Matthew Meszaros
bb4156cc6a
feat: add resource-scoped member access that restricts a member to selected campaign folders, campaigns and mailboxes read-only, enforced in the API route gate, SQL filters, permission trigger, realtime channels and dashboard
2026-10-09 13:34:05 +02:00
Matthew Meszaros
676445a6ee
Merge pull request #888 from warmbly/devin/1791517488-campaign-mailbox-admission
...
feat: enforce per-mailbox campaign caps and configurable variable sending defaults
2026-10-09 04:56:33 +00:00
Matthew Meszaros
b95655c358
Merge remote-tracking branch 'origin/main' into fix888
2026-10-09 06:40:54 +02:00
Matthew Meszaros
1386dac607
Merge pull request #892 from warmbly/feature/campaign-positive-reply-analytics
...
feat: positive replies, positive reply rate and interested leads in campaign analytics
2026-10-09 04:28:22 +00:00
Matthew Meszaros
b9cc87db1a
feat: enable configurable 28–32 daily mailbox sending plans with admission rechecks, clear limit controls and consistent UTC placement budgets
2026-10-09 04:18:52 +00:00
Matthew Meszaros
fd1c333402
feat: add positive replies, positive reply rate, interested leads and a reply-class breakdown to campaign analytics (summary, per-step, daily series, AI tool, OpenAPI, Zapier/Make samples), show them on the campaign overview with a reply quality card, positive chart series and step column, mirror them in the iOS models, document them, and seed classified replies plus a proof flow
2026-10-09 06:08:28 +02:00
Matthew Meszaros
6d88588350
feat: filter the Analytics dashboard by campaigns and campaign folders (campaign_ids/folder_ids on GET /analytics/dashboard, resolved server-side to one deduplicated org-scoped set), with a picker on web, a filter sheet on iOS, CLI flags, an AI tool argument, and API, OpenAPI and guide docs
2026-10-09 06:04:31 +02:00
Matthew Meszaros
f23c04ddd8
Merge remote-tracking branch 'origin/main' into feature/slack-app-agent
...
# Conflicts:
# deploy/slack/manifest.json
# docs/content/docs/development/slack-app.mdx
# docs/content/docs/guides/slack.mdx
# internal/app/integration/slack.go
# internal/app/slackapp/agent.go
# internal/app/slackapp/client.go
# internal/app/slackapp/slackapp_test.go
# web/src/lib/integrations/oauthPopup.ts
2026-10-04 06:54:19 -07:00
Matthew Meszaros
4bd5c1283c
feat: refuse assistant connect links for integrations this instance has no credentials for, give a second OAuth account the first free label so it never replaces another account's connection, open the integration OAuth window inside the click so browsers do not block it, and stub the Slack test repository so link prompts run with APP_URL set
2026-10-04 05:32:44 -07:00
Matthew Meszaros
801c87ffe1
feat: make the Warmbly Slack bot a mention-driven agent that DMs the account link, answers the held question once linked, auto-links the installer, reacts while working, lets teammates take over a thread, sets up Slack and links integrations through permission-gated assistant tools with strict approvals in channels, drops the /warmbly slash command, and replaces the integration connect drawer and label field with a connect popup
2026-10-04 05:15:07 -07:00
Matthew Meszaros
5d4b0ad6e5
feat: hold the invite_member, update_member_role and rotate_webhook_secret AI tools to the same recent confirmation their REST routes require, answering reauth_required on /ai/tools and refusing them where no confirmed session exists
2026-10-04 05:14:30 -07:00
Matthew Meszaros
663c3013d1
feat: bind each Remie approval to its tool call and run it once, show every argument and the resolved send on dashboard and Slack approval cards, keep always-allow to settings managers with a revocable list and never for tools that start sending or change access, withhold secrets and unpermitted tool results from the assistant and shared conversations, gate /mcp, /ai/tools and the web and playbook tools on AI_AGENT or use_ai, and scope get_mailbox by organization
2026-10-04 03:45:02 -07:00
Matthew Meszaros
1c555934a5
feat: authorize warmup ban status and warmup appeals by the caller's organization and its view_campaigns / manage_emails gates, so any member who manages mailboxes can appeal, answering 404 for a mailbox outside the workspace
2026-10-04 03:22:09 -07:00
Matthew Meszaros
6c36be44aa
feat: require the actor to hold every permission a role edit, re-role or member removal takes away as well as every one it grants, matching role deletion, with the workspace owner holding all permissions
2026-10-04 03:22:09 -07:00
Matthew Meszaros
ec77a3e3d2
feat: key unibox snoozes by organization as well as user and thread (migration 000259 backfills from each thread's mailbox organization), scope every snooze read and write and the org-transfer scope to it, and resolve unibox list cursors only within the caller's organization or user
2026-10-04 03:22:09 -07:00
Matthew Meszaros
43a9d004f2
