@littlebearapps/outlook-assistant 3.7.4 → 3.8.0

package/.env.example

@@ -28,3 +28,22 @@ USE_TEST_MODE=false
 # device-code: No auth server needed, works remotely/headless
 # browser: Traditional OAuth redirect via localhost:3333
 # OUTLOOK_AUTH_METHOD=device-code
+
+# Optional: OAuth audience — controls which Microsoft Identity Platform
+# endpoint is used. Must match the Azure app registration's "Supported
+# account types" setting:
+#   common         — personal AND work/school accounts (default; multi-tenant + personal apps)
+#   consumers      — personal Microsoft accounts only
+#   organizations  — work/school accounts only
+#   <tenant-guid>  — single-tenant
+# Example: OUTLOOK_AUTH_AUDIENCE=consumers   (for personal-account-only apps)
+# OUTLOOK_AUTH_AUDIENCE=common
+
+# Optional: Default timezone for calendar events when not explicitly
+# specified by the caller. Use any IANA timezone identifier.
+# Default: Australia/Melbourne
+# Examples:
+#   OUTLOOK_DEFAULT_TIMEZONE=Europe/London
+#   OUTLOOK_DEFAULT_TIMEZONE=America/New_York
+#   OUTLOOK_DEFAULT_TIMEZONE=Asia/Tokyo
+# OUTLOOK_DEFAULT_TIMEZONE=Australia/Melbourne

package/README.md

@@ -23,8 +23,8 @@ Outlook Assistant connects AI assistants to your Microsoft Outlook account throu
 
 <div align="center">
   <br />
-  <a href="docs/demo/outlook-assistant-demo.mp4">
-    <img src="docs/demo/outlook-assistant-demo.gif" alt="Outlook Assistant Demo — searching emails, reading, and drafting a reply" width="720" style="border-radius: 12px; box-shadow: 0 8px 32px rgba(0,0,0,0.12);" />
+  <a href="https://github.com/littlebearapps/outlook-assistant/blob/main/docs/demo/outlook-assistant-demo.mp4">
+    <img src="https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/demo/outlook-assistant-demo.gif" alt="Outlook Assistant Demo — searching emails, reading, and drafting a reply" width="720" style="border-radius: 12px; box-shadow: 0 8px 32px rgba(0,0,0,0.12);" />
   </a>
   <br />
   <sub>Search inbox → read &amp; summarise → draft a reply — all from the conversation</sub>
@@ -63,7 +63,7 @@ Outlook Assistant connects AI assistants to your Microsoft Outlook account throu
 | Module | Tools | What You Can Do |
 |--------|------:|-----------------|
 | **Email** | 8 | `search-emails` (list/search/delta/conversations), `read-email` (content + forensic headers), `send-email` (with dry-run + mail tips), `draft` (create/update/send/delete/reply/forward), `update-email` (read status, flags), `attachments`, `export`, `get-mail-tips` |
-| **Calendar** | 3 | `list-events`, `create-event`, `manage-event` (decline/cancel/delete) |
+| **Calendar** | 3 | `list-events`, `create-event`, `manage-event` (update/decline/cancel/delete) |
 | **Contacts** | 2 | `manage-contact` (list/search/get/create/update/delete), `search-people` |
 | **Categories** | 3 | `manage-category` (CRUD), `apply-category`, `manage-focused-inbox` |
 | **Settings** | 1 | `mailbox-settings` (get/set auto-replies/set working hours) |
@@ -336,6 +336,15 @@ USE_TEST_MODE=false
 
 > **Note:** The server also accepts `MS_CLIENT_ID` and `MS_CLIENT_SECRET` for backwards compatibility.
 
+**Optional overrides** (v3.8.0+) — see [`.env.example`](.env.example) for the full list with commented worked examples:
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `OUTLOOK_AUTH_AUDIENCE` | OAuth audience: `common`, `consumers` (personal-only Azure apps), `organizations`, or single-tenant GUID. Fixes `AADSTS9002331` for personal-only app registrations. | `common` |
+| `OUTLOOK_DEFAULT_TIMEZONE` | IANA timezone applied to calendar events when callers don't pass one (e.g. `Europe/London`, `America/New_York`). | `Australia/Melbourne` |
+| `OUTLOOK_MAX_EMAILS_PER_SESSION` | Cap on `send-email` + `draft send` per MCP server lifetime. | unlimited |
+| `OUTLOOK_ALLOWED_RECIPIENTS` | Comma-separated allowlist of domains/addresses for sends, drafts, and rule forwards. | unrestricted |
+
 ### MCP Client Configuration
 
