auto-save: 2026-07-16T09:12:20 (1 files) — lib.js

3edd995edb1fa37d5197e520b217d23a9eb1fd02 · 2026-07-16 09:12:22 -0700 · Steve Abrams

Files touched

M lib.js

Diff

commit 3edd995edb1fa37d5197e520b217d23a9eb1fd02
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:12:22 2026 -0700

    auto-save: 2026-07-16T09:12:20 (1 files) — lib.js
---
 lib.js | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/lib.js b/lib.js
index eaa2930..59af214 100644
--- a/lib.js
+++ b/lib.js
@@ -64,14 +64,11 @@ function gate(parsed) {
 
   if (!cfg.allowed.includes(from)) return { ok: false, reason: `sender not allowlisted: ${from}` };
 
-  const subject = (parsed.subject || '');
-  // Normalize away case + every non-alphanumeric char on BOTH sides so the
-  // phrase still matches when a human types it naturally: "DUST 2026",
-  // "[ok:DUST2026]", "dust-2026" all collapse to "dust2026". This loosens
-  // formatting, NOT security — a stranger still can't guess the token.
-  const norm = (s) => (s || '').toLowerCase().replace(/[^a-z0-9]/g, '');
-  const hasPhrase = cfg.phrase && norm(subject).includes(norm(cfg.phrase));
-  if (!hasPhrase) return { ok: false, reason: 'missing secret phrase in subject' };
+  // Secret phrase NO LONGER required (Steve 2026-07-16: "allowlist = enough").
+  // The allowlist check above already hard-rejects any non-allowlisted sender, so
+  // the phrase was only ever a redundant second factor on trusted mail. The gate
+  // is now: on the allowlist AND DKIM/DMARC-aligned. Dave + every George agent
+  // account can just email claude@agentabrams.com with any subject.
 
   if (cfg.requireAuthPass) {
     const ar = headerStr(parsed, 'authentication-results').toLowerCase();

← 69f2dae chore: macstudio3 migration — reconcile from mac2 + repoint · back to Claude Mail · claude-mail: retire secret phrase — allowlist + DKIM is the 4294bd6 →