@marlinjai/email-mcp 1.7.2 → 1.8.1

package/dist/index.js

@@ -123,6 +123,14 @@ function decrypt(ciphertext, seeds) {
   }
   throw lastError ?? new Error("Unable to decrypt credentials");
 }
+function encryptWithMachineKey(plaintext) {
+  return encrypt(plaintext, getSeedCandidates()[0]);
+}
+function decryptWithMachineKey(ciphertext) {
+  const seeds = getSeedCandidates();
+  const { plaintext, seedUsed } = decrypt(ciphertext, seeds);
+  return { plaintext, usedLegacyKey: seedUsed !== seeds[0] };
+}
 var ALGORITHM, KEY_LENGTH, IV_LENGTH, SALT_LENGTH, PBKDF2_ITERATIONS, cachedMachineId, CredentialStore;
 var init_credential_store = __esm({
   "src/auth/credential-store.ts"() {
@@ -146,10 +154,9 @@ var init_credential_store = __esm({
           return { accounts: {} };
         }
         const raw = fs.readFileSync(this.filePath, "utf-8");
-        const seeds = getSeedCandidates();
-        const { plaintext, seedUsed } = decrypt(raw, seeds);
+        const { plaintext, usedLegacyKey } = decryptWithMachineKey(raw);
         const data = JSON.parse(plaintext);
-        if (seedUsed !== seeds[0]) {
+        if (usedLegacyKey) {
           try {
             this.write(data);
           } catch {
@@ -159,7 +166,7 @@ var init_credential_store = __esm({
       }
       write(data) {
         const json2 = JSON.stringify(data);
-        const encrypted = encrypt(json2, getSeedCandidates()[0]);
+        const encrypted = encryptWithMachineKey(json2);
         fs.writeFileSync(this.filePath, encrypted, { mode: 384 });
       }
       async save(creds) {
@@ -7144,6 +7151,58 @@ var init_mapper = __esm({
   }
 });
 
+// src/providers/mime.ts
+import MailComposer from "nodemailer/lib/mail-composer/index.js";
+import { convert } from "html-to-text";
+function htmlToText(html) {
+  return convert(html, {
+    wordwrap: false,
+    selectors: [
+      { selector: "img", format: "skip" },
+      { selector: "a", options: { hideLinkHrefIfSameAsText: true } }
+    ]
+  }).trim();
+}
+function normalizeBody(body) {
+  const html = body.html ? body.html : void 0;
+  if (body.text) return { text: body.text, html };
+  if (html) return { text: htmlToText(html), html };
+  return { text: "" };
+}
+function toAddress(contact) {
+  return contact.name ? { name: contact.name, address: contact.email } : contact.email;
+}
+function toAddressList(contacts) {
+  return contacts?.length ? contacts.map(toAddress) : void 0;
+}
+async function buildMimeMessage(from, params) {
+  const { text, html } = normalizeBody(params.body);
+  const mail = {
+    from,
+    to: toAddressList(params.to),
+    cc: toAddressList(params.cc),
+    bcc: toAddressList(params.bcc),
+    subject: params.subject,
+    text,
+    html,
+    inReplyTo: params.inReplyTo,
+    references: params.references?.length ? params.references : void 0,
+    attachments: params.attachments?.map((a) => ({
+      filename: a.filename,
+      content: a.content,
+      contentType: a.contentType
+    }))
+  };
+  const node = new MailComposer(mail).compile();
+  node.keepBcc = true;
+  return node.build();
+}
+var init_mime = __esm({
+  "src/providers/mime.ts"() {
+    "use strict";
+  }
+});
+
 // src/providers/gmail/adapter.ts
 import { Readable } from "node:stream";
 import { google } from "googleapis";
@@ -7154,6 +7213,7 @@ var init_adapter = __esm({
     "use strict";
     init_types();
     init_mapper();
+    init_mime();
