@bobfrankston/mailx-types 0.1.106 → 0.1.110

package/index.d.ts

@@ -418,6 +418,66 @@ export declare function sanitizeHtml(html: string): {
  * boundaries so a multi-byte sequence is never cut in half.
  */
 export declare function encodeHeaderWord(text: string): string;
+/** Format one recipient for a message header: `Name <addr>`, with the name
+ *  quoted (and `\` / `"` escaped) when it contains RFC 5322 specials. Use this
+ *  for every From/To/Cc/Bcc header the app writes — never interpolate by hand. */
+export declare function formatAddressForHeader(name: string | undefined, address: string): string;
+/** Format a recipient list for a header (see formatAddressForHeader). */
+export declare function formatAddressListForHeader(list: {
+    name?: string;
+    address?: string;
+}[] | undefined): string;
+/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
+ *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
+ *  and angle brackets don't split): the `<…>` part when there is one, else the
+ *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
+ *
+ *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
+ *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
+ *  Android android-bootstrap and sync-manager) carried as copies. That class
+ *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
+ *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
+ *  member) matched as `msn.com@groups.io`: the To header was right, the
+ *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
+ *  exist". Taking the addr-spec whole avoids guessing at its characters. */
+export declare function envelopeAddresses(value: string): string[];
+/** What an SMTP send needs from a finished RFC 822 message. */
+export interface OutgoingEnvelope {
+    /** RCPT TO: every addr-spec in To, Cc and Bcc. */
+    recipients: string[];
+    /** MAIL FROM: the From addr-spec, or the caller's fallback. */
+    sender: string;
+    /** Subject header value, or "". */
+    subject: string;
+    /** Message-ID header value with its angle brackets, or "". */
+    messageId: string;
+    /** The message as transmitted: Bcc removed from the header section. */
+    rawToSend: string;
+}
+/** Build the SMTP envelope and the transmitted copy of an outgoing message.
+ *  ONE implementation for every send path (desktop mailx-imap sendRaw, Android
+ *  android-bootstrap and sync-manager), which each used to carry their own copy
+ *  of this code (2026-10-25 — Claude Code (Opus 5.5), at Bob's direction:
+ *  "economy of mechanism — why does that pattern appear in multiple places").
+ *  The copies are how one too-narrow address regex reached all three.
+ *
+ *  Reads the HEADER SECTION only, unfolded: matching the whole raw file once
+ *  scraped Cc lines out of a quoted reply chain into RCPT TO (2026-07-21).
+ *  Bcc is stripped from the header section only, continuation lines included,
+ *  so a quoted "Bcc:" in the body is never eaten. */
+export declare function outgoingEnvelope(raw: string, fallbackSender: string): OutgoingEnvelope;
+/** Entries of an address header that a reader would see as an address with
+ *  no `@` — e.g. the "Frankston" in `Frankston, Bob <x@y>`. Empty when sound. */
+export declare function findBareAddresses(value: string): string[];
+/** Send-time check (Bob 2026-10-05: "perhaps put in a debugging check"):
+ *  refuse to send when a header we built would carry an address without an
+ *  `@`, which the outgoing server would silently complete with its own
+ *  domain. Throws with the offending entries named; the caller's send error
+ *  path shows it to the user. */
+export declare function assertAddressHeaders(headers: Record<string, string | undefined>): void;
+export declare function tempAssertNoBogusIeccRecipients(lists: {
+    address?: string;
+}[][]): void;
 /**
  * Encode an address header value (From/To/Cc/Bcc/Reply-To), encoding only the
  * DISPLAY NAME of each address. The addr-spec must stay literal: encoding it
@@ -569,4 +629,6 @@ export declare function parseInvite(ics: string): ParsedInvite | null;
  * case specially").
  */
 export declare function inviteHasGoogleRsvp(bodyHtml: string): boolean;
+export { readListIdentity } from "./list-identity.js";
+export type { ListIdentity, ListHeaderLine } from "./list-identity.js";
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -194,6 +194,162 @@ function bytesToBase64(bytes) {
     // btoa exists in browsers and in Node ≥16.
     return btoa(bin);
 }
+// 2026-10-05 — Claude Code (Opus 5.5), at Bob's direction.
+// The send paths wrote `${name} <${address}>` with the name UNQUOTED. A contact
+// named "Frankston, Bob" went out as `To: Frankston, Bob <from-eleanor@...>`,
+// which every reader parses as TWO recipients: a bare "Frankston" and
+// "Bob <...>". The outgoing server (iecc's qmail) completes a bare name with
+// its own domain, so the header said Frankston@iecc.com, and every reply-all
+// bounced. Seen on Eleanor's sends since 2026-07-27 ("Frankston, Bob",
+// "Yehezkel, Revital", "Elkin Frankston, Seth"). SMTP RCPT used the parsed
+// list, so the original send itself was delivered correctly; only the header
+// was wrong.
