sessionmail 0.3.1__tar.gz → 0.3.3__tar.gz

{sessionmail-0.3.1 → sessionmail-0.3.3}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sessionmail",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Mail for coding agents: message moves messages, pager alerts, memory is the filesystem view - three commands over one maildir.",
   "author": {
     "name": "Mike Bailey",

{sessionmail-0.3.1 → sessionmail-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sessionmail
-Version: 0.3.1
+Version: 0.3.3
 Summary: sessionmail - mail for coding agents: message, pager and memory over one maildir.
 Project-URL: Homepage, https://github.com/sessionkit/sessionmail
 Project-URL: Repository, https://github.com/sessionkit/sessionmail
@@ -14,7 +14,7 @@ Requires-Dist: cryptography>=42
 Requires-Dist: markdown>=3.6
 Requires-Dist: mcp>=2.2.0
 Requires-Dist: pymdown-extensions>=10.0
-Requires-Dist: sessiontools>=0.3.0
+Requires-Dist: sessiontools>=0.3.3
 Description-Content-Type: text/markdown
 
 # sessionmail
@@ -91,8 +91,7 @@ hook says so once per session rather than leaving you to guess.
   name.
 - Reading needs no server either: `message list`, `tree` and `read`, and
   `pager`, read the maildir directly. `message mark` and `memory` read the
-  [notmuch][] index, which is only as current as its last `notmuch new`
-  (below).
+  [notmuch][] index, and refresh it themselves before they read (below).
 - **Mail across machines** goes through postfix, which is opt-in:
   [postfix configuration][postfix-configuration].
 
@@ -112,9 +111,12 @@ message setup --box NAME         # the mail root, the boxes, the notmuch profile
 - It never touches your own notmuch config, never edits postfix, and
   writes no settings key.
 - **Setup runs `notmuch new --no-hooks` once**, on its own empty profile,
-  to build the index the hook needs. Nothing keeps it fresh: `message mark`
-  and `memory` read what was indexed until something runs `notmuch new`
-  again: launchd, cron, or by hand.
+  to build the index the hook needs. It schedules nothing and installs no
+  job.
+- **The readers keep the index fresh.** `memory` runs a bounded
+  `notmuch new --no-hooks` before it reads, and `message mark` runs one
+  when an id is missing. The bound is `notmuch.refresh`: 2 seconds by
+  default, and 0 turns it off: [notmuch][].
 
 `message`, `pager` and `memory` all run; the specs, in the git repository
 (the release archive leaves them out), say what each verb is meant to do
@@ -125,11 +127,25 @@ and `make progress` counts how much of it is built.
 ```sh
 claude plugin uninstall sessionmail                  # skills, hooks, MCP entries
 uv tool uninstall sessionmail                        # the three commands
-rm ~/.mail/.notmuch/hooks/post-new ~/.mail/.notmuch/hooks/post-insert   # the linked hook (in notmuch's database.hook_dir)
-notmuch --config="$HOME/.config/notmuch/sessionkit/config" config set sessionmail.post_new_command   # the optional command, off
-rm ~/.config/notmuch/sessionkit/config               # sessionmail's notmuch profile (its index stays in ~/.mail/.notmuch)
+R="$(message path --root)"; rm "$R/.notmuch/hooks/post-new" "$R/.notmuch/hooks/post-insert"   # the linked hook (in notmuch's database.hook_dir)
 ```
 
+- sessionmail's notmuch profile (its index stays in the mail root's
+  `.notmuch`). A fresh host:
+
+  ```sh
+  notmuch --config="$HOME/.sessionkit/mail/settings/notmuch/sessionkit/config" config set sessionmail.post_new_command   # the optional command, off
+  rm ~/.sessionkit/mail/settings/notmuch/sessionkit/config
+  ```
+
+- A host that kept its older profile (or `~/.notmuch-config.sessionkit`,
+  if that is the file it has):
+
+  ```sh
+  notmuch --config="$HOME/.config/notmuch/sessionkit/config" config set sessionmail.post_new_command   # the optional command, off
+  rm ~/.config/notmuch/sessionkit/config
+  ```
+
 ## Configuration
 
