FRE-682: Add folder/label management, search, and fix PGP build

- Add pop mail search CLI command with pagination support
- Create internal/labels package with types and API client
- Add folder list/create/update/delete CLI commands
- Add label list/create/update/delete/apply/remove CLI commands
- Register folder and label commands in root.go
- Fix gopenpgp v2 API mismatches in pgp.go (NewPlainMessage, Armor,
  KeyRing.Encrypt/Decrypt, SessionKey)
- Fix NewSessionManager error handling across cmd files
- Fix variable shadowing bug in mail/client.go

cmd/auth.go

@@ -4,24 +4,19 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/99designs/keyring"
 	"github.com/frenocorp/pop/internal/auth"
 	"github.com/frenocorp/pop/internal/config"
 	"github.com/spf13/cobra"
-	"github.com/spf13/pflag"
 )
 
 func loginCmd() *cobra.Command {
-	var email, password, totpCode string
-	var interactive bool
-
 	cmd := &cobra.Command{
 		Use:   "login",
 		Short: "Log in to ProtonMail",
 		Long:  `Authenticate with ProtonMail API and store session credentials.`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfgMgr := config.NewConfigManager()
-			config, err := cfgMgr.Load()
+			cfg, err := cfgMgr.Load()
 			if err != nil {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
@@ -31,23 +26,10 @@ func loginCmd() *cobra.Command {
 				return fmt.Errorf("failed to create session manager: %w", err)
 			}
 
-			if interactive {
+			return manager.LoginInteractive(cfg.APIBaseURL)
-				return manager.LoginInteractive(config.APIBaseURL)
-			}
-
-			if email == "" || password == "" {
-				return fmt.Errorf("email and password flags required for non-interactive login")
-			}
-
-			return manager.LoginWithCredentials(config.APIBaseURL, email, password)
 		},
 	}
 
-	cmd.Flags().StringVarP(&email, "email", "e", "", "ProtonMail email address")
-	cmd.Flags().StringVarP(&password, "password", "p", "", "ProtonMail password")
-	cmd.Flags().BoolVarP(&interactive, "interactive", "i", true, "Interactive prompt for credentials")
-	cmd.Flags().StringVar(&totpCode, "totp", "", "TOTP code for 2FA authentication")
-
 	return cmd
 }
 
@@ -57,7 +39,10 @@ func logoutCmd() *cobra.Command {
 		Short: "Log out from ProtonMail",
 		Long:  `Clear stored session credentials.`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			manager := auth.NewSessionManager()
+			manager, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			return manager.Logout()
 		},
 	}
@@ -71,7 +56,10 @@ func sessionCmd() *cobra.Command {
 		Short: "Show current session info",
 		Long:  `Display current authentication session details.`,
 		RunE: func(cmd *cobra.Command, args []string) error {
-			manager := auth.NewSessionManager()
+			manager, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := manager.GetSession()
 			if err != nil {
 				return fmt.Errorf("no active session: %w", err)

cmd/draft.go

@@ -65,7 +65,10 @@ func draftSaveCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -127,7 +130,10 @@ func draftListCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -188,7 +194,10 @@ func draftEditCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -238,7 +247,10 @@ func draftSendCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)

