@rubytech/create-sitedesk-code 0.1.340

package/payload/platform/plugins/email/mcp/dist/tools/email-setup.js

@@ -0,0 +1,202 @@
+import { spawnSync } from "node:child_process";
+import { writeConfig, writePassword, removeConfig, checkAddressBinding, writeBindingConfig, } from "../lib/credentials.js";
+import { describeProvider } from "../lib/providers.js";
+import * as imap from "../lib/imap.js";
+import * as smtp from "../lib/smtp.js";
+import { newProbeToken } from "../lib/setup-probe.js";
+/**
+ * Task 432 — operator-initiated ingestion replaces the background poll.
+ * Strips any pre-existing email-fetch crontab line written by an older
+ * setup so previously-configured installs stop auto-polling on next
+ * email-setup. Returns true when a stale line was removed.
+ */
+function stripStaleEmailFetchCron() {
+    try {
+        const listResult = spawnSync("crontab", ["-l"], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        if (listResult.status !== 0)
+            return false;
+        const existing = listResult.stdout ?? "";
+        if (!existing.includes("email-fetch"))
+            return false;
+        const cleaned = existing
+            .split("\n")
+            .filter((line) => !line.includes("email-fetch"))
+            .join("\n");
+        const writeResult = spawnSync("crontab", ["-"], {
+            input: cleaned.endsWith("\n") ? cleaned : `${cleaned}\n`,
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return writeResult.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function emailSetup(params) {
+    const { email, password, accountId } = params;
+    // Setup-probe lifeline: one token correlates every line this call emits,
+    // including the acquired/released census inside the probe helpers. A
+    // lifeline that stops mid-sequence names the failing step.
+    const token = newProbeToken();
+    process.stderr.write(`[email] setup-probe op=request token=${token} domain=${email.split("@")[1] ?? "unknown"}\n`);
+    const logResult = (outcome) => process.stderr.write(`[email] setup-probe op=result token=${token} outcome=${outcome}\n`);
+    // Resolve the provider once (static map → MX fallback). This runs regardless
+    // of supplied hosts, because a Microsoft address must be refused even when the
+    // operator hand-enters office365 hosts: the email-plugin IMAP path is dead
+    // (Basic auth retired; M365 app passwords ended 1 March 2026). Microsoft mail
+    // connects through the outlook Graph plugin, not email-setup.
+    const info = await describeProvider(email);
+    if (info.status === "redirect") {
+        process.stderr.write(`[email] setup-redirect domain=${info.domain} target=${info.plugin} reason=ms-basic-auth-retired\n`);
+        logResult("fail");
+        return {
+            success: false,
+            message: `${email} is a Microsoft (Outlook.com / Microsoft 365) address. ${info.reason} Do not retry email-setup for this address — run ${info.registerTool} on the ${info.plugin} plugin to connect it.`,
+        };
+    }
+    // Use inferred host defaults only when a host is actually missing. When the
+    // operator supplies both hosts, the inferred fields are discarded below by the
+    // `??` chain and the domain-derived note could describe a different provider
+    // than the hosts in use, so both are skipped. The describeProvider call above
+    // is the single resolution; notes come from the same result.
