hypermail-mcp 0.7.13 → 0.7.15

package/dist/cli.js

@@ -13954,21 +13954,79 @@ async function tryKeytarSet(key) {
   }
 }
 
+// src/logger.ts
+var noopLogger = {
+  debug: () => void 0
+};
+var REDACTED = "[redacted]";
+var SENSITIVE_FIELD = /token|secret|password|credential|key|body|content/i;
+function createLogger(opts) {
+  if (!opts.enabled) return noopLogger;
+  const write = opts.write ?? ((line) => process.stderr.write(line));
+  return {
+    debug(component, event, fields = {}) {
+      try {
+        const payload = {
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          pid: process.pid,
+          component,
+          event,
+          ...sanitizeFields(fields)
+        };
+        write(`[hypermail-mcp] debug ${JSON.stringify(payload)}
+`);
+      } catch {
+      }
+    }
+  };
+}
+function sanitizeFields(fields) {
+  const sanitized = {};
+  for (const [key, value] of Object.entries(fields)) {
+    sanitized[key] = sanitizeValue(key, value, 0);
+  }
+  return sanitized;
+}
+function sanitizeValue(key, value, depth) {
+  if (SENSITIVE_FIELD.test(key)) return REDACTED;
+  if (value === null || value === void 0) return value;
+  const valueType = typeof value;
+  if (valueType === "string" || valueType === "number" || valueType === "boolean") {
+    return value;
+  }
+  if (value instanceof Date) return value.toISOString();
+  if (Array.isArray(value)) {
+    if (depth >= 2) return `[array:${value.length}]`;
+    return value.map((item) => sanitizeValue(key, item, depth + 1));
+  }
+  if (valueType === "object") {
+    if (depth >= 2) return "[object]";
+    const out = {};
+    for (const [childKey, childValue] of Object.entries(value)) {
+      out[childKey] = sanitizeValue(childKey, childValue, depth + 1);
+    }
+    return out;
+  }
+  return String(value);
+}
+
 // src/store/account-store.ts
 var FILE_NAME = "accounts.json.enc";
 var LOCK_STALE_MS = 3e4;
 var LOCK_TIMEOUT_MS = 1e4;
 var LOCK_RETRY_MS = 25;
 var AccountStore = class _AccountStore {
-  constructor(filePath, key, data) {
+  constructor(filePath, key, data, logger) {
     this.filePath = filePath;
     this.key = key;
     this.data = data;
+    this.logger = logger;
     this.lockPath = `${filePath}.lock`;
   }
   filePath;
   key;
   data;
+  logger;
   writeLocks = /* @__PURE__ */ new Map();
   lockPath;
   static async open(opts = {}) {
@@ -13987,7 +14045,12 @@ var AccountStore = class _AccountStore {
         throw err;
       }
     }
-    return new _AccountStore(filePath, key, data);
+    const logger = opts.logger ?? noopLogger;
+    logger.debug("account-store", "open", {
+      filePath,
+      accountCount: data.accounts.length
+    });
+    return new _AccountStore(filePath, key, data, logger);
   }
   listAccounts() {
     return this.data.accounts.map((a) => ({ ...a }));
@@ -14011,6 +14074,13 @@ var AccountStore = class _AccountStore {
       else delete next.newEmailCheckpoint;
       if (idx >= 0) data.accounts[idx] = next;
       else data.accounts.push(next);
+      this.logger.debug("account-store", "upsertAccount", {
+        email: norm,
+        existed: idx >= 0,
+        checkpointReceivedAt: mergedCheckpoint?.receivedAt ?? null,
+        deliveredIdCount: mergedCheckpoint?.deliveredIdsAtReceivedAt?.length ?? 0,
+        changed: true
+      });
       return { result: { ...next }, changed: true };
     }));
   }
@@ -14018,10 +14088,25 @@ var AccountStore = class _AccountStore {
     return this.runSerial(email, async () => this.updateLocked((data) => {
       const norm = email.trim().toLowerCase();
       const idx = data.accounts.findIndex((a) => a.email.toLowerCase() === norm);
-      if (idx < 0) return { result: void 0, changed: false };
+      if (idx < 0) {
+        this.logger.debug("account-store", "updateTokens", {
+          email: norm,
+          found: false,
+          changed: false
+        });
+        return { result: void 0, changed: false };
+      }
       const current = data.accounts[idx];
       const next = { ...current, tokens };
       data.accounts[idx] = next;
+      this.logger.debug("account-store", "updateTokens", {
+        email: norm,
+        found: true,
+        fieldCount: Object.keys(tokens).length,
+        storedCheckpointReceivedAt: current.newEmailCheckpoint?.receivedAt ?? null,
+        storedDeliveredIdCount: current.newEmailCheckpoint?.deliveredIdsAtReceivedAt?.length ?? 0,
+        changed: true
+      });
       return { result: { ...next }, changed: true };
     }));
   }
@@ -14029,18 +14114,45 @@ var AccountStore = class _AccountStore {
     return this.runSerial(email, async () => this.updateLocked((data) => {
       const norm = email.trim().toLowerCase();
       const idx = data.accounts.findIndex((a) => a.email.toLowerCase() === norm);
-      if (idx < 0) return { result: void 0, changed: false };
+      if (idx < 0) {
+        this.logger.debug("account-store", "updateNewEmailCheckpoint", {
+          email: norm,
+          found: false,
+          incomingReceivedAt: checkpoint.receivedAt,
+          incomingDeliveredIdCount: checkpoint.deliveredIdsAtReceivedAt?.length ?? 0,
+          changed: false
+        });
+        return { result: void 0, changed: false };
+      }
       const current = data.accounts[idx];
       const mergedCheckpoint = mergeNewEmailCheckpoints(
         current.newEmailCheckpoint,
         checkpoint
       );
-      if (!mergedCheckpoint) return { result: { ...current }, changed: false };
+      if (!mergedCheckpoint) {
+        this.logger.debug("account-store", "updateNewEmailCheckpoint", {
+          email: norm,
+          found: true,
+          incomingReceivedAt: checkpoint.receivedAt,
+          incomingDeliveredIdCount: checkpoint.deliveredIdsAtReceivedAt?.length ?? 0,
+          changed: false
+        });
+        return { result: { ...current }, changed: false };
+      }
       const next = {
         ...current,
         newEmailCheckpoint: mergedCheckpoint
       };
       data.accounts[idx] = next;
+      this.logger.debug("account-store", "updateNewEmailCheckpoint", {
+        email: norm,
+        found: true,
+        currentReceivedAt: current.newEmailCheckpoint?.receivedAt ?? null,
+        incomingReceivedAt: checkpoint.receivedAt,
+        mergedReceivedAt: mergedCheckpoint.receivedAt,
+        mergedDeliveredIdCount: mergedCheckpoint.deliveredIdsAtReceivedAt?.length ?? 0,
+        changed: true
+      });
       return { result: { ...next }, changed: true };
     }));
   }
@@ -14048,7 +14160,17 @@ var AccountStore = class _AccountStore {
