@agenticmail/enterprise 0.5.319 → 0.5.321

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (330) hide show
  1. package/CHANGELOG.md +68 -0
  2. package/CODE_OF_CONDUCT.md +31 -0
  3. package/README.md +118 -38
  4. package/SECURITY.md +42 -0
  5. package/dist/agent-heartbeat-3FWNHZFX.js +510 -0
  6. package/dist/agent-heartbeat-4RWHZR7H.js +510 -0
  7. package/dist/agent-heartbeat-6ZGB5ILY.js +510 -0
  8. package/dist/agent-heartbeat-BIVHLKFM.js +510 -0
  9. package/dist/agent-heartbeat-HRKVFK2T.js +510 -0
  10. package/dist/agent-heartbeat-JC5GWVXD.js +510 -0
  11. package/dist/agent-heartbeat-K6A4HMHB.js +510 -0
  12. package/dist/agent-heartbeat-LCDXWFVB.js +510 -0
  13. package/dist/agent-heartbeat-P7HZCZAQ.js +510 -0
  14. package/dist/agent-heartbeat-PUIRSNIO.js +510 -0
  15. package/dist/agent-heartbeat-SN5ILQ6Y.js +510 -0
  16. package/dist/agent-heartbeat-TW5YTDYC.js +510 -0
  17. package/dist/agent-heartbeat-Z2QQXROL.js +510 -0
  18. package/dist/agent-notify-OEQBCZLN.js +43 -0
  19. package/dist/{agent-tools-263HM5QU.js → agent-tools-3W7XLUYA.js} +1 -1
  20. package/dist/agent-tools-4QK7LLNP.js +9 -0
  21. package/dist/agent-tools-54VZGT6L.js +9 -0
  22. package/dist/{agent-tools-AT4D276V.js → agent-tools-AYYDPO27.js} +7 -7
  23. package/dist/{agent-tools-MSTAPX2I.js → agent-tools-F2X47FKF.js} +7 -7
  24. package/dist/{agent-tools-FA26SY5O.js → agent-tools-O6W3QAZL.js} +11 -6
  25. package/dist/agent-tools-OAWVZBMW.js +9 -0
  26. package/dist/agent-tools-QCCU74PN.js +13949 -0
  27. package/dist/chunk-2LHUARN6.js +4929 -0
  28. package/dist/chunk-2WVCNCYC.js +5087 -0
  29. package/dist/{chunk-6PWDS7KY.js → chunk-3FM6YQUK.js} +20 -20
  30. package/dist/chunk-3UAFHUEC.js +212 -0
  31. package/dist/{chunk-WJO57PMO.js → chunk-46GOWZT4.js} +20 -20
  32. package/dist/{chunk-BNRE7TSX.js → chunk-5KYJAUZV.js} +3 -3
  33. package/dist/chunk-6C5PKREN.js +467 -0
  34. package/dist/{chunk-447MTPZF.js → chunk-6ZMLNEHB.js} +3 -3
  35. package/dist/chunk-BPZQT5N5.js +25652 -0
  36. package/dist/chunk-BQM7MBPS.js +1380 -0
  37. package/dist/{chunk-ZRFKGPIU.js → chunk-C52OQNNY.js} +20 -20
  38. package/dist/chunk-C7HGQF4Y.js +25652 -0
  39. package/dist/chunk-CAHNZGGK.js +25656 -0
  40. package/dist/{chunk-FL3CH3ET.js → chunk-CK7R6UHE.js} +51 -27
  41. package/dist/chunk-D36RPWB7.js +25652 -0
  42. package/dist/{chunk-36NM2B4C.js → chunk-DJK2UPFH.js} +63 -93
  43. package/dist/chunk-DM7FTF7W.js +4929 -0
  44. package/dist/chunk-DMD24UFZ.js +5101 -0
  45. package/dist/{chunk-36XNMIHA.js → chunk-DXZGPUAF.js} +20 -20
  46. package/dist/chunk-F46WB5IL.js +5087 -0
  47. package/dist/chunk-F5QG5SQH.js +5087 -0
  48. package/dist/{chunk-JGEVQZDR.js → chunk-FLQ5FLHW.js} +13 -16
  49. package/dist/chunk-H7GP733U.js +5087 -0
  50. package/dist/{chunk-OZSQLOV6.js → chunk-HHBXWB5U.js} +415 -19
  51. package/dist/{chunk-D24JY75H.js → chunk-IMXS4N6W.js} +3 -3
  52. package/dist/{chunk-6PVBV6ZP.js → chunk-JNMDD7JY.js} +3 -3
  53. package/dist/chunk-JTV5LA47.js +1519 -0
  54. package/dist/chunk-KV6G7NZX.js +1519 -0
  55. package/dist/chunk-MU5MEBIK.js +1519 -0
  56. package/dist/chunk-NLT5MC7X.js +465 -0
  57. package/dist/{chunk-GTFZZUXX.js → chunk-NVLYIM4J.js} +51 -27
  58. package/dist/{chunk-6G5SXLXC.js → chunk-NZY2BIZH.js} +63 -93
  59. package/dist/chunk-O42L6G67.js +1519 -0
  60. package/dist/chunk-OCNERGGM.js +4891 -0
  61. package/dist/chunk-OJSNHONE.js +1519 -0
  62. package/dist/{chunk-2TAZJWJN.js → chunk-OWL3QVH7.js} +18 -0
  63. package/dist/{chunk-P3HVY2HS.js → chunk-OWTLNV4Q.js} +382 -7
  64. package/dist/chunk-PCNYEP6T.js +4891 -0
  65. package/dist/{chunk-YL3Z5KPR.js → chunk-PI4AQ4Z6.js} +438 -15
  66. package/dist/chunk-PN3EGTCA.js +194 -0
  67. package/dist/chunk-Q37UKNRC.js +1519 -0
  68. package/dist/chunk-QXTC6J7H.js +5087 -0
  69. package/dist/{chunk-SPBQVNDI.js → chunk-RKERL5LZ.js} +25 -21
  70. package/dist/chunk-RVBK2IOX.js +25652 -0
  71. package/dist/chunk-SAKODCZ5.js +4891 -0
  72. package/dist/{chunk-XV4TU65E.js → chunk-SALGFC5L.js} +51 -27
  73. package/dist/chunk-STGWZ2MS.js +1519 -0
  74. package/dist/chunk-UY3ZVQDP.js +25652 -0
  75. package/dist/chunk-V6OSD62M.js +5087 -0
  76. package/dist/chunk-VP6YAHX4.js +1519 -0
  77. package/dist/chunk-WDYJOEAI.js +5087 -0
  78. package/dist/chunk-WEAFQNOS.js +195 -0
  79. package/dist/chunk-XKUSAZGP.js +5087 -0
  80. package/dist/chunk-Z6K5FKAB.js +548 -0
  81. package/dist/chunk-ZGE3XAXY.js +1519 -0
  82. package/dist/chunk-ZGYVXYQQ.js +3296 -0
  83. package/dist/cli-agent-7TB2BWS6.js +2370 -0
  84. package/dist/cli-agent-AKXFFST2.js +2370 -0
  85. package/dist/cli-agent-DZTKLITB.js +2357 -0
  86. package/dist/cli-agent-FOF7PFEP.js +2357 -0
