zele 0.3.14 → 0.3.16

package/dist/gmail-client.d.ts

@@ -54,10 +54,16 @@ export interface ThreadListItem {
     snippet: string;
     subject: string;
     from: Sender;
+    to: Sender[];
+    cc: Sender[];
     date: string;
     labelIds: string[];
     unread: boolean;
+    starred: boolean;
     messageCount: number;
+    inReplyTo: string | null;
+    hasAttachments: boolean;
+    listUnsubscribe: string | null;
 }
 export interface ThreadListResult {
     threads: ThreadListItem[];
@@ -244,6 +250,12 @@ export declare class GmailClient {
     archive({ threadIds }: {
         threadIds: string[];
     }): Promise<void | AuthError | ApiError>;
+    markAsSpam({ threadIds }: {
+        threadIds: string[];
+    }): Promise<void | AuthError | ApiError>;
+    unmarkSpam({ threadIds }: {
+        threadIds: string[];
+    }): Promise<void | AuthError | ApiError>;
     /** Invalidate thread cache after a thread mutation. */
     private invalidateAfterThreadMutation;
     /** Moves all spam threads to trash. Does not permanently delete. */
@@ -282,6 +294,18 @@ export declare class GmailClient {
     deleteLabel({ labelId }: {
         labelId: string;
     }): Promise<void>;
+    listFilters(): Promise<{
+        parsed: gmail_v1.Schema$Filter[];
+    } | AuthError | ApiError>;
+    createFilter(opts: {
+        from?: string;
+        query?: string;
+        addLabelIds?: string[];
+        removeLabelIds?: string[];
+    }): Promise<gmail_v1.Schema$Filter | AuthError | ApiError>;
+    deleteFilter(filterId: string): Promise<void | AuthError | ApiError>;
+    /** Resolve a label name to its ID, auto-creating if missing. Public wrapper for filter commands. */
+    resolveLabel(nameOrId: string): Promise<string | AuthError | ApiError>;
     getLabelCounts(): Promise<{
         parsed: Array<{
             label: string;
@@ -327,6 +351,10 @@ export declare class GmailClient {
     private extractBody;
     private findBodyPart;
     private extractAttachmentMeta;
+    /** Quick check: does the message payload tree contain any non-inline attachments?
+     *  Checks the root part itself (some messages have attachment metadata there)
+     *  then recurses into child parts. */
+    private hasNonInlineAttachments;
     getEmailAliases(): Promise<Array<{
         email: string;
         name?: string;

package/dist/gmail-client.js

@@ -71,6 +71,14 @@ function sanitizeSnippet(snippet) {
         .replace(/\s+/g, ' ')
         .trim();
 }
+/**
+ * Sanitize header values to prevent CRLF injection attacks.
+ * The mimetext library does not sanitize custom header values, so newlines
+ * in In-Reply-To or References could inject arbitrary headers.
+ */
+function sanitizeHeaderValue(value) {
+    return value.replace(/[\r\n]/g, ' ').trim();
+}
 function encodeBase64Url(data) {
     const buf = typeof data === 'string' ? Buffer.from(data) : data;
     return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
@@ -98,6 +106,23 @@ function gmailBoundary(email, fn) {
             : new ApiError({ reason: String(err), cause: err }),
     });
 }
+/**
+ * Known folder names that map to Gmail system folders/labels.
+ * Used to validate custom label names and prevent query injection.
