v0.1.2 — Out-of-band approval

First public release worth installing. GigaMail is an MCP server that gives
your AI agent controlled access to email — Microsoft Graph and IMAP,
calendar, a local search index, your own documents — plus an optional
console for the human.

Security fix: the agent could approve its own destructive actions

v0.1.0 returned a one-time confirmation token inside the tool result, which
put it in the model's context. The agent held both halves — the preview and
the key — so an instruction injected through an email could call the tool
again with the token it had just read. The gate stopped accidents, not a
determined injection.

Reported on r/mcp by u/ranbuman; u/anderson_the_one added the point
about binding approval to the exact operation shown. Thank you both.

Approval now happens out of band:

• a dangerous tool returns only request_id, an inert reference — no secret
  enters the model's context
• approval goes through channels the agent has no path to: the console API
  (behind its session token) or gigamail approvals approve <id>
• execution uses the arguments stored when the request was made, never what
  the agent passes back
• repeating a request_id returns awaiting approval, indefinitely
• consuming an approval is a single conditional UPDATE: concurrent calls
  can no longer execute one approval twice (with the old code, 8 concurrent
  calls consumed the same approval 8 times out of 8)
• the action log records who approved and when

Declared limit: an agent with full shell access on the same machine can
run the approval CLI. Different threat model — GigaMail does not claim to
defend it.

What's in this release

• 24 typed tools — 15 read, 3 audited writes, 6 requiring human approval
• Microsoft Graph + IMAP/SMTP (Aruba, Gmail, Libero, any IMAP server)
• Per-account identity and knowledge files: the agent answers with figures
  from your own documents and attaches the right ones
• Free-slot calendar availability, so proposed appointment times are real
• Human console (Electron) over a local API — no LLM inside GigaMail, the
  intelligence is whatever agent you bring
• 106 tests, green on Windows and Linux across Python 3.10 / 3.12 / 3.13

Known limitations

• The action log is append-only, not tamper-proof
• The bundled Azure app is not publisher-verified: the Microsoft consent
  screen shows an "unverified" notice. Bring your own client_id to avoid
  it — IMAP needs none of this
• Gmail works via IMAP with an app password but is untested against a live
  account
• mark_spam, update_event, auth_status, search_contacts and
  list_followup_needed are designed but not implemented

AGPL-3.0-or-later. Commercial licenses for closed-source use available from
the copyright holder. Security policy: SECURITY.md