@wraps.dev/cli 3.4.0 → 3.5.0

package/dist/lambda/agent-enforcer/index.test.ts

@@ -535,3 +535,102 @@ describe("agent-enforcer — status poll", () => {
     expect(res).toEqual({ status: "unknown" });
   });
 });
+
+describe("agent-enforcer — reply-to and threading headers", () => {
+  it("sends with replyTo and sets ReplyToAddresses", async () => {
+    ddbMock.on(GetCommand).resolves({ Item: configItem() });
+    ddbMock.on(UpdateCommand).resolves({});
+    sesMock.on(SendEmailCommand).resolves({ MessageId: "msg-1" });
+
+    const event = sendEvent();
+    event.payload!.replyTo = "human@example.com";
+    const handler = makeHandler();
+    const res = await handler(event, agentContext("a1"));
+
+    expect(res.status).toBe("sent");
+    const sent = sesMock.commandCalls(SendEmailCommand)[0].args[0].input;
+    expect(sent.ReplyToAddresses).toEqual(["human@example.com"]);
+  });
+
+  it("sends with inReplyTo + references and sets Content.Simple.Headers", async () => {
+    ddbMock.on(GetCommand).resolves({ Item: configItem() });
+    ddbMock.on(UpdateCommand).resolves({});
+    sesMock.on(SendEmailCommand).resolves({ MessageId: "msg-1" });
+
+    const event = sendEvent();
+    event.payload!.inReplyTo = "<abc@mail.example.com>";
+    event.payload!.references = "<abc@mail.example.com> <def@mail.example.com>";
+    const handler = makeHandler();
+    const res = await handler(event, agentContext("a1"));
+
+    expect(res.status).toBe("sent");
+    const sent = sesMock.commandCalls(SendEmailCommand)[0].args[0].input;
+    expect(sent.Content?.Simple?.Headers).toEqual([
+      { Name: "In-Reply-To", Value: "<abc@mail.example.com>" },
+      {
+        Name: "References",
+        Value: "<abc@mail.example.com> <def@mail.example.com>",
+      },
+    ]);
+  });
+
+  it("omits ReplyToAddresses and Headers keys entirely when none of the three fields are set", async () => {
+    ddbMock.on(GetCommand).resolves({ Item: configItem() });
+    ddbMock.on(UpdateCommand).resolves({});
+    sesMock.on(SendEmailCommand).resolves({ MessageId: "msg-1" });
+
+    const handler = makeHandler();
+    const res = await handler(sendEvent(), agentContext("a1"));
+
+    expect(res.status).toBe("sent");
+    const sent = sesMock.commandCalls(SendEmailCommand)[0].args[0].input;
+    expect(sent).not.toHaveProperty("ReplyToAddresses");
+    expect(sent.Content?.Simple).not.toHaveProperty("Headers");
+  });
+
+  it("blocks a multi-address replyTo before consuming any cap", async () => {
+    ddbMock.on(GetCommand).resolves({ Item: configItem() });
+    ddbMock.on(UpdateCommand).resolves({});
+    sesMock.on(SendEmailCommand).resolves({ MessageId: "nope" });
+
+    const event = sendEvent();
+    event.payload!.replyTo = "a@b.com, c@d.com";
+    const handler = makeHandler();
+    const res = await handler(event, agentContext("a1"));
+
+    expect(res).toEqual({ status: "blocked", reason: "invalid reply-to" });
+    expect(sesMock.commandCalls(SendEmailCommand)).toHaveLength(0);
+    expect(ddbMock.commandCalls(UpdateCommand)).toHaveLength(0);
+  });
+
+  it("blocks a CRLF header-injection attempt in inReplyTo, no SES, no counter write", async () => {
+    ddbMock.on(GetCommand).resolves({ Item: configItem() });
+    ddbMock.on(UpdateCommand).resolves({});
+    sesMock.on(SendEmailCommand).resolves({ MessageId: "nope" });
+
+    const event = sendEvent();
+    event.payload!.inReplyTo =
+      "<abc@mail.example.com>\r\nBcc: attacker@evil.com";
+    const handler = makeHandler();
+    const res = await handler(event, agentContext("a1"));
+
+    expect(res).toEqual({ status: "blocked", reason: "invalid in-reply-to" });
+    expect(sesMock.commandCalls(SendEmailCommand)).toHaveLength(0);
+    expect(ddbMock.commandCalls(UpdateCommand)).toHaveLength(0);
+  });
+
+  it("blocks the same malformed replyTo on an execute event too", async () => {
+    routeExecuteReads({ outcome: null });
+    ddbMock.on(PutCommand).resolves({});
+    sesMock.on(SendEmailCommand).resolves({ MessageId: "should-not-send" });
+
+    const event = executeEvent();
+    event.payload!.replyTo = "a@b.com, c@d.com";
+    const handler = makeHandler();
+    const res = await handler(event, platformContext());
+
+    expect(res).toEqual({ status: "blocked", reason: "invalid reply-to" });
+    expect(sesMock.commandCalls(SendEmailCommand)).toHaveLength(0);
+    expect(ddbMock.commandCalls(PutCommand)).toHaveLength(0);
+  });
+});