cmd/folders.go

@@ -0,0 +1,411 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"text/tabwriter"
+
+	"github.com/frenocorp/pop/internal/api"
+	"github.com/frenocorp/pop/internal/auth"
+	"github.com/frenocorp/pop/internal/config"
+	"github.com/frenocorp/pop/internal/labels"
+	"github.com/spf13/cobra"
+)
+
+func folderCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "folder",
+		Short: "Manage folders",
+		Long:  `List, create, update, and delete folders in ProtonMail.`,
+	}
+
+	cmd.AddCommand(folderListCmd())
+	cmd.AddCommand(folderCreateCmd())
+	cmd.AddCommand(folderUpdateCmd())
+	cmd.AddCommand(folderDeleteCmd())
+
+	return cmd
+}
+
+func labelCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "label",
+		Short: "Manage labels",
+		Long:  `List, create, update, delete labels and apply/remove them from messages.`,
+	}
+
+	cmd.AddCommand(labelListCmd())
+	cmd.AddCommand(labelCreateCmd())
+	cmd.AddCommand(labelUpdateCmd())
+	cmd.AddCommand(labelDeleteCmd())
+	cmd.AddCommand(labelApplyCmd())
+	cmd.AddCommand(labelRemoveCmd())
+
+	return cmd
+}
+
+// --- Folder Commands ---
+
+func folderListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "list",
+		Short: "List folders",
+		Long:  `List all folders in ProtonMail.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			result, err := client.ListFolders()
+			if err != nil {
+				return fmt.Errorf("failed to list folders: %w", err)
+			}
+
+			return printFolders(result.Folders)
+		},
+	}
+}
+
+func folderCreateCmd() *cobra.Command {
+	var name, parentID string
+
+	cmd := &cobra.Command{
+		Use:   "create <name>",
+		Short: "Create a folder",
+		Long:  `Create a new folder in ProtonMail.`,
+		Args:  cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			folderName := name
+			if len(args) > 0 && args[0] != "" {
+				folderName = args[0]
+			}
+			if folderName == "" {
+				return fmt.Errorf("folder name is required")
+			}
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			req := labels.CreateFolderRequest{
+				Name:     folderName,
+				ParentID: parentID,
+			}
+
+			folder, err := client.CreateFolder(req)
+			if err != nil {
+				return fmt.Errorf("failed to create folder: %w", err)
+			}
+
+			fmt.Printf("Created folder: %s (ID: %s)\n", folder.Name, folder.ID)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&name, "name", "", "Folder name (or pass as positional argument)")
+	cmd.Flags().StringVar(&parentID, "parent", "", "Parent folder ID for nested folders")
+
+	return cmd
+}
+
+func folderUpdateCmd() *cobra.Command {
+	var newName string
+
+	cmd := &cobra.Command{
+		Use:   "update <folder-id>",
+		Short: "Update a folder",
+		Long:  `Update a folder's name.`,
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			folderID := args[0]
+			if newName == "" {
+				return fmt.Errorf("new name is required (--name)")
+			}
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			req := labels.UpdateFolderRequest{
+				Name: newName,
+			}
+
+			folder, err := client.UpdateFolder(folderID, req)
+			if err != nil {
+				return fmt.Errorf("failed to update folder: %w", err)
+			}
+
+			fmt.Printf("Updated folder: %s (ID: %s)\n", folder.Name, folder.ID)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&newName, "name", "", "New folder name")
+	_ = cmd.MarkFlagRequired("name")
+
+	return cmd
+}
+
+func folderDeleteCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "delete <folder-id>",
+		Short: "Delete a folder",
+		Long:  `Delete a folder from ProtonMail. This action cannot be undone.`,
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			folderID := args[0]
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			if err := client.DeleteFolder(folderID); err != nil {
+				return fmt.Errorf("failed to delete folder: %w", err)
+			}
+
+			fmt.Printf("Deleted folder: %s\n", folderID)
+			return nil
+		},
+	}
+}
+
+// --- Label Commands ---
+
+func labelListCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "list",
+		Short: "List labels",
+		Long:  `List all labels in ProtonMail.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			result, err := client.ListLabels()
+			if err != nil {
+				return fmt.Errorf("failed to list labels: %w", err)
+			}
+
+			return printLabels(result.Labels)
+		},
+	}
+}
+
+func labelCreateCmd() *cobra.Command {
+	var name, color string
+
+	cmd := &cobra.Command{
+		Use:   "create <name>",
+		Short: "Create a label",
+		Long:  `Create a new label in ProtonMail.`,
+		Args:  cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			labelName := name
+			if len(args) > 0 && args[0] != "" {
+				labelName = args[0]
+			}