  87. package/dist/cli-agent-H74M2ZYN.js +2357 -0
  88. package/dist/cli-agent-HORWVPHB.js +2370 -0
  89. package/dist/cli-agent-HSZT6SKF.js +2423 -0
  90. package/dist/cli-agent-JLUQ4ZU6.js +2424 -0
  91. package/dist/cli-agent-MVCDH4HV.js +2370 -0
  92. package/dist/cli-agent-NZXOEPJ2.js +2357 -0
  93. package/dist/cli-agent-PADN3QRC.js +2357 -0
  94. package/dist/cli-agent-QAYEX3BE.js +2441 -0
  95. package/dist/cli-agent-QT64DT5J.js +2370 -0
  96. package/dist/cli-agent-TFL2M6UK.js +2424 -0
  97. package/dist/cli-agent-UIKXATTD.js +2357 -0
  98. package/dist/cli-agent-UJN6FYTO.js +2370 -0
  99. package/dist/cli-agent-VIQAYVY4.js +2357 -0
  100. package/dist/cli-agent-WNWFVOFM.js +2370 -0
  101. package/dist/cli-agent-XBQX67VJ.js +2423 -0
  102. package/dist/cli-agent-ZLSC6FF4.js +2357 -0
  103. package/dist/cli-serve-2IL5DTEY.js +153 -0
  104. package/dist/cli-serve-47N5UKKW.js +153 -0
  105. package/dist/cli-serve-4XGZFUV2.js +140 -0
  106. package/dist/cli-serve-6OT3UEAN.js +140 -0
  107. package/dist/cli-serve-7L6EY5UH.js +153 -0
  108. package/dist/cli-serve-BDGOOOKQ.js +260 -0
  109. package/dist/cli-serve-BFNIW2LF.js +153 -0
  110. package/dist/cli-serve-C7MN6U5Q.js +153 -0
  111. package/dist/cli-serve-CR3OY3IM.js +153 -0
  112. package/dist/cli-serve-DAJFRWQ7.js +153 -0
  113. package/dist/cli-serve-FW6FHFW4.js +153 -0
  114. package/dist/cli-serve-GEEOQS77.js +153 -0
  115. package/dist/cli-serve-H562I3ZK.js +153 -0
  116. package/dist/cli-serve-HDQZF4C4.js +153 -0
  117. package/dist/cli-serve-LICAOMEB.js +140 -0
  118. package/dist/cli-serve-LLGYLWFS.js +153 -0
  119. package/dist/cli-serve-N3OISDNB.js +153 -0
  120. package/dist/cli-serve-TIZ27EVR.js +153 -0
  121. package/dist/cli-serve-TUNI2RCN.js +153 -0
  122. package/dist/cli-serve-WNOZMAWD.js +153 -0
  123. package/dist/cli-validate-Z726VJCN.js +150 -0
  124. package/dist/cli.js +4 -4
  125. package/dist/connection-manager-KAWEUWUR.js +9 -0
  126. package/dist/dashboard/app.js +9 -3
  127. package/dist/dashboard/components/knowledge-link.js +15 -0
  128. package/dist/dashboard/components/settings-help.js +4 -2
  129. package/dist/dashboard/docs/agent-deployment.html +33 -1
  130. package/dist/dashboard/docs/settings-network.html +321 -0
  131. package/dist/dashboard/docs/settings-security.html +347 -0
  132. package/dist/dashboard/docs/settings-tool-security.html +176 -0
  133. package/dist/dashboard/docs/settings.html +36 -16
  134. package/dist/dashboard/pages/agent-detail/deployment.js +39 -6
  135. package/dist/dashboard/pages/agent-detail/tools.js +10 -0
  136. package/dist/dashboard/pages/database-access.js +4 -3
  137. package/dist/dashboard/pages/settings.js +174 -37
  138. package/dist/dashboard/pages/task-pipeline.js +400 -843
  139. package/dist/db-adapter-2T56ORSD.js +7 -0
  140. package/dist/db-adapter-IRHOUMVC.js +7 -0
  141. package/dist/index.js +41 -41
  142. package/dist/microsoft-VREAZ7M2.js +3955 -0
  143. package/dist/routes-3MMLQTB6.js +90 -0
  144. package/dist/routes-4ZUIJ4HE.js +90 -0
  145. package/dist/routes-5MXHKKH4.js +90 -0
  146. package/dist/routes-64NJFK3B.js +90 -0
  147. package/dist/routes-6AKQ2LBV.js +90 -0
  148. package/dist/routes-CRRBUDO4.js +90 -0
  149. package/dist/routes-DIAF3MC3.js +90 -0
  150. package/dist/routes-KMUNU6CY.js +90 -0
  151. package/dist/routes-LRRLXIZR.js +90 -0
  152. package/dist/routes-N647AJYG.js +90 -0
  153. package/dist/routes-SSSELAAR.js +90 -0
  154. package/dist/routes-STERVGKJ.js +90 -0
  155. package/dist/routes-ZEZZACZP.js +90 -0
  156. package/dist/runtime-5EQN4GFM.js +45 -0
  157. package/dist/runtime-5LP7PUD4.js +45 -0
  158. package/dist/runtime-6BULDBR3.js +45 -0
  159. package/dist/runtime-6YEENDN3.js +45 -0
  160. package/dist/runtime-7LQFRG3B.js +45 -0
  161. package/dist/runtime-AMXJU2MB.js +45 -0
  162. package/dist/runtime-D6WSE7FG.js +45 -0
  163. package/dist/runtime-EYVN7NFJ.js +45 -0
  164. package/dist/runtime-F6RPWQVW.js +45 -0
  165. package/dist/runtime-FYMJURFC.js +45 -0
  166. package/dist/runtime-JRNBL4O4.js +45 -0
  167. package/dist/runtime-OM2NIBMI.js +45 -0
  168. package/dist/runtime-QWPVD7CY.js +45 -0
  169. package/dist/runtime-YLIIPTE4.js +45 -0
  170. package/dist/runtime-YU6P22CG.js +45 -0
  171. package/dist/screen-unlock-4RPZBHOI.js +118 -0
  172. package/dist/server-AMCSXINC.js +28 -0
  173. package/dist/server-CU6LVQS4.js +28 -0
  174. package/dist/server-DFYGH2CV.js +28 -0
  175. package/dist/server-EELWOC3X.js +28 -0
  176. package/dist/server-EN5E2OWQ.js +28 -0
  177. package/dist/server-GW2HYJYI.js +28 -0
  178. package/dist/server-J25NCRWJ.js +28 -0
  179. package/dist/server-JDGNOTFV.js +28 -0
