@rubytech/create-maxy-code 0.1.358 → 0.1.360

package/payload/platform/plugins/email/mcp/dist/lib/imap.js

@@ -1,6 +1,6 @@
 import { ImapFlow } from "imapflow";
 import { simpleParser } from "mailparser";
-import { trackProbe, releaseProbe, newProbeToken } from "./setup-probe.js";
+import { trackProbe, releaseProbe, newProbeToken, containProbeSocket } from "./setup-probe.js";
 const CONNECT_TIMEOUT = 10_000;
 const COMMAND_TIMEOUT = 30_000;
 /** Diagnostic logging to stderr (captured by claude-agent-stderr log on Pi) */
@@ -299,42 +299,100 @@ export async function fetchAttachmentBytesForMessages(config, password, requests
     }
     return results;
 }
+/**
+ * Classify an IMAP probe error by its structured fields, falling back to message
+ * strings only where no structured field carries the signal.
+ *
+ * The auth case is why this exists: ImapFlow reports an authentication rejection
+ * as a generic `Error("Command failed")` and carries the real signal in
+ * `authenticationFailed` / `serverResponseCode` / `responseText` (set by
+ * imapflow's login.js / authenticate.js), none of which appear in `err.message`.
+ * The transport cases (refused/not-found/timeout) carry `err.code` from Node's
+ * socket layer; TLS errors carry a cert/TLS/SSL marker in code or message.
+ */
+export function classifyImapError(err) {
+    const e = (err ?? {});
+    const message = typeof e.message === "string" ? e.message : String(err);
+    const code = typeof e.code === "string" ? e.code : "";
+    const serverCode = typeof e.serverResponseCode === "string" ? e.serverResponseCode : "";
+    const responseText = typeof e.responseText === "string" ? e.responseText : "";
+    // Order: structured/code signals beat fuzzy message strings. Auth's structured
+    // fields are unambiguous and come first. The code-bearing transport cases are
+    // checked before the message-only TLS and auth fallbacks, so a timeout/refusal
+    // whose OS message embeds a hostname containing "ssl"/"tls"/"authentication"
+    // is not stolen by a later substring match.
+    if (e.authenticationFailed === true || serverCode === "AUTHENTICATIONFAILED")
+        return "auth";
+    if (code === "ECONNREFUSED" || message.includes("ECONNREFUSED"))
+        return "refused";
+    if (code === "ENOTFOUND" || message.includes("ENOTFOUND"))
+        return "not-found";
+    if (code === "ETIMEDOUT" || code === "CONNECT_TIMEOUT" || code === "GREETING_TIMEOUT")
+        return "timeout";
+    // TLS errors carry a cert/TLS/SSL marker in the code (e.g. CERT_HAS_EXPIRED,
+    // ERR_TLS_*) or the message; checked on code first, message second.
+    if (/cert|TLS|SSL/i.test(`${code} ${message}`))
+        return "tls";
+    // Message-only fallbacks for errors that arrived without a structured field —
+    // last resort, after every code-based case above.
+    if (/AUTHENTICATIONFAILED|Invalid credentials|LOGIN failed|Authentication failed/i.test(`${message} ${responseText}`))
+        return "auth";
+    if (/ETIMEDOUT|timed?\s?out/i.test(message))
+        return "timeout";
+    return "unknown";
+}
+/** Map a classified failure to the operator-actionable message. */
+function imapFailureMessage(kind, config, err) {
+    switch (kind) {
+        case "auth":
+            return `IMAP authentication failed for ${config.email}. Check the password — most providers require an app-specific password when 2FA is enabled.`;
+        case "refused":
+            return `IMAP connection refused at ${config.imapHost}:${config.imapPort}. Check that IMAP is enabled in your email provider settings.`;
+        case "not-found":
+            return `IMAP host ${config.imapHost} not found. Check the hostname.`;
+        case "tls":
+            return `IMAP TLS error connecting to ${config.imapHost}:${config.imapPort}. Try port 993 (TLS) or 143 (STARTTLS).`;
+        case "timeout":
+            return `IMAP connection timed out to ${config.imapHost}:${config.imapPort}. Check the host and port.`;
+        default:
+            return `IMAP connection failed: ${err instanceof Error ? err.message : String(err)}`;
+    }
+}
 /**
  * Test IMAP connectivity and authentication.
  * Returns null on success, error message on failure.