+    const needsInference = !params.imapHost || !params.smtpHost;
+    const provider = needsInference && info.status === "known" ? info.defaults : null;
+    const providerNotes = needsInference && info.status === "known" ? info.notes : undefined;
+    const agentAddress = params.agentAddress?.trim() || email;
+    const config = {
+        email,
+        agentAddress,
+        imapHost: params.imapHost ?? provider?.imapHost ?? "",
+        imapPort: params.imapPort ?? provider?.imapPort ?? 993,
+        imapSecurity: params.imapSecurity ?? provider?.imapSecurity ?? "tls",
+        smtpHost: params.smtpHost ?? provider?.smtpHost ?? "",
+        smtpPort: params.smtpPort ?? provider?.smtpPort ?? 587,
+        smtpSecurity: params.smtpSecurity ?? provider?.smtpSecurity ?? "starttls",
+    };
+    // Reject if hosts are still empty (unknown provider, user didn't provide)
+    if (!config.imapHost) {
+        logResult("fail");
+        return {
+            success: false,
+            message: `Cannot infer IMAP host for ${email}. Provide imapHost and smtpHost explicitly.`,
+            providerNotes,
+        };
+    }
+    if (!config.smtpHost) {
+        logResult("fail");
+        return {
+            success: false,
+            message: `Cannot infer SMTP host for ${email}. Provide smtpHost explicitly.`,
+            providerNotes,
+        };
+    }
+    // Validate 1:1 agent-email binding: each address maps to exactly one agent
+    const agentSlug = params.agentSlug ?? "admin";
+    const conflicting = await checkAddressBinding(agentAddress, agentSlug);
+    if (conflicting) {
+        logResult("fail");
+        return {
+            success: false,
+            message: `Email address ${agentAddress} is already bound to agent "${conflicting}". Each email address can only be used by one agent.`,
+        };
+    }
+    // Warn about likely misconfigured port/security combinations
+    if (config.imapPort === 993 && config.imapSecurity === "starttls") {
+        logResult("fail");
+        return {
+            success: false,
+            message: "Port 993 uses implicit TLS, not STARTTLS. Use imapSecurity: 'tls' with port 993, or port 143 with 'starttls'.",
+        };
+    }
+    if (config.smtpPort === 465 && config.smtpSecurity === "starttls") {
+        logResult("fail");
+        return {
+            success: false,
+            message: "Port 465 uses implicit TLS, not STARTTLS. Use smtpSecurity: 'tls' with port 465, or port 587 with 'starttls'.",
+        };
+    }
+    // Test IMAP connectivity
+    const tImap = Date.now();
+    const imapError = await imap.testConnection(config, password, token);
+    process.stderr.write(`[email] setup-probe op=probe-imap token=${token} ms=${Date.now() - tImap}\n`);
+    if (imapError) {
+        logResult("fail");
+        return { success: false, message: imapError, providerNotes };
+    }
+    // Test SMTP connectivity
+    const tSmtp = Date.now();
+    const smtpError = await smtp.testConnection(config, password, token);
+    process.stderr.write(`[email] setup-probe op=probe-smtp token=${token} ms=${Date.now() - tSmtp}\n`);
+    if (smtpError) {
+        logResult("fail");
+        return { success: false, message: smtpError, providerNotes };
+    }
+    // Both tests passed — persist credentials
+    // Write graph node first (easier to clean up), then password file
+    try {
+        await writeConfig(accountId, config);
+    }
+    catch (err) {
+        logResult("fail");
+        return {
+            success: false,
+            message: `IMAP and SMTP connections verified, but failed to store config: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    try {
+        writePassword(password);
+    }
+    catch (err) {
+        // Rollback graph node — best effort, don't mask the original error
+        try {
+            await removeConfig(accountId);
+        }
+        catch { /* rollback failed — next setup will MERGE over it */ }
+        logResult("fail");
+        return {
+            success: false,
+            message: `IMAP and SMTP connections verified, but failed to store password file: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    // Set agent binding and poll config
+    let bindingOk = true;
+    try {
+        await writeBindingConfig(accountId, agentSlug, params.pollIntervalMinutes ?? 5);
+    }
+    catch {
+        bindingOk = false;
+    }
+    // Task 432 — background polling retired. Strip any stale email-fetch
+    // crontab line from an earlier setup so previously-configured installs
+    // stop auto-polling. Operator now drives ingestion via the email-ingest
+    // skill (email-fetch + email-ingest tools).
