proton-mail-bridge-client 2.1.2 → 2.1.4

package/dist/index.d.ts

@@ -23,6 +23,8 @@ export declare function extractUnsubscribeInfo(detail: EmailDetail): {
     mailto?: string;
     url?: string;
 };
+export declare function buildReplyHtml(detail: EmailDetail, htmlBody: string): string;
+export declare function buildForwardHtml(detail: EmailDetail, htmlBody?: string): string;
 export declare function getReplyRecipients(detail: EmailDetail, ownerEmail: string, replyAll: boolean): {
     to: string[];
     cc: string[];
@@ -63,6 +65,10 @@ export declare function redactDraftAttachmentsForListing(draft: DraftRecord): {
     remoteDraft?: import("./types/index.js").RemoteDraftRef;
     lastSendResult?: import("./types/index.js").DraftSendResult;
 };
+export declare function paginateMergedAccountResults<T>(sortedMerged: T[], offset: number, limit: number): {
+    page: T[];
+    hasMore: boolean;
+};
 export declare function getBulkMaxBatchSize(args: Record<string, unknown>): number;
 export declare function ensureBulkBatchSize(uidsLength: number, max: number): void;
 interface BulkExcludedEmailId {

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAkB,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAIjB,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAmrDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAmED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AA4KD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAilBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkjIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAmC,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAIjB,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAmrDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAmED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AAuLD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAe/E;AAWD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAgWD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKjI;AA8PD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmrIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}

package/dist/index.js

@@ -12,7 +12,7 @@ import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, ListResources
 import { isMainModule } from "./is-main.js";
 import { AnalyticsService } from "./services/analytics-service.js";
 import { BULK_ITEM_TIMEOUT_MS, describeImapError, isLikelyAuthenticationError, isLikelyConnectionError, isLikelyTlsMismatchError, UID_VALIDITY_MISMATCH_ERROR } from "./services/simple-imap-service.js";
-import { applySignature } from "./services/smtp-service.js";
+import { applySignature, plainTextToHtml } from "./services/smtp-service.js";
 import { ensureValidEmails, foldQuotedHistory, isTextLikeMimeType, isValidEmail, lowerCaseAddress, normalizeBoolean, normalizeLimit, normalizeJsonValue, parseEmailId, parseEmails, projectFields, renderMarkdown, slugifyAccountAddress, splitAccountPrefix, stringifyForJson, withAccountPrefix, } from "./utils/helpers.js";
 import { AccountManager } from "./services/account-manager.js";
 import { logger } from "./utils/logger.js";
@@ -2069,6 +2069,53 @@ function buildForwardText(detail, body) {
         .filter((line, index, array) => line !== "" || (index > 0 && array[index - 1] !== ""))
         .join("\n");
 }
+// HTML counterparts of buildReplyText/buildForwardText — needed because a
+// markdown-authored reply/forward (markdownBody) renders its OWN new text to a
+// real, separate htmlBody, but buildReplyText/buildForwardText only ever wrapped
+// the PLAIN TEXT `body` with the quoted/forwarded original. That original never
+// made it into htmlBody at all — an HTML-viewing recipient of a markdown reply
+// saw only the new text and signature, with the entire original message missing
+// (confirmed on generated MIME messages), while the text/plain part had it via
+// buildReplyText. Uses the original message's own detail.html when present
+// (real markup, not reconstructed); falls back to escaping detail.text/preview
+// through plainTextToHtml otherwise, same as a plain-text send's own html
+// alternative (see smtp-service.ts's plainTextToHtml comment).
