@littlebearapps/outlook-assistant 3.14.0 → 3.14.1

package/email/draft.js

@@ -8,6 +8,7 @@ const { callGraphAPI } = require('../utils/graph-api');
 const { ensureAuthenticated } = require('../auth');
 const {
   checkRateLimit,
+  releaseRateLimit,
   checkRecipientAllowlist,
   findBlockedRecipients,
   getRecipientAllowlist,
@@ -86,7 +87,7 @@ function buildMessageObject(args) {
 /**
  * Format a draft response with key details
  * @param {object} draft - Graph API message response
- * @param {string} actionLabel - Human-readable action (e.g. "created", "updated")
+ * @param {string} actionLabel - Heading, e.g. "Draft created" or "Reply draft created"
  * @returns {object} - MCP response
  */
 function formatDraftResponse(draft, actionLabel) {
@@ -94,7 +95,7 @@ function formatDraftResponse(draft, actionLabel) {
     .map((r) => r.emailAddress?.address)
     .join(', ');
 
-  let text = `Draft ${actionLabel}.\n\n`;
+  let text = `${actionLabel}.\n\n`;
   text += `**ID**: \`${draft.id}\`\n`;
   if (draft.subject) text += `**Subject**: ${draft.subject}\n`;
   if (to) text += `**To**: ${to}\n`;
@@ -220,7 +221,7 @@ async function handleCreateDraft(args) {
     const tipsText = tipsResult.content[0]?.text || '';
 
     if (dryRun) {
-      const preview = formatDryRunPreview({ message, saveToSentItems: true });
+      const preview = formatDryRunPreview({ message, isDraft: true });
       return {
         content: [
           {
@@ -238,7 +239,7 @@ async function handleCreateDraft(args) {
 
   // Dry-run mode: preview without saving
   if (dryRun) {
-    const preview = formatDryRunPreview({ message, saveToSentItems: true });
+    const preview = formatDryRunPreview({ message, isDraft: true });
     return {
       content: [
         {
@@ -264,7 +265,7 @@ async function handleCreateDraft(args) {
       'me/messages',
       message
     );
-    const response = formatDraftResponse(draft, 'created');
+    const response = formatDraftResponse(draft, 'Draft created');
     if (tipsResult) {
       response.content[0].text += `\n---\n\n${tipsResult.content[0]?.text || ''}`;
       response._meta.mailTips = tipsResult._meta;
@@ -312,7 +313,7 @@ async function handleUpdateDraft(args) {
       `me/messages/${id}`,
       message
     );
-    return formatDraftResponse(draft, 'updated');
+    return formatDraftResponse(draft, 'Draft updated');
   } catch (error) {
     return handleError('updating draft', error);
   }
@@ -426,14 +427,17 @@ async function handleReplyDraft(args, endpoint) {
 
   const actionName = endpoint === 'createReplyAll' ? 'reply-all' : 'reply';
 
-  // Counted before the draft is created: a reply that the allowlist refuses
-  // below has still written (and removed) a draft.
+  // Taken before the draft is created, and given back only when nothing is
+  // definitely left behind (#299): Graph rejected the create with a 4xx, or
+  // the allowlist refused the reply and its draft was deleted again. A
+  // timeout, 5xx or failed delete may leave a draft, so the slot stays used.
   const rateLimitError = checkRateLimit('draft');
   if (rateLimitError) return rateLimitError;
 
+  let draft;
   try {
     const accessToken = await ensureAuthenticated();
-    const draft = await callGraphAPI(
+    draft = await callGraphAPI(
       accessToken,
       'POST',
       `me/messages/${id}/${endpoint}`,
@@ -443,10 +447,24 @@ async function handleReplyDraft(args, endpoint) {
     // Graph fills in the recipients from the original message, so they can
     // only be checked once the draft exists.
     const refusal = await refuseBlockedReply(accessToken, draft, actionName);
-    if (refusal) return refusal;
+    if (refusal) {
+      if (refusal.draftDeleted) releaseRateLimit('draft');
+      return refusal.error;
+    }
 
-    return formatDraftResponse(draft, `${actionName} draft created`);
+    return formatDraftResponse(
+      draft,
+      `${actionName.charAt(0).toUpperCase()}${actionName.slice(1)} draft created`
+    );
   } catch (error) {
+    // Only Graph's own rejection, read from the start of the error (the
+    // body after it is server text). 408 means it may have gone through.
+    const rejected = /^API call failed with status (4\d\d):/.exec(
+      error.message || ''
+    );
+    if (!draft && rejected && rejected[1] !== '408') {
+      releaseRateLimit('draft');
+    }
     return handleError(`creating ${actionName} draft`, error);
   }
 }
@@ -458,7 +476,8 @@ async function handleReplyDraft(args, endpoint) {
  * @param {string} accessToken - Graph access token
  * @param {object} draft - The draft Graph returned from createReply/createReplyAll
  * @param {string} actionName - 'reply' or 'reply-all'
- * @returns {Promise<object|null>} A tool error, or null to keep the draft
+ * @returns {Promise<{error: object, draftDeleted: boolean}|null>} The
+ *   refusal and whether its draft was deleted, or null to keep the draft
  */
 async function refuseBlockedReply(accessToken, draft, actionName) {
   if (!getRecipientAllowlist()) return null;
@@ -490,18 +509,22 @@ async function refuseBlockedReply(accessToken, draft, actionName) {
   try {
     await callGraphAPI(accessToken, 'DELETE', `me/messages/${draft.id}`);
   } catch (error) {
-    return toolError(
+    const stillThere = toolError(
       `${reason} The draft Graph created could not be deleted (${error.message}), so it is still in Drafts with ID \`${draft.id}\`. Do not send it.`,
       {
         nextStep: `Delete it with draft action=delete id=${draft.id} (or in Outlook). ${nextStep}`,
       }
     );
+    return { error: stillThere, draftDeleted: false };
   }
 
