ofw-mcp 2.9.2 → 2.10.1

package/dist/bundle.js

@@ -3651,7 +3651,12 @@ var require_fast_uri = __commonJS({
     }
     function resolve2(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
+      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed) {
+        throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+      }
+      const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -3777,6 +3782,7 @@ var require_fast_uri = __commonJS({
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
     var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3811,6 +3817,20 @@ var require_fast_uri = __commonJS({
         parsed.error = "URI authority must not contain a literal backslash.";
         malformedAuthorityOrPort = true;
       }
+      const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+      if (introducerMatch !== null) {
+        const region = introducerMatch[1];
+        const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+        if (normalizedRegion.length >= 2) {
+          if (normalizedRegion.slice(0, 2) !== "//") {
+            parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+            malformedAuthorityOrPort = true;
+          } else if (region.length !== normalizedRegion.length) {
+            parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+            malformedAuthorityOrPort = true;
+          }
+        }
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
         parsed.scheme = matches[1];
@@ -26725,17 +26745,33 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error51) {
   if (error51 && typeof error51 === "object") {
+    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
+      return error51.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join("\n");
+    }
     if ("message" in error51 && typeof error51.message === "string") {
       return error51.message;
     }
-    if ("issues" in error51 && Array.isArray(error51.issues) && error51.issues.length > 0) {
-      const firstIssue = error51.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error51);
     } catch {
@@ -33350,16 +33386,7 @@ var Server = class extends Protocol {
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
     }
-    let methodValue;
-    if (isZ4Schema(methodSchema)) {
-      const v4Schema = methodSchema;
-      const v4Def = v4Schema._zod?.def;
-      methodValue = v4Def?.value ?? v4Schema.value;
-    } else {
-      const v3Schema = methodSchema;
-      const legacyDef = v3Schema._def;
-      methodValue = legacyDef?.value ?? v3Schema.value;
-    }
+    const methodValue = getLiteralValue(methodSchema);
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
@@ -34547,8 +34574,17 @@ var EMPTY_COMPLETION_RESULT = {
 import process3 from "node:process";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk2) {
+    const newSize = (this._buffer?.length ?? 0) + chunk2.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk2]) : chunk2;
   }
   readMessage() {
@@ -34576,18 +34612,24 @@ function serializeMessage(message) {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var StdioServerTransport = class {
-  constructor(_stdin = process3.stdin, _stdout = process3.stdout) {
+  constructor(_stdin = process3.stdin, _stdout = process3.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer();
     this._started = false;
     this._ondata = (chunk2) => {
-      this._readBuffer.append(chunk2);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk2);
+        this.processReadBuffer();
+      } catch (error51) {
+        this.onerror?.(error51);
+        this.close().catch(() => {
+        });
+      }
     };
     this._onerror = (error51) => {
       this.onerror?.(error51);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   /**
    * Starts listening for messages on stdin.
@@ -34914,12 +34956,19 @@ var TokenManager = class {
 };
 
 // src/client.ts
-import { dirname, join as join3 } from "path";
+import { dirname, join as join4 } from "path";
 import { fileURLToPath } from "url";
 
 // node_modules/@fetchproxy/protocol/dist/frames.js
-var PROTOCOL_VERSION = 2;
+var PROTOCOL_VERSION = 3;
 var HKDF_SESSION_INFO = "fetchproxy/1.0.0/session";
+function readySignaturePayload(mcpHelloNonce, extHelloNonce, extensionSessionPub) {
+  const out = new Uint8Array(mcpHelloNonce.length + extHelloNonce.length + extensionSessionPub.length);
+  out.set(mcpHelloNonce, 0);
+  out.set(extHelloNonce, mcpHelloNonce.length);
+  out.set(extensionSessionPub, mcpHelloNonce.length + extHelloNonce.length);
+  return out;
+}
 var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "fetch",
   "read_cookies",
@@ -34930,7 +34979,8 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "read_indexed_db",
   "read_dom",
   "download",
-  "graphql"
+  "graphql",
+  "write_cookies"
 ]);
 
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
@@ -35041,6 +35091,15 @@ function assertHttpUrl(x, label) {
     throw new ProtocolError(`${label}: must be http(s), got ${u.protocol}`);
   }
 }
+function assertCookiePath(x, label) {
+  assertString(x, label);
+  if (!x.startsWith("/") || x.startsWith("//")) {
+    throw new ProtocolError(`${label}: must be an absolute path like "/campus"`);
+  }
+  if (x.includes("?") || x.includes("#") || x.includes("\\")) {
+    throw new ProtocolError(`${label}: must not contain a query, fragment, or backslash`);
+  }
+}
 function assertHttpsOriginOnly(x, label) {
   assertString(x, label);
   let u;
@@ -35485,13 +35544,43 @@ function validateInnerRequest(raw) {
     }
     assertHttpsOriginOnly(raw.init.origin, "inner.init.origin");
     assertNonEmptyKeyArray(raw.init.keys, "inner.init.keys");
+    if (raw.init.path !== void 0)
+      assertCookiePath(raw.init.path, "inner.init.path");
     for (const k of Object.keys(raw.init)) {
-      if (k !== "origin" && k !== "keys") {
+      if (k !== "origin" && k !== "keys" && k !== "path") {
         throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on read_cookies`);
       }
     }
     return raw;
   }
+  if (raw.op === "write_cookies") {
+    assertObject(raw.init, "inner.init");
+    assertHttpsOriginOnly(raw.init.origin, "inner.init.origin");
+    if (!Array.isArray(raw.init.cookies) || raw.init.cookies.length === 0) {
+      throw new ProtocolError("inner.init.cookies: must be a non-empty array");
+    }
+    for (const [i, entry] of raw.init.cookies.entries()) {
+      assertObject(entry, `inner.init.cookies[${i}]`);
+      assertString(entry.name, `inner.init.cookies[${i}].name`);
+      if (!SCOPE_KEY_RE.test(entry.name)) {
+        throw new ProtocolError(`inner.init.cookies[${i}].name: invalid key ${JSON.stringify(entry.name)}`);
+      }
+      assertString(entry.value, `inner.init.cookies[${i}].value`);
+      for (const k of Object.keys(entry)) {
+        if (k !== "name" && k !== "value") {
+          throw new ProtocolError(`inner.init.cookies[${i}]: unexpected field ${JSON.stringify(k)}`);
+        }
+      }
+    }
+    if (raw.init.path !== void 0)
+      assertCookiePath(raw.init.path, "inner.init.path");
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "origin" && k !== "cookies" && k !== "path") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on write_cookies`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "read_local_storage" || raw.op === "read_session_storage") {
     assertObject(raw.init, "inner.init");
     if (raw.init.origin === void 0) {
@@ -35678,7 +35767,7 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download", "graphql_query"; got ${JSON.stringify(raw.op)}`);
+  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download", "graphql_query", "write_cookies"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -35739,6 +35828,18 @@ function validateInnerResponse(raw) {
       }
       return raw;
     }
+    if (op === "write_cookies") {
+      if (raw.written === void 0) {
+        throw new ProtocolError("inner.written: missing on write_cookies response");
+      }
+      if (!Array.isArray(raw.written)) {
+        throw new ProtocolError("inner.written: must be an array");
+      }
+      for (const [i, name] of raw.written.entries()) {
+        assertString(name, `inner.written[${i}]`);
+      }
+      return raw;
+    }
     if (op === "read_local_storage" || op === "read_session_storage") {
       if (raw.values === void 0) {
         throw new ProtocolError(`inner.values: missing on ${String(op)} response`);
@@ -36216,6 +36317,148 @@ async function awaitSessionReady(ready, opts) {
   }
 }
 
+// node_modules/@fetchproxy/server/dist/extension-trust.js
+import { readFile as readFile2, writeFile as writeFile2, rename, unlink, mkdir as mkdir2, chmod as chmod2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+
+// node_modules/@fetchproxy/server/dist/identity.js
+import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
+import { join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
+var SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+function defaultIdentityDir() {
+  return join2(homedir2(), ".fetchproxy", "identity");
+}
+function safeIdentityFileBase(serverName) {
+  if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
+    throw new Error(`unsafe serverName for identity file: ${JSON.stringify(serverName)}`);
+  }
+  return serverName.replace(/\//g, "_");
+}
+async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
+  const safeFile = safeIdentityFileBase(serverName);
+  const path = join2(dir, `${safeFile}.json`);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  try {
+    const raw = await readFile(path, "utf8");
+    const j2 = JSON.parse(raw);
+    return {
+      x25519Priv: fromB64(j2.x25519Priv),
+      x25519Pub: fromB64(j2.x25519Pub),
+      ed25519Priv: fromB64(j2.ed25519Priv),
