@bobfrankston/rmfmail 1.2.128 → 1.2.130

package/bin/popout-server.ts

@@ -29,6 +29,11 @@ import { dispatch } from "@bobfrankston/mailx-service/jsonrpc.js";
 export interface PopoutServerInfo {
     port: number;
     token: string;
+    /** Agent tokens (written to ~/.rmfmail/agent.json for third-party apps
+     *  and AI agents). `triage` = reads + flagging; `full` = everything the
+     *  UI can do. Sending remains a human act by convention — the MCP layer
+     *  exposes drafts, not send. */
+    agentTokens: { triage: string; full: string };
     /** Push a daemon event to every connected popout/secondary window
      *  (SSE). The main window gets events over the msger service channel;
      *  popout-served pages subscribe to GET /events and receive the same
@@ -49,6 +54,18 @@ export interface PopoutAction {
  *  window. Returns null if the server can't bind (popout disabled). */
 export async function startPopoutServer(svc: any, onAction?: (act: PopoutAction) => void): Promise<PopoutServerInfo | null> {
     const token = crypto.randomBytes(18).toString("hex");
+    const agentTokens = { triage: crypto.randomBytes(18).toString("hex"), full: crypto.randomBytes(18).toString("hex") };
+    // Actions a TRIAGE-scoped agent may call: reads plus flag/read-state.
+    // Deliberately excludes send/move/delete/settings and every popout/window
+    // action. Full-scope agents get the whole dispatcher.
+    const TRIAGE_ACTIONS = new Set([
+        "getVersion", "getAccounts", "getFolders", "getMessages", "getUnifiedInbox",
+        "getMessage", "searchMessages", "getThreadMessages", "getAttachment",
+        "getMessageSource", "searchContacts", "listContacts", "getCalendarEvents",
+        "getCalendars", "getTasks", "getOutboxStatus", "getSyncPending",
+        "getDiagnostics", "getPriorityLists", "hasCcHistoryTo", "hasBccHistoryTo",
+        "updateFlags", "markFolderRead", "logClientEvent",
+    ]);
     // Static root for /app/<token>/... — the app package root, so pages under
     // client/ can reach ../styles, ../../node_modules etc. exactly as they do
     // through msger's custom protocol.
@@ -69,12 +86,18 @@ export async function startPopoutServer(svc: any, onAction?: (act: PopoutAction)
                     res.writeHead(403).end("forbidden");
                     return;
                 }
-                await serveStatic(appRoot, staticMatch[2], token, res);
+                await serveStatic(appRoot, staticMatch[2], token, res, svc);
                 return;
             }
 
