@littlebearapps/outlook-assistant 3.12.0 → 3.13.0

package/.env.example

@@ -31,6 +31,14 @@ USE_TEST_MODE=false
 # receivedBefore rather than raising this if you can.
 # OUTLOOK_SEARCH_SCAN_LIMIT=500
 
+# Inactivity timeout for each Graph request attempt (milliseconds): an attempt
+# that receives no data for this long is abandoned with a timeout error. It is
+# not an overall deadline — a slow response that keeps arriving isn't cut off.
+# Throttled (429) and busy (503/504) responses are retried automatically (up to
+# 3 times, honouring Retry-After); POST requests such as sending mail are only
+# retried on a 429 asking for a short wait (10 s or less, 20 s in total).
+# OUTLOOK_REQUEST_TIMEOUT_MS=60000
+
 # Optional: Default authentication method (device-code or browser)
 # device-code: No auth server needed, works remotely/headless
 # browser: Traditional OAuth redirect via localhost:3333

package/README.md

@@ -17,7 +17,7 @@
   <a href="https://glama.ai/mcp/servers/littlebearapps/outlook-assistant"><img src="https://glama.ai/mcp/servers/littlebearapps/outlook-assistant/badges/score.svg" alt="Glama score" /></a>
 </p>
 
-Outlook Assistant connects AI assistants to your Microsoft Outlook account through the [Model Context Protocol](https://modelcontextprotocol.io/). Ask your AI assistant to search your inbox, send emails, schedule meetings, manage contacts, and configure mailbox settings — without leaving the conversation. Works with Claude, Cursor, Windsurf, and any MCP-compatible client.
+Outlook Assistant connects AI assistants to your Microsoft Outlook account through the [Model Context Protocol](https://modelcontextprotocol.io/). Ask your AI assistant to search your inbox, send emails, schedule meetings, manage contacts, and configure mailbox settings — without leaving the conversation. Works with Claude, GitHub Copilot, Cursor, Windsurf, and any MCP-compatible client.
 
 **Works with personal Outlook.com and work/school Microsoft 365 accounts.**
 
@@ -135,7 +135,6 @@ Outlook Assistant is designed with safety-first principles for AI-driven email a
 > ```json
 > "env": {
 >   "OUTLOOK_CLIENT_ID": "…",
->   "OUTLOOK_CLIENT_SECRET": "…",
 >   "OUTLOOK_MAX_EMAILS_PER_SESSION": "10",
 >   "OUTLOOK_ALLOWED_RECIPIENTS": "your-domain.com,trusted@example.com"
 > }
@@ -143,7 +142,7 @@ Outlook Assistant is designed with safety-first principles for AI-driven email a
 
 **Input and file hardening** — IDs containing `.` or `..` path segments are refused before any request is made, continuation links (`deltaToken`) must point at `graph.microsoft.com`, and attachment downloads and exports write sanitised filenames inside the output directory without overwriting existing files or following symlinks.
 
-**Draft protections** — The `draft` tool shares `send-email` safety controls: dry-run preview, recipient allowlist, mail-tips validation, and rate limiting. The `send` action shares the `send-email` rate limit counter, preventing circumvention via the draft-then-send pathway.
+**Draft protections** — The `draft` tool shares `send-email` safety controls: dry-run preview, recipient allowlist, mail-tips validation, and rate limiting. The `send` action shares the `send-email` rate limit counter, preventing circumvention via the draft-then-send pathway. `update`, `send` and `delete` refuse any ID that is not an unsent draft, so a received or sent message is never edited, deleted or re-sent.
 
 **Token-optimised architecture** — Tools are consolidated using the STRAP (Single Tool, Resource, Action Pattern) approach. 22 tools instead of 55 reduces per-turn overhead by ~11,000 tokens (~64%), keeping more of the AI's context window available for your actual conversation. Fewer tools also means the AI selects the right tool more accurately — research shows tool selection degrades beyond ~40 tools.
 