-  return toolError(
-    `${reason} The draft Graph created was deleted, so nothing was kept.`,
-    { nextStep }
-  );
+  return {
+    error: toolError(
+      `${reason} The draft Graph created was deleted, so nothing was kept.`,
+      { nextStep }
+    ),
+    draftDeleted: true,
+  };
 }
 
 /**
@@ -556,7 +579,7 @@ async function handleForwardDraft(args) {
       `me/messages/${id}/createForward`,
       requestBody
     );
-    return formatDraftResponse(draft, 'forward draft created');
+    return formatDraftResponse(draft, 'Forward draft created');
   } catch (error) {
     return handleError('creating forward draft', error);
   }

package/email/export.js

@@ -67,8 +67,8 @@ async function handleExportEmail(args) {
   }
 
   // Where to write, checked before anything is fetched. F-27: `outputDir`
-  // is always a directory. `savePath` names a directory if one exists
-  // there, otherwise the file to write. With no path, the system temp
+  // is always a directory. `savePath` names a directory if it ends in a
+  // separator or one exists there, otherwise the file to write. With no path, the system temp
   // directory is used. Writes go to the resolved path, never the raw one.
   let explicitFile = null;
   let requestedFile = null; // savePath as given, for messages
@@ -77,6 +77,10 @@ async function handleExportEmail(args) {
   try {
     if (args.outputDir) {
       targetDir = confineOutputPath(args.outputDir);
+    } else if (args.savePath && /[\\/]$/.test(args.savePath)) {
+      // A trailing separator names a directory even when it doesn't exist
+      // yet; resolving the path drops it, so decide here (#301).
+      targetDir = confineOutputPath(args.savePath);
     } else if (args.savePath) {
       const target = confineOutputTarget(args.savePath);
       const resolved = target.path;

