v0.1.4

v0.1.4 — uninstall command, --version, help output fix

v0.1.3 — pip install inboxsweeper

One line to install now:

pipx install inboxsweeper      # or: pip install inboxsweeper
inboxsweeper wizard

On a Mac this is also the smoothest route: a pip install carries no "downloaded from the internet" flag, so there's no Gatekeeper unlock to work through.

Published to PyPI via Trusted Publishing — the release is authenticated by GitHub's OIDC identity, so there's no API token stored anywhere that could leak.

Also in this release:

• The macOS instructions were wrong for every current Mac. They said right-click → Open; Apple removed that bypass in macOS 15 Sequoia. Now documents the real flow — System Settings → Privacy & Security → Open Anyway — with the Terminal one-liner for anyone who'd rather skip the clicking.
• The command-line help still introduced the tool by its old working name, "mail-declutter", including in the text telling you what to name your app password. Renamed everywhere. (Your stored credentials are untouched.)
• The four usage paths are ordered by who they're for now, with the AI-agent route ahead of the terminal instead of buried at the bottom.
• Fixed a link in the README that pointed at a heading which no longer existed.

Windows .exe below carries build provenance, same as v0.1.2:

gh attestation verify InboxSweeper.exe --repo elixir-bash/inboxsweeper

v0.1.2 — verifiable builds, safer credential file

Security-focused release. Worth updating to.

Every binary here is now verifiable. Releases are built by a public workflow that records signed build provenance. The .exe is still unsigned — a certificate costs $99/year and this stays free — but you no longer have to take that on faith:

gh attestation verify InboxSweeper.exe --repo elixir-bash/inboxsweeper

Fixed: a window where your app password was readable. On Linux and any non-macOS system without a Keychain, credentials fall back to ~/.config/mail-declutter/. That file was written first and locked down to 0600 immediately after — but in between it sat on disk under the default umask, world-readable on most systems. It's now created 0600, inside a 0700 directory. macOS was never affected (it uses the Keychain).

Hardened the build itself. Actions are pinned to commit SHAs rather than mutable tags, and the workflow runs with the minimum permissions it needs. A compromise upstream of this project shouldn't be able to reach a binary you download from it.

Also: the local web UI validates the mail provider at the request boundary instead of relying on a downstream error; there's now a security policy with a private reporting channel; LICENSE is verbatim MIT again (an appended note was making it register as "Other").

Nothing changed about how sweeping works, and nothing about the privacy model: your mail and credentials still never leave your machine.

v0.1.1

Add CI: build macOS + Windows installers on tag, attach to release

InboxSweeper v0.1.0

First public build. macOS app attached below — download, unzip, right-click → Open (unsigned).

Also works via terminal (python3 inboxsweeper.py wizard) or Claude Code/Codex. Windows .exe coming via CI.

100% local · free · open source.