feat: import-pst — import Microsoft Outlook PST archives

[YourEconProf]

Adds import-pst, a new CLI command to import Microsoft Outlook PST files into msgvault. Complements the existing MBOX, EMLX, and IMAP importers.

What's new

• msgvault import-pst <identifier> <file.pst> — imports all email messages from a PST archive; calendar items, contacts, tasks, and notes are skipped automatically
• PST folder structure is preserved as labels (e.g. Inbox, Sent Items)
• Resumable: interrupt with Ctrl+C and rerun to continue from the last checkpoint; --no-resume to start fresh
• --skip-folder flag to exclude folders (e.g. --skip-folder "Deleted Items")
• --no-attachments flag to skip attachment import
• Content-hash deduplication and cross-folder label merging consistent with other importers
• MIME reconstruction from PST: uses TransportMessageHeaders verbatim when present (~80% of messages); synthesizes RFC 5322 headers from MAPI properties for drafts and Exchange-native sends

Security fixes included

• CRLF injection prevention on synthesized headers (addresses MAPI properties written directly into RFC 5322 headers)
• Path traversal sanitization on attachment filenames
• ContentID sanitization to prevent MIME structure breakage

Dependencies

Adds github.com/mooijtech/go-pst/v6 (Apache 2.0, pure Go).

Usage

msgvault import-pst you@company.com /path/to/archive.pst
msgvault import-pst you@outlook.com backup.pst --skip-folder "Deleted Items"
msgvault import-pst you@outlook.com backup.pst --no-resume

[roborev-ci]

roborev: Combined Review (0eaebb3)

High confidence this PR still has one High and four Medium issues to fix before merge.

High

• internal/importer/pst_import.go:377 and internal/importer/pst_import.go:318
  Checkpoint cursor tracking uses the outer loop variables (currentFolder, currentMsgIdx) instead of the message currently being ingested inside flushPending. If cancellation or a checkpoint interval happens during a flush, the saved checkpoint can point at the last queued message, or the first message of the next folder, causing earlier unflushed messages to be skipped permanently on resume.
  Fix: Store FolderIndex, FolderPath, and MsgIndex on each pending PST message and use those values when calling saveCp() during the flush loop.

Medium

• internal/importer/pst_import.go:209
ImportPst saves an initial checkpoint at folder/message 0 even when resuming an active sync. That overwrites the existing checkpoint before resumed work completes, so a crash before the next checkpoint can make the next run restart from the beginning.
  Fix: Only write the initial checkpoint for a new sync, or preserve the loaded resume position when summary.WasResumed is true.

• internal/importer/pst_import.go:244
  Resume folder validation is skipped when resume.FolderIndex == 0, so a checkpoint inside the first folder can resume against the wrong folder if folder ordering or paths change. The import may skip the first MsgIndex messages from an unrelated folder.
  Fix: Validate whenever resuming with a non-empty FolderPath, including folder index 0.

• internal/pst/mime.go:79 and internal/pst/mime.go:85
att.MIMEType comes from PST data and is written into MIME part headers. If it contains CR/LF, it can inject additional MIME headers or corrupt the message structure.
  Fix: Validate or normalize attachment MIME types before use. Reject control characters, parse with mime.ParseMediaType, and fall back to application/octet-stream on invalid input.

• internal/pst/reader.go:247
  The attachment memory limit can be bypassed when a corrupted or malicious PST reports size 0. att.WriteTo(&buf) may buffer the full payload into memory before the post-read size check runs, risking OOM.
  Fix: Wrap the buffer in a bounded io.Writer that returns an error as soon as the configured byte limit is exceeded.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (7d23b2c)

PST import support looks mostly solid, but there is one Medium issue that can silently ingest incomplete messages.

Medium

• internal/importer/pst_import.go:478: When ReadAttachments fails, the importer logs the error but still imports the message without attachments. Size-limit truncation from ReadAttachments is also surfaced as success with only the attachments read before the limit, so oversized attachment sets can be silently imported as incomplete messages.
  • Fix: Treat attachment read/limit failures as a skipped message or hard error, or preserve a clear marker that attachments were intentionally omitted. Do not ingest reconstructed MIME that silently drops attachments.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)