`send-quadrille-email.sh`

73 lines
#!/bin/bash
# TK-10895 — send the Quadrille vendor email (Erica, cc Rhaiza) via George.
#
# WHY THIS IS A PASTE AND NOT AN AGENT ACTION:
# George's external-send guard (server.js:1266) exists because "an autonomous worker drained gated
# vendor-email memos and auto-sent them via George". It fails closed on any external recipient
# unless a human-approval token is supplied. Running THIS script is the human approval — Steve
# executes it deliberately. The agent did not extract the token to auto-send.
#
# Body source of truth: ~/.claude/yolo-queue/pending-approval/2026-09-10-TK-10895-REVISED-email-quadrille-roll-length.md
# Rendered HTML:        ~/Projects/tk10895-groupB/quadrille-email.html
set -euo pipefail

GEORGE=http://127.0.0.1:9850
BODY_FILE=~/Projects/tk10895-groupB/quadrille-email.html
# `|| true` so a missing token doesn't abort here (set -e + pipefail) — let the explicit check below report it.
TOKEN=$(grep -m1 '^GEORGE_EXTERNAL_SEND_TOKEN=' ~/Projects/george-gmail/.env 2>/dev/null | cut -d= -f2- | tr -d ' ' || true)

if [ -z "$TOKEN" ]; then
  echo "!! GEORGE_EXTERNAL_SEND_TOKEN not found in ~/Projects/george-gmail/.env — cannot send."
  exit 1
fi
if [ ! -s "$BODY_FILE" ]; then
  echo "!! body file missing or empty: $BODY_FILE"
  exit 1
fi

echo "=== PREVIEW (first 40 lines of the HTML that will be sent) ==="
head -40 "$BODY_FILE"
echo
echo "=== TO: Erica@quadrilleinc.com   CC: Rhaiza@quadrilleinc.com   FROM: info@designerwallcoverings.com"
echo "=== SUBJECT: Re: Designer Wallcoverings"
echo
read -r -p "Send this now? type SEND to confirm: " ans
[ "$ans" = "SEND" ] || { echo "aborted — nothing sent."; exit 0; }

# George's API is Basic-auth'd; the MCP loads the same credential from Keychain.
# `|| true` so a missing Keychain item doesn't abort here (set -e + pipefail) — let the check below report it.
BASIC=$(security find-generic-password -s dw-agents -a admin -w 2>/dev/null || true)
BASIC=${BASIC//$'\n'/}
if [ -z "$BASIC" ]; then
  echo "!! no Keychain credential (service dw-agents / account admin) — cannot authenticate to George."
  exit 1
fi

# Secrets go through the environment, NOT argv — argv is visible to any local process via `ps`.
GEORGE_TOKEN="$TOKEN" GEORGE_BASIC="$BASIC" python3 - "$BODY_FILE" "$GEORGE" <<'PY'
import base64, json, os, sys, urllib.request
body_file, george = sys.argv[1], sys.argv[2]
token, basic = os.environ["GEORGE_TOKEN"], os.environ["GEORGE_BASIC"]
payload = {
    "account": "info",
    "to": "Erica@quadrilleinc.com",
    "cc": "Rhaiza@quadrilleinc.com",
    "subject": "Re: Designer Wallcoverings",
    "body": open(body_file, encoding="utf-8").read(),
}
req = urllib.request.Request(
    george + "/api/send",
    data=json.dumps(payload).encode(),
    headers={
        "Content-Type": "application/json",
        "X-Send-Approval": token,
        "Authorization": "Basic " + base64.b64encode(("admin:" + basic).encode()).decode(),
    },
)
try:
    print(json.load(urllib.request.urlopen(req, timeout=60)))
    print("\nSENT.")
except urllib.error.HTTPError as e:
    print("FAILED", e.code, e.read().decode()[:400])
PY