# Vibemail — notes for agents

Vibemail is email for vibe coders: a mailbox next to the repo. One human inbox, extra addresses per agent or ship, threads kept as working context. The product is private dogfood. Claims below are only what is actually running.

## Origins

| Role | URL | Notes |
| --- | --- | --- |
| Web client | https://vibemail.cc , https://www.vibemail.cc , https://app.vibemail.cc | Same Cloudflare Worker `vibemail`. Next.js UI + BFF. |
| Login | /login on any of those hosts | Existing Stalwart mailboxes only. |
| Inbox | /inbox on any of those hosts | Session cookie required. Do not index. |
| Mail server | https://mail.vibemail.cc | Stalwart 0.16. JMAP, IMAPS 993, SMTPS 465, HTTPS 443. |
| JMAP session | https://mail.vibemail.cc/jmap/session | Also `/.well-known/jmap` → 307 here. |
| JMAP API | https://mail.vibemail.cc/jmap/ | HTTP Basic. Browser never calls this origin (no CORS). |

Canonical public page: `https://app.vibemail.cc/`. Apex `https://vibemail.cc/` is the same landing.

## Product lock

- Human inbox + addresses per agent/ship
- Threads are context
- Editor-first
- Mail on Stalwart at `mail.vibemail.cc`
- This Worker is the web client only
- Not Cloudflare Email Routing
- Not Mailflare-the-product
- No public signup
- CTA is Log in → `/login`

Known mailboxes in this install: `ak@vibemail.cc` (human), `agent@vibemail.cc` (agent). Further agent addresses may exist on Stalwart; they are not created from this website.

## How the client talks to mail

```
browser  →  vibemail.cc / app.vibemail.cc  (BFF)  →  https://mail.vibemail.cc  (Stalwart / JMAP)
```

1. User posts email + password to `/api/auth/login`.
2. The Worker `GET`s `{MAIL_SERVER_URL}/jmap/session` with HTTP Basic.
3. 401 means bad credentials. A session with accounts is success.
4. Credentials are stored in an encrypted HTTP-only cookie (`ep_session`).
5. Later API routes decrypt the cookie and `POST` JMAP method calls (`Mailbox/get`, `Email/query`, `Email/get`, `Email/set`, `EmailSubmission/set`).

Unauthenticated `GET /jmap/session` returns a session object with `apiUrl` and empty `accounts`. Wrong Basic auth returns 401 with `WWW-Authenticate: Basic` and `Bearer`.

The mail host does not send CORS headers to `app.vibemail.cc`. That is expected. Do not “fix” it by pointing the browser at JMAP directly.

## DNS that must not change

Agents must not edit these records when working on the web client:

- `mail` A → Hetzner host for Stalwart
- MX for `vibemail.cc` → `mail.vibemail.cc`
- SPF / DKIM / DMARC for the zone

`app`, apex `@`, and `www` are proxied custom domains for Worker `vibemail` only. Attaching the apex may replace a grey-cloud A `@` to Hetzner. Do not delete or change the `mail` A record.

## What leftover code is not the product

The repository still contains unused Mailflare paths (Cloudflare Email Routing ingest, D1/R2, API-key send, public `/setup` registration). They are dormant while `MAIL_BACKEND=jmap`. Do not describe those as live Vibemail features. Do not send users to Create account / `/setup`.

## Indexing

- Index: `/`, `/llms.txt`, `/llms-full.txt`, `/sitemap.xml`
- Do not index: `/inbox` and other authenticated mail surfaces, `/login`, `/api/*`, `/setup`, `/register`
- `robots.txt` allows GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and Applebot-Extended on the public files above