docs/retention.md covers the 30-day body window, the actions_log row cap, the
audit-row ordering, configuration, unit + deployed verification, deployment on
.13 (commit 453d8a2), scheduling, and rollback. Phase 7's deferred note now
points at the completed work.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
RetainWithAudit now takes only the actor; the store builds the detail after
body clearing so bodies_cleared is a real number, and still writes the row
before the cap.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
RetainWithAudit appends the 'retain' audit row inside the same transaction and
before the cap, so the cap counts it. After a run, actions_log holds at most
EMAIL_AGENT_ACTIONS_LOG_MAX_ROWS rows, including the audit row. Adds a test.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Implements the AGENTS.md §7 data rule: keep message bodies for one month, and
size-cap the append-only action log.
- internal/store/retention.go: Store.Retain clears messages.body_text older
than the window (metadata stays) and deletes actions_log rows beyond the
newest N, in one transaction.
- internal/config: EMAIL_AGENT_RETENTION_DAYS (30) and
EMAIL_AGENT_ACTIONS_LOG_MAX_ROWS (50000).
- cmd/email-agent: bounded -retain flag for the n8n schedule.
- Tests for body clearing, metadata retention, log cap, and disabled policy.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- internal/hub: project side of the frozen ask-contract. GET /capabilities,
read-only POST /ask answerer (no LLM, <3s), and the outbound POST /notify
client.
- internal/apprise: daily-summary delivery through the house Apprise API.
- internal/summary: deterministic plain-text daily summary builder.
- internal/store: CountByCategory, MessagesByCategory, and summary CRUD.
- internal/server: /capabilities and /ask (bearer-token protected), plus the
Reports screen (/reports, build, send, delete).
- main.go: -summary, -summary-send, and -notify CLI entry points for n8n.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- FR-11 rules editor: plain-text area at /rules, saved and versioned
(SaveRules appends a version; restore re-saves an old version), parse
errors surfaced, one-click re-classify. The reply model now reads the
rules document too (FR-11).
- FR-7 unsubscribe: parse and store List-Unsubscribe / List-Unsubscribe-Post
(migration v6), detect email and web links (internal/unsubscribe), a
domain-level ignore list, and an explicit record of what was marked. No
code path contacts an unsubscribe link; acting on one needs Sam's approval.
- Migration v6 is additive; unsubscribe gains url/updated_at.
- Tests: detector, parser, store migration/records/candidates, rules editor,
unsubscribe handlers, message-detail rendering.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The approved real test reply was sent and the thread updated (same
X-GM-THRID as the original). The live test exposed one bug: the thread
check hardcoded Gmail's sent mailbox as "[Gmail]/Sent Mail", but this
account exposes it as "[Google Mail]/Sent Mail".
- internal/mailfetch: LIST parser, ListMailboxes, and SentMailbox that
finds the mailbox flagged \Sent (RFC 6154) with name fallbacks.
- internal/mailops: VerifyThreadUpdated selects the discovered \Sent
mailbox instead of a hardcoded name.
- cmd/email-agent: -check-thread <id> exercises the check against real
Gmail without sending mail.
- Tests for LIST parsing, sent-mailbox discovery, and the discovery
error path.
- docs/phase5-replies.md: record send-as verification, the sent reply's
thread id, the app confirmation (sent_reply_in_thread=true), and the
fix.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Implements Phase 5 of AGENTS.md §11 (FR-8, FR-15):
- Message detail pane (GET /partials/message) with body, recommended
action, reply identity, template picker, editable draft, and history.
- internal/reply: OmniRoute (OpenAI-compatible) chat client and a
template-based draft generator. All non-JEV models go through
OmniRoute (§10).
- internal/mailops: SMTP send over smtp.gmail.com:587 with STARTTLS and
the app password, forcing IPv4 (§9); FR-15 reply identity (send as the
arrived-at X-Pm-Original-To address, else "Sam Rolfe"); threading via
In-Reply-To/References; -check-smtp safe verification; and a
[Gmail]/Sent Mail thread check.
- Migration v5 stores messages.message_id_header and drafts.sent_at;
mailfetch parses Message-ID.
- Send is user-triggered only: CSRF + UI confirm + confirm=yes guard,
no auto-send, duplicate-send refused. A sent reply files the original
under Replied-to/<address> and logs every step (FR-13).
- Tests for reply, mailops SMTP/identity/thread check, store drafts and
migration v5, and the server draft/edit/send guards.
