Fastmail Mail

Read, search, and send mail in a Fastmail mailbox over IMAP and SMTP, with an app password that does not expire.

Connect it

$ lanes link connect fastmail_mail --profile personal --workspace local

This takes an app password rather than a browser sign-in. One password covers fastmail_calendar and fastmail_contacts as well, because they share a credential.

Because it needs no browser, an agent with a shell can do the whole setup:

$ printf %s "$TOKEN" | lanes link secrets set fastmail/main --profile personal
$ lanes link connect fastmail_mail --id main --non-interactive --json --profile personal

Credentials go in on stdin, never as a flag: an argument lands in your shell history, in ps output, and in any transcript.

What your agent can do

IMAP and SMTP give a fixed set of capabilities, the same on every mailbox:

• fastmail_mail.list_mailboxes
• fastmail_mail.search_messages
• fastmail_mail.get_message
• fastmail_mail.get_attachment
• fastmail_mail.mark_messages
• fastmail_mail.move_messages
• fastmail_mail.send_message

What is recorded

Every call is recorded, allowed or refused. The rule is to keep the shape and withhold the words: an audit log that reproduced the content would be a second copy of the thing it was meant to make accountable.

Identifiers such as mailbox, limit, unseen, flagged, uid, and message_id are kept. Everything that carries your words is withheld.

fastmail_mail.send_message records nothing but the receipt.

What an entry holds and how to read one is on the audit log.

Narrowing what it may do

Connecting grants the read bundle. Tightening it happens on your machine and takes effect at once:

$ lanes link policy deny 'fastmail_mail.*' --connection fastmail_mail.main --profile personal --workspace local

A deny always beats an allow, whatever the order in the file. See Scopes and permissions for widening, and for what can and cannot be set per connection.

Untested

The manifest is right in every way the code can check: it validates, its tools generate inside the budget, its scopes are described, and its endpoint answered a probe. Nobody has yet connected it to a real account, which is the part only a real account proves.

If you connect it, say so and this note comes off.

Next: every provider, or Connections for what a connection is and the methods behind one.