proton-mail-bridge-client 2.3.1 → 2.4.0

package/dist/index.js

@@ -14,7 +14,7 @@ import { AnalyticsService } from "./services/analytics-service.js";
 import { applyBodyEdits, draftSyncFingerprint } from "./services/draft-store-service.js";
 import { BULK_ITEM_TIMEOUT_MS, describeImapError, isLikelyAuthenticationError, isLikelyConnectionError, isLikelyTlsMismatchError, UID_VALIDITY_MISMATCH_ERROR } from "./services/simple-imap-service.js";
 import { applySignature, plainTextToHtml } from "./services/smtp-service.js";
-import { ensureValidEmails, foldQuotedHistory, isTextLikeMimeType, isValidEmail, isSelfAddress, lowerCaseAddress, normalizeBoolean, normalizeLimit, normalizeJsonValue, parseEmailId, parseEmails, projectFields, trimAttachmentsForListing, renderMarkdown, slugifyAccountAddress, splitAccountPrefix, stringifyForJson, withAccountPrefix, } from "./utils/helpers.js";
+import { ensureValidEmails, foldQuotedHistory, isTextLikeMimeType, isValidEmail, isSelfAddress, lowerCaseAddress, InvalidArgumentError, isOutgoingMessage, isPathInside, normalizeBoolean, normalizeLimit, optionalBoolean, optionalInteger, optionalNumber, normalizeJsonValue, parseEmailId, parseEmails, projectFields, trimAttachmentsForListing, renderMarkdown, slugifyAccountAddress, splitAccountPrefix, stringifyForJson, withAccountPrefix, } from "./utils/helpers.js";
 import { AccountManager } from "./services/account-manager.js";
 import { logger } from "./utils/logger.js";
 import { ensureDestructiveConfirmed, ensureEmailActionAllowed, ensureFlagChangeAllowed, ensureMailboxWriteAllowed, ensureOutboundRecipientsAllowed, ensureRemoteDraftSyncAllowed, ensureSendAllowed, resolveRemoteDraftSync, sanitizeRuntimeConfig, } from "./utils/runtime-policy.js";
@@ -148,7 +148,7 @@ const TOOLS = [
     },
     {
         name: "reply_to_email",
-        description: "Immediately send a reply to an existing email, threading it correctly via In-Reply-To and References headers. Use when you have an emailId and want to send the reply right away. Prefer create_reply_draft to save the reply for review first, or create_thread_reply_draft when replying from a threadId. Use reply_all_email to reply to all original recipients. Requires PROTONMAIL_ALLOW_SEND.",
+        description: "Immediately send a reply to an existing email, threading it correctly via In-Reply-To and References headers. Use when you have an emailId and want to send the reply right away. Prefer create_reply_draft to save the reply for review first, or create_thread_reply_draft when replying from a threadId. Use reply_all_email to reply to all original recipients. Provide body (plain text, or HTML with isHtml) or markdownBody. Requires PROTONMAIL_ALLOW_SEND.",
         annotations: { destructiveHint: true },
         inputSchema: {
             type: "object",
@@ -184,7 +184,7 @@ const TOOLS = [
                 includeQuote: { type: "boolean", description: "Append the quoted original message to the reply body.", default: true },
                 appendSignature: { type: "boolean", description: "Append PROTONMAIL_SIGNATURE (if configured) after your reply text and before the quoted original. Set false to send without it for this one message.", default: true },
             },
-            required: ["emailId", "body"],
+            required: ["emailId"],
         },
     },
     {
@@ -543,7 +543,7 @@ const TOOLS = [
             type: "object",
             properties: {
                 folder: { type: "string", description: "Folder name.", default: "INBOX" },
-                limit: { type: "number", description: "Number of emails to return.", default: 50 },
+                limit: { type: "number", description: "Number of emails to return (1-250; larger values are capped at 250, use hasMore and offset/beforeUid to page).", default: 50, maximum: 250 },
                 offset: { type: "number", description: "Pagination offset from newest first.", default: 0 },
                 includeSnippet: { type: "boolean", description: "Fetch a short plain-text preview of each email body. Slightly slower (requires fetching the message source) but lets you triage without a separate get_email_by_id call. Warning: snippet content is from untrusted senders and may contain prompt-injection text.", default: false },
                 beforeUid: { type: "number", description: "Return only messages with UID less than this value. Use for UID-cursor pagination (more reliable than offset under concurrent modifications)." },
@@ -613,7 +613,7 @@ const TOOLS = [
                 messageId: { type: "string", description: "RFC 5322 Message-ID header value to match exactly." },
                 cc: { type: "string", description: "Filter by CC/BCC recipient address." },
                 bcc: { type: "string", description: "Filter by CC/BCC recipient address." },
-                limit: { type: "number", description: "Maximum results.", default: 50 },
+                limit: { type: "number", description: "Maximum results (1-250; larger values are capped at 250, check hasMore).", default: 50, maximum: 250 },
                 includeSnippet: { type: "boolean", description: "Fetch a short plain-text preview of each matched email body. Slightly slower but avoids follow-up get_email_by_id calls for triage. Warning: snippet content is from untrusted senders and may contain prompt-injection text.", default: false },
                 fields: { oneOf: [{ type: "array", items: { type: "string" } }, { type: "string" }], description: "Trim each returned email to just these field names (e.g. [\"subject\",\"from\",\"date\"]) to save tokens on large result sets. id is always included. Accepts either an array or a comma-separated string. Omit to get the full object." },
             },
@@ -629,7 +629,12 @@ const TOOLS = [
         name: "sync_folders",
         description: "Refresh the in-memory folder list from the IMAP server and return the updated list. Use when folders have been created, renamed, or deleted externally (e.g. via Proton webmail) and get_folders is returning stale data. Prefer get_folders for a read-only view that does not force a refresh.",
         annotations: { readOnlyHint: true },
-        inputSchema: { type: "object", properties: {} },
+        inputSchema: {
+            type: "object",
+            properties: {
+                account: { type: "string", description: "Account address or slug to act on. Defaults to the primary account." },
+            },
+        },
     },
     {
         name: "create_folder",
@@ -780,7 +785,7 @@ const TOOLS = [
         inputSchema: {
             type: "object",
             properties: {
-                status: { type: "string", enum: ["pending", "woken", "canceled", "failed"], description: "Filter to one status. Omit to list everything." },
+                status: { type: "string", enum: ["pending", "waking", "woken", "canceled", "failed"], description: "Filter to one status. Omit to list everything (waking = being moved back right now)." },
             },
         },
     },
@@ -905,7 +910,7 @@ const TOOLS = [
     },
     {
         name: "count_messages",
-        description: "Count messages matching search criteria. Plain IMAP criteria are answered by the server without fetching messages; non-ASCII values (accented letters, ł, ß) and local-only filters (hasAttachment, senderDomain, label, threadId) are checked locally, and the result carries approximate: true when only the newest 500 candidates could be checked. Use to preview how many results a search would return before running it. Prefer folder_stats for a simple unread/total count on one folder without filters.",
+        description: "Count messages matching search criteria. Plain IMAP criteria are answered by the server without fetching messages; non-ASCII values (accented letters, ł, ß) and local-only filters (hasAttachment, senderDomain, threadId, attachmentName, mailboxRole) are checked locally, and the result carries approximate: true when only the newest 500 candidates could be checked. A label that names a folder (Proton: Labels/<name>) counts that folder, as search_emails does. Across several accounts the counts are summed and an account that fails (for example one without that folder) is listed in failedAccounts instead of failing the whole call. Use to preview how many results a search would return before running it. Prefer folder_stats for a simple unread/total count on one folder without filters.",
         annotations: { readOnlyHint: true },
         inputSchema: {
             type: "object",
@@ -1154,6 +1159,10 @@ const TOOLS = [
                     description: "Continue applying the action after an individual failure.",
                     default: true,
                 },
+                confirmed: {
+                    type: "boolean",
+                    description: "Set to true to confirm a permanent delete (action \"delete\") when PROTONMAIL_CONFIRM_DESTRUCTIVE is enabled.",
+                },
                 dryRun: {
                     type: "boolean",
                     description: "Preview the impact without mutating the mailbox.",
@@ -1190,6 +1199,10 @@ const TOOLS = [
                     description: "Continue applying the action after an individual failure.",
                     default: true,
                 },
+                confirmed: {
+                    type: "boolean",
+                    description: "Set to true to confirm a permanent delete (action \"delete\") when PROTONMAIL_CONFIRM_DESTRUCTIVE is enabled.",
+                },
                 dryRun: {
                     type: "boolean",
                     description: "Preview the impact without mutating the mailbox.",
@@ -1300,7 +1313,7 @@ const TOOLS = [
         name: "run_background_sync",
         description: "Immediately trigger the configured background mailbox sync cycle outside its normal schedule and return its updated status. Use to force a sync when the index may be stale. Does nothing useful if PROTONMAIL_AUTO_SYNC is disabled. Prefer sync_emails for an on-demand, configurable sync with folder and depth options.",
         annotations: { destructiveHint: false },
-        inputSchema: { type: "object", properties: {} },
+        inputSchema: { type: "object", properties: { account: { type: "string", description: "Account address or slug to act on. Defaults to the primary account." }, } },
     },
     {
         name: "wait_for_mailbox_changes",
@@ -1309,6 +1322,7 @@ const TOOLS = [
         inputSchema: {
             type: "object",
             properties: {
+                account: { type: "string", description: "Account address or slug to act on. Defaults to the primary account." },
                 folder: { type: "string", description: "Mailbox to watch during IDLE.", default: "INBOX" },
                 timeoutSeconds: { type: "number", description: "Maximum watch duration in seconds.", default: 15 },
             },
@@ -1321,6 +1335,7 @@ const TOOLS = [
         inputSchema: {
             type: "object",
             properties: {
+                account: { type: "string", description: "Account address or slug to act on. Defaults to the primary account." },
                 folder: { type: "string", description: "Folder to sync. Defaults to all folders." },
                 timeBudgetSeconds: {
                     type: "number",
@@ -1605,7 +1620,7 @@ const TOOLS = [
     {
         name: "get_attachment_content",
         description: "Fetch metadata for a specific email attachment and optionally return its base64-encoded content inline. Use when you need to read or process attachment data in-memory. Set includeBase64:false (default) to retrieve metadata only without loading the full payload. Prefer save_attachment to write the file to disk instead.",
-        annotations: { readOnlyHint: true },
+        annotations: { readOnlyHint: false },
         inputSchema: {
             type: "object",
             properties: {
@@ -1827,6 +1842,14 @@ function createTextResult(value, isError = false, sources = []) {
 // size exceeded"), failing the whole tool call. So: never descend into class instances
 // (services, sockets, clients), never into an account bundle, stop on cycles, and cap depth.
