fix: harden calendar code from post-merge security review; bump to v1.11.0

Five findings from an adversarial review of the merged PR #53 code:

- escapeICalText: normalize bare CR to LF before escaping and strip
  remaining control characters — a lone \r previously passed through
  verbatim and could act as a line terminator for downstream parsers
  (iCal property injection via title/description/location).
- normalizeMasterVEventFirst: reorder VEVENT blocks so the master (no
  RECURRENCE-ID) is first before in-place patching. Component order is
  not guaranteed by RFC; an exception-first payload previously had its
  exception patched and skipped the recurring-event guard.
- parseICalDateAsUTC: orphaned-exception detection now compares
  RECURRENCE-IDs and RRULE occurrences in a single UTC frame. With
  TZ != UTC, naive datetimes were parsed in local time while rrule used
  naive-as-UTC, flagging valid exceptions as orphans (deleted once the
  user passed confirmRecurring).
- replaceICalProperty: insert new properties before the first
  sub-component (VALARM) per RFC 5545 ABNF eventprop *alarmc.
- Quoted TZID params handled in formatDateTimeProperty and
  removeOrphanedVTimezones (plus fold-aware reference scanning).

15 new unit tests pin these behaviors. Version synced to 1.11.0 across
package.json, manifest.json, src/index.ts, and README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: MadLlama25

README.md

@@ -114,7 +114,7 @@ Pin to a tagged release:
 
 ```bash
 FASTMAIL_API_TOKEN="your_token" \
-  npx --yes github:MadLlama25/fastmail-mcp@v1.10.0 fastmail-mcp
+  npx --yes github:MadLlama25/fastmail-mcp@v1.11.0 fastmail-mcp
 ```
 
 ## Install as a Claude Desktop Extension (DXT)

manifest.json

@@ -1,7 +1,7 @@
 {
   "dxt_version": "0.1",
   "name": "fastmail-mcp",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "MCP server for Fastmail API integration",
   "author": {
     "name": "Jeremy Gill"

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "fastmail-mcp",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "MCP server for Fastmail API integration",
   "main": "dist/index.js",
   "type": "module",

