feat(cli): add token subcommand for Graph API bearer token export

[stevenobiajulu]

Summary

Add a token subcommand that prints a Microsoft Graph API bearer token to stdout for use in sandboxed environments where the OS keychain is unavailable.

• Auto-selects mailbox when exactly one is configured
• Requires --mailbox if multiple exist (exit 2 with list)
• Strictly noninteractive — expired auth directs to configure
• Awaits stdout flush to prevent truncation on pipe

Usage

# One mailbox — auto-selects
export GRAPH_TOKEN=$(npx email-agent-mcp token)

# Multiple mailboxes
export GRAPH_TOKEN=$(npx email-agent-mcp token --mailbox [email protected])

# One-shot (most secure — token only lives for the command)
GRAPH_TOKEN=$(npx email-agent-mcp token) openshell sandbox create --name test --from openclaw

Motivation

NemoClaw sandboxes pass credentials as env vars at creation time (same pattern as Discord/Slack bot tokens). This command enables gh auth token-style piping for Graph API tokens.

Test plan

• Prints valid JWT to stdout (2610 chars)
• Token works against Graph API (/v1.0/me returns correct user)
• --mailbox nonexistent returns exit 2 with error on stderr
• --mailbox [email protected] returns valid token
• All 95 existing tests pass

[codecov]

Codecov Report

❌ Patch coverage is 0% with 34 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
packages/email-mcp/src/cli.ts	0.00%	26 Missing and 8 partials ⚠️

📢 Thoughts on this report? Let us know!