proton-mail-bridge-client 2.1.6 → 2.1.8

package/README.md

@@ -311,6 +311,7 @@ First, enable **Split Addresses** in Proton Bridge and configure each address as
 - Search & read: `search_indexed_emails`, `get_emails`, `get_threads`, `get_thread_by_id`, `count_messages`, `get_labels`, `folder_stats`, `top_senders`, `get_contacts`, `get_volume_trends`, `get_email_analytics`, `get_email_stats`, `get_folders`
 - Triage: `get_inbox_digest`, `get_follow_up_candidates`, `get_actionable_threads`, `find_document_threads`, `prepare_meeting_context`
 - Diagnostics: `get_connection_status`, `get_runtime_status`, `run_doctor` (include an `accounts` array showing per-account status)
+- Drafts: `list_drafts` — lists every configured account's drafts, merged and re-sorted by last update; supports optional `limit`/`offset`
 
 **Account-specific (prefix to target):**
 - Actions: `mark_email_read`, `star_email`, `move_email`, `delete_email`, etc. — prefix the `emailId` with account slug if targeting a non-primary account
@@ -318,7 +319,7 @@ First, enable **Split Addresses** in Proton Bridge and configure each address as
 - Send: `send_email`, `reply_to_email`, `forward_email` — match the `from` address to route through the correct account's SMTP
 
 **Primary-only (for now):**
-- `list_drafts`, `list_remote_drafts` — show primary account drafts only
+- `list_remote_drafts` — shows the primary account's remote Proton Drafts folder only
 - Thread actions (`move_thread`, `delete_thread`, `flag_thread`) — operate on the account the thread ID's prefix names
 
 ### Verify setup

package/dist/index.d.ts

@@ -12,6 +12,7 @@ import type { BulkOperationResult, DraftRecord, EmailDetail, ProtonMailConfig, S
 import { AccountManager, type AccountBundle } from "./services/account-manager.js";
 export declare const CORE_TOOL_NAMES: Set<string>;
 export declare function withAudit<T>(auditService: AuditService, tool: string, input: Record<string, unknown>, operation: () => Promise<T>): Promise<T>;
+export declare function optionalClearableString(args: Record<string, unknown>, key: string): string | undefined;
 export declare function headerString(headers: Record<string, unknown> | undefined, name: string): string | undefined;
 export declare function parseAuthenticationResults(value?: string): {
     dkim?: string;
@@ -65,6 +66,9 @@ export declare function redactDraftAttachmentsForListing(draft: DraftRecord): {
     remoteDraft?: import("./types/index.js").RemoteDraftRef;
     lastSendResult?: import("./types/index.js").DraftSendResult;
 };
+export declare function truncateDraftBodyForResponse<T extends {
+    body: string;
+}>(draft: T): T;
 export declare function redactQueueRecordAttachments<T extends {
     payload: SendEmailInput;
 }>(record: T): T;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAmC,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAChB,cAAc,EAGf,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAorDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAmED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AAuLD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAe/E;AAWD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAQD,wBAAgB,4BAA4B,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,KAmB5F;AA8WD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKjI;AA8PD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+tIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAmC,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAChB,cAAc,EAGf,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAsrDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAiCD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKtG;AA+CD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AAuLD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAe/E;AAWD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAoBD,wBAAgB,4BAA4B,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,CAAC,KAUhF;AAQD,wBAAgB,4BAA4B,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,KAmB5F;AA8WD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKjI;AA8PD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0zIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}

package/dist/index.js

@@ -385,12 +385,14 @@ const TOOLS = [
     },
     {
         name: "list_drafts",
-        description: "List all locally saved drafts with their status, subject, and timestamps. Attachment content is omitted here (filename/type/size only) to keep this unbounded listing from blowing up on large attachments — use get_draft for the full attachment content of one draft. Use to review in-progress or unsent messages. Does NOT list drafts stored only on the Proton server — use list_remote_drafts for those. Prefer get_draft when you already have a draftId and need the full content.",
