@chrischall/office-outlook-mcp 0.6.0 → 0.6.1

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Outlook / Microsoft 365 — mail, calendar, contacts and tasks via natural language",
-    "version": "0.6.0"
+    "version": "0.6.1"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Outlook (Microsoft 365)",
       "source": "./",
       "description": "MCP server for Outlook / Microsoft 365 — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/mcp.json

@@ -1,8 +1,8 @@
 {
   "mcpServers": {
     "outlook": {
-      "command": "node",
-      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/bundle.js"],
+      "command": "npx",
+      "args": ["-y", "@chrischall/office-outlook-mcp"],
       "env": {
         "OUTLOOK_ACCESS_TOKEN": "${OUTLOOK_ACCESS_TOKEN}"
       }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "office-outlook-mcp",
   "displayName": "Outlook (Microsoft 365)",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Outlook / Microsoft 365 for Claude — triage unread mail, reply, answer meeting invites and schedule meetings, plus folders, calendar, contacts and tasks, with confirmation before anything is sent, using your signed-in browser session",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -119,8 +119,9 @@ Everything is optional — with nothing set, the server captures from the browse
 `outlook_update_message`, `outlook_move_message`, `outlook_create_event`,
 `outlook_update_event`, `outlook_respond_to_invite`, `outlook_delete_event`,
 `outlook_reply`.
-Three skip the confirmation when nothing reaches anyone else:
-`outlook_reply` with `draftOnly: true` (the reply stays in Drafts),
+Some skip the confirmation because nothing reaches anyone else:
+`outlook_create_draft` (the draft stays in Drafts until you send it from
+Outlook), `outlook_reply` with `draftOnly: true` (the reply stays in Drafts),
 `outlook_respond_to_invite` with `sendResponse: false`, and
 `outlook_delete_event` on your own appointment with no attendees or on a
 meeting the organizer already cancelled (in each, only your calendar
@@ -129,9 +130,12 @@ changes).
 **Meetings** — `outlook_find_meeting_times` asks Outlook's Scheduling
 Assistant for slots when everyone is free, and `outlook_get_schedule` shows
 each person's busy blocks. Each suggested slot carries `createEventArgs`,
-which `outlook_create_event` accepts unchanged. `outlook_create_event` and
-`outlook_update_event` attach a Microsoft Teams meeting by default and return
-its join link; pass `teamsMeeting: false` to leave it off. Only the organizer
+which `outlook_create_event` accepts unchanged. `outlook_create_event`
+attaches a Microsoft Teams meeting by default and returns its join link; pass
+`teamsMeeting: false` to leave it off. `outlook_update_event` never changes how
+people join a meeting unless asked: pass `teamsMeeting: true` to add a Teams
+meeting to an event that lacks one, and the confirmation says so in plain
+words. Only the organizer
 can update a meeting. `outlook_respond_to_invite` accepts, tentatively accepts
 or declines an invite, by its message id or its event id.
 `outlook_delete_event` deletes an event you organize — one occurrence by the
@@ -217,7 +221,8 @@ or repeated across pages, and marking mail read between pages loses nothing.
 ## Confirmations
 
 Every write asks you to confirm before anything is sent or changed (except a
-draft-only reply and a silent invite response — see [Tools](#tools)). A client
+new draft, a draft-only reply and a silent invite response — see
+[Tools](#tools)). A client
 that can show a confirmation prompt (Claude Code) shows one. On a client that
 cannot, the first call does nothing and returns a `confirmation-required`
 preview plus a `confirmToken`; only a repeat call with that token performs the