 Which files, which environment variables, and where each one lives, one
@@ -141,8 +157,10 @@ component at a time: [configuration][configuration].
   and the two maps the generator writes as you, in
   `/usr/local/etc/postfix-agents/`.
 - **notmuch**, the index: sessionmail's own profile,
-  `~/.config/notmuch/sessionkit/config`. Your own `~/.notmuch-config` is
-  never read.
+  `~/.sessionkit/mail/settings/notmuch/sessionkit/config` on a fresh host.
+  An older `~/.config/notmuch/sessionkit/config` (or
+  `~/.notmuch-config.sessionkit`) is still read while it exists, and is
+  never moved. Your own `~/.notmuch-config` is never read.
 - **Environment variables**: each settings key has one (the `sendmail`
   key's is `SESSIONMAIL_SENDMAIL`). When it is set and not empty, it wins
   over the file.
@@ -160,13 +178,14 @@ to record:
   under `~/.session/seats/<seat>/`: each settings change for that session
   or seat, such as a subscription or its address, with the command that
   made it.
-- `~/.mail/.state/regen-failures.log`: each time the map generator
+- `<mail root>/.state/regen-failures.log` (`message path --root`): each time the map generator
   refused to rewrite the alias map, and why.
-- `~/.sessionmail/post-new/log`: the [post-new command][post-new-command]'s
+- `~/.sessionkit/mail/state/post-new/log` (`~/.sessionmail/post-new/log` on
+  an existing host where that folder is still real): the [post-new command][post-new-command]'s
   runs and output, only once you set one. Past 1 MiB it becomes `log.1`.
 
 Follow one as it grows with `tail -F`, for example
-`tail -F ~/.mail/.state/regen-failures.log`. `pager status` ends its
+`tail -F "$(message path --root)/.state/regen-failures.log"`. `pager status` ends its
 `today:` line with the path of this session's `pager.jsonl`.
 
 - **Health:** `pager status`, run by the agent. `monitor: armed (pid N)`,
@@ -181,12 +200,15 @@ Follow one as it grows with `tail -F`, for example
 Everything else is in `docs/`, one subject per file:
 
 - [The pager][pager], the model in one page; [how `pager listen`
-  works][pager-listen-internals]; [the pager monitor][pager-monitor]; [not
-  running under Claude Code][pager-outside-claude]; [what the pager
+  works][pager-listen-internals]; [the pager monitor][pager-monitor] and
+  its [frozen-turn watch][frozen-watch], off by default; [not running
+  under Claude Code][pager-outside-claude]; [what the pager
   injects][pager-inject-log].
 - Three hidden verbs: [`message seat`][message-seat], a seat with no Claude
   session; [`message receipt`][message-receipt], what another session
   recorded; and [`message setup`][message-setup], making a host ready.
+- [Your first memory root, by hand][memory-first-root]: `memory` has no
+  automated first step yet.
 - [Gating on `message verify --json`][verify-json-verdict]: the verdict as
   one JSON object.
 - [The writing model][session-model]: the signed `Session-Model:` header,
@@ -207,12 +229,14 @@ Everything else is in `docs/`, one subject per file:
 [pager]: docs/pager.md
 [pager-listen-internals]: docs/pager-listen-internals.md
 [pager-monitor]: docs/pager-monitor.md
+[frozen-watch]: docs/frozen-watch.md
 [pager-outside-claude]: docs/pager-outside-claude.md
 [pager-inject-log]: docs/pager-inject-log.md
 [message-seat]: docs/message-seat.md
 [session-model]: docs/session-model.md
 [message-receipt]: docs/message-receipt.md
 [message-setup]: docs/message-setup.md
+[memory-first-root]: docs/memory-first-root.md
 [verify-json-verdict]: docs/verify-json-verdict.md
 [mail-delivery-paths]: docs/mail-delivery-paths.md
 [postfix-configuration]: docs/postfix-configuration.md

{sessionmail-0.3.1 → sessionmail-0.3.3}/README.md

@@ -72,8 +72,7 @@ hook says so once per session rather than leaving you to guess.
   name.
 - Reading needs no server either: `message list`, `tree` and `read`, and
   `pager`, read the maildir directly. `message mark` and `memory` read the
-  [notmuch][] index, which is only as current as its last `notmuch new`
-  (below).
+  [notmuch][] index, and refresh it themselves before they read (below).
 - **Mail across machines** goes through postfix, which is opt-in:
   [postfix configuration][postfix-configuration].
 