package/email/index.js

@@ -260,7 +260,7 @@ const emailTools = [
   {
     name: 'send-email',
     description:
-      'Compose and send an email immediately (destructive: sends external comms). Returns a confirmation. Safety controls: `dryRun: true` returns the composed message for review without sending; `checkRecipients: true` runs `get-mail-tips` first and returns its warnings. If the tips show an out-of-office reply, a full mailbox, a delivery restriction or external recipients, the send is refused until repeated with `acknowledgeWarnings: true`. Personal Outlook.com accounts return no tips, and no warnings is not proof of delivery. Subject to session rate limits (`OUTLOOK_MAX_EMAILS_PER_SESSION` env) and recipient allowlist (`OUTLOOK_ALLOWED_RECIPIENTS` env) when configured — calls outside the allowlist fail before any Graph request. For a review-before-send workflow, use `draft` (action=`create` → `update` → `send`); a draft can be checked in Outlook before it goes. Comma-separated recipient strings or arrays both accepted.',
+      'Compose and send an email immediately (destructive: sends external comms). Returns a confirmation. Safety controls: `dryRun: true` returns the composed message for review without sending; `checkRecipients: true` runs `get-mail-tips` first and returns its warnings. If the tips show an out-of-office reply, a full mailbox, a delivery restriction or external recipients, the send is refused until repeated with `acknowledgeWarnings: true`. Personal Outlook.com accounts return no tips, and no warnings is not proof of delivery. Subject to the session limit (`OUTLOOK_MAX_SEND_EMAIL_PER_SESSION`, else `OUTLOOK_MAX_EMAILS_PER_SESSION`; 0 refuses every send) and recipient allowlist (`OUTLOOK_ALLOWED_RECIPIENTS`) when configured; both refuse before any Graph request. For a review-before-send workflow, use `draft` (action=`create` → `update` → `send`); a draft can be checked in Outlook before it goes. Comma-separated recipient strings or arrays both accepted.',
     ...toolMetadata('send-email', 'Send Email'),
     inputSchema: {
       type: 'object',
@@ -319,7 +319,7 @@ const emailTools = [
   {
     name: 'draft',
     description:
-      "Draft lifecycle for review-before-send workflows (destructive: covers `send` and `delete`). action=`create` saves a new draft and returns its id (`dryRun: true` previews without saving; `checkRecipients: true` runs mail-tips first). action=`update` patches a draft by `id` (only fields passed change). action=`send` sends a draft and shares the rate limit with `send-email`. action=`delete` deletes a draft into Recoverable Items (Outlook can restore it for a limited time, depending on the account). update/send/delete refuse any `id` that is not an unsent draft. action=`reply`/`reply-all` creates a reply draft from a message `id` (`comment` prepends text; not with `body`). action=`forward` creates a forward draft (needs `id` and `to`). The recipient allowlist (OUTLOOK_ALLOWED_RECIPIENTS) applies to create/update/forward, to the draft's current to/cc/bcc on send, and to reply/reply-all, whose draft is deleted if a recipient is not allowed. Returns the draft on create/update/reply/forward; a status on send/delete.",
+      "Draft lifecycle for review-before-send workflows (destructive: covers `send` and `delete`). action=`create` saves a new draft and returns its id (`dryRun: true` previews without saving; `checkRecipients: true` runs mail-tips first). action=`update` patches a draft by `id` (only fields passed change). action=`send` sends a draft and counts against the `send-email` session limit (0 refuses every send). action=`delete` moves a draft to Recoverable Items (restorable for a limited time). update/send/delete refuse any `id` that is not an unsent draft. action=`reply`/`reply-all` creates a reply draft from a message `id` (`comment` prepends text; not with `body`). action=`forward` creates a forward draft (needs `id` and `to`). The recipient allowlist (OUTLOOK_ALLOWED_RECIPIENTS) applies to create/update/forward, to the draft's current to/cc/bcc on send, and to reply/reply-all, whose draft is deleted if a recipient is not allowed. Returns the draft on create/update/reply/forward; a status on send/delete.",
     ...toolMetadata('draft', 'Draft Operations'),
     inputSchema: {
       type: 'object',
@@ -540,7 +540,7 @@ const emailTools = [
   {
     name: 'export',
     description:
-      'Export emails to files. target=`message` (default) exports one email by `id` (mime/eml/markdown/json/csv) to `savePath`: a directory gets a new, unique file name; a file path is created new and an existing file is replaced only with `overwrite: true`. target=`messages` batch-exports `emailIds`, or matches for `searchQuery`/`query`, into `outputDir` (markdown/json/csv), at most 100 messages per call. target=`conversation` exports a thread (up to 1000 messages) by `conversationId` into `outputDir` (eml/mbox/markdown/json/html/csv; `order: "reverse"` for newest first). target=`mime` returns raw RFC-822 MIME for `id` (`headersOnly`, `base64`, `maxSize`, default 1MB). Files are written only inside the system temp directory (the default), ~/Downloads, ~/Documents or OUTLOOK_EXPORT_DIR, never to dot-prefixed names. Pass `sharedMailbox` (alias `email`) when the ids come from a shared mailbox. `includeAttachments` defaults to true for one message, false for batch.',
+      'Export emails to files. target=`message` (default) exports one email by `id` (mime/eml/markdown/json/csv) to `savePath`: a directory (or a path ending in `/`, created if missing) gets a new, unique file name; a file path is created new and an existing file is replaced only with `overwrite: true`. target=`messages` batch-exports `emailIds`, or matches for `searchQuery`/`query`, into `outputDir`, at most 100 messages per call. target=`conversation` exports a thread (up to 1000 messages) by `conversationId` into `outputDir` (eml/mbox/markdown/json/html/csv; `order: "reverse"` for newest first). target=`mime` returns raw RFC-822 MIME for `id` (`headersOnly`, `base64`, `maxSize`, default 1MB). Files are written only inside the system temp directory (the default), ~/Downloads, ~/Documents or OUTLOOK_EXPORT_DIR, never to dot-prefixed names. Pass `sharedMailbox` (alias `email`) when the ids come from a shared mailbox. `includeAttachments` defaults to true for one message, false for batch.',
     ...toolMetadata('export', 'Export Emails'),
     inputSchema: {
       type: 'object',
@@ -559,7 +559,7 @@ const emailTools = [
           type: 'string',
           enum: ['mime', 'eml', 'markdown', 'json', 'mbox', 'html', 'csv'],
           description:
-            'Export format. Valid values vary by target: target=message accepts mime/eml/markdown/json/csv (mbox and html are conversation-only). target=conversation accepts eml/mbox/markdown/json/html/csv. target=messages (batch) accepts markdown/json/csv. mime is an alias for eml (same RFC822 bytes, .eml extension on disk).',
+            'Export format. Valid values vary by target: target=message accepts mime/eml/markdown/json/csv (mbox and html are conversation-only). target=conversation accepts eml/mbox/markdown/json/html/csv. target=messages (batch) accepts mime/eml/markdown/json (one file per message) or csv (one file). mime is an alias for eml (same RFC822 bytes, .eml extension on disk).',
         },
         savePath: {
           type: 'string',

package/email/mime.js

@@ -10,6 +10,22 @@ const { buildMailboxPrefix } = require('../utils/mailbox');
 const { toolError, authRequiredError } = require('../utils/tool-error');
 const { log } = require('../utils/logger');
 
+/**
+ * The longest prefix of `text` that fits in `maxBytes` of UTF-8 without
+ * splitting a character (which would render as U+FFFD).
+ * @param {string} text
+ * @param {number} maxBytes
+ * @returns {string}
+ */
+function utf8Prefix(text, maxBytes) {
+  const bytes = Buffer.from(text, 'utf8');
+  if (bytes.length <= maxBytes) return text;
+  let end = maxBytes;
+  // Step back over continuation bytes (10xxxxxx) to a character start.
+  while (end > 0 && (bytes[end] & 0xc0) === 0x80) end--;
+  return bytes.subarray(0, end).toString('utf8');
+}
+
 /**
  * Parse MIME headers from raw content
  * @param {string} mimeContent - Raw MIME content
@@ -123,7 +139,13 @@ async function handleGetMimeContent(args) {
       // Check size limit
       if (maxSize > 0 && stats.bytes > maxSize) {
         if (headersOnly) {
-          // Return just headers if over limit
+          // Return just headers if over limit, themselves capped at
+          // maxSize (#306): a large header block used to come back whole.
+          const headerBytes = Buffer.byteLength(parsed.headerSection, 'utf8');
+          const headerText =
+            headerBytes > maxSize
+              ? `${utf8Prefix(parsed.headerSection, maxSize)}\n… (headers cut at maxSize ${maxSize} bytes of ${headerBytes})`
+              : parsed.headerSection;
           return {
             content: [
               {
@@ -132,7 +154,7 @@ async function handleGetMimeContent(args) {
                   `# MIME Content (Headers Only - Content Truncated)\n\n` +
                   `**Size**: ${stats.formattedSize} (exceeds ${maxSize} byte limit)\n` +
                   `**Lines**: ${stats.lines}\n\n` +
-                  `## MIME Headers\n\n\`\`\`\n${parsed.headerSection}\n\`\`\``,
+                  `## MIME Headers\n\n\`\`\`\n${headerText}\n\`\`\``,
               },
             ],
             _meta: {
@@ -250,6 +272,7 @@ async function handleGetMimeContent(args) {
 
