hypermail-mcp 0.7.9 → 0.7.11

package/README.md

@@ -3,6 +3,16 @@
 A **Model Context Protocol** server that lets an agent operate any of the user's
 inboxes through a single, unified tool surface.
 
+> **v0.7.11** — Fixed Outlook reply/forward drafts whose Graph-generated
+> quoted bodies are plain text by escaping them and patching the draft as HTML,
+> so newly composed HTML replies no longer render as raw text.
+>
+> **v0.7.10** — Fixed an account-store race where Gmail/Outlook token
+> refreshes could overwrite `get_new_emails` checkpoints. Checkpoint updates now
+> preserve token data and merge delivered IDs at the same timestamp. `edit_draft`
+> body edits now require exact selected-section replacement (`old_text` +
+> `new_text`) so reply/forward history is preserved instead of overwritten.
+>
 > **v0.7.9** — Replaced server-side email watch/webhook/script delivery with
 > the pull-based `get_new_emails` tool. Agents schedule their own repeated calls
 > and fetch bounded batches of new inbox email.
@@ -245,7 +255,7 @@ account store.
 | `move_email` | `account`, `id`, `destination` | Move to any folder by well-known name (`inbox`, `drafts`, etc.) or custom folder ID. |
 | `send_email` | `account`, `to[]`, `cc?`, `bcc?`, `subject`, `body`, `format`, `include_signature`, `inReplyTo`, `replyAll?`, `forwardMessageId?`, `attachments?` | Send an email. `format` (`"html"` or `"markdown"`) controls body format — Markdown is converted to HTML via `marked`. Appends signature when `include_signature` is true. `inReplyTo` sends as threaded reply; `forwardMessageId` sends as forward. `inReplyTo` is required — set to `false` for new emails. `attachments` is an optional array of `{filePath, name?}` — files are read from disk and encoded automatically. |
 | `draft_email` | `account`, `to[]`, `cc?`, `bcc?`, `subject`, `body`, `format`, `include_signature`, `inReplyTo`, `replyAll?`, `forwardMessageId?`, `attachments?` | Save as draft instead of sending. Same params as `send_email` including `attachments`. Returns the draft message ID and HTML body (`draftHtml`). `inReplyTo` is required — set to `false` for new emails. |
-| `edit_draft` | `account`, `id`, `to?`, `cc?`, `bcc?`, `subject?`, `body?`, `format?`, `include_signature?`, `new_attachments?`, `remove_attachments?` | Edit an existing draft by ID. Only provided fields are updated. `new_attachments` adds files (`{filePath, name?}[]`); `remove_attachments` removes by attachment ID (`string[]`). Returns the updated draft ID, HTML body (`draftHtml`), and attachment metadata. |
+| `edit_draft` | `account`, `id`, `to?`, `cc?`, `bcc?`, `subject?`, `old_text?`, `new_text?`, `body?`, `format?`, `include_signature?`, `new_attachments?`, `remove_attachments?` | Edit an existing draft by ID. Body edits require exact selected-section replacement: copy `old_text` from the current draft HTML (`draftHtml` or `read_email` with `format: "html"`) and provide `new_text`; the match must occur exactly once, and unselected content such as reply/forward history is preserved. Deprecated `body` is only an alias for `new_text` when `old_text` is also provided; body-only full replacement is rejected. `new_attachments` adds files (`{filePath, name?}[]`); `remove_attachments` removes by attachment ID (`string[]`). Returns the updated draft ID, HTML body (`draftHtml`), and attachment metadata. |
 | `send_draft` | `account`, `id` | Send an existing draft email by ID. Use with draft IDs returned by `draft_email` or `edit_draft`. |
 | `list_folders` | `account`, `parentFolderId?` | List available mail folders. Returns top-level folders by default, or children of `parentFolderId`. |
 | `create_folder` | `account`, `displayName`, `parentFolderId?` | Create a new mail folder under root (default) or the given parent. |

package/dist/cli.js

@@ -13965,6 +13965,7 @@ var AccountStore = class _AccountStore {
   filePath;
   key;
   data;