+    const cronStripped = stripStaleEmailFetchCron();
+    // Get inbox count as a confirmation signal
+    let inboxCount;
+    try {
+        inboxCount = await imap.getInboxCount(config, password, token);
+    }
+    catch {
+        // Non-fatal — setup still succeeded
+    }
+    const aliasNote = agentAddress !== email ? ` Agent address: ${agentAddress} (auth: ${email}).` : "";
+    const bindingNote = bindingOk
+        ? ` Bound to agent ${agentSlug}.`
+        : ` Email configured but agent binding could not be set — run email-setup again.`;
+    const ingestNote = ` Ingestion is operator-initiated: ask the agent to "check my emails" to review and decide on new messages.`;
+    const cronNote = cronStripped
+        ? ` Removed a stale background-fetch crontab line from an earlier setup.`
+        : "";
+    logResult("ok");
+    return {
+        success: true,
+        message: `Email configured successfully for ${email}.${aliasNote} IMAP and SMTP connections verified.${inboxCount !== undefined ? ` Inbox has ${inboxCount} messages.` : ""}${bindingNote}${ingestNote}${cronNote}`,
+        inboxCount,
+        providerNotes,
+    };
+}
+//# sourceMappingURL=email-setup.js.map

package/payload/platform/plugins/email/mcp/dist/tools/email-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-setup.js","sourceRoot":"","sources":["../../src/tools/email-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EACL,WAAW,EAAE,aAAa,EAAE,YAAY,EACxC,mBAAmB,EAAE,kBAAkB,GACxC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,wBAAwB;IAC/B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE;YAC9C,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpD,MAAM,OAAO,GAAG,QAAQ;aACrB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE;YAC9C,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI;YACxD,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAmB;IAMlD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE9C,yEAAyE;IACzE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,KAAK,WAAW,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC;IACnH,MAAM,SAAS,GAAG,CAAC,OAAsB,EAAE,EAAE,CAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,KAAK,YAAY,OAAO,IAAI,CAAC,CAAC;IAE5F,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,MAAM,iCAAiC,CACpG,CAAC;QACF,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,GAAG,KAAK,0DAA0D,IAAI,CAAC,MAAM,oDAAoD,IAAI,CAAC,YAAY,WAAW,IAAI,CAAC,MAAM,wBAAwB;SAC1M,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAG,cAAc,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,aAAa,GAAG,cAAc,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAE1D,MAAM,MAAM,GAAgB;QAC1B,KAAK;QACL,YAAY;QACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,EAAE;QACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,GAAG;QACtD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ,EAAE,YAAY,IAAI,KAAK;QACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,EAAE;QACrD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,GAAG;QACtD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ,EAAE,YAAY,IAAI,UAAU;KAC1E,CAAC;IAEF,0EAA0E;IAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,8BAA8B,KAAK,6CAA6C;YACzF,aAAa;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,8BAA8B,KAAK,gCAAgC;YAC5E,aAAa;SACd,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,iBAAiB,YAAY,+BAA+B,WAAW,sDAAsD;SACvI,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAClE,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,+GAA+G;SACzH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAClE,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,+GAA+G;SACzH,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;IACpG,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAC/D,CAAC;IAED,yBAAyB;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,KAAK,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;IACpG,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAC/D,CAAC;IAED,0CAA0C;IAC1C,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,mEAAmE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC/H,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,IAAI,CAAC;YAAC,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qDAAqD,CAAC,CAAC;QACtG,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,0EAA0E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACtI,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,YAAY,GAAG,wBAAwB,EAAE,CAAC;IAEhD,2CAA2C;IAC3C,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,YAAY,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,WAAW,GAAG,SAAS;QAC3B,CAAC,CAAC,mBAAmB,SAAS,GAAG;QACjC,CAAC,CAAC,+EAA+E,CAAC;IACpF,MAAM,UAAU,GAAG,4GAA4G,CAAC;IAChI,MAAM,QAAQ,GAAG,YAAY;QAC3B,CAAC,CAAC,uEAAuE;QACzE,CAAC,CAAC,EAAE,CAAC;IACP,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,qCAAqC,KAAK,IAAI,SAAS,uCAAuC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,UAAU,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,EAAE;QACnN,UAAU;QACV,aAAa;KACd,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/email/mcp/dist/tools/email-status.d.ts