 const AUDIT_MAX_DEPTH = 8;
+// The audit log records what was done, not the content of the mail or any secret. Message text can arrive under
+// many names (body, markdownBody, htmlBody, a draft's notes, the find/replace of body edits, a raw .eml...), so
+// every one of them is redacted by key; credential-like keys are caught by pattern.
+const AUDIT_REDACTED_KEYS = new Set([
+    "body", "html", "text", "htmlBody", "textBody", "markdownBody", "customMessage", "notes", "bodyEdits",
+    "raw", "rawBase64", "base64", "content", "find", "replace", "signature",
+]);
+const AUDIT_SECRET_KEY = /pass(word|wd|phrase)?$|secret|token|api[-_]?key|authoriz|credential|cookie|private[-_]?key/i;
 function sanitizeAuditValue(value, depth = 0, seen = new WeakSet()) {
     if (value === undefined || value === null) {
         return value;
@@ -1853,12 +1876,7 @@ function sanitizeAuditValue(value, depth = 0, seen = new WeakSet()) {
             return `[${value.constructor?.name ?? "object"}]`;
         }
         return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => {
-            if (key === "body" ||
-                key === "html" ||
-                key === "text" ||
-                key === "base64" ||
-                key === "customMessage" ||
-                /password|secret|token/i.test(key)) {
+            if (AUDIT_REDACTED_KEYS.has(key) || AUDIT_SECRET_KEY.test(key)) {
                 return [key, "[redacted]"];
             }
             if (key === "bundle") {
@@ -1887,20 +1905,23 @@ function sanitizeAuditValue(value, depth = 0, seen = new WeakSet()) {
 }
 export async function withAudit(auditService, tool, input, operation) {
     const startedAt = Date.now();
+    // Writing the audit entry is bookkeeping about an operation that has already happened. If it fails (disk
+    // full, a locked file), the failure is logged and swallowed: raising it turned a successful move or send
+    // into a tool error, so a client would retry it, and on the error path it would hide the real error.
+    const record = async (entry) => {
+        try {
+            await auditService.record(entry);
+        }
+        catch (auditError) {
+            logger.error("Could not write the audit entry", "MCPServer", { tool, error: auditError });
+        }
+    };
+    let result;
     try {
-        const result = await operation();
-        await auditService.record({
-            timestamp: new Date().toISOString(),
-            tool,
-            status: "success",
-            durationMs: Date.now() - startedAt,
-            input: sanitizeAuditValue(input),
-            result: sanitizeAuditValue(result),
-        });
-        return result;
+        result = await operation();
     }
     catch (error) {
-        await auditService.record({
+        await record({
             timestamp: new Date().toISOString(),
             tool,
             status: "error",
@@ -1910,6 +1931,15 @@ export async function withAudit(auditService, tool, input, operation) {
         });
         throw error;
     }
+    await record({
+        timestamp: new Date().toISOString(),
+        tool,
+        status: "success",
+        durationMs: Date.now() - startedAt,
+        input: sanitizeAuditValue(input),
+        result: sanitizeAuditValue(result),
+    });
+    return result;
 }
 // Validates update_draft's `bodyEdits` argument into BodyEdit[] (shape only; whether each
 // find text is present/unambiguous is decided against the stored body by applyBodyEdits).
@@ -2040,13 +2070,42 @@ export function buildSecurityInfo(detail) {
         dmarc: auth.dmarc,
     };
 }
+// "unsub@list.example?subject=Remove%20me&body=..." as mailparser hands over a List-Unsubscribe mailto: one
+// address plus the subject and body the sender asked for. Anything with more than one recipient, or an
+// address part that is not an address, is refused; the requested text is cut to a sane length and stripped of
+// line breaks, because it ends up in a header and a body of a mail this server sends.
+export function parseUnsubscribeMailto(value) {
+    const cleaned = value.trim().replace(/^mailto:/i, "");
+    const questionMark = cleaned.indexOf("?");
+    const addressPart = questionMark === -1 ? cleaned : cleaned.slice(0, questionMark);
+    let address;
+    try {
+        address = decodeURIComponent(addressPart).trim();
+    }
+    catch {
+        return undefined;
+    }
+    if (!address || /[\s,;<>]/.test(address) || !isValidEmail(address))
+        return undefined;
+    const params = new URLSearchParams(questionMark === -1 ? "" : cleaned.slice(questionMark + 1));
+    const text = (key, max, keepNewlines) => {
+        const raw = params.get(key);
+        if (!raw)
+            return undefined;
+        const clean = (keepNewlines ? raw.replace(/\r/g, "") : raw.replace(/[\r\n]+/g, " ")).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "").trim();
+        return clean ? clean.slice(0, max) : undefined;
+    };
+    return { address, subject: text("subject", 200, false), body: text("body", 2000, true) };
+}
 export function extractUnsubscribeInfo(detail) {
     const list = detail.headers?.list;
     const unsubscribe = list?.unsubscribe;
-    const mail = typeof unsubscribe?.mail === "string" ? unsubscribe.mail : undefined;
+    const mail = typeof unsubscribe?.mail === "string" ? parseUnsubscribeMailto(unsubscribe.mail) : undefined;
     const url = typeof unsubscribe?.url === "string" ? unsubscribe.url : undefined;
     return {
-        mailto: mail && isValidEmail(mail) ? mail : undefined,
+        mailto: mail?.address,
+        ...(mail?.subject ? { mailtoSubject: mail.subject } : {}),
+        ...(mail?.body ? { mailtoBody: mail.body } : {}),
         url,
     };
 }
@@ -2179,7 +2238,9 @@ export function formatQuoteDate(value) {
 // (a broken-image box) and copies its base64 into every reply, and a cid: image refers to a part
 // that is not attached here. Replace each with its alt text, or nothing.
 export function stripUnshippableImages(html) {
-    return html.replace(/<img\b[^>]*>/gi, (tag) => {
+    // A tag is a run of non-quote characters and quoted strings, so a ">" inside alt="a>b" does not end
+    // it and an unclosed "<img" stops at the next "<" instead of scanning to the end of the text.