+  writeLocks = /* @__PURE__ */ new Map();
   static async open(opts = {}) {
     const dataDir = resolveDataDir(opts.dataDir);
     await fs2.mkdir(dataDir, { recursive: true, mode: 448 });
@@ -13992,21 +13993,79 @@ var AccountStore = class _AccountStore {
     return rec ? { ...rec } : void 0;
   }
   async upsertAccount(rec) {
-    const norm = rec.email.trim().toLowerCase();
-    const next = { ...rec, email: norm };
-    const idx = this.data.accounts.findIndex((a) => a.email.toLowerCase() === norm);
-    if (idx >= 0) this.data.accounts[idx] = next;
-    else this.data.accounts.push(next);
-    await this.flush();
-    return { ...next };
+    return this.runSerial(rec.email, async () => {
+      const norm = rec.email.trim().toLowerCase();
+      const next = { ...rec, email: norm };
+      const idx = this.data.accounts.findIndex((a) => a.email.toLowerCase() === norm);
+      if (idx >= 0) this.data.accounts[idx] = next;
+      else this.data.accounts.push(next);
+      await this.flush();
+      return { ...next };
+    });
+  }
+  async updateTokens(email, tokens) {
+    return this.runSerial(email, async () => {
+      const norm = email.trim().toLowerCase();
+      const idx = this.data.accounts.findIndex((a) => a.email.toLowerCase() === norm);
+      if (idx < 0) return void 0;
+      const current = this.data.accounts[idx];
+      const next = { ...current, tokens };
+      this.data.accounts[idx] = next;
+      await this.flush();
+      return { ...next };
+    });
+  }
+  async updateNewEmailCheckpoint(email, checkpoint) {
+    return this.runSerial(email, async () => {
+      const norm = email.trim().toLowerCase();
+      const idx = this.data.accounts.findIndex((a) => a.email.toLowerCase() === norm);
+      if (idx < 0) return void 0;
+      const current = this.data.accounts[idx];
+      const currentCheckpoint = current.newEmailCheckpoint;
+      const mergedCheckpoint = currentCheckpoint?.receivedAt === checkpoint.receivedAt ? {
+        receivedAt: checkpoint.receivedAt,
+        deliveredIdsAtReceivedAt: [
+          .../* @__PURE__ */ new Set([
+            ...currentCheckpoint.deliveredIdsAtReceivedAt ?? [],
+            ...checkpoint.deliveredIdsAtReceivedAt ?? []
+          ])
+        ]
+      } : checkpoint;
+      const next = {
+        ...current,
+        newEmailCheckpoint: mergedCheckpoint
+      };
+      this.data.accounts[idx] = next;
+      await this.flush();
+      return { ...next };
+    });
   }
   async removeAccount(email) {
+    return this.runSerial(email, async () => {
+      const norm = email.trim().toLowerCase();
+      const before = this.data.accounts.length;
+      this.data.accounts = this.data.accounts.filter((a) => a.email.toLowerCase() !== norm);
+      if (this.data.accounts.length === before) return false;
+      await this.flush();
+      return true;
+    });
+  }
+  async runSerial(email, task) {
     const norm = email.trim().toLowerCase();
-    const before = this.data.accounts.length;
-    this.data.accounts = this.data.accounts.filter((a) => a.email.toLowerCase() !== norm);
-    if (this.data.accounts.length === before) return false;
-    await this.flush();
-    return true;
+    const previous = this.writeLocks.get(norm) ?? Promise.resolve();
+    const run = previous.catch(() => void 0).then(task);
+    const lock = run.then(
+      () => void 0,
+      () => void 0
+    );
+    this.writeLocks.set(norm, lock);
+    try {
+      return await run;
+    } finally {
+      if (this.writeLocks.get(norm) === lock) {
+        this.writeLocks.delete(norm);
+      }
+    }
   }
   async flush() {
     const buf = encrypt(this.data, this.key);
@@ -14203,10 +14262,10 @@ var OutlookClientFactory = class {
             this.tenantId
           );
           if (nextTokens.msalCache !== tokens.msalCache) {
-            store.upsertAccount({
-              ...fresh,