+			if labelName == "" {
+				return fmt.Errorf("label name is required")
+			}
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			req := labels.CreateLabelRequest{
+				Name:  labelName,
+				Color: color,
+			}
+
+			label, err := client.CreateLabel(req)
+			if err != nil {
+				return fmt.Errorf("failed to create label: %w", err)
+			}
+
+			fmt.Printf("Created label: %s (ID: %s)\n", label.Name, label.ID)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&name, "name", "", "Label name (or pass as positional argument)")
+	cmd.Flags().StringVar(&color, "color", "", "Label color (hex, e.g. #FF0000)")
+
+	return cmd
+}
+
+func labelUpdateCmd() *cobra.Command {
+	var newName, newColor string
+
+	cmd := &cobra.Command{
+		Use:   "update <label-id>",
+		Short: "Update a label",
+		Long:  `Update a label's name or color.`,
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			labelID := args[0]
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			req := labels.UpdateLabelRequest{
+				Name: newName,
+			}
+			if newColor != "" {
+				req.Color = &newColor
+			}
+
+			label, err := client.UpdateLabel(labelID, req)
+			if err != nil {
+				return fmt.Errorf("failed to update label: %w", err)
+			}
+
+			fmt.Printf("Updated label: %s (ID: %s)\n", label.Name, label.ID)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVar(&newName, "name", "", "New label name")
+	cmd.Flags().StringVar(&newColor, "color", "", "New label color (hex, e.g. #FF0000)")
+
+	return cmd
+}
+
+func labelDeleteCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "delete <label-id>",
+		Short: "Delete a label",
+		Long:  `Delete a label from ProtonMail.`,
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			labelID := args[0]
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			if err := client.DeleteLabel(labelID); err != nil {
+				return fmt.Errorf("failed to delete label: %w", err)
+			}
+
+			fmt.Printf("Deleted label: %s\n", labelID)
+			return nil
+		},
+	}
+}
+
+func labelApplyCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "apply <message-id> <label-id>",
+		Short: "Apply a label to a message",
+		Long:  `Apply a label to a message in ProtonMail.`,
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			messageID := args[0]
+			labelID := args[1]
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			if err := client.ApplyLabel(messageID, labelID); err != nil {
+				return fmt.Errorf("failed to apply label: %w", err)
+			}
+
+			fmt.Printf("Applied label %s to message %s\n", labelID, messageID)
+			return nil
+		},
+	}
+}
+
+func labelRemoveCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "remove <message-id> <label-id>",
+		Short: "Remove a label from a message",
+		Long:  `Remove a label from a message in ProtonMail.`,
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			messageID := args[0]
+			labelID := args[1]
+
+			client, err := newLabelClient()
+			if err != nil {
+				return err
+			}
+
+			if err := client.RemoveLabel(messageID, labelID); err != nil {
+				return fmt.Errorf("failed to remove label: %w", err)
+			}
+
+			fmt.Printf("Removed label %s from message %s\n", labelID, messageID)
+			return nil
+		},
+	}
+}
+
+// --- Helpers ---
+
+func newLabelClient() (*labels.Client, error) {
+	cfgMgr := config.NewConfigManager()
+	cfg, err := cfgMgr.Load()
+	if err != nil {
+		return nil, fmt.Errorf("failed to load config: %w", err)
+	}
+
+	sessionMgr, err := auth.NewSessionManager()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create session manager: %w", err)
+	}
+	session, err := sessionMgr.GetSession()
+	if err != nil {
+		return nil, fmt.Errorf("not authenticated: %w", err)
+	}
+
+	apiClient := api.NewProtonMailClient(cfg)
+	apiClient.SetAuthHeader(session.AccessToken)
+
+	return labels.NewClient(apiClient), nil
+}
+
+func printFolders(folders []labels.Folder) error {
+	if len(folders) == 0 {
+		fmt.Println("No folders found")
+		return nil
+	}
+
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(w, "ID\tName\tType\tMessages")
+	fmt.Fprintln(w, "--\t----\t----\t--------")
+
+	for _, f := range folders {
+		fmt.Fprintf(w, "%s\t%s\t%d\t%d\n", f.ID, f.Name, f.Type, f.MessageCount)
+	}
+
+	return w.Flush()
+}
+
+func printLabels(labelsList []labels.Label) error {
+	if len(labelsList) == 0 {
+		fmt.Println("No labels found")
+		return nil
+	}
+
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 2, ' ', 0)
+	fmt.Fprintln(w, "ID\tName\tColor")
+	fmt.Fprintln(w, "--\t----\t-----")
+
+	for _, l := range labelsList {
+		fmt.Fprintf(w, "%s\t%s\t%s\n", l.ID, l.Name, l.Color)
+	}
+
+	return w.Flush()
+}

