@bobfrankston/mailx-store 0.1.105 → 0.1.108

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.105",
+  "version": "0.1.108",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -10,7 +10,7 @@
   "license": "ISC",
   "dependencies": {
     "@bobfrankston/mailx-types": "^0.1.73",
-    "@bobfrankston/mailx-settings": "^0.1.69",
+    "@bobfrankston/mailx-settings": "^0.1.70",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -30,7 +30,7 @@
   ".transformedSnapshot": {
     "dependencies": {
       "@bobfrankston/mailx-types": "^0.1.73",
-      "@bobfrankston/mailx-settings": "^0.1.69",
+      "@bobfrankston/mailx-settings": "^0.1.70",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.js

@@ -278,11 +278,26 @@ export class Store {
         // reached an address of the reader's, which permits images but is not
         // a statement about who sent it — and the trust banner asks about the
         // sender. (Claude Code 2026-08-28)
+        //
+        // Two lists, two questions. `senders`/`domains` came from the
+        // remote-content banner and mean "load their images"; loading someone's
+        // images implies trusting them, so they count here too.
+        // `trustedSenders`/`trustedDomains` mean ONLY "stop warning me about
+        // this sender" — Bob 2026-08-28: "I don't need the spam reminder but I
+        // don't want to say show remote content in order to prevent tracking."
+        // They must never widen allowRemote.
         const senders = (allowList.senders || []).map((s) => (s || "").toLowerCase());
         const domains = (allowList.domains || []).map((d) => (d || "").toLowerCase());
-        const senderTrusted = senders.includes(senderAddr) || domains.includes(senderDomain);
+        const trustedSenders = (allowList.trustedSenders || []).map((s) => (s || "").toLowerCase());
+        const trustedDomains = (allowList.trustedDomains || []).map((d) => (d || "").toLowerCase());
+        const senderTrusted = senders.includes(senderAddr) || domains.includes(senderDomain)
+            || trustedSenders.includes(senderAddr) || trustedDomains.includes(senderDomain);
         if (!allowRemote) {
-            if (senderTrusted || rcptAddrs.some((a) => recipients.includes(a))) {
+            // Deliberately NOT senderTrusted: that now also covers the
+            // quiet-the-banner list, and quieting a banner must never turn on
+            // a tracking pixel.
+            if (senders.includes(senderAddr) || domains.includes(senderDomain)
+                || rcptAddrs.some((a) => recipients.includes(a))) {
                 allowRemote = true;
             }
         }