-              tokens: nextTokens
-            }).catch(() => {
+            store.updateTokens(
+              account.email,
+              nextTokens
+            ).catch(() => {
             });
           }
           return accessToken;
@@ -14300,16 +14359,22 @@ function clampLimit(v, dflt, max) {
 
 // src/providers/outlook/write-ops.ts
 var THREAD_MARKER = "<!-- hypermail-thread-boundary -->";
+function isTextBody(contentType) {
+  return contentType?.toLowerCase() === "text";
+}
+function textToHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/\r\n|\r|\n/g, "<br>");
+}
 async function buildDraftFromReference(client, createEndpoint, createPayload, converted) {
   const draft = await client.api(createEndpoint).post(createPayload);
   const draftMsg = await client.api(`/me/messages/${draft.id}`).select("body").get();
-  const draftBody = draftMsg.body?.content ?? "";
-  const draftContentType = draftMsg.body?.contentType ?? "HTML";
+  const rawDraftBody = draftMsg.body?.content ?? "";
+  const draftBody = isTextBody(draftMsg.body?.contentType) ? textToHtml(rawDraftBody) : rawDraftBody;
   const spacer = '<div style="line-height:12px"><br></div>';
   const prepend = converted.body + spacer + THREAD_MARKER;
   const finalBody = draftBody.includes("<body") ? draftBody.replace(/(<body[^>]*>)/i, `$1${prepend}`) : prepend + draftBody;
   await client.api(`/me/messages/${draft.id}`).patch({
-    body: { contentType: draftContentType, content: finalBody }
+    body: { contentType: "HTML", content: finalBody }
   });
   for (const att of converted.attachments) {
     await client.api(`/me/messages/${draft.id}/attachments`).post(att);
@@ -15826,10 +15891,10 @@ var GmailClientFactory = class {
           expiryDate: updated.expiry_date ?? currentTokens.expiryDate,
           scopes: updated.scope ? updated.scope.split(" ") : currentTokens.scopes
         };
-        await store.upsertAccount({
-          ...fresh,
-          tokens: nextTokens
-        }).catch(() => {
+        await store.updateTokens(
+          account.email,
+          nextTokens
+        ).catch(() => {
         });
       });
       persistLocks.set(key, chain);
@@ -16781,30 +16846,21 @@ function buildStyleAttr(style) {
   if (style.fontColor) parts.push(`color: ${style.fontColor}`);
   return parts.join("; ");
 }
-function findThreadBoundary(html) {
-  const markerIdx = html.indexOf(THREAD_MARKER);
-  if (markerIdx !== -1) {
-    const before = html.slice(0, markerIdx);
-    let answerEnd = before.lastIndexOf(
-      '<div style="line-height:12px"><br></div>'
-    );
-    if (answerEnd === -1) {
-      const re = /<div\s+style=["'][^"']*line-height\s*:\s*12px[^"']*["']\s*>\s*<br\s*\/?>\s*<\/div>/gi;
-      let m;
-      while ((m = re.exec(before)) !== null) answerEnd = m.index;
-    }
-    return { threadStart: markerIdx, answerEnd: Math.max(answerEnd, 0) };
+function applyExactTextEdit(content, oldText, newText) {
+  if (oldText.length === 0) {
+    throw new Error("old_text must not be empty");
   }
-  const spacerRe = /<div\s+style=["'][^"']*line-height\s*:\s*12px[^"']*["']\s*>\s*<br\s*\/?>\s*<\/div>/i;
-  const spacerMatch = spacerRe.exec(html);
-  if (spacerMatch) {
-    return { threadStart: spacerMatch.index, answerEnd: spacerMatch.index };
+  const first = content.indexOf(oldText);
+  if (first === -1) {
+    throw new Error("old_text was not found in the current draft body");
   }
-  for (const re of [/id=["']?Signature["']?/i, /<blockquote/i]) {
-    const idx = html.search(re);
-    if (idx !== -1) return { threadStart: idx, answerEnd: idx };
+  const second = content.indexOf(oldText, first + oldText.length);
+  if (second !== -1) {
+    throw new Error(
+      "old_text matched multiple sections in the current draft body; provide a more specific selection"
+    );
   }
-  return null;
+  return content.slice(0, first) + newText + content.slice(first + oldText.length);
