proton-mail-bridge-client 2.10.0 → 2.12.0

package/README.md

@@ -35,8 +35,8 @@ Give Claude Desktop (or Cline, or any MCP client) full access to your Proton Mai
 > **No terminal?** Follow the [step-by-step guide](docs/install-for-non-developers.md) instead.
 
 1. **Install and sign in to [Proton Mail Bridge](https://proton.me/mail/bridge)**, and leave it running. In the Bridge app, open your account and copy the **Bridge password** (it is not your Proton password).
-2. **Connect Claude Desktop**, either way:
-   - **Bundle:** download the `proton-mail-bridge-client-<your-os>.mcpb` for macOS (`darwin-arm64` Apple silicon, `darwin-x64` Intel), Linux (`linux-x64`, `linux-arm64`) or Windows (`win32-x64`) from the [latest release](https://github.com/googlarz/proton-mail-bridge-client/releases/latest) and open it. Claude Desktop asks for your Proton address and the Bridge password, plus optional settings (Bridge IMAP/SMTP host and port, read-only, allow sending, signature, extra accounts, data and download folders, tool tier); the defaults match a standard Bridge install.
+2. **Connect Claude Desktop**, either way (quit Claude Desktop completely first, so it does not overwrite the config on exit):
+   - **Bundle** (needs Node.js 24 or later on the machine): download the `proton-mail-bridge-client-<your-os>.mcpb` for macOS (`darwin-arm64` Apple silicon, `darwin-x64` Intel), Linux (`linux-x64`, `linux-arm64`) or Windows (`win32-x64`) from the [latest release](https://github.com/googlarz/proton-mail-bridge-client/releases/latest) and open it. Claude Desktop asks for your Proton address and the Bridge password, plus optional settings (Bridge IMAP/SMTP host and port, read-only, allow sending, signature, extra accounts, data and download folders, tool tier); the defaults match a standard Bridge install.
    - **npm:** `npm install -g proton-mail-bridge-client`, then `proton-mail-bridge-client setup-claude-desktop` (it checks your Bridge ports and writes the config). Fully quit and reopen Claude Desktop afterwards.
 3. **Check it works:** run `proton-mail-bridge-client doctor`, or ask Claude "run the Proton Mail doctor".
 4. **Try these prompts:**
@@ -81,7 +81,7 @@ Download: [proton.me/mail/bridge](https://proton.me/mail/bridge)
 
 **3. Your Bridge credentials** — from the Bridge app:
 - IMAP host/port (default: `127.0.0.1:1143`)
-- SMTP host/port (default: `127.0.0.1:1025`)
+- SMTP host/port (default: `127.0.0.1:1025`); the IMAP and SMTP password is the same Bridge password
 - Username (your Proton email address)
 - Bridge password (see note above)
 
@@ -290,11 +290,11 @@ Reload the Cline extension after saving. Proton Mail tools will appear in Cline'
 
 ## Multi-account support (v2.1.0+)
 
-Support multiple Proton Mail addresses configured in Bridge (using Bridge's **Split Addresses** feature). Each address gets its own isolated service stack, local index, and drafts storage.
+Use more than one Proton mailbox from the same server: either several addresses of one account (Bridge's **Split Addresses** feature) or separate Proton accounts signed in to the same Bridge. Each one gets its own isolated service stack, local index, and drafts storage.
 
