@essentialai/cogent-bridge 3.16.0 → 3.18.0

package/dist/tools/rotate-mail-creds.d.ts

@@ -0,0 +1,15 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * cogent_rotate_mail_creds — self-service mailbox password rotation (Cogent Mail M2.4).
+ *
+ * Re-keys THIS agent's Team mailbox: the bridge asks the relay (authenticated by the per-cwd cloud
+ * session token) to rotate on the mail server; the relay derives orgScope + channel label from the
+ * session (never client input) so the box is targeted deterministically. On success the fresh
+ * password is returned ONCE and written to the per-cwd 0600 mail-credential store, so subsequent
+ * cogent_send_mail / cogent_fetch_mail keep working. Use it if a mailbox password may be compromised.
+ *
+ * Cloud + Team only: it needs cloud credentials (endpoint/session/token/peerId) and a CP-provisioned
+ * mailbox. A free/local session gets a clear "rotation isn't available for this channel" error.
+ */
+export declare function registerRotateMailCredsTool(server: McpServer): void;
+//# sourceMappingURL=rotate-mail-creds.d.ts.map

package/dist/tools/rotate-mail-creds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-mail-creds.d.ts","sourceRoot":"","sources":["../../src/tools/rotate-mail-creds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAYpE;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAqFnE"}

package/dist/tools/rotate-mail-creds.js

@@ -0,0 +1,83 @@
+import { successResult, errorResult, BridgeError, BridgeErrorCode } from "../errors.js";
+import { loadCredentials } from "../cloud/credential-store.js";
+import { loadMailCredentials, saveMailCredentials, MAIL_DEFAULT_HOST, } from "../cloud/mail-credential-store.js";
+/** Total budget for the relay round-trip. */
+const ROTATE_TIMEOUT_MS = 8000;
+/**
+ * cogent_rotate_mail_creds — self-service mailbox password rotation (Cogent Mail M2.4).
+ *
+ * Re-keys THIS agent's Team mailbox: the bridge asks the relay (authenticated by the per-cwd cloud
+ * session token) to rotate on the mail server; the relay derives orgScope + channel label from the
+ * session (never client input) so the box is targeted deterministically. On success the fresh
+ * password is returned ONCE and written to the per-cwd 0600 mail-credential store, so subsequent
+ * cogent_send_mail / cogent_fetch_mail keep working. Use it if a mailbox password may be compromised.
+ *
+ * Cloud + Team only: it needs cloud credentials (endpoint/session/token/peerId) and a CP-provisioned
+ * mailbox. A free/local session gets a clear "rotation isn't available for this channel" error.
+ */
+export function registerRotateMailCredsTool(server) {
+    server.registerTool("cogent_rotate_mail_creds", {
+        title: "Rotate this agent's mailbox password",
+        description: "Rotate (re-key) this agent's Team mailbox password on the mail server and update the local " +
+            "credential store, so cogent_send_mail / cogent_fetch_mail keep working with the fresh secret. " +
+            "Use it if the mailbox password may be compromised. Team channels only.",
+        inputSchema: {},
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    }, async () => {
+        try {
+            const creds = await loadCredentials();
+            if (!creds || !creds.endpoint || !creds.sessionId || !creds.token) {
+                throw new BridgeError(BridgeErrorCode.INVALID_INPUT, "Not registered in cloud mode", "Rotation applies to a cloud Team channel — register the peer first");
+            }
+            if (!creds.peerId) {
+                throw new BridgeError(BridgeErrorCode.INVALID_INPUT, "Cannot identify this peer", "Re-register the peer so its peerId is stored, then rotate");
+            }
+            const url = `${creds.endpoint.replace(/\/+$/, "")}/api/sessions/${encodeURIComponent(creds.sessionId)}` +
+                `/peers/${encodeURIComponent(creds.peerId)}/mail/rotate`;
+            let res;
+            try {
+                res = await fetch(url, {
+                    method: "POST",
+                    headers: { "content-type": "application/json", authorization: `Bearer ${creds.token}` },
+                    body: "{}",
+                    signal: AbortSignal.timeout(ROTATE_TIMEOUT_MS),
+                });
+            }
+            catch {
+                throw new BridgeError(BridgeErrorCode.NETWORK_TIMEOUT, "Could not reach the relay to rotate the mailbox", "Check connectivity and try again");
+            }
+            if (!res.ok) {
+                // The relay maps a non-Team / no-rotator channel to a 400 with a clear message.
+                const detail = await res.text().catch(() => "");
+                throw new BridgeError(BridgeErrorCode.INVALID_INPUT, `Mailbox rotation was rejected (HTTP ${res.status})`, detail.slice(0, 200) || "Rotation applies to Team channels with a provisioned mailbox");
+            }
+            const data = (await res.json().catch(() => null));
+            if (!data || data.success !== true) {
+                throw new BridgeError(BridgeErrorCode.NETWORK_TIMEOUT, "Mailbox rotation failed", "The relay returned an unexpected response");
+            }
+            if (!data.rotated) {
+                // Clean "nothing to rotate" (no mailbox) — do NOT touch the local creds.
+                return successResult({ rotated: false, reason: data.reason ?? "no_mailbox" });
+            }
+            if (!data.address || !data.password) {
+                throw new BridgeError(BridgeErrorCode.NETWORK_TIMEOUT, "Rotation returned no new password", "Try again; the mailbox password was not updated locally");
+            }
+            // Persist the fresh secret, preserving the existing host/port config where present.
+            const existing = await loadMailCredentials();
+            await saveMailCredentials({
+                address: data.address,
+                password: data.password,
+                imapHost: existing?.imapHost ?? MAIL_DEFAULT_HOST,
+                imapPort: existing?.imapPort ?? 993,
+                smtpHost: existing?.smtpHost ?? MAIL_DEFAULT_HOST,
+                smtpPort: existing?.smtpPort ?? 465,
+                savedAt: new Date().toISOString(),
+            });
+            return successResult({ rotated: true, address: data.address });
+        }
+        catch (err) {
+            return errorResult(err);
+        }
+    });
+}
+//# sourceMappingURL=rotate-mail-creds.js.map