 See [Quick Start — Configure Your MCP Client](#3-configure-your-mcp-client) above for Claude Desktop, Claude Code, Cursor, and Windsurf configs.

package/calendar/index.js

@@ -6,6 +6,7 @@ const handleDeclineEvent = require('./decline');
 const handleCreateEvent = require('./create');
 const handleCancelEvent = require('./cancel');
 const handleDeleteEvent = require('./delete');
+const handleUpdateEvent = require('./update');
 
 // Calendar tool definitions (consolidated: 5 → 3)
 const calendarTools = [
@@ -74,7 +75,7 @@ const calendarTools = [
   {
     name: 'manage-event',
     description:
-      'Manage an existing calendar event. action=decline declines an invitation. action=cancel cancels an event you organised. action=delete permanently removes an event.',
+      'Manage an existing calendar event. action=update edits fields (subject, start, end, attendees, body, location, isOnlineMeeting, sensitivity, showAs, importance, categories, reminderMinutesBeforeStart) without rebuilding the event; pass dryRun=true to preview the PATCH payload. action=decline declines an invitation. action=cancel cancels an event you organised. action=delete permanently removes an event.',
     annotations: {
       title: 'Manage Calendar Event',
       readOnlyHint: false,
@@ -86,7 +87,7 @@ const calendarTools = [
       properties: {
         action: {
           type: 'string',
-          enum: ['decline', 'cancel', 'delete'],
+          enum: ['update', 'decline', 'cancel', 'delete'],
           description: 'Action to perform (required)',
         },
         eventId: {
@@ -102,6 +103,98 @@ const calendarTools = [
           type: 'string',
           description: 'Optional comment for declining or cancelling the event',
         },
+        subject: {
+          type: 'string',
+          description: 'New subject (action=update only)',
+        },
+        start: {
+          oneOf: [
+            { type: 'string' },
+            {
+              type: 'object',
+              properties: {
+                dateTime: { type: 'string' },
+                timeZone: { type: 'string' },
+              },
+              required: ['dateTime'],
+              additionalProperties: false,
+            },
+          ],
+          description:
+            'New start time as ISO 8601 string or {dateTime, timeZone} object (action=update only)',
+        },
+        end: {
+          oneOf: [
+            { type: 'string' },
+            {
+              type: 'object',
+              properties: {
+                dateTime: { type: 'string' },
+                timeZone: { type: 'string' },
+              },
+              required: ['dateTime'],
+              additionalProperties: false,
+            },
+          ],
+          description:
+            'New end time as ISO 8601 string or {dateTime, timeZone} object (action=update only)',
+        },
+        attendees: {
+          type: 'array',
+          items: { type: 'string' },
+          description:
+            'Full replacement attendee list — pass complete desired list, or [] to clear (action=update only)',
+        },
+        body: {
+          type: 'string',
+          description: 'New body content (action=update only)',
+        },
+        location: {
+          type: 'string',
+          description: 'New location display name (action=update only)',
+        },
+        isOnlineMeeting: {
+          type: 'boolean',
+          description: 'Toggle online meeting flag (action=update only)',
+        },
+        sensitivity: {
+          type: 'string',
+          enum: ['normal', 'personal', 'private', 'confidential'],
+          description: 'Event sensitivity classification (action=update only)',
+        },
+        showAs: {
+          type: 'string',
+          enum: [
+            'free',
+            'tentative',
+            'busy',
+            'oof',
+            'workingElsewhere',
+            'unknown',
+          ],
+          description: 'Free/busy status shown to others (action=update only)',
+        },
+        importance: {
+          type: 'string',
+          enum: ['low', 'normal', 'high'],
+          description: 'Event importance flag (action=update only)',
+        },
+        categories: {
+          type: 'array',
+          items: { type: 'string' },
+          description:
+            'Full replacement category list — pass [] to clear (action=update only)',
+        },
+        reminderMinutesBeforeStart: {
+          type: 'number',
+          description:
+            'Minutes before start to fire the reminder (action=update only)',
+        },
+        dryRun: {
+          type: 'boolean',
+          description:
+            'Preview the PATCH without applying it (action=update only). Returns the body that would be sent to Graph.',
+        },
       },
       additionalProperties: false,
       required: ['action'],
@@ -126,6 +219,8 @@ const calendarTools = [
       }
       args = normalised;
       switch (args.action) {
+        case 'update':
+          return handleUpdateEvent(args);
         case 'decline':
           return handleDeclineEvent(args);
         case 'cancel':
@@ -137,7 +232,7 @@ const calendarTools = [
             content: [
               {
                 type: 'text',
-                text: "Invalid action. Use 'decline', 'cancel', or 'delete'.",
+                text: "Invalid action. Use 'update', 'decline', 'cancel', or 'delete'.",
               },
             ],
           };
@@ -153,4 +248,5 @@ module.exports = {
   handleCreateEvent,
   handleCancelEvent,
   handleDeleteEvent,
+  handleUpdateEvent,
 };