@@ -93,9 +92,12 @@ message setup --box NAME         # the mail root, the boxes, the notmuch profile
 - It never touches your own notmuch config, never edits postfix, and
   writes no settings key.
 - **Setup runs `notmuch new --no-hooks` once**, on its own empty profile,
-  to build the index the hook needs. Nothing keeps it fresh: `message mark`
-  and `memory` read what was indexed until something runs `notmuch new`
-  again: launchd, cron, or by hand.
+  to build the index the hook needs. It schedules nothing and installs no
+  job.
+- **The readers keep the index fresh.** `memory` runs a bounded
+  `notmuch new --no-hooks` before it reads, and `message mark` runs one
+  when an id is missing. The bound is `notmuch.refresh`: 2 seconds by
+  default, and 0 turns it off: [notmuch][].
 
 `message`, `pager` and `memory` all run; the specs, in the git repository
 (the release archive leaves them out), say what each verb is meant to do
@@ -106,11 +108,25 @@ and `make progress` counts how much of it is built.
 ```sh
 claude plugin uninstall sessionmail                  # skills, hooks, MCP entries
 uv tool uninstall sessionmail                        # the three commands
-rm ~/.mail/.notmuch/hooks/post-new ~/.mail/.notmuch/hooks/post-insert   # the linked hook (in notmuch's database.hook_dir)
-notmuch --config="$HOME/.config/notmuch/sessionkit/config" config set sessionmail.post_new_command   # the optional command, off
-rm ~/.config/notmuch/sessionkit/config               # sessionmail's notmuch profile (its index stays in ~/.mail/.notmuch)
+R="$(message path --root)"; rm "$R/.notmuch/hooks/post-new" "$R/.notmuch/hooks/post-insert"   # the linked hook (in notmuch's database.hook_dir)
 ```
 
+- sessionmail's notmuch profile (its index stays in the mail root's
+  `.notmuch`). A fresh host:
+
+  ```sh
+  notmuch --config="$HOME/.sessionkit/mail/settings/notmuch/sessionkit/config" config set sessionmail.post_new_command   # the optional command, off
+  rm ~/.sessionkit/mail/settings/notmuch/sessionkit/config
+  ```
+
+- A host that kept its older profile (or `~/.notmuch-config.sessionkit`,
+  if that is the file it has):
+
+  ```sh
+  notmuch --config="$HOME/.config/notmuch/sessionkit/config" config set sessionmail.post_new_command   # the optional command, off
+  rm ~/.config/notmuch/sessionkit/config
+  ```
+
 ## Configuration
 
 Which files, which environment variables, and where each one lives, one
@@ -122,8 +138,10 @@ component at a time: [configuration][configuration].
   and the two maps the generator writes as you, in
   `/usr/local/etc/postfix-agents/`.
 - **notmuch**, the index: sessionmail's own profile,
-  `~/.config/notmuch/sessionkit/config`. Your own `~/.notmuch-config` is
-  never read.
+  `~/.sessionkit/mail/settings/notmuch/sessionkit/config` on a fresh host.
+  An older `~/.config/notmuch/sessionkit/config` (or
+  `~/.notmuch-config.sessionkit`) is still read while it exists, and is
+  never moved. Your own `~/.notmuch-config` is never read.
 - **Environment variables**: each settings key has one (the `sendmail`
   key's is `SESSIONMAIL_SENDMAIL`). When it is set and not empty, it wins
   over the file.
@@ -141,13 +159,14 @@ to record:
   under `~/.session/seats/<seat>/`: each settings change for that session
   or seat, such as a subscription or its address, with the command that
   made it.
-- `~/.mail/.state/regen-failures.log`: each time the map generator
+- `<mail root>/.state/regen-failures.log` (`message path --root`): each time the map generator
   refused to rewrite the alias map, and why.
-- `~/.sessionmail/post-new/log`: the [post-new command][post-new-command]'s
+- `~/.sessionkit/mail/state/post-new/log` (`~/.sessionmail/post-new/log` on
+  an existing host where that folder is still real): the [post-new command][post-new-command]'s
   runs and output, only once you set one. Past 1 MiB it becomes `log.1`.
 
