mailmate 1.6.0 → 1.8.0

data/lib/mailmate/cli/search.rb

@@ -71,7 +71,17 @@ module Mailmate
         parser = build_parser(opts)
         parser.parse!(argv)
 
+        self.date_order = opts[:european] ? :dmy : :mdy
+
         search_string = argv[0] || DEFAULT_SEARCH
+        # Rewrite Gmail/Outlook-style key:value tokens to their exact
+        # quicksearch equivalent — loudly, never silently: every rewrite is
+        # announced on stderr so the transcript shows what actually ran (and
+        # the caller learns the syntax). stdout stays clean CSV.
+        search_string, translations = Mailmate::SearchSyntax.translate(search_string, european: !!opts[:european])
+        if (notice = Mailmate::SearchSyntax.translation_notice(translations))
+          warn notice
+        end
         fields_arg    = (opts[:fields] || argv[1] || DEFAULT_FIELDS).to_s.strip
         # `+...` means "defaults plus these"; bare list = exactly those columns.
         # Defaults already include `id` as the first column, so `+x` keeps id
@@ -103,6 +113,19 @@ module Mailmate
         end
 
         specs = order_specs(parse_search(search_string))
+        # Validate date specs per or-group: only when EVERY branch is
+        # unsatisfiable is the query itself an error. A single dead branch
+        # in a multi-branch query gets a warning — the other branches still
+        # mean something, and the dead one silently contributing nothing is
+        # exactly the failure mode this validation exists to surface.
+        date_errs = specs.filter_map { |group| date_spec_error(group) }
+        if date_errs.any?
+          if date_errs.size == specs.size
+            warn date_errs.first
+            return 2
+          end
+          date_errs.each { |e| warn "dead or-branch (matches nothing): #{e}" }
+        end
 
         # Compose + parse the smart-mailbox filter exactly once. The same AST
         # feeds the evaluator, the tier classifier, and the literals extractor.
@@ -142,6 +165,15 @@ module Mailmate
 
         sort_rows!(rows, opts[:sort])
         emit_output(rows, fields, opts)
+        # A query written in another mail system's dialect is not a syntax
+        # error here — it parses as a literal term and quietly matches
+        # nothing. Callers (people and agents alike) read that empty result
+        # as "no such mail" and stop. Say so on stderr, so stdout stays
+        # clean CSV and the exit status stays 0: the search DID run, it just
+        # cannot have found what the caller meant.
+        if rows.empty? && (hint = Mailmate::SearchSyntax.zero_result_hint(search_string))
+          warn hint
+        end
         0
       end
 
@@ -189,26 +221,18 @@ module Mailmate
           o.on("--no-align", "Plain CSV (no column padding)") { opts[:align] = false }
           o.on("--sort MODE", %w[asc desc none],
                "Sort rows by date+time: asc (default), desc, none") { |v| opts[:sort] = v.to_sym }
+          o.on("--european",
+               "Slash dates are day-first: d 9/8/2026 = Aug 9 (default: month-first American)") { opts[:european] = true }
           o.separator ""
           o.separator "SEARCH-STRING SYNTAX"
-          o.separator "  Mirrors MailMate's toolbar quicksearch. Specs combine with AND."
-          o.separator "  Wrap multi-word terms in \"double quotes\". Prefix operand with ! to negate."
-          o.separator ""
-          o.separator "    <term>    common headers (from/to/cc/subject) OR body contains <term>"
-          o.separator "    f <term>  from contains"
-          o.separator "    t <term>  to/cc (recipients) contains"
-          o.separator "    c <term>  cc contains"
-          o.separator "    s <term>  subject contains"
-          o.separator "    a <term>  any address header contains"
-          o.separator "    b <term>  body contains (reads MailMate's body indexes; --all for un-indexed too)"
-          o.separator "    m <term>  common headers OR body (same as bare term)"
-          o.separator "    d <date>  received date: Nd|Nw|Nm|Ny (relative), or Y, Y-M, Y-M-D"
-          o.separator "    T <tag>   tag / IMAP keyword contains  (K is a synonym)"
+          o.separator "  Mirrors MailMate's toolbar quicksearch, plus native state specs"
+          o.separator "  (is:unread, has:attachment). Other familiar key:value tokens are"
+          o.separator "  auto-translated (see FOREIGN SYNTAX below)."
+          o.separator Mailmate::SearchSyntax.reference(indent: "  ")
+          o.separator "  (b also takes --all to include un-indexed messages.)"
           o.separator ""
-          o.separator "  Examples:"
-          o.separator "    mmsearch 'f substack d 7d'         from Substack in last 7 days"
-          o.separator "    mmsearch 's \"invoice due\" !draft'  subject has invoice due, no 'draft'"
-          o.separator "    mmsearch 'd 2026-05'               received in May 2026"
+          o.separator "FOREIGN SYNTAX (Gmail/Outlook-style, auto-translated, announced on stderr)"
+          o.separator Mailmate::SearchSyntax.translation_reference(indent: "  ")
           o.separator ""
           o.separator "FIELDS (for the fields argument / --fields)"
           o.separator "  id          eml-id (always included as first column)"
@@ -303,6 +327,13 @@ module Mailmate
       # ---- search-string parsing ----------------------------------------------
 