     return this.runSerial(email, async () => this.updateLocked((data) => {
       const norm = email.trim().toLowerCase();
       const idx = data.accounts.findIndex((a) => a.email.toLowerCase() === norm);
-      if (idx < 0 || candidates.length === 0) return { result: [], changed: false };
+      if (idx < 0 || candidates.length === 0) {
+        this.logger.debug("account-store", "claimNewEmails", {
+          email: norm,
+          found: idx >= 0,
+          candidateCount: candidates.length,
+          candidateIds: candidates.map((candidate) => candidate.summaryId),
+          claimedCount: 0,
+          changed: false
+        });
+        return { result: [], changed: false };
+      }
       const account = data.accounts[idx];
       let checkpoint = normalizeCheckpoint(account.newEmailCheckpoint);
       const claimed = [];
@@ -14069,12 +14191,36 @@ var AccountStore = class _AccountStore {
           deliveredIdsAtReceivedAt: ids
         });
       }
-      if (claimed.length === 0 || !checkpoint) return { result: claimed, changed: false };
+      if (claimed.length === 0 || !checkpoint) {
+        this.logger.debug("account-store", "claimNewEmails", {
+          email: norm,
+          found: true,
+          candidateCount: candidates.length,
+          candidateIds: candidates.map((candidate) => candidate.summaryId),
+          claimedCount: claimed.length,
+          claimedIds: claimed,
+          checkpointReceivedAt: checkpoint?.receivedAt ?? null,
+          deliveredIdCount: checkpoint?.deliveredIdsAtReceivedAt?.length ?? 0,
+          changed: false
+        });
+        return { result: claimed, changed: false };
+      }
       const next = {
         ...account,
         newEmailCheckpoint: checkpoint
       };
       data.accounts[idx] = next;
+      this.logger.debug("account-store", "claimNewEmails", {
+        email: norm,
+        found: true,
+        candidateCount: candidates.length,
+        candidateIds: candidates.map((candidate) => candidate.summaryId),
+        claimedCount: claimed.length,
+        claimedIds: claimed,
+        checkpointReceivedAt: checkpoint.receivedAt,
+        deliveredIdCount: checkpoint.deliveredIdsAtReceivedAt?.length ?? 0,
+        changed: true
+      });
       return { result: claimed, changed: true };
     }));
   }
@@ -14083,7 +14229,12 @@ var AccountStore = class _AccountStore {
       const norm = email.trim().toLowerCase();
       const before = data.accounts.length;
       data.accounts = data.accounts.filter((a) => a.email.toLowerCase() !== norm);
-      return { result: data.accounts.length !== before, changed: data.accounts.length !== before };
+      const changed = data.accounts.length !== before;
+      this.logger.debug("account-store", "removeAccount", {
+        email: norm,
+        changed
+      });
+      return { result: changed, changed };
     }));
   }
   async runSerial(email, task) {
@@ -14125,6 +14276,10 @@ var AccountStore = class _AccountStore {
   async flush() {
     const buf = encrypt(this.data, this.key);
     await writeAtomic(this.filePath, buf);
+    this.logger.debug("account-store", "flush", {
+      filePath: this.filePath,
+      accountCount: this.data.accounts.length
+    });
   }
   async withFileLock(task) {
     await this.acquireFileLock();
@@ -14132,10 +14287,14 @@ var AccountStore = class _AccountStore {
       return await task();
     } finally {
       await fs2.rm(this.lockPath, { recursive: true, force: true });
+      this.logger.debug("account-store", "lockReleased", {
+        lockPath: this.lockPath
+      });
     }
   }
   async acquireFileLock() {
     const startedAt = Date.now();
+    let loggedWait = false;
     while (true) {
       try {
         await fs2.mkdir(this.lockPath, { mode: 448 });
@@ -14146,11 +14305,25 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
 `,
           { mode: 384 }
         );
+        this.logger.debug("account-store", "lockAcquired", {
+          lockPath: this.lockPath,
+          waitedMs: Date.now() - startedAt
+        });
         return;
       } catch (err) {
         if (err.code !== "EEXIST") throw err;
+        if (!loggedWait) {
+          this.logger.debug("account-store", "lockWait", {
+            lockPath: this.lockPath
+          });
+          loggedWait = true;
+        }
         await this.removeStaleLock();
         if (Date.now() - startedAt > LOCK_TIMEOUT_MS) {
+          this.logger.debug("account-store", "lockTimeout", {
+            lockPath: this.lockPath,
+            waitedMs: Date.now() - startedAt
+          });
           throw new Error(`timed out waiting for account store lock: ${this.lockPath}`);
         }
         await delay(LOCK_RETRY_MS);
@@ -14162,6 +14335,10 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
       const stat = await fs2.stat(this.lockPath);
       if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
         await fs2.rm(this.lockPath, { recursive: true, force: true });
+        this.logger.debug("account-store", "staleLockRemoved", {
+          lockPath: this.lockPath,
+          staleMs: Date.now() - stat.mtimeMs
+        });
       }
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
@@ -14635,8 +14812,8 @@ async function updateDraft(client, account, id, update) {
       payload.attachments = converted.attachments;
     }
   }
-  await client.api(`/me/messages/${encodeURIComponent(id)}`).patch(payload);
-  return { id };
+  const updated = await client.api(`/me/messages/${encodeURIComponent(id)}`).header("Prefer", "return=representation").patch(payload);
+  return { id: updated?.id ?? id };
 }
 async function addAttachmentToDraft(client, account, draftId, name, contentBytes, contentType) {
   const att = await client.api(`/me/messages/${encodeURIComponent(draftId)}/attachments`).post({
@@ -14950,6 +15127,7 @@ var ImapClient = class {
   imap = null;
   transporter = null;
   connecting = null;
+  imapQueue = Promise.resolve();
   /** Get (or create) the ImapFlow instance. */
   async getImap() {
     if (this.imap) return this.imap;
@@ -14987,18 +15165,31 @@ var ImapClient = class {
     });
     return this.transporter;
   }
+  /** Run an IMAP operation serially on this account's shared connection. */
+  async run(fn) {
+    const run = this.imapQueue.catch(() => void 0).then(async () => {
+      const imap = await this.getImap();
+      return fn(imap);
+    });
+    this.imapQueue = run.then(
+      () => void 0,
+      () => void 0
+    );
+    return run;
+  }
   /**
    * Acquire a mailbox lock and run `fn` with the mailbox selected.
    * Releases the lock automatically after `fn` completes.