package/dist/lambda/agent-enforcer/index.ts

@@ -82,6 +82,21 @@ function isSingleEmail(to: unknown): to is string {
   return /^[^\s@,]+@[^\s@,]+\.[^\s@,]+$/.test(to);
 }
 
+/**
+ * A value safe to place on a MIME header line. CR/LF is the header-injection
+ * vector; SES additionally requires printable ASCII. Mirrors
+ * assertNoHeaderInjection() in wraps-js packages/email/src/utils/headers.ts,
+ * reimplemented as a predicate because the enforcer returns verdicts, never throws.
+ */
+function isSafeHeaderValue(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length > 0 &&
+    value.length <= 998 &&
+    /^[\x20-\x7e]+$/.test(value)
+  );
+}
+
 /** Sender pinning (SEC-3): `payload.from` must be the agent's own address. */
 function isOwnSender(from: unknown, emailAddress: string): boolean {
   return (
@@ -167,6 +182,26 @@ async function tryDecrement(
   }
 }
 
+/** Verdict reason if the optional header fields are malformed, else null. */
+function headerFieldProblem(payload: AgentEmailPayload): string | null {
+  if (payload.replyTo !== undefined && !isSingleEmail(payload.replyTo)) {
+    return "invalid reply-to";
+  }
+  if (
+    payload.inReplyTo !== undefined &&
+    !isSafeHeaderValue(payload.inReplyTo)
+  ) {
+    return "invalid in-reply-to";
+  }
+  if (
+    payload.references !== undefined &&
+    !isSafeHeaderValue(payload.references)
+  ) {
+    return "invalid references";
+  }
+  return null;
+}
+
 /** Caller identity bound to the invoke principal, never the payload (SEC-2). */
 type Caller = { kind: "agent"; agentId: string } | { kind: "platform" };
 
@@ -211,10 +246,20 @@ async function sendViaSes(
   agentId: string,
   configSet: string
 ): Promise<string> {
+  const headers = [
+    ...(payload.inReplyTo
+      ? [{ Name: "In-Reply-To", Value: payload.inReplyTo }]
+      : []),
+    ...(payload.references
+      ? [{ Name: "References", Value: payload.references }]
+      : []),
+  ];
+
   const response = await sesClient.send(
     new SendEmailCommand({
       FromEmailAddress: payload.from,
       Destination: { ToAddresses: [payload.to] },
+      ...(payload.replyTo ? { ReplyToAddresses: [payload.replyTo] } : {}),
       Content: {
         Simple: {
           Subject: { Data: payload.subject },
@@ -222,6 +267,7 @@ async function sendViaSes(
             Html: { Data: payload.html },
             Text: { Data: payload.text },
           },
+          ...(headers.length > 0 ? { Headers: headers } : {}),
         },
       },
       ConfigurationSetName: configSet,
@@ -287,6 +333,10 @@ export function createHandler(deps: EnforcerDeps) {
     if (!isSingleEmail(payload.to)) {
       return { status: "blocked", reason: "invalid recipient" };
     }
+    const headerProblem = headerFieldProblem(payload);
+    if (headerProblem) {
+      return { status: "blocked", reason: headerProblem };
+    }
 
     const config = await loadConfig(dynamo, table, agentId);
     // 1. Kill-switch + policy existence FIRST.
@@ -420,6 +470,10 @@ export function createHandler(deps: EnforcerDeps) {
     if (!isSingleEmail(payload.to)) {
       return { status: "blocked", reason: "invalid recipient" };
     }
+    const headerProblem = headerFieldProblem(payload);
+    if (headerProblem) {
+      return { status: "blocked", reason: headerProblem };
+    }
 
     const configSet = process.env.CONFIG_SET || DEFAULT_CONFIG_SET;
     try {

package/dist/lambda/event-processor/.bundled

@@ -1 +1 @@
-Built at: 2026-08-22T22:34:10.008Z
+Built at: 2026-09-01T19:28:31.153Z

package/dist/lambda/inbound-processor/.bundled

@@ -1 +1 @@
-Built at: 2026-08-22T22:34:10.163Z
+Built at: 2026-09-01T19:28:31.306Z