 ### Setup
 
-First, enable **Split Addresses** in Proton Bridge and configure each address as a separate account. Bridge will generate a separate password for each address. Then set `PROTONMAIL_ACCOUNTS_JSON`:
+In Proton Bridge, make each address or account its own login: with **Split Addresses** on, every address has a login; separate accounts each have their own. Bridge generates a separate password for each login, and the same password works for IMAP and SMTP. The first account is `PROTONMAIL_USERNAME` / `PROTONMAIL_PASSWORD`; **`PROTONMAIL_ACCOUNTS_JSON` lists only the additional ones**, as a JSON array on one line:
 
 ```json
 {
@@ -304,27 +304,22 @@ First, enable **Split Addresses** in Proton Bridge and configure each address as
       "env": {
         "PROTONMAIL_USERNAME": "primary@proton.me",
         "PROTONMAIL_PASSWORD": "primary-bridge-password",
-        "PROTONMAIL_IMAP_HOST": "127.0.0.1",
-        "PROTONMAIL_IMAP_PORT": "1143",
-        "PROTONMAIL_IMAP_SECURE": "false",
-        "PROTONMAIL_SMTP_HOST": "127.0.0.1",
-        "PROTONMAIL_SMTP_PORT": "1025",
-        "PROTONMAIL_ACCOUNTS_JSON": "[
-          { \"address\": \"primary@proton.me\", \"password\": \"primary-bridge-password\" },
-          { \"address\": \"alias@proton.me\", \"password\": \"alias-bridge-password\" },
-          { \"address\": \"business@custom.com\", \"password\": \"business-bridge-password\" }
-        ]"
+        "PROTONMAIL_ACCOUNTS_JSON": "[{\"address\": \"alias@proton.me\", \"password\": \"alias-bridge-password\"}, {\"address\": \"business@custom.com\", \"password\": \"business-bridge-password\"}]"
       }
     }
   }
 }
 ```
 
-**Note:** The password is the **Bridge password for each address**, not your Proton account password. Bridge generates a unique password for each Split Address.
+Instead of `password` an entry can use `passwordFile` (path to a file with the Bridge password) or `passwordCommand` (a command that prints it), so the password need not sit in the client config; use only one of the three. `autoSyncFolder` sets that account's folders for background sync (default `PROTONMAIL_AUTO_SYNC_FOLDER`). Folders in a list that an account does not have are skipped and reported as `skippedFolders`.
+
+Listing the primary address again is refused at startup ("duplicate address"). Host, ports and the TLS mode default to the primary account's; an entry can override them with `imapHost`, `imapPort`, `imapSecure`, `smtpHost`, `smtpPort` and `smtpSecure`.
+
+**Note:** The password is the **Bridge password for each login**, not your Proton account password.
 
 ### How it works
 
-- **Primary account:** the first entry in `PROTONMAIL_ACCOUNTS_JSON` (or the main `PROTONMAIL_USERNAME`/`PROTONMAIL_PASSWORD` pair if not set). Email IDs from the primary account have no prefix.
+- **Primary account:** the `PROTONMAIL_USERNAME`/`PROTONMAIL_PASSWORD` pair. Email IDs from the primary account have no prefix.
 - **Additional accounts:** each has an auto-generated slug (e.g., `alias`, `business`). Email IDs carry an account prefix: `alias::message-id`, `business::message-id`.
 - **Sending:** `send_email`, `reply_to_email`, etc. route through the account matching the `from` address. If no account matches, the primary connection is used with a header override (for non-configured aliases).
 - **Search and read:** all read tools (search, threads, analytics, digest) automatically fan out across all configured accounts and merge results, preserving the account prefix in returned IDs.
@@ -484,7 +479,7 @@ PROTONMAIL_IMAP_PORT='1143'
 PROTONMAIL_IMAP_SECURE='false'
 PROTONMAIL_SMTP_HOST='127.0.0.1'
 PROTONMAIL_SMTP_PORT='1025'
-PROTONMAIL_SMTP_SECURE='true'         # Bridge's local SMTP port requires implicit TLS from the first byte; set false only for a non-Bridge SMTP relay
+PROTONMAIL_SMTP_SECURE='true'         # true = implicit TLS, false = STARTTLS. Unset, the server tries the other mode itself if Bridge's SMTP mode differs
 PROTONMAIL_IMAP_USERNAME=''           # optional: log in to IMAP as a different user than PROTONMAIL_USERNAME (default: the same). The send identity, and RESTRICT_OUTBOUND_TO_SELF, still use PROTONMAIL_USERNAME.
 PROTONMAIL_IMAP_PASSWORD=''           # optional: a different IMAP password than PROTONMAIL_PASSWORD (default: the same)
 
@@ -528,6 +523,11 @@ PROTONMAIL_SYNC_INTERVAL_MINUTES='5'
 PROTONMAIL_IDLE_WATCH='true'
 PROTONMAIL_IDLE_MAX_SECONDS='30'
 