+    return html.replace(/<img\b(?:[^<>"']|"[^"]*"|'[^']*')*>/gi, (tag) => {
         const src = /\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i.exec(tag);
         const value = (src?.[1] ?? src?.[2] ?? src?.[3] ?? "").trim().toLowerCase();
         if (!value.startsWith("data:") && !value.startsWith("cid:"))
@@ -2189,22 +2250,33 @@ export function stripUnshippableImages(html) {
         return text ? `[${text}]` : "";
     });
 }
-function buildReplyText(detail, body) {
+// References for a reply: the original's own chain followed by the original's Message-ID (RFC 5322),
+// so mail clients that thread by References keep the whole conversation together.
+function replyReferences(detail) {
+    const chain = [...(detail.references ?? []), detail.messageId].filter((id) => Boolean(id));
+    const unique = [...new Set(chain)];
+    return unique.length > 0 ? unique : undefined;
+}
+// Drops blank lines around the body but keeps the first line's own indentation (code, lists).
+function trimBodyEdges(body) {
+    return body.replace(/^(?:[ \t]*\r?\n)+/, "").trimEnd();
+}
+export function buildReplyText(detail, body) {
     const originalText = detail.text || detail.preview || "";
     const fromText = formatAddressList(detail.from);
     const dateText = formatQuoteDate(detail.date || detail.internalDate || "an unknown date");
     return [
-        body.trim(),
+        trimBodyEdges(body),
         "",
         `On ${dateText}, ${fromText || "the sender"} wrote:`,
         quotePlainText(originalText),
     ].join("\n");
 }
-function buildForwardText(detail, body) {
+export function buildForwardText(detail, body) {
     const originalText = detail.text || detail.preview || "";
     return [
-        body?.trim() || "",
-        body?.trim() ? "" : "",
+        body?.trim() ? trimBodyEdges(body) : "",
+        "",
         "---------- Forwarded message ---------",
         `From: ${formatAddressList(detail.from)}`,
         `Date: ${detail.date || detail.internalDate || ""}`,
@@ -2285,7 +2357,8 @@ export function getReplyRecipients(detail, ownerEmail, replyAll, otherSelfAddres
     if (!replyAll) {
         return { to, cc: [] };
     }
-    const ccPool = notSelf([...addressValues(detail.to), ...addressValues(detail.cc)]).filter((address) => !to.some((recipient) => lowerCaseAddress(recipient) === lowerCaseAddress(address)));
+    // Reply-To redirected the primary recipient; reply-all must still reach the original sender.
+    const ccPool = notSelf([...addressValues(detail.from), ...addressValues(detail.to), ...addressValues(detail.cc)]).filter((address) => !to.some((recipient) => lowerCaseAddress(recipient) === lowerCaseAddress(address)));
     return { to, cc: ccPool };
 }
 function buildEmailResourceUri(emailId) {
@@ -2636,17 +2709,35 @@ function parseResourceUri(uri) {
 // created here are owner-only (0700) and the file is 0600, existing files included.
 export async function writeAttachmentToDownloadDir(downloadDir, saveTo, data) {
     const { resolve: pathResolve, join: pathJoin, dirname, basename, sep } = await import("node:path");
-    const { realpathSync } = await import("node:fs");
+    const { realpathSync, existsSync } = await import("node:fs");
     const { writeFile: wf, mkdir: mkd, chmod: chm } = await import("node:fs/promises");
     const absDir = pathResolve(downloadDir);
     const absTarget = pathJoin(absDir, saveTo);
     // A hardcoded "/" never matched on win32 (path.resolve/join produce
     // backslash-separated paths there), hence `sep`.
-    if (!absTarget.startsWith(absDir + sep) && absTarget !== absDir) {
+    if (!isPathInside(absDir, absTarget, sep)) {
         throw new McpError(ErrorCode.InvalidParams, "saveTo path escapes the allowed directory.");
     }
-    await mkd(pathResolve(absTarget, ".."), { recursive: true, mode: 0o700 });
+    // The allowed directory itself may be created. Then check, BEFORE creating anything below it, that the
+    // deepest directory that already exists on the way to the target really is inside it: otherwise a
+    // symlink in the allowed dir could make mkdir create new directories outside it before the final
+    // containment check below refuses the save.
+    await mkd(absDir, { recursive: true, mode: 0o700 });
     const realDir = realpathSync(absDir);
+    let probe = pathResolve(absTarget, "..");
+    while (!existsSync(probe))
+        probe = dirname(probe);
+    let realProbe;
+    try {
+        realProbe = realpathSync(probe);
+    }
+    catch {
+        throw new McpError(ErrorCode.InvalidParams, "saveTo path escapes the allowed directory.");
+    }
+    if (!isPathInside(realDir, realProbe, sep)) {
+        throw new McpError(ErrorCode.InvalidParams, "saveTo path escapes the allowed directory.");
+    }
+    await mkd(pathResolve(absTarget, ".."), { recursive: true, mode: 0o700 });
     let realTarget;
     try {
         realTarget = realpathSync(absTarget);
@@ -2659,7 +2750,7 @@ export async function writeAttachmentToDownloadDir(downloadDir, saveTo, data) {
             throw error;
         }
     }
-    if (!realTarget.startsWith(realDir + sep) && realTarget !== realDir) {
+    if (!isPathInside(realDir, realTarget, sep)) {
         throw new McpError(ErrorCode.InvalidParams, "saveTo path escapes the allowed directory.");
     }
     await wf(absTarget, data, { mode: 0o600 });
@@ -3105,12 +3196,14 @@ async function applyBatchEmailAction(imapService, entries, input) {
         }
     }
     const succeeded = entries.filter((entry) => entry.ok).length;
+    const notAttempted = input.emailIds.slice(entries.length);
     return {
         action: input.action,
         total: input.emailIds.length,
         succeeded,
         failed: entries.length - succeeded,
         results: entries,
+        ...(notAttempted.length > 0 ? { notAttempted } : {}),
     };
 }
 async function previewEmailAction(imapService, emailId, action, targetFolder) {
@@ -3153,7 +3246,7 @@ async function verifySentCopy(imapService, messageId) {
     return imapService.sentCopyVerify(messageId, "Sent", 8_000);
 }
 export function getBulkMaxBatchSize(args) {
-    return typeof args.maxBatchSize === "number" ? Math.min(args.maxBatchSize, 2000) : 500;
+    return normalizeLimit(args.maxBatchSize, 500, 1, 2000);
 }
 export function ensureBulkBatchSize(uidsLength, max) {
     if (uidsLength > max) {
@@ -3293,7 +3386,7 @@ function pickReplyTargetFromThread(thread, ownerEmail, preferLatestInbound) {
     if (preferLatestInbound) {
         const inbound = [...messages]
             .reverse()
-            .find((message) => !message.from.some((address) => lowerCaseAddress(address.address) === lowerCaseAddress(ownerEmail)));
+            .find((message) => !isOutgoingMessage(message, ownerEmail));
         if (inbound) {
             return inbound;
         }
@@ -3305,12 +3398,12 @@ function buildThreadBrief(thread, ownerEmail) {
     const latestMessage = messages[messages.length - 1];
     const latestInbound = [...messages]
         .reverse()
-        .find((message) => !message.from.some((entry) => lowerCaseAddress(entry.address) === lowerCaseAddress(ownerEmail)));
+        .find((message) => !isOutgoingMessage(message, ownerEmail));
     const latestOutbound = [...messages]
         .reverse()
-        .find((message) => message.from.some((entry) => lowerCaseAddress(entry.address) === lowerCaseAddress(ownerEmail)));
+        .find((message) => isOutgoingMessage(message, ownerEmail));
     const pendingOn = latestMessage
-        ? latestMessage.from.some((entry) => lowerCaseAddress(entry.address) === lowerCaseAddress(ownerEmail))
+        ? isOutgoingMessage(latestMessage, ownerEmail)
             ? "them"
             : "you"
         : "unknown";
@@ -4041,6 +4134,8 @@ export function createServer(config, options = {}) {
                         emailId: prefixedIdFor(bundle, detail.id),
                         hasUnsubscribeHeader: Boolean(info.mailto || info.url),
                         mailto: info.mailto,
+                        ...(info.mailtoSubject ? { mailtoSubject: info.mailtoSubject } : {}),
+                        ...(info.mailtoBody ? { mailtoBody: info.mailtoBody } : {}),
                         url: info.url,
                         note: info.url
                             ? "This server never auto-fetches unsubscribe URLs — open the url yourself, or use unsubscribe_sender if mailto is also set."
