v0.14.0

In short

• Security: with 0.13.0, a reply or a forward saved as a draft (mode: "draft") could carry an image or a link
  of the original message that Thunderbird fetches and attaches when the draft is opened and sent. Fixed here; update
  if you use drafts of replies or forwards. Direct sends and replies made in Thunderbird's window were not affected.
• New: replyToMessage can answer the newest message of a conversation (latestInThread), in a window or as a
  draft.
• Fixed: a signature with images read from files, and the bridge now waits long enough for a slow send or save.
• Changes you may notice: moz-do-not-send="false" in an HTML body passed to the compose tools is no longer
  kept. No call that worked stops working.
• This release changes the bridge: update it in every MCP client (steps below). A bridge 0.13 keeps working.

How to update

• Thunderbird add-on: it updates itself. To get this version now: Add-ons and Themes, gear menu, Check for Updates, then restart Thunderbird. For a first installation, see the README (commonpost-mcp-v0.14.0.xpi below).
• MCP bridge: it is installed in your MCP client and is never updated automatically. This release changes the bridge: update it in every MCP client that uses it.
  • Claude Desktop: download commonpost-mcp-v0.14.0.mcpb below and open it with Claude Desktop; if the file does not open there (Windows), use Settings > Extensions > Advanced settings > Install Extension.
  • Other clients (Claude Code, Cursor, VS Code, ...): download mcp-bridge.cjs below and put it in place of your copy, then restart the client or reconnect the server (/mcp in Claude Code). The path of your copy is in the MCP configuration of the client (Claude Code: claude mcp get <server name>).
  • Not sure which bridges you have? The options page of the add-on (section Bridge) lists the bridges that connected, each with its version and "Up to date" or "Update recommended". Claude Desktop and another client on the same computer are two bridges, updated separately.

The .sigstore.json files are provenance attestations, not something to install.

All changes

Added

• replyToMessage latestInThread: true replies to the newest message of the conversation (Sent included; Drafts,
  Templates and the Outbox left out), found as searchMessages threadOf finds it. When that is another message
  than the one passed, the result names it in repliedTo (messageId, folderPath, date, and
  linkedBy: "subject" when it has no References to the conversation). The server instructions gain a line on
  replies and one on editing drafts with saveDraft draftId. Thanks to Konstantin (@mazixs), last piece of #18.
  • Only for a window or a draft, which you review: with mode: "send" (or skipReview) it is refused, because
    anyone can join a conversation with a message and the newest one would be quoted and answered unseen. It also
    needs the searchMessages tool enabled.
  • threadIncomplete: true in the result means the mailbox holds more messages than the conversation search reads
    (10,000 headers): a newer message may exist.

Security

• A reply or a forward saved as a draft (mode: "draft") could keep an image or a link of the original message
  without the moz-do-not-send="true" mark that Thunderbird's own reply sets, and with the sender's own
  moz-do-not-send="false". The mark was set on the tags found in the text of the quote, and a tag that the text
  and Thunderbird's parser read differently (a quote character in an attribute name is enough) was missed. Opened in
  the compose window and sent, such a draft makes Thunderbird fetch the URL and attach what it gets, as it does for
  an object marked "false". The elements Thunderbird's parser finds in the quote are now checked after the text,
  and no moz-do-not-send written by the message is kept. A direct send was not affected (it embeds nothing), nor
  a reply made in Thunderbird's window.
• The <html>, <head> and <body> tags of a quoted message are removed from its text; a <body> tag could be
  left when the removal itself put one together (<bo<body x>dy background=...>), and it then gave its attributes,
  a background image for one, to the body of the draft. What is left of such a tag is now text.
• moz-do-not-send="false" in the HTML body given by the caller (sendMail, saveDraft, replyToMessage,
  forwardMessage) is no longer kept either, for the same reason: text an assistant wrote after reading a message
  must not make Thunderbird fetch and attach a URL. moz-do-not-send="true" is kept.

Fixed

• A signature with file:// images: the URL that was replaced by its data was looked for in a lower-cased copy of the
  signature, made again for every URL, and a character whose lower case is longer (U+0130) before a URL moved the
  place that was replaced. The signature is now read once, as it is.
• mcp-bridge.cjs waits up to 180 s, instead of 150 s, for a direct send or a saved draft. Before the 120 s of the
  send or the save, the add-on can wait for a folder summary (20 s), the original message (20 s) and its quote
  (15 s): 175 s in all, so a bridge that gave up at 150 s could report a failure for a message that still went out. A
  test now keeps the wait of the bridge above the sum of the waits of the add-on. A bridge 0.13 keeps working.