@marlinjai/email-mcp 1.7.1 → 1.8.0

package/dist/setup/wizard.js

@@ -202,6 +202,14 @@ function decrypt(ciphertext, seeds) {
   }
   throw lastError ?? new Error("Unable to decrypt credentials");
 }
+function encryptWithMachineKey(plaintext) {
+  return encrypt(plaintext, getSeedCandidates()[0]);
+}
+function decryptWithMachineKey(ciphertext) {
+  const seeds = getSeedCandidates();
+  const { plaintext, seedUsed } = decrypt(ciphertext, seeds);
+  return { plaintext, usedLegacyKey: seedUsed !== seeds[0] };
+}
 var CredentialStore = class {
   filePath;
   constructor(dir) {
@@ -216,10 +224,9 @@ var CredentialStore = class {
       return { accounts: {} };
     }
     const raw = fs.readFileSync(this.filePath, "utf-8");
-    const seeds = getSeedCandidates();
-    const { plaintext, seedUsed } = decrypt(raw, seeds);
+    const { plaintext, usedLegacyKey } = decryptWithMachineKey(raw);
     const data = JSON.parse(plaintext);
-    if (seedUsed !== seeds[0]) {
+    if (usedLegacyKey) {
       try {
         this.write(data);
       } catch {
@@ -229,7 +236,7 @@ var CredentialStore = class {
   }
   write(data) {
     const json = JSON.stringify(data);
-    const encrypted = encrypt(json, getSeedCandidates()[0]);
+    const encrypted = encryptWithMachineKey(json);
     fs.writeFileSync(this.filePath, encrypted, { mode: 384 });
   }
   async save(creds) {
@@ -245,6 +252,18 @@ var CredentialStore = class {
     const data = this.read();
     return Object.values(data.accounts);
   }
+  /**
+   * The account already configured for this mailbox, if any. Provider plus
+   * address identifies a mailbox; the address comparison is case-insensitive
+   * because providers report it in varying case.
+   */
+  async findByProviderAndEmail(provider, email) {
+    const wanted = email.trim().toLowerCase();
+    const data = this.read();
+    return Object.values(data.accounts).find(
+      (a) => a.provider === provider && a.email.trim().toLowerCase() === wanted
+    ) ?? null;
+  }
   async remove(id) {
     const data = this.read();
     delete data.accounts[id];
@@ -270,53 +289,95 @@ var ERROR_HTML = `<!DOCTYPE html>
   <p>An error occurred during authorization. Please try again.</p>
 </body>
 </html>`;
-var OAuthCallbackServer = class {
-  server = null;
+var OAuthCallbackServer = class _OAuthCallbackServer {
+  servers = [];
   resolveCode = null;
   rejectCode = null;
   timeoutMs;
   timeoutHandle = null;
   expectedState = null;
+  static IPV4_LOOPBACK = "127.0.0.1";
+  static IPV6_LOOPBACK = "::1";
+  /** Attempts at finding a port that is free on both loopback addresses. */
+  static MAX_PORT_ATTEMPTS = 5;
   constructor(timeoutMs = 12e4) {
     this.timeoutMs = timeoutMs;
   }
-  start() {
+  handleRequest = (req, res) => {
+    const url = new URL(req.url || "/", `http://localhost`);
+    if (url.pathname === "/callback" || url.pathname === "/") {
+      const code = url.searchParams.get("code");
+      const error = url.searchParams.get("error");
+      const state = url.searchParams.get("state");
+      if (code && this.expectedState !== null && state !== this.expectedState) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(ERROR_HTML);
+        this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
+      } else if (code) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(SUCCESS_HTML);
+        this.resolveCode?.(code);
+      } else {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(ERROR_HTML);
+        this.rejectCode?.(new Error(`OAuth error: ${error || "no code received"}`));
+      }
+    } else {
+      res.writeHead(404);
+      res.end("Not Found");
+    }
+  };
+  listenOn(host, port) {
     return new Promise((resolve, reject) => {
-      this.server = http.createServer((req, res) => {
-        const url = new URL(req.url || "/", `http://localhost`);
-        if (url.pathname === "/callback" || url.pathname === "/") {
-          const code = url.searchParams.get("code");
-          const error = url.searchParams.get("error");
-          const state = url.searchParams.get("state");
-          if (code && this.expectedState !== null && state !== this.expectedState) {
-            res.writeHead(400, { "Content-Type": "text/html" });
-            res.end(ERROR_HTML);
-            this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
-          } else if (code) {
-            res.writeHead(200, { "Content-Type": "text/html" });
-            res.end(SUCCESS_HTML);
-            this.resolveCode?.(code);
-          } else {
-            res.writeHead(400, { "Content-Type": "text/html" });
-            res.end(ERROR_HTML);
-            this.rejectCode?.(new Error(`OAuth error: ${error || "no code received"}`));
-          }
-        } else {
-          res.writeHead(404);
-          res.end("Not Found");
-        }
-      });
-      this.server.listen(0, () => {
-        const addr = this.server.address();
-        if (addr && typeof addr === "object") {
-          resolve(addr.port);
-        } else {
-          reject(new Error("Failed to get server port"));
-        }
+      const server = http.createServer(this.handleRequest);
+      const onError = (err) => {
+        server.close();
+        reject(err);
+      };
+      server.once("error", onError);
+      server.listen(port, host, () => {
+        server.off("error", onError);
+        server.on("error", (err) => this.rejectCode?.(err));
+        resolve(server);
       });
-      this.server.on("error", reject);
     });
   }
+  /**
+   * Starts listening on an OS-assigned port on 127.0.0.1 and, when available,
+   * the same port on ::1. Resolves with the port.