package/dist/tools/rotate-mail-creds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-mail-creds.js","sourceRoot":"","sources":["../../src/tools/rotate-mail-creds.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,mCAAmC,CAAC;AAE3C,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,6FAA6F;YAC7F,gGAAgG;YAChG,wEAAwE;QAC1E,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACzG,EACD,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAClE,MAAM,IAAI,WAAW,CACnB,eAAe,CAAC,aAAa,EAC7B,8BAA8B,EAC9B,oEAAoE,CACrE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,IAAI,WAAW,CACnB,eAAe,CAAC,aAAa,EAC7B,2BAA2B,EAC3B,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GACP,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;gBAC3F,UAAU,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YAC3D,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBACrB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;oBACvF,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;iBAC/C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,iDAAiD,EAAE,kCAAkC,CAAC,CAAC;YAChJ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,gFAAgF;gBAChF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAChD,MAAM,IAAI,WAAW,CACnB,eAAe,CAAC,aAAa,EAC7B,uCAAuC,GAAG,CAAC,MAAM,GAAG,EACpD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,8DAA8D,CACvF,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAExC,CAAC;YACT,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,yBAAyB,EAAE,2CAA2C,CAAC,CAAC;YACjI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,yEAAyE;gBACzE,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,eAAe,EAAE,mCAAmC,EAAE,yDAAyD,CAAC,CAAC;YACzJ,CAAC;YAED,oFAAoF;YACpF,MAAM,QAAQ,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC7C,MAAM,mBAAmB,CAAC;gBACxB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;gBACjD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,GAAG;gBACnC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;gBACjD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,GAAG;gBACnC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/send-mail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send-mail.d.ts","sourceRoot":"","sources":["../../src/tools/send-mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AACvG,OAAO,EAA0C,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGjG,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,UAAU,CAAC;CACjE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,GAAE,YAAiB,GAAG,IAAI,CA6CrF"}
+{"version":3,"file":"send-mail.d.ts","sourceRoot":"","sources":["../../src/tools/send-mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AACvG,OAAO,EAA0C,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIjG,yFAAyF;AACzF,MAAM,WAAW,YAAY;IAC3B,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,UAAU,CAAC;CACjE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,GAAE,YAAiB,GAAG,IAAI,CAsDrF"}

