63 lines
2.5 KiB
Markdown
63 lines
2.5 KiB
Markdown
# Session learnings — 2925 account pool + Luban SMS + reporting guardrails (2026-05-11)
|
|
|
|
## 2925 provider decision
|
|
|
|
BOSS decided to abandon POP3/SMTP/IMAP forwarding from 2925 to ClawEmail. Use 2925 Webmail directly with a local account pool.
|
|
|
|
Hard invariant:
|
|
|
|
```text
|
|
selected account: chickliu2021@2925.com
|
|
allowed alias: chickliu2021xxxxxx@2925.com
|
|
reader mailbox: chickliu2021@2925.com
|
|
```
|
|
|
|
Never generate an alias from one account local-part and read codes from another account. Before polling, verify both:
|
|
|
|
```text
|
|
alias.localPart startsWith selectedAccount.localPart
|
|
displayedMailboxEmail == selectedAccount.email
|
|
```
|
|
|
|
If the displayed mailbox mismatches, clear cookies for `2925.com`, `www.2925.com`, `mail2.xiyouji.com` and force-login the selected account.
|
|
|
|
BOSS-provided pool is stored locally at:
|
|
|
|
```text
|
|
~/.hermes/secrets/mail2925_accounts.txt
|
|
```
|
|
|
|
Mode must be `0600`; passwords must never be printed or committed. Helper:
|
|
|
|
```bash
|
|
python3 scripts/mail2925_pool.py selftest
|
|
python3 scripts/mail2925_pool.py pick --dry-run # preview without changing rotation state
|
|
python3 scripts/mail2925_pool.py pick # allocate and update lastUsedAt
|
|
python3 scripts/mail2925_pool.py list
|
|
```
|
|
|
|
Use `--dry-run` for probes/reviews so verification does not pollute production rotation state. Real registration allocation should use plain `pick` and persist the selected account + generated alias together for the rest of that OpenAI attempt.
|
|
|
|
Boundary: the helper only guarantees alias/account binding at generation time. The Webmail automation must still gate on `displayedMailboxEmail == selectedAccount.email` before clearing inbox or polling mail; otherwise a stale browser session could still read the wrong mailbox.
|
|
|
|
## Luban SMS provider
|
|
|
|
Luban API docs: `https://lubansms.com/api_docs/`. Requests without a browser-like `User-Agent` can return HTTP 403. The helper `scripts/luban_sms.py` must send a Chrome UA.
|
|
|
|
Core provider mapping:
|
|
|
|
```text
|
|
balance -> /getBalance
|
|
service list -> /List
|
|
buy -> /getNumber
|
|
poll -> /getSms
|
|
reject/cancel -> /setStatus?status=reject
|
|
success finish -> local no-op
|
|
```
|
|
|
|
The API key is stored in `~/.hermes/env/codex_oauth_onboarding.env` as `LUBAN_SMS_API_KEY`; never print it.
|
|
|
|
## Reporting guardrail
|
|
|
|
A tool-writing step once ended with an empty assistant response, and BOSS explicitly asked to process tool results and continue. For this skill class, after tool calls always return a visible checkpoint: what changed, what was verified, and any remaining next action. Do not leave BOSS with an empty result after tools.
|