@bobfrankston/mailx-store 0.1.101 → 0.1.105

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.101",
+  "version": "0.1.105",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,8 +9,8 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.69",
-    "@bobfrankston/mailx-settings": "^0.1.66",
+    "@bobfrankston/mailx-types": "^0.1.73",
+    "@bobfrankston/mailx-settings": "^0.1.69",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -29,8 +29,8 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.69",
-      "@bobfrankston/mailx-settings": "^0.1.66",
+      "@bobfrankston/mailx-types": "^0.1.73",
+      "@bobfrankston/mailx-settings": "^0.1.69",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.js

@@ -271,12 +271,18 @@ export class Store {
             .map((a) => (a.address || "").toLowerCase());
         // Allowlist auto-allow: trusted sender / domain / recipient skips
         // sanitization. Same rule as the legacy service implementation.
+        //
+        // senderTrusted is deliberately NARROWER than allowRemote: it is only
+        // the sender and domain lists, the two the reader fills in by saying
+        // "this correspondent is fine". A recipient-alias match says the mail
+        // reached an address of the reader's, which permits images but is not
+        // a statement about who sent it — and the trust banner asks about the
+        // sender. (Claude Code 2026-08-28)
+        const senders = (allowList.senders || []).map((s) => (s || "").toLowerCase());
+        const domains = (allowList.domains || []).map((d) => (d || "").toLowerCase());
+        const senderTrusted = senders.includes(senderAddr) || domains.includes(senderDomain);
         if (!allowRemote) {
-            const senders = (allowList.senders || []).map((s) => (s || "").toLowerCase());
-            const domains = (allowList.domains || []).map((d) => (d || "").toLowerCase());
-            if (senders.includes(senderAddr) ||
-                domains.includes(senderDomain) ||
-                rcptAddrs.some((a) => recipients.includes(a))) {
+            if (senderTrusted || rcptAddrs.some((a) => recipients.includes(a))) {
                 allowRemote = true;
             }
         }
@@ -548,6 +554,10 @@ export class Store {
             headerLines: trustHeaderLines,
             fromAddress: envelope.from?.address || "",
             ownAddresses: [...recipients, (deliveredTo.match(/[^\s<>]+@[^\s<>]+/) || [""])[0]].filter(Boolean),
+            // The reader's own answer to "is this wanted", which no score can
+            // reach. Suppresses the bulk/association note on a PROVED sender
+            // only; forgery evidence is never silenced by a list.
+            senderTrusted,
             bodyHtml,
             bodyText,
         };