Skip to content

fix(email): detect reply prefixes case-insensitively - #1655

Draft
seonghobae wants to merge 5 commits into
autoresearch/frontend-sec-bumpfrom
autoresearch/reply-subject-prefix-1086
Draft

fix(email): detect reply prefixes case-insensitively#1655
seonghobae wants to merge 5 commits into
autoresearch/frontend-sec-bumpfrom
autoresearch/reply-subject-prefix-1086

Conversation

@seonghobae

@seonghobae seonghobae commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Current authority — 2026-09-12

  • protected root: develop@042b0c70531b229af3acbd0421a2f23098d848b3
  • canonical frontend dependency-security parent: #1623@17a7618eda2b212b691f08fa936e042b34258fc9
  • direct-develop predecessor: b3fd6fa041ae090634080b23c3371284c8375c73
  • ordinary parent adoption: fc03381e58ad245d566e37d2f761c60d103aaf46
  • production restoration: c952a1d7a6cac8b55f9ca992e12a82776ee8791a
  • strengthened regression: 3849cc4235964f1a4b2dac42f5fa0b528f7ac6ab
  • exact head / doctoring: 32d709b8367f16ca8bce634127dbe24622c144b8
  • lifecycle: Draft / product repair + exact-head independent approval complete / repository-owned execution GREEN / central CodeQL + parent integration pending / do not merge

Finding and repair

buildReplyPayload() previously recognized only exact-case Re:. Existing reply subjects such as RE: Original Subject, re: Original Subject, or mixed-case rE: Original Subject therefore received another generated prefix.

The product repair changes only the reply-marker check to a start-anchored ASCII case-insensitive ^re: match. Existing subject spelling is preserved; unprefixed subjects still receive canonical Re: . The regression covers uppercase, lowercase, mixed-case, and a non-prefix control (Release notes) so ordinary words beginning with re are not misclassified.

Standards traceability

RFC 5322 §3.6.5 permits reply subjects to begin with Re: and says only one instance ought to be used because repeated instances can have undesirable consequences. Naruon treats ASCII case variants of that human-readable marker as equivalent for interoperability while preserving the original user-visible subject text.

docs/doctoring/email-reply-subject-prefix.md records the problem, alternatives, scope, evidence boundary, and APA 7th reference:

Resnick, P. W. (2008). Internet Message Format (RFC 5322). Internet Engineering Task Force. https://doi.org/10.17487/RFC5322

Owner topology

The original direct-develop candidate inherited frontend dependency/security failures owned by #1623. fc03381e... preserves the original candidate as first-parent provenance, adopts exact #1623 as second parent, and starts from the canonical #1623 tree without force push or destructive rebase. The reply-prefix source and tests are then restored on that tree.

Fresh compare over #1623 is ahead-only with exactly three effective files: frontend/src/lib/email-threading.ts, frontend/src/lib/email-threading.test.ts, and docs/doctoring/email-reply-subject-prefix.md. No dependency manifest, lockfile, security-floor source, or workflow is copied into this lane.

Exact-head execution

Current exact 32d709b... has terminal-success repository-owned product/security lanes on the current feature base:

  • Application CI 34566987333 — success
  • Bandit Security Scan 34566987292 — success
  • Security Scan 34566987348 — success
  • SAST Semgrep 34566987336 — success
  • Build and Publish Docker Images 34566987448 — success

Central CodeQL PR 34566987310 remains terminal failure. This is the known compatibility-publication/wake-ordering lane: the leaf product checks are not evidence for bypassing that required central gate, and no Naruon workflow workaround is introduced.

Review boundary

CodeRabbit submitted formal APPROVED at 2026-09-11T07:42:50Z with commit_id=32d709b8367f16ca8bce634127dbe24622c144b8. Current inline review-thread count is zero. Therefore the independent exact-head review requirement is satisfied for the unchanged head. This corrects the earlier stale PR-body statement that approval was still pending.

Any source-changing descendant invalidates that exact-head approval for merge purposes.

Merge boundary

Keep Draft. Merge remains prohibited until central required CodeQL evidence is terminal-success on the unchanged exact head and #1623 is protected-integrated or otherwise satisfied through the canonical stacked-verification path. The current formal approval and repository-owned GREEN receipts do not authorize bypassing either prerequisite.