package/dist/bundle.js

@@ -248,6 +248,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -671,6 +672,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -2234,7 +2247,7 @@ var init_versions = __esm({
     version = {
       major: 4,
       minor: 6,
-      patch: 5
+      patch: 7
     };
   }
 });
@@ -2396,6 +2409,28 @@ function isValidJWT(token, algorithm = null) {
     return false;
   }
 }
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -2896,7 +2931,7 @@ function handleRefineResult(result, payload, input2, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-var $ZodType, toStandardResult, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT, URL_UNPARSEABLE, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodCreditCard, $ZodIBAN, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodPreprocess, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom;
+var $ZodType, toStandardResult, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT, URL_UNPARSEABLE, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodMAC, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, CC_SANITIZE, $ZodCreditCard, $ZodIBAN, $ZodJWT, $ZodCustomStringFormat, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodBigInt, $ZodBigIntFormat, $ZodSymbol, $ZodUndefined, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodVoid, $ZodDate, arraySize, mapSize, setSize, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodXor, $ZodDiscriminatedUnion, $ZodIntersection, $ZodTuple, $ZodRecord, $ZodMap, $ZodSet, $ZodEnum, $ZodLiteral, $ZodFile, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodSuccess, $ZodCatch, $ZodNaN, $ZodPipe, $ZodCodec, $ZodPreprocess, $ZodReadonly, $ZodTemplateLiteral, $ZodFunction, $ZodPromise, $ZodLazy, $ZodCustom;
 var init_schemas = __esm({
   "node_modules/zod/v4/core/schemas.js"() {
     init_checks();
@@ -3503,6 +3538,9 @@ var init_schemas = __esm({
         return payload;
       };
     });
+    arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+    mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+    setSize = (input2) => input2 instanceof Set ? input2.size : -1;
     $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
       $ZodType.init(inst, def);
       const memo3 = globalConfig.memoizer;
@@ -3540,6 +3578,7 @@ var init_schemas = __esm({
         }
         return payload;
       };
+      capSize(inst, arraySize);
     });
     NO_SYMBOL_KEYS = [];
     $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
@@ -4178,6 +4217,7 @@ var init_schemas = __esm({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize(inst, mapSize);
     });
     $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       $ZodType.init(inst, def);
@@ -4214,6 +4254,7 @@ var init_schemas = __esm({
           return Promise.all(proms).then(() => payload);
         return payload;
       };
+      capSize(inst, setSize);
     });
     $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
       $ZodType.init(inst, def);
@@ -14003,9 +14044,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -14405,6 +14452,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -14421,6 +14469,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -35482,7 +35531,7 @@ var init_errors3 = __esm({
       // webhook signing secret (Stripe-style)
     ].map((p) => `\\b${p}`).join("|"), "g");
     GOOGLE_OAUTH_TOKEN_RE = /(?<![A-Za-z0-9+/])(?:ya29\.|1\/\/)[A-Za-z0-9._-]{8,}/g;
-    QUERY_SECRET_RE = new RegExp(`([?&](?:(?:access|refresh|id|auth|session|csrf|xsrf)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|token|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
+    QUERY_SECRET_RE = new RegExp(`([?&#;](?:(?:access|refresh|id|auth|session|csrf|xsrf|api)[_-]?token|client[_-]?secret|api[_-]?secret|api[_-]?key|password|passwd|signature|secret|token|auth|key|sig|(?:code[_-]?)?verifier|(?:php|j)?sess(?:ion)?[_-]?id|sid|x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN})=)[^&#\\s"'<>\`]+`, "gi");
     OAUTH_CODE_RE = /([?&]code=)(?=[^&#\s"'<>`]{16,})[^&#\s"'<>`]+/gi;
     FORM_PASSWORD_RE = /((?:^|[\s,;:"'(\[{])(?:password|passwd)=)[^&#\s"'<>`]+/gim;
     HEADER_SECRET_RE = new RegExp(`(\\b(?:x[-_]${HEADER_NAME_RUN}?(?:api[-_]?key|token|secret|auth)${HEADER_NAME_RUN}|api[-_]?key)\\s*:\\s*)[^\\s,;"'<>\`]+`, "gi");
@@ -35493,6 +35542,8 @@ var init_errors3 = __esm({
       "api[_-]?secret",
       "(?:x[_-])?api[_-]?key",
       "private[_-]?key",
+      "aws[_-]?secret[_-]?access[_-]?key",
+      // fleet-audit#1297
       "code[_-]?verifier",
       // PKCE; a bare `verifier` key is too generic for JSON
       `x[_-]${HEADER_NAME_RUN}?(?:api[_-]?key|token|secret|auth)${HEADER_NAME_RUN}`,
@@ -36651,6 +36702,9 @@ var init_headers = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
+function asciiLower(s) {
+  return s.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
 var init_ascii = __esm({
   "node_modules/@chrischall/mcp-utils/dist/internal/ascii.js"() {
   }
@@ -36662,16 +36716,42 @@ var init_code_point = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/internal/tags.js
+var init_tags = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/internal/tags.js"() {
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/scrape/index.js
 function isCloudflareChallenge(html) {
-  return /_cf_chl_opt/.test(html) || /<title[^>]*>\s*Just a moment/i.test(html);
+  return html.includes("_cf_chl_opt") || hasJustAMomentTitle(html);
+}
+function hasJustAMomentTitle(html) {
+  const lower2 = asciiLower(html);
+  let i = 0;
+  for (; ; ) {
+    const open2 = lower2.indexOf("<title", i);
+    if (open2 < 0)
+      return false;
+    const gt = lower2.indexOf(">", open2 + 6);
+    if (gt < 0)
+      return false;
+    let j = gt + 1;
+    while (j < lower2.length && /\s/.test(lower2[j]))
+      j++;
+    if (lower2.startsWith(JUST_A_MOMENT, j))
+      return true;
+    i = gt + 1;
+  }
 }
-var NEXT_DATA_MAX_CHARS;
+var NEXT_DATA_MAX_CHARS, JUST_A_MOMENT;
 var init_scrape = __esm({
   "node_modules/@chrischall/mcp-utils/dist/scrape/index.js"() {
     init_ascii();
     init_code_point();
+    init_tags();
     NEXT_DATA_MAX_CHARS = 16 * 1024 * 1024;
+    JUST_A_MOMENT = "just a moment";
   }
 });
 
