v2.3.3

src/tools/email.ts

@@ -2,6 +2,7 @@ import fs from 'fs';
 import path from 'path';
 import os from 'os';
 import { ToolResult } from '../types.js';
+import { getVault } from '../security/vault.js';
 
 // ── Config ────────────────────────────────────────────────────────────────────
 
@@ -40,6 +41,19 @@ function getEmailConfig(accountId?: string): EmailConfig | null {
     }
 
     if (!e?.imap_host || !e?.username) return null;
+
+    // Resolve vault: references for password
+    let password = e.password || '';
+    if (password.startsWith('vault:')) {
+      try {
+        const vault = getVault(path.dirname(cfgPath));
+        const secret = vault.get(password.slice(6), 'email:resolve');
+        password = secret ? secret.expose() : '';
+      } catch {
+        password = '';
+      }
+    }
+
     return {
       imap_host:                e.imap_host,
       imap_port:                Number(e.imap_port   ?? 993),
@@ -50,7 +64,7 @@ function getEmailConfig(accountId?: string): EmailConfig | null {
       smtp_secure:              e.smtp_secure === true,
       smtp_reject_unauthorized: e.smtp_reject_unauthorized !== false,
       username:                 e.username,
-      password:                 e.password || '',
+      password,
     };
   } catch {
     return null;