@@ -166,7 +165,7 @@ npx @littlebearapps/outlook-assistant
 To check which version you have, or to see the available options:
 
 ```bash
-outlook-assistant --version     # prints e.g. 3.12.0
+outlook-assistant --version     # prints e.g. 3.13.0
 outlook-assistant --help        # usage, options and key environment variables
 ```
 
@@ -180,14 +179,23 @@ You need a Microsoft Azure app registration to authenticate. See the **[Azure Se
 
 1. Create a new app registration at [portal.azure.com](https://portal.azure.com/)
 2. Add Microsoft Graph delegated permissions (Mail, Calendar, Contacts)
-3. Create a client secret and copy the **Value** (not the Secret ID)
+3. _(Browser flow only)_ Create a client secret and copy the **Value** (not the Secret ID). The default device-code sign-in doesn't need one
 4. Under Authentication > **Add a platform** > **Mobile and desktop applications** — check `nativeclient` URI
 5. Enable **"Allow public client flows"** in Authentication > Advanced settings
 6. _(Optional)_ Set redirect URI to `http://localhost:3333/auth/callback` — only needed for browser auth flow
 
 ### 3. Configure Your MCP Client
 
-Add to your MCP client config:
+**Plugin install (Claude Code).** The plugin bundles the server pinned to an exact version and asks for your settings when you enable it:
+
+```bash
+claude plugin marketplace add littlebearapps/outlook-assistant
+claude plugin install outlook-assistant@littlebearapps
+```
+
+The same plugin folder ([`plugins/outlook-assistant`](plugins/outlook-assistant/)) also follows the [Agent Plugins](https://agent-plugins.org/) format used by GitHub Copilot and Cursor.
+
+**Manual config.** Add to your MCP client config. Only `OUTLOOK_CLIENT_ID` is needed for the default device-code sign-in; add `OUTLOOK_CLIENT_SECRET` only if you use the [browser flow](#browser-redirect-flow-alternative). You can also leave the client ID out and give it to your assistant when you first connect (`auth action=authenticate clientId=…`), which saves it to `~/.outlook-assistant-config.json`. An `OUTLOOK_CLIENT_ID` in the environment always takes precedence.
 
 <details>
 <summary><strong>Claude Desktop</strong> (<code>claude_desktop_config.json</code>)</summary>
@@ -199,8 +207,7 @@ Add to your MCP client config:
       "command": "npx",
       "args": ["@littlebearapps/outlook-assistant"],
       "env": {
-        "OUTLOOK_CLIENT_ID": "your-application-client-id",
-        "OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
+        "OUTLOOK_CLIENT_ID": "your-application-client-id"
       }
     }
   }
@@ -214,17 +221,46 @@ Add to your MCP client config:
 ```bash
 claude mcp add outlook \
   -e OUTLOOK_CLIENT_ID=your-application-client-id \
-  -e OUTLOOK_CLIENT_SECRET=your-client-secret-VALUE \
   -- npx -y @littlebearapps/outlook-assistant
 ```
 
 The MCP server reads its settings from the environment your client passes it; it doesn't load a `.env` file.
 </details>
 
+<details>
+<summary><strong>VS Code / GitHub Copilot</strong> (<code>.vscode/mcp.json</code>)</summary>
+
+VS Code prompts for the client ID the first time the server starts and stores it securely:
+
+```json
+{
+  "inputs": [
+    {
+      "type": "promptString",
+      "id": "outlook-client-id",
+      "description": "Azure application (client) ID"
+    }
+  ],
+  "servers": {
+    "outlook": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@littlebearapps/outlook-assistant"],
+      "env": {
+        "OUTLOOK_CLIENT_ID": "${input:outlook-client-id}"
+      }
+    }
+  }
+}
+```
+
+Use it from Copilot Chat in **Agent** mode. To use it in every workspace, add the same entry to your user `mcp.json` (Command Palette → **MCP: Open User Configuration**).
+</details>
+
 <details>
 <summary><strong>Cursor</strong> (<code>.cursor/mcp.json</code>)</summary>
 
