fix: correct Strix model to github_models/gpt-4o

.github/workflows/strix.yml

@@ -225,7 +225,7 @@ jobs:
         run: |
           umask 077
           strix_llm_file="$RUNNER_TEMP/strix_llm.txt"
-            printf '%s' "github_models/gpt-5.4" > "$strix_llm_file"
+            printf '%s' "github_models/gpt-4o" > "$strix_llm_file"
           echo "STRIX_LLM_FILE=$strix_llm_file" >> "$GITHUB_ENV"
 
       - name: Prepare LLM API base input file

.vooster/project.json

@@ -0,0 +1,6 @@
+{
+  "uid": "XIDB",
+  "name": "Naruon - AI Email Workspace",
+  "description": null,
+  "connectedAt": "2026-05-24T13:23:50.376Z"
+}

AGENTS.md

@@ -10,7 +10,7 @@
   explicit `if: ${{ always() }}` upload steps when needed.
 - Prefer upgrading or removing vulnerable dependencies over downgrading patched
   packages unless compatibility evidence is recorded in the PR.
-- Strix Security Scan must use `github_models/gpt-5.4` as the default model to bypass Vertex AI GCP credential prerequisites in PR bounds.
+- Strix Security Scan must use `github_models/gpt-4o` as the default model to bypass Vertex AI GCP credential prerequisites in PR bounds.
 
 ## PR automation and review defaults
 

backend/api/webdav.py

@@ -0,0 +1,28 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from typing import List
+
+from api.auth import get_auth_context, AuthContext
+from services.webdav_service import webdav_service
+
+router = APIRouter(prefix="/api/webdav", tags=["webdav"])
+
+class WebdavAccountResponse(BaseModel):
+    account_id: int
+    server_url: str
+    username: str
+
+class ProjectFolderResponse(BaseModel):
+    folder_id: int
+    project_name: str
+    webdav_path: str
+
+@router.get("/accounts", response_model=List[WebdavAccountResponse])
+async def get_webdav_accounts(auth_context: AuthContext = Depends(get_auth_context)):
+    user_id = auth_context.user_id
+    return webdav_service.get_connected_accounts(user_id)
+
+@router.get("/folders", response_model=List[ProjectFolderResponse])
+async def get_project_folders(auth_context: AuthContext = Depends(get_auth_context)):
+    user_id = auth_context.user_id
+    return webdav_service.get_project_folders(user_id)

backend/db/models.py

@@ -339,3 +339,30 @@ class SenderRelationship(Base):
         default=lambda: datetime.datetime.now(datetime.timezone.utc),
         onupdate=lambda: datetime.datetime.now(datetime.timezone.utc),
     )
+
+
+class WebdavAccount(Base):
+    __tablename__ = "webdav_accounts"
+
+    id: Mapped[int] = mapped_column("account_id", primary_key=True)
+    user_id: Mapped[str] = mapped_column(String, index=True, nullable=False)
+    server_url: Mapped[str] = mapped_column(String, nullable=False)
+    username: Mapped[str] = mapped_column(String, nullable=False)
+    credentials_encrypted: Mapped[str] = mapped_column(EncryptedString, nullable=False)
+    created_at: Mapped[datetime.datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=lambda: datetime.datetime.now(datetime.timezone.utc),
+    )
+
+
+class ProjectFolder(Base):
+    __tablename__ = "project_folders"
+
+    id: Mapped[int] = mapped_column("folder_id", primary_key=True)
+    user_id: Mapped[str] = mapped_column(String, index=True, nullable=False)
+    project_name: Mapped[str] = mapped_column(String, index=True, nullable=False)
+    webdav_path: Mapped[str] = mapped_column(String, nullable=False)
+    created_at: Mapped[datetime.datetime] = mapped_column(
+        DateTime(timezone=True),
+        default=lambda: datetime.datetime.now(datetime.timezone.utc),
+    )

backend/main.py

@@ -18,6 +18,7 @@
 from api.runner_ws import router as runner_ws_router
 from api.dav import router as dav_router
 from api.accounts import router as accounts_router
+from api.webdav import router as webdav_router
 from services.imap_worker import ImapSyncWorker
 from prometheus_fastapi_instrumentator import Instrumentator
 from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor
@@ -92,6 +93,7 @@ async def lifespan(app: FastAPI):
 app.include_router(runner_ws_router)
 app.include_router(dav_router)
 app.include_router(accounts_router, dependencies=PRIVATE_API_DEPENDENCIES)
+app.include_router(webdav_router, dependencies=PRIVATE_API_DEPENDENCIES)
 
 
 app.add_middleware(

backend/requirements.txt

@@ -24,3 +24,4 @@ opentelemetry-sdk==1.25.0
 opentelemetry-instrumentation-fastapi==0.46b0
 opentelemetry-exporter-otlp==1.25.0
 setuptools==78.1.1
+websockets==14.1