No self-approval, dummy requeue, temporary develop retarget, copied central workflow, synthetic status, stale-evidence transfer, or gate weakening.

buildReplyPayload only matched an exact "Re:" prefix, so subjects already carrying RE:/re:/rE: were prefixed again into "Re: RE: ...". Match the prefix case-insensitively and keep the original casing.
@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: ad0295a0-2f55-47ba-aed9-b7943eca3287

📥 Commits

Reviewing files that changed from the base of the PR and between 17a7618 and 32d709b.

📒 Files selected for processing (3)
  • docs/doctoring/email-reply-subject-prefix.md
  • frontend/src/lib/email-threading.test.ts
  • frontend/src/lib/email-threading.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The reply subject logic now recognizes Re: in any casing at the subject start. It preserves existing subjects, prefixes unmarked subjects, and treats empty subjects as unmarked. Tests and a decision record document the behavior.

Changes

Reply subject prefix handling

Layer / File(s) Summary
Case-insensitive prefix detection and validation
frontend/src/lib/email-threading.ts, frontend/src/lib/email-threading.test.ts, docs/doctoring/email-reply-subject-prefix.md
buildReplyPayload detects case-insensitive Re: prefixes and leaves other subjects eligible for the generated prefix. Tests cover mixed-case prefixes and Release controls. The decision record documents the matching rule and rejected alternatives.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 32d70

The reply-subject change has regression coverage and no actionable merge-blocking issue remains.

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: case-insensitive detection of email reply prefixes.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch autoresearch/reply-subject-prefix-1086

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae changed the base branch from develop to autoresearch/frontend-sec-bump September 11, 2026 05:42

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

현재 exact range 17a7618eda2b212b691f08fa936e042b34258fc9..32d709b8367f16ca8bce634127dbe24622c144b8만 검토해 주세요. Reply subject prefix의 RFC 5322 정합성, case-insensitive marker 판정, mixed-case/non-prefix regression, 그리고 #1623 owner adoption 이후 effective 3-file scope에 초점을 맞춰 주세요. Pre-retarget predecessor evidence는 current-head approval로 간주하지 않습니다.

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="17a7618eda2b212b691f08fa936e042b34258fc9"
head="32d709b8367f16ca8bce634127dbe24622c144b8"

echo '=== exact range ==='
git diff --stat "$base" "$head"
git diff --name-status "$base" "$head"
echo '=== exact patch ==='
git diff --find-renames --find-copies --no-ext-diff "$base" "$head" -- \
  frontend/src/lib/email-threading.ts \
  frontend/src/lib/email-threading.test.ts \
  docs/doctoring/email-reply-subject-prefix.md

echo '=== source outline ==='
ast-grep outline frontend/src/lib/email-threading.ts --items all --match 'buildReplyPayload|ReplyPayload' --view expanded || true
echo '=== buildReplyPayload contexts at base and head ==='
git show "${base}:frontend/src/lib/email-threading.ts" | nl -ba | sed -n '/buildReplyPayload/,/^[[:space:]]*}/p'
git show "${head}:frontend/src/lib/email-threading.ts" | nl -ba | sed -n '/buildReplyPayload/,/^[[:space:]]*}/p'

echo '=== test outline ==='
ast-grep outline frontend/src/lib/email-threading.test.ts --items all --match 'buildReplyPayload|reply' --view expanded || true
echo '=== changed test/documentation content at head ==='
git show "${head}:frontend/src/lib/email-threading.test.ts" | nl -ba | sed -n '1,260p'
git show "${head}:docs/doctoring/email-reply-subject-prefix.md" | nl -ba | sed -n '1,260p'

echo '=== commits exclusive to exact range ==='
git log --oneline --decorate "${base}..${head}"

echo '=== PR current state, review decision, checks ==='
gh pr view 1655 --repo ContextualWisdomLab/naruon \
  --json number,state,isDraft,headRefOid,baseRefOid,reviewDecision,reviews,statusCheckRollup,mergeStateStatus,url

Length of output: 28086


🤖 web_search executed:

RFC 5322 section 3.6.5 subject Re case insensitive exact wording

Length of output: 6720


@seonghobae 검토를 완료했습니다. 요청한 exact range만 검토했습니다.

발견 사항은 없습니다.