+/** RFC 5322 `specials`: a display name containing any of these must be a
+ *  quoted-string, or the comma / @ / angle bracket is read as syntax. */
+const DISPLAY_NAME_SPECIALS = /[()<>[\]:;@\\,."]/;
+/** Format one recipient for a message header: `Name <addr>`, with the name
+ *  quoted (and `\` / `"` escaped) when it contains RFC 5322 specials. Use this
+ *  for every From/To/Cc/Bcc header the app writes — never interpolate by hand. */
+export function formatAddressForHeader(name, address) {
+    const n = (name || "").trim();
+    if (!n)
+        return address;
+    const display = DISPLAY_NAME_SPECIALS.test(n) ? `"${n.replace(/[\\"]/g, "\\$&")}"` : n;
+    return `${display} <${address}>`;
+}
+/** Format a recipient list for a header (see formatAddressForHeader). */
+export function formatAddressListForHeader(list) {
+    return (list || []).map(a => formatAddressForHeader(a.name, a.address || "")).join(", ");
+}
+/** Split an address header on top-level commas (outside quotes and angle
+ *  brackets; `\` escapes inside quotes honored). */
+function splitAddressHeader(value) {
+    const parts = [];
+    let cur = "";
+    let inAngle = false;
+    let inQuote = false;
+    for (let i = 0; i < value.length; i++) {
+        const ch = value[i];
+        if (inQuote && ch === "\\" && i + 1 < value.length) {
+            cur += ch + value[++i];
+            continue;
+        }
+        if (ch === '"' && !inAngle)
+            inQuote = !inQuote;
+        else if (ch === "<" && !inQuote)
+            inAngle = true;
+        else if (ch === ">" && !inQuote)
+            inAngle = false;
+        if (ch === "," && !inAngle && !inQuote) {
+            parts.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        parts.push(cur);
+    return parts.map(p => p.trim()).filter(Boolean);
+}
+/** The addr-spec of every entry in an address header — what SMTP RCPT TO /
+ *  MAIL FROM must carry. One per comma-separated entry (commas inside quotes
+ *  and angle brackets don't split): the `<…>` part when there is one, else the
+ *  entry itself minus any `(comment)`. Entries without an `@` are dropped.
+ *
+ *  2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Replaces the
+ *  `/[\w.+-]+@[\w.-]+/g` scan that all three send paths (desktop mailx-imap,
+ *  Android android-bootstrap and sync-manager) carried as copies. That class
+ *  omits characters RFC 5322 allows in a local part (`= ! # $ % & ' * / ? ^ { | } ~`),
+ *  so `bernardgreenberg=msn.com@groups.io` (groups.io's relay address for a
+ *  member) matched as `msn.com@groups.io`: the To header was right, the
+ *  envelope was wrong, and groups.io bounced "The group 'msn.com' does not
+ *  exist". Taking the addr-spec whole avoids guessing at its characters. */
+export function envelopeAddresses(value) {
+    if (!value)
+        return [];
+    const out = [];
+    for (const part of splitAddressHeader(value)) {
+        const angle = /<([^<>]*)>\s*$/.exec(part);
+        const spec = (angle ? angle[1] : part.replace(/\([^()]*\)/g, "")).trim();
+        if (spec.includes("@"))
+            out.push(spec);
+    }
+    return out;
+}
+/** Build the SMTP envelope and the transmitted copy of an outgoing message.
+ *  ONE implementation for every send path (desktop mailx-imap sendRaw, Android
+ *  android-bootstrap and sync-manager), which each used to carry their own copy
+ *  of this code (2026-10-25 — Claude Code (Opus 5.5), at Bob's direction:
+ *  "economy of mechanism — why does that pattern appear in multiple places").
+ *  The copies are how one too-narrow address regex reached all three.
+ *
+ *  Reads the HEADER SECTION only, unfolded: matching the whole raw file once
+ *  scraped Cc lines out of a quoted reply chain into RCPT TO (2026-07-21).