+export function buildReplyHtml(detail, htmlBody) {
+    const originalHtml = typeof detail.html === "string" && detail.html
+        ? detail.html
+        : plainTextToHtml(detail.text || detail.preview || "");
+    const fromText = formatAddressList(detail.from);
+    const dateText = detail.date || detail.internalDate || "an unknown date";
+    return [
+        htmlBody,
+        `<p>On ${escapeHtmlForQuote(dateText)}, ${escapeHtmlForQuote(fromText || "the sender")} wrote:</p>`,
+        `<blockquote>${originalHtml}</blockquote>`,
+    ].join("\n");
+}
+export function buildForwardHtml(detail, htmlBody) {
+    const originalHtml = typeof detail.html === "string" && detail.html
+        ? detail.html
+        : plainTextToHtml(detail.text || detail.preview || "");
+    return [
+        htmlBody?.trim() || "",
+        "<p>---------- Forwarded message ---------</p>",
+        `<p>From: ${escapeHtmlForQuote(formatAddressList(detail.from))}<br>`,
+        `Date: ${escapeHtmlForQuote(detail.date || detail.internalDate || "")}<br>`,
+        `Subject: ${escapeHtmlForQuote(detail.subject)}<br>`,
+        `To: ${escapeHtmlForQuote(formatAddressList(detail.to))}${detail.cc.length > 0 ? `<br>Cc: ${escapeHtmlForQuote(formatAddressList(detail.cc))}` : ""}</p>`,
+        originalHtml,
+    ]
+        .filter((part) => part !== "")
+        .join("\n");
+}
+function escapeHtmlForQuote(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
 export function getReplyRecipients(detail, ownerEmail, replyAll) {
     const owner = lowerCaseAddress(ownerEmail);
     const primary = addressValues(detail.replyTo).length > 0 ? detail.replyTo : detail.from;
@@ -2495,6 +2542,23 @@ function sortByDateDesc(items, dateOf) {
         return rightTime - leftTime;
     });
 }
+// get_emails' multi-account offset/limit pagination math, pulled out for direct
+// testing. Applying `offset` separately to EACH account's own page before merging
+// is wrong — page 2 (offset=25,limit=25) would skip each account's own first 25
+// messages independently, then concatenate their page-2 results, which drops
+// items relative to page 2 of the globally-merged, newest-first timeline (found
+// live with interleaved messages across two accounts: page 2 skipped the
+// second-newest message overall). The caller is expected to have already fetched
+// each account from offset 0 up to (offset + limit) — since every account's own
+// list already arrives newest-first, that's guaranteed to include every item that
+// could rank in the global top (offset + limit) — and passes the sorted,
+// concatenated superset in here to be paginated as one timeline.
+export function paginateMergedAccountResults(sortedMerged, offset, limit) {
+    return {
+        page: sortedMerged.slice(offset, offset + limit),
+        hasMore: sortedMerged.length > offset + limit,
+    };
+}
 function mergeMailboxLabels(perAccountLabels) {
     const merged = new Map();
     for (const labels of perAccountLabels) {
@@ -3170,6 +3234,12 @@ export function createServer(config, options = {}) {
     // string-prefix stripping over the non-primary slugs), so draftId resolution reuses
     // resolveAccountForEmailId itself rather than a second, parallel mechanism.
     const resolveAccountForDraftId = resolveAccountForEmailId;
+    // Same scheme again for delivery-queue ids (cancel_send/list_scheduled_sends) and
+    // snooze ids (cancel_snooze/list_snoozed) — both are per-account services (their own
+    // JSON file under that account's dataDir), so a queued/snoozed item's id needs the
+    // same slug-prefix round-trip as an emailId/draftId to be found again by account.
+    const resolveAccountForQueueId = resolveAccountForEmailId;
+    const resolveAccountForSnoozeId = resolveAccountForEmailId;
     // The slug to prefix a response id with for this bundle — undefined for the
     // primary account, so a primary-account id round-trips with NO prefix at all,
     // exactly as it did before multi-account support existed.
@@ -3429,22 +3499,6 @@ export function createServer(config, options = {}) {
                         }
                         undoWindowSeconds = requested;
                     }
-                    if (undoWindowSeconds > 0) {
-                        // Scope limitation (follow-up round): the undo-send queue is always the
-                        // primary's deliveryQueueService, so a delayed send with a non-primary
-                        // `from` still only gets the header-override-on-primary fallback at fire
-                        // time, not this account's own SMTP connection — unlike the immediate-send
-                        // path above. Fine for now since `from` is still passed through in the
-                        // payload and Proton accepts any verified address on the account.
