proton-mail-bridge-client 2.1.1 → 2.1.3

package/dist/index.d.ts

@@ -63,6 +63,10 @@ export declare function redactDraftAttachmentsForListing(draft: DraftRecord): {
     remoteDraft?: import("./types/index.js").RemoteDraftRef;
     lastSendResult?: import("./types/index.js").DraftSendResult;
 };
+export declare function paginateMergedAccountResults<T>(sortedMerged: T[], offset: number, limit: number): {
+    page: T[];
+    hasMore: boolean;
+};
 export declare function getBulkMaxBatchSize(args: Record<string, unknown>): number;
 export declare function ensureBulkBatchSize(uidsLength: number, max: number): void;
 interface BulkExcludedEmailId {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAkB,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAIjB,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAmrDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAmED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AA4KD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAilBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2iIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAkB,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAIjB,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAmrDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAmED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AA4KD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAgWD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKjI;AA8PD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4oIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}

package/dist/index.js

@@ -420,7 +420,7 @@ const TOOLS = [
     },
     {
         name: "update_draft",
-        description: "Update an existing locally saved draft's recipients, subject, body, or other fields. Use to edit a draft before sending. Only provided fields are updated — omitted fields retain their current values. After updating, call send_draft to send or sync_draft_to_remote to push to Proton Drafts.",
+        description: "Update an existing locally saved draft's recipients, subject, body, or other fields. Use to edit a draft before sending. Only provided fields are updated — omitted fields retain their current values. After updating, call send_draft to send or sync_draft_to_remote to push to Proton Drafts. The response's attachments are metadata only (filename/contentType/size, no base64 content) even if the draft has attachments from a previous call — use get_draft if you need the actual attachment bytes back.",
         annotations: { destructiveHint: false },
         inputSchema: {
             type: "object",
@@ -2495,6 +2495,23 @@ function sortByDateDesc(items, dateOf) {
         return rightTime - leftTime;
     });
 }
+// get_emails' multi-account offset/limit pagination math, pulled out for direct
+// testing. Applying `offset` separately to EACH account's own page before merging
+// is wrong — page 2 (offset=25,limit=25) would skip each account's own first 25
+// messages independently, then concatenate their page-2 results, which drops
+// items relative to page 2 of the globally-merged, newest-first timeline (found
+// live with interleaved messages across two accounts: page 2 skipped the
+// second-newest message overall). The caller is expected to have already fetched
+// each account from offset 0 up to (offset + limit) — since every account's own
+// list already arrives newest-first, that's guaranteed to include every item that
+// could rank in the global top (offset + limit) — and passes the sorted,
+// concatenated superset in here to be paginated as one timeline.
+export function paginateMergedAccountResults(sortedMerged, offset, limit) {
+    return {
+        page: sortedMerged.slice(offset, offset + limit),
+        hasMore: sortedMerged.length > offset + limit,
+    };
+}
 function mergeMailboxLabels(perAccountLabels) {
     const merged = new Map();
     for (const labels of perAccountLabels) {
@@ -3170,6 +3187,12 @@ export function createServer(config, options = {}) {
     // string-prefix stripping over the non-primary slugs), so draftId resolution reuses
     // resolveAccountForEmailId itself rather than a second, parallel mechanism.
     const resolveAccountForDraftId = resolveAccountForEmailId;
+    // Same scheme again for delivery-queue ids (cancel_send/list_scheduled_sends) and
+    // snooze ids (cancel_snooze/list_snoozed) — both are per-account services (their own
+    // JSON file under that account's dataDir), so a queued/snoozed item's id needs the
+    // same slug-prefix round-trip as an emailId/draftId to be found again by account.
+    const resolveAccountForQueueId = resolveAccountForEmailId;
+    const resolveAccountForSnoozeId = resolveAccountForEmailId;
     // The slug to prefix a response id with for this bundle — undefined for the
     // primary account, so a primary-account id round-trips with NO prefix at all,
     // exactly as it did before multi-account support existed.
@@ -3429,22 +3452,6 @@ export function createServer(config, options = {}) {
                         }
                         undoWindowSeconds = requested;
                     }
-                    if (undoWindowSeconds > 0) {
-                        // Scope limitation (follow-up round): the undo-send queue is always the
-                        // primary's deliveryQueueService, so a delayed send with a non-primary
-                        // `from` still only gets the header-override-on-primary fallback at fire
-                        // time, not this account's own SMTP connection — unlike the immediate-send
-                        // path above. Fine for now since `from` is still passed through in the
-                        // payload and Proton accepts any verified address on the account.