- docs/phase5-replies.md, README, .env.example, docker-compose updated.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Record the DoD evidence for Phase 4: select-all toolbar, live delete ->
Delete label -> restore of message 100 over public HTTPS, the missing-CSRF
403, the two confirmation gates, and the FR-13 action-log rows.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
schema.sql runs before the incremental migrations, so the folder index must
not live there: on a v3 database the column does not exist yet and startup
failed with "no such column: folder". The migration still creates the index.
The regression test opens a hand-built v3 database with the current code.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Implements FR-3, FR-4, FR-5 and FR-14.
- internal/classify: TypeSafe System One (JEV) HTTP client with the confirmed
request/response shape, retry with backoff on 429/529/5xx, a plain-text rule
engine (first match wins, overrides only the named fields), and bounded
orchestration with a per-run cap.
- internal/store: migration v3 adds an editable `categories` table (name =
JEV Choice option and classifications key; rename cascades, remove reassigns)
and seeds a starter rules version once. Classification persistence, coverage,
and pending/all message queries.
- internal/server: POST /actions/classify and /actions/reclassify, plus the
FR-14 category editor (GET /categories and add/rename/remove). The triage list
now groups by the live category list and shows action + confidence.
- CLI: -classify and -classify-all for n8n.
- Docs: docs/phase3-classify.md with the confirmed JEV shape, a live read-only
classification, and the DoD evidence.
DoD: all 100 stored messages have a non-null category, importance, and suggested
action (0 nulls); JEV picked a newly added/renamed category for 6 real messages
over HTTP. One live JEV call recorded in the phase doc.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- internal/mailfetch: stdlib-only read-only IMAP client (LOGIN, SELECT,
UID SEARCH, UID FETCH) that always dials tcp4; IPv6 to Gmail is broken
from .13 and caused a socket EOF.
- MIME parsing to text, RFC2047 header decoding, FR-2 source address:
X-Pm-Original-To -> To -> Received 'for <addr>' -> Return-Path, never
Delivered-To. The matched header is recorded for audit.
- store: Message upsert/list/count + LogAction; schema migration v2 adds
imap_uid and imap_uidvalidity.
- server: dashboard and /partials/inbox render real mail grouped by
category with a recommended action; POST /actions/fetch runs a scan
(CSRF-checked); nav counts; 'Check mail' button.
- config: GMAIL_USER, GMAIL_APP_PASSWORD, IMAP host/port/lookback/max.
- cmd: -fetch runs one scan and exits (n8n/CLI entry point, FR-1).
- compose/.env.example expose the Gmail + IMAP settings.
- tests: FR-2 precedence, MIME bodies, IMAP literal/parser, store
upsert/migration, inbox rendering.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Login and dashboard verified over public HTTPS; record the secret path and
the Paperclip card cascade limitation that forced direct configuration.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Container email-agent live on .13:8790; Caddy route on .35 serves
mail.lab.audasmedia.com.au with a Let's Encrypt cert. Login + dashboard
await the board-gated EMAIL_AGENT_SESSION_SECRET.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Session login for the single user Sam: server-side session store with an
HMAC-signed session cookie, POST /login, POST /logout, and double-submit
CSRF on every form post. Unauthenticated requests to / and /partials/*
redirect to /login?next=...
- Empty dashboard shell in the Family Home Lab design system: left nav
(category and folder placeholders), centre list, right detail pane.
- Copy tokens.css and the self-hosted Inter fonts from the family-home-lab
design system into web/static; vendor htmx 2.0.4. No cross-project imports
at runtime.
- Dark mode via prefers-color-scheme plus a persisted toggle; phone-first
layout with 44px touch targets, hairline borders, 8px grid, pill CTAs.
- Config: EMAIL_AGENT_PASSWORD for the login password, falling back to
EMAIL_AGENT_SESSION_SECRET so one configured secret is enough.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Call out two facts that already caused a confusing failure, before the
build phases begin:
1. Force IPv4 for every Gmail connection (IMAP and SMTP).
2. The source address header is X-Pm-Original-To; never use Delivered-To.
Additive only. No FR id, phase id, or other section is changed.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The unanchored `email-agent` ignore rule matched the `cmd/email-agent/`
directory as well as the root build artifact, so the service entry point was
never committed and a fresh clone could not build. Anchor the rule to the repo
root (`/email-agent`).
This completes the Phase 1.1 tracked tree (AUD-58): entry point, config, SQLite
store, HTTP server, Dockerfile and compose.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Capture the AUD-60 deploy facts (port 8790, Caddy on .35, wildcard DNS,
reload command) as a repo runbook. Prepared for AUD-61; do not execute
until AUD-58 and AUD-59 are done.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