feat: bound user-authored templates (range only over data fields, two-deep nesting, no template calls, 1 MiB output, capped compile cache) for campaign and automation rendering, accept only single addresses and single Message-IDs for to/cc/bcc/in_reply_to on every send path with invalid_recipient and invalid_message_id, refuse multi-line headers in the Gmail, Graph and SMTP writers, always apply a no-script CSP and drop non-http(s)/mailto/tel link targets in email previews, treat only single-slash paths as internal Remie links, accept integration OAuth callbacks only from the API origin, and follow only http(s) form redirects and app install links
2026-10-04 03:02:37 -07:00
Matthew Meszaros
ff54338806
feat: keep every deal in the pipeline its stage belongs to on create and update, validate pipeline stage names and colours in the CRM service for every caller, bound the AI bulk contact edit to MaxContactBatchIDs parsed ids, and start placement tests for API-key callers only through the REST route that applies the key's mailbox limits
2026-10-04 03:02:15 -07:00
Matthew Meszaros
bf47984cd5
feat: cap every OAuth grant and API key at the delegating member's role (consent narrows scopes and reports the withheld ones, tokens re-check the member's current role at every gate and MCP tool, keys stay within their creator's permissions, mailboxes and IP allowlist), keep OAuth tokens off API key and OAuth app management, require a fresh sign-in to approve an app, revoke a grant whose refresh token is presented twice, count only unexpired grants as installs, seal app webhook secrets under the instance key, name the workspace and flag unverified apps on the consent screen, and let credential managers list and revoke every member's app authorizations
2026-10-04 02:59:10 -07:00
Matthew Meszaros
610d511307
feat: answer every server-side failure in admin, internal, webhook, warmup routing, Stripe webhook, agent tool and MCP handlers with the fixed internal error and log the detail against the request id, keep correctable webhook and routing refusals as typed errors with their own messages, drop the request URL from MillionVerifier transport errors so the API key never reaches a log or response, and redact :code path parameters in the access log
2026-10-04 02:57:17 -07:00
Matthew Meszaros
f0ec39febd
feat: scope automation and sequence unsubscribes to the caller's organization, require manage_settings to create, edit, enable or delete automations, run each integration action only on its own provider's connection (400 action_provider_mismatch), refuse org-permission gates when no organization service is wired, read /integrations/bookings like contacts, scope lead claims, research runs and CRM list cursors to the organization, and bind contact note edits to the contact in the path
2026-10-04 02:47:10 -07:00
Matthew Meszaros
a84b3bbbf3
feat: mark only a conversation's newest received message unread on Mark as unread, never a sent or draft copy, from the reader, the row menu, the selection bar, PATCH /unibox/seen and the mark_thread_seen AI tool, with the guide and API docs updated
2026-10-01 22:22:56 -07:00
Matthew Meszaros
f41b377f0c
feat: offer the Advisor's campaign hold only while a mailbox is still sending cold, reseed warmup when an AI tool switches a mailbox on or starts warmup, and fix the mailbox switch's bulk selection, double clicks and revoked-mailbox hints
2026-09-30 21:02:00 -07:00
Matthew Meszaros
7ea17c0150
feat: let a switched-off mailbox be switched back on from its row menu, warmup menu, drawer, settings and the selection bar, and make the Advisor's stop-cold-sending fixes hold the mailbox from campaigns instead of switching it off
2026-09-30 20:45:42 -07:00
Matthew Meszaros
184e26a427
feat: call contact categories and inbox labels one name, Labels, across the dashboard (contacts tab moved to /app/contacts/labels with a redirect, pickers, filters, import, export, forms, segment field, timeline, and the Add label, Remove label and Label conversation automation actions), backend messages, AI tool descriptions and docs, keeping every API field name unchanged
2026-09-30 06:17:57 +02:00
Matthew Meszaros
d99a09825f
feat: run one inbox placement test across many sending mailboxes as a placement batch (issue #736 ): server-side sender scopes (a campaign's senders or the whole workspace, filtered by provider, domain, tag and untested days) and sampling (random, percent stratified by provider or domain, per domain, per provider) snapshotted at creation, a runner that starts senders under per-workspace and instance-wide concurrency and a start rate with defer or skip for unavailable mailboxes, aggregate placement by sending domain, sending provider and recipient provider, fleet coverage, cancel, credits agreed per batch, org transfer, operator settings in the admin panel, dashboard pages and dialog, CLI commands, agent tools, OpenAPI and docs
2026-09-29 10:19:46 -07:00
Matthew Meszaros
f88ecd7b4c
feat: rebuild the new campaign flow as Leads, Emails, Schedule and Review with a lead-list picker, the full step editor and a live launch plan, keep unlaunched campaigns as server drafts that reopen in the flow from the campaigns list and a Continue setup button, simulate POST /campaigns-estimate day by day under warmup graduation, warmup mail sharing the send spacing, other campaigns, health holds and follow-up waits, retire one-time emails (migration 000229 drops campaigns.kind, the list type filter and badge go), enlarge the step subject field, and lift the editor popovers above dialogs