package/dist/tools/send-mail.js

@@ -2,7 +2,8 @@ import { z } from "zod";
 import { BridgeError, BridgeErrorCode, successResult, errorResult } from "../errors.js";
 import { loadMailCredentials } from "../cloud/mail-credential-store.js";
 import { NodemailerMailSender, buildAndSendMail } from "../mail/mail-sender.js";
-import { assertValidEmail } from "../mail/validate.js";
+import { assertValidEmail, assertAllowedMailDomain } from "../mail/validate.js";
+import { isMailAuthError, mailAuthErrorHint } from "../mail/auth-error.js";
 /**
  * cogent_send_mail — send an email from this agent's mailbox (Cogent Mail M2.2). Reads the
  * agent's own creds from the local store, composes the message with optional attachments read
@@ -29,6 +30,7 @@ export function registerSendMailTool(server, deps = {}) {
     }, async ({ to, subject, body, attachments }) => {
         try {
             assertValidEmail(to, "to"); // fail fast at the tool boundary, before the SMTP sink
+            assertAllowedMailDomain(to, "to"); // F4: org-only mail — no sending to external domains
             const creds = await loadMailCredentials();
             if (!creds) {
                 return errorResult(new BridgeError(BridgeErrorCode.INVALID_INPUT, "No mailbox is configured for this agent", "Run cogent_setup_mail with the address + password from the admin Mail panel first"));
@@ -42,6 +44,14 @@ export function registerSendMailTool(server, deps = {}) {
             return successResult({ ...result, attachmentCount: attachments?.length ?? 0 });
         }
         catch (err) {
+            // Cogent Mail F3: on an SMTP AUTH failure, do NOT clear the local creds — a temporary admin
+            // SUSPEND is wire-indistinguishable from a reap-delete, and wiping still-valid creds would
+            // permanently lock the agent out after the box is resumed. A genuine reap already clears creds
+            // via the deregister deprovision-header path; here we just surface an actionable hint.
+            if (isMailAuthError(err)) {
+                const detail = err instanceof Error ? err.message : String(err);
+                return errorResult(new BridgeError(BridgeErrorCode.INVALID_INPUT, `Mailbox login was refused: ${detail}`, mailAuthErrorHint()));
+            }
             return errorResult(err);
         }
     });

package/dist/tools/send-mail.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-mail.js","sourceRoot":"","sources":["../../src/tools/send-mail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAiC,MAAM,mCAAmC,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAOvD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,OAAqB,EAAE;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,KAA+B,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,yCAAyC;QAChD,WAAW,EACT,6FAA6F;YAC7F,mFAAmF;QACrF,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;YAC9F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAClD,WAAW,EAAE,CAAC;iBACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;SAC3F;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACzG,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,uDAAuD;YACnF,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,WAAW,CAChB,IAAI,WAAW,CACb,eAAe,CAAC,aAAa,EAC7B,yCAAyC,EACzC,mFAAmF,CACpF,CACF,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE;gBAC9D,EAAE,EAAE,CAAC,EAAE,CAAC;gBACR,OAAO;gBACP,IAAI,EAAE,IAAI;gBACV,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"send-mail.js","sourceRoot":"","sources":["../../src/tools/send-mail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAiC,MAAM,mCAAmC,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAmB,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO3E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,OAAqB,EAAE;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,KAA+B,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,yCAAyC;QAChD,WAAW,EACT,6FAA6F;YAC7F,mFAAmF;QACrF,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;YAC9F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAClD,WAAW,EAAE,CAAC;iBACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,6EAA6E,CAAC;SAC3F;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;KACzG,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,uDAAuD;YACnF,uBAAuB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,qDAAqD;YACxF,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,WAAW,CAChB,IAAI,WAAW,CACb,eAAe,CAAC,aAAa,EAC7B,yCAAyC,EACzC,mFAAmF,CACpF,CACF,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE;gBAC9D,EAAE,EAAE,CAAC,EAAE,CAAC;gBACR,OAAO;gBACP,IAAI,EAAE,IAAI;gBACV,eAAe,EAAE,WAAW;aAC7B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4FAA4F;YAC5F,2FAA2F;YAC3F,+FAA+F;YAC/F,uFAAuF;YACvF,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChE,OAAO,WAAW,CAAC,IAAI,WAAW,CAAC,eAAe,CAAC,aAAa,EAAE,8BAA8B,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;YAClI,CAAC;YACD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/setup-mail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-mail.d.ts","sourceRoot":"","sources":["../../src/tools/setup-mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAqC7D"}
+{"version":3,"file":"setup-mail.d.ts","sourceRoot":"","sources":["../../src/tools/setup-mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAQpE;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAsC7D"}

package/dist/tools/setup-mail.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { successResult, errorResult } from "../errors.js";
 import { saveMailCredentials, MAIL_DEFAULT_HOST } from "../cloud/mail-credential-store.js";
-import { assertValidEmail } from "../mail/validate.js";
+import { assertValidEmail, assertAllowedMailDomain } from "../mail/validate.js";
 const DEFAULT_MAIL_HOST = MAIL_DEFAULT_HOST;
 /**
  * cogent_setup_mail — store this agent's mailbox credentials locally (Cogent Mail M2).
@@ -28,6 +28,7 @@ export function registerSetupMailTool(server) {
     }, async ({ address, password, imapHost, imapPort, smtpHost, smtpPort }) => {
         try {
             assertValidEmail(address, "address"); // reject fat-finger creds before persisting
+            assertAllowedMailDomain(address, "address"); // F4: org-only — block BYO external mailboxes
             await saveMailCredentials({
                 address,
                 password,

