chore(agentmail): modern bbs defaults (mail host, 465 implicit TLS)

[ralyodio]

Rescues 5eb4420 from the stale chore/agentmail-modern-ports branch, which had fallen ~35k lines behind master and could not be merged as-is. Cherry-picked cleanly onto current master — git patch-id confirms the change is identical to the original commit.

What it does

resolveMailuConfig now defaults to the real bbs mail stack:

• address domain bbs.profullstack.com, mail host mail.profullstack.com
• SMTP 465 implicit TLS (the bbs Mailu front does not listen on 587 — it refuses the connection)
• IMAPS 993

Also fixes a latent mismatch where the address domain (bbs) and the transport's from-domain check (mail) diverged when no env was set.

Verification

• Full monorepo build clean
• @logicsrc/plugin-agentmail: 20 tests pass

The original branch has been deleted now that this commit is preserved here.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

59 finding(s)

HIGH/CRITICAL: 31 | MEDIUM: 28

Severity	Rule	Location
HIGH	secret-openai-key	plugins/credential-sharing/src/vault-encryption.test.ts:21
HIGH	manifest-typosquat	apps/commandboard-web/package.json:20
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:392
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:410
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:426
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:428
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:433
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:471
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:477
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:499
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:516
HIGH	secret-generic-credential	apps/logicsrc-web/contract/logicsrc-web.contract.test.ts:528
HIGH	manifest-typosquat	apps/logicsrc-web/package.json:28
HIGH	js-ssrf-outbound-request	apps/logicsrc-web/src/lib/coinpay.ts:50
HIGH	manifest-typosquat	apps/pwa/package.json:19
HIGH	js-ssrf-outbound-request	apps/pwa/public/sw.js:45
HIGH	secret-generic-credential	apps/pwa/test/appbar.test.mjs:10
HIGH	secret-generic-credential	apps/pwa/test/team-members.test.mjs:68
HIGH	secret-generic-credential	packages/account-core/src/index.test.ts:104
HIGH	secret-generic-credential	packages/agentad/src/exchange.test.ts:13
HIGH	secret-generic-credential	plugins/agentgit/src/index.ts:12
HIGH	secret-generic-credential	plugins/c0mpute/src/index.ts:12
HIGH	secret-generic-credential	plugins/coinpay/src/index.ts:12
HIGH	secret-generic-credential	plugins/credential-sharing/src/engine.test.ts:69
HIGH	secret-generic-credential	plugins/credential-sharing/src/engine.test.ts:134
HIGH	secret-database-url	plugins/credential-sharing/src/rekey.test.ts:33
HIGH	secret-generic-credential	plugins/credential-sharing/src/vault-encryption.test.ts:21
HIGH	js-ssrf-outbound-request	plugins/feed-discovery/src/providers/itunes-podcast.ts:37
HIGH	js-ssrf-outbound-request	plugins/feed-discovery/src/providers/podcastindex.ts:43
HIGH	secret-generic-credential	plugins/sh1pt/src/index.ts:11
HIGH	secret-generic-credential	plugins/ugig/src/index.ts:11
MEDIUM	js-unescaped-html-sink	apps/commandboard-web/src/main.ts:19
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/[[...slug]]/page.tsx:73
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/blog/[slug]/page.tsx:120
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/docs/[slug]/page.tsx:55
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/layout.tsx:83
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/pricing/page.tsx:46
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/components/site-shell.tsx:46
MEDIUM	sql-template-interpolation	apps/pwa/src/routes/pages.mjs:44
MEDIUM	sql-template-interpolation	packages/cli/src/index.ts:845
MEDIUM	sql-template-interpolation	packages/cli/src/index.ts:847
MEDIUM	sql-template-interpolation	packages/cli/src/index.ts:854
MEDIUM	sql-template-interpolation	packages/cli/src/teams.ts:286
MEDIUM	sql-template-interpolation	packages/cli/src/teams.ts:439
MEDIUM	sql-template-interpolation	packages/cli/src/teams.ts:442
MEDIUM	redos-nested-quantifier	packages/openontology/src/ids.ts:20
MEDIUM	redos-nested-quantifier	packages/openprd/src/validate.ts:41
MEDIUM	redos-nested-quantifier	packages/schemas/schemas/logicsrc-account-audit-event.schema.json:23
MEDIUM	redos-nested-quantifier	packages/schemas/schemas/logicsrc-account-grant.schema.json:23
MEDIUM	redos-nested-quantifier	packages/schemas/schemas/logicsrc-account-grant.schema.json:35

…and 9 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.