+      ed25519Pub: fromB64(j2.ed25519Pub),
+      createdAt: j2.createdAt
+    };
+  } catch (e) {
+    if (e.code !== "ENOENT")
+      throw e;
+  }
+  const x = await generateX25519();
+  const ed = await generateEd25519();
+  const id = {
+    x25519Priv: x.privateKey,
+    x25519Pub: x.publicKey,
+    ed25519Priv: ed.privateKey,
+    ed25519Pub: ed.publicKey,
+    createdAt: Date.now()
+  };
+  const j = {
+    x25519Priv: toB64(id.x25519Priv),
+    x25519Pub: toB64(id.x25519Pub),
+    ed25519Priv: toB64(id.ed25519Priv),
+    ed25519Pub: toB64(id.ed25519Pub),
+    createdAt: id.createdAt
+  };
+  await writeFile(path, JSON.stringify(j, null, 2), { mode: 384 });
+  await chmod(path, 384);
+  return id;
+}
+
+// node_modules/@fetchproxy/server/dist/extension-trust.js
+function fileExtensionTrust(args) {
+  return {
+    allowNew: args.allowNew,
+    location: extensionTrustPath(args.serverName, args.dir ?? defaultIdentityDir()),
+    read: () => readExtensionPin(args.serverName, args.dir ?? defaultIdentityDir()),
+    write: (pin) => writeExtensionPin(args.serverName, pin, args.dir ?? defaultIdentityDir())
+  };
+}
+var TRUST_NEW_EXTENSION_ENV = "FETCHPROXY_TRUST_NEW_EXTENSION";
+function allowNewExtensionIdentity(explicit, env = process.env) {
+  if (explicit !== void 0)
+    return explicit;
+  return env[TRUST_NEW_EXTENSION_ENV] === "1";
+}
+function decideExtensionTrust(args) {
+  const { pin, hello, allowNew, serverName } = args;
+  if (!pin)
+    return { decision: "first-use" };
+  if (pin.identityX25519Pub === hello.identityX25519Pub && pin.identityEd25519Pub === hello.identityEd25519Pub) {
+    return { decision: "pinned" };
+  }
+  const trustPath = args.location ?? extensionTrustPathHint(serverName);
+  if (allowNew) {
+    return {
+      decision: "replace",
+      message: `[fetchproxy] ${serverName}: accepting a NEW extension identity because ${TRUST_NEW_EXTENSION_ENV}=1 \u2014 re-pinning. Unset it once the browser you expect is connected.`
+    };
+  }
+  return {
+    decision: "refused",
+    message: `[fetchproxy] ${serverName}: refusing an extension whose identity is not the one this MCP paired with. If you re-installed the extension or moved to another browser, re-pair deliberately: run this MCP once with ${TRUST_NEW_EXTENSION_ENV}=1, or delete ${trustPath}. If you did neither, something else is answering as your browser.`
+  };
+}
+function extensionTrustPath(serverName, dir = defaultIdentityDir()) {
+  return join3(dir, `${safeIdentityFileBase(serverName)}.extension-trust.json`);
+}
+function extensionTrustPathHint(serverName) {
+  try {
+    return extensionTrustPath(serverName);
+  } catch {
+    return join3(defaultIdentityDir(), "<server-name>.extension-trust.json");
+  }
+}
+function isPin(x) {
+  if (!x || typeof x !== "object")
+    return false;
+  const r = x;
+  return typeof r.identityX25519Pub === "string" && typeof r.identityEd25519Pub === "string" && typeof r.pinnedAt === "number";
+}
+async function readExtensionPin(serverName, dir = defaultIdentityDir()) {
+  const path = extensionTrustPath(serverName, dir);
+  let raw;
+  try {
+    raw = await readFile2(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT")
+      return null;
+    throw e;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`unreadable extension pin at ${path} (not JSON) \u2014 delete it to re-pair`);
+  }
+  if (!isPin(parsed)) {
+    throw new Error(`unreadable extension pin at ${path} (wrong shape) \u2014 delete it to re-pair`);
+  }
+  return {
+    identityX25519Pub: parsed.identityX25519Pub,
+    identityEd25519Pub: parsed.identityEd25519Pub,
+    pinnedAt: parsed.pinnedAt
+  };
+}
+async function writeExtensionPin(serverName, pin, dir = defaultIdentityDir()) {
+  const path = extensionTrustPath(serverName, dir);
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  const tmp = `${path}.tmp`;
+  await writeFile2(tmp, JSON.stringify(pin, null, 2), { mode: 384 });
+  await chmod2(tmp, 384);
+  await rename(tmp, path);
+}
+
 // node_modules/@fetchproxy/server/dist/host.js
 var PUBLIC_ORIGIN_RE = /^https?:\/\/(?!(127\.0\.0\.1|localhost)(:|$))/i;
 var enc2 = new TextEncoder();
@@ -36269,9 +36512,12 @@ async function startHost(opts) {
   }
   resetSessionPromise();
   let extensionHello = null;
+  let extensionClaim = null;
   wss.on("connection", (ws) => {
     let identified = null;
     let peerMcpId = null;
+    let closed = false;
+    let pinOnReady = false;
     ws.on("message", async (data) => {
       try {
         let frame;
@@ -36283,10 +36529,43 @@ async function startHost(opts) {
           return;
         }
         if (frame.type === "hello" && frame.role === "extension") {
-          if (extensionWs) {
+          if (extensionWs || extensionClaim) {
             ws.close(1008, "extension already connected");
             return;
           }
+          extensionClaim = ws;
+          let pin;
+          try {
+            pin = await opts.extensionTrust.read();
+          } catch (e) {
+            console.error(`[fetchproxy] ${String(e)}`);
+            if (extensionClaim === ws)
+              extensionClaim = null;
+            ws.close(1008, "extension pin unreadable");
+            return;
+          }
+          const outcome = decideExtensionTrust({
+            pin,
+            hello: frame,
+            allowNew: opts.extensionTrust.allowNew,
+            serverName: opts.ownServerName,
+            location: opts.extensionTrust.location
+          });
+          if (outcome.decision === "refused") {
+            console.warn(outcome.message);
+            if (extensionClaim === ws)
+              extensionClaim = null;
+            ws.close(1008, "extension identity is not the pinned one");
+            return;
+          }
+          if (outcome.decision === "replace")
+            console.warn(outcome.message);
+          if (closed || ws.readyState !== import_websocket.default.OPEN) {
+            if (extensionClaim === ws)
+              extensionClaim = null;
+            return;
+          }
+          pinOnReady = outcome.decision !== "pinned";
           identified = "extension";
           extensionWs = ws;
           extensionHello = frame;
@@ -36298,6 +36577,8 @@ async function startHost(opts) {
               console.error("[fetchproxy] onPairCode threw:", e);
             }
           }
+          for (const slot of peers.values())
+            slot.ws.send(JSON.stringify(frame));
           ws.send(JSON.stringify(ownHello));
           for (const slot of peers.values()) {
             ws.send(JSON.stringify(slot.helloFrame));
@@ -36333,6 +36614,8 @@ async function startHost(opts) {
           peers.set(frame.mcpId, { ws, helloFrame: frame });
           if (extensionWs)
             extensionWs.send(JSON.stringify(frame));
+          if (extensionHello)
+            ws.send(JSON.stringify(extensionHello));
           return;
         }
         if (frame.type === "ready") {
@@ -36344,7 +36627,7 @@ async function startHost(opts) {
             }
             const extEdPub = fromB64(extensionHello.identityEd25519Pub);
             const extNonce = fromB64(extensionHello.sessionNonce);
-            const msg = concatBytes(ownSessionNonce, extNonce);
+            const msg = readySignaturePayload(ownSessionNonce, extNonce, fromB64(frame.extensionSessionPub));
             const sig = fromB64(frame.sessionSig);
             let sigOk = false;
             try {
@@ -36357,6 +36640,18 @@ async function startHost(opts) {
               ws.close(1008, "extension session signature invalid");
               return;
             }
+            if (pinOnReady) {
+              pinOnReady = false;
+              try {
+                await opts.extensionTrust.write({
+                  identityX25519Pub: extensionHello.identityX25519Pub,
+                  identityEd25519Pub: extensionHello.identityEd25519Pub,
+                  pinnedAt: Date.now()
+                });
+              } catch (e) {
+                console.error(`[fetchproxy] could not persist the extension pin: ${String(e)}`);
+              }
+            }
             const extPub = fromB64(frame.extensionSessionPub);
             const shared = await ecdhX25519(opts.ownIdentity.x25519Priv, extPub);
             const key = await hkdfSha256(shared, ownSessionNonce, enc2.encode(HKDF_SESSION_INFO), 32);
@@ -36410,6 +36705,9 @@ async function startHost(opts) {
       }
     });
     ws.on("close", () => {
+      closed = true;
+      if (extensionClaim === ws)
+        extensionClaim = null;
       if (identified === "extension" && extensionWs === ws) {
         extensionWs = null;
         extensionHello = null;
@@ -36500,11 +36798,84 @@ async function startPeer(opts) {
     resolveFirstReady = resolve2;
     rejectFirstReady = reject;
   });
+  let extensionHello = null;
+  let warnedUnverifiable = false;
+  let cachedPin = void 0;
+  const authenticateExtension = async (sessionSig, extensionSessionPub) => {
+    if (!extensionHello) {
+      if (opts.requireExtensionIdentity) {
+        console.error(`[fetchproxy] ${opts.serverName}: the concentrator does not forward the extension's identity, so this session cannot be verified \u2014 refusing. Upgrade the MCP holding the bridge port to 1.12.0 or later.`);
+        return false;
+      }
+      if (!warnedUnverifiable) {
+        warnedUnverifiable = true;
+        console.warn(`[fetchproxy] ${opts.serverName}: the concentrator does not forward the extension's identity (pre-1.12.0), so this peer cannot verify which browser it is talking to. Upgrade the MCP holding the bridge port to close this.`);
+      }
+      return true;
+    }
+    const payload = readySignaturePayload(sessionNonce, fromB64(extensionHello.sessionNonce), fromB64(extensionSessionPub));