       def tokenize(str)
+        tokenize_q(str).map(&:first)
+      end
+
+      # [text, quoted] pairs — quoted-ness must survive tokenization so a
+      # deliberate search for the literal word "or" (`s "or"`) is not taken
+      # as the group separator, and a quoted "f" is never read as a modifier.
+      def tokenize_q(str)
         tokens = []
         i = 0
         while i < str.length
@@ -311,42 +342,82 @@ module Mailmate
             i += 1
           elsif c == "\""
             j = str.index("\"", i + 1) || str.length
-            tokens << str[(i + 1)...j]
+            tokens << [str[(i + 1)...j], true]
             i = j + 1
           else
             j = i
             j += 1 while j < str.length && str[j] != " "
-            tokens << str[i...j]
+            tokens << [str[i...j], false]
             i = j
           end
         end
         tokens
       end
 
+      # A bare `or` splits the query into groups: specs within a group AND
+      # together, groups OR together — `and` (juxtaposition) binds tighter
+      # than `or`, and there are no parens: `(f bob or f ann) s invoice` is
+      # written out as `f bob s invoice or f ann s invoice`. A group that
+      # OPENS with a bare unquoted operand inherits the modifier in force at
+      # the end of the previous group — the app's `d 2024 or 2025 or 2y`
+      # shorthand. Returns an array of spec groups; empty groups (a dangling
+      # `or`) are dropped.
       def parse_search(str)
-        tokens = tokenize(str)
+        token_groups = [[]]
+        tokenize_q(str).each do |tok, quoted|
+          if !quoted && tok.casecmp?("or")
+            token_groups << []
+          else
+            token_groups.last << [tok, quoted]
+          end
+        end
+
+        carried = nil
+        groups = token_groups.map do |tokens|
+          specs, carried = parse_group(tokens, carried)
+          specs
+        end
+        groups.reject(&:empty?)
+      end
+
+      def parse_group(tokens, inherited_field)
         specs = []
+        in_force = inherited_field
         i = 0
         while i < tokens.size
-          tok = tokens[i]
-          field = MODIFIERS[tok]
+          tok, quoted = tokens[i]
+          field = quoted ? nil : MODIFIERS[tok]
           if field && i + 1 < tokens.size
-            operand = tokens[i + 1]
+            operand, = tokens[i + 1]
             negate = operand.start_with?("!")
             operand = operand[1..] if negate
             specs << [field, operand.downcase, negate]
+            in_force = field
             i += 2
           else
             negate = tok.start_with?("!")
             operand = negate ? tok[1..] : tok
-            # Bare terms default to MailMate's "Common" specifier — common
-            # headers OR body — matching the UI quicksearch behavior. Pass
-            # --headers-only to skip the body scan when speed matters.
-            specs << [:message_or_body, operand.downcase, negate]
+            if !quoted && operand =~ /\A-?(?:is|has):\S+\z/i
+              # First-class message-state specs (is:unread, has:attachment).
+              # The app has no state vocabulary to mirror (its A modifier
+              # searches attachment FILENAMES), so the familiar Gmail
+              # spellings are native syntax here. `-` negates too — the form
+              # Gmail callers actually write.
+              negate ||= operand.start_with?("-")
+              specs << [:state, operand.delete_prefix("-").downcase, negate]
+            else
+              # A bare term opening an or-group inherits the modifier in
+              # force (`d 2024 or 2025`). Elsewhere it is MailMate's
+              # "Common" specifier — common headers OR body — matching the
+              # UI quicksearch behavior. Pass --headers-only to skip the
+              # body scan when speed matters.
+              target = (i.zero? && !quoted && in_force) ? in_force : :message_or_body
+              specs << [target, operand.downcase, negate]
+            end
             i += 1
           end
         end
-        specs
+        [specs, in_force]
       end
 
