ask-marcel-office-cli 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -2,6 +2,72 @@
 
 All notable changes to `ask-marcel-office-cli` are documented here.
 
+## 2.1.0
+
+### Added
+
+- **`create-forward-draft`** creates an UNSENT forward draft of an existing
+  message. `POST /me/messages/{id}/createForward` mints the draft (`FW:` subject,
+  quoted original) with your comment placed above the quote and the recipients
+  set, in one call (`Mail.ReadWrite`, already on the basic token).
+  `--to-recipients` is required (a forward with no recipient is not actionable);
+  `--cc-recipients` and a `--subject` override are optional. Like the other
+  mail-draft commands, it produces an UNSENT draft only; the CLI can never send.
+  This is the fourth and last write command, closing the "forward to the right
+  owner" gap that `create-reply-draft` (in-thread) could not.
+- **`convert-local-file --include-images`** (a `.zip` only) also extracts every
+  archive entry's embedded images (docx/xlsx/pptx OOXML media parts, pdf page
+  images), so a screenshot pasted inside a zipped document is reachable in one
+  call.
+- **`login` now reports all four cached tokens** (basic, elevated/M365, and the
+  two Teams-chat substrate tokens chatsvcagg / ic3) with each one's time-left and
+  refresh route, so running `login` while already signed in shows the full token
+  picture instead of a bare `{ status: "authenticated" }`. Each token is
+  `{ available, expiresInSeconds?, refresh: "automatic" | "interactive", reason? }`:
+  basic/chatsvcagg/ic3 refresh automatically from the cached refresh token; the
+  elevated token is `interactive` (re-captured only on a browser login).
+- **`login --force`** ignores the cache and re-captures every token via the
+  browser in one pass — the only way to refresh the elevated token while the
+  basic token is still valid. The persistent browser profile is reused, so you
+  are usually not re-prompted for credentials.
+- **`scopes-check` now reports the elevated (M365ChatClient) token** plus the two
+  Teams-chat substrate tokens (`chatsvcagg` / `ic3`), each in an
+  `{ available, expiresInSeconds? }` block, so a fresh process can pre-flight the
+  historical-version download / convert commands instead of discovering a 403
+  mid-run. The two substrate blocks are additive; the existing top-level fields
+  are unchanged.
+- **Machine-readable `errorCode`s on more error paths** — the elevated /
+  substrate fail-fast (`secondary_token_unavailable`) and the client-side
+  unsupported-input rejections (`unsupported_image` / `unsupported_format` /
+  `unsupported_legacy_office` / `unsupported_document`), so an agent branches on
+  a stable code instead of substring-matching the message.
+
+### Fixed
+
+- **`create-forward-draft` and `create-reply-draft` no longer drop the forwarded
+  / quoted body.** They set the comment via Graph's `comment` parameter on the
+  `createForward` / `createReplyAll` POST, which places it above the preserved
+  quote. The previous implementation PATCHed `body` with only the comment, which
+  **replaced** the whole draft body and dropped the entire forwarded original (a
+  forward went out with just the comment, no message). Caught by a live smoke
+  test; the fix is live-verified.
+
+### Changed
+
+- The `parseRecipients` helper shared by the mail-draft write commands moved to
+  `parse-recipients.ts` (one definition, three call sites), with no behaviour
+  change.
+- `scopes-check` `responseShape` corrected: `elevated.expiresInSeconds` is
+  omitted (the key is absent) when no elevated token is cached, not `null`.
+
+### Removed
+
+- The `--body-content-type` flag on **`create-forward-draft` and
+  `create-reply-draft`** is removed. It never affected the quoted body (Graph
+  embeds the comment / reply as text above the quote), so it was a no-op on those
+  two commands. It remains on `create-mail-draft` and `update-mail-draft`, which
+  set the body directly.
+
 ## 2.0.0
 