     GmailAdapter = class {
       providerType = ProviderType.Gmail;
       gmail = null;
@@ -7295,7 +7355,7 @@ var init_adapter = __esm({
       }
       async sendEmail(params) {
         const gmail = this.ensureConnected();
-        const raw = this.buildRfc2822(params);
+        const raw = await this.buildRaw(params);
         const res = await gmail.users.messages.send({
           userId: "me",
           requestBody: { raw }
@@ -7307,7 +7367,7 @@ var init_adapter = __esm({
       }
       async createDraft(params) {
         const gmail = this.ensureConnected();
-        const raw = this.buildRfc2822(params);
+        const raw = await this.buildRaw(params);
         const res = await gmail.users.drafts.create({
           userId: "me",
           requestBody: {
@@ -7318,7 +7378,7 @@ var init_adapter = __esm({
       }
       async updateDraft(draftId, params) {
         const gmail = this.ensureConnected();
-        const raw = this.buildRfc2822(params);
+        const raw = await this.buildRaw(params);
         const res = await gmail.users.drafts.update({
           userId: "me",
           id: draftId,
@@ -7647,30 +7707,15 @@ var init_adapter = __esm({
         const gmail = this.ensureConnected();
         await gmail.users.settings.filters.delete({ userId: "me", id: ruleId });
       }
-      buildRfc2822(params) {
-        const lines = [];
-        lines.push(`From: ${this.email}`);
-        lines.push(
-          `To: ${params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", ")}`
-        );
-        if (params.cc?.length) {
-          lines.push(`Cc: ${params.cc.map((c) => c.email).join(", ")}`);
-        }
-        if (params.bcc?.length) {
-          lines.push(`Bcc: ${params.bcc.map((c) => c.email).join(", ")}`);
-        }
-        lines.push(`Subject: ${params.subject}`);
-        if (params.inReplyTo) {
-          lines.push(`In-Reply-To: ${params.inReplyTo}`);
-        }
-        if (params.references?.length) {
-          lines.push(`References: ${params.references.join(" ")}`);
-        }
-        lines.push("MIME-Version: 1.0");
-        lines.push("Content-Type: text/plain; charset=UTF-8");
-        lines.push("");
-        lines.push(params.body.text || params.body.html || "");
-        return Buffer.from(lines.join("\r\n")).toString("base64url");
+      /**
+       * Builds the base64url `raw` payload Gmail expects for send, draft create and
+       * draft update: a full MIME message with a text part, an HTML part when one
+       * was given (or a text part derived from HTML-only input), encoded headers
+       * and any attachments. See `buildMimeMessage`.
+       */
+      async buildRaw(params) {
+        const message = await buildMimeMessage(this.email, params);
+        return message.toString("base64url");
       }
     };
   }
@@ -7683,7 +7728,41 @@ function resolveScopeMode(explicit) {
   if (explicit) return explicit;
   return process.env.EMAIL_MCP_GMAIL_SCOPE?.toLowerCase() === "restricted" ? "restricted" : "full";
 }
-var GMAIL_SCOPES, GmailAuth;
+async function revokeGoogleGrant(token) {
+  if (!token) {
+    return {
+      ok: false,
+      detail: `No Google token was stored for this account, so nothing could be revoked. Remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  }
+  try {
+    const res = await fetch(GOOGLE_REVOKE_ENDPOINT, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token }).toString(),