@@ -4065,8 +4160,8 @@ export function createServer(config, options = {}) {
                     ensureOutboundRecipientsAllowed(config.runtime, config.smtp.username, [info.mailto]);
                     const result = await withAudit(auditService, name, args, () => bundle.smtpService.sendEmail({
                         to: [info.mailto],
-                        subject: "unsubscribe",
-                        body: "unsubscribe",
+                        subject: info.mailtoSubject ?? "unsubscribe",
+                        body: info.mailtoBody ?? "unsubscribe",
                         isHtml: false,
                     }));
                     return createTextResult({
@@ -4140,7 +4235,11 @@ export function createServer(config, options = {}) {
                     // Signature goes right after the user's own reply text, before the
                     // quoted original — not at the very end, after the quote.
                     const signedReply = applySignature(body, htmlBody, normalizeBoolean(args.appendSignature, true), isHtml);
-                    const replyBody = includeQuoteReply ? buildReplyText(detail, signedReply.body) : signedReply.body;
+                    // With isHtml the body is HTML source, so the quoted original (untrusted text) must be HTML-escaped
+                    // by the HTML builder, not appended as raw plain text.
+                    const replyBody = includeQuoteReply
+                        ? (isHtml ? buildReplyHtml(detail, signedReply.body) : buildReplyText(detail, signedReply.body))
+                        : signedReply.body;
                     // A separate htmlBody (the markdown-rendered case) needs the SAME quoted
                     // original merged in — see buildReplyHtml's comment for why this was
                     // previously missing entirely from the html part.
@@ -4165,7 +4264,7 @@ export function createServer(config, options = {}) {
                         from: fromReply,
                         sanitizeHtml: sanitizeHtmlReply,
                         inReplyTo: detail.messageId,
-                        references: detail.messageId ? [detail.messageId] : undefined,
+                        references: replyReferences(detail),
                         attachments,
                         // Already applied above, before quote-wrapping.
                         appendSignature: false,
@@ -4237,7 +4336,9 @@ export function createServer(config, options = {}) {
                     // Signature goes right after the user's own reply text, before the
                     // quoted original — not at the very end, after the quote.
                     const signedReplyRa = applySignature(bodyRa, htmlBodyRa, normalizeBoolean(args.appendSignature, true), isHtmlRa);
-                    const replyBodyRa = includeQuoteRa ? buildReplyText(detailRa, signedReplyRa.body) : signedReplyRa.body;
+                    const replyBodyRa = includeQuoteRa
+                        ? (isHtmlRa ? buildReplyHtml(detailRa, signedReplyRa.body) : buildReplyText(detailRa, signedReplyRa.body))
+                        : signedReplyRa.body;
                     // Same fix as reply_to_email — see buildReplyHtml's comment.
                     const replyHtmlBodyRa = includeQuoteRa && signedReplyRa.htmlBody !== undefined
                         ? buildReplyHtml(detailRa, signedReplyRa.htmlBody)
@@ -4360,7 +4461,7 @@ export function createServer(config, options = {}) {
                         cc,
                         bcc,
                         subject: prefixedSubject(detail.subject, "Fwd:"),
-                        body: buildForwardText(detail, signedFwd.body),
+                        body: isHtml ? buildForwardHtml(detail, signedFwd.body) : buildForwardText(detail, signedFwd.body),
                         isHtml,
                         htmlBody: forwardHtmlBody,
                         fromName: fromNameFwd,
@@ -4523,7 +4624,7 @@ export function createServer(config, options = {}) {
                             // sender instead of the alias the caller asked for.
                             from: optionalString(args, "from"),
                             inReplyTo: detail.messageId,
-                            references: detail.messageId ? [detail.messageId] : undefined,
+                            references: replyReferences(detail),
                             attachments,
                             sourceEmailId: detail.id,
                             sourceMessageId: detail.messageId,
@@ -4749,7 +4850,7 @@ export function createServer(config, options = {}) {
                         subject: optionalString(args, "subject"),
                         body,
                         bodyEdits,
-                        isHtml: typeof args.isHtml === "boolean" ? args.isHtml : undefined,
+                        isHtml: optionalBoolean(args.isHtml),
                         priority: priority === "high" || priority === "low" || priority === "normal"
                             ? priority
                             : undefined,
@@ -5149,7 +5250,7 @@ export function createServer(config, options = {}) {
                     const getEmailsInput = {
                         folder: optionalString(args, "folder"),
                         limit: effectiveLimit,
-                        offset: typeof args.offset === "number" ? args.offset : undefined,
+                        offset: optionalInteger(args.offset, 0, 1_000_000),
                         beforeUid: typeof args?.beforeUid === "number" ? args.beforeUid : undefined,
                         sortByUid: (args?.sortByUid === "asc" || args?.sortByUid === "desc" ? args.sortByUid : undefined),
                         includeSnippet: normalizeBoolean(args.includeSnippet, false),
@@ -5282,14 +5383,14 @@ export function createServer(config, options = {}) {
                             cc: optionalString(args, "cc"),
                             bcc: optionalString(args, "bcc"),
                             subject: optionalString(args, "subject"),
-                            hasAttachment: typeof args.hasAttachment === "boolean" ? args.hasAttachment : undefined,
+                            hasAttachment: optionalBoolean(args.hasAttachment),
                             attachmentName: optionalString(args, "attachmentName"),
-                            isRead: typeof args.isRead === "boolean" ? args.isRead : undefined,
-                            isStarred: typeof args.isStarred === "boolean" ? args.isStarred : undefined,
+                            isRead: optionalBoolean(args.isRead),
+                            isStarred: optionalBoolean(args.isStarred),
                             dateFrom: optionalString(args, "dateFrom"),
                             dateTo: optionalString(args, "dateTo"),
-                            sizeLarger: typeof args.sizeLarger === "number" ? args.sizeLarger : undefined,
-                            sizeSmaller: typeof args.sizeSmaller === "number" ? args.sizeSmaller : undefined,
+                            sizeLarger: optionalNumber(args.sizeLarger, 0, Number.MAX_SAFE_INTEGER),
+                            sizeSmaller: optionalNumber(args.sizeSmaller, 0, Number.MAX_SAFE_INTEGER),
                             listId: optionalString(args, "listId"),
                             limit: effectiveLimit,
                             includeSnippet: normalizeBoolean(args.includeSnippet, false),
@@ -5404,16 +5505,16 @@ export function createServer(config, options = {}) {
                         from: optionalString(args, "from"),
                         to: optionalString(args, "to"),
                         subject: optionalString(args, "subject"),
-                        hasAttachment: typeof args.hasAttachment === "boolean" ? args.hasAttachment : undefined,
+                        hasAttachment: optionalBoolean(args.hasAttachment),
                         label: optionalString(args, "label"),
                         threadId: optionalString(args, "threadId"),
                         senderDomain: optionalString(args, "senderDomain"),
-                        isRead: typeof args.isRead === "boolean" ? args.isRead : undefined,
-                        isStarred: typeof args.isStarred === "boolean" ? args.isStarred : undefined,
+                        isRead: optionalBoolean(args.isRead),
+                        isStarred: optionalBoolean(args.isStarred),
                         dateFrom: optionalString(args, "dateFrom"),
                         dateTo: optionalString(args, "dateTo"),
-                        sizeLarger: typeof args.sizeLarger === "number" ? args.sizeLarger : undefined,
-                        sizeSmaller: typeof args.sizeSmaller === "number" ? args.sizeSmaller : undefined,
+                        sizeLarger: optionalNumber(args.sizeLarger, 0, Number.MAX_SAFE_INTEGER),
+                        sizeSmaller: optionalNumber(args.sizeSmaller, 0, Number.MAX_SAFE_INTEGER),
                     };
                     if (accountManager.all().length === 1) {
                         const result = await imapService.countMessages(countInput);
@@ -5422,14 +5523,24 @@ export function createServer(config, options = {}) {
                     // Merge strategy: count in every account's mailbox and sum — folder is
                     // reported from the request (all accounts are counted against the same
                     // folder name), with a per-account breakdown alongside the total.
