mailctl - Agent-safe CLI wrapper around notmuch: search and organize mail, with no ability to send

Age	Commit message (Collapse)	Author	Files	Lines
13 days	feat(rules): build the scoped query in one place	Danilo M.	2	-0/+48
	A rule stores no scope. The hook supplies tag:new, a dry run supplies nothing. The parentheses around the rule's own query are what stop a disjunction of senders from escaping the scope and matching everything.
13 days	feat(rules): save atomically, preserving unknown fields	Danilo M.	2	-0/+101
	Write to a temp file and rename, so the hook can never read a partial file. Fields this version does not understand round-trip untouched, which is what makes the format belong to neither tool.
13 days	feat(rules): order rules by stage, ties by file position	Danilo M.	2	-0/+47
	Account tags must run before topic rules, which is what the stage field is for. Disabled rules stay loaded so a UI can re-enable them.
13 days	feat(rules): drop a malformed rule rather than the whole file	Danilo M.	2	-13/+167
	One typo must not stop the other rules from tagging. A missing file and a file that will not parse are tracked separately: the hook may run on the first and must refuse on the second.
13 days	feat(rules): load a shared tagging-rule store	Danilo M.	2	-0/+189
	The rules that tag incoming mail live in a notmuch post-new hook as hand-written shell. This is the first piece of moving them into a JSON store that both this tool and qtmaildir read. A rule carries no scope: the hook supplies tag:new, a dry run supplies nothing. Unknown fields are kept per rule so the format belongs to neither tool.
2026-08-04	deleted mailsync.sh as it now lives in mailctl project repository.	Danilo M.	3	-71/+21

2026-08-03	Initial commit: agent-safe notmuch wrapper	Danilo M.	9	-0/+1588
	mailctl is a deliberately narrow CLI wrapper around notmuch, built so an AI coding agent can search and organize local mail with no ability to send. There is no SMTP, reply, or compose code path in the tool. Safety model: - reads run freely, mutations are gated - tag changes are dry-run until --apply - cross-account mutations need an explicit --all-accounts - destructive tags need --apply and --confirm-destructive - bulk mutations are capped by --max-messages - every applied mutation is audited to a local log Accounts are not in the source. They load from ~/.config/mailctl/accounts.json and are validated against both the schema and the actual maildirs on disk at import time, so a typo cannot produce a query matching nothing or a draft under the wrong identity. Ships with mailsync.sh (a separate mbsync + notmuch new driver, meant for cron) and mail-organize, a Claude Code skill that makes mailctl the only sanctioned interface to the user's mail. Licensed GPLv2-only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>