fix(smartlead): stop email-account tools from emitting mailbox credentials

Connecting a real mailbox to the verification account made the email-account
response shapes observable for the first time, and they carry the stored
credentials: `GET /email-accounts/{id}/` and the campaign route return
`password` in plaintext, the list route returns it base64-encoded, and both
carry `imap_password`.

Both tools passed rows through unmapped, so those values would have reached
workflow output, execution logs, and model context. They now select fields
explicitly and omit the credentials.

Verified against the live API: the API response contains the password while the
tool output does not, for both tools.

Also fills in the real email-account fields, which were previously an opaque
array — id, sender identity, SMTP/IMAP host and port, verification state and
last error, sending caps, warmup status, and tags.

Author: waleedlatif1

apps/sim/tools/generated/tool-outputs.ts

@@ -1,10 +1,11 @@
 import { ErrorExtractorId } from '@/tools/error-extractors'
 import type {
   SmartleadCampaignIdParams,
-  SmartleadOpaqueListResponse,
+  SmartleadEmailAccountsResponse,
 } from '@/tools/smartlead/types'
 import {
-  opaqueListOutputs,
+  emailAccountsOutputs,
+  mapEmailAccount,
   pathSegment,
   smartleadArray,
   smartleadBaseParamFields,
@@ -16,7 +17,7 @@ import type { ToolConfig } from '@/tools/types'
 
 export const listCampaignEmailAccountsTool: ToolConfig<
   SmartleadCampaignIdParams,
-  SmartleadOpaqueListResponse
+  SmartleadEmailAccountsResponse
 > = {
   id: 'smartlead_list_campaign_email_accounts',
   name: 'Smartlead List Campaign Email Accounts',
@@ -34,12 +35,13 @@ export const listCampaignEmailAccountsTool: ToolConfig<
     headers: smartleadHeaders,
   },
   transformResponse: async (response) => {
-    const items = await smartleadArray(response, 'campaign email accounts')
+    const rows = await smartleadArray(response, 'campaign email accounts')
+    const accounts = rows.map(mapEmailAccount)
 
     return {
       success: true,
-      output: { items, count: items.length },
+      output: { accounts, count: accounts.length },
     }
   },
-  outputs: opaqueListOutputs,
+  outputs: emailAccountsOutputs,
 }

apps/sim/tools/smartlead/list_campaign_email_accounts.ts

@@ -1,7 +1,8 @@
 import { ErrorExtractorId } from '@/tools/error-extractors'
-import type { SmartleadBaseParams, SmartleadOpaqueListResponse } from '@/tools/smartlead/types'
+import type { SmartleadBaseParams, SmartleadEmailAccountsResponse } from '@/tools/smartlead/types'
 import {
-  opaqueListOutputs,
+  emailAccountsOutputs,
+  mapEmailAccount,
   smartleadArray,
   smartleadBaseParamFields,
   smartleadHeaders,
@@ -17,7 +18,7 @@ interface ListEmailAccountsParams extends SmartleadBaseParams {
 
 export const listEmailAccountsTool: ToolConfig<
   ListEmailAccountsParams,
-  SmartleadOpaqueListResponse
+  SmartleadEmailAccountsResponse
 > = {
   id: 'smartlead_list_email_accounts',
   name: 'Smartlead List Email Accounts',
@@ -57,12 +58,13 @@ export const listEmailAccountsTool: ToolConfig<
     headers: smartleadHeaders,
   },
   transformResponse: async (response) => {
-    const items = await smartleadArray(response, 'email accounts')
+    const rows = await smartleadArray(response, 'email accounts')
+    const accounts = rows.map(mapEmailAccount)
 
     return {
       success: true,
-      output: { items, count: items.length },
+      output: { accounts, count: accounts.length },
     }
   },
-  outputs: opaqueListOutputs,
+  outputs: emailAccountsOutputs,
 }

apps/sim/tools/smartlead/list_email_accounts.ts

@@ -308,6 +308,45 @@ export interface SmartleadUpsertWebhookResponse extends ToolResponse {
   output: SmartleadSavedWebhook
 }
 