2026-09-29 01:37:07 -07:00
Matthew Meszaros
4924d2c88d
feat: let a placement test target chosen seed inboxes or providers, add a quick pace that sends copies seconds apart, charge credits with explicit consent for tests past the monthly free allowance with automatic refunds for tests that deliver nothing, and add a Seeds picker to the compose window
2026-09-27 21:16:12 -07:00
Matthew Meszaros
f00591b6e1
feat: read a campaign's first send inside the summary query instead of a separate untenanted lookup, file campaign hourly stats under the same UTC day as the daily series, treat any instant passed as a campaign period day as its calendar day, share one from/to parser between the analytics API and get_campaign_stats, chart All time from the campaign's creation day alongside the summary so an analytics error cannot leave the overview loading, and roll period presets over at UTC midnight
2026-09-26 23:00:30 -07:00
Matthew Meszaros
0b809dee40
feat: scope campaign analytics to an optional from/to send cohort (summary, step performance, engagement and the daily chart read the same UTC days, total_contacts and emails_pending stay campaign-wide, date_range reports the resolved period), count the whole last day in campaign compare and daily stats, add a 7d/30d/90d/all-time/custom period picker to the campaign overview and its share image, take the period in get_campaign_stats, the warmbly and warmblyctl CLIs and the Make and Zapier modules, close a date picker's calendar alone on Escape, and document it in the analytics guide, API reference, MCP table and OpenAPI
2026-09-26 22:42:19 -07:00
Matthew Meszaros
bbcf8725c3
feat: add warmbly placement CLI commands for overview, test, list, view, cancel, seed inboxes and campaign monitors, the list_placement_tests, get_placement_test and run_placement_test assistant tools, and the placement commands in the warmbly-cli skill
2026-09-25 20:56:02 -07:00
Matthew Meszaros
a544847fcb
feat: resolve a Unibox reply's Gmail thread per sending mailbox (its own copy of the conversation, or the thread its earlier reply started, and none for other providers or on a failed lookup keeps the handle), honour an API key's mailbox allowlist on scheduled list and cancel, fall back from a saved mailbox that is gone and block Send until the sender can send, fetch From candidates only when the picker opens, and fix the Unibox threading and drafts docs
2026-09-23 21:29:24 -07:00
Matthew Meszaros
ce5eb4fd25
feat: let a Unibox reply or forward choose its sending mailbox in From (the shared MailboxPicker without Auto, kept in the draft and the undo-send), send the provider thread handle only from a mailbox that holds the thread so a switched reply threads on In-Reply-To alone, and scope scheduled sends, their cancel, count and cap to the organization whose mailboxes send them ( #670 )
2026-09-23 21:18:20 -07:00
Matthew Meszaros
0a5e7947b4
feat: return a failed warmup retention delete from the worker so the bus redelivers it up to five times, re-key a Graph message in the map on every move so the sender copy's body can be dropped, never expunge a whole IMAP folder for one message (UID EXPUNGE, else MOVE to Trash, else refuse), build the two retention indexes concurrently in their own migrations 000193 and 000194, keep the dashboard stepper off 1 and 2 days, and describe retention as applying wherever the placement files warmup mail
2026-09-21 01:11:22 -07:00
Matthew Meszaros
1513419a2a
feat: delete warmup mail from each mailbox once past a per-mailbox retention window (email_accounts.warmup_retention_days, else retention.warmup_mail_days, default 30) via a consumer sweep that retires the receipt and sender copy and a worker delete action that trashes on Gmail, deletes on Graph, expunges on IMAP and drops the stored body, prune per-message warmup records after retention.warmup_event_days, and count a warmup deletion as tampering only within 24 hours of arrival and never for a retired message, judging Gmail's Trash label on the same rule
2026-09-21 00:52:02 -07:00
Matthew Meszaros
7b93e48bd4
feat: make Archive mean something everywhere by keeping filed conversations out of every working unibox view except All mail and the Archive folder, read a mailbox address out of the raw From header so Awaiting reply stops missing every thread sent as "Name <addr>", file and mark read by thread id rather than by message id, and add per-row triage actions plus a multi-select selection bar to the conversation list
2026-09-20 07:16:35 -07:00
Matthew Meszaros
addb956ad6
feat: shared TypeSafe client under internal/pkg/typesafe with inbox tagging phases 2 and 3 (hold, stop, task, suppress behind workspace switches, reversible ones on by default), labels seeded at workspace creation and by the follow-up sweep, premade inbox views (hot leads, needs a reply, follow up, declined, automated), typed reply classification and a reply_intent branch condition, an inbox agent draft gate, Advisor copy judgment with a cached editor re-check, warmup content lint, bounce cause classification that keeps a blocked address sendable, and per-form submission triage