@@ -36707,7 +36787,7 @@ var init_net_atoms = __esm({
 // node_modules/@chrischall/mcp-utils/dist/http/body-limit.js
 async function readBytesCapped(res, maxBytes, service, bounded) {
   if (maxBytes !== void 0) {
-    const declared = Number(res.headers.get("content-length") ?? NaN);
+    const declared = Number(responseHeader(res, "content-length") ?? NaN);
     if (Number.isFinite(declared) && declared > maxBytes) {
       cancelStream(res.body);
       throw new ResponseTooLargeError(service, maxBytes);
@@ -36752,6 +36832,7 @@ var ResponseTooLargeError;
 var init_body_limit = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/body-limit.js"() {
     init_errors3();
+    init_headers();
     ResponseTooLargeError = class extends McpToolError {
       maxBytes;
       constructor(service, maxBytes) {
@@ -36831,6 +36912,27 @@ var init_retry_after = __esm({
 });
 
 // node_modules/@chrischall/mcp-utils/dist/http/index.js
+function withoutCredentials(headers, tokenHeader) {
+  const drop = new Set(CROSS_ORIGIN_DROPPED_HEADERS);
+  if (tokenHeader !== void 0)
+    drop.add(tokenHeader.toLowerCase());
+  const out = {};
+  for (const [k, v] of Object.entries(headers))
+    if (!drop.has(k.toLowerCase()))
+      out[k] = v;
+  return out;
+}
+function joinQuery(path, query) {
+  if (!query)
+    return path;
+  const hashAt = path.indexOf("#");
+  const head = hashAt < 0 ? path : path.slice(0, hashAt);
+  const fragment = hashAt < 0 ? "" : path.slice(hashAt);
+  if (!head.includes("?"))
+    return `${head}${query}${fragment}`;
+  const sep = head.endsWith("?") || head.endsWith("&") ? "" : "&";
+  return `${head}${sep}${query.slice(1)}${fragment}`;
+}
 function cancelBody(res) {
   try {
     const body = res.body;
@@ -36959,7 +37061,9 @@ function createApiClient(opts) {
   const retryStatuses = retry.statuses ?? [429];
   const timeoutMs = opts.timeout === false ? 0 : opts.timeout ?? DEFAULT_REQUEST_TIMEOUT_MS;
   const redirectMode = opts.redirect;
-  const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const stripCrossOrigin = redirectMode === void 0 && opts.tokenHeader !== void 0;
+  const manualRedirects = redirectMode === "same-origin" || stripCrossOrigin;
+  const maxRedirects = opts.maxRedirects ?? (stripCrossOrigin ? FETCH_MAX_REDIRECTS : DEFAULT_MAX_REDIRECTS);
   const reportWriteOutcome = opts.writeOutcomeUnknown !== false;
   const defaultMaxBytes = checkMaxBytes("maxResponseBytes", opts.maxResponseBytes);
   if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0) {
@@ -37061,7 +37165,7 @@ function createApiClient(opts) {
         `Refusing request to ${service}: path ${JSON.stringify(path.split(/[?#]/, 1)[0])} contains a ${hazard}, which URL normalisation would rewrite. Build paths with apiPath\`...\` so each value is one encoded segment.`
       );
     }
-    const url2 = `${base}${path}${query}`;
+    const url2 = `${base}${joinQuery(path, query)}`;
     if (baseOrigin === void 0)
       return url2;
     let parsed;
@@ -37075,14 +37179,21 @@ function createApiClient(opts) {
     }
     return url2;
   }
-  function sameOriginHop(location, from) {
-    let next;
+  function resolveLocation(location, from) {
     try {
-      next = new URL(location, from);
+      return new URL(location, from).href;
     } catch {
       throw new RedirectRefusedError(`Refusing redirect from ${service}: the Location header is not a valid URL.`);
     }
-    if (baseOrigin === void 0 || next.origin !== baseOrigin || next.username !== baseParts?.username || next.password !== baseParts?.password) {
+  }
+  function onBaseOrigin(href) {
+    const next = new URL(href);
+    return baseOrigin !== void 0 && next.origin === baseOrigin && next.username === baseParts?.username && next.password === baseParts?.password;
+  }
+  function sameOriginHop(location, from) {
+    const href = resolveLocation(location, from);
+    const next = new URL(href);
+    if (!onBaseOrigin(href)) {
       throw new RedirectRefusedError(`Refusing redirect from ${service} to ${next.origin}: it leaves the base origin ${baseOrigin ?? "(unparseable)"}, and following it would re-send the credential there.`);
     }
     return next.href;
@@ -37092,20 +37203,21 @@ function createApiClient(opts) {
     const query = opt.query ? buildQueryString(opt.query) : "";