package.json

@@ -12,6 +12,8 @@ import {
   escapeICalText,
   unescapeICalText,
   validateAndFormatICalDate,
+  parseICalDateAsUTC,
+  normalizeMasterVEventFirst,
   toICalUTC,
   foldICalLine,
   detectLineEnding,
@@ -2148,3 +2150,138 @@ describe('Recurring event: no orphans proceeds without confirmRecurring', () =>
     assert.ok(updatedData.includes('DTEND:20260406T120000Z')); // End updated
   });
 });
+
+// ---------- v1.11.0 review fixes ----------
+
+describe('escapeICalText control-character hardening', () => {
+  it('escapes a bare CR as \\n instead of passing it through', () => {
+    assert.equal(escapeICalText('Standup\rATTENDEE:mailto:x@example.com'),
+      'Standup\\nATTENDEE:mailto:x@example.com');
+  });
+
+  it('still escapes CRLF and LF as \\n', () => {
+    assert.equal(escapeICalText('a\r\nb\nc'), 'a\\nb\\nc');
+  });
+
+  it('strips other control characters', () => {
+    assert.equal(escapeICalText('a\x00b\x08c\x7Fd'), 'abcd');
+  });
+
+  it('keeps horizontal tabs (legal in iCal TEXT)', () => {
+    assert.equal(escapeICalText('a\tb'), 'a\tb');
+  });
+});
+
+describe('parseICalDateAsUTC', () => {
+  it('interprets naive datetimes as UTC regardless of process TZ', () => {
+    const d = parseICalDateAsUTC('2026-03-20T09:30:00');
+    assert.equal(d.getTime(), Date.UTC(2026, 2, 20, 9, 30, 0));
+  });
+
+  it('handles explicit Z', () => {
+    assert.equal(parseICalDateAsUTC('2026-03-20T09:30:00Z').getTime(), Date.UTC(2026, 2, 20, 9, 30, 0));
+  });
+
+  it('handles offsets', () => {
+    assert.equal(parseICalDateAsUTC('2026-03-20T10:30:00+01:00').getTime(), Date.UTC(2026, 2, 20, 9, 30, 0));
+  });
+
+  it('handles date-only as UTC midnight', () => {
+    assert.equal(parseICalDateAsUTC('2026-03-20').getTime(), Date.UTC(2026, 2, 20));
+  });
+});
+
+describe('normalizeMasterVEventFirst', () => {
+  const exception = 'BEGIN:VEVENT\nUID:u1\nRECURRENCE-ID:20260327T093000Z\nDTSTART:20260327T110000Z\nSUMMARY:Moved instance\nEND:VEVENT';
+  const master = 'BEGIN:VEVENT\nUID:u1\nDTSTART:20260320T093000Z\nRRULE:FREQ=WEEKLY\nSUMMARY:Weekly\nEND:VEVENT';
+
+  it('moves the master VEVENT ahead of an exception-first ordering', () => {
+    const data = `BEGIN:VCALENDAR\n${exception}\n${master}\nEND:VCALENDAR`;
+    const out = normalizeMasterVEventFirst(data);
+    const firstVevent = out.match(/BEGIN:VEVENT[\s\S]*?END:VEVENT/)?.[0] || '';
+    assert.ok(/^RRULE/m.test(firstVevent), 'master (RRULE, no RECURRENCE-ID) should now be first');
+    assert.ok(out.includes('Moved instance'), 'exception must be preserved');
+  });
+
+  it('leaves master-first payloads untouched', () => {
+    const data = `BEGIN:VCALENDAR\n${master}\n${exception}\nEND:VCALENDAR`;
+    assert.equal(normalizeMasterVEventFirst(data), data);
+  });
+
+  it('leaves single-VEVENT payloads untouched', () => {
+    const data = `BEGIN:VCALENDAR\n${master}\nEND:VCALENDAR`;
+    assert.equal(normalizeMasterVEventFirst(data), data);
+  });
+});
+
+describe('replaceICalProperty insert position with VALARM', () => {
+  it('inserts a new property before the first sub-component, not after it', () => {
+    const data = [
+      'BEGIN:VCALENDAR',
+      'BEGIN:VEVENT',
+      'UID:u1',
+      'DTSTART:20260320T093000Z',
+      'BEGIN:VALARM',
+      'TRIGGER:-PT15M',
+      'END:VALARM',
+      'END:VEVENT',
+      'END:VCALENDAR',
+    ].join('\n');
+    const out = replaceICalProperty(data, 'DESCRIPTION', 'DESCRIPTION:hello');
+    const descIdx = out.indexOf('DESCRIPTION:hello');
+    const alarmIdx = out.indexOf('BEGIN:VALARM');
+    assert.ok(descIdx !== -1 && alarmIdx !== -1);
+    assert.ok(descIdx < alarmIdx, 'property must precede VALARM per RFC 5545 ABNF');
+  });
+});
+
+describe('removeOrphanedVTimezones quoted/folded references', () => {
+  it('keeps a VTIMEZONE referenced via a quoted TZID parameter', () => {
+    const data = [
+      'BEGIN:VCALENDAR',
+      'BEGIN:VTIMEZONE',
+      'TZID:Custom/Zone',
+      'END:VTIMEZONE',
+      'BEGIN:VEVENT',
+      'UID:u1',
+      'DTSTART;TZID="Custom/Zone":20260320T093000',
+      'END:VEVENT',
+      'END:VCALENDAR',
+    ].join('\n');
+    const out = removeOrphanedVTimezones(data);
+    assert.ok(out.includes('BEGIN:VTIMEZONE'), 'referenced VTIMEZONE must not be removed');
+  });
+
+  it('keeps a VTIMEZONE whose reference is split across a folded line', () => {
+    const data = [
+      'BEGIN:VCALENDAR',
+      'BEGIN:VTIMEZONE',
+      'TZID:America/Argentina/ComodRivadavia',
+      'END:VTIMEZONE',
+      'BEGIN:VEVENT',
+      'UID:u1',
+      'DTSTART;TZID=America/Argentina/Comod',
+      ' Rivadavia:20260320T093000',
+      'END:VEVENT',
+      'END:VCALENDAR',
+    ].join('\n');
+    const out = removeOrphanedVTimezones(data);
+    assert.ok(out.includes('BEGIN:VTIMEZONE'), 'folded reference must still count');
+  });
+
+  it('still removes a genuinely orphaned VTIMEZONE', () => {
+    const data = [
+      'BEGIN:VCALENDAR',
+      'BEGIN:VTIMEZONE',
+      'TZID:Unused/Zone',
+      'END:VTIMEZONE',
+      'BEGIN:VEVENT',
+      'UID:u1',
+      'DTSTART:20260320T093000Z',
+      'END:VEVENT',
+      'END:VCALENDAR',
+    ].join('\n');
+    const out = removeOrphanedVTimezones(data);
+    assert.ok(!out.includes('BEGIN:VTIMEZONE'));
+  });
+});

