Merge email accounts into beta

Signed-off-by: Tiberiu Socaci <tsocaci@makeitfuture.com>

Author: tbiyss

CHANGELOG.md

@@ -18,6 +18,18 @@ product overview.
 
 ## Unreleased
 
+- **Email accounts.** Connect an ordinary mailbox — IMAP for reading, SMTP for sending — to a
+  conversation or to yourself by entering its server settings once on one form: in the admin UI
+  (the conversation's Connections, or a person under Users), in Slack's ⚙️ Settings (MCP page for
+  the conversation's, You page for your own), in Teams' Settings → MCPs, or through Google Chat's
+  private settings form. Both logins are tested before the account is saved, passwords are
+  write-only everywhere, and the mail clients run in the gateway, so a channel container never
+  holds a mailbox password. The agent reads, searches, files, downloads attachments from and
+  sends with the account through new `gateway` tools (`list_email_accounts`, `email_search`,
+  `email_read`, `email_download_attachment`, `email_move`, `email_set_flag`, `email_send`);
+  personal accounts exist only in their owner's turns. Gmail, Outlook and other Composio apps stay
+  on Composio. Adds the `nodemailer` and `imapflow` dependencies.
+
 - Price GPT-6.1 Sol at its September 29 Standard rates, including per-request long-context
   multipliers. Preserve pre-July 30 GPT-5.6 Terra/Luna rates during historical previews and
   refreshes. Defer this pricing basis's automatic historical refresh until an audited,

FEATURES.md

@@ -415,6 +415,59 @@ control-plane status.
   `--strict-mcp-config`, Codex `--ignore-user-config`).
   → TEST-PLAN: Custom MCP connections.
 
+## Email accounts (IMAP + SMTP, per person and per conversation)
+
+- A mailbox is connected **once, on one form** — name, address, optional display name, IMAP
+  server/port/user/password, SMTP server/port/user/password — to a conversation (channel scope,
+  shared by everyone who talks there) or to one person (personal scope, usable only in runs they
+  author). Each scope holds at most five. Ports default to 993 (IMAP) and 587 (SMTP); security is
+  derived from the port (993/465 implicit TLS, anything else a **mandatory** STARTTLS upgrade —
+  there is no cleartext option). Blank SMTP user/password reuse the IMAP ones. Rules in
+  `src/gateway/email-accounts.js`, writes in `email-account-store.js`.
+- **Tested before stored.** Every save logs in to the IMAP server and the SMTP server (no message
+  is sent) and refuses the record naming the failing side (`IMAP login failed (host:port): …`).
+  The daemon dials each server through the same public-address check as custom MCP relays, pins
+  the connection to the vetted address and verifies TLS against the configured host name:
+  loopback, private, link-local and metadata destinations are refused at save time and again at
+  every dial. A server that does not upgrade to TLS fails the connection.
+- **Where to connect one.** Admin UI → the conversation → Connections → *Email accounts*, or
+  Users → the person → *Personal email accounts* (`/api/channels/:id/email-accounts/:name`,
+  `/api/users/:id/email-accounts/:name`). In Slack: ⚙️ Settings → **MCP** → *Email accounts*
+  (the conversation's; channel managers and admins) and **You** → *Email accounts* (the viewer's
+  own) as inline forms, with the save acknowledged at once and the connection test allowed up to
+  45 s. In Teams: Settings → **MCPs** → *Email accounts* (channel block and *My connections*). In
+  Google Chat: Settings → *Open private settings* — the private browser form, since a public card
+  cannot take a password. All surfaces call the same store; audit events
+  `channel_email_account_set/_removed` and `user_email_account_set/_removed` carry the name, the
+  address and the server hosts, never a password.
+- **Write-only.** Every listing (`GET /api/channels`, `/api/users`, the per-scope routes, the
+  Slack/Teams/Chat views, the browser form) returns servers, ports, security, user names,
+  `hasPassword` and who/when. There is no reveal path. Saving an existing name with the password
+  boxes empty keeps the stored passwords; a new IMAP password with a shared SMTP password rotates
+  both. Passwords are also pushed into every run's output redactor (`emailSecrets` from
+  `resolveRunIntegrations`), so no reply, stream or job log can echo one.
+- **The agent uses it through gateway tools, in the daemon.** `list_email_accounts`,
+  `email_mailboxes`, `email_search`, `email_read`, `email_download_attachment` (into
+  `uploads/email/<account>/`, ≤ 50 MB, no-follow writes), `email_move`, `email_set_flag` and
+  `email_send` (From is the account's address; attachments are opened through the confined-file
+  opener, 10 files / 25 MB; `in_reply_to` threads; a copy is appended to the `\Sent` mailbox
+  when the server exposes one; refused when the account's *allow sending* is off). ImapFlow and
+  Nodemailer run in the daemon process; a container never holds a mailbox password and the
+  `.claude/settings.json` allowlist pre-approves the tools like every other gateway tool. The
+  memory reviewer's reduced toolset does not get them.
+- **Scope resolution is explicit.** A turn sees the conversation's accounts plus the VERIFIED
+  author's own; the HTTP run API's named author is attribution only and gets the channel scope
+  alone, and another person's turn in the same conversation never sees someone's personal account.
+  `account` takes a name, `personal/<name>`, `channel/<name>` or the address; a bare name present
+  in both scopes is refused until qualified; with exactly one account it may be omitted. The
+  `gateway-usage` guide (`references/email.md`) carries the pronoun rule ("my" = personal, "your /
+  the team's" = channel), the confirm-before-send rule, the shared-thread privacy note and the
+  instruction to send people to Settings instead of asking for a password in chat.
+- **Not a Composio replacement.** Gmail, Outlook and the other apps a Composio account already
+  holds stay on Composio; email accounts cover the mailboxes it does not — custom domains, app
+  passwords, shared inboxes, transactional SMTP relays.
+  → TEST-PLAN: Email accounts.
+
 ## Platform activation emoji settings
 