+    let sigOk = false;
+    try {
+      sigOk = await ed25519Verify(fromB64(extensionHello.identityEd25519Pub), payload, fromB64(sessionSig));
+    } catch {
+      sigOk = false;
+    }
+    if (!sigOk) {
+      console.warn(`[fetchproxy] ${opts.serverName}: extension session signature invalid \u2014 refusing (the concentrator may be answering in the browser's place)`);
+      return false;
+    }
+    if (cachedPin === void 0) {
+      try {
+        cachedPin = await opts.extensionTrust.read();
+      } catch (e) {
+        console.error(`[fetchproxy] ${String(e)}`);
+        return false;
+      }
+    }
+    const pin = cachedPin;
+    const outcome = decideExtensionTrust({
+      pin,
+      hello: extensionHello,
+      allowNew: opts.extensionTrust.allowNew,
+      serverName: opts.serverName,
+      location: opts.extensionTrust.location
+    });
+    if (outcome.decision === "refused") {
+      console.warn(outcome.message);
+      return false;
+    }
+    if (outcome.decision === "replace")
+      console.warn(outcome.message);
+    if (outcome.decision !== "pinned") {
+      try {
+        const written = {
+          identityX25519Pub: extensionHello.identityX25519Pub,
+          identityEd25519Pub: extensionHello.identityEd25519Pub,
+          pinnedAt: Date.now()
+        };
+        await opts.extensionTrust.write(written);
+        cachedPin = written;
+      } catch (e) {
+        console.error(`[fetchproxy] could not persist the extension pin: ${String(e)}`);
+      }
+    }
+    return true;
+  };
   const onMessage = async (data) => {
     try {
       const raw = JSON.parse(data.toString());
       const frame = validateFrame(raw);
+      if (frame.type === "hello" && frame.role === "extension") {
+        extensionHello = frame;
+        return;
+      }
       if (frame.type === "ready" && frame.mcpId === opts.mcpId) {
+        const authorised = await authenticateExtension(frame.sessionSig, frame.extensionSessionPub);
+        if (!authorised) {
+          ws.close(1008, "extension identity refused");
+          rejectFirstReady(new Error("peer: extension identity refused"));
+          return;
+        }
         const extPub = fromB64(frame.extensionSessionPub);
         const shared = await ecdhX25519(opts.identity.x25519Priv, extPub);
         const sessionKey = await hkdfSha256(shared, sessionNonce, enc3.encode(HKDF_SESSION_INFO), 32);
@@ -36585,57 +36956,6 @@ async function startPeer(opts) {
   return handle;
 }
 
-// node_modules/@fetchproxy/server/dist/identity.js
-import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { join as join2 } from "node:path";
-import { homedir as homedir2 } from "node:os";
-var SAFE_PLAIN = /^[A-Za-z0-9._-]+$/;
-var SAFE_SCOPED = /^@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
-function defaultIdentityDir() {
-  return join2(homedir2(), ".fetchproxy", "identity");
-}
-async function loadOrCreateIdentity(serverName, dir = defaultIdentityDir()) {
-  if (!serverName || serverName === ".." || serverName.includes("..") || !SAFE_PLAIN.test(serverName) && !SAFE_SCOPED.test(serverName)) {
-    throw new Error(`unsafe serverName for identity file: ${JSON.stringify(serverName)}`);
-  }
-  const safeFile = serverName.replace(/\//g, "_");
-  const path = join2(dir, `${safeFile}.json`);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  try {
-    const raw = await readFile(path, "utf8");
-    const j2 = JSON.parse(raw);
-    return {
-      x25519Priv: fromB64(j2.x25519Priv),
-      x25519Pub: fromB64(j2.x25519Pub),
-      ed25519Priv: fromB64(j2.ed25519Priv),
-      ed25519Pub: fromB64(j2.ed25519Pub),
-      createdAt: j2.createdAt
-    };
-  } catch (e) {
-    if (e.code !== "ENOENT")
-      throw e;
-  }
-  const x = await generateX25519();
-  const ed = await generateEd25519();
-  const id = {
-    x25519Priv: x.privateKey,
-    x25519Pub: x.publicKey,
-    ed25519Priv: ed.privateKey,
-    ed25519Pub: ed.publicKey,
-    createdAt: Date.now()
-  };
-  const j = {
-    x25519Priv: toB64(id.x25519Priv),
-    x25519Pub: toB64(id.x25519Pub),
-    ed25519Priv: toB64(id.ed25519Priv),
-    ed25519Pub: toB64(id.ed25519Pub),
-    createdAt: id.createdAt
-  };
-  await writeFile(path, JSON.stringify(j, null, 2), { mode: 384 });
-  await chmod(path, 384);
-  return id;
-}
-
 // node_modules/@fetchproxy/server/dist/error-kind.js
 function classifyFetchError(error51) {
   if (/Could not establish connection/i.test(error51) || /Receiving end does not exist/i.test(error51)) {
@@ -36717,6 +37037,39 @@ var FetchproxyBridgeDownError = class extends FetchproxyProtocolError {
     this.hint = hint;
   }
 };
+var FetchproxyHintedError = class extends FetchproxyProtocolError {
+  /** The extension's raw rejection, unmodified. */
+  originalError;
+  /** What the user should actually do, in prose. */
+  hint;
+  constructor(originalError, hint) {
+    super(`${originalError} \u2014 ${hint}`);
+    this.name = "FetchproxyHintedError";
+    this.originalError = originalError;
+    this.hint = hint;
+  }
+};
+var FetchproxyScopeError = class extends FetchproxyHintedError {
+  constructor(originalError) {
+    super(originalError, "the declared scope changed since you paired, so the extension is refusing the request. Revoke this MCP in the Transporter extension popup, then re-run \u2014 you will be asked to approve the new scope. This is not a version problem and does not need an update.");
+    this.name = "FetchproxyScopeError";
+  }
+};
+var FetchproxyNoTabError = class extends FetchproxyHintedError {
+  constructor(originalError) {
+    super(originalError, "open a tab on that host and sign in, then re-run. This is not a version problem and does not need an update.");
+    this.name = "FetchproxyNoTabError";
+  }
+};
+var SCOPE_REJECTION = /not in declared/;
+var NO_TAB_REJECTION = /no tab matching (?!.*content script loaded)/;
+function protocolErrorFrom(error51) {
+  if (SCOPE_REJECTION.test(error51))
+    return new FetchproxyScopeError(error51);
+  if (NO_TAB_REJECTION.test(error51))
+    return new FetchproxyNoTabError(error51);
+  return new FetchproxyProtocolError(error51);
+}
 var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
   url;
   timeoutMs;
@@ -36746,6 +37099,17 @@ var FetchproxyTimeoutError = class extends FetchproxyProtocolError {
   }
 };
 var SUBDOMAIN_LABEL_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
+function normalizeCookiePath(path) {
+  if (path === void 0 || path === "")
+    return void 0;
+  const trimmed = path.endsWith("/") && path !== "/" ? path.slice(0, -1) : path;
+  try {
+    assertCookiePath(trimmed, "path");
+  } catch (e) {
+    throw new Error(`FetchproxyServer: ${e instanceof Error ? e.message : String(e)} (got ${JSON.stringify(path)})`);
+  }
+  return trimmed;
+}
 function assertSubdomainLabel(label) {
   if (!SUBDOMAIN_LABEL_RE.test(label)) {
     throw new Error(`FetchproxyServer: subdomain must be a DNS label like "www" or "api" (or dot-separated like "auth.api"), got ${JSON.stringify(label)}`);
@@ -36810,6 +37174,9 @@ var FetchproxyServer = class {
   // them off from `pending` (fetch) and `pendingReadCookies` (legacy
   // string-shape) so the response routing in `onInner` stays linear.
   pendingStorage = /* @__PURE__ */ new Map();
+  // 1.12.0+: write-cookies awaiters resolve the list of names actually
+  // written, so a caller can confirm rather than assume.
+  pendingWriteCookies = /* @__PURE__ */ new Map();
   // 0.3.0+: capture-header awaiters resolve a single string.
   pendingCapture = /* @__PURE__ */ new Map();
   // capture_redirect awaiters resolve the captured redirect URL string.
@@ -36936,6 +37303,8 @@ var FetchproxyServer = class {
       keepAliveIntervalMs: opts.keepAliveIntervalMs ?? 2e4,
       keepAliveMaxIdleMs: opts.keepAliveMaxIdleMs ?? 5 * 60 * 1e3,
       identityDir: opts.identityDir,
+      allowNewExtensionIdentity: opts.allowNewExtensionIdentity,
+      requireExtensionIdentity: opts.requireExtensionIdentity,
       onPairCode: opts.onPairCode
     };
   }
@@ -37035,7 +37404,8 @@ var FetchproxyServer = class {
         ownSessionStoragePointers: this.opts.sessionStoragePointers,
         ownDomSelectors: this.opts.domSelectors,
         ownGraphqlOps: this.opts.graphqlOps,
-        onPairCode: this.opts.onPairCode
+        onPairCode: this.opts.onPairCode,
+        extensionTrust: this.extensionTrust()
       });
       this.hostHandle.onOwnInner((inner) => this.onInner(inner));
       this.hostHandle.onExtensionDisconnect(() => {
@@ -37064,7 +37434,9 @@ var FetchproxyServer = class {
         localStoragePointers: this.opts.localStoragePointers,
         sessionStoragePointers: this.opts.sessionStoragePointers,
         domSelectors: this.opts.domSelectors,
-        graphqlOps: this.opts.graphqlOps
+        graphqlOps: this.opts.graphqlOps,
+        extensionTrust: this.extensionTrust(),
+        requireExtensionIdentity: this.opts.requireExtensionIdentity
       });
       this.peerHandle.onInner((inner) => this.onInner(inner));
       this.peerHandle.onRenegotiate(() => {
@@ -37203,6 +37575,23 @@ var FetchproxyServer = class {
   markActive() {
     this.noteActivityForKeepalive();
   }
+  /**
+   * #208: this MCP's pin on the extension's identity, stored beside its own
+   * identity key and so following `identityDir` wherever the caller put it.
+   *
+   * `allowNewExtensionIdentity` falls back to an environment variable when the
+   * caller expressed no opinion, because the thirteen MCPs that construct this
+   * class are separate packages: an operator whose extension re-install has
+   * just locked all of them out needs one lever that does not require patching
+   * every one of them.