-[![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](cursor://anysphere.cursor-deeplink/mcp/install?name=Outlook%20Assistant&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBsaXR0bGViZWFyYXBwcy9vdXRsb29rLWFzc2lzdGFudCJdLCJlbnYiOnsiT1VUTE9PS19DTElFTlRfSUQiOiIiLCJPVVRMT09LX0NMSUVOVF9TRUNSRVQiOiIifX0=)
+[![Install in Cursor](https://cursor.com/deeplink/mcp-install-dark.svg)](cursor://anysphere.cursor-deeplink/mcp/install?name=Outlook%20Assistant&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBsaXR0bGViZWFyYXBwcy9vdXRsb29rLWFzc2lzdGFudCJdLCJlbnYiOnsiT1VUTE9PS19DTElFTlRfSUQiOiIifX0=)
 
 Or add manually to `.cursor/mcp.json`:
 
@@ -235,8 +271,7 @@ Or add manually to `.cursor/mcp.json`:
       "command": "npx",
       "args": ["@littlebearapps/outlook-assistant"],
       "env": {
-        "OUTLOOK_CLIENT_ID": "your-application-client-id",
-        "OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
+        "OUTLOOK_CLIENT_ID": "your-application-client-id"
       }
     }
   }
@@ -254,8 +289,7 @@ Or add manually to `.cursor/mcp.json`:
       "command": "npx",
       "args": ["@littlebearapps/outlook-assistant"],
       "env": {
-        "OUTLOOK_CLIENT_ID": "your-application-client-id",
-        "OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
+        "OUTLOOK_CLIENT_ID": "your-application-client-id"
       }
     }
   }
@@ -339,6 +373,8 @@ a server that would ignore it.
 
 ### Create a Client Secret
 
+Only needed for the [browser redirect flow](#browser-redirect-flow-alternative). Skip this if you sign in with the default device code.
+
 1. Go to **Certificates & secrets** > **New client secret**
 2. Enter a description and select expiration
 3. Click **Add**
@@ -374,10 +410,11 @@ USE_TEST_MODE=false
 | `OUTLOOK_ALLOWED_RECIPIENTS` | Comma-separated allowlist of domains/addresses for sends, drafts, and rule forwards. | unrestricted |
 | `OUTLOOK_SHARED_MAILBOX` | Opt-in shared-mailbox support (work/school only). `read` requests `Mail.Read.Shared`; `true` (or `readwrite`/`1`) also requests `Mail.ReadWrite.Shared`. Unset leaves sign-in unchanged. After enabling, restart and run `auth action=authenticate force=true`. | unset (off) |
 | `OUTLOOK_SEARCH_SCAN_LIMIT` | How many recent messages the client-side search fallback scans. Personal accounts match `to` locally within this window, so the default caps how far back a `to` search reaches. Max 5000. | `500` |
+| `OUTLOOK_REQUEST_TIMEOUT_MS` | Inactivity timeout for each Graph request attempt, in milliseconds: an attempt that receives no data for this long is abandoned with a timeout error. It isn't an overall deadline, so a slow response that keeps arriving isn't cut off. Throttled (`429`) and busy (`503`/`504`) responses are retried automatically, honouring `Retry-After`. | `60000` |
 
 ### MCP Client Configuration
 
-See [Quick Start — Configure Your MCP Client](#3-configure-your-mcp-client) above for Claude Desktop, Claude Code, Cursor, and Windsurf configs.
+See [Quick Start — Configure Your MCP Client](#3-configure-your-mcp-client) above for Claude Desktop, Claude Code, VS Code / GitHub Copilot, Cursor, and Windsurf configs.
 