+      signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    });
+    if (res.ok) {
+      return { ok: true, detail: "Google revoked the grant: email-mcp no longer has access to this Gmail account." };
+    }
+    let reason = "";
+    try {
+      const body = await res.json();
+      reason = [body.error, body.error_description].filter(Boolean).join(": ");
+    } catch {
+    }
+    return {
+      ok: false,
+      detail: `Google refused the revocation (HTTP ${res.status}${reason ? `, ${reason}` : ""}). The grant may already be revoked or expired. Check and remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      detail: `Could not reach Google's revocation endpoint (${err?.message ?? String(err)}). Remove email-mcp manually at ${GOOGLE_PERMISSIONS_URL}.`
+    };
+  }
+}
+var GMAIL_SCOPES, GOOGLE_REVOKE_ENDPOINT, GOOGLE_PERMISSIONS_URL, REVOKE_TIMEOUT_MS, GmailAuth;
 var init_auth = __esm({
   "src/providers/gmail/auth.ts"() {
     "use strict";
@@ -7710,6 +7789,9 @@ var init_auth = __esm({
         "https://www.googleapis.com/auth/gmail.settings.basic"
       ]
     };
+    GOOGLE_REVOKE_ENDPOINT = "https://oauth2.googleapis.com/revoke";
+    GOOGLE_PERMISSIONS_URL = "https://myaccount.google.com/permissions";
+    REVOKE_TIMEOUT_MS = 1e4;
     GmailAuth = class {
       clientId;
       clientSecret;
@@ -8391,31 +8473,82 @@ import {
   PublicClientApplication,
   CryptoProvider
 } from "@azure/msal-node";
-function createFileCachePlugin(cacheFilePath) {
+function writeEncryptedCache(cacheFilePath, serialized) {
+  const dir = path2.dirname(cacheFilePath);
+  if (!fs2.existsSync(dir)) {
+    fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  const tmpPath = `${cacheFilePath}.${process.pid}.tmp`;
+  fs2.writeFileSync(tmpPath, encryptWithMachineKey(serialized), { mode: 384 });
+  fs2.chmodSync(tmpPath, 384);
+  fs2.renameSync(tmpPath, cacheFilePath);
+}
+function loadSerializedCache(cacheFilePath, legacyPlaintextPath) {
+  const hasEncrypted = fs2.existsSync(cacheFilePath);
+  if (fs2.existsSync(legacyPlaintextPath)) {
+    const plaintextIsNewer = !hasEncrypted || fs2.statSync(legacyPlaintextPath).mtimeMs > fs2.statSync(cacheFilePath).mtimeMs;
+    if (plaintextIsNewer) {
+      const serialized = fs2.readFileSync(legacyPlaintextPath, "utf-8");
+      writeEncryptedCache(cacheFilePath, serialized);
+      fs2.unlinkSync(legacyPlaintextPath);
+      return serialized;
+    }
+    fs2.unlinkSync(legacyPlaintextPath);
+  }
+  if (!hasEncrypted) return null;
+  const raw = fs2.readFileSync(cacheFilePath, "utf-8");
+  let plaintext;
+  let usedLegacyKey;
+  try {
+    ({ plaintext, usedLegacyKey } = decryptWithMachineKey(raw));
+  } catch {
+    throw new MsalCacheDecryptError(cacheFilePath);
+  }
+  if (usedLegacyKey) {
+    try {
+      writeEncryptedCache(cacheFilePath, plaintext);
+    } catch {
+    }
+  }
+  return plaintext;
+}
+function createEncryptedFileCachePlugin(cacheFilePath, legacyPlaintextPath = path2.join(path2.dirname(cacheFilePath), LEGACY_PLAINTEXT_CACHE_NAME)) {
+  let loadFailed = false;
   return {
     async beforeCacheAccess(context) {
-      if (fs2.existsSync(cacheFilePath)) {
-        const data = fs2.readFileSync(cacheFilePath, "utf-8");
-        context.tokenCache.deserialize(data);
+      loadFailed = false;
+      try {
+        const serialized = loadSerializedCache(cacheFilePath, legacyPlaintextPath);
+        if (serialized !== null) {
