@littlebearapps/outlook-assistant 3.5.2 → 3.7.0

package/README.md

@@ -34,6 +34,7 @@ Outlook Assistant connects AI assistants to your Microsoft Outlook account throu
 
 - 📨 **Search and read emails** — find messages by sender, subject, date, or keywords; read full threads with conversation grouping; batch flag, move, export, or categorise multiple emails at once
 - 🛡️ **Send emails with safety controls** — dry-run preview, pre-send mail tips (out-of-office, mailbox full, delivery restrictions), session rate limiting, and recipient allowlist to prevent mistakes
+- ✏️ **Draft emails for review** — create, update, and send drafts; reply and forward as drafts; preview before saving with dry-run mode
 - 📅 **Manage your calendar** — view upcoming events, schedule meetings with attendees, decline or cancel invitations
 - 📦 **Export emails** — save to Markdown, EML, MBOX, JSON, or HTML for archiving, analysis, or migration; export search results or entire threads in one call
 - 🔍 **Investigate email headers** — check DKIM, SPF, and DMARC authentication; trace delivery chains; analyse spam scores — useful for phishing investigation and compliance
@@ -60,17 +61,17 @@ Outlook Assistant connects AI assistants to your Microsoft Outlook account throu
 
 | Module | Tools | What You Can Do |
 |--------|------:|-----------------|
-| **Email** | 7 | `search-emails` (list/search/delta/conversations), `read-email` (content + forensic headers), `send-email` (with dry-run + mail tips), `update-email` (read status, flags), `attachments`, `export`, `get-mail-tips` |
+| **Email** | 8 | `search-emails` (list/search/delta/conversations), `read-email` (content + forensic headers), `send-email` (with dry-run + mail tips), `draft` (create/update/send/delete/reply/forward), `update-email` (read status, flags), `attachments`, `export`, `get-mail-tips` |
 | **Calendar** | 3 | `list-events`, `create-event`, `manage-event` (decline/cancel/delete) |
 | **Contacts** | 2 | `manage-contact` (list/search/get/create/update/delete), `search-people` |
 | **Categories** | 3 | `manage-category` (CRUD), `apply-category`, `manage-focused-inbox` |
 | **Settings** | 1 | `mailbox-settings` (get/set auto-replies/set working hours) |
 | **Folder** | 1 | `folders` (list/create/move/stats/delete) |
-| **Rules** | 1 | `manage-rules` (list/create/reorder/delete) |
+| **Rules** | 1 | `manage-rules` (list/create/update/reorder/delete) |
 | **Advanced** | 2 | `access-shared-mailbox`, `find-meeting-rooms` |
 | **Auth** | 1 | `auth` (status/authenticate/about) |
 
-**21 tools total** — consolidated from 55 for optimal AI performance. See the [Tools Reference](docs/quickrefs/tools-reference.md) for complete parameter details.
+**22 tools total** — consolidated from 55 for optimal AI performance. See the [Tools Reference](docs/quickrefs/tools-reference.md) for complete parameter details.
 
 ### Export Formats
 
@@ -126,7 +127,9 @@ Outlook Assistant is designed with safety-first principles for AI-driven email a
 - **Session rate limiting** — configurable via `OUTLOOK_MAX_EMAILS_PER_SESSION` (default: unlimited)
 - **Recipient allowlist** — restrict sending to approved addresses/domains via `OUTLOOK_ALLOWED_RECIPIENTS`
 
-**Token-optimised architecture** — Tools are consolidated using the STRAP (Single Tool, Resource, Action Pattern) approach. 21 tools instead of 55 reduces per-turn overhead by ~11,000 tokens (~64%), keeping more of the AI's context window available for your actual conversation. Fewer tools also means the AI selects the right tool more accurately — research shows tool selection degrades beyond ~40 tools.
+**Draft protections** — The `draft` tool shares `send-email` safety controls: dry-run preview, recipient allowlist, mail-tips validation, and rate limiting. The `send` action shares the `send-email` rate limit counter, preventing circumvention via the draft-then-send pathway.
+
+**Token-optimised architecture** — Tools are consolidated using the STRAP (Single Tool, Resource, Action Pattern) approach. 22 tools instead of 55 reduces per-turn overhead by ~11,000 tokens (~64%), keeping more of the AI's context window available for your actual conversation. Fewer tools also means the AI selects the right tool more accurately — research shows tool selection degrades beyond ~40 tools.
 
 > **Important**: These safeguards are defence-in-depth measures that reduce risk, but they are not a guarantee against unintended actions. AI-driven access to your email is inherently sensitive — always review tool calls before approving, particularly for sends and deletes. No automated guardrail is foolproof, and you remain responsible for actions taken through your mailbox.
 