    */
   async withMailbox(mailbox, fn) {
-    const imap = await this.getImap();
-    const lock = await imap.getMailboxLock(mailbox);
-    try {
-      return await fn(imap);
-    } finally {
-      lock.release();
-    }
+    return this.run(async (imap) => {
+      const lock = await imap.getMailboxLock(mailbox);
+      try {
+        return await fn(imap);
+      } finally {
+        lock.release();
+      }
+    });
   }
   /** Disconnect IMAP and close the SMTP pool. */
   async disconnect() {
@@ -15296,10 +15487,11 @@ async function readAttachment2(clients, account, messageId, attachmentId) {
 }
 async function listFolders2(clients, account, opts) {
   const client = clients.get(account);
-  const imap = await client.getImap();
-  const mailboxes = await imap.list({
-    statusQuery: { messages: true, unseen: true, uidNext: true }
-  });
+  const mailboxes = await client.run(
+    (imap) => imap.list({
+      statusQuery: { messages: true, unseen: true, uidNext: true }
+    })
+  );
   let results = mailboxes.map(mapMailboxToListEntry);
   if (opts.parentFolderId) {
     const parentPath = opts.parentFolderId;
@@ -15438,59 +15630,11 @@ function removeMimePart(source, targetFilename, targetContentType) {
 async function sendEmail(clients, account, msg) {
   const client = clients.get(account);
   const transporter = client.getTransporter();
-  const mailOptions = {
-    from: `${account.displayName ?? ""} <${account.email}>`,
-    to: msg.to.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", "),
-    subject: msg.subject
-  };
-  if (msg.isHtml) {
-    mailOptions.html = msg.body;
-  } else {
-    mailOptions.text = msg.body;
-  }
-  mailOptions.attachDataUrls = true;
-  if (msg.cc && msg.cc.length > 0) {
-    mailOptions.cc = msg.cc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
-  }
-  if (msg.bcc && msg.bcc.length > 0) {
-    mailOptions.bcc = msg.bcc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
-  }
-  if (msg.inReplyTo || msg.forwardMessageId) {
-    const refId = msg.inReplyTo ?? msg.forwardMessageId;
-    if (refId) {
-      try {
-        const { folder: refFolder, uid: refUid } = decodeId(refId);
-        const refMsg = await client.withMailbox(refFolder, async (imap) => {
-          return imap.fetchOne(
-            refUid,
-            { envelope: true, source: true },
-            { uid: true }
-          );
-        });
-        if (refMsg?.envelope) {
-          const env = refMsg.envelope;
-          if (msg.inReplyTo && env.messageId && !msg.forwardMessageId) {
-            mailOptions.inReplyTo = env.messageId;
-            mailOptions.references = env.messageId;
-          }
-        }
-        if (msg.forwardMessageId && refMsg?.source) {
-          const sourceStr = typeof refMsg.source === "string" ? refMsg.source : Buffer.from(refMsg.source).toString("utf-8");
-          const divider = '\n\n<div style="line-height:12px"><br></div>\n\n<div style="border-left:2px solid #ccc; padding-left:8px; margin-left:0; color:#666">\n---------- Forwarded message ---------<br>' + sourceStr + "\n</div>";
-          if (mailOptions.html) {
-            mailOptions.html += divider;
-          } else if (mailOptions.text) {
-            mailOptions.text += "\n\n---------- Forwarded message ---------\n" + sourceStr;
-          }
-        }
-      } catch {
-      }
-    }
-  }
+  const mailOptions = await buildMailOptions(client, account, msg);
   const info = await transporter.sendMail(mailOptions);
   try {
-    const rawMsg = await buildRawMessage(account, msg, info.messageId);
-    await client.withMailbox("Sent", async (imap) => {
+    const rawMsg = await buildRawMessage(client, account, msg, info.messageId);
+    await client.run(async (imap) => {
       await imap.append("Sent", rawMsg, ["\\Seen"]);
     });
   } catch {
@@ -15499,48 +15643,55 @@ async function sendEmail(clients, account, msg) {
 }
 async function saveDraft(clients, account, msg) {
   const client = clients.get(account);
-  const rawMsg = await buildRawMessage(account, msg);
-  return client.withMailbox("Drafts", async (imap) => {
-    const result = await imap.append("Drafts", rawMsg, ["\\Draft"]);
-    return { id: encodeId("Drafts", result.uid) };
-  });
+  const folder = "Drafts";
+  const rawMsg = await buildRawMessage(client, account, msg);
+  try {
+    const result = await client.run((imap) => appendDraft(imap, folder, rawMsg));
+    return { id: encodeId(folder, appendUid(result, folder)) };
+  } catch (err) {
+    throw imapOperationError(`failed to save IMAP draft to ${folder}`, err);
+  }
 }
 async function updateDraft2(clients, account, id, update) {
   const client = clients.get(account);
   const { folder, uid } = decodeId(id);
-  return client.withMailbox(folder, async (imap) => {
-    const existing = await imap.fetchOne(
-      uid,
-      { source: true, envelope: true },
-      { uid: true }
-    );
-    if (!existing?.source) {
-      throw new Error(`draft not found: ${id}`);
-    }
-    const origSubject = existing.envelope ? existing.envelope.subject ?? "" : "";
-    const updatedMsg = {
-      from: `${account.displayName ?? ""} <${account.email}>`,
-      subject: update.subject ?? origSubject,
-      attachDataUrls: true
-    };
-    if (update.body !== void 0) {
-      if (update.isHtml) {
-        updatedMsg.html = update.body;
-      } else {
-        updatedMsg.text = update.body;
+  try {
+    return await client.withMailbox(folder, async (imap) => {
+      const existing = await imap.fetchOne(
+        uid,
+        { source: true, envelope: true },
+        { uid: true }
+      );
+      if (!existing?.source) {
+        throw new Error(`draft not found: ${id}`);
+      }
+      const origSubject = existing.envelope ? existing.envelope.subject ?? "" : "";
+      const updatedMsg = {
+        from: `${account.displayName ?? ""} <${account.email}>`,
+        subject: update.subject ?? origSubject,
+        attachDataUrls: true
+      };
+      if (update.body !== void 0) {
+        if (update.isHtml) {
+          updatedMsg.html = update.body;
+        } else {
+          updatedMsg.text = update.body;
+        }
       }
-    }
-    const raw = await new Promise((resolve, reject) => {
-      const mc = new MailComposer(updatedMsg);
-      mc.compile().build((err, buf) => {
-        if (err) reject(err);
-        else resolve(buf);
+      const raw = await new Promise((resolve, reject) => {
+        const mc = new MailComposer(updatedMsg);
+        mc.compile().build((err, buf) => {
+          if (err) reject(err);
+          else resolve(buf);
+        });
       });
+      const result = await appendDraft(imap, folder, raw.toString("utf-8"));
+      await imap.messageDelete(uid, { uid: true });
+      return { id: encodeId(folder, appendUid(result, folder)) };
     });
-    await imap.messageDelete(uid, { uid: true });
-    const result = await imap.append(folder, raw, ["\\Draft"]);
-    return { id: encodeId(folder, result.uid) };
-  });
+  } catch (err) {
+    throw imapOperationError(`failed to update IMAP draft ${id}`, err);
+  }
 }
 async function moveEmail2(clients, account, id, destinationId) {
   if (isTrashFolderAlias(destinationId)) {
@@ -15556,9 +15707,8 @@ async function moveEmail2(clients, account, id, destinationId) {
 async function trashEmail(clients, account, id) {
   const client = clients.get(account);
   const { folder, uid } = decodeId(id);
-  const imap = await client.getImap();
-  const dest = resolveTrashMailbox(
-    await imap.list()
+  const dest = await client.run(
+    async (imap) => resolveTrashMailbox(await imap.list())
   );
   return client.withMailbox(folder, async (lockedImap) => {
     await lockedImap.messageMove(uid, dest, { uid: true });
@@ -15589,43 +15739,47 @@ async function sendDraft2(clients, account, id) {
 async function addAttachmentToDraft2(clients, account, draftId, name, contentBytes, contentType) {
   const client = clients.get(account);
   const { folder, uid } = decodeId(draftId);
-  return client.withMailbox(folder, async (imap) => {
-    const existing = await imap.fetchOne(
-      uid,
-      { source: true },
-      { uid: true }
-    );
-    if (!existing?.source) {
-      throw new Error(`draft not found: ${draftId}`);
-    }
-    const sourceStr = typeof existing.source === "string" ? existing.source : Buffer.from(existing.source).toString("utf-8");
-    const built = await new Promise((resolve, reject) => {
