@ni-c/imap-mcp 0.4.0 → 0.5.0

package/README.md

@@ -1,14 +1,19 @@
 # imap-mcp
 
+<!-- badges: start -->
+
 [![CI](https://img.shields.io/github/actions/workflow/status/ni-c/imap-mcp/ci.yml?branch=main&label=CI)](https://github.com/ni-c/imap-mcp/actions/workflows/ci.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ni-c/imap-mcp/badge)](https://scorecard.dev/viewer/?uri=github.com/ni-c/imap-mcp)
+<a href="https://socket.dev/npm/package/@ni-c/imap-mcp"><img src="https://socket.dev/api/badge/npm/package/@ni-c/imap-mcp" alt="Socket supply-chain report" height="20"></a>
+[![Glama score](https://glama.ai/mcp/servers/ni-c/imap-mcp/badges/score.svg)](https://glama.ai/mcp/servers/ni-c/imap-mcp)
+<br>
 [![npm version](https://img.shields.io/npm/v/%40ni-c%2Fimap-mcp)](https://www.npmjs.com/package/@ni-c/imap-mcp)
-[![npm downloads](https://img.shields.io/npm/dm/%40ni-c%2Fimap-mcp)](https://www.npmjs.com/package/@ni-c/imap-mcp)
-[![node](https://img.shields.io/node/v/%40ni-c%2Fimap-mcp)](https://nodejs.org)
-[![license](https://img.shields.io/npm/l/%40ni-c%2Fimap-mcp)](LICENSE)
-[![container](https://img.shields.io/badge/ghcr.io-ni--c%2Fimap--mcp-blue)](https://github.com/ni-c/imap-mcp/pkgs/container/imap-mcp)
-[![docs](https://img.shields.io/badge/docs-imap--mcp.ni--c.de-informational)](https://imap-mcp.ni-c.de)
-[![HTTP • via mcp-hub](https://img.shields.io/badge/HTTP-via%20mcp--hub-6f42c1)](https://mcp-hub.ni-c.de)
+[![container image](https://img.shields.io/badge/ghcr.io-ni--c%2Fimap--mcp-4f46e5?logo=docker&logoColor=white)](https://github.com/ni-c/imap-mcp/pkgs/container/imap-mcp)
+[![HTTP via mcp-hub](https://img.shields.io/badge/HTTP-via%20mcp--hub-4f46e5?logo=modelcontextprotocol&logoColor=white)](https://mcp-hub.ni-c.de)
+<br>
+[![docs](https://img.shields.io/badge/docs-imap--mcp.ni--c.de-4f46e5?logo=readthedocs&logoColor=white)](https://imap-mcp.ni-c.de)
 [![sponsor](https://img.shields.io/badge/sponsor-ni--c-ea4aaa?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/ni-c)
+<!-- badges: end -->
 
 A [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server for any IMAP
 mailbox. It speaks IMAP rather than one vendor's API, so it works with whatever provider you
@@ -144,6 +149,10 @@ IMAP_ALLOW_TOOLS=list_new_messages,get_message,move_messages
 IMAP_DENY_TOOLS=delete_messages
 ```
 
+One boundary the list cannot draw: `move_messages` copies as well as moves (`mode: "copy"`),
+and the two are one tool. Denying `move_messages` removes both; there is no way to keep moving
+and forbid copying, or the other way round. Both modes ask for confirmation.
+
 An entry that matches no tool aborts startup and names it, so a typo cannot silently hide a
 tool — an absent tool is not something anyone traces back to an environment variable. A
 filtered tool is never registered, so it is absent from `tools/list` and unknown to

package/dist/analyze.d.ts

@@ -61,6 +61,7 @@ export interface SecurityAssessment {
  * and the fencing in {@link wrapUntrusted} is what carries the weight.
  */
 export declare function htmlToText(html: string, maxChars?: number): string;
+export declare function decodeCharacterReferences(text: string): string;
 /**
  * Removes the characters a human reader cannot see but the model can.