-                        const sendAt = new Date(Date.now() + undoWindowSeconds * 1000).toISOString();
-                        const queued = await withAudit(auditService, name, args, async () => deliveryQueueService.enqueue(emailPayload, sendAt, "undo_send"));
-                        return createTextResult({
-                            queued: true,
-                            id: queued.id,
-                            sendAt: queued.sendAt,
-                            note: `Not sent yet — will send in ~${undoWindowSeconds}s unless canceled with cancel_send. This server must stay running for the send to fire; if it's restarted before sendAt, the send fires on next startup instead.`,
-                        });
-                    }
                     // A `from` matching a configured additional account routes through that
                     // account's own SMTP connection — required under Bridge's Split Addresses
                     // feature, where each address is its own separate IMAP/SMTP login, not just
@@ -3453,8 +3507,26 @@ export function createServer(config, options = {}) {
                     // the primary connection with `from` passed through as a plain header
                     // override (still valid for a genuine alias only reachable that way).
                     const sendBundle = from ? accountManager.byAddress(from) : undefined;
+                    const effectiveSendBundle = sendBundle ?? primaryBundle;
                     const sendSmtp = sendBundle ? sendBundle.smtpService : smtpService;
                     const sendImap = sendBundle ? sendBundle.imapService : imapService;
+                    if (undoWindowSeconds > 0) {
+                        // The undo-send queue now goes through the resolved account's OWN
+                        // deliveryQueueService (same routing as the immediate-send path above),
+                        // so it fires later via that account's real SMTP connection rather than
+                        // always the primary's — a delayed send with a non-primary `from` used
+                        // to only ever get the header-override-on-primary fallback at fire time.
+                        // The returned id is prefixed with that account's slug (same scheme as
+                        // emailId/draftId) so cancel_send/list_scheduled_sends can find it again.
+                        const sendAt = new Date(Date.now() + undoWindowSeconds * 1000).toISOString();
+                        const queued = await withAudit(auditService, name, args, async () => effectiveSendBundle.deliveryQueueService.enqueue(emailPayload, sendAt, "undo_send"));
+                        return createTextResult({
+                            queued: true,
+                            id: withAccountPrefix(responseSlug(effectiveSendBundle), queued.id),
+                            sendAt: queued.sendAt,
+                            note: `Not sent yet — will send in ~${undoWindowSeconds}s unless canceled with cancel_send. This server must stay running for the send to fire; if it's restarted before sendAt, the send fires on next startup instead.`,
+                        });
+                    }
                     const result = await withAudit(auditService, name, args, async () => sendSmtp.sendEmail(emailPayload));
                     let sentCopyTokenSend = "[sent-copy:unverified]";
                     try {
@@ -3475,13 +3547,31 @@ export function createServer(config, options = {}) {
                     });
                 }
                 case "cancel_send": {
-                    const result = await withAudit(auditService, name, args, async () => deliveryQueueService.cancel(requireString(args, "id")));
-                    return createTextResult(result);
+                    // The queue id carries an account-slug prefix when the item was enqueued
+                    // through a non-primary account (see send_email/schedule_draft) — resolve
+                    // it back to that account's own deliveryQueueService, same as an
+                    // emailId/draftId, instead of always checking the primary's queue.
+                    const { bundle: cancelSendBundle, rest: cancelSendIdRest } = resolveAccountForQueueId(requireString(args, "id"));
+                    const result = await withAudit(auditService, name, args, async () => cancelSendBundle.deliveryQueueService.cancel(cancelSendIdRest));
+                    return createTextResult({ ...result, id: withAccountPrefix(responseSlug(cancelSendBundle), result.id) });
                 }
                 case "list_scheduled_sends": {
                     const statusFilter = optionalString(args, "status");
-                    const all = await withAudit(auditService, name, args, async () => deliveryQueueService.list());
-                    const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                    // Fan out across every configured account's own delivery queue and tag each
+                    // item's id with its owning account's slug — mirrors the read-tool fan-out
+                    // pattern (get_emails etc.). Single-account guard keeps byte-identical output
+                    // for the common case.
+                    if (accountManager.all().length === 1) {
+                        const all = await withAudit(auditService, name, args, async () => deliveryQueueService.list());
+                        const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                        return createTextResult(filtered);
+                    }
+                    const perAccount = await withAudit(auditService, name, args, async () => Promise.all(accountManager.all().map(async (bundle) => ({
+                        bundle,
+                        items: await bundle.deliveryQueueService.list(),
+                    }))));
+                    const tagged = perAccount.flatMap(({ bundle, items }) => items.map((item) => ({ ...item, id: withAccountPrefix(responseSlug(bundle), item.id) })));
+                    const filtered = statusFilter ? tagged.filter((item) => item.status === statusFilter) : tagged;
                     return createTextResult(filtered);
                 }
                 case "get_unsubscribe_info": {
@@ -3591,8 +3681,14 @@ export function createServer(config, options = {}) {
                     const includeQuoteReply = normalizeBoolean(args.includeQuote, true);
                     // Signature goes right after the user's own reply text, before the
                     // quoted original — not at the very end, after the quote.
