Postmaster v9.4.0 per-link tracking and clean Sent copies

[the-code-learner]

Summary

Implements Postmaster v9.4.0 per-link click tracking while preserving the existing tracking pixel pipeline.

Link tracking

• rewrites eligible HTTP/HTTPS anchors in recipient HTML to GET /t/c/<token>
• opaque random tokens resolve server-side only; the request never supplies the redirect destination
• exact original query strings/fragments are preserved
• repeated occurrences retain separate positions/link IDs
• additive tracking_links + tracking_clicks schema in the existing analytics DB
• reuses existing country/source/browser/OS/User-Agent/HMAC fingerprint enrichment
• unique click = delivery_id + link_id + client_fingerprint
• adds total/unique/recipient/top-link analytics and unified pixel/AMP/link events

Sent clean

Pre-v9.4 the individualized EmailMessage sent via SMTP was also serialized directly into Sent, so tracked Sent copies could contain the recipient pixel. v9.4 builds recipient and Sent MIME variants separately from the same canonical body/attachment inputs:

• recipient: existing pixel + /t/c/<token> links
• Sent: no recipient pixel, no /t/c/<token>, original URLs
• preserves Message-ID, Date, Subject, In-Reply-To, References and attachment bytes

MCP/dashboard

• extends tracking_status
• extends get_tracking_campaign
• adds get_tracking_summary
• adds list_tracking_links
• adds list_tracking_events
• adds Top links + unified tracking-event dashboard views
• build_status: link_tracking=true, sent_copy_tracking_sanitized=true

Tests/docs

Adds v9.4 regression coverage for rewrite exclusions/double-wrap, query/fragment preservation, repeated occurrences, event persistence/enrichment, unique aggregation, invalid-token/open-redirect safety, unchanged pixel behavior, historical Sent behavior, clean Sent MIME, headers/threading, attachment byte identity, no self-open/self-click instrumentation, public-route preflight and version-independent build status.

postmaster-mcp.yml is intentionally unchanged.

MANUAL ACTION REQUIRED

Cloudflare Access must add a public Bypass for:

/t/c/*

Keep the existing public callback bypasses for:

/track/open/*
/api/amp/*

Do not expose /mcp, dashboard/admin/private APIs, mail/task/memory/skill/file-management routes or tracking analytics.

/files/* is a separate pre-existing v9.3 signed file-handoff concern and is not added to the v9.4 bypass policy.

After the stable release, POSTMASTER_VERSION=latest + POSTMASTER_CHECK_UPDATES_ON_START=true requires only a stack restart; Cloudflare Access remains an external/manual configuration step.