     const url2 = resolveUrl(path, query);
     const bodyInit = reqBody !== void 0 ? { body: reqBody } : {};
-    const fetchHop = (hopUrl, hopMethod, withBody, token, signal) => {
+    const fetchHop = (hopUrl, hopMethod, withBody, token, signal, credentialed = true) => {
       if (!signal?.aborted)
         dispatch.sent = true;
+      const headers = {
+        Accept: "application/json",
+        ...withBody && contentType !== void 0 ? { "Content-Type": contentType } : {},
+        ...opts.baseHeaders,
+        ...authHeader(token || void 0),
+        ...opt.headers
+      };
       return doFetch(hopUrl, {
         method: hopMethod,
-        headers: {
-          Accept: "application/json",
-          ...withBody && contentType !== void 0 ? { "Content-Type": contentType } : {},
-          ...opts.baseHeaders,
-          ...authHeader(token || void 0),
-          ...opt.headers
-        },
+        headers: credentialed ? headers : withoutCredentials(headers, opts.tokenHeader),
         ...signal ? { signal } : {},
-        ...redirectMode !== void 0 ? { redirect: redirectMode === "same-origin" ? "manual" : redirectMode } : {},
+        ...manualRedirects ? { redirect: "manual" } : redirectMode !== void 0 ? { redirect: redirectMode } : {},
         ...withBody ? bodyInit : {}
       }).catch((err) => {
         markTransportFailure(err);
@@ -37113,13 +37225,14 @@ function createApiClient(opts) {
       });
     };
     const fetchWith = async (token, signal) => {
-      if (redirectMode !== "same-origin")
+      if (!manualRedirects)
         return fetchHop(url2, method, true, token, signal);
       let hopUrl = url2;
       let hopMethod = method;
       let withBody = true;
+      let credentialed = true;
       for (let hops = 0; ; hops += 1) {
-        const res = await fetchHop(hopUrl, hopMethod, withBody, token, signal);
+        const res = await fetchHop(hopUrl, hopMethod, withBody, token, signal, credentialed);
         const location = REDIRECT_STATUSES.has(res.status) ? responseHeader(res, "location") : void 0;
         if (location === void 0 || location === null)
           return res;
@@ -37127,7 +37240,13 @@ function createApiClient(opts) {
         if (hops >= maxRedirects) {
           throw new RedirectRefusedError(`Refusing request to ${service}: too many redirects (more than ${maxRedirects}).`);
         }
-        hopUrl = sameOriginHop(location, hopUrl);
+        if (stripCrossOrigin) {
+          hopUrl = resolveLocation(location, hopUrl);
+          if (credentialed && !onBaseOrigin(hopUrl))
+            credentialed = false;
+        } else {
+          hopUrl = sameOriginHop(location, hopUrl);
+        }
         if (res.status === 303 || (res.status === 301 || res.status === 302) && hopMethod === "POST") {
           if (hopMethod !== "HEAD")
             hopMethod = "GET";
@@ -37331,7 +37450,7 @@ function decodeJwtExp(token) {
   }
   return exp;
 }
-var DEFAULT_RETRY, defaultSleep, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, REDIRECT_STATUSES, UnauthorizedError, RateLimitedError, RequestTimeoutError, DEFAULT_WRITE_OUTCOME_HINT, WriteOutcomeUnknownError, SAFE_METHODS, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
+var DEFAULT_RETRY, defaultSleep, DEFAULT_REQUEST_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, FETCH_MAX_REDIRECTS, CROSS_ORIGIN_DROPPED_HEADERS, REDIRECT_STATUSES, UnauthorizedError, RateLimitedError, RequestTimeoutError, DEFAULT_WRITE_OUTCOME_HINT, WriteOutcomeUnknownError, SAFE_METHODS, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
 var init_http = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/index.js"() {
     init_headers();
@@ -37351,6 +37470,8 @@ var init_http = __esm({
     defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
     DEFAULT_MAX_REDIRECTS = 5;
+    FETCH_MAX_REDIRECTS = 20;
+    CROSS_ORIGIN_DROPPED_HEADERS = ["authorization", "cookie", "proxy-authorization"];
     REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
     UnauthorizedError = class extends Error {
       status = 401;
@@ -37588,7 +37709,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     PACKAGE_NAME = "office-outlook-mcp";
-    VERSION = "0.6.0";
+    VERSION = "0.6.1";
   }
 });
 