  *

package/dist/analyze.js

@@ -338,38 +338,46 @@ export function htmlToText(html, maxChars = MAX_HTML_CHARS) {
         }
         i = gt + 1;
     }
-    return (out
-        .join('')
-        .replace(/ /gi, ' ')
-        .replace(/&lt;/gi, '<')
-        .replace(/&gt;/gi, '>')
-        .replace(/&quot;/gi, '"')
-        .replace(/&#39;/g, "'")
-        // Numeric character references. Common in HTML mail (`&#8217;` for a
-        // curly apostrophe) and near-universal in OOXML, where a German document
-        // may write every umlaut this way — without this they arrive as literal
-        // `&#228;`. Bounded digit counts so the pattern cannot be made to scan,
-        // and out-of-range values produce nothing rather than a guess.
-        .replace(/&#x([0-9a-f]{1,6});/gi, (match, hex) => fromCodePoint(parseInt(hex, 16), match))
-        .replace(/&#(\d{1,7});/g, (match, digits) => fromCodePoint(Number(digits), match))
-        // Last, so a decoded `&amp;lt;` does not turn into a `<` the caller never
-        // received.
-        .replace(/&amp;/gi, '&'));
+    return decodeCharacterReferences(out.join(''));
 }
 /**
- * One character from a numeric reference, or the reference itself.
+ * The character references a mail client decodes, decoded the way it does.
  *
- * Returning the original text for anything out of range is the conservative
- * half: a reference nobody can render is better left visible than turned into a
- * replacement character that reads as content. Surrogates are excluded because
- * a lone one is not a character and only makes the string harder to handle
- * downstream.
+ * One alternation, one pass. It used to be six `replace` calls in sequence,
+ * and a sequence decodes twice: `&#x26;#104;` became `&#104;` in the hex pass
+ * and `h` in the decimal pass, a character no client ever shows. And the digit
+ * runs were bounded (`{1,7}`) with the semicolon required, while the HTML
+ * tokenizer reads *every* digit and takes the semicolon as optional — so
+ * `&#0000000104;` reached the model as eleven literal characters and the
+ * recipient as an `h`. Here a numeric reference is any digit run, with or
+ * without its semicolon; the named ones are the five HTML mail and OOXML use.
+ *
+ * Out-of-range values, zero and surrogates decode to U+FFFD, which is what a
+ * browser renders — a character, and not `''`, which would make `&#0;` an
+ * invisible separator inside a word.
  */
-function fromCodePoint(value, original) {
+const CHARACTER_REFERENCE = /&(?:#[xX]([0-9a-fA-F]+);?|#([0-9]+);?|(nbsp|lt|gt|quot|amp|apos);)/g;
+export function decodeCharacterReferences(text) {
+    return text.replace(CHARACTER_REFERENCE, (_match, hex, decimal, name) => hex !== undefined
+        ? fromCodePoint(parseInt(hex, 16))
+        : decimal !== undefined
+            ? fromCodePoint(Number(decimal))
+            : (NAMED_REFERENCES.get(String(name).toLowerCase()) ?? _match));
+}
+const NAMED_REFERENCES = new Map([
+    ['nbsp', ' '],
+    ['lt', '<'],
+    ['gt', '>'],
+    ['quot', '"'],
+    ['amp', '&'],
+    ['apos', "'"],
+]);
+/** One character from a numeric reference, U+FFFD where no client has one. */
+function fromCodePoint(value) {
     if (!Number.isInteger(value) || value < 1 || value > 0x10ffff)
-        return original;
+        return String.fromCodePoint(0xfffd);
     if (value >= 0xd800 && value <= 0xdfff)
-        return original;
+        return String.fromCodePoint(0xfffd);
     return String.fromCodePoint(value);
 }
 /**
@@ -392,8 +400,13 @@ export function stripInvisible(input) {
  * not the `Archive` they know.