 module.exports = {
   handleGetMimeContent,
+  utf8Prefix,
   parseMimeHeaders,
   getMimeStats,
 };

package/email/search.js

@@ -1344,7 +1344,7 @@ function buildNoResultsSuggestions(searchInfo, searchAllFolders) {
     );
   } else {
     suggestions.push(
-      'Try `searchAllFolders: true` to search across all folders including Archive'
+      'Try `searchAllFolders: true` to search across all folders, including Archive and Junk Email (mail from a new sender often lands in Junk)'
     );
     suggestions.push(
       'Specify the correct folder if emails have been moved (use the `folders` tool to list folders)'

package/folder/index.js

@@ -77,7 +77,8 @@ const folderTools = [
         },
         sourceFolder: {
           type: 'string',
-          description: 'Source folder name, default is inbox (action=move)',
+          description:
+            'Ignored: action=move moves each email by ID from wherever it is. Accepted for older callers.',
         },
         // stats params
         folder: {

package/folder/stats.js

@@ -180,8 +180,10 @@ function formatFolderStats(folder, dateRange, verbosity) {
       text += `| Date Range | ${oldest} to ${newest} |\n`;
     }
 
-    if (totalItems > 100) {
-      text += `\n_Hint: Use list-emails-delta for efficient incremental sync of large folders._`;
+    // List mode returns at most 50 with no page cursor, so anything bigger
+    // needs delta sync to read in full.
+    if (totalItems > 50) {
+      text += `\n_Hint: Use \`search-emails\` with \`deltaMode: true\` for efficient incremental sync of large folders._`;
     }
 
     return { text, meta };
@@ -210,7 +212,10 @@ function formatFolderStats(folder, dateRange, verbosity) {
   text += `|---------|-------|\n`;
   text += `| Page Size | ${pageSize} emails |\n`;
   text += `| Total Pages | ${totalPages} |\n`;
-  text += `| Estimated API Calls | ${totalPages} (list-emails) |\n`;
+  text +=
+    totalItems > 50
+      ? `| Estimated API Calls | ${Math.ceil(totalItems / 100)} (\`search-emails\` \`deltaMode: true\`, 100 per page; list mode stops at 50) |\n`
+      : `| Estimated API Calls | 1 (\`search-emails\` list mode, \`count\` up to 50) |\n`;
 
   if (dateRange) {
     const newestDate = new Date(dateRange.newest);
@@ -233,12 +238,12 @@ function formatFolderStats(folder, dateRange, verbosity) {
   text += `\n## Recommendations\n\n`;
 
   if (totalItems > 1000) {
-    text += `- **Large folder**: Use \`list-emails-delta\` for incremental sync\n`;
+    text += `- **Large folder**: Use \`search-emails\` with \`deltaMode: true\` for incremental sync\n`;
     text += `- **Use date filters**: \`receivedAfter\` and \`receivedBefore\` to narrow scope\n`;
-  } else if (totalItems > 100) {
-    text += `- **Medium folder**: Consider using \`list-emails-delta\` for efficient updates\n`;
+  } else if (totalItems > 50) {
+    text += `- **Medium folder**: Consider \`search-emails\` with \`deltaMode: true\` for efficient updates\n`;
   } else {
-    text += `- **Small folder**: \`list-emails\` with default pagination is efficient\n`;
+    text += `- **Small folder**: \`search-emails\` in list mode (raise \`count\` up to 50) is enough\n`;
   }
 
   if (unreadItems > 50) {

package/index.js

@@ -42,9 +42,12 @@ Key environment variables:
                                     send or delete anything (reads and sign-in still work)
   OUTLOOK_ALLOWED_RECIPIENTS        Comma-separated recipient allowlist
   OUTLOOK_MAX_EMAILS_PER_SESSION    Default cap per session for every rate-limited tool
-                                    (send-email, draft, manage-rules); 0 or unset = no cap
+                                    (send-email, draft, create-event, manage-rules).
+                                    Unset or empty = no cap. 0 BLOCKS those tools; so does
+                                    any value that isn't a whole number (fails closed)
   OUTLOOK_MAX_<TOOL>_PER_SESSION    Per-tool cap overriding the default, tool name in upper
                                     case with _ for -, e.g. OUTLOOK_MAX_SEND_EMAIL_PER_SESSION
+                                    (also covers draft action=send); 0 blocks that tool
   OUTLOOK_DEFAULT_TIMEZONE          IANA timezone for event times (default Australia/Melbourne)
   OUTLOOK_IMMUTABLE_IDS             Set to "true" for message IDs that survive folder moves
   OUTLOOK_SEARCH_SCAN_LIMIT         Local search fallback window (default 500, max 5000)
@@ -88,6 +91,11 @@ const { createServer } = require('./server');
 const { setToolCount } = require('./auth');
 const { TOOLS } = require('./tools');
 const { isDebugEnabled } = require('./utils/logger');
+const {
+  blockedTools,
+  resolveSessionLimit,
+  RATE_LIMITED_TOOLS,
+} = require('./utils/safety');
 