-                    const perAccount = await Promise.all(accountManager.all().map(async (bundle) => ({
+                    // One account lacking the folder or label (or unreachable) must not fail the whole count, as in
+                    // search_emails: report it and return the rest. Every account failing still throws.
+                    const settled = await Promise.allSettled(accountManager.all().map(async (bundle) => ({
                         slug: bundle.account.slug,
                         ...(await bundle.imapService.countMessages(countInput)),
                     })));
+                    const perAccount = settled.flatMap((entry) => (entry.status === "fulfilled" ? [entry.value] : []));
+                    if (perAccount.length === 0) {
+                        throw settled[0].reason;
+                    }
+                    const failedAccounts = settled.flatMap((entry, index) => entry.status === "rejected"
+                        ? [{ account: accountManager.all()[index].account.slug, error: entry.reason instanceof Error ? entry.reason.message : String(entry.reason) }]
+                        : []);
                     return createTextResult({
                         folder: countInput.folder ?? "INBOX",
                         count: perAccount.reduce((sum, entry) => sum + entry.count, 0),
                         ...(perAccount.some((entry) => entry.approximate) ? { approximate: true } : {}),
+                        ...(failedAccounts.length > 0 ? { failedAccounts } : {}),
                         byAccount: perAccount,
                     });
                 }
@@ -5508,7 +5619,7 @@ export function createServer(config, options = {}) {
                         // check against it — a match-only bulk_move has no ids that could
                         // be stale, since match resolves directly against the live
                         // mailbox each time.
-                        const currentUidValidity = group.restIds ? await group.bundle.imapService.getMailboxUidValidity(folder) : undefined;
+                        const currentUidValidity = await group.bundle.imapService.getMailboxUidValidity(folder);
                         const notFoundEmailIds = getBulkNotFoundEmailIds(group.restIds, folder, currentUidValidity);
                         // Resolve the match/emailIds set exactly once and reuse it for both
                         // the preview and the real run — see resolveUidsForBulkOp's
@@ -5582,7 +5693,7 @@ export function createServer(config, options = {}) {
                         // excluded and the uids it actually acts on can never disagree
                         // about which generation was current. Only fetched when there are
                         // ids to check against it (a match-only call has none).
-                        const currentUidValidity = group.restIds ? await group.bundle.imapService.getMailboxUidValidity(folder) : undefined;
+                        const currentUidValidity = await group.bundle.imapService.getMailboxUidValidity(folder);
                         const notFoundEmailIds = getBulkNotFoundEmailIds(group.restIds, folder, currentUidValidity);
                         // Resolve the match/emailIds set exactly once and reuse it for both
                         // the preview and the real run — see resolveUidsForBulkOp's
@@ -5650,7 +5761,7 @@ export function createServer(config, options = {}) {
                     for (const [slug, group] of groups) {
                         // See the bulk_delete case above for why this is fetched once and
                         // shared between notFound reporting and uid resolution.
-                        const currentUidValidity = group.restIds ? await group.bundle.imapService.getMailboxUidValidity(folder) : undefined;
+                        const currentUidValidity = await group.bundle.imapService.getMailboxUidValidity(folder);
                         const notFoundEmailIds = getBulkNotFoundEmailIds(group.restIds, folder, currentUidValidity);
                         // Resolve the match/emailIds set exactly once and reuse it for both
                         // the preview and the real run — see resolveUidsForBulkOp's
@@ -5716,7 +5827,7 @@ export function createServer(config, options = {}) {
                     for (const [slug, group] of groups) {
                         // See the bulk_delete case above for why this is fetched once and
                         // shared between notFound reporting and uid resolution.
-                        const currentUidValidity = group.restIds ? await group.bundle.imapService.getMailboxUidValidity(folder) : undefined;
+                        const currentUidValidity = await group.bundle.imapService.getMailboxUidValidity(folder);
                         const notFoundEmailIds = getBulkNotFoundEmailIds(group.restIds, folder, currentUidValidity);
                         // Resolve the match/emailIds set exactly once and reuse it for both
                         // the preview and the real run — see resolveUidsForBulkOp's
@@ -5751,13 +5862,13 @@ export function createServer(config, options = {}) {
                     return createTextResult(mergeBulkResults(outputs));
                 }
                 case "top_senders": {
-                    const topSendersLimit = typeof args.limit === "number" ? args.limit : undefined;
+                    const topSendersLimit = optionalInteger(args.limit, 1, 200);
                     const topSendersInput = {
                         folder: optionalString(args, "folder"),
                         since: optionalString(args, "since"),
                         before: optionalString(args, "before"),
                         limit: topSendersLimit,
-                        scanLimit: typeof args.scanLimit === "number" ? args.scanLimit : undefined,
+                        scanLimit: optionalInteger(args.scanLimit, 1, 20_000),
                         excludeSelf: normalizeBoolean(args.excludeSelf, true),
                     };
                     if (accountManager.all().length === 1) {
@@ -5767,9 +5878,11 @@ export function createServer(config, options = {}) {
                     // Merge strategy: scan each account's folder independently, merge
                     // sender frequency by address (summing counts across accounts), then
                     // re-sort and re-apply the requested top-N limit over the merged set.
+                    // Each account is asked for its WHOLE table, not just its own top N: a sender in the middle of every
+                    // account's table can still be first in total, and cutting each table first made it disappear.
                     const perAccount = await Promise.all(accountManager.all().map(async (bundle) => ({
                         bundle,
-                        result: await bundle.imapService.topSenders(topSendersInput),
+                        result: await bundle.imapService.topSenders({ ...topSendersInput, limit: 10_000 }),
                     })));
                     const senderMap = new Map();
                     for (const { result } of perAccount) {
@@ -5808,6 +5921,7 @@ export function createServer(config, options = {}) {
                         destination: requireString(args, "destination"),
                         acrossFolders: normalizeBoolean(args.acrossFolders, false),
                         dryRun: normalizeBoolean(args.dryRun, false),
+                        maxBatchSize: getBulkMaxBatchSize(args),
                     }));
                     return createTextResult(result);
                 }
@@ -5826,6 +5940,7 @@ export function createServer(config, options = {}) {
                         permanent: permanentThread,
                         acrossFolders: normalizeBoolean(args.acrossFolders, false),
                         dryRun: normalizeBoolean(args.dryRun, false),
+                        maxBatchSize: getBulkMaxBatchSize(args),
                     }));
                     return createTextResult(result);
                 }
@@ -5845,6 +5960,7 @@ export function createServer(config, options = {}) {
                         flagsToRemove,
                         acrossFolders: normalizeBoolean(args.acrossFolders, false),
                         dryRun: normalizeBoolean(args.dryRun, false),
+                        maxBatchSize: getBulkMaxBatchSize(args),
                     }));
                     return createTextResult(result);
                 }
@@ -5897,7 +6013,7 @@ export function createServer(config, options = {}) {
                     return createTextResult(merged);
                 }
                 case "sync_folders":
-                    return createTextResult(await imapService.syncFolders());
+                    return createTextResult(await (resolveAccountArg(args) ?? primaryBundle).imapService.syncFolders());
                 case "create_folder":
                     ensureMailboxWriteAllowed(config.runtime);
                     return createTextResult(await withAudit(auditService, name, args, async () => imapService.createFolder(requireString(args, "path"))));
@@ -6020,13 +6136,18 @@ export function createServer(config, options = {}) {
                 case "snooze_email": {
                     ensureEmailActionAllowed(config.runtime, "archive");
                     const wakeAt = requireString(args, "wakeAt");
-                    const wakeAtTime = new Date(wakeAt).getTime();
+                    // A date-time with no zone ("2026-03-05T09:30:00") is read by JavaScript in the server's local time,
+                    // which is not what a caller reading "ISO 8601" expects and changes with the machine. Read it as UTC.