@@ -38143,6 +38264,21 @@ var init_public_suffix = __esm({
   }
 });
 
+// node_modules/@fetchproxy/protocol/dist/ip-literal.js
+function isIpLiteralHost(host) {
+  if (host.includes(":") || host.startsWith("["))
+    return true;
+  const labels = host.split(".");
+  if (labels.length > 1 && labels[labels.length - 1] === "")
+    labels.pop();
+  const last = labels[labels.length - 1] ?? "";
+  return /^[0-9]+$/.test(last) || /^0x[0-9a-f]*$/i.test(last);
+}
+var init_ip_literal = __esm({
+  "node_modules/@fetchproxy/protocol/dist/ip-literal.js"() {
+  }
+});
+
 // node_modules/@fetchproxy/protocol/dist/validate.js
 function assertObject(x, label) {
   if (typeof x !== "object" || x === null || Array.isArray(x)) {
@@ -38592,6 +38728,9 @@ function validateHello(raw) {
       if (!HOSTNAME_RE.test(d)) {
         throw new ProtocolError3(`hello.domains: invalid hostname ${JSON.stringify(d)}`);
       }
+      if (isIpLiteralHost(d)) {
+        throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+      }
       if (isPublicSuffix(d)) {
         throw new ProtocolError3(`hello.domains: ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
       }
@@ -39365,6 +39504,7 @@ var init_validate = __esm({
     init_account_attest();
     init_json_pointer();
     init_public_suffix();
+    init_ip_literal();
     ProtocolError3 = class extends Error {
       constructor(message) {
         super(message);
@@ -39544,6 +39684,7 @@ var init_dist3 = __esm({
     init_seal();
     init_encoding();
     init_public_suffix();
+    init_ip_literal();
     init_json_pointer();
   }
 });
@@ -44514,7 +44655,7 @@ async function startHost(opts) {
             if (ownRetryableRefusal)
               resetSessionPromise();
             resolveOwnSession(ownSession);
-          } else {
+          } else if (identified === "extension" && extensionWs === ws) {
             const slot = peers.get(frame.mcpId);
             if (slot)
               slot.ws.send(JSON.stringify(frame));
@@ -45602,6 +45743,9 @@ var init_ws_server = __esm({
           throw new Error("FetchproxyServer: opts.domains must be a non-empty array of hostnames");
         }
         for (const d of opts.domains) {
+          if (typeof d === "string" && isIpLiteralHost(d)) {
+            throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is an IP address \u2014 declare the site's DNS hostname; IP-literal origins (LAN, loopback, link-local) are not reachable through the bridge`);
+          }
           if (typeof d === "string" && isPublicSuffix(d)) {
             throw new Error(`FetchproxyServer: opts.domains entry ${JSON.stringify(d)} is a public suffix \u2014 declare a registrable domain (e.g. "example.${d}"), not the suffix every site under it shares`);
           }
@@ -47547,8 +47691,10 @@ var init_bulk = __esm({
 });
 
 // node_modules/@fetchproxy/server/dist/bot-wall.js
+var CLOUDFLARE_TITLE_SCAN_MAX;
 var init_bot_wall = __esm({
   "node_modules/@fetchproxy/server/dist/bot-wall.js"() {
+    CLOUDFLARE_TITLE_SCAN_MAX = 64 * 1024;
   }
 });
 
