Changelog

Notable changes to the agent packages: AgentSkill, the MCP servers, presets and integrations. The source of truth is CHANGELOG.md in the repository; this page mirrors it.

27 Sep 2026

v0.3.311 security · 3 fixed

• Python clients now JSON-escape $VAR values. langchain-atomicmail, pydantic-ai-atomicmail and the Dify plugin substituted $VAR values into the JMAP JSON unescaped, so a crafted inbound subject could add method calls to a reply.json batch (reachable since 0.3.30). Values are now escaped in string context, like the TypeScript runtime. Python callers who pre-escaped values (for example \n for a newline) should now pass raw text.
• reply.json picks its recipient like the hosted MCP server (first usable Reply-To, else From, else Sender) and replies to that one address only. Line breaks in the subject collapse to a space and an existing Re: is kept.
• Send examples in help and the docs now file the sender's copy in Sent and clear $draft on success, like the bundled presets.

SecurityFixed

27 Sep 2026

v0.3.302 fixed · 1 changed · 2 added

• Sent mail no longer stays a draft in the inbox. The send presets (send_mail.json, send_mail_attachment.json, send_mail_blob_attachment.json, reply.json) now file the sender's copy in Sent and clear $draft once the message is submitted, so it is marked $sent instead of looking unsent. Accounts without a Sent mailbox keep using the inbox.
• reply.json sends again, in the same thread. The server rejected it with invalidProperties, so no reply ever went out. The client now looks up the original by MAIL_ID and replies to its Reply-To (else From), with Re: and inReplyTo set. Inputs are unchanged (MAIL_ID, BODY), so the n8n and Dify reply actions work too.
• list_inbox.json shows only mail that arrived; the agent's own sent mail is no longer mixed in. Read it with list_sent.json.

FixedChangedAdded