+ */
+const KNOWN_FOLDERS = new Set([
+    'inbox',
+    'sent',
+    'trash',
+    'bin',
+    'spam',
+    'drafts',
+    'draft',
+    'starred',
+    'archive',
+    'snoozed',
+    'all',
+]);
 export class GmailClient {
     gmail;
     labelIdCache = {};
@@ -503,7 +528,9 @@ export class GmailClient {
             return messageIds;
         if (messageIds.length === 0)
             return;
-        await this.batchModifyMessages(messageIds, { removeLabelIds: ['UNREAD'] });
+        const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['UNREAD'] });
+        if (mod instanceof Error)
+            return mod;
         await this.invalidateAfterThreadMutation(threadIds);
     }
     async markAsUnread({ threadIds }) {
@@ -512,7 +539,9 @@ export class GmailClient {
             return messageIds;
         if (messageIds.length === 0)
             return;
-        await this.batchModifyMessages(messageIds, { addLabelIds: ['UNREAD'] });
+        const mod = await this.batchModifyMessages(messageIds, { addLabelIds: ['UNREAD'] });
+        if (mod instanceof Error)
+            return mod;
         await this.invalidateAfterThreadMutation(threadIds);
     }
     async star({ threadIds }) {
@@ -521,7 +550,9 @@ export class GmailClient {
             return messageIds;
         if (messageIds.length === 0)
             return;
-        await this.batchModifyMessages(messageIds, { addLabelIds: ['STARRED'] });
+        const mod = await this.batchModifyMessages(messageIds, { addLabelIds: ['STARRED'] });
+        if (mod instanceof Error)
+            return mod;
         await this.invalidateAfterThreadMutation(threadIds);
     }
     async unstar({ threadIds }) {
@@ -530,7 +561,9 @@ export class GmailClient {
             return messageIds;
         if (messageIds.length === 0)
             return;
-        await this.batchModifyMessages(messageIds, { removeLabelIds: ['STARRED'] });
+        const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['STARRED'] });
+        if (mod instanceof Error)
+            return mod;
         await this.invalidateAfterThreadMutation(threadIds);
     }
     async modifyLabels({ threadIds, addLabelIds = [], removeLabelIds = [], }) {
@@ -549,10 +582,12 @@ export class GmailClient {
             return messageIds;
         if (messageIds.length === 0)
             return;
-        await this.batchModifyMessages(messageIds, {
+        const mod = await this.batchModifyMessages(messageIds, {
             addLabelIds: resolvedAdd.filter((r) => typeof r === 'string'),
             removeLabelIds: resolvedRemove,
         });
+        if (mod instanceof Error)
+            return mod;
         await this.invalidateAfterThreadMutation(threadIds);
     }
     async trash({ threadId }) {
@@ -575,7 +610,31 @@ export class GmailClient {
             return messageIds;
         if (messageIds.length === 0)
             return;
-        await this.batchModifyMessages(messageIds, { removeLabelIds: ['INBOX'] });
+        const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['INBOX'] });
+        if (mod instanceof Error)
+            return mod;
+        await this.invalidateAfterThreadMutation(threadIds);
+    }
+    async markAsSpam({ threadIds }) {
+        const messageIds = await this.getMessageIdsForThreads(threadIds);
+        if (messageIds instanceof Error)
+            return messageIds;
+        if (messageIds.length === 0)
+            return;
+        const mod = await this.batchModifyMessages(messageIds, { addLabelIds: ['SPAM'], removeLabelIds: ['INBOX'] });
+        if (mod instanceof Error)
+            return mod;
+        await this.invalidateAfterThreadMutation(threadIds);
+    }
+    async unmarkSpam({ threadIds }) {
+        const messageIds = await this.getMessageIdsForThreads(threadIds, (labelIds) => labelIds.includes('SPAM'));
+        if (messageIds instanceof Error)
+            return messageIds;
+        if (messageIds.length === 0)
+            return;
+        const mod = await this.batchModifyMessages(messageIds, { removeLabelIds: ['SPAM'], addLabelIds: ['INBOX'] });
+        if (mod instanceof Error)
+            return mod;
         await this.invalidateAfterThreadMutation(threadIds);
     }
     /** Invalidate thread cache after a thread mutation. */
@@ -600,10 +659,12 @@ export class GmailClient {
             const messageIds = await this.getMessageIdsForThreads(threadIds);
             if (messageIds instanceof Error)
                 return messageIds;
-            await this.batchModifyMessages(messageIds, {
