proton-mail-bridge-client 2.0.0 → 2.0.2

package/dist/index.js

@@ -135,13 +135,14 @@ const TOOLS = [
     },
     {
         name: "send_test_email",
-        description: "Send a minimal diagnostic email to confirm Proton Bridge SMTP credentials and connectivity. Use before relying on send_email in a new environment. Prefer get_connection_status for a connectivity check that does not actually send mail. Returns transport debug info and delivery status.",
+        description: "Send a minimal diagnostic email to confirm Proton Bridge SMTP credentials and connectivity. Use before relying on send_email in a new environment. Prefer get_connection_status for a connectivity check that does not actually send mail. Returns transport debug info and delivery status. Requires PROTONMAIL_ALLOW_SEND, and confirmed:true when PROTONMAIL_CONFIRM_DESTRUCTIVE is enabled; subject to PROTONMAIL_RESTRICT_OUTBOUND_TO_SELF like every other send path.",
         annotations: { destructiveHint: true },
         inputSchema: {
             type: "object",
             properties: {
                 to: { type: "string", description: "Recipient email address." },
                 customMessage: { type: "string", description: "Optional custom test body." },
+                confirmed: { type: "boolean", description: "Set to true to confirm this send when PROTONMAIL_CONFIRM_DESTRUCTIVE is enabled." },
             },
             required: ["to"],
         },
@@ -2776,6 +2777,9 @@ export function createServer(config, options = {}) {
     const draftStore = new DraftStoreService(config, logger);
     const backgroundSyncService = new BackgroundSyncService(config, imapService, localIndexService, logger);
     const deliveryQueueService = new DeliveryQueueService(config, smtpService, logger);
+    // Lets a fired scheduled_send close the loop back to its source draft —
+    // see DeliveryQueueService.checkDue()'s draftStore usage.
+    deliveryQueueService.setDraftStore(draftStore);
     const snoozeService = new SnoozeService(config, imapService, logger);
     const templateService = new TemplateService(config, logger);
     if (options.startBackgroundSync) {
@@ -3075,11 +3079,13 @@ export function createServer(config, options = {}) {
                     });
                 }
                 case "send_test_email": {
-                    ensureSendAllowed(config.runtime);
                     const to = requireString(args, "to");
                     if (!isValidEmail(to)) {
                         throw new McpError(ErrorCode.InvalidParams, "to must be a valid email address.");
                     }
+                    ensureDestructiveConfirmed(config.runtime, normalizeBoolean(args.confirmed, false), `Send test email to ${to}`);
+                    ensureSendAllowed(config.runtime);
+                    ensureOutboundRecipientsAllowed(config.runtime, config.smtp.username, [to]);
                     const result = await withAudit(auditService, name, args, async () => smtpService.sendTestEmail(to, optionalString(args, "customMessage")));
                     return createTextResult({
                         messageId: result.messageId,
@@ -3676,24 +3682,41 @@ export function createServer(config, options = {}) {
                             note: "No email was sent.",
                         }, false, [draftSource(draft)]);
                     }
-                    const result = await withAudit(auditService, name, args, async () => smtpService.sendEmail({
-                        to: draft.to,
-                        cc: draft.cc,
-                        bcc: draft.bcc,
-                        subject: draft.subject,
-                        body: draft.body,
-                        isHtml: draft.isHtml,
-                        priority: draft.priority,
-                        replyTo: draft.replyTo,
-                        inReplyTo: draft.inReplyTo,
-                        references: draft.references,
-                        attachments: draft.attachments,
-                        // Draft content is already finalized and reviewed — appending a
-                        // signature invisibly at send time would change what the user
-                        // saw and approved. If a signature is wanted, it belongs in the
-                        // draft body itself.
-                        appendSignature: false,
-                    }));
+                    // Atomic claim: the status/pending-scheduled checks above are read
+                    // then acted on non-atomically, so two concurrent send_draft calls
+                    // (or a scheduled send firing at the same instant) could both pass
+                    // them. claimForSending() re-reads status under the draft store's
+                    // lock and flips "draft" -> "sending" in that same critical
+                    // section — only the call that wins the claim proceeds to SMTP.