 Follow one as it grows with `tail -F`, for example
-`tail -F ~/.mail/.state/regen-failures.log`. `pager status` ends its
+`tail -F "$(message path --root)/.state/regen-failures.log"`. `pager status` ends its
 `today:` line with the path of this session's `pager.jsonl`.
 
 - **Health:** `pager status`, run by the agent. `monitor: armed (pid N)`,
@@ -162,12 +181,15 @@ Follow one as it grows with `tail -F`, for example
 Everything else is in `docs/`, one subject per file:
 
 - [The pager][pager], the model in one page; [how `pager listen`
-  works][pager-listen-internals]; [the pager monitor][pager-monitor]; [not
-  running under Claude Code][pager-outside-claude]; [what the pager
+  works][pager-listen-internals]; [the pager monitor][pager-monitor] and
+  its [frozen-turn watch][frozen-watch], off by default; [not running
+  under Claude Code][pager-outside-claude]; [what the pager
   injects][pager-inject-log].
 - Three hidden verbs: [`message seat`][message-seat], a seat with no Claude
   session; [`message receipt`][message-receipt], what another session
   recorded; and [`message setup`][message-setup], making a host ready.
+- [Your first memory root, by hand][memory-first-root]: `memory` has no
+  automated first step yet.
 - [Gating on `message verify --json`][verify-json-verdict]: the verdict as
   one JSON object.
 - [The writing model][session-model]: the signed `Session-Model:` header,
@@ -188,12 +210,14 @@ Everything else is in `docs/`, one subject per file:
 [pager]: docs/pager.md
 [pager-listen-internals]: docs/pager-listen-internals.md
 [pager-monitor]: docs/pager-monitor.md
+[frozen-watch]: docs/frozen-watch.md
 [pager-outside-claude]: docs/pager-outside-claude.md
 [pager-inject-log]: docs/pager-inject-log.md
 [message-seat]: docs/message-seat.md
 [session-model]: docs/session-model.md
 [message-receipt]: docs/message-receipt.md
 [message-setup]: docs/message-setup.md
+[memory-first-root]: docs/memory-first-root.md
 [verify-json-verdict]: docs/verify-json-verdict.md
 [mail-delivery-paths]: docs/mail-delivery-paths.md
 [postfix-configuration]: docs/postfix-configuration.md

{sessionmail-0.3.1 → sessionmail-0.3.3}/hooks/mail-guard/README.md

@@ -131,6 +131,41 @@ backtick or `$(` somewhere). One false positive was found and fixed before
 this landed — arithmetic `$(( … ))` in a subject. ~18µs per command; the hook
 process through its shim, ~27ms.
 
+## Turning it off — `"mail_guard": false`
+
+The guard has one switch, in the host settings file
+`~/.sessionkit/mail/settings/mail.json`: `"mail_guard": false` turns off its
+subject and body checks for every seat on the host. It is the lever for a
+guard that is broken. A person turns it off with `pager settings hooks
+mail_guard off`, and back on with `pager settings hooks mail_guard on`;
+`pager settings hooks mail_guard` says which.
+
+- **Missing means on.** Only the boolean `false` turns the checks off. Any
+  other value (`"no"`, `0`), and a file that is missing, cannot be read, is
+  not JSON or is not a JSON object, leaves them on. An odd or broken
+  settings file never turns the guard off.
+- **The subagent rules stay on.** Inside a subagent, the guard still denies
+  what would take or mark the seat's mail, write its settings or switch its
+  hooks, through both doors, whatever the switch says. The switch is read
+  only when the subject and body checks would run, so an MCP call and a
+  call those rules deny never read the file.
+- **`"hooks"` does not touch it.** `"hooks": false` silences the hooks that
+  speak; the guard still judges.
+- **Off, nothing stands before the shell.** The CLI refuses a subject that
+  *arrives* carrying a backtick or `$(`, but the shell has already expanded
+  and run a double-quoted one by then. With the guard off, that command runs.
+- **It is a person's switch, by convention.** Every seat runs as the user
+  who owns the file, so nothing refuses a main-thread agent that writes it.
+  Each change the verb makes is logged, with who made it
+  ([the settings doc][settings-hooks]); turn it off only when a person
+  asked for it.
+
+The guard reads the file itself, stdlib only (`guard_switched_off` in
+`hook.py`): it cannot import sessionmail. A test keeps its reading in step
+with sessionmail's own reader.
+
+[settings-hooks]: ../../docs/settings.md#the-per-hook-switches
+
 ## Wiring it — the plugin registers it
 