 If installed from source, use `node` instead of `npx`:
 
@@ -388,8 +425,7 @@ If installed from source, use `node` instead of `npx`:
       "command": "node",
       "args": ["/path/to/outlook-assistant/index.js"],
       "env": {
-        "OUTLOOK_CLIENT_ID": "your-application-client-id",
-        "OUTLOOK_CLIENT_SECRET": "your-client-secret-VALUE"
+        "OUTLOOK_CLIENT_ID": "your-application-client-id"
       }
     }
   }
@@ -451,7 +487,9 @@ outlook-assistant/
 │   ├── conversations.js     # Thread listing/export
 │   ├── attachments.js       # Attachment operations
 │   └── ...
-├── calendar/                # Calendar module (3 tools; list.js builds list-events filters)
+├── calendar/                # Calendar module (3 tools)
+│   ├── attendees.js         # Attendee builder (email or {email, type})
+│   └── list.js              # list-events filters
 ├── contacts/                # Contacts module (2 tools)
 ├── categories/              # Categories module (3 tools)
 ├── settings/                # Settings module (1 tool)
@@ -462,6 +500,8 @@ outlook-assistant/
     ├── graph-api.js         # Microsoft Graph API client (includes $batch, path guards)
     ├── mailbox.js           # me vs users/{sharedMailbox} prefix, shared-mailbox opt-in
     ├── safety.js            # Rate limiting, recipient allowlist, dry-run
+    ├── safe-write.js        # Exclusive, outputDir-confined file writes
+    ├── datetime.js          # ISO 8601 parsing and timezone conversion
     ├── odata-helpers.js     # OData query building
     ├── field-presets.js     # Token-efficient field selections
     ├── response-formatter.js # Verbosity levels

package/advanced/index.js

@@ -20,6 +20,12 @@ const {
 } = require('../utils/mailbox');
 const { resolveFolder } = require('../folder/resolve');
 const { getAllFoldersHierarchy } = require('../folder/list');
+const {
+  InvalidDateTimeError,
+  toGraphDateTimeTimeZone,
+  zonedParts,
+  zonedWallTimeToUtcMs,
+} = require('../utils/datetime');
 
 /**
  * Format an email for display (simplified)
@@ -408,6 +414,49 @@ async function handleListSharedMailboxFolders(sharedMailbox, args) {
   }
 }
 
+/**
+ * Default follow-up start for a flag with only a due date: 09:00 in
+ * DEFAULT_TIMEZONE on the due's local date, or the due itself when the due is
+ * earlier than that (a start after the due would be nonsense).
+ */
+function deriveFlagStart(due) {
+  let wall;
+  if (due.timeZone === DEFAULT_TIMEZONE) {
+    wall = due.dateTime;
+  } else {
+    const parts = zonedParts(Date.parse(`${due.dateTime}Z`), DEFAULT_TIMEZONE);
+    if (!parts) return { ...due };
+    wall = `${parts.date}T${parts.time}`;
+  }
+  const nineAm = `${wall.slice(0, 10)}T09:00:00`;
+  // Same zone and fixed-width prefix, so string order is time order.
+  return wall < nineAm
+    ? { ...due }
+    : { dateTime: nineAm, timeZone: DEFAULT_TIMEZONE };
+}
+
+/**
+ * Describe a flag dateTimeTimeZone envelope as UTC plus DEFAULT_TIMEZONE,
+ * e.g. "2026-03-01 09:00 UTC (2026-03-01 20:00 Australia/Melbourne)".
+ */
+function describeFlagTime(envelope) {
+  const ms =
+    envelope.timeZone === 'UTC'
+      ? Date.parse(`${envelope.dateTime}Z`)
+      : zonedWallTimeToUtcMs(envelope.dateTime, envelope.timeZone);
+  const local = (date, time) =>
+    `${date} ${time.slice(0, 5)} ${DEFAULT_TIMEZONE}`;
+  if (Number.isNaN(ms)) {
+    // DEFAULT_TIMEZONE isn't an IANA zone Intl knows; show it as given.
+    return local(envelope.dateTime.slice(0, 10), envelope.dateTime.slice(11));
+  }
+  const iso = new Date(ms).toISOString();
+  const utc = `${iso.slice(0, 10)} ${iso.slice(11, 16)} UTC`;
+  const parts =
+    DEFAULT_TIMEZONE === 'UTC' ? null : zonedParts(ms, DEFAULT_TIMEZONE);
+  return parts ? `${utc} (${local(parts.date, parts.time)})` : utc;
+}
+
 /**
  * Set message flag handler
  */
@@ -435,43 +484,38 @@ async function handleSetMessageFlag(args) {
     };
   }
 
