@agenticmail/core 0.9.4 → 0.9.5

package/dist/index.cjs

@@ -726,6 +726,8 @@ __export(index_exports, {
   InboxWatcher: () => InboxWatcher,
   MailReceiver: () => MailReceiver,
   MailSender: () => MailSender,
+  PathTraversalError: () => PathTraversalError,
+  REDACTED: () => REDACTED,
   RELAY_PRESETS: () => RELAY_PRESETS,
   RelayBridge: () => RelayBridge,
   RelayGateway: () => RelayGateway,
@@ -737,7 +739,10 @@ __export(index_exports, {
   StalwartAdmin: () => StalwartAdmin,
   ThreadCache: () => ThreadCache,
   TunnelManager: () => TunnelManager,
+  UnsafeApiUrlError: () => UnsafeApiUrlError,
   WARNING_THRESHOLD: () => WARNING_THRESHOLD,
+  assertWithinBase: () => assertWithinBase,
+  buildApiUrl: () => buildApiUrl,
   buildInboundSecurityAdvisory: () => buildInboundSecurityAdvisory,
   classifyEmailRoute: () => classifyEmailRoute,
   closeDatabase: () => closeDatabase,
@@ -756,14 +761,19 @@ __export(index_exports, {
   parseEmail: () => parseEmail,
   parseGoogleVoiceSms: () => parseGoogleVoiceSms,
   recordToolCall: () => recordToolCall,
+  redactObject: () => redactObject,
+  redactSecret: () => redactSecret,
   resolveConfig: () => resolveConfig,
+  safeJoin: () => safeJoin,
   sanitizeEmail: () => sanitizeEmail,
   saveConfig: () => saveConfig,
   scanOutboundEmail: () => scanOutboundEmail,
   scoreEmail: () => scoreEmail,
   setTelemetryVersion: () => setTelemetryVersion,
   startRelayBridge: () => startRelayBridge,
-  threadIdFor: () => threadIdFor
+  threadIdFor: () => threadIdFor,
+  tryJoin: () => tryJoin,
+  validateApiUrl: () => validateApiUrl
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -837,7 +847,7 @@ var MailSender = class {
         const code = err?.responseCode ?? err?.code;
         const isTransient = typeof code === "number" && code >= 400 && code < 500 || code === "ECONNRESET" || code === "ETIMEDOUT" || code === "ESOCKET";
         if (!isTransient || attempt === MAX_RETRIES) throw err;
-        await new Promise((resolve) => setTimeout(resolve, 1e3 * (attempt + 1)));
+        await new Promise((resolve2) => setTimeout(resolve2, 1e3 * (attempt + 1)));
       }
     }
     throw lastError;
@@ -1769,20 +1779,20 @@ var StalwartAdmin = class {
     }
     try {
       const net = await import("net");
-      return await new Promise((resolve) => {
+      return await new Promise((resolve2) => {
         const smtpPort = parseInt(process.env.SMTP_PORT || "25", 10);
         const smtpHost = process.env.SMTP_HOST || "localhost";
         const socket = net.createConnection({ host: smtpHost, port: smtpPort, timeout: 3e3 }, () => {
           socket.destroy();
-          resolve(true);
+          resolve2(true);
         });
         socket.on("error", () => {
           socket.destroy();
-          resolve(false);
+          resolve2(false);
         });
         socket.on("timeout", () => {
           socket.destroy();
-          resolve(false);
+          resolve2(false);
         });
       });
     } catch {
@@ -1854,8 +1864,8 @@ var StalwartAdmin = class {
     }
     const { readFileSync: readFileSync7, writeFileSync: writeFileSync8 } = await import("fs");
     const { homedir: homedir11 } = await import("os");
-    const { join: join12 } = await import("path");
-    const configPath = join12(homedir11(), ".agenticmail", "stalwart.toml");
+    const { join: join13 } = await import("path");
+    const configPath = join13(homedir11(), ".agenticmail", "stalwart.toml");
     try {
       let config = readFileSync7(configPath, "utf-8");
       config = config.replace(/^hostname\s*=\s*"[^"]*"/m, `hostname = "${escapeTomlString(domain)}"`);
@@ -1869,14 +1879,14 @@ var StalwartAdmin = class {
   /** Path to the host-side stalwart.toml (mounted read-only into container) */
   get configPath() {
     const { homedir: homedir11 } = require("os");
-    const { join: join12 } = require("path");
-    return join12(homedir11(), ".agenticmail", "stalwart.toml");
+    const { join: join13 } = require("path");
+    return join13(homedir11(), ".agenticmail", "stalwart.toml");
   }
   /** Path to host-side DKIM key directory */
   get dkimDir() {
     const { homedir: homedir11 } = require("os");
-    const { join: join12 } = require("path");
-    return join12(homedir11(), ".agenticmail");
+    const { join: join13 } = require("path");
+    return join13(homedir11(), ".agenticmail");
   }
   /**
    * Create/reuse a DKIM signing key for a domain.