 This hook lived in the `session` repo until that project was retired
@@ -143,6 +178,7 @@ it, like its other hooks:
 ```
 hooks/hooks.json    PreToolUse, matcher Bash -> hooks/mail-guard-hook (timeout 5)
                     PreToolUse, matcher mcp__plugin_sessionmail_(message|pager)__.*
+                        |mcp__plugin_sessionmail_memory__memory_init
                         -> the same shim (a subagent's MCP door)
 hooks/mail-guard-hook   the shim: python3 hooks/mail-guard/hook.py, and exit 0
                         whatever goes wrong
@@ -151,13 +187,28 @@ hooks/mail-guard-hook   the shim: python3 hooks/mail-guard/hook.py, and exit 0
 So a seat that loaded sessionmail is behind the guard, and one that did not
 is not.
 
-**The MCP group** routes the message and pager servers' tools (not
-memory's) to the same guard. It acts only on a payload that carries
-`agent_id` (a subagent's): there it denies what the Bash door denies a
-subagent (`message_read` without `peek`, `message_mark`, `pager_status` with
-`new_only`, `pager_stop|off|mute|unmute|listen`), judged by the same table
-(`subagent_verb`). A main thread's MCP call is allowed at once, exit 0 and
-no output. Cost: one python3 run per such call, about 23 ms on one Mac. Hook configuration is read at **session start**: loading the plugin
+**The MCP group** routes the message and pager servers' tools, and of
+memory's only `memory_init`, to the same guard. It acts only on a payload
+that carries `agent_id` (a subagent's): there it denies what the Bash door
+denies a subagent (`message_read` without `peek`, `message_mark`,
+`pager_status` with `new_only`, `pager_stop|off|mute|unmute|listen`,
+`pager_focus`, `message_subscription_add|remove` and
+`memory_init`), judged by the same table (`subagent_verb`). A main thread's
+MCP call is allowed at once, exit 0 and no output. Cost: one python3 run per
+such call, about 23 ms on one Mac. The rest of memory's tools are not
+routed, so they cost nothing.
+
+**Inside a subagent, through either door**, the table also denies
+`memory init` (the whole verb), `memory run` without `--list`, `message
+subscription add|remove`, `pager rule add|remove`, `pager focus` and
+`pager settings hooks on|off` or `pager settings hooks KEY on|off`: each
+writes the seat's memory, runs its script-mail, or changes its state, as the
+seat (the last two, the HOST's switches, for every seat on it). Their reads
+stay allowed (`memory ls|tree|cat|wake`, `memory run --list`, `message
+subscription list`, `pager rule list`, `pager status --stopped`, a bare
+`pager settings hooks`, and `pager settings hooks KEY` alone). A word that would allow (`--peek`, `--list`, `--help`) counts
+only before a `--`, where click still reads options: `message read 1 --
+--peek` reads, and is denied. Hook configuration is read at **session start**: loading the plugin
 does not guard agents that are already running.
 
 **It never blocks by failing.** The only way it speaks is decision JSON on
@@ -182,7 +233,12 @@ group, and the hook process contract. `tests/test_mail_guard_wiring.py` —
 the registration in `hooks/hooks.json`, and the shim allowing when python3
 is missing, `hook.py` is missing, or it crashes. Both run under `make test`.
 `tests/test_mail_guard_subagent.py` and `tests/test_mail_guard_subagent_mcp.py`
-— the subagent rule through the Bash door and the MCP door.
+— the subagent rule through the Bash door and the MCP door;