+  // Build flag object. Zoned values (Z/offset) are sent as the same instant in
+  // UTC; zone-less values are read in DEFAULT_TIMEZONE. Bad dates are refused
+  // here, before authenticating or calling Graph.
+  const flag = {
+    flagStatus: 'flagged',
+  };
   try {
-    const accessToken = await ensureAuthenticated();
-
-    // Build flag object
-    const flag = {
-      flagStatus: 'flagged',
-    };
-
+    if (startDateTime) {
+      flag.startDateTime = toGraphDateTimeTimeZone(
+        startDateTime,
+        'startDateTime'
+      );
+    }
     if (dueDateTime) {
-      // Graph API expects { dateTime, timeZone } envelope without trailing Z
-      // When timeZone is specified, the dateTime value is interpreted in that zone
-      const dueDt = dueDateTime.replace(/Z$/i, '');
-      flag.dueDateTime = {
-        dateTime: dueDt,
-        timeZone: DEFAULT_TIMEZONE,
-      };
-
-      // Graph API requires startDateTime when dueDateTime is set
-      // Default to start of the same day if not explicitly provided
-      if (startDateTime) {
-        flag.startDateTime = {
-          dateTime: startDateTime.replace(/Z$/i, ''),
-          timeZone: DEFAULT_TIMEZONE,
-        };
-      } else {
-        const startOfDay = `${dueDt.split('T')[0]}T09:00:00`;
-        flag.startDateTime = {
-          dateTime: startOfDay,
-          timeZone: DEFAULT_TIMEZONE,
-        };
+      flag.dueDateTime = toGraphDateTimeTimeZone(dueDateTime, 'dueDateTime');
+      // Graph requires startDateTime when dueDateTime is set.
+      if (!flag.startDateTime) {
+        flag.startDateTime = deriveFlagStart(flag.dueDateTime);
       }
-    } else if (startDateTime) {
-      flag.startDateTime = {
-        dateTime: startDateTime.replace(/Z$/i, ''),
-        timeZone: DEFAULT_TIMEZONE,
+    }
+  } catch (error) {
+    if (error instanceof InvalidDateTimeError) {
+      return {
+        content: [{ type: 'text', text: error.message }],
+        isError: true,
       };
     }
+    throw error;
+  }
+
+  try {
+    const accessToken = await ensureAuthenticated();
 
     // Process all messages
     const results = [];
@@ -493,11 +537,11 @@ async function handleSetMessageFlag(args) {
     if (results.length > 0) {
       output.push(`Flagged ${results.length} message(s) for follow-up`);
 
