@beryl-so/cli 0.24.1 → 0.25.0

package/dist/commands/mailboxes.js

@@ -1,4 +1,4 @@
-import { extractCode } from "../email-extract.js";
+import { ApiError } from "../http.js";
 import { dim, green, table } from "../output.js";
 import { arg, flagBool, flagNum, flagStr, projectPath } from "./util.js";
 const mailboxPath = (ws) => `/workspaces/${ws}/mailboxes`;
@@ -89,7 +89,8 @@ export const mailboxCommands = [
         summary: "Read the latest email in a mailbox (waits for one to arrive)",
         description: "Waits up to --timeout-s for a matching email and returns it (one blocking request; " +
             "the server caps the wait at 50s — re-run to keep waiting). With --extract-code, " +
-            "also pulls the one-time code (4-8 digits) out of the body/subject. Use " +
+            "also asks the server to pull the one-time code out of the email (AI-assisted when " +
+            "the email is ambiguous; `code` is null if none was found). Use " +
             "--recipient-contains to read only one `+tag` alias's mail when several identities " +
             "share the mailbox. Exits non-zero if nothing arrives before the timeout. Waits for " +
             "and returns ONE latest matching email — `mailbox emails` lists what has already " +
@@ -126,7 +127,8 @@ export const mailboxCommands = [
         ],
         async run(ctx, input) {
             const { workspaceId } = await ctx.requireProject(input);
-            const email = (await ctx.client.get(`${mailboxPath(workspaceId)}/${arg(input, "mailbox-id")}/emails/latest`, {
+            const mailboxId = arg(input, "mailbox-id");
+            const email = (await ctx.client.get(`${mailboxPath(workspaceId)}/${mailboxId}/emails/latest`, {
                 timeout_s: flagNum(input, "timeout-s"),
                 since: flagStr(input, "since"),
                 from_contains: flagStr(input, "from-contains"),
@@ -135,7 +137,18 @@ export const mailboxCommands = [
             }));
             if (!flagBool(input, "extract-code"))
                 return { data: email };
-            return { data: { ...email, code: extractCode(email) } };
+            // Extraction is the server's job (the same brain runs use, AI included); a 422
+            // means the email genuinely carries no code.
+            try {
+                const extracted = (await ctx.client.post(`${mailboxPath(workspaceId)}/${mailboxId}/emails/${email.id}/extract`, { extract: "code" }));
+                return { data: { ...email, code: extracted.value } };
+            }
+            catch (err) {
+                if (err instanceof ApiError && err.status === 422) {
+                    return { data: { ...email, code: null } };
+                }
+                throw err;
+            }
         },
     },
     {

package/dist/email-pump.js

@@ -1,10 +1,10 @@
 import fs from "node:fs";
-import { extractValue } from "./email-extract.js";
 import { ApiError } from "./http.js";
 const SIDECAR_POLL_MS = 500;
 // The server caps one blocking wait at 50s; stay under it and loop.
 const SERVER_WAIT_MAX_S = 45;
 const DEFAULT_WAIT_S = 30;
+const EXTRACT_RETRY_MS = 1000;
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export function startEmailPump(opts) {
     let stopped = false;
@@ -29,11 +29,36 @@ export function startEmailPump(opts) {
             throw err;
         }
     };
+    // A 422 is a real verdict — "this email carries no artifact" — and sends the wait on
+    // to the next email; anything else is transport trouble, retried until the step's own
+    // deadline does the failing.
+    const extractOnServer = async (emailId, req, deadline) => {
+        while (!stopped && Date.now() < deadline) {
+            try {
+                const res = (await opts.client.post(`/workspaces/${opts.workspaceId}/mailboxes/${opts.inboxId}/emails/${emailId}/extract`, { extract: req.extract ?? "code", extract_pattern: req.pattern }));
+                if (res.source === "ai")
+                    opts.onEvent?.("await_email: the AI extractor answered");
+                return { ok: true, value: res.value };
+            }
+            catch (err) {
+                if (err instanceof ApiError && err.status === 422) {
+                    const detail = typeof err.detail === "string" ? err.detail : err.message;
+                    return {
+                        ok: false,
+                        error: detail.replace(/^EMAIL_EXTRACTION_FAILED:\s*/, ""),
+                    };
+                }
+                await sleep(EXTRACT_RETRY_MS);
+            }
+        }
+        return { ok: false, error: "extraction did not complete before the wait deadline" };
+    };
     const resolveRequest = async (req) => {
         // Wait exactly wait_s, like the cloud resolver — the spec's own grace window
         // covers this side's poll tick + round trip.
         const waitS = Math.max(1, Number(req.wait_s) || DEFAULT_WAIT_S);
         const deadline = Date.now() + waitS * 1000;
+        let lastExtractError;
         while (!stopped && Date.now() < deadline) {
             const remainingS = Math.ceil((deadline - Date.now()) / 1000);
             const email = await fetchLatest(req, Math.min(SERVER_WAIT_MAX_S, remainingS));
@@ -48,9 +73,15 @@ export function startEmailPump(opts) {
             consumed.add(email.id);
             since = email.received_at;
             opts.onEvent?.(`await_email: matched "${email.subject ?? "(no subject)"}"`);
-            return extractValue(email, String(req.extract ?? "code"), req.pattern);
+            const extracted = await extractOnServer(email.id, req, deadline);
+            if (extracted.ok)
+                return extracted.value;
+            // Same move as the cloud resolver: an email without the artifact (a welcome mail
+            // racing the code mail) is consumed and the wait continues for the next one.
+            lastExtractError = extracted.error;
+            opts.onEvent?.(`await_email: ${extracted.error} — waiting for the next email`);
         }
-        throw new Error(`no matching email arrived in the run inbox within ${waitS}s`);
+        throw new Error(lastExtractError ?? `no matching email arrived in the run inbox within ${waitS}s`);
     };
     const writeResponse = (response) => {
         let box = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beryl-so/cli",
-  "version": "0.24.1",
+  "version": "0.25.0",
   "description": "Beryl on the command line — projects, runs, the exploring agent, and an MCP server over the same commands.",
   "license": "MIT",
   "type": "module",

