v0.5.0

First release since the platform build landed — multi-surface email triage (MCP server, Ink TUI, web dashboard) for Gmail + Outlook.

Added

• Multi-account sync orchestration — bounded-concurrency rate limiting + active-account prioritization (most recently active mailboxes sync first).
• L5 security CI — gitleaks secret scan + OSV dependency scan.
• L3 mutation testing (Stryker, report-only baseline), rules-engine E2E suite, and a gated Gmail/Outlook integration harness.
• build:web gated in CI; governance scaffolding (CoC, CONTRIBUTING, SECURITY, SUPPORT, Dependabot, …).

Changed

• React 19 + Ink 7 across the TUI and web app.
• Dependency modernization — better-sqlite3 12, openai 6, googleapis 173, @anthropic-ai/sdk, @inquirer/prompts 8, conf 15, dotenv 17, commander 15, +types, +CI actions.
• Web app is now the decoupled DailyReview surface on /api (legacy browser-OAuth views removed).
• Lint rules no-case-declarations + no-var-requires promoted to errors.

Fixed

• Sync daemon now refreshes and persists Gmail OAuth tokens (token drift) + guards overlapping poll cycles.
• OSV scan no longer shows a phantom red check on every PR.

Removed

• Dead @anthropic-ai/claude-agent-sdk; obsolete GCP deploy machinery (Cloud Run + Terraform); dead deps (marked, md-to-pdf, Playwright).

Full changelog: https://github.com/jeremylongshore/intent-mail/blob/v0.5.0/CHANGELOG.md