+ *
+ * Emits one structured attempt line per probe (host/port/security/outcome/reason,
+ * no secret) so a failing setup is visible server-side without opening the session
+ * transcript.
  */
 export async function testConnection(config, password, token = newProbeToken()) {
     const client = createClient(config, password);
     trackProbe("imap", client, token);
+    const attempt = (outcome, reason) => {
+        process.stderr.write(`[email] imap-attempt host=${config.imapHost} port=${config.imapPort} security=${config.imapSecurity} outcome=${outcome} reason=${reason}\n`);
+    };
     try {
         await client.connect();
+        // Socket is live once connect resolves — contain a late socket 'error' that
+        // could fire during logout/teardown.
+        containProbeSocket(client, "imap", token);
         await safeLogout(client);
+        attempt("ok", "none");
         return null;
     }
     catch (err) {
-        // Never abandon the client: an unlistened half-established TLS socket
-        // emitting a late 'error' kills the process.
+        // On the auth-reject path ImapFlow leaves the socket live; contain it before
+        // close() removes ImapFlow's own forwarder, so a late socket 'error' cannot
+        // escape as an uncaughtException once the census has returned to baseline.
+        containProbeSocket(client, "imap", token);
         try {
             client.close();
         }
         catch { /* contained */ }
-        const msg = err instanceof Error ? err.message : String(err);
-        if (msg.includes("AUTHENTICATIONFAILED") || msg.includes("Invalid credentials") || msg.includes("LOGIN failed")) {
-            return `IMAP authentication failed for ${config.email}. Check the password — most providers require an app-specific password when 2FA is enabled.`;
-        }
-        if (msg.includes("ECONNREFUSED")) {
-            return `IMAP connection refused at ${config.imapHost}:${config.imapPort}. Check that IMAP is enabled in your email provider settings.`;
-        }
-        if (msg.includes("ENOTFOUND")) {
-            return `IMAP host ${config.imapHost} not found. Check the hostname.`;
-        }
-        if (msg.includes("certificate") || msg.includes("TLS") || msg.includes("SSL")) {
-            return `IMAP TLS error connecting to ${config.imapHost}:${config.imapPort}. Try port 993 (TLS) or 143 (STARTTLS).`;
-        }
-        if (msg.includes("ETIMEDOUT") || msg.includes("timeout")) {
-            return `IMAP connection timed out to ${config.imapHost}:${config.imapPort}. Check the host and port.`;
-        }
-        return `IMAP connection failed: ${msg}`;
+        const kind = classifyImapError(err);
+        attempt("fail", kind);
+        return imapFailureMessage(kind, config, err);
     }
     finally {
         releaseProbe("imap", token);
@@ -506,15 +564,15 @@ export async function fetchRecent(config, password, options = {}) {
             let envelopeCount = 0;
             let recipientKept = 0;
             let recipientHidden = 0;
-            // Body sources captured during streaming and parsed after the fetch
-            // iterator closes — running simpleParser inside the open fetch loop can
-            // stall the IMAP socket. Aligned by index with `messages`.
-            const bodySources = [];
+            // Pass 1: envelopes + structure only (no source) across the whole
+            // over-fetched window, so recipient kept/hidden accounting covers every
+            // UID while costing only envelope bytes. structureType is captured per
+            // displayed message (aligned by index with `messages`) for the diag.
+            const displayStructureTypes = [];
             for await (const msg of client.fetch(uidList, {
                 envelope: true,
                 uid: true,
                 bodyStructure: true,
-                source: true,
             }, { uid: true })) {
                 envelopeCount++;
                 diag("fetchRecent", `envelope #${envelopeCount}`, `uid=${msg.uid} from=${msg.envelope?.from?.[0]?.address ?? "?"} at ${Date.now() - t2}ms`);
@@ -535,14 +593,10 @@ export async function fetchRecent(config, password, options = {}) {
                     continue;
                 // Collect up to `limit` messages for display, but keep iterating past
                 // that point so the recipient kept/hidden accounting covers the whole
-                // fetched window. Body parsing is deferred until the iterator closes
-                // (see bodySources) and only runs for the displayed messages.