 // Log startup information
 console.error(
@@ -103,8 +111,11 @@ if (isDebugEnabled()) {
 // F-1 / F-48: warn at startup when safety belts are unset. Mirrors the
 // warning surfaced by `auth action=about`. Visible to operators reading
 // stderr; AI clients reading the JSON-RPC stream are unaffected.
+const sessionLimitSet = Object.keys(RATE_LIMITED_TOOLS).some(
+  (tool) => resolveSessionLimit(tool).limit !== null
+);
 if (
-  !process.env.OUTLOOK_MAX_EMAILS_PER_SESSION &&
+  !sessionLimitSet &&
   !process.env.OUTLOOK_ALLOWED_RECIPIENTS &&
   !config.USE_TEST_MODE
 ) {
@@ -112,6 +123,13 @@ if (
     '⚠ Safety belts not configured. Consider setting OUTLOOK_MAX_EMAILS_PER_SESSION and OUTLOOK_ALLOWED_RECIPIENTS in your .mcp.json env block for safer AI-assisted sending. See `auth action=about` for details.'
   );
 }
+// #302: say plainly when a session limit of 0 switches a tool off.
+const blocked = blockedTools();
+if (blocked.length > 0) {
+  console.error(
+    `Session limits block ${blocked.join(', ')} (0 or an unreadable value). Unset the setting for no limit. See \`auth action=about\`.`
+  );
+}
 
 // Set dynamic tool count for auth about handler
 setToolCount(TOOLS.length);

package/llms-install.md

@@ -81,7 +81,7 @@ Add these to the same `env` block if needed:
 |----------|---------|
 | `OUTLOOK_AUTH_AUDIENCE` | `consumers` for Azure apps registered as personal-accounts-only (fixes `AADSTS9002331`); `organizations` or a tenant GUID for work-only apps. Default `common` |
 | `OUTLOOK_DEFAULT_TIMEZONE` | IANA timezone for calendar times (default `Australia/Melbourne`) |
-| `OUTLOOK_MAX_EMAILS_PER_SESSION` | Default per-session cap, counted separately per tool, for `send-email` (including `draft` send), `draft` create/update/reply/reply-all/forward, `manage-rules` and `create-event` (override one tool with `OUTLOOK_MAX_<TOOL>_PER_SESSION`, e.g. `OUTLOOK_MAX_SEND_EMAIL_PER_SESSION`) |
+| `OUTLOOK_MAX_EMAILS_PER_SESSION` | Default per-session cap, counted separately per tool, for `send-email` (including `draft` send), `draft` create/update/reply/reply-all/forward, `manage-rules` and `create-event` (override one tool with `OUTLOOK_MAX_<TOOL>_PER_SESSION`, e.g. `OUTLOOK_MAX_SEND_EMAIL_PER_SESSION`). Unset = no limit; `0` blocks the tool |
 | `OUTLOOK_ALLOWED_RECIPIENTS` | Comma-separated allowlist of recipient domains/addresses for sends, drafts, rule forwards and event attendees |
 | `OUTLOOK_READ_ONLY` | `true` refuses every tool call that would change something (sending, drafts, moves, deletes, rules, settings, file writes), dry runs included; reads and sign-in still work |
 | `OUTLOOK_SHARED_MAILBOX` | Opt-in shared-mailbox support, work/school accounts only: `read` or `true` (read and organise). Also add `Mail.Read.Shared` (and `Mail.ReadWrite.Shared` for `true`) in Azure, restart, then run `auth` with `action=authenticate` and `force=true` |

package/llms.txt

@@ -26,7 +26,7 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 - **Progressive search**: Automatically falls back through 4 search strategies when Microsoft's `$search` API is unavailable (personal accounts) — most Graph API wrappers fail silently. Explicit "no results" messaging instead of unfiltered fallback, and `_meta.searchMetadata` reports which strategy answered plus any filter that could not be honoured (`droppedFilters`), so a partially-applied search can never pass as a complete one. Field-scoped `$search` expressions (`from:`/`to:`/`subject:`), which personal accounts reject outright, are translated to equivalent OData filters and retried. Cross-folder search (`searchAllFolders`) reliably returns a superset of inbox results.
 - **Remote-friendly auth**: Device code flow (default) — no auth server, no port forwarding, no SSH tunnels. State persists across MCP server restarts. Works from Untether, mosh, SSH, and headless environments.
 - **Email forensics**: Built-in header analysis for DKIM, SPF, DMARC authentication, delivery chains, and spam scores — useful for phishing investigation and compliance
-- **Delta sync**: Incremental inbox monitoring — returns only new, modified, and deleted emails since last check, with tokens for continuous polling
+- **Delta sync**: Incremental inbox monitoring — returns only new, modified, and deleted emails since last check, with tokens for continuous polling; every page is labelled initial or incremental (`_meta.syncType`)
 - **Batch operations**: Flag, move, export, or categorise multiple emails in a single tool call; search-driven export for batch archiving without collecting IDs
 - **Pre-send intelligence**: Check recipients for out-of-office, mailbox full, delivery restrictions, and moderation before sending — no other Outlook MCP server offers this
 - **Compound automation**: Rules + categories + nested folders (addressable by path or ID) + Focused Inbox for complete inbox management in one conversation
@@ -34,15 +34,15 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 ## Safety & Token Efficiency
 