+   */
+  extensionTrust() {
+    return fileExtensionTrust({
+      serverName: this.opts.serverName,
+      dir: this.opts.identityDir,
+      allowNew: allowNewExtensionIdentity(this.opts.allowNewExtensionIdentity)
+    });
+  }
   noteActivityForKeepalive() {
     const intervalMs = this.opts.keepAliveIntervalMs;
     if (intervalMs <= 0)
@@ -37266,6 +37655,7 @@ var FetchproxyServer = class {
         this.pending.delete(id);
         this.pendingReadCookies.delete(id);
         this.pendingStorage.delete(id);
+        this.pendingWriteCookies.delete(id);
         this.pendingCapture.delete(id);
         this.pendingRedirect.delete(id);
         this.pendingDownload.delete(id);
@@ -37387,7 +37777,7 @@ var FetchproxyServer = class {
         port: this.opts.port
       });
     }
-    return new FetchproxyProtocolError(result.error);
+    return protocolErrorFrom(result.error);
   }
   /**
    * Convenience wrapper around `fetch()`. Builds the URL from a path
@@ -37423,10 +37813,20 @@ var FetchproxyServer = class {
     }
     const url2 = isAbsolute2 ? path : `https://${host}${path}`;
     assertUrlInDomains("request url", url2, this.opts.domains);
+    let tabUrl = `https://${host}/`;
+    if (opts.viaTab !== void 0) {
+      try {
+        new URL(opts.viaTab);
+      } catch {
+        throw new Error(`FetchproxyServer.request: viaTab is not a valid URL: ${JSON.stringify(opts.viaTab)}`);
+      }
+      assertUrlInDomains("viaTab", opts.viaTab, this.opts.domains);
+      tabUrl = opts.viaTab;
+    }
     const init = {
       url: url2,
       method,
-      tabUrl: `https://${host}/`,
+      tabUrl,
       headers: opts.headers,
       body: opts.body
     };
@@ -37638,9 +38038,14 @@ var FetchproxyServer = class {
     let inner;
     if (opts.keys !== void 0) {
       this.assertScopeSubset(opts.keys, this.opts.cookieKeys, "cookieKeys");
+      const cookiePath = normalizeCookiePath(opts.path);
       const initV3 = {
+        // Origin stays BARE. The path travels as its own validated field —
+        // `assertHttpsOriginOnly` deliberately refuses a path here so one
+        // cannot be used to re-point the read past the domain gate.
         origin: `https://${host}`,
-        keys: [...opts.keys]
+        keys: [...opts.keys],
+        ...cookiePath !== void 0 ? { path: cookiePath } : {}
       };
       inner = { type: "request", id, op: "read_cookies", init: initV3 };
     } else {
@@ -37653,10 +38058,65 @@ var FetchproxyServer = class {
     await this.sendInnerFrame(inner);
     const result = await this._withVerbTimeout(pending, this.pendingReadCookies, id, `https://${host}`);
     if (!result.ok) {
-      throw new FetchproxyProtocolError(result.error);
+      throw protocolErrorFrom(result.error);
     }
     return result.cookies;
   }
+  /**
+   * 1.12.0+: overwrite the value of cookies this MCP already declares.
+   *
+   * The bridge's only write verb, and it exists for one failure class. Sites
+   * that ROTATE a credential cookie hand back a new value on every refresh; if
+   * the MCP refreshes and keeps the result to itself, the copy in the browser's
+   * cookie jar is dead, and the user gets signed out of a tab they never
+   * touched — usually reported to them as "inactivity". Writing the rotated
+   * value back is the only thing that repairs it.
+   *
+   * Requires `'write_cookies'` in capabilities, which the user approves at pair
+   * time as its own line. Every name must ALSO be in declared `cookieKeys`: a
+   * write can never reach a cookie the MCP was not already trusted to read, so
+   * granting it cannot widen which cookies are in play — only what may be done
+   * to the ones already listed.
+   *
+   * The extension refuses the whole request unless every named cookie already
+   * exists; this refreshes a value in place and deliberately cannot author new
+   * cookies. Returns the names actually written.
+   */
+  async writeCookies(opts) {
+    if (!this.opts.capabilities.includes("write_cookies")) {
+      throw new Error('FetchproxyServer.writeCookies(): MCP did not declare "write_cookies" in capabilities \u2014 add it to FetchproxyServerOpts.capabilities to enable this verb');
+    }
+    const names = Object.keys(opts.cookies);
+    if (names.length === 0) {
+      throw new Error("FetchproxyServer.writeCookies(): no cookies given");
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    if (opts.subdomain !== void 0)
+      assertSubdomainLabel(opts.subdomain);
+    const baseDomain = this.resolveBaseDomain(opts.domain);
+    const host = opts.subdomain ? `${opts.subdomain}.${baseDomain}` : baseDomain;
+    this.assertScopeSubset(names, this.opts.cookieKeys, "cookieKeys");
+    const cookiePath = normalizeCookiePath(opts.path);
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "write_cookies",
+      init: {
+        // Bare origin, same invariant as the read path: a path must never be
+        // able to move the request past the domain gate.
+        origin: `https://${host}`,
+        cookies: Object.entries(opts.cookies).map(([name, value]) => ({ name, value })),
+        ...cookiePath !== void 0 ? { path: cookiePath } : {}
+      }
+    };
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingWriteCookies.set(id, { resolve: resolve2, reject });
+    });
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingWriteCookies, id, `https://${host}`);
+  }
   /**
    * 0.3.0+: read declared localStorage keys from the user's signed-in
    * tab. Requires `'read_local_storage'` in capabilities AND each key
@@ -38203,7 +38663,7 @@ var FetchproxyServer = class {
           storageCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on storage awaiter`));
         }
       } else {
-        storageCb.reject(new FetchproxyProtocolError(inner.error));
+        storageCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38217,7 +38677,7 @@ var FetchproxyServer = class {
           captureCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture awaiter`));
         }
       } else {
-        captureCb.reject(new FetchproxyProtocolError(inner.error));
+        captureCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38231,7 +38691,7 @@ var FetchproxyServer = class {
           redirectCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on capture_redirect awaiter`));
         }
       } else {
-        redirectCb.reject(new FetchproxyProtocolError(inner.error));
+        redirectCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38245,7 +38705,7 @@ var FetchproxyServer = class {
           idbCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on read_indexed_db awaiter`));
         }
       } else {
-        idbCb.reject(new FetchproxyProtocolError(inner.error));
+        idbCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38259,7 +38719,7 @@ var FetchproxyServer = class {
           downloadCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on download awaiter`));
         }
       } else {
-        downloadCb.reject(new FetchproxyProtocolError(inner.error));
+        downloadCb.reject(protocolErrorFrom(inner.error));
       }
       return;
     }
@@ -38273,7 +38733,17 @@ var FetchproxyServer = class {
           graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
         }
       } else {
-        graphqlCb.reject(new FetchproxyProtocolError(inner.error));
+        graphqlCb.reject(protocolErrorFrom(inner.error));
+      }
+      return;
+    }
+    const writeCookiesCb = this.pendingWriteCookies.get(inner.id);
+    if (writeCookiesCb) {
+      this.pendingWriteCookies.delete(inner.id);
+      if (inner.ok && inner.op === "write_cookies") {
+        writeCookiesCb.resolve([...inner.written]);
+      } else {
+        writeCookiesCb.reject(protocolErrorFrom(inner.ok ? "write_cookies response had the wrong op" : inner.error));
       }
       return;
     }
@@ -38316,6 +38786,9 @@ var FetchproxyServer = class {
     for (const { reject } of this.pendingStorage.values())
       reject(err);
     this.pendingStorage.clear();
+    for (const { reject } of this.pendingWriteCookies.values())
+      reject(err);
+    this.pendingWriteCookies.clear();
     for (const { reject } of this.pendingCapture.values())
       reject(err);
     this.pendingCapture.clear();
@@ -38385,6 +38858,9 @@ var FetchproxyServer = class {
 // node_modules/@fetchproxy/bootstrap/dist/index.js
 var defaultFactory = (opts) => new FetchproxyServer(opts);
 async function bootstrap(opts) {
+  return runOneLift(opts);
+}
+async function runOneLift(opts) {
   const envVar = opts.serverName.toUpperCase().replace(/[^A-Z0-9]/g, "_").replace(/^_+/, "") + "_DISABLE_FETCHPROXY";
   const envVal = process.env[envVar];
   if (envVal !== void 0 && envVal !== "" && envVal !== "0" && envVal !== "false") {
@@ -38453,7 +38929,9 @@ async function bootstrap(opts) {
     if (opts.declare.cookies.length > 0) {
       const joined = await server.readCookies({
         keys: opts.declare.cookies,
-        ...storageDomainOpts
+        ...storageDomainOpts,
+        // Cookie-only: the other buckets are origin-scoped and ignore path.
+        ...opts.storagePath !== void 0 ? { path: opts.storagePath } : {}
       });
       for (const piece of joined.split("; ")) {
         if (!piece)
@@ -38511,12 +38989,18 @@ async function bootstrap(opts) {
       });
       indexedDbBucket[`${d.database}/${d.store}`] = values;
     }
+    const absent = (declared, got) => declared.filter((k) => !(k in got));
     return {
       cookies,
       localStorage,
       sessionStorage,
       capturedHeaders,
-      indexedDb: indexedDbBucket
+      indexedDb: indexedDbBucket,
+      missing: {
+        cookies: absent(opts.declare.cookies, cookies),
+        localStorage: absent(opts.declare.localStorage, localStorage),
+        sessionStorage: absent(opts.declare.sessionStorage, sessionStorage)
+      }
     };
   } finally {
     try {
@@ -38590,7 +39074,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.9.2",
+  version: "2.10.1",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -38626,14 +39110,14 @@ var package_default = {
   },
   dependencies: {
     "@chrischall/mcp-utils": "^0.14.0",
-    "@fetchproxy/bootstrap": "^1.7.0",
+    "@fetchproxy/bootstrap": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
     zod: "^4.4.3"
   },
   devDependencies: {
     "@chrischall/mcp-connector": "^1.1.1",
-    "@cloudflare/vitest-pool-workers": "^0.18.4",
+    "@cloudflare/vitest-pool-workers": "^0.19.1",
     "@cloudflare/workers-oauth-provider": "^0.8.1",
     "@cloudflare/workers-types": "^5.20260708.1",
     "@types/node": "^26.0.0",
@@ -38710,7 +39194,7 @@ async function resolveAuth() {
 // src/client.ts
 try {
   const dir = dirname(fileURLToPath(import.meta.url));
-  await loadDotenvSafely({ path: join3(dir, "..", ".env") });
+  await loadDotenvSafely({ path: join4(dir, "..", ".env") });
 } catch {
 }
 function parseContentDispositionFilename(cd) {
@@ -39099,6 +39583,16 @@ function mapRecipients(items) {
 function hasRealView(recipients) {
   return recipients.some((r) => r.viewedAt !== null && !r.viewedAt.startsWith("1970-01-01"));
 }
+function threadedReplyTo(detail) {
+  return detail.replyToId ?? detail.inReplyTo ?? null;
+}
+function reportsThreaded(detail) {
+  return threadedReplyTo(detail) !== null || detail.showContext === true;
+}
+function reportsUnthreaded(detail) {
+  if (reportsThreaded(detail)) return false;
+  return detail.inReplyTo !== void 0 || detail.showContext !== void 0;
+}
 function scrapeSaysRead(listData) {
   if (typeof listData !== "object" || listData === null) return false;
   const ld = listData;
@@ -39413,7 +39907,12 @@ var DraftListItemSchema = external_exports.looseObject({
   id: external_exports.number(),
   subject: external_exports.string(),
   date: external_exports.looseObject({ dateTime: external_exports.string() }),
+  // Both spellings of the threading echo — OFW reports the reply target as
+  // `inReplyTo` (with showContext) on list payloads where `replyToId` is null.