+        description: "List all locally saved drafts with their status, subject, and timestamps. Attachment content is omitted here (filename/type/size only) — use get_draft for the full attachment content of one draft. Each draft's body is also truncated to a short preview (bodyTruncated:true, bodyLength gives the real size) — use get_draft for the full body of one draft. Use to review in-progress or unsent messages. Does NOT list drafts stored only on the Proton server — use list_remote_drafts for those. Prefer get_draft when you already have a draftId and need the full content.",
         annotations: { readOnlyHint: true },
         inputSchema: {
             type: "object",
             properties: {
                 includeSent: { type: "boolean", description: "Include drafts already sent.", default: false },
+                limit: { type: "number", description: "Maximum drafts to return. Omit to return every draft (still with truncated bodies/attachments) — set this when you only need a bounded page." },
+                offset: { type: "number", description: "Number of drafts to skip, newest-updated first.", default: 0 },
             },
         },
     },
@@ -1839,6 +1841,23 @@ function optionalString(args, key) {
     const value = args[key];
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+// Found live (external review): update_draft's body:'' and replyTo:'' both
+// returned success but left the old values in place — optionalString collapses
+// an explicitly-empty string to undefined the same as an omitted field
+// entirely, and DraftStoreService.updateDraft's patch treats undefined as
+// "don't touch this field" (`patch.body ?? existing.body`). So there was no
+// way to actually clear either field once set — only used for update_draft's
+// body/replyTo, which are the two fields the review confirmed this breaks
+// (cc/bcc/attachments already have their own clear path via
+// `args.x === undefined ? undefined : ...`, checked separately). Not applied
+// to optionalString itself, since most of its many other callers legitimately
+// want "" treated the same as "not provided".
+export function optionalClearableString(args, key) {
+    if (!(key in args) || args[key] === undefined) {
+        return undefined;
+    }
+    return typeof args[key] === "string" ? args[key].trim() : undefined;
+}
 // Shared by get_email_by_id and get_emails_by_ids: applies body preference/
 // truncation and strips the full raw header map by default (needless token
 // bloat — get_email_by_id re-adds it when showHeaders is explicitly true).
@@ -2277,6 +2296,34 @@ export function redactDraftAttachmentsForListing(draft) {
         })),
     };
 }
+// How much of a draft's body survives into a mutation/listing response before
+// it's truncated — long enough to recognize the draft at a glance, short
+// enough that a large body (a long thread quoted into a reply, a big pasted
+// table) doesn't dominate the response the way redactDraftAttachmentsForListing
+// already stops a base64 attachment from doing.
+const DRAFT_BODY_PREVIEW_LENGTH = 500;
+// Found live (external review, repeated across three rounds): create_draft,
+// update_draft, create_reply_draft, create_forward_draft,
+// create_thread_reply_draft, sync_draft_to_remote, and list_drafts all echoed
+// the draft's COMPLETE body back — confirmed live at ~40k tokens for a single
+// update_draft call that only changed the subject of a ~202 KB draft, and
+// ~261k tokens for list_drafts with 107 drafts. The caller supplied the body
+// itself (create/update) or already has it from a prior call (list) — same
+// "caller already knows what it sent" reasoning as attachment redaction, just
+// for the text body instead of base64. get_draft deliberately keeps the full
+// body — it's the "let me look at this one draft" call, not a repeated-edit
+// or bulk-listing one.
+export function truncateDraftBodyForResponse(draft) {
+    if (draft.body.length <= DRAFT_BODY_PREVIEW_LENGTH) {
+        return draft;
+    }
+    return {
+        ...draft,
+        body: `${draft.body.slice(0, DRAFT_BODY_PREVIEW_LENGTH)}…`,
+        bodyLength: draft.body.length,
+        bodyTruncated: true,
+    };
+}
 // Same fix as redactDraftAttachmentsForListing, for list_scheduled_sends — a
 // queued send's payload carries the same full base64 EmailAttachmentInput
 // content (found live: ~955k tokens for a single 1 MiB attachment on ONE
@@ -2459,7 +2506,7 @@ async function syncDraftToRemote(draftStore, smtpService, imapService, draft) {
             // signature into the draft body themselves, got it appended a second time
             // on every remote sync.
             appendSignature: false,
-        });
+        }, /* preserveBcc */ true);
         const remoteDraft = await imapService.upsertRemoteDraft({
             raw,
             messageId: draft.draftMessageId,
@@ -4041,9 +4088,9 @@ export function createServer(config, options = {}) {
                         return presentDraft(createDraftBundle, remoteSync ? { ...synced.draft, remoteSync } : synced.draft);
                     });
                     // Same fix as update_draft's identical bloat — see its comment. The
-                    // caller already knows what it attached; get_draft is the "let me see
-                    // the full attachment content" call, not this one.