  */
 export function escapeInvisible(input) {
-    const escape = (match) => `\\u${match.codePointAt(0).toString(16).padStart(4, '0')}`;
-    return input.replace(INVISIBLE_CHARS, escape).replace(CONTROL_CHARS, escape);
+    return input
+        .replace(INVISIBLE_CHARS, escapeCodePoint)
+        .replace(CONTROL_CHARS, escapeCodePoint);
+}
+/** One character as a Unicode escape, for `escapeInvisible`. */
+function escapeCodePoint(match) {
+    return `\\u${match.codePointAt(0).toString(16).padStart(4, '0')}`;
 }
 /**
  * Normalises text before it reaches the model: Unicode-folded, stripped of the
@@ -414,9 +427,13 @@ export function sanitizeText(input, maxChars = MAX_BODY_CHARS) {
         .replace(/[ \t]+/g, ' ')
         .replace(/\n{3,}/g, '\n\n')
         .trim();
-    return normalized.length > maxChars
+    // `toWellFormed` after the cut, which can split a surrogate pair — and on
+    // the whole string either way, because a lone surrogate can arrive decoded
+    // out of a header. JSON carries one as an escape and a Python client then
+    // fails to encode it; U+FFFD is the honest rendering.
+    return (normalized.length > maxChars
         ? `${normalized.slice(0, maxChars)}\n… (truncated at ${maxChars} characters)`
-        : normalized;
+        : normalized).toWellFormed();
 }
 /**
  * Names of the injection shapes present in `text`.
@@ -490,7 +507,13 @@ export function parseAuthResults(header, trustedAuthservId) {
         const match = new RegExp(`\\b${name}=([a-z]+)`, 'i').exec(topmost);
         return match?.[1]?.toLowerCase() ?? 'unknown';
     };
-    const authservId = /^\s*([A-Za-z0-9._-]+)/.exec(topmost ?? '')?.[1];
+    // Bounded like a hostname, which is what an authserv-id is. Unbounded, the
+    // id went into the metadata block beside the fence — the one part of a
+    // `get_message` answer with its own budget and nothing array-shaped to
+    // shrink — and a header of sixty thousand letters made the whole message
+    // unreadable through this server. The verdict is what matters; an id past
+    // this length is not an id, and the header is reported as forgeable.
+    const authservId = /^\s*([A-Za-z0-9._-]{1,253})(?![A-Za-z0-9._-])/.exec(topmost ?? '')?.[1];
     return {
         spf: read('spf'),
         dkim: read('dkim'),

package/dist/attachments.d.ts

@@ -10,6 +10,7 @@ import type { MessageStructureObject } from 'imapflow';
  * about reading the two declarations side by side says which is which.
  */
 export declare const EXECUTABLE_EXTENSIONS: Set<string>;
+export declare function isMediaType(value: string): boolean;
 export interface AttachmentCandidate {
     partId: string;
     filename: string;

package/dist/attachments.js

@@ -117,6 +117,22 @@ export const EXECUTABLE_EXTENSIONS = new Set([
  * extensions render it as `invoice.pdf`.
  */
 const DOUBLE_EXTENSION_BAIT = /\.(pdf|docx?|xlsx?|pptx?|txt|csv|jpe?g|png|gif|zip|rtf|odt|ods)\.[a-z0-9]{1,5}$/i;
+/**
+ * The shape of a media type — RFC 6838's token characters, bounded on both
+ * sides of the slash.
+ *
+ * The declared type of a part is the sender's string, and it used to travel
+ * as it came: into `content_type`, into the refusal note that quotes it, and
+ * from there into the `get_message` metadata block outside the fence and into
+ * error results the budget never measures. A hundred kilobytes of it in one
+ * `Content-Type` header made the message unreadable. Anything that does not
+ * match here is not a media type, is never on the allowlist, and is reported
+ * as `application/octet-stream` with a note that says so without quoting it.
+ */
+const MEDIA_TYPE = /^[a-z0-9!#$&^_.+-]{1,127}\/[a-z0-9!#$&^_.+-]{1,127}$/;
+export function isMediaType(value) {
+    return MEDIA_TYPE.test(value);
+}
 /**
  * Strips a filename down to something safe to print and to reason about.