+          context.tokenCache.deserialize(serialized);
+        }
+      } catch (err) {
+        loadFailed = true;
+        throw err;
       }
     },
     async afterCacheAccess(context) {
-      if (context.cacheHasChanged) {
-        const dir = path2.dirname(cacheFilePath);
-        if (!fs2.existsSync(dir)) {
-          fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-        }
-        fs2.writeFileSync(cacheFilePath, context.tokenCache.serialize(), { mode: 384 });
-      }
+      if (loadFailed || !context.cacheHasChanged) return;
+      writeEncryptedCache(cacheFilePath, context.tokenCache.serialize());
     }
   };
 }
-var DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, OutlookAuth;
+var DEFAULT_CACHE_DIR, DEFAULT_CACHE_FILE, LEGACY_PLAINTEXT_CACHE_NAME, MsalCacheDecryptError, OutlookAuth;
 var init_auth2 = __esm({
   "src/providers/outlook/auth.ts"() {
     "use strict";
+    init_credential_store();
     DEFAULT_CACHE_DIR = path2.join(os2.homedir(), ".email-mcp");
-    DEFAULT_CACHE_FILE = path2.join(DEFAULT_CACHE_DIR, "msal-cache.json");
+    DEFAULT_CACHE_FILE = path2.join(DEFAULT_CACHE_DIR, "msal-cache.enc");
+    LEGACY_PLAINTEXT_CACHE_NAME = "msal-cache.json";
+    MsalCacheDecryptError = class extends Error {
+      constructor(cacheFilePath) {
+        super(
+          `The Outlook token cache ${cacheFilePath} could not be decrypted: it was modified, is corrupt, or was written with a different key (EMAIL_MCP_KEY or another machine). Delete that file and re-run email-mcp-setup to sign in to Outlook again.`
+        );
+        this.name = "MsalCacheDecryptError";
+      }
+    };
     OutlookAuth = class _OutlookAuth {
       static AUTHORITY = "https://login.microsoftonline.com/consumers";
       // MailboxSettings.ReadWrite is required for the messageRules API (block
@@ -8431,7 +8564,7 @@ var init_auth2 = __esm({
             authority: _OutlookAuth.AUTHORITY
           },
           cache: {
-            cachePlugin: createFileCachePlugin(cacheFilePath ?? DEFAULT_CACHE_FILE)
+            cachePlugin: createEncryptedFileCachePlugin(cacheFilePath ?? DEFAULT_CACHE_FILE)
           }
         });
         this.cryptoProvider = new CryptoProvider();
@@ -8485,6 +8618,27 @@ var init_auth2 = __esm({
           homeAccountId: result.account?.homeAccountId ?? homeAccountId
         };
       }
+      /**
+       * Removes one account (its refresh, access and ID tokens) from the MSAL
+       * cache. Matches by home account id, or by username for credentials saved
+       * before the home account id was recorded. Returns whether an entry was
+       * found and removed.
+       */
+      async removeCachedAccount(match) {
+        const cache = this.pca.getTokenCache();
+        let account = null;
+        if (match.homeAccountId) {
+          account = await cache.getAccountByHomeId(match.homeAccountId);
+        }
+        if (!account && match.username) {
+          const wanted = match.username.trim().toLowerCase();
+          const all = await cache.getAllAccounts();
+          account = all.find((a) => (a.username ?? "").trim().toLowerCase() === wanted) ?? null;
+        }
+        if (!account) return false;
+        await cache.removeAccount(account);
+        return true;
+      }
       /**
        * @deprecated Use refreshTokenSilent() instead.
        * Kept for backward compatibility with credentials that have a stored refresh token.