2026-09-19 23:33:37 -07:00
Matthew Meszaros
acecd62c88
feat: scope mailbox disconnect and warmup lifecycle to the workspace rather than the member who connected the mailbox so an admin can act on every mailbox the list already shows them, evict a mailbox whose row is gone from every live worker when its provider errors arrive so a deleted mailbox stops calling the provider once a sync interval forever, subscribe before publishing the credential-validation job and classify a socket deadline as the retryable timeout it is, give the worker's validation reply its own budget so a slow mail host no longer loses a finished verdict, guard every global key handler against a keydown carrying no key, drop exceptions whose whole message is an object's default toString, make the Postgres pool size configurable, and record the CASA and security invariants in AGENTS.md
2026-09-19 12:49:46 +02:00
Matthew Meszaros
e668a2a36b
feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa
2026-09-19 08:18:35 +02:00
Matthew Meszaros
f99ee57484
feat: scope mailbox disconnect to the workspace instead of the connecting member, so a teammate with manage_emails no longer gets 404 on a mailbox the list shows them, delete by id in the repository on the strength of that check while the worker removal still names the owner the consumer's unibox cleanup is keyed on, and read the API's own reason off the normalised AppError in the accounts page so a refused disconnect says why instead of "The mailbox couldn't be disconnected" on every failure
2026-09-19 06:01:03 +02:00
Matthew Meszaros
0f5ca71155
feat: correct mailbox sending metrics and workspace analytics across dashboard surfaces
2026-09-16 21:44:42 -07:00
Matthew Meszaros
6762b4e491
feat: scope contact activity timelines to the selected organization so teammates can load contacts and campaigns created by other members
2026-09-16 08:20:31 -07:00
Matthew Meszaros
def0a5e5f1
feat: restore workspace campaign access and enforce shared analytics permissions ( #543 )
2026-09-16 03:31:01 -07:00
Matthew Meszaros
50711a8e66
fix: a campaign's linked segments are its audience, so detaching one withdraws its leads ( #510 ) ( #523 )
...
* fix: make a campaign's linked segments the audience rather than an accumulator, so detaching one withdraws the leads it enrolled instead of leaving the old list mixed in with the new, tracked by a new campaign_leads.source that keeps a hand-picked lead, an overlapping segment's member and anyone the campaign has already emailed out of the withdrawal, and reported back as withdrawn/contacted counts the dialog confirms and explains (issue #510 )
* fix: serialize the linked-segment sweep against a link replacement by taking the same campaign lock, so a sweep that read the old set cannot re-enrol the audience the replacement just withdrew, and word the dialog's confirm and toast so the campaign, not the segment, is what has already emailed a lead
* fix: stop the one-shot segment enrol from re-stamping leads that are already in the campaign, since the Leads tab's Add back runs through it and pinning a whole linked audience as hand-picked because one held-out member was restored is the accumulation this change exists to end
* fix: lock the leads a detachment is about to withdraw before deciding, because a send is reserved by stamping campaign_contact_progress and only then locking the lead row, so a reservation committing mid-pass was invisible to the delete's snapshot and could withdraw a lead whose first email had already gone; and report the already-emailed count on every toast branch, since a detach where the whole audience had been emailed changed no count and said nothing after confirming a removal
* fix: add the campaign_leads.source check constraint NOT VALID, which still enforces every insert and update while skipping a full scan of the largest table in the product under ACCESS EXCLUSIVE to learn that a one-statement-old column holds its own default everywhere
2026-09-14 22:12:15 -07:00
Matthew Meszaros
13e9ce8e10
feat: hold a lead whose mailbox answers out of office until they are back, resuming at the return date it names, plus a manual per-contact pause in one campaign that unsubscribing and the suppression list were the only stand-ins for
2026-09-14 09:26:06 -07:00
Matthew Meszaros
6b6efca865
fix: campaign follow-ups opened a new conversation instead of replying in the contact's thread, so carry In-Reply-To/References and the Gmail threadId from the previous send, give every step a reply-in-thread switch, and let a threading step inherit the conversation's subject (issue #472 ) ( #489 )
2026-09-13 20:51:41 -07:00
Matthew Meszaros
c4aece241b
feat: scope the tag, category and folder registries and unibox conversation labels to the organization instead of the creating user, so a teammate sees and can edit the labels the owner made, splitting a label two workspaces shared into one copy each and guarding every label write against ids from another workspace ( #457 )
2026-09-12 03:37:31 -07:00
Matthew Meszaros
47defafa09
feat: fix the six self-host defects reported in issue #439 ( #456 )
...