-                        const sendAt = new Date(Date.now() + undoWindowSeconds * 1000).toISOString();
-                        const queued = await withAudit(auditService, name, args, async () => deliveryQueueService.enqueue(emailPayload, sendAt, "undo_send"));
-                        return createTextResult({
-                            queued: true,
-                            id: queued.id,
-                            sendAt: queued.sendAt,
-                            note: `Not sent yet — will send in ~${undoWindowSeconds}s unless canceled with cancel_send. This server must stay running for the send to fire; if it's restarted before sendAt, the send fires on next startup instead.`,
-                        });
-                    }
                     // A `from` matching a configured additional account routes through that
                     // account's own SMTP connection — required under Bridge's Split Addresses
                     // feature, where each address is its own separate IMAP/SMTP login, not just
@@ -3453,8 +3460,26 @@ export function createServer(config, options = {}) {
                     // the primary connection with `from` passed through as a plain header
                     // override (still valid for a genuine alias only reachable that way).
                     const sendBundle = from ? accountManager.byAddress(from) : undefined;
+                    const effectiveSendBundle = sendBundle ?? primaryBundle;
                     const sendSmtp = sendBundle ? sendBundle.smtpService : smtpService;
                     const sendImap = sendBundle ? sendBundle.imapService : imapService;
+                    if (undoWindowSeconds > 0) {
+                        // The undo-send queue now goes through the resolved account's OWN
+                        // deliveryQueueService (same routing as the immediate-send path above),
+                        // so it fires later via that account's real SMTP connection rather than
+                        // always the primary's — a delayed send with a non-primary `from` used
+                        // to only ever get the header-override-on-primary fallback at fire time.
+                        // The returned id is prefixed with that account's slug (same scheme as
+                        // emailId/draftId) so cancel_send/list_scheduled_sends can find it again.
+                        const sendAt = new Date(Date.now() + undoWindowSeconds * 1000).toISOString();
+                        const queued = await withAudit(auditService, name, args, async () => effectiveSendBundle.deliveryQueueService.enqueue(emailPayload, sendAt, "undo_send"));
+                        return createTextResult({
+                            queued: true,
+                            id: withAccountPrefix(responseSlug(effectiveSendBundle), queued.id),
+                            sendAt: queued.sendAt,
+                            note: `Not sent yet — will send in ~${undoWindowSeconds}s unless canceled with cancel_send. This server must stay running for the send to fire; if it's restarted before sendAt, the send fires on next startup instead.`,
+                        });
+                    }
                     const result = await withAudit(auditService, name, args, async () => sendSmtp.sendEmail(emailPayload));
                     let sentCopyTokenSend = "[sent-copy:unverified]";
                     try {
@@ -3475,13 +3500,31 @@ export function createServer(config, options = {}) {
                     });
                 }
                 case "cancel_send": {
-                    const result = await withAudit(auditService, name, args, async () => deliveryQueueService.cancel(requireString(args, "id")));
-                    return createTextResult(result);
+                    // The queue id carries an account-slug prefix when the item was enqueued
+                    // through a non-primary account (see send_email/schedule_draft) — resolve
+                    // it back to that account's own deliveryQueueService, same as an
+                    // emailId/draftId, instead of always checking the primary's queue.
+                    const { bundle: cancelSendBundle, rest: cancelSendIdRest } = resolveAccountForQueueId(requireString(args, "id"));
+                    const result = await withAudit(auditService, name, args, async () => cancelSendBundle.deliveryQueueService.cancel(cancelSendIdRest));
+                    return createTextResult({ ...result, id: withAccountPrefix(responseSlug(cancelSendBundle), result.id) });
                 }
                 case "list_scheduled_sends": {
                     const statusFilter = optionalString(args, "status");
-                    const all = await withAudit(auditService, name, args, async () => deliveryQueueService.list());
-                    const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                    // Fan out across every configured account's own delivery queue and tag each
+                    // item's id with its owning account's slug — mirrors the read-tool fan-out
+                    // pattern (get_emails etc.). Single-account guard keeps byte-identical output
+                    // for the common case.