@@ -8586,14 +8740,15 @@ function createSmtpTransport(email3, creds) {
   });
 }
 async function sendViaSmtp(transport, from, params) {
+  const { text, html } = normalizeBody(params.body);
   const result = await transport.sendMail({
     from,
-    to: params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", "),
-    cc: params.cc?.map((c) => c.email).join(", "),
-    bcc: params.bcc?.map((c) => c.email).join(", "),
+    to: params.to.map(toAddress),
+    cc: params.cc?.length ? params.cc.map(toAddress) : void 0,
+    bcc: params.bcc?.length ? params.bcc.map(toAddress) : void 0,
     subject: params.subject,
-    text: params.body.text,
-    html: params.body.html,
+    text,
+    html,
     inReplyTo: params.inReplyTo,
     references: params.references?.join(" "),
     attachments: params.attachments?.map((a) => ({
@@ -8607,6 +8762,7 @@ async function sendViaSmtp(transport, from, params) {
 var init_smtp = __esm({
   "src/providers/imap/smtp.ts"() {
     "use strict";
+    init_mime();
   }
 });
 
@@ -8639,6 +8795,7 @@ var init_adapter3 = __esm({
     init_types();
     init_mapper3();
     init_smtp();
+    init_mime();
     ImapAdapter = class {
       providerType = ProviderType.IMAP;
       client = null;
@@ -8754,7 +8911,7 @@ var init_adapter3 = __esm({
         const result = await client.mailboxCreate(fullPath);
         return {
           id: result.path,
-          name: result.name || name,
+          name,
           path: result.path,
           type: FolderType.Other
         };
@@ -8992,6 +9149,7 @@ var init_adapter3 = __esm({
           const uid = parseInt(id, 10);
           const msg = await client.fetchOne(String(uid), { source: true, uid: true, flags: true }, { uid: true });
           if (!msg) throw new Error(`Email ${id} not found`);
+          if (!msg.source) throw new Error(`Email ${id} has no source`);
           const parsed = await simpleParser(msg.source);
           parsed.flags = msg.flags;
           return mapParsedEmail(parsed, targetFolder, this.accountId, msg.uid);
@@ -9016,6 +9174,7 @@ var init_adapter3 = __esm({
           if (uids.length === 0) throw new Error(`Thread ${threadId} not found`);
           const messages = [];
           for await (const msg of client.fetch(uids, { source: true, uid: true, flags: true })) {
+            if (!msg.source) continue;
             const parsed = await simpleParser(msg.source);
             parsed.flags = msg.flags;
             messages.push(mapParsedEmail(parsed, "INBOX", this.accountId, msg.uid));
@@ -9051,6 +9210,7 @@ var init_adapter3 = __esm({
         try {
           const msg = await client.fetchOne(String(emailId), { source: true, uid: true }, { uid: true });
           if (!msg) throw new Error(`Email ${emailId} not found`);
+          if (!msg.source) throw new Error(`Email ${emailId} has no source`);
           const parsed = await simpleParser(msg.source);
           const attachment = (parsed.attachments || []).find(
             (att) => att.contentId === attachmentId || att.filename === attachmentId
@@ -9075,26 +9235,17 @@ var init_adapter3 = __esm({
         const messageId = await sendViaSmtp(transport, this.email, params);
         return { id: messageId };
       }
-      buildDraftRfc2822(params) {
-        const lines = [];
-        lines.push(`From: ${this.email}`);
-        lines.push(`To: ${params.to.map((c) => c.name ? `"${c.name}" <${c.email}>` : c.email).join(", ")}`);
-        if (params.cc?.length) {
-          lines.push(`Cc: ${params.cc.map((c) => c.email).join(", ")}`);
-        }
-        lines.push(`Subject: ${params.subject}`);
-        lines.push(`Date: ${(/* @__PURE__ */ new Date()).toUTCString()}`);
-        if (params.inReplyTo) lines.push(`In-Reply-To: ${params.inReplyTo}`);
-        if (params.references?.length) lines.push(`References: ${params.references.join(" ")}`);
-        lines.push("MIME-Version: 1.0");
-        lines.push("Content-Type: text/plain; charset=utf-8");
-        lines.push("");
-        lines.push(params.body.text || "");
-        return lines.join("\r\n");
+      /**
+       * Builds the full MIME message a draft is stored as: text and HTML parts,
+       * Bcc kept so the draft remembers its recipients, encoded headers and any
+       * attachments. See `buildMimeMessage`.
