proton-mail-bridge-client 2.1.7 → 2.1.8

package/README.md

@@ -311,6 +311,7 @@ First, enable **Split Addresses** in Proton Bridge and configure each address as
 - Search & read: `search_indexed_emails`, `get_emails`, `get_threads`, `get_thread_by_id`, `count_messages`, `get_labels`, `folder_stats`, `top_senders`, `get_contacts`, `get_volume_trends`, `get_email_analytics`, `get_email_stats`, `get_folders`
 - Triage: `get_inbox_digest`, `get_follow_up_candidates`, `get_actionable_threads`, `find_document_threads`, `prepare_meeting_context`
 - Diagnostics: `get_connection_status`, `get_runtime_status`, `run_doctor` (include an `accounts` array showing per-account status)
+- Drafts: `list_drafts` — lists every configured account's drafts, merged and re-sorted by last update; supports optional `limit`/`offset`
 
 **Account-specific (prefix to target):**
 - Actions: `mark_email_read`, `star_email`, `move_email`, `delete_email`, etc. — prefix the `emailId` with account slug if targeting a non-primary account
@@ -318,7 +319,7 @@ First, enable **Split Addresses** in Proton Bridge and configure each address as
 - Send: `send_email`, `reply_to_email`, `forward_email` — match the `from` address to route through the correct account's SMTP
 
 **Primary-only (for now):**
-- `list_drafts`, `list_remote_drafts` — show primary account drafts only
+- `list_remote_drafts` — shows the primary account's remote Proton Drafts folder only
 - Thread actions (`move_thread`, `delete_thread`, `flag_thread`) — operate on the account the thread ID's prefix names
 
 ### Verify setup

package/dist/index.d.ts

@@ -12,6 +12,7 @@ import type { BulkOperationResult, DraftRecord, EmailDetail, ProtonMailConfig, S
 import { AccountManager, type AccountBundle } from "./services/account-manager.js";
 export declare const CORE_TOOL_NAMES: Set<string>;
 export declare function withAudit<T>(auditService: AuditService, tool: string, input: Record<string, unknown>, operation: () => Promise<T>): Promise<T>;
+export declare function optionalClearableString(args: Record<string, unknown>, key: string): string | undefined;
 export declare function headerString(headers: Record<string, unknown> | undefined, name: string): string | undefined;
 export declare function parseAuthenticationResults(value?: string): {
     dkim?: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAmC,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAChB,cAAc,EAGf,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAsrDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAmED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AAuLD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAe/E;AAWD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAoBD,wBAAgB,4BAA4B,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,CAAC,KAUhF;AAQD,wBAAgB,4BAA4B,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,KAmB5F;AA8WD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKjI;AA8PD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwvIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AASA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAYnE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAA2H,iBAAiB,EAA+B,MAAM,mCAAmC,CAAC;AAC5N,OAAO,EAAmC,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,KAAK,EAMV,mBAAmB,EAEnB,WAAW,EAIX,WAAW,EAIX,gBAAgB,EAChB,cAAc,EAGf,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAsrDnF,eAAO,MAAM,eAAe,aAyB1B,CAAC;AAgGH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAiCD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKtG;AA+CD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK3G;AAKD,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAI1G;AASD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAS7F;AAuLD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAe/E;AAWD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,OAAO,GAChB;IAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,MAAM,EAAE,CAAA;CAAE,CAyBhC;AA6ED,wBAAgB,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA4CtE;AAcD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYlE;AAoBD,wBAAgB,4BAA4B,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,CAAC,KAUhF;AAQD,wBAAgB,4BAA4B,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,KAmB5F;AA8WD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAKjI;AA8PD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEzE;AAED,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAOzE;AAED,UAAU,mBAAmB;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,mBAAmB,EAAE,CA8CvB;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,EAAE,mBAAmB,EAAE,GACtC,mBAAmB,CAmBrB;AAWD,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,EAAE,GACjB,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYvE;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAQ3G;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,EAAE,CAK/G;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CASpF;AAsQD,wBAAgB,kBAAkB,IAAI,gBAAgB,CAkGrD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE;IACP,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0zIP;AAED,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAmE1C"}

package/dist/index.js

@@ -1841,6 +1841,23 @@ function optionalString(args, key) {
     const value = args[key];
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+// Found live (external review): update_draft's body:'' and replyTo:'' both
+// returned success but left the old values in place — optionalString collapses
+// an explicitly-empty string to undefined the same as an omitted field
+// entirely, and DraftStoreService.updateDraft's patch treats undefined as
+// "don't touch this field" (`patch.body ?? existing.body`). So there was no
+// way to actually clear either field once set — only used for update_draft's
+// body/replyTo, which are the two fields the review confirmed this breaks
+// (cc/bcc/attachments already have their own clear path via
+// `args.x === undefined ? undefined : ...`, checked separately). Not applied
+// to optionalString itself, since most of its many other callers legitimately
+// want "" treated the same as "not provided".
+export function optionalClearableString(args, key) {
+    if (!(key in args) || args[key] === undefined) {
+        return undefined;
+    }
+    return typeof args[key] === "string" ? args[key].trim() : undefined;
+}
 // Shared by get_email_by_id and get_emails_by_ids: applies body preference/
 // truncation and strips the full raw header map by default (needless token
 // bloat — get_email_by_id re-adds it when showHeaders is explicitly true).
@@ -2489,7 +2506,7 @@ async function syncDraftToRemote(draftStore, smtpService, imapService, draft) {
             // signature into the draft body themselves, got it appended a second time
             // on every remote sync.
             appendSignature: false,
-        });
+        }, /* preserveBcc */ true);
         const remoteDraft = await imapService.upsertRemoteDraft({
             raw,
             messageId: draft.draftMessageId,
@@ -4246,10 +4263,24 @@ export function createServer(config, options = {}) {
                     ]);
                 }
                 case "list_drafts": {
-                    // Scope limitation (follow-up round): stays scoped to the primary account's
-                    // drafts only — a non-primary account's drafts aren't listed here yet. Use
-                    // get_draft with that account's prefixed draftId if you already have one.
-                    const drafts = await draftStore.listDrafts(normalizeBoolean(args.includeSent, false));
+                    // Found live (external review): this stayed scoped to the primary
+                    // account's own drafts only — a draft created via create_draft(from:
+                    // secondary@example.com) is real and gettable by its prefixed draftId,
+                    // but never showed up here, so day-to-day draft discovery silently
+                    // missed every non-primary account's drafts. Now fans out across every
+                    // configured account, same pattern as list_scheduled_sends/
+                    // list_snoozed, and re-sorts the merged set by updatedAt (each
+                    // account's own list already arrives that way). Single-account guard
+                    // keeps byte-identical output for the common case.
+                    const includeSent = normalizeBoolean(args.includeSent, false);
+                    const allDrafts = accountManager.all().length === 1
+                        ? (await draftStore.listDrafts(includeSent)).map((draft) => ({ bundle: primaryBundle, draft }))
+                        : (await Promise.all(accountManager.all().map(async (bundle) => {
+                            const drafts = await bundle.draftStore.listDrafts(includeSent);
+                            return drafts.map((draft) => ({ bundle, draft: presentDraft(bundle, draft) }));
+                        })))
+                            .flat()
+                            .sort((left, right) => right.draft.updatedAt.localeCompare(left.draft.updatedAt));
                     // Found live (external review): every draft's full body was returned
                     // alongside the already-redacted attachments — confirmed live at ~261k
                     // tokens for 107 drafts. Bodies are now truncated the same way a
@@ -4258,15 +4289,15 @@ export function createServer(config, options = {}) {
                     // draft (just with truncated bodies/attachments), so this doesn't change
                     // behavior for a caller not using the new params.
                     const offset = normalizeLimit(args.offset, 0, 0, 10_000);
-                    const limit = typeof args.limit === "number" ? normalizeLimit(args.limit, drafts.length, 1, 10_000) : undefined;
-                    const page = limit !== undefined ? drafts.slice(offset, offset + limit) : drafts.slice(offset);
+                    const limit = typeof args.limit === "number" ? normalizeLimit(args.limit, allDrafts.length, 1, 10_000) : undefined;
+                    const page = limit !== undefined ? allDrafts.slice(offset, offset + limit) : allDrafts.slice(offset);
                     return createTextResult({
-                        total: drafts.length,
+                        total: allDrafts.length,
                         offset,
                         returned: page.length,
-                        hasMore: offset + page.length < drafts.length,
-                        drafts: page.map((draft) => truncateDraftBodyForResponse(redactDraftAttachmentsForListing(draft))),
-                    }, false, page.map(draftSource));
+                        hasMore: offset + page.length < allDrafts.length,
+                        drafts: page.map(({ draft }) => truncateDraftBodyForResponse(redactDraftAttachmentsForListing(draft))),
+                    }, false, page.map(({ draft }) => draftSource(draft)));
                 }
                 case "list_remote_drafts": {
                     // Scope limitation (follow-up round): stays scoped to the primary account's
@@ -4304,7 +4335,11 @@ export function createServer(config, options = {}) {
                     const to = args.to === undefined ? undefined : parseEmails(optionalString(args, "to"));