+                // fetched window.
                 if (messages.length < limit) {
                     const attachments = walkAttachmentMetadata(msg.bodyStructure);
-                    bodySources.push({
-                        source: msg.source ?? Buffer.alloc(0),
-                        structureType: msg.bodyStructure?.type ?? "?",
-                    });
+                    displayStructureTypes.push(msg.bodyStructure?.type ?? "?");
                     messages.push({
                         uid: msg.uid,
                         messageId,
@@ -555,11 +609,20 @@ export async function fetchRecent(config, password, options = {}) {
                     });
                 }
             }
-            // Parse the captured sources now that the fetch stream is closed.
-            for (let i = 0; i < messages.length; i++) {
-                const { body, kind } = await extractBody(bodySources[i].source);
-                messages[i].bodyPreview = previewBody(body);
-                diag("fetchRecent", `body #${i + 1}`, `uid=${messages[i].uid} preview=${messages[i].bodyPreview.length}chars type=${bodySources[i].structureType} bodySource=${kind}`);
+            // Pass 2: download full source ONLY for the messages we display, keyed by
+            // UID, then decode previews now that the stream is closed. A heavily
+            // filtered over-fetch no longer pulls source for the UIDs it dropped.
+            if (messages.length > 0) {
+                const displayUids = messages.map((m) => m.uid);
+                const sourceByUid = new Map();
+                for await (const msg of client.fetch(displayUids.map(String).join(","), { uid: true, source: true }, { uid: true })) {
+                    sourceByUid.set(msg.uid, msg.source ?? Buffer.alloc(0));
+                }
+                for (let i = 0; i < messages.length; i++) {
+                    const { body, kind } = await extractBody(sourceByUid.get(messages[i].uid) ?? Buffer.alloc(0));
+                    messages[i].bodyPreview = previewBody(body);
+                    diag("fetchRecent", `body #${i + 1}`, `uid=${messages[i].uid} preview=${messages[i].bodyPreview.length}chars type=${displayStructureTypes[i]} bodySource=${kind}`);
+                }
             }
             diag("fetchRecent", "fetch done", `${envelopeCount} envelopes, ${messages.length} messages in ${Date.now() - t2}ms (total ${Date.now() - t0}ms)`);
             if (clientSideRecipients) {
@@ -635,14 +698,14 @@ export async function searchMessages(config, password, query) {
             let envelopeCount = 0;
             let recipientKept = 0;
             let recipientHidden = 0;
-            // Body sources captured during streaming and parsed after the fetch
-            // iterator closes (see fetchRecent). Aligned by index with `messages`.
-            const bodySources = [];
+            // Pass 1: envelopes + structure only (no source) across the whole
+            // over-fetched window (see fetchRecent). structureType is captured per
+            // displayed message, aligned by index with `messages`.
+            const displayStructureTypes = [];
             for await (const msg of client.fetch(recentUids.map(String).join(","), {
                 envelope: true,
                 uid: true,
                 bodyStructure: true,
-                source: true,
             }, { uid: true })) {
                 envelopeCount++;
                 // Client-side recipient filter (replaces IMAP SEARCH TO), with kept-vs-hidden accounting
@@ -660,13 +723,10 @@ export async function searchMessages(config, password, query) {
                 const inReplyTo = msg.envelope?.inReplyTo ?? null;
                 // Collect up to `limit` messages for display, but keep iterating past
                 // that point so the recipient kept/hidden accounting covers the whole
-                // fetched window. Body parsing is deferred until the iterator closes.
+                // fetched window.
                 if (messages.length < limit) {
                     const attachments = walkAttachmentMetadata(msg.bodyStructure);
-                    bodySources.push({
-                        source: msg.source ?? Buffer.alloc(0),
-                        structureType: msg.bodyStructure?.type ?? "?",
-                    });
+                    displayStructureTypes.push(msg.bodyStructure?.type ?? "?");
                     messages.push({
                         uid: msg.uid,
                         messageId,
@@ -679,11 +739,19 @@ export async function searchMessages(config, password, query) {
                     });
                 }
             }
-            // Parse the captured sources now that the fetch stream is closed.
-            for (let i = 0; i < messages.length; i++) {
-                const { body, kind } = await extractBody(bodySources[i].source);
-                messages[i].bodyPreview = previewBody(body);
-                diag("searchMessages", `body #${i + 1}`, `uid=${messages[i].uid} preview=${messages[i].bodyPreview.length}chars type=${bodySources[i].structureType} bodySource=${kind}`);
+            // Pass 2: download full source ONLY for the displayed messages, keyed by
+            // UID, then decode previews (see fetchRecent).
