IMAP and SMTP mail accounts

Metnos can read and send mail through providers other than Google. Standard mailboxes use IMAP for reading and SMTP for sending; features specific to Gmail use the separate Google Workspace integration.

A simple name for each mailbox

Each account receives a short, stable name such as work. This is not the email address: it is how users and executors refer to the mailbox. You can therefore ask Metnos to “read my work mail” or “send from work” without repeating server details and credentials.

In the encrypted store, the same configuration is named smtp_work. The prefix is retained for compatibility, but the record can contain both SMTP and IMAP settings. Executors receive only account="work". For reading, account="all" covers every configured account; a specific list of account names is also valid.

How to configure an account

During guided installation, the Sensitive data phase can add one or more mailboxes. Accounts can also be added later through the protected credential flow: Metnos collects the required values without retaining them in the conversation and saves them in its local encrypted store.

To begin, simply ask: “Configure a non-Google mail account named work.” Metnos will request only the missing details. A complete configuration uses these fields:

FieldMeaning
user, passwordThe username and password, or the provider's application-specific password.
imap_host, imap_portThe incoming-mail server. Port 993 is the usual encrypted port.
smtp_host, smtp_portThe outgoing-mail server. Port 465 is commonly used for SMTPS; omitting these fields makes the account read-only.
verify_tlsServer certificate verification. Installation always enables it; turning it off weakens security and is not a normal configuration.

Passwords must never appear in manifests, logs, or documentation. The credential flow intercepts them before the request reaches the planner, encrypts them, and leaves a secret-free placeholder in their place.

What Metnos can do

read_messages can read one mailbox, a named selection, or all available accounts. If one account fails, the result separates successfully read messages from errors and never loses their source-mailbox identity. send_messages uses SMTP for delivery. Once a message has been accepted by the server, Metnos cannot recall it, so sending is not undoable.

move_messages moves mail between folders and is undoable when the server allows Metnos to record and retrace the move. Metnos uses the atomic MOVE command when available; otherwise it proceeds only when it can copy and remove exactly the selected messages. If it cannot guarantee that, the mailbox is left unchanged.

An IMAP identifier is meaningful only inside the mailbox and folder that produced it. An identifier supplied directly must therefore include its account and source folder. When it comes from a preceding read, Metnos preserves this context automatically and never guesses a default mailbox.

The Gmail case

Google Workspace is a separate, OAuth-authorized integration built on the Gmail APIs. It handles Gmail concepts such as threads and labels. For example, set_messages adds or removes labels and can undo the change; it does not manage flags in a generic IMAP mailbox.

move_messages also works with Gmail, where it operates on the labels defined by the provider. Gmail message IDs do not follow IMAP UID rules, because Google defines their identity scope.

Compatibility with earlier configurations

A mode-0600 file at ~/.config/metnos/mail/<name>.env remains accepted with fields HOST_IMAP, PORT_IMAP, HOST_SMTP, PORT_SMTP, USER, PASS, and VERIFY_TLS. The encrypted vault takes precedence; the file is a compatibility and migration path.