@@ -0,0 +1,6 @@
+interface StatusParams {
+    accountId: string;
+}
+export declare function emailStatus(params: StatusParams): Promise<string>;
+export {};
+//# sourceMappingURL=email-status.d.ts.map

package/payload/platform/plugins/email/mcp/dist/tools/email-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-status.d.ts","sourceRoot":"","sources":["../../src/tools/email-status.ts"],"names":[],"mappings":"AAIA,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA4CvE"}

package/payload/platform/plugins/email/mcp/dist/tools/email-status.js

@@ -0,0 +1,43 @@
+import { readConfig, loadCredentials } from "../lib/credentials.js";
+import * as imap from "../lib/imap.js";
+import * as smtp from "../lib/smtp.js";
+export async function emailStatus(params) {
+    const config = await readConfig(params.accountId);
+    if (!config) {
+        return "Email: not configured. Run email-setup to set up the agent's email account.";
+    }
+    const credResult = await loadCredentials(params.accountId);
+    if ("error" in credResult) {
+        return `Email: ${config.email} — ${credResult.error}`;
+    }
+    const { password } = credResult.credentials;
+    // Test IMAP
+    const imapError = await imap.testConnection(config, password);
+    const imapStatus = imapError ? `FAIL — ${imapError}` : "OK";
+    // Test SMTP
+    const smtpError = await smtp.testConnection(config, password);
+    const smtpStatus = smtpError ? `FAIL — ${smtpError}` : "OK";
+    // Get inbox count if IMAP is healthy
+    let inboxInfo = "";
+    if (!imapError) {
+        try {
+            const count = await imap.getInboxCount(config, password);
+            inboxInfo = `\nInbox: ${count} messages`;
+        }
+        catch {
+            inboxInfo = "\nInbox: could not retrieve count";
+        }
+    }
+    const aliasLine = config.agentAddress !== config.email
+        ? `Agent address: ${config.agentAddress} (auth: ${config.email})`
+        : `Email: ${config.email}`;
+    return [
+        aliasLine,
+        `IMAP: ${config.imapHost}:${config.imapPort} (${config.imapSecurity}) — ${imapStatus}`,
+        `SMTP: ${config.smtpHost}:${config.smtpPort} (${config.smtpSecurity}) — ${smtpStatus}`,
+        inboxInfo,
+    ]
+        .filter(Boolean)
+        .join("\n");
+}
+//# sourceMappingURL=email-status.js.map

package/payload/platform/plugins/email/mcp/dist/tools/email-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-status.js","sourceRoot":"","sources":["../../src/tools/email-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,gBAAgB,CAAC;AAMvC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAoB;IACpD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,6EAA6E,CAAC;IACvF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QAC1B,OAAO,UAAU,MAAM,CAAC,KAAK,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC;IAE5C,YAAY;IACZ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5D,YAAY;IACZ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5D,qCAAqC;IACrC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACzD,SAAS,GAAG,YAAY,KAAK,WAAW,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,mCAAmC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,KAAK;QACpD,CAAC,CAAC,kBAAkB,MAAM,CAAC,YAAY,WAAW,MAAM,CAAC,KAAK,GAAG;QACjE,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,EAAE,CAAC;IAE7B,OAAO;QACL,SAAS;QACT,SAAS,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,OAAO,UAAU,EAAE;QACtF,SAAS,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,OAAO,UAAU,EAAE;QACtF,SAAS;KACV;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/payload/platform/plugins/email/mcp/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@maxy/email",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "imapflow": "^1.0.171",
+    "neo4j-driver": "^5.28.1",
+    "nodemailer": "^6.10.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/nodemailer": "^6.4.17",
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.7"
+  }
+}

package/payload/platform/plugins/email/mcp/vitest.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["src/**/__tests__/**/*.test.ts"],
+    testTimeout: 10_000,
+  },
+});

package/payload/platform/plugins/email/references/email-reference.md

@@ -0,0 +1,181 @@
+# Email Reference
+
+Full reference for the email plugin. Load with `plugin-read` when detailed configuration or behaviour reference is needed.
+
+## Setup
+
+Setup is two steps in plain chat, in this order. **Do the provider lookup before asking for any password** — most providers reject the normal login password and require a credential the operator has to mint in the provider's own settings, so asking for "the password" first sends them down a path that cannot work.