+            if (messages.length > 0) {
+                const displayUids = messages.map((m) => m.uid);
+                const sourceByUid = new Map();
+                for await (const msg of client.fetch(displayUids.map(String).join(","), { uid: true, source: true }, { uid: true })) {
+                    sourceByUid.set(msg.uid, msg.source ?? Buffer.alloc(0));
+                }
+                for (let i = 0; i < messages.length; i++) {
+                    const { body, kind } = await extractBody(sourceByUid.get(messages[i].uid) ?? Buffer.alloc(0));
+                    messages[i].bodyPreview = previewBody(body);
+                    diag("searchMessages", `body #${i + 1}`, `uid=${messages[i].uid} preview=${messages[i].bodyPreview.length}chars type=${displayStructureTypes[i]} bodySource=${kind}`);
+                }
             }
             diag("searchMessages", "fetch done", `${envelopeCount} envelopes, ${messages.length} messages in ${Date.now() - t2}ms (total ${Date.now() - t0}ms)`);
             if (clientSideRecipients) {
@@ -823,67 +891,81 @@ export async function fetchSinceUid(config, password, sinceUid, recipients) {
     }
 }
 /**
- * Resolve an envelope by Message-ID via IMAP. Searches INBOX first, then
- * the \Sent special-use folder. Returns null when no folder yields a hit.
+ * Locate a message by Message-ID on an ALREADY-CONNECTED client. Searches
+ * INBOX first, then the \Sent special-use folder, returning the first hit
+ * whose envelope carries a From address. The caller owns connect/logout — this
+ * helper neither opens nor closes the connection, so one login can both resolve
+ * the message and fetch its source (see fetchFullBody's message_id path).
  *
- * Uses `header: { "message-id": ... }` IMAP SEARCH — sufficient on every
- * server that honours RFC 3501 header search. The Message-ID is sent with
- * angle brackets restored because some servers (notably Gmail) only match
- * the raw header value, not the bare identifier.
+ * Uses `header: { "message-id": ... }` IMAP SEARCH — sufficient on every server
+ * that honours RFC 3501 header search. The Message-ID is sent with angle
+ * brackets restored because some servers (notably Gmail) only match the raw
+ * header value, not the bare identifier.
  */
-export async function fetchEnvelopeByMessageId(config, password, messageId) {
+async function locateByMessageId(client, messageId) {
     const cleanId = messageId.replace(/^<|>$/g, "");
     const needle = `<${cleanId}>`;
+    const folders = ["INBOX"];
+    try {
+        const sentPath = await resolveFolderName(client, "sent");
+        folders.push(sentPath);
+    }
+    catch {
+        // No \Sent folder advertised — only search INBOX.
+    }
+    for (const folderPath of folders) {
+        const lock = await client.getMailboxLock(folderPath);
+        try {
+            const uids = await client.search({ header: { "message-id": needle } }, { uid: true });
+            if (!uids || uids.length === 0)
+                continue;
+            const uid = uids[0];
+            for await (const msg of client.fetch(String(uid), { envelope: true, uid: true }, { uid: true })) {
+                const env = msg.envelope;
+                if (!env?.from?.[0]?.address)
+                    continue;
+                return { uid: msg.uid, mailbox: folderPath, envelope: env };
+            }
+        }
+        finally {
+            lock.release();
+        }
+    }
+    return null;
+}
+/**
+ * Resolve an envelope by Message-ID via IMAP. Searches INBOX first, then
+ * the \Sent special-use folder. Returns null when no folder yields a hit.
+ */
+export async function fetchEnvelopeByMessageId(config, password, messageId) {
     const client = createClient(config, password);
     const t0 = Date.now();
-    diag("fetchEnvelopeByMessageId", "start", `messageId=${cleanId}`);
+    diag("fetchEnvelopeByMessageId", "start", `messageId=${messageId.replace(/^<|>$/g, "")}`);
     try {
         await client.connect();
         diag("fetchEnvelopeByMessageId", "connected", `${Date.now() - t0}ms`);
-        const folders = ["INBOX"];
-        try {
-            const sentPath = await resolveFolderName(client, "sent");
-            folders.push(sentPath);
-        }
-        catch {
-            // No \Sent folder advertised — only search INBOX.
