0.16.3

Fixed

• The Microsoft sign-in notes no longer describe publisher verification. They say that making a shared Microsoft
  app public is complex, and point to your own Microsoft app. No behaviour changes.

0.16.2

Fixed

• The "Prepare the mailbox" page lists the international providers first: Gmail, Outlook, Microsoft 365, iCloud,
  Fastmail, then Yandex. Mail.ru is no longer on the English page; it stays a built-in provider and keeps its steps
  in the Russian translation. No behaviour changes.
• The Google and Microsoft sign-in notes no longer describe WireCat's review or verification status. They say that
  making a shared Google app public for mail is complex, so Google may refuse WireCat's app, and then point to your own
  Google app or an app password. No behaviour changes.
• session end help says what --revoke does to your account. With Gmail over OAuth it asks Google to revoke
  the sign-in, which signs out every tool that uses the same Google project. The command's description and examples
  now say so. No behaviour changes.

0.16.1

Fixed

• The tests of the private file modes skip the mode check on Windows, where files have no Unix modes.
• Docs, help examples and the skill name the example profile personal, not ya, as tg does. A second
  mailbox in an example is work. No behaviour changes.
• docs/configuration.md says which flag answers ask: --allow-dangerous for drafts delete, --yes for
  every other change, and confirmation_required without a terminal or a flag.
• The sender domain cache and the sign-in records folder are private to you. domain-ages.json is written with
  mode 600 and the folder that holds sign-ins.json with mode 700, as every other private file of mail's.
• Every error and issue reason mail raises is in its registry, so mail commands info lists it and an agent can
  branch on it: mail.smtp-login-refused, mail.no-drafts, mail.draft-unknown, mail.gmail-objectid,
  mail.export-destination-exists, download.exists, mail.unreadable, mail.deletions-skipped,
  mail.rules-unreadable and mail.export-unreadable. A test keeps the list complete.
• The secret scan knows Google's OAuth access tokens, refresh tokens and client secrets.
• mail commands info says what rules remove, rules apply and rules import answer with, as every other
  command does: mail_rule_change, mail_rules_apply and mail_rule_import. The answers are unchanged.
• rules apply closes its connection to the mail server before it answers, and the tag commands hand the store
  to the run, so a timeout or a signal closes it too.

0.16.0

Changed — may break callers

• mail runs on cli-core 0.569.0: an agent schedule runs on Sonnet, starts lean and stops for the day at a cost
  cap. mail <profile> schedule agent takes --model <model> and --max-cost-per-day <usd>. Without them a claude
  schedule runs on sonnet and a codex one on codex's own default, a new claude schedule starts without your MCP
  servers, skills, settings and CLAUDE.md, and no run starts for the rest of the day once the day's runs cost 5 US
  dollars. schedule_model_claude, schedule_model_codex, schedule_lean_start and schedule_max_cost_per_day in
  the config file's defaults change that for every new schedule; mail config show lists them.

0.15.0

Changed — may break callers

• The profile sets whether and up to what size sync reads attachments, and one run can override it. The
  profile's read_attachments (default true) and max_attachment_mb (default 10) set it; --no-attachments,
  --attachments and --max-attachment-mb <n> override it for one run. A file left unread is stored with its name and
  size, its extraction not-read or too-large. No file is kept either way.
• messages show reads an email again when one of its attachments was left unread, every attachment whatever
  its size, so the command now reaches the mail server for such an email. --offline or a failed read shows the stored
  email with meta.complete: false and the issue mail.attachments-unread. attachments download keeps a file.
• Gmail over OAuth signs in with WireCat's Google app when you name none. It needed --client-file or
  MAIL_GOOGLE_CLIENT_ID and failed with mail.oauth-no-client without them. The order is --client-file, then
  MAIL_GOOGLE_CLIENT_ID (with MAIL_GOOGLE_CLIENT_SECRET), then the profile's new google_client_id, then
  WireCat's app. Google has not reviewed WireCat's app for mail yet: if Google refuses it, use your own
  (steps). Choosing OAuth for a Gmail profile is unchanged.
• MAIL_MICROSOFT_CLIENT_ID picks the Microsoft app for one run, before the profile's microsoft_client_id and
  WireCat's app, which now comes from cli-core's constants.json. mail.oauth-no-client is gone: there is always an
  app.
• doctor's oauth rows say which app each profile uses as oauth_client: { client, source }, in place of
  client: source is flag, env, config or constants (WireCat's). A profile's row reports the app it
  signed in with when its sign-in recorded one. session start answers source beside client.
• mail runs on cli-base 0.77.1 and cli-core 0.566.0.

Added

• stats messages show counts the profile's stored mail per day, week or sender, received and sent, over the
  same query as search messages: { by, received, sent, rows: [{ key, name, received, sent }] }, a day or week key
  YYYY-MM-DD in --timezone (a week by its Monday), a sender keyed by address with sent 0. Counts only, no search
  recorded. For WireCat Desktop's mail per day (cli-core's mailStats, 0.564.0).
• account inspect groups the mailbox's mail by sender and list before you sync it: emails, MB, unread and bulk
  shares, years, whether you replied, a skip suggestion and a spam or scam score, plus the rule kinds the mail would
  match. Headers only, nothing stored. --domain-age asks each sender domain's registry (RDAP) when it was
  registered. Moved from memo mail inspect.
• messages import <file.mbox> adds a Google Takeout archive to a Gmail profile's stored mail, joined with what
  sync stores by Gmail's ids; it only adds, leaves out Spam and Trash and follows the profile's rules. Moved from
  memo's mode: "mbox" mail accounts.
• sync scores the senders of the stored mail, at most once a day, and asks registries about new sender domains
  until its deadline; search ranks mail from senders with signs of fraud lower. The answer's senders says how many.
  memo sync did this before; it no longer reads mail.