+
+**Step 1 — look up the provider.** As soon as you have the email address, call `email-provider-info` with it. The tool returns one of four outcomes:
+
+- **Known provider** — it gives the IMAP/SMTP hosts (already inferred, no need to ask) and the provider's specific requirement: an app-specific password, a trusted-device/IMAP toggle, enabling IMAP on a paid plan, etc. Relay that requirement to the operator and wait for them to create the credential in their provider's settings. Name the provider and the step it needs — that is the whole point of this tool.
+- **Microsoft (redirect)** — an Outlook.com / Hotmail / Live / Microsoft 365 address (consumer domains, or a custom domain whose MX is Microsoft). The email plugin's IMAP path for Microsoft is dead — Microsoft retired Basic auth for Exchange Online and M365 app passwords stopped working on 1 March 2026 — so the tool does **not** return hosts. Do not call `email-setup`. Connect the account through the `outlook` Graph plugin instead: run `outlook-account-register`. See § Microsoft / Microsoft 365 below.
+- **Unsupported provider** — some providers (e.g. Tuta/Tutanota) deliberately offer no IMAP/SMTP at all. The tool says so; tell the operator this account cannot be connected here, and stop.
+- **Unknown provider** — no host mapping. Ask the operator for the IMAP host/port and SMTP host/port (their provider's "mail client" / "IMAP/SMTP" help page lists these) along with the password.
+
+**Step 2 — collect the credential and connect.** Once the operator has the right password (the app-specific one for known providers, or the account password where no app step is required), call `email-setup`. For a known provider, pass only `password` (and `agentAddress` if it differs) — the hosts are inferred. For an unknown provider, pass the hosts the operator gave you as well.
+
+`email-setup` accepts these fields:
+
+| name | required | notes |
+|------|----------|-------|
+| `email` | yes | the address being set up |
+| `password` | yes | the app-specific password where the provider requires one, otherwise the account password |
+| `imapHost` / `imapPort` / `imapSecurity` | only for unknown providers | inferred for known providers |
+| `smtpHost` / `smtpPort` / `smtpSecurity` | only for unknown providers | inferred for known providers |
+| `agentAddress` | no | for catchall/alias setups where the auth email differs from the address the agent operates as; leave empty when they're the same |
+
+On success, confirm "credentials stored" and the inbox count. On failure, relay the diagnostic — the tool returns specific guidance (wrong password, connection refused, TLS mismatch); an authentication failure on a known provider usually means the operator used the login password instead of the app-specific one.
+
+The agent never displays stored passwords.
+
+### Google / Google Workspace
+
+`email-provider-info` returns the gmail hosts for a Google address by either path: the `gmail.com` / `googlemail.com` static entry, or — for a Google Workspace custom domain (e.g. `name@company.co.uk` whose mail is hosted by Google) — MX detection. A Workspace custom domain is no longer `unknown`: the tool resolves its MX records, sees Google as the mail host, and returns `imap.gmail.com` / `smtp.gmail.com`. There is no host guessing.
+
+For any Google address, **require an app password — never the regular account password.** Google retired regular-password (basic auth) sign-in in May 2025, so the login password cannot work for IMAP/SMTP. Walk the operator through generating one: Google Account → Security → turn on 2-Step Verification (required first) → App passwords → Mail → generate. Paste that 16-character value as `password` to `email-setup`. Do not ask for the normal password at any point.
+
+For a Workspace custom domain there is one extra dependency: the Workspace admin must allow app passwords (Admin console → Security). If the app password is rejected at `email-setup` — an authentication failure with an app password supplied — the tenant has app passwords disabled, and the account needs OAuth instead (not yet shipped). Relay that to the operator rather than retrying the password.
+
+### Microsoft / Microsoft 365
+
+Microsoft mail does not go through the email plugin. Microsoft retired Basic authentication for Exchange Online IMAP/POP, and Microsoft 365 app passwords stopped working on 1 March 2026, so there is no IMAP path left — for consumer Outlook.com / Hotmail / Live / MSN addresses or for a custom domain whose mail is hosted by Microsoft 365 (MX records ending in `mail.protection.outlook.com`).