backend/runner/connector.py

@@ -0,0 +1,74 @@
+import asyncio
+import logging
+from typing import Dict, Any
+
+try:
+    import websockets
+except ImportError:
+    # Optional dependency for the runner
+    websockets = None
+
+logger = logging.getLogger(__name__)
+
+class SelfHostedConnector:
+    def __init__(self, target_ws_url: str, token: str):
+        self.target_ws_url = target_ws_url
+        self.token = token
+        self.connection = None
+        self.is_connected = False
+
+    async def connect(self):
+        if websockets is None:
+            logger.error("websockets library is not installed. Runner cannot start.")
+            return
+
+        headers = {"Authorization": f"Bearer {self.token}"}
+        try:
+            self.connection = await websockets.connect(self.target_ws_url, additional_headers=headers)
+            self.is_connected = True
+            logger.info(f"Connected to Naruon Gateway at {self.target_ws_url}")
+            await self._listen_loop()
+        except asyncio.CancelledError:
+            raise
+        except (ConnectionRefusedError, OSError, asyncio.TimeoutError) as e:
+            self.is_connected = False
+            logger.exception(f"Failed to connect to Naruon Gateway: {e}")
+        except Exception as e:
+            # We catch Exception here but limit logger.exception to websocket errors
+            # to avoid referencing websockets.exceptions directly in the tuple
+            # in case websockets is None (though we return early if it is)
+            if websockets and isinstance(e, websockets.exceptions.WebSocketException):
+                self.is_connected = False
+                logger.exception(f"Failed to connect to Naruon Gateway: {e}")
+            else:
+                self.is_connected = False
+                logger.exception(f"Failed to connect to Naruon Gateway with unexpected error: {e}")
+
+    async def _listen_loop(self):
+        if not self.connection:
+            return
+        try:
+            while self.is_connected:
+                message = await self.connection.recv()
+                await self.handle_message(message)
+        except Exception as e:
+            if websockets and isinstance(e, websockets.exceptions.ConnectionClosed):
+                logger.warning("Connection closed by remote gateway.")
+            else:
+                logger.warning(f"Connection loop ended: {e}")
+            self.is_connected = False
+
+    async def handle_message(self, message: str | bytes):
+        # Dispatch message to internal SMTP/IMAP proxy handlers
+        logger.debug(f"Received instruction from gateway: {message}")
+        pass
+
+    async def send_response(self, response: Dict[str, Any]):
+        if self.is_connected and self.connection:
+            import json
+            await self.connection.send(json.dumps(response))
+
+if __name__ == "__main__":
+    # Example usage for local bootstrap
+    connector = SelfHostedConnector("ws://localhost:8080/api/runner/ws", "sample-token")
+    asyncio.run(connector.connect())

backend/schema/connector.py

@@ -0,0 +1,33 @@
+from typing import Literal
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class SelfHostedConnectorRegistrationRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    connector_id: str = Field(..., description="Unique identifier for the self-hosted connector")
+    public_key: str = Field(..., description="Public key for mTLS or secure payload exchange")
+    supported_protocols: list[Literal["imap", "smtp", "pop3", "caldav", "webdav"]] = Field(
+        default_factory=list, description="Protocols supported by this connector instance"
+    )
+    capabilities: list[str] = Field(default_factory=list)
+
+
+class SelfHostedConnectorRegistrationResponse(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    connector_id: str
+    status: Literal["pending_approval", "active", "rejected"]
+    issued_certificate: str | None = None
+    endpoint_url: str
+
+
+class OIDCGatewayConfig(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    provider_name: str
+    issuer_url: str
+    client_id: str
+    audience: str
+    required_scopes: list[str]
+    enforce_rbac_sync: bool = True

backend/services/caldav_service.py

@@ -0,0 +1,29 @@
+import logging
+from typing import Dict, Any
+
+logger = logging.getLogger(__name__)
+
+class CalDavService:
+    def __init__(self):
+        pass
+
+    def determine_writeback_target(self, task_context: Dict[str, Any], connected_accounts: list) -> str:
+        """
+        Determines the most appropriate CalDav account to write back to,
+        based on the context of the task (e.g., if it originated from a company email).
+        """
+        # Basic ontology/context mock logic
+        source_email = task_context.get("source_email", "")
+        if isinstance(source_email, str) and "@" in source_email:
+            source_domain = source_email.strip().lower().rsplit("@", 1)[-1]
+            for account in connected_accounts:
+                account_domain = str(account.get("domain", "")).lower().strip()
+                if account_domain and source_domain == account_domain:
+                    return account.get("account_id")
+
+        # Fallback to the primary account
+        if connected_accounts:
+            return connected_accounts[0].get("account_id")
+        return "default_system_caldav"
+
+caldav_service = CalDavService()