+            const mod = await this.batchModifyMessages(messageIds, {
                 addLabelIds: ['TRASH'],
                 removeLabelIds: ['SPAM', 'INBOX'],
             });
+            if (mod instanceof Error)
+                return mod;
             totalDeleted += threadIds.length;
             pageToken = res.nextPageToken ?? undefined;
             if (!pageToken)
@@ -674,6 +735,46 @@ export class GmailClient {
         await this.invalidateLabels();
     }
     // =========================================================================
+    // Filters
+    // =========================================================================
+    async listFilters() {
+        const res = await gmailBoundary(this.account?.email ?? 'unknown', () => withRetry(() => this.gmail.users.settings.filters.list({ userId: 'me' })));
+        if (res instanceof Error)
+            return res;
+        return { parsed: res.data.filter ?? [] };
+    }
+    async createFilter(opts) {
+        const criteria = {};
+        if (opts.from)
+            criteria.from = opts.from;
+        if (opts.query)
+            criteria.query = opts.query;
+        const action = {};
+        if (opts.addLabelIds?.length)
+            action.addLabelIds = opts.addLabelIds;
+        if (opts.removeLabelIds?.length)
+            action.removeLabelIds = opts.removeLabelIds;
+        const res = await gmailBoundary(this.account?.email ?? 'unknown', () => withRetry(() => this.gmail.users.settings.filters.create({
+            userId: 'me',
+            requestBody: { criteria, action },
+        })));
+        if (res instanceof Error)
+            return res;
+        return res.data;
+    }
+    async deleteFilter(filterId) {
+        const res = await gmailBoundary(this.account?.email ?? 'unknown', () => withRetry(() => this.gmail.users.settings.filters.delete({
+            userId: 'me',
+            id: filterId,
+        })));
+        if (res instanceof Error)
+            return res;
+    }
+    /** Resolve a label name to its ID, auto-creating if missing. Public wrapper for filter commands. */
+    async resolveLabel(nameOrId) {
+        return this.resolveLabelId(nameOrId);
+    }
+    // =========================================================================
     // Label counts (unread counts per folder/label)
     // =========================================================================
     async getLabelCounts() {
@@ -865,16 +966,39 @@ export class GmailClient {
                 }
             }
         }
+        // Parse recipients from latest message
+        const toHeader = getHeader('to') ?? '';
+        const ccHeaders = headers
+            .filter((h) => h.name?.toLowerCase() === 'cc')
+            .map((h) => h.value ?? '')
+            .filter((v) => v.length > 0);
+        // Check if any non-draft message in the thread is a reply (has In-Reply-To header)
+        const inReplyTo = nonDraftMessages
+            .map((m) => m.payload?.headers?.find((h) => h.name?.toLowerCase() === 'in-reply-to')?.value ??
+            null)
+            .find((v) => v !== null) ?? null;
+        // Check if any message has attachments (non-inline)
+        const hasAttachments = messages.some((m) => this.hasNonInlineAttachments(m.payload));
+        // List-Unsubscribe from latest message
+        const listUnsubscribe = getHeader('list-unsubscribe') ?? null;
         return {
             id: raw.id ?? '',
             historyId: raw.historyId ?? null,
             snippet: sanitizeSnippet(latest?.snippet ?? ''),
             subject: (getHeader('subject') ?? '(no subject)').replace(/"/g, '').trim(),
             from: displayFrom,
+            to: toHeader ? parseAddressList(toHeader) : [],
+            cc: ccHeaders.length > 0
+                ? ccHeaders.filter((h) => h.trim().length > 0).flatMap((h) => parseAddressList(h))
+                : [],
             date: getHeader('date') ?? '',
             labelIds: allLabels,
             unread: allLabels.includes('UNREAD'),
+            starred: allLabels.includes('STARRED'),
             messageCount: nonDraftMessages.length,
+            inReplyTo,
+            hasAttachments,
+            listUnsubscribe,
         };
     }
     /** Parse raw gmail_v1.Schema$Label[] from labels.list into our label objects. */
@@ -976,6 +1100,25 @@ export class GmailClient {
         }
         return results;
     }
+    /** Quick check: does the message payload tree contain any non-inline attachments?
