TK-11365: never send the internal "From job:" banner to an outside party

e7ccd8a94c764d8a358391923a2c5f9132607a6e · 2026-09-10 11:56:23 -0700 · Steve

The banner is an internal provenance aid and was OPT-OUT (inferSource), so any
caller that forgot no_source_tag prepended an internal job label to the top of
vendor and customer mail. Proven in prod on a real customer - four emails opening
"From job: kelly-reply-tk10830" - and found today on 14 of 15 queued vendor
drafts in info@ (WallQuest, York, Thibaut, Kravet, Brewster, MDC, Astek, OAL,
Sancar, Innovations, Egg-and-Dart, Quadrille).

The opt-out was also unreachable from the agent path: the george MCP tool
gmail_create_draft does not expose no_source_tag at all, so an agent drafting
vendor mail through the MCP could not suppress the banner even knowing about it.

Now: if ANY recipient is external, no banner. Internal mail keeps it, so the
provenance aid survives where it is actually useful. Fails open on error.

Logic unit-tested 5/5 offline: external, mixed internal+external, internal-only,
the internal gmail allowlist, and the explicit opt-out.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit e7ccd8a94c764d8a358391923a2c5f9132607a6e
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Sep 10 11:56:23 2026 -0700

    TK-11365: never send the internal "From job:" banner to an outside party
    
    The banner is an internal provenance aid and was OPT-OUT (inferSource), so any
    caller that forgot no_source_tag prepended an internal job label to the top of
    vendor and customer mail. Proven in prod on a real customer - four emails opening
    "From job: kelly-reply-tk10830" - and found today on 14 of 15 queued vendor
    drafts in info@ (WallQuest, York, Thibaut, Kravet, Brewster, MDC, Astek, OAL,
    Sancar, Innovations, Egg-and-Dart, Quadrille).
    
    The opt-out was also unreachable from the agent path: the george MCP tool
    gmail_create_draft does not expose no_source_tag at all, so an agent drafting
    vendor mail through the MCP could not suppress the banner even knowing about it.
    
    Now: if ANY recipient is external, no banner. Internal mail keeps it, so the
    provenance aid survives where it is actually useful. Fails open on error.
    
    Logic unit-tested 5/5 offline: external, mixed internal+external, internal-only,
    the internal gmail allowlist, and the explicit opt-out.
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 server.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server.js b/server.js
index 74bc9d1..a808867 100644
--- a/server.js
+++ b/server.js
@@ -1208,6 +1208,17 @@ function encodeMimeHeader(s) {
 function inferSource(body, req) {
   if (body && (body.no_source_tag || body.noSourceTag)) return '';   // opt out of the From-job banner
   if (req?.headers?.['x-george-no-tag']) return '';
+  // TK-11365 (2026-09-10): the banner is an INTERNAL provenance aid and must never reach an
+  // outside party. It was opt-OUT, so any caller that forgot no_source_tag prepended an internal
+  // job label to vendor/customer mail - proven in prod on a real customer (4 emails opening
+  // "From job: kelly-reply-tk10830") and found on 14 of 15 queued vendor drafts. The MCP tool
+  // gmail_create_draft does not even expose no_source_tag, so the opt-out was unreachable from
+  // the agent path. Now: if ANY recipient is external, no banner. Internal mail keeps it.
+  try {
+    const b = body || {};
+    const ext = _recips(b.to, b.cc, b.bcc).filter(a => !_isInternal(a));
+    if (ext.length) return '';
+  } catch (e) { /* helpers defined later in file; fall through to normal behaviour */ }
   const raw = body.source || body.job || body.from_job || body.origin
            || req?.headers?.['x-george-source']
            || req?.headers?.['user-agent']

← ce00205 auto-data-snapshot: 2026-09-10T10:34:55 (1 data files) — dat · back to George Gmail · auto-data-snapshot: 2026-09-10T14:13:31 (1 data files) — dat d751824 →