 Breaking auth simplification, a repo-wide privacy scrub (including a rewrite of

package/README.md

@@ -1,6 +1,6 @@
 # ask-marcel-office-cli
 
-**A Microsoft Graph CLI built for LLMs.** 179 commands across Mail, Calendar, OneDrive, SharePoint, Excel, Teams chats, Planner / To-Do, OneNote, and directory — plus local-file tools (markdown conversion, image extraction) that need no sign-in at all. Sign in once with your Microsoft 365 account — no Azure app registration, no admin consent, no client secrets.
+**A Microsoft Graph CLI built for LLMs.** 180 commands across Mail, Calendar, OneDrive, SharePoint, Excel, Teams chats, Planner / To-Do, OneNote, and directory — plus local-file tools (markdown conversion, image extraction) that need no sign-in at all. Sign in once with your Microsoft 365 account — no Azure app registration, no admin consent, no client secrets.
 
 ```bash
 npm i -g ask-marcel-office-cli
@@ -25,7 +25,7 @@ LLM tool-loops keep hitting the same three walls with Microsoft Graph:
 
 ### Read-only by design
 
-**This is the most important property.** 173 GET endpoints + 3 read-only POST (two searches + free/busy lookup) + 2 POST (create mail draft / create threaded reply draft) + 1 PATCH (update draft) = 179 commands. No `send-mail`, no `create-event`, no `upload-file`, no `delete-anything`. The only write operations are draft creation (a new mail or a threaded reply-all) and update — a hallucinated command can at most create an unsent draft in your Drafts folder. Safe default for autonomous agents, MCP servers, and "let Claude poke around my mailbox" sessions where you can't fully review every tool call.
+**This is the most important property.** 173 GET endpoints + 3 read-only POST (two searches + free/busy lookup) + 3 POST (create mail draft / threaded reply draft / forward draft) + 1 PATCH (update draft) = 180 commands. No `send-mail`, no `create-event`, no `upload-file`, no `delete-anything`. The only write operations are draft creation (a new mail, a threaded reply-all, or a forward) and update — a hallucinated command can at most create an unsent draft in your Drafts folder. Safe default for autonomous agents, MCP servers, and "let Claude poke around my mailbox" sessions where you can't fully review every tool call.
 
 ### One call gets the full email context
 
@@ -56,7 +56,7 @@ Pass `--include-metadata true` on any `*-as-markdown` (or `convert-mail-attachme
 
 ### Extract embedded images from documents
 
-`extract-drive-item-images` (OneDrive / SharePoint), `extract-mail-attachment-images` (Outlook attachments), and `extract-local-file-images` (a file **on disk** — no Graph, no login) pull the embedded images out of a **docx, xlsx, pptx, or pdf**. For Office files it reads the OOXML media parts (png/jpg/gif/bmp/tiff/webp/svg) — including original full-resolution / un-cropped originals and images on hidden slides that the rendered view never shows. SVG rides back as its XML source (which carries the diagram's own text labels); legacy vector (emf/wmf) and audio/video are skipped. For a PDF it walks every page via [unpdf](https://github.com/unjs/unpdf) (a pure-JS, no-native-deps pdf.js build) and re-encodes each painted image as PNG — page-oriented, so it captures images as drawn on each page (it does not reach layer-hidden/unpainted XObjects or the full uncropped original behind a clipped image). Pair with the global `--output-dir <dir>` to write every image to a folder (the directory is auto-created and each `base64` becomes a `savedTo` path); without it the bytes ride back base64-encoded so a vision model can read them directly.
+`extract-drive-item-images` (OneDrive / SharePoint), `extract-mail-attachment-images` (Outlook attachments), and `extract-local-file-images` (a file **on disk** — no Graph, no login) pull the embedded images out of a **docx, xlsx, pptx, or pdf**. For Office files it reads the OOXML media parts (png/jpg/gif/bmp/tiff/webp/svg) — including original full-resolution / un-cropped originals and images on hidden slides that the rendered view never shows. SVG rides back as its XML source (which carries the diagram's own text labels); legacy vector (emf/wmf) and audio/video are skipped. For a PDF it walks every page via [unpdf](https://github.com/unjs/unpdf) (a pure-JS, no-native-deps pdf.js build) and re-encodes each painted image as PNG — page-oriented, so it captures images as drawn on each page (it does not reach layer-hidden/unpainted XObjects or the full uncropped original behind a clipped image). Pair with the global `--output-dir <dir>` to write every image to a folder (the directory is auto-created and each `base64` becomes a `savedTo` path); without it the bytes ride back base64-encoded so a vision model can read them directly. The same OOXML / PDF image extraction runs over every file **inside a `.zip`** when you pass `convert-local-file --include-images true`: each archive entry gains an `images` array, so a screenshot pasted into a zipped document is still reachable in one call.
 
 The CLI follows any SharePoint media-transform redirect internally, so the LLM never has to fetch an external URL.
 
@@ -68,10 +68,11 @@ The CLI follows any SharePoint media-transform redirect internally, so the LLM n
 
 No Azure app, no tenant admin. The CLI captures the same token the Teams web client uses — works for any Microsoft 365 account, personal or enterprise.
 
-**Login flow:** the CLI drives a Playwright-launched Edge/Chrome window through the Teams sign-in, captures the tokens, and caches them at `~/.ask-marcel/token-cache.json` (0600).
+**Login flow:** the CLI drives a Playwright-launched Edge/Chrome window through the Teams sign-in, captures the tokens, and caches them at `~/.ask-marcel/token-cache.json` (0600). Running `login` again (even when already signed in) reports all four cached tokens — basic, elevated (M365), and the two Teams-chat substrate tokens (chatsvcagg / ic3) — each with its time-left and refresh route: basic/chatsvcagg/ic3 refresh automatically from the cached refresh token, while the elevated token is re-captured only on an interactive login. `login --force` ignores the cache and re-captures every token in one browser pass (the persistent profile is reused, so you are usually not re-prompted for credentials) — the only way to refresh the elevated token while the basic one is still valid. `scopes-check` reports the same four tokens without opening a browser.
 
 ```bash
-ask-marcel-office login
+ask-marcel-office login          # sign in, or show all four tokens' status if already signed in
+ask-marcel-office login --force  # re-capture every token, ignoring the cache
 ```
 
 ### Stable error envelope with actionable hints
@@ -176,7 +177,7 @@ The `AuthManager` interface is two async methods that return `Result<T, AuthErro
 
 ## Deep docs
 
-- **[All 179 commands](docs/COMMANDS.md)** — per-category tables with required params + Graph endpoint
+- **[All 180 commands](docs/COMMANDS.md)** — per-category tables with required params + Graph endpoint
 - **[Usage guide](docs/USAGE.md)** — output formats, OData passthrough, `--output-path`, pagination, library API, architecture, configuration, quality gates
 - **[Machine-readable manifest](docs/commands.json)** — JSON for programmatic discovery (LLM tool-loops, IDE plugins, MCP servers); also importable via `import manifest from 'ask-marcel-office-cli/commands.json'`
 - **[QA playbook](docs/QA-PLAYBOOK.md)** — the repeatable full-surface health-check procedure (offline gates, parameter matrix, conversion contracts, live Graph drift probes) used to audit each release