@@ -1979,9 +1989,9 @@ var StalwartAdmin = class {
   async configureOutboundRelay(config) {
     const { readFileSync: readFileSync7, writeFileSync: writeFileSync8 } = await import("fs");
     const { homedir: homedir11 } = await import("os");
-    const { join: join12 } = await import("path");
+    const { join: join13 } = await import("path");
     const routeName = config.routeName ?? "gmail";
-    const tomlPath = join12(homedir11(), ".agenticmail", "stalwart.toml");
+    const tomlPath = join13(homedir11(), ".agenticmail", "stalwart.toml");
     let toml = readFileSync7(tomlPath, "utf-8");
     toml = toml.replace(/\n\[queue\.route\.gmail\][\s\S]*?(?=\n\[|$)/, "");
     toml = toml.replace(/\n\[queue\.strategy\][\s\S]*?(?=\n\[|$)/, "");
@@ -3089,7 +3099,8 @@ var OUTBOUND_TEXT_RULES = [
 var HIGH_RISK_EXTENSIONS = /* @__PURE__ */ new Set([".pem", ".key", ".p12", ".pfx", ".env", ".credentials", ".keystore", ".jks", ".p8"]);
 var MEDIUM_RISK_EXTENSIONS = /* @__PURE__ */ new Set([".db", ".sqlite", ".sqlite3", ".sql", ".csv", ".tsv", ".json", ".yml", ".yaml", ".conf", ".config", ".ini"]);
 function stripHtmlTags(html) {
-  return html.replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "").replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<[^>]+>/g, "").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#0?39;/g, "'").replace(/&nbsp;/g, " ").replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)));
+  const bounded = html.length > 1048576 ? html.slice(0, 1048576) : html;
+  return bounded.replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "").replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<[^>]+>/g, "").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#0?39;/g, "'").replace(/&nbsp;/g, " ").replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16))).replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)));
 }
 var TEXT_SCANNABLE_TYPES = /* @__PURE__ */ new Set([
   "text/plain",
@@ -4622,7 +4633,7 @@ var CloudflareClient = class {
   // --- Workers methods ---
   /** Deploy an Email Worker script (ES module format) */
   async deployEmailWorker(scriptName, scriptContent, envVars = {}) {
-    const url = `${CF_API_BASE}/accounts/${this.accountId}/workers/scripts/${scriptName}`;
+    const url = `${CF_API_BASE}/accounts/${encodeURIComponent(this.accountId)}/workers/scripts/${encodeURIComponent(scriptName)}`;
     const bindings = Object.entries(envVars).map(([name, text2]) => ({
       type: "plain_text",
       name,
@@ -5040,7 +5051,7 @@ var TunnelManager = class {
       detached: false,
       env: { ...process.env, TUNNEL_TOKEN: tunnelToken }
     });
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve2, reject) => {
       let resolved = false;
       const timeout = setTimeout(() => {
         if (!resolved) {
@@ -5054,7 +5065,7 @@ var TunnelManager = class {
           resolved = true;
           clearTimeout(timeout);
           this.running = true;
-          resolve();
+          resolve2();
         }
       };
       this.process.stderr?.on("data", onData);
@@ -5093,8 +5104,8 @@ var TunnelManager = class {
       this.process = null;
       p.kill("SIGTERM");
       await Promise.race([
-        new Promise((resolve) => p.on("exit", () => resolve())),
-        new Promise((resolve) => setTimeout(resolve, 5e3))
+        new Promise((resolve2) => p.on("exit", () => resolve2())),
+        new Promise((resolve2) => setTimeout(resolve2, 5e3))
       ]);
       this.running = false;
     }
@@ -5150,7 +5161,10 @@ function parseGoogleVoiceSms(emailBody, emailFrom) {
   if (!emailBody || typeof emailBody !== "string") return null;
   if (!emailFrom || typeof emailFrom !== "string") return null;
   const fromLower = emailFrom.toLowerCase();
-  const isGoogleVoice = fromLower.includes("voice-noreply@google.com") || fromLower.includes("@txt.voice.google.com") || fromLower.includes("voice.google.com") || fromLower.includes("google.com/voice") || fromLower.includes("google") && fromLower.includes("voice");
+  const atIdx = fromLower.lastIndexOf("@");
+  const domain = atIdx >= 0 ? fromLower.slice(atIdx + 1).replace(/[>"'\s].*$/, "") : "";
+  const isGoogleDomain = domain === "google.com" || domain.endsWith(".google.com");
+  const isGoogleVoice = isGoogleDomain && (fromLower.startsWith("voice-noreply@") || domain === "txt.voice.google.com" || domain === "voice.google.com" || domain.endsWith(".voice.google.com") || fromLower.includes("voice"));
   if (!isGoogleVoice) return null;
   let text = emailBody.replace(/<br\s*\/?>/gi, "\n").replace(/<\/p>/gi, "\n").replace(/<\/div>/gi, "\n").replace(/<[^>]+>/g, "").replace(/&nbsp;/gi, " ").replace(/&amp;/gi, "&").replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/&quot;/gi, '"').replace(/&#39;/gi, "'").trim();
   let from = "";
@@ -6181,6 +6195,15 @@ var GatewayManager = class {
       bcc: mail.bcc ? Array.isArray(mail.bcc) ? mail.bcc.join(", ") : mail.bcc : void 0,
       subject: mail.subject,
       text: mail.text || void 0,
+      // The `html` field is the literal HTML body of the outbound
+      // mail — by design it is whatever the sender chose to compose.
