pikuri-thunderbird 0.1.0

data/lib/pikuri-thunderbird.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require 'pikuri-core'
+
+# Entry file for the pikuri-thunderbird gem: local Thunderbird mail +
+# calendar search/read for a pikuri agent, home of the
+# +bin/pikuri-thunderbird+ no-egress demo. {Pikuri::Thunderbird::Extension}
+# is the one-call wiring; it reads Thunderbird's own on-disk profile
+# ({Pikuri::Thunderbird::Profile} discovers it) and never touches the
+# network.
+#
+# The load-bearing posture (v1): search + read are inbound-only, so an
+# agent wired with only these tools has private data + untrusted content
+# but *no egress leg* — the lethal trifecta is broken by construction, the
+# same model as +bin/pikuri-corpus+. Outbound actions (compose / create
+# event) are v2 and are always human-gated hand-offs to Thunderbird's own
+# UI. Threat model: +DESIGN.md+; design rationale: +ideas/thunderbird.md+.
+Pikuri::PROMPT_DIRS << File.expand_path('../prompts', __dir__)
+
+module Pikuri
+  module Thunderbird
+    # Legs of the five inbound tools: a mailbox and a calendar are private by
+    # *domain*, and their contents are written by whoever mailed you.
+    #
+    # The +private: true+ is the one place the framework declares that leg for
+    # you, and it is a narrow exception rather than a breach of the rule that
+    # the user declares sensitivity: elsewhere the framework cannot tell
+    # +~/work/scratch+ from +~/work/payroll+, but a *mailbox* is sensitive by
+    # what it is, not by how it was configured. Nothing was inspected to know
+    # this — only the tool's domain.
+    #
+    # @return [Pikuri::Tool::TrifectaLegs]
+    INBOUND_LEGS = Pikuri::Tool::TrifectaLegs.new(
+      private: true, untrusted: :hard, egress_payload_review: :no_egress
+    ).freeze
+
+    # Legs of the two opt-in outbound hand-offs.
+    #
+    # +:human_reviewed+ rather than +:unreviewed+ because all four clauses of
+    # the approver seat hold, and the load-bearing one is payload visibility:
+    # the human commits in Thunderbird's own compose window / import wizard, so
+    # what is on screen *is* what leaves, byte for byte. That is why these are
+    # graded differently from a confirmer-gated shell command, where the human
+    # approves a program whose output was never shown.
+    #
+    # The destination stays +:attacker_reachable+, and the pair is the clearest
+    # proof the two egress axes are orthogonal: the recipient is a drafted
+    # field, so an injection can address the mail to itself and a reviewed
+    # payload still lands in an inbox the attacker reads.
+    #
+    # It stays true only while the outbound surface carries nothing but fields
+    # that render literally — no attachments, no HTML body. A tool that gained
+    # one would silently drop to hard +:egress+, since the human would be
+    # approving a reference to bytes nobody saw.
+    #
+    # No +private+, unlike {INBOUND_LEGS}: these *send*, they do not read the
+    # mailbox. The one trickle back is {ComposeGuard}'s recipient-novelty note,
+    # and it is a single incidental bit about an address the model itself
+    # supplied — worthless under attack, where a novel recipient is expected by
+    # construction. The private leg grades what a tool lets an attacker
+    # **query** over the pool, not whether any bit at all flows back.
+    #
+    # @return [Pikuri::Tool::TrifectaLegs]
+    OUTBOUND_LEGS = Pikuri::Tool::TrifectaLegs.new(
+      private: false, untrusted: :none,
+      egress_payload_review: :human_reviewed, egress_destination: :attacker_reachable
+    ).freeze
+
+    LOADER = Zeitwerk::Loader.new
+    LOADER.tag = 'pikuri-thunderbird'
+    LOADER.push_dir(__dir__)
+    LOADER.ignore(File.expand_path('pikuri-thunderbird.rb', __dir__))
+    LOADER.setup
+    LOADER.eager_load
+  end
+end

data/prompts/thunderbird.txt

@@ -0,0 +1,5 @@
+You are a helpful assistant for the user's own local Thunderbird data — their
+stored mail and their calendars. You help them find messages and events, recall
+what was said, and answer questions grounded in what is actually there.
+
+Be concise. Lead with the answer, then the supporting details.

metadata

@@ -0,0 +1,114 @@
+--- !ruby/object:Gem::Specification
+name: pikuri-thunderbird
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Martin Vysny
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: pikuri-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.9'
+description: |
+  pikuri-thunderbird lets a pikuri agent search and read the user's
+  *local* Thunderbird data — mail folders and cached calendars — by
+  reading Thunderbird's own on-disk profile. It never speaks
+  IMAP/POP3/SMTP itself and never egresses: search and read are both
+  inbound-only, so the v1 demo (+bin/pikuri-thunderbird+) breaks the
+  lethal trifecta by construction, exactly like +bin/pikuri-corpus+.
+
+  Mail search rides Thunderbird's Gloda index
+  (+global-messages-db.sqlite+) as a pre-decoded corpus: pikuri copies a
+  consistent snapshot, builds its own ephemeral FTS5 index over the
+  decoded columns, and serves ranked search + full-body reads with no
+  MIME parsing. Calendar reads come from the +calendar-data/*.sqlite+
+  stores (normalized columns, no ICS parser for the common case).
+
+  Any *outbound* action (compose a mail, create an event) is a v2
+  feature and is always a human-gated hand-off to Thunderbird's own UI —
+  pikuri writes nothing to Thunderbird's stores and sends nothing itself.
+  See +pikuri-thunderbird/DESIGN.md+ and +ideas/thunderbird.md+.
+email:
+- martin@vysny.me
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- DESIGN.md
+- README.md
+- lib/pikuri-thunderbird.rb
+- lib/pikuri/thunderbird/calendar.rb
+- lib/pikuri/thunderbird/calendar_create.rb
+- lib/pikuri/thunderbird/calendar_read.rb
+- lib/pikuri/thunderbird/calendar_search.rb
+- lib/pikuri/thunderbird/compose_guard.rb
+- lib/pikuri/thunderbird/contact_search.rb
+- lib/pikuri/thunderbird/database_snapshot.rb
+- lib/pikuri/thunderbird/date_helpers.rb
+- lib/pikuri/thunderbird/extension.rb
+- lib/pikuri/thunderbird/gloda.rb
+- lib/pikuri/thunderbird/gloda/contacts.rb
+- lib/pikuri/thunderbird/gloda/mail.rb
+- lib/pikuri/thunderbird/ical_line.rb
+- lib/pikuri/thunderbird/ics_event.rb
+- lib/pikuri/thunderbird/launcher.rb
+- lib/pikuri/thunderbird/mail_compose.rb
+- lib/pikuri/thunderbird/mail_read.rb
+- lib/pikuri/thunderbird/mail_search.rb
+- lib/pikuri/thunderbird/mailto_uri.rb
+- lib/pikuri/thunderbird/profile.rb
+- prompts/thunderbird.txt
+homepage: https://codeberg.org/mvysny/pikuri
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://codeberg.org/mvysny/pikuri/src/branch/master
+  changelog_uri: https://codeberg.org/mvysny/pikuri/src/branch/master/CHANGELOG.md
+  bug_tracker_uri: https://codeberg.org/mvysny/pikuri/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.3'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: Local Thunderbird mail + calendar tools for pikuri.
+test_files: []