package/dist/tools/setup-mail.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-mail.js","sourceRoot":"","sources":["../../src/tools/setup-mail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,sFAAsF;YACtF,0FAA0F;YAC1F,wBAAwB;QAC1B,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;YACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;YACvG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,iBAAiB,GAAG,CAAC;YACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,iBAAiB,GAAG,CAAC;YACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChG;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACzG,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,4CAA4C;YAClF,MAAM,mBAAmB,CAAC;gBACxB,OAAO;gBACP,QAAQ;gBACR,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;gBACvC,QAAQ,EAAE,QAAQ,IAAI,GAAG;gBACzB,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;gBACvC,QAAQ,EAAE,QAAQ,IAAI,GAAG;gBACzB,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"setup-mail.js","sourceRoot":"","sources":["../../src/tools/setup-mail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEhF,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiB;IACrD,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,sFAAsF;YACtF,0FAA0F;YAC1F,wBAAwB;QAC1B,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;YACjG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;YACvG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,iBAAiB,GAAG,CAAC;YACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sBAAsB,iBAAiB,GAAG,CAAC;YACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAChG;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;KACzG,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,4CAA4C;YAClF,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,8CAA8C;YAC3F,MAAM,mBAAmB,CAAC;gBACxB,OAAO;gBACP,QAAQ;gBACR,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;gBACvC,QAAQ,EAAE,QAAQ,IAAI,GAAG;gBACzB,QAAQ,EAAE,QAAQ,IAAI,iBAAiB;gBACvC,QAAQ,EAAE,QAAQ,IAAI,GAAG;gBACzB,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -92,6 +92,21 @@ export interface MessageRecord {
      * Absent on older records → treated as agent-origin (safe default).
      */
     originPlatform?: "cc" | "codex" | "slack" | "gchat" | "web";
+    /**
+     * Cogent Mail M2.5 — file REFERENCES carried alongside the message (the byte transport
+     * is email; this is the reference layer). Either a public `url` or a `mailMessageId` the
+     * recipient fetches with `cogent_fetch_mail`. Optional/additive → no-attachment messages
+     * are unchanged. Mirrors @essentialai/cogent `Attachment`.
+     */
+    attachments?: Attachment[];
+}
+/** Cogent Mail M2.5 attachment reference (mirrors @essentialai/cogent `Attachment`). */
+export interface Attachment {
+    url?: string;
+    mailMessageId?: string;
+    name?: string;
+    mimeType?: string;
+    size?: number;
 }
 export interface SendMessageResult {
     success: boolean;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;CAC7D;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;IACnD,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;IAC5D;;;;;OAKG;IACH,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,cAAc,GAAG,eAAe,CAAC;IACnD,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/wizard/templates.js

@@ -48,7 +48,7 @@ Your peer identity: **peerId=\`${peerId}\`**, **label=\`${label}\`**
 ### On Session Start
 1. Find your Claude Code session ID:
    \`\`\`bash
-   ls -t ~/.claude/projects/$(pwd | sed 's/[^a-zA-Z0-9-]/-/g')/*.jsonl 2>/dev/null | head -1 | xargs -I{} basename {} .jsonl
+   ls -t "\${CLAUDE_CONFIG_DIR:-$HOME/.claude}"/projects/$(pwd | sed 's/[^a-zA-Z0-9-]/-/g')/*.jsonl 2>/dev/null | head -1 | xargs -I{} basename {} .jsonl
    \`\`\`
 2. Register yourself on the bridge:
    - Use \`cogent_register_peer\` with peerId="${peerId}", label="${label}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@essentialai/cogent-bridge",
-  "version": "3.16.0",
+  "version": "3.18.0",
   "description": "MCP server for inter-Claude-Code session communication bridge",
   "type": "module",
   "workspaces": [

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.eaisdevelopment/cogent",
   "title": "Cogent Bridge from Essential AI Solutions (essentialai.uk)",
   "description": "MCP bridge for inter-session communication between Claude Code instances",
-  "version": "3.16.0",
+  "version": "3.18.0",
   "repository": {
     "url": "https://github.com/eaisdevelopment/cogent",
     "source": "github"
@@ -12,7 +12,7 @@
     {
       "registryType": "npm",
       "identifier": "@essentialai/cogent-bridge",
-      "version": "3.16.0",
+      "version": "3.18.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"