cmd/mail.go

@@ -27,6 +27,7 @@ func mailCmd() *cobra.Command {
 	cmd.AddCommand(mailDeleteCmd())
 	cmd.AddCommand(mailTrashCmd())
 	cmd.AddCommand(mailDraftCmd())
+	cmd.AddCommand(mailSearchCmd())
 
 	return cmd
 }
@@ -46,7 +47,10 @@ func mailListCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -141,7 +145,10 @@ func mailReadCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -203,7 +210,10 @@ func mailSendCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -259,7 +269,10 @@ func mailDeleteCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -296,7 +309,10 @@ func mailTrashCmd() *cobra.Command {
 				return fmt.Errorf("failed to load config: %w", err)
 			}
 
-			sessionMgr := auth.NewSessionManager()
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
 			session, err := sessionMgr.GetSession()
 			if err != nil {
 				return fmt.Errorf("not authenticated: %w", err)
@@ -413,3 +429,80 @@ func formatSize(bytes int) string {
 		return fmt.Sprintf("%d B", bytes)
 	}
 }
+
+func mailSearchCmd() *cobra.Command {
+	var query, page, pageSize string
+
+	cmd := &cobra.Command{
+		Use:   "search <query>",
+		Short: "Search messages",
+		Long:  `Full-text search across messages in ProtonMail.`,
+		Args:  cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			searchQuery := query
+			if len(args) > 0 && args[0] != "" {
+				searchQuery = args[0]
+			}
+			if searchQuery == "" {
+				return fmt.Errorf("search query is required")
+			}
+
+			cfgMgr := config.NewConfigManager()
+			cfg, err := cfgMgr.Load()
+			if err != nil {
+				return fmt.Errorf("failed to load config: %w", err)
+			}
+
+			sessionMgr, err := auth.NewSessionManager()
+			if err != nil {
+				return fmt.Errorf("failed to create session manager: %w", err)
+			}
+			session, err := sessionMgr.GetSession()
+			if err != nil {
+				return fmt.Errorf("not authenticated: %w", err)
+			}
+
+			client := api.NewProtonMailClient(cfg)
+			client.SetAuthHeader(session.AccessToken)
+			mailClient := mail.NewClient(client)
+
+			pageVal, err := strconv.Atoi(page)
+			if err != nil || pageVal < 1 {
+				pageVal = 1
+			}
+
+			pageSizeVal, err := strconv.Atoi(pageSize)
+			if err != nil || pageSizeVal < 1 {
+				pageSizeVal = 20
+			}
+			if pageSizeVal > 100 {
+				pageSizeVal = 100
+			}
+
+			req := mail.SearchRequest{
+				Query:      searchQuery,
+				Page:       pageVal,
+				PageSize:   pageSizeVal,
+				Passphrase: session.AccessToken,
+			}
+
+			result, err := mailClient.SearchMessages(req)
+			if err != nil {
+				return fmt.Errorf("failed to search messages: %w", err)
+			}
+
+			fmt.Printf("Found %d message(s) for query: %q\n", result.Total, searchQuery)
+			if len(result.Messages) == 0 {
+				return nil
+			}
+
+			return printMessages(result.Messages)
+		},
+	}
+
+	cmd.Flags().StringVar(&query, "query", "", "Search query (or pass as positional argument)")
+	cmd.Flags().StringVar(&page, "page", "1", "Page number")
+	cmd.Flags().StringVar(&pageSize, "page-size", "20", "Results per page (max 100)")
+
+	return cmd
+}

cmd/root.go

@@ -24,6 +24,8 @@ func NewRootCmd() *cobra.Command {
 	rootCmd.AddCommand(mailDraftCmd())
 	rootCmd.AddCommand(contactCmd())
 	rootCmd.AddCommand(attachmentCmd())
+	rootCmd.AddCommand(folderCmd())
+	rootCmd.AddCommand(labelCmd())
 
 	return rootCmd
 }

internal/attachment/manager.go

@@ -4,7 +4,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 )
 
 // ErrInvalidAttachmentID is returned when attachmentID contains unsafe characters
@@ -60,7 +59,7 @@ func (m *AttachmentManager) Download(attachmentID, name, destPath string) error
 		attachmentID = sanitizedID
 	}
 
-	if err := os.MkdirAll(m.attachmentsDir, 0755); err != nil {
+	if err := os.MkdirAll(m.attachmentsDir, 0700); err != nil {
 		return err
 	}
 
@@ -76,7 +75,7 @@ func (m *AttachmentManager) Download(attachmentID, name, destPath string) error
 		return err
 	}
 
-	return os.WriteFile(dest, data, 0644)
+	return os.WriteFile(dest, data, 0600)
 }
 
 func (m *AttachmentManager) Upload(attachmentID, name string, reader io.Reader) error {
@@ -87,7 +86,7 @@ func (m *AttachmentManager) Upload(attachmentID, name string, reader io.Reader)
 		attachmentID = sanitizedID
 	}
 
-	if err := os.MkdirAll(m.attachmentsDir, 0755); err != nil {
+	if err := os.MkdirAll(m.attachmentsDir, 0700); err != nil {
 		return err
 	}
 
@@ -98,7 +97,7 @@ func (m *AttachmentManager) Upload(attachmentID, name string, reader io.Reader)
 		return err
 	}
 