-      if (dueDateTime) {
-        output.push(`**Due**: ${new Date(dueDateTime).toLocaleString()}`);
+      if (flag.dueDateTime) {
+        output.push(`**Due**: ${describeFlagTime(flag.dueDateTime)}`);
       }
-      if (startDateTime) {
-        output.push(`**Start**: ${new Date(startDateTime).toLocaleString()}`);
+      if (flag.startDateTime) {
+        output.push(`**Start**: ${describeFlagTime(flag.startDateTime)}`);
       }
     }
 

package/auth/client-config.js

@@ -0,0 +1,142 @@
+/**
+ * Runtime-supplied Azure Application (client) ID.
+ *
+ * Plugin marketplaces (GitHub Copilot, Cursor — Agent Plugins 1.0) ship a
+ * static `mcp.json` with no way to prompt for settings, so users there can't
+ * set OUTLOOK_CLIENT_ID. Device-code sign-in only needs the client ID (never
+ * the secret), so the `auth` tool accepts it at runtime and it's persisted to
+ * `~/.outlook-assistant-config.json`.
+ *
+ * Precedence: OUTLOOK_CLIENT_ID env → MS_CLIENT_ID env (legacy) → saved file.
+ *
+ * Deliberately does NOT require ../config (config.js requires this module).
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const CONFIG_FILE_NAME = '.outlook-assistant-config.json';
+
+// Azure Application (client) IDs are GUIDs.
+const CLIENT_ID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Path of the persisted config file. Resolved per call (not at load) so a
+ * changed HOME — e.g. in tests — is honoured.
+ * @returns {string}
+ */
+function getConfigPath() {
+  const homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir();
+  return path.join(homeDir, CONFIG_FILE_NAME);
+}
+
+/**
+ * @param {unknown} id
+ * @returns {boolean} - true when `id` (trimmed) is a GUID
+ */
+function isValidClientId(id) {
+  return typeof id === 'string' && CLIENT_ID_RE.test(id.trim());
+}
+
+/**
+ * Read the whole config file. Never throws.
+ * @returns {object} - Parsed object, or {} when missing/unreadable/not an object
+ */
+function readConfigFile() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(getConfigPath(), 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed
+      : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * The saved client ID, or '' when there is none or it isn't a valid GUID.
+ * Never throws.
+ * @returns {string}
+ */
+function loadSavedClientId() {
+  const { clientId } = readConfigFile();
+  return isValidClientId(clientId) ? clientId.trim() : '';
+}
+
+/**
+ * Validate and persist a client ID (mode 0600, temp file + rename), keeping
+ * any other keys already in the file.
+ * @param {string} id
+ * @returns {string} - The normalised (trimmed) ID that was saved
+ * @throws {Error} - When `id` isn't a GUID or the write fails
+ */
+function saveClientId(id) {
+  if (!isValidClientId(id)) {
+    throw new Error(
+      'Invalid client ID: expected the Application (client) ID GUID from your Azure app registration.'
+    );
+  }
+  const clientId = id.trim();
+  const filePath = getConfigPath();
+  const data = { ...readConfigFile(), clientId };
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    fs.writeFileSync(tmpPath, `${JSON.stringify(data, null, 2)}\n`, {
+      mode: 0o600,
+      flag: 'wx',
+    });
+    fs.renameSync(tmpPath, filePath);
+  } catch (error) {
+    try {
+      fs.unlinkSync(tmpPath);
+    } catch {
+      // Temp file was never created or is already gone
+    }
+    throw error;
+  }
+  return clientId;
+}
+
+/**
+ * Which environment variable supplies the client ID, if any.
+ * @returns {{name: string, value: string}|null}
+ */
+function getEnvClientId() {
+  // Trimmed, and blank counts as unset: plugin managers pass "" (or stray
+  // whitespace) for an unset option, which must not hide a saved ID.
+  for (const name of ['OUTLOOK_CLIENT_ID', 'MS_CLIENT_ID']) {
+    const value = (process.env[name] || '').trim();
+    if (value) return { name, value };
+  }
+  return null;
+}
+
+/**
+ * Effective client ID: env (OUTLOOK_CLIENT_ID, then legacy MS_CLIENT_ID),
+ * then the saved file, then ''.
+ * @returns {string}
+ */
+function resolveClientId() {
+  const env = getEnvClientId();
+  return env ? env.value : loadSavedClientId();
+}
+
+/**
+ * @returns {'env'|'saved'|'none'} - Where the effective client ID comes from
+ */
+function getClientIdSource() {
+  if (getEnvClientId()) return 'env';
+  return loadSavedClientId() ? 'saved' : 'none';
+}
+
+module.exports = {
+  CONFIG_FILE_NAME,
+  getConfigPath,
+  isValidClientId,
+  loadSavedClientId,
+  saveClientId,
+  getEnvClientId,
+  resolveClientId,
+  getClientIdSource,
+};