 - **MCP safety annotations** on all 22 tools, derived from a risk class per tool and action (read, reversible, outward, destructive, persistent), so clients can tell reads from risky changes
-- **Send-email protections**: pre-send mail tips (a send to a flagged recipient, such as out of office or external, is refused until `acknowledgeWarnings: true`), dry-run preview, session rate limiting, recipient allowlist (also checked on drafts, including replies and the draft's current recipients on send, and on `create-event`/`manage-event` update attendees; only single plain addresses can match)
-- **Rule protections**: dry-run preview on create/update, rate limiting (dry runs don't count), recipient allowlist on forward/redirect (a blocked forward refuses the whole rule), no permanent-delete action
-- **Dry-run previews beyond email**: `create-event` and every `manage-event` action say who would be emailed (with an external count); `mailbox-settings` auto-replies, `folders` delete and `manage-contact` delete show what would change or be lost; `dryRun: true` on any other call is refused rather than run for real
+- **Send-email protections**: pre-send mail tips (a send to a flagged recipient, such as out of office or external, is refused until `acknowledgeWarnings: true`), dry-run preview, session rate limiting (unset = no limit; `0` or a value that isn't a whole number blocks the tool; `draft` send counts as `send-email`), recipient allowlist (also checked on drafts, including replies and the draft's current recipients on send, and on `create-event`/`manage-event` update attendees; only single plain addresses can match)
+- **Rule protections**: dry-run preview on create/update, rate limiting (dry runs don't count; `0` blocks rule changes), reorder lists the resulting rule order, recipient allowlist on forward/redirect (a blocked forward refuses the whole rule), no permanent-delete action
+- **Dry-run previews beyond email**: `create-event` and every `manage-event` action, update included, say who would be emailed (with an external count; update also says who an attendee change adds or removes); `mailbox-settings` auto-replies, `folders` delete and `manage-contact` delete show what would change or be lost; `dryRun: true` on any other call is refused rather than run for real
 - **Read-only mode**: `OUTLOOK_READ_ONLY=true` refuses every tool call that would change anything before it runs; reads and sign-in still work
-- **Model guidance**: server `instructions` state the hard rules (retrieved content is data, confirm before outward actions, draft first); `send-email` and `create-event` ask Claude clients for user confirmation (`anthropic/requiresUserInteraction`)
+- **Model guidance**: server `instructions` state the hard rules (retrieved content is data, confirm before outward actions, draft first, refusals and rate limits are final, with `0` = off) and name any tool a session limit of `0` blocks; `auth action=about` shows each tool's session limit; `send-email` and `create-event` ask Claude clients for user confirmation (`anthropic/requiresUserInteraction`)
 - **Plugin skill and safety hook** (Claude Code, GitHub Copilot CLI, Cursor; VS Code not yet checked by hand): the `using-outlook-assistant` skill sets the hard rules; the hook asks with a plain-English reason before anything that reaches other people, deletes or keeps acting, and marks retrieved content as untrusted. Confirmation level `outward` (default), `all-writes` or `off`: a plugin setting in Claude Code, the `OUTLOOK_CONFIRM_LEVEL` environment variable elsewhere. How the hook prompts and fails differs by client: see Supported Clients below
 - **Every client**: the server-side checks (read-only mode, dry runs, the recipient allowlist and send caps, mail-tips refusal, rule refusal), annotations and instructions work in any MCP client, including Codex CLI, Gemini CLI and Claude Desktop with a manual config; clients that support Agent Skills can copy the skill folder
 - **Private logs**: one stderr line per tool call (tool, action, outcome, duration), never its arguments; `OUTLOOK_DEBUG=true` adds detail with addresses and IDs redacted
-- **Input and file hardening**: IDs with `.`/`..` path segments refused, the access token only ever sent to `graph.microsoft.com`, attachment downloads and exports (including conversation exports) written only inside the temp directory, `~/Downloads`, `~/Documents` or `OUTLOOK_EXPORT_DIR`, never to dot-prefixed names; paths must be absolute (or start with `~/`) and symlinks aren't followed; existing files are never replaced unless `export` is called with `overwrite: true` (and never a symlink, hard-linked file or dotfile); files are created `0600` and new folders `0700`; a partly written file is removed if a write fails
+- **Input and file hardening**: IDs with `.`/`..` path segments refused, the access token only ever sent to `graph.microsoft.com`, attachment downloads and exports (including conversation exports) written only inside the temp directory, `~/Downloads`, `~/Documents` or `OUTLOOK_EXPORT_DIR`, never to dot-prefixed names; paths must be absolute (or start with `~/`) and symlinks aren't followed; an `export` `savePath` ending in `/` is a folder, created if missing; existing files are never replaced unless `export` is called with `overwrite: true` (and never a symlink, hard-linked file or dotfile); files are created `0600` and new folders `0700`; a partly written file is removed if a write fails
 - **Throttling-aware Graph client**: `429` (and `503`/`504` for non-POST requests) retried honouring `Retry-After`, a per-attempt inactivity timeout (`OUTLOOK_REQUEST_TIMEOUT_MS`, default 60000 ms) and at most 4 requests in flight, so bulk operations neither hang nor throttle themselves
 - **Shared mailboxes off by default**: `.Shared` scopes are requested only when `OUTLOOK_SHARED_MAILBOX` is set (`read` keeps shared access read-only)
 - **Token-optimised**: 22 tools instead of 55 saves ~11,000 tokens per turn (~64% reduction), improving AI accuracy and context efficiency
@@ -73,9 +73,9 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 - **Calendar (3 tools)**: `list-events` (`startAfter`, `startBefore`, `subject` filters), `create-event` (`dryRun`; retry-safe `transactionId`), `manage-event` (update, decline, cancel, delete; `dryRun` on all)
 - **Contacts (2 tools)**: `manage-contact`, `search-people`
 - **Folders (1 tool)**: `folders` — list, create, move, stats, delete; folders addressable by nested path (`Parent/Child`) or ID
-- **Rules (1 tool)**: `manage-rules` — list, create, update, reorder, delete
+- **Rules (1 tool)**: `manage-rules` — list, create, update, reorder, delete (12 conditions including `hasAttachments`, 9 actions, `except*` exceptions)
 - **Categories (3 tools)**: `manage-category`, `apply-category`, `manage-focused-inbox`
-- **Settings (1 tool)**: `mailbox-settings` — get, set auto-replies, set working hours
+- **Settings (1 tool)**: `mailbox-settings` — get, set auto-replies (`dryRun`; schedules shown as UTC plus a labelled local time), set working hours
 - **Advanced (2 tools)**: `access-shared-mailbox` (messages, `listFolders`, `folderId`, nested folder paths), `find-meeting-rooms`
 