  • Effective scope는 지정한 3개 파일과 일치합니다.
  • buildReplyPayload()/^re:/i는 subject 시작 위치와 colon을 모두 요구합니다.
  • 기존 RE:, re:, rE: subject는 원래 표기를 유지합니다.
  • Release notes는 reply marker로 판정되지 않고 Re: prefix를 받습니다.
  • RFC 5322 §3.6.5의 단일 Re: prefix 권고와 일치합니다. Case-insensitive 판정은 기존 subject를 변경하지 않는 상호운용성 확장입니다.
  • Pre-retarget predecessor evidence는 current-head approval evidence로 취급하지 않았습니다.

PR #1655는 아직 Draft입니다. Current head의 required checks는 queued 상태입니다. GitHub의 current-head approval도 아직 없습니다. 따라서 승인 또는 merge 가능 상태로 판단하지 않습니다.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

현재 exact range 17a7618eda2b212b691f08fa936e042b34258fc9..32d709b8367f16ca8bce634127dbe24622c144b8만 다시 검토해 주세요. 이전 요청은 review-capacity limit에서 종료됐습니다. Reply subject marker의 RFC 5322 범위, ASCII case-insensitive 판정, mixed-case/non-prefix regression, 그리고 #1623 adoption 이후 effective 3-file scope에 초점을 맞춰 주세요. Pre-retarget/predecessor evidence는 current-head approval로 간주하지 않습니다.

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="17a7618eda2b212b691f08fa936e042b34258fc9"
head="32d709b8367f16ca8bce634127dbe24622c144b8"
repo="ContextualWisdomLab/naruon"

echo '=== Exact-range file scope ==='
git diff --name-status "$base" "$head"
echo
echo '=== Exact-range statistics ==='
git diff --stat "$base" "$head"

echo
echo '=== Exact patch ==='
git diff --no-ext-diff --find-renames --find-copies "$base" "$head" -- \
  frontend/src/lib/email-threading.ts \
  frontend/src/lib/email-threading.test.ts \
  docs/doctoring/email-reply-subject-prefix.md

echo
echo '=== Source outline ==='
ast-grep outline frontend/src/lib/email-threading.ts --items all --match 'buildReplyPayload|ReplyPayload' --view expanded || true

echo
echo '=== Head source context ==='
nl -ba frontend/src/lib/email-threading.ts | sed -n '/buildReplyPayload/,/^[[:space:]]*}/p'

echo
echo '=== Test outline ==='
ast-grep outline frontend/src/lib/email-threading.test.ts --items all --match 'buildReplyPayload|reply' --view expanded || true

echo
echo '=== Head test file ==='
nl -ba frontend/src/lib/email-threading.test.ts | sed -n '1,280p'

echo
echo '=== Head documentation ==='
nl -ba docs/doctoring/email-reply-subject-prefix.md | sed -n '1,280p'

echo
echo '=== Exclusive commits ==='
git log --oneline "$base..$head"

echo
echo '=== Current PR state ==='
gh pr view 1655 --repo "$repo" \
  --json number,state,isDraft,headRefOid,baseRefOid,reviewDecision,mergeStateStatus,url \
  --jq '{number,state,isDraft,headRefOid,baseRefOid,reviewDecision,mergeStateStatus,url}'

Length of output: 19071


🤖 web_search executed:

RFC 5322 section 3.6.5 exact subject reply prefix wording Re:

Length of output: 5195


@seonghobae 검토를 완료했습니다. 요청한 exact range만 검토했습니다.

발견 사항은 없습니다.

  • Effective scope는 frontend/src/lib/email-threading.ts, frontend/src/lib/email-threading.test.ts, docs/doctoring/email-reply-subject-prefix.md의 3개 파일입니다.
  • buildReplyPayload()/^re:/i를 사용합니다. 이 검사는 subject 시작 위치의 Re: ASCII marker만 인식합니다.
  • 기존 RE:, re:, rE: subject는 변경하지 않고 유지합니다.
  • Release notes는 marker가 아닙니다. 함수는 Re: Release notes를 생성합니다.
  • RFC 5322 §3.6.5는 reply subject가 "Re: "로 시작할 수 있다고 정의하고, 중복 사용을 피하도록 권고합니다. 이 변경은 기존 subject의 표기를 보존하면서 중복 prefix를 방지합니다.
  • Pre-retarget 또는 predecessor의 검사 및 승인 evidence는 current-head approval evidence로 사용하지 않았습니다.