+      // CodeQL `js/xss` flags this because the value flows from user
+      // input, but nodemailer is the SMTP serializer, not an HTML
+      // renderer; XSS would only occur if the recipient's MUA
+      // executed the body, which is outside our trust boundary.
+      // The outbound-guard (packages/core/src/mail/outbound-guard.ts)
+      // already scores HTML bodies for suspicious patterns at the
+      // pre-send step. lgtm[js/xss]
       html: mail.html || void 0,
       replyTo: mail.replyTo || from,
       inReplyTo: mail.inReplyTo || void 0,
@@ -6542,11 +6565,11 @@ var RelayBridge = class {
     this.options = options;
   }
   async start() {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       this.server = (0, import_node_http.createServer)((req, res) => this.handleRequest(req, res));
       this.server.listen(this.options.port, "127.0.0.1", () => {
         console.log(`[RelayBridge] Listening on 127.0.0.1:${this.options.port}`);
-        resolve();
+        resolve2();
       });
       this.server.on("error", reject);
     });
@@ -6748,16 +6771,161 @@ try {
 } catch {
 }
 
+// src/util/safe-path.ts
+var import_node_path5 = require("path");
+var PathTraversalError = class extends Error {
+  constructor(baseDir, parts) {
+    super(
+      `path traversal attempt: ${JSON.stringify(parts)} resolves outside ${baseDir}`
+    );
+    this.baseDir = baseDir;
+    this.parts = parts;
+    this.name = "PathTraversalError";
+  }
+};
+function safeJoin(baseDir, ...partsAndOpts) {
+  let opts = {};
+  const parts = [];
+  for (const p of partsAndOpts) {
+    if (typeof p === "string") {
+      parts.push(p);
+    } else if (p && typeof p === "object") {
+      opts = p;
+    }
+  }
+  if (!opts.allowAbsolute) {
+    for (const part of parts) {
+      if ((0, import_node_path5.isAbsolute)(part)) {
+        throw new PathTraversalError(baseDir, parts);
+      }
+    }
+  }
+  const resolvedBase = (0, import_node_path5.resolve)(baseDir);
+  const resolved = (0, import_node_path5.resolve)(resolvedBase, ...parts);
+  if (resolved !== resolvedBase && !resolved.startsWith(resolvedBase + import_node_path5.sep)) {
+    throw new PathTraversalError(baseDir, parts);
+  }
+  return resolved;
+}
+function tryJoin(baseDir, ...parts) {
+  try {
+    return safeJoin(baseDir, ...parts);
+  } catch (err) {
+    if (err instanceof PathTraversalError) return null;
+    throw err;
+  }
+}
+function assertWithinBase(baseDir, candidate) {
+  const resolvedBase = (0, import_node_path5.resolve)(baseDir);
+  const resolvedCandidate = (0, import_node_path5.resolve)(candidate);
+  if (resolvedCandidate !== resolvedBase && !resolvedCandidate.startsWith(resolvedBase + import_node_path5.sep)) {
+    throw new PathTraversalError(baseDir, [candidate]);
+  }
+  return resolvedCandidate;
+}
+
+// src/util/redact.ts
+var REDACTED = "***";
+function redactSecret(value) {
+  if (typeof value !== "string") return REDACTED;
+  if (value.length === 0) return REDACTED;
+  for (const prefix of ["mk_", "ak_", "sk-", "pk_", "tok_"]) {
+    if (value.startsWith(prefix)) return `${prefix}${REDACTED}`;
+  }
+  return REDACTED;
+}
+var SENSITIVE_KEY_PATTERNS = [
+  /key$/i,
+  /secret/i,
+  /password/i,
+  /passwd/i,
+  /token/i,
+  /authorization/i,
+  /bearer/i,
+  /\bapikey\b/i,
+  /\bapi_key\b/i,
+  /\bmasterkey\b/i,
+  /\bmaster_key\b/i
+];
+function looksSensitive(key) {
+  return SENSITIVE_KEY_PATTERNS.some((p) => p.test(key));
+}
+function redactObject(input, _depth = 0) {
+  if (_depth > 12) return input;
+  if (input === null || input === void 0) return input;
+  if (typeof input !== "object") return input;
+  if (Array.isArray(input)) {
+    return input.map((v) => redactObject(v, _depth + 1));
+  }
+  const proto = Object.getPrototypeOf(input);
+  if (proto !== Object.prototype && proto !== null) return input;
+  const out = {};
+  for (const [k, v] of Object.entries(input)) {
+    if (looksSensitive(k)) {
+      out[k] = typeof v === "string" ? redactSecret(v) : REDACTED;
+    } else {
+      out[k] = redactObject(v, _depth + 1);
+    }
+  }
+  return out;
+}
+
+// src/util/safe-url.ts
+var UnsafeApiUrlError = class extends Error {
+  constructor(raw, reason) {
+    super(`unsafe AgenticMail API URL ${JSON.stringify(raw)}: ${reason}`);
+    this.raw = raw;
+    this.reason = reason;
+    this.name = "UnsafeApiUrlError";
+  }
+};
+var BLOCKED_HOSTS = /* @__PURE__ */ new Set([
+  "169.254.169.254",
+  // AWS / Azure / GCP IPv4 metadata
+  "fd00:ec2::254",
+  // AWS IPv6 metadata
+  "metadata.google.internal",
+  // GCP DNS
+  "metadata.azure.internal"
+  // Azure DNS
+]);
+function validateApiUrl(raw) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    throw new UnsafeApiUrlError(String(raw), "must be a non-empty string");
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch (err) {
+    throw new UnsafeApiUrlError(raw, `unparseable: ${err.message}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new UnsafeApiUrlError(raw, `unsupported protocol: ${parsed.protocol}`);
+  }
+  const host = parsed.hostname.toLowerCase().replace(/\.$/, "");
+  if (BLOCKED_HOSTS.has(host)) {