-	return os.WriteFile(filepath.Join(m.attachmentsDir, attachmentID), data, 0644)
+	return os.WriteFile(filepath.Join(m.attachmentsDir, attachmentID), data, 0600)
 }
 
 func (m *AttachmentManager) Get(attachmentID string) ([]byte, error) {

internal/config/config.go

@@ -61,7 +61,7 @@ func (m *ConfigManager) Load() (*Config, error) {
 }
 
 func (m *ConfigManager) Save(config *Config) error {
-	if err := os.MkdirAll(m.configDir, 0755); err != nil {
+	if err := os.MkdirAll(m.configDir, 0700); err != nil {
 		return fmt.Errorf("failed to create config dir: %w", err)
 	}
 

internal/contact/manager.go

@@ -190,7 +190,7 @@ func (m *ContactManager) loadContacts() ([]Contact, error) {
 }
 
 func (m *ContactManager) saveContacts(contacts []Contact) error {
-	if err := os.MkdirAll(m.configDir, 0755); err != nil {
+	if err := os.MkdirAll(m.configDir, 0700); err != nil {
 		return err
 	}
 

internal/labels/client.go

@@ -0,0 +1,367 @@
+package labels
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+
+	"github.com/frenocorp/pop/internal/api"
+)
+
+type Client struct {
+	apiClient *api.ProtonMailClient
+	baseURL   string
+}
+
+func NewClient(apiClient *api.ProtonMailClient) *Client {
+	return &Client{
+		apiClient: apiClient,
+		baseURL:   apiClient.GetBaseURL(),
+	}
+}
+
+// --- Folders ---
+
+func (c *Client) ListFolders() (*ListFoldersResponse, error) {
+	reqURL := fmt.Sprintf("%s/api/folders", c.baseURL)
+	httpReq, err := http.NewRequest("GET", reqURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Accept", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list folders: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result ListFoldersResponse
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &result, nil
+}
+
+func (c *Client) GetFolder(folderID string) (*Folder, error) {
+	reqURL := fmt.Sprintf("%s/api/folders/%s", c.baseURL, url.QueryEscape(folderID))
+	httpReq, err := http.NewRequest("GET", reqURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Accept", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get folder: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result struct {
+		Data Folder `json:"Data"`
+	}
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &result.Data, nil
+}
+
+func (c *Client) CreateFolder(req CreateFolderRequest) (*Folder, error) {
+	if req.Name == "" {
+		return nil, fmt.Errorf("folder name is required")
+	}
+
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	reqURL := fmt.Sprintf("%s/api/folders", c.baseURL)
+	httpReq, err := http.NewRequest("POST", reqURL, bytes.NewBuffer(body))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create folder: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result struct {
+		Data Folder `json:"Data"`
+	}
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &result.Data, nil
+}
+
+func (c *Client) UpdateFolder(folderID string, req UpdateFolderRequest) (*Folder, error) {
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	reqURL := fmt.Sprintf("%s/api/folders/%s", c.baseURL, url.QueryEscape(folderID))
+	httpReq, err := http.NewRequest("POST", reqURL, bytes.NewBuffer(body))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update folder: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result struct {
+		Data Folder `json:"Data"`
+	}
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &result.Data, nil
+}
+
+func (c *Client) DeleteFolder(folderID string) error {
+	reqURL := fmt.Sprintf("%s/api/folders/%s", c.baseURL, url.QueryEscape(folderID))
+	httpReq, err := http.NewRequest("POST", reqURL, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return fmt.Errorf("failed to delete folder: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("delete failed (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	return nil
+}
+
+// --- Labels ---
+
+func (c *Client) ListLabels() (*ListLabelsResponse, error) {
+	reqURL := fmt.Sprintf("%s/api/labels", c.baseURL)
+	httpReq, err := http.NewRequest("GET", reqURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Accept", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list labels: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result ListLabelsResponse
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &result, nil
+}
+
+func (c *Client) CreateLabel(req CreateLabelRequest) (*Label, error) {
+	if req.Name == "" {
+		return nil, fmt.Errorf("label name is required")
+	}
+
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	reqURL := fmt.Sprintf("%s/api/labels", c.baseURL)
+	httpReq, err := http.NewRequest("POST", reqURL, bytes.NewBuffer(body))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create label: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result struct {
+		Data Label `json:"Data"`
+	}
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &result.Data, nil
+}
+
+func (c *Client) UpdateLabel(labelID string, req UpdateLabelRequest) (*Label, error) {
+	body, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	reqURL := fmt.Sprintf("%s/api/labels/%s", c.baseURL, url.QueryEscape(labelID))
+	httpReq, err := http.NewRequest("POST", reqURL, bytes.NewBuffer(body))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update label: %w", err)
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var result struct {
+		Data Label `json:"Data"`
+	}
+	if err := json.Unmarshal(respBody, &result); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	return &result.Data, nil
+}
+
+func (c *Client) DeleteLabel(labelID string) error {
+	reqURL := fmt.Sprintf("%s/api/labels/%s", c.baseURL, url.QueryEscape(labelID))
+	httpReq, err := http.NewRequest("POST", reqURL, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return fmt.Errorf("failed to delete label: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("delete failed (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	return nil
+}
+
+// --- Message Labels ---
+
+func (c *Client) ApplyLabel(messageID, labelID string) error {
+	if messageID == "" || labelID == "" {
+		return fmt.Errorf("message ID and label ID are required")
+	}
+
+	body := map[string]string{
+		"LabelID": labelID,
+	}
+	jsonBody, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	reqURL := fmt.Sprintf("%s/api/messages/%s/setlabel", c.baseURL, url.QueryEscape(messageID))
+	httpReq, err := http.NewRequest("POST", reqURL, bytes.NewBuffer(jsonBody))
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return fmt.Errorf("failed to apply label: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("apply label failed (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	return nil
+}
+
+func (c *Client) RemoveLabel(messageID, labelID string) error {
+	if messageID == "" || labelID == "" {
+		return fmt.Errorf("message ID and label ID are required")
+	}
+
+	body := map[string]string{
+		"LabelID": labelID,
+	}
+	jsonBody, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("failed to marshal request: %w", err)
+	}
+
+	reqURL := fmt.Sprintf("%s/api/messages/%s/clearlabel", c.baseURL, url.QueryEscape(messageID))
+	httpReq, err := http.NewRequest("POST", reqURL, bytes.NewBuffer(jsonBody))
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.apiClient.Do(httpReq)
+	if err != nil {
+		return fmt.Errorf("failed to remove label: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("remove label failed (status %d): %s", resp.StatusCode, string(body))
+	}
+
+	return nil
+}

