0.10.0

Removed

• Dropped Node.js 20.x support: 20.x is end-of-life and has no patch for the
  October 2026 security release (Brotli RCE CVE-2026-111497 and others).
  The engines floor is now >=22; use 22.23.4+, 24.22.1+, or 26.12.1+.

0.9.0

Added

• New read-only mail tool mail_list_inference_overrides: the Focused/Other
  sender overrides, on the group's Mail.Read — no new scope needed.

0.8.1

Fixed

• Harden sidecar temp and token-cache permissions: mip-decrypt tightens
  passthrough and decrypted outputs to owner-only, the example auth helper
  creates its token cache atomically at 0600, and the README documents
  storage cleanup. No parsing or detection behavior change.

0.8.0

Added

• Purview-protected (AIP/RMS) document support in files_parse_document:
  wrappers are detected by their markers (cover text is a second net) and
  refused with PROTECTED_DOCUMENT instead of returning the cover page as
  content. With a mip-decrypt sidecar configured (--mip-decryptor /
  MS365_MCP_MIP_DECRYPTOR, else a bundled copy or PATH lookup), the
  document is decrypted through a temp file and parsed, and the result and
  manifest carry protected, protection: 'aip-rms' and decrypted.
  status, permissions and graph_list_permissions report the sidecar
  as mip-decryptor resolved or absent. No new Graph scope and no new
  dependency: the sidecar (see native/mip-decrypt) authenticates to RMS
  on its own. See Rights Management consent.

0.7.0

Added

• Login-time identity snapshot: every successful sign-in caches who signed
  in (username, display name, tenant) encrypted beside the token cache, so
  status output can name the session without a Graph call. session_status
  returns it as cachedIdentity, and tools can opt in to a one-line header
  above their output. The snapshot is dropped with logout, when the
  session can no longer mint tokens, or when another process signs in over
  it; a missing or corrupt file reads as absent, never as an error.

0.6.1

Added

• Proxy support: when HTTPS_PROXY/https_proxy/ALL_PROXY/all_proxy
  is set, the global fetch is wrapped at startup (CONNECT tunneling for
  HTTPS, absolute-form for HTTP, NO_PROXY honored), so Entra, Graph and
  the update check work behind a proxy. One stderr line names the proxy
  host when it activates. A malformed proxy value warns on stderr and falls
  back to a direct connection instead of failing startup.

Fixed

• Behind a proxy, sign-in and every Graph call failed with ENOTFOUND
  (Node's fetch ignores proxy variables); requests now route through
  the proxy automatically. See Proxy.

0.6.0

Added

• Per-group usage examples: every tool group now has a prompt-plus-call
  example in docs/examples.md.
• Boolean flags accept an explicit value: --read-only=false switches off
  MS365_MCP_READ_ONLY=true, using the same vocabulary as the environment
  variables.
• permissions annotates cross-group scopes with a one-clause reason, so
  files -> Mail.Read and the search index scopes explain themselves.

Changed

• README slimmed to an overview; detail sections moved to docs/
  (auth, configuration, tools, examples, troubleshooting, security,
  agents, why).
• status reports the exposed tool count (36 under --read-only,
  6 under --discovery) instead of the raw catalogue total.
• status names dropped groups inline with the --org-mode remedy
  instead of printing an empty group list.
• logout with no session says nothing was removed rather than
  claiming it deleted files.
• --groups is case-insensitive, like --preset.
• --help documents that --preset and --groups combine by union.
• permissions closing line now distinguishes Microsoft's classification
  from the tenant consent policy gate.

Fixed

• Help examples used the nonexistent microsoft-graph-mcp command;
  every user-facing command string now uses the real ms-graph-mcp bin.
• A bad environment value no longer defeats --help/--version;
  real commands still fail fast on it.
• Non-login commands warn on stderr when --scopes/--full would
  be silently ignored.

0.5.0

Added

• CLI update notice: human commands print a one-line stderr notice when a
  newer release is on npm (24h cache, silent offline, NO_UPDATE_NOTIFIER
  respected, serve stdout untouched).
• README install prompt block at the top for one-paste AI setup.

Changed

• Raise extraction fidelity: unit text renders tables as Markdown and the
  manifest carries a titles[] outline, so outline-first reads need no text
  fetch. docx gains header/footer units, tracked-change tagging and comments;
  xlsx renders number formats, skips hidden rows/sheets with warnings, and
  fills merged cells; pptx follows SmartArt/chart references with warning
  fallback, dedupes master text, and skips note placeholders.
• Releases now also cut a GitHub Release from the CHANGELOG section.