-                    return createTextResult(redactDraftAttachmentsForListing(result), false, [
+                    // caller already knows what it attached (and what body it just sent);
+                    // get_draft is the "let me see the full content" call, not this one.
+                    return createTextResult(truncateDraftBodyForResponse(redactDraftAttachmentsForListing(result)), false, [
                         draftSource(result),
                         ...(result.remoteDraft?.emailId
                             ? [
@@ -4126,7 +4173,7 @@ export function createServer(config, options = {}) {
                         return presentDraft(createReplyDraftBundle, remoteSync ? { ...synced.draft, remoteSync } : synced.draft);
                     });
                     // Same fix as create_draft/update_draft's identical bloat — see their comments.
-                    return createTextResult(redactDraftAttachmentsForListing(result), false, [
+                    return createTextResult(truncateDraftBodyForResponse(redactDraftAttachmentsForListing(result)), false, [
                         draftSource(result),
                         emailSource(detail),
                         ...(result.remoteDraft?.emailId
@@ -4201,7 +4248,7 @@ export function createServer(config, options = {}) {
                         return presentDraft(createForwardDraftBundle, remoteSync ? { ...synced.draft, remoteSync } : synced.draft);
                     });
                     // Same fix as create_draft/update_draft's identical bloat — see their comments.
-                    return createTextResult(redactDraftAttachmentsForListing(result), false, [
+                    return createTextResult(truncateDraftBodyForResponse(redactDraftAttachmentsForListing(result)), false, [
                         draftSource(result),
                         emailSource(detail),
                         ...(result.remoteDraft?.emailId
@@ -4216,14 +4263,41 @@ export function createServer(config, options = {}) {
                     ]);
                 }
                 case "list_drafts": {
-                    // Scope limitation (follow-up round): stays scoped to the primary account's
-                    // drafts only — a non-primary account's drafts aren't listed here yet. Use
-                    // get_draft with that account's prefixed draftId if you already have one.
-                    const drafts = await draftStore.listDrafts(normalizeBoolean(args.includeSent, false));
+                    // Found live (external review): this stayed scoped to the primary
+                    // account's own drafts only — a draft created via create_draft(from:
+                    // secondary@example.com) is real and gettable by its prefixed draftId,
+                    // but never showed up here, so day-to-day draft discovery silently
+                    // missed every non-primary account's drafts. Now fans out across every
+                    // configured account, same pattern as list_scheduled_sends/
+                    // list_snoozed, and re-sorts the merged set by updatedAt (each
+                    // account's own list already arrives that way). Single-account guard
+                    // keeps byte-identical output for the common case.
+                    const includeSent = normalizeBoolean(args.includeSent, false);
+                    const allDrafts = accountManager.all().length === 1
+                        ? (await draftStore.listDrafts(includeSent)).map((draft) => ({ bundle: primaryBundle, draft }))
+                        : (await Promise.all(accountManager.all().map(async (bundle) => {
+                            const drafts = await bundle.draftStore.listDrafts(includeSent);
+                            return drafts.map((draft) => ({ bundle, draft: presentDraft(bundle, draft) }));
+                        })))
+                            .flat()
+                            .sort((left, right) => right.draft.updatedAt.localeCompare(left.draft.updatedAt));
+                    // Found live (external review): every draft's full body was returned
+                    // alongside the already-redacted attachments — confirmed live at ~261k
+                    // tokens for 107 drafts. Bodies are now truncated the same way a
+                    // mutation response's body is (see truncateDraftBodyForResponse). limit/
+                    // offset are optional and additive — omitting them still returns every
+                    // draft (just with truncated bodies/attachments), so this doesn't change
+                    // behavior for a caller not using the new params.