       # Static cost rank per spec field for AND evaluation order: compiled
@@ -355,17 +426,35 @@ module Mailmate
       SPEC_COST = {
         date: 0,
         from: 1, recipients: 1, cc: 1, subject: 1, address_any: 1, any: 1,
-        tag: 1, keyword: 1,
+        tag: 1, keyword: 1, state: 1,
         body: 2, message_or_body: 2,
       }.freeze
 
-      # Evaluate cheap, selective specs before expensive ones. specs combine
-      # with AND (order-independent), and matches? short-circuits on the
-      # first miss — so `b invoice d 7d` should date-reject 47k messages
-      # before body matching ever runs, not after. Stable within a cost rank
-      # to keep the user's order deterministic.
-      def order_specs(specs)
-        specs.sort_by.with_index { |(field, _term, _negate), i| [SPEC_COST.fetch(field, 1), i] }
+      # Canonical state names for is:/has: specs, including the spellings
+      # Gmail callers actually use. Values map to a #flags IMAP flag except
+      # :unread (absence of \Seen) and :attachment (root MIME layout).
+      STATE_CANON = {
+        "unread" => :unread, "read" => :read,
+        "flagged" => :flagged, "starred" => :flagged,
+        "replied" => :replied, "answered" => :replied,
+        "draft" => :draft,
+        "attachment" => :attachment, "attachments" => :attachment,
+      }.freeze
+
+      STATE_FLAGS = {
+        read: "\\Seen", flagged: "\\Flagged", replied: "\\Answered", draft: "\\Draft",
+      }.freeze
+
+      # Evaluate cheap, selective specs before expensive ones, within each
+      # or-group. Specs in a group combine with AND (order-independent), and
+      # matches? short-circuits on the first miss — so `b invoice d 7d`
+      # should date-reject 47k messages before body matching ever runs, not
+      # after. Stable within a cost rank to keep the user's order
+      # deterministic.
+      def order_specs(groups)
+        groups.map do |specs|
+          specs.sort_by.with_index { |(field, _term, _negate), i| [SPEC_COST.fetch(field, 1), i] }
+        end
       end
 
