@bobfrankston/mailx-store 0.1.36 → 0.1.38

package/file-store.d.ts

@@ -26,7 +26,16 @@ export declare class FileMessageStore implements MessageStore {
     private resolveStored;
     /** Write a new body. Returns a path RELATIVE to basePath; caller stores
      *  it in `body_path`. The (folderId, uid) args are kept for interface
-     *  compatibility; they do NOT affect the filename. */
+     *  compatibility; they do NOT affect the filename.
+     *
+     *  Defensive content check: if the FIRST line of the would-be .eml
+     *  matches an IMAP client-command pattern (`<tag> <UPPERCASE_CMD> ...`),
+     *  the upstream IMAP parser desynced and wrote one of mailx's own
+     *  outbound commands into the response stream — see the
+     *  a39a84e1853441bcac09e1b3e1463e8d.eml corruption (2026-05-23). Refuse
+     *  the write rather than persist garbage that the message-viewer will
+     *  later render as broken. The caller's exception path treats this the
+     *  same as any other transient fetch error; the reconciler re-enqueues. */
     putMessage(accountId: string, _folderId: number, _uid: number, raw: Buffer): Promise<string>;
     /** Resolve a stored body_path (relative or absolute) to an absolute
      *  filesystem path. Returns "" if the input doesn't resolve to a file

package/file-store.js

@@ -43,8 +43,33 @@ export class FileMessageStore {
     }
     /** Write a new body. Returns a path RELATIVE to basePath; caller stores
      *  it in `body_path`. The (folderId, uid) args are kept for interface
-     *  compatibility; they do NOT affect the filename. */
+     *  compatibility; they do NOT affect the filename.
+     *
+     *  Defensive content check: if the FIRST line of the would-be .eml
+     *  matches an IMAP client-command pattern (`<tag> <UPPERCASE_CMD> ...`),
+     *  the upstream IMAP parser desynced and wrote one of mailx's own
+     *  outbound commands into the response stream — see the
+     *  a39a84e1853441bcac09e1b3e1463e8d.eml corruption (2026-05-23). Refuse
+     *  the write rather than persist garbage that the message-viewer will
+     *  later render as broken. The caller's exception path treats this the
+     *  same as any other transient fetch error; the reconciler re-enqueues. */
     async putMessage(accountId, _folderId, _uid, raw) {
+        if (raw.length >= 6) {
+            // Look at the first ≤512 bytes to spot a leaked IMAP command.
+            // Pattern: optional CRLFs, then `<tag> <CMD> ...` where tag
+            // starts with a letter+digits (iflow tags are like `A123`,
+            // `B47`) and CMD is all-caps with at least 4 chars.
+            const sniff = raw.subarray(0, Math.min(512, raw.length)).toString("ascii");
+            const firstNonBlank = sniff.replace(/^\s+/, "");
+            // Strict: tag is letter + digits, then a space, then an
+            // all-caps IMAP command keyword. Real RFC822 headers can't
+            // match because they require a `Name: value` shape (colon),
+            // and `Return-Path:`, `Received:`, `Subject:` etc. are
+            // capitalized but include a colon and mixed case in tokens.
+            if (/^[A-Z]+\d+ (UID )?(FETCH|SEARCH|STORE|COPY|MOVE|EXPUNGE|SELECT|EXAMINE|APPEND|LIST|LSUB|STATUS|NOOP|IDLE|DONE|LOGIN|LOGOUT|CAPABILITY|AUTHENTICATE)\b/.test(firstNonBlank)) {
+                throw new Error(`putMessage: refusing to write corrupt body — IMAP command leaked into response stream (first line: ${firstNonBlank.split(/\r?\n/)[0].substring(0, 100)})`);
+            }
+        }
         const rel = this.newRelativePath(accountId);
         const abs = path.join(this.basePath, rel);
         fs.mkdirSync(path.dirname(abs), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -10,7 +10,7 @@
   "license": "ISC",
   "dependencies": {
     "@bobfrankston/mailx-types": "^0.1.18",
-    "@bobfrankston/mailx-settings": "^0.1.22",
+    "@bobfrankston/mailx-settings": "^0.1.24",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -30,7 +30,7 @@
   ".transformedSnapshot": {
     "dependencies": {
       "@bobfrankston/mailx-types": "^0.1.18",
-      "@bobfrankston/mailx-settings": "^0.1.22",
+      "@bobfrankston/mailx-settings": "^0.1.24",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.d.ts

@@ -58,6 +58,11 @@ export interface StoreMessage extends MessageEnvelope {
     listUnsubscribeOneClick: boolean;
     emlPath: string;
     isFlagged: boolean;
+    /** X-Mailx-Draft-ID header value (empty for non-draft messages). When
+     *  the user re-opens a draft for edit, the compose layer threads this
+     *  back into saveDraft so the server-side dedup keeps replacing the
+     *  same draft instead of stacking up a new one every save. */
+    mailxDraftId: string;
 }
 export declare class Store {
     /** SQLite metadata index. Exposed as a public field — sync clients

package/store.js

@@ -400,6 +400,7 @@ export class Store {
             return String(v);
         };
         const returnPath = hdr("return-path").replace(/[<>]/g, "");
+        const mailxDraftId = hdr("x-mailx-draft-id").trim();
         const { listUnsubscribeMail, listUnsubscribeHttp, listUnsubscribeOneClick } = parseListUnsubscribe(parsed.headers);
         const listUnsubscribe = listUnsubscribeHttp || listUnsubscribeMail;
         const result = {
@@ -416,6 +417,7 @@ export class Store {
             // basePath every time.
             emlPath: this.bodyStore.absolutePath(storedPath),
             isFlagged,
+            mailxDraftId,
         };
         // Memoize for instant re-view of the same message. cacheKey is
         // path+mtime so a re-fetch (mtime changes) invalidates naturally.