+                    const offset = normalizeLimit(args.offset, 0, 0, 10_000);
+                    const limit = typeof args.limit === "number" ? normalizeLimit(args.limit, allDrafts.length, 1, 10_000) : undefined;
+                    const page = limit !== undefined ? allDrafts.slice(offset, offset + limit) : allDrafts.slice(offset);
                     return createTextResult({
-                        total: drafts.length,
-                        drafts: drafts.map(redactDraftAttachmentsForListing),
-                    }, false, drafts.map(draftSource));
+                        total: allDrafts.length,
+                        offset,
+                        returned: page.length,
+                        hasMore: offset + page.length < allDrafts.length,
+                        drafts: page.map(({ draft }) => truncateDraftBodyForResponse(redactDraftAttachmentsForListing(draft))),
+                    }, false, page.map(({ draft }) => draftSource(draft)));
                 }
                 case "list_remote_drafts": {
                     // Scope limitation (follow-up round): stays scoped to the primary account's
@@ -4261,7 +4335,11 @@ export function createServer(config, options = {}) {
                     const to = args.to === undefined ? undefined : parseEmails(optionalString(args, "to"));
                     const cc = args.cc === undefined ? undefined : parseEmails(optionalString(args, "cc"));
                     const bcc = args.bcc === undefined ? undefined : parseEmails(optionalString(args, "bcc"));
-                    const replyTo = optionalString(args, "replyTo");
+                    // body/replyTo use optionalClearableString, not optionalString — see its
+                    // comment — so an explicit body:'' or replyTo:'' actually clears the
+                    // field instead of being silently treated as "field not provided".
+                    const body = optionalClearableString(args, "body");
+                    const replyTo = optionalClearableString(args, "replyTo");
                     const from = optionalString(args, "from");
                     const priority = optionalString(args, "priority");
                     const attachments = args.attachments === undefined ? undefined : optionalAttachmentList(args.attachments);
@@ -4286,7 +4364,7 @@ export function createServer(config, options = {}) {
                             cc,
                             bcc,
                             subject: optionalString(args, "subject"),
-                            body: optionalString(args, "body"),
+                            body,
                             isHtml: typeof args.isHtml === "boolean" ? args.isHtml : undefined,
                             priority: priority === "high" || priority === "low" || priority === "normal"
                                 ? priority
@@ -4314,10 +4392,13 @@ export function createServer(config, options = {}) {
                     // subject/body — the attachments usually aren't touched by this call at all, so
                     // re-echoing their full base64 `content` (serialized twice by createTextResult,
                     // same issue redactDraftAttachmentsForListing already fixed for list_drafts)
-                    // burns tokens on every single edit for a draft that has any attachment. The
-                    // caller already knows what it attached; get_draft remains full-content for the
-                    // "let me look at this draft" case, which is a single call rather than a loop.
-                    return createTextResult(redactDraftAttachmentsForListing(result), false, [
+                    // burns tokens on every single edit for a draft that has any attachment. Same
+                    // reasoning for the body itself — confirmed live at ~40k tokens for a single
+                    // subject-only edit of a ~202 KB draft (see truncateDraftBodyForResponse). The
+                    // caller already knows what it attached and what body it just sent; get_draft
+                    // remains full-content for the "let me look at this draft" case, which is a
+                    // single call rather than a loop.
+                    return createTextResult(truncateDraftBodyForResponse(redactDraftAttachmentsForListing(result)), false, [
                         draftSource(result),
                         ...(result.remoteDraft?.emailId
                             ? [
@@ -4337,7 +4418,7 @@ export function createServer(config, options = {}) {
                     const synced = await withAudit(auditService, name, args, async () => syncDraftToRemote(syncDraftBundle.draftStore, syncDraftBundle.smtpService, syncDraftBundle.imapService, draft));
                     const presentedSynced = presentDraft(syncDraftBundle, synced.draft);
                     // Same fix as create_draft/update_draft's identical bloat — see their comments.
