@marlinjai/email-mcp 1.4.4 → 1.7.0

package/dist/setup/wizard.js

@@ -108,6 +108,7 @@ function askPassword(message) {
 
 // src/auth/credential-store.ts
 import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
@@ -116,15 +117,59 @@ var KEY_LENGTH = 32;
 var IV_LENGTH = 16;
 var SALT_LENGTH = 32;
 var PBKDF2_ITERATIONS = 1e5;
-function getMachineSeed() {
-  return `email-mcp:${os.hostname()}:${os.userInfo().username}`;
+var cachedMachineId;
+function getStableMachineId() {
+  if (cachedMachineId !== void 0) return cachedMachineId;
+  cachedMachineId = computeStableMachineId();
+  return cachedMachineId;
 }
-function deriveKey(salt) {
-  return crypto.pbkdf2Sync(getMachineSeed(), salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha512");
+function computeStableMachineId() {
+  try {
+    if (process.platform === "darwin") {
+      const out = execFileSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+        encoding: "utf-8"
+      });
+      const match = out.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+      return match ? match[1] : null;
+    }
+    if (process.platform === "linux") {
+      for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+        if (fs.existsSync(p)) {
+          const id = fs.readFileSync(p, "utf-8").trim();
+          if (id) return id;
+        }
+      }
+      return null;
+    }
+    if (process.platform === "win32") {
+      const out = execFileSync(
+        "reg",
+        ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+        { encoding: "utf-8" }
+      );
+      const match = out.match(/MachineGuid\s+REG_SZ\s+([A-Za-z0-9-]+)/);
+      return match ? match[1] : null;
+    }
+  } catch {
+  }
+  return null;
+}
+function getSeedCandidates() {
+  const seeds = [];
+  const username = os.userInfo().username;
+  const envKey = process.env.EMAIL_MCP_KEY;
+  if (envKey) seeds.push(`email-mcp:env:${envKey}`);
+  const machineId = getStableMachineId();
+  if (machineId) seeds.push(`email-mcp:machine:${machineId}:${username}`);
+  seeds.push(`email-mcp:${os.hostname()}:${username}`);
+  return seeds;
 }
-function encrypt(plaintext) {
+function deriveKey(seed, salt) {
+  return crypto.pbkdf2Sync(seed, salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha512");
+}
+function encrypt(plaintext, seed) {
   const salt = crypto.randomBytes(SALT_LENGTH);
-  const key = deriveKey(salt);
+  const key = deriveKey(seed, salt);
   const iv = crypto.randomBytes(IV_LENGTH);
   const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
   let encrypted = cipher.update(plaintext, "utf-8", "hex");
@@ -137,14 +182,25 @@ function encrypt(plaintext) {
     data: encrypted
   });
 }
-function decrypt(ciphertext) {
+function decrypt(ciphertext, seeds) {
   const { salt, iv, authTag, data } = JSON.parse(ciphertext);
-  const key = deriveKey(Buffer.from(salt, "hex"));
-  const decipher = crypto.createDecipheriv(ALGORITHM, key, Buffer.from(iv, "hex"));
-  decipher.setAuthTag(Buffer.from(authTag, "hex"));
-  let decrypted = decipher.update(data, "hex", "utf-8");
-  decrypted += decipher.final("utf-8");
-  return decrypted;
+  const saltBuf = Buffer.from(salt, "hex");
+  const ivBuf = Buffer.from(iv, "hex");
+  const authTagBuf = Buffer.from(authTag, "hex");
+  let lastError;
+  for (const seed of seeds) {
+    try {
+      const key = deriveKey(seed, saltBuf);
+      const decipher = crypto.createDecipheriv(ALGORITHM, key, ivBuf);
+      decipher.setAuthTag(authTagBuf);
+      let decrypted = decipher.update(data, "hex", "utf-8");
+      decrypted += decipher.final("utf-8");
+      return { plaintext: decrypted, seedUsed: seed };
+    } catch (err) {
+      lastError = err;
+    }
+  }
+  throw lastError ?? new Error("Unable to decrypt credentials");
 }
 var CredentialStore = class {
   filePath;
@@ -160,12 +216,20 @@ var CredentialStore = class {
       return { accounts: {} };
     }
     const raw = fs.readFileSync(this.filePath, "utf-8");
-    const json = decrypt(raw);
-    return JSON.parse(json);
+    const seeds = getSeedCandidates();
+    const { plaintext, seedUsed } = decrypt(raw, seeds);
+    const data = JSON.parse(plaintext);
+    if (seedUsed !== seeds[0]) {
+      try {
+        this.write(data);
+      } catch {
+      }
+    }
+    return data;
   }
   write(data) {
     const json = JSON.stringify(data);
-    const encrypted = encrypt(json);
+    const encrypted = encrypt(json, getSeedCandidates()[0]);
     fs.writeFileSync(this.filePath, encrypted, { mode: 384 });
   }
   async save(creds) {
@@ -278,14 +342,33 @@ var OAuthCallbackServer = class {
 // src/providers/gmail/auth.ts
 import { OAuth2Client } from "google-auth-library";
 import crypto2 from "node:crypto";
-var GMAIL_SCOPES = [
-  "https://mail.google.com/",
-  "https://www.googleapis.com/auth/gmail.modify",
-  // Mailbox content access (above) does NOT cover the Settings API —
-  // Google treats them as separate permission domains. Needed for
-  // users.settings.filters.* (email_create_block_rule/list/delete).
