fix(email): review round 1 + audit hardening for Gmail provider

- a 2xx from Gmail with an empty/malformed body no longer surfaces as a send
  failure (the mailer's fallback chain would deliver the same email twice);
  covered by a regression test
- normalize bare-LF line endings in html/text bodies to CRLF (RFC 822) before
  composing the raw message
- add multi-recipient and text-only test cases

Author: waleedlatif1

apps/sim/lib/messaging/email/providers/gmail.test.ts

@@ -164,6 +164,43 @@ describe('Gmail mail provider', () => {
       expect(raw).toContain(Buffer.from('report body').toString('base64'))
     })
 
+    it('joins multiple recipients into one To header', async () => {
+      mockFetch.mockResolvedValueOnce(
+        new Response(JSON.stringify({ id: 'msg-3' }), { status: 200 })
+      )
+
+      const provider = createGmailProvider()
+      await provider!.send({ ...BASE_DATA, to: ['a@example.com', 'b@example.com'] })
+
+      const [, init] = mockFetch.mock.calls[0]
+      expect((init.body as Buffer).toString()).toContain('To: a@example.com, b@example.com')
+    })
+
+    it('sends text-only messages', async () => {
+      mockFetch.mockResolvedValueOnce(
+        new Response(JSON.stringify({ id: 'msg-4' }), { status: 200 })
+      )
+
+      const provider = createGmailProvider()
+      await provider!.send({ ...BASE_DATA, html: undefined, text: 'plain body' })
+
+      const [, init] = mockFetch.mock.calls[0]
+      const raw = (init.body as Buffer).toString()
+      expect(raw).toContain('Content-Type: text/plain')
+      expect(raw).toContain('plain body')
+      expect(raw).not.toContain('text/html')
+    })
+
+    it('treats an accepted send with an empty response body as success (no fallback re-send)', async () => {
+      mockFetch.mockResolvedValueOnce(new Response(null, { status: 200 }))
+
+      const provider = createGmailProvider()
+      const result = await provider!.send(BASE_DATA)
+
+      expect(result.success).toBe(true)
+      expect(result.data).toEqual({ id: undefined })
+    })
+
     it('throws when no access token can be obtained', async () => {
       mockGetAccessToken.mockResolvedValueOnce({ token: null })
 

apps/sim/lib/messaging/email/providers/gmail.ts

@@ -41,14 +41,22 @@ function parseServiceAccount(credentialsJson: string): GmailServiceAccount | nul
   return credentials as GmailServiceAccount
 }
 
+/**
+ * RFC 822 requires CRLF line endings throughout; MailComposer preserves
+ * caller-supplied bare-LF endings inside html/text bodies, so normalize them.
+ */
+function normalizeCrlf(value: string | undefined): string | undefined {
+  return value?.replace(/\r?\n/g, '\r\n')
+}
+
 /** Build the raw RFC 822 message via nodemailer's composer (multipart, attachments, headers). */
 function buildRawMessage(data: ProcessedEmailData): Promise<Buffer> {
   const composer = new MailComposer({
     from: data.senderEmail,
     to: data.to,
     subject: data.subject,
-    html: data.html,
-    text: data.text,
+    html: normalizeCrlf(data.html),
+    text: normalizeCrlf(data.text),
     replyTo: data.replyTo,
     headers: Object.keys(data.headers).length > 0 ? data.headers : undefined,
     attachments: data.attachments?.map((att) => ({
@@ -123,7 +131,10 @@ export function createGmailProvider(): MailProvider | null {
         )
       }
 
-      const result = (await response.json()) as { id?: string }
+      // Gmail accepted the message once the status is 2xx; a missing or
+      // malformed body must not surface as a send failure, or the mailer's
+      // fallback chain would deliver the same email again via another provider.
+      const result = (await response.json().catch(() => ({}))) as { id?: string }
       return {
         success: true,
         message: 'Email sent successfully via Gmail',