-                    return createTextResult({ ...redactDraftAttachmentsForListing(presentedSynced), remoteSync: synced.remoteSync }, false, [
+                    return createTextResult({ ...truncateDraftBodyForResponse(redactDraftAttachmentsForListing(presentedSynced)), remoteSync: synced.remoteSync }, false, [
                         draftSource(presentedSynced),
                         ...(presentedSynced.remoteDraft?.emailId
                             ? [
@@ -4355,6 +4436,22 @@ export function createServer(config, options = {}) {
                     ensureSendAllowed(config.runtime);
                     const { bundle: sendDraftBundle, rest: sendDraftIdRest } = resolveAccountForDraftId(requireString(args, "draftId"));
                     const draft = await sendDraftBundle.draftStore.getDraft(sendDraftIdRest);
+                    // Found live (external review): sendDraftBundle above is resolved from
+                    // the draftId's own account-slug prefix — i.e. where the draft is
+                    // STORED — which never changes just because update_draft later set a
+                    // different draft.from. Repro: create_draft on primary, then
+                    // update_draft(from: secondary@example.com), then send_draft — the
+                    // payload correctly carries "secondary@example.com", but it went out
+                    // through PRIMARY's live SMTP connection with that as a header
+                    // override, which a Split-Addresses config (separate login per
+                    // address) can reject outright instead of accepting as a plain alias.
+                    // sendBundleForDraft is resolved separately, same distinction
+                    // send_email/reply_to_email already draw between "where to read/store"
+                    // and "which account to actually send through" — draft storage,
+                    // claimForSending, markSent, and remote-draft cleanup all still use
+                    // sendDraftBundle (the draft doesn't move), only the SMTP call itself
+                    // uses the resolved account.
+                    const sendBundleForDraft = draft.from ? accountManager.byAddress(draft.from) ?? sendDraftBundle : sendDraftBundle;
                     // Found live: calling send_draft twice on the same draft sent it
                     // twice — nothing here checked whether it was already marked
                     // "sent" before sending again. Refuse; create_draft for a new
@@ -4422,7 +4519,7 @@ export function createServer(config, options = {}) {
                     const sendStartedAt = Date.now();
                     let result;
                     try {
-                        result = await sendDraftBundle.smtpService.sendEmail({
+                        result = await sendBundleForDraft.smtpService.sendEmail({
                             to: draft.to,
                             cc: draft.cc,
                             bcc: draft.bcc,
@@ -4494,15 +4591,27 @@ export function createServer(config, options = {}) {
                                 : undefined,
                         };
                     sentDraft = presentDraft(sendDraftBundle, remoteCleanup.draft);
+                    // Found live (external review): the send and markSent() above already
+                    // succeeded — this citation lookup is purely for the response's source
+                    // list, and used to throw uncaught if the original message had been
+                    // moved/deleted since the draft was created, reporting a false failure
+                    // for an email that had actually already been sent (and the draft
+                    // already marked "sent", so a caller who saw the error and retried
+                    // would correctly hit the already-sent guard above — but with no way to
+                    // know the first attempt had, in fact, worked). Best-effort, same as
+                    // verifySentCopy just below.
                     const sources = [draftSource(sentDraft)];
                     if (sentDraft.sourceEmailId) {
-                        sources.push(emailSource(await sendDraftBundle.imapService.getEmailById(sentDraft.sourceEmailId)));
+                        try {
+                            sources.push(emailSource(await sendDraftBundle.imapService.getEmailById(sentDraft.sourceEmailId)));
+                        }
+                        catch (_) { }
                     }
                     let sentCopyTokenDraft = "[sent-copy:unverified]";
                     try {
                         const verifyMsgId = result.messageId;
                         if (verifyMsgId) {
-                            const scv = await verifySentCopy(sendDraftBundle.imapService, verifyMsgId);
+                            const scv = await verifySentCopy(sendBundleForDraft.imapService, verifyMsgId);
                             if (scv.found)
                                 sentCopyTokenDraft = "[sent-copy:verified]";
                         }
@@ -4524,6 +4633,13 @@ export function createServer(config, options = {}) {
                     ensureSendAllowed(config.runtime);
                     const { bundle: scheduleDraftBundle, rest: scheduleDraftIdRest } = resolveAccountForDraftId(requireString(args, "draftId"));
                     const draft = await scheduleDraftBundle.draftStore.getDraft(scheduleDraftIdRest);
+                    // Same fix as send_draft's identical sendBundleForDraft — see its
+                    // comment. The delivery queue fires via whichever account's own
+                    // deliveryQueueService it was enqueued into, so this must be the
+                    // account draft.from actually names, not always the draft's storage
+                    // account — used consistently below for both the duplicate-schedule
+                    // check and the enqueue call itself, so both look at the same queue.