package/calendar/update.js

@@ -0,0 +1,287 @@
+/**
+ * Update event functionality.
+ *
+ * Wraps the Microsoft Graph PATCH /me/events/{id} endpoint. Sends only
+ * the fields the caller provides — anything left out is preserved
+ * server-side. Useful for re-scheduling, adding/removing attendees,
+ * editing the body, or tweaking metadata without rebuilding the event
+ * from scratch (which loses RSVP state).
+ *
+ * Supports the following Graph event properties:
+ *   - subject
+ *   - start          (ISO string or {dateTime, timeZone} object)
+ *   - end            (same shape as start)
+ *   - attendees      (full replacement list of emails)
+ *   - body           (sent as HTML)
+ *   - location       (displayName)
+ *   - isOnlineMeeting
+ *   - sensitivity    (normal | personal | private | confidential)
+ *   - showAs         (free | tentative | busy | oof | workingElsewhere | unknown)
+ *   - importance     (low | normal | high)
+ *   - categories     (full replacement array of category names)
+ *   - reminderMinutesBeforeStart
+ *
+ * `dryRun: true` returns a preview of the PATCH payload without calling
+ * Graph — useful for confirming behaviour before mutating real data.
+ */
+const { callGraphAPI } = require('../utils/graph-api');
+const { ensureAuthenticated } = require('../auth');
+const { DEFAULT_TIMEZONE } = require('../config');
+
+const SENSITIVITY_VALUES = new Set([
+  'normal',
+  'personal',
+  'private',
+  'confidential',
+]);
+const SHOW_AS_VALUES = new Set([
+  'free',
+  'tentative',
+  'busy',
+  'oof',
+  'workingElsewhere',
+  'unknown',
+]);
+const IMPORTANCE_VALUES = new Set(['low', 'normal', 'high']);
+
+/**
+ * Update event handler
+ * @param {object} args - Tool arguments
+ * @returns {object} - MCP response
+ */
+async function handleUpdateEvent(args) {
+  const {
+    eventId,
+    subject,
+    start,
+    end,
+    attendees,
+    body,
+    location,
+    isOnlineMeeting,
+    sensitivity,
+    showAs,
+    importance,
+    categories,
+    reminderMinutesBeforeStart,
+    dryRun = false,
+  } = args;
+
+  if (!eventId) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: 'Event ID is required to update an event.',
+        },
+      ],
+    };
+  }
+
+  // Build the patch body from only the fields the caller actually provided.
+  // Graph treats absent properties as "no change", so we never overwrite
+  // something the user didn't intend to touch.
+  const patch = {};
+
+  if (subject !== undefined) patch.subject = subject;
+
+  if (start !== undefined) {
+    patch.start = {
+      dateTime: start.dateTime || start,
+      timeZone: start.timeZone || DEFAULT_TIMEZONE,
+    };
+  }
+
+  if (end !== undefined) {
+    patch.end = {
+      dateTime: end.dateTime || end,
+      timeZone: end.timeZone || DEFAULT_TIMEZONE,
+    };
+  }
+
+  if (attendees !== undefined) {
+    // Replaces the full attendee list — Graph PATCH on this property is
+    // not additive. Caller must pass the desired complete list.
+    patch.attendees = (attendees || []).map((email) => ({
+      emailAddress: { address: email },
+      type: 'required',
+    }));
+  }
+
+  if (body !== undefined) {
+    patch.body = { contentType: 'HTML', content: body };
+  }
+
+  if (location !== undefined) {
+    patch.location = { displayName: location };
+  }
+
+  if (isOnlineMeeting !== undefined) {
+    patch.isOnlineMeeting = Boolean(isOnlineMeeting);
+  }
+
+  if (sensitivity !== undefined) {
+    if (!SENSITIVITY_VALUES.has(sensitivity)) {
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `Invalid sensitivity: '${sensitivity}'. Must be one of: ${[...SENSITIVITY_VALUES].join(', ')}.`,
+          },
+        ],
+      };
+    }
+    patch.sensitivity = sensitivity;
+  }
+
+  if (showAs !== undefined) {