+       */
+      buildDraftMessage(params) {
+        return buildMimeMessage(this.email, params);
       }
       async createDraft(params) {
         const client = await this.ensureConnected();
-        const rawMessage = this.buildDraftRfc2822(params);
+        const rawMessage = await this.buildDraftMessage(params);
         const draftsFolder = await this.resolveFolder("Drafts");
         const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
         if (!result) throw new Error("Failed to append draft");
@@ -9109,6 +9260,7 @@ var init_adapter3 = __esm({
       async updateDraft(draftId, params, sourceFolder) {
         const client = await this.ensureConnected();
         const draftsFolder = sourceFolder ? await this.resolveFolder(sourceFolder) : await this.resolveFolder("Drafts");
+        const rawMessage = await this.buildDraftMessage(params);
         let lock;
         try {
           lock = await client.getMailboxLock(draftsFolder);
@@ -9120,7 +9272,6 @@ var init_adapter3 = __esm({
         } finally {
           lock.release();
         }
-        const rawMessage = this.buildDraftRfc2822(params);
         const result = await client.append(draftsFolder, rawMessage, ["\\Draft", "\\Seen"]);
         if (!result) throw new Error("Failed to append updated draft");
         return { id: String(result.uid || result) };
@@ -9358,16 +9509,16 @@ var init_adapter4 = __esm({
     ICloudAdapter = class extends ImapAdapter {
       providerType = ProviderType.ICloud;
       async connect(credentials) {
+        const passwordDefaults = {
+          host: "imap.mail.me.com",
+          port: 993,
+          tls: true,
+          smtpHost: "smtp.mail.me.com",
+          smtpPort: 587
+        };
         const withDefaults = {
           ...credentials,
-          password: {
-            host: "imap.mail.me.com",
-            port: 993,
-            tls: true,
-            smtpHost: "smtp.mail.me.com",
-            smtpPort: 587,
-            ...credentials.password
-          }
+          password: { ...passwordDefaults, ...credentials.password }
         };
         return super.connect(withDefaults);
       }
@@ -9401,7 +9552,7 @@ function createProvider(provider) {
       throw new Error(`Unknown provider: ${provider}`);
   }
 }
-var AccountManager;
+var MICROSOFT_CONSENT_URL, AccountManager;
 var init_account_manager = __esm({
   "src/account-manager.ts"() {
     "use strict";
@@ -9414,6 +9565,7 @@ var init_account_manager = __esm({
     init_adapter3();
     init_types();
     init_oauth_config();
+    MICROSOFT_CONSENT_URL = "https://account.live.com/consent/Manage";
     AccountManager = class {
       store;
       providers = /* @__PURE__ */ new Map();
@@ -9468,9 +9620,55 @@ var init_account_manager = __esm({
         await this.store.save(creds);
         await this.connectAccount(creds.id);
       }
+      /**
+       * Removes an account locally, then cleans up at the provider as far as the
+       * provider allows. Local removal always happens first and never depends on
+       * the network; a failed provider step is reported in the result, not thrown.
+       */
       async removeAccount(accountId) {
+        const creds = await this.store.get(accountId);
+        if (!creds) throw new Error(`Account ${accountId} not found`);
         await this.disconnectAccount(accountId);
         await this.store.remove(accountId);
+        const result = {
+          success: true,
+          accountId,
+          provider: creds.provider,
+          email: creds.email,
+          revocation: { status: "not_applicable", detail: "" }
+        };
+        if (creds.provider === ProviderType.Gmail) {
+          const token = creds.oauth?.refresh_token || creds.oauth?.access_token || "";
+          const { ok, detail } = await revokeGoogleGrant(token);
+          result.revocation = { status: ok ? "revoked" : "failed", detail };
+        } else if (creds.provider === ProviderType.Outlook) {
+          result.tokenCache = await this.removeFromMsalCache(creds);
+          result.revocation = {
+            status: "local_only",
+            detail: `Microsoft offers no endpoint to revoke a refresh token for a personal Microsoft account, so the grant still exists at Microsoft until it expires. To cancel it now, remove email-mcp at ${MICROSOFT_CONSENT_URL}.`
+          };
+        } else {
+          result.revocation = {
+            status: "not_applicable",
+            detail: "This account used a password, not an OAuth grant, so there is nothing to revoke. The password itself stays valid at your provider; if it was an app-specific password (for example from Apple), delete it there if you no longer need it."