       # ---- date matching ------------------------------------------------------
@@ -373,44 +462,170 @@ module Mailmate
       # The `#date` index stores fixed-format strings ("2026-03-19 18:55:19
       # -0600", sender-local time with varying UTC offsets — NOT lexically
       # comparable). date_matches? runs once per candidate message, so the
-      # hot path avoids Time.parse (~10× slower than slicing) and per-call
-      # cutoff arithmetic: terms compile once to an inclusive [lo, hi] range
-      # of YYYYMMDD integers, and the indexed value slices straight to the
-      # same integer form. Calendar-date comparison semantics are unchanged.
+      # hot path avoids Time.parse (~10× slower than fast_time's slicing) and
+      # per-call cutoff arithmetic: day terms compile once to an inclusive
+      # [lo, hi] range of YYYYMMDD integers; per message, fast_time slices
+      # the indexed value into a Time (offset preserved) which localize then
+      # converts to the display zone before the day compare. Hour terms
+      # (`24h`) compare the same Time as an epoch instant instead.
+
+      # Slash-date ordering for three-part dates with a trailing 4-digit
+      # year: :mdy (American month-first, the default — `8/9/2026` = Aug 9)
+      # or :dmy (day-first, the --european flag — `9/8/2026` = Aug 9).
+      # ISO Y-M-D is unaffected. Module-level because the compiled-range
+      # memo must reset when it flips (the MCP server outlives any one call).
+      def date_order
+        @date_order || :mdy
+      end
+
+      def date_order=(order)
+        @date_order = order
+      end
 
       # Compiled day-range for a date term, memoized per term. nil = term
       # can't match anything. The memo resets when the calendar day rolls
-      # over so relative terms ("1d") stay correct in long-lived processes
-      # (the MCP server).
+      # over (so relative terms like "1d" stay correct in long-lived
+      # processes — the MCP server) or when date_order flips.
       def date_range_for(term)
         today = Date.today
-        if @date_ranges_day != today
+        if @date_ranges_day != today || @date_ranges_order != date_order
           @date_ranges_day = today
+          @date_ranges_order = date_order
           @date_ranges = {}
         end
         return @date_ranges[term] if @date_ranges.key?(term)
         @date_ranges[term] = compile_date_range(term, today)
       end
 
+      # A term is an optional comparison prefix (>, >=, <, <=) on a period.
+      # The prefix reshapes the period's inclusive [lo, hi] window: `>2026-08`
+      # is "after August" = [20260901, max], `<2026-08` is "before August" =
+      # [min, 20260731]. Bounds are compared as YYYYMMDD integers, so ±1 on a
+      # synthetic bound (a month's "day 31", a year's "Dec 31"+1) is safe —
+      # no real date falls in the gap. A comparison can produce an empty
+      # window (`>3d` — nothing is after a window that already reaches the
+      # future); date_spec_error reports those up front rather than letting
+      # them silently match nothing.
       def compile_date_range(term, today)
+        op = nil
+        if term =~ /\A(>=|<=|>|<)(.+)\z/
+          op, term = Regexp.last_match(1), Regexp.last_match(2)
+        end
+        base = compile_period_range(term, today)
+        return nil unless base
+        return base unless op
+
+        lo, hi = base
+        case op
+        when ">"  then [hi + 1, 9999_12_31]
+        when ">=" then [lo, 9999_12_31]
+        when "<"  then [0, lo - 1]
+        when "<=" then [0, hi]
+        end
+      end
+
+      def compile_period_range(term, today)
         if term =~ /\A(\d+)([dwmy])\z/
           n, u = Regexp.last_match(1).to_i, Regexp.last_match(2)
+          return nil if n.zero? # a zero-length window matches nothing
+          # N units ENDING today: `1d` = today only, `7d` = the last 7
+          # calendar days including today. (Off-by-one fixed 2026-08-11 to
+          # match the MailMate app, where `d 1d` is today's mail — the old
+          # cutoff of today-N made `d 1d` span two calendar days. For a
+          # rolling 24-hour clock window, that's `d 24h` now.)
           cutoff = case u
-                   when "d" then today - n
-                   when "w" then today - (n * 7)
-                   when "m" then today << n
-                   when "y" then today << (n * 12)
+                   when "d" then today - (n - 1)
+                   when "w" then today - (n * 7 - 1)
+                   when "m" then (today << n) + 1
+                   when "y" then (today << (n * 12)) + 1
                    end
           return [ymd_int(cutoff), 9999_12_31]
         end
 