+                    if (accountManager.all().length === 1) {
+                        const all = await withAudit(auditService, name, args, async () => deliveryQueueService.list());
+                        const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                        return createTextResult(filtered);
+                    }
+                    const perAccount = await withAudit(auditService, name, args, async () => Promise.all(accountManager.all().map(async (bundle) => ({
+                        bundle,
+                        items: await bundle.deliveryQueueService.list(),
+                    }))));
+                    const tagged = perAccount.flatMap(({ bundle, items }) => items.map((item) => ({ ...item, id: withAccountPrefix(responseSlug(bundle), item.id) })));
+                    const filtered = statusFilter ? tagged.filter((item) => item.status === statusFilter) : tagged;
                     return createTextResult(filtered);
                 }
                 case "get_unsubscribe_info": {
@@ -4119,7 +4162,14 @@ export function createServer(config, options = {}) {
                                 : undefined);
                         return presentDraft(updateDraftBundle, remoteSync ? { ...synced.draft, remoteSync } : synced.draft);
                     });
-                    return createTextResult(result, false, [
+                    // update_draft is typically called repeatedly against the same draft to tweak
+                    // subject/body — the attachments usually aren't touched by this call at all, so
+                    // re-echoing their full base64 `content` (serialized twice by createTextResult,
+                    // same issue redactDraftAttachmentsForListing already fixed for list_drafts)
+                    // burns tokens on every single edit for a draft that has any attachment. The
+                    // caller already knows what it attached; get_draft remains full-content for the
+                    // "let me look at this draft" case, which is a single call rather than a loop.
+                    return createTextResult(redactDraftAttachmentsForListing(result), false, [
                         draftSource(result),
                         ...(result.remoteDraft?.emailId
                             ? [
@@ -4170,7 +4220,7 @@ export function createServer(config, options = {}) {
                     // immediate send is actually what's wanted.
                     const pendingScheduled = (await sendDraftBundle.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
                     if (pendingScheduled) {
-                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${pendingScheduled.id}, sendAt ${pendingScheduled.sendAt}). Sending now would deliver it twice. Cancel that scheduled send with cancel_send first, or wait for it to fire.`);
+                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(sendDraftBundle), pendingScheduled.id)}, sendAt ${pendingScheduled.sendAt}). Sending now would deliver it twice. Cancel that scheduled send with cancel_send first, or wait for it to fire.`);
                     }
                     ensureValidEmails(draft.to, "to");
                     ensureValidEmails(draft.cc, "cc");
@@ -4351,7 +4401,7 @@ export function createServer(config, options = {}) {
                     // in the common non-racing case.
                     const alreadyPendingScheduled = (await scheduleDraftBundle.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
                     if (alreadyPendingScheduled) {
-                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${alreadyPendingScheduled.id}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
+                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(scheduleDraftBundle), alreadyPendingScheduled.id)}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
                     }
                     const sendAt = requireString(args, "sendAt");
                     const sendAtTime = new Date(sendAt).getTime();
@@ -4394,7 +4444,7 @@ export function createServer(config, options = {}) {
                     }, new Date(sendAtTime).toISOString(), "scheduled_send", draft.id));
                     return createTextResult({
                         queued: true,
-                        id: queued.id,
+                        id: withAccountPrefix(responseSlug(scheduleDraftBundle), queued.id),
                         draftId: withAccountPrefix(responseSlug(scheduleDraftBundle), draft.id),
                         sendAt: queued.sendAt,
                         note: "The draft's content was snapshotted now and queued. This server must stay running for the send to fire at sendAt — if restarted first, it fires on next startup instead. The draft record itself is not automatically marked sent; use cancel_send with this id to abort before it fires.",
@@ -4445,26 +4495,36 @@ export function createServer(config, options = {}) {
                             hasMore: result.emails.length === effectiveLimit,
                         }, false, result.emails.map(emailSource));
                     }
-                    // Merge strategy: live-fetch each account's own folder page (LIVE IMAP,
-                    // one call per account), tag ids with the account slug, concatenate,
-                    // re-sort newest-first, then re-apply the original limit across the
-                    // merged set (not per account) and sum totals across accounts.