+# Attachments
+PROTONMAIL_MAX_INLINE_KB='40'         # in KB (older name PROTONMAIL_MAX_INLINE_BYTES still works, also in KB): largest attachment get_attachment_content returns inline as base64
+PROTONMAIL_PDF_MAX_MB='10'            # largest PDF get_attachment_text extracts text from (1-100 MB); bigger ones are refused with a message
+PROTONMAIL_PDF_MAX_PAGES='50'         # pages get_attachment_text reads from a PDF (1-2000); a longer PDF is cut off with a note saying how many pages are missing
+
 # Tuning and diagnostics
 PROTONMAIL_OP_DELAY_MS='0'            # minimum gap in ms between IMAP mailbox operations (0-5000); raise it to be gentler on a slow Bridge. 0 = no throttling
 PROTONMAIL_DEBUG='false'              # true: get_connection_status and run_doctor include the raw underlying connection error text (otherwise only a classified cause and suggestion)
@@ -548,7 +548,7 @@ With several accounts or a signature, the server sends from whichever `from` the
 | Search and read | Native Claude UX | IMAP + local index |
 | Send email | No | Yes |
 | Draft workflows | Better first-party UX | Full control incl. remote draft sync |
-| Attachment content | Limited | Fetch and save to disk |
+| Attachment content | Limited | Fetch, save to disk, read text from PDFs |
 | Mailbox actions | Limited | Full (star, move, archive, trash, restore, delete, batch) |
 | Folder management | No | Yes (create, rename, delete) |
 | CLI access | No | Full parity with MCP |
@@ -594,6 +594,8 @@ With several accounts or a signature, the server sends from whichever `from` the
 ### Import/export & attachments
 `export_email` · `import_email` · `get_attachment_text` · `get_emails_by_ids`
 
+`get_attachment_text` reads text-like attachments and PDFs. A PDF comes back page by page, each page headed `--- Page N of M ---`, and the result has a `pdf` field with `totalPages`, `extractedPages`, `omittedPages` and `truncated`. It is limited by `PROTONMAIL_PDF_MAX_MB` (default 10) and `PROTONMAIL_PDF_MAX_PAGES` (default 50); past the page limit the text ends with a line saying how many pages were left out. A password-protected PDF, a damaged file and a scan without a text layer each fail with a short explanation. The PDF is read in memory with [unpdf](https://github.com/unjs/unpdf) (pure JavaScript, no native module): nothing is written to disk, nothing is downloaded, and a document that takes longer than 30 seconds is stopped.
+
 ---
 
 ## Using it as a library
@@ -666,7 +668,7 @@ Measured in October 2026 (v2.7.0) on a copy of the same ~57,000-message index. "
 - List and search results are compact by default: attachments are metadata only, and empty or derivable fields are left out. Pass `fields: ["subject","from","date"]` to trim further — 10 results is roughly 800 tokens that way, versus about 11,000 for 50 full results.
 - Defaults are bounded: `search_emails`/`search_indexed_emails` return 50 (pass `limit` for more), `list_drafts` 20, `list_scheduled_sends` 50 newest first. Each reports `hasMore`; page with `offset`.
 - Draft and queued-message bodies are shortened to a preview in list and update responses (`bodyTruncated`, `bodyLength`); use `get_draft` for one full draft. Attachment content is never inlined in a listing.
-- Large attachments: set `PROTONMAIL_ALLOW_FILE_DOWNLOAD_DIR` and pass `saveTo`, rather than raising `PROTONMAIL_MAX_INLINE_BYTES`.
+- Large attachments: set `PROTONMAIL_ALLOW_FILE_DOWNLOAD_DIR` and pass `saveTo`, rather than raising `PROTONMAIL_MAX_INLINE_KB`.
 - **`PROTONMAIL_TOOL_TIER=core`** exposes 25 tools instead of 100: about 7k tokens of tool definitions instead of about 21k (roughly 67% less; the earlier measurement with a reference tokenizer, 7k against 20k for 96 tools, scaled by the 3.7% the four newest tool definitions add), paid on every conversation that loads the server.
 - Repeating an `update_draft` that changes nothing on a draft whose remote copy is already in sync does no store write and no IMAP upload. (A draft whose last sync failed, or that was edited with `syncToRemote:false`, still syncs.)
 
