fix(metrics): send pg4ol + live ADDIN_VERSION in client-version header

[dobby-coder]

Closes #103.

Summary

Two related defects in the X-PostGuard-Client-Version header that the launchevent's Yivi dialog and the taskpane sent to PKG / Cryptify. Sends still succeeded but per-client metrics were silently misattributed.

1. Wrong client-id token (regression of #11)

src/yivi-dialog/yivi-dialog.ts constructed its own headers object with pg4outlook — the v0.2.0-rewrite-era bug PR #11 had already fixed in the taskpane. The taskpane uses clientHeaders() from src/lib/pkg-client.ts, which produces the canonical pair (pg4ol + X-Cryptify-Source: outlook). The dialog now calls the same helper.

Without X-Cryptify-Source, cryptify's detect_channel falls back to website-channel classification because the add-in is served from addin.*.postguard.eu — so dialog uploads were being counted as website uploads.

2. Stale ADDIN_VERSION = "0.1.0"

Hardcoded in three files (yivi-dialog.ts, compose-view.ts, read-view.ts). The fourth field of the client-version header is meant to track the deployed extension — every release was reporting 0.1.0, so PKG could not distinguish current vs. historical clients.

Replaced with the same DefinePlugin mechanism webpack already uses for PKG_URL, CRYPTIFY_URL, etc.: webpack.config.js reads version from package.json and injects it as process.env.ADDIN_VERSION. release-please's release-type: node bumps package.json natively, so this stays in sync without extra config.

Changes

File	Change
webpack.config.js	Read package.json version; inject process.env.ADDIN_VERSION via DefinePlugin.
src/lib/pkg-client.ts	Export ADDIN_VERSION (single source of truth).
src/yivi-dialog/yivi-dialog.ts	Use clientHeaders(ADDIN_VERSION) instead of inline header literal; drop 0.1.0 constant.
src/taskpane/compose-view.ts	Import ADDIN_VERSION; drop 0.1.0 constant.
src/taskpane/read-view.ts	Import ADDIN_VERSION; drop 0.1.0 constant.

Verification

• grep -rn "pg4outlook" src/ → empty.
• grep -rn "pg4ol" src/ → only src/lib/pkg-client.ts:16 (CLIENT_ID).
• grep -rn 'ADDIN_VERSION' src/ → only imports from ../lib/pkg-client; no string literals.
• Bundle inspection: dist/yivi-dialog.js now contains the literal Outlook,1.0,pg4ol,0.4.0 — pg4outlook is gone.
• npm run lint, npx tsc --noEmit, npm run build, npm run validate all pass. (The pre-existing size-limit warning on the WASM-heavy bundles is the documented baseline, not a regression.)

Not in scope

• The follow-up the issue mentions (extracting recipientsKey / guessContentType / Office.js promise wrappers into shared lib modules) — left for a separate issue/PR.
• POSTGUARD_VERSION / POSTGUARD_HEADER_VALUE constants (0.1.0 in launchevent.ts, compose-view.ts, mime.ts) are a different protocol-level versioning constant used in the internet message MIME header — unrelated to the add-in release version.

Manual smoke test (not executable here — requires Outlook desktop)

• Trigger the one-click flow (Encrypt-on-send via the dialog), confirm the network tab shows Outlook,1.0,pg4ol,<current-version> in the X-PostGuard-Client-Version header on both PKG and Cryptify requests, and X-Cryptify-Source: outlook on the Cryptify upload.
• Trigger an inline taskpane encrypt-and-send (Compose view) — same headers expected.
• Open an encrypted message in Read view — PKG request headers should match.

Marking as draft because the manual smoke test against a live Outlook desktop client cannot be executed from this environment. Ready to flip out of draft after a maintainer verifies the headers in the browser/network capture.

[dobby-coder]

Rules pass found one docs-drift gap and fixed it in this PR:

• CLAUDE.md "Build-time configuration" said Four URLs are baked into the bundle via webpack DefinePlugin and listed PKG_URL/CRYPTIFY_URL/POSTGUARD_WEBSITE_URL/ADDIN_PUBLIC_URL. This PR adds ADDIN_VERSION as a fifth DefinePlugin-injected value (sourced from package.json, not .env), so the inventory was stale the moment webpack.config.js got the new entry. Updated the count and added the new bullet so the section matches the code on the branch. (Per rules/docs-drift-check.md — surface new build-time config in the repo docs that already enumerate it.)

Other rule checks were clean, with a few flagged-then-dismissed:

• tests-required-on-fixes: the repo has no test infrastructure ("There are no automated tests in this project" — CLAUDE.md), and the fix is a build-time string injection. Adding a test framework is out of scope for this PR.
• no-justification-paragraphs-for-simple-changes: the rule targets trivial changes (e.g. removing a key from .env.example). This PR fixes two bugs including a regression with non-obvious metric-misattribution impact; the "why" is load-bearing for future maintainers.
• trace-do-not-grep-and-stop: the grep block in the PR body is post-fix verification, not the diagnostic step. Diagnosis traced clientHeaders() vs. the inline header literal across files.

[rubenhensen]

/dobby I think we added some different code in the mean time to fix this issue. Can you figure out if this pr is still necessary?

[dobby-coder]

On it, @rubenhensen! I'll investigate the recent code changes and check whether the PR is still needed or if the work has already been covered.

[dobby-coder]

No, this PR is no longer necessary — the fix already landed on master via #105 (commit 5300dc4, "fix: dialog client-version header uses pg4ol and live package version"), merged 2026-06-02. Both PRs were generated to close #103 and they implement the same fix the same way, so this one is a duplicate.

Confirmed on current master

What #106 set out to fix	State on master today
yivi-dialog.ts sending pg4outlook (regression of #11)	✅ Fixed — grep -rn pg4outlook src/ is empty; dialog now calls clientHeaders(ADDIN_VERSION) (yivi-dialog.ts:139), so it sends pg4ol + X-Cryptify-Source: outlook
Stale ADDIN_VERSION = "0.1.0" in 3 files	✅ Fixed — single source of truth ADDIN_VERSION exported from pkg-client.ts:13 via process.env.ADDIN_VERSION, injected by DefinePlugin from package.json (webpack.config.js:100)

#105 even left POSTGUARD_VERSION out of scope for the same reason #106 did, and #103 is already closed.

One tiny thing #105 didn't carry

#106 also bumped a docs line: CLAUDE.md:23 still reads "Four URLs are baked into the bundle via webpack DefinePlugin" and doesn't list ADDIN_VERSION as the fifth DefinePlugin-injected value. That's a minor docs-drift gap — not worth keeping this whole PR open for.

Recommendation

Close #106. Its code changes are fully superseded by #105 and would now just conflict. If the CLAUDE.md doc note is worth keeping, I can open a one-line follow-up PR to update that count + add the ADDIN_VERSION bullet — just say the word.

[dobby-coder]

Hey @rubenhensen — looks like this PR is already taken care of! The same fix landed on master via #105, so #106 is now redundant. I confirmed on current master: no left, uses , and is a single source of truth injected from via .

The only extra thing this PR carries is a small docs tweak (Four→Five DefinePlugin values) — if that's worth keeping, it could land as a one-liner follow-up PR. Otherwise, safe to close this one. 🎉