  180. package/dist/server-NE5HD5DJ.js +28 -0
  181. package/dist/server-NQOT7W77.js +28 -0
  182. package/dist/server-PWE5PQTR.js +28 -0
  183. package/dist/server-Q2Q32H2B.js +28 -0
  184. package/dist/server-Q77ME7TL.js +28 -0
  185. package/dist/server-WLLH4WST.js +28 -0
  186. package/dist/server-WTUJ2O3F.js +28 -0
  187. package/dist/server-X4CJTHHF.js +28 -0
  188. package/dist/server-XK3ILCJC.js +28 -0
  189. package/dist/server-ZRD3NDJE.js +28 -0
  190. package/dist/setup-44VBAO4J.js +20 -0
  191. package/dist/setup-4ONNQBWB.js +20 -0
  192. package/dist/setup-4OSBXSCL.js +20 -0
  193. package/dist/setup-4QFGRBLZ.js +20 -0
  194. package/dist/setup-6766SGAR.js +20 -0
  195. package/dist/setup-AYY24DKM.js +20 -0
  196. package/dist/setup-B34N4HPU.js +20 -0
  197. package/dist/setup-E2YLC2EY.js +20 -0
  198. package/dist/setup-ER6NXTY5.js +20 -0
  199. package/dist/setup-H2AGCBW5.js +20 -0
  200. package/dist/setup-ICOZRKCX.js +20 -0
  201. package/dist/setup-JFTJH7UF.js +20 -0
  202. package/dist/setup-PRFNI6YW.js +20 -0
  203. package/dist/setup-RAHBMYHE.js +20 -0
  204. package/dist/setup-TXPR5UQX.js +20 -0
  205. package/dist/setup-XCJMELVU.js +20 -0
  206. package/dist/setup-XIYEIFVK.js +20 -0
  207. package/dist/setup-Z4PZSHBI.js +20 -0
  208. package/dist/skills-FR7I5V7H.js +16 -0
  209. package/dist/skills-HCVBA6PK.js +16 -0
  210. package/dist/system-prompts-TM7OA32C.js +913 -0
  211. package/dist/task-queue-O7IVZYUO.js +9 -0
  212. package/dist/transport-encryption-2T7PIXKG.js +25 -0
  213. package/logs/cloudflared-error.log +61 -0
  214. package/logs/cloudflared-out.log +0 -0
  215. package/logs/enterprise-error.log +0 -0
  216. package/logs/enterprise-out.log +3 -0
  217. package/logs/fola-error.log +0 -0
  218. package/logs/fola-out.log +0 -0
  219. package/logs/john-error.log +8 -0
  220. package/logs/john-out.log +0 -0
  221. package/package.json +31 -3
  222. package/src/agent-tools/tool-resolver.ts +50 -61
  223. package/src/agent-tools/tools/enterprise-database.ts +5 -5
  224. package/src/agent-tools/tools/local/dependency-manager.ts +2 -2
  225. package/src/agent-tools/tools/microsoft/graph-api.ts +137 -26
  226. package/src/agent-tools/tools/microsoft/outlook-mail.ts +392 -100
  227. package/src/agent-tools/tools/microsoft/teams.ts +267 -48
  228. package/src/auth/routes.ts +4 -4
  229. package/src/cli-agent.ts +108 -8
  230. package/src/cli-serve.ts +140 -0
  231. package/src/dashboard/app.js +9 -3
  232. package/src/dashboard/components/knowledge-link.js +15 -0
  233. package/src/dashboard/components/settings-help.js +4 -2
  234. package/src/dashboard/docs/agent-deployment.html +33 -1
  235. package/src/dashboard/docs/settings-network.html +321 -0
  236. package/src/dashboard/docs/settings-security.html +347 -0
  237. package/src/dashboard/docs/settings-tool-security.html +176 -0
  238. package/src/dashboard/docs/settings.html +36 -16
  239. package/src/dashboard/pages/agent-detail/deployment.js +39 -6
  240. package/src/dashboard/pages/agent-detail/tools.js +10 -0
  241. package/src/dashboard/pages/database-access.js +4 -3
  242. package/src/dashboard/pages/settings.js +174 -37
  243. package/src/dashboard/pages/task-pipeline.js +400 -843
  244. package/src/database-access/agent-tools.ts +78 -63
  245. package/src/database-access/connection-manager.ts +13 -2
  246. package/src/database-access/routes.ts +13 -1
  247. package/src/db/adapter.ts +1 -0
  248. package/src/engine/agent-memory.ts +2 -1
  249. package/src/engine/agent-notify.ts +50 -0
  250. package/src/engine/agent-routes.ts +257 -4
  251. package/src/engine/db-adapter.ts +16 -0
  252. package/src/engine/lifecycle.ts +4 -0
  253. package/src/engine/routes.ts +4 -3
  254. package/src/engine/screen-unlock.ts +136 -0
  255. package/src/engine/skills/database-access.ts +78 -0
  256. package/src/engine/skills/index.ts +3 -2
  257. package/src/engine/skills.ts +2 -0
  258. package/src/engine/task-queue-routes.ts +18 -0
  259. package/src/engine/task-queue.ts +15 -2
  260. package/src/middleware/transport-encryption.ts +1 -4
  261. package/src/runtime/agent-loop.ts +4 -0
  262. package/src/runtime/index.ts +15 -6
  263. package/src/server.ts +14 -1
  264. package/src/system-prompts/google/index.ts +1 -2
  265. package/src/system-prompts/index.ts +1 -1
  266. package/src/system-prompts/microsoft/contacts.ts +34 -0
  267. package/src/system-prompts/microsoft/excel.ts +52 -0
  268. package/src/system-prompts/microsoft/index.ts +31 -0
  269. package/src/system-prompts/microsoft/onedrive.ts +41 -0
  270. package/src/system-prompts/microsoft/onenote.ts +36 -0
  271. package/src/system-prompts/microsoft/outlook-calendar.ts +37 -0