@@ -374,7 +377,7 @@ This starts a local server on port 3333 to handle the OAuth callback.
 
 ```
 outlook-assistant/
-├── index.js                 # Main entry point (21 tools)
+├── index.js                 # Main entry point (22 tools)
 ├── config.js                # Configuration settings
 ├── outlook-auth-server.js   # OAuth server (port 3333)
 ├── auth/                    # Authentication module (1 tool)
@@ -466,7 +469,7 @@ USE_TEST_MODE=true npm start
 | [Azure Setup Guide](docs/guides/azure-setup.md) | Azure account creation, app registration, permissions, and secrets |
 | [How-To Guides](docs/how-to/index.md) | 28 practical guides for email, calendar, contacts, and settings |
 | [Troubleshooting & FAQ](docs/how-to/getting-started/verify-your-connection.md#common-connection-problems) | Common problems, re-authentication, and frequently asked questions |
-| [Tools Reference](docs/quickrefs/tools-reference.md) | All 21 tools with parameters |
+| [Tools Reference](docs/quickrefs/tools-reference.md) | All 22 tools with parameters |
 | [AI Agent Guide](docs/how-to/ai-agents/using-outlook-assistant-in-agents.md) | Tool selection and workflow patterns for AI agents |
 
 Full documentation: [docs/](docs/README.md)

package/advanced/index.js

@@ -96,7 +96,7 @@ async function handleAccessSharedMailbox(args) {
       };
     }
 
-    let output = [];
+    const output = [];
     output.push(`# Shared Mailbox: ${sharedMailbox}`);
     output.push(`**Folder**: ${mailFolder} | **Count**: ${messages.length}\n`);
 
@@ -241,7 +241,7 @@ async function handleSetMessageFlag(args) {
           timeZone: DEFAULT_TIMEZONE,
         };
       } else {
-        const startOfDay = dueDt.split('T')[0] + 'T09:00:00';
+        const startOfDay = `${dueDt.split('T')[0]}T09:00:00`;
         flag.startDateTime = {
           dateTime: startOfDay,
           timeZone: DEFAULT_TIMEZONE,
@@ -269,7 +269,7 @@ async function handleSetMessageFlag(args) {
       }
     }
 
-    let output = [];
+    const output = [];
 
     if (results.length > 0) {
       output.push(`Flagged ${results.length} message(s) for follow-up`);
@@ -377,7 +377,7 @@ async function handleClearMessageFlag(args) {
     }
 
     const action = markComplete ? 'marked complete' : 'cleared';
-    let output = [];
+    const output = [];
 
     if (results.length > 0) {
       output.push(`${results.length} message(s) ${action}`);
@@ -504,7 +504,7 @@ async function handleFindMeetingRooms(args) {
       };
     }
 
-    let output = [];
+    const output = [];
     output.push(`# Meeting Rooms (${rooms.length})\n`);
 
     if (verbosity === 'minimal') {

package/auth/device-code.js

@@ -92,7 +92,9 @@ async function pollForToken(clientId, deviceCode, interval, expiresIn) {
   let pollInterval = interval;
 
   while (Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, pollInterval * 1000));
+    await new Promise((resolve) => {
+      setTimeout(resolve, pollInterval * 1000);
+    });
 
     const postData = querystring.stringify({
       client_id: clientId,

package/auth/oauth-server.js

@@ -112,16 +112,16 @@ function setupOAuthRoutes(
     // Since this is a module, actual session handling is outside its direct scope,
     // but it's crucial for the consuming application to handle state verification.
 
-    const authorizationUrl =
-      `${authConfig.authEndpoint}?` +
-      querystring.stringify({
+    const authorizationUrl = `${authConfig.authEndpoint}?${querystring.stringify(
+      {
         client_id: authConfig.clientId,
         response_type: 'code',
         redirect_uri: authConfig.redirectUri,
         scope: authConfig.scopes.join(' '),
         response_mode: 'query',
         state: state,
-      });
+      }
+    )}`;
     res.redirect(authorizationUrl);
   });
 

package/auth/token-manager.js

@@ -88,8 +88,8 @@ function getAccessToken() {
  */
 function createTestTokens() {
   const testTokens = {
-    access_token: 'test_access_token_' + Date.now(),
-    refresh_token: 'test_refresh_token_' + Date.now(),
+    access_token: `test_access_token_${Date.now()}`,
+    refresh_token: `test_refresh_token_${Date.now()}`,
     expires_at: Date.now() + 3600 * 1000, // 1 hour
   };
 

package/calendar/list.js

@@ -18,7 +18,7 @@ async function handleListEvents(args) {
     const accessToken = await ensureAuthenticated();
 
     // Build API endpoint
-    let endpoint = 'me/events';