backend/services/email_service.py

@@ -0,0 +1,50 @@
+import hashlib
+import logging
+from typing import Dict, Any
+import email.utils
+
+logger = logging.getLogger(__name__)
+
+def generate_email_fingerprint(email_data: Dict[str, Any]) -> str:
+    """
+    Generates a unique fingerprint for an email based on its sender, subject, date, and body content.
+    Used to de-duplicate emails from ZIP imports or forwarding loops.
+    """
+    sender = str(email_data.get("sender") or "")
+    subject = str(email_data.get("subject") or "")
+    date = str(email_data.get("date") or "")
+    body = str(email_data.get("body") or "")
+    body_snippet = body[:500] # First 500 chars
+
+    raw_str = f"{sender}|{subject}|{date}|{body_snippet}"
+    return hashlib.sha256(raw_str.encode("utf-8")).hexdigest()
+
+def detect_reply_tracking(email_data: Dict[str, Any]) -> bool:
+    """
+    Detects if the user sent an email that expects a reply.
+    """
+    body = str(email_data.get("body") or "").lower()
+    return "please reply" in body or "?" in body
+
+def process_self_to_self(email_data: Dict[str, Any], user_email: str) -> bool:
+    """
+    Detects if an email is sent from the user to themselves, turning it into a knowledge node.
+    """
+    sender_raw = str(email_data.get("sender") or "")
+    recipients_raw = email_data.get("recipients") or []
+    recipient_inputs = recipients_raw if isinstance(recipients_raw, list) else [recipients_raw]
+    recipient_inputs = [str(v) for v in recipient_inputs]
+
+    _, sender_addr = email.utils.parseaddr(sender_raw)
+    normalized_user = user_email.strip().lower()
+    normalized_sender = sender_addr.strip().lower()
+    parsed_recipients = {
+        addr.strip().lower()
+        for _, addr in email.utils.getaddresses(recipient_inputs)
+        if addr
+    }
+
+    if normalized_user and normalized_user == normalized_sender and normalized_user in parsed_recipients:
+        logger.info("Self-to-self email detected. Organizing as knowledge node.")
+        return True
+    return False

backend/services/ontology_service.py

@@ -0,0 +1,36 @@
+import logging
+from typing import Dict, Any
+
+logger = logging.getLogger(__name__)
+
+class OntologyService:
+    def __init__(self):
+        self.relationships = {}
+
+    def analyze_sender_relationship(self, user_email: str, sender_email: str, email_content: str) -> Dict[str, Any]:
+        """
+        Analyzes the email content to build a relationship graph (DAG) between the user and the sender.
+        Returns attributes like the relationship type (e.g., Colleague, Client, Newsletter, Unknown)
+        and confidence score.
+        """
+        # A simple stub logic for Phase 10 implementation
+        relationship_type = "Unknown"
+        confidence = 0.5
+
+        if "unsubscribe" in email_content.lower():
+            relationship_type = "Newsletter"
+            confidence = 0.9
+        elif "@" in user_email and "@" in sender_email:
+            user_domain = user_email.split("@")[1].lower()
+            sender_domain = sender_email.split("@")[1].lower()
+            if user_domain == sender_domain:
+                relationship_type = "Colleague"
+                confidence = 0.85
+
+        logger.info(f"Analyzed relationship: {sender_email} -> {relationship_type} (conf: {confidence})")
+        return {
+            "type": relationship_type,
+            "confidence": confidence
+        }
+
+ontology_service = OntologyService()

backend/services/webdav_service.py

@@ -0,0 +1,53 @@
+import logging
+from typing import Dict, Any, List
+
+logger = logging.getLogger(__name__)
+
+class WebDavService:
+    def __init__(self):
+        self._mock_accounts = {
+            "demo_user": [
+                {
+                    "account_id": 1,
+                    "server_url": "https://webdav.naruon.net",
+                    "username": "demo_user"
+                }
+            ]
+        }
+        self._mock_folders = {
+            "demo_user": [
+                {
+                    "folder_id": 1,
+                    "project_name": "Naruon Roadmap 2026",
+                    "webdav_path": "/Projects/Naruon_Roadmap_2026"
+                },
+                {
+                    "folder_id": 2,
+                    "project_name": "Marketing Assets",
+                    "webdav_path": "/Projects/Marketing_Assets"
+                }
+            ]
+        }
+
+    def get_connected_accounts(self, user_id: str) -> List[Dict[str, Any]]:
+        """
+        Fetch connected WebDAV accounts for a user.
+        In a real implementation, this queries the database.
+        """
+        return self._mock_accounts.get(user_id, [])
+
+    def get_project_folders(self, user_id: str) -> List[Dict[str, Any]]:
+        """
+        Fetch the list of project folders structured by AI.
+        """
+        return self._mock_folders.get(user_id, [])
+
+    def sync_attachments_to_folder(self, email_id: str, project_name: str) -> bool:
+        """
+        Organizes an email's attachments into the specified WebDAV project folder.
+        """
+        logger.info(f"Syncing attachments from email {email_id} to project {project_name}")
+        # Mock implementation: in reality, this would download from storage and upload via webdavclient3
+        return True
+
+webdav_service = WebDavService()