feat: add safe compose session lifecycle - #350
Open
salmonumbrella wants to merge 12 commits into
Open
Conversation
Results ranked by relevance instead of date-only: subject > sender > body (setweight A-D + ts_rank_cd), prefix matching as you type, quoted phrases, served by a GIN index over a trigger-maintained search_fts column. Backfill runs as a resumable background drainer (fast-DDL migrations 0035-0037, no boot-blocking rewrite); not-yet-backfilled rows fall back to the previous query path. Body text is materialized by a provider-gated background IMAP drainer with circuit breakers, poison-message forward progress, and progress reporting. Filter-only queries stay date-ordered. No infrastructure changes - runs on stock postgres:16-alpine. Split 1/3 of maathimself#283. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tor) Explicit opt-in embeddings pipeline against any OpenAI-compatible /v1/embeddings endpoint (key encrypted at rest, host-validated, masked on read). Fingerprinted generations (config change => clean rebuild), a crash-safe fill worker, per-dimension HNSW partial indexes, re-embedding of late-arriving bodies. Query side adds hybrid BM25+ANN reciprocal-rank fusion behind an in-input Semantic toggle; lexical stays the default, with silent fallback while the index builds. Settings UI with explicit privacy copy and live Test/Build progress, in all 7 locales. Migrations 0038-0039. Includes the search-eval harness that produced the published quality numbers, and its explain/total diagnostics seams. Infra: compose moves postgres:16-alpine -> pgvector/pgvector:pg16 (same PG16 major). Run REINDEX DATABASE once after the first boot: the musl -> glibc collation change can misorder existing text btree indexes; the app logs a loud warning when it detects this. Split 2/3 of maathimself#283, stacked on the weighted-FTS PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Streamable-HTTP /mcp endpoint (SHA-256-hashed tokens minted in Profile, Origin-validated, rate-limited) exposing 12 tools including semantic_search_messages and search_in_message. Every call is scoped to the token owner's accounts; deletion is staged-only. Adds the MCP-only search seams (trusted account scoping, body-scope FTS leg, strictVector, loadVector), the chunk-excerpt read path, migrations 0040-0041, and one new backend dependency: @modelcontextprotocol/sdk. Split 3/3 of maathimself#283, stacked on the semantic-embeddings PR. The stacked tree is byte-identical to the reviewed maathimself#283 head (3773150). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tings Extends the read-only MCP server (maathimself#296) to the full mail client: - Token scopes (read/write/send/settings) enforced fail-closed at one dispatch choke point; tools/list filtered per token; existing tokens stay read-only. Per-class rate limits plus a daily send cap. - 33 new tools (58 total): drafts, send/reply/reply-all/forward with hard alias validation and receipts, unsend via a real outbox (0-120s window, SKIP LOCKED worker, race-safe cancel), honest best-effort recall, folders/ move/archive/trash/flags/spam/snooze/category/GTD with refuse-unbounded guards, an inbox-triage loop (triage_inbox / get_triage_context / mark_triaged) with embedding-derived signals, and settings tools including a staged add_account that never accepts secrets over MCP. - Undo-send frontend: countdown toast with Undo, user preference (0-120s, default off so upgrades never change send behavior). - Service extractions shared by REST and MCP (send/draft/reply/mailbox), fixing real bugs en route: alias silent-fallback, the References chain (thread_references was never used by compose), drafts dropping threading headers, and a new synchronous account test-connection endpoint. - Migrations 0042-0046. Every tool def carries MCP annotations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the safe compose lifecycle on top of #349: source-draft claiming, atomic
close-to-Drafts, explicit discard, queued send/undo, and durable restore
capsules.
Review the last commit only:
679de27(feat: add safe compose session lifecycle).Changes
mailbox results.
and SHA-256 checks before mutation.
Testing
green.
example.comfixtures only.Contributor License Agreement
By submitting this pull request I confirm that:
third-party material and confirmed it is compatible with the CLA).