRequests argument) caps how far one call walks; when the budget is hit the response reports done:false with a note — call again with the SAME arguments to resume. done:false means older history is still being backfilled; it does NOT mean recent messages are missing. Local installs are unbounded by default (done is always true).',
         annotations: { readOnlyHint: false },
         inputSchema: {
-            folders: z.array(z.enum(['inbox', 'sent', 'drafts'])).describe('Folders to sync (default: all three)').optional(),
+            folders: z.array(z.enum(['inbox', 'sent', 'drafts'])).min(1).describe('Folders to sync (default: all three). Must be non-empty if given — an empty list would sync nothing while reporting success.').optional(),
             fetchUnreadBodies: z.boolean().describe('If true, also fetch bodies for unread inbox messages (will mark them as read on OFW). Default false.').optional(),
             deep: z.boolean().describe('If true, walk every OFW page until empty regardless of cache state. Use to backfill gaps. Default false.').optional(),
             maxRequests: z.number().int().min(1).describe('Maximum OFW requests this single call may make before pausing. When hit, the response reports done:false — call again with the same arguments to continue. Omit to use the server default (OFW_SYNC_MAX_REQUESTS, or unbounded on local installs).').optional(),
         },
     }, async (args) => {
+        const cache = cacheProvider();
         const result = await syncAll(client, {
             folders: args.folders,
             fetchUnreadBodies: args.fetchUnreadBodies,
             deep: args.deep,
             maxRequests: args.maxRequests ?? getSyncMaxRequests(),
-        }, cacheProvider());
-        return jsonResponse(result);
+        }, cache);
+        // Freshness of the cache AS OF this sync completing — so a paused call
+        // that skipped a folder says so here too, not just in `notRefreshed`.
+        const freshness = await buildFreshness(cache, {
+            source: 'cache',
+            folders: args.folders ?? ['inbox', 'sent', 'drafts'],
+        });
+        return jsonResponse({ ...result, freshness });
+    });
+    server.registerTool('ofw_check_freshness', {
+        description: 'Cheaply confirm whether the local cache still matches OurFamilyWizard, WITHOUT running a full sync. Use this before asserting anything about current state — especially "draft X is still sitting unsent" — when a read returned serverConfirmed:false or freshness.staleness other than "fresh". Costs one OFW request for the folder check plus one per messageId. For each folder it returns the live server count next to the cached count; for each id, whether it still exists on OFW and whether its content matches the cache (compared by content revision, because OFW draft timestamps do NOT change when a draft is edited in the web app). Does not fetch bodies into the cache, does not touch attachments, and does not depend on sync state.',
+        annotations: { readOnlyHint: true },
+        inputSchema: {
+            folders: z.array(z.enum(['inbox', 'sent', 'drafts'])).min(1).describe('Folders to compare cached vs live counts for. Defaults to all three when messageIds is not given. Must be non-empty if given.').optional(),
+            messageIds: z.array(z.number()).describe(`Specific ids to verify against OFW (max ${MAX_FRESHNESS_IDS}). By default only ids present in the drafts cache are probed — see allowMarkRead.`).optional(),
+            allowMarkRead: z.boolean().describe('Default false. Probing an id that is NOT a cached draft requires fetching its detail, which marks an unread inbox message as READ on OurFamilyWizard — an irreversible change to the record. Such ids are skipped unless you set this to true.').optional(),
+        },
+    }, async (args) => {
+        const cache = cacheProvider();
+        const allowMarkRead = args.allowMarkRead ?? false;
+        const requestedIds = args.messageIds ?? [];
+        const ids = requestedIds.slice(0, MAX_FRESHNESS_IDS);
+        // Folders default to "all three" only when the caller asked about nothing
+        // else; an ids-only call shouldn't silently spend a request on folders.
+        const wantFolders = args.folders
+            ?? (requestedIds.length > 0 ? [] : ['inbox', 'sent', 'drafts']);
+        let requestsUsed = 0;
+        const folders = [];
+        if (wantFolders.length > 0) {
+            requestsUsed++;
+            const data = parseLenient(FolderCountsSchema, await client.request('GET', '/pub/v1/messageFolders?includeFolderCounts=true'), { label: 'ofw-mcp', context: 'GET /pub/v1/messageFolders (ofw_check_freshness)' });
+            const sys = data.systemFolders ?? [];
+            for (const folder of wantFolders) {
+                const entry = sys.find((x) => x.folderType === FOLDER_TYPE[folder]);
+                const serverCount = entry?.totalCount ?? entry?.messageCount ?? entry?.count ?? null;
+                const cachedCount = folder === 'drafts'
+                    ? (await cache.listDraftIds()).length
+                    : await cache.countMessages({ folder });
+                const state = await cache.getSyncState(folder);
+                const historyComplete = state !== null && state.resumePage === null;
+                // A partially backfilled folder legitimately holds fewer messages than