  *
@@ -127,11 +143,30 @@ const DOUBLE_EXTENSION_BAIT = /\.(pdf|docx?|xlsx?|pptx?|txt|csv|jpe?g|png|gif|zi
 export function sanitizeFilename(raw) {
     if (raw === undefined || raw.trim() === '')
         return '(unnamed)';
+    // Two orderings matter here, and both were wrong.
+    //
+    // The trim runs *before* the leading dots are taken off, and again after. The
+    // other way round, one space defeated the rule: ` .bashrc` has no dot in
+    // first position when the strip runs, and the trim that followed exposed it,
+    // so the name reached the model looking like a dotfile after all.
+    //
+    // And the strip never takes the dot that carries the extension. It used to:
+    // `.exe` came out as `exe`, `extensionOf` then answered `''`, and an empty
+    // extension makes `checkPolicy` skip the executable check entirely rather
+    // than fail it — so the blocklist was bypassed by naming the attachment
+    // `.exe`. That is the same failure `appref-ms` caused, reached by a different
+    // route. The lookahead keeps the leading dots whenever removing them would
+    // consume the last one; a name that has another dot further along loses them
+    // as before.
     const cleaned = defuseAutoFetch(stripInvisible(raw.normalize('NFKC')))
         .replace(/[/\\]/g, '_')
-        .replace(/^\.+/, '')
+        .trim()
+        .replace(/^\.+(?=.*\.)/, '')
         .trim();
-    if (cleaned === '')
+    // A name of nothing but dots is not a name. It carries no extension either,
+    // so keeping it buys the check above nothing and only puts `...` in front of
+    // a reader.
+    if (cleaned === '' || /^\.+$/.test(cleaned))
         return '(unnamed)';
     return cleaned.length > MAX_FILENAME_LENGTH
         ? `${cleaned.slice(0, MAX_FILENAME_LENGTH)}…`
@@ -178,7 +213,10 @@ function walk(node, depth, found) {
             walk(child, depth + 1, found);
         return;
     }
-    const type = (node.type ?? 'application/octet-stream').toLowerCase();
+    const declaredType = (node.type ?? 'application/octet-stream').toLowerCase();
+    const type = isMediaType(declaredType)
+        ? declaredType
+        : 'application/octet-stream';
     const disposition = node.disposition?.toLowerCase();
     const declaredName = node.dispositionParameters?.filename ?? node.parameters?.name;
     // A part is an attachment when it says so, or when it carries a filename, or
@@ -191,6 +229,9 @@ function walk(node, depth, found) {
         return;
     const filename = sanitizeFilename(declaredName);
     const notes = [];
+    if (type !== declaredType) {
+        notes.push('the declared content type is not a valid media type and is reported as application/octet-stream');
+    }
     if (declaredName !== undefined && DOUBLE_EXTENSION_BAIT.test(declaredName)) {
         notes.push('filename has a double extension — it renders as a document but is not one');
     }
@@ -198,7 +239,13 @@ function walk(node, depth, found) {
         partId: node.part,
         filename,
         contentType: type,
-        size: node.size,
+        // imapflow reads the size with `Number(value) || 0`, so a server that
+        // writes `1e400` hands over Infinity — which JSON renders as null, and
+        // null fails the `size: number` the output schema promises for the whole
+        // listing. A size that is not a safe non-negative integer is unknown.
+        size: Number.isSafeInteger(node.size) && node.size >= 0
+            ? node.size
+            : undefined,
         disposition,
         allowed: true,
         notes,

package/dist/config.d.ts

@@ -31,6 +31,13 @@ export interface ImapConfig {
      * Where attachments may be written. Unset means this server never touches the
      * filesystem — setting it is the opt-in, and it is the only source of the
      * target directory. A caller cannot choose where bytes from a stranger land.
+     *
+     * Stored as the resolved real path of a directory that existed at startup.
+     * The value is printed by `get_server_info` and by every attachment listing,
+     * and `IMAP_DOWNLOAD_DIR` sits a few lines below `IMAP_PASSWORD` in every
+     * compose file — so a value that is not a directory is refused before it can
+     * be printed anywhere, and the refusal describes it by length, never by
+     * content.