+   */
+  async start() {
+    let lastError;
+    for (let attempt = 0; attempt < _OAuthCallbackServer.MAX_PORT_ATTEMPTS; attempt++) {
+      const v4 = await this.listenOn(_OAuthCallbackServer.IPV4_LOOPBACK, 0);
+      const addr = v4.address();
+      if (!addr || typeof addr !== "object") {
+        v4.close();
+        throw new Error("Failed to get server port");
+      }
+      const port = addr.port;
+      try {
+        const v6 = await this.listenOn(_OAuthCallbackServer.IPV6_LOOPBACK, port);
+        this.servers = [v4, v6];
+        return port;
+      } catch (err) {
+        if (err?.code === "EADDRINUSE") {
+          v4.close();
+          lastError = err;
+          continue;
+        }
+        this.servers = [v4];
+        return port;
+      }
+    }
+    throw new Error(
+      `Could not find a port free on both loopback addresses: ${lastError?.message ?? "unknown error"}`
+    );
+  }
+  /** The addresses the callback server is listening on (for diagnostics and tests). */
+  boundAddresses() {
+    return this.servers.map((s) => s.address()).filter((a) => !!a && typeof a === "object").map((a) => a.address);
+  }
   /**
    * Resolve with the authorization code once the browser is redirected back.
    * Pass the `state` that was put into the authorization URL: callbacks whose
@@ -344,10 +405,10 @@ var OAuthCallbackServer = class {
       clearTimeout(this.timeoutHandle);
       this.timeoutHandle = null;
     }
-    if (this.server) {
-      this.server.close();
-      this.server = null;
+    for (const server of this.servers) {
+      server.close();
     }
+    this.servers = [];
   }
 };
 
@@ -381,6 +442,43 @@ function resolveScopeMode(explicit) {
   if (explicit) return explicit;
   return process.env.EMAIL_MCP_GMAIL_SCOPE?.toLowerCase() === "restricted" ? "restricted" : "full";
 }
+var GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+var GOOGLE_PERMISSIONS_URL = "https://myaccount.google.com/permissions";
+var REVOKE_TIMEOUT_MS = 1e4;
+async function revokeGoogleGrant(token) {
+  if (!token) {
+    return {
+      ok: false,
+      detail: `No Google token was stored for this account, so nothing could be revoked. Remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  }
+  try {
+    const res = await fetch(GOOGLE_REVOKE_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token }).toString(),
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    if (res.ok) {
+      return { ok: true, detail: "Google revoked the grant: email-mcp no longer has access to this Gmail account." };
+    }
+    let reason = "";
+    try {
+      const body = await res.json();
+      reason = [body.error, body.error_description].filter(Boolean).join(": ");
+    } catch {
+    }
+    return {
+      ok: false,
+      detail: `Google refused the revocation (HTTP ${res.status}${reason ? `, ${reason}` : ""}). The grant may already be revoked or expired. Check and remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      detail: `Could not reach Google's revocation endpoint (${err?.message ?? String(err)}). Remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  }
+}
 var GmailAuth = class {
   clientId;
   clientSecret;
@@ -444,23 +542,73 @@ import {
   CryptoProvider
 } from "@azure/msal-node";
 var DEFAULT_CACHE_DIR = path2.join(os2.homedir(), ".email-mcp");
-var DEFAULT_CACHE_FILE = path2.join(DEFAULT_CACHE_DIR, "msal-cache.json");
-function createFileCachePlugin(cacheFilePath) {
+var DEFAULT_CACHE_FILE = path2.join(DEFAULT_CACHE_DIR, "msal-cache.enc");
+var LEGACY_PLAINTEXT_CACHE_NAME = "msal-cache.json";
+var MsalCacheDecryptError = class extends Error {
+  constructor(cacheFilePath) {
