inboxd 1.0.9 → 1.0.11

package/CLAUDE.md

@@ -106,16 +106,21 @@ inbox install-skill --uninstall  # Remove
 
 The `inbox setup` wizard also offers to install the skill automatically.
 
-### Skill Location & Versioning
+### Skill Location & Update Detection
 
 | Location | Purpose |
 |----------|---------|
 | `.claude/skills/inbox-assistant/SKILL.md` | Source (bundled with package) |
 | `~/.claude/skills/inbox-assistant/SKILL.md` | Installed (global for Claude Code) |
 
-The skill has a `version` field in its front matter. When updating:
-1. Bump version in `SKILL.md`
-2. Users run `inbox install-skill` to get the update
+The skill uses content-hash detection (no version field). Updates are detected automatically:
+- On `npm install`: Auto-updates if skill already installed
+- Manual: Run `inbox install-skill` to update
+
+Safety features:
+- `source: inboxd` marker identifies ownership (won't overwrite user's own skills)
+- Creates `SKILL.md.backup` before replacing modified files
+- Use `--force` to override ownership check
 
 ### Architecture
 
@@ -135,10 +140,22 @@ scripts/postinstall.js    # npm postinstall hint about install-skill
 |---------|---------|
 | `inbox summary --json` | Quick status check (unread counts) |
 | `inbox analyze --count 50` | Get email data as JSON for classification |
-| `inbox delete --ids "id1,id2" --confirm` | Delete with confirmation flag |
+| `inbox analyze --group-by sender` | Group emails by sender domain |
+| `inbox delete --ids "id1,id2" --confirm` | Delete specific emails by ID |
+| `inbox delete --sender "pattern" --dry-run` | Preview deletion by sender filter |
+| `inbox delete --match "pattern" --dry-run` | Preview deletion by subject filter |
 | `inbox restore --last N` | Undo last N deletions |
 | `inbox install-skill` | Install/update the Claude Code skill |
 
+### Smart Filtering Options
+| Option | Description |
+|--------|-------------|
+| `--sender <pattern>` | Case-insensitive substring match on From field |
+| `--match <pattern>` | Case-insensitive substring match on Subject field |
+| `--limit <N>` | Max emails for filter operations (default: 50) |
+| `--force` | Override safety warnings (short patterns, large batches) |
+| `--dry-run` | Preview what would be deleted without deleting |
+
 ### Email Object Shape (from `analyze`)
 ```json
 {

package/README.md

@@ -80,6 +80,8 @@ inbox summary
 | `inbox check` | Check for new emails + send notifications |
 | `inbox check -q` | Silent check (for background use) |
 | `inbox delete --ids <ids>` | Move emails to trash |
+| `inbox delete --sender <pattern>` | Delete by sender (with confirmation) |
+| `inbox delete --match <pattern>` | Delete by subject (with confirmation) |
 | `inbox restore --last 1` | Restore last deleted email |
 | `inbox deletion-log` | View deletion history |
 | `inbox logout --all` | Remove all accounts |
@@ -188,13 +190,18 @@ The skill provides:
 
 ### Updating the Skill
 
-When you update inboxd, run `inbox install-skill` again to get the latest skill version:
+The skill auto-updates when you update inboxd (if already installed). You can also update manually:
 