+                    const sendBundleForScheduleDraft = draft.from ? accountManager.byAddress(draft.from) ?? scheduleDraftBundle : scheduleDraftBundle;
                     // Mirrors send_draft's own pendingScheduled guard, for the reverse
                     // ordering: send_draft already delivered this draft once, and
                     // scheduling it again here would deliver it a second time at
@@ -4548,9 +4664,9 @@ export function createServer(config, options = {}) {
                     // duplicate. This external check is kept only as an optional
                     // early-exit optimization to avoid a wasted round-trip to the lock
                     // in the common non-racing case.
-                    const alreadyPendingScheduled = (await scheduleDraftBundle.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
+                    const alreadyPendingScheduled = (await sendBundleForScheduleDraft.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
                     if (alreadyPendingScheduled) {
-                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(scheduleDraftBundle), alreadyPendingScheduled.id)}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
+                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(sendBundleForScheduleDraft), alreadyPendingScheduled.id)}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
                     }
                     const sendAt = requireString(args, "sendAt");
                     const sendAtTime = new Date(sendAt).getTime();
@@ -4574,7 +4690,7 @@ export function createServer(config, options = {}) {
                         if (external.length > 0)
                             throw new McpError(ErrorCode.InvalidParams, "PROTONMAIL_RESTRICT_OUTBOUND_TO_SELF is enabled. All recipients must be the authenticated user.");
                     }
-                    const queued = await withAudit(auditService, name, args, async () => scheduleDraftBundle.deliveryQueueService.enqueue({
+                    const queued = await withAudit(auditService, name, args, async () => sendBundleForScheduleDraft.deliveryQueueService.enqueue({
                         to: draft.to,
                         cc: draft.cc,
                         bcc: draft.bcc,
@@ -4593,7 +4709,7 @@ export function createServer(config, options = {}) {
                     }, new Date(sendAtTime).toISOString(), "scheduled_send", draft.id));
                     return createTextResult({
                         queued: true,
-                        id: withAccountPrefix(responseSlug(scheduleDraftBundle), queued.id),
+                        id: withAccountPrefix(responseSlug(sendBundleForScheduleDraft), queued.id),
                         draftId: withAccountPrefix(responseSlug(scheduleDraftBundle), draft.id),
                         sendAt: queued.sendAt,
                         note: "The draft's content was snapshotted now and queued. This server must stay running for the send to fire at sendAt — if restarted first, it fires on next startup instead. The draft record itself is not automatically marked sent; use cancel_send with this id to abort before it fires.",
@@ -4657,25 +4773,34 @@ export function createServer(config, options = {}) {
                     // requested offset/limit to that merged superset instead of per account.
                     const primarySlug = accountManager.primary().account.slug;
                     const requestedOffset = getEmailsInput.offset ?? 0;
-                    const perAccountFetchLimit = requestedOffset + effectiveLimit;
+                    // +1 beyond what's strictly needed to fill the page: whether that extra
+                    // item actually comes back is what tells us hasMore, independent of any
+                    // filter (beforeUid etc.) or of how the raw mailbox total compares to the
+                    // page window. Two things were tried and each broke a different case:
+                    // (1) using mergedAll.length > offset+limit as hasMore, with NO extra
+                    // overfetch — a lopsided distribution (e.g. 300 messages in one account,
+                    // 0 in another) fetches exactly offset+limit from the big account, so
+                    // mergedAll.length can never exceed that window even though hundreds
+                    // more exist, reporting hasMore:false wrongly.