-                    const signedReply = applySignature(body, htmlBody, normalizeBoolean(args.appendSignature, true));
+                    const signedReply = applySignature(body, htmlBody, normalizeBoolean(args.appendSignature, true), isHtml);
                     const replyBody = includeQuoteReply ? buildReplyText(detail, signedReply.body) : signedReply.body;
+                    // A separate htmlBody (the markdown-rendered case) needs the SAME quoted
+                    // original merged in — see buildReplyHtml's comment for why this was
+                    // previously missing entirely from the html part.
+                    const replyHtmlBody = includeQuoteReply && signedReply.htmlBody !== undefined
+                        ? buildReplyHtml(detail, signedReply.htmlBody)
+                        : signedReply.htmlBody;
                     if (config.runtime.restrictOutboundToSelf) {
                         const selfAddr = config.smtp.username.toLowerCase();
                         const allR = [...to, ...cc, ...extraBcc];
@@ -3611,7 +3707,7 @@ export function createServer(config, options = {}) {
                         subject: prefixedSubject(detail.subject, "Re:"),
                         body: replyBody,
                         isHtml,
-                        htmlBody: signedReply.htmlBody,
+                        htmlBody: replyHtmlBody,
                         fromName: fromNameReply,
                         from: fromReply,
                         sanitizeHtml: sanitizeHtmlReply,
@@ -3687,8 +3783,12 @@ export function createServer(config, options = {}) {
                     const includeQuoteRa = normalizeBoolean(args.includeQuote, true);
                     // Signature goes right after the user's own reply text, before the
                     // quoted original — not at the very end, after the quote.
-                    const signedReplyRa = applySignature(bodyRa, htmlBodyRa, normalizeBoolean(args.appendSignature, true));
+                    const signedReplyRa = applySignature(bodyRa, htmlBodyRa, normalizeBoolean(args.appendSignature, true), isHtmlRa);
                     const replyBodyRa = includeQuoteRa ? buildReplyText(detailRa, signedReplyRa.body) : signedReplyRa.body;
+                    // Same fix as reply_to_email — see buildReplyHtml's comment.
+                    const replyHtmlBodyRa = includeQuoteRa && signedReplyRa.htmlBody !== undefined
+                        ? buildReplyHtml(detailRa, signedReplyRa.htmlBody)
+                        : signedReplyRa.htmlBody;
                     const resultRa = await withAudit(auditService, name, args, async () => sendBundleForRa.smtpService.sendEmail({
                         to: toRa,
                         cc: ccRa,
@@ -3696,7 +3796,7 @@ export function createServer(config, options = {}) {
                         subject: prefixedSubject(detailRa.subject, "Re:"),
                         body: replyBodyRa,
                         isHtml: isHtmlRa,
-                        htmlBody: signedReplyRa.htmlBody,
+                        htmlBody: replyHtmlBodyRa,
                         fromName: fromNameRa,
                         from: fromRa,
                         sanitizeHtml: sanitizeHtmlRa,
@@ -3795,7 +3895,13 @@ export function createServer(config, options = {}) {
                     // Signature goes right after the user's own note, before the
                     // "---------- Forwarded message ---------" block — not at the very
                     // end, after the forwarded content.
-                    const signedFwd = applySignature(body ?? "", htmlBody, normalizeBoolean(args.appendSignature, true));
+                    const signedFwd = applySignature(body ?? "", htmlBody, normalizeBoolean(args.appendSignature, true), isHtml);
+                    // Same fix as reply_to_email/reply_all_email — see buildReplyHtml's
+                    // comment (applies equally to a markdown-authored forward's separate
+                    // htmlBody, which buildForwardText never touches).