 }
 function shouldRegister(name, tools) {
   if (tools.enabledTools) {
@@ -17222,9 +17278,9 @@ async function initializeCheckpoint(store, provider, account) {
   const first = items[0];
   const receivedAt = first ? effectiveReceivedAt(first.receivedAt) : (/* @__PURE__ */ new Date()).toISOString();
   const deliveredIdsAtReceivedAt = items.filter((item) => effectiveReceivedAt(item.receivedAt) === receivedAt).map((item) => item.id);
-  await store.upsertAccount({
-    ...account,
-    newEmailCheckpoint: { receivedAt, deliveredIdsAtReceivedAt }
+  await store.updateNewEmailCheckpoint(account.email, {
+    receivedAt,
+    deliveredIdsAtReceivedAt
   });
 }
 async function hydrateAndAdvance(store, provider, account, selected) {
@@ -17264,24 +17320,11 @@ async function advanceCheckpoint(store, account, selected) {
   const ordered = oldestCandidatesFirst(selected);
   const newest = ordered[ordered.length - 1];
   if (!newest) return;
-  const previous = normalizeCheckpoint(account.newEmailCheckpoint);
   const newestTimestamp = newest.timestamp;
   const idsAtNewest = ordered.filter((candidate) => candidate.timestamp === newestTimestamp).map((candidate) => candidate.summary.id);
-  let deliveredIdsAtReceivedAt = idsAtNewest;
-  if (previous?.receivedAt === newestTimestamp) {
-    deliveredIdsAtReceivedAt = [
-      .../* @__PURE__ */ new Set([
-        ...previous.deliveredIdsAtReceivedAt ?? [],
-        ...idsAtNewest
-      ])
-    ];
-  }
-  await store.upsertAccount({
-    ...account,
-    newEmailCheckpoint: {
-      receivedAt: newestTimestamp,
-      deliveredIdsAtReceivedAt
-    }
+  await store.updateNewEmailCheckpoint(account.email, {
+    receivedAt: newestTimestamp,
+    deliveredIdsAtReceivedAt: idsAtNewest
   });
 }
 function normalizeCheckpoint(checkpoint) {
@@ -17779,33 +17822,37 @@ function registerOrganizeTools(server, ctx) {
 import { z as z8 } from "zod";
 import { readFileSync } from "fs";
 import { basename, extname } from "path";
+
+// src/tools/mime-types.ts
+var MIME_TYPES = {
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".webp": "image/webp",
+  ".txt": "text/plain",
+  ".html": "text/html",
+  ".css": "text/css",
+  ".csv": "text/csv",
+  ".json": "application/json",
+  ".xml": "application/xml",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".tar": "application/x-tar",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4"
+};
+
+// src/tools/compose.ts
 function registerComposeTools(server, ctx) {
   const { store, registry, tools } = ctx;
-  const MIME_TYPES = {
-    ".pdf": "application/pdf",
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".gif": "image/gif",
-    ".svg": "image/svg+xml",
-    ".webp": "image/webp",
-    ".txt": "text/plain",
-    ".html": "text/html",
-    ".css": "text/css",
-    ".csv": "text/csv",
-    ".json": "application/json",
-    ".xml": "application/xml",
-    ".zip": "application/zip",
-    ".gz": "application/gzip",
-    ".tar": "application/x-tar",
-    ".doc": "application/msword",
-    ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-    ".xls": "application/vnd.ms-excel",
-    ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-    ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-    ".mp3": "audio/mpeg",
-    ".mp4": "video/mp4"
-  };
   const sendEmailSchema = z8.object({
     account: z8.string().email(),
     to: z8.array(emailAddrSchema).min(1),
@@ -17941,12 +17988,20 @@ function registerComposeTools(server, ctx) {
     cc: z8.array(emailAddrSchema).optional(),
     bcc: z8.array(emailAddrSchema).optional(),
     subject: z8.string().optional(),
-    body: z8.string().optional(),
+    old_text: z8.string().min(1).optional().describe(
+      "Exact current HTML section to replace in the draft body. Copy this from `draftHtml` or from `read_email` with format='html'. Must match exactly once; unselected content is preserved."