  272. package/src/system-prompts/microsoft/outlook-mail.ts +46 -0
  273. package/src/system-prompts/microsoft/planner.ts +37 -0
  274. package/src/system-prompts/microsoft/powerbi.ts +38 -0
  275. package/src/system-prompts/microsoft/powerpoint.ts +35 -0
  276. package/src/system-prompts/microsoft/sharepoint.ts +44 -0
  277. package/src/system-prompts/microsoft/teams.ts +49 -0
  278. package/src/system-prompts/microsoft/todo.ts +37 -0
  279. package/src/types/hono-env.ts +4 -0
  280. package/.github/CODEOWNERS +0 -23
  281. package/.github/workflows/publish-community-skills.yml +0 -121
  282. package/.github/workflows/validate-community-skills.yml +0 -172
  283. package/agriculture_southwest_nigeria_research.txt +0 -10
  284. package/boa_credit_cards_research.txt +0 -10
  285. package/customer_support_research_feb2026.txt +0 -10
  286. package/dist/agent-tools-LRA7PPXG.js +0 -13922
  287. package/dist/agent-tools-VAU5DOQB.js +0 -13910
  288. package/dist/agent-tools-VWV7OWXU.js +0 -13922
  289. package/dist/chunk-2Z7MWTCX.js +0 -4977
  290. package/dist/chunk-3T4XU3VV.js +0 -5010
  291. package/dist/chunk-445QM4NX.js +0 -5061
  292. package/dist/chunk-5TW3Y7DJ.js +0 -1519
  293. package/dist/chunk-6I7VY3LT.js +0 -5060
  294. package/dist/chunk-6W5EK3UP.js +0 -4977
  295. package/dist/chunk-AQMSHJQT.js +0 -5069
  296. package/dist/chunk-ASSQW7HX.js +0 -5051
  297. package/dist/chunk-CIN27FGC.js +0 -5037
  298. package/dist/chunk-CMXY3NUB.js +0 -4977
  299. package/dist/chunk-DRLMRUDP.js +0 -5052
  300. package/dist/chunk-EHI7Z446.js +0 -1519
  301. package/dist/chunk-FEAILFAQ.js +0 -1519
  302. package/dist/chunk-GA3PYBZL.js +0 -1519
  303. package/dist/chunk-GWX63G5J.js +0 -1519
  304. package/dist/chunk-HHMZ4UY6.js +0 -1519
  305. package/dist/chunk-HVQMNF7E.js +0 -4921
  306. package/dist/chunk-HXM7F3YN.js +0 -1519
  307. package/dist/chunk-K6NGOUXG.js +0 -5060
  308. package/dist/chunk-KPG5WINJ.js +0 -4977
  309. package/dist/chunk-LBCUBYDL.js +0 -1519
  310. package/dist/chunk-LIRQSWLR.js +0 -5014
  311. package/dist/chunk-LRCKO5KE.js +0 -1519
  312. package/dist/chunk-M7XL3DJD.js +0 -5069
  313. package/dist/chunk-MHJULEIQ.js +0 -1519
  314. package/dist/chunk-MJGGW6MC.js +0 -106
  315. package/dist/chunk-MMYBDHDB.js +0 -4921
  316. package/dist/chunk-MQT5FXKD.js +0 -1519
  317. package/dist/chunk-OIMPEQF5.js +0 -4977
  318. package/dist/chunk-OOU7JUYE.js +0 -542
  319. package/dist/chunk-OW4GLBHP.js +0 -1519
  320. package/dist/chunk-Q4K4MMLU.js +0 -4977
  321. package/dist/chunk-RUK4CRPF.js +0 -1519
  322. package/dist/chunk-T7H65XQY.js +0 -1519
  323. package/dist/chunk-TQVFWG57.js +0 -5064
  324. package/dist/chunk-UEPK3IMC.js +0 -1519
  325. package/dist/chunk-VUWTXJH6.js +0 -1519
  326. package/dist/chunk-WCPGGSAD.js +0 -1519
  327. package/dist/chunk-WO63NZOJ.js +0 -1519
  328. package/dist/chunk-YPJDRVUM.js +0 -5064
  329. package/dist/chunk-ZROMH5DL.js +0 -4921
  330. package/src/dashboard/docs/_template.txt +0 -92
package/dist/dashboard/docs/settings-network.html ADDED
@@ -0,0 +1,321 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Network &amp; Firewall — AgenticMail Enterprise</title>
7
+ <style>
8
+ :root {
9
+ --bg-primary: #0f1117; --bg-secondary: #161822; --bg-tertiary: #1c1f2e; --bg-card: #181b28;
10
+ --text-primary: #e8eaf0; --text-secondary: #9ca3b8; --text-muted: #6b7394;
11
+ --accent: #6366f1; --accent-soft: rgba(99,102,241,0.12);
12
+ --border: #2a2f45; --border-light: #353a52; --radius: 10px;
13
+ --success: #15803d; --warning: #eab308; --danger: #ef4444;
14
+ --info-soft: rgba(99,102,241,0.06);
15
+ }
16
+ [data-theme="light"] {
17
+ --bg-primary: #d0c5a0; --bg-secondary: #ddd3b2; --bg-tertiary: #c8bc94; --bg-card: #e5dcc0;
18
+ --text-primary: #2c2410; --text-secondary: #3d3520; --text-muted: #6b5e42;
19
+ --accent: #2563eb; --accent-soft: rgba(37,99,235,0.1);
20
+ --border: #b8ad8a; --border-light: #a89e7a; --info-soft: rgba(37,99,235,0.06);
21
+ }
22
+ * { box-sizing: border-box; margin: 0; padding: 0; }
23
+ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg-primary); color: var(--text-primary); line-height: 1.7; padding: 32px; max-width: 900px; margin: 0 auto; }
24
+ h1 { font-size: 28px; margin-bottom: 8px; }
25
+ h2 { font-size: 20px; margin: 32px 0 12px; padding-bottom: 8px; border-bottom: 1px solid var(--border); }
26
+ h3 { font-size: 16px; margin: 20px 0 8px; color: var(--accent); }
27
+ p { margin-bottom: 12px; color: var(--text-secondary); }
28
+ code { background: var(--bg-primary); border: 1px solid var(--border); padding: 2px 6px; border-radius: 4px; font-size: 13px; color: var(--accent); }
29