+    throw new UnsafeApiUrlError(raw, `blocked metadata host: ${host}`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new UnsafeApiUrlError(raw, "embedded credentials are not supported");
+  }
+  return parsed.origin;
+}
+function buildApiUrl(baseOrigin, pathAndQuery) {
+  const path = pathAndQuery.startsWith("/") ? pathAndQuery : `/${pathAndQuery}`;
+  return new URL(path, baseOrigin + "/").toString();
+}
+
 // src/setup/index.ts
 var import_node_crypto3 = require("crypto");
 var import_node_fs7 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 var import_node_os7 = require("os");
 
 // src/setup/deps.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs4 = require("fs");
-var import_node_path5 = require("path");
+var import_node_path6 = require("path");
 var import_node_os4 = require("os");
 var DependencyChecker = class {
   async checkAll() {
@@ -6808,7 +6976,7 @@ var DependencyChecker = class {
     }
   }
   async checkCloudflared() {
-    const binPath = (0, import_node_path5.join)((0, import_node_os4.homedir)(), ".agenticmail", "bin", "cloudflared");
+    const binPath = (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".agenticmail", "bin", "cloudflared");
     if ((0, import_node_fs4.existsSync)(binPath)) {
       let version;
       try {
@@ -6833,12 +7001,12 @@ var DependencyChecker = class {
 var import_node_child_process3 = require("child_process");
 var import_node_fs5 = require("fs");
 var import_promises2 = require("fs/promises");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 var import_node_os5 = require("os");
 function runShellWithRollingOutput(cmd, opts = {}) {
   const maxLines = opts.maxLines ?? 20;
   const timeout = opts.timeout ?? 3e5;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const child = (0, import_node_child_process3.spawn)("sh", ["-c", cmd], {
       stdio: ["ignore", "pipe", "pipe"],
       timeout
@@ -6880,7 +7048,7 @@ function runShellWithRollingOutput(cmd, opts = {}) {
         }
         process.stdout.write(`\x1B[${displayedCount}A`);
       }
-      resolve({ exitCode: code ?? 1, fullOutput });
+      resolve2({ exitCode: code ?? 1, fullOutput });
     });
     child.on("error", (err) => {
       if (displayedCount > 0) {
@@ -6896,7 +7064,7 @@ function runShellWithRollingOutput(cmd, opts = {}) {
 }
 function runSilent(command, args, opts = {}) {
   const timeout = opts.timeout ?? 3e5;
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const child = (0, import_node_child_process3.spawn)(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       timeout
@@ -6908,7 +7076,7 @@ function runSilent(command, args, opts = {}) {
     child.stderr?.on("data", (d) => {
       fullOutput += d.toString();
     });
-    child.on("close", (code) => resolve({ exitCode: code ?? 1, fullOutput }));
+    child.on("close", (code) => resolve2({ exitCode: code ?? 1, fullOutput }));
     child.on("error", reject);
   });
 }
@@ -7010,8 +7178,8 @@ var DependencyInstaller = class {
     try {
       const composeBin = (0, import_node_child_process3.execFileSync)("which", ["docker-compose"], { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
       if (!composeBin) return;
-      const pluginDir = (0, import_node_path6.join)((0, import_node_os5.homedir)(), ".docker", "cli-plugins");
-      const pluginPath = (0, import_node_path6.join)(pluginDir, "docker-compose");
+      const pluginDir = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".docker", "cli-plugins");
+      const pluginPath = (0, import_node_path7.join)(pluginDir, "docker-compose");
       if ((0, import_node_fs5.existsSync)(pluginPath)) return;
       try {
         (0, import_node_fs5.mkdirSync)(pluginDir, { recursive: true });
@@ -7077,9 +7245,9 @@ var DependencyInstaller = class {
       return;
     }
     this.onProgress("__progress__:5:Installing Docker Engine...");
-    const tmpDir = (0, import_node_path6.join)((0, import_node_os5.homedir)(), ".agenticmail", "tmp");
+    const tmpDir = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".agenticmail", "tmp");
     await (0, import_promises2.mkdir)(tmpDir, { recursive: true });
-    const scriptPath = (0, import_node_path6.join)(tmpDir, "install-docker.sh");
+    const scriptPath = (0, import_node_path7.join)(tmpDir, "install-docker.sh");
     const dlResult = await runShellWithRollingOutput(
       `curl -fsSL https://get.docker.com -o "${scriptPath}" && sudo sh "${scriptPath}"`,
       { timeout: 3e5 }
@@ -7147,7 +7315,7 @@ var DependencyInstaller = class {
       }
       try {
         const programFiles = process.env["ProgramFiles"] || "C:\\Program Files";
-        const dockerExe = (0, import_node_path6.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
+        const dockerExe = (0, import_node_path7.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
         if ((0, import_node_fs5.existsSync)(dockerExe)) {
           (0, import_node_child_process3.execSync)(`start "" "${dockerExe}"`, { timeout: 1e4, stdio: "ignore", shell: "cmd.exe" });
         }
@@ -7198,7 +7366,7 @@ var DependencyInstaller = class {