-  "https://www.googleapis.com/auth/gmail.settings.basic"
-];
+var GMAIL_SCOPES = {
+  full: [
+    // Gmail's maximum-permission scope. Superset of gmail.modify below;
+    // the only capability it adds is immediate, trash-bypassing permanent
+    // deletion (messages.delete / batchDelete with permanent: true).
+    "https://mail.google.com/",
+    "https://www.googleapis.com/auth/gmail.modify",
+    // Mailbox content access (above) does NOT cover the Settings API —
+    // Google treats them as separate permission domains. Needed for
+    // users.settings.filters.* (email_create_block_rule/list/delete).
+    "https://www.googleapis.com/auth/gmail.settings.basic"
+  ],
+  // Drops https://mail.google.com/ so an AI-triggered permanent delete
+  // can't happen: gmail.modify already covers every other read/write
+  // operation this server performs (read, send, label, archive, trash,
+  // drafts, filters). Choosing this mode means deleteEmail(..., permanent:
+  // true) and batchDelete(..., permanent: true) will fail with a Gmail API
+  // 403 instead of succeeding — everything else behaves identically.
+  restricted: [
+    "https://www.googleapis.com/auth/gmail.modify",
+    "https://www.googleapis.com/auth/gmail.settings.basic"
+  ]
+};
+function resolveScopeMode(explicit) {
+  if (explicit) return explicit;
+  return process.env.EMAIL_MCP_GMAIL_SCOPE?.toLowerCase() === "restricted" ? "restricted" : "full";
+}
 var GmailAuth = class {
   clientId;
   clientSecret;
@@ -295,13 +378,13 @@ var GmailAuth = class {
     this.clientSecret = clientSecret;
     this.oauth2Client = new OAuth2Client(clientId, clientSecret, redirectUri);
   }
-  getAuthUrl(redirectUri) {
+  getAuthUrl(redirectUri, scopeMode) {
     const codeVerifier = crypto2.randomBytes(32).toString("base64url");
     const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
     this.oauth2Client = new OAuth2Client(this.clientId, this.clientSecret, redirectUri);
     const url = this.oauth2Client.generateAuthUrl({
       access_type: "offline",
-      scope: GMAIL_SCOPES,
+      scope: GMAIL_SCOPES[resolveScopeMode(scopeMode)],
       prompt: "consent",
       code_challenge: codeChallenge,
       code_challenge_method: "S256"
@@ -664,11 +747,12 @@ var GmailAdapter = class {
     const labels = res.data.labels || [];
     return labels.map(mapGmailLabel);
   }
-  async createFolder(name) {
+  async createFolder(name, parentPath) {
     const gmail = this.ensureConnected();
+    const fullName = parentPath ? `${parentPath}/${name}` : name;
     const res = await gmail.users.labels.create({
       userId: "me",
-      requestBody: { name }
+      requestBody: { name: fullName }
     });
     return mapGmailLabel(res.data);
   }
@@ -785,6 +869,18 @@ var GmailAdapter = class {
     });
     return { id: res.data.id || "" };
   }
+  async updateDraft(draftId, params) {
+    const gmail = this.ensureConnected();
+    const raw = this.buildRfc2822(params);
+    const res = await gmail.users.drafts.update({
+      userId: "me",
+      id: draftId,
+      requestBody: {
+        message: { raw }
+      }
+    });
+    return { id: res.data.id || draftId };
+  }
   async listDrafts(limit, _offset) {
     const gmail = this.ensureConnected();
     const res = await gmail.users.drafts.list({
@@ -948,6 +1044,34 @@ var GmailAdapter = class {
     }
     return result;
   }
+  async batchLabel(emailIds, addLabels, removeLabels) {
+    const gmail = this.ensureConnected();
+    const result = { succeeded: [], failed: [] };
+    const addLabelIds = addLabels ?? [];
+    const removeLabelIds = removeLabels ?? [];
+    if (addLabelIds.length === 0 && removeLabelIds.length === 0) {
+      result.succeeded = [...emailIds];