+
+`email-provider-info` recognises both — the static consumer domains, and a custom M365 domain via MX detection — and returns the **redirect** outcome rather than IMAP hosts. `email-setup` likewise refuses a Microsoft address (even if you hand it `outlook.office365.com` hosts) and points back here; it never attempts a connection.
+
+Connect the account through the **`outlook` Graph plugin** instead: run `outlook-account-register`. That plugin authorises over OAuth — it opens a Microsoft sign-in for the operator (in the headless browser) and stores the token; there is no password or app password to ask for. After registration, Microsoft mail is read with the `outlook-mail-list` / `outlook-mail-search` tools, not `email-read` / `email-search`.
+
+## Reading and Searching
+
+`email-read` and `email-search` return message metadata only: UID, sender, subject, and date. Body content is not included — present results as a message list without commenting on missing bodies.
+
+### Pagination
+
+Both tools return up to 50 messages per request (default 20). When more messages exist beyond the returned set, the response includes a `next_before_uid` value. Pass this value as the `before_uid` parameter on the next call to retrieve the next page of older messages. When `next_before_uid` is absent, all matching messages have been returned.
+
+### Folders
+
+Both tools accept a `folder` parameter: `"inbox"` (default) or `"sent"`. The Sent folder is discovered automatically via the IMAP server's special-use flags — no folder name guessing required.
+
+### Filtering
+
+Both tools support filtering by:
+- `sender` — sender address or domain
+- `to` — recipient address
+- `since` / `before` — ISO date range
+- `email-read` additionally supports `subjectPattern` (regex)
+- `email-search` additionally supports `subject` (text) and `body` (keyword)
+
+## Replying
+
+`email-reply` sends a reply to an existing email, threaded correctly in the recipient's mail client.
+
+The tool accepts the `messageId` of the email being replied to (visible in `email-read` output as the `Message-ID` field). It looks up the original email in the graph, sets `In-Reply-To` and `References` headers, derives the recipient from the original sender, and prepends `Re:` to the subject (stripping duplicate prefixes).
+
+- **Reply to sender:** Default behaviour — replies to the original sender only.
+- **Reply all:** Set `replyAll: true` to include all original recipients (TO + CC). The agent's own address is automatically excluded from the recipient list.
+- **Add CC/BCC:** Pass `cc` and/or `bcc` (each an array of email addresses) to copy or blind-copy recipients on the reply. These are added in addition to whatever `replyAll` places in the TO line — they are independent of the reply-list derivation and are passed through exactly as given (an address that is also in TO is not de-duplicated). CC is visible in the header; BCC is hidden from all headers.
+- **Threading:** The reply appears in the same conversation thread in Gmail, Apple Mail, Outlook, and other RFC 2822-compliant clients.
+- **Prerequisite:** The original email must exist in the graph (ingested via the operator-initiated `email-ingest` flow). If the message hasn't been ingested yet, the tool returns a clear error.
+
+Use `email-reply` when responding to a received email. Use `email-send` for new outbound messages.
+
+## CC and BCC
+
+Both `email-send` and `email-reply` accept optional `cc` and `bcc` fields. Each is an array of email addresses (one element or many); every address is validated individually. CC recipients appear in the message header and are visible to all recipients. BCC recipients receive the message but do not appear in any header — the other recipients cannot see them. Omitting both sends exactly as before, with no CC/BCC headers. The success message names the CC recipients so the operator can confirm the copy went out, and reports the BCC count without naming them, preserving the blind semantics.
+
+## Attachments
+
+Both `email-send` and `email-reply` accept an optional `attachments` array of absolute file paths. Each path must point to a regular file inside the account directory and be 25 MB or smaller; the path is validated before the message is sent, so an invalid, missing, oversized, or out-of-account path fails the call with a clear error and no email dispatched. Validated files ride the message as real SMTP attachments, and the success message names each attached file.
+
+## Alias Support
+
+When `agentAddress` is set and differs from the auth email:
+
+- **Sending:** emails are sent with the agent address as the From header. SMTP authentication still uses the auth email.