         parts = term.tr("/.", "-").split("-")
-        y = parts[0].to_i
-        return nil if y.zero?
+        return nil unless parts.any? && parts.all? { |p| p.match?(/\A\d+\z/) }
+
         case parts.size
-        when 1 then [y * 10_000 + 101, y * 10_000 + 1231]
-        when 2 then [y * 10_000 + parts[1].to_i * 100 + 1, y * 10_000 + parts[1].to_i * 100 + 31]
-        when 3 then [ymd = y * 10_000 + parts[1].to_i * 100 + parts[2].to_i, ymd]
+        when 1
+          y = parts[0].to_i
+          return nil if y.zero?
+          [y * 10_000 + 101, y * 10_000 + 1231]
+        when 2
+          # Year-first (2026-08) or month-first with a 4-digit year (8/2026).
+          y, m = parts[1].length == 4 ? [parts[1], parts[0]] : [parts[0], parts[1]]
+          y, m = y.to_i, m.to_i
+          return nil if y.zero? || !(1..12).cover?(m)
+          [y * 10_000 + m * 100 + 1, y * 10_000 + m * 100 + 31]
+        when 3
+          # ISO year-first, or slash-date with trailing 4-digit year ordered
+          # per date_order. Impossible calendar dates (2026-02-31, month 13)
+          # compile to nil so date_spec_error names them instead of the
+          # search silently matching nothing.
+          y, m, d =
+            if parts[0].length == 4
+              parts.map(&:to_i)
+            elsif parts[2].length == 4
+              a, b, yr = parts.map(&:to_i)
+              date_order == :dmy ? [yr, b, a] : [yr, a, b]
+            end
+          return nil unless y && Date.valid_date?(y, m, d)
+          [ymd = y * 10_000 + m * 100 + d, ymd]
+        end
+      end
+
+      # Usage-error string for the date specs in ONE or-group (specs within a
+      # group AND together; the caller decides how errors across groups
+      # combine), nil when they're fine. Two failure classes, both of which
+      # would otherwise surface as a clean, successful, empty result — the
+      # silent-nothing this gem keeps having to fight: a single term that
+      # cannot match anything (`d >3d`, `d garbage`), and positive terms
+      # whose windows don't intersect (`d >2026 d <2025`). Negated terms
+      # subtract rather than intersect, so they're validated individually
+      # but excluded from the intersection.
+      def date_spec_error(specs)
+        day_terms, hour_terms = [], []
+        specs.each do |field, term, negate|
+          # State specs validate here too (same pre-pass, same
+          # silent-nothing failure being prevented): an unknown state value
+          # would otherwise quietly match no message ever.
+          if field == :state && !STATE_CANON.key?(term.split(":", 2).last)
+            return "state term cannot match anything: #{term} " \
+                   "(known: is:unread is:read is:flagged is:replied is:draft has:attachment)"
+          end
+          next unless field == :date
+          range = hour_range_for(term) || date_range_for(term)
+          if range.nil? || range[0] > range[1]
+            return "date term cannot match anything: d #{term}#{date_term_hint(term)}"
+          end
+          next if negate
+          (term.end_with?("h") ? hour_terms : day_terms) << [term, range]
+        end
+
+        # Day windows intersect with day windows and hour windows with hour
+        # windows; the two families use different scales (YYYYMMDD ints vs
+        # epoch seconds), and a cross-family contradiction is not worth the
+        # unit conversion to detect.
+        [day_terms, hour_terms].each do |family|
+          next if family.size < 2
+          lo = family.map { |_, r| r[0] }.max
+          hi = family.map { |_, r| r[1] }.min
+          next if lo <= hi
+          return "impossible date range (empty intersection): #{family.map { |t, _| "d #{t}" }.join(" ")}"
+        end
+        nil
+      end
+
+      # `13/8/2026` under month-first ordering is month 13 — almost certainly
+      # a day-first date (and vice versa). Name the likely fix instead of
+      # leaving the generic cannot-match.
+      def date_term_hint(term)
+        parts = term.sub(/\A(>=|<=|>|<)/, "").tr("/.", "-").split("-")
+        return nil unless parts.size == 3 && parts[2].length == 4
+        a, b = parts[0].to_i, parts[1].to_i
+        if date_order == :mdy && a > 12 && (1..12).cover?(b)
+          " (day-first date? pass --european)"
+        elsif date_order == :dmy && b > 12 && (1..12).cover?(a)
+          " (month-first date? drop --european)"
         end
       end
 