@@ -49928,6 +50074,9 @@ function messageBody(subject, body, html) {
 }
 var TEAMS = { IsOnlineMeeting: true, OnlineMeetingProvider: "TeamsForBusiness" };
 var teamsMeetingParam = external_exports.boolean().optional().describe("Attach a Microsoft Teams meeting (default true). false leaves it off.");
+var addTeamsMeetingParam = external_exports.boolean().optional().describe(
+  "true adds a Microsoft Teams meeting to an event that lacks one (default false: the way people join is left as it is)."
+);
 var EVENT_STATE_SELECT = "Id,Subject,IsOrganizer,Start,End,Location,Attendees,IsOnlineMeeting,OnlineMeetingProvider,OnlineMeeting";
 function attendee(Address, Type) {
   return { Type, EmailAddress: { Address } };
@@ -50077,39 +50226,30 @@ function registerWriteTools(server, client2) {
   server.registerTool(
     "outlook_create_draft",
     {
-      description: "Create a draft message in the Drafts folder without sending it. Returns the created draft, which can be reviewed and sent from Outlook. " + CONFIRM_FLOW_SENTENCE,
-      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+      description: "Create a draft message in the Drafts folder without sending it. Returns the created draft, which can be reviewed and sent from Outlook. It does not ask to confirm: a draft reaches nobody until it is sent from Outlook. Calling it twice leaves two drafts. " + TIMEOUT_SENTENCE,
+      // Self-only and additive, like outlook_reply with draftOnly: nothing is
+      // overwritten or sent. Not idempotent: a repeat creates a second draft.
+      annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       inputSchema: external_exports.object({
         to: recipientList,
         cc: recipientList,
         subject: external_exports.string().describe("Subject line"),
         body: external_exports.string().describe("Message body"),
-        html: external_exports.boolean().optional().describe("Compose the body as HTML (default: plain text)"),
-        confirmToken: confirmTokenParam
+        html: external_exports.boolean().optional().describe("Compose the body as HTML (default: plain text)")
       })
     },
-    async ({ to, cc, subject, body, html, confirmToken }, ctx) => {
+    async ({ to, cc, subject, body, html }) => {
       const payload = {
         ...messageBody(subject, body, html),
         ToRecipients: toRecipients(to),
         ...cc?.length ? { CcRecipients: toRecipients(cc) } : {}
       };
-      const gate = await confirmWrite(ctx, {
-        tool: "outlook_create_draft",
-        action: "mail.create_draft",
-        message: "Review and confirm this draft:",
-        summary: `Create draft "${subject}"`,
-        // One signed-in mailbox per server process.
-        account: void 0,
-        request: { method: "POST", path: "/me/messages", body: payload },
-        confirmToken
-      });
-      if (gate) return gate;
-      const created = await client2.write(
-        "POST",
-        "/me/messages",
-        payload
+      const create = await writeOrUnknown(
+        () => client2.write("POST", "/me/messages", payload),
+        "Drafts"
       );
+      if (!create.ok) return create.result;
+      const created = create.value;
       return minifiedResult({ created: true, Id: created?.Id, WebLink: created?.WebLink });
     }
   );
@@ -50326,7 +50466,7 @@ function registerWriteTools(server, client2) {
   server.registerTool(
     "outlook_update_event",
     {
-      description: "Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting's length. A Microsoft Teams meeting is added if the event lacks one (`teamsMeeting: false` to skip). Attendees are sent an updated invitation. Only the organizer can update a meeting \u2014 an attendee's edit would change their own copy alone, so it is refused. The result is verified by re-reading the event. " + CONFIRM_FLOW_SENTENCE + " " + CONFIRM_INJECTION_RULE,
+      description: "Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting's length. It does not add a Microsoft Teams meeting unless you pass `teamsMeeting: true` (on an event that lacks one). Attendees are sent an updated invitation. Only the organizer can update a meeting \u2014 an attendee's edit would change their own copy alone, so it is refused. The result is verified by re-reading the event. " + CONFIRM_FLOW_SENTENCE + " " + CONFIRM_INJECTION_RULE,
       annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
       inputSchema: external_exports.object({
         id: external_exports.string().min(1).describe("Event Id from outlook_list_events or outlook_get_event"),
@@ -50339,7 +50479,7 @@ function registerWriteTools(server, client2) {
         addAttendees: recipientList.describe("Required attendees to add"),
         addOptionalAttendees: recipientList.describe("Optional attendees to add"),
         removeAttendees: recipientList.describe("Attendees to remove"),
-        teamsMeeting: teamsMeetingParam,
+        teamsMeeting: addTeamsMeetingParam,
         confirmToken: confirmTokenParam
       })
     },
@@ -50392,18 +50532,21 @@ function registerWriteTools(server, client2) {
         }
         payload.Attendees = next;
       }
-      const addTeams = args.teamsMeeting !== false && !(current && isTeams(current));
+      const addTeams = args.teamsMeeting === true && !(current && isTeams(current));
       if (addTeams) Object.assign(payload, TEAMS);
       if (Object.keys(payload).length === 0) {
         throw new McpToolError("Nothing to update.", {
-          hint: "Pass at least one of subject, start, end, location, body, or attendee changes."
+          hint: "Pass at least one of subject, start, end, location, body, attendee changes, or teamsMeeting: true."
         });
       }
       const gate = await confirmWrite(ctx, {
         tool: "outlook_update_event",
         action: "calendar.update_event",
-        message: "Review and confirm this change (attendees are sent an updated invitation):",
-        summary: `Update "${current?.Subject ?? args.id}": ${Object.keys(payload).join(", ")}`,
+        message: addTeams ? "Review and confirm this change (attendees are sent an updated invitation). This will also make it a Microsoft Teams meeting: attendees get a Teams join link." : "Review and confirm this change (attendees are sent an updated invitation):",
+        summary: `Update "${current?.Subject ?? args.id}": ${[
+          Object.keys(payload).filter((k) => !(k in TEAMS)).join(", "),
+          addTeams ? "this will also make it a Microsoft Teams meeting" : ""
+        ].filter((part) => part !== "").join("; ")}`,
         // One signed-in mailbox per server process.
         account: void 0,
         target: args.id,