+                    const forwardHtmlBody = signedFwd.htmlBody !== undefined
+                        ? buildForwardHtml(detail, signedFwd.htmlBody)
+                        : signedFwd.htmlBody;
                     const result = await withAudit(auditService, name, args, async () => sendBundleForFwd.smtpService.sendEmail({
                         to,
                         cc,
@@ -3803,7 +3909,7 @@ export function createServer(config, options = {}) {
                         subject: prefixedSubject(detail.subject, "Fwd:"),
                         body: buildForwardText(detail, signedFwd.body),
                         isHtml,
-                        htmlBody: signedFwd.htmlBody,
+                        htmlBody: forwardHtmlBody,
                         fromName: fromNameFwd,
                         from: fromFwd,
                         sanitizeHtml: sanitizeHtmlFwd,
@@ -3901,14 +4007,19 @@ export function createServer(config, options = {}) {
                     ]);
                 }
                 case "create_reply_draft": {
-                    const detail = await imapService.getEmailById(requireString(args, "emailId"));
+                    // emailId carries the same "<slug>::" account prefix as everywhere else —
+                    // this previously always read via the PRIMARY account's imapService
+                    // regardless of that prefix, so replying to a non-primary account's email
+                    // either resolved the wrong message or threw not-found.
+                    const { bundle: createReplyReadBundle, rest: createReplyEmailIdRest } = resolveAccountForEmailId(requireString(args, "emailId"));
+                    const detail = await createReplyReadBundle.imapService.getEmailById(createReplyEmailIdRest);
                     const body = requireString(args, "body");
                     const isHtml = normalizeBoolean(args.isHtml, false);
                     const replyAll = normalizeBoolean(args.replyAll, false);
                     const attachments = optionalAttachmentList(args.attachments);
                     const extraCc = parseEmails(optionalString(args, "cc"));
                     const extraBcc = parseEmails(optionalString(args, "bcc"));
-                    const recipients = getReplyRecipients(detail, config.smtp.username, replyAll);
+                    const recipients = getReplyRecipients(detail, createReplyReadBundle.config.smtp.username, replyAll);
                     const cc = uniqueAddresses([...recipients.cc, ...extraCc]);
                     const to = uniqueAddresses(recipients.to);
                     ensureValidEmails(to, "to");
@@ -3917,10 +4028,15 @@ export function createServer(config, options = {}) {
                     if (to.length === 0) {
                         throw new McpError(ErrorCode.InvalidParams, "Unable to infer reply recipient.");
                     }
-                    // Same from-based draftStore routing as create_draft — see its comment.
+                    // Same from-based draftStore routing as create_draft — see its comment —
+                    // except the no-`from` default is the ACCOUNT THE ORIGINAL MESSAGE BELONGS
+                    // TO, not always the primary: a reply drafted against a non-primary
+                    // account's email with no explicit `from` should default to replying as
+                    // that same account, not silently switch to primary. `from` still wins
+                    // when it names a different configured account.
                     const createReplyDraftBundle = optionalString(args, "from") !== undefined
-                        ? accountManager.byAddress(optionalString(args, "from")) ?? primaryBundle
-                        : primaryBundle;
+                        ? accountManager.byAddress(optionalString(args, "from")) ?? createReplyReadBundle
+                        : createReplyReadBundle;
                     const result = await withAudit(auditService, name, args, async () => {
                         const draft = await createReplyDraftBundle.draftStore.createDraft({
                             mode: "reply",
@@ -3966,7 +4082,9 @@ export function createServer(config, options = {}) {
                     ]);
                 }
                 case "create_forward_draft": {
-                    const detail = await imapService.getEmailById(requireString(args, "emailId"));
+                    // Same emailId account resolution as create_reply_draft — see its comment.
+                    const { bundle: createForwardReadBundle, rest: createForwardEmailIdRest } = resolveAccountForEmailId(requireString(args, "emailId"));
+                    const detail = await createForwardReadBundle.imapService.getEmailById(createForwardEmailIdRest);
                     const to = parseEmails(requireString(args, "to"));
                     const cc = parseEmails(optionalString(args, "cc"));
                     const bcc = parseEmails(optionalString(args, "bcc"));
@@ -3984,13 +4102,15 @@ export function createServer(config, options = {}) {
                     const originalAttachments = includeAttachments
                         ? await Promise.all(detail.attachments
                             .filter((a) => a.id)
-                            .map((a) => imapService.getAttachmentForForward(detail.id, a.id)))
+                            .map((a) => createForwardReadBundle.imapService.getAttachmentForForward(detail.id, a.id)))
                         : [];
                     const attachments = [...originalAttachments, ...callerAttachments];
-                    // Same from-based draftStore routing as create_draft — see its comment.