@@ -418,39 +633,56 @@ module Mailmate
         d.year * 10_000 + d.month * 100 + d.day
       end
 
-      # "2026-03-19 …" → 20260319 without Time.parse. nil when the value
-      # isn't in the indexed shape (caller falls back to the slow path).
-      def fast_ymd(s)
-        return nil unless s && s.length >= 10 && s.getbyte(4) == 0x2D && s.getbyte(7) == 0x2D
-        y = s[0, 4].to_i
-        m = s[5, 2].to_i
-        d = s[8, 2].to_i
-        return nil if y.zero? || m.zero? || d.zero?
-        y * 10_000 + m * 100 + d
+      # Rolling clock windows: `24h` = the last 24 hours as an instant range,
+      # unlike d/w/m/y which are calendar windows. Returns [lo, hi] epoch
+      # floats (lo > hi means the term cannot match — date_spec_error reports
+      # it), or nil when the term isn't an hour form. Deliberately NOT
+      # memoized: the cutoff moves with the clock, and the MCP server process
+      # lives long enough for a cached one to go stale.
+      def hour_range_for(term)
+        m = /\A(>=|<=|>|<)?(\d+)h\z/.match(term)
+        return nil unless m
+        op, n = m[1], m[2].to_i
+        return [1.0, 0.0] if n.zero?
+
+        cutoff = Time.now.to_f - (n * 3600)
+        case op
+        when nil, ">=" then [cutoff, Float::INFINITY]
+        when ">"       then [1.0, 0.0] # the window already reaches the future
+        when "<"       then [-Float::INFINITY, cutoff]
+        when "<="      then [-Float::INFINITY, Float::INFINITY]
+        end
       end
 
+      # Match on the message's absolute send instant, converted to the display
+      # zone via Mailmate.localize — the SAME conversion the date/time output
+      # columns use, so the day a term matches is always the day the caller
+      # sees in the output. (The raw `#date` index value is sender-local time;
+      # matching on its sliced day — the old fast path — made `d 1d` return
+      # mail displayed under yesterday's date whenever the sender's calendar
+      # ran ahead of the display zone, e.g. a UTC sender after 6pm MDT.)
       def date_matches?(mail, eml_id, term)
-        range = date_range_for(term)
-        return false unless range
-
-        ymd = nil
+        t = nil
         if eml_id
           s = (reader_for("#date")&.value_for(eml_id.to_i) rescue nil)
-          if s && !s.empty?
-            ymd = fast_ymd(s)
-            if ymd.nil?
-              t = (Time.parse(s) rescue nil)
-              ymd = t && ymd_int(t.to_date)
-            end
-          end
+          t = fast_time(s) || (Time.parse(s) rescue nil) if s && !s.empty?
         end
-        if ymd.nil? && mail
+        if t.nil? && mail
           raw = mail.date
-          d = raw.respond_to?(:to_time) ? raw.to_time : raw
-          ymd = d && ymd_int(d.to_date)
+          t = raw.respond_to?(:to_time) ? raw.to_time : raw
         end
-        return false unless ymd
+        return false unless t
 
+        if (hours = hour_range_for(term))
+          f = t.to_f
+          return f >= hours[0] && f <= hours[1]
+        end
+
+        range = date_range_for(term)
+        return false unless range
+
+        local = Mailmate.localize(t)
+        ymd = local.year * 10_000 + local.month * 100 + local.day
         ymd >= range[0] && ymd <= range[1]
       rescue StandardError
         false
@@ -552,6 +784,35 @@ module Mailmate
         flags.reject { |f| f.start_with?("\\", "$") }.join(" ").downcase
       end
 