src/caldav-client.test.ts

@@ -335,9 +335,14 @@ export function replaceICalProperty(icalData: string, key: string, newLine: stri
     const newLines = newLine !== null ? newLine.split(/\r?\n/) : [];
     lines.splice(foundIdx, foundEndIdx - foundIdx, ...newLines);
   } else if (newLine !== null) {
-    // Insert before END:VEVENT
+    // Insert before the first sub-component (e.g. VALARM) when present —
+    // RFC 5545 ABNF is `eventprop *alarmc`, so properties must precede alarms.
+    let insertAt = veventEnd;
+    for (let i = veventStart + 1; i < veventEnd; i++) {
+      if (lines[i].trim().startsWith('BEGIN:')) { insertAt = i; break; }
+    }
     const newLines = newLine.split(/\r?\n/);
-    lines.splice(veventEnd, 0, ...newLines);
+    lines.splice(insertAt, 0, ...newLines);
   }
 
   return lines.join(lineEnding);
@@ -478,13 +483,15 @@ export function removeOrphanedVTimezones(icalData: string): string {
     if (lines[i].trim() === 'END:VTIMEZONE') { inTz = false; continue; }
     if (!inTz) nonTzLines.push(lines[i]);
   }
-  const nonTzContent = nonTzLines.join('\n');
+  // Unfold before scanning so a reference split across a folded line isn't
+  // missed, and check both bare and quoted parameter forms.
+  const nonTzContent = nonTzLines.join('\n').replace(/\n[ \t]/g, '');
 
   // Check each VTIMEZONE for references
   const orphaned = tzBlocks.filter(tz => {
     if (!tz.tzid) return false;
-    // Check for ;TZID=<tzid> references in any property
-    return !nonTzContent.includes(`;TZID=${tz.tzid}`);
+    return !nonTzContent.includes(`;TZID=${tz.tzid}`) &&
+           !nonTzContent.includes(`;TZID="${tz.tzid}"`);
   });
 
   // Remove orphaned blocks in reverse order
@@ -535,8 +542,9 @@ export function removeExceptionVEvents(icalData: string, orphanedRecurrenceIds:
     if (!block.recurrenceId) return false; // master VEVENT — never remove
     const recIdFormatted = formatICalDate(block.recurrenceId);
     if (!recIdFormatted) return false;
-    // Compare as UTC ISO string — handles both date-only and datetime
-    const recDate = new Date(recIdFormatted);
+    // Compare in a fixed UTC frame — naive datetimes must not be interpreted
+    // in the process's local timezone (must match orphan-detection's frame).
+    const recDate = parseICalDateAsUTC(recIdFormatted);
     const recDateStr = recDate.toISOString().replace(/\.\d{3}Z$/, 'Z');
     return orphanedDateStrings.includes(recDateStr);
   });
@@ -701,10 +709,17 @@ export function unescapeICalText(value: string): string {
  */
 export function escapeICalText(value: string): string {
   return value
+    // Normalize CRLF and BARE CR to LF first — a lone \r would otherwise pass
+    // through untouched and act as a line terminator for downstream parsers,
+    // reopening the property-injection class the date paths are guarded against.
+    .replace(/\r\n?/g, '\n')
+    // Strip remaining control characters (HTAB is legal in iCal TEXT; LF is
+    // escaped below).
+    .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '')
     .replace(/\\/g, '\\\\')
     .replace(/;/g, '\\;')
     .replace(/,/g, '\\,')
-    .replace(/\r?\n/g, '\\n');
+    .replace(/\n/g, '\\n');
 }
 
 /**
@@ -857,7 +872,7 @@ function formatDateTimeProperty(
     if (originalVevent) {
       const rawLines = parseAllICalProperties(originalVevent, propName);
       if (rawLines.length > 0) {
-        const tzMatch = rawLines[0].match(/;TZID=([^;:]+)/);
+        const tzMatch = rawLines[0].match(/;TZID=("[^"]*"|[^;:]+)/);
         if (tzMatch) {
           return { line: foldICalLine(`${propName};TZID=${tzMatch[1]}:${icalTime}`, lineEnding), isDateOnly: false };
         }
@@ -866,7 +881,7 @@ function formatDateTimeProperty(
       if (propName === 'DTEND') {
         const startLines = parseAllICalProperties(originalVevent, 'DTSTART');
         if (startLines.length > 0) {
-          const tzMatch = startLines[0].match(/;TZID=([^;:]+)/);
+          const tzMatch = startLines[0].match(/;TZID=("[^"]*"|[^;:]+)/);
           if (tzMatch) {
             return { line: foldICalLine(`${propName};TZID=${tzMatch[1]}:${icalTime}`, lineEnding), isDateOnly: false };
           }
@@ -920,6 +935,43 @@ function nextDay(dateStr: string): string {
   return d.toISOString().slice(0, 10);
 }
 