-      const mc = new MailComposer({
-        raw: sourceStr,
-        attachments: [
-          {
-            filename: name,
-            content: Buffer.from(contentBytes, "base64"),
-            contentType: contentType ?? "application/octet-stream"
-          }
-        ]
-      });
-      mc.compile().build((err, buf) => {
-        if (err) reject(err);
-        else resolve(buf);
+  try {
+    return await client.withMailbox(folder, async (imap) => {
+      const existing = await imap.fetchOne(
+        uid,
+        { source: true },
+        { uid: true }
+      );
+      if (!existing?.source) {
+        throw new Error(`draft not found: ${draftId}`);
+      }
+      const sourceStr = typeof existing.source === "string" ? existing.source : Buffer.from(existing.source).toString("utf-8");
+      const built = await new Promise((resolve, reject) => {
+        const mc = new MailComposer({
+          raw: sourceStr,
+          attachments: [
+            {
+              filename: name,
+              content: Buffer.from(contentBytes, "base64"),
+              contentType: contentType ?? "application/octet-stream"
+            }
+          ]
+        });
+        mc.compile().build((err, buf) => {
+          if (err) reject(err);
+          else resolve(buf);
+        });
       });
+      const result = await appendDraft(imap, folder, built.toString("utf-8"));
+      await imap.messageDelete(uid, { uid: true });
+      return {
+        id: encodeId(folder, appendUid(result, folder)),
+        attachment: {
+          id: randomUUID3(),
+          name,
+          contentType: contentType ?? "application/octet-stream"
+        }
+      };
     });
-    await imap.messageDelete(uid, { uid: true });
-    const result = await imap.append(folder, built, ["\\Draft"]);
-    return {
-      id: encodeId(folder, result.uid),
-      attachment: {
-        id: randomUUID3(),
-        name,
-        contentType: contentType ?? "application/octet-stream"
-      }
-    };
-  });
+  } catch (err) {
+    throw imapOperationError(`failed to add attachment to IMAP draft ${draftId}`, err);
+  }
 }
 async function removeAttachmentFromDraft2(clients, account, draftId, attachmentId) {
   const client = clients.get(account);
@@ -15660,7 +15814,7 @@ async function markRead2(clients, account, id, isRead) {
     }
   });
 }
-async function buildRawMessage(account, msg, messageId) {
+async function buildMailOptions(client, account, msg, messageId) {
   const mailOptions = {
     from: `${account.displayName ?? ""} <${account.email}>`,
     to: msg.to.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", "),
@@ -15679,16 +15833,55 @@ async function buildRawMessage(account, msg, messageId) {
     mailOptions.bcc = msg.bcc.map((a) => a.name ? `"${a.name}" <${a.address}>` : a.address).join(", ");
   }
   if (msg.attachments && msg.attachments.length > 0) {
-    const fileAttachments = msg.attachments.map((att) => ({
+    mailOptions.attachments = msg.attachments.map((att) => ({
       filename: att.name,
       content: Buffer.from(att.contentBytes, "base64"),
       contentType: att.contentType
     }));
-    mailOptions.attachments = fileAttachments;
   }
   if (messageId) {
     mailOptions.messageId = messageId;
   }
+  await applyReferenceMessage(client, mailOptions, msg);
+  return mailOptions;
+}
+async function applyReferenceMessage(client, mailOptions, msg) {
+  if (!msg.inReplyTo && !msg.forwardMessageId) return;
+  const refId = msg.inReplyTo || msg.forwardMessageId;
+  if (!refId) return;
+  try {
+    const { folder: refFolder, uid: refUid } = decodeId(refId);
+    const refMsg = await client.withMailbox(refFolder, async (imap) => {
+      return imap.fetchOne(
+        refUid,
+        { envelope: true, source: true },
+        { uid: true }
+      );
+    });
+    if (refMsg?.envelope) {
+      const env = refMsg.envelope;
+      if (msg.inReplyTo && env.messageId && !msg.forwardMessageId) {
+        mailOptions.inReplyTo = env.messageId;
+        mailOptions.references = env.messageId;
+      }
+    }
+    if (msg.forwardMessageId && refMsg?.source) {
+      const sourceStr = typeof refMsg.source === "string" ? refMsg.source : Buffer.from(refMsg.source).toString("utf-8");
+      const divider = '\n\n<div style="line-height:12px"><br></div>\n\n<div style="border-left:2px solid #ccc; padding-left:8px; margin-left:0; color:#666">\n---------- Forwarded message ---------<br>' + sourceStr + "\n</div>";
+      if (mailOptions.html) {
+        mailOptions.html = `${mailOptions.html}${divider}`;
+      } else if (mailOptions.text) {
+        mailOptions.text = `${mailOptions.text}
+
+---------- Forwarded message ---------
+${sourceStr}`;
+      }
+    }
+  } catch {
+  }
+}
+async function buildRawMessage(client, account, msg, messageId) {
+  const mailOptions = await buildMailOptions(client, account, msg, messageId);
   return new Promise((resolve, reject) => {
     const mc = new MailComposer(mailOptions);
     mc.compile().build((err, buf) => {
@@ -15697,6 +15890,48 @@ async function buildRawMessage(account, msg, messageId) {
     });
   });
 }
+async function appendDraft(imap, folder, rawMsg) {
+  try {
+    return await imap.append(folder, rawMsg, ["\\Draft"]);
+  } catch (err) {
+    if (!isImapCommandFailure(err)) throw err;
+    return imap.append(folder, rawMsg);
+  }
+}
+function appendUid(result, folder) {
+  if (!result || typeof result !== "object") {
+    throw new Error(`IMAP append to ${folder} did not return a UID`);
+  }
+  const uid = Number(result.uid);
+  if (Number.isFinite(uid) && uid > 0) return uid;
+  throw new Error(`IMAP append to ${folder} did not return a UID`);
+}
+function isImapCommandFailure(err) {
+  const e = err;
+  return typeof e.responseStatus === "string" || typeof e.message === "string" && e.message.includes("Command failed");
+}
+function imapOperationError(message, err) {
+  const detail = formatImapError(err);
+  return new Error(`${message}: ${detail}`, { cause: err });
+}
+function formatImapError(err) {
+  const e = err;
+  const parts = [];
+  const message = err instanceof Error ? err.message : String(err);
+  if (message) parts.push(message);
+  for (const key of ["responseStatus", "responseText", "serverResponseCode", "response"]) {
+    const value = e[key];
+    if (value !== void 0 && value !== null) {
+      parts.push(`${key}=${safeErrorValue(value)}`);
+    }
+  }
+  return parts.join("; ");
+}
+function safeErrorValue(value) {
+  const raw = typeof value === "string" ? value : JSON.stringify(value);
+  const text = raw ?? String(value);
+  return text.length > 500 ? `${text.slice(0, 500)}\u2026` : text;
+}
 
 // src/providers/imap/folders.ts
 async function createFolder2(clients, account, input) {
@@ -17013,11 +17248,29 @@ var accountFullOutputSchema = z2.object({
   email: z2.string(),
   provider: providerIdEnum,
   displayName: z2.string().optional(),
-  tokens: z2.record(z2.string(), z2.unknown()),
   addedAt: z2.string(),
   signature: z2.string().optional(),
   style: styleOutputSchema.optional()
 });
+function publicAccount(account) {
+  return {
+    email: account.email,
+    provider: account.provider,
+    displayName: account.displayName,
+    addedAt: account.addedAt,
+    signature: account.signature,
+    style: account.style
+  };
+}
+function publicAccountResult(result) {
+  if (typeof result !== "object" || result === null) {
+    return { result };
+  }
+  const record2 = result;
+  const account = record2.account;
+  if (!account) return record2;
+  return { ...record2, account: publicAccount(account) };
+}
 var emailSummaryOutputSchema = z2.object({
   id: z2.string(),
   subject: z2.string(),
@@ -17043,8 +17296,17 @@ var folderInfoOutputSchema = z2.object({
   totalItemCount: z2.number(),
   unreadItemCount: z2.number()
 });
+var meaningfulHtmlTagRe = /<\/?(?:p|div|br|blockquote|table|thead|tbody|tfoot|tr|td|th|ul|ol|li|a|span|font|b|strong|em|i|u|img|hr|pre|h[1-6])\b/i;
+function isSuspiciousPlainTextHtml(body) {
+  return body.trim() !== "" && /\r\n|\r|\n/.test(body) && !meaningfulHtmlTagRe.test(body);
+}
 function composeBody(input) {
   const { body, format, signature, style, includeSignature } = input;
+  if (format === "html" && isSuspiciousPlainTextHtml(body)) {
+    throw new Error(
+      'format: "html" requires valid HTML for multiline bodies. Use format: "markdown" for plain text with paragraphs, or add HTML tags such as <p> or <br>.'