+ pre { background: var(--bg-primary); border: 1px solid var(--border); padding: 16px; border-radius: var(--radius); overflow-x: auto; margin: 12px 0; font-size: 13px; line-height: 1.5; color: var(--text-secondary); }
30
+ pre code { background: none; border: none; padding: 0; }
31
+ .card { background: var(--bg-card); border: 1px solid var(--border); border-radius: var(--radius); padding: 20px; margin: 16px 0; }
32
+ .tip { background: var(--info-soft); border: 1px solid rgba(59,130,246,0.3); padding: 12px 16px; border-radius: var(--radius); margin: 12px 0; font-size: 13px; color: var(--text-secondary); }
33
+ .warning { background: rgba(245,158,11,0.08); border: 1px solid rgba(245,158,11,0.3); padding: 12px 16px; border-radius: var(--radius); margin: 12px 0; font-size: 13px; color: var(--text-secondary); }
34
+ .danger { background: rgba(239,68,68,0.08); border: 1px solid rgba(239,68,68,0.3); padding: 12px 16px; border-radius: var(--radius); margin: 12px 0; font-size: 13px; color: var(--text-secondary); }
35
+ table { width: 100%; border-collapse: collapse; margin: 12px 0; font-size: 13px; }
36
+ th, td { text-align: left; padding: 8px 12px; border: 1px solid var(--border); color: var(--text-secondary); }
37
+ th { background: var(--bg-secondary); font-weight: 600; color: var(--text-primary); }
38
+ ul, ol { padding-left: 24px; margin-bottom: 12px; color: var(--text-secondary); }
39
+ li { margin-bottom: 6px; }
40
+ a { color: var(--accent); }
41
+ .back { display: inline-block; margin-bottom: 20px; font-size: 13px; color: var(--text-muted); text-decoration: none; }
42
+ .back:hover { color: var(--text-primary); }
43
+ strong { color: var(--text-primary); }
44
+ .toc { background: var(--bg-card); border: 1px solid var(--border); border-radius: var(--radius); padding: 16px 20px; margin: 16px 0; }
45
+ .toc h3 { margin: 0 0 8px; font-size: 14px; }
46
+ .toc ul { list-style: none; padding: 0; }
47
+ .toc li { margin: 4px 0; }
48
+ .toc a { font-size: 13px; text-decoration: none; }
49
+ </style>
50
+ <script>
51
+ var t = localStorage.getItem('em_theme') || 'dark';
52
+ document.documentElement.setAttribute('data-theme', t);
53
+ </script>
54
+ </head>
55
+ <body>
56
+
57
+ <a class="back" href="/dashboard/settings">&#8592; Back to Settings</a>
58
+
59
+ <h1>Network &amp; Firewall</h1>
60
+ <p style="color: var(--text-muted); margin-bottom: 24px;">Control network access, egress rules, proxy settings, and deployment security for your enterprise instance.</p>
61
+
62
+ <div class="toc">
63
+ <h3>On This Page</h3>
64
+ <ul>
65
+ <li><a href="#overview">Overview</a></li>
66
+ <li><a href="#ip-access">Inbound IP Filtering</a></li>
67
+ <li><a href="#egress">Egress Filtering</a></li>
68
+ <li><a href="#proxy">Proxy Configuration</a></li>
69
+ <li><a href="#trusted-proxies">Trusted Proxies</a></li>
70
+ <li><a href="#cors">CORS Origins</a></li>
71
+ <li><a href="#rate-limiting">Rate Limiting</a></li>
72
+ <li><a href="#https">HTTPS Enforcement</a></li>
73
+ <li><a href="#security-headers">Security Headers</a></li>
74
+ <li><a href="#dns-rebinding">DNS Rebinding Protection</a></li>
75
+ <li><a href="#body-limits">Request Body Limits</a></li>
76
+ <li><a href="#geo-ip">Geo-IP Restrictions</a></li>
77
+ <li><a href="#webhooks">Webhook Security</a></li>
78
+ <li><a href="#deployment-scenarios">Deployment Scenarios</a></li>
79
+ </ul>
80
+ </div>
81
+
82
+ <h2 id="overview">Overview</h2>
83
+ <p>The Network &amp; Firewall tab controls who can access your AgenticMail instance (inbound) and what your agents can reach on the internet (outbound). These settings form the perimeter defense of your deployment.</p>
84
+
85
+ <div class="tip"><strong>Save behavior:</strong> Changes are saved when you click the "Save Settings" button at the top or the sticky bar at the bottom. A "Changes take effect immediately" note appears — no server restart is needed.</div>
86
+
87
+ <h2 id="ip-access">Inbound IP Filtering</h2>
88
+ <p>Restricts which IP addresses can access the dashboard, APIs, and engine endpoints. Supports individual IPs and CIDR ranges.</p>
89
+
90
+ <div class="card">
91
+ <table>
92
+ <tr><th>Setting</th><th>Description</th></tr>
93
+ <tr><td><strong>Enable</strong></td><td>Master toggle for IP filtering</td></tr>
94
+ <tr><td><strong>Mode</strong></td><td>
95
+ <ul style="margin: 0;">
96
+ <li><strong>Allowlist</strong> — Only listed IPs can access. Everything else is blocked. Use for production lockdown.</li>
97
+ <li><strong>Blocklist</strong> — All IPs allowed except listed ones. Use for blocking known attackers.</li>
98
+ </ul>
99
+ </td></tr>
100
+ <tr><td><strong>Allowed IPs / CIDRs</strong></td><td>IPs permitted in allowlist mode. E.g., <code>10.0.0.0/8</code>, <code>203.0.113.42</code></td></tr>