         this.onProgress("__progress__:70:Docker Desktop installed. Starting...");
         try {
           const programFiles = process.env["ProgramFiles"] || "C:\\Program Files";
-          const dockerExe = (0, import_node_path6.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
+          const dockerExe = (0, import_node_path7.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
           if ((0, import_node_fs5.existsSync)(dockerExe)) {
             (0, import_node_child_process3.execSync)(`start "" "${dockerExe}"`, { timeout: 1e4, stdio: "ignore", shell: "cmd.exe" });
           }
@@ -7295,9 +7463,9 @@ var DependencyInstaller = class {
    */
   async installCloudflared() {
     const os = (0, import_node_os5.platform)();
-    const binDir = (0, import_node_path6.join)((0, import_node_os5.homedir)(), ".agenticmail", "bin");
+    const binDir = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".agenticmail", "bin");
     const binName = os === "win32" ? "cloudflared.exe" : "cloudflared";
-    const binPath = (0, import_node_path6.join)(binDir, binName);
+    const binPath = (0, import_node_path7.join)(binDir, binName);
     if ((0, import_node_fs5.existsSync)(binPath)) {
       return binPath;
     }
@@ -7327,7 +7495,7 @@ var DependencyInstaller = class {
     }
     const buffer = Buffer.from(await response.arrayBuffer());
     if (os === "darwin") {
-      const tgzPath = (0, import_node_path6.join)(binDir, "cloudflared.tgz");
+      const tgzPath = (0, import_node_path7.join)(binDir, "cloudflared.tgz");
       await (0, import_promises2.writeFile)(tgzPath, buffer);
       try {
         (0, import_node_child_process3.execFileSync)("tar", ["-xzf", tgzPath, "-C", binDir, "cloudflared"], { timeout: 15e3, stdio: "ignore" });
@@ -7363,7 +7531,7 @@ var DependencyInstaller = class {
 // src/setup/service.ts
 var import_node_child_process4 = require("child_process");
 var import_node_fs6 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_node_os6 = require("os");
 var import_node_module2 = require("module");
 var import_meta2 = {};
@@ -7376,9 +7544,9 @@ var ServiceManager = class {
    */
   getServicePath() {
     if (this.os === "darwin") {
-      return (0, import_node_path7.join)((0, import_node_os6.homedir)(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+      return (0, import_node_path8.join)((0, import_node_os6.homedir)(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
     } else {
-      return (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".config", "systemd", "user", SYSTEMD_UNIT);
+      return (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".config", "systemd", "user", SYSTEMD_UNIT);
     }
   }
   /**
@@ -7416,33 +7584,33 @@ var ServiceManager = class {
     } catch {
     }
     const parentPackages = [
-      (0, import_node_path7.join)("@agenticmail", "cli"),
+      (0, import_node_path8.join)("@agenticmail", "cli"),
       // current scoped package
       "agenticmail"
       // legacy unscoped package
     ];
     const baseDirs = [
       // user-local install
-      (0, import_node_path7.join)((0, import_node_os6.homedir)(), "node_modules")
+      (0, import_node_path8.join)((0, import_node_os6.homedir)(), "node_modules")
     ];
     try {
       const prefix = (0, import_node_child_process4.execSync)("npm prefix -g", { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-      baseDirs.push((0, import_node_path7.join)(prefix, "lib", "node_modules"));
-      baseDirs.push((0, import_node_path7.join)(prefix, "node_modules"));
+      baseDirs.push((0, import_node_path8.join)(prefix, "lib", "node_modules"));
+      baseDirs.push((0, import_node_path8.join)(prefix, "node_modules"));
     } catch {
     }
     baseDirs.push("/opt/homebrew/lib/node_modules");
     baseDirs.push("/usr/local/lib/node_modules");
     for (const base of baseDirs) {
-      const sibling = (0, import_node_path7.join)(base, "@agenticmail", "api", "dist", "index.js");
+      const sibling = (0, import_node_path8.join)(base, "@agenticmail", "api", "dist", "index.js");
       if ((0, import_node_fs6.existsSync)(sibling)) return sibling;
       for (const parent of parentPackages) {
-        const nested = (0, import_node_path7.join)(base, parent, "node_modules", "@agenticmail", "api", "dist", "index.js");
+        const nested = (0, import_node_path8.join)(base, parent, "node_modules", "@agenticmail", "api", "dist", "index.js");
         if ((0, import_node_fs6.existsSync)(nested)) return nested;
       }
     }
-    const dataDir = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail");
-    const entryCache = (0, import_node_path7.join)(dataDir, "api-entry.path");
+    const dataDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail");
+    const entryCache = (0, import_node_path8.join)(dataDir, "api-entry.path");
     if ((0, import_node_fs6.existsSync)(entryCache)) {
       const cached = (0, import_node_fs6.readFileSync)(entryCache, "utf-8").trim();
       if (cached && (0, import_node_fs6.existsSync)(cached)) return cached;
@@ -7453,9 +7621,9 @@ var ServiceManager = class {
    * Cache the API entry path so the service can find it later.