 - Admin Settings → Agent defaults → **Message activation reactions** has independent Slack,

README.md

@@ -155,6 +155,9 @@ catalog, including edge cases and links to regression coverage.
   agent account. When both have the requested app and the account is ambiguous, the agent asks.
 - **Custom MCP servers:** maintain an admin catalog of granted servers and non-interactive
   credentials; supported transports and optional integrations depend on the engine.
+- **Email accounts:** connect an ordinary mailbox (IMAP + SMTP) to a conversation or to yourself
+  from the admin UI or your chat platform's settings; the agent reads, files and sends with it
+  through gateway tools while the passwords stay in the gateway, never in a container.
 - **Enterprise SDK provisioning (Beta):** an organization Composio SDK key provisions separate
   Slack user/channel identities and reusable thread sessions. Standard MCP mode remains available
   without Enterprise entitlement.

TEST-PLAN.md

@@ -1,5 +1,74 @@
 # ChannelGate — Test Plan
 
+## Email accounts (2026-10-22)
+
+### Regression
+- [x] Automated: `node --test test/email-accounts.test.js`.
+  - One-form rules: port defaults, security by port, SMTP credentials falling back to IMAP's,
+    name/address/port/user validation, loopback/private/link-local/metadata hosts refused by
+    name and literal.
+  - Updates: blank passwords keep the stored ones, a rotated IMAP password follows into a shared
+    SMTP password and leaves a distinct one alone. Upsert by name, the five-entry cap, remove.
+    The masked list and `emailAccountSecrets` never disagree; malformed rows are dropped.
+  - Run resolution: channel accounts always, personal accounts only for a trusted principal;
+    `selectEmailAccount` with bare names, `personal/` / `channel/` / `my/` prefixes, addresses,
+    the single-account default and the cross-scope name clash.
+  - Store: the connection test receives the MERGED record (stored passwords on an update), a
+    failing test stores nothing, the interactive `authorize` re-check runs after it, audit rows
+    carry no password; personal accounts on the user record.
+  - Tools (fake mail client): every tool registered and in `GATEWAY_TOOL_NAMES`; the verified
+    author sees channel + own, an untrusted principal and another person do not see the personal
+    account; search/read/move/flag pass the chosen account through and render compactly;
+    attachment downloads land under `uploads/email/<account>/` with a sanitized name; `email_send`
+    attaches only confined files (a symlink out of the folder and a `../` path are refused) and
+    refuses an account with sending off before any client call.
+  - `resolveRunIntegrations` returns every channel and personal password as `emailSecrets`, and no
+    personal password for an untrusted principal.
+  - Admin routes: channel and user PUT/GET/DELETE, the failing-login 400 without the password,
+    the loopback refusal, `GET /api/channels` and `/api/users` listings without a password.
+- [x] Automated: `node --test test/slack-email-account-settings.test.js` — the Slack Settings
+  inline forms (`em-add:<scope>`, `em:<scope>:<name>`), the MCP and You page sections, manager
+  gating, masked rendering, the password-field error mapping.
+- [x] Automated: `node --test test/teams-email-account-settings.test.js
+  test/conversation-settings-email.test.js` — the Teams MCPs page blocks and
+  `settings.email.save/remove`, public-card refusal, the confirm round-trip, the private browser
+  form's save/remove and masked listing.
+- [x] `test/folders-settings.test.js` tracks the new tool module in the permission allowlist;
+  `test/progress-report-availability.test.js` still proves the integration resolver's shape.
+
+### Live gates (Claude AND Codex) — UNEXECUTED
+Fixture: a disposable conversation in Worker mode. A mailbox on a public IMAP/SMTP host you own
+(any provider that issues app passwords, or a test domain on a transactional relay with an IMAP
+inbox). Record the address and the servers; never the password.
+- [ ] Connect (dashboard): admin UI → the conversation → Connections → *Email accounts*: name
+  `qa`, the address, IMAP host/user/password, SMTP host (ports blank). Pass: the hint says both
+  logins were verified, the row shows `qa`, the address, `imap…:993` and `smtp…:587`;
+  `GET /api/channels` contains no password. A wrong password answers "IMAP login failed (…)" and
+  stores nothing. `127.0.0.1` or a private host name as the IMAP server is refused.
+- [ ] Connect (Slack): ⚙️ Settings → **MCP** → *+ Connect email account* as a channel manager
+  (name `qa2`); a non-manager sees the list but no button. ⚙️ Settings → **You** → connect
+  `mine`. Pass: the modal acknowledges at once, the row appears masked, no password in the view
+  payload (`views.update` body) or in Slack history.
+- [ ] Connect (Teams and Google Chat): Teams Settings → MCPs → *Email accounts* save; Google Chat
+  Settings → *Open private settings* → the browser form. Pass: the account appears masked on the
+  card and the page; the Chat card itself has no password input.
+- [ ] Read, Claude then Codex (`codex …` directive): "List my newest 5 emails in qa and read the
+  first one; save its attachment." Pass: `email_search` output, `email_read` with headers and
+  body, `email_download_attachment` saves under `uploads/email/qa/` and the reply names the
+  file with a 📄 button. No password in the reply or the artifact dir (`grep -r <password>`).
+- [ ] Send, both engines: "Send an email from qa to <your address>, subject QA, attaching that
+  file, replying to the message you read." Pass: the agent confirms recipients first (or the
+  prompt gave them), the mail arrives threaded (`In-Reply-To` set), with the attachment, From the
+  account's address and display name; a copy sits in the Sent folder where the server has one;
+  the reply names the account used. With *allow sending* off, the tool refuses and the agent
+  reports it without trying another account.
+- [ ] Scope: the personal account `mine` is used by its owner's turn, absent from another approved
+  user's turn in the same conversation and from a `POST /api/runs` turn; a bare name present in
+  both scopes makes the agent ask which one. Lean mode does not hide the tools (they are gateway
+  tools) but the memory reviewer's run has none.
+- [ ] Rotation and removal: change the IMAP password with the SMTP box blank (shared password) —
+  the next send still works; remove the account — the next turn reports it absent.
+
 ## Registered inventory caps and Enterprise harness approvals (2026-10-22)
 