+`tests/test_mail_guard_subagent_sm837.py` — the seat-state rows and the `--` cut,
+both doors, with the main thread pinned byte for byte to the master it was
+built on. `tests/test_hook_switches_mail_guard.py` — the off switch, both
+doors, and the guard's reader in step with sessionmail's over every file
+shape and value kind.
 
 Written in python3, stdlib only, on purpose: a quoting-aware guard written in
 the language whose quoting is the hazard is how you get a guard with its own

{sessionmail-0.3.1 → sessionmail-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sessionmail"
-version = "0.3.1"
+version = "0.3.3"
 description = "sessionmail - mail for coding agents: message, pager and memory over one maildir."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"
@@ -20,7 +20,7 @@ dependencies = [
     "markdown>=3.6",
     "mcp>=2.2.0",
     "pymdown-extensions>=10.0",
-    "sessiontools>=0.3.0",
+    "sessiontools>=0.3.3",
 ]
 
 # One package, three commands (openspec/specs/package/spec.md):
@@ -31,7 +31,7 @@ dependencies = [
 #
 # `pager listen` regenerates the LIVE postfix maps on a seat birth
 # (pager.py:486-489), and it resolves which generator to run via
-# shutil.which("vmailbox-gen") BEFORE ~/.mail/.postfix/vmailbox-gen
+# shutil.which("vmailbox-gen") BEFORE <mail root>/.postfix/vmailbox-gen
 # (_seat.py:994), with no --no-postmap. So an entry point here does not merely
 # put a command on the PATH: at the next seat birth it COMPILES AND SERVES the
 # packaged generator's map to postfix, for every agent address on this host.

{sessionmail-0.3.1 → sessionmail-0.3.3}/scripts/seat-agent/README.md

@@ -24,8 +24,12 @@ seat --help` answers when typed.
 
 ## The wrapper
 
-- **The key** is `$SESSIONMAIL_HOME/seat-keys/ADDRESS/id_ed25519`, which is
-  `message seat init`'s layout. The pub the adapter names is `seat.pub` in the same dir.
+- **The key** is `KEYS/ADDRESS/id_ed25519`, which is `message seat init`'s layout.
+  The pub the adapter names is `seat.pub` in the same dir. KEYS is
+  `$SESSIONMAIL_HOME/seat-keys` when that is set; else `~/.sessionmail/seat-keys`
+  while that is a real folder (an existing host's keys never move); else
+  `~/.sessionkit/mail/state/seat-keys`, where a fresh host mints. See "Where the
+  keys are" in [`docs/message-seat.md`](../../docs/message-seat.md).
 - **It refuses before starting anything (exit 2)** when:
   - the sessionmail install is broken: the packaged wrapper is missing or not
     executable (said by `message` itself);
@@ -43,7 +47,9 @@ seat --help` answers when typed.
 - **A TERM** (launchd stopping the job) stops the agent and removes the socket, exit 0.
 - **The socket cap is 103 bytes.** macOS's `sun_path` is 104 bytes including the NUL.
   Measured: ssh-agent binds a 103-byte path and refuses a 104-byte one. The default,
-  `~/.sessionmail/seat-keys/<address>/agent.sock`, is well under the cap.
+  `KEYS/<address>/agent.sock`, is under the cap for a usual home and address
+  (`/Users/<name>/.sessionkit/mail/state/seat-keys/` is 45 bytes for a 4-letter
+  name); a longer one is refused before anything starts.
 - **An orphan agent.** If the wrapper is SIGKILLed outside launchd, its agent can outlive it,
   and the next start then refuses ("a live agent already answers"). Kill the orphan by
   hand. Under launchd this does not arise: a job's process group goes with the job.
@@ -57,15 +63,27 @@ answers. `--uninstall ADDRESS` boots it out and removes the plist. Their contrac