      */
     downloadDir: string | undefined;
     maxDownloadBytes: number;

package/dist/config.js

@@ -1,3 +1,6 @@
+import { realpathSync, statSync } from 'node:fs';
+import { isMediaType } from './attachments.js';
+import { MAILBOX_CONTROL_CHARS } from './schema.js';
 export const DEFAULT_ATTACHMENT_TYPES = [
     'application/pdf',
     'application/json',
@@ -36,6 +39,18 @@ const DEFAULT_MAX_EXTRACT_BYTES = 10 * 1024 * 1024;
  */
 const MAX_MAX_EXTRACT_BYTES = 64 * 1024 * 1024;
 const DEFAULT_SEEN_KEYWORD = 'AiSeen';
+/** A hostname is at most 253 characters; an IPv6 literal far fewer. */
+const MAX_HOST_LENGTH = 253;
+/** IMAP allows 255 bytes of mailbox name; the tool parameter says the same. */
+const MAX_MAILBOX_LENGTH = 255;
+/** Matches the `keyword` tool parameter, which is the other place one is typed. */
+const MAX_KEYWORD_LENGTH = 64;
+const MAX_ATTACHMENT_TYPES = 64;
+/**
+ * The rule the `mailbox` tool parameter applies, imported rather than spelled
+ * again: a second copy of a control-character class is how two of them drift.
+ */
+const CONTROL_CHARS = MAILBOX_CONTROL_CHARS;
 /** Shown when the configuration is incomplete — at startup and on every call. */
 export function missingConfigMessage(missing) {
     return (`missing required environment variable(s): ${missing.join(', ')}\n` +
@@ -78,13 +93,20 @@ export function loadConfig(env = process.env) {
     const elicitation = parseElicitation(env.ELICITATION);
     if (host !== undefined)
         assertSafeHost(host, 'IMAP_HOST');
+    // A user name is written into a LOGIN command and into the From header of
+    // every draft. Neither tolerates a line break, and neither is a place for a
+    // value that was meant for the line above it.
+    if (user !== undefined)
+        assertSingleLine(user, 'IMAP_USER');
+    const mailbox = env.IMAP_MAILBOX || 'INBOX';
+    assertMailboxName(mailbox, 'IMAP_MAILBOX');
     const draftsMailbox = env.IMAP_DRAFTS_MAILBOX;
     if (draftsMailbox !== undefined) {
-        assertSingleLine(draftsMailbox, 'IMAP_DRAFTS_MAILBOX');
+        assertMailboxName(draftsMailbox, 'IMAP_DRAFTS_MAILBOX');
     }
     const trustedAuthservId = env.IMAP_TRUSTED_AUTHSERV_ID?.trim() || undefined;
     if (trustedAuthservId !== undefined) {
-        assertSingleLine(trustedAuthservId, 'IMAP_TRUSTED_AUTHSERV_ID');
+        assertSafeHost(trustedAuthservId, 'IMAP_TRUSTED_AUTHSERV_ID');
     }
     const config = {
         imap: {
@@ -94,14 +116,14 @@ export function loadConfig(env = process.env) {
             password,
             tls,
             insecureTls: env.IMAP_INSECURE_TLS === 'true',
-            mailbox: env.IMAP_MAILBOX || 'INBOX',
+            mailbox,
             seenKeyword: parseKeyword(env.IMAP_SEEN_KEYWORD),
             draftsMailbox,
             trustedAuthservId,
             maxMessages: parseCount(env.IMAP_MAX_MESSAGES, DEFAULT_MAX_MESSAGES, 'IMAP_MAX_MESSAGES'),
             maxAttachmentBytes: parseCount(env.IMAP_MAX_ATTACHMENT_BYTES, DEFAULT_MAX_ATTACHMENT_BYTES, 'IMAP_MAX_ATTACHMENT_BYTES'),
             allowedAttachmentTypes: parseTypes(env.IMAP_ATTACHMENT_TYPES),
-            downloadDir: env.IMAP_DOWNLOAD_DIR,
+            downloadDir: parseDownloadDir(env.IMAP_DOWNLOAD_DIR),
             maxDownloadBytes: parseCount(env.IMAP_MAX_DOWNLOAD_BYTES, DEFAULT_MAX_DOWNLOAD_BYTES, 'IMAP_MAX_DOWNLOAD_BYTES'),
             maxExtractBytes: parseCount(env.IMAP_MAX_EXTRACT_BYTES, DEFAULT_MAX_EXTRACT_BYTES, 'IMAP_MAX_EXTRACT_BYTES', MAX_MAX_EXTRACT_BYTES),
         },
@@ -159,10 +181,22 @@ export function parseElicitation(raw) {
         return true;
     if (value === 'false')
         return false;
-    console.error(`imap-mcp: ELICITATION must be "true" or "false" — got "${raw}". ` +
+    // Described, not quoted. The variable is unprefixed and sits in the same
+    // block as IMAP_PASSWORD in every compose file; what lands in it by mistake
+    // is exactly the value that must not be printed into the client's log.