+ *  Bcc is stripped from the header section only, continuation lines included,
+ *  so a quoted "Bcc:" in the body is never eaten. */
+export function outgoingEnvelope(raw, fallbackSender) {
+    const headerEnd = raw.search(/\r?\n\r?\n/);
+    const headerRaw = headerEnd === -1 ? raw : raw.slice(0, headerEnd);
+    const headerSec = headerRaw.replace(/\r?\n[ \t]+/g, " ");
+    const field = (name) => headerSec.match(new RegExp(`^${name}:[ \\t]*(.*)$`, "mi"))?.[1] ?? "";
+    const recipients = [
+        ...envelopeAddresses(field("To")),
+        ...envelopeAddresses(field("Cc")),
+        ...envelopeAddresses(field("Bcc")),
+    ];
+    const sender = envelopeAddresses(field("From"))[0] || fallbackSender;
+    const messageId = field("Message-ID").match(/<[^<>]+>/)?.[0] ?? "";
+    // The `(\r?\n|$)` tail takes the line ending with the header so no blank
+    // line is left mid-headers; the final trim covers Bcc as the last header.
+    const stripBcc = (h) => h.replace(/^Bcc:[^\n]*(\r?\n[ \t][^\n]*)*(\r?\n|$)/mi, "").replace(/\r?\n$/, "");
+    const rawToSend = headerEnd === -1 ? stripBcc(raw) : stripBcc(headerRaw) + raw.slice(headerEnd);
+    return { recipients, sender, subject: field("Subject").trim(), messageId, rawToSend };
+}
+/** Entries of an address header that a reader would see as an address with
+ *  no `@` — e.g. the "Frankston" in `Frankston, Bob <x@y>`. Empty when sound. */
+export function findBareAddresses(value) {
+    if (!value)
+        return [];
+    return splitAddressHeader(value).filter(part => {
+        const angle = /<([^>]*)>\s*$/.exec(part);
+        const addrSpec = angle ? angle[1] : part;
+        return !addrSpec.includes("@");
+    });
+}
+/** Send-time check (Bob 2026-10-05: "perhaps put in a debugging check"):
+ *  refuse to send when a header we built would carry an address without an
+ *  `@`, which the outgoing server would silently complete with its own
+ *  domain. Throws with the offending entries named; the caller's send error
+ *  path shows it to the user. */
+export function assertAddressHeaders(headers) {
+    for (const [label, value] of Object.entries(headers)) {
+        const bare = findBareAddresses(value || "");
+        if (bare.length) {
+            throw new Error(`${label} header would contain ${bare.map(b => `"${b}"`).join(", ")} with no @ — the mail server would add its own domain to it. Not sent. Header: ${value}`);
+        }
+    }
+}
+// ─── TEMPORARY — REMOVE AFTER 2026-10-19 ───────────────────────────────────
+// 2026-10-05 — Claude Code (Opus 5.5), at Bob's direction ("add a temporary
+// bug check"). Leftovers of the unquoted-name bug above: old message headers
+// and learned contacts still hold bogus addresses like Frankston@iecc.com,
+// which reply-all copies — and they have an @, so assertAddressHeaders lets
+// them through. Real iecc recipients per Bob: johnl@ (2026-10-05), and
+// hostmaster@, accounts@, publishers@ "may be valid" — allowed.
+// iecc is specific to Bob's setup, which is why this is dated and temporary,
+// not a feature. Remove this function and its two callers (mailx-service
+// send, mailx-store-web send) once the old threads have aged out; tracked in
+// TODO.md.
+const TEMP_IECC_ALLOWED = new Set(["johnl@iecc.com", "hostmaster@iecc.com", "accounts@iecc.com", "publishers@iecc.com"]);
+export function tempAssertNoBogusIeccRecipients(lists) {
+    const bad = lists.flat()
+        .map(a => (a?.address || "").trim())
+        .filter(addr => /@iecc\.com$/i.test(addr) && !TEMP_IECC_ALLOWED.has(addr.toLowerCase()));
+    if (bad.length) {
+        throw new Error(`Recipient ${bad.join(", ")} looks like a name that the iecc server turned into an address (known real iecc addresses: ${[...TEMP_IECC_ALLOWED].join(", ")}). Remove it and send again. [temporary check, 2026-10-05]`);
+    }
+}
+// ─── END TEMPORARY ─────────────────────────────────────────────────────────
 /**
  * Encode an address header value (From/To/Cc/Bcc/Reply-To), encoding only the
  * DISPLAY NAME of each address. The addr-spec must stay literal: encoding it
@@ -234,7 +390,9 @@ export function encodeAddressHeader(value) {
         const m = /^(.*?)\s*(<[^>]*>)\s*$/.exec(p);
         if (!m)
             return p; // bare addr-spec, nothing to encode
-        const display = m[1].replace(/^"(.*)"$/s, "$1");
+        // 2026-10-05 Claude Code: undo formatAddressForHeader's \" / \\ escapes
+        // before RFC 2047-encoding (an encoded-word carries the raw text).