+    );
+  }
   const htmlBody = format === "markdown" ? markdownToHtml(body) : body;
   const hasSignature = includeSignature && !!signature;
   const hasStyle = !!(style && (style.fontFamily || style.fontSize || style.fontColor));
@@ -17155,7 +17417,8 @@ function registerAccountTools(server, ctx) {
             email: args.email,
             config: args.config
           });
-          return ok(res, res);
+          const data = publicAccountResult(res);
+          return ok(data, data);
         } catch (err) {
           return fail(errMsg(err));
         }
@@ -17200,7 +17463,8 @@ function registerAccountTools(server, ctx) {
             code: args.code,
             state: args.state
           });
-          return ok(res, res);
+          const data = publicAccountResult(res);
+          return ok(data, data);
         } catch (err) {
           return fail(errMsg(err));
         }
@@ -17347,7 +17611,7 @@ var BODY_LIMIT = 2e4;
 var PAGE_SIZE = 100;
 var MISSING_RECEIVED_AT = "1970-01-01T00:00:00.000Z";
 function registerNewEmailTool(server, ctx) {
-  const { store, registry, tools } = ctx;
+  const { store, registry, tools, logger = noopLogger } = ctx;
   if (!shouldRegister("get_new_emails", tools)) return;
   const newEmailOutputSchema = z4.object({
     account: z4.string(),
@@ -17389,20 +17653,46 @@ function registerNewEmailTool(server, ctx) {
     },
     async (args) => {
       const limit = args.limit ?? DEFAULT_LIMIT;
+      logger.debug("get-new-emails", "start", {
+        account: args.account ?? null,
+        limit
+      });
       if (args.account) {
         try {
           const { provider, account } = registry.resolveByEmail(args.account);
-          const result = await collectCandidatesForAccount(store, provider, account);
+          const result = await collectCandidatesForAccount(store, provider, account, logger);
           const selected2 = oldestCandidatesFirst(result.candidates).slice(0, limit);
-          const emails2 = limit === 0 ? [] : await hydrateAndAdvance(store, provider, result.account, selected2);
+          logger.debug("get-new-emails", "selected", {
+            account: result.account.email,
+            candidateCount: result.candidates.length,
+            selectedCount: selected2.length,
+            selectedIds: selected2.map((candidate) => candidate.summary.id),
+            selectedReceivedAt: selected2.map((candidate) => candidate.timestamp),
+            limit
+          });
+          const emails2 = limit === 0 ? [] : await hydrateAndAdvance(store, provider, result.account, selected2, logger);
           const data2 = { count: emails2.length, emails: emails2, errors: [] };
+          logger.debug("get-new-emails", "end", {
+            account: result.account.email,
+            returnedCount: emails2.length,
+            errorCount: 0
+          });
           return ok(data2, data2);
         } catch (err) {
+          logger.debug("get-new-emails", "error", {
+            account: args.account,
+            message: errMsg(err)
+          });
           return fail(errMsg(err));
         }
       }
       const accounts = store.listAccounts();
       if (accounts.length === 0) {
+        logger.debug("get-new-emails", "end", {
+          accountCount: 0,
+          returnedCount: 0,
+          errorCount: 1
+        });
         return fail("no accounts registered. Call add_account first.");
       }
       const errors = [];
@@ -17412,15 +17702,27 @@ function registerNewEmailTool(server, ctx) {
       for (const stored of accounts) {
         try {
           const { provider, account } = registry.resolveByEmail(stored.email);
-          const result = await collectCandidatesForAccount(store, provider, account);
+          const result = await collectCandidatesForAccount(store, provider, account, logger);
           providersByEmail.set(result.account.email, provider);
           accountsByEmail.set(result.account.email, result.account);
           collected.push(...result.candidates);
         } catch (err) {
+          logger.debug("get-new-emails", "accountError", {
+            account: stored.email,
+            message: errMsg(err)
+          });
           errors.push({ account: stored.email, message: errMsg(err) });
         }
       }
       const selected = oldestCandidatesFirst(collected).slice(0, limit);
+      logger.debug("get-new-emails", "selected", {
+        accountCount: accounts.length,
+        candidateCount: collected.length,
+        selectedCount: selected.length,
+        selectedIds: selected.map((candidate) => candidate.summary.id),
+        selectedReceivedAt: selected.map((candidate) => candidate.timestamp),
+        limit
+      });
       const emails = [];
       if (limit > 0) {
         const byAccount = /* @__PURE__ */ new Map();
@@ -17439,24 +17741,39 @@ function registerNewEmailTool(server, ctx) {
                 store,
                 provider,
                 account,
-                accountCandidates
+                accountCandidates,
+                logger
               )
             );
           } catch (err) {
+            logger.debug("get-new-emails", "accountError", {
+              account: email,
+              message: errMsg(err)
+            });
             errors.push({ account: email, message: errMsg(err) });
           }
         }
       }
       const orderedEmails = emails.sort(compareNewEmailOutputOldestFirst);
       const data = { count: orderedEmails.length, emails: orderedEmails, errors };
+      logger.debug("get-new-emails", "end", {
+        accountCount: accounts.length,
+        returnedCount: orderedEmails.length,
+        errorCount: errors.length
+      });
       return ok(data, data);
     }
   );
 }
-async function collectCandidatesForAccount(store, provider, account) {
+async function collectCandidatesForAccount(store, provider, account, logger) {
   const checkpoint = normalizeCheckpoint2(account.newEmailCheckpoint);
   if (!checkpoint) {
-    await initializeCheckpoint(store, provider, account);
+    await initializeCheckpoint(store, provider, account, logger);
+    logger.debug("get-new-emails", "candidatesCollected", {
+      account: account.email,
+      initialized: true,
+      candidateCount: 0
+    });
     return { account, candidates: [] };
   }
   const deliveredAtCheckpoint = new Set(checkpoint.deliveredIdsAtReceivedAt ?? []);
@@ -17486,9 +17803,18 @@ async function collectCandidatesForAccount(store, provider, account) {
     if (sawOlderThanCheckpoint || !hasMore) break;
     skip += items.length;
   }
+  logger.debug("get-new-emails", "candidatesCollected", {
+    account: account.email,
+    initialized: false,
+    checkpointReceivedAt: checkpoint.receivedAt,
+    deliveredIdCount: checkpoint.deliveredIdsAtReceivedAt?.length ?? 0,