+    console.error(`imap-mcp: ELICITATION must be "true" or "false" — got ${describeValue(raw ?? '')}. ` +
         'Refusing to start rather than guess.');
     process.exit(1);
 }
+/**
+ * A configuration value for an error message: its length and nothing else.
+ *
+ * Every variable this file reads has a neighbour that is a secret, and the
+ * value that fails a shape check is the one most likely to be that neighbour.
+ */
+function describeValue(raw) {
+    return `a ${raw.length}-character value`;
+}
 function parsePort(raw, fallback, name) {
     if (raw === undefined || raw === '')
         return fallback;
@@ -200,19 +234,72 @@ function parseKeyword(raw) {
         return DEFAULT_SEEN_KEYWORD;
     if (raw === '')
         return '';
-    if (!/^[A-Za-z0-9$_.-]+$/.test(raw)) {
-        console.error('imap-mcp: IMAP_SEEN_KEYWORD must consist of letters, digits, $, _, . or -');
+    // Bounded like the `keyword` tool parameter. The value is written into a
+    // tool description and into every `get_server_info` answer, so a length has
+    // to be a length and not whatever was pasted.
+    if (raw.length > MAX_KEYWORD_LENGTH || !/^[A-Za-z0-9$_.-]+$/.test(raw)) {
+        console.error('imap-mcp: IMAP_SEEN_KEYWORD must consist of letters, digits, $, _, . or -, ' +
+            `at most ${MAX_KEYWORD_LENGTH} of them (got ${describeValue(raw)})`);
         process.exit(1);
     }
     return raw;
 }
+/**
+ * The attachment allowlist, one media type per entry.
+ *
+ * Every entry is answered back by `get_server_info` as `allowed_attachment_types`
+ * and compared against what messages declare. An entry that is not shaped like
+ * a media type can never match an attachment, so it is either a typo or a value
+ * meant for another variable — and in both cases the operator should hear
+ * about it at startup rather than read it in a tool result.
+ */
 function parseTypes(raw) {
     if (raw === undefined || raw.trim() === '')
         return DEFAULT_ATTACHMENT_TYPES;
-    return raw
+    const entries = raw
         .split(',')
         .map((t) => t.trim().toLowerCase())
         .filter((t) => t !== '');
+    if (entries.length > MAX_ATTACHMENT_TYPES) {
+        console.error(`imap-mcp: IMAP_ATTACHMENT_TYPES lists ${entries.length} entries; at most ${MAX_ATTACHMENT_TYPES} are accepted`);
+        process.exit(1);
+    }
+    const bad = entries.findIndex((entry) => !isMediaType(entry));
+    if (bad >= 0) {
+        console.error(`imap-mcp: IMAP_ATTACHMENT_TYPES entry ${bad + 1} is not a media type ` +
+            `such as application/pdf (got ${describeValue(entries[bad])})`);
+        process.exit(1);
+    }
+    return entries;
+}
+/**
+ * The download directory, resolved and checked before anything can print it.
