feat(leads): track opens, and read replies out of the mailbox

[ralyodio]

Everything past "contacted" waited on somebody remembering to mark it, so a funnel left alone reported a reply rate of structurally zero — a number that reads as a verdict on the campaign rather than on the bookkeeping.

Opens: per send, and honest about the error bar

Per send, not per campaign — a campaign-level pixel only says somebody opened something, which nobody can act on.

Privacy proxies fetch every image the instant mail arrives. Those loads are counted separately and kept out of the total:

GoogleImageProxy            → prefetch
opened 2s after send        → prefetch
no user-agent at all        → prefetch
Slackbot / facebookexternalhit → prefetch
Safari, 4h later            → open

The number is a floor, and the UI says so. Open rate divides by tracked sends, not every send ever — otherwise a healthy campaign appears to decline as its pre-tracking history piles up behind it.

Replies: two findings from the live mailbox

The mailbox connected in #126 has had IMAP settings stored all along and was never read. Running it for real found two bugs that no unit test would have.

1. A cap on an oldest-first walk never reaches today.

before: scanned 200, matched 0     ← budget spent on two-week-old mail
after:  scanned 199, matched 1     ← same window, newest-first

2. That one match was wrong. A Huntress marketing blast, from a contacted domain, from a plausible address, marked the prospect replied. Its own headers say what it was:

List-Unsubscribe: <mailto:...@bf02x.hubspotemail.net>
Feedback-ID:      aecl4ke:aig3kzw8:aib1s:HubSpot
In-Reply-To:      (absent)
Subject:          Here's what hackers can expect     ← no Re:

Three independent signals. So: bulk fingerprints now count as automatic, and the domain fallback requires evidence of being a response at all. Sends also record their own Message-Id, so a reply naming it in In-Reply-To matches that exact send instead of being inferred from a domain.

Verified against the live mailbox

mailbox: anthony@profullstack.com via imap.forwardemail.net:993
scanned: 200   matched: 0   autoReplies: 3   error: null

The newsletter no longer matches. The three that do all carry Auto-Submitted: auto-replied (helpdesk acknowledgements) — recorded, flagged, kept out of the reply rate. The bad row and the prospect status it changed have been reverted.

Both of those also reference our real sent Message-Ids, confirming the threading path works.

Checks

• tsc --noEmit clean · 1,014 tests pass (65 new) · build compiles
• Migrations applied to prod; crawlproof-outreach-replies scheduled and active
• imapflow added, externalised in next.config.ts (raw TLS sockets, must not be bundled)

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	imapflow@​1.6.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @zone-eu/mailsplit under EUPL-1.2 License: EUPL-1.2 - The applicable license policy does not permit this license (5) (package/LICENSE.EUPL-1.2) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (package/LICENSE.EUPL-1.2) License: EUPL-1.1+ - This license classifier is not allowed by the applicable policy (package/package.json) From: package-lock.json → npm/imapflow@1.6.1 → npm/@zone-eu/mailsplit@5.4.14 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@zone-eu/mailsplit@5.4.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report