+- **Reading/searching/fetching:** emails whose **To or Cc** header contains **either the login (auth email) or the agent address** are returned. `email-read`, `email-search`, and `email-fetch` apply the same `{login, alias}` recipient set, inspecting both To and Cc, so a reply that arrives at the login or Cc's the alias is not hidden. Pass an explicit `to=` (read/search) to narrow to one address.
+- **OTP extraction:** OTPs addressed (To or Cc) to the login or the agent address are found.
+- **Status:** reports both the agent address and the auth email.
+
+When `agentAddress` is not set or matches the auth email, all tools behave as before — no recipient filter, From header uses the auth email.
+
+## Email Persistence
+
+Emails enter the graph as `:ConversationArchive {source:'email'}` thread archives (with `:Section` chunks bounded by gap-hour sessionisation) via the **operator-initiated ingestion flow** (see `skills/email-ingest/SKILL.md`). There is no background poll, cron, or auto-classifier — new messages are written only when the operator says "check my emails" and approves each one.
+
+The two ingestion tools:
+
+- **`email-fetch`** — lists new IMAP messages since the stored high-water mark (`lastFetchedUid` on the `:EmailAccount` node). Returns sender, subject, date, Message-ID, UID, and a body preview. Writes nothing to the graph; stages the batch in-memory for the follow-up `email-ingest` call.
+- **`email-ingest`** — takes a `decisions` array (`messageId` + `ingest` or `discard` per message). Writes only the `ingest` subset to the graph, advances `lastFetchedUid` to the batch's max UID, and consumes the staged batch. Refuses if any pending Message-ID lacks a decision.
+
+Properties of the persistence layer:
+
+- **Operator-initiated only.** No `setInterval`, cron, or systemd timer ever invokes `email-fetch`. The operator drives every cycle.
+- **Deduplication:** Each archive is keyed by `conversationIdentity` (sha256 over `accountId + sortedParticipantElementIds`). Re-ingesting the same thread delta-appends new sections rather than duplicating.
+- **Alias filtering:** Emails whose To or Cc carries the agent's `agentAddress` **or** the login (auth email) are listed by `email-fetch` and ingested. The fetch path uses the same `{login, alias}` recipient set, inspecting To and Cc, as `email-read`/`email-search`; when no distinct alias is configured no recipient filter is applied and every message in the UID window is listed.
+- **Semantic search:** Sections are vector-indexed via `section_embedding`, enabling natural-language search via `email-graph-query` that ranks parent archives by their best-matching section.
+- **Isolation:** Each agent sees only archives whose participants resolve to its own account scope, even when sharing a catchall mailbox.
+
+## Email Threading
+
+Ingested messages are grouped into one `:ConversationArchive {source:'email'}` per thread, with operator-confirmed `:Person`/`:AdminUser` participants attached via `:PARTICIPANT_IN` edges. Thread grouping (`In-Reply-To`/`References` walk to the root Message-ID) happens in the email-plugin dispatcher before the conversation-archive pipeline sees the batch.
+
+- **Out-of-order arrival:** If a reply is ingested before its parent, the dispatcher treats the reply as its own thread root; once the parent arrives the dispatcher re-groups under the older root and the conversation-archive writer delta-appends into the shared archive.
+- **Per-message context:** Per-message envelopes are not stored in the graph. `email-read` and `email-search` surface a best-effort `Archive` / `Archive-Section` hint when the IMAP message's `receivedAt` falls inside a stored section's `firstMessageAt..lastMessageAt` window; this is a UI hint, not a primary key.
+- **Scope:** Thread linkage never crosses account boundaries — every archive carries `accountId` and the writer refuses cross-account participants.
+
+### Agent-Email Binding
+
+Each email address is bound to exactly one agent. Each agent can have at most one email address. This is enforced during `email-setup`:
+
+- The `agentSlug` parameter identifies which agent owns this email address (defaults to `"admin"`)
+- If the address is already bound to a different agent, setup fails with a clear error naming the conflicting agent
+- The binding is on `agentAddress` (the identity the agent presents), not the auth email
+
+### Email Retrieval Paths
+
+Three retrieval paths exist for email data — each scoped to a different purpose:
+
+- **Live inbox** (`email-read`, `email-search`) — queries IMAP directly. Use for checking the inbox, reading recent messages, browsing folders, and real-time inbox state. Requires IMAP connectivity.