+    if (!SHOW_AS_VALUES.has(showAs)) {
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `Invalid showAs: '${showAs}'. Must be one of: ${[...SHOW_AS_VALUES].join(', ')}.`,
+          },
+        ],
+      };
+    }
+    patch.showAs = showAs;
+  }
+
+  if (importance !== undefined) {
+    if (!IMPORTANCE_VALUES.has(importance)) {
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `Invalid importance: '${importance}'. Must be one of: ${[...IMPORTANCE_VALUES].join(', ')}.`,
+          },
+        ],
+      };
+    }
+    patch.importance = importance;
+  }
+
+  if (categories !== undefined) {
+    // Full replacement, like attendees. Pass [] to clear all categories.
+    patch.categories = Array.isArray(categories) ? categories : [];
+  }
+
+  if (reminderMinutesBeforeStart !== undefined) {
+    const reminder = Number(reminderMinutesBeforeStart);
+    if (!Number.isFinite(reminder) || reminder < 0) {
+      return {
+        content: [
+          {
+            type: 'text',
+            text: `Invalid reminderMinutesBeforeStart: '${reminderMinutesBeforeStart}'. Must be a non-negative number.`,
+          },
+        ],
+      };
+    }
+    patch.reminderMinutesBeforeStart = reminder;
+  }
+
+  if (Object.keys(patch).length === 0) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: 'No fields to update — provide at least one updatable field (subject, start, end, attendees, body, location, isOnlineMeeting, sensitivity, showAs, importance, categories, reminderMinutesBeforeStart).',
+        },
+      ],
+    };
+  }
+
+  // dryRun: don't touch Graph; just show the caller what would be sent.
+  if (dryRun) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: [
+            `**Dry run** — would PATCH \`me/events/${eventId}\` with:`,
+            '',
+            '```json',
+            JSON.stringify(patch, null, 2),
+            '```',
+            '',
+            `Fields that would change: ${Object.keys(patch).join(', ')}`,
+          ].join('\n'),
+        },
+      ],
+      _meta: {
+        eventId,
+        dryRun: true,
+        patch,
+        fieldsChanged: Object.keys(patch),
+      },
+    };
+  }
+
+  try {
+    const accessToken = await ensureAuthenticated();
+    const endpoint = `me/events/${eventId}`;
+
+    const response = await callGraphAPI(accessToken, 'PATCH', endpoint, patch);
+
+    const output = [
+      `Event '${response.subject || eventId}' updated successfully.`,
+    ];
+    if (response.id) {
+      output.push(`**ID**: \`${response.id}\``);
+    }
+    if (response.start) {
+      output.push(
+        `**Start**: ${response.start.dateTime} (${response.start.timeZone})`
+      );
+    }
+    if (response.end) {
+      output.push(
+        `**End**: ${response.end.dateTime} (${response.end.timeZone})`
+      );
+    }
+    if (response.webLink) {
+      output.push(`**Link**: ${response.webLink}`);
+    }
+    output.push(`\nFields changed: ${Object.keys(patch).join(', ')}`);
+
+    return {
+      content: [
+        {
+          type: 'text',
+          text: output.join('\n'),
+        },
+      ],
+      _meta: {
+        eventId: response.id,
+        subject: response.subject,
+        start: response.start,
+        end: response.end,
+        fieldsChanged: Object.keys(patch),
+      },
+    };
+  } catch (error) {
+    if (error.message === 'Authentication required') {
+      return {
+        content: [
+          {
+            type: 'text',
+            text: "Authentication required. Please use the 'authenticate' tool first.",
+          },
+        ],
+      };
+    }
+
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Error updating event: ${error.message}`,
+        },
+      ],
+    };
+  }
+}
+
+module.exports = handleUpdateEvent;