101
+ <tr><td><strong>Blocked IPs / CIDRs</strong></td><td>IPs rejected in blocklist mode</td></tr>
102
+ <tr><td><strong>Bypass Paths</strong></td><td>URL paths that skip IP filtering (e.g., <code>/health</code>, <code>/ready</code> for load balancer checks)</td></tr>
103
+ </table>
104
+ </div>
105
+
106
+ <h3>Test IP Tool</h3>
107
+ <p>Enter any IP address and click "Test" to see whether it would be allowed or blocked under the current rules. Useful for validating your configuration before saving.</p>
108
+
109
+ <div class="warning"><strong>Don't lock yourself out!</strong> Before enabling allowlist mode, make sure your current IP is included. If you do lock yourself out, you can modify the firewall config directly in the database (<code>securityConfig</code> in the <code>settings</code> table).</div>
110
+
111
+ <h2 id="egress">Egress Filtering</h2>
112
+ <p>Controls which external hosts and ports agents can reach when using web fetch, browser automation, and other network tools.</p>
113
+
114
+ <div class="card">
115
+ <table>
116
+ <tr><th>Setting</th><th>Description</th></tr>
117
+ <tr><td><strong>Enable</strong></td><td>Master toggle for egress filtering</td></tr>
118
+ <tr><td><strong>Mode</strong></td><td>
119
+ <ul style="margin: 0;">
120
+ <li><strong>Allowlist</strong> — Agents can only connect to listed hosts. Maximum restriction.</li>
121
+ <li><strong>Blocklist</strong> — Agents can connect anywhere except listed hosts. More permissive.</li>
122
+ </ul>
123
+ </td></tr>
124
+ <tr><td><strong>Allowed Hosts</strong></td><td>Wildcards supported: <code>*.googleapis.com</code>, <code>api.openai.com</code></td></tr>
125
+ <tr><td><strong>Blocked Hosts</strong></td><td>Hosts agents cannot reach: <code>evil.example.com</code></td></tr>
126
+ <tr><td><strong>Allowed Ports</strong></td><td>Only these outbound ports are permitted (e.g., 443, 80)</td></tr>
127
+ <tr><td><strong>Blocked Ports</strong></td><td>These outbound ports are blocked (e.g., 25 for SMTP, 22 for SSH)</td></tr>
128
+ </table>
129
+ </div>
130
+
131
+ <div class="tip"><strong>Minimal egress for production:</strong> Use allowlist mode and only permit the hosts your agents actually need — LLM provider APIs, email servers, and specific integration endpoints. This prevents data exfiltration even if an agent is compromised.</div>
132
+
133
+ <h2 id="proxy">Proxy Configuration</h2>
134
+ <p>Configure HTTP/HTTPS proxies for agent outbound traffic. Required in corporate environments with restricted internet access.</p>
135
+
136
+ <div class="card">
137
+ <table>
138
+ <tr><th>Setting</th><th>Description</th></tr>
139
+ <tr><td><strong>HTTP Proxy</strong></td><td>Proxy URL for HTTP traffic: <code>http://proxy.corp.internal:8080</code></td></tr>
140
+ <tr><td><strong>HTTPS Proxy</strong></td><td>Proxy URL for HTTPS traffic (often the same as HTTP proxy)</td></tr>
141
+ <tr><td><strong>No-Proxy Hosts</strong></td><td>Hosts that bypass the proxy: <code>localhost</code>, <code>127.0.0.1</code>, <code>*.internal</code></td></tr>
142
+ </table>
143
+ </div>
144
+
145
+ <p>When configured, these proxy settings are applied to all outbound HTTP/HTTPS requests made by agents via tools like <code>web_fetch</code>, <code>web_search</code>, and browser automation.</p>
146
+
147
+ <h2 id="trusted-proxies">Trusted Proxies</h2>
148
+ <p>When your instance sits behind a reverse proxy (nginx, Cloudflare, AWS ALB), the real client IP is in the <code>X-Forwarded-For</code> header. You must list your proxy IPs here so the system extracts the correct client IP.</p>
149
+
150
+ <div class="card">
151
+ <table>
152
+ <tr><th>Setting</th><th>Description</th></tr>
153
+ <tr><td><strong>Enable</strong></td><td>Toggle trusted proxy validation</td></tr>
154
+ <tr><td><strong>Trusted Proxy IPs / CIDRs</strong></td><td>IP ranges of your proxies: <code>10.0.0.0/8</code>, <code>172.16.0.0/12</code></td></tr>
155
+ </table>
156
+ </div>
157
+
158
+ <div class="danger"><strong>Critical for IP filtering:</strong> Without trusted proxies configured, the system sees the proxy's IP instead of the real client IP. This breaks IP allowlisting, rate limiting, and audit logging.</div>
159
+
160
+ <h2 id="cors">CORS Origins</h2>
161
+ <p>Controls which domains can make cross-origin API requests from a browser. Required when your dashboard is served from a different domain than the API.</p>
162
+
163
+ <div class="card">
164
+ <table>
165
+ <tr><th>Setting</th><th>Description</th></tr>
166
+ <tr><td><strong>Allowed Origins</strong></td><td>List of allowed origins: <code>https://dashboard.example.com</code>. Leave empty to allow all (<code>*</code>).</td></tr>