+  // The cached row must derive the SAME value ofw_save_draft derived from the
+  // detail, or the content revision drifts between a save and the next sync.
   replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
   recipients: external_exports.array(ApiRecipientSchema).optional()
 });
 var DraftListResponseSchema = external_exports.looseObject({ data: external_exports.array(DraftListItemSchema).optional() });
@@ -39476,7 +39975,7 @@ async function syncDrafts(client2, draftsFolderId, store, budget) {
       subject: detail.subject ?? item.subject ?? "(no subject)",
       body: detail.body ?? "",
       recipients: mapRecipients(item.recipients),
-      replyToId: item.replyToId ?? null,
+      replyToId: threadedReplyTo(item),
       modifiedAt: item.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
       listData: item
     });
@@ -39582,24 +40081,24 @@ async function syncAll(client2, opts, store) {
 // src/config.ts
 import { createHash } from "node:crypto";
 import { homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 function readCacheIdentity() {
   return readEnvVar("OFW_CACHE_IDENTITY") ?? readEnvVar("OFW_USERNAME") ?? "_default";
 }
 function getCacheDir() {
   const override = process.env.OFW_CACHE_DIR;
   if (override && override.trim().length > 0) return override.trim();
-  return join4(homedir3(), ".cache", "ofw-mcp");
+  return join5(homedir3(), ".cache", "ofw-mcp");
 }
 function getCacheDbPath() {
   const identity = readCacheIdentity();
   const hash2 = createHash("sha256").update(identity).digest("hex").slice(0, 16);
-  return join4(getCacheDir(), `${hash2}.db`);
+  return join5(getCacheDir(), `${hash2}.db`);
 }
 function getAttachmentsDir() {
   const override = process.env.OFW_ATTACHMENTS_DIR;
   if (override && override.trim().length > 0) return override.trim();
-  return join4(homedir3(), "Downloads", "ofw-mcp");
+  return join5(homedir3(), "Downloads", "ofw-mcp");
 }
 function getWriteMode() {
   const raw = process.env.OFW_WRITE_MODE;
@@ -39777,8 +40276,18 @@ function draftRevision(d) {
 var ServerDraftSchema = external_exports.looseObject({
   subject: external_exports.string().optional(),
   body: external_exports.string().optional(),
+  // BOTH spellings of the threading echo (see ThreadingEcho in _shared.ts):
+  // OFW reports the reply target as `replyToId` on some payloads and as
+  // `inReplyTo` on others. The snapshot derives one value from whichever is
+  // present, so the revision hashed here matches the one ofw_save_draft
+  // computed from the same server state — a one-sided read produced revisions
+  // that disagreed about the same draft.
   replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
   recipients: external_exports.array(ApiRecipientSchema).optional(),
+  // Attachment fileIds — read so send-by-draft carries the draft's
+  // attachments onto the sent message (see DraftContent.files).
+  files: external_exports.array(external_exports.number()).optional(),
   // Read for the LIFECYCLE answer (see tools/lifecycle.ts): which folder OFW
   // itself says this id lives in right now. `existsOnServer` alone cannot
   // distinguish "still a draft" from "was sent" — a sent draft still exists.
@@ -39821,8 +40330,9 @@ async function fetchMessageSnapshot(client2, id) {
     content: {
       subject: detail.subject ?? "",
       body: detail.body ?? "",
-      replyToId: detail.replyToId ?? null,
-      recipients: mapRecipients(detail.recipients)
+      replyToId: threadedReplyTo(detail),
+      recipients: mapRecipients(detail.recipients),
+      ...detail.files !== void 0 ? { files: detail.files } : {}
     },
     folderId: detail.folder?.id === void 0 ? null : String(detail.folder.id),
     folderName: detail.folder?.name ?? null,
@@ -39952,13 +40462,24 @@ async function ensureFolderIdMap(client2, store) {
     return { map: cached2, requests: 1 };
   }
 }
+var STATE_BY_FOLDER_NAME = /* @__PURE__ */ new Map([
+  ["drafts", "draft"],
+  ["sent", "sent"],
+  ["sent messages", "sent"],
+  ["inbox", "received"]
+]);
 function classifyState(snapshot, map2) {
   if (snapshot === null) return "deleted";
-  const { folderId } = snapshot;
-  if (folderId === null) return "unknown";
-  if (map2.drafts !== null && folderId === map2.drafts) return "draft";
-  if (map2.sent !== null && folderId === map2.sent) return "sent";
-  if (map2.inbox !== null && folderId === map2.inbox) return "received";
+  const { folderId, folderName } = snapshot;
+  if (folderId !== null) {
+    if (map2.drafts !== null && folderId === map2.drafts) return "draft";
+    if (map2.sent !== null && folderId === map2.sent) return "sent";
+    if (map2.inbox !== null && folderId === map2.inbox) return "received";
+  }
+  if (folderName !== null) {
+    const byName = STATE_BY_FOLDER_NAME.get(folderName.trim().toLowerCase());
+    if (byName !== void 0) return byName;
+  }
   return "unknown";
 }
 function probeWouldStamp(cachedDraft, cachedMessage) {
@@ -41093,20 +41614,32 @@ async function buildInlineDelivery(input) {
 }
 
 // src/tools/messages.ts
-import { basename as basename2, join as join5 } from "node:path";
+import { basename as basename2, join as join6 } from "node:path";
 var DateSchema = external_exports.looseObject({ dateTime: external_exports.string() });
 var SentDetailSchema = external_exports.looseObject({
   subject: external_exports.string().optional(),
   body: external_exports.string().optional(),
   date: DateSchema.optional(),
   from: external_exports.looseObject({ name: external_exports.string().optional() }).optional(),
-  recipients: external_exports.array(ApiRecipientSchema).optional()
+  recipients: external_exports.array(ApiRecipientSchema).optional(),
+  // The threading echo, in BOTH spellings plus showContext — OFW reports the
+  // reply target inconsistently across payloads (see ThreadingEcho in
+  // _shared.ts). Backs the `threaded` verdict on ofw_send_message.
+  replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
+  showContext: external_exports.boolean().optional()
 });
 var SavedDraftDetailSchema = external_exports.looseObject({
   subject: external_exports.string().optional(),
   body: external_exports.string().optional(),
   date: DateSchema.optional(),
+  // All three threading-echo fields. Reading ONLY `replyToId` here fired a
+  // false "OurFamilyWizard did not thread this draft" warning on nearly every
+  // threaded save, while the same payload's `inReplyTo`/`showContext` showed
+  // the draft WAS threaded — see threadedReplyTo in _shared.ts.
   replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
+  showContext: external_exports.boolean().optional(),
   recipients: external_exports.array(ApiRecipientSchema).optional(),
   // Read to audit whether requested myFileIDs actually attached (Defect 3).
   files: external_exports.array(external_exports.number()).optional()
@@ -41305,6 +41838,11 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     if (draftRow !== null) {
       const { freshness: freshness2, serverConfirmed, cacheStatus } = await draftsFreshness(cache);
       return jsonResponse({
+        // Stable identity FIRST — the id below changes on every edit
+        // (create-then-delete), so callers should key off draftKey. Null when
+        // this draft was never written through this tool (e.g. authored in
+        // the web app).
+        draftKey: (await cache.getDraftLineageById(draftRow.id))?.draftKey ?? null,
         id: draftRow.id,
         folder: "drafts",
         subject: draftRow.subject,
@@ -41321,13 +41859,9 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
         listData: draftRow.listData,
         attachments: [],
         // Concurrency token — pass as expectedRevision to ofw_save_draft /
-        // ofw_delete_draft to assert you are editing THIS version.
+        // ofw_delete_draft / ofw_send_message to assert you are acting on
+        // THIS version.
         revision: draftRevision(draftRow),
-        // Stable logical identity. Survives the create-then-delete id churn of
-        // editing AND the transition to sent — pass it to ofw_status to ask
-        // "what happened to the thing I was working on?". Null when this draft
-        // was never written through this tool (e.g. authored in the web app).