+                    await draftStore.claimForSending(draft.id);
+                    let result;
+                    try {
+                        result = await withAudit(auditService, name, args, async () => smtpService.sendEmail({
+                            to: draft.to,
+                            cc: draft.cc,
+                            bcc: draft.bcc,
+                            subject: draft.subject,
+                            body: draft.body,
+                            isHtml: draft.isHtml,
+                            priority: draft.priority,
+                            replyTo: draft.replyTo,
+                            inReplyTo: draft.inReplyTo,
+                            references: draft.references,
+                            attachments: draft.attachments,
+                            // Draft content is already finalized and reviewed — appending a
+                            // signature invisibly at send time would change what the user
+                            // saw and approved. If a signature is wanted, it belongs in the
+                            // draft body itself.
+                            appendSignature: false,
+                        }));
+                    }
+                    catch (error) {
+                        // Mirrors SnoozeService.wake()'s catch handler: revert the claim
+                        // so the draft is retryable instead of stuck in "sending"
+                        // forever because SMTP failed.
+                        await draftStore.revertSending(draft.id);
+                        throw error;
+                    }
                     let sentDraft = await draftStore.markSent(draft.id, {
                         messageId: result.messageId,
                         accepted: result.accepted,
@@ -4002,7 +4025,7 @@ export function createServer(config, options = {}) {
                     return createTextResult(result);
                 }
                 case "bulk_move": {
-                    ensureMailboxWriteAllowed(config.runtime);
+                    ensureEmailActionAllowed(config.runtime, "move");
                     const emailIds = Array.isArray(args.emailIds)
                         ? args.emailIds.map(String) : undefined;
                     const match = args.match && typeof args.match === "object"
@@ -4055,15 +4078,21 @@ export function createServer(config, options = {}) {
                     const folder = optionalString(args, "folder") ?? "INBOX";
                     const max = getBulkMaxBatchSize(args);
                     const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder);
-                    const preview = await imapService.bulkDelete({
-                        emailIds,
-                        match,
-                        folder,
-                        permanent,
-                        dryRun: true,
-                    });
-                    ensureBulkBatchSize(preview.total, max);
+                    // Resolve the match/emailIds set exactly once and reuse it for both
+                    // the preview and the real run — see resolveUidsForBulkOp's
+                    // comment for why re-resolving `match` a second time (the old
+                    // dry-run-then-real-run pattern) could silently exceed maxBatchSize.
+                    const uids = await imapService.resolveUidsForBulkOp(folder, emailIds, match);
+                    ensureBulkBatchSize(uids.length, max);
                     if (normalizeBoolean(args.dryRun, false)) {
+                        const preview = await imapService.bulkDelete({
+                            emailIds,
+                            match,
+                            folder,
+                            permanent,
+                            resolvedUids: uids,
+                            dryRun: true,
+                        });
                         return createTextResult(withBulkNotFound(preview, notFoundEmailIds));
                     }
                     const result = await withAudit(auditService, name, args, () => imapService.bulkDelete({
@@ -4071,6 +4100,7 @@ export function createServer(config, options = {}) {
                         match,
                         folder,
                         permanent,
+                        resolvedUids: uids,
                         dryRun: false,
                     }));
                     return createTextResult(withBulkNotFound(result, notFoundEmailIds));
@@ -4094,12 +4124,17 @@ export function createServer(config, options = {}) {
                     const folder = optionalString(args, "folder") ?? "INBOX";
                     const max = getBulkMaxBatchSize(args);
                     const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder);
-                    const preview = await imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, dryRun: true });
-                    ensureBulkBatchSize(preview.total, max);
+                    // Resolve the match/emailIds set exactly once and reuse it for both
+                    // the preview and the real run — see resolveUidsForBulkOp's
+                    // comment for why re-resolving `match` a second time (the old
+                    // dry-run-then-real-run pattern) could silently exceed maxBatchSize.