package/dist/tools/writes.js

@@ -31,6 +31,14 @@ const teamsMeetingParam = z
     .boolean()
     .optional()
     .describe('Attach a Microsoft Teams meeting (default true). false leaves it off.');
+/**
+ * On update the Teams meeting is opt-in: an edit to an in-person meeting (or one
+ * on another provider) must not change how people join it unless asked.
+ */
+const addTeamsMeetingParam = z
+    .boolean()
+    .optional()
+    .describe('true adds a Microsoft Teams meeting to an event that lacks one (default false: the way people join is left as it is).');
 const EVENT_STATE_SELECT = 'Id,Subject,IsOrganizer,Start,End,Location,Attendees,IsOnlineMeeting,OnlineMeetingProvider,OnlineMeeting';
 function attendee(Address, Type) {
     return { Type, EmailAddress: { Address } };
@@ -242,37 +250,32 @@ export function registerWriteTools(server, client) {
         return minifiedResult({ sent: true, subject, recipients: recipients || null });
     });
     server.registerTool('outlook_create_draft', {
-        description: 'Create a draft message in the Drafts folder without sending it. Returns the created draft, which can be reviewed and sent from Outlook.' +
-            ' ' +
-            CONFIRM_FLOW_SENTENCE,
-        annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
+        description: 'Create a draft message in the Drafts folder without sending it. Returns the created draft, which can be reviewed and sent from Outlook. ' +
+            'It does not ask to confirm: a draft reaches nobody until it is sent from Outlook. Calling it twice leaves two drafts. ' +
+            TIMEOUT_SENTENCE,
+        // Self-only and additive, like outlook_reply with draftOnly: nothing is
+        // overwritten or sent. Not idempotent: a repeat creates a second draft.
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
         inputSchema: z.object({
             to: recipientList,
             cc: recipientList,
             subject: z.string().describe('Subject line'),
             body: z.string().describe('Message body'),
             html: z.boolean().optional().describe('Compose the body as HTML (default: plain text)'),
-            confirmToken: confirmTokenParam,
         }),
-    }, async ({ to, cc, subject, body, html, confirmToken }, ctx) => {
+    }, async ({ to, cc, subject, body, html }) => {
         const payload = {
             ...messageBody(subject, body, html),
             ToRecipients: toRecipients(to),
             ...(cc?.length ? { CcRecipients: toRecipients(cc) } : {}),
         };
-        const gate = await confirmWrite(ctx, {
-            tool: 'outlook_create_draft',
-            action: 'mail.create_draft',
-            message: 'Review and confirm this draft:',
-            summary: `Create draft "${subject}"`,
-            // One signed-in mailbox per server process.
-            account: undefined,
-            request: { method: 'POST', path: '/me/messages', body: payload },
-            confirmToken,
-        });
-        if (gate)
-            return gate;
-        const created = await client.write('POST', '/me/messages', payload);
+        // Nothing leaves the mailbox, so there is no one to protect with a
+        // confirmation (same rule as outlook_reply draftOnly). A lost answer
+        // says to look in Drafts before retrying, so a retry does not duplicate.
+        const create = await writeOrUnknown(() => client.write('POST', '/me/messages', payload), 'Drafts');
+        if (!create.ok)
+            return create.result;
+        const created = create.value;
         return minifiedResult({ created: true, Id: created?.Id, WebLink: created?.WebLink });
     });
     server.registerTool('outlook_mark_read', {
@@ -507,7 +510,7 @@ export function registerWriteTools(server, client) {
         });
     });
     server.registerTool('outlook_update_event', {
-        description: 'Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting\'s length. A Microsoft Teams meeting is added if the event lacks one (`teamsMeeting: false` to skip). Attendees are sent an updated invitation. Only the organizer can update a meeting — an attendee\'s edit would change their own copy alone, so it is refused. The result is verified by re-reading the event.' +