+                    const wakeAtTime = new Date(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/.test(wakeAt.trim()) ? `${wakeAt.trim()}Z` : wakeAt).getTime();
                     if (Number.isNaN(wakeAtTime)) {
                         throw new McpError(ErrorCode.InvalidParams, `wakeAt is not a valid ISO 8601 timestamp: ${wakeAt}`);
                     }
                     if (wakeAtTime <= Date.now()) {
                         throw new McpError(ErrorCode.InvalidParams, "wakeAt must be in the future.");
                     }
+                    if (wakeAtTime > Date.now() + 10 * 365 * 24 * 60 * 60 * 1000) {
+                        throw new McpError(ErrorCode.InvalidParams, "wakeAt is more than ten years away.");
+                    }
                     // emailId carries the same "<slug>::" prefix as everywhere else — resolve it
                     // to that account's own snoozeService instead of always the primary's, and
                     // prefix the returned ids (the snooze's own id, and the email id) the same
@@ -6102,7 +6223,10 @@ export function createServer(config, options = {}) {
                     return createTextResult(result);
                 }
                 case "render_template": {
-                    const variables = (args.variables && typeof args.variables === "object" ? args.variables : {});
+                    if (args.variables !== undefined && args.variables !== null && (typeof args.variables !== "object" || Array.isArray(args.variables))) {
+                        throw new McpError(ErrorCode.InvalidParams, "variables must be an object of name: value pairs.");
+                    }
+                    const variables = (args.variables ?? {});
                     const result = await withAudit(auditService, name, args, async () => templateService.render(requireString(args, "id"), variables));
                     return createTextResult(result);
                 }
@@ -6165,19 +6289,21 @@ export function createServer(config, options = {}) {
                             return entry ? [entry] : [];
                         });
                         const succeeded = orderedResults.filter((entry) => entry.ok).length;
+                        const notAttempted = groupResults.flatMap(({ slug, result: groupResult }) => (groupResult.notAttempted ?? []).map((id) => withAccountPrefix(outputSlugFor(slug), id)));
                         const result = {
                             action,
                             total: orderedResults.length,
                             succeeded,
                             failed: orderedResults.length - succeeded,
                             results: orderedResults,
+                            ...(notAttempted.length > 0 ? { notAttempted } : {}),
                         };
                         const sources = result.results.flatMap((entry) => entry.ok ? emailSourceFromActionResult(entry.result) : []);
                         return createTextResult(result, false, sources);
                     }
                 case "get_email_stats": {
-                    const statsDays = typeof args.days === "number" ? args.days : 30;
-                    const statsLimit = typeof args.limit === "number" ? args.limit : 2000;
+                    const statsDays = normalizeLimit(args.days, 30, 1, 365);
+                    const statsLimit = normalizeLimit(args.limit, 2000, 1, 10_000);
                     if (accountManager.all().length === 1) {
                         const folders = await imapService.getFolders();
                         const sample = await getAnalyticsSampleFromIndex(imapService, localIndexService, statsDays, statsLimit);
@@ -6217,11 +6343,11 @@ export function createServer(config, options = {}) {
                     });
                 }
                 case "get_email_analytics": {
-                    const analyticsDays = typeof args.days === "number" ? args.days : 30;
-                    const analyticsLimit = typeof args.limit === "number" ? args.limit : 2000;
+                    const analyticsDays = normalizeLimit(args.days, 30, 1, 365);
+                    const analyticsLimit = normalizeLimit(args.limit, 2000, 1, 10_000);
                     if (accountManager.all().length === 1) {
                         const sample = await getAnalyticsSampleFromIndex(imapService, localIndexService, analyticsDays, analyticsLimit);
-                        return createTextResult(analyticsService.getEmailAnalytics(sample, config.smtp.username));
+                        return createTextResult(analyticsService.getEmailAnalytics(sample, config.smtp.username, analyticsDays));
                     }
                     // Merge strategy: compute each account's own analytics independently
                     // (self-detection needs each account's own address), then merge the
@@ -6230,7 +6356,7 @@ export function createServer(config, options = {}) {
                     // results.
                     const analyticsPerAccount = await Promise.all(accountManager.all().map(async (bundle) => {
                         const sample = await getAnalyticsSampleFromIndex(bundle.imapService, bundle.localIndexService, analyticsDays, analyticsLimit);
-                        return analyticsService.getEmailAnalytics(sample, bundle.config.smtp.username);
+                        return analyticsService.getEmailAnalytics(sample, bundle.config.smtp.username, analyticsDays);
                     }));
                     const busiestHours = mergeCountedEntries(analyticsPerAccount.map((entry) => entry.busiestHours), (entry) => entry.hour, 5);
                     const topSenders = mergeCountedEntries(analyticsPerAccount.map((entry) => entry.topSenders), (entry) => entry.address, 10);
@@ -6283,16 +6409,17 @@ export function createServer(config, options = {}) {
                 }
                 case "get_volume_trends": {
                     const days = normalizeLimit(args.days, 30, 1, 365);
+                    // Counted in SQL over the whole index (a sample of the newest 3000 messages cut the older days short).
                     if (accountManager.all().length === 1) {
-                        const sample = await getAnalyticsSampleFromIndex(imapService, localIndexService, days, 3000);
-                        return createTextResult(analyticsService.getVolumeTrends(sample, days));
+                        await maybeRefreshLocalIndex(imapService, localIndexService, {});
+                        return createTextResult(await localIndexService.getDailyVolume(days));
                     }
                     // Merge strategy: compute each account's own daily trend points
                     // independently, then sum count/unreadCount/starredCount/attachmentCount
                     // for matching dates across accounts.
                     const trendsPerAccount = await Promise.all(accountManager.all().map(async (bundle) => {
-                        const sample = await getAnalyticsSampleFromIndex(bundle.imapService, bundle.localIndexService, days, 3000);
-                        return analyticsService.getVolumeTrends(sample, days);
+                        await maybeRefreshLocalIndex(bundle.imapService, bundle.localIndexService, {});
+                        return bundle.localIndexService.getDailyVolume(days);
                     }));
                     return createTextResult(mergeVolumeTrends(trendsPerAccount));
                 }
@@ -6572,23 +6699,30 @@ export function createServer(config, options = {}) {
                     });
                 }
                 case "run_background_sync":
-                    return createTextResult({
-                        checkedAt: new Date().toISOString(),
-                        backgroundSync: await backgroundSyncService.runNow(),
-                        index: await localIndexService.getStatus(),
-                    });
+                    {
+                        const target = resolveAccountArg(args) ?? primaryBundle;
+                        return createTextResult({
+                            checkedAt: new Date().toISOString(),
+                            backgroundSync: await target.backgroundSyncService.runNow(),
+                            index: await target.localIndexService.getStatus(),
+                        });
+                    }
                 case "wait_for_mailbox_changes":
-                    return createTextResult(await imapService.waitForMailboxChanges({
-                        folder: optionalString(args, "folder"),
-                        timeoutMs: normalizeLimit(args.timeoutSeconds, 15, 1, 300) * 1000,
-                    }));
+                    {
+                        const target = resolveAccountArg(args) ?? primaryBundle;
+                        return createTextResult(await target.imapService.waitForMailboxChanges({
+                            folder: optionalString(args, "folder"),
+                            timeoutMs: normalizeLimit(args.timeoutSeconds, 15, 1, 300) * 1000,
+                        }));
+                    }
                 case "sync_emails":
                     {
+                        const target = resolveAccountArg(args) ?? primaryBundle;
                         const folder = optionalString(args, "folder");
-                        const full = typeof args.full === "boolean" ? args.full : undefined;
-                        const limitPerFolder = typeof args.limitPerFolder === "number" ? args.limitPerFolder : undefined;
-                        const includeAttachmentText = typeof args.includeAttachmentText === "boolean" ? args.includeAttachmentText : undefined;
-                        // backgroundSyncService.runNow() always runs the *fixed* background-
+                        const full = optionalBoolean(args.full);
+                        const limitPerFolder = optionalInteger(args.limitPerFolder, 1, 50_000);
+                        const includeAttachmentText = optionalBoolean(args.includeAttachmentText);
+                        // target.backgroundSyncService.runNow() always runs the *fixed* background-
                         // sync config (autoSyncFolder/autoSyncFull/autoSyncLimitPerFolder —
                         // typically just "INBOX,Sent", incremental, 100/folder) and ignores
                         // any argument entirely. This tool's own schema advertises folder/
@@ -6609,15 +6743,15 @@ export function createServer(config, options = {}) {
                             // 60s MCP client timeouts; a single folder in flight still runs to completion.
