Conversation
Read, search, reply, send, file and delete over IMAP, sending through the account's SMTP with Resend as the fallback for a domain verified there. Accounts are configuration (~/.config/cli-tools/mail.json, 0600) and import from the cli-tools-mail team vault as MAIL_<NAME>_EMAIL/_PROVIDER/_PASSWORD; nothing in the tree names a person. A webmail address never goes through Resend, because its domain cannot be verified there. Replies thread (In-Reply-To, References, Reply-To honoured) and quote the original. Also lifts promptSecret out of the dispatcher into src/prompt.ts so both commands share it, and adds resend to KNOWN_KEYS. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GX6xEcjGFxcvcMCFLhQng
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| export function parseQuery(input: string): SearchObject { | ||
| const query: SearchObject = {}; | ||
| const text: string[] = []; | ||
| const tokens = input.match(/(?:[^\s"]+|"[^"]*")+/g) ?? []; |
| const resolved = resolveAccount( | ||
| 'work', | ||
| { email: 'a@example.com', provider: 'forwardemail', password: 'stored' }, | ||
| env({ MAIL_WORK_PASSWORD: 'exported' }), |
ThreatCrush Security Scan10 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 4 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
2 participants
What
A
mailcommand: read, search, reply, send, file and delete over IMAP, sending through the account's SMTP with Resend as the fallback for a domain verified there. Accounts are configuration, not code:~/.config/cli-tools/mail.json(0600), imported from the newcli-tools-mail--prodteam vault asMAIL_<NAME>_EMAIL/_PROVIDER/_PASSWORDplusMAIL_DEFAULT. Nothing in the tree names a person.mail login <provider|address> [address] [--as NAME]— sign in to any provider that still takes a password. Says which kind of password the host wants before asking (app password, per-alias password, bridge password, or the account one), tries IMAP and SMTP, and stores nothing on a refusal. The provider is read off the name, a webmail domain, or a custom domain's MX records.mail providers— the fifteen built in (Forward Email, Gmail / Workspace, Yahoo, AOL, iCloud, Fastmail, Zoho, Proton via Bridge, GMX, Yandex, mail.com, Posteo, mailbox.org, Migadu, Purelymail) with hosts, ports and the password rule, and the ones a password cannot reach (Outlook.com / Microsoft 365: OAuth2 only; Tuta, HEY: no IMAP) with the reason.mail accounts [add|password|default|rm|pull]mail folders,mail ls [-a all] [--unread],mail search <query>,mail read <uid>mail send,mail reply <uid> [--all],--draftfiles to Drafts insteadmail mark,mail mv,mail archive,mail rm [--purge]mail(/mail:login,/mail:inbox,/mail:send) in the marketplace; README section;resendjoinsKNOWN_KEYS.promptSecretandpromptLineinsrc/prompt.ts, shared by both commands.Decisions worth a look
--no-verifyopts out.mail login you@yourdomain.comresolves the domain's MX and matches the host (Google, Zoho, Fastmail, Proton, iCloud, Forward Email, Migadu, …); a Microsoft-hosted domain gets the OAuth2 explanation. A failed lookup is simply "say which provider".mail login outlookexplains instead of failing a login.imapSecureandinsecureTlsfor exactly that, andinsecureTlsis never set for a real host.mail readsets\Seenitself;--keep-unreadskips that.Verified
test/mail.test.ts); typecheck clean apart from the two pre-existingfree-nameserrors on master.mail login anthony@… --as worktestwith no provider named read Forward Email off the MX records, verified both IMAP and SMTP, stored the account,mail ls -a worktestlisted the inbox,accounts rmremoved it.accounts,folders,ls,search,read,send --draft,rm --purgeall work with the real password.MAIL_WORK_PASSWORDis in thecli-tools-mail--prodvault, so a fresh box needs onlymail accounts pull.mail login outlook …,mail login me@hotmail.com, an unknown provider name, a bare address on an unknown domain, and a wrong Gmail password each produce the intended message and store nothing.mail accounts pullfrom the vault on the dev box, end to end; a self-addressed message sent through Resend with the vault key.mail login gmail … --as personal).🤖 Generated with Claude Code
https://claude.ai/code/session_013GX6xEcjGFxcvcMCFLhQng
https://claude.ai/code/session_013h8jopY81BGQ4Pn22NfZTu