+        description: 'Update a meeting you organize: retitle, move, relocate, edit the description, or add/remove attendees. Moving only `start` keeps the meeting\'s length. It does not add a Microsoft Teams meeting unless you pass `teamsMeeting: true` (on an event that lacks one). Attendees are sent an updated invitation. Only the organizer can update a meeting — an attendee\'s edit would change their own copy alone, so it is refused. The result is verified by re-reading the event.' +
             ' ' +
             CONFIRM_FLOW_SENTENCE +
             ' ' +
@@ -530,7 +533,7 @@ export function registerWriteTools(server, client) {
             addAttendees: recipientList.describe('Required attendees to add'),
             addOptionalAttendees: recipientList.describe('Optional attendees to add'),
             removeAttendees: recipientList.describe('Attendees to remove'),
-            teamsMeeting: teamsMeetingParam,
+            teamsMeeting: addTeamsMeetingParam,
             confirmToken: confirmTokenParam,
         }),
     }, async (args, ctx) => {
@@ -603,19 +606,26 @@ export function registerWriteTools(server, client) {
             }
             payload.Attendees = next;
         }
-        const addTeams = args.teamsMeeting !== false && !(current && isTeams(current));
+        const addTeams = args.teamsMeeting === true && !(current && isTeams(current));
         if (addTeams)
             Object.assign(payload, TEAMS);
         if (Object.keys(payload).length === 0) {
             throw new McpToolError('Nothing to update.', {
-                hint: 'Pass at least one of subject, start, end, location, body, or attendee changes.',
+                hint: 'Pass at least one of subject, start, end, location, body, attendee changes, or teamsMeeting: true.',
             });
         }
         const gate = await confirmWrite(ctx, {
             tool: 'outlook_update_event',
             action: 'calendar.update_event',
-            message: 'Review and confirm this change (attendees are sent an updated invitation):',
-            summary: `Update "${current?.Subject ?? args.id}": ${Object.keys(payload).join(', ')}`,
+            message: addTeams
+                ? 'Review and confirm this change (attendees are sent an updated invitation). This will also make it a Microsoft Teams meeting: attendees get a Teams join link.'
+                : 'Review and confirm this change (attendees are sent an updated invitation):',
+            summary: `Update "${current?.Subject ?? args.id}": ${[
+                Object.keys(payload).filter((k) => !(k in TEAMS)).join(', '),
+                addTeams ? 'this will also make it a Microsoft Teams meeting' : '',
+            ]
+                .filter((part) => part !== '')
+                .join('; ')}`,
             // One signed-in mailbox per server process.
             account: undefined,
             target: args.id,

package/dist/version.js

@@ -10,4 +10,4 @@
  * line below and nowhere else — not even in prose.
  */
 export const PACKAGE_NAME = 'office-outlook-mcp';
-export const VERSION = '0.6.0'; // x-release-please-version
+export const VERSION = '0.6.1'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/office-outlook-mcp",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "mcpName": "io.github.chrischall/office-outlook-mcp",
   "description": "Outlook / Microsoft 365 MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -45,8 +45,8 @@
     "typecheck": "tsc -p tsconfig.check.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^3.0.1",
-    "@fetchproxy/server": "^3.6.0",
+    "@chrischall/mcp-utils": "^3.0.3",
+    "@fetchproxy/server": "^3.6.2",
     "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.1",
     "zod": "^4.6.5"

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/office-outlook-mcp",
     "source": "github"
   },
-  "version": "0.6.0",
+  "version": "0.6.1",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/office-outlook-mcp",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "transport": {
         "type": "stdio"
       },