@marlinjai/email-mcp 1.5.0 → 1.7.0

package/dist/setup/wizard.js

@@ -342,14 +342,33 @@ var OAuthCallbackServer = class {
 // src/providers/gmail/auth.ts
 import { OAuth2Client } from "google-auth-library";
 import crypto2 from "node:crypto";
-var GMAIL_SCOPES = [
-  "https://mail.google.com/",
-  "https://www.googleapis.com/auth/gmail.modify",
-  // Mailbox content access (above) does NOT cover the Settings API —
-  // Google treats them as separate permission domains. Needed for
-  // users.settings.filters.* (email_create_block_rule/list/delete).
-  "https://www.googleapis.com/auth/gmail.settings.basic"
-];
+var GMAIL_SCOPES = {
+  full: [
+    // Gmail's maximum-permission scope. Superset of gmail.modify below;
+    // the only capability it adds is immediate, trash-bypassing permanent
+    // deletion (messages.delete / batchDelete with permanent: true).
+    "https://mail.google.com/",
+    "https://www.googleapis.com/auth/gmail.modify",
+    // Mailbox content access (above) does NOT cover the Settings API —
+    // Google treats them as separate permission domains. Needed for
+    // users.settings.filters.* (email_create_block_rule/list/delete).
+    "https://www.googleapis.com/auth/gmail.settings.basic"
+  ],
+  // Drops https://mail.google.com/ so an AI-triggered permanent delete
+  // can't happen: gmail.modify already covers every other read/write
+  // operation this server performs (read, send, label, archive, trash,
+  // drafts, filters). Choosing this mode means deleteEmail(..., permanent:
+  // true) and batchDelete(..., permanent: true) will fail with a Gmail API
+  // 403 instead of succeeding — everything else behaves identically.
+  restricted: [
+    "https://www.googleapis.com/auth/gmail.modify",
+    "https://www.googleapis.com/auth/gmail.settings.basic"
+  ]
+};
+function resolveScopeMode(explicit) {
+  if (explicit) return explicit;
+  return process.env.EMAIL_MCP_GMAIL_SCOPE?.toLowerCase() === "restricted" ? "restricted" : "full";
+}
 var GmailAuth = class {
   clientId;
   clientSecret;
@@ -359,13 +378,13 @@ var GmailAuth = class {
     this.clientSecret = clientSecret;
     this.oauth2Client = new OAuth2Client(clientId, clientSecret, redirectUri);
   }
-  getAuthUrl(redirectUri) {
+  getAuthUrl(redirectUri, scopeMode) {
     const codeVerifier = crypto2.randomBytes(32).toString("base64url");
     const codeChallenge = crypto2.createHash("sha256").update(codeVerifier).digest("base64url");
     this.oauth2Client = new OAuth2Client(this.clientId, this.clientSecret, redirectUri);
     const url = this.oauth2Client.generateAuthUrl({
       access_type: "offline",
-      scope: GMAIL_SCOPES,
+      scope: GMAIL_SCOPES[resolveScopeMode(scopeMode)],
       prompt: "consent",
       code_challenge: codeChallenge,
       code_challenge_method: "S256"
@@ -728,11 +747,12 @@ var GmailAdapter = class {
     const labels = res.data.labels || [];
     return labels.map(mapGmailLabel);
   }
-  async createFolder(name) {
+  async createFolder(name, parentPath) {
     const gmail = this.ensureConnected();
+    const fullName = parentPath ? `${parentPath}/${name}` : name;
     const res = await gmail.users.labels.create({
       userId: "me",
-      requestBody: { name }
+      requestBody: { name: fullName }
     });
     return mapGmailLabel(res.data);
   }
@@ -849,6 +869,18 @@ var GmailAdapter = class {
     });
     return { id: res.data.id || "" };
   }
+  async updateDraft(draftId, params) {
+    const gmail = this.ensureConnected();
