Fixes from testing email search (docs/enhancements-2026-07-07.md):
- New `folders` agent command lists the account's mailboxes (name,
delimiter, selectable), INBOX first, so agents can discover archived
mail outside INBOX.
- `search --all-folders` sweeps every selectable mailbox; each hit
carries a `folder` field, `skipped_folders` reports mailboxes the
server refused, and --limit caps visible results across the sweep.
The sweep deliberately skips EnsureFolderBaseline so a read-only
search never mutates list --new state.
- Empty search results include a generic `data.hint` with next steps.
The hint is a fixed constant per mode, so the invisibility invariant
holds: absent and policy-filtered mail produce byte-identical
envelopes (codified in TestSearchEmptyHintIndistinguishableFromFiltered).
- Skill and user docs: document `--text` full-text search as
best-effort (server-dependent); recommend --subject-contains/--from.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Let an agent holding only EMCLI_KEY discover accounts via `account list`,
exposing name/from/can_send (not host/username); admin keeps the full
text table. account add/edit/remove stay admin-only.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Enforce the agent/admin trust boundary with two env keys (EMCLI_ADMIN_KEY,
EMCLI_KEY) via envelope encryption: one DEK wrapped per role. Admin commands
unwrap the admin slot only (no agent fallback), so a forced agent holding
EMCLI_KEY cannot authorize config changes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
steve