@bobfrankston/mailx-store 0.1.95 → 0.1.99

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store",
-  "version": "0.1.95",
+  "version": "0.1.99",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,8 +9,8 @@
   },
   "license": "ISC",
   "dependencies": {
-    "@bobfrankston/mailx-types": "^0.1.63",
-    "@bobfrankston/mailx-settings": "^0.1.62",
+    "@bobfrankston/mailx-types": "^0.1.67",
+    "@bobfrankston/mailx-settings": "^0.1.65",
     "@bobfrankston/mailx-bus": "^0.1.2",
     "mailparser": "^3.7.2"
   },
@@ -29,8 +29,8 @@
   },
   ".transformedSnapshot": {
     "dependencies": {
-      "@bobfrankston/mailx-types": "^0.1.63",
-      "@bobfrankston/mailx-settings": "^0.1.62",
+      "@bobfrankston/mailx-types": "^0.1.67",
+      "@bobfrankston/mailx-settings": "^0.1.65",
       "@bobfrankston/mailx-bus": "^0.1.2",
       "mailparser": "^3.7.2"
     }

package/store.js

@@ -544,19 +544,23 @@ export class Store {
         // forges, so an alias the user never got round to listing is still
         // covered. (Claude Code 2026-08-25)
         const trustHeaderLines = (parsed.headerLines || []).map(h => ({ key: h.key, line: h.line }));
-        const trust = assessMessageTrust({
+        const trustInput = {
             headerLines: trustHeaderLines,
             fromAddress: envelope.from?.address || "",
             ownAddresses: [...recipients, (deliveredTo.match(/[^\s<>]+@[^\s<>]+/) || [""])[0]].filter(Boolean),
             bodyHtml,
             bodyText,
-        });
+        };
+        const trust = assessMessageTrust(trustInput);
         // The server's score travels separately from the findings: a finding is
         // an accusation and fires only on evidence, this is a measurement the
         // reader asked to see either way (Bob 2026-08-25). A 2.7 against a 4.5
         // threshold is "did not quite trip the wire", which is not the same
         // thing as clean — and that is exactly the message that got through.
-        const spamScore = spamScoreOf(trustHeaderLines);
+        // Same input as the findings, so the chip and the banner are computed
+        // from one analysis and cannot contradict each other about whether the
+        // sender was proved. (Claude Code 2026-08-27)
+        const spamScore = spamScoreOf(trustInput);
         if (bodyHtml && !allowRemote) {
             const result = sanitizeHtml(bodyHtml);
             bodyHtml = result.html;