internal/labels/types.go

@@ -0,0 +1,58 @@
+package labels
+
+// Folder represents a ProtonMail folder (system or custom)
+type Folder struct {
+	ID           string `json:"ID"`
+	Name         string `json:"Name"`
+	Type         int    `json:"Type"`
+	MessageCount int    `json:"MessageCount,omitempty"`
+	ParentID     string `json:"ParentID,omitempty"`
+	SortOrder    int    `json:"SortOrder,omitempty"`
+}
+
+// Label represents a user-created label/tag
+type Label struct {
+	ID   string `json:"ID"`
+	Name string `json:"Name"`
+	Color string `json:"Color,omitempty"`
+}
+
+// CreateFolderRequest for creating a new folder
+type CreateFolderRequest struct {
+	Name     string `json:"Name"`
+	ParentID string `json:"ParentID,omitempty"`
+}
+
+// UpdateFolderRequest for updating a folder
+type UpdateFolderRequest struct {
+	Name      string `json:"Name,omitempty"`
+	SortOrder *int   `json:"SortOrder,omitempty"`
+}
+
+// CreateLabelRequest for creating a new label
+type CreateLabelRequest struct {
+	Name  string `json:"Name"`
+	Color string `json:"Color,omitempty"`
+}
+
+// UpdateLabelRequest for updating a label
+type UpdateLabelRequest struct {
+	Name  string  `json:"Name,omitempty"`
+	Color *string `json:"Color,omitempty"`
+}
+
+// LabelMessageRequest for applying/removing labels from messages
+type LabelMessageRequest struct {
+	MessageID string `json:"MessageID"`
+	LabelID   string `json:"LabelID"`
+}
+
+// ListFoldersResponse for listing folders
+type ListFoldersResponse struct {
+	Folders []Folder `json:"Folders"`
+}
+
+// ListLabelsResponse for listing labels
+type ListLabelsResponse struct {
+	Labels []Label `json:"Labels"`
+}

internal/mail/client.go

@@ -238,7 +238,7 @@ func (c *Client) SaveDraft(draft Draft, passphrase string) (string, error) {
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(resp.Body)
+	respBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return "", fmt.Errorf("failed to read response: %w", err)
 	}
@@ -248,7 +248,7 @@ func (c *Client) SaveDraft(draft Draft, passphrase string) (string, error) {
 			MessageID string `json:"MessageID"`
 		} `json:"Data"`
 	}
-	if err := json.Unmarshal(body, &result); err != nil {
+	if err := json.Unmarshal(respBody, &result); err != nil {
 		return "", fmt.Errorf("failed to parse response: %w", err)
 	}
 