+                    // Same from-based draftStore routing as create_reply_draft — defaults to
+                    // the ORIGINAL MESSAGE's own account, not always primary, when `from`
+                    // isn't given.
                     const createForwardDraftBundle = optionalString(args, "from") !== undefined
-                        ? accountManager.byAddress(optionalString(args, "from")) ?? primaryBundle
-                        : primaryBundle;
+                        ? accountManager.byAddress(optionalString(args, "from")) ?? createForwardReadBundle
+                        : createForwardReadBundle;
                     const result = await withAudit(auditService, name, args, async () => {
                         const draft = await createForwardDraftBundle.draftStore.createDraft({
                             mode: "forward",
@@ -4177,7 +4297,7 @@ export function createServer(config, options = {}) {
                     // immediate send is actually what's wanted.
                     const pendingScheduled = (await sendDraftBundle.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
                     if (pendingScheduled) {
-                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${pendingScheduled.id}, sendAt ${pendingScheduled.sendAt}). Sending now would deliver it twice. Cancel that scheduled send with cancel_send first, or wait for it to fire.`);
+                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(sendDraftBundle), pendingScheduled.id)}, sendAt ${pendingScheduled.sendAt}). Sending now would deliver it twice. Cancel that scheduled send with cancel_send first, or wait for it to fire.`);
                     }
                     ensureValidEmails(draft.to, "to");
                     ensureValidEmails(draft.cc, "cc");
@@ -4358,7 +4478,7 @@ export function createServer(config, options = {}) {
                     // in the common non-racing case.
                     const alreadyPendingScheduled = (await scheduleDraftBundle.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
                     if (alreadyPendingScheduled) {
-                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${alreadyPendingScheduled.id}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
+                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(scheduleDraftBundle), alreadyPendingScheduled.id)}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
                     }
                     const sendAt = requireString(args, "sendAt");
                     const sendAtTime = new Date(sendAt).getTime();
@@ -4401,7 +4521,7 @@ export function createServer(config, options = {}) {
                     }, new Date(sendAtTime).toISOString(), "scheduled_send", draft.id));
                     return createTextResult({
                         queued: true,
-                        id: queued.id,
+                        id: withAccountPrefix(responseSlug(scheduleDraftBundle), queued.id),
                         draftId: withAccountPrefix(responseSlug(scheduleDraftBundle), draft.id),
                         sendAt: queued.sendAt,
                         note: "The draft's content was snapshotted now and queued. This server must stay running for the send to fire at sendAt — if restarted first, it fires on next startup instead. The draft record itself is not automatically marked sent; use cancel_send with this id to abort before it fires.",
@@ -4452,26 +4572,36 @@ export function createServer(config, options = {}) {
                             hasMore: result.emails.length === effectiveLimit,
                         }, false, result.emails.map(emailSource));
                     }
-                    // Merge strategy: live-fetch each account's own folder page (LIVE IMAP,
-                    // one call per account), tag ids with the account slug, concatenate,
-                    // re-sort newest-first, then re-apply the original limit across the
-                    // merged set (not per account) and sum totals across accounts.
+                    // Merge strategy: an `offset` applied separately to each account's own page
+                    // BEFORE merging is wrong — e.g. offset=25,limit=25 (page 2) would skip each
+                    // account's own first 25 messages independently, then concatenate their
+                    // page-2 results, which is not the same as page 2 of the globally-merged,
+                    // newest-first timeline (found live with interleaved messages across two
+                    // accounts: page 2 skipped the second-newest message overall). Fixed by
+                    // always fetching from offset 0 up to (requestedOffset + limit) from EVERY
+                    // account — enough that each account's true contribution to the global top
+                    // (requestedOffset + limit) is fully captured, since getEmails already
+                    // returns newest-first — then merging, re-sorting, and applying the
+                    // requested offset/limit to that merged superset instead of per account.