 ## Documentation
@@ -92,6 +92,6 @@ Built by [Little Bear Apps](https://littlebearapps.com).
 - [FAQ](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/faq/faq.md): Frequently asked questions — install, accounts, permissions, tokens, send safety, updates, uninstall (also at <https://littlebearapps.com/help/outlook-assistant/faq/>)
 - [CLAUDE.md](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CLAUDE.md): Quick reference for development
 - [CONTRIBUTING](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CONTRIBUTING.md): Contribution guidelines
-- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.14.0 — security and safety release: read-only mode, server instructions, more dry-run previews, mail-tips refusal, the plugin skill and a safety hook for Claude Code, GitHub Copilot and Cursor, and fixes for three advisories covering the recipient allowlist, export file writes and dry runs)
-- [ROADMAP](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/ROADMAP.md): Active milestones (v3.14.0 safety skill, hooks and MCP hardening; v3.15.0 structured outputs and paging; v4.0.0 MCP 2026-07-28 and server-side confirmation; the patch-release fix queue; v3.8.x carry-over; v3.16.0+ new Graph APIs)
+- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.14.1 — security and safety release: read-only mode, server instructions, more dry-run previews, mail-tips refusal, the plugin skill and a safety hook for Claude Code, GitHub Copilot and Cursor, and fixes for three advisories covering the recipient allowlist, export file writes and dry runs)
+- [ROADMAP](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/ROADMAP.md): Active milestones (v3.14.1 live-test fixes; v3.15.0 structured outputs and paging; v4.0.0 MCP 2026-07-28 and server-side confirmation; the patch-release fix queue; v3.8.x carry-over; v3.16.0+ new Graph APIs)
 - [SECURITY](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/SECURITY.md): Security policy (report vulnerabilities privately via GitHub private vulnerability reporting; acknowledged within 7 days), token handling, and MCP safety controls

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@littlebearapps/outlook-assistant",
-  "version": "3.14.0",
+  "version": "3.14.1",
   "mcpName": "io.github.littlebearapps/outlook-assistant",
   "description": "Outlook Assistant — MCP server with 22 tools for email, calendar, contacts, and settings via Microsoft Graph API",
   "main": "index.js",

package/rules/create.js

@@ -104,7 +104,7 @@ async function handleCreateRule(args) {
     // Dry-run: preview without creating
     if (dryRun) {
       const preview = formatRuleDryRunPreview(rule);
-      let text = `DRY RUN — Rule preview (not created):\n\n${preview}`;
+      let text = `Rule preview (not created):\n\n${preview}`;
       if (allWarnings.length > 0) {
         text += `\n\nWarnings:\n${allWarnings.map((w) => `- ${w}`).join('\n')}`;
       }

package/rules/index.js

@@ -106,11 +106,32 @@ async function handleEditRuleSequence(args) {
       { sequence }
     );
 