    */
   cacheApiEntryPath(entryPath) {
-    const dataDir = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail");
+    const dataDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail");
     if (!(0, import_node_fs6.existsSync)(dataDir)) (0, import_node_fs6.mkdirSync)(dataDir, { recursive: true });
-    (0, import_node_fs6.writeFileSync)((0, import_node_path7.join)(dataDir, "api-entry.path"), entryPath);
+    (0, import_node_fs6.writeFileSync)((0, import_node_path8.join)(dataDir, "api-entry.path"), entryPath);
   }
   /**
    * Get the current package version.
@@ -7476,7 +7644,7 @@ var ServiceManager = class {
     }
     try {
       const apiEntry = this.getApiEntryPath();
-      const apiPkg = (0, import_node_path7.join)(apiEntry, "..", "..", "package.json");
+      const apiPkg = (0, import_node_path8.join)(apiEntry, "..", "..", "package.json");
       if ((0, import_node_fs6.existsSync)(apiPkg)) {
         const pkg = JSON.parse((0, import_node_fs6.readFileSync)(apiPkg, "utf-8"));
         if (pkg.version) return pkg.version;
@@ -7484,14 +7652,14 @@ var ServiceManager = class {
     } catch {
     }
     const candidates = [
-      (0, import_node_path7.join)((0, import_node_os6.homedir)(), "node_modules", "@agenticmail", "cli", "package.json"),
-      (0, import_node_path7.join)((0, import_node_os6.homedir)(), "node_modules", "agenticmail", "package.json"),
-      (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail", "package-version.json")
+      (0, import_node_path8.join)((0, import_node_os6.homedir)(), "node_modules", "@agenticmail", "cli", "package.json"),
+      (0, import_node_path8.join)((0, import_node_os6.homedir)(), "node_modules", "agenticmail", "package.json"),
+      (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "package-version.json")
     ];
     try {
       const prefix = (0, import_node_child_process4.execSync)("npm prefix -g", { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-      candidates.push((0, import_node_path7.join)(prefix, "lib", "node_modules", "@agenticmail", "cli", "package.json"));
-      candidates.push((0, import_node_path7.join)(prefix, "lib", "node_modules", "agenticmail", "package.json"));
+      candidates.push((0, import_node_path8.join)(prefix, "lib", "node_modules", "@agenticmail", "cli", "package.json"));
+      candidates.push((0, import_node_path8.join)(prefix, "lib", "node_modules", "agenticmail", "package.json"));
     } catch {
     }
     for (const p of candidates) {
@@ -7510,8 +7678,8 @@ var ServiceManager = class {
    * This ensures AgenticMail doesn't fail on boot when Docker is still loading.
    */
   generateStartScript(nodePath, apiEntry) {
-    const scriptPath = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin", "start-server.sh");
-    const scriptDir = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin");
+    const scriptPath = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin", "start-server.sh");
+    const scriptDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin");
     if (!(0, import_node_fs6.existsSync)(scriptDir)) (0, import_node_fs6.mkdirSync)(scriptDir, { recursive: true });
     const script = [
       "#!/bin/bash",
@@ -7577,7 +7745,7 @@ var ServiceManager = class {
    */
   generatePlist(nodePath, apiEntry, configPath) {
     const config = JSON.parse((0, import_node_fs6.readFileSync)(configPath, "utf-8"));
-    const logDir = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail", "logs");
+    const logDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "logs");
     if (!(0, import_node_fs6.existsSync)(logDir)) (0, import_node_fs6.mkdirSync)(logDir, { recursive: true });
     const version = this.getVersion();
     const startScript = this.generateStartScript(nodePath, apiEntry);
@@ -7601,7 +7769,7 @@ var ServiceManager = class {
     <key>HOME</key>
     <string>${(0, import_node_os6.homedir)()}</string>
     <key>AGENTICMAIL_DATA_DIR</key>
-    <string>${config.dataDir || (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail")}</string>
+    <string>${config.dataDir || (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail")}</string>
     <key>PATH</key>
     <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     <key>AGENTICMAIL_SERVICE_VERSION</key>
@@ -7655,7 +7823,7 @@ var ServiceManager = class {
    */
   generateSystemdUnit(nodePath, apiEntry, configPath) {
     const config = JSON.parse((0, import_node_fs6.readFileSync)(configPath, "utf-8"));
-    const dataDir = config.dataDir || (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail");
+    const dataDir = config.dataDir || (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail");
     const version = this.getVersion();
     const startScript = this.generateStartScript(nodePath, apiEntry);
     return `[Unit]
@@ -7685,7 +7853,7 @@ WantedBy=default.target
    * Install the auto-start service.