                     const primarySlug = accountManager.primary().account.slug;
+                    const requestedOffset = getEmailsInput.offset ?? 0;
+                    const perAccountFetchLimit = requestedOffset + effectiveLimit;
                     const perAccount = await Promise.all(accountManager.all().map(async (bundle) => {
-                        const result = await bundle.imapService.getEmails(getEmailsInput);
+                        const result = await bundle.imapService.getEmails({ ...getEmailsInput, offset: 0, limit: perAccountFetchLimit });
                         return { bundle, result };
                     }));
                     const taggedEmails = perAccount.flatMap(({ bundle, result }) => result.emails.map((email) => ({ ...email, id: withAccountPrefix(accountSlugForTag(bundle, primarySlug), email.id) })));
-                    const merged = sortByDateDesc(taggedEmails, (email) => email.internalDate || email.date).slice(0, effectiveLimit);
+                    const mergedAll = sortByDateDesc(taggedEmails, (email) => email.internalDate || email.date);
+                    const { page: merged, hasMore } = paginateMergedAccountResults(mergedAll, requestedOffset, effectiveLimit);
                     const total = perAccount.reduce((sum, { result }) => sum + result.total, 0);
                     return createTextResult({
                         folder: getEmailsInput.folder?.trim() || "INBOX",
                         total,
                         limit: effectiveLimit,
-                        offset: getEmailsInput.offset ?? 0,
+                        offset: requestedOffset,
                         emails: projectFields(merged, parseFieldsArg(args.fields)),
                         returned: merged.length,
-                        hasMore: merged.length === effectiveLimit,
+                        hasMore,
                         byAccount: perAccount.map(({ bundle, result }) => ({ slug: bundle.account.slug, total: result.total })),
                     }, false, merged.map(emailSource));
                 }
@@ -5222,10 +5352,15 @@ export function createServer(config, options = {}) {
                     if (wakeAtTime <= Date.now()) {
                         throw new McpError(ErrorCode.InvalidParams, "wakeAt must be in the future.");
                     }
-                    const snoozed = await withAudit(auditService, name, args, async () => snoozeService.snooze(requireString(args, "emailId"), new Date(wakeAtTime).toISOString()));
+                    // emailId carries the same "<slug>::" prefix as everywhere else — resolve it
+                    // to that account's own snoozeService instead of always the primary's, and
+                    // prefix the returned ids (the snooze's own id, and the email id) the same
+                    // way so cancel_snooze/list_snoozed can find them again by account.
+                    const { bundle: snoozeBundle, rest: snoozeEmailIdRest } = resolveAccountForSnoozeId(requireString(args, "emailId"));
+                    const snoozed = await withAudit(auditService, name, args, async () => snoozeBundle.snoozeService.snooze(snoozeEmailIdRest, new Date(wakeAtTime).toISOString()));
                     return createTextResult({
-                        id: snoozed.id,
-                        emailId: snoozed.currentEmailId,
+                        id: withAccountPrefix(responseSlug(snoozeBundle), snoozed.id),
+                        emailId: withAccountPrefix(responseSlug(snoozeBundle), snoozed.currentEmailId),
                         wakeAt: snoozed.wakeAt,
                         note: "This server must stay running for the wake to fire at wakeAt — if restarted first, it wakes on next startup instead. Cancelable via cancel_snooze.",
                     });
@@ -5234,13 +5369,34 @@ export function createServer(config, options = {}) {
                     // cancel moves the mailbox back to its original folder, same as
                     // snooze_email's own move — gate it the same way.
                     ensureEmailActionAllowed(config.runtime, "archive");
-                    const result = await withAudit(auditService, name, args, async () => snoozeService.cancel(requireString(args, "id")));
-                    return createTextResult(result);
+                    const { bundle: cancelSnoozeBundle, rest: cancelSnoozeIdRest } = resolveAccountForSnoozeId(requireString(args, "id"));
+                    const result = await withAudit(auditService, name, args, async () => cancelSnoozeBundle.snoozeService.cancel(cancelSnoozeIdRest));
+                    return createTextResult({
+                        ...result,
+                        id: withAccountPrefix(responseSlug(cancelSnoozeBundle), result.id),
+                        currentEmailId: withAccountPrefix(responseSlug(cancelSnoozeBundle), result.currentEmailId),
+                    });
                 }
                 case "list_snoozed": {
                     const statusFilter = optionalString(args, "status");
-                    const all = await withAudit(auditService, name, args, async () => snoozeService.list());
-                    const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                    // Same fan-out pattern as list_scheduled_sends — each account has its own
+                    // independent snoozeService/JSON file. Single-account guard keeps
+                    // byte-identical output for the common case.