@@ -693,6 +695,7 @@ To check a real Bridge yourself, run the read-only smoke test: `PROTONMAIL_USERN
 - `get_emails` and `search_emails` return a composite `emailId` — use it for all subsequent reads and actions.
 - `search_indexed_emails` supports `from:`, `to:`, `subject:`, `label:`, `domain:` shortcuts.
 - The local index lives at `PROTONMAIL_DATA_DIR/mail-index.sqlite`. Background sync and IMAP IDLE keep it warm.
+- **Several clients at once.** Every MCP client starts its own server. Per data directory, only one of them runs the background sync and the IDLE watch (it holds `background-sync.lock`); the others serve tools from the index and take over when it exits. `get_runtime_status` shows `backgroundSync.leader`. A manual `sync_emails` / `run_background_sync` always runs.
 - Filters on the local index ignore case and accents, and match spelling variants: `Müller` finds `Mueller`, `lodz` finds `Łódź`, `strasse` finds `Straße`. Live `search_emails` and `count_messages` go through Bridge: a query with umlauts or other non-ASCII letters also matches the spelled-out form (`Müller` finds `Mueller`), but a plain ASCII query is sent as typed, so `Mueller` does not find `Müller` there. Use `search_indexed_emails` for that.
 - Audit logs live at `PROTONMAIL_DATA_DIR/audit.log`.
 - Draft sync is best-effort — the local draft is always preserved even if remote sync fails.

package/dist/cli.d.ts

@@ -24,6 +24,10 @@ export declare function completionCommands(): Array<{
 export declare function completionScript(shell: string): string;
 export declare function commandHelpText(command: string): string | undefined;
 export declare function toolResultExitCode(toolName: string, result: Record<string, unknown>): number;
+export declare function diagnoseConnectionFailure(reason: unknown): {
+    cause: string;
+    suggestion: string;
+} | undefined;
 interface ToolOnlyCommand {
     command: string;
     tool: string;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA8BA,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;CACjB;AAiBD,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAM3C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAuD1D;AA0ID,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAoErD,CAAC;AAoBF,eAAO,MAAM,iBAAiB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAGlE,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAQlG;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA+DtD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcnE;AAyKD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAY5F;AAk0CD,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IAIb,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAmE/C,CAAC;AA2EF,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAqO1C;AA4ED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA8BA,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;CACjB;AAiBD,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAM3C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAuD1D;AA0ID,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAoErD,CAAC;AAoBF,eAAO,MAAM,iBAAiB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAGlE,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAQlG;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA+DtD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcnE;AAyKD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAY5F;AAiND,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAiB5G;AAupCD,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IAIb,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAmE/C,CAAC;AA2EF,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAqO1C;AA4ED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}