+    ),
+    new_text: z8.string().optional().describe(
+      "Replacement content for `old_text`. The replacement is composed using `format` and `include_signature`, then inserted exactly where `old_text` matched."
+    ),
+    body: z8.string().optional().describe(
+      "Deprecated alias for `new_text`. Body-only full replacement is not supported; provide `old_text` with this field."
+    ),
     format: z8.enum(["html", "markdown"]).optional().describe(
-      "Body format. Only meaningful when `body` is also provided. 'html' sends the body as-is (must be valid HTML). 'markdown' converts the body from Markdown to HTML for clean rendering on the recipient side."
+      "Replacement format. Only meaningful when `new_text` or deprecated `body` is also provided. 'html' inserts the replacement as-is (must be valid HTML). 'markdown' converts the replacement from Markdown to HTML."
     ),
     include_signature: z8.boolean().optional().describe(
-      "Whether to re-apply the account's saved HTML signature to the body. If true, don't include a signature in the body param. Only meaningful when `body` is also provided. Returns an error if true but no signature is configured for this account."
+      "Whether to append the account's saved HTML signature to the replacement section. If true, don't include a signature in `new_text`/`body`. Only meaningful when replacement content is provided. Returns an error if true but no signature is configured for this account."
     ),
     new_attachments: z8.array(
       z8.object({
@@ -17971,7 +18026,7 @@ function registerComposeTools(server, ctx) {
     server.registerTool(
       "edit_draft",
       {
-        description: "Edit an existing draft email by ID. Only the fields you provide are updated \u2014 unmentioned fields stay unchanged. When `body` is provided and `include_signature` is true, the account's signature is re-applied. Returns the draft ID and the draft's updated HTML body content (`draftHtml`). Before sending, inspect `draftHtml` to verify the draft looks correct. Does not support changing `inReplyTo` or `forwardMessageId` \u2014 those are set at creation time via `draft_email`. Disabled in --read-only mode.",
+        description: "Edit an existing draft email by ID. Only the fields you provide are updated \u2014 unmentioned fields stay unchanged. Body edits work like an exact text edit: provide `old_text` copied from the current draft HTML and `new_text` to replace that exact section. The match must occur exactly once, and all unselected content \u2014 including reply/forward history \u2014 is preserved. Deprecated `body` is accepted only as an alias for `new_text` when `old_text` is also provided. Returns the draft ID and the draft's updated HTML body content (`draftHtml`). Before sending, inspect `draftHtml` to verify the draft looks correct. Does not support changing `inReplyTo` or `forwardMessageId` \u2014 those are set at creation time via `draft_email`. Disabled in --read-only mode.",
         inputSchema: editDraftSchema,
         outputSchema: editDraftOutputSchema
       },
@@ -17979,43 +18034,57 @@ function registerComposeTools(server, ctx) {
         const a = args;
         try {
           const { provider, account } = registry.resolveByEmail(a.account);
-          if (a.include_signature && !account.signature) {
+          const hasNewText = a.new_text !== void 0;
+          const hasBodyAlias = a.body !== void 0;
+          const hasOldText = a.old_text !== void 0;
+          if (hasNewText && hasBodyAlias) {
+            return fail("Provide only one of new_text or deprecated body, not both.");
+          }
+          if (hasBodyAlias && !hasOldText) {
+            return fail(
+              "Body-only full replacement is no longer supported. Provide old_text copied from the current draft HTML and use body as the replacement, or use new_text."