                             const budgetMs = normalizeLimit(args.timeBudgetSeconds, 45, 1, 300) * 1000;
                             const startedAtMs = Date.now();
-                            const snapshot = await imapService.collectEmailsForIndex({
+                            const snapshot = await target.imapService.collectEmailsForIndex({
                                 folder,
                                 full,
                                 limitPerFolder,
                                 includeAttachmentText,
-                                checkpoints: await localIndexService.getSyncCheckpointMap(),
+                                checkpoints: await target.localIndexService.getSyncCheckpointMap(),
                                 deadlineAt: startedAtMs + budgetMs,
                                 onFolderCollected: async (batch) => {
-                                    await localIndexService.recordSnapshot({
+                                    await target.localIndexService.recordSnapshot({
                                         folders: [],
                                         emails: batch.emails,
                                         syncedAt: batch.checkpoint.lastSyncAt ?? new Date().toISOString(),
@@ -6627,7 +6761,7 @@ export function createServer(config, options = {}) {
                             });
                             // Final commit carries the complete folder list (folder counts, pruning of folders
                             // deleted server-side) — no messages, those were committed per folder above.
-                            const indexStatus = await localIndexService.recordSnapshot({
+                            const indexStatus = await target.localIndexService.recordSnapshot({
                                 folders: snapshot.folders,
                                 folderListComplete: true,
                                 emails: [],
@@ -6669,8 +6803,8 @@ export function createServer(config, options = {}) {
                                 },
                             });
                         }
-                        const syncStatus = await backgroundSyncService.runNow("sync_emails");
-                        const indexStatus = await localIndexService.getStatus();
+                        const syncStatus = await target.backgroundSyncService.runNow("sync_emails");
+                        const indexStatus = await target.localIndexService.getStatus();
                         return createTextResult({
                             checkedAt: new Date().toISOString(),
                             backgroundSync: syncStatus,
@@ -6711,14 +6845,14 @@ export function createServer(config, options = {}) {
                             to: optionalString(args, "to"),
                             senderDomain: optionalString(args, "senderDomain"),
                             subject: optionalString(args, "subject"),
-                            hasAttachment: typeof args.hasAttachment === "boolean" ? args.hasAttachment : undefined,
+                            hasAttachment: optionalBoolean(args.hasAttachment),
                             attachmentName: optionalString(args, "attachmentName"),
-                            isRead: typeof args.isRead === "boolean" ? args.isRead : undefined,
-                            isStarred: typeof args.isStarred === "boolean" ? args.isStarred : undefined,
+                            isRead: optionalBoolean(args.isRead),
+                            isStarred: optionalBoolean(args.isStarred),
                             mailboxRole: optionalString(args, "mailboxRole"),
                             dateFrom: optionalString(args, "dateFrom"),
                             dateTo: optionalString(args, "dateTo"),
-                            limit: typeof args.limit === "number" ? args.limit : undefined,
+                            limit: optionalInteger(args.limit, 1, 1000),
                         };
                         const indexedAccount = resolveAccountArg(args);
                         // Serve fresh data: a cheap UIDNEXT/message-count probe, refreshing only when the
@@ -6778,8 +6912,8 @@ export function createServer(config, options = {}) {
                         const threadsInput = {
                             query: optionalString(args, "query"),
                             label: optionalString(args, "label"),
-                            limit: typeof args.limit === "number" ? args.limit : undefined,
-                            offset: typeof args.offset === "number" ? args.offset : undefined,
+                            limit: optionalInteger(args.limit, 1, 1000),
+                            offset: optionalInteger(args.offset, 0, 1_000_000),
                         };
                         if (accountManager.all().length === 1) {
                             await maybeRefreshLocalIndex(imapService, localIndexService, {
@@ -6828,8 +6962,8 @@ export function createServer(config, options = {}) {
                     }
                 case "get_actionable_threads":
                     {
-                        const limit = typeof args.limit === "number" ? args.limit : 50;
-                        const offset = typeof args.offset === "number" ? Math.max(0, Math.floor(args.offset)) : 0;
+                        const limit = normalizeLimit(args.limit, 50, 1, 1000);
+                        const offset = normalizeLimit(args.offset, 0, 0, 1_000_000);
                         // Fan-out merge: ask every account for its own top-`limit` actionable threads
                         // (each account's own getActionableThreads already sorts by score, then
                         // recency — see local-index-service.ts), tag every thread/message id with its
@@ -6881,8 +7015,8 @@ export function createServer(config, options = {}) {
                     }
                 case "get_inbox_digest":
                     {
-                        const limit = typeof args.limit === "number" ? args.limit : 10;
-                        const offset = typeof args.offset === "number" ? Math.max(0, Math.floor(args.offset)) : 0;
+                        const limit = normalizeLimit(args.limit, 10, 1, 1000);
+                        const offset = normalizeLimit(args.offset, 0, 0, 1_000_000);
                         // Each account is asked for offset+limit+1 rows per section: enough to slice the requested
                         // page from the merged list and to know whether another page exists.
                         const perAccountWindow = offset + limit + 1;
@@ -6903,11 +7037,12 @@ export function createServer(config, options = {}) {
                             });
                             const result = await bundle.localIndexService.getInboxDigest({
                                 limit: perAccountWindow,
-                                minAgeHours: typeof args.minAgeHours === "number" ? args.minAgeHours : undefined,
+                                minAgeHours: optionalNumber(args.minAgeHours, 0, 87_600),
                             });
                             const slug = slugForBundle(bundle);
                             return {
                                 counts: (result.counts ?? {}),
+                                countsCapped: result.countsCapped === true,
                                 indexUpdatedAt: result.indexUpdatedAt,
                                 topThreads: tagAccountIds(slug, (result.topThreads ?? [])),
                                 staleAwaitingYou: tagAccountIds(slug, (result.staleAwaitingYou ?? [])),
@@ -6933,6 +7068,9 @@ export function createServer(config, options = {}) {
                             generatedAt: new Date().toISOString(),
                             indexUpdatedAt: perAccount.map((entry) => entry.indexUpdatedAt).filter(Boolean).sort().reverse()[0],
                             counts,
+                            ...(perAccount.some((entry) => entry.countsCapped)
+                                ? { countsCapped: true, countsNote: "counts and topThreads cover only the newest 5000 indexed messages per account." }
+                                : {}),
                             topThreads,
                             staleAwaitingYou,
                             // Each section pages independently with the same offset/limit: pass nextOffset back as
@@ -6947,8 +7085,8 @@ export function createServer(config, options = {}) {
                     }
                 case "get_follow_up_candidates":
                     {
-                        const limit = typeof args.limit === "number" ? args.limit : 25;
-                        const offset = typeof args.offset === "number" ? Math.max(0, Math.floor(args.offset)) : 0;
+                        const limit = normalizeLimit(args.limit, 25, 1, 1000);
+                        const offset = normalizeLimit(args.offset, 0, 0, 1_000_000);
                         // Fan-out merge: ask every account for its own top-`limit` follow-up
                         // candidates (each account's own getFollowUpCandidates sorts by ageHours, then
                         // score), tag ids with the account's slug, concatenate, re-sort by that same
@@ -6962,7 +7100,7 @@ export function createServer(config, options = {}) {
                             });
                             const result = await bundle.localIndexService.getFollowUpCandidates({
                                 limit: limit + offset,
-                                minAgeHours: typeof args.minAgeHours === "number" ? args.minAgeHours : undefined,
+                                minAgeHours: optionalNumber(args.minAgeHours, 0, 87_600),
                                 pendingOn: args.pendingOn === "you" || args.pendingOn === "them" || args.pendingOn === "any"
                                     ? args.pendingOn
                                     : undefined,
@@ -6987,7 +7125,7 @@ export function createServer(config, options = {}) {
                         const result = {
                             generatedAt: new Date().toISOString(),
                             indexUpdatedAt: perAccount.map((entry) => entry.indexUpdatedAt).filter(Boolean).sort().reverse()[0],
-                            minAgeHours: typeof args.minAgeHours === "number" ? args.minAgeHours : 24,
+                            minAgeHours: (optionalNumber(args.minAgeHours, 0, 87_600) ?? 24),
                             pendingOn: args.pendingOn === "you" || args.pendingOn === "them" || args.pendingOn === "any" ? args.pendingOn : "you",
                             total: totalCount,
                             ...paginationFields(totalCount, offset, followUpBudget.threads.length, followUpBudget.trimmed),
@@ -6999,7 +7137,7 @@ export function createServer(config, options = {}) {
                     }
                 case "find_document_threads":
                     {
-                        const limit = typeof args.limit === "number" ? args.limit : 25;
+                        const limit = normalizeLimit(args.limit, 25, 1, 1000);
                         // Fan-out merge: ask every account for its own top-`limit` document threads
                         // (each account's own findDocumentThreads sorts by document count, then
                         // recency), tag ids (including each document's own emailId) with the
@@ -7051,7 +7189,7 @@ export function createServer(config, options = {}) {
                     }
                 case "prepare_meeting_context":
                     {
-                        const limit = typeof args.limit === "number" ? args.limit : 10;
+                        const limit = normalizeLimit(args.limit, 10, 1, 1000);
                         // Fan-out merge: ask every account for its own top-`limit` meeting-prep
                         // threads (each account's own getMeetingPrep sorts by recency — see
                         // local-index-service.ts), tag ids with the account's slug, concatenate,
@@ -7226,7 +7364,7 @@ export function createServer(config, options = {}) {
                                 // Same fix as create_reply_draft — see its comment.