+      return result;
+    }
+    try {
+      await gmail.users.messages.batchModify({
+        userId: "me",
+        requestBody: { ids: emailIds, addLabelIds, removeLabelIds }
+      });
+      result.succeeded = [...emailIds];
+    } catch (error) {
+      for (const id of emailIds) {
+        try {
+          if (addLabelIds.length > 0) await this.addLabels(id, addLabelIds);
+          if (removeLabelIds.length > 0) await this.removeLabels(id, removeLabelIds);
+          result.succeeded.push(id);
+        } catch (e) {
+          result.failed.push({ id, error: e.message });
+        }
+      }
+    }
+    return result;
+  }
   async getRawMessage(emailId, _sourceFolder) {
     const gmail = this.ensureConnected();
     const res = await gmail.users.messages.get({
@@ -1411,6 +1535,12 @@ var OutlookAdapter = class {
     const result = await client.api("/me/messages").post(message);
     return { id: result.id };
   }
+  async updateDraft(draftId, params) {
+    const client = this.ensureClient();
+    const message = this.buildGraphMessage(params);
+    await client.api(`/me/messages/${encodeURIComponent(draftId)}`).patch(message);
+    return { id: draftId };
+  }
   async listDrafts(limit, offset) {
     const client = this.ensureClient();
     let request = client.api("/me/mailFolders/drafts/messages");
@@ -1823,6 +1953,7 @@ var ImapAdapter = class {
   accountId = "";
   email = "";
   passwordCreds = null;
+  connectingPromise = null;
   async connect(credentials) {
     if (!credentials.password) {
       throw new Error("IMAP adapter requires password credentials");
@@ -1830,23 +1961,87 @@ var ImapAdapter = class {
     this.accountId = credentials.id;
     this.email = credentials.email;
     this.passwordCreds = credentials.password;
-    this.client = new ImapFlow({
-      host: credentials.password.host,
-      port: credentials.password.port,
-      secure: credentials.password.tls,
-      auth: {
-        user: credentials.email,
-        pass: credentials.password.password
-      },
-      logger: false
-    });
-    await this.client.connect();
+    await this.ensureConnected();
   }
   async disconnect() {
     if (this.client) {
-      await this.client.logout();
+      try {
+        await this.client.logout();
+      } catch {
+      }
       this.client = null;
     }
+    this.passwordCreds = null;
+  }
+  /**
+   * Builds a fresh ImapFlow client from stored credentials and wires up
+   * close/error listeners so a dropped socket clears `this.client`, forcing
+   * the next `ensureConnected()` call to reconnect.
+   */
+  buildClient() {
+    if (!this.passwordCreds) {
+      throw new Error("Cannot build IMAP client without stored credentials");
+    }
+    const client = new ImapFlow({
+      host: this.passwordCreds.host,
+      port: this.passwordCreds.port,
+      secure: this.passwordCreds.tls,
+      auth: { user: this.email, pass: this.passwordCreds.password },
+      logger: false
+    });
+    const drop = () => {
+      if (this.client === client) this.client = null;
+    };
+    client.on("close", drop);
+    client.on("error", drop);
+    return client;
+  }
+  /**
+   * Returns true while the underlying ImapFlow socket is healthy.
+   * ImapFlow sets `usable=false` when the connection is closed, in the
+   * middle of logging out, or otherwise unsafe to issue commands on.
+   */
+  isClientUsable() {
+    return !!this.client && this.client.usable === true;
+  }
+  /**
+   * Guarantees a usable IMAP client and returns it. Reconnects transparently
+   * if the previous client was dropped (idle timeout, server-side disconnect,
+   * network flap). Concurrent callers share a single in-flight reconnect to
+   * avoid duplicate sessions.