+        const display = m[1].replace(/^"(.*)"$/s, "$1").replace(/\\(.)/g, "$1");
         if (!display)
             return m[2];
         // eslint-disable-next-line no-control-regex
@@ -749,4 +907,6 @@ export function inviteHasGoogleRsvp(bodyHtml) {
         return false;
     return /calendar\.google\.com\/calendar\/event\?action=RESPOND/i.test(bodyHtml);
 }
+// Delivery address + mailing-list identity for reply's From (desktop + Android).
+export { readListIdentity } from "./list-identity.js";
 //# sourceMappingURL=index.js.map

package/list-identity.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Which of the reader's addresses a message was delivered to, and which
+ * mailing list it came through — the facts reply uses to pick a From.
+ *
+ * 2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Posting to the
+ * Multicians list (groups.io) needs From: Multicians@bobf.frankston.com, the
+ * subscribed address, and nothing in the message's headers names it:
+ *   - groups.io writes its OWN `Delivered-To: mailing list multicians@groups.io`
+ *     (the qmail/ezmlm loop-detection convention), which the old code took to
+ *     be the reader's address — so a reply's From became the list itself;
+ *   - the reader's own Delivered-To was lost before the message reached
+ *     IMAP. IECC did record it (`bobf-Multicians@bobf.frankston.com`), but
+ *     an older deployed mlproc (processletter.ts parseEnvelope) rewrote that
+ *     line with groups.io's marker — see MailApps/mlproc/.llm/
+ *     delivered-to-loss.md. (Corrected 2026-10-25; this said IECC recorded none.)
+ *   - groups.io names the subscriber only in its footer, after the
+ *     Unsubscribe link: `.../leave/... [Multicians@bobf.frankston.com]`.
+ *
+ * One module for desktop (mailx-store) and Android (mailx-store-web), so the
+ * two cannot drift apart again. Pure: header lines and body text in, strings
+ * out — no I/O, browser-safe.
+ */
+/** A header line as mailparser's `headerLines` gives it: lowercase key, raw `Key: value` line. */
+export interface ListHeaderLine {
+    key: string;
+    line: string;
+}
+export interface ListIdentity {
+    /** Address the RECEIVING server recorded delivering this copy to
+     *  (Delivered-To / X-Original-To / Envelope-To), or "". A mailing list's
+     *  own `Delivered-To: mailing list …` is never taken. */
+    deliveredTo: string;
+    /** List-Id identifier (`multicians.groups.io`), lowercase, or "". */
+    listId: string;
+    /** Addresses a post to this list would be sent To, most specific first:
+     *  List-Post, Reply-To, Sender. Bare, lowercase. Empty when not list mail. */
+    listAddresses: string[];
+    /** The reader's subscribed address as the list itself states it (groups.io
+     *  footer), or "". */
+    listSubscriber: string;
+}
+/** Read the delivery and list facts out of a parsed message. */
+export declare function readListIdentity(headerLines: readonly ListHeaderLine[], bodyText: string, bodyHtml: string): ListIdentity;
+//# sourceMappingURL=list-identity.d.ts.map

package/list-identity.js

@@ -0,0 +1,89 @@
+/**
+ * Which of the reader's addresses a message was delivered to, and which
+ * mailing list it came through — the facts reply uses to pick a From.
+ *
+ * 2026-10-25 — Claude Code (Opus 5.5), at Bob's direction. Posting to the
+ * Multicians list (groups.io) needs From: Multicians@bobf.frankston.com, the
+ * subscribed address, and nothing in the message's headers names it:
+ *   - groups.io writes its OWN `Delivered-To: mailing list multicians@groups.io`
+ *     (the qmail/ezmlm loop-detection convention), which the old code took to
+ *     be the reader's address — so a reply's From became the list itself;
+ *   - the reader's own Delivered-To was lost before the message reached
+ *     IMAP. IECC did record it (`bobf-Multicians@bobf.frankston.com`), but
+ *     an older deployed mlproc (processletter.ts parseEnvelope) rewrote that
+ *     line with groups.io's marker — see MailApps/mlproc/.llm/
+ *     delivered-to-loss.md. (Corrected 2026-10-25; this said IECC recorded none.)
+ *   - groups.io names the subscriber only in its footer, after the
+ *     Unsubscribe link: `.../leave/... [Multicians@bobf.frankston.com]`.
+ *
+ * One module for desktop (mailx-store) and Android (mailx-store-web), so the
+ * two cannot drift apart again. Pure: header lines and body text in, strings
+ * out — no I/O, browser-safe.
