@yunori/mcp 0.1.0 → 0.1.1

package/dist/api.js

@@ -3,7 +3,7 @@
  * personal API token, so the server's scope check decides what happens; this
  * only makes sure the token goes to one place and that failures read clearly.
  */
-export const VERSION = "0.1.0";
+export const VERSION = "0.1.1";
 export const DEFAULT_BASE_URL = "https://yunori.email";
 const TOKEN_SHAPE = /^tori_pat_[A-Za-z0-9]{32}$/;
 const TIMEOUT_MS = 30_000;

package/dist/mail-text.js

@@ -229,20 +229,30 @@ export function draftBody(parts) {
 }
 // ── Handing mail to a model ─────────────────────────────────────────────────
 /**
- * Characters a person never sees and a model reads anyway: the Tags block
- * (U+E0000–E007F, invisible ASCII), zero-width characters and direction
- * overrides. A sender can hide instructions in these.
+ * Characters a person never sees and a model reads anyway, which a sender can
+ * hide instructions in or split a tag with: the Tags block (invisible ASCII),
+ * zero-width characters, direction overrides, soft hyphens, variation selectors
+ * and the rest of what Unicode calls default-ignorable, and every control
+ * character but tab and newline. `sdk/mcp` carries the same patterns, and the
+ * test holds them equal.
  */
-const INVISIBLE = /[\u{E0000}-\u{E007F}\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]/gu;
-/** A sender can write the closing tag too, so nothing that reads as one survives inside. */
-const FENCE_LOOKALIKE = /<\s*\/?\s*untrusted_mail/gi;
+const INVISIBLE = /(?![\t\n\r])[\p{Default_Ignorable_Code_Point}\p{Cc}]/gu;
+/**
+ * A sender can write the closing tag too, so nothing that reads as one survives
+ * inside: any case, spaced out, backslashed, in wide characters. Matching only as
+ * far as "untrusted" takes in `<untrusted_email>` from `@yunori/agent-mail-mcp`
+ * too, which may be feeding the same model.
+ */
+const FENCE_LOOKALIKE = /[<＜﹤][\s\\/／]*(untrusted)/giu;
+const defuse = (text) => text.replace(INVISIBLE, "").replace(FENCE_LOOKALIKE, "[$1");
 /**
  * Anything strangers had a hand in, wrapped so a model can tell it from what it
  * was asked. This is a signal to the model, not a wall: the wall is the token's
  * scopes, which is why the docs tell people to leave Send unticked.
  */
 export function fenceMail(value) {
-    const json = JSON.stringify(value, null, 2) ?? "null";
-    const safe = json.replace(INVISIBLE, "").replace(FENCE_LOOKALIKE, "[untrusted_mail");
-    return `<untrusted_mail>\n${safe}\n</untrusted_mail>`;
+    // String by string, because once this is JSON a newline in a tag is the two
+    // characters \n and the pattern can't see through it. Then the whole, for keys.
+    const json = JSON.stringify(value, (_key, v) => (typeof v === "string" ? defuse(v) : v), 2) ?? "null";
+    return `<untrusted_mail>\n${defuse(json)}\n</untrusted_mail>`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yunori/mcp",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "MCP server for your Yunori mail: let an AI assistant read your mailboxes, organise them and write drafts, with a token you control.",
   "license": "MIT",
   "author": "FutureForge Studios",