+                // the server, so a count mismatch there proves nothing. Report both
+                // numbers and leave the verdict null rather than crying wolf for the
+                // entire duration of a backfill.
+                const inSync = serverCount === null || !historyComplete
+                    ? null
+                    : serverCount === cachedCount;
+                folders.push({
+                    folder,
+                    existsOnServer: entry !== undefined,
+                    serverCount,
+                    cachedCount,
+                    historyComplete,
+                    lastVerifiedAt: await getFolderVerifiedAt(cache, folder),
+                    inSync,
+                    ...(inSync === null
+                        ? { note: serverCount === null
+                                ? 'OFW did not report a count for this folder, so cached-vs-server cannot be compared. Use the per-id check instead.'
+                                : 'Older history is still being backfilled, so a lower cachedCount is expected and does not indicate drift.' }
+                        : {}),
+                });
+            }
+        }
+        const items = [];
+        for (const id of ids) {
+            const cachedDraft = await cache.getDraft(id);
+            // Drafts have no read state, so probing one is genuinely side-effect
+            // free. Any other id means GET /pub/v3/messages/{id}, which marks an
+            // unread inbox message read on OFW — a permanent change to a
+            // court-visible record. Refuse by default rather than quietly doing it.
+            if (cachedDraft === null && !allowMarkRead) {
+                items.push({
+                    id,
+                    skipped: true,
+                    reason: 'NOT_A_CACHED_DRAFT',
+                    note: 'Not in the drafts cache. Verifying it requires fetching its detail from OFW, which would mark an unread inbox message as READ on OurFamilyWizard. Pass allowMarkRead:true if that is acceptable.',
+                });
+                continue;
+            }
+            requestsUsed++;
+            try {
+                const server = await fetchServerDraft(client, id);
+                const cacheRevision = cachedDraft === null ? null : draftRevision(cachedDraft);
+                if (server === null) {
+                    items.push({
+                        id,
+                        existsOnServer: false,
+                        inSync: false,
+                        cacheRevision,
+                        serverRevision: null,
+                        note: cachedDraft === null
+                            ? 'Not found on OurFamilyWizard.'
+                            : 'This draft is in the local cache but NO LONGER EXISTS on OurFamilyWizard — it was sent or deleted elsewhere. Do not describe it as still unsent.',
+                    });
+                    continue;
+                }
+                const serverRevision = draftRevision(server);
+                items.push({
+                    id,
+                    existsOnServer: true,
+                    cacheRevision,
+                    serverRevision,
+                    inSync: cacheRevision !== null && cacheRevision === serverRevision,
+                    ...(cacheRevision === null
+                        ? { note: 'Exists on OurFamilyWizard but is not in the local cache.' }
+                        : cacheRevision !== serverRevision
+                            ? { note: 'Content differs from the cache — it was edited on OurFamilyWizard since the last sync. Run ofw_sync_messages before reading or writing it.' }
+                            : {}),
+                });
+            }
+            catch (e) {
+                // A check that could not run must not read as "in sync".
+                items.push({
+                    id,
+                    error: 'FRESHNESS_CHECK_FAILED',
+                    message: e.message,
+                    inSync: null,
+                    note: 'The freshness check itself failed, so nothing is confirmed either way.',
+                });
+            }
+        }
+        const payload = {
+            checkedAt: new Date().toISOString(),
+            requestsUsed,
+            ...(folders.length > 0 ? { folders } : {}),
+            ...(items.length > 0 ? { items } : {}),
+        };
+        if (requestedIds.length > ids.length) {
+            payload.note = `Only the first ${MAX_FRESHNESS_IDS} of ${requestedIds.length} messageIds were checked (per-call cap). The remaining ${requestedIds.length - ids.length} were NOT verified — call again with the rest.`;
+        }
+        return jsonResponse(payload);
     });
 }
 // OFW's bulk-delete endpoint takes a multipart form with `messageIds`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ofw-mcp",
-  "version": "2.6.7",
+  "version": "2.7.0",
   "license": "MIT",
   "mcpName": "io.github.chrischall/ofw-mcp",
   "description": "OurFamilyWizard MCP server for Claude — developed and maintained by AI (Claude Code)",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/ofw-mcp",
     "source": "github"
   },
-  "version": "2.6.7",
+  "version": "2.7.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "ofw-mcp",
-      "version": "2.6.7",
+      "version": "2.7.0",
       "transport": {
         "type": "stdio"
       },