+    super(
+      `The Outlook token cache ${cacheFilePath} could not be decrypted: it was modified, is corrupt, or was written with a different key (EMAIL_MCP_KEY or another machine). Delete that file and re-run email-mcp-setup to sign in to Outlook again.`
+    );
+    this.name = "MsalCacheDecryptError";
+  }
+};
+function writeEncryptedCache(cacheFilePath, serialized) {
+  const dir = path2.dirname(cacheFilePath);
+  if (!fs2.existsSync(dir)) {
+    fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  const tmpPath = `${cacheFilePath}.${process.pid}.tmp`;
+  fs2.writeFileSync(tmpPath, encryptWithMachineKey(serialized), { mode: 384 });
+  fs2.chmodSync(tmpPath, 384);
+  fs2.renameSync(tmpPath, cacheFilePath);
+}
+function loadSerializedCache(cacheFilePath, legacyPlaintextPath) {
+  const hasEncrypted = fs2.existsSync(cacheFilePath);
+  if (fs2.existsSync(legacyPlaintextPath)) {
+    const plaintextIsNewer = !hasEncrypted || fs2.statSync(legacyPlaintextPath).mtimeMs > fs2.statSync(cacheFilePath).mtimeMs;
+    if (plaintextIsNewer) {
+      const serialized = fs2.readFileSync(legacyPlaintextPath, "utf-8");
+      writeEncryptedCache(cacheFilePath, serialized);
+      fs2.unlinkSync(legacyPlaintextPath);
+      return serialized;
+    }
+    fs2.unlinkSync(legacyPlaintextPath);
+  }
+  if (!hasEncrypted) return null;
+  const raw = fs2.readFileSync(cacheFilePath, "utf-8");
+  let plaintext;
+  let usedLegacyKey;
+  try {
+    ({ plaintext, usedLegacyKey } = decryptWithMachineKey(raw));
+  } catch {
+    throw new MsalCacheDecryptError(cacheFilePath);
+  }
+  if (usedLegacyKey) {
+    try {
+      writeEncryptedCache(cacheFilePath, plaintext);
+    } catch {
+    }
+  }
+  return plaintext;
+}
+function createEncryptedFileCachePlugin(cacheFilePath, legacyPlaintextPath = path2.join(path2.dirname(cacheFilePath), LEGACY_PLAINTEXT_CACHE_NAME)) {
+  let loadFailed = false;
   return {
     async beforeCacheAccess(context) {
-      if (fs2.existsSync(cacheFilePath)) {
-        const data = fs2.readFileSync(cacheFilePath, "utf-8");
-        context.tokenCache.deserialize(data);
+      loadFailed = false;
+      try {
+        const serialized = loadSerializedCache(cacheFilePath, legacyPlaintextPath);
+        if (serialized !== null) {
+          context.tokenCache.deserialize(serialized);
+        }
+      } catch (err) {
+        loadFailed = true;
+        throw err;
       }
     },
     async afterCacheAccess(context) {
-      if (context.cacheHasChanged) {
-        const dir = path2.dirname(cacheFilePath);
-        if (!fs2.existsSync(dir)) {
-          fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-        }
-        fs2.writeFileSync(cacheFilePath, context.tokenCache.serialize(), { mode: 384 });
-      }
+      if (loadFailed || !context.cacheHasChanged) return;
+      writeEncryptedCache(cacheFilePath, context.tokenCache.serialize());
     }
   };
 }
@@ -479,7 +627,7 @@ var OutlookAuth = class _OutlookAuth {
         authority: _OutlookAuth.AUTHORITY
       },
       cache: {
-        cachePlugin: createFileCachePlugin(cacheFilePath ?? DEFAULT_CACHE_FILE)
+        cachePlugin: createEncryptedFileCachePlugin(cacheFilePath ?? DEFAULT_CACHE_FILE)
       }
     });
     this.cryptoProvider = new CryptoProvider();
@@ -533,6 +681,27 @@ var OutlookAuth = class _OutlookAuth {
       homeAccountId: result.account?.homeAccountId ?? homeAccountId
     };
   }
+  /**
+   * Removes one account (its refresh, access and ID tokens) from the MSAL
+   * cache. Matches by home account id, or by username for credentials saved
+   * before the home account id was recorded. Returns whether an entry was
+   * found and removed.
