[PR] docs(tools/ponymail): offer to save the ASF password in a kept login profile [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1782:
URL: https://github.com/apache/magpie/pull/1782

   ## Summary
   
   - The PonyMail MCP login opens a throwaway browser profile by default, so the browser cannot save the ASF password and the user types it at every login. The MCP supports keeping the profile (`PONYMAIL_BROWSER_PROFILE=persistent`), but nothing in Magpie tells the user it exists.
   - `tools/ponymail/operations.md`: when a skill asks the user to log in and `~/.ponymail-mcp/browser-profile/` does not exist, it adds a one-line tip: the user can ask to have the password saved next time. When asked, the agent first warns that the profile saves only the password and 2FA is still asked on every login. It also warns that once logged in, the MCP reads every allowed private list without asking again until the session expires (up to about 24 hours) or `logout`. Only after the user confirms does it propose the `env` edit to the `ponymail` server entry, which the user applies. The Pre-flight paragraph links to the new section, and the Logout section says what a kept profile still holds.
   - `tools/ponymail/tool.md` mentions the same opt-in and its trade-off in the first-login install step.
   
   Depends on [apache/comdev#68](https://github.com/apache/comdev/pull/68): `ponymail-mcp` now clears the kept profile's cookies after each login, so the ASF OAuth session (and its 2FA) is never reused. Older `ponymail-mcp` versions kept those cookies, and the text says the tip applies only to a version that clears them.
   
   ## Type of change
   
   - [x] Tool / bridge contract (`tools/<system>/*.md`)
   
   ## Test plan
   
   - [x] `prek run --files tools/ponymail/operations.md tools/ponymail/tool.md` passes
   - [x] Other: checked against the comdev `ponymail-mcp` sources (`auth.js` `browserProfileDir()`, `browser-login.js`) with the companion change applied. `persistent` maps to `~/.ponymail-mcp/browser-profile`, a kept profile uses the OS credential store, and its cookies are cleared before the login window closes. The login result does not report the profile mode, which is why the tip checks the default directory.
   
   ## RFC-AI-0004 compliance
   
   - [x] **HITL** — the agent only offers the tip and the warning; the config change is proposed and applied by the user.
   - [x] **Conversational + correctable** — opt-in, given once per session, not repeated after a decline.
   
   ## Notes for reviewers (optional)
   
   The directory check is a heuristic: a user who set `PONYMAIL_BROWSER_PROFILE` to an absolute path elsewhere gets the tip once more, which is harmless. A more precise signal would be the MCP reporting the profile mode in the `login` result, which belongs in `apache/comdev`.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] docs(tools/ponymail): offer to save the ASF password in a kept login profile [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1782:
URL: https://github.com/apache/magpie/pull/1782


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org