+          };
+        }
+        return result;
+      }
+      async removeFromMsalCache(creds) {
+        try {
+          const outlookAuth = new OutlookAuth(OUTLOOK_CLIENT_ID);
+          const removed = await outlookAuth.removeCachedAccount({
+            homeAccountId: creds.oauth?.msal_home_account_id,
+            username: creds.email
+          });
+          return removed ? { status: "removed", detail: "The account's refresh and access tokens were removed from the local Outlook token cache." } : { status: "not_found", detail: "The local Outlook token cache held no tokens for this account." };
+        } catch (err) {
+          return {
+            status: "failed",
+            detail: `The account's tokens could not be removed from the local Outlook token cache: ${err?.message ?? String(err)}`
+          };
+        }
       }
       async disconnectAccount(accountId) {
         const provider = this.providers.get(accountId);
@@ -9671,53 +9869,95 @@ var init_oauth_server = __esm({
   <p>An error occurred during authorization. Please try again.</p>
 </body>
 </html>`;
-    OAuthCallbackServer = class {
-      server = null;
+    OAuthCallbackServer = class _OAuthCallbackServer {
+      servers = [];
       resolveCode = null;
       rejectCode = null;
       timeoutMs;
       timeoutHandle = null;
       expectedState = null;
+      static IPV4_LOOPBACK = "127.0.0.1";
+      static IPV6_LOOPBACK = "::1";
+      /** Attempts at finding a port that is free on both loopback addresses. */
+      static MAX_PORT_ATTEMPTS = 5;
       constructor(timeoutMs = 12e4) {
         this.timeoutMs = timeoutMs;
       }
-      start() {
+      handleRequest = (req, res) => {
+        const url2 = new URL(req.url || "/", `http://localhost`);
+        if (url2.pathname === "/callback" || url2.pathname === "/") {
+          const code = url2.searchParams.get("code");
+          const error48 = url2.searchParams.get("error");
+          const state = url2.searchParams.get("state");
+          if (code && this.expectedState !== null && state !== this.expectedState) {
+            res.writeHead(400, { "Content-Type": "text/html" });
+            res.end(ERROR_HTML);
+            this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
+          } else if (code) {
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end(SUCCESS_HTML);
+            this.resolveCode?.(code);
+          } else {
+            res.writeHead(400, { "Content-Type": "text/html" });
+            res.end(ERROR_HTML);
+            this.rejectCode?.(new Error(`OAuth error: ${error48 || "no code received"}`));
+          }
+        } else {
+          res.writeHead(404);
+          res.end("Not Found");
+        }
+      };
+      listenOn(host, port) {
         return new Promise((resolve, reject) => {
-          this.server = http.createServer((req, res) => {
-            const url2 = new URL(req.url || "/", `http://localhost`);
-            if (url2.pathname === "/callback" || url2.pathname === "/") {
-              const code = url2.searchParams.get("code");
-              const error48 = url2.searchParams.get("error");
-              const state = url2.searchParams.get("state");
-              if (code && this.expectedState !== null && state !== this.expectedState) {
-                res.writeHead(400, { "Content-Type": "text/html" });
-                res.end(ERROR_HTML);
-                this.rejectCode?.(new Error("OAuth error: state mismatch, callback did not come from the authorization request we started"));
-              } else if (code) {
-                res.writeHead(200, { "Content-Type": "text/html" });
-                res.end(SUCCESS_HTML);
-                this.resolveCode?.(code);
-              } else {
-                res.writeHead(400, { "Content-Type": "text/html" });
-                res.end(ERROR_HTML);
-                this.rejectCode?.(new Error(`OAuth error: ${error48 || "no code received"}`));
-              }
-            } else {
-              res.writeHead(404);
-              res.end("Not Found");
-            }
-          });
-          this.server.listen(0, () => {
-            const addr = this.server.address();
-            if (addr && typeof addr === "object") {
-              resolve(addr.port);
-            } else {
-              reject(new Error("Failed to get server port"));
-            }
+          const server = http.createServer(this.handleRequest);
+          const onError = (err) => {
+            server.close();
+            reject(err);
+          };
+          server.once("error", onError);
+          server.listen(port, host, () => {
+            server.off("error", onError);
+            server.on("error", (err) => this.rejectCode?.(err));
+            resolve(server);
           });
-          this.server.on("error", reject);
         });
       }
+      /**
+       * Starts listening on an OS-assigned port on 127.0.0.1 and, when available,
+       * the same port on ::1. Resolves with the port.
