1.3.4

What's Changed

• Fix attachment path traversal in attachment extraction and cleanup flows
• Encode Message-ID values into safe directory names while preserving RFC-valid IDs such as those containing '/'
• Restore package-style imports for src modules
• Add regression tests covering traversal-shaped inputs, symlink escapes, slash-containing Message-IDs, and package imports
• Bump the MCP version to 1.3.4

Validation

• python3 -m unittest discover -s tests -v
• python3 -c 'import src.cleanup_attachments, src.extract_attachments; print("package imports ok")'