@agenticmail/enterprise 0.5.320 → 0.5.322

package/CHANGELOG.md

@@ -0,0 +1,68 @@
+# Changelog
+
+All notable changes to AgenticMail Enterprise are documented here.
+
+## [0.5.320] - 2026-03-05
+
+### Added
+- **Microsoft 365 Integration** — 97 tools across 13 services (Outlook Mail, Calendar, OneDrive, Teams, Excel, SharePoint, OneNote, To Do, Contacts, PowerPoint, Planner, Power BI)
+- **Microsoft Graph API helper** — Retry with backoff, rate-limit handling, auto-pagination, JSON batching
+- **Microsoft system prompts** — 12 structured prompt files mirroring Google tools pattern
+- **Task pipeline redesign** — Table/list view with status tabs, search, pagination, real-time updates via webhook
+- **Client organization data isolation** — Org-bound users see only their organization's data
+- **Visible roles configuration** — Parent org controls which roles client org users can see
+- **Cross-platform dependency manager** — macOS, Linux, Windows support with policy-driven installation
+- **Org-wide dependency policy** — Configurable from Settings > Security tab
+- **PM2 production persistence** — ecosystem.config.cjs, LaunchAgent, log rotation
+- **LOG_LEVEL env var** — Production log noise suppression
+- **Port validation** — Checks availability before local agent deployment
+- **Screen unlock** — Agents can auto-unlock machine screen
+- **Per-section editing** — Independent edit buttons on Security and Permissions tabs
+- **Dynamic sidebar company name** — Updates in real-time from settings
+- **Tiered tool loading** — ~75% tool count reduction for messaging channels
+
+### Fixed
+- DB connection pool exhaustion (MaxClientsInSessionMode)
+- Smart DB URL auto-configuration for Supabase/Neon
+- Stop-impersonation logging user out
+- Client org skills/roles showing all data during impersonation
+- Agent UUID display in compliance reports
+
+## [0.5.315] - 2026-03-03
+
+### Added
+- Client organization data isolation across all dashboard pages
+- `allowed_roles` JSONB column for role visibility control
+- Impersonation token refresh preserving org restrictions
+
+## [0.5.313] - 2026-03-01
+
+### Added
+- Smart DB URL auto-configuration (Supabase/Neon detection)
+- 7 enterprise DLP rule packs (53 rules)
+- SOC 2 Type II compliance reports with HTML export
+- Comprehensive README rewrite
+
+### Fixed
+- DB connection pool exhaustion
+- Compliance report generation crashes
+
+## [0.5.312] - 2026-02-28
+
+### Added
+- Transport encryption (AES-256-GCM)
+- Org switchers across all dashboard pages
+- DLP rule editing, enable/disable toggle, detail modal
+- Journal action detail modal
+
+### Fixed
+- Double encryption with Hono wildcard middleware
+- Engine sub-app body forwarding
+- Org switching not reloading data
+- Knowledge base auto-assign persistence
+- Workforce/guardrails/audit org filtering
+
+[0.5.320]: https://github.com/agenticmail/enterprise/releases/tag/v0.5.320
+[0.5.315]: https://github.com/agenticmail/enterprise/releases/tag/v0.5.315
+[0.5.313]: https://github.com/agenticmail/enterprise/releases/tag/v0.5.313
+[0.5.312]: https://github.com/agenticmail/enterprise/releases/tag/v0.5.312

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,31 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior:
+
+* The use of sexualized language or imagery, and sexual attention or advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to **conduct@agenticmail.io**. All complaints will be reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

package/SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.5.x   | :white_check_mark: |
+| < 0.5   | :x:                |
+
+## Reporting a Vulnerability
+
+**Do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report them via email to **security@agenticmail.io**.
+
+You should receive an acknowledgment within 48 hours. We will send a detailed response within 7 days indicating next steps.
+
+Please include:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Impact assessment
+- Any suggested fixes (optional)
+
+## Security Measures
+
+AgenticMail Enterprise implements multiple layers of security:
+
+- **Transport Encryption** — AES-256-GCM encryption for all API traffic
+- **Data Loss Prevention (DLP)** — Real-time content scanning with 53 built-in rules across 7 categories
+- **Role-Based Access Control (RBAC)** — Granular permissions with preset profiles
+- **Multi-Tenant Isolation** — Client organization data isolation across all endpoints
+- **Audit Logging** — Comprehensive action journal with org-scoped filtering
+- **SOC 2 Type II Compliance** — Automated reporting across all 9 Common Criteria (CC1-CC9)
+- **OAuth 2.0 / SAML / OIDC** — Enterprise SSO with provider-based tool auto-detection
+- **Rate Limiting** — Configurable per-endpoint and per-agent limits
+- **CORS / Security Headers** — Strict origin validation and security header enforcement
+- **Outbound Guard** — PII and credential scanning on all outgoing communications
+
+## Disclosure Policy
+
+We follow responsible disclosure. Security issues are patched in private and released as part of the next version. Critical vulnerabilities may receive out-of-band patches.