@bobfrankston/mailx-store 0.1.36 → 0.1.37

package/file-store.d.ts

@@ -26,7 +26,16 @@ export declare class FileMessageStore implements MessageStore {
     private resolveStored;
     /** Write a new body. Returns a path RELATIVE to basePath; caller stores
      *  it in `body_path`. The (folderId, uid) args are kept for interface
-     *  compatibility; they do NOT affect the filename. */
+     *  compatibility; they do NOT affect the filename.
+     *
+     *  Defensive content check: if the FIRST line of the would-be .eml
+     *  matches an IMAP client-command pattern (`<tag> <UPPERCASE_CMD> ...`),
+     *  the upstream IMAP parser desynced and wrote one of mailx's own
+     *  outbound commands into the response stream — see the
+     *  a39a84e1853441bcac09e1b3e1463e8d.eml corruption (2026-05-23). Refuse
+     *  the write rather than persist garbage that the message-viewer will
+     *  later render as broken. The caller's exception path treats this the
+     *  same as any other transient fetch error; the reconciler re-enqueues. */
     putMessage(accountId: string, _folderId: number, _uid: number, raw: Buffer): Promise<string>;
     /** Resolve a stored body_path (relative or absolute) to an absolute
      *  filesystem path. Returns "" if the input doesn't resolve to a file

package/file-store.js

@@ -43,8 +43,33 @@ export class FileMessageStore {
     }
     /** Write a new body. Returns a path RELATIVE to basePath; caller stores
      *  it in `body_path`. The (folderId, uid) args are kept for interface
-     *  compatibility; they do NOT affect the filename. */
+     *  compatibility; they do NOT affect the filename.
+     *
+     *  Defensive content check: if the FIRST line of the would-be .eml
+     *  matches an IMAP client-command pattern (`<tag> <UPPERCASE_CMD> ...`),
+     *  the upstream IMAP parser desynced and wrote one of mailx's own
+     *  outbound commands into the response stream — see the
+     *  a39a84e1853441bcac09e1b3e1463e8d.eml corruption (2026-05-23). Refuse
+     *  the write rather than persist garbage that the message-viewer will
+     *  later render as broken. The caller's exception path treats this the
+     *  same as any other transient fetch error; the reconciler re-enqueues. */
     async putMessage(accountId, _folderId, _uid, raw) {
+        if (raw.length >= 6) {
+            // Look at the first ≤512 bytes to spot a leaked IMAP command.
+            // Pattern: optional CRLFs, then `<tag> <CMD> ...` where tag
+            // starts with a letter+digits (iflow tags are like `A123`,
+            // `B47`) and CMD is all-caps with at least 4 chars.
+            const sniff = raw.subarray(0, Math.min(512, raw.length)).toString("ascii");
+            const firstNonBlank = sniff.replace(/^\s+/, "");
+            // Strict: tag is letter + digits, then a space, then an
+            // all-caps IMAP command keyword. Real RFC822 headers can't
+            // match because they require a `Name: value` shape (colon),
+            // and `Return-Path:`, `Received:`, `Subject:` etc. are
+            // capitalized but include a colon and mixed case in tokens.
+            if (/^[A-Z]+\d+ (UID )?(FETCH|SEARCH|STORE|COPY|MOVE|EXPUNGE|SELECT|EXAMINE|APPEND|LIST|LSUB|STATUS|NOOP|IDLE|DONE|LOGIN|LOGOUT|CAPABILITY|AUTHENTICATE)\b/.test(firstNonBlank)) {
+                throw new Error(`putMessage: refusing to write corrupt body — IMAP command leaked into response stream (first line: ${firstNonBlank.split(/\r?\n/)[0].substring(0, 100)})`);
+            }
+        }
         const rel = this.newRelativePath(accountId);
         const abs = path.join(this.basePath, rel);
         fs.mkdirSync(path.dirname(abs), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",