Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Mail: a reply, forward or attachment built from a flagged message waits for approval

Open
  • Is something wrong?
#349 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
15/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
backend, security

Research direction

Start with flaggedTold in src/main/mail.ts and the mailAccess rules in src/shared/mailboxes.ts, then read #188, which this depends on. The open decision is whether a held send goes to the owner or to Michael, so settle that with the maintainers before coding. Done would mean a send with reply_to, forward or attach_from pointing at a flagged message is refused without a proposal id, while other sends are unchanged.

Written by the indexing model from the issue text.

Description

Problem / motivation

Follow-up to #188, as suggested in the review there.

With #188, when an agent reads a message that contains a clear injection attempt (for example "ignore all previous instructions" or a system: line), the agent is told not to follow those lines and Michael gets one notice. The agent then carries on with its work, which is what we want.

The gap is what comes next. If that agent can send without approval, or has a standing approval that fits, it can still reply to that message, forward it, or attach from it straight away. A reply or forward is exactly what an attacker in that email is usually asking for, and right now it goes out before Michael (or anyone) has looked at the notice.

Proposed solution

Keep it narrow, so ordinary mail is untouched:

  • Main already keeps the ids of flagged messages (flaggedTold in mail.ts). Keep a small, capped set of flagged message ids per mailbox.
  • When send carries reply_to, forward or attach_from that points at a flagged message, treat that one send as Send on approval: it needs a proposal id, and a standing approval does not count for it.
  • Every other send is unchanged, including other mail from the same agent and replies to unflagged messages in the same thread.
  • The refusal reason says why, so the agent can propose it instead: "This replies to a message that was flagged as a possible instruction attack. Use propose so it can be checked before it goes."

Since only high-confidence flags count, this should be rare, and it only touches the one send that is built on the suspicious message.

Alternatives considered
  • Hold every send from an agent after it reads a flagged message. Simpler, but it would stop unrelated work, which goes against agents carrying on by themselves.
  • Let Michael decide instead of the owner. In keeping with #188 (tell Michael, not the owner), the held send could go to Michael first, and he approves it or passes it to Ask me. I'm happy to build it that way if you prefer; it needs a way for Michael to approve a proposal, which I don't think exists yet.
  • Do nothing and rely on the note. The note helps, but a model can still be talked round, and a send is the one action that can't be undone.
Area

Other (mail: src/shared/mailboxes.ts mailAccess, src/main/mail.ts)

If this direction works for you, I'm happy to open a PR for it once #188 is in.

Dominant language
TypeScript
Stars
273
Forks
211
Avg merge
13h 7m
Merged PRs (30d)
195

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from agentvivekkumar/dontbemichael

All issues in agentvivekkumar/dontbemichael

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.