package/config.js

@@ -23,6 +23,48 @@ if (!homeDir) {
   );
 }
 
+/**
+ * Resolve the OAuth audience segment used in Microsoft Graph endpoints.
+ *
+ * Microsoft's identity platform v2.0 routes by audience:
+ *   - `common`         — personal AND work/school accounts (multi-tenant + personal)
+ *   - `consumers`      — personal Microsoft accounts only
+ *   - `organizations`  — work/school accounts only
+ *   - `<tenant-guid>`  — single-tenant
+ *
+ * The right value depends on the Azure app registration's "Supported account
+ * types" setting. An app registered as "Personal Microsoft accounts only" is
+ * rejected by `/common/` with `AADSTS9002331` and must use `/consumers/`;
+ * a single-tenant app must use its tenant GUID; etc.
+ *
+ * Defaulting to `common` preserves existing behaviour. Set
+ * `OUTLOOK_AUTH_AUDIENCE` to override.
+ */
+const AUTH_AUDIENCE = process.env.OUTLOOK_AUTH_AUDIENCE || 'common';
+
+// Surface obvious misconfigurations at startup rather than failing later with a
+// cryptic AADSTS error from Microsoft. Warn rather than throw so we never break
+// an existing deployment on upgrade — Graph itself remains the source of truth
+// for what audiences it accepts.
+const VALID_AUDIENCE_LITERALS = new Set([
+  'common',
+  'consumers',
+  'organizations',
+]);
+const TENANT_GUID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+if (
+  !VALID_AUDIENCE_LITERALS.has(AUTH_AUDIENCE) &&
+  !TENANT_GUID_RE.test(AUTH_AUDIENCE)
+) {
+  // eslint-disable-next-line no-console
+  console.warn(
+    `[outlook-assistant] OUTLOOK_AUTH_AUDIENCE="${AUTH_AUDIENCE}" is not a recognised value. ` +
+      `Expected one of: common, consumers, organizations, or a tenant GUID. ` +
+      `Proceeding anyway — Microsoft's identity platform will reject it at runtime if invalid.`
+  );
+}
+
 module.exports = {
   // Server information
   SERVER_NAME: 'outlook-assistant',
@@ -54,9 +96,10 @@ module.exports = {
     ],
     tokenStorePath: path.join(homeDir, '.outlook-assistant-tokens.json'),
     authServerUrl: 'http://localhost:3333',
-    deviceCodeEndpoint:
-      'https://login.microsoftonline.com/common/oauth2/v2.0/devicecode',
-    tokenEndpoint: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+    audience: AUTH_AUDIENCE,
+    deviceCodeEndpoint: `https://login.microsoftonline.com/${AUTH_AUDIENCE}/oauth2/v2.0/devicecode`,
+    tokenEndpoint: `https://login.microsoftonline.com/${AUTH_AUDIENCE}/oauth2/v2.0/token`,
+    authorizeEndpoint: `https://login.microsoftonline.com/${AUTH_AUDIENCE}/oauth2/v2.0/authorize`,
     defaultAuthMethod: process.env.OUTLOOK_AUTH_METHOD || 'device-code',
   },
 
@@ -97,6 +140,9 @@ module.exports = {
   // Immutable IDs (opt-in: IDs persist through folder moves)
   USE_IMMUTABLE_IDS: process.env.OUTLOOK_IMMUTABLE_IDS === 'true',
 
-  // Timezone
-  DEFAULT_TIMEZONE: 'Australia/Melbourne', // Updated for Nathan's timezone
+  // Timezone — IANA zone (e.g. "Australia/Melbourne", "Europe/London",
+  // "America/New_York"). Override per-deployment via OUTLOOK_DEFAULT_TIMEZONE.
+  // Default preserves the historic value for backwards compatibility.
+  DEFAULT_TIMEZONE:
+    process.env.OUTLOOK_DEFAULT_TIMEZONE || 'Australia/Melbourne',
 };