package/dist/cli.js

@@ -8,7 +8,7 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { buildConfigFromEnv, createServer, withAudit } from "./index.js";
 import { isMainModule } from "./is-main.js";
-import { SimpleIMAPService } from "./services/simple-imap-service.js";
+import { isLikelyAuthenticationError, isLikelyConnectionError, isLikelyTlsMismatchError, SimpleIMAPService } from "./services/simple-imap-service.js";
 import { ensureDestructiveConfirmed, ensureEmailActionAllowed, ensureMailboxWriteAllowed, sanitizeRuntimeConfig } from "./utils/runtime-policy.js";
 import { isValidEmail, parseEmails } from "./utils/helpers.js";
 import { buildSchedule, defaultSchedulerSystem, findStableAlias, parseTimeOfDay, SCHEDULER_SYSTEMS } from "./utils/schedule-templates.js";
@@ -235,9 +235,9 @@ export const COMMAND_SPECS = {
     "setup-claude-desktop": { usage: "setup-claude-desktop", description: "Run the Claude Desktop setup wizard (works from any install)", flags: [] },
     claude: { usage: "claude <setup|install|check|update|doctor>", description: "Claude Desktop integration: setup wizard, install or update the runtime, check status (update is an alias for install, doctor for check)", flags: [] },
     status: { usage: "status", description: "Show local config, index, runtime, and Claude Desktop status", flags: [] },
-    doctor: { usage: "doctor", description: "Verify IMAP, SMTP, and Claude Desktop wiring (exits 1 when the check fails)", flags: [] },
+    doctor: { usage: "doctor [--account <slug|address>]", description: "Verify IMAP, SMTP, and Claude Desktop wiring for every account, or one (exits 1 when the check fails)", flags: ["account"] },
     "connection-status": { usage: "connection-status", description: "Show live IMAP/SMTP connectivity state (exits 1 when either is unreachable)", flags: [] },
-    "runtime-status": { usage: "runtime-status", description: "Show runtime policy and background sync state", flags: [] },
+    "runtime-status": { usage: "runtime-status [--account <slug|address>]", description: "Show runtime policy and background sync state, per account", flags: ["account"] },
     sync: { usage: "sync [--folder <name>] [--limit <n>] [--full]", description: "Refresh the local index from Proton Bridge", flags: ["folder", "limit", "full", "no-attachment-text"] },
     "index-status": { usage: "index-status", description: "Show local index health and freshness", flags: [] },
     folders: { usage: "folders", description: "List available folders from Proton Bridge", flags: [] },
@@ -577,7 +577,11 @@ async function withMcpClient(run) {
     const transport = new StdioClientTransport({
         command: process.execPath,
         args: [cliEntryPath()],
-        env: Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
+        env: {
+            ...Object.fromEntries(Object.entries(process.env).filter((entry) => typeof entry[1] === "string")),
+            // The CLI reports a failed tool on stderr with its own exit codes; MCP clients get an isError result instead.
+            PROTONMAIL_TOOL_ERRORS: "protocol",
+        },
         stderr: "ignore",
     });
     const client = new Client({
@@ -651,10 +655,23 @@ async function withServices(run) {
         return await run({ config, ...services });
     }
     finally {
-        services.backgroundSyncService.stop();
-        await Promise.allSettled([services.imapService.disconnect(), services.smtpService.close()]);
+        for (const bundle of services.accountManager.all()) {
+            bundle.backgroundSyncService.stop();
+            await Promise.allSettled([bundle.imapService.disconnect(), bundle.smtpService.close()]);
+        }
     }
 }
+// --account picks one account (slug or address); without it, every configured account.
+function selectAccountBundles(accountManager, parsed) {
+    const wanted = getStringFlag(parsed.flags, "account");
+    if (!wanted)
+        return accountManager.all();
+    const bundle = accountManager.byAddress(wanted) ?? accountManager.all().find((entry) => entry.account.slug === wanted);
+    if (!bundle) {
+        throw new CliUsageError(`Unknown account "${wanted}". Configured: ${accountManager.all().map((entry) => entry.account.slug).join(", ")}`);
+    }
+    return [bundle];
+}
 async function syncIndex(context, input) {
     const snapshot = await context.imapService.collectEmailsForIndex({
         ...input,
@@ -736,41 +753,71 @@ async function runStatus(parsed) {
         process.stdout.write(wantJson ? json(result) : renderStatus(result));
     });
 }
+// Same classification as the run_doctor tool, so the CLI explains a failure instead of printing the raw error.
+export function diagnoseConnectionFailure(reason) {
+    if (isLikelyAuthenticationError(reason)) {
+        return {
+            cause: "authentication_failed",
+            suggestion: "PROTONMAIL_PASSWORD must be the Bridge password (Bridge app -> account -> Mailbox details), not your Proton account password.",
+        };
+    }
+    if (isLikelyTlsMismatchError(reason)) {
+        return {
+            cause: "tls_mismatch",
+            suggestion: "TLS handshake failed: PROTONMAIL_IMAP_SECURE / PROTONMAIL_SMTP_SECURE probably does not match the connection mode of that port in Bridge (implicit TLS vs STARTTLS).",