+/**
+ * Parse an ISO-ish date/datetime string in a fixed UTC frame.
+ * Naive datetimes ("2026-03-20T09:30:00") are interpreted as UTC — matching
+ * rrule's naive-as-UTC convention — instead of the process's local timezone,
+ * which `new Date(...)` would use. Without this, orphaned-exception detection
+ * compares RECURRENCE-IDs and RRULE occurrences in two different timezone
+ * frames whenever TZ != UTC, flagging valid exceptions as orphans.
+ */
+export function parseICalDateAsUTC(iso: string): Date {
+  if (/^\d{4}-\d{2}-\d{2}$/.test(iso)) return new Date(iso + 'T00:00:00Z');
+  if (/Z$|[+-]\d{2}:?\d{2}$/.test(iso)) return new Date(iso);
+  return new Date(iso + 'Z');
+}
+
+/**
+ * Reorder VEVENT blocks so the master (no RECURRENCE-ID) comes first.
+ * RFC 5545/4791 do not guarantee component ordering — a resource authored by
+ * a third-party client may list an overridden instance before the master.
+ * All in-place patch helpers target the first VEVENT, so without this
+ * normalization an exception-first payload would have its exception patched
+ * (and the recurring-event guard skipped) instead of the master.
+ */
+export function normalizeMasterVEventFirst(icalData: string): string {
+  const vevents = icalData.match(/BEGIN:VEVENT[\s\S]*?END:VEVENT/g) || [];
+  if (vevents.length < 2) return icalData;
+  const first = vevents[0];
+  if (!first || !/^RECURRENCE-ID[;:]/m.test(first)) return icalData;
+  const master = vevents.find(v => !/^RECURRENCE-ID[;:]/m.test(v));
+  if (!master) return icalData;
+  // Swap the two blocks. Function replacements avoid `$`-pattern expansion.
+  const SENTINEL = '\u0000MASTER-VEVENT\u0000';
+  let out = icalData.replace(master, () => SENTINEL);
+  out = out.replace(first, () => master);
+  out = out.replace(SENTINEL, () => first);
+  return out;
+}
+
 export class CalDAVCalendarClient {
   private config: CalDAVConfig;
   private client: DAVClient | null = null;
@@ -1164,14 +1216,18 @@ export class CalDAVCalendarClient {
     const lineEnding = detectLineEnding(obj.data);
     const fold = (line: string) => foldICalLine(line, lineEnding);
 
+    // All patch helpers target the FIRST VEVENT — make sure that's the master,
+    // not an overridden instance (component order is not guaranteed by RFC).
+    const normalizedData = normalizeMasterVEventFirst(obj.data);
+
     // Capture original VEVENT before any patching for reads
-    const originalVevent = extractVEvent(obj.data);
+    const originalVevent = extractVEvent(normalizedData);
     if (!originalVevent) {
       throw new Error('Cannot update event: no VEVENT block found');
     }
 
     const existingUid = parseICalValue(originalVevent, 'UID') || eventId;
-    let data = obj.data;
+    let data = normalizedData;
 
     // --- Recurring event guard ---
     const hasRRule = /^RRULE[;:]/m.test(originalVevent);
@@ -1207,7 +1263,10 @@ export class CalDAVCalendarClient {
               if (!recIdRaw) continue;
               const recIdFormatted = formatICalDate(recIdRaw);
               if (!recIdFormatted) continue;
-              const recDate = new Date(recIdFormatted);
+              // Parse naive datetimes as UTC to match rrule's naive-as-UTC
+              // convention — new Date() would use the process's local TZ and
+              // flag every valid exception as an orphan when TZ != UTC.
+              const recDate = parseICalDateAsUTC(recIdFormatted);
               // Check if this recurrence-id still matches an occurrence
               const matches = rule.between(
                 new Date(recDate.getTime() - 1000),

src/caldav-client.ts

@@ -16,7 +16,7 @@ import { coerceRecipients, coerceBool, redactBearerTokens } from './coerce.js';
 const server = new Server(
   {
     name: 'fastmail-mcp',
-    version: '1.10.0',
+    version: '1.11.0',
   },
   {
     capabilities: {