+    candidateCount: candidates.length,
+    candidateIds: candidates.map((candidate) => candidate.summary.id),
+    candidateReceivedAt: candidates.map((candidate) => candidate.timestamp)
+  });
   return { account, candidates };
 }
-async function initializeCheckpoint(store, provider, account) {
+async function initializeCheckpoint(store, provider, account, logger) {
   const { items } = await provider.listEmails(account, {
     folder: "inbox",
     limit: PAGE_SIZE
@@ -17500,9 +17826,22 @@ async function initializeCheckpoint(store, provider, account) {
     receivedAt,
     deliveredIdsAtReceivedAt
   });
+  logger.debug("get-new-emails", "checkpointInitialized", {
+    account: account.email,
+    receivedAt,
+    deliveredIdCount: deliveredIdsAtReceivedAt.length
+  });
 }
-async function hydrateAndAdvance(store, provider, account, selected) {
-  if (selected.length === 0) return [];
+async function hydrateAndAdvance(store, provider, account, selected, logger) {
+  if (selected.length === 0) {
+    logger.debug("get-new-emails", "hydrated", {
+      account: account.email,
+      selectedCount: 0,
+      hydratedCount: 0,
+      claimedCount: 0
+    });
+    return [];
+  }
   const hydrated = [];
   for (const candidate of selected) {
     const full = await provider.readEmail(account, candidate.summary.id);
@@ -17517,7 +17856,19 @@ async function hydrateAndAdvance(store, provider, account, selected) {
     receivedAt: candidate.timestamp,
     ids: [candidate.summary.id, fullId]
   }));
+  logger.debug("get-new-emails", "hydrated", {
+    account: account.email,
+    selectedCount: selected.length,
+    hydratedCount: hydrated.length
+  });
   const claimed = new Set(await store.claimNewEmails(account.email, claims));
+  logger.debug("get-new-emails", "claimed", {
+    account: account.email,
+    claimCount: claims.length,
+    claimedCount: claimed.size,
+    claimIds: claims.map((claim) => claim.summaryId),
+    claimedIds: [...claimed]
+  });
   return hydrated.filter(({ candidate }) => claimed.has(candidate.summary.id)).map(({ email }) => email);
 }
 function formatNewEmail(account, msg, summary) {
@@ -17583,7 +17934,7 @@ function compareTimestamp2(a, b) {
 
 // src/tools/browse.ts
 function registerBrowseTools(server, ctx) {
-  const { store, registry, tools } = ctx;
+  const { store, registry, tools, logger } = ctx;
   const emailListOutputSchema = z5.object({
     account: z5.string(),
     count: z5.number(),
@@ -17633,7 +17984,7 @@ function registerBrowseTools(server, ctx) {
       }
     );
   }
-  registerNewEmailTool(server, { store, registry, tools });
+  registerNewEmailTool(server, { store, registry, tools, logger });
   if (shouldRegister("search_emails", tools)) {
     server.registerTool(
       "search_emails",
@@ -18041,7 +18392,7 @@ function registerOrganizeTools(server, ctx) {
 }
 
 // src/tools/compose.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 import { readFileSync } from "fs";
 import { basename, extname } from "path";
 
@@ -18072,42 +18423,106 @@ var MIME_TYPES = {
   ".mp4": "video/mp4"
 };
 
+// src/tools/edit-draft-verify.ts
+var EDIT_DRAFT_VERIFY_DELAYS_MS = [250, 1e3, 2e3];
+function normalizeDraftBody2(body) {
+  return body.replace(/\r\n/g, "\n").trim();
+}
+function bodyEditPersisted(actualBody, expectation) {
+  const actual = normalizeDraftBody2(actualBody);
+  const expected = normalizeDraftBody2(expectation.expectedBody);
+  if (actual === expected) return true;
+  const oldText = normalizeDraftBody2(expectation.oldText);
+  const replacementBody = normalizeDraftBody2(expectation.replacementBody);
+  if (oldText === replacementBody) {
+    return actual.includes(replacementBody);
+  }
+  return actual.includes(replacementBody) && !actual.includes(oldText);
+}
+function delay2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function readDraftWithVerifiedBody(provider, account, id, expectation) {
+  let draft = await provider.readEmail(account, id);
+  for (const delayMs of EDIT_DRAFT_VERIFY_DELAYS_MS) {
+    const body2 = draft.bodyHtml ?? draft.bodyText ?? "";
+    if (bodyEditPersisted(body2, expectation)) return draft;
+    await delay2(delayMs);
+    draft = await provider.readEmail(account, id);
+  }
+  const body = draft.bodyHtml ?? draft.bodyText ?? "";
+  return bodyEditPersisted(body, expectation) ? draft : void 0;
+}
+
+// src/tools/compose-schemas.ts
+import { z as z8 } from "zod";
+var sendEmailSchema = z8.object({
+  account: z8.string().email(),
+  to: z8.array(emailAddrSchema).min(1),
+  cc: z8.array(emailAddrSchema).optional(),
+  bcc: z8.array(emailAddrSchema).optional(),
+  subject: z8.string(),
+  body: z8.string(),
+  format: z8.enum(["html", "markdown"]).describe(
+    "Body format. 'html' sends the body as-is (must be valid HTML); multiline plain text with format='html' is rejected, so use 'markdown' for paragraphs or add tags like <p>/<br>. 'markdown' converts the body from Markdown to HTML for clean rendering on the recipient side."
+  ),
+  include_signature: z8.boolean().describe(
+    "Whether to append the account's saved HTML signature to the email. If true, don't include a signature in the body param to avoid double signature. Returns an error if true but no signature is configured for this account."
+  ),
+  inReplyTo: z8.union([z8.string(), z8.literal(false)]).describe(
+    "Message ID to reply to. When set, sends as a threaded reply which includes the quoted thread history automatically. Set to `false` for a new email (not a reply)."
+  ),
+  replyAll: z8.boolean().default(false).optional().describe(
+    "When true and `inReplyTo` is set, reply to all recipients instead of just the sender."
+  ),
+  forwardMessageId: z8.string().optional().describe(
+    "Message ID to forward. When set, sends as a forward of the specified message, preserving the original content. Mutually exclusive with `inReplyTo`."
+  ),
+  attachments: z8.array(
+    z8.object({
+      filePath: z8.string().min(1).describe("Absolute path to a local file"),
+      name: z8.string().optional().describe("Attachment filename. Defaults to the file's basename.")
+    })
+  ).optional().describe(
+    "File attachments to include. The server reads the files from disk and base64-encodes them automatically."
+  )
+});
+var editDraftSchema = z8.object({
+  account: z8.string().email(),
+  id: z8.string().min(1).describe("Draft message ID to edit"),
+  to: z8.array(emailAddrSchema).optional(),
+  cc: z8.array(emailAddrSchema).optional(),
+  bcc: z8.array(emailAddrSchema).optional(),
+  subject: z8.string().optional(),
+  old_text: z8.string().min(1).optional().describe(
+    "Exact current HTML section to replace in the draft body. Copy this from `draftHtml` or from `read_email` with format='html'. Must match exactly once; unselected content is preserved."