package/llms.txt

@@ -79,6 +79,6 @@ Requires an Azure app registration with Microsoft Graph delegated permissions. S
 - [FAQ](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/docs/faq/index.md): Frequently asked questions — install, accounts, permissions, tokens, send safety, updates, uninstall (also at <https://littlebearapps.com/help/outlook-assistant/faq/>)
 - [CLAUDE.md](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CLAUDE.md): Quick reference for development
 - [CONTRIBUTING](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CONTRIBUTING.md): Contribution guidelines
-- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.7.4 — patch release closing two regressions surfaced by an independent v3.7.3 E2E re-verification: F-24 chokepoint now catches JSON-stringified arrays from MCP transport (#168) and search-emails kqlQuery no longer silently drops on Step 0 fall-through (#169))
-- [ROADMAP](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/ROADMAP.md): Active milestones (v3.7.5 polish, v3.8.0 task integration & auth, v3.9.0 new Graph APIs)
+- [CHANGELOG](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/CHANGELOG.md): Version history (current: v3.8.0 — `manage-event` gains an `update` action covering 12 fields with `dryRun` (#173, closes #124); new `OUTLOOK_AUTH_AUDIENCE` env var fixes AADSTS9002331 for personal-only Azure apps (#174); new `OUTLOOK_DEFAULT_TIMEZONE` env var overrides the hardcoded Australia/Melbourne default (#175))
+- [ROADMAP](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/ROADMAP.md): Active milestones (v3.8.x polish, v3.9.0 new Graph APIs)
 - [SECURITY](https://raw.githubusercontent.com/littlebearapps/outlook-assistant/main/SECURITY.md): Security policy, token handling, and MCP safety controls

package/outlook-auth-server.js

@@ -39,7 +39,8 @@ const { AUTH_CONFIG: centralAuth } = require('./config');
 // Log to console
 console.log('Starting Outlook Authentication Server');
 
-// Authentication configuration — scopes and tokenStorePath from config.js (single source of truth)
+// Authentication configuration — scopes, tokenStorePath, and audience-driven
+// endpoints sourced from config.js (single source of truth).
 const AUTH_CONFIG = {
   clientId: process.env.OUTLOOK_CLIENT_ID || process.env.MS_CLIENT_ID || '',
   clientSecret:
@@ -47,6 +48,8 @@ const AUTH_CONFIG = {
   redirectUri: centralAuth.redirectUri,
   scopes: centralAuth.scopes,
   tokenStorePath: centralAuth.tokenStorePath,
+  authorizeEndpoint: centralAuth.authorizeEndpoint,
+  tokenEndpoint: centralAuth.tokenEndpoint,
 };
 
 // Create HTTP server
@@ -247,7 +250,9 @@ const server = http.createServer((req, res) => {
       state,
     };
 
-    const authUrl = `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?${querystring.stringify(authParams)}`;
+    // Use the audience from config (defaults to "common"; configurable via
+    // OUTLOOK_AUTH_AUDIENCE for personal-only / single-tenant Azure apps).
+    const authUrl = `${AUTH_CONFIG.authorizeEndpoint}?${querystring.stringify(authParams)}`;
     console.log(`Redirecting to: ${authUrl}`);
 
     // Redirect to Microsoft's login page
@@ -296,9 +301,13 @@ function exchangeCodeForTokens(code) {
       scope: AUTH_CONFIG.scopes.join(' '),
     });
 
+    // Same audience-driven path as the authorize URL above.
+    const tokenUrl = new URL(AUTH_CONFIG.tokenEndpoint);
     const options = {
-      hostname: 'login.microsoftonline.com',
-      path: '/common/oauth2/v2.0/token',
+      hostname: tokenUrl.hostname,
+      // Preserve any query string on the endpoint (none today, but future-safe
+      // if Microsoft ever adds hint params to the token URL).
+      path: tokenUrl.pathname + tokenUrl.search,
       method: 'POST',
       headers: {
         'Content-Type': 'application/x-www-form-urlencoded',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@littlebearapps/outlook-assistant",
-  "version": "3.7.4",
+  "version": "3.8.0",
   "mcpName": "io.github.littlebearapps/outlook-assistant",
   "description": "Outlook Assistant — MCP server with 22 tools for email, calendar, contacts, and settings via Microsoft Graph API",
   "main": "index.js",
@@ -74,7 +74,7 @@
     "llms-install.md"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.3.1"
   },
   "devDependencies": {