-        draftKey: (await cache.getDraftLineageById(draftRow.id))?.draftKey ?? null,
         cacheStatus,
         // False = this draft's existence and unsent status are remembered from
         // a cache, not confirmed on OFW. Call ofw_check_freshness before
@@ -41410,16 +41944,19 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     return jsonResponse({ ...withReadState(row), attachments, freshness });
   });
   if (allowSend) server.registerTool("ofw_send_message", {
-    description: "Send a message via OurFamilyWizard. To send an existing draft, pass messageId \u2014 subject/body/recipientIds become optional overrides (missing fields default to the draft's cached values) and the draft is deleted after sending. To send a fresh message, supply subject/body/recipientIds directly. draftId is the legacy spelling of messageId and works the same way. If replyToId is provided, the cache may rewrite it to the latest reply in the same thread (a note is included in the response when this happens). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After sending, the tool re-fetches the message from OFW to populate the local cache and link attachments to the new message id.",
+    description: "Send a message via OurFamilyWizard \u2014 the ONE irreversible operation here, so it carries the strongest guard. TO SEND AN EXISTING DRAFT (the safe default): pass draftId (or messageId \u2014 same thing). The tool re-reads the draft from OFW and sends the SERVER'S version, so what goes out is what is on OurFamilyWizard, not what this session remembers \u2014 subject/body act only as explicit overrides. It is guarded exactly like ofw_save_draft: pass expectedRevision to assert which version you are sending; if the draft changed on OFW since you read it \u2014 or no longer exists (it may already have been SENT) \u2014 the send is REFUSED with the current server content echoed back, and nothing goes out. RECIPIENTS: OurFamilyWizard does not persist recipients on drafts, so recipientIds is usually still required at send time (ids from ofw_get_profile). After the send is CONFIRMED (OFW returned the new message id and the re-fetched sent record matches what was posted), the source draft is deleted automatically; pass deleteDraftOnSuccess:false to keep it. On ANY failure or ambiguity the draft is never deleted \u2014 the response carries draftRetained:true with the reason. TO COMPOSE FROM SCRATCH: supply subject/body/recipientIds with no draftId. If replyToId is provided (or inherited from the draft), the cache may rewrite it to the latest reply in the same thread (a note is included when this happens). ATTACHMENTS: when sending by draftId, the server draft's own attachments carry over automatically; myFileIDs (from ofw_upload_attachment) overrides or attaches files on a fresh compose. The response leads with sentMessageId and the stable draftKey, and reports threaded (whether OFW actually linked the reply) and draftDeleted.",
     annotations: { destructiveHint: true },
     inputSchema: {
-      subject: external_exports.string().describe("Message subject. Required unless messageId/draftId references a cached draft.").optional(),
-      body: external_exports.string().describe("Message body text. Required unless messageId/draftId references a cached draft.").optional(),
-      recipientIds: external_exports.array(external_exports.number()).describe("Array of recipient user IDs (get from ofw_get_profile). Required unless messageId/draftId references a cached draft.").optional(),
-      replyToId: external_exports.number().describe("ID of the message being replied to").optional(),
-      messageId: external_exports.number().describe("ID of an existing draft to send. When set, missing subject/body/recipientIds default to the draft's cached values, and the draft is deleted after sending.").optional(),
-      draftId: external_exports.number().describe("Legacy synonym for messageId. If both are passed they must be equal.").optional(),
-      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment) to attach to the message").optional()
+      subject: external_exports.string().describe("Message subject. Required unless draftId/messageId is given (then it overrides the server draft's subject).").optional(),
+      body: external_exports.string().describe("Message body text. Required unless draftId/messageId is given (then it overrides the server draft's body \u2014 omit it to send exactly what is on OurFamilyWizard).").optional(),
+      recipientIds: external_exports.array(external_exports.number()).describe("Array of recipient user IDs (get from ofw_get_profile). Usually required even when sending a draft: OurFamilyWizard does not persist recipients on drafts.").optional(),
+      replyToId: external_exports.number().describe("ID of the message being replied to. Defaults to the draft's stored reply target when sending by draftId.").optional(),
+      draftId: external_exports.number().describe("ID of an existing draft to send. The draft is re-read from OurFamilyWizard and its SERVER content is sent; missing subject/body default from it. Guarded: a draft that changed since you read it, or that was already sent/deleted, refuses rather than sending blind.").optional(),
+      messageId: external_exports.number().describe("Synonym for draftId (if both are passed they must be equal).").optional(),
+      expectedRevision: external_exports.string().describe('With draftId: the `revision` from ofw_list_drafts / ofw_get_message / ofw_check_freshness for that draft. Asserts you are sending THAT version; if the draft changed on OFW since, the send is refused and the current server content returned. Omit and the tool compares the server against the local cache instead \u2014 omitting never means "send whatever is there now".').optional(),
+      deleteDraftOnSuccess: external_exports.boolean().describe("Default true. Delete the source draft after \u2014 and ONLY after \u2014 the send is confirmed (new message id returned and the re-fetched sent record checks out). Set false to keep the draft. On a failed or unverifiable send the draft is ALWAYS kept, regardless of this flag.").optional(),
+      force: external_exports.boolean().describe("Default false. Send even when the draft changed on OurFamilyWizard since you read it, or its current state could not be read. Only use after showing the user the conflict.").optional(),
+      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment) to attach to the message. When sending by draftId, omit it to carry the server draft's own attachments over; passing it overrides them.").optional()
     }
   }, async (args) => {
     if (args.messageId !== void 0 && args.draftId !== void 0 && args.messageId !== args.draftId) {
@@ -41427,37 +41964,51 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     }
     const draftRef = args.messageId ?? args.draftId;
     const cache = cacheProvider();
+    const deleteOnSuccess = args.deleteDraftOnSuccess ?? true;
     let subject = args.subject;
     let body = args.body;
     let recipientIds = args.recipientIds;
     let draftReplyToId = null;
-    let draftLookupAttempted = false;
-    let draftFound = false;
+    let guardNote = null;
+    let serverDraft;
     if (draftRef !== void 0) {
-      draftLookupAttempted = true;
-      const draft = await cache.getDraft(draftRef);
-      if (draft !== null) {
-        draftFound = true;
-        subject = subject ?? draft.subject;
-        body = body ?? draft.body;
-        recipientIds = recipientIds ?? draft.recipients.map((r) => r.userId);
-        draftReplyToId = draft.replyToId;
+      const cachedDraft = await cache.getDraft(draftRef);
+      const needsContent = subject === void 0 || body === void 0 || recipientIds === void 0;
+      if (needsContent || deleteOnSuccess) {
+        const guard = await guardDestructiveDraftOp({
+          cache,
+          draftId: draftRef,
+          expectedRevision: args.expectedRevision,
+          force: args.force ?? false,
+          action: "send"
+        });
+        if (!guard.ok) return guard.response;
+        guardNote = guard.note;
+        serverDraft = guard.server;
+      }
+      const base = serverDraft ?? cachedDraft;
+      if (base != null) {
+        subject = subject ?? base.subject;
+        body = body ?? base.body;
+        draftReplyToId = base.replyToId;
+      }
+      if (recipientIds === void 0) {
+        const source = [serverDraft ?? null, cachedDraft].find(
+          (s) => s !== null && s !== void 0 && s.recipients.some((r) => r.userId !== 0)
+        );
+        if (source != null) {
+          recipientIds = [...new Set(source.recipients.map((r) => r.userId).filter((id) => id !== 0))];
+        }
       }
     }
     if (subject === void 0 || body === void 0 || recipientIds === void 0) {
-      if (draftLookupAttempted && !draftFound) {
-        throw new Error(
-          `draft ${draftRef} not found in local cache. Call ofw_sync_messages first, or supply subject/body/recipientIds explicitly.`
-        );
-      }
       const missing = [
         subject === void 0 ? "subject" : null,
         body === void 0 ? "body" : null,
         recipientIds === void 0 ? "recipientIds" : null
       ].filter((n) => n !== null).join(", ");
-      throw new Error(
-        `ofw_send_message requires ${missing}. Pass it directly, or pass messageId to default missing fields from a cached draft.`
-      );
+      const hint = draftRef === void 0 ? "Pass them directly, or pass draftId to send an existing draft." : missing === "recipientIds" ? `Draft ${draftRef} carries no stored recipients \u2014 OurFamilyWizard does not persist recipients on drafts, so they must be supplied at send time. Get the co-parent's user id from ofw_get_profile and pass recipientIds.` : `Draft ${draftRef}'s content was not readable from OurFamilyWizard or the local cache, so it cannot supply the missing fields. Pass them explicitly.`;
+      throw new Error(`ofw_send_message requires ${missing}. ${hint}`);
     }
     const requestedReplyTo = args.replyToId ?? draftReplyToId ?? null;
     let resolvedReplyTo = requestedReplyTo;
@@ -41471,7 +42022,7 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
       const parent = await cache.getMessage(resolvedReplyTo);
       chainRootId = parent?.chainRootId ?? parent?.id ?? requestedReplyTo;
     }
-    const myFileIDs = args.myFileIDs ?? [];
+    const myFileIDs = args.myFileIDs ?? serverDraft?.files ?? [];
     const { id: newId, detail, raw } = await postMessageAndRefetch(client2, {
       subject,
       body,
@@ -41484,19 +42035,51 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     let persisted = null;
     let verifyNote = null;
     let sentDraftKey = null;
+    let threaded = false;
+    let threadNote = null;
     if (newId !== null) {
       verifyNote = verifyWriteLanded("message", { subject, body }, detail);
+      const echoed = threadedReplyTo(detail);
+      if (resolvedReplyTo === null) {
+        threaded = reportsThreaded(detail);
+      } else if (reportsThreaded(detail)) {
+        threaded = true;
+        if (echoed !== null && echoed !== resolvedReplyTo) {
+          threadNote = `NOTE: the sent message threads to ${echoed}, not the requested ${resolvedReplyTo} \u2014 OurFamilyWizard re-targeted the reply within the thread.`;
+        }
+      } else if (reportsUnthreaded(detail)) {
+        threaded = false;
+        threadNote = `WARNING: the sent message came back UNTHREADED \u2014 replyToId ${resolvedReplyTo} was posted but OurFamilyWizard reports no reply linkage on the sent record, so it went out as a new top-level conversation. Verify on ourfamilywizard.com.`;
+      } else {
+        threaded = true;
+      }
+      const storedRecipients = mapRecipients(detail.recipients);
+      if (Array.isArray(detail.recipients) && detail.recipients.length > 0) {
+        const landed = new Set(storedRecipients.map((r) => r.userId));
+        const missingRecipients = recipientIds.filter((rid) => !landed.has(rid));
+        if (missingRecipients.length > 0) {
+          verifyNote = [
+            verifyNote,
+            `WARNING: the sent record does not list requested recipient id(s) ${missingRecipients.join(", ")}, so the send could not be fully confirmed. Verify on ourfamilywizard.com.`
+          ].filter((n) => n !== null).join("\n\n");
+        }
+      }
       persisted = {
         id: newId,
         folder: "sent",
         subject: detail.subject ?? subject,
         fromUser: detail.from?.name ?? "",
         sentAt: detail.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
-        recipients: mapRecipients(detail.recipients),
+        recipients: storedRecipients,
         body: detail.body ?? body,
         fetchedBodyAt: (/* @__PURE__ */ new Date()).toISOString(),
-        replyToId: resolvedReplyTo,
-        chainRootId,
+        // Prefer OFW's own echo of where the reply landed; keep what was
+        // posted when OFW echoed nothing (sent rows feed findLatestReplyTip,
+        // and a null would break the chain for a message that IS threaded).