167
+ </table>
168
+ </div>
169
+
170
+ <div class="warning"><strong>Production:</strong> Never leave CORS origins empty in production. Always specify exact origins to prevent unauthorized cross-origin requests.</div>
171
+
172
+ <h2 id="rate-limiting">Rate Limiting</h2>
173
+ <p>Per-IP rate limiting using a token bucket algorithm. Protects against brute-force attacks, API abuse, and basic DDoS.</p>
174
+
175
+ <div class="card">
176
+ <table>
177
+ <tr><th>Setting</th><th>Default</th><th>Description</th></tr>
178
+ <tr><td><strong>Enable</strong></td><td>On</td><td>Master toggle</td></tr>
179
+ <tr><td><strong>Requests per Minute</strong></td><td>120</td><td>Maximum API requests per IP per minute</td></tr>
180
+ <tr><td><strong>Skip Paths</strong></td><td><code>/health</code>, <code>/ready</code></td><td>Paths excluded from rate limiting (health checks, webhooks)</td></tr>
181
+ </table>
182
+ </div>
183
+
184
+ <p>When a client exceeds the limit, they receive a <code>429 Too Many Requests</code> response with a <code>Retry-After</code> header.</p>
185
+
186
+ <h2 id="https">HTTPS Enforcement</h2>
187
+ <p>Redirects all HTTP requests to HTTPS. Essential for production deployments.</p>
188
+
189
+ <div class="card">
190
+ <table>
191
+ <tr><th>Setting</th><th>Description</th></tr>
192
+ <tr><td><strong>Enforce HTTPS</strong></td><td>Redirect HTTP to HTTPS. Checks <code>X-Forwarded-Proto</code> for reverse proxy setups.</td></tr>
193
+ <tr><td><strong>Exclude Paths</strong></td><td>Paths that can be accessed over HTTP (e.g., health checks from internal LB)</td></tr>
194
+ </table>
195
+ </div>
196
+
197
+ <h2 id="security-headers">Security Headers</h2>
198
+ <p>HTTP headers added to every response for browser-level security.</p>
199
+
200
+ <div class="card">
201
+ <table>
202
+ <tr><th>Header</th><th>Default</th><th>Purpose</th></tr>
203
+ <tr><td><strong>Strict-Transport-Security (HSTS)</strong></td><td>Enabled, 1 year</td><td>Forces browsers to always use HTTPS. <code>max-age</code> sets how long browsers remember this.</td></tr>
204
+ <tr><td><strong>X-Content-Type-Options</strong></td><td><code>nosniff</code></td><td>Prevents browsers from guessing content types. Stops MIME-based attacks.</td></tr>
205
+ <tr><td><strong>X-Frame-Options</strong></td><td><code>DENY</code></td><td>Prevents your dashboard from being embedded in iframes. Stops clickjacking.</td></tr>
206
+ <tr><td><strong>Referrer-Policy</strong></td><td><code>strict-origin-when-cross-origin</code></td><td>Controls how much URL info is sent in the <code>Referer</code> header.</td></tr>
207
+ <tr><td><strong>Permissions-Policy</strong></td><td><code>camera=(), microphone=(), geolocation=()</code></td><td>Disables browser features not needed by the dashboard.</td></tr>
208
+ </table>
209
+ </div>
210
+
211
+ <div class="tip"><strong>Recommended:</strong> Keep all defaults. Only change X-Frame-Options to <code>SAMEORIGIN</code> if you embed the dashboard in your own portal.</div>
212
+
213
+ <h2 id="dns-rebinding">DNS Rebinding Protection</h2>
214
+ <p>Validates the <code>Host</code> header against an allowlist to prevent DNS rebinding attacks.</p>
215
+
216
+ <div class="card">
217
+ <h3 style="margin-top: 0;">What is DNS Rebinding?</h3>
218
+ <p>An attacker registers a domain that initially resolves to their server, then re-resolves to your internal server IP. The browser thinks it's making a same-origin request to the attacker's domain, but it's actually hitting your internal API.</p>
219
+ <p>When enabled, requests with a <code>Host</code> header not in the allowlist are rejected with a <code>403 Forbidden</code>.</p>
220
+ </div>
221
+
222
+ <table>
223
+ <tr><th>Setting</th><th>Description</th></tr>
224
+ <tr><td><strong>Enable</strong></td><td>Toggle DNS rebinding protection</td></tr>
225
+ <tr><td><strong>Allowed Hosts</strong></td><td>Your domain(s): <code>enterprise.example.com</code>, <code>localhost</code></td></tr>
226
+ </table>
227
+
228
+ <h2 id="body-limits">Request Body Limits</h2>
229
+ <p>Maximum size for incoming request bodies. Prevents denial-of-service via oversized payloads.</p>
230
+
231
+ <div class="card">
232
+ <table>
233
+ <tr><th>Setting</th><th>Default</th><th>Description</th></tr>
234
+ <tr><td><strong>Max Body Size</strong></td><td>10,240 KB (10 MB)</td><td>Requests exceeding this are rejected with <code>413 Payload Too Large</code></td></tr>
235
+ </table>
236
+ </div>
237
+
238
+ <p>Increase this if agents need to upload large files (documents, images). Decrease for tighter security in exposed environments.</p>
239
+
240
+ <h2 id="geo-ip">Geo-IP Restrictions</h2>
241
