OakenMail

Settings

Theme

Layout

Reading pane
Density

Reading

Workspaces TBD

Not defined yet

“Workspace” isn’t part of the Oaken Mail architecture. This pane is a placeholder until the concept is pinned down — likely a switchable context that bundles a set of accounts, filters and folders (e.g. Work vs Personal).

Accounts

AE
alex@example.com Gmail
Synced 2 min ago · cursor 184213 · 12,904 messages
Active
authsync.pullflags.writesendevery 15 min · America/New_York
AW
alex.work@gmail.com Gmail
Paused — refresh token refused
Auth error
authsync.pullflags.writesendevery 15 min · America/New_York
AF
alex@fastmail.com IMAP
Synced 5 min ago · 2 folder schedules · 8,110 messages
Active
authsync.pullflags.writefolderscron · Europe/London
smtp.example.org SMTP
Send only · no mailbox to sync
Ready
send

Secrets live only in the OS keyring (service oaken), never in config, logs or exceptions. Google uses your own OAuth client at gmail.modify scope.

Defaults

Default interval
Every 15 minutes
Minimum interval
60 seconds (floor, enforced on save)
Max concurrent syncs
Missed runs
Collapse into one catch-up run
On failure
Back off with jitter; an auth failure pauses only that account

Quiet hours

to

Schedules

Account / folderTypeWhenTimezoneNext runLast run
alex@example.comIntervalevery 15 minAmerica/New_Yorkin 11 min ok · 2 min ago
alex.work@gmail.comIntervalevery 15 minAmerica/New_Yorkpaused auth error
alex@fastmail.com · INBOXCron*/10 * * * *Europe/Londonin 4 min ok · 5 min ago
alex@fastmail.com · ListsCron0 * * * *Europe/Londonin 38 min ok · 22 min ago
Schedules are live data in raw.db; every edit is audited.

Backends

Local by default. Nothing leaves the machine unless you point this elsewhere.
Changing the embedder re-runs an embed job — mail is never re-downloaded.

Token thrift

Enrichment cache

Every LLM result is cached by (content_hash, model, prompt_version), so re-runs are free until an input changes.

18,442
cached results
312 MB
cache size
v4
prompt version
94%
hit rate

Installed plugins

First-party only in v1 · in-process
Gmail · Provider
authsync.pullflags.writesend
healthy
IMAP · Provider (generic)
authsync.pullflags.writefolders
healthy
SMTP · Provider (send)
send
healthy
Ollama · Embedder
embednomic-embed-text
healthy
Ollama · LLM backend
generatellama3.1:8b
healthy
Enricher · first-party
summarytriageactionsheader/MIME
degraded
sqlite-vec · Vector store
upsertsearch
healthy

Databases

2.3 GB
raw.db — source of truth
640 MB
index.db — rebuildable
41,208
messages
188,502
chunks + vectors

Data lives in ~/.local/share/oaken/, never in the repo. index.db can be deleted and rebuilt entirely from raw.db.

Maintenance

Rebuild index
Reparse, re-chunk and re-index from raw bytes (keyword-only; deterministic).
Re-enrich
Re-run summaries, triage and actions — a separate job from the index rebuild.
Vacuum databases
Reclaim disk space after large deletions.

Quarantine

owner-only
3 attachments quarantined
Stored with no execute bit; never opened or analysed by core.
TimeActorActionTarget
15:21:04userreadstate.mark_readmsg 184213
15:18:40userschedule.updatealex@fastmail.com · INBOX
15:02:11useraccount.pausealex.work@gmail.com
14:47:55systemsieve.file12 messages → Lists—

The audit log lives in raw.db and holds ids and booleans only — never mail content.

{"ts":"2026-10-20T15:21:04Z","event":"sync.completed","account":"alex@example.com","new":3,"ms":812}
{"ts":"2026-10-20T15:20:52Z","event":"ingest.enriched","doc":184213,"model":"llama3.1:8b","cached":false}
{"ts":"2026-10-20T15:18:40Z","event":"schedule.updated","target":"alex@fastmail.com/INBOX"}
{"ts":"2026-10-20T15:02:11Z","event":"account.paused","account":"alex.work@gmail.com","reason":"AuthError"}
{"ts":"2026-10-20T14:47:55Z","event":"sieve.filed","count":12,"label":"Lists"}

Events are an append-only JSON-lines file, read via the oaken events CLI.

Sending identities

Alex Example <alex@example.com>
Default
Alex Example <alex@example.org>

Signature

Sieve

List-Id contains dev.lists.example.com
Move to dev@lists, skip Inbox
Subject contains [VOTE]
Label Releases, star

Composing

Security

Two-factor authentication
Enabled via authenticator app
PGP keys
1 key imported
Active sessions
2 devices