+   *
+   * Callers should bind the result to a local `const client` and use that
+   * within the method instead of `this.client`, so a `'close'` event mid-call
+   * does not race the active operation.
+   */
+  async ensureConnected() {
+    if (this.connectingPromise) {
+      await this.connectingPromise;
+    }
+    if (!this.isClientUsable()) {
+      if (!this.passwordCreds) {
+        throw new Error("Not connected");
+      }
+      this.connectingPromise = (async () => {
+        if (this.client) {
+          try {
+            await this.client.logout();
+          } catch {
+          }
+          this.client = null;
+        }
+        const client = this.buildClient();
+        await client.connect();
+        this.client = client;
+      })().finally(() => {
+        this.connectingPromise = null;
+      });
+      await this.connectingPromise;
+    }
+    if (!this.client) {
+      throw new Error("IMAP client unavailable after reconnect attempt");
+    }
+    return this.client;
   }
   async testConnection() {
     try {
@@ -1857,14 +2052,14 @@ var ImapAdapter = class {
     }
   }
   async listFolders() {
-    if (!this.client) throw new Error("Not connected");
-    const imapFolders = await this.client.list();
+    const client = await this.ensureConnected();
+    const imapFolders = await client.list();
     return imapFolders.map(mapImapFolder);
   }
   async createFolder(name, parentPath) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const fullPath = parentPath ? `${parentPath}/${name}` : name;
-    const result = await this.client.mailboxCreate(fullPath);
+    const result = await client.mailboxCreate(fullPath);
     return {
       id: result.path,
       name: result.name || name,
@@ -1893,7 +2088,7 @@ var ImapAdapter = class {
    * and matching by name or special-use type.
    */
   async resolveFolder(folder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const FOLDER_ALIASES = {
       junk: ["Junk", "Spam", "Bulk Mail", "Junk E-mail", "Junk Email"],
       spam: ["Junk", "Spam", "Bulk Mail", "Junk E-mail", "Junk Email"],
@@ -1902,7 +2097,7 @@ var ImapAdapter = class {
       drafts: ["Drafts", "Draft"],
       archive: ["Archive", "All Mail"]
     };
-    const folders = await this.client.list();
+    const folders = await client.list();
     const lowerFolder = folder.toLowerCase();
     const exactMatch = folders.find(
       (f) => f.path === folder || f.path.toLowerCase() === lowerFolder
@@ -1940,7 +2135,7 @@ var ImapAdapter = class {
     return folder;
   }
   async search(query) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const requestedFolder = query.folder || "INBOX";
     let folder;
     try {
@@ -1949,17 +2144,25 @@ var ImapAdapter = class {
       folder = requestedFolder;
     }
     try {
-      await this.client.noop();
+      await client.noop();
     } catch {
     }
     let lock;
     try {
-      lock = await this.client.getMailboxLock(folder);
+      lock = await client.getMailboxLock(folder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${folder}"`);
     }
     try {
-      const mailboxExists = this.client.mailbox?.exists ?? 0;
+      let mailboxExists = client.mailbox?.exists ?? 0;
+      if (mailboxExists === 0) {
+        try {
+          const status = await client.status(folder, { messages: true });
+          mailboxExists = status?.messages ?? 0;
+        } catch {
+          mailboxExists = 0;
+        }
+      }
       if (mailboxExists === 0) {
         return [];
       }
@@ -1967,14 +2170,14 @@ var ImapAdapter = class {
       const hasCriteria = Object.keys(criteria).length > 0;
       let allUids = [];
       try {
-        const searchResult = await this.client.search(
+        const searchResult = await client.search(
           hasCriteria ? criteria : { all: true },
           { uid: true }
         );
         allUids = Array.isArray(searchResult) ? searchResult : [];
       } catch {
         try {
-          allUids = await this.collectUidsViaFetch(query);
+          allUids = await this.collectUidsViaFetch(client, query);
         } catch {
           return [];
         }
@@ -1982,7 +2185,7 @@ var ImapAdapter = class {
       const offset = query.offset || 0;
       const slicedUids = query.limit ? allUids.slice(offset, offset + query.limit) : allUids.slice(offset);
       if (slicedUids.length === 0) return [];
-      return await this.fetchEmails(slicedUids, folder, query.returnBody);