internal/mail/pgp.go

@@ -36,50 +36,69 @@ func NewPGPService(privateKeyArmored string) (*PGPService, error) {
 }
 
 func (s *PGPService) Encrypt(plaintext string, recipientPublicKey *crypto.Key) (string, error) {
-	pgpMessage, err := crypto.NewPlainMessage([]byte(plaintext))
+	pgpMessage := crypto.NewPlainMessage([]byte(plaintext))
+
+	recipientKeyRing, err := crypto.NewKeyRing(recipientPublicKey)
 	if err != nil {
-		return "", fmt.Errorf("failed to create PGP message: %w", err)
+		return "", fmt.Errorf("failed to create recipient key ring: %w", err)
 	}
 
-	encrypted, err := pgpMessage.Encrypt(recipientPublicKey)
+	encrypted, err := recipientKeyRing.Encrypt(pgpMessage, nil)
 	if err != nil {
 		return "", fmt.Errorf("failed to encrypt: %w", err)
 	}
 
-	return encrypted.GetArmored()
+	armored, err := encrypted.GetArmored()
+	if err != nil {
+		return "", fmt.Errorf("failed to armor encrypted message: %w", err)
+	}
+
+	return armored, nil
 }
 
 func (s *PGPService) EncryptAndSign(plaintext string, recipientPublicKey *crypto.Key, passphrase string) (string, error) {
-	pgpMessage, err := crypto.NewPlainMessage([]byte(plaintext))
+	pgpMessage := crypto.NewPlainMessage([]byte(plaintext))
+
+	recipientKeyRing, err := crypto.NewKeyRing(recipientPublicKey)
 	if err != nil {
-		return "", fmt.Errorf("failed to create PGP message: %w", err)
+		return "", fmt.Errorf("failed to create recipient key ring: %w", err)
 	}
 
-	encrypted, err := pgpMessage.EncryptAndSign(recipientPublicKey, s.keyRing.PrivateKey, []byte(passphrase))
+	signingKeyRing, err := crypto.NewKeyRing(s.keyRing.PrivateKey)
+	if err != nil {
+		return "", fmt.Errorf("failed to create signing key ring: %w", err)
+	}
+
+	encrypted, err := recipientKeyRing.Encrypt(pgpMessage, signingKeyRing)
 	if err != nil {
 		return "", fmt.Errorf("failed to encrypt and sign: %w", err)
 	}
 
-	return encrypted.GetArmored()
+	armored, err := encrypted.GetArmored()
+	if err != nil {
+		return "", fmt.Errorf("failed to armor encrypted message: %w", err)
+	}
+
+	return armored, nil
 }
 
 func (s *PGPService) Decrypt(encrypted string, passphrase string) (string, error) {
-	armoredKey, err := crypto.NewKeyFromArmored(encrypted)
+	pgpMessage, err := crypto.NewPGPMessageFromArmored(encrypted)
-	if err != nil {
-		return "", fmt.Errorf("failed to parse armored key: %w", err)
-	}
-
-	pgpMessage, err := crypto.NewPlainMessageFromString(armoredKey.GetArmored())
 	if err != nil {
 		return "", fmt.Errorf("failed to parse encrypted message: %w", err)
 	}
 
-	decrypted, err := pgpMessage.Decrypt(s.keyRing.PrivateKey, []byte(passphrase))
+	decryptionKeyRing, err := crypto.NewKeyRing(s.keyRing.PrivateKey)
+	if err != nil {
+		return "", fmt.Errorf("failed to create decryption key ring: %w", err)
+	}
+
+	decrypted, err := decryptionKeyRing.Decrypt(pgpMessage, nil, 0)
 	if err != nil {
 		return "", fmt.Errorf("failed to decrypt: %w", err)
 	}
 
-	return string(decrypted.GetBinary()), nil
+	return decrypted.GetString(), nil
 }
 
 func (s *PGPService) GenerateKeyPair(email string, passphrase string) (privateKey, publicKey string, err error) {
@@ -100,7 +119,7 @@ func (s *PGPService) GenerateKeyPair(email string, passphrase string) (privateKe
 
 	pubArmor := string(pubKeyBytes)
 