+   */
+  async removeCachedAccount(match) {
+    const cache = this.pca.getTokenCache();
+    let account = null;
+    if (match.homeAccountId) {
+      account = await cache.getAccountByHomeId(match.homeAccountId);
+    }
+    if (!account && match.username) {
+      const wanted = match.username.trim().toLowerCase();
+      const all = await cache.getAllAccounts();
+      account = all.find((a) => (a.username ?? "").trim().toLowerCase() === wanted) ?? null;
+    }
+    if (!account) return false;
+    await cache.removeAccount(account);
+    return true;
+  }
   /**
    * @deprecated Use refreshTokenSilent() instead.
    * Kept for backward compatibility with credentials that have a stored refresh token.
@@ -2079,7 +2248,7 @@ var ImapAdapter = class {
     const result = await client.mailboxCreate(fullPath);
     return {
       id: result.path,
-      name: result.name || name,
+      name,
       path: result.path,
       type: FolderType.Other
     };
@@ -2317,6 +2486,7 @@ var ImapAdapter = class {
       const uid = parseInt(id, 10);
       const msg = await client.fetchOne(String(uid), { source: true, uid: true, flags: true }, { uid: true });
       if (!msg) throw new Error(`Email ${id} not found`);
+      if (!msg.source) throw new Error(`Email ${id} has no source`);
       const parsed = await simpleParser(msg.source);
       parsed.flags = msg.flags;
       return mapParsedEmail(parsed, targetFolder, this.accountId, msg.uid);
@@ -2341,6 +2511,7 @@ var ImapAdapter = class {
       if (uids.length === 0) throw new Error(`Thread ${threadId} not found`);
       const messages = [];
       for await (const msg of client.fetch(uids, { source: true, uid: true, flags: true })) {
+        if (!msg.source) continue;
         const parsed = await simpleParser(msg.source);
         parsed.flags = msg.flags;
         messages.push(mapParsedEmail(parsed, "INBOX", this.accountId, msg.uid));
@@ -2376,6 +2547,7 @@ var ImapAdapter = class {
     try {
       const msg = await client.fetchOne(String(emailId), { source: true, uid: true }, { uid: true });
       if (!msg) throw new Error(`Email ${emailId} not found`);
+      if (!msg.source) throw new Error(`Email ${emailId} has no source`);
       const parsed = await simpleParser(msg.source);
       const attachment = (parsed.attachments || []).find(
         (att) => att.contentId === attachmentId || att.filename === attachmentId
@@ -2675,16 +2847,16 @@ var ImapAdapter = class {
 var ICloudAdapter = class extends ImapAdapter {
   providerType = ProviderType.ICloud;
   async connect(credentials) {
+    const passwordDefaults = {
+      host: "imap.mail.me.com",
+      port: 993,
+      tls: true,
+      smtpHost: "smtp.mail.me.com",
+      smtpPort: 587
+    };
     const withDefaults = {
       ...credentials,
-      password: {
-        host: "imap.mail.me.com",
-        port: 993,
-        tls: true,
-        smtpHost: "smtp.mail.me.com",
-        smtpPort: 587,
-        ...credentials.password
-      }
+      password: { ...passwordDefaults, ...credentials.password }
     };
     return super.connect(withDefaults);
   }
@@ -2710,6 +2882,7 @@ function createProvider(provider) {
       throw new Error(`Unknown provider: ${provider}`);
   }
 }
+var MICROSOFT_CONSENT_URL = "https://account.live.com/consent/Manage";
 var AccountManager = class {
   store;
   providers = /* @__PURE__ */ new Map();
@@ -2764,9 +2937,55 @@ var AccountManager = class {
     await this.store.save(creds);
     await this.connectAccount(creds.id);
   }
+  /**
+   * Removes an account locally, then cleans up at the provider as far as the
+   * provider allows. Local removal always happens first and never depends on
+   * the network; a failed provider step is reported in the result, not thrown.