 [`docs/message-seat.md`](../../docs/message-seat.md).
 
 `message seat agent --template` prints it, and nothing else: it never renders it, loads
-it or runs launchctl. To render it by hand, replace each `@PLACEHOLDER@`, then lint it:
+it or runs launchctl. To render it by hand, set KEYS to the seat-keys folder (above),
+replace each `@PLACEHOLDER@`, then lint it. With no `SESSIONMAIL_HOME` of your own,
+drop its entry, as `--install` does; the wrapper then finds KEYS under the job's HOME:
 
+    KEYS=$HOME/.sessionkit/mail/state/seat-keys   # or $HOME/.sessionmail/seat-keys where the keys are
     message seat agent --template |
       sed -e 's|@ADDRESS@|bot.alice|g' -e "s|@MESSAGE@|$(command -v message)|g" \
-        -e "s|@SESSIONMAIL_HOME@|$HOME/.sessionmail|g" \
-        -e "s|@SOCKET@|$HOME/.sessionmail/seat-keys/bot.alice/agent.sock|g" \
-        -e "s|@LOG_DIR@|$HOME/Library/Logs|g" > /some/scratch/dir/dev.sessionkit.mail.seat-agent.bot.alice.plist
+        -e '/<key>SESSIONMAIL_HOME<\/key>/{N;d;}' \
+        -e "s|@SEAT_PUB@|$KEYS/bot.alice/seat.pub|g" \
+        -e "s|@SOCKET@|$KEYS/bot.alice/agent.sock|g" \
+        -e "s|@LOG_DIR@|$HOME/.sessionkit/mail/log|g" > /some/scratch/dir/dev.sessionkit.mail.seat-agent.bot.alice.plist
     plutil -lint /some/scratch/dir/dev.sessionkit.mail.seat-agent.bot.alice.plist
 
+With a `SESSIONMAIL_HOME` of your own, keep the entry and fill it instead
+(`-e "s|@SESSIONMAIL_HOME@|$SESSIONMAIL_HOME|g"`, absolute), with KEYS its `seat-keys`.
+
+`@LOG_DIR@` must be a folder that exists before launchd loads the job; `--install` makes
+`~/.sessionkit/mail/log` mode 0700 when it is missing. An agent installed before 0.3.2
+logs to `~/Library/Logs` and keeps doing so until it is uninstalled and installed again
+(see "The log" in [`docs/message-seat.md`](../../docs/message-seat.md)).
+
 `@MESSAGE@` is the path `command -v message` prints, not resolved: `~/.local/bin/message`
 under uv tool or pipx, `<venv>/bin/message` in a venv. It stays the same across upgrades,
 and its launcher is absolute, so launchd's `PATH=/usr/bin:/bin` is enough.
@@ -89,7 +107,7 @@ them as a plist dict.
 |---|---|
 | `TM_AGENT_ADDRESS` | the seat, `bot.alice` |
 | `DESK_SIGNER_SOCK` | this job's `SOCKET` |
-| `DESK_SIGNER_PUB` | `$SESSIONMAIL_HOME/seat-keys/<address>/seat.pub`, apart from the private key |
+| `DESK_SIGNER_PUB` | `KEYS/<address>/seat.pub`, apart from the private key |
 | `SESSIONMAIL_REQUIRE_SIGNATURE` | `1`: a send that cannot sign is refused |
 | `SESSION_REGISTRY` | the registry that `message seat init` registered into, for `message verify --trust` |
 

{sessionmail-0.3.1 → sessionmail-0.3.3}/src/sessionmail/_archive.py

@@ -197,11 +197,13 @@ def routed_names(text: str) -> set[str]:
     return names
 
 
-def mailbox_keys(text: str, rel: str) -> list[str]:
+def mailbox_keys(text: str, rel: str, boxes: str) -> list[str]:
     """The keys of REL's rows in a mailbox map's text: the rows whose
-    SECOND field is exactly `agents/<rel>/` (BN1), so both host forms are
-    found by one test and never by a substring."""
-    want = f"agents/{rel.lower()}/"
+    SECOND field is exactly `<boxes>/<rel>/` (BN1), so both host forms are
+    found by one test and never by a substring. BOXES is the boxes folder's
+    name on this tree (`Ctx.root.name`: `stores`, or `agents` on an old
+    tree), which the generator writes into every value."""