+    // Exchange may renumber other rules to make room, and deleting a rule
+    // later doesn't shift them back (#307), so show the resulting order.
+    let order = '';
+    try {
+      const after = await getInboxRules(accessToken);
+      const before = new Map(rules.map((r) => [r.id, r.sequence]));
+      const lines = [...after]
+        .sort((a, b) => (a.sequence ?? 0) - (b.sequence ?? 0))
+        .map((r) => `${r.sequence}: ${r.displayName}`);
+      const moved = after.filter(
+        (r) => r.id !== rule.id && before.get(r.id) !== r.sequence
+      );
+      const movedNote =
+        moved.length > 0
+          ? `\n\nRenumbered by Exchange: ${moved.map((r) => `"${r.displayName}" ${before.get(r.id)} → ${r.sequence}`).join('; ')}. Tell the user; deleting a rule later doesn't shift them back.`
+          : '\n\nNo other rule was renumbered.';
+      order = `\n\nRule order now (sequence: name):\n${lines.join('\n')}${movedNote}`;
+    } catch (_error) {
+      // The reorder succeeded; the order listing is a courtesy.
+    }
+
     return {
       content: [
         {
           type: 'text',
-          text: `Successfully updated the sequence of rule "${ruleName}" to ${sequence}.`,
+          text: `Successfully updated the sequence of rule "${ruleName}" to ${sequence}.${order}`,
         },
       ],
     };
@@ -128,7 +149,7 @@ const rulesTools = [
   {
     name: 'manage-rules',
     description:
-      'Server-side inbox rules (destructive: covers `delete`; `dryRun` previews create/update). Rules run on the Exchange server whichever client is open. action=`list` (default) returns rules with id/name/sequence; `includeDetails: true` adds conditions/actions/exceptions. action=`create` builds a rule from condition params (12, e.g. fromAddresses, containsSubject, bodyContains, hasAttachments, importance, sentTo, sensitivity), action params (9, e.g. moveToFolder/copyToFolder — folder name, nested path like `Triage/Delete`, or ID — forwardTo, redirectTo, assignCategories, markAsRead, delete) and optional `except*` exceptions. action=`update` patches fields by `ruleId` or `ruleName`. action=`reorder` changes priority via `sequence` (lower runs first). action=`delete` removes a rule. The recipient allowlist applies to forwardTo/redirectTo. There is deliberately no `permanentDelete` action (too dangerous for AI use; use the Outlook UI). Subject to session rate limits (`OUTLOOK_MAX_MANAGE_RULES_PER_SESSION`).',
+      'Server-side inbox rules (destructive: covers `delete`; `dryRun` previews create/update). Rules run on the Exchange server whichever client is open. action=`list` (default) returns rules with id/name/sequence; `includeDetails: true` adds conditions/actions/exceptions. action=`create` builds a rule from condition params (12, e.g. fromAddresses, containsSubject, bodyContains, hasAttachments, importance, sensitivity), action params (9, e.g. moveToFolder/copyToFolder — folder name, nested path like `Triage/Delete`, or ID — forwardTo, redirectTo, assignCategories, markAsRead, delete) and optional `except*` exceptions. action=`update` patches fields by `ruleId` or `ruleName`. action=`reorder` changes priority via `sequence` (lower runs first). action=`delete` removes a rule. The recipient allowlist applies to forwardTo/redirectTo. There is no `permanentDelete` action. Changes count against the session limit (`OUTLOOK_MAX_MANAGE_RULES_PER_SESSION`, else `OUTLOOK_MAX_EMAILS_PER_SESSION`); 0 refuses them.',
     ...toolMetadata('manage-rules', 'Inbox Rules'),
     inputSchema: {
       type: 'object',

package/rules/list.js

@@ -153,7 +153,7 @@ function formatRuleConditions(rule) {
   }
 
   // Booleans
-  if (c.hasAttachment === true) conditions.push('Has attachment');
+  if (c.hasAttachments === true) conditions.push('Has attachment');
   if (c.sentToMe === true) conditions.push('Sent to me');
   if (c.sentOnlyToMe === true) conditions.push('Sent only to me');
   if (c.sentCcMe === true) conditions.push('I am in CC');
@@ -269,7 +269,7 @@ function formatRuleExceptions(rule) {
   if (e.recipientContains?.length > 0) {
     parts.push(`Recipient contains: "${e.recipientContains.join('", "')}"`);
   }
-  if (e.hasAttachment === true) parts.push('Has attachment');
+  if (e.hasAttachments === true) parts.push('Has attachment');
   if (e.importance) parts.push(`Importance: ${e.importance}`);
   if (e.sensitivity) parts.push(`Sensitivity: ${e.sensitivity}`);
   if (e.sentToMe === true) parts.push('Sent to me');

package/rules/rule-builder.js

@@ -76,7 +76,7 @@ function buildConditions(args) {
   }
 
   // Boolean conditions
-  if (args.hasAttachments === true) conditions.hasAttachment = true;
+  if (args.hasAttachments === true) conditions.hasAttachments = true;
   if (args.sentToMe === true) conditions.sentToMe = true;
   if (args.sentOnlyToMe === true) conditions.sentOnlyToMe = true;
   if (args.sentCcMe === true) conditions.sentCcMe = true;
@@ -303,7 +303,7 @@ function buildExceptions(args) {
     exceptions.bodyContains = parseCommaSeparated(args.exceptBodyContains);
   }
   if (args.exceptHasAttachments === true) {
-    exceptions.hasAttachment = true;
+    exceptions.hasAttachments = true;
   }
 
   return { exceptions, warnings };

package/rules/update.js

@@ -118,7 +118,7 @@ async function handleUpdateRule(args) {
       const currentPreview = formatRuleDryRunPreview(currentRule);
       const updatedPreview = formatRuleDryRunPreview(updatedRule);
 
-      let text = `DRY RUN — Update preview for "${currentRule.displayName}" (not applied):\n\n`;
+      let text = `Update preview for "${currentRule.displayName}" (not applied):\n\n`;
       text += `CURRENT:\n${currentPreview}\n\n`;
       text += `AFTER UPDATE:\n${updatedPreview}`;
       if (allWarnings.length > 0) {

package/server.js

@@ -9,6 +9,7 @@ const config = require('./config');
 const { createRequestHandler } = require('./request-handler');
 const { TOOLS } = require('./tools');
 const { serverInstructions } = require('./utils/server-instructions');
+const { blockedTools } = require('./utils/safety');
 
 /**
  * @param {Array<object>} [tools] - tool definitions (default: the registry)
@@ -23,8 +24,11 @@ function createServer(tools = TOOLS) {
       // -32601 rather than empty stubs. (#276)
       capabilities: { tools: { listChanged: false } },
       // Model-facing safety rules and usage tips, sent in the initialize
-      // result (#271).
-      instructions: serverInstructions({ readOnly: config.READ_ONLY }),
+      // result (#271), naming any tool a session limit of 0 blocks (#302).
+      instructions: serverInstructions({
+        readOnly: config.READ_ONLY,
+        blockedTools: blockedTools(),
+      }),
     }
   );