+      # term is the full lowercased token ("is:unread", "has:attachment").
+      # Flag states read the #flags index; attachment presence reads the
+      # indexed root content-type — multipart/mixed is the standard
+      # attachment layout (a Mail fallback checks real attachments when the
+      # message is already loaded). Unknown state values never reach here:
+      # date_spec_error rejects them up front.
+      def state_matches?(eml_id, mail, term)
+        state = STATE_CANON[term.split(":", 2).last]
+        return false unless state
+
+        case state
+        when :unread
+          eml_id ? !message_flags(eml_id).include?("\\Seen") : false
+        when :attachment
+          ct = eml_id ? (reader_for("content-type")&.value_for(eml_id.to_i) rescue nil).to_s : ""
+          return ct.downcase.include?("multipart/mixed") unless ct.empty?
+          mail ? mail.attachments.any? : false
+        else
+          message_flags(eml_id).include?(STATE_FLAGS[state])
+        end
+      end
+
+      def message_flags(eml_id)
+        return [] unless eml_id
+        reader_for("#flags")&.flags_for(eml_id.to_i) || []
+      rescue StandardError
+        []
+      end
+
       def text_body(mail)
         (mail.text_part&.decoded || mail.body.decoded).to_s.force_encoding("UTF-8").scrub.downcase
       rescue StandardError
@@ -627,26 +888,30 @@ module Mailmate
         texts
       end
 
-      def matches?(mail, eml_id, specs, headers_only, path = nil, index_only: false, exclude_quoted: false)
-        specs.all? do |field, term, negate|
-          term_b = term.b
-          hit =
-            case field
-            when :from, :recipients, :cc, :subject, :address_any
-              field_value(eml_id, mail, field).include?(term_b)
-            when :tag, :keyword
-              tag_value(eml_id).include?(term_b)
-            when :body
-              headers_only ? false : body_matches?(eml_id, mail, path, term, term_b, index_only: index_only, exclude_quoted: exclude_quoted)
-            when :message_or_body
-              common = %i[from recipients subject].any? { |f| field_value(eml_id, mail, f).include?(term_b) }
-              common || (!headers_only && body_matches?(eml_id, mail, path, term, term_b, index_only: index_only, exclude_quoted: exclude_quoted))
-            when :date
-              date_matches?(mail, eml_id, term)
-            when :any
-              %i[from recipients subject].any? { |f| field_value(eml_id, mail, f).include?(term_b) }
-            end
-          negate ? !hit : hit
+      def matches?(mail, eml_id, groups, headers_only, path = nil, index_only: false, exclude_quoted: false)
+        groups.any? do |specs|
+          specs.all? do |field, term, negate|
+            term_b = term.b
+            hit =
+              case field
+              when :from, :recipients, :cc, :subject, :address_any
+                field_value(eml_id, mail, field).include?(term_b)
+              when :tag, :keyword
+                tag_value(eml_id).include?(term_b)
+              when :body
+                headers_only ? false : body_matches?(eml_id, mail, path, term, term_b, index_only: index_only, exclude_quoted: exclude_quoted)
+              when :message_or_body
+                common = %i[from recipients subject].any? { |f| field_value(eml_id, mail, f).include?(term_b) }
+                common || (!headers_only && body_matches?(eml_id, mail, path, term, term_b, index_only: index_only, exclude_quoted: exclude_quoted))
+              when :date
+                date_matches?(mail, eml_id, term)
+              when :state
+                state_matches?(eml_id, mail, term)
+              when :any
+                %i[from recipients subject].any? { |f| field_value(eml_id, mail, f).include?(term_b) }
+              end
+            negate ? !hit : hit
+          end
         end
       end