+ */
+/** Value of every occurrence of a header, unfolded, in message order. */
+function headerValues(lines, name) {
+    const want = name.toLowerCase();
+    const out = [];
+    for (const h of lines || []) {
+        if ((h.key || "").toLowerCase() !== want)
+            continue;
+        const colon = h.line.indexOf(":");
+        if (colon >= 0)
+            out.push(h.line.slice(colon + 1).replace(/\r?\n[ \t]+/g, " ").trim());
+    }
+    return out;
+}
+function bareAddress(value) {
+    return ((value || "").match(/[^\s<>,;:"]+@[^\s<>,;:"]+/)?.[0] || "").toLowerCase();
+}
+/** qmail/ezmlm, and groups.io after them, stamp `Delivered-To: mailing list
+ *  <addr>` on the copy they fan out, to catch mail loops. It names the LIST,
+ *  not the subscriber, and it sits below the receiving server's own line
+ *  when there is one. */
+const LIST_DELIVERED_TO = /^mailing list\s/i;
+/** The footer groups.io appends to every copy:
+ *    text: `Unsubscribe: https://groups.io/g/<group>/leave/<ids> [addr]`
+ *    html: `<a href="https://groups.io/g/<group>/leave/<ids>">Unsubscribe</a> [addr]`
+ *  Each piece matches one way only (the URL stops at quote/space, then the
+ *  optional anchor tail, then blanks, then the bracket), so a long body with
+ *  no footer fails in a single pass. */
+const GROUPS_IO_SUBSCRIBER = /groups\.io\/g\/[^\s"'<>\/]+\/leave\/[^\s"'<>]*(?:["']>Unsubscribe<\/a>)?\s*\[([^\s\[\]<>@]+@[^\s\[\]<>@]+)\]/i;
+/** Read the delivery and list facts out of a parsed message. */
+export function readListIdentity(headerLines, bodyText, bodyHtml) {
+    // Receiving-server headers: each agent PREPENDS its own, so the first
+    // that is not a list's loop marker is the final delivery to this mailbox.
+    let deliveredTo = "";
+    for (const key of ["delivered-to", "x-original-to", "envelope-to"]) {
+        for (const value of headerValues(headerLines, key)) {
+            if (LIST_DELIVERED_TO.test(value))
+                continue;
+            if (bareAddress(value)) {
+                deliveredTo = value;
+                break;
+            }
+        }
+        if (deliveredTo)
+            break;
+    }
+    const rawListId = headerValues(headerLines, "list-id")[0] || "";
+    const listId = ((rawListId.match(/<([^>]+)>/)?.[1]) || rawListId).trim().toLowerCase();
+    if (!listId)
+        return { deliveredTo, listId: "", listAddresses: [], listSubscriber: "" };
+    const listPost = (headerValues(headerLines, "list-post")[0] || "").match(/<mailto:([^>?]+)/i)?.[1] || "";
+    const listAddresses = [];
+    for (const candidate of [listPost, headerValues(headerLines, "reply-to")[0], headerValues(headerLines, "sender")[0]]) {
+        const addr = bareAddress(candidate || "");
+        if (addr && !listAddresses.includes(addr))
+            listAddresses.push(addr);
+    }
+    // Only groups.io states the subscriber, and only in its footer; the List-Id
+    // gate keeps the pattern off every other message's body.
+    let listSubscriber = "";
+    if (listId === "groups.io" || listId.endsWith(".groups.io")) {
+        const m = (bodyText || "").match(GROUPS_IO_SUBSCRIBER) || (bodyHtml || "").match(GROUPS_IO_SUBSCRIBER);
+        if (m)
+            listSubscriber = m[1];
+    }
+    return { deliveredTo, listId, listAddresses, listSubscriber };
+}
+//# sourceMappingURL=list-identity.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.106",
+  "version": "0.1.110",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.d.ts

@@ -40,6 +40,7 @@ export declare const TRUST_LIST_KEYS: {
     readonly intermediary: "trustedIntermediaries";
     readonly list: "trustedLists";
     readonly via: "trustedSendersVia";
+    readonly linkhost: "trustedLinkHosts";
 };
 export type TrustListType = keyof typeof TRUST_LIST_KEYS;
 /** One piece of evidence that a message is not what it claims to be. */
@@ -73,6 +74,11 @@ export interface TrustFinding {
      *  on a redirector warning when the sender is proved but not yet on the
      *  reader's list, so the viewer can offer "Stop warning about". (2026-09-11) */
     sender?: string;
+    /** Link hosts a phishing/malware URL listing named, set only when they
+     *  are the WHOLE of the forgery evidence on a proved sender, so the viewer
+     *  can offer "Trust links to ‹host›" (allowlist.jsonc `trustedLinkHosts`).
