@bobfrankston/mailx-types 0.1.53 → 0.1.57

package/index.d.ts

@@ -253,10 +253,17 @@ export interface MailxSettings {
     accounts: AccountConfig[];
     ui: {
         theme: "system" | "dark" | "light";
-        editor: "quill" | "tiptap";
+        editor: "quill" | "tiptap" | "tinymce";
         folderWidth: number;
         listViewerSplit: number; /** Percentage for message list height */
+        /** Root font-size in px — scales the whole app chrome (rem-based CSS). */
         fontSize: number;
+        /** Editor body font-size in px. DISPLAY ONLY — it reaches the editors as
+         *  a content stylesheet / CSS var and is never serialized into outgoing
+         *  mail, so changing it cannot affect recipients. Distinct from
+         *  `fontSize` above, which is the app chrome. Was read by app.ts and
+         *  compose.ts but never declared here (Bob 2026-08-19). */
+        composeFontSize: number;
     };
     sync: {
         intervalMinutes: number;

package/index.js

@@ -479,9 +479,32 @@ export function displayNameClaimsOtherAddress(name, address) {
     const m = n.match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g);
     if (!m)
         return null;
+    const realDomain = real.split("@").pop() || "";
     for (const claimed of m) {
-        if (claimed.toLowerCase() !== real)
-            return claimed;
+        if (claimed.toLowerCase() === real)
+            continue;
+        // Same organisation is not impersonation. Plenty of legitimate senders
+        // put a contact address in the display name that differs from the
+        // envelope address at the same org — IEEE Xplore alerts arrive as
+        // `"Content-Alert@ieee.org" <no-reply@xplore.ieee.org>`, which the
+        // first cut flagged in danger red and read as a spam marker
+        // (Bob 2026-08-20: "marked as spam but is a valid message"; that
+        // message passes SPF, DKIM and DMARC and SpamAssassin scores it -2.0).
+        //
+        // Sub/parent-domain rather than "same registrable domain" on purpose:
+        // comparing the last two labels would treat paypal.co.uk and
+        // evil.co.uk as related, which is exactly the case that must stay
+        // flagged. A subdomain relationship cannot be forged across orgs.
+        const claimedDomain = claimed.toLowerCase().split("@").pop() || "";
+        if (claimedDomain && realDomain) {
+            if (claimedDomain === realDomain)
+                continue;
+            if (claimedDomain.endsWith("." + realDomain))
+                continue;
+            if (realDomain.endsWith("." + claimedDomain))
+                continue;
+        }
+        return claimed;
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.53",
+  "version": "0.1.57",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",