package/dist/email-extract.js

@@ -1,99 +0,0 @@
-import vm from "node:vm";
-// A labelled digit run ("your code is 654321") beats the bare fenced pattern, because a
-// real sign-in mail is full of innocent 4-8 digit runs — "© 2026", a support number —
-// and the bare fence would happily return the first of them.
-const CODE_PATTERN = /(?<!\d)(\d{4,8})(?!\d)/;
-const LABELLED_CODE_PATTERN = /(?:verification|security|one[\s-]?time|login|sign[\s-]?in|access|confirmation)?\s*(?:code|otp|passcode|pin)\b[^0-9]{0,20}(?<!\d)(\d{4,8})(?!\d)/i;
-const LINK_PATTERN = /https:\/\/[^\s"'<>)\]]+/;
-// An anchor's href is the click target in an HTML mail; a bare URL scan over raw markup
-// would return a CSS background or tracking pixel instead.
-const HREF_PATTERN = /<a\b[^>]*\bhref\s*=\s*["']?(https:\/\/[^\s"'>]+)/gi;
-// Footer furniture a sign-in mail carries but nobody means.
-const LINK_NOISE = [
-    "unsubscribe",
-    "/privacy",
-    "/terms",
-    "list-manage",
-    "mailchimp",
-    "sendgrid.net",
-    "/track/",
-    "/wf/open",
-    "twitter.com",
-    "facebook.com",
-    "linkedin.com",
-];
-// Matches the server's EMAIL_PATTERN_MAX_BODY_CHARS bound: backtracking cost scales with
-// haystack length, and no real sign-in code lives past the first few KB of an email.
-const PATTERN_MAX_BODY_CHARS = 20_000;
-const PATTERN_TIMEOUT_MS = 2_000;
-// An author-supplied regex against a sender-supplied body is the textbook ReDoS setup,
-// and native RegExp cannot be interrupted once it starts. Running the match inside a vm
-// context gives it a real wall-clock deadline — V8 services the timeout interrupt while
-// backtracking — matching the server's regex-engine timeout, whatever the pattern is.
-function matchWithDeadline(haystack, pattern) {
-    try {
-        return vm.runInNewContext("haystack.match(new RegExp(pattern))", { haystack, pattern }, { timeout: PATTERN_TIMEOUT_MS });
-    }
-    catch (err) {
-        const code = err?.code;
-        if (code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || /timed out/i.test(String(err))) {
-            throw new Error("the extract_pattern took too long to match this email — it backtracks " +
-                "explosively (an ambiguous quantifier like (a+)+ or (a|a)+ does this). " +
-                "Rewrite it to match unambiguously.");
-        }
-        throw err;
-    }
-}
-export function visibleText(html) {
-    return html
-        .replace(/<(style|script|head)\b[\s\S]*?<\/\1>/gi, " ")
-        .replace(/<[^>]+>/g, " ");
-}
-function bodyOf(email) {
-    if (email.body_text)
-        return email.body_text;
-    if (email.body_html)
-        return visibleText(email.body_html);
-    return "";
-}
-export function extractCode(email) {
-    for (const pattern of [LABELLED_CODE_PATTERN, CODE_PATTERN]) {
-        for (const text of [bodyOf(email), email.subject ?? ""]) {
-            const match = text.match(pattern);
-            if (match)
-                return match[1];
-        }
-    }
-    return null;
-}
-export function extractLink(email) {
-    const html = email.body_html ?? "";
-    const hrefs = [...html.matchAll(HREF_PATTERN)].map((m) => m[1]);
-    const candidates = hrefs.length > 0 ? hrefs : (bodyOf(email).match(LINK_PATTERN) ?? []);
-    for (const url of candidates) {
-        if (!LINK_NOISE.some((noise) => url.toLowerCase().includes(noise)))
-            return url;
-    }
-    if (candidates.length > 0) {
-        throw new Error("the email's only links look like footer/unsubscribe links, not a sign-in link");
-    }
-    throw new Error("the email arrived but carried no https link to follow");
-}
-export function extractValue(email, extract, pattern) {
-    if (extract === "link")
-        return extractLink(email);
-    const body = bodyOf(email);
-    if (extract === "pattern") {
-        if (!pattern)
-            throw new Error("extract=pattern needs an extract_pattern");
-        const match = matchWithDeadline(body.slice(0, PATTERN_MAX_BODY_CHARS), pattern);
-        if (!match) {
-            throw new Error("the email arrived but nothing in it matched the extract_pattern");
-        }
-        return match[1] ?? match[0];
-    }
-    const code = extractCode(email);
-    if (!code)
-        throw new Error("the email arrived but carried no 4-8 digit sign-in code");
-    return code;
-}