+     *  (2026-09-30) */
+    linkHosts?: string[];
 }
 export interface TrustInput {
     /** Every header line, in order, as mailparser's `headerLines`. Repeated
@@ -135,6 +141,19 @@ export interface TrustInput {
      *  forger with their own SES account is not groundnews.email's, and one
      *  without a relay signature matches nothing. See provedSenderVia. */
     trustedSendersVia?: string[];
+    /** Link hosts the reader vouches for, from allowlist.jsonc
+     *  `trustedLinkHosts` ("us.list-manage.com"). 2026-09-30, Claude Code
+     *  (Opus 5.5), at Bob's direction: Fig City News, a newsletter proved by
+     *  DMARC, went red because its links run through Mailchimp's click tracker
+     *  us.list-manage.com, which Spamhaus lists as abused for phishing
+     *  (URIBL_DBL_ABUSE_PHISH, 7.0) — and a phishing listing is forgery-class,
+     *  so no sender trust could clear it. A phishing listing stays forgery by
+     *  default: a proved sender can still send a bad link. An entry here
+     *  demotes such a listing to association ONLY when (a) the From line is
+     *  proved and nothing failed authentication, and (b) EVERY host the
+     *  server's report names for that rule is listed. A listing that names no
+     *  host, or any unlisted host, is untouched. */
+    trustedLinkHosts?: string[];
 }
 /**
  * Everything findable about this message, worst first.

package/trust.js

@@ -40,6 +40,8 @@ export const TRUST_LIST_KEYS = {
     intermediary: "trustedIntermediaries",
     list: "trustedLists",
     via: "trustedSendersVia",
+    // 2026-09-30 — see TrustInput.trustedLinkHosts.
+    linkhost: "trustedLinkHosts",
 };
 /** First value of a header, case-insensitive. */
 function header(lines, name) {
@@ -378,8 +380,10 @@ function unfold(value) {
  *      *      blocklist
  *      *      [URI: ns12.xincache.com/112.80.181.111]
  *
- *  The bracketed evidence lines are dropped: they name the third party, and
- *  the finding is about this message. */
+ *  The bracketed evidence lines stay out of the description — they name the
+ *  third party, and the finding is about this message — but `[URI: host]`
+ *  lines are kept per rule in `uris`: they are the only record of WHICH link
+ *  host a URL listing is about (2026-09-30, for trustedLinkHosts). */
 function parseSpamReport(report) {
     const out = new Map();
     let current = null;
@@ -389,12 +393,20 @@ function parseSpamReport(report) {
             continue;
         const start = line.match(/^(-?\d+(?:\.\d+)?)\s+([A-Z0-9_]{3,})\s*(.*)$/);
         if (start) {
-            current = { score: Number(start[1]), description: start[3].trim() };
+            current = { score: Number(start[1]), description: start[3].trim(), uris: [] };
             out.set(start[2], current);
             continue;
         }
-        if (current && !line.startsWith("["))
-            current.description += " " + line;
+        if (!current)
+            continue;
+        if (line.startsWith("[")) {
+            // "[URI: ns12.xincache.com/112.80.181.111]" — keep the host only.
+            const uri = line.match(/^\[URI:\s*([^\]\s/]+)/i)?.[1];
+            if (uri)
+                current.uris.push(uri.toLowerCase());
+            continue;
+        }
+        current.description += " " + line;
     }
     for (const rule of out.values())
         rule.description = rule.description
@@ -403,6 +415,19 @@ function parseSpamReport(report) {
             .trim();
     return out;
 }
+/** Rules that are a third party's listing of a host the message LINKS to.
+ *  Wider than ASSOCIATION_RULES: it includes the phishing/malware variants
+ *  (URIBL_PHISH, URIBL_DBL_ABUSE_PHISH), which classifyRule files as forgery.
+ *  Used only to decide whether trustedLinkHosts may speak to a rule. */
+const URL_LISTING_RULES = [
+    /^URIBL_/, /^SH_DBL/, /^SEM_URIBL/, /^KAM_(BODY_|FROM_)?\w*URIBL/,
+];
+const isUrlListing = (name) => URL_LISTING_RULES.some(re => re.test(name));
+/** Is `host` one of the reader's trusted link hosts, or a subdomain of one? */
+function linkHostTrusted(host, trusted) {
+    const h = (host || "").toLowerCase();
+    return trusted.some(t => h === t || h.endsWith("." + t));
+}
 function analyzeServerSpam(input) {
     const status = unfold(header(input.headerLines, "x-spam-status"));
     const flag = header(input.headerLines, "x-spam-flag");
@@ -433,15 +458,39 @@ function analyzeServerSpam(input) {
     // from delivering a rule called WORD_INVISshortcircuit.