-	return string(privateArmor), pubArmor, nil
+	return privateArmor, pubArmor, nil
 }
 
 func (s *PGPService) GetFingerprint() (string, error) {
@@ -112,17 +131,24 @@ func (s *PGPService) GetFingerprint() (string, error) {
 }
 
 func (s *PGPService) SignData(data []byte, passphrase string) (string, error) {
-	pgpMessage, err := crypto.NewPlainMessage(data)
+	pgpMessage := crypto.NewPlainMessage(data)
+
+	signingKeyRing, err := crypto.NewKeyRing(s.keyRing.PrivateKey)
 	if err != nil {
-		return "", fmt.Errorf("failed to create PGP message: %w", err)
+		return "", fmt.Errorf("failed to create signing key ring: %w", err)
 	}
 
-	signed, err := pgpMessage.Sign(s.keyRing.PrivateKey, []byte(passphrase))
+	signed, err := signingKeyRing.SignDetached(pgpMessage)
 	if err != nil {
 		return "", fmt.Errorf("failed to sign data: %w", err)
 	}
 
-	return signed.GetArmored()
+	armored, err := signed.GetArmored()
+	if err != nil {
+		return "", fmt.Errorf("failed to armor signed data: %w", err)
+	}
+
+	return armored, nil
 }
 
 func (s *PGPService) EncryptAttachment(data []byte, recipientPublicKey *crypto.Key) (*Attachment, error) {
@@ -131,32 +157,30 @@ func (s *PGPService) EncryptAttachment(data []byte, recipientPublicKey *crypto.K
 		return nil, fmt.Errorf("failed to generate symmetric key: %w", err)
 	}
 
-	symKeyRing, err := crypto.NewKeyFromArmored(recipientPublicKey.GetArmored())
+	pgpMessage := crypto.NewPlainMessage(data)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse recipient key: %w", err)
-	}
 
-	pgpMessage, err := crypto.NewPlainMessage(data)
+	sk, err := crypto.NewSessionKeyFromToken(symKey, "AES256").Encrypt(pgpMessage)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create PGP message: %w", err)
-	}
-
-	encrypted, err := pgpMessage.Encrypt(symKeyRing)
 	if err != nil {
 		return nil, fmt.Errorf("failed to encrypt attachment: %w", err)
 	}
 
-	encData := []byte(encrypted.GetBinary())
+	// Encrypt the symmetric key with recipient's public key
+	recipientKeyRing, err := crypto.NewKeyRing(recipientPublicKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create recipient key ring: %w", err)
+	}
 
-	encryptedSymKey, err := symKeyRing.Encrypt(symKey)
+	encryptedSymKey, err := recipientKeyRing.EncryptSessionKey(
+		crypto.NewSessionKeyFromToken(symKey, "AES256"),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("failed to encrypt symmetric key: %w", err)
 	}
 
 	return &Attachment{
-		DataEnc: string(encData),
+		DataEnc: string(sk),
 		Keys: []AttachmentKey{{
-			DataEnc: string(encryptedSymKey.GetBinary()),
+			DataEnc: string(encryptedSymKey),
 		}},
 	}, nil
 }
@@ -166,22 +190,17 @@ func (s *PGPService) DecryptAttachment(attachment *Attachment, passphrase string
 		return nil, fmt.Errorf("no keys available for attachment decryption")
 	}
 
-	encryptedSymKey, err := crypto.NewKeyFromArmored(string(attachment.Keys[0].DataEnc))
+	decryptionKeyRing, err := crypto.NewKeyRing(s.keyRing.PrivateKey)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse encrypted symmetric key: %w", err)
+		return nil, fmt.Errorf("failed to create decryption key ring: %w", err)
 	}
 
-	symKey, err := encryptedSymKey.Decrypt([]byte(passphrase))
+	sk, err := decryptionKeyRing.DecryptSessionKey([]byte(attachment.Keys[0].DataEnc))
 	if err != nil {
 		return nil, fmt.Errorf("failed to decrypt symmetric key: %w", err)
 	}
 
-	pgpMessage, err := crypto.NewPlainMessage([]byte(attachment.DataEnc))
+	decrypted, err := sk.Decrypt([]byte(attachment.DataEnc))
-	if err != nil {
-		return nil, fmt.Errorf("failed to create PGP message: %w", err)
-	}
-
-	decrypted, err := pgpMessage.DecryptWithKey(s.keyRing.PrivateKey, symKey)
 	if err != nil {
 		return nil, fmt.Errorf("failed to decrypt attachment: %w", err)
 	}