+/** Deliberately omits `password` and `imap_password`, which Smartlead returns. */
+export interface SmartleadEmailAccount {
+  id: number | null
+  from_name: string | null
+  from_email: string | null
+  username: string | null
+  type: string | null
+  smtp_host: string | null
+  smtp_port: number | null
+  smtp_port_type: string | null
+  imap_host: string | null
+  imap_port: number | null
+  imap_port_type: string | null
+  is_smtp_success: boolean | null
+  is_imap_success: boolean | null
+  smtp_failure_error: string | null
+  imap_failure_error: string | null
+  message_per_day: number | null
+  daily_sent_count: number | null
+  campaign_count: number | null
+  signature: string | null
+  custom_tracking_domain: string | null
+  bcc_email: string | null
+  different_reply_to_address: string | null
+  client_id: number | null
+  is_suspended: boolean | null
+  warmup_status: string | null
+  tags: unknown[]
+  created_at: string | null
+  updated_at: string | null
+}
+
+export interface SmartleadEmailAccountsResponse extends ToolResponse {
+  output: {
+    accounts: SmartleadEmailAccount[]
+    count: number
+  }
+}
+
 export interface SmartleadLeadList {
   id: number | null
   list_name: string | null
@@ -430,3 +469,4 @@ export type SmartleadResponse =
   | SmartleadWebhookSummaryResponse
   | SmartleadLeadListsResponse
   | SmartleadLeadListResponse
+  | SmartleadEmailAccountsResponse

apps/sim/tools/smartlead/types.ts

@@ -6,6 +6,7 @@ import type {
   SmartleadCampaignAnalyticsByDate,
   SmartleadCampaignLead,
   SmartleadCampaignLeadStats,
+  SmartleadEmailAccount,
   SmartleadLead,
   SmartleadLeadCampaignData,
   SmartleadLeadCategory,
@@ -450,6 +451,50 @@ export function isOk(record: Record<string, unknown>): boolean {
   return record.ok === true
 }
 
+/**
+ * Selects the email-account fields explicitly rather than passing the record
+ * through. Smartlead returns the mailbox credentials on these endpoints —
+ * `password` in plaintext on the by-id and campaign routes, base64-encoded on the
+ * list route, plus `imap_password` — and a passthrough would surface them in
+ * workflow output, logs, and model context.
+ */
+export function mapEmailAccount(value: unknown): SmartleadEmailAccount {
+  const record = toRecord(value)
+
+  return {
+    id: toNullableNumber(record.id),
+    from_name: toStringOrNull(record.from_name),
+    from_email: toStringOrNull(record.from_email),
+    username: toStringOrNull(record.username),
+    type: toStringOrNull(record.type),
+    smtp_host: toStringOrNull(record.smtp_host),
+    smtp_port: toNullableNumber(record.smtp_port),
+    smtp_port_type: toStringOrNull(record.smtp_port_type),
+    imap_host: toStringOrNull(record.imap_host),
+    imap_port: toNullableNumber(record.imap_port),
+    imap_port_type: toStringOrNull(record.imap_port_type),
+    is_smtp_success: toNullableBoolean(record.is_smtp_success),
+    is_imap_success: toNullableBoolean(record.is_imap_success),
+    smtp_failure_error: toStringOrNull(record.smtp_failure_error),
+    imap_failure_error: toStringOrNull(record.imap_failure_error),
+    message_per_day: toNullableNumber(record.message_per_day),
+    daily_sent_count: toNullableNumber(record.daily_sent_count),
+    campaign_count: toNullableNumber(record.campaign_count),
+    signature: toStringOrNull(record.signature),
+    custom_tracking_domain: toStringOrNull(record.custom_tracking_domain),
+    bcc_email: toStringOrNull(record.bcc_email),
+    different_reply_to_address: toStringOrNull(record.different_reply_to_address),
+    client_id: toNullableNumber(record.client_id),
+    is_suspended: toNullableBoolean(record.is_suspended),
+    warmup_status: isRecordLike(record.warmup_details)
+      ? toStringOrNull(record.warmup_details.status)
+      : null,
+    tags: toArray(record.tags),
+    created_at: toStringOrNull(record.created_at),
+    updated_at: toStringOrNull(record.updated_at),
+  }
+}
+
 export function mapLeadList(value: unknown): SmartleadLeadList {
   const record = toRecord(value)
 