+  ),
+  new_text: z8.string().optional().describe(
+    "Replacement content for `old_text`. The replacement is composed using `format` and `include_signature`, then inserted exactly where `old_text` matched."
+  ),
+  body: z8.string().optional().describe(
+    "Deprecated alias for `new_text`. Body-only full replacement is not supported; provide `old_text` with this field."
+  ),
+  format: z8.enum(["html", "markdown"]).optional().describe(
+    "Replacement format. Only meaningful when `new_text` or deprecated `body` is also provided. 'html' inserts the replacement as-is (must be valid HTML); multiline plain text with format='html' is rejected, so use 'markdown' for paragraphs or add tags like <p>/<br>. 'markdown' converts the replacement from Markdown to HTML."
+  ),
+  include_signature: z8.boolean().optional().describe(
+    "Whether to append the account's saved HTML signature to the replacement section. If true, don't include a signature in `new_text`/`body`. Only meaningful when replacement content is provided. Returns an error if true but no signature is configured for this account."
+  ),
+  new_attachments: z8.array(
+    z8.object({
+      filePath: z8.string().min(1).describe("Absolute path to a local file"),
+      name: z8.string().optional().describe("Attachment filename. Defaults to the file's basename.")
+    })
+  ).optional().describe(
+    "New file attachments to add to the draft. The server reads the files from disk and base64-encodes them automatically."
+  ),
+  remove_attachments: z8.array(z8.string().min(1)).optional().describe("Attachment IDs to remove from the draft. Get attachment IDs from read_email.")
+});
+
 // src/tools/compose.ts
 function registerComposeTools(server, ctx) {
   const { store, registry, tools } = ctx;
-  const sendEmailSchema = z8.object({
-    account: z8.string().email(),
-    to: z8.array(emailAddrSchema).min(1),
-    cc: z8.array(emailAddrSchema).optional(),
-    bcc: z8.array(emailAddrSchema).optional(),
-    subject: z8.string(),
-    body: z8.string(),
-    format: z8.enum(["html", "markdown"]).describe(
-      "Body format. 'html' sends the body as-is (must be valid HTML). 'markdown' converts the body from Markdown to HTML for clean rendering on the recipient side."
-    ),
-    include_signature: z8.boolean().describe(
-      "Whether to append the account's saved HTML signature to the email. If true, don't include a signature in the body param to avoid double signature. Returns an error if true but no signature is configured for this account."
-    ),
-    inReplyTo: z8.union([z8.string(), z8.literal(false)]).describe(
-      "Message ID to reply to. When set, sends as a threaded reply which includes the quoted thread history automatically. Set to `false` for a new email (not a reply)."
-    ),
-    replyAll: z8.boolean().default(false).optional().describe(
-      "When true and `inReplyTo` is set, reply to all recipients instead of just the sender."
-    ),
-    forwardMessageId: z8.string().optional().describe(
-      "Message ID to forward. When set, sends as a forward of the specified message, preserving the original content. Mutually exclusive with `inReplyTo`."
-    ),
-    attachments: z8.array(
-      z8.object({
-        filePath: z8.string().min(1).describe("Absolute path to a local file"),
-        name: z8.string().optional().describe(
-          "Attachment filename. Defaults to the file's basename."
-        )
-      })
-    ).optional().describe(
-      "File attachments to include. The server reads the files from disk and base64-encodes them automatically."
-    )
-  });
   async function handleSendOrDraft(args, action, resultKey, toolName) {
     try {
       const { provider, account } = registry.resolveByEmail(args.account);
@@ -18163,8 +18578,8 @@ function registerComposeTools(server, ctx) {
     }
   }
   const sendEmailOutputSchema = {
-    sent: z8.literal(true),
-    id: z8.string()
+    sent: z9.literal(true),
+    id: z9.string()
   };
   if (shouldRegister("send_email", tools)) {
     server.registerTool(
@@ -18183,9 +18598,9 @@ function registerComposeTools(server, ctx) {
     );
   }
   const draftEmailOutputSchema = {
-    draft: z8.literal(true),
-    id: z8.string(),
-    draftHtml: z8.string().optional()
+    draft: z9.literal(true),
+    id: z9.string(),
+    draftHtml: z9.string().optional()
   };
   if (shouldRegister("draft_email", tools)) {
     server.registerTool(
@@ -18203,46 +18618,10 @@ function registerComposeTools(server, ctx) {
       )
     );
   }
-  const editDraftSchema = z8.object({
-    account: z8.string().email(),
-    id: z8.string().min(1).describe("Draft message ID to edit"),
-    to: z8.array(emailAddrSchema).optional(),
-    cc: z8.array(emailAddrSchema).optional(),
-    bcc: z8.array(emailAddrSchema).optional(),
-    subject: z8.string().optional(),
-    old_text: z8.string().min(1).optional().describe(
-      "Exact current HTML section to replace in the draft body. Copy this from `draftHtml` or from `read_email` with format='html'. Must match exactly once; unselected content is preserved."
-    ),
-    new_text: z8.string().optional().describe(
-      "Replacement content for `old_text`. The replacement is composed using `format` and `include_signature`, then inserted exactly where `old_text` matched."
-    ),
-    body: z8.string().optional().describe(
-      "Deprecated alias for `new_text`. Body-only full replacement is not supported; provide `old_text` with this field."
-    ),
-    format: z8.enum(["html", "markdown"]).optional().describe(
-      "Replacement format. Only meaningful when `new_text` or deprecated `body` is also provided. 'html' inserts the replacement as-is (must be valid HTML). 'markdown' converts the replacement from Markdown to HTML."
-    ),
-    include_signature: z8.boolean().optional().describe(
-      "Whether to append the account's saved HTML signature to the replacement section. If true, don't include a signature in `new_text`/`body`. Only meaningful when replacement content is provided. Returns an error if true but no signature is configured for this account."
-    ),
-    new_attachments: z8.array(
-      z8.object({
-        filePath: z8.string().min(1).describe("Absolute path to a local file"),
-        name: z8.string().optional().describe(
-          "Attachment filename. Defaults to the file's basename."
-        )
-      })
-    ).optional().describe(
-      "New file attachments to add to the draft. The server reads the files from disk and base64-encodes them automatically."
-    ),
-    remove_attachments: z8.array(z8.string().min(1)).optional().describe(
-      "Attachment IDs to remove from the draft. Get attachment IDs from read_email."