package/auth/index.js

@@ -6,9 +6,11 @@ const TokenStorage = require('./token-storage');
 const config = require('../config');
 const { authTools, setToolCount } = require('./tools');
 
-// Singleton TokenStorage instance with auto-refresh support
+// Singleton TokenStorage instance with auto-refresh support. No clientId is
+// passed: TokenStorage resolves it on each use (env → saved config file), so
+// an ID saved at runtime via `auth action=authenticate clientId=…` applies
+// without a restart.
 const tokenStorage = new TokenStorage({
-  clientId: config.AUTH_CONFIG.clientId,
   clientSecret: config.AUTH_CONFIG.clientSecret,
   tokenStorePath: config.AUTH_CONFIG.tokenStorePath,
   scopes: config.AUTH_CONFIG.scopes,

package/auth/oauth-server.js

@@ -4,6 +4,7 @@ const _https = require('https'); // Reserved for future HTTPS support
 const _fs = require('fs'); // Reserved for future HTTPS support
 const crypto = require('crypto'); // Added for generating random string
 const TokenStorage = require('./token-storage'); // Assuming TokenStorage is in the same directory
+const { loadSavedClientId } = require('./client-config');
 
 // HTML templates
 function escapeHtml(unsafe) {
@@ -54,8 +55,11 @@ const templates = {
 
 function createAuthConfig(envPrefix = 'OUTLOOK_') {
   return {
+    // Env first; then the ID saved via `auth action=authenticate clientId=…`.
     clientId:
-      process.env[`${envPrefix}CLIENT_ID`] || process.env.MS_CLIENT_ID || '',
+      process.env[`${envPrefix}CLIENT_ID`] ||
+      process.env.MS_CLIENT_ID ||
+      loadSavedClientId(),
     clientSecret:
       process.env[`${envPrefix}CLIENT_SECRET`] ||
       process.env.MS_CLIENT_SECRET ||

package/auth/token-storage.js

@@ -4,6 +4,7 @@ const path = require('path');
 const https = require('https');
 const querystring = require('querystring');
 const { describeAuthError } = require('./auth-errors');
+const { resolveClientId } = require('./client-config');
 
 /**
  * Decide which scopes a refresh request should use. Prefer the scopes that were
@@ -42,7 +43,9 @@ class TokenStorage {
         process.env.HOME || process.env.USERPROFILE,
         '.outlook-assistant-tokens.json'
       ),
-      clientId: process.env.OUTLOOK_CLIENT_ID || process.env.MS_CLIENT_ID,
+      // No default clientId: when none is passed, getClientId() resolves it on
+      // every use (env → saved ~/.outlook-assistant-config.json), so an ID
+      // saved at runtime via the auth tool takes effect without a restart.
       clientSecret:
         process.env.OUTLOOK_CLIENT_SECRET || process.env.MS_CLIENT_SECRET,
       redirectUri:
@@ -80,7 +83,7 @@ class TokenStorage {
       }
     }
 
-    if (!this.config.clientId) {
+    if (!this.getClientId()) {
       console.warn(
         'TokenStorage: OUTLOOK_CLIENT_ID is not configured. Token operations will fail.'
       );
@@ -89,6 +92,15 @@ class TokenStorage {
     // Device code flow (public client) does not use client_secret.
   }
 