+                    // Merge strategy: an `offset` applied separately to each account's own page
+                    // BEFORE merging is wrong — e.g. offset=25,limit=25 (page 2) would skip each
+                    // account's own first 25 messages independently, then concatenate their
+                    // page-2 results, which is not the same as page 2 of the globally-merged,
+                    // newest-first timeline (found live with interleaved messages across two
+                    // accounts: page 2 skipped the second-newest message overall). Fixed by
+                    // always fetching from offset 0 up to (requestedOffset + limit) from EVERY
+                    // account — enough that each account's true contribution to the global top
+                    // (requestedOffset + limit) is fully captured, since getEmails already
+                    // returns newest-first — then merging, re-sorting, and applying the
+                    // requested offset/limit to that merged superset instead of per account.
                     const primarySlug = accountManager.primary().account.slug;
+                    const requestedOffset = getEmailsInput.offset ?? 0;
+                    const perAccountFetchLimit = requestedOffset + effectiveLimit;
                     const perAccount = await Promise.all(accountManager.all().map(async (bundle) => {
-                        const result = await bundle.imapService.getEmails(getEmailsInput);
+                        const result = await bundle.imapService.getEmails({ ...getEmailsInput, offset: 0, limit: perAccountFetchLimit });
                         return { bundle, result };
                     }));
                     const taggedEmails = perAccount.flatMap(({ bundle, result }) => result.emails.map((email) => ({ ...email, id: withAccountPrefix(accountSlugForTag(bundle, primarySlug), email.id) })));
-                    const merged = sortByDateDesc(taggedEmails, (email) => email.internalDate || email.date).slice(0, effectiveLimit);
+                    const mergedAll = sortByDateDesc(taggedEmails, (email) => email.internalDate || email.date);
+                    const { page: merged, hasMore } = paginateMergedAccountResults(mergedAll, requestedOffset, effectiveLimit);
                     const total = perAccount.reduce((sum, { result }) => sum + result.total, 0);
                     return createTextResult({
                         folder: getEmailsInput.folder?.trim() || "INBOX",
                         total,
                         limit: effectiveLimit,
-                        offset: getEmailsInput.offset ?? 0,
+                        offset: requestedOffset,
                         emails: projectFields(merged, parseFieldsArg(args.fields)),
                         returned: merged.length,
-                        hasMore: merged.length === effectiveLimit,
+                        hasMore,
                         byAccount: perAccount.map(({ bundle, result }) => ({ slug: bundle.account.slug, total: result.total })),
                     }, false, merged.map(emailSource));
                 }
@@ -5215,10 +5275,15 @@ export function createServer(config, options = {}) {
                     if (wakeAtTime <= Date.now()) {
                         throw new McpError(ErrorCode.InvalidParams, "wakeAt must be in the future.");
                     }
-                    const snoozed = await withAudit(auditService, name, args, async () => snoozeService.snooze(requireString(args, "emailId"), new Date(wakeAtTime).toISOString()));
+                    // emailId carries the same "<slug>::" prefix as everywhere else — resolve it
+                    // to that account's own snoozeService instead of always the primary's, and
+                    // prefix the returned ids (the snooze's own id, and the email id) the same
+                    // way so cancel_snooze/list_snoozed can find them again by account.
+                    const { bundle: snoozeBundle, rest: snoozeEmailIdRest } = resolveAccountForSnoozeId(requireString(args, "emailId"));
+                    const snoozed = await withAudit(auditService, name, args, async () => snoozeBundle.snoozeService.snooze(snoozeEmailIdRest, new Date(wakeAtTime).toISOString()));
                     return createTextResult({
-                        id: snoozed.id,
-                        emailId: snoozed.currentEmailId,
+                        id: withAccountPrefix(responseSlug(snoozeBundle), snoozed.id),
+                        emailId: withAccountPrefix(responseSlug(snoozeBundle), snoozed.currentEmailId),
                         wakeAt: snoozed.wakeAt,
                         note: "This server must stay running for the wake to fire at wakeAt — if restarted first, it wakes on next startup instead. Cancelable via cancel_snooze.",
                     });
@@ -5227,13 +5292,34 @@ export function createServer(config, options = {}) {
                     // cancel moves the mailbox back to its original folder, same as
                     // snooze_email's own move — gate it the same way.