-        }
-        for (const folderPath of folders) {
-            const lock = await client.getMailboxLock(folderPath);
-            try {
-                const uids = await client.search({ header: { "message-id": needle } }, { uid: true });
-                if (!uids || uids.length === 0)
-                    continue;
-                const uid = uids[0];
-                for await (const msg of client.fetch(String(uid), { envelope: true, uid: true }, { uid: true })) {
-                    const env = msg.envelope ?? {};
-                    const fromAddr = env.from?.[0]?.address ?? "";
-                    if (!fromAddr)
-                        continue;
-                    diag("fetchEnvelopeByMessageId", "match", `folder=${folderPath} uid=${msg.uid} in ${Date.now() - t0}ms`);
-                    return {
-                        uid: msg.uid,
-                        mailbox: folderPath,
-                        messageId: env.messageId ?? messageId,
-                        fromAddress: fromAddr,
-                        fromName: env.from?.[0]?.name ?? null,
-                        toAddresses: (env.to ?? [])
-                            .map((a) => a.address)
-                            .filter((a) => !!a),
-                        ccAddresses: (env.cc ?? [])
-                            .map((a) => a.address)
-                            .filter((a) => !!a),
-                        subject: env.subject ?? "",
-                        date: env.date?.toISOString() ?? "",
-                    };
-                }
-            }
-            finally {
-                lock.release();
-            }
+        const loc = await locateByMessageId(client, messageId);
+        if (!loc) {
+            diag("fetchEnvelopeByMessageId", "no-match", `in ${Date.now() - t0}ms`);
+            return null;
         }
-        diag("fetchEnvelopeByMessageId", "no-match", `searched=${folders.join(",")} in ${Date.now() - t0}ms`);
-        return null;
+        const env = loc.envelope;
+        diag("fetchEnvelopeByMessageId", "match", `folder=${loc.mailbox} uid=${loc.uid} in ${Date.now() - t0}ms`);
+        return {
+            uid: loc.uid,
+            mailbox: loc.mailbox,
+            messageId: env.messageId ?? messageId,
+            fromAddress: env.from?.[0]?.address ?? "",
+            fromName: env.from?.[0]?.name ?? null,
+            toAddresses: (env.to ?? [])
+                .map((a) => a.address)
+                .filter((a) => !!a),
+            ccAddresses: (env.cc ?? [])
+                .map((a) => a.address)
+                .filter((a) => !!a),
+            subject: env.subject ?? "",
+            date: env.date?.toISOString() ?? "",
+        };
     }
     catch (err) {
         diag("fetchEnvelopeByMessageId", "FAILED", `${err instanceof Error ? err.message : String(err)} after ${Date.now() - t0}ms`);
@@ -900,18 +982,6 @@ export async function fetchEnvelopeByMessageId(config, password, messageId) {
  * MIME-shape blind spot. Returns null when the message cannot be located.
  */
 export async function fetchFullBody(config, password, target) {
-    let mailbox = "";
-    let uid;
-    if ("messageId" in target) {
-        const env = await fetchEnvelopeByMessageId(config, password, target.messageId);
-        if (!env)
-            return null;
-        mailbox = env.mailbox;
-        uid = env.uid;
-    }
-    else {
-        uid = target.uid;
-    }
     const client = createClient(config, password);
     const t0 = Date.now();
     const label = "messageId" in target
@@ -920,8 +990,22 @@ export async function fetchFullBody(config, password, target) {
     diag("fetchFullBody", "start", label);
     try {
         await client.connect();
-        if (!("messageId" in target)) {
+        // Resolve the message location on THIS connection — a message_id read no
+        // longer opens a second login just to learn its uid/mailbox.
+        let mailbox;
+        let uid;
+        if ("messageId" in target) {
+            const loc = await locateByMessageId(client, target.messageId);
+            if (!loc) {
+                diag("fetchFullBody", "not-found", `messageId=${target.messageId} in ${Date.now() - t0}ms`);
+                return null;
+            }
+            mailbox = loc.mailbox;
+            uid = loc.uid;
+        }
+        else {
             mailbox = await resolveFolderName(client, target.folder ?? "inbox");
+            uid = target.uid;
         }
         const lock = await client.getMailboxLock(mailbox);
         try {
@@ -965,6 +1049,7 @@ export async function getInboxCount(config, password, token = newProbeToken()) {
     trackProbe("imap", client, token);
     try {
         await client.connect();
+        containProbeSocket(client, "imap", token);
         const mailbox = await client.mailboxOpen("INBOX");
         return mailbox.exists;
     }