+ *
+ * The path is answered by `get_server_info` and by every attachment listing,
+ * so it has to be a path — an existing directory, resolved through symlinks so
+ * that the containment check in `download.ts` compares against the place files
+ * really land. A value that is not a directory ends the process, and the
+ * message says how long it was, not what it said.
+ */
+function parseDownloadDir(raw) {
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    if (trimmed === '')
+        return undefined;
+    let resolved;
+    try {
+        resolved = realpathSync(trimmed);
+        if (!statSync(resolved).isDirectory())
+            throw new Error('not a directory');
+    }
+    catch {
+        console.error('imap-mcp: IMAP_DOWNLOAD_DIR must name an existing directory ' +
+            `(got ${describeValue(trimmed)} that does not resolve to one). ` +
+            'Create it first, or unset the variable to keep this server off the filesystem.');
+        process.exit(1);
+    }
+    return resolved;
 }
 /**
  * Rejects anything that could break out of the line it is written on. IMAP is a
@@ -223,11 +310,13 @@ function assertSafeHost(value, name) {
     // A hostname or IPv4 address — or an IPv6 address, which is the only place
     // a colon is legal. Allowing ":" everywhere would silently accept
     // "imap.example.net:993", which the error message promises to reject.
+    // The length is checked first: nothing below walks a value longer than a
+    // hostname can be.
     const hostname = /^[A-Za-z0-9._-]+$/.test(value);
     const ipv6 = /^\[?[0-9A-Fa-f:.]*:[0-9A-Fa-f:.]*\]?$/.test(value);
-    if (!hostname && !ipv6) {
+    if (value.length > MAX_HOST_LENGTH || (!hostname && !ipv6)) {
         console.error(`imap-mcp: ${name} must be a plain hostname or IP address without ` +
-            'scheme, port, credentials or whitespace');
+            `scheme, port, credentials or whitespace (got ${describeValue(value)})`);
         process.exit(1);
     }
 }
@@ -238,6 +327,22 @@ function assertSingleLine(value, name) {
         process.exit(1);
     }
 }
+/**
+ * The rule the `mailbox` tool parameter enforces, for a name that arrives
+ * through the environment instead: bounded, no control characters, no LIST
+ * wildcards. The value is answered by every listing tool and printed on the
+ * startup line, so it has to look like a folder before it is printed anywhere.
+ */
+function assertMailboxName(value, name) {
+    if (value.length > MAX_MAILBOX_LENGTH ||
+        CONTROL_CHARS.test(value) ||
+        /[%*]/.test(value)) {
+        console.error(`imap-mcp: ${name} must be a mailbox name of at most ${MAX_MAILBOX_LENGTH} ` +
+            'characters without control characters or the wildcards % and * ' +
+            `(got ${describeValue(value)})`);
+        process.exit(1);
+    }
+}
 function isLoopbackHost(hostname) {
     // URL.hostname keeps the brackets around an IPv6 literal, may carry a %zone
     // suffix, and 'localhost.' with its root label is the same name as
@@ -245,11 +350,19 @@ function isLoopbackHost(hostname) {
     // its bare '::1' branch could never match a hostname taken from a URL.
     if (hostname === undefined)
         return false;
-    const host = hostname
+    let host = hostname
         .toLowerCase()
         .replace(/^\[|]$/g, '')
-        .replace(/%.*$/, '')
-        .replace(/\.+$/, '');
+        .replace(/%.*$/, '');
+    // Trailing root labels, walked from the end rather than matched with `\.+$`:
+    // that pattern is tried from every position of a run of dots and consumes
+    // the run each time, which is quadratic. The host is bounded to 253
+    // characters above, so this is a habit rather than a measured risk here —
+    // the same pattern on an unbounded value is the measured one.
+    let end = host.length;
+    while (end > 0 && host[end - 1] === '.')