PR #1655는 아직 Draft입니다. 현재 head는 요청한 32d709b8367f16ca8bce634127dbe24622c144b8입니다. 이 검토는 승인이나 merge 가능 상태를 의미하지 않습니다.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review the unchanged current exact stacked range 17a7618eda2b212b691f08fa936e042b34258fc9..32d709b8367f16ca8bce634127dbe24622c144b8. Focus on RFC 5322 reply-prefix semantics, mixed-case existing prefixes, false-positive prefix detection, preservation of user-visible subject text, and whether the three-file scope contains any regression. Central CodeQL publication failure is an owner-path gate, not a request to change Naruon source.

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="17a7618eda2b212b691f08fa936e042b34258fc9"
head="32d709b8367f16ca8bce634127dbe24622c144b8"
repo="ContextualWisdomLab/naruon"

echo '=== Exact range: changed files ==='
git diff --name-status "$base" "$head"

echo
echo '=== Exact range: statistics ==='
git diff --stat "$base" "$head"

echo
echo '=== Exact range: complete patch ==='
git diff --no-ext-diff --find-renames --find-copies "$base" "$head"

echo
echo '=== Source outline ==='
ast-grep outline frontend/src/lib/email-threading.ts --items all \
  --match 'buildReplyPayload|ReplyPayload' --view expanded || true

echo
echo '=== buildReplyPayload at exact head ==='
git show "${head}:frontend/src/lib/email-threading.ts" |
  nl -ba | sed -n '/buildReplyPayload/,/^[[:space:]]*}/p'

echo
echo '=== Test outline ==='
ast-grep outline frontend/src/lib/email-threading.test.ts --items all \
  --match 'buildReplyPayload|reply' --view expanded || true

echo
echo '=== Exact-head tests ==='
git show "${head}:frontend/src/lib/email-threading.test.ts" |
  nl -ba | sed -n '1,320p'

echo
echo '=== Exact-head doctoring record ==='
git show "${head}:docs/doctoring/email-reply-subject-prefix.md" |
  nl -ba | sed -n '1,320p'

echo
echo '=== Current PR state and reviews ==='
gh pr view 1655 --repo "$repo" \
  --json number,state,isDraft,headRefOid,baseRefOid,reviewDecision,mergeStateStatus,reviews,statusCheckRollup,url

Length of output: 33601


@seonghobae Review complete for 17a7618eda2b212b691f08fa936e042b34258fc9..32d709b8367f16ca8bce634127dbe24622c144b8.

I found no regression in the three-file scope.

  • The range changes exactly these files:
    • frontend/src/lib/email-threading.ts
    • frontend/src/lib/email-threading.test.ts
    • docs/doctoring/email-reply-subject-prefix.md
  • buildReplyPayload() uses /^re:/i. The check requires Re: at the start of the subject.
  • Existing RE:, re:, and rE: subjects are returned unchanged. This preserves user-visible subject text.
  • Release notes does not match because it lacks the required colon. The function generates Re: Release notes.
  • The tests cover uppercase, lowercase, mixed-case, and non-prefix input.
  • The implementation continues to generate canonical Re: for unprefixed and empty subjects.
  • The behavior is consistent with RFC 5322 §3.6.5 guidance to avoid repeated reply prefixes. The case-insensitive recognition is an interoperability behavior. It does not rewrite an existing Subject field.

The central CodeQL compatibility publication failures are outside this source-change scope. I found no Naruon source or test change that is required for that owner-path gate.

PR #1655 remains Draft. The current head is the requested commit. GitHub reports no submitted reviews, so this review is not an approval or merge readiness decision.


✏️ Learnings added
Learnt from: seonghobae
URL: https://github.com/ContextualWisdomLab/naruon/pull/1655

Timestamp: 2026-09-11T07:40:06.468Z
Learning: For Naruon pull request `#1655` at exact head `32d709b8367f16ca8bce634127dbe24622c144b8`, central CodeQL compatibility publication failures are owner-path merge gates. They do not require changes to the reply-prefix source or tests in `frontend/src/lib/email-threading.ts` and `frontend/src/lib/email-threading.test.ts`.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@seonghobae seonghobae added bug Something isn't working priority: high High-priority or P1 work labels Sep 12, 2026 — with ChatGPT Codex Connector
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working priority: high High-priority or P1 work

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant