proton-mail-bridge-client 2.12.0 → 2.13.1

package/README.md

@@ -288,6 +288,20 @@ Reload the Cline extension after saving. Proton Mail tools will appear in Cline'
 
 ---
 
+## Running in Docker (headless machines)
+
+For a server with no desktop, next to a headless Bridge. The image installs the published npm package and is published for each release to `ghcr.io/googlarz/proton-mail-bridge-client` (`:<version>` and `:latest`, linux/amd64 and linux/arm64). To build it yourself from this repo:
+
+```bash
+docker build -f docker/Dockerfile --build-arg VERSION=2.13.1 -t proton-mail-bridge-client .
+docker run -i --rm --network host \
+  -e PROTONMAIL_USERNAME=you@proton.me -e PROTONMAIL_PASSWORD_FILE=/run/secrets/bridge \
+  -v /path/to/bridge-password:/run/secrets/bridge:ro -v bridge-client-data:/data \
+  proton-mail-bridge-client
+```
+
+`docker run -i` speaks MCP over stdio. The container must reach Bridge's IMAP and SMTP ports (`--network host`, or `--network container:<bridge>` to share Bridge's network). The CLI is in the same image: add `--entrypoint proton-mail-bridge-client` and a command such as `doctor`. If Bridge is reached by a host name (for example `host.docker.internal` or another container), its self-signed certificate fails verification: export it from Bridge and point `PROTONMAIL_TLS_CA_FILE` at it, or list the name in `PROTONMAIL_TLS_INSECURE_HOSTS`. The server has no network transport of its own; reaching it from a remote client needs your own wrapper. The image was checked to build, report its version, run as a non-root user and answer an MCP `initialize`; it has not been run against a real Bridge.
+
 ## Multi-account support (v2.1.0+)
 
 Use more than one Proton mailbox from the same server: either several addresses of one account (Bridge's **Split Addresses** feature) or separate Proton accounts signed in to the same Bridge. Each one gets its own isolated service stack, local index, and drafts storage.
@@ -524,6 +538,9 @@ PROTONMAIL_IDLE_WATCH='true'
 PROTONMAIL_IDLE_MAX_SECONDS='30'
 
 # Attachments
+PROTONMAIL_TLS_CA_FILE=''              # PEM file with Bridge's exported certificate: trusted when Bridge is reached by a name other than localhost (another container, another machine)
+PROTONMAIL_TLS_INSECURE_HOSTS=''      # comma-separated host names whose certificate is not verified, like localhost is (only for a private network you trust)
+PROTONMAIL_SHORTEN_LINKS='false'     # true = long tracking links in Markdown bodies become host/… (unsubscribe, confirm, reset links are kept)
 PROTONMAIL_MAX_INLINE_KB='40'         # in KB (older name PROTONMAIL_MAX_INLINE_BYTES still works, also in KB): largest attachment get_attachment_content returns inline as base64
 PROTONMAIL_PDF_MAX_MB='10'            # largest PDF get_attachment_text extracts text from (1-100 MB); bigger ones are refused with a message
 PROTONMAIL_PDF_MAX_PAGES='50'         # pages get_attachment_text reads from a PDF (1-2000); a longer PDF is cut off with a note saying how many pages are missing

package/dist/cli.d.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import type { ProtonMailConfig } from "./types/index.js";
 type CliFlags = Record<string, string | boolean>;
 export interface ParsedCliArgs {
     command: string;
@@ -28,6 +29,15 @@ export declare function diagnoseConnectionFailure(reason: unknown): {
     cause: string;
     suggestion: string;
 } | undefined;
+export declare function maskAddress(address: string): string;
+export declare function reportRuntime(runtime: ProtonMailConfig["runtime"], home?: string): Record<string, unknown>;
+export declare function watchHealthNotice(previous: string | undefined, error: unknown): {
+    cause: string | undefined;
+    notice?: {
+        title: string;
+        body: string;
+    };
+};
 interface ToolOnlyCommand {
     command: string;
     tool: string;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA8BA,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;CACjB;AAiBD,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAM3C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAuD1D;AA0ID,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAoErD,CAAC;AAoBF,eAAO,MAAM,iBAAiB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAGlE,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAQlG;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA+DtD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcnE;AAyKD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAY5F;AAiND,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAiB5G;AAupCD,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IAIb,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAmE/C,CAAC;AA2EF,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAqO1C;AA4ED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAaA,OAAO,KAAK,EAAgB,gBAAgB,EAAqB,MAAM,kBAAkB,CAAC;AAoB1F,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,QAAQ,CAAC;CACjB;AAiBD,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAM3C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CAuD1D;AA0ID,UAAU,WAAW;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAqErD,CAAC;AAoBF,eAAO,MAAM,iBAAiB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAGlE,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAQlG;AAID,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA+DtD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcnE;AAyKD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAY5F;AAiND,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAiB5G;AA+FD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGnD;AAGD,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,SAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS7G;AA01BD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,OAAO,GACb;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAYzE;AAySD,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IAIb,SAAS,CAAC,EAAE,MAAM,CAAC;IAMnB,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAmE/C,CAAC;AA2EF,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAoP1C;AA4ED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}