+        // A positively UNTHREADED send stores null — the chain link OFW says
+        // does not exist must not be invented.
+        replyToId: threaded ? echoed ?? resolvedReplyTo : null,
+        chainRootId: threaded ? chainRootId : null,
         listData: detail
       };
       await cache.upsertMessage(persisted);
@@ -41524,16 +42107,43 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
       }
     }
     let unconfirmedNote = null;
+    let draftDeleted = false;
+    let draftRetainedReason = null;
     if (newId === null) {
       const draftClause = draftRef !== void 0 ? `Draft ${draftRef} was NOT deleted \u2014 check` : "Check";
       unconfirmedNote = `WARNING: OFW's send response did not include a message id, so the send could not be confirmed. ${draftClause} ourfamilywizard.com to see whether the message went out before retrying.`;
+      if (draftRef !== void 0) {
+        draftRetainedReason = "the send could not be confirmed (OFW returned no message id), so the draft is your only reliable copy of the message";
+      }
     } else if (draftRef !== void 0) {
-      await deleteOFWMessages(client2, [draftRef]);
-      await cache.deleteDraft(draftRef);
+      if (verifyNote !== null) {
+        draftRetainedReason = "the sent record could not be fully verified against what was posted (see WARNING above) \u2014 the draft is kept until you confirm the send on ourfamilywizard.com";
+      } else if (!deleteOnSuccess) {
+        draftRetainedReason = "deleteDraftOnSuccess:false \u2014 kept by request";
+      } else {
+        try {
+          await deleteOFWMessages(client2, [draftRef]);
+          await cache.deleteDraft(draftRef);
+          draftDeleted = true;
+        } catch (e) {
+          draftRetainedReason = `the send succeeded but the draft delete failed (${e.message}) \u2014 remove it with ofw_delete_draft once you have verified the sent message`;
+        }
+      }
     }
-    const responseObj = persisted === null ? raw : { ...persisted, ...sentDraftKey !== null ? { draftKey: sentDraftKey, previousId: draftRef } : {} };
+    const retainNote = draftRef !== void 0 && newId !== null && !draftDeleted ? `NOTE: draft ${draftRef} was retained: ${draftRetainedReason}.` : null;
+    const responseObj = persisted === null ? draftRef !== void 0 ? { sendConfirmed: false, draftDeleted: false, draftRetained: true, draftRetainedReason, raw } : raw : {
+      sentMessageId: newId,
+      draftKey: sentDraftKey,
+      threaded,
+      ...draftRef !== void 0 ? {
+        draftDeleted,
+        ...draftDeleted ? {} : { draftRetained: true, draftRetainedReason },
+        previousId: draftRef
+      } : {},
+      ...persisted
+    };
     const text = responseObj ? JSON.stringify(responseObj, null, 2) : "Message sent successfully.";
-    const notes = [rewriteNote, verifyNote, unconfirmedNote].filter((n) => n !== null).join("\n\n");
+    const notes = [guardNote, rewriteNote, verifyNote, threadNote, unconfirmedNote, retainNote].filter((n) => n !== null).join("\n\n");
     return textResponse(notes ? `${notes}
 
 ${text}` : text);
@@ -41553,7 +42163,7 @@ ${text}` : text);
     } catch (e) {
       const reason = e.message;
       if (force) {
-        return { ok: true, note: `WARNING: force:true \u2014 proceeded with ${action} on draft ${draftId} even though its current state could not be read from OurFamilyWizard (${reason}). Any newer server-side version was destroyed and is NOT recoverable from this response.` };
+        return { ok: true, note: `WARNING: force:true \u2014 proceeded with ${action} on draft ${draftId} even though its current state could not be read from OurFamilyWizard (${reason}). Any newer server-side version was destroyed and is NOT recoverable from this response.`, server: void 0 };
       }
       return {
         ok: false,
@@ -41568,7 +42178,7 @@ ${text}` : text);
     const verdict = checkDraftFreshness({ server: server2, cached: cached2, expectedRevision });
     if (verdict.verdict === "FRESH") {
       const note = verdict.metadataOnly ? `NOTE: draft ${draftId} was treated as current for this ${action}. Since you read it, OurFamilyWizard normalized connector-authored metadata (${verdict.changedFields.join(", ")}); the subject, body and recipients are unchanged, so this is not a conflict.` : null;
-      return { ok: true, note };
+      return { ok: true, note, server: server2 };
     }
     if (force) {
       console.error(`[ofw-mcp] WARNING: force:true overrode a ${verdict.verdict} verdict on draft ${draftId} (${action}). ${verdict.reason}`);
@@ -41581,7 +42191,8 @@ ${JSON.stringify(
           { overwrittenServerDraft: server2 === null ? null : { ...server2, revision: draftRevision(server2) } },
           null,
           2
-        )}`
+        )}`,
+        server: server2
       };
     }
     return {
@@ -41596,17 +42207,31 @@ ${JSON.stringify(
     };
   }
   server.registerTool("ofw_list_drafts", {
-    description: 'List draft messages from the local OurFamilyWizard cache. Returns an explicit `complete` boolean describing the RESULT SET: true means "these are ALL the drafts on OurFamilyWizard as of freshness.asOf" \u2014 check it before saying "you have N drafts". Each draft carries its `draftKey` (stable across the create-then-delete churn of editing) when one is known. An empty result from a cache that is not verified-fresh is REFUSED (result:"UNVERIFIED_EMPTY"); pass autoRefresh:true to sync and answer instead. For a live, one-call answer prefer ofw_status(includeDraftInventory:true).',
+    description: 'List draft messages, verified against OurFamilyWizard in ONE call: when the local drafts cache is not verified-fresh, a cheap drafts sync runs first by default (verify:true), so the answer is server-confirmed without a second call. Pass verify:false to answer purely from the cache (no OFW requests). Returns an explicit `complete` boolean describing the RESULT SET: true means "these are ALL the drafts on OurFamilyWizard as of freshness.asOf" \u2014 check it before saying "you have N drafts". Each draft carries its `draftKey` (stable across the create-then-delete churn of editing) when one is known. An empty result from a cache that is not verified-fresh is REFUSED (result:"UNVERIFIED_EMPTY"); pass autoRefresh:true to sync and answer instead.',
     annotations: { readOnlyHint: false },
     inputSchema: {
       page: external_exports.number().int().min(1).describe("Page number (default 1)").optional(),
       size: external_exports.number().int().min(1).describe("Drafts per page (default 50)").optional(),
+      verify: external_exports.boolean().describe("Default true: when the drafts cache is not verified-fresh, run a drafts sync first (cheap \u2014 one list page plus one detail per draft) so the response is server-confirmed in one call. Set false to serve straight from the local cache with no OFW requests.").optional(),
       autoRefresh: external_exports.boolean().describe(AUTO_REFRESH_DESC).optional()
     }
   }, async (args) => {
     const page = args.page ?? 1;
     const size = args.size ?? 50;
     const cache = cacheProvider();
+    let autoVerified = false;
+    let verifyNote = null;
+    if (args.verify ?? true) {
+      const { cacheStatus } = await draftsFreshness(cache);
+      if (cacheStatus !== "fresh") {
+        try {
+          await syncAll(client2, { folders: ["drafts"], maxRequests: getSyncMaxRequests() }, cache);
+          autoVerified = await getDraftsCacheStatus(cache) === "fresh";
+        } catch (e) {
+          verifyNote = `The automatic drafts verification could not reach OurFamilyWizard (${e.message}). Answering from the local cache \u2014 the freshness block below labels its age, and an empty result will still be refused rather than reported as an absence.`;
+        }
+      }
+    }
     const { value, refreshed, unverifiedEmpty } = await guardedCacheRead({
       client: client2,
       cache,
@@ -41637,7 +42262,7 @@ ${JSON.stringify(
         freshness: value.freshness,
         refreshed,
         remedy: 'Call ofw_sync_messages(folders:["drafts"]) and retry, re-call with autoRefresh:true, or use ofw_status(includeDraftInventory:true) for a single live answer.',
-        extra: { page, size }
+        extra: { page, size, ...verifyNote !== null ? { verifyNote } : {} }
       });
     }
     const { drafts, total, freshness, serverConfirmed } = value;
@@ -41656,10 +42281,16 @@ ${JSON.stringify(
     if (refreshed) {
       payload.autoRefreshed = true;
     }
+    if (autoVerified) {
+      payload.autoVerified = true;
+    }
+    if (verifyNote !== null) {
+      payload.verifyNote = verifyNote;
+    }
     return jsonResponse(payload);
   });
   if (allowDrafts) server.registerTool("ofw_save_draft", {
-    description: "Save a message as a draft in OurFamilyWizard. Recipients are optional. Pass messageId to replace an existing draft \u2014 note that under the hood this creates a NEW draft and deletes the old one (OFW's update-in-place endpoint silently no-ops while echoing the posted body, so we don't use it); the response.id will be the NEW id, not the messageId you passed, and the change is documented in a transparency NOTE in the response that also lists which fields (subject/body/recipients/replyToId/attachments) were carried over. If replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included in response). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After saving, the tool re-fetches the draft from OFW to populate the local cache from authoritative server state, and the returned `revision` reflects that authoritative state (so it will match on your next edit). FIELD PRESERVATION: the response echoes the effective threading (replyToId/inReplyTo) and, whenever OFW did not carry over a requested replyToId, recipient or attachment, a `warnings[]` entry naming what was dropped \u2014 never a silent null. SAFETY: because replacing DESTROYS the old draft rather than merging, passing messageId first re-reads that draft from OFW and REFUSES the write if its subject/body/recipients changed since you read it (drafts edited in the OFW web app do not bump any timestamp, so the local cache can be silently behind). A pure replyToId normalization by OFW is NOT treated as a conflict. The refusal returns the current server body under serverBody \u2014 merge your edit into it and retry with expectedRevision.",