+    const raw = this.buildRfc2822(params);
+    const res = await gmail.users.drafts.update({
+      userId: "me",
+      id: draftId,
+      requestBody: {
+        message: { raw }
+      }
+    });
+    return { id: res.data.id || draftId };
+  }
   async listDrafts(limit, _offset) {
     const gmail = this.ensureConnected();
     const res = await gmail.users.drafts.list({
@@ -1012,6 +1044,34 @@ var GmailAdapter = class {
     }
     return result;
   }
+  async batchLabel(emailIds, addLabels, removeLabels) {
+    const gmail = this.ensureConnected();
+    const result = { succeeded: [], failed: [] };
+    const addLabelIds = addLabels ?? [];
+    const removeLabelIds = removeLabels ?? [];
+    if (addLabelIds.length === 0 && removeLabelIds.length === 0) {
+      result.succeeded = [...emailIds];
+      return result;
+    }
+    try {
+      await gmail.users.messages.batchModify({
+        userId: "me",
+        requestBody: { ids: emailIds, addLabelIds, removeLabelIds }
+      });
+      result.succeeded = [...emailIds];
+    } catch (error) {
+      for (const id of emailIds) {
+        try {
+          if (addLabelIds.length > 0) await this.addLabels(id, addLabelIds);
+          if (removeLabelIds.length > 0) await this.removeLabels(id, removeLabelIds);
+          result.succeeded.push(id);
+        } catch (e) {
+          result.failed.push({ id, error: e.message });
+        }
+      }
+    }
+    return result;
+  }
   async getRawMessage(emailId, _sourceFolder) {
     const gmail = this.ensureConnected();
     const res = await gmail.users.messages.get({
@@ -1475,6 +1535,12 @@ var OutlookAdapter = class {
     const result = await client.api("/me/messages").post(message);
     return { id: result.id };
   }
+  async updateDraft(draftId, params) {
+    const client = this.ensureClient();
+    const message = this.buildGraphMessage(params);
+    await client.api(`/me/messages/${encodeURIComponent(draftId)}`).patch(message);
+    return { id: draftId };
+  }
   async listDrafts(limit, offset) {
     const client = this.ensureClient();
     let request = client.api("/me/mailFolders/drafts/messages");
@@ -2317,8 +2383,7 @@ var ImapAdapter = class {
     const messageId = await sendViaSmtp(transport, this.email, params);
     return { id: messageId };
   }
-  async createDraft(params) {
-    const client = await this.ensureConnected();
+  buildDraftRfc2822(params) {
     const lines = [];
     lines.push(`From: ${this.email}`);
     lines.push(`To: ${params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", ")}`);
@@ -2333,12 +2398,41 @@ var ImapAdapter = class {
     lines.push("Content-Type: text/plain; charset=utf-8");
     lines.push("");
     lines.push(params.body.text || "");
-    const rawMessage = lines.join("\r\n");
+    return lines.join("\r\n");
+  }
+  async createDraft(params) {
+    const client = await this.ensureConnected();
+    const rawMessage = this.buildDraftRfc2822(params);
     const draftsFolder = await this.resolveFolder("Drafts");
     const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
     if (!result) throw new Error("Failed to append draft");
     return { id: String(result.uid || result) };
   }
+  /**
+   * IMAP has no in-place message update — a draft is just a message in the
+   * Drafts folder, and IMAP messages are immutable once appended. This
+   * deletes the old revision and appends a new one, so the returned `id`
+   * is a NEW uid; the old id no longer resolves after this call.