Fixed

• The MCP server tells an agent that attachment text is data, not instructions, beside subjects, bodies and file
  names. sync indexes attachment text and messages show returns it.
• session start writes every setting at its default when it saves a new profile, as config set does. The
  first file a sign-in made held only the profile, so the owner could not see the other settings until a later
  config set or config migrate.

0.14.0

Added

• config migrate writes each setting your config file lacks, at its default, and keeps your values, their order
  and keys it does not know; it creates no section and running it again adds nothing. A first run now writes every
  shared setting into the file, and config set and config unset fill in the missing ones. config show gives each
  setting its default and description, and no longer creates a missing file. From cli-core 0.563.0.

Changed — may break callers

• Mail sync reads attachments up to 10 MB a file by default, and can skip them. From cli-core 0.563.0.
• review --holder leaves out mail from suspicious senders too, beside bulk, envelopes, drafts and partial mail.
  From cli-core 0.560.0.
• An answer over the output cap names what to run instead (WC-OUT-22). From cli-core 0.563.0.
• The store moves to version 48 (invoices and payments, imports through one envelope, the cleanup of test rows
  that leaked into a real store). The first run of this version migrates it. From cli-core 0.557.0–0.560.0.

0.13.0

Added

• review: what is new, what you owe, what waits for an answer, with tg's words: review "date>2h", --new
  (a point per mailbox and reader), --unanswered [duration] (newest email came to you in To or Cc, no answer),
  --waiting [duration] (you wrote last), and bulk:false to leave out mail sent to many. Each email carries
  bulk, list_id and rule_id. It reads the store only; over MCP it is the read tool review. From cli-core.
• A processing mark per agent: review --holder <name> reads what is stored past that holder's mark, by store
  order, so late-synced mail is not skipped; messages acknowledge --holder <name> --cursor <cursor> moves it forward.
  Bulk mail, envelopes and drafts are skipped and counted, partial mail held. status lists each holder: how far it
  got, held, read and skipped by reason. From cli-core 0.556.0.
• config repair mends a settings file whose JSON is broken only in its syntax, with a backup; --dry-run
  previews. From cli-core.

Fixed

• The browser login page of mail mcp serve --http says the app asks to reach your mail and names
  mail mcp serve --http. It said "your messages" and mail mcp --http. From cli-core 0.551.0.

0.12.0

Added

• Work or school accounts: what to do when Microsoft asks for admin approval (docs/outlook.md):
  why AADSTS90094 appears, the admin-consent link for WireCat's app with how to revoke it, and how an organisation
  registers its own app.

0.11.0

Added

• A guide to connect Outlook.com or Microsoft 365 (docs/outlook.md): turn IMAP on, sign in
  through the browser, sync and send, and what to do when the token is refused or an admin must allow the app.

0.10.0

Changed — may break callers

• search messages says search.server-partial, not search.server-too-large. It downloads the first 256 KiB of
  each message the server finds and stores a bigger one with its text and without its attachments; the next sync
  reads it whole. Before, a candidate over 5 MB was left on the server and a smaller one was downloaded with all its
  attachments. A script that matched search.server-too-large matches search.server-partial instead.
• After messages send, stored is true only when this message is in the store, not when any other mail of the
  last 10 minutes was. A caller that read stored: true as "some mail was synced" reads it now as "this message is
  stored".
• mail.search-refused is cli-core's reason now (cli-core 0.550.0); the reason, its code and its message are
  the same.

Added

• --compact answers one line per item (cli-base 0.74.0). mail now needs @wirecat/cli-core 0.550.0 and
  @wirecat/cli-base 0.74.0.
• sync says what became of the emails a search stored text-first: partial_emails with completed (read whole
  this run), left (waiting for a later run) and stuck (given up on: the server no longer gives them where they
  were stored). It is absent when there are none.

Fixed

• A Microsoft sign-in whose new token the mail server refuses says how to turn IMAP on. On Outlook.com IMAP is
  off by default; the error now names the switch (Settings, "Mail", "Forwarding and IMAP", "Let devices and apps use
  IMAP") and no longer claims a refresh was tried. The answer carries the server's response code as cause_code, never
  its text.
• A server that refuses SEARCH no longer looks like an empty folder. sync leaves that folder unread and reads
  the rest: the answer is partial, names it in refused_folders with a mail.search-refused issue, and nothing of it
  is marked deleted. messages move, copy, delete, restore and drafts stop with mail.search-refused
  instead of acting on nothing (cli-core).
• On Gmail, an email a search stored text-first is read whole by the next sync. It was never completed there:
  mail worked out its id from the Message-ID, and Gmail's mail is stored under its X-GM-MSGID, so every sync downloaded
  the whole message again and threw it away. fetchRaw now reads Gmail's ids beside the bytes.
• An email a search stored text-first is no longer downloaded whole on every sync when the server no longer gives
  it. It is read under the UIDVALIDITY it was stored with, and given up on after three failed tries, or at once when
  its place holds another message; it no longer holds back newer ones (cli-core).
• A search no longer stores a text-first copy over an email a sync in another process stored whole meanwhile,
  which dropped its attachments (cli-core).
• The reader of your own Google --client-file and the browser opener come from @wirecat/cli-core 0.546.0, not
  copies in mail. The file shapes, the chmod 600 check and the errors are unchanged.