+    want = f"{boxes}/{rel.lower()}/"
     keys = []
     for line in text.splitlines():
         parts = line.split()
@@ -214,7 +216,7 @@ def mailbox_keys(text: str, rel: str) -> list[str]:
 class Ctx:
     """One run: where things are, and what it may ask."""
 
-    root: Path                          # the agents dir (`_maildir.root()`)
+    root: Path                          # the boxes dir (`_maildir.root()`); its name is the map values' folder
     archive: Path
     days: float = DEFAULT_DAYS
     maps: Path | None = None            # --maps DIR; None: ask postconf
@@ -411,14 +413,17 @@ def release_lock(archive: Path) -> None:
 
 def notmuch_configs(env: dict[str, str]) -> list[Path]:
     """Every notmuch config file this host could use: `$NOTMUCH_CONFIG`
-    (else `~/.notmuch-config`), each `~/.notmuch-config.<profile>`, and
-    each `$XDG_CONFIG_HOME/notmuch/<profile>/config`."""
+    (else `~/.notmuch-config`), each `~/.notmuch-config.<profile>`, each
+    `$XDG_CONFIG_HOME/notmuch/<profile>/config`, and each kit profile,
+    `~/.sessionkit/mail/settings/notmuch/<profile>/config` (`_index`)."""
     home = Path(env.get("HOME") or Path.home())
     found = [Path(env["NOTMUCH_CONFIG"]).expanduser()] if env.get("NOTMUCH_CONFIG") \
         else [home / ".notmuch-config"]
     found += sorted(home.glob(".notmuch-config.*"))
     xdg = Path(env.get("XDG_CONFIG_HOME") or home / ".config")
     found += sorted(xdg.glob("notmuch/*/config"))
+    from . import _index         # here, not at import: _index reaches _notmuch
+    found += sorted(_index.kit_profiles(env).glob("*/config"))
     out: list[Path] = []
     for p in found:
         if p.is_file() and p not in out:
@@ -853,7 +858,7 @@ def verify_gone(ctx: Ctx, text: str | None, m: Moved) -> tuple[str, str]:
     resolves against, so TEXT is the print (`Ctx.mailbox_text`)."""
     if text is None:
         return "UNKNOWN", "map unreadable"
-    if mailbox_keys(text, m.rel):
+    if mailbox_keys(text, m.rel, ctx.root.name):
         return "PRESENT", "regenerate did not take"
     if not m.keys:
         # BN6: a `moving` line with no keys (or a box with no row) cannot ask
@@ -873,7 +878,7 @@ def routed_now(ctx: Ctx, text: str | None, rel: str) -> bool:
     """REL has its row back, in the text and (when postconf answers) the .db."""
     if text is None:
         return False
-    keys = mailbox_keys(text, rel)
+    keys = mailbox_keys(text, rel, ctx.root.name)
     if not keys:
         return False
     if ctx.use_db():
@@ -893,7 +898,7 @@ def alias_db_hit(ctx: Ctx, rel: str) -> str | None:
     maps = _seat._postfix_maps("virtual_alias_maps")
     if not maps:
         raise Unknown("postconf could not say which alias .db postfix reads")
-    for key in mailbox_keys(ctx.mailbox_text() or "", rel):
+    for key in mailbox_keys(ctx.mailbox_text() or "", rel, ctx.root.name):
         if _seat._postmap_lookup(key, maps):
             return key
     return None
@@ -1020,7 +1025,7 @@ def _apply_locked(ctx: Ctx, c: Census, pf: Preflight, candidates: list[Row],
             warn(f"refused {rel}: archive/{rel} already exists; message box unarchive {rel} --merge --apply")
             continue
         text = ctx.mailbox_text()
-        keys = mailbox_keys(text or "", rel)
+        keys = mailbox_keys(text or "", rel, ctx.root.name)
         if not keys:
             warn(f"not moved {rel}: no mailbox row for it before the move (BN2)")
             continue