    */
   install() {
-    const configPath = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail", "config.json");
+    const configPath = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "config.json");
     if (!(0, import_node_fs6.existsSync)(configPath)) {
       return { installed: false, message: "Config not found. Run agenticmail setup first." };
     }
@@ -7698,7 +7866,7 @@ WantedBy=default.target
     }
     const servicePath = this.getServicePath();
     if (this.os === "darwin") {
-      const dir = (0, import_node_path7.join)((0, import_node_os6.homedir)(), "Library", "LaunchAgents");
+      const dir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), "Library", "LaunchAgents");
       if (!(0, import_node_fs6.existsSync)(dir)) (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
       if ((0, import_node_fs6.existsSync)(servicePath)) {
         try {
@@ -7716,7 +7884,7 @@ WantedBy=default.target
       }
       return { installed: true, message: `Service installed at ${servicePath}` };
     } else if (this.os === "linux") {
-      const dir = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".config", "systemd", "user");
+      const dir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".config", "systemd", "user");
       if (!(0, import_node_fs6.existsSync)(dir)) (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
       const unit = this.generateSystemdUnit(nodePath, apiEntry, configPath);
       (0, import_node_fs6.writeFileSync)(servicePath, unit);
@@ -7842,7 +8010,7 @@ WantedBy=default.target
     } catch {
       return { reason: "Service file unreadable" };
     }
-    const startScript = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin", "start-server.sh");
+    const startScript = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin", "start-server.sh");
     if (serviceContent.includes(startScript)) {
       if (!(0, import_node_fs6.existsSync)(startScript)) {
         return { reason: "start-server.sh is missing" };
@@ -7875,7 +8043,7 @@ WantedBy=default.target
         return { reason: `Service version drift (current CLI is v${currentVersion})` };
       }
     }
-    const entryCache = (0, import_node_path7.join)((0, import_node_os6.homedir)(), ".agenticmail", "api-entry.path");
+    const entryCache = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "api-entry.path");
     if ((0, import_node_fs6.existsSync)(entryCache)) {
       try {
         const cached = (0, import_node_fs6.readFileSync)(entryCache, "utf-8").trim();
@@ -7930,12 +8098,12 @@ var SetupManager = class {
    * falls back to monorepo location.
    */
   getComposePath() {
-    const standalonePath = (0, import_node_path8.join)((0, import_node_os7.homedir)(), ".agenticmail", "docker-compose.yml");
+    const standalonePath = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail", "docker-compose.yml");
     if ((0, import_node_fs7.existsSync)(standalonePath)) return standalonePath;
     const cwd = process.cwd();
-    const candidates = [cwd, (0, import_node_path8.join)(cwd, "..")];
+    const candidates = [cwd, (0, import_node_path9.join)(cwd, "..")];
     for (const dir of candidates) {
-      const p = (0, import_node_path8.join)(dir, "docker-compose.yml");
+      const p = (0, import_node_path9.join)(dir, "docker-compose.yml");
       if ((0, import_node_fs7.existsSync)(p)) return p;
     }
     return standalonePath;
@@ -7946,9 +8114,9 @@ var SetupManager = class {
    * Always regenerates Docker files to keep passwords in sync.
    */
   initConfig() {
-    const dataDir = (0, import_node_path8.join)((0, import_node_os7.homedir)(), ".agenticmail");
-    const configPath = (0, import_node_path8.join)(dataDir, "config.json");
-    const envPath = (0, import_node_path8.join)(dataDir, ".env");
+    const dataDir = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail");
+    const configPath = (0, import_node_path9.join)(dataDir, "config.json");
+    const envPath = (0, import_node_path9.join)(dataDir, ".env");
     if ((0, import_node_fs7.existsSync)(configPath)) {
       try {
         const existing = JSON.parse((0, import_node_fs7.readFileSync)(configPath, "utf-8"));
@@ -8000,12 +8168,12 @@ IMAP_PORT=143
    * with the correct admin password from config.
    */
   generateDockerFiles(config) {
-    const dataDir = config.dataDir || (0, import_node_path8.join)((0, import_node_os7.homedir)(), ".agenticmail");
+    const dataDir = config.dataDir || (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail");
     if (!(0, import_node_fs7.existsSync)(dataDir)) {
       (0, import_node_fs7.mkdirSync)(dataDir, { recursive: true });
     }
     const password = config.stalwart?.adminPassword || "changeme";
-    const composePath = (0, import_node_path8.join)(dataDir, "docker-compose.yml");
+    const composePath = (0, import_node_path9.join)(dataDir, "docker-compose.yml");
     (0, import_node_fs7.writeFileSync)(composePath, `services:
   stalwart:
     # Pinned to v0.15.5 \u2014 Stalwart 0.16+ moved its config to JSON
@@ -8036,7 +8204,7 @@ volumes:
   stalwart-data:
 `);
     (0, import_node_fs7.chmodSync)(composePath, 384);
-    const tomlPath = (0, import_node_path8.join)(dataDir, "stalwart.toml");
+    const tomlPath = (0, import_node_path9.join)(dataDir, "stalwart.toml");
     (0, import_node_fs7.writeFileSync)(tomlPath, `# Stalwart Mail Server \u2014 AgenticMail Configuration
 
 [server]
@@ -8093,7 +8261,7 @@ secret = "${password}"
    * Check if config has already been initialized.