+        end -= 1;
+    host = host.slice(0, end);
     return (host === 'localhost' ||
         host.endsWith('.localhost') ||
         host.startsWith('127.') ||

package/dist/extract/ooxml.js

@@ -152,7 +152,7 @@ export async function extractZipDocument(kind, bytes, maxChars, toText) {
         // the archive happens to list them.
         const all = Object.keys(entries)
             .filter((name) => /^ppt\/slides\/slide\d+\.xml$/.test(name))
-            .sort((a, b) => slideNumber(a) - slideNumber(b));
+            .toSorted((a, b) => slideNumber(a) - slideNumber(b));
         if (all.length === 0)
             return { ok: false, reason: 'not-a-document' };
         const slides = all.slice(0, MAX_SLIDES);
@@ -213,7 +213,7 @@ function readXlsx(entries, strFromU8, maxChars) {
     const order = sheetOrder(at('xl/workbook.xml'), at('xl/_rels/workbook.xml.rels'));
     const available = Object.keys(entries)
         .filter((name) => /^xl\/worksheets\/[^/]+\.xml$/.test(name))
-        .sort();
+        .toSorted();
     if (available.length === 0)
         return undefined;
     // The rels file is how a tab's name is tied to its file, and `sheet1.xml` is
@@ -590,7 +590,7 @@ function between(source, open, close) {
  */
 function cell(value) {
     const flat = value.replace(/[\t\r\n]+/g, ' ');
-    return flat.length > MAX_CELL_CHARS ? flat.slice(0, MAX_CELL_CHARS) : flat;
+    return (flat.length > MAX_CELL_CHARS ? flat.slice(0, MAX_CELL_CHARS) : flat).toWellFormed();
 }
 /**
  * The five predefined XML entities and bounded numeric references.
@@ -601,27 +601,34 @@ function cell(value) {
  * rather than defended-against attacks.
  */
 function decodeEntities(value) {
-    return value
-        .replace(/&lt;/g, '<')
-        .replace(/&gt;/g, '>')
-        .replace(/&quot;/g, '"')
-        .replace(/&apos;/g, "'")
-        .replace(/&#x([0-9a-fA-F]{1,6});/g, (match, hex) => codePoint(parseInt(hex, 16), match))
-        .replace(/&#(\d{1,7});/g, (match, digits) => codePoint(Number(digits), match))
-        .replace(/&amp;/g, '&');
+    return value.replace(ENTITY, (match, hex, decimal, name) => hex !== undefined
+        ? codePoint(parseInt(hex, 16))
+        : decimal !== undefined
+            ? codePoint(Number(decimal))
+            : (PREDEFINED.get(String(name)) ?? match));
 }
 /**
- * Same rule as `fromCodePoint` in `../analyze.ts`, and deliberately the same
- * answer: a reference nobody can render stays visible rather than becoming a
- * replacement character that reads as content. Duplicated rather than shared
+ * One alternation, one pass — the same shape as `decodeCharacterReferences`
+ * in `../analyze.ts`, and for the same reason: a sequence of `replace` calls
+ * decodes `&#x26;#104;` twice, and a bounded digit run leaves `&#0000000104;`
+ * standing where an XML parser reads an `h`. Duplicated rather than shared
  * because this module is reached from the child, where a relative import of
  * `../analyze.js` does not resolve.
  */
-function codePoint(value, original) {
+const ENTITY = /&(?:#[xX]([0-9a-fA-F]+);|#([0-9]+);|(lt|gt|quot|amp|apos);)/g;
+const PREDEFINED = new Map([
+    ['lt', '<'],
+    ['gt', '>'],
+    ['quot', '"'],
+    ['amp', '&'],
+    ['apos', "'"],
+]);
+/** One character from a numeric reference, U+FFFD where no parser has one. */
+function codePoint(value) {
     if (!Number.isInteger(value) || value < 1 || value > 0x10ffff)
-        return original;
+        return String.fromCodePoint(0xfffd);
     if (value >= 0xd800 && value <= 0xdfff)
-        return original;
+        return String.fromCodePoint(0xfffd);
     return String.fromCodePoint(value);
 }
 //# sourceMappingURL=ooxml.js.map