     const names = (status.match(/tests=([\s\S]*?)(?=\s+[a-z_]+=|$)/)?.[1] || "")
         .replace(/\s+/g, "").split(",").map(n => n.toUpperCase()).filter(Boolean);
+    // Proof of the From line, from the same three sources provedBy uses below
+    // — needed BEFORE classification so a trusted link host can only ever
+    // speak for a proved sender. (2026-09-30)
+    const fromProved = dmarc.pass || names.includes("DKIM_VALID_AU") || names.includes("ALL_TRUSTED");
+    const trustedLinkHosts = (input.trustedLinkHosts || []).map(h => (h || "").trim().toLowerCase()).filter(Boolean);
+    const linkHostCandidates = new Set();
+    let forgeryOnlyUrlListings = true;
     const rules = names.map(name => {
         const found = report.get(name);
-        return {
-            name,
-            score: found ? found.score : NaN,
-            description: found ? found.description : "",
-            cls: classifyRule(name, dmarc.failed, list.proved),
-        };
+        let cls = classifyRule(name, dmarc.failed, list.proved);
+        const score = found ? found.score : NaN;
+        if (cls === "forgery" && !(score <= 0)) {
+            const uris = found?.uris || [];
+            const clearable = fromProved && !authFailures.length && isUrlListing(name) && uris.length > 0;
+            if (clearable && uris.every(u => linkHostTrusted(u, trustedLinkHosts))) {
+                // Every host this listing names is one the reader vouched for,
+                // on mail the sender proved: evidence about the link, not the From.
+                cls = "association";
+            }
+            else if (clearable) {
+                for (const u of uris)
+                    if (!linkHostTrusted(u, trustedLinkHosts))
+                        linkHostCandidates.add(u);
+            }
+            else {
+                forgeryOnlyUrlListings = false;
+            }
+        }
+        return { name, score, description: found ? found.description : "", cls };
     });
+    // Offered only when trusting these hosts would remove every forgery rule —
+    // a button that leaves the banner red would be a lie about what it does.
+    const linkHosts = forgeryOnlyUrlListings && !authFailures.length ? [...linkHostCandidates] : [];
     // A rule that scored zero or negative did not put this message over any
     // line, so it cannot be the reason the message is here. Unscored rules
     // (no X-Spam-Report, which is most unflagged mail) still count — absence
@@ -522,6 +571,7 @@ function analyzeServerSpam(input) {
         signers: dkimSigners(input),
         list,
         senderVia: provedSenderVia(input),
+        linkHosts,
     };
 }
 /**
@@ -611,15 +661,24 @@ function serverSpamVerdict(input) {
         : "flagged by SpamAssassin";
     const why = a.reasons.length ? ` — ${a.reasons.join("; ")}` : "";
     const bayes = a.bayesHam ? "; your own trained filter puts it at 0-1% spam (BAYES_00)" : "";
-    if (a.kind === "forgery")
+    if (a.kind === "forgery") {
+        // The one danger finding that carries an action (2026-09-30): the
+        // forgery evidence is entirely phishing listings of link hosts, on a
+        // proved sender. Say which host and what trusting it does.
+        const hosts = a.linkHosts;
+        const linkNote = hosts.length
+            ? `. The only rule here that tests identity is a listing of the link host ${hosts.join(", ")}; ${a.provedDomain} proved it sent this message. If that host is the sender's mail service (a newsletter's click tracker), "Trust links to ${hosts[0]}" stops treating the listing as forgery on proved mail.`
+            : "";
         return {
             id: "server-spam-verdict",
             severity: "danger",
             text: "Your mail server classified this as spam, and the rules that fired test who sent it.",
             detail: a.authFailures.length
                 ? `${a.authFailures.join(" and ")} authentication failed at your server. ${numbers}${why}`
-                : `${numbers}${why}`,
+                : `${numbers}${why}${linkNote}`,
+            ...(hosts.length ? { linkHosts: hosts } : {}),
         };
+    }
     if (a.proved && a.kind !== "unclassified")
         return {
             id: "server-spam-verdict",
@@ -875,6 +934,15 @@ function redirectorLink(input) {
     //    trusted domain into From.
     if (senderDomain && input.senderTrusted)
         return null;
+    // 6. (2026-10-12, Claude Code (Opus 5.5), at Bob's direction: "This is
+    //    from me to me".) The proved sender is the READER — a copy of their
+    //    own reply cc'd to themselves, From bob2021b@bob.ma, DKIM_VALID_AU for
+    //    bob.ma. "Only the sender could vouch for the link" — and the sender
+    //    is the person reading, who chose the link. Same proof requirement as
+    //    rule 5: an unproved From of the reader's own address is what a
+    //    self-spoof looks like, and stays checked.
