Repository navigation
1.1.1: fix list sorting, full-text search, extension slot takeover; tags in email_mark; signing docs - #26
Open
vitalio-sh wants to merge 6 commits into
Open
1.1.1: fix list sorting, full-text search, extension slot takeover; tags in email_mark; signing docs#26vitalio-sh wants to merge 6 commits into
vitalio-sh wants to merge 6 commits into
Conversation
collectMessages stopped at `limit` in Thunderbird's database order and the sort ran afterwards, so `sort: "date", sortOrder: "desc"` returned the first N stored messages re-ordered — often months old — instead of the newest ones. With `sort`, the filtered folder is now collected in full, sorted, and offset/limit applied to the sorted list; hasMore is computed against the full set. Unsorted listing is unchanged. Fixes #24, fixes #15. Co-authored-by: squasso <13817979+squasso@users.noreply.github.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPQy2hf2UYq4jm9W7SBXB4
…on's slot Any local process could connect to :7701 and replace the extension socket, receiving every forwarded request and answering with forged data — bypassing the extension-side sanitization the threat model relies on. A new connection now only takes the slot if the connected extension fails to answer a ping within TB_BRIDGE_WS_TAKEOVER_MS (default 2000); otherwise it is closed with 1008. Half-open sockets after sleep still get replaced, and a cleanly disconnected extension frees the slot immediately. Implements options 1+2 from #22. The WebSocket side remains unauthenticated (option 3, a shared token in extension settings, is future work). Co-authored-by: jctots <5144517+jctots@users.noreply.github.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPQy2hf2UYq4jm9W7SBXB4
… a TIMEOUT code
- Text queries go through messages.query({ fullText }) — Thunderbird's
global search index over subject, body and author — instead of
{ body }, which scans message bodies and timed out on folders with
thousands of messages. searchMode: "body" (MCP) / --body-only (CLI)
keeps the scan; if fullText is unsupported the extension falls back to
it. The response reports which searchMode ran.
- The bridge answered extension timeouts with HTTP 500 and no code, so
clients surfaced them as THUNDERBIRD_ERROR. It now returns 504 +
TIMEOUT, 503 + EXTENSION_DISCONNECTED, and 500 + THUNDERBIRD_ERROR.
- MCP email_search rewrites a TIMEOUT into "results are UNKNOWN, not
empty" so an agent can't report a false negative.
Fixes #12.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WPQy2hf2UYq4jm9W7SBXB4
email_mark could only set read/flagged/junk, so MCP agents could filter by tag but never set one. It now accepts addTags and removeTags (read the message's current tags, apply the change, keep the rest) and tags (replace the whole set; [] clears). Mixing tags with addTags/removeTags is INVALID_ARGS. Uses the existing /messages/update endpoint, so no extension change is needed. Closes #10. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPQy2hf2UYq4jm9W7SBXB4
The release XPIs (2.0.0 and 2.1.0) contain no META-INF signature: the file addons.thunderbird.net returns after "Version Signed" is byte-identical to the uploaded build. README, SETUP, dist/releases, AGENTS, the skill, the architecture diagram and the release notes template claimed "signed and approved" or an "out-of-band trust registry" — replaced with what is verifiable: distributed via ATN, no embedded signature, byte-identical to extension/ at the tag, plus how to check it (and the SHA-256 for 2.1.0). Private vulnerability reporting is now enabled; SECURITY.md links it. Fixes #11. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPQy2hf2UYq4jm9W7SBXB4
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WPQy2hf2UYq4jm9W7SBXB4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes for the open issues, released as npm 1.1.1 / extension 2.1.1.
Changes
/messages/listsorting. Withsort, the whole filtered folder is now sorted beforeoffset/limit. Previously only the firstlimitmessages in storage order were sorted.messages.query({ fullText }), Thunderbird's search index, instead of a body scan.searchMode: "body"/--body-onlykeeps the scan, with an automatic fallback to it iffullTextis unsupported.TIMEOUT, 503EXTENSION_DISCONNECTED, 500THUNDERBIRD_ERROR.email_searchsays timed-out results are unknown, not empty.email_mark. NewaddTags/removeTags/tagsparameters.Testing
main.fullTextsearch speed and sorted listing on a large mailbox.🤖 Generated with Claude Code
https://claude.ai/code/session_01WPQy2hf2UYq4jm9W7SBXB4