package/dist/cli.js

@@ -2,6 +2,7 @@
 import { execFile } from "node:child_process";
 import { accessSync, constants as fsConstants, realpathSync } from "node:fs";
 import { readFile } from "node:fs/promises";
+import { homedir, release as osRelease } from "node:os";
 import { promisify } from "node:util";
 import { fileURLToPath } from "node:url";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -11,6 +12,8 @@ import { isMainModule } from "./is-main.js";
 import { isLikelyAuthenticationError, isLikelyConnectionError, isLikelyTlsMismatchError, SimpleIMAPService } from "./services/simple-imap-service.js";
 import { ensureDestructiveConfirmed, ensureEmailActionAllowed, ensureMailboxWriteAllowed, sanitizeRuntimeConfig } from "./utils/runtime-policy.js";
 import { isValidEmail, parseEmails } from "./utils/helpers.js";
+import { checkForUpdate } from "./utils/update-check.js";
+import { healthProblems } from "./utils/health.js";
 import { buildSchedule, defaultSchedulerSystem, findStableAlias, parseTimeOfDay, SCHEDULER_SYSTEMS } from "./utils/schedule-templates.js";
 import { getClaudeDesktopInstallStatus } from "./scripts/check-claude-desktop.js";
 import { installClaudeDesktopConfig } from "./scripts/install-claude-desktop.js";
@@ -231,12 +234,13 @@ export const COMMAND_SPECS = {
     completion: { usage: "completion <zsh|bash|fish>", description: "Print a shell completion script for the commands and their flags", flags: [] },
     schedule: { usage: "schedule [--at HH:MM] [--system launchd|systemd|cron|schtasks] [--output <file>] [--password-file <file>]", description: "Print the scheduler definition that runs `digest` every day, with the commands to switch it on (installs nothing)", flags: ["at", "system", "output", "password-file"] },
     help: { usage: "help [command]", description: "Show the command list, or the help for one command", flags: [] },
-    version: { usage: "version", description: "Print the version and exit", flags: [] },
+    version: { usage: "version [--check]", description: "Print the version and exit; --check also asks the npm registry whether a newer release exists", flags: ["check"] },
     "setup-claude-desktop": { usage: "setup-claude-desktop", description: "Run the Claude Desktop setup wizard (works from any install)", flags: [] },
     claude: { usage: "claude <setup|install|check|update|doctor>", description: "Claude Desktop integration: setup wizard, install or update the runtime, check status (update is an alias for install, doctor for check)", flags: [] },
     status: { usage: "status", description: "Show local config, index, runtime, and Claude Desktop status", flags: [] },
-    doctor: { usage: "doctor [--account <slug|address>]", description: "Verify IMAP, SMTP, and Claude Desktop wiring for every account, or one (exits 1 when the check fails)", flags: ["account"] },
+    doctor: { usage: "doctor [--account <slug|address>] [--check-updates]", description: "Verify IMAP, SMTP, and Claude Desktop wiring for every account, or one (exits 1 when the check fails); --check-updates also asks the npm registry for a newer release", flags: ["account", "check-updates"] },
     "connection-status": { usage: "connection-status", description: "Show live IMAP/SMTP connectivity state (exits 1 when either is unreachable)", flags: [] },
+    report: { usage: "report", description: "Print a diagnostic summary to paste into a bug report: versions, system, connection modes, flags and per-account state; no passwords, no mail content, addresses masked", flags: [] },
     "runtime-status": { usage: "runtime-status [--account <slug|address>]", description: "Show runtime policy and background sync state, per account", flags: ["account"] },
     sync: { usage: "sync [--folder <name>] [--limit <n>] [--full]", description: "Refresh the local index from Proton Bridge", flags: ["folder", "limit", "full", "no-attachment-text"] },
     "index-status": { usage: "index-status", description: "Show local index health and freshness", flags: [] },
@@ -281,7 +285,7 @@ export const COMMAND_SPECS = {
     watch: { usage: "watch [--folder <name>] [--timeout <s>]", description: "Wait for mailbox changes via IMAP IDLE", flags: ["folder", "timeout"] },
     "clear-cache": { usage: "clear-cache", description: "Clear in-memory MCP server caches", flags: [] },
     "get-logs": { usage: "get-logs [--limit <n>] [--offset <n>] [--level <level>]", description: "Return recent in-memory MCP server logs", flags: ["limit", "level", "offset"] },
-    notify: { usage: "notify [--folder <name>] [--timeout <s>]", description: "Daemon: watch a folder and send a system notification on new mail", flags: ["folder", "timeout"] },
+    notify: { usage: "notify [--folder <name>] [--timeout <s>]", description: "Daemon: watch a folder and send a system notification on new mail, and when it cannot reach or log in to Bridge (once per problem, and when it recovers)", flags: ["folder", "timeout"] },
     drafts: { usage: "drafts [--sent]", description: "List local drafts", flags: ["sent"] },
     "remote-drafts": { usage: "remote-drafts [--limit <n>] [--offset <n>]", description: "List drafts in the Proton Drafts mailbox", flags: ["limit", "offset"] },
     "draft-create": { usage: "draft-create --subject <text> [--to <addr>] (--body <text> | stdin) [--cc <a>] [--bcc <a>]", description: "Create a draft", flags: ["to", "cc", "bcc", "subject", ...BODY_FLAGS] },
@@ -817,6 +821,7 @@ async function runDoctor(parsed) {
             // Top-level fields describe the first account shown; ok covers all of them.
             ok: checked.every((entry) => entry.ok),
             claudeDesktopInstalled: claudeDesktop.installed,
+            ...(isTruthyFlag(parsed.flags["check-updates"]) ? { update: await checkForUpdate(await getPkgVersion()) } : {}),
             ...(checked.length > 1 ? { accounts: checked } : {}),
         };
         process.stdout.write(wantJson ? json(result) : `${result.ok ? "Doctor OK" : "Doctor failed"}\n${json(result)}`);
@@ -859,6 +864,71 @@ async function runConnectionStatus(parsed) {
             process.exitCode = 1;
     });
 }
+// a***@example.com: enough to tell accounts apart in a bug report, not enough to identify the person.
+export function maskAddress(address) {
+    const at = address.lastIndexOf("@");
+    return at <= 0 ? "***" : `${address[0]}***${address.slice(at)}`;
+}
+// The runtime settings for a bug report: folder lists become a count, and the home directory is written as ~.
+export function reportRuntime(runtime, home = homedir()) {
+    const sanitized = sanitizeRuntimeConfig(runtime);
+    const folders = typeof sanitized.autoSyncFolder === "string" ? sanitized.autoSyncFolder.split(",").filter((entry) => entry.trim()).length : undefined;
+    const download = typeof sanitized.allowFileDownloadDir === "string" ? sanitized.allowFileDownloadDir : undefined;
+    return {
+        ...sanitized,
+        autoSyncFolder: folders === undefined ? undefined : `${folders} folder${folders === 1 ? "" : "s"}`,
+        allowFileDownloadDir: download ? (home && download.startsWith(home) ? `~${download.slice(home.length)}` : download) : sanitized.allowFileDownloadDir,
+    };
+}
+async function runReport() {
+    await withServices(async ({ config, accountManager }) => {
+        const accounts = await Promise.all(accountManager.all().map(async (bundle) => {
+            let imap = "ok";
+            let folderCount;
+            try {
+                await bundle.imapService.ping();
+                folderCount = (await bundle.imapService.getFolders(true)).length;
+            }
+            catch (error) {
+                imap = diagnoseConnectionFailure(error)?.cause ?? "failed";
+            }
+            let smtp = "ok";
+            try {
+                await bundle.smtpService.verifyConnection();
+            }
+            catch (error) {
+                smtp = diagnoseConnectionFailure(error)?.cause ?? "failed";
+            }
+            const index = await bundle.localIndexService.getStatus();
+            return {
+                account: maskAddress(bundle.account.address),
+                imap: { host: bundle.config.imap.host, port: bundle.config.imap.port, secure: bundle.config.imap.secure, check: imap },
+                smtp: {
+                    host: bundle.config.smtp.host,
+                    port: bundle.config.smtp.port,
+                    configuredSecure: bundle.config.smtp.secure,
+                    secureInUse: bundle.smtpService.effectiveSecure,
+                    userSet: bundle.config.smtp.secureExplicit === true,
+                    check: smtp,
+                },
+                bridge: bundle.imapService.getServerInfo(),
+                folderCount,
+                index: { storedMessageCount: index.storedMessageCount, updatedAt: index.updatedAt, isStale: index.isStale },
+                // Folder names can be as private as an address: only how many are synced.
+                backgroundSync: { syncedFolderCount: bundle.imapService.getSyncFolderList().length, full: bundle.backgroundSyncService.getStatus().full },
+            };
+        }));
+        const claudeDesktop = await getClaudeDesktopInstallStatus();
+        process.stdout.write(json({
+            version: await getPkgVersion(),
+            node: process.version,
+            platform: `${process.platform} ${process.arch} ${osRelease()}`,
+            claudeDesktopInstalled: claudeDesktop.installed,
+            runtime: reportRuntime(config.runtime),
+            accounts,
+        }));
+    });
+}
 async function runRuntimeStatus(parsed) {
     const wantJson = isTruthyFlag(parsed.flags.json);
     await withServices(async ({ accountManager }) => {
@@ -868,6 +938,7 @@ async function runRuntimeStatus(parsed) {
             account: bundle.config.smtp.username,
             runtime: sanitizeRuntimeConfig(bundle.config.runtime),
             backgroundSync: bundle.backgroundSyncService.getStatus(),
+            health: healthProblems(bundle.backgroundSyncService.getStatus(), await bundle.localIndexService.getStatus()),
             localIndex: await bundle.localIndexService.getStatus(),
             drafts: {
                 total: (await bundle.draftStore.listDrafts(true)).length,
@@ -1599,6 +1670,21 @@ async function sendSystemNotification(title, body) {
         // Silent — stdout already carries the event
     }
 }
+// What `notify` should tell the user when its own watch starts or stops working. A problem is announced once per
+// cause (not every retry), and recovery once; `cause` is what the caller passes back in as `previous`.
+export function watchHealthNotice(previous, error) {
+    if (error === null) {
+        return previous
+            ? { cause: undefined, notice: { title: "Proton Mail Bridge Client", body: "The connection to Bridge works again." } }
+            : { cause: undefined };
+    }
+    const cause = diagnoseConnectionFailure(error)?.cause ?? "failed";
+    if (cause === previous)
+        return { cause };
+    const body = diagnoseConnectionFailure(error)?.suggestion ??
+        `The mailbox watch stopped working: ${error instanceof Error ? error.message : String(error)}`;
+    return { cause, notice: { title: "Proton Mail Bridge Client needs attention", body } };
+}
 async function runNotify(parsed) {
     const folder = getStringFlag(parsed.flags, "folder") || "INBOX";
     const timeoutSeconds = getNumberFlag(parsed.flags, "timeout", 30);
@@ -1606,6 +1692,7 @@ async function runNotify(parsed) {
     const imapService = new SimpleIMAPService(config);
     let running = true;
     let previousCount;
+    let problemCause;
     const shutdown = () => { running = false; };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -1618,6 +1705,12 @@ async function runNotify(parsed) {
             });
             if (!running)
                 break;
+            const recovered = watchHealthNotice(problemCause, null);
+            if (recovered.notice) {
+                await sendSystemNotification(recovered.notice.title, recovered.notice.body);
+                process.stdout.write(JSON.stringify({ event: "recovered", at: result.checkedAt }) + "\n");
+            }
+            problemCause = recovered.cause;
             if (result.changed) {
                 const existsEvent = result.events.find((e) => e["type"] === "exists");
                 if (existsEvent) {
@@ -1644,8 +1737,14 @@ async function runNotify(parsed) {
                 break;
             const msg = error instanceof Error ? error.message : String(error);
             process.stderr.write(`[notify] Watch error: ${msg}\n`);
-            // Simple backoff before retrying
-            await new Promise((resolve) => { setTimeout(resolve, 15_000).unref(); });
+            const health = watchHealthNotice(problemCause, error);
+            problemCause = health.cause;
+            if (health.notice) {
+                await sendSystemNotification(health.notice.title, health.notice.body);
+                process.stdout.write(JSON.stringify({ event: "problem", cause: health.cause, message: health.notice.body }) + "\n");
+            }
+            // Simple backoff before retrying; a rejected login will not fix itself in seconds.
+            await new Promise((resolve) => { setTimeout(resolve, health.cause === "authentication_failed" ? 120_000 : 15_000).unref(); });
         }
     }
     try {
@@ -2023,9 +2122,19 @@ export async function main() {
             process.stdout.write(scheduleText(parsed));
             return;
         case "-v":
-        case "version":
-            process.stdout.write(`proton-mail-bridge-client ${await getPkgVersion()}\n`);
+        case "version": {
+            const current = await getPkgVersion();
+            process.stdout.write(`proton-mail-bridge-client ${current}\n`);
+            if (isTruthyFlag(parsed.flags.check)) {
+                const update = await checkForUpdate(current);
+                process.stdout.write(update.error
+                    ? `Could not check for updates: ${update.error}\n`
+                    : update.newer
+                        ? `A newer release is available: ${update.latest} (${update.releaseUrl}). Update with: npm install -g proton-mail-bridge-client\n`
+                        : "You are on the latest release.\n");
+            }
             return;
+        }
         case "setup-claude-desktop":
             await runClaudeDesktopSetupWizard();
             return;
@@ -2038,6 +2147,9 @@ export async function main() {
         case "connection-status":
             await runConnectionStatus(parsed);
             return;
+        case "report":
+            await runReport();
+            return;
         case "runtime-status":
             await runRuntimeStatus(parsed);
             return;