@@ -866,6 +911,51 @@ export const listWebhooksOutputs = {
 
 export const upsertWebhookOutputs = webhookProperties satisfies NonNullable<ToolConfig['outputs']>
 
+const emailAccountProperties = {
+  id: { type: 'number', description: 'Email account ID, used to attach it to a campaign' },
+  from_name: { type: 'string', description: 'Sender display name', optional: true },
+  from_email: { type: 'string', description: 'Sender email address' },
+  username: { type: 'string', description: 'Mailbox username', optional: true },
+  type: { type: 'string', description: 'Account type (GMAIL, OUTLOOK, SMTP)', optional: true },
+  smtp_host: { type: 'string', description: 'SMTP host', optional: true },
+  smtp_port: { type: 'number', description: 'SMTP port', optional: true },
+  smtp_port_type: { type: 'string', description: 'SMTP encryption type', optional: true },
+  imap_host: { type: 'string', description: 'IMAP host', optional: true },
+  imap_port: { type: 'number', description: 'IMAP port', optional: true },
+  imap_port_type: { type: 'string', description: 'IMAP encryption type', optional: true },
+  is_smtp_success: { type: 'boolean', description: 'Whether SMTP verification succeeded' },
+  is_imap_success: { type: 'boolean', description: 'Whether IMAP verification succeeded' },
+  smtp_failure_error: { type: 'string', description: 'Last SMTP error', optional: true },
+  imap_failure_error: { type: 'string', description: 'Last IMAP error', optional: true },
+  message_per_day: { type: 'number', description: 'Daily sending cap', optional: true },
+  daily_sent_count: { type: 'number', description: 'Messages sent today', optional: true },
+  campaign_count: { type: 'number', description: 'Campaigns using this account', optional: true },
+  signature: { type: 'string', description: 'Email signature HTML', optional: true },
+  custom_tracking_domain: { type: 'string', description: 'Custom tracking domain', optional: true },
+  bcc_email: { type: 'string', description: 'BCC address', optional: true },
+  different_reply_to_address: { type: 'string', description: 'Reply-to address', optional: true },
+  client_id: { type: 'number', description: 'Owning client ID', optional: true },
+  is_suspended: {
+    type: 'boolean',
+    description: 'Whether the account is suspended',
+    optional: true,
+  },
+  warmup_status: { type: 'string', description: 'Warmup status', optional: true },
+  tags: { type: 'array', description: 'Tags applied to the account' },
+  created_at: { type: 'string', description: 'Creation timestamp', optional: true },
+  updated_at: { type: 'string', description: 'Last update timestamp', optional: true },
+} satisfies Record<string, OutputProperty>
+
+/** Credentials are intentionally absent — see `mapEmailAccount`. */
+export const emailAccountsOutputs = {
+  accounts: {
+    type: 'array',
+    description: 'Email accounts, excluding their stored mailbox credentials',
+    items: { type: 'object', properties: emailAccountProperties },
+  },
+  count: { type: 'number', description: 'Number of accounts returned' },
+} satisfies NonNullable<ToolConfig['outputs']>
+
 export const duplicateCampaignOutputs = {
   success: { type: 'boolean', description: 'Whether Smartlead duplicated the campaign' },
   id: { type: 'number', description: 'ID of the newly created campaign' },