+                    // (2) using the raw summed mailbox `total` for hasMore instead — correct
+                    // for that case, but wrong under a restrictive filter like beforeUid:
+                    // `total` is the UNFILTERED mailbox message count, not the count of
+                    // messages actually matching the filter, so a beforeUid narrowing 300
+                    // messages down to 2 matches still compared against total=300 and
+                    // reported hasMore:true with nothing left to page to.
+                    // Fetching one extra item fixes both: it directly observes whether a
+                    // NEXT matching item exists, under whatever filter is active, rather
+                    // than inferring it from a count that can be either capped-by-fetch or
+                    // filter-blind depending on which one you pick.
+                    const perAccountFetchLimit = requestedOffset + effectiveLimit + 1;
                     const perAccount = await Promise.all(accountManager.all().map(async (bundle) => {
                         const result = await bundle.imapService.getEmails({ ...getEmailsInput, offset: 0, limit: perAccountFetchLimit });
                         return { bundle, result };
                     }));
                     const taggedEmails = perAccount.flatMap(({ bundle, result }) => result.emails.map((email) => ({ ...email, id: withAccountPrefix(accountSlugForTag(bundle, primarySlug), email.id) })));
                     const mergedAll = sortByDateDesc(taggedEmails, (email) => email.internalDate || email.date);
-                    const { page: merged } = paginateMergedAccountResults(mergedAll, requestedOffset, effectiveLimit);
+                    const { page: merged, hasMore } = paginateMergedAccountResults(mergedAll, requestedOffset, effectiveLimit);
                     const total = perAccount.reduce((sum, { result }) => sum + result.total, 0);
-                    // Found live (external review): paginateMergedAccountResults' own hasMore
-                    // only looks at what was actually FETCHED (mergedAll.length, capped at
-                    // perAccountFetchLimit per account) — with a lopsided distribution (e.g.
-                    // 300 messages in one account, 0 in another) and a small page near the
-                    // start, mergedAll.length can equal requestedOffset+limit exactly even
-                    // though the account's real total is far larger, reporting hasMore:false
-                    // while 275 more messages exist. `total` above is each account's real,
-                    // authoritative IMAP mailbox count (not bounded by what we fetched), so
-                    // it's the correct source for this instead.
-                    const hasMore = total > requestedOffset + effectiveLimit;
                     return createTextResult({
                         folder: getEmailsInput.folder?.trim() || "INBOX",
                         total,
@@ -4715,10 +4840,20 @@ export function createServer(config, options = {}) {
                     }
                     const preferHtml = normalizeBoolean(args.preferHtml, false);
                     const maxBodyLength = normalizeLimit(args.maxBodyLength, undefined, 1, 500_000);
+                    // Found live (external review): every id went straight to the primary
+                    // account's imapService regardless of its own "<slug>::" prefix, so a
+                    // non-primary account's id in the list either resolved the wrong
+                    // message on primary or (more often) just failed to be found — the
+                    // list [primaryId, secondary::id] reported succeeded:1 instead of 2.
+                    // Each id is now resolved to its own account first, same as every
+                    // other emailId-taking tool, and the returned id keeps its prefix.
                     const results = await Promise.all(emailIds.map(async (emailId) => {
                         try {
-                            const detail = await imapService.getEmailById(emailId);
-                            return { emailId, ok: true, email: formatEmailDetailOutput(detail, preferHtml, maxBodyLength) };
+                            const { bundle, rest } = resolveAccountForEmailId(emailId);
+                            const detail = await bundle.imapService.getEmailById(rest);
+                            const output = formatEmailDetailOutput(detail, preferHtml, maxBodyLength);
+                            output.id = prefixedIdFor(bundle, detail.id);
+                            return { emailId, ok: true, email: output };
                         }
                         catch (error) {
                             return { emailId, ok: false, error: error instanceof Error ? error.message : String(error) };
@@ -6537,7 +6672,7 @@ export function createServer(config, options = {}) {
                             return { ...presented, threadId: thread.id };
                         });
                         // Same fix as create_draft/update_draft's identical bloat — see their comments.
-                        return createTextResult(redactDraftAttachmentsForListing(result), false, [
+                        return createTextResult(truncateDraftBodyForResponse(redactDraftAttachmentsForListing(result)), false, [
                             draftSource(result),
                             threadSource(thread),
                             emailSource(detail),