+      return await this.fetchEmails(client, slicedUids, folder, query.returnBody);
     } catch (error) {
       throw formatImapError(error, `Search failed in folder "${folder}"`);
     } finally {
@@ -1996,13 +2199,12 @@ var ImapAdapter = class {
    * 2. FETCH 1:N using mailbox.exists as explicit range
    * 3. Individual sequence number fetches (slowest but most resilient)
    */
-  async collectUidsViaFetch(query) {
-    if (!this.client) return [];
+  async collectUidsViaFetch(client, query) {
     const uids = [];
-    const exists = this.client.mailbox?.exists ?? 0;
+    const exists = client.mailbox?.exists ?? 0;
     const safeFetch = async (range) => {
       try {
-        const messages = await this.client.fetchAll(range, { uid: true, flags: true });
+        const messages = await client.fetchAll(range, { uid: true, flags: true });
         for (const msg of messages) {
           if (query.unreadOnly && msg.flags?.has("\\Seen")) continue;
           if (query.starredOnly && !msg.flags?.has("\\Flagged")) continue;
@@ -2022,7 +2224,7 @@ var ImapAdapter = class {
     const count = exists > 0 ? exists : 50;
     for (let seq = 1; seq <= count; seq++) {
       try {
-        const msgs = await this.client.fetchAll(String(seq), { uid: true, flags: true });
+        const msgs = await client.fetchAll(String(seq), { uid: true, flags: true });
         for (const msg of msgs) {
           if (query.unreadOnly && msg.flags?.has("\\Seen")) continue;
           if (query.starredOnly && !msg.flags?.has("\\Flagged")) continue;
@@ -2036,19 +2238,18 @@ var ImapAdapter = class {
   /**
    * Fetches email data for a set of UIDs, either with full body or lightweight headers.
    */
-  async fetchEmails(uids, folder, returnBody) {
-    if (!this.client) return [];
+  async fetchEmails(client, uids, folder, returnBody) {
     const emails = [];
     const fetchOpts = returnBody ? { source: true, uid: true, flags: true } : { envelope: true, uid: true, flags: true, bodyStructure: true };
     const uidRange = uids.join(",");
     let messages;
     try {
-      messages = await this.client.fetchAll(uidRange, fetchOpts, { uid: true });
+      messages = await client.fetchAll(uidRange, fetchOpts, { uid: true });
     } catch {
       messages = [];
       for (const uid of uids) {
         try {
-          const batch = await this.client.fetchAll(String(uid), fetchOpts, { uid: true });
+          const batch = await client.fetchAll(String(uid), fetchOpts, { uid: true });
           messages.push(...batch);
         } catch {
         }
@@ -2087,17 +2288,17 @@ var ImapAdapter = class {
     return emails;
   }
   async getEmail(id, folder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const targetFolder = folder || "INBOX";
     let lock;
     try {
-      lock = await this.client.getMailboxLock(targetFolder);
+      lock = await client.getMailboxLock(targetFolder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${targetFolder}"`);
     }
     try {
       const uid = parseInt(id, 10);
-      const msg = await this.client.fetchOne(String(uid), { source: true, uid: true, flags: true }, { uid: true });
+      const msg = await client.fetchOne(String(uid), { source: true, uid: true, flags: true }, { uid: true });
       if (!msg) throw new Error(`Email ${id} not found`);
       const parsed = await simpleParser(msg.source);
       parsed.flags = msg.flags;
@@ -2107,22 +2308,22 @@ var ImapAdapter = class {
     }
   }
   async getThread(threadId) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     let lock;
     try {
-      lock = await this.client.getMailboxLock("INBOX");
+      lock = await client.getMailboxLock("INBOX");
     } catch (error) {
       throw formatImapError(error, 'Failed to open folder "INBOX"');
     }
     try {
-      const searchResult = await this.client.search(
+      const searchResult = await client.search(
         { or: [{ header: { "message-id": threadId } }, { header: { references: threadId } }, { header: { "in-reply-to": threadId } }] },
         { uid: true }
       );
       const uids = Array.isArray(searchResult) ? searchResult : [];
       if (uids.length === 0) throw new Error(`Thread ${threadId} not found`);
       const messages = [];
-      for await (const msg of this.client.fetch(uids, { source: true, uid: true, flags: true })) {