                                 from: optionalString(args, "from"),
                                 inReplyTo: detail.messageId,
-                                references: detail.messageId ? [detail.messageId] : undefined,
+                                references: replyReferences(detail),
                                 attachments,
                                 sourceEmailId: detail.id,
                                 sourceMessageId: detail.messageId,
@@ -7348,25 +7486,28 @@ export function createServer(config, options = {}) {
                     {
                         const rawEmailId = requireString(args, "emailId");
                         const { bundle, rest: emailId } = resolveAccountForEmailId(rawEmailId);
+                        const saveTo = optionalString(args, "saveTo");
+                        if (saveTo) {
+                            // A save writes to disk: it needs the download directory, and the inline-size limit (which bounds
+                            // what is returned in the reply) does not apply. Checked before the attachment is fetched.
+                            const downloadDir = config.runtime.allowFileDownloadDir;
+                            if (!downloadDir) {
+                                throw new McpError(ErrorCode.InvalidParams, "PROTONMAIL_ALLOW_FILE_DOWNLOAD_DIR env var is not set.");
+                            }
+                            const saving = await bundle.imapService.getAttachmentContent(emailId, requireString(args, "attachmentId"), { forSave: true });
+                            const buf = Buffer.from(saving.base64 ?? "", "base64");
+                            const savedPath = await writeAttachmentToDownloadDir(downloadDir, saveTo, buf);
+                            return createTextResult({ saved: true, path: savedPath, bytes: buf.length, filename: saving.attachment?.filename });
+                        }
                         const result = await bundle.imapService.getAttachmentContent(emailId, requireString(args, "attachmentId"), normalizeBoolean(args.includeBase64, false));
                         result.emailId = prefixedIdFor(bundle, result.emailId);
-                        const saveTo = optionalString(args, "saveTo");
-                        if (!saveTo && result.base64) {
+                        if (result.base64) {
                             const MAX_INLINE_BYTES = (config.runtime.maxInlineBytes ?? 40) * 1024;
                             const decodedSize = Math.floor(result.base64.length * 0.75);
                             if (decodedSize > MAX_INLINE_BYTES) {
                                 throw new McpError(ErrorCode.InvalidParams, `Attachment is ~${Math.round(decodedSize / 1024)}KB decoded. Inline limit is ${config.runtime.maxInlineBytes ?? 40}KB. Set PROTONMAIL_ALLOW_FILE_DOWNLOAD_DIR and pass saveTo to write to disk instead, or increase the limit with PROTONMAIL_MAX_INLINE_BYTES.`);
                             }
                         }
-                        if (saveTo && result.base64) {
-                            const downloadDir = config.runtime.allowFileDownloadDir;
-                            if (!downloadDir) {
-                                throw new McpError(ErrorCode.InvalidParams, "PROTONMAIL_ALLOW_FILE_DOWNLOAD_DIR env var is not set.");
-                            }
-                            const buf = Buffer.from(result.base64, "base64");
-                            const savedPath = await writeAttachmentToDownloadDir(downloadDir, saveTo, buf);
-                            return createTextResult({ saved: true, path: savedPath, bytes: buf.length, filename: result.attachment?.filename });
-                        }
                         return createTextResult(result, false, [attachmentSource(result.emailId, result.attachment)]);
                     }
                 case "get_attachment_text": {
@@ -7391,7 +7532,7 @@ export function createServer(config, options = {}) {
                             const absTarget = pathResolve(join(absDir, saveTo));
                             // See the identical fix/comment in get_attachment_content above —
                             // hardcoded "/" never matched a real subdirectory path on win32.
-                            if (!absTarget.startsWith(absDir + pathSep) && absTarget !== absDir) {
+                            if (!isPathInside(absDir, absTarget, pathSep)) {
                                 throw new McpError(ErrorCode.InvalidParams, "saveTo path escapes the allowed directory.");
                             }
                             resolvedPath = absTarget;
@@ -7422,6 +7563,10 @@ export function createServer(config, options = {}) {
                     // those bytes as UTF-8 either mangles them or throws outright.
                     // rawBase64 preserves the message byte-for-byte regardless of
                     // its original encoding.
+                    // Bounded before the bytes are decoded: base64 is about a third larger than what it encodes.
+                    if ((rawBase64 ?? rawText ?? "").length > MAX_IMPORT_MESSAGE_BYTES * (rawBase64 ? 4 / 3 : 1)) {
+                        throw new McpError(ErrorCode.InvalidParams, `The message is larger than the ${Math.round(MAX_IMPORT_MESSAGE_BYTES / 1024 / 1024)} MB import limit.`);
+                    }
                     const raw = rawBase64
                         ? Buffer.from(rawBase64, "base64")
                         : Buffer.from(rawText, "utf8");
@@ -7494,6 +7639,9 @@ export function createServer(config, options = {}) {
             if (error instanceof McpError) {
                 throw error;
             }
+            if (error instanceof InvalidArgumentError) {
+                throw new McpError(ErrorCode.InvalidParams, error.message);
+            }
             logger.error("Tool call failed", "MCPServer", { name, error });
             if (isLikelyAuthenticationError(error)) {
                 throw new McpError(ErrorCode.InternalError, "IMAP authentication failed. Check that PROTONMAIL_PASSWORD is your Proton Bridge password (not your Proton account password) and that you're signed in inside the Bridge app. Run run_doctor for a full connectivity check.");
@@ -7528,6 +7676,26 @@ export function createServer(config, options = {}) {
         accountManager,
     };
 }
+// Stops every account's timers, then closes connections and indexes, waiting at most `timeoutMs` for the
+// closing to finish. A Bridge that never answers LOGOUT must not hold the process up (imapflow's own socket
+// timeout is minutes, and a pending shutdown ignores further signals).
+const MAX_IMPORT_MESSAGE_BYTES = 50 * 1024 * 1024;
+export async function stopAllAccounts(bundles, timeoutMs = 3_000) {
+    for (const bundle of bundles) {
+        bundle.backgroundSyncService.stop();
+        bundle.deliveryQueueService.stop();
+        bundle.snoozeService.stop();
+    }
+    const closing = Promise.allSettled(bundles.flatMap((bundle) => [
+        Promise.resolve().then(() => bundle.imapService.disconnect()),
+        Promise.resolve().then(() => bundle.smtpService.close()),
+        Promise.resolve().then(() => bundle.localIndexService.close()),
+    ]));
+    let timer;
+    await Promise.race([closing, new Promise((resolve) => { timer = setTimeout(resolve, timeoutMs); })]);
+    if (timer)
+        clearTimeout(timer);
+}
 export async function main() {
     const config = buildConfigFromEnv();
     // Create the data directory explicitly with a restrictive mode as its very
@@ -7544,7 +7712,7 @@ export async function main() {
     // Explicitly chmod it too so the restriction actually takes effect on
     // upgrade, not only on a brand-new dataDir.
     await chmod(config.dataDir, 0o700).catch(() => { });
-    const { server, smtpService, imapService, backgroundSyncService, deliveryQueueService, snoozeService, accountManager } = createServer(config, {
+    const { server, accountManager } = createServer(config, {
         startBackgroundSync: true,
     });
     logger.info("Starting ProtonMail MCP server", "MCPServer");
@@ -7558,14 +7726,7 @@ export async function main() {
         }
         shuttingDown = true;
         logger.info(`Received ${reason}, shutting down`, "MCPServer");
-        backgroundSyncService.stop();
-        deliveryQueueService.stop();
-        snoozeService.stop();
-        await Promise.allSettled([
-            imapService.disconnect(),
-            smtpService.close(),
-            ...accountManager.all().map((bundle) => bundle.localIndexService.close()),
-        ]);
+        await stopAllAccounts(accountManager.all());
         process.exit(0);
     };
     process.on("SIGINT", () => {