* feat: fix the six defects reported in issue #439 by mapping the IMAP UNAVAILABLE, INUSE and NONEXISTENT response codes to retry-level errors instead of a critical reconnect prompt, synthesising a stable no-msgid key so one message with no Message-ID header can no longer 400 the internal map endpoint and wedge every later sync pass with its cursors held, adding mailhtml.FromText and HasContent so an API or agent-created step with a plain body stops shipping the composer's empty div placeholder as its text/html part (derived on create and plain-only update, exposed as body_html on update_campaign_step, dropped at send and preview time, and refused at campaign start with empty_step_body), honouring sender_strategy='explicit' in ResolveCampaignSenderPool and ValidateCampaignReady so an emptied explicit pool parks the campaign instead of widening it to every mailbox in the workspace, making the paused_no_accounts auto-pause loud with an error log line, an error-level activity-feed entry and an org-scoped CAMPAIGN_PAUSED realtime pulse, gating the admin sign-in's Turnstile widget on GET /v1/auth/config so a self-host with CAPTCHA_PROVIDER=none is not locked out, and parsing NATS_URL down to its host:port so a credentialed bus URL no longer reports NATS down
* feat: act on the self-review of the issue #439 fixes by dropping the campaign wizard's own escapeHtml body_html builder, which entity-escaped the quotes in a conditional and made the template fail to parse at send time, and letting the backend's FromText render that part instead so wizard-written steps also get their bare URLs linked for click tracking, correcting the docs and openapi description that claimed an explicit sender pool never falls back when it still unions its tags as migration 000013 designed, extracting the duplicated blank-HTML-part guard into dropBlankHTMLPart shared by the send path and the preview, and recording why the no-msgid key keeps the folder name despite a RENAME changing it
* feat: address the CodeRabbit review on the issue #439 fixes by holding the admin sign-in's Turnstile widget unmounted until /v1/auth/config resolves so an instance with no route to Cloudflare cannot raise a widget error on a screen nobody submitted, failing StartCampaign closed when the sequence read errors rather than skipping both the malformed-template and empty-body refusals, giving TCPCheck the default port its protocol assumes so a portless NATS_URL is no longer reported down, leaving a URL that carries a merge field unanchored because the send path renders bodies with text/template and a quoted contact value would break out of the href, and correcting the sequences guide and the Campaign and CampaignUpdate openapi descriptions that named the wrong tag field
2026-09-12 03:13:38 -07:00
Matthew Meszaros
470654f5b0
feat: say machine_clicks counts the contacts whose only clicks on a step were automated rather than counting steps, document the zero-send rule on all four step rates in the OpenAPI schema, and stop get_campaign_stats dropping the machine open and click counts from both the campaign totals and each step
2026-09-11 09:12:22 -07:00
Matthew Meszaros
5087023e48
feat: give every campaign step its own open, click, reply and bounce rate in Step performance, computed against that step's own sends, with the automated share of its opens and clicks carried alongside them through GetSequenceStats, the campaign analytics API, the get_campaign_stats AI tool and the docs
2026-09-11 08:56:03 -07:00
Matthew Meszaros
68b5d8f358
feat: bind a campaign lead to the mailbox that sends its first email so every follow-up leaves from the same address, holding a lead back while its mailbox is merely out of budget or outside its hours and moving it to another mailbox only when that one can no longer send for the campaign at all
2026-09-09 08:51:00 -07:00
Matthew Meszaros
Matthew Meszaros