                     const cc = args.cc === undefined ? undefined : parseEmails(optionalString(args, "cc"));
                     const bcc = args.bcc === undefined ? undefined : parseEmails(optionalString(args, "bcc"));
-                    const replyTo = optionalString(args, "replyTo");
+                    // body/replyTo use optionalClearableString, not optionalString — see its
+                    // comment — so an explicit body:'' or replyTo:'' actually clears the
+                    // field instead of being silently treated as "field not provided".
+                    const body = optionalClearableString(args, "body");
+                    const replyTo = optionalClearableString(args, "replyTo");
                     const from = optionalString(args, "from");
                     const priority = optionalString(args, "priority");
                     const attachments = args.attachments === undefined ? undefined : optionalAttachmentList(args.attachments);
@@ -4329,7 +4364,7 @@ export function createServer(config, options = {}) {
                             cc,
                             bcc,
                             subject: optionalString(args, "subject"),
-                            body: optionalString(args, "body"),
+                            body,
                             isHtml: typeof args.isHtml === "boolean" ? args.isHtml : undefined,
                             priority: priority === "high" || priority === "low" || priority === "normal"
                                 ? priority
@@ -4401,6 +4436,22 @@ export function createServer(config, options = {}) {
                     ensureSendAllowed(config.runtime);
                     const { bundle: sendDraftBundle, rest: sendDraftIdRest } = resolveAccountForDraftId(requireString(args, "draftId"));
                     const draft = await sendDraftBundle.draftStore.getDraft(sendDraftIdRest);
+                    // Found live (external review): sendDraftBundle above is resolved from
+                    // the draftId's own account-slug prefix — i.e. where the draft is
+                    // STORED — which never changes just because update_draft later set a
+                    // different draft.from. Repro: create_draft on primary, then
+                    // update_draft(from: secondary@example.com), then send_draft — the
+                    // payload correctly carries "secondary@example.com", but it went out
+                    // through PRIMARY's live SMTP connection with that as a header
+                    // override, which a Split-Addresses config (separate login per
+                    // address) can reject outright instead of accepting as a plain alias.
+                    // sendBundleForDraft is resolved separately, same distinction
+                    // send_email/reply_to_email already draw between "where to read/store"
+                    // and "which account to actually send through" — draft storage,
+                    // claimForSending, markSent, and remote-draft cleanup all still use
+                    // sendDraftBundle (the draft doesn't move), only the SMTP call itself
+                    // uses the resolved account.
+                    const sendBundleForDraft = draft.from ? accountManager.byAddress(draft.from) ?? sendDraftBundle : sendDraftBundle;
                     // Found live: calling send_draft twice on the same draft sent it
                     // twice — nothing here checked whether it was already marked
                     // "sent" before sending again. Refuse; create_draft for a new
@@ -4468,7 +4519,7 @@ export function createServer(config, options = {}) {
                     const sendStartedAt = Date.now();
                     let result;
                     try {
-                        result = await sendDraftBundle.smtpService.sendEmail({
+                        result = await sendBundleForDraft.smtpService.sendEmail({
                             to: draft.to,
                             cc: draft.cc,
                             bcc: draft.bcc,
@@ -4540,15 +4591,27 @@ export function createServer(config, options = {}) {
                                 : undefined,
                         };
                     sentDraft = presentDraft(sendDraftBundle, remoteCleanup.draft);
+                    // Found live (external review): the send and markSent() above already
+                    // succeeded — this citation lookup is purely for the response's source
+                    // list, and used to throw uncaught if the original message had been
+                    // moved/deleted since the draft was created, reporting a false failure
+                    // for an email that had actually already been sent (and the draft
+                    // already marked "sent", so a caller who saw the error and retried
+                    // would correctly hit the already-sent guard above — but with no way to
+                    // know the first attempt had, in fact, worked). Best-effort, same as
+                    // verifySentCopy just below.
                     const sources = [draftSource(sentDraft)];
                     if (sentDraft.sourceEmailId) {
-                        sources.push(emailSource(await sendDraftBundle.imapService.getEmailById(sentDraft.sourceEmailId)));
+                        try {
+                            sources.push(emailSource(await sendDraftBundle.imapService.getEmailById(sentDraft.sourceEmailId)));
+                        }
+                        catch (_) { }
                     }
                     let sentCopyTokenDraft = "[sent-copy:unverified]";
                     try {
                         const verifyMsgId = result.messageId;
                         if (verifyMsgId) {
-                            const scv = await verifySentCopy(sendDraftBundle.imapService, verifyMsgId);
+                            const scv = await verifySentCopy(sendBundleForDraft.imapService, verifyMsgId);
                             if (scv.found)
                                 sentCopyTokenDraft = "[sent-copy:verified]";
                         }
@@ -4570,6 +4633,13 @@ export function createServer(config, options = {}) {