 - [x] Automated `test/license-registration.test.js`: signed Registered and no-key fixtures admit

documentation/src/content/docs/controls/accounts-and-secrets.md

@@ -138,6 +138,24 @@ Approve an exact host for a hidden secret awaiting destination approval.
 
 **Restrictions:** Model API hosts are refused. Does not enable arbitrary network access or override known destination restrictions. Useful when a background job/SSH request posted no approval card.
 
+## Email account tools
+
+An email account is a mailbox's IMAP and SMTP settings entered once on one form — in the admin UI (a conversation's Connections, or a person under Users), in Slack's ⚙️ Settings (the **MCP** page for the conversation's account, the **You** page for your own), in Teams' Settings → MCPs, or through Google Chat's private settings form. Both logins are tested before the account is stored, passwords are write-only, and the mail clients run in the gateway. There is no tool that connects an account: a password typed into chat would stay in the conversation's history.
+
+| Tool | Purpose |
+| --- | --- |
+| `list_email_accounts` | The accounts this turn may use: the conversation's (`channel/<name>`) and the requester's own (`personal/<name>`), with address and whether sending is enabled. |
+| `email_mailboxes` | Folders and their roles. |
+| `email_search` | Newest-first listing with `query`, `from`, `to`, `subject`, `since`, `before`, `unseen`, `flagged` and `limit` (≤ 50). |
+| `email_read` | One message by uid: headers, text body (HTML converted), attachments with part ids. |
+| `email_download_attachment` | Saves one attachment under `uploads/email/<account>/` in the working folder (≤ 50 MB). |
+| `email_move` / `email_set_flag` | File a message elsewhere; mark seen, unseen, flagged, unflagged or answered. |
+| `email_send` | Send as the account, with attachments from the working folder (10 files, 25 MB total) and `in_reply_to` threading; a copy goes to the Sent folder when the server has one. |
+
+**Authority and scope:** channel accounts are usable by anyone authorized in the conversation; personal accounts exist only in runs their owner authored — never in another person's turn, a scheduled run or an HTTP run-API turn. `account` takes a name, `personal/<name>`, `channel/<name>` or the address, and a bare name present in both scopes is refused until qualified.
+
+**Restrictions:** sending is refused on an account whose *allow sending* is off. Replies, streams and job output are redacted of every stored password.
+
 ## Related guides
 
 [Accounts](/docs/features/connected-accounts), [environment configuration](/docs/configuration/environment-variables), [secrets](/docs/features/secrets), [Composio SDK](/docs/features/composio-sdk), and [Toolbox/Make](/docs/features/toolbox-and-make).