+   */
+  async updateDraft(draftId, params, sourceFolder) {
+    const client = await this.ensureConnected();
+    const draftsFolder = sourceFolder ? await this.resolveFolder(sourceFolder) : await this.resolveFolder("Drafts");
+    let lock;
+    try {
+      lock = await client.getMailboxLock(draftsFolder);
+    } catch (error) {
+      throw formatImapError(error, `Failed to open folder "${draftsFolder}"`);
+    }
+    try {
+      await client.messageDelete(draftId, { uid: true });
+    } finally {
+      lock.release();
+    }
+    const rawMessage = this.buildDraftRfc2822(params);
+    const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
+    if (!result) throw new Error("Failed to append updated draft");
+    return { id: String(result.uid || result) };
+  }
   async listDrafts(limit, offset) {
     return this.search({
       folder: "Drafts",
@@ -2580,9 +2674,9 @@ var ICloudAdapter = class extends ImapAdapter {
 };
 
 // src/oauth-config.ts
-var GMAIL_CLIENT_ID = "1062266096576-lu2ukplhc3lcm0bvheml5i18urptdp4t.apps.googleusercontent.com";
-var GMAIL_CLIENT_SECRET = "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";
-var OUTLOOK_CLIENT_ID = "76d32225-ef10-4b49-951c-c80ae906595d";
+var GMAIL_CLIENT_ID = process.env.EMAIL_MCP_GMAIL_CLIENT_ID || "1062266096576-lu2ukplhc3lcm0bvheml5i18urptdp4t.apps.googleusercontent.com";
+var GMAIL_CLIENT_SECRET = process.env.EMAIL_MCP_GMAIL_CLIENT_SECRET || "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";
+var OUTLOOK_CLIENT_ID = process.env.EMAIL_MCP_OUTLOOK_CLIENT_ID || "76d32225-ef10-4b49-951c-c80ae906595d";
 
 // src/account-manager.ts
 function createProvider(provider) {
@@ -2770,14 +2864,30 @@ async function testAndSave(creds) {
 async function promptAccountName(defaultName) {
   return askText("Account name:", defaultName);
 }
-async function setupGmail() {
+async function setupGmail(scopeModeFlag) {
   console.log("\n--- Gmail Setup ---");
+  if (process.env.EMAIL_MCP_GMAIL_CLIENT_ID) {
+    console.log("Using your own Google OAuth Client ID (EMAIL_MCP_GMAIL_CLIENT_ID).");
+  }
   console.log("A browser window will open for Google authorization.\n");
+  let scopeMode = scopeModeFlag;
+  if (!scopeMode) {
+    scopeMode = await askChoice("Gmail permission scope:", [
+      {
+        name: "Full (default) \u2014 includes permanent delete, bypassing Trash",
+        value: "full"
+      },
+      {
+        name: "Restricted \u2014 read/send/label/archive/trash only, no permanent delete",
+        value: "restricted"
+      }
+    ]);
+  }
   const server = new OAuthCallbackServer();
   const port = await server.start();
   const redirectUri = `http://localhost:${port}/callback`;
   const gmailAuth = new GmailAuth(GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, redirectUri);
-  const { url, codeVerifier } = gmailAuth.getAuthUrl(redirectUri);
+  const { url, codeVerifier } = gmailAuth.getAuthUrl(redirectUri, scopeMode);
   console.log("\nOpening browser for Google authorization...");
   console.log(`If the browser does not open, visit:
 ${url}
@@ -2976,6 +3086,17 @@ async function main() {
     await removeAccount(id);
     return;
   }
+  const scopeIdx = args.indexOf("--scope");
+  let scopeModeFlag;
+  if (scopeIdx !== -1) {
+    const value = args[scopeIdx + 1];
+    if (value === "full" || value === "restricted") {
+      scopeModeFlag = value;
+    } else {
+      console.error("Usage: --scope <full|restricted>");
+      process.exit(1);
+    }
+  }
   console.log("@marlinjai/email-mcp Account Setup\n");
   let addMore = true;
   while (addMore) {
@@ -2987,7 +3108,7 @@ async function main() {
     ]);
     switch (provider) {
       case ProviderType.Gmail:
-        await setupGmail();
+        await setupGmail(scopeModeFlag);
         break;
       case ProviderType.Outlook:
         await setupOutlook();