+       */
+      async start() {
+        let lastError;
+        for (let attempt = 0; attempt < _OAuthCallbackServer.MAX_PORT_ATTEMPTS; attempt++) {
+          const v4 = await this.listenOn(_OAuthCallbackServer.IPV4_LOOPBACK, 0);
+          const addr = v4.address();
+          if (!addr || typeof addr !== "object") {
+            v4.close();
+            throw new Error("Failed to get server port");
+          }
+          const port = addr.port;
+          try {
+            const v6 = await this.listenOn(_OAuthCallbackServer.IPV6_LOOPBACK, port);
+            this.servers = [v4, v6];
+            return port;
+          } catch (err) {
+            if (err?.code === "EADDRINUSE") {
+              v4.close();
+              lastError = err;
+              continue;
+            }
+            this.servers = [v4];
+            return port;
+          }
+        }
+        throw new Error(
+          `Could not find a port free on both loopback addresses: ${lastError?.message ?? "unknown error"}`
+        );
+      }
+      /** The addresses the callback server is listening on (for diagnostics and tests). */
+      boundAddresses() {
+        return this.servers.map((s) => s.address()).filter((a) => !!a && typeof a === "object").map((a) => a.address);
+      }
       /**
        * Resolve with the authorization code once the browser is redirected back.
        * Pass the `state` that was put into the authorization URL: callbacks whose
@@ -9745,10 +9985,10 @@ var init_oauth_server = __esm({
           clearTimeout(this.timeoutHandle);
           this.timeoutHandle = null;
         }
-        if (this.server) {
-          this.server.close();
-          this.server = null;
+        for (const server of this.servers) {
+          server.close();
         }
+        this.servers = [];
       }
     };
   }
@@ -33327,14 +33567,14 @@ function registerAccountTools(server, accountManager) {
   );
   server.tool(
     "email_remove_account",
-    "Remove an email account",
+    "Remove an email account: deletes its stored credentials, revokes the Google grant for Gmail accounts, and removes Outlook tokens from the local token cache. The result reports whether provider-side revocation succeeded.",
     {
       accountId: external_exports3.string().describe("ID of the account to remove")
     },
     async (args) => {
       try {
-        await accountManager.removeAccount(args.accountId);
-        return jsonResult({ success: true });
+        const result = await accountManager.removeAccount(args.accountId);
+        return jsonResult(result);
       } catch (error48) {
         return jsonResult({ error: error48.message });
       }
@@ -33518,8 +33758,9 @@ function registerReadingTools(server, accountManager) {
         const absPath = resolveDownloadPath(args.outputPath);
         const provider = await accountManager.getProvider(args.accountId);
         const { data, meta: meta3 } = await provider.getAttachment(args.emailId, args.attachmentId);
-        fs3.mkdirSync(path3.dirname(absPath), { recursive: true });
-        fs3.writeFileSync(absPath, Buffer.from(data));
+        fs3.mkdirSync(path3.dirname(absPath), { recursive: true, mode: 448 });
+        fs3.writeFileSync(absPath, Buffer.from(data), { mode: 384 });
+        fs3.chmodSync(absPath, 384);
         return jsonResult2({
           path: absPath,
           bytes: data.length,
@@ -34242,11 +34483,12 @@ function registerModerationTools(server, accountManager) {
 }
 
 // src/server.ts
+var SERVER_VERSION = "1.8.1";
 async function createServer(accountManager) {
   const mgr = accountManager ?? new AccountManager();
   const server = new McpServer({
     name: "email-mcp",
-    version: "0.1.0"
+    version: SERVER_VERSION
   });
   registerAccountTools(server, mgr);
   registerReadingTools(server, mgr);