+    const endpoint = 'me/events';
 
     // Add query parameters
     const queryParams = {
@@ -54,10 +54,10 @@ async function handleListEvents(args) {
       .map((event, index) => {
         const startDt = event.start.dateTime.endsWith('Z')
           ? event.start.dateTime
-          : event.start.dateTime + 'Z';
+          : `${event.start.dateTime}Z`;
         const endDt = event.end.dateTime.endsWith('Z')
           ? event.end.dateTime
-          : event.end.dateTime + 'Z';
+          : `${event.end.dateTime}Z`;
         const startDate = new Date(startDt).toLocaleString('en-AU', {
           timeZone: tz,
           dateStyle: 'medium',

package/categories/index.js

@@ -106,7 +106,7 @@ async function handleListCategories(args) {
     }
 
     // Format output based on verbosity
-    let output = [];
+    const output = [];
     output.push(`# Master Categories (${categories.length})\n`);
 
     if (outputVerbosity === 'minimal') {
@@ -117,7 +117,7 @@ async function handleListCategories(args) {
       categories.forEach((cat) => {
         const colorName = COLOR_NAMES[cat.color] || cat.color;
         const idDisplay =
-          outputVerbosity === 'full' ? cat.id : cat.id.substring(0, 8) + '...';
+          outputVerbosity === 'full' ? cat.id : `${cat.id.substring(0, 8)}...`;
         output.push(`| ${cat.displayName} | ${colorName} | ${idDisplay} |`);
       });
     }
@@ -503,7 +503,7 @@ async function handleApplyCategory(args) {
       }
     }
 
-    let output = [];
+    const output = [];
 
     if (results.length > 0) {
       output.push(
@@ -591,7 +591,7 @@ async function handleGetFocusedInboxOverrides(args) {
       };
     }
 
-    let output = [];
+    const output = [];
     output.push(`# Focused Inbox Overrides (${overrides.length})\n`);
 
     // Group by classification

package/contacts/index.js

@@ -66,10 +66,12 @@ function formatContact(contact, verbosity = 'standard') {
     // Phone numbers
     const phones = [];
     if (contact.mobilePhone) phones.push(`Mobile: ${contact.mobilePhone}`);
-    if (contact.businessPhones?.length > 0)
+    if (contact.businessPhones?.length > 0) {
       phones.push(`Work: ${contact.businessPhones[0]}`);
-    if (contact.homePhones?.length > 0)
+    }
+    if (contact.homePhones?.length > 0) {
       phones.push(`Home: ${contact.homePhones[0]}`);
+    }
     if (phones.length > 0) {
       lines.push(`**Phone**: ${phones.join(' | ')}`);
     }
@@ -86,8 +88,9 @@ function formatContact(contact, verbosity = 'standard') {
   // Full verbosity extras
   if (verbosity === 'full') {
     if (contact.department) lines.push(`**Department**: ${contact.department}`);
-    if (contact.officeLocation)
+    if (contact.officeLocation) {
       lines.push(`**Office**: ${contact.officeLocation}`);
+    }
     if (contact.birthday) lines.push(`**Birthday**: ${contact.birthday}`);
 
     // Addresses
@@ -130,12 +133,7 @@ async function handleListContacts(args) {
   try {
     const accessToken = await ensureAuthenticated();
 
-    const fields =
-      verbosity === 'full'
-        ? CONTACT_FIELDS.full
-        : verbosity === 'minimal'
-          ? CONTACT_FIELDS.minimal
-          : CONTACT_FIELDS.list;
+    const fields = CONTACT_FIELDS[verbosity] || CONTACT_FIELDS.list;
     const endpoint = folder
       ? `me/contactFolders/${folder}/contacts`
       : 'me/contacts';
@@ -155,7 +153,7 @@ async function handleListContacts(args) {
     );
     const contacts = response.value || [];
 
-    let output = [];
+    const output = [];
     output.push(`# Contacts\n`);
     output.push(`**Total**: ${contacts.length}`);
     output.push('');
@@ -202,12 +200,7 @@ async function handleSearchContacts(args) {
   try {
     const accessToken = await ensureAuthenticated();
 
-    const fields =
-      verbosity === 'full'
-        ? CONTACT_FIELDS.full
-        : verbosity === 'minimal'
-          ? CONTACT_FIELDS.minimal
-          : CONTACT_FIELDS.list;
+    const fields = CONTACT_FIELDS[verbosity] || CONTACT_FIELDS.list;
     const endpoint = 'me/contacts';
 
     // Build filter for name — emailAddresses/any() lambda is unreliable on personal accounts
@@ -259,7 +252,7 @@ async function handleSearchContacts(args) {
     }
     const contacts = response.value || [];
 
-    let output = [];
+    const output = [];
     output.push(`# Contact Search Results\n`);
     output.push(`**Query**: "${query}"`);