 ```bash
 npm update -g inboxd
 inbox install-skill
 ```
 
+Safety features:
+- Won't overwrite skills not created by inboxd (uses `source: inboxd` marker)
+- Creates `SKILL.md.backup` before replacing if you've modified the skill
+- Use `inbox install-skill --force` to override ownership check
+
 ### CLI vs MCP
 
 Unlike an MCP server that exposes raw Gmail API primitives, `inboxd` provides **opinionated commands** with built-in safety:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inboxd",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "CLI assistant for Gmail monitoring with multi-account support and AI-ready JSON output",
   "main": "src/cli.js",
   "bin": {

package/scripts/postinstall.js

@@ -62,10 +62,14 @@ function handleSkillUpdate() {
 
       if (result.success) {
         if (result.backedUp) {
-          console.log(`\n✓ inbox-assistant skill updated (previous saved to SKILL.md.backup)\n`);
+          console.log(`\n✓ inbox-assistant skill updated`);
+          console.log(`  Your previous version was saved to: SKILL.md.backup\n`);
         } else {
           console.log(`\n✓ inbox-assistant skill updated\n`);
         }
+      } else if (result.reason === 'backup_failed') {
+        console.log(`\n⚠️  Could not backup existing skill - update skipped`);
+        console.log(`   Run 'inbox install-skill' manually to update\n`);
       }
     }
     // Up-to-date → silent (no message)

package/src/skill-installer.js

@@ -50,7 +50,7 @@ function getSkillSource(skillPath) {
 /**
  * Create a backup of the skill file
  * @param {string} skillDir - Directory containing SKILL.md
- * @returns {string|null} Backup path or null if failed
+ * @returns {{ success: boolean, tempPath: string|null, originalHash: string|null }} Backup result
  */
 function createBackup(skillDir) {
   const skillPath = path.join(skillDir, 'SKILL.md');
@@ -59,12 +59,21 @@ function createBackup(skillDir) {
 
   try {
     if (fs.existsSync(skillPath)) {
+      // Get hash of original before backup (for verification)
+      const originalHash = getFileHash(skillPath);
       fs.copyFileSync(skillPath, backupPath);
-      return backupPath;
+
+      // Verify backup was created with correct content
+      const backupHash = getFileHash(backupPath);
+      if (backupHash === originalHash) {
+        return { success: true, tempPath: backupPath, originalHash };
+      }
+      // Backup hash doesn't match - something went wrong
+      return { success: false, tempPath: null, originalHash: null };
     }
-    return null;
+    return { success: false, tempPath: null, originalHash: null };
   } catch {
-    return null;
+    return { success: false, tempPath: null, originalHash: null };
   }
 }
 
@@ -194,13 +203,28 @@ function installSkill(options = {}) {
   const skillsDir = path.dirname(SKILL_DEST_DIR);
   fs.mkdirSync(skillsDir, { recursive: true });
 
-  // Backup if replacing existing (user may have modified)
+  // Backup if replacing existing AND user modified it
+  // (Don't backup if it matches source - nothing worth preserving)
   let backedUp = false;
   let backupPath = null;
-  let tempBackupPath = null;
-  if (status.installed) {
-    tempBackupPath = createBackup(SKILL_DEST_DIR);
+  let backupResult = null;
+  if (status.installed && updateInfo.hashMismatch) {
+    // Only backup if the installed version differs from our source
+    // This prevents overwriting a previous backup with an unmodified version
+    backupResult = createBackup(SKILL_DEST_DIR);
+
+    if (!backupResult.success) {
+      // Backup failed - don't proceed without protecting user's data
+      return {
+        success: false,
+        action: 'skipped',
+        reason: 'backup_failed',
+        path: SKILL_DEST_DIR
+      };
+    }
+  }
 
+  if (status.installed) {
     // Remove existing for clean update
     fs.rmSync(SKILL_DEST_DIR, { recursive: true, force: true });
   }
@@ -209,9 +233,18 @@ function installSkill(options = {}) {
   copyDirSync(SKILL_SOURCE_DIR, SKILL_DEST_DIR);
 
   // Move backup into the new skill directory
-  if (tempBackupPath) {
-    backupPath = moveBackupToSkillDir(tempBackupPath, SKILL_DEST_DIR);
+  if (backupResult && backupResult.tempPath) {
+    backupPath = moveBackupToSkillDir(backupResult.tempPath, SKILL_DEST_DIR);
     backedUp = !!backupPath;
+
+    // Verify the backup still has the original content after move
+    if (backedUp && backupResult.originalHash) {
+      const movedBackupHash = getFileHash(backupPath);
+      if (movedBackupHash !== backupResult.originalHash) {
+        // Something went wrong during move - backup is corrupted
+        backedUp = false;
+      }
+    }
   }
 
   const action = status.installed ? 'updated' : 'installed';