+      for await (const msg of client.fetch(uids, { source: true, uid: true, flags: true })) {
         const parsed = await simpleParser(msg.source);
         parsed.flags = msg.flags;
         messages.push(mapParsedEmail(parsed, "INBOX", this.accountId, msg.uid));
@@ -2148,15 +2349,15 @@ var ImapAdapter = class {
     }
   }
   async getAttachment(emailId, attachmentId) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     let lock;
     try {
-      lock = await this.client.getMailboxLock("INBOX");
+      lock = await client.getMailboxLock("INBOX");
     } catch (error) {
       throw formatImapError(error, 'Failed to open folder "INBOX"');
     }
     try {
-      const msg = await this.client.fetchOne(String(emailId), { source: true, uid: true }, { uid: true });
+      const msg = await client.fetchOne(String(emailId), { source: true, uid: true }, { uid: true });
       if (!msg) throw new Error(`Email ${emailId} not found`);
       const parsed = await simpleParser(msg.source);
       const attachment = (parsed.attachments || []).find(
@@ -2182,8 +2383,7 @@ var ImapAdapter = class {
     const messageId = await sendViaSmtp(transport, this.email, params);
     return { id: messageId };
   }
-  async createDraft(params) {
-    if (!this.client) throw new Error("Not connected");
+  buildDraftRfc2822(params) {
     const lines = [];
     lines.push(`From: ${this.email}`);
     lines.push(`To: ${params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", ")}`);
@@ -2198,8 +2398,39 @@ var ImapAdapter = class {
     lines.push("Content-Type: text/plain; charset=utf-8");
     lines.push("");
     lines.push(params.body.text || "");
-    const rawMessage = lines.join("\r\n");
-    const result = await this.client.append("Drafts", rawMessage, ["\\Draft", "\\Seen"]);
+    return lines.join("\r\n");
+  }
+  async createDraft(params) {
+    const client = await this.ensureConnected();
+    const rawMessage = this.buildDraftRfc2822(params);
+    const draftsFolder = await this.resolveFolder("Drafts");
+    const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
+    if (!result) throw new Error("Failed to append draft");
+    return { id: String(result.uid || result) };
+  }
+  /**
+   * IMAP has no in-place message update — a draft is just a message in the
+   * Drafts folder, and IMAP messages are immutable once appended. This
+   * deletes the old revision and appends a new one, so the returned `id`
+   * is a NEW uid; the old id no longer resolves after this call.
+   */
+  async updateDraft(draftId, params, sourceFolder) {
+    const client = await this.ensureConnected();
+    const draftsFolder = sourceFolder ? await this.resolveFolder(sourceFolder) : await this.resolveFolder("Drafts");
+    let lock;
+    try {
+      lock = await client.getMailboxLock(draftsFolder);
+    } catch (error) {
+      throw formatImapError(error, `Failed to open folder "${draftsFolder}"`);
+    }
+    try {
+      await client.messageDelete(draftId, { uid: true });
+    } finally {
+      lock.release();
+    }
+    const rawMessage = this.buildDraftRfc2822(params);
+    const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
+    if (!result) throw new Error("Failed to append updated draft");
     return { id: String(result.uid || result) };
   }
   async listDrafts(limit, offset) {
@@ -2210,16 +2441,16 @@ var ImapAdapter = class {
     });
   }
   async moveEmail(emailId, targetFolder, sourceFolder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const folder = sourceFolder || "INBOX";
     let lock;
     try {
-      lock = await this.client.getMailboxLock(folder);
+      lock = await client.getMailboxLock(folder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${folder}"`);
     }
     try {
-      await this.client.messageMove(emailId, targetFolder, { uid: true });
+      await client.messageMove(emailId, targetFolder, { uid: true });
     } finally {
       lock.release();
     }
@@ -2249,44 +2480,44 @@ var ImapAdapter = class {
     }
   }
   async deleteEmail(emailId, permanent, sourceFolder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const folder = sourceFolder ? await this.resolveFolder(sourceFolder) : "INBOX";
     const trashFolder = await this.resolveFolder("Trash");
     let lock;
     try {
-      lock = await this.client.getMailboxLock(folder);
+      lock = await client.getMailboxLock(folder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${folder}"`);
     }
     try {