+     *  Checks the root part itself (some messages have attachment metadata there)
+     *  then recurses into child parts. */
+    hasNonInlineAttachments(part) {
+        if (!part)
+            return false;
+        if (part.filename && part.filename.length > 0 && part.body?.attachmentId) {
+            const disposition = part.headers?.find((h) => h.name?.toLowerCase() === 'content-disposition')?.value ?? '';
+            const hasContentId = part.headers?.some((h) => h.name?.toLowerCase() === 'content-id');
+            const isInline = disposition.toLowerCase().includes('inline');
+            if (!isInline || !hasContentId)
+                return true;
+        }
+        for (const child of part.parts ?? []) {
+            if (this.hasNonInlineAttachments(child))
+                return true;
+        }
+        return false;
+    }
     async getEmailAliases() {
         const profile = await this.getProfile();
         if (profile instanceof Error)
@@ -1162,13 +1305,14 @@ export class GmailClient {
             data: body,
         });
         if (inReplyTo) {
-            msg.setHeader('In-Reply-To', inReplyTo);
+            msg.setHeader('In-Reply-To', sanitizeHeaderValue(inReplyTo));
         }
         if (references) {
             const refs = references
                 .split(' ')
                 .filter(Boolean)
                 .map((ref) => {
+                ref = sanitizeHeaderValue(ref);
                 if (!ref.startsWith('<'))
                     ref = `<${ref}`;
                 if (!ref.endsWith('>'))
@@ -1244,7 +1388,16 @@ export class GmailClient {
         }
         // For non-inbox folders, use Gmail search syntax.
         // Caller-provided labelIds are preserved as additional filters.
-        switch (folder) {
+        // Normalize folder name to lowercase for consistent matching
+        const normalizedFolder = folder.toLowerCase();
+        // Validate custom label names to prevent query injection.
+        // Gmail query operators like "OR", "from:", parentheses, etc. could manipulate search results.
+        // Known folders are handled by the switch cases below; custom labels must be safe characters only.
+        // Slashes are allowed for nested labels (e.g., "work/projects").
+        if (!KNOWN_FOLDERS.has(normalizedFolder) && !/^[\w\/-]+$/.test(normalizedFolder)) {
+            throw new Error(`Invalid folder/label name: "${folder}". Use alphanumeric characters, underscores, hyphens, and slashes only.`);
+        }
+        switch (normalizedFolder) {
             case 'sent':
                 q = `in:sent ${q}`.trim();
                 break;
@@ -1272,8 +1425,8 @@ export class GmailClient {
                 q = `in:anywhere ${q}`.trim();
                 break;
             default:
-                // Treat as a label name
-                q = `label:${folder} ${q}`.trim();
+                // Treat as a label name (use normalized for consistency)
+                q = `label:${normalizedFolder} ${q}`.trim();
                 break;
         }
         return { q, resolvedLabelIds };
@@ -1310,13 +1463,15 @@ export class GmailClient {
         const chunkSize = 1000;
         for (let i = 0; i < messageIds.length; i += chunkSize) {
             const chunk = messageIds.slice(i, i + chunkSize);
-            await withRetry(() => this.gmail.users.messages.batchModify({
+            const res = await gmailBoundary(this.account?.email ?? 'unknown', () => withRetry(() => this.gmail.users.messages.batchModify({
                 userId: 'me',
                 requestBody: {
                     ids: chunk,
                     ...body,
                 },
-            }));
+            })));
+            if (res instanceof Error)
+                return res;
         }
     }
     // =========================================================================