     output.push(`**Found**: ${contacts.length}`);
@@ -559,7 +552,7 @@ async function handleSearchPeople(args) {
     );
     const people = response.value || [];
 
-    let output = [];
+    const output = [];
     output.push(`# People Search Results\n`);
     output.push(`**Query**: "${query}"`);
     output.push(`**Found**: ${people.length} (sorted by relevance)`);

package/email/conversations.js

@@ -175,12 +175,12 @@ async function handleListConversations(args) {
     });
 
     // Convert to array and sort by most recent
-    let conversationList = Array.from(conversations.values())
+    const conversationList = Array.from(conversations.values())
       .sort((a, b) => new Date(b.lastDate) - new Date(a.lastDate))
       .slice(0, count);
 
     // Format output
-    let output = [];
+    const output = [];
     output.push(`# Email Conversations\n`);
     output.push(`**Folder**: ${folder}`);
     output.push(`**Conversations**: ${conversationList.length}`);
@@ -314,7 +314,7 @@ async function handleGetConversation(args) {
     }
 
     // Format output
-    let output = [];
+    const output = [];
     output.push(`# Email Conversation\n`);
     output.push(`**Subject**: ${messages[0].subject || '(no subject)'}`);
     output.push(`**Messages**: ${messages.length}`);
@@ -463,8 +463,8 @@ async function handleExportConversation(args) {
     const date = formatDateForFilename(messages[0].receivedDateTime);
     const filenameBase = `${date}_${subject}_conversation`;
 
-    let exportedFiles = [];
-    let exportStats = { messages: messages.length, attachments: 0, bytes: 0 };
+    const exportedFiles = [];
+    const exportStats = { messages: messages.length, attachments: 0, bytes: 0 };
 
     switch (format) {
       case 'eml': {
@@ -497,8 +497,8 @@ async function handleExportConversation(args) {
         for (const msg of messages) {
           const mimeContent = await callGraphAPIRaw(accessToken, msg.id);
           const from = msg.from?.emailAddress?.address || 'unknown@unknown.com';
-          const date = new Date(msg.receivedDateTime);
-          const mboxDate = date.toUTCString().replace('GMT', '+0000');
+          const msgDate = new Date(msg.receivedDateTime);
+          const mboxDate = msgDate.toUTCString().replace('GMT', '+0000');
 
           // MBOX format: From line + MIME content + blank line
           mboxContent += `From ${from} ${mboxDate}\n`;
@@ -515,7 +515,7 @@ async function handleExportConversation(args) {
       case 'markdown': {
         // Export as threaded Markdown document
         const mdPath = path.join(resolvedDir, `${filenameBase}.md`);
-        let mdContent = [];
+        const mdContent = [];
 
         mdContent.push(
           `# Email Conversation: ${messages[0].subject || '(no subject)'}\n`
@@ -600,7 +600,7 @@ async function handleExportConversation(args) {
       case 'html': {
         // Export as HTML document
         const htmlPath = path.join(resolvedDir, `${filenameBase}.html`);
-        let htmlContent = [];
+        const htmlContent = [];
 
         htmlContent.push('<!DOCTYPE html>');
         htmlContent.push('<html><head>');
@@ -674,14 +674,16 @@ async function handleExportConversation(args) {
     }
 
     // Format result
-    const sizeFormatted =
-      exportStats.bytes < 1024
-        ? `${exportStats.bytes} B`
-        : exportStats.bytes < 1024 * 1024
-          ? `${(exportStats.bytes / 1024).toFixed(1)} KB`
-          : `${(exportStats.bytes / (1024 * 1024)).toFixed(2)} MB`;
-
-    let output = [];
+    let sizeFormatted;
+    if (exportStats.bytes < 1024) {
+      sizeFormatted = `${exportStats.bytes} B`;
+    } else if (exportStats.bytes < 1024 * 1024) {
+      sizeFormatted = `${(exportStats.bytes / 1024).toFixed(1)} KB`;
+    } else {
+      sizeFormatted = `${(exportStats.bytes / (1024 * 1024)).toFixed(2)} MB`;
+    }
+
+    const output = [];
     output.push(`# Conversation Exported\n`);
     output.push(`**Subject**: ${messages[0].subject || '(no subject)'}`);
     output.push(`**Format**: ${format.toUpperCase()}`);

package/email/delta.js

@@ -88,7 +88,7 @@ async function handleListEmailsDelta(args) {
 
     // Build response
     const isInitialSync = !deltaToken;
-    const hasMoreChanges = !!nextLink;
+    const hasMoreChanges = Boolean(nextLink);
     const newDeltaToken = deltaLink || nextLink;
 
     // Format output based on verbosity