       if (permanent || folder === trashFolder) {
-        await this.client.messageDelete(emailId, { uid: true });
+        await client.messageDelete(emailId, { uid: true });
       } else {
-        await this.client.messageMove(emailId, trashFolder, { uid: true });
+        await client.messageMove(emailId, trashFolder, { uid: true });
       }
     } finally {
       lock.release();
     }
   }
   async markEmail(emailId, flags, sourceFolder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const folder = sourceFolder || "INBOX";
     let lock;
     try {
-      lock = await this.client.getMailboxLock(folder);
+      lock = await client.getMailboxLock(folder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${folder}"`);
     }
     try {
       if (flags.read === true) {
-        await this.client.messageFlagsAdd(emailId, ["\\Seen"], { uid: true });
+        await client.messageFlagsAdd(emailId, ["\\Seen"], { uid: true });
       } else if (flags.read === false) {
-        await this.client.messageFlagsRemove(emailId, ["\\Seen"], { uid: true });
+        await client.messageFlagsRemove(emailId, ["\\Seen"], { uid: true });
       }
       if (flags.starred === true || flags.flagged === true) {
-        await this.client.messageFlagsAdd(emailId, ["\\Flagged"], { uid: true });
+        await client.messageFlagsAdd(emailId, ["\\Flagged"], { uid: true });
       } else if (flags.starred === false || flags.flagged === false) {
-        await this.client.messageFlagsRemove(emailId, ["\\Flagged"], { uid: true });
+        await client.messageFlagsRemove(emailId, ["\\Flagged"], { uid: true });
       }
     } finally {
       lock.release();
@@ -2319,32 +2550,32 @@ var ImapAdapter = class {
     return { id: String(result?.uid ?? "") };
   }
   async batchDelete(emailIds, permanent, sourceFolder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const result = { succeeded: [], failed: [] };
     const folder = sourceFolder ? await this.resolveFolder(sourceFolder) : "INBOX";
     const trashFolder = await this.resolveFolder("Trash");
     const shouldPermanentDelete = permanent || folder === trashFolder;
     let lock;
     try {
-      lock = await this.client.getMailboxLock(folder);
+      lock = await client.getMailboxLock(folder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${folder}"`);
     }
     try {
       const uidRange = emailIds.join(",");
       if (shouldPermanentDelete) {
-        await this.client.messageDelete(uidRange, { uid: true });
+        await client.messageDelete(uidRange, { uid: true });
       } else {
-        await this.client.messageMove(uidRange, trashFolder, { uid: true });
+        await client.messageMove(uidRange, trashFolder, { uid: true });
       }
       result.succeeded = [...emailIds];
     } catch (error) {
       for (const id of emailIds) {
         try {
           if (shouldPermanentDelete) {
-            await this.client.messageDelete(id, { uid: true });
+            await client.messageDelete(id, { uid: true });
           } else {
-            await this.client.messageMove(id, trashFolder, { uid: true });
+            await client.messageMove(id, trashFolder, { uid: true });
           }
           result.succeeded.push(id);
         } catch (e) {
@@ -2357,23 +2588,23 @@ var ImapAdapter = class {
     return result;
   }
   async batchMove(emailIds, targetFolder, sourceFolder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const result = { succeeded: [], failed: [] };
     const folder = sourceFolder || "INBOX";
     let lock;
     try {
-      lock = await this.client.getMailboxLock(folder);
+      lock = await client.getMailboxLock(folder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${folder}"`);
     }
     try {
       const uidRange = emailIds.join(",");
-      await this.client.messageMove(uidRange, targetFolder, { uid: true });
+      await client.messageMove(uidRange, targetFolder, { uid: true });
       result.succeeded = [...emailIds];
     } catch (error) {
       for (const id of emailIds) {
         try {
-          await this.client.messageMove(id, targetFolder, { uid: true });
+          await client.messageMove(id, targetFolder, { uid: true });
           result.succeeded.push(id);
         } catch (e) {
           result.failed.push({ id, error: e.message });
@@ -2385,26 +2616,26 @@ var ImapAdapter = class {
     return result;
   }
   async batchMark(emailIds, flags, sourceFolder) {