+                    const uids = await imapService.resolveUidsForBulkOp(folder, emailIds, match);
+                    ensureBulkBatchSize(uids.length, max);
                     if (normalizeBoolean(args.dryRun, false)) {
+                        const preview = await imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, resolvedUids: uids, dryRun: true });
                         return createTextResult(withBulkNotFound(preview, notFoundEmailIds));
                     }
-                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, dryRun: false }));
+                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateFlags({ emailIds, match, folder, flagsToAdd, flagsToRemove, resolvedUids: uids, dryRun: false }));
                     return createTextResult(withBulkNotFound(result, notFoundEmailIds));
                 }
                 case "bulk_update_labels": {
@@ -4119,12 +4154,17 @@ export function createServer(config, options = {}) {
                     const folder = optionalString(args, "folder") ?? "INBOX";
                     const max = getBulkMaxBatchSize(args);
                     const notFoundEmailIds = getBulkNotFoundEmailIds(emailIds, folder);
-                    const preview = await imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, dryRun: true });
-                    ensureBulkBatchSize(preview.total, max);
+                    // Resolve the match/emailIds set exactly once and reuse it for both
+                    // the preview and the real run — see resolveUidsForBulkOp's
+                    // comment for why re-resolving `match` a second time (the old
+                    // dry-run-then-real-run pattern) could silently exceed maxBatchSize.
+                    const uids = await imapService.resolveUidsForBulkOp(folder, emailIds, match);
+                    ensureBulkBatchSize(uids.length, max);
                     if (normalizeBoolean(args.dryRun, false)) {
+                        const preview = await imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, resolvedUids: uids, dryRun: true });
                         return createTextResult(withBulkNotFound(preview, notFoundEmailIds));
                     }
-                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, dryRun: false }));
+                    const result = await withAudit(auditService, name, args, () => imapService.bulkUpdateLabels({ emailIds, match, folder, labelsToAdd, labelsToRemove, resolvedUids: uids, dryRun: false }));
                     return createTextResult(withBulkNotFound(result, notFoundEmailIds));
                 }
                 case "top_senders": {
@@ -4230,7 +4270,7 @@ export function createServer(config, options = {}) {
                     return createTextResult(await withAudit(auditService, name, args, async () => imapService.starEmail(requireString(args, "emailId"), normalizeBoolean(args.isStarred, true))));
                 case "move_email":
                     {
-                        ensureMailboxWriteAllowed(config.runtime);
+                        ensureEmailActionAllowed(config.runtime, "move");
                         const emailId = requireString(args, "emailId");
                         const targetFolder = requireString(args, "targetFolder");
                         const result = await withAudit(auditService, name, args, async () => {
@@ -4379,6 +4419,9 @@ export function createServer(config, options = {}) {
                         }
                         const action = requireEmailAction(args);
                         ensureEmailActionAllowed(config.runtime, action);
+                        if (action === "delete") {
+                            ensureDestructiveConfirmed(config.runtime, normalizeBoolean(args.confirmed, false), `Permanently delete ${emailIds.length} email(s) (cannot be recovered)`);
+                        }
                         const result = await withAudit(auditService, name, args, async () => applyBatchEmailAction(imapService, [], {
                             emailIds,
                             action,
@@ -4606,7 +4649,7 @@ export function createServer(config, options = {}) {
                         },
                         drafts: {
                             total: drafts.length,
-                            active: drafts.filter((draft) => draft.status === "draft").length,
+                            active: drafts.filter((draft) => draft.status !== "sent").length,
                             remoteSynced: drafts.filter((draft) => draft.remoteSyncState === "synced").length,
                             syncFailed: drafts.filter((draft) => draft.remoteSyncState === "sync_failed").length,
                         },
@@ -4956,6 +4999,9 @@ export function createServer(config, options = {}) {
                         const emailIds = [...new Set(thread.messages
                                 .filter((message) => !unreadOnly || !message.isRead)
                                 .map((message) => message.primaryEmailId))];
+                        if (action === "delete") {
+                            ensureDestructiveConfirmed(config.runtime, normalizeBoolean(args.confirmed, false), `Permanently delete ${emailIds.length} email(s) in thread (cannot be recovered)`);
+                        }
                         const result = await withAudit(auditService, name, args, async () => applyBatchEmailAction(imapService, [], {
                             emailIds,
                             action,