* Add Hey CLI support as alternative email backend
The Postman agent now supports two email backends:
- Hey (hey CLI) for Hey.com accounts with pre-sorted mailboxes
- GWS (gws CLI) for Gmail/Google Workspace accounts
Hey's mailbox model (Imbox, Feed, Paper Trail, Reply Later,
Set Aside, Bubble Up) is mapped to triage behaviours so the
agent leverages Hey's existing sorting. Calendar operations
remain on GWS.
All MCP function references replaced with CLI equivalents.
No user-specific details in the agent file.
* Update agents in postman.md by removing two roles
Removed descriptions for Food Coach and Wellness Guide agents from the postman documentation.
* Add Hey CLI as email backend across all docs, skills, and references
- Resolve all merge conflicts in postman.md keeping GWS + MCP + Hey
- Apply all 7 review comments from PR #14 (complete mailbox list,
concrete email_backend setting, consistent template placeholders,
Hey ID clarification, productivity features disclaimer, deadline
body scanning, remove user-specific agent references)
- Add Hey CLI alongside GWS/MCP in: README, CLAUDE.md, TERMS_OF_USE,
DISCLAIMERS, getting-started, gws-setup-guide (renamed sections),
agents-registry, agents.md, onboarding skill, launchme.sh
- Update all 4 Postman-related skills (email-triage, deadline-radar,
meeting-prep, weekly-agenda) with Hey CLI commands and backend
detection
- Expand security section to cover Hey CLI injection vectors
- Keep MCP as read-only fallback for all backends
* Address Copilot review: fix typos, injection rules, platform compat, install hooks
- Fix hey imbox --json typo → hey box imbox --json
- Fix after:{{yesterday}} → newer_than:2d for consistent 48h scan
- Reconcile shell injection rules with hey reply/compose -m (user-approved
text only, with safe quoting guidance)
- Separate email write ops (GWS/Hey) from calendar write ops (GWS only)
in TERMS_OF_USE and DISCLAIMERS
- Replace grep -P with POSIX-compatible tab detection in validate-frontmatter
- Add hooks/ and settings.json installation to launchme.sh and updateme.sh
so .claude/hooks/ paths in settings.json resolve correctly
---------
Co-authored-by: gnekt <dima9610@gmail.com>
* Replace MCP Gmail/Calendar with Google Workspace CLI
Swap all MCP tool references (gmail_*, gcal_*) for gws CLI
equivalents in the postman agent and all 4 postman-related skills.
Add Bash to postman tools for gws execution. Include setup guide
for gws installation and OAuth configuration.
Addresses review feedback: Food Coach and Wellness Guide references
removed (those agents no longer exist on main).
* Update skills/weekly-agenda/SKILL.md
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Address Copilot review feedback
- Add gmail.send scope to setup guide and agent docs
- Use narrower calendar scopes (calendar.events + calendarlist.readonly)
- Make gcloud optional in prerequisites
- Fix .mcp.json example to remove only Gmail/Calendar entries
- Split label modify into separate add/remove examples
- Replace hard-coded dates with placeholders
- Fix after:{{yesterday}} to newer_than:2d for 48h filtering
- Update all docs/gws-setup-guide.md paths to repo-relative
- Add MCP fallback note for users without gws
- Add mandatory user confirmation before mark-read/archive actions
* Fix PR review findings: add security guardrails and update all MCP references for gws dual-support
- Add Security: External Content section to postman.md to prevent command injection from untrusted email content
- Update agents-registry.md, agents.md, CLAUDE.md, README.md to reflect gws CLI + MCP fallback duality
- Update TERMS_OF_USE.md and DISCLAIMERS.md legal text to mention gws alongside MCP
- Update onboarding skill to present gws as recommended option with MCP as fallback
- Fix placeholder in gws-setup-guide.md (was a raw template, now a concrete date)
- Update agent-template.md to document Bash for CLI tool access pattern
* Harden security for email/calendar operations and update legal coverage
- Postman agent: comprehensive security section covering prompt injection,
shell injection, write operation safeguards, and Bash command allowlist
- All 4 postman-related skills: add security sections with prompt injection
defense, shell injection rules, and explicit MCP fallback instructions
- TERMS_OF_USE.md: new Section 4A covering risks from email/calendar read
and write operations (adversarial content, unintended sends, deletions,
calendar disruptions), updated Limitation of Liability section
- DISCLAIMERS.md: new section explaining write operation risks in plain
language, MCP as safer read-only alternative, and acknowledgment of
prompt-based security limitations
---------
Co-authored-by: gnekt <dima9610@gmail.com>