    */
   isInitialized() {
-    const configPath = (0, import_node_path8.join)((0, import_node_os7.homedir)(), ".agenticmail", "config.json");
+    const configPath = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail", "config.json");
     return (0, import_node_fs7.existsSync)(configPath);
   }
 };
@@ -8101,7 +8269,7 @@ secret = "${password}"
 // src/threading/thread-id.ts
 var import_node_crypto4 = require("crypto");
 function stripReplyPrefixes(subject) {
-  let s = subject;
+  let s = subject.length > 1e3 ? subject.slice(0, 1e3) : subject;
   for (; ; ) {
     const next = s.replace(/^\s*(?:re|fwd?|fw)\s*(?:\[\d+\])?\s*:\s*/i, "");
     if (next === s) break;
@@ -8121,8 +8289,9 @@ function normalizeSubject(subject) {
 }
 function normalizeAddress(addr) {
   if (!addr) return "(unknown)";
-  const m = addr.match(/<([^>]+)>/);
-  const raw = m ? m[1] : addr;
+  const bounded = addr.length > 500 ? addr.slice(0, 500) : addr;
+  const m = bounded.match(/<([^>]+)>/);
+  const raw = m ? m[1] : bounded;
   return raw.trim().toLowerCase();
 }
 function threadIdFor(input) {
@@ -8133,8 +8302,8 @@ function threadIdFor(input) {
 // src/threading/thread-cache.ts
 var import_node_fs8 = require("fs");
 var import_node_os8 = require("os");
-var import_node_path9 = require("path");
-var CACHE_DIR_DEFAULT = (0, import_node_path9.join)((0, import_node_os8.homedir)(), ".agenticmail", "thread-cache");
+var import_node_path10 = require("path");
+var CACHE_DIR_DEFAULT = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "thread-cache");
 var DEFAULT_K_MESSAGES = 10;
 var DEFAULT_LRU_CAP = 5e3;
 var PREVIEW_MAX_CHARS = 240;
@@ -8152,7 +8321,7 @@ var ThreadCache = class {
     }
   }
   pathFor(threadId) {
-    return (0, import_node_path9.join)(this.dir, `${threadId}.json`);
+    return (0, import_node_path10.join)(this.dir, `${threadId}.json`);
   }
   read(threadId) {
     const p = this.pathFor(threadId);
@@ -8242,7 +8411,7 @@ var ThreadCache = class {
     }
     if (files.length <= this.lruCap) return;
     const stats = files.map((f) => {
-      const p = (0, import_node_path9.join)(this.dir, f);
+      const p = (0, import_node_path10.join)(this.dir, f);
       try {
         return { p, mtime: (0, import_node_fs8.statSync)(p).mtimeMs };
       } catch {
@@ -8274,8 +8443,8 @@ function dedupAndCap(messages, k) {
 // src/threading/agent-memory.ts
 var import_node_fs9 = require("fs");
 var import_node_os9 = require("os");
-var import_node_path10 = require("path");
-var MEMORY_DIR_DEFAULT = (0, import_node_path10.join)((0, import_node_os9.homedir)(), ".agenticmail", "agent-memory");
+var import_node_path11 = require("path");
+var MEMORY_DIR_DEFAULT = (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".agenticmail", "agent-memory");
 var AgentMemoryStore = class {
   dir;
   constructor(opts = {}) {
@@ -8286,10 +8455,10 @@ var AgentMemoryStore = class {
     }
   }
   dirFor(agentId) {
-    return (0, import_node_path10.join)(this.dir, sanitizeId(agentId));
+    return (0, import_node_path11.join)(this.dir, sanitizeId(agentId));
   }
   pathFor(agentId, threadId) {
-    return (0, import_node_path10.join)(this.dirFor(agentId), `${sanitizeId(threadId)}.md`);
+    return (0, import_node_path11.join)(this.dirFor(agentId), `${sanitizeId(threadId)}.md`);
   }
   read(agentId, threadId) {
     const p = this.pathFor(agentId, threadId);
@@ -8391,6 +8560,8 @@ function parse(raw) {
   InboxWatcher,
   MailReceiver,
   MailSender,
+  PathTraversalError,
+  REDACTED,
   RELAY_PRESETS,
   RelayBridge,
   RelayGateway,
@@ -8402,7 +8573,10 @@ function parse(raw) {
   StalwartAdmin,
   ThreadCache,
   TunnelManager,
+  UnsafeApiUrlError,
   WARNING_THRESHOLD,
+  assertWithinBase,
+  buildApiUrl,
   buildInboundSecurityAdvisory,
   classifyEmailRoute,
   closeDatabase,
@@ -8421,12 +8595,17 @@ function parse(raw) {
   parseEmail,
   parseGoogleVoiceSms,
   recordToolCall,
+  redactObject,
+  redactSecret,
   resolveConfig,
+  safeJoin,
   sanitizeEmail,
   saveConfig,
   scanOutboundEmail,
   scoreEmail,
   setTelemetryVersion,
   startRelayBridge,
-  threadIdFor
+  threadIdFor,
+  tryJoin,
+  validateApiUrl
 });