+- **Graph list/search** (`email-graph-query`) — queries stored Email nodes in Neo4j. Use for email history, recall, and semantic search ("what emails are in memory?", "find emails about cabbages", "what did Sarah send about the contract?"). Works without IMAP. Supports date/sender/direction filters and natural-language semantic matching.
+- **General knowledge** (`memory-search`) — searches the entire knowledge graph across all node types. Use when the user's question spans all memory, not just emails ("what do you know about contract renewals?").
+
+When the user asks about stored emails, email history, or email recall — use `email-graph-query`. When they ask to check the inbox or read specific recent messages — use the IMAP tools. When the question is broader than emails — use `memory-search`.
+
+## Inbound Email Screening
+
+There is no automated screener. The operator screens by eye during the `email-ingest` skill flow: `email-fetch` lists the new messages with sender, subject, and a body preview; the operator picks which ones to ingest and which to discard. A `screening` property of `clean` is stamped on every operator-approved row as a provenance marker (operator-approved), and discarded messages never enter the graph.
+
+The previous Haiku classifier was removed; the auto-respond binary that depended on it was removed alongside the screener. Both are intentionally absent — the doctrine is that every LLM-bearing pipeline is operator-initiated.
+
+## Security
+
+- Credentials stored as a file with restricted permissions — never in conversation
+- IMAP and SMTP connections require TLS or STARTTLS — plaintext is rejected
+- Only the agent's own dedicated account is accessed — never the user's personal email
+- Email nodes have `scope: "admin"` — never visible to public agents
+- Inbound messages enter the graph only when the operator approves them by eye via `email-ingest`
+
+## Setup-Probe Hardening and Observability
+
+No `email-setup` execution path — success, credential failure, unreachable host, slow host, or a late socket event minutes after the tool returned — may terminate the email MCP server-host process. Containment has two layers, both in `lib/setup-probe.ts`:
+
+- **Per-resource.** Every IMAP client and SMTP transport created by a connection probe (`email-setup`, `email-status`) carries a persistent `'error'` listener for the object's full lifetime, and is closed on every path — including the failure path, where the IMAP client was previously abandoned half-connected. A late socket event is logged and contained instead of crashing the process via Node's unhandled-`'error'` rule.
+- **Process-level last resort.** `uncaughtException`/`unhandledRejection` handlers contain only errors attributable to a probe (stack references `imapflow`/`nodemailer`, or a probe is still open). Any other escaped error preserves the previous behaviour: dump and exit 1. Containment is always logged loudly — it never hides the defect.
+
+Log lines (all on stderr, prefix `[email] setup-probe`, correlated by one per-call `token=`):
+
+- `op=request domain=<d>` → `op=probe-imap ms=<t>` → `op=probe-smtp ms=<t>` → `op=result outcome=<ok|fail>` — the setup lifeline; a lifeline that stops mid-sequence names the failing step.
+- `op=acquired` / `op=released source=<imap|smtp> socketCount=<n>` — the socket census; a count not returning to baseline is the leak signature.
+- `op=late-event source=<imap|smtp|process> err=<msg> contained=true` — a contained late event; on a live box this line is the evidence trail for the crash-mechanism investigation.
+
+Diagnostic path: `grep -E '\[email\] setup-probe' ~/.<brand>/logs/mcp-email-*.log`, cross-referenced with `[mcp-helper] op=exit server=email` in `server.log` for the same window.
+
+## OTP Integration
+
+Other skills call `email-otp-extract` during service authentication (Anthropic OAuth, Cloudflare setup) with:
+- `sender` — expected sender domain
+- `subject_pattern` — optional regex for subject line
+- `timeout` — how long to poll (default 60s)
+
+The tool polls at short intervals, extracts the verification code, and returns it. On timeout, it returns a clear failure so the calling skill can ask the user to check manually.