+  /**
+   * Client ID for token requests: an explicitly configured value wins,
+   * otherwise it is resolved now (OUTLOOK_CLIENT_ID → MS_CLIENT_ID → saved).
+   * @returns {string}
+   */
+  getClientId() {
+    return this.config.clientId || resolveClientId();
+  }
+
   async _loadTokensFromFile() {
     try {
       const tokenData = await fs.readFile(this.config.tokenStorePath, 'utf8');
@@ -149,12 +161,12 @@ class TokenStorage {
     await this.getTokens(); // Ensure tokens are loaded
 
     if (!this.tokens || !this.tokens.access_token) {
-      console.log('No access token available.');
+      console.error('No access token available.');
       return null;
     }
 
     if (this.isTokenExpired()) {
-      console.log(
+      console.error(
         'Access token expired or nearing expiration. Attempting refresh.'
       );
       if (this.tokens.refresh_token) {
@@ -193,7 +205,7 @@ class TokenStorage {
 
     // Prevent multiple concurrent refresh attempts
     if (this._refreshPromise) {
-      console.log('Refresh already in progress, returning existing promise.');
+      console.error('Refresh already in progress, returning existing promise.');
       return this._refreshPromise.then((tokens) => tokens.access_token);
     }
 
@@ -201,12 +213,12 @@ class TokenStorage {
     // in refresh requests for tokens obtained via device code.
     // Browser flow (confidential client) requires client_secret.
     const isDeviceCode = this.tokens.auth_method === 'device-code';
-    console.log(
+    console.error(
       `Attempting to refresh access token (auth_method: ${this.tokens.auth_method || 'browser'})...`
     );
 
     const refreshParams = {
-      client_id: this.config.clientId,
+      client_id: this.getClientId(),
       grant_type: 'refresh_token',
       refresh_token: this.tokens.refresh_token,
       // Use the GRANTED scopes, not the full configured set. After a base-only
@@ -247,7 +259,9 @@ class TokenStorage {
                   Date.now() + responseBody.expires_in * 1000;
                 try {
                   await this._saveTokensToFile();
-                  console.log('Access token refreshed and saved successfully.');
+                  console.error(
+                    'Access token refreshed and saved successfully.'
+                  );
                   resolve(this.tokens);
                 } catch (saveError) {
                   console.error('Failed to save refreshed tokens:', saveError);
@@ -298,15 +312,16 @@ class TokenStorage {
   }
 
   async exchangeCodeForTokens(authCode) {
-    if (!this.config.clientId || !this.config.clientSecret) {
+    const clientId = this.getClientId();
+    if (!clientId || !this.config.clientSecret) {
       throw new Error(
         'Client ID or Client Secret is not configured. Cannot exchange code for tokens.'
       );
     }
-    console.log('Exchanging authorization code for tokens...');
+    console.error('Exchanging authorization code for tokens...');
     const requestedScopes = this.config.scopes;
     const postData = querystring.stringify({
-      client_id: this.config.clientId,
+      client_id: clientId,
       client_secret: this.config.clientSecret,
       grant_type: 'authorization_code',
       code: authCode,
@@ -351,7 +366,7 @@ class TokenStorage {
                 };
                 try {
                   await this._saveTokensToFile();
-                  console.log('Tokens exchanged and saved successfully.');
+                  console.error('Tokens exchanged and saved successfully.');
                   resolve(this.tokens);
                 } catch (saveError) {
                   console.error('Failed to save exchanged tokens:', saveError);
@@ -408,10 +423,10 @@ class TokenStorage {
     this.tokens = null;
     try {
       await fs.unlink(this.config.tokenStorePath);
-      console.log('Token file deleted successfully.');
+      console.error('Token file deleted successfully.');
     } catch (error) {
       if (error.code === 'ENOENT') {
-        console.log('Token file not found, nothing to delete.');
+        console.error('Token file not found, nothing to delete.');
       } else {
         console.error('Error deleting token file:', error);
       }