+   */
   async removeAccount(accountId) {
+    const creds = await this.store.get(accountId);
+    if (!creds) throw new Error(`Account ${accountId} not found`);
     await this.disconnectAccount(accountId);
     await this.store.remove(accountId);
+    const result = {
+      success: true,
+      accountId,
+      provider: creds.provider,
+      email: creds.email,
+      revocation: { status: "not_applicable", detail: "" }
+    };
+    if (creds.provider === ProviderType.Gmail) {
+      const token = creds.oauth?.refresh_token || creds.oauth?.access_token || "";
+      const { ok, detail } = await revokeGoogleGrant(token);
+      result.revocation = { status: ok ? "revoked" : "failed", detail };
+    } else if (creds.provider === ProviderType.Outlook) {
+      result.tokenCache = await this.removeFromMsalCache(creds);
+      result.revocation = {
+        status: "local_only",
+        detail: `Microsoft offers no endpoint to revoke a refresh token for a personal Microsoft account, so the grant still exists at Microsoft until it expires. To cancel it now, remove email-mcp at ${MICROSOFT_CONSENT_URL}.`
+      };
+    } else {
+      result.revocation = {
+        status: "not_applicable",
+        detail: "This account used a password, not an OAuth grant, so there is nothing to revoke. The password itself stays valid at your provider; if it was an app-specific password (for example from Apple), delete it there if you no longer need it."
+      };
+    }
+    return result;
+  }
+  async removeFromMsalCache(creds) {
+    try {
+      const outlookAuth = new OutlookAuth(OUTLOOK_CLIENT_ID);
+      const removed = await outlookAuth.removeCachedAccount({
+        homeAccountId: creds.oauth?.msal_home_account_id,
+        username: creds.email
+      });
+      return removed ? { status: "removed", detail: "The account's refresh and access tokens were removed from the local Outlook token cache." } : { status: "not_found", detail: "The local Outlook token cache held no tokens for this account." };
+    } catch (err) {
+      return {
+        status: "failed",
+        detail: `The account's tokens could not be removed from the local Outlook token cache: ${err?.message ?? String(err)}`
+      };
+    }
   }
   async disconnectAccount(accountId) {
     const provider = this.providers.get(accountId);
@@ -2881,6 +3100,14 @@ async function testAndSave(creds) {
 async function promptAccountName(defaultName) {
   return askText("Account name:", defaultName);
 }
+async function resolveAccountIdentity(provider, email, defaultName) {
+  const existing = await store.findByProviderAndEmail(provider, email);
+  if (existing) {
+    console.log(`An account for ${email} already exists ("${existing.name}"), updating it in place.`);
+    return { id: existing.id, name: await promptAccountName(existing.name) };
+  }
+  return { id: crypto4.randomUUID(), name: await promptAccountName(defaultName) };
+}
 async function setupGmail(scopeModeFlag) {
   console.log("\n--- Gmail Setup ---");
   if (process.env.EMAIL_MCP_GMAIL_CLIENT_ID) {
@@ -2927,8 +3154,7 @@ ${url}
   const email = profile.emailAddress ?? "";
   if (!email) throw new Error("Could not retrieve Gmail address from profile");
   console.log(`Authenticated as ${email}`);
-  const name = await promptAccountName("Gmail");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.Gmail, email.trim(), "Gmail");
   const creds = {
     id,
     name,
@@ -2965,8 +3191,7 @@ ${url}
   const email = account?.username ?? "";
   if (!email) throw new Error("Could not retrieve email from Microsoft account");
   console.log(`Authenticated as ${email}`);
-  const name = await promptAccountName("Outlook");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.Outlook, email.trim(), "Outlook");
   const creds = {
     id,
     name,
@@ -2997,8 +3222,7 @@ async function setupICloud() {
     console.log("  Password is required");
     password = await askPassword("App-specific password:");
   }
-  const name = await promptAccountName("iCloud");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.ICloud, email.trim(), "iCloud");
   const creds = {
     id,
     name,
@@ -3038,8 +3262,7 @@ async function setupIMAP() {
     const smtpPortStr = await askValidated("SMTP port:", "587", portValidator);
     smtpPort = parseInt(smtpPortStr, 10);
   }
-  const name = await promptAccountName("IMAP");
-  const id = crypto4.randomUUID();
+  const { id, name } = await resolveAccountIdentity(ProviderType.IMAP, email.trim(), "IMAP");
   const creds = {
     id,
     name,