The command that blamed the wrong password

On 27 August, four emails were queued in Outlook for the next morning. An hour later the wording had to change. co outlook send --at had confirmed each one with a timestamp and a recipient, and nothing else. The way to take them back was found by opening useful_tools/outlook.py and reading what get_scheduled did, then guessing that cancel existed. It did. The CLI had simply never said so.

The same afternoon, co outlook inbox said the Microsoft session had expired and told the user to run co auth microsoft. They did, twice, through the browser consent flow, and got the same error. The token was fine. A direct request to Graph with the stored token returned 200. What had died was the OpenOnion key that the refresh broker checks first, and the 401 from our own backend had been reported as a Microsoft expiry. Later the same key was absent from the environment altogether, and that surfaced as "Microsoft Mail permission missing". Three causes, one wrong instruction.

The third complaint was quieter and worse. A threaded reply to an external founder needed a colleague copied in. co outlook reply had no --cc, so the reply went out as a fresh send with "RE:" in the subject. On the founder's side it arrived as a new conversation with no history, the shape of a mass mail, and it had to be re-sent by hand.

None of these were failures of the Graph integration. Every request that mattered had worked. They were failures of what the command said afterwards, and the lesson we kept relearning is that an error message naming the wrong command costs more than no message at all: the user does the wrong thing confidently and then trusts the tool less.

So the fix was mostly about the last line of output. A scheduled send now ends with the cancel path, and the --at help says it too. The credential layer that failed is the one that gets named: co auth when the OpenOnion key is missing or rejected, co auth microsoft when Microsoft revoked the grant or the saved record has no refresh token, and the scope by name when the token predates it. reply gained --cc and --bcc, set on Graph's reply action so the message stays in its thread. And because the Microsoft calendar tool had existed for months with no way to reach it from a terminal, co outlook calendar now mirrors co gcalendar leaf for leaf, under co outlook because Outlook is one product with three panes, not four.

Writing the tips was not the hard part. Testing that they work was. We gave a fresh model only the output of each command and a goal, and asked for one shell command back. Twenty-five of twenty-six rows passed on the first run. The one that failed was an invalid --at value: the error explained the accepted formats but named no command, and the model answered with a shell history substitution that would have done nothing. A human reading that message would have called it clear. The tip test is worth running precisely because it does not read like a human.

The regression tests were run against the public 1.8.3 wheel before the fix. Thirteen of fifteen failed there, which is the evidence that they test the complaint and not the implementation. The two that passed cover the token reuse from #1312, which 1.8.3 had already fixed; they stay as guards. No live mailbox was used for any of this, and that is what the beta is for.