+    description: "Save a message as a draft in OurFamilyWizard. RECIPIENTS: OurFamilyWizard does NOT persist recipients on drafts \u2014 recipientIds are accepted but the saved draft comes back with none (documented OFW behavior, noted once in the response, not warned about; supply recipientIds at send time instead). IDENTITY: the response leads with `draftKey`, the stable identity that survives editing \u2014 key off it, because the `id` changes on EVERY edit (replacing a draft creates a NEW draft and deletes the old one; OFW's update-in-place endpoint silently no-ops, so we never use it). Pass messageId to replace an existing draft; the response.id will be the NEW id, and a transparency NOTE documents the swap and which fields were carried over. THREADING: if replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included). The threading verdict is read from OFW's full echo (replyToId/inReplyTo/showContext) \u2014 a warning appears ONLY when the reply linkage was genuinely dropped or re-targeted, and the response's top-level replyToId/inReplyTo always agree with its listData. Attach files via myFileIDs (from ofw_upload_attachment). After saving, the tool re-fetches the draft from OFW, and the returned `revision` reflects that authoritative state (so it will match on your next edit). SAFETY: because replacing DESTROYS the old draft rather than merging, passing messageId first re-reads that draft from OFW and REFUSES the write if its subject/body/recipients changed since you read it (drafts edited in the OFW web app do not bump any timestamp, so the local cache can be silently behind). A pure replyToId normalization by OFW is NOT treated as a conflict. The refusal returns the current server body under serverBody \u2014 merge your edit into it and retry with expectedRevision.",
     annotations: { readOnlyHint: false },
     inputSchema: {
       subject: external_exports.string().describe("Message subject"),
@@ -41713,12 +42344,13 @@ ${JSON.stringify(
     let persisted = null;
     let replaceNote = null;
     let verifyNote = null;
+    let recipientsNote = null;
     let newRevision = null;
     let draftKey = null;
     const warnings = [];
     if (newId !== null) {
       verifyNote = verifyWriteLanded("draft", { subject: args.subject, body: args.body }, detail);
-      const effectiveReplyTo = detail.replyToId ?? null;
+      const effectiveReplyTo = threadedReplyTo(detail);
       const storedRecipients = mapRecipients(detail.recipients);
       persisted = {
         id: newId,
@@ -41754,17 +42386,23 @@ ${JSON.stringify(
         previousId: args.messageId ?? null,
         recordedAt: now
       });
-      if (resolvedReplyTo !== null && effectiveReplyTo !== resolvedReplyTo) {
+      if (resolvedReplyTo !== null && effectiveReplyTo !== resolvedReplyTo && reportsUnthreaded(detail)) {
+        const rewrittenFrom = requestedReplyTo !== resolvedReplyTo ? ` (rewritten from ${requestedReplyTo})` : "";
+        warnings.push(
+          `replyToId was requested as ${resolvedReplyTo}${rewrittenFrom} but the saved draft came back with replyToId null \u2014 OurFamilyWizard did not thread this draft (its inReplyTo/showContext are empty). The subject and body were saved; only the reply linkage was dropped. If threading matters, verify on ourfamilywizard.com.`
+        );
+      } else if (resolvedReplyTo !== null && effectiveReplyTo !== null && effectiveReplyTo !== resolvedReplyTo) {
         const rewrittenFrom = requestedReplyTo !== resolvedReplyTo ? ` (rewritten from ${requestedReplyTo})` : "";
-        const outcome = effectiveReplyTo === null ? "OurFamilyWizard did not thread this draft (its inReplyTo/showContext will be empty). The subject and body were saved; only the reply linkage was dropped." : `OurFamilyWizard re-targeted the reply to message ${effectiveReplyTo} instead. The draft IS threaded \u2014 to that message, not the one requested \u2014 and the inReplyTo in this response reflects where it actually landed.`;
         warnings.push(
-          `replyToId was requested as ${resolvedReplyTo}${rewrittenFrom} but the saved draft came back with replyToId ${effectiveReplyTo === null ? "null" : effectiveReplyTo} \u2014 ${outcome} If threading matters, verify on ourfamilywizard.com.`
+          `replyToId was requested as ${resolvedReplyTo}${rewrittenFrom} but the saved draft came back with replyToId ${effectiveReplyTo} \u2014 OurFamilyWizard re-targeted the reply to message ${effectiveReplyTo} instead. The draft IS threaded \u2014 to that message, not the one requested. If threading matters, verify on ourfamilywizard.com.`
         );
       }
-      if (args.recipientIds !== void 0 && Array.isArray(detail.recipients)) {
+      if (args.recipientIds !== void 0 && args.recipientIds.length > 0 && Array.isArray(detail.recipients)) {
         const requested = [...new Set(args.recipientIds)].sort((a, b) => a - b);
         const stored = [...new Set(storedRecipients.map((r) => r.userId))].sort((a, b) => a - b);
-        if (requested.join(",") !== stored.join(",")) {
+        if (stored.length === 0) {
+          recipientsNote = "NOTE: OurFamilyWizard does not persist recipients on drafts \u2014 the recipientIds you passed were accepted but are not stored on the draft (documented OFW behavior, not an error; it also means a draft cannot be sent by accident). Supply recipientIds when you send: ofw_send_message requires them when the draft carries none.";
+        } else if (requested.join(",") !== stored.join(",")) {
           warnings.push(
             `recipientIds were requested as [${requested.join(", ")}] but the saved draft has [${stored.join(", ")}]. Verify the recipients on ourfamilywizard.com.`
           );
@@ -41783,28 +42421,26 @@ ${JSON.stringify(
         try {
           await deleteOFWMessages(client2, [args.messageId]);
           await cache.deleteDraft(args.messageId);
-          replaceNote = `NOTE: ofw_save_draft replaced draft ${args.messageId} via create-then-delete. The new draft id is ${newId}; the old draft has been deleted. (OFW's update-in-place endpoint silently no-ops on subsequent updates, so we never use it. If you cached the old id anywhere, replace it with the new one.) Fields carried over to the new draft: subject, body, recipients (${persisted.recipients.length}), replyToId (${persisted.replyToId === null ? "none" : persisted.replyToId}), attachments (${myFileIDs.length}).${warnings.length > 0 ? " See warnings above for any field OurFamilyWizard did not carry over." : ""}`;
+          replaceNote = `NOTE: ofw_save_draft replaced draft ${args.messageId} via create-then-delete. The new draft id is ${newId}; the old draft has been deleted. The draftKey is UNCHANGED \u2014 key off it rather than the volatile id, which changes on every edit. (OFW's update-in-place endpoint silently no-ops on subsequent updates, so we never use it.) Fields carried over to the new draft: subject, body, recipients (${persisted.recipients.length}), replyToId (${persisted.replyToId === null ? "none" : persisted.replyToId}), attachments (${myFileIDs.length}).${warnings.length > 0 ? " See warnings above for any field OurFamilyWizard did not carry over." : ""}`;
         } catch (e) {
           replaceNote = `WARNING: New draft ${newId} was created successfully, but the old draft ${args.messageId} could NOT be deleted: ${e.message}. BOTH drafts now exist on OurFamilyWizard and nothing was lost. Verify ${newId} reads correctly, then remove ${args.messageId} with ofw_delete_draft.`;
         }
       }
     }
     const responseObj = persisted !== null ? {
+      draftKey,
+      revision: newRevision,
       ...persisted,
       inReplyTo: persisted.replyToId,
-      revision: newRevision,
-      // The id above is volatile — it changes on every edit. `draftKey` is
-      // not: pass it to ofw_status to resolve the chain's CURRENT id, or to
-      // find out that the draft was sent and when.
-      draftKey,
       previousId: args.messageId ?? null,
       cacheStatus: "fresh",
       serverConfirmed: true,
-      ...warnings.length > 0 ? { warnings } : {}
+      ...warnings.length > 0 ? { warnings } : {},
+      ...recipientsNote !== null ? { recipientsNote } : {}
     } : raw;
     const text = responseObj ? JSON.stringify(responseObj, null, 2) : "Draft saved.";
     const warnNote = warnings.length > 0 ? `WARNING: ${warnings.join("\n\n")}` : null;
-    const notes = [forceNote, rewriteNote, verifyNote, warnNote, replaceNote].filter((n) => n !== null).join("\n\n");
+    const notes = [forceNote, rewriteNote, verifyNote, warnNote, recipientsNote, replaceNote].filter((n) => n !== null).join("\n\n");
     return textResponse(notes ? `${notes}
 
 ${text}` : text);
@@ -41988,9 +42624,9 @@ ${text}` : text);
     if (args.saveTo) {
       const isDirArg = args.saveTo.endsWith("/") || args.saveTo.endsWith("\\");
       const abs = expandPath2(args.saveTo);
-      dest = isDirArg ? join5(abs, `${fileId}-${safeName}`) : abs;
+      dest = isDirArg ? join6(abs, `${fileId}-${safeName}`) : abs;
     } else {
-      dest = join5(getAttachmentsDir(), `${fileId}-${safeName}`);
+      dest = join6(getAttachmentsDir(), `${fileId}-${safeName}`);
     }
     const extractOnDisk = args.extract === true;
     if (!args.force && cached2.downloadedPath === dest) {
@@ -43094,7 +43730,7 @@ var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
 await runMcp({
   name: "ofw",
-  version: "2.9.2",
+  version: "2.10.1",
   // x-release-please-version
   deps: client,
   tools: [