+    if (senderDomain && input.ownAddresses.map(bare).includes(bare(input.fromAddress)))
+        return null;
     // 3. (2026-09-08) The redirector belongs to a reader-listed intermediary
     //    that provably handled the message. Google Calendar wraps every link
     //    in an invitation as google.com/url?q=…, signs the mail d=google.com,
@@ -882,6 +950,18 @@ function redirectorLink(input) {
     //    is "I trust google.com to do that". Same second-party logic: the
     //    host spending its reputation is the host that signed.
     const intermediary = provedIntermediary(input);
+    // 7. (2026-10-23, Claude Code (Opus 5.5), at Bob's direction: "I want to
+    //    allow mail from Aaron through Google but not all mail through
+    //    Google. I thought I had specified that.") He had: allowlist.jsonc
+    //    `trustedSendersVia: ["aaronsylvan.com via google.com"]`. But Aaron's
+    //    Google Calendar invite is signed only d=google.com, so the From is
+    //    never proved on its own, rule 5 cannot fire, and the only offer left
+    //    was rule 3's "trust google.com as an intermediary" for ALL mail
+    //    Google signs. The via pair is the narrower answer and its proof is
+    //    the same one provedSenderVia demands (the relay's verified
+    //    signature): links through THAT relay's own hosts are cleared for
+    //    THAT sender only. Links through any other redirector stay checked.
+    const senderVia = parseSenderVia(provedSenderVia(input));
     const signers = dkimSigners(input);
     for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
         let url;
@@ -897,6 +977,8 @@ function redirectorLink(input) {
             continue; // the sender's own host
         if (intermediary && sameOrg(url.hostname, intermediary))
             continue; // a trusted relay's own host
+        if (senderVia && sameOrg(url.hostname, senderVia.signer))
+            continue; // this sender's trusted relay (rule 7)
         for (const [, value] of url.searchParams) {
             let target;
             try {
@@ -983,11 +1065,57 @@ const RELAY_IDENTITY_HEADERS = [
     "x-auth-id",
     "x-authenticated-user",
 ];
+/**
+ * The author a mailing list rewrote out of From, or "" when the list did not
+ * rewrite it or left no trace of who it was.
+ *
+ * 2026-10-15 — Claude Code (Opus 5.5), at Bob's direction. A groups.io post by
+ * cd@libertyhaven.com arrived as `From: cd=libertyhaven.com@groups.io` (the
+ * list rewrites From to its own domain so the author's DMARC policy cannot
+ * bounce it), carrying `X-Authenticated-Sender: libertyhaven@libertyhaven.com`
+ * from the AUTHOR'S own host, one hop before the list. relayAuthMismatch
+ * compared that stamp with groups.io and painted a valid post red. A stamp
+ * describes the From that existed at the hop that wrote it — upstream of the
+ * list, that is the author's From, not the list's.
+ *
+ * Order matters. The `local=domain@list` form is built by the list from the
+ * From it actually received, so it is preferred over headers that merely
+ * travelled with the message (X-Original-From, Resent-From) and that an
+ * upstream sender could have written for itself.
+ */
+function listRewrittenAuthor(input, fromDomain) {
+    const list = listProof(input);
+    if (!list.proved || !sameOrg(fromDomain, list.host))
+        return "";
+    const local = bare(input.fromAddress).split("@")[0];
+    const encoded = local.match(/^([^=]+)=([a-z0-9.-]+\.[a-z]{2,})$/i);
+    if (encoded)
+        return `${encoded[1]}@${encoded[2]}`.toLowerCase();
+    for (const name of ["x-original-from", "resent-from"]) {
+        const addr = bare(header(input.headerLines, name));
+        if (addr.includes("@"))
+            return addr;
+    }
+    return "";
+}
 function relayAuthMismatch(input) {
-    const from = bare(input.fromAddress);
-    const fromDomain = from.split("@")[1] || "";
+    let from = bare(input.fromAddress);
+    let fromDomain = from.split("@")[1] || "";
     if (!fromDomain)
         return null;
+    // A list that provably delivered this and rewrote From to itself: the
+    // relay stamps are upstream of the list, so they are compared with the
+    // author the list rewrote out. If the list left no trace of the author
+    // there is nothing the stamp could be compared with, and no finding.
+    // (2026-10-15 — see listRewrittenAuthor.)
+    const list = listProof(input);
+    if (list.proved && sameOrg(fromDomain, list.host)) {
+        const author = listRewrittenAuthor(input, fromDomain);
+        if (!author)
+            return null;
+        from = author;
+        fromDomain = author.split("@")[1];
+    }
     for (const name of RELAY_IDENTITY_HEADERS) {
         const stamped = bare(header(input.headerLines, name));
         const stampedDomain = stamped.split("@")[1] || "";