                     ensureEmailActionAllowed(config.runtime, "archive");
-                    const result = await withAudit(auditService, name, args, async () => snoozeService.cancel(requireString(args, "id")));
-                    return createTextResult(result);
+                    const { bundle: cancelSnoozeBundle, rest: cancelSnoozeIdRest } = resolveAccountForSnoozeId(requireString(args, "id"));
+                    const result = await withAudit(auditService, name, args, async () => cancelSnoozeBundle.snoozeService.cancel(cancelSnoozeIdRest));
+                    return createTextResult({
+                        ...result,
+                        id: withAccountPrefix(responseSlug(cancelSnoozeBundle), result.id),
+                        currentEmailId: withAccountPrefix(responseSlug(cancelSnoozeBundle), result.currentEmailId),
+                    });
                 }
                 case "list_snoozed": {
                     const statusFilter = optionalString(args, "status");
-                    const all = await withAudit(auditService, name, args, async () => snoozeService.list());
-                    const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                    // Same fan-out pattern as list_scheduled_sends — each account has its own
+                    // independent snoozeService/JSON file. Single-account guard keeps
+                    // byte-identical output for the common case.
+                    if (accountManager.all().length === 1) {
+                        const all = await withAudit(auditService, name, args, async () => snoozeService.list());
+                        const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                        return createTextResult(filtered);
+                    }
+                    const perAccount = await withAudit(auditService, name, args, async () => Promise.all(accountManager.all().map(async (bundle) => ({
+                        bundle,
+                        items: await bundle.snoozeService.list(),
+                    }))));
+                    const tagged = perAccount.flatMap(({ bundle, items }) => items.map((item) => ({
+                        ...item,
+                        id: withAccountPrefix(responseSlug(bundle), item.id),
+                        currentEmailId: withAccountPrefix(responseSlug(bundle), item.currentEmailId),
+                    })));
+                    const filtered = statusFilter ? tagged.filter((item) => item.status === statusFilter) : tagged;
                     return createTextResult(filtered);
                 }
                 case "create_template": {
@@ -6215,24 +6301,32 @@ export function createServer(config, options = {}) {
                     }
                 case "create_thread_reply_draft":
                     {
-                        await maybeRefreshLocalIndex(imapService, localIndexService, {
+                        // A threadId is only ever valid within the single account it was produced
+                        // by — same "<slug>::" resolution as get_thread_by_id/move_thread. This was
+                        // previously always reading via the PRIMARY account's localIndexService/
+                        // imapService regardless of the threadId's own prefix, so a reply drafted
+                        // against a non-primary account's thread either resolved the wrong thread
+                        // (if the primary happened to have a same-shaped local id) or threw not
+                        // found. Every read below now goes through the resolved threadBundle.
+                        const { bundle: threadReplyBundle, rest: threadReplyIdRest } = resolveAccountForEmailId(requireString(args, "threadId"));
+                        await maybeRefreshLocalIndex(threadReplyBundle.imapService, threadReplyBundle.localIndexService, {
                             force: normalizeBoolean(args.syncBefore, false),
                             folder: "INBOX",
                             limitPerFolder: 100,
                         });
-                        const thread = await localIndexService.getThreadById(requireString(args, "threadId"));
-                        const targetMessage = pickReplyTargetFromThread(thread, config.smtp.username, normalizeBoolean(args.preferLatestInbound, true));
+                        const thread = await threadReplyBundle.localIndexService.getThreadById(threadReplyIdRest);
+                        const targetMessage = pickReplyTargetFromThread(thread, threadReplyBundle.config.smtp.username, normalizeBoolean(args.preferLatestInbound, true));
                         if (!targetMessage?.primaryEmailId) {
                             throw new McpError(ErrorCode.InvalidParams, "Unable to resolve a reply target from the thread.");
                         }
-                        const detail = await imapService.getEmailById(targetMessage.primaryEmailId);
+                        const detail = await threadReplyBundle.imapService.getEmailById(targetMessage.primaryEmailId);
                         const body = requireString(args, "body");
                         const isHtml = normalizeBoolean(args.isHtml, false);
                         const replyAll = normalizeBoolean(args.replyAll, false);
                         const attachments = optionalAttachmentList(args.attachments);
                         const extraCc = parseEmails(optionalString(args, "cc"));
                         const extraBcc = parseEmails(optionalString(args, "bcc"));
-                        const recipients = getReplyRecipients(detail, config.smtp.username, replyAll);
+                        const recipients = getReplyRecipients(detail, threadReplyBundle.config.smtp.username, replyAll);
                         const cc = uniqueAddresses([...recipients.cc, ...extraCc]);
                         const to = uniqueAddresses(recipients.to);
                         ensureValidEmails(to, "to");