@meffecta/agent 1.0.16 → 1.0.17

package/engine.json

@@ -1,4 +1,4 @@
 {
-  "engineTag": "1.0.16",
-  "builtFrom": "95496c7dce1df80834700c5db4696c39f4b3a804"
+  "engineTag": "1.0.17",
+  "builtFrom": "d1ae4180870e3506d070a58d2d9c16256c794533"
 }

package/lib/doctor.js

@@ -76,6 +76,7 @@ export function readLocalJobs(dir) {
       cron: meta.cron,
       webhook: meta.webhook,
       inbox: meta.inbox,
+      requireAuth: meta.requireAuth,
       systems: meta.systems,
       disabled: meta.disabled === "true",
     });
@@ -332,6 +333,31 @@ export async function doctor() {
         r.ok("Content repo", `${local.length} job(s) on disk, all registered`);
       }
 
+      // --- what inbound mail has to prove ------------------------------------------
+      // allowFrom: matches the From: header, which is free text. Without an authentication
+      // requirement it is a list of names anyone can put on a message.
+      const inboxJobs = local.filter((j) => j.inbox);
+      const badAuth = inboxJobs.filter(
+        (j) =>
+          j.requireAuth &&
+          (!j.inbox.startsWith("gmail:") ||
+            j.requireAuth.split(",").some((v) => !["dmarc", "dkim"].includes(v.trim().toLowerCase()))),
+      );
+      const unauthenticated = inboxJobs.filter((j) => j.inbox.startsWith("gmail:") && !j.requireAuth);
+      if (badAuth.length) {
+        r.fail(
+          "An inbox job has a requireAuth: it cannot honor",
+          `${badAuth.map((j) => `${j.name}: ${j.requireAuth}`).join("; ")}. Known values are dmarc and dkim, and only on a gmail: inbox — AgentMail authenticates mail itself and reports no verdict to check. Such a job refuses every message.`,
+          "Fix the value, or remove the line",
+        );
+      } else if (unauthenticated.length) {
+        r.warn(
+          `${unauthenticated.length} inbox job(s) accept an unverified From address`,
+          `${unauthenticated.map((j) => j.name).join(", ")} — allowFrom: matches a header anyone can forge. The verdict is recorded on every message either way, so look at what real mail scores before switching this on.`,
+          "Add requireAuth: dmarc to the job",
+        );
+      }
+
       // --- what each job may reach ------------------------------------------------
       const register = readLocalSystems(`${process.cwd()}/systems`);
       if (register) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meffecta/agent",
-  "version": "1.0.16",
+  "version": "1.0.17",
   "description": "Set up and operate a Meffecta Agent deployment — a self-hosted Claude Code job runner.",
   "type": "module",
   "bin": {