-    if (!this.client) throw new Error("Not connected");
+    const client = await this.ensureConnected();
     const result = { succeeded: [], failed: [] };
     const folder = sourceFolder || "INBOX";
     let lock;
     try {
-      lock = await this.client.getMailboxLock(folder);
+      lock = await client.getMailboxLock(folder);
     } catch (error) {
       throw formatImapError(error, `Failed to open folder "${folder}"`);
     }
     try {
       const uidRange = emailIds.join(",");
       if (flags.read === true) {
-        await this.client.messageFlagsAdd(uidRange, ["\\Seen"], { uid: true });
+        await client.messageFlagsAdd(uidRange, ["\\Seen"], { uid: true });
       } else if (flags.read === false) {
-        await this.client.messageFlagsRemove(uidRange, ["\\Seen"], { uid: true });
+        await client.messageFlagsRemove(uidRange, ["\\Seen"], { uid: true });
       }
       if (flags.starred === true || flags.flagged === true) {
-        await this.client.messageFlagsAdd(uidRange, ["\\Flagged"], { uid: true });
+        await client.messageFlagsAdd(uidRange, ["\\Flagged"], { uid: true });
       } else if (flags.starred === false || flags.flagged === false) {
-        await this.client.messageFlagsRemove(uidRange, ["\\Flagged"], { uid: true });
+        await client.messageFlagsRemove(uidRange, ["\\Flagged"], { uid: true });
       }
       result.succeeded = [...emailIds];
     } catch (error) {
@@ -2443,9 +2674,9 @@ var ICloudAdapter = class extends ImapAdapter {
 };
 
 // src/oauth-config.ts
-var GMAIL_CLIENT_ID = "1062266096576-lu2ukplhc3lcm0bvheml5i18urptdp4t.apps.googleusercontent.com";
-var GMAIL_CLIENT_SECRET = "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";
-var OUTLOOK_CLIENT_ID = "76d32225-ef10-4b49-951c-c80ae906595d";
+var GMAIL_CLIENT_ID = process.env.EMAIL_MCP_GMAIL_CLIENT_ID || "1062266096576-lu2ukplhc3lcm0bvheml5i18urptdp4t.apps.googleusercontent.com";
+var GMAIL_CLIENT_SECRET = process.env.EMAIL_MCP_GMAIL_CLIENT_SECRET || "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";
+var OUTLOOK_CLIENT_ID = process.env.EMAIL_MCP_OUTLOOK_CLIENT_ID || "76d32225-ef10-4b49-951c-c80ae906595d";
 
 // src/account-manager.ts
 function createProvider(provider) {
@@ -2633,14 +2864,30 @@ async function testAndSave(creds) {
 async function promptAccountName(defaultName) {
   return askText("Account name:", defaultName);
 }
-async function setupGmail() {
+async function setupGmail(scopeModeFlag) {
   console.log("\n--- Gmail Setup ---");
+  if (process.env.EMAIL_MCP_GMAIL_CLIENT_ID) {
+    console.log("Using your own Google OAuth Client ID (EMAIL_MCP_GMAIL_CLIENT_ID).");
+  }
   console.log("A browser window will open for Google authorization.\n");
+  let scopeMode = scopeModeFlag;
+  if (!scopeMode) {
+    scopeMode = await askChoice("Gmail permission scope:", [
+      {
+        name: "Full (default) \u2014 includes permanent delete, bypassing Trash",
+        value: "full"
+      },
+      {
+        name: "Restricted \u2014 read/send/label/archive/trash only, no permanent delete",
+        value: "restricted"
+      }
+    ]);
+  }
   const server = new OAuthCallbackServer();
   const port = await server.start();
   const redirectUri = `http://localhost:${port}/callback`;
   const gmailAuth = new GmailAuth(GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, redirectUri);
-  const { url, codeVerifier } = gmailAuth.getAuthUrl(redirectUri);
+  const { url, codeVerifier } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
   console.log("\nOpening browser for Google authorization...");
   console.log(`If the browser does not open, visit:
 ${url}
@@ -2839,6 +3086,17 @@ async function main() {
     await removeAccount(id);
     return;
   }
+  const scopeIdx = args.indexOf("--scope");
+  let scopeModeFlag;
+  if (scopeIdx !== -1) {
+    const value = args[scopeIdx + 1];
+    if (value === "full" || value === "restricted") {
+      scopeModeFlag = value;
+    } else {
+      console.error("Usage: --scope <full|restricted>");
+      process.exit(1);
+    }
+  }
   console.log("@marlinjai/email-mcp Account Setup\n");
   let addMore = true;
   while (addMore) {
@@ -2850,7 +3108,7 @@ async function main() {
     ]);
     switch (provider) {
       case ProviderType.Gmail:
-        await setupGmail();
+        await setupGmail(scopeModeFlag);
         break;
       case ProviderType.Outlook:
         await setupOutlook();