-    )
-  });
   const editDraftOutputSchema = {
-    edited: z8.literal(true),
-    id: z8.string(),
-    draftHtml: z8.string().optional()
+    edited: z9.literal(true),
+    id: z9.string(),
+    draftHtml: z9.string().optional()
   };
   if (shouldRegister("edit_draft", tools)) {
     server.registerTool(
@@ -18281,6 +18660,7 @@ function registerComposeTools(server, ctx) {
           }
           let bodyPayload;
           let isHtmlPayload;
+          let bodyExpectation;
           if (replacementText !== void 0) {
             const existing = await provider.readEmail(account, a.id);
             const existingBody = existing.bodyHtml ?? existing.bodyText ?? "";
@@ -18293,6 +18673,11 @@ function registerComposeTools(server, ctx) {
             });
             bodyPayload = applyExactTextEdit(existingBody, a.old_text ?? "", composed.body);
             isHtmlPayload = composed.isHtml;
+            bodyExpectation = {
+              expectedBody: bodyPayload,
+              oldText: a.old_text ?? "",
+              replacementBody: composed.body
+            };
           }
           const hasDraftUpdate = a.to !== void 0 || a.cc !== void 0 || a.bcc !== void 0 || a.subject !== void 0 || bodyPayload !== void 0;
           let currentId = a.id;
@@ -18335,7 +18720,35 @@ function registerComposeTools(server, ctx) {
               removedIds.push(attId);
             }
           }
-          const draft = await provider.readEmail(account, currentId);
+          let draft;
+          if (bodyExpectation) {
+            draft = await readDraftWithVerifiedBody(
+              provider,
+              account,
+              currentId,
+              bodyExpectation
+            );
+            if (!draft && provider.id === "outlook" && bodyPayload !== void 0) {
+              const res = await provider.updateDraft(account, currentId, {
+                body: bodyPayload,
+                isHtml: isHtmlPayload
+              });
+              currentId = res.id;
+              draft = await readDraftWithVerifiedBody(
+                provider,
+                account,
+                currentId,
+                bodyExpectation
+              );
+            }
+            if (!draft) {
+              return fail(
+                "Draft body edit was not observable after saving. Retry edit_draft, or recreate the draft with draft_email before sending."
+              );
+            }
+          } else {
+            draft = await provider.readEmail(account, currentId);
+          }
           const result = {
             edited: true,
             id: currentId,
@@ -18349,8 +18762,8 @@ function registerComposeTools(server, ctx) {
     );
   }
   const sendDraftOutputSchema = {
-    sent: z8.literal(true),
-    id: z8.string()
+    sent: z9.literal(true),
+    id: z9.string()
   };
   if (shouldRegister("send_draft", tools)) {
     server.registerTool(
@@ -18358,8 +18771,8 @@ function registerComposeTools(server, ctx) {
       {
         description: "Send an existing draft email by ID. Use this with draft IDs returned by `draft_email` or `edit_draft`. Disabled in --read-only mode.",
         inputSchema: {
-          account: z8.string().email(),
-          id: z8.string().min(1).describe("Draft message ID to send")
+          account: z9.string().email(),
+          id: z9.string().min(1).describe("Draft message ID to send")
         },
         outputSchema: sendDraftOutputSchema
       },
@@ -18379,9 +18792,9 @@ function registerComposeTools(server, ctx) {
 
 // src/tools/index.ts
 function registerTools(server, opts) {
-  const { store, registry, tools } = opts;
+  const { store, registry, tools, logger } = opts;
   registerAccountTools(server, { store, registry, tools });
-  registerBrowseTools(server, { store, registry, tools });
+  registerBrowseTools(server, { store, registry, tools, logger });
   registerFolderTools(server, { registry, tools });
   registerOrganizeTools(server, { registry, tools });
   registerComposeTools(server, { store, registry, tools });
@@ -18390,7 +18803,7 @@ function registerTools(server, opts) {
 // package.json
 var package_default = {
   name: "hypermail-mcp",
-  version: "0.7.13",
+  version: "0.7.15",
   description: "Unified email MCP server \u2014 operate any inbox (Outlook now, IMAP/Gmail later) by passing an email address.",
   type: "module",
   bin: {
@@ -18400,7 +18813,8 @@ var package_default = {
   files: [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "examples"
   ],
   scripts: {
     build: "tsup",
@@ -18470,6 +18884,7 @@ var ENV_HTTP_PORT = "HYPERMAIL_HTTP_PORT";
 var ENV_HTTP_HOST = "HYPERMAIL_HTTP_HOST";
 var ENV_TOOLS_DISABLED = "HYPERMAIL_TOOLS_DISABLED";
 var ENV_TOOLS_ENABLED = "HYPERMAIL_TOOLS_ENABLED";
+var ENV_DEBUG = "HYPERMAIL_DEBUG";
 var ENV_OUTLOOK_CLIENT_ID = "HYPERMAIL_OUTLOOK_CLIENT_ID";
 var ENV_OUTLOOK_TENANT_ID = "HYPERMAIL_OUTLOOK_TENANT_ID";
 var ENV_GMAIL_CLIENT_ID = "HYPERMAIL_GMAIL_CLIENT_ID";
@@ -18510,6 +18925,15 @@ function parseStringArray(value) {
   if (trimmed === "") return [];
   return trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 }
+function resolveDebugLogging(warnings) {
+  const value = envRaw(ENV_DEBUG);
+  if (value === void 0 || value.trim() === "") return false;
+  const lower = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on", "debug"].includes(lower)) return true;
+  if (["0", "false", "no", "off"].includes(lower)) return false;
+  warnings.push(`Invalid ${ENV_DEBUG}; debug logging disabled.`);
+  return false;
+}
 function validateToolNames(toolNames, envName) {
   if (!toolNames || toolNames.length === 0) return;
   const known = new Set(KNOWN_TOOLS);
@@ -18591,6 +19015,7 @@ function loadConfig(cliOverrides = {}) {
   const tools = resolveToolsConfig();
   const providers = resolveProvidersConfig();
   const dataDir = cliOverrides.dataDir ?? optionalEnvString(ENV_DATA_DIR);
+  const debugLogging = resolveDebugLogging(warnings);
   if (!optionalEnvString(ENV_KEY)) {
     warnings.push(
       `${ENV_KEY} is not set; a local generated key will be used. Set ${ENV_KEY} explicitly for portable hosted deployments.`
@@ -18602,7 +19027,8 @@ function loadConfig(cliOverrides = {}) {
       transport,
       http,
       tools,
-      providers
+      providers,
+      debugLogging
     },
     warnings
   };
@@ -18648,7 +19074,16 @@ function resolveTools(config) {
 // src/server.ts
 async function startServer(opts) {
   const { config } = opts;
-  const store = await AccountStore.open({ dataDir: config.dataDir });
+  const logger = createLogger({ enabled: config.debugLogging });
+  const dataDir = resolveDataDir(config.dataDir);
+  logger.debug("server", "startup", {
+    version: VERSION,
+    transport: config.transport,
+    dataDir,
+    toolsEnabled: config.tools?.enabled ?? null,
+    toolsDisabled: config.tools?.disabled ?? null
+  });
+  const store = await AccountStore.open({ dataDir, logger });
   const registry = buildRegistry({ store, providers: config.providers });
   const tools = resolveTools(config);
   const createServer = () => {
@@ -18656,7 +19091,7 @@ async function startServer(opts) {
       { name: "hypermail-mcp", version: VERSION },
       { capabilities: { tools: {}, logging: {} } }
     );
-    registerTools(s, { store, registry, tools });
+    registerTools(s, { store, registry, tools, logger });
     return s;
   };
   if (config.transport === "http") {
@@ -18847,6 +19282,7 @@ Core environment variables:
   HYPERMAIL_HTTP_HOST
   HYPERMAIL_TOOLS_ENABLED
   HYPERMAIL_TOOLS_DISABLED
+  HYPERMAIL_DEBUG=1|true|yes|on|debug
 
 Provider environment variables:
   HYPERMAIL_OUTLOOK_CLIENT_ID