+        };
+    }
+    if (isLikelyConnectionError(reason)) {
+        return { cause: "bridge_unreachable", suggestion: "Bridge is not reachable: check that it is running and that the host and ports match Bridge's Mailbox details." };
+    }
+    return undefined;
+}
 async function runDoctor(parsed) {
     const wantJson = isTruthyFlag(parsed.flags.json);
-    await withServices(async ({ config, smtpService, imapService, localIndexService }) => {
-        const [claudeDesktop, index] = await Promise.all([
-            getClaudeDesktopInstallStatus(),
-            localIndexService.getStatus(),
-        ]);
-        let imapOk = false;
-        let smtpOk = false;
-        let folderCount = 0;
-        let error;
-        try {
-            await imapService.ping();
-            imapOk = true;
-            folderCount = (await imapService.getFolders(true)).length;
-            await smtpService.verifyConnection();
-            smtpOk = true;
-        }
-        catch (err) {
-            error = err instanceof Error ? err.message : String(err);
-        }
+    await withServices(async ({ accountManager }) => {
+        const bundles = selectAccountBundles(accountManager, parsed);
+        const checked = await Promise.all(bundles.map(async (bundle) => {
+            let imapOk = false;
+            let smtpOk = false;
+            let folderCount = 0;
+            let error;
+            let diagnosis;
+            try {
+                await bundle.imapService.ping();
+                imapOk = true;
+                folderCount = (await bundle.imapService.getFolders(true)).length;
+                await bundle.smtpService.verifyConnection();
+                smtpOk = true;
+            }
+            catch (err) {
+                error = err instanceof Error ? err.message : String(err);
+                diagnosis = diagnoseConnectionFailure(err);
+            }
+            return {
+                slug: bundle.account.slug,
+                account: bundle.config.smtp.username,
+                ok: imapOk && smtpOk,
+                imapOk,
+                smtpOk,
+                folderCount,
+                indexUpdatedAt: (await bundle.localIndexService.getStatus()).updatedAt,
+                error,
+                ...(diagnosis ? { cause: diagnosis.cause, suggestion: diagnosis.suggestion } : {}),
+            };
+        }));
+        const claudeDesktop = await getClaudeDesktopInstallStatus();
+        const { slug: _slug, ...firstFields } = checked[0];
         const result = {
-            ok: imapOk && smtpOk,
             // A stale/orphaned install elsewhere on disk (wrong path, old
             // version) looks identical to a fresh one on every other field
             // above — this is the field that actually distinguishes them.
             version: await getPkgVersion(),
             entrypoint: cliEntryPath(),
-            account: config.smtp.username,
-            imapOk,
-            smtpOk,
-            folderCount,
-            indexUpdatedAt: index.updatedAt,
+            ...firstFields,
+            // Top-level fields describe the first account shown; ok covers all of them.
+            ok: checked.every((entry) => entry.ok),
             claudeDesktopInstalled: claudeDesktop.installed,
-            error,
+            ...(checked.length > 1 ? { accounts: checked } : {}),
         };
         process.stdout.write(wantJson ? json(result) : `${result.ok ? "Doctor OK" : "Doctor failed"}\n${json(result)}`);
         if (!result.ok)
@@ -814,16 +861,23 @@ async function runConnectionStatus(parsed) {
 }
 async function runRuntimeStatus(parsed) {
     const wantJson = isTruthyFlag(parsed.flags.json);
-    await withServices(async ({ config, backgroundSyncService, draftStore, localIndexService }) => {
-        const result = {
-            account: config.smtp.username,
-            runtime: sanitizeRuntimeConfig(config.runtime),
-            backgroundSync: backgroundSyncService.getStatus(),
-            localIndex: await localIndexService.getStatus(),
+    await withServices(async ({ accountManager }) => {
+        const bundles = selectAccountBundles(accountManager, parsed);
+        const perAccount = await Promise.all(bundles.map(async (bundle) => ({
+            slug: bundle.account.slug,
+            account: bundle.config.smtp.username,
+            runtime: sanitizeRuntimeConfig(bundle.config.runtime),
+            backgroundSync: bundle.backgroundSyncService.getStatus(),
+            localIndex: await bundle.localIndexService.getStatus(),
             drafts: {
-                total: (await draftStore.listDrafts(true)).length,
-                active: (await draftStore.listDrafts(false)).length,
+                total: (await bundle.draftStore.listDrafts(true)).length,
+                active: (await bundle.draftStore.listDrafts(false)).length,
             },
+        })));
+        const { slug: _slug, ...firstFields } = perAccount[0];
+        const result = {
+            ...firstFields,
+            ...(perAccount.length > 1 ? { accounts: perAccount } : {}),
         };
         process.stdout.write(wantJson ? json(result) : `${JSON.stringify(result, null, 2)}\n`);
     });