package/skills/ofw/SKILL.md

@@ -97,11 +97,12 @@ Always pass `--config ~/.mcporter/mcporter.json` unless a local `config/mcporter
 | `ofw_get_message(messageId)` | Read a message OR draft body. Cache-first. Ids in the drafts cache return `folder: "drafts"`. ⚠️ Falls through to OFW for unread inbox messages, which marks them as read. |
 | `ofw_send_message(subject, body, recipientIds[], replyToId?, draftId?, myFileIDs?)` | Send a message. Pass `replyToId` to thread original history. Pass `draftId` to auto-delete the draft after sending. Pass `myFileIDs` (from `ofw_upload_attachment`) to attach files. |
 | `ofw_get_unread_sent` | Sent messages your co-parent hasn't read yet (from cache). |
-| `ofw_list_drafts` | List saved drafts (cache-backed). |
+| `ofw_list_drafts` | List saved drafts (cache-backed). Each draft carries `serverConfirmed` — see [Freshness](#freshness). |
 | `ofw_save_draft(subject, body, recipientIds?, messageId?, replyToId?, myFileIDs?)` | Create a new draft. Pass `messageId` to **replace** an existing draft: the tool creates a fresh draft and deletes the old one (OFW's update-in-place endpoint silently no-ops). The returned `id` is the NEW id; the response includes a `NOTE` documenting the swap. |
 | `ofw_delete_draft(messageId)` | Delete a draft. |
 | `ofw_upload_attachment(path, shareClass?, label?, description?)` | Upload a local file to My Files; returns a fileId to pass into `myFileIDs`. |
 | `ofw_download_attachment(fileId, inline?, saveTo?, force?)` | Download an attachment. `inline:true` returns bytes as MCP content; default writes to `~/Downloads/ofw-mcp/`. |
+| `ofw_check_freshness(folders?, messageIds?, allowMarkRead?)` | Cheap live check that the cache still matches OFW — one request for folder counts plus one per id, no bodies, no sync. Use before asserting current state. Only probes ids in the drafts cache unless `allowMarkRead:true` (probing others marks inbox messages read). |
 
 ### Calendar
 | Tool | Notes |
@@ -124,6 +125,19 @@ Always pass `--config ~/.mcporter/mcporter.json` unless a local `config/mcporter
 | `ofw_list_journal_entries(start?, max?)` | 1-based offset; default max 10 |
 | `ofw_create_journal_entry(title, body)` | Create a new entry |
 
+## Freshness
+
+Message and draft reads come from a local cache, so **a result can be stale without looking stale**. Every read tool returns a `freshness` block: `staleness` (`fresh`/`unverified`/`stale`), `asOf`, `ageSeconds`, and a `warning` whenever it is not `fresh`. Drafts additionally carry `serverConfirmed`.
+
+Rules for using it:
+
+- **Never state current state from memory.** If you saved a draft earlier in the session, that is not evidence it still exists unsent now — the user may have sent or deleted it in the web app since.
+- **`serverConfirmed: false` means "remembered, not known."** Do not say a draft "is still sitting unsent" on that basis. Call `ofw_check_freshness(messageIds: [id])` first, or say plainly that you are reporting cached state and give its age.
+- **If `freshness.staleness` is not `fresh`, either re-read or surface the caveat** in your answer. The `warning` string is written to be quotable.
+- OFW does **not** bump a draft's timestamp when it is edited in the web app, which is why freshness is tracked separately and compared by content revision. "Nothing changed" and "we didn't look" are otherwise indistinguishable.
+- A missing folder count in `ofw_sync_messages` output means that folder was **not checked** — it is never "no changes". Check `notRefreshed`.
+
+
 ## Workflows
 
 **Check inbox:**
@@ -152,3 +166,4 @@ Always pass `--config ~/.mcporter/mcporter.json` unless a local `config/mcporter
 - **Always confirm before sending messages or deleting anything** — OFW is a legal co-parenting record.
 - `ofw_get_notifications` updates last-seen status — avoid calling silently in the background.
 - `ofw_get_message` marks messages read — warn the user if they want to keep something unread.
+- **Do not narrate cached state as present fact.** Check `freshness`/`serverConfirmed` before saying what "is" true on OFW right now, and prefer `ofw_check_freshness` over guessing — it is one cheap call.