+ <p>Restrict access by country using built-in IP geolocation. Works without Cloudflare or any reverse proxy — the server resolves IPs directly.</p>
242
+
243
+ <div class="card">
244
+ <table>
245
+ <tr><th>Setting</th><th>Description</th></tr>
246
+ <tr><td><strong>Enable</strong></td><td>Toggle geo-IP filtering</td></tr>
247
+ <tr><td><strong>Mode</strong></td><td>
248
+ <ul style="margin: 0;">
249
+ <li><strong>Allowlist</strong> — Only selected countries can access</li>
250
+ <li><strong>Blocklist</strong> — Selected countries are blocked, all others allowed</li>
251
+ </ul>
252
+ </td></tr>
253
+ <tr><td><strong>Countries</strong></td><td>Select countries using the picker (search by name or code)</td></tr>
254
+ </table>
255
+ </div>
256
+
257
+ <div class="warning"><strong>VPN users:</strong> Geo-IP filtering is based on the IP address the server sees. Users on VPNs will appear to be in the VPN's country, not their actual location. Consider this when using allowlist mode.</div>
258
+
259
+ <h2 id="webhooks">Webhook Security</h2>
260
+ <p>Security controls for inbound webhook endpoints used by Slack, Google Chat, and third-party integrations.</p>
261
+
262
+ <div class="card">
263
+ <table>
264
+ <tr><th>Setting</th><th>Description</th></tr>
265
+ <tr><td><strong>Enable</strong></td><td>Toggle webhook security</td></tr>
266
+ <tr><td><strong>Require HMAC Signature</strong></td><td>Webhooks must include a valid HMAC signature. Prevents spoofed requests from attackers.</td></tr>
267
+ <tr><td><strong>Allowed Source IPs</strong></td><td>Only accept webhooks from known provider IP ranges (e.g., Google: <code>35.0.0.0/8</code>, Slack: <code>3.0.0.0/8</code>)</td></tr>
268
+ </table>
269
+ </div>
270
+
271
+ <h2 id="deployment-scenarios">Deployment Scenarios</h2>
272
+
273
+ <div class="card">
274
+ <h3 style="margin-top: 0;">Development / Local</h3>
275
+ <ul>
276
+ <li>IP filtering: Disabled</li>
277
+ <li>HTTPS: Disabled</li>
278
+ <li>CORS: Empty (allow all)</li>
279
+ <li>Rate limiting: Enabled (prevents runaway scripts)</li>
280
+ </ul>
281
+ </div>
282
+
283
+ <div class="card">
284
+ <h3 style="margin-top: 0;">Production — Behind Cloudflare</h3>
285
+ <ul>
286
+ <li>IP filtering: Allowlist with Cloudflare IPs (<code>173.245.48.0/20</code>, <code>103.21.244.0/22</code>, etc.)</li>
287
+ <li>Trusted proxies: Cloudflare IP ranges</li>
288
+ <li>HTTPS: Enforced</li>
289
+ <li>CORS: Your dashboard domain only</li>
290
+ <li>Security headers: All defaults</li>
291
+ <li>Geo-IP: Optional — Cloudflare can also handle this at the edge</li>
292
+ </ul>
293
+ </div>
294
+
295
+ <div class="card">
296
+ <h3 style="margin-top: 0;">Corporate / Air-Gapped</h3>
297
+ <ul>
298
+ <li>IP filtering: Allowlist with corporate IP ranges</li>
299
+ <li>Egress: Allowlist with only required API endpoints</li>
300
+ <li>Proxy: Corporate HTTP/HTTPS proxy configured</li>
301
+ <li>HTTPS: Enforced</li>
302
+ <li>DNS rebinding: Enabled with internal hostnames</li>
303
+ </ul>
304
+ </div>
305
+
306
+ <h2>Related Pages</h2>
307
+ <div class="card">
308
+ <ul>
309
+ <li><a href="/docs/settings-security">Security System</a> — Prompt injection, encryption, dependency management</li>
310
+ <li><a href="/docs/settings-tool-security">Tool Security</a> — Path sandbox, SSRF, command sanitizer</li>
311
+ <li><a href="/docs/settings">Settings Overview</a> — All settings tabs</li>
312
+ <li><a href="/docs/audit">Audit Log</a> — Monitor security events</li>
313
+ </ul>
314
+ </div>
315
+
316
+ <div style="margin-top:40px;padding-top:16px;border-top:1px solid var(--border);display:flex;justify-content:space-between;align-items:center;font-size:12px;color:var(--text-muted)">
317
+ <span>AgenticMail Enterprise Documentation</span>
318
+ <a href="https://github.com/agenticmail/enterprise/issues" target="_blank" style="display:inline-flex;align-items:center;gap:4px;color:var(--text-muted);text-decoration:none"><svg width="14" height="14" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.435 9.795 8.205 11.385.6.105.825-.255.825-.57 0-.285-.015-1.23-.015-2.235-3.015.555-3.795-.735-4.035-1.41-.135-.345-.72-1.41-1.23-1.695-.42-.225-1.02-.78-.015-.795.945-.015 1.62.87 1.845 1.23 1.08 1.815 2.805 1.305 3.495.99.105-.78.42-1.305.765-1.605-2.67-.3-5.46-1.335-5.46-5.925 0-1.305.465-2.385 1.23-3.225-.12-.3-.54-1.53.12-3.18 0 0 1.005-.315 3.3 1.23.96-.27 1.98-.405 3-.405s2.04.135 3 .405c2.295-1.56 3.3-1.23 3.3-1.23.66 1.65.24 2.88.12 3.18.765.84 1.23 1.905 1.23 3.225 0 4.605-2.805 5.625-5.475 5.925.435.375.81 1.095.81 2.22 0 1.605-.015 2.895-.015 3.3 0 .315.225.69.825.57A12.02 12.02 0 0024 12c0-6.63-5.37-12-12-12z"/></svg> Report an issue</a>
319
+ </div>
320
+ </body>
321
+ </html>