+                    if (accountManager.all().length === 1) {
+                        const all = await withAudit(auditService, name, args, async () => snoozeService.list());
+                        const filtered = statusFilter ? all.filter((item) => item.status === statusFilter) : all;
+                        return createTextResult(filtered);
+                    }
+                    const perAccount = await withAudit(auditService, name, args, async () => Promise.all(accountManager.all().map(async (bundle) => ({
+                        bundle,
+                        items: await bundle.snoozeService.list(),
+                    }))));
+                    const tagged = perAccount.flatMap(({ bundle, items }) => items.map((item) => ({
+                        ...item,
+                        id: withAccountPrefix(responseSlug(bundle), item.id),
+                        currentEmailId: withAccountPrefix(responseSlug(bundle), item.currentEmailId),
+                    })));
+                    const filtered = statusFilter ? tagged.filter((item) => item.status === statusFilter) : tagged;
                     return createTextResult(filtered);
                 }
                 case "create_template": {
@@ -6222,24 +6378,32 @@ export function createServer(config, options = {}) {
                     }
                 case "create_thread_reply_draft":
                     {
-                        await maybeRefreshLocalIndex(imapService, localIndexService, {
+                        // A threadId is only ever valid within the single account it was produced
+                        // by — same "<slug>::" resolution as get_thread_by_id/move_thread. This was
+                        // previously always reading via the PRIMARY account's localIndexService/
+                        // imapService regardless of the threadId's own prefix, so a reply drafted
+                        // against a non-primary account's thread either resolved the wrong thread
+                        // (if the primary happened to have a same-shaped local id) or threw not
+                        // found. Every read below now goes through the resolved threadBundle.
+                        const { bundle: threadReplyBundle, rest: threadReplyIdRest } = resolveAccountForEmailId(requireString(args, "threadId"));
+                        await maybeRefreshLocalIndex(threadReplyBundle.imapService, threadReplyBundle.localIndexService, {
                             force: normalizeBoolean(args.syncBefore, false),
                             folder: "INBOX",
                             limitPerFolder: 100,
                         });
-                        const thread = await localIndexService.getThreadById(requireString(args, "threadId"));
-                        const targetMessage = pickReplyTargetFromThread(thread, config.smtp.username, normalizeBoolean(args.preferLatestInbound, true));
+                        const thread = await threadReplyBundle.localIndexService.getThreadById(threadReplyIdRest);
+                        const targetMessage = pickReplyTargetFromThread(thread, threadReplyBundle.config.smtp.username, normalizeBoolean(args.preferLatestInbound, true));
                         if (!targetMessage?.primaryEmailId) {
                             throw new McpError(ErrorCode.InvalidParams, "Unable to resolve a reply target from the thread.");
                         }
-                        const detail = await imapService.getEmailById(targetMessage.primaryEmailId);
+                        const detail = await threadReplyBundle.imapService.getEmailById(targetMessage.primaryEmailId);
                         const body = requireString(args, "body");
                         const isHtml = normalizeBoolean(args.isHtml, false);
                         const replyAll = normalizeBoolean(args.replyAll, false);
                         const attachments = optionalAttachmentList(args.attachments);
                         const extraCc = parseEmails(optionalString(args, "cc"));
                         const extraBcc = parseEmails(optionalString(args, "bcc"));
-                        const recipients = getReplyRecipients(detail, config.smtp.username, replyAll);
+                        const recipients = getReplyRecipients(detail, threadReplyBundle.config.smtp.username, replyAll);
                         const cc = uniqueAddresses([...recipients.cc, ...extraCc]);
                         const to = uniqueAddresses(recipients.to);
                         ensureValidEmails(to, "to");
@@ -6248,10 +6412,15 @@ export function createServer(config, options = {}) {
                         if (to.length === 0) {
                             throw new McpError(ErrorCode.InvalidParams, "Unable to infer reply recipient.");
                         }
-                        // Same from-based draftStore routing as create_draft — see its comment.
+                        // Same from-based draftStore routing as create_reply_draft — defaults to
+                        // the THREAD's own account (threadReplyBundle, already resolved above from
+                        // the threadId's own prefix), not always primary, when `from` isn't given.
+                        // Previously always defaulted to primary regardless of which account the
+                        // thread actually belonged to — a reply drafted with no explicit `from`
+                        // against a non-primary account's thread silently switched accounts.
                         const createThreadReplyDraftBundle = optionalString(args, "from") !== undefined
-                            ? accountManager.byAddress(optionalString(args, "from")) ?? primaryBundle
-                            : primaryBundle;
+                            ? accountManager.byAddress(optionalString(args, "from")) ?? threadReplyBundle
+                            : threadReplyBundle;
                         const result = await withAudit(auditService, name, args, async () => {
                             const draft = await createThreadReplyDraftBundle.draftStore.createDraft({
                                 mode: "reply",