+            );
+          }
+          if (hasNewText && !hasOldText) {
+            return fail("new_text requires old_text so only the selected section is edited.");
+          }
+          if (hasOldText && !hasNewText && !hasBodyAlias) {
+            return fail("old_text requires new_text with the replacement content.");
+          }
+          const replacementText = a.new_text ?? a.body;
+          if (replacementText !== void 0 && a.include_signature && !account.signature) {
             return fail(
               "include_signature is true but no signature is configured for this account. Set up a signature first with set_account_settings."
             );
           }
           let bodyPayload;
           let isHtmlPayload;
-          if (a.body !== void 0) {
+          if (replacementText !== void 0) {
+            const existing = await provider.readEmail(account, a.id);
+            const existingBody = existing.bodyHtml ?? existing.bodyText ?? "";
             const composed = composeBody({
-              body: a.body,
+              body: replacementText,
               format: a.format ?? "html",
               signature: account.signature,
               style: account.style,
               includeSignature: !!a.include_signature
             });
-            bodyPayload = composed.body;
+            bodyPayload = applyExactTextEdit(existingBody, a.old_text ?? "", composed.body);
             isHtmlPayload = composed.isHtml;
           }
-          if (bodyPayload !== void 0) {
-            try {
-              const existing = await provider.readEmail(account, a.id);
-              const existingHtml = existing.bodyHtml ?? "";
-              const boundary = findThreadBoundary(existingHtml);
-              if (boundary !== null) {
-                bodyPayload = bodyPayload + existingHtml.slice(boundary.answerEnd);
-              }
-            } catch {
-            }
+          const hasDraftUpdate = a.to !== void 0 || a.cc !== void 0 || a.bcc !== void 0 || a.subject !== void 0 || bodyPayload !== void 0;
+          let currentId = a.id;
+          if (hasDraftUpdate) {
+            const res = await provider.updateDraft(account, currentId, {
+              to: a.to,
+              cc: a.cc,
+              bcc: a.bcc,
+              subject: a.subject,
+              body: bodyPayload,
+              isHtml: isHtmlPayload
+            });
+            currentId = res.id;
           }
-          const res = await provider.updateDraft(account, a.id, {
-            to: a.to,
-            cc: a.cc,
-            bcc: a.bcc,
-            subject: a.subject,
-            body: bodyPayload,
-            isHtml: isHtmlPayload
-          });
           const newAttachmentIds = [];
           if (a.new_attachments && a.new_attachments.length > 0) {
             for (const att of a.new_attachments) {
@@ -18024,11 +18093,12 @@ function registerComposeTools(server, ctx) {
               const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
               const attRes = await provider.addAttachmentToDraft(
                 account,
-                res.id,
+                currentId,
                 att.name ?? basename(att.filePath),
                 fileData.toString("base64"),
                 contentType
               );
+              currentId = attRes.id;
               newAttachmentIds.push(attRes.attachment.id);
             }
           }
@@ -18037,16 +18107,16 @@ function registerComposeTools(server, ctx) {
             for (const attId of a.remove_attachments) {
               await provider.removeAttachmentFromDraft(
                 account,
-                res.id,
+                currentId,
                 attId
               );
               removedIds.push(attId);
             }
           }
-          const draft = await provider.readEmail(account, res.id);
+          const draft = await provider.readEmail(account, currentId);
           const result = {
             edited: true,
-            id: res.id,
+            id: currentId,
             draftHtml: draft.bodyHtml ?? ""
           };
           return ok(result, result);
@@ -18098,7 +18168,7 @@ function registerTools(server, opts) {
 // package.json
 var package_default = {
   name: "hypermail-mcp",
-  version: "0.7.9",
+  version: "0.7.11",
   description: "Unified email MCP server \u2014 operate any inbox (Outlook now, IMAP/Gmail later) by passing an email address.",
   type: "module",
   bin: {