                     ensureSendAllowed(config.runtime);
                     const { bundle: scheduleDraftBundle, rest: scheduleDraftIdRest } = resolveAccountForDraftId(requireString(args, "draftId"));
                     const draft = await scheduleDraftBundle.draftStore.getDraft(scheduleDraftIdRest);
+                    // Same fix as send_draft's identical sendBundleForDraft — see its
+                    // comment. The delivery queue fires via whichever account's own
+                    // deliveryQueueService it was enqueued into, so this must be the
+                    // account draft.from actually names, not always the draft's storage
+                    // account — used consistently below for both the duplicate-schedule
+                    // check and the enqueue call itself, so both look at the same queue.
+                    const sendBundleForScheduleDraft = draft.from ? accountManager.byAddress(draft.from) ?? scheduleDraftBundle : scheduleDraftBundle;
                     // Mirrors send_draft's own pendingScheduled guard, for the reverse
                     // ordering: send_draft already delivered this draft once, and
                     // scheduling it again here would deliver it a second time at
@@ -4594,9 +4664,9 @@ export function createServer(config, options = {}) {
                     // duplicate. This external check is kept only as an optional
                     // early-exit optimization to avoid a wasted round-trip to the lock
                     // in the common non-racing case.
-                    const alreadyPendingScheduled = (await scheduleDraftBundle.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
+                    const alreadyPendingScheduled = (await sendBundleForScheduleDraft.deliveryQueueService.list()).find((record) => record.sourceDraftId === draft.id && record.status === "pending");
                     if (alreadyPendingScheduled) {
-                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(scheduleDraftBundle), alreadyPendingScheduled.id)}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
+                        throw new McpError(ErrorCode.InvalidParams, `This draft already has a pending scheduled send (id ${withAccountPrefix(responseSlug(sendBundleForScheduleDraft), alreadyPendingScheduled.id)}, sendAt ${alreadyPendingScheduled.sendAt}). Scheduling it again would deliver it twice. Cancel the existing one with cancel_send first if you want a different sendAt.`);
                     }
                     const sendAt = requireString(args, "sendAt");
                     const sendAtTime = new Date(sendAt).getTime();
@@ -4620,7 +4690,7 @@ export function createServer(config, options = {}) {
                         if (external.length > 0)
                             throw new McpError(ErrorCode.InvalidParams, "PROTONMAIL_RESTRICT_OUTBOUND_TO_SELF is enabled. All recipients must be the authenticated user.");
                     }
-                    const queued = await withAudit(auditService, name, args, async () => scheduleDraftBundle.deliveryQueueService.enqueue({
+                    const queued = await withAudit(auditService, name, args, async () => sendBundleForScheduleDraft.deliveryQueueService.enqueue({
                         to: draft.to,
                         cc: draft.cc,
                         bcc: draft.bcc,
@@ -4639,7 +4709,7 @@ export function createServer(config, options = {}) {
                     }, new Date(sendAtTime).toISOString(), "scheduled_send", draft.id));
                     return createTextResult({
                         queued: true,
-                        id: withAccountPrefix(responseSlug(scheduleDraftBundle), queued.id),
+                        id: withAccountPrefix(responseSlug(sendBundleForScheduleDraft), queued.id),
                         draftId: withAccountPrefix(responseSlug(scheduleDraftBundle), draft.id),
                         sendAt: queued.sendAt,
                         note: "The draft's content was snapshotted now and queued. This server must stay running for the send to fire at sendAt — if restarted first, it fires on next startup instead. The draft record itself is not automatically marked sent; use cancel_send with this id to abort before it fires.",
@@ -4770,10 +4840,20 @@ export function createServer(config, options = {}) {
                     }
                     const preferHtml = normalizeBoolean(args.preferHtml, false);
                     const maxBodyLength = normalizeLimit(args.maxBodyLength, undefined, 1, 500_000);
+                    // Found live (external review): every id went straight to the primary
+                    // account's imapService regardless of its own "<slug>::" prefix, so a
+                    // non-primary account's id in the list either resolved the wrong
+                    // message on primary or (more often) just failed to be found — the
+                    // list [primaryId, secondary::id] reported succeeded:1 instead of 2.
+                    // Each id is now resolved to its own account first, same as every
+                    // other emailId-taking tool, and the returned id keeps its prefix.
                     const results = await Promise.all(emailIds.map(async (emailId) => {
                         try {
-                            const detail = await imapService.getEmailById(emailId);
-                            return { emailId, ok: true, email: formatEmailDetailOutput(detail, preferHtml, maxBodyLength) };
+                            const { bundle, rest } = resolveAccountForEmailId(emailId);
+                            const detail = await bundle.imapService.getEmailById(rest);
+                            const output = formatEmailDetailOutput(detail, preferHtml, maxBodyLength);
+                            output.id = prefixedIdFor(bundle, detail.id);
+                            return { emailId, ok: true, email: output };
                         }
                         catch (error) {
                             return { emailId, ok: false, error: error instanceof Error ? error.message : String(error) };