             // Token gate on every request — loopback TCP is locally reachable.
-            if (url.searchParams.get("t") !== token) {
+            // Three tokens: the per-launch window token (full surface), and two
+            // agent tokens published in ~/.rmfmail/agent.json.
+            const presented = url.searchParams.get("t");
+            const isWindowToken = presented === token;
+            const isFullAgent = presented === agentTokens.full;
+            const isTriageAgent = presented === agentTokens.triage;
+            if (!isWindowToken && !isFullAgent && !isTriageAgent) {
                 res.writeHead(403).end("forbidden");
                 return;
             }
@@ -109,6 +132,11 @@ export async function startPopoutServer(svc: any, onAction?: (act: PopoutAction)
                     res.writeHead(400).end("bad rpc request");
                     return;
                 }
+                if (isTriageAgent && !TRIAGE_ACTIONS.has(rpcReq._action)) {
+                    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+                    res.end(JSON.stringify({ _cbid: rpcReq._cbid, error: `action "${rpcReq._action}" requires the full agent token (triage scope is reads + flags)` }));
+                    return;
+                }
                 const rpcRes = await dispatch(svc, rpcReq);
                 res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
                 res.end(JSON.stringify(rpcRes));
@@ -183,7 +211,7 @@ export async function startPopoutServer(svc: any, onAction?: (act: PopoutAction)
             const port = typeof addr === "object" && addr ? addr.port : 0;
             if (port) {
                 console.log(`  [popout] window server on http://127.0.0.1:${port} (loopback, token-gated)`);
-                resolve({ port, token, broadcastEvent });
+                resolve({ port, token, agentTokens, broadcastEvent });
             } else {
                 resolve(null);
             }
@@ -210,7 +238,7 @@ const STATIC_MIME: Record<string, string> = {
  *  the IPC-over-HTTP bridge injected at the top of <head>: config + bridge
  *  (window.ipc → POST /rpc) + the REAL mailxapi.js — so the page runs the
  *  byte-identical API surface the main WebView gets via initScript. */
-async function serveStatic(appRoot: string, relRaw: string, token: string, res: http.ServerResponse): Promise<void> {
+async function serveStatic(appRoot: string, relRaw: string, token: string, res: http.ServerResponse, svc?: any): Promise<void> {
     const rel = decodeURIComponent(relRaw);
     const abs = path.resolve(appRoot, rel);
     // Traversal guard — resolved path must stay inside the app root.
@@ -237,7 +265,15 @@ async function serveStatic(appRoot: string, relRaw: string, token: string, res:
         // after parse but in DOCUMENT ORDER, so the bridge still executes
         // before the page's own module (compose.bundle.js) makes any RPC.
         // mailxapi.js stays classic — it's the same file every host injects.
-        const inject = `<script>window.__rmfPopoutRpc={url:"/rpc?t=${token}",events:"/events?t=${token}"};</script>`
+        //
+        // Settings snapshot baked into the page: popout windows live on a
+        // per-port origin whose localStorage caches (editor type, font size)
+        // start EMPTY on every daemon restart — a reply opened in Quill when
+        // TinyMCE was selected (Bob 2026-07-12). Pages prefer this snapshot
+        // over their localStorage caches; ui subset keeps the payload small.
+        let bootUi: any = null;
+        try { bootUi = (await svc?.getSettings?.())?.ui ?? null; } catch { /* page falls back to defaults */ }
+        const inject = `<script>window.__rmfPopoutRpc={url:"/rpc?t=${token}",events:"/events?t=${token}"};window.__rmfBootSettings=${JSON.stringify({ ui: bootUi })};</script>`
             + `<script type="module" src="/app/${token}/client/lib/popout-bridge.js"></script>`
             + `<script src="/app/${token}/client/lib/mailxapi.js"></script>`;
         const html = data.toString("utf-8").replace(/<head([^>]*)>/i, (m) => m + inject);

package/client/compose/compose.bundle.js

@@ -3851,10 +3851,15 @@ async function loadEditorAssets(type) {
 }
 var editorType = "quill";
 var appSettings = null;
-try {
-  const cached = localStorage.getItem("mailx-editor-type");
-  if (cached === "tiptap" || cached === "quill" || cached === "tinymce") editorType = cached;
-} catch {
+var __bootUi = window.__rmfBootSettings?.ui || null;
+if (__bootUi?.editor === "tiptap" || __bootUi?.editor === "quill" || __bootUi?.editor === "tinymce") {
+  editorType = __bootUi.editor;
+} else {
+  try {
+    const cached = localStorage.getItem("mailx-editor-type");
+    if (cached === "tiptap" || cached === "quill" || cached === "tinymce") editorType = cached;
+  } catch {
+  }
 }
 var COMPOSE_FONT_MIN_PX = 8;
 var COMPOSE_FONT_MAX_PX = 32;
@@ -3864,7 +3869,8 @@ function applyComposeFontSize(px) {
   document.documentElement.style.setProperty("--compose-font-size", `${px}px`);
 }
 try {
-  applyComposeFontSize(Number(localStorage.getItem("mailx-compose-font-size")));
+  const bootFont = Number(__bootUi?.composeFontSize);
+  applyComposeFontSize(Number.isFinite(bootFont) && bootFont > 0 ? bootFont : Number(localStorage.getItem("mailx-compose-font-size")));
 } catch {
   applyComposeFontSize(COMPOSE_FONT_DEFAULT_PX);
 }