@bobfrankston/mailx-types 0.1.76 → 0.1.80

package/index.d.ts

@@ -55,11 +55,17 @@ export interface AccountConfig {
     signature?: string; /** Legacy: HTML signature appended to all outgoing messages (new + reply + forward). Plain text or HTML allowed. Superseded by `sig`. */
     sig?: AccountSignature; /** Per-account signature object. Initially appended only to NEW messages; later options will cover replies/forwards. */
 }
-/** Signature configuration in accounts.jsonc. Initial shape carries `text`
- *  only; `html: true` reserved for future support of raw HTML signatures. */
+/** Signature configuration in accounts.jsonc. May be set per-account or once
+ *  at the top level of the file, where it applies to every account that has
+ *  no `sig` of its own. Appended by compose to new mail, replies and
+ *  forwards; drafts already carry it in the saved body.
+ *
+ *  2026-09-02 — Claude Code (Opus 5), at Bob's direction: `html` is honoured
+ *  (client/compose/compose.ts), not "reserved for future use" as this comment
+ *  previously claimed. */
 export interface AccountSignature {
-    text: string; /** Plain-text signature body. Newlines preserved. Appended to NEW messages with the standard "-- " RFC 3676 separator. */
-    html?: boolean; /** Future flag: when true, `text` is treated as raw HTML rather than escaped plain text. Currently ignored. */
+    text: string; /** Signature body. Plain text unless `html` is set. Appended to NEW messages with the standard "-- " RFC 3676 separator. */
+    html?: boolean; /** When true, `text` is inserted as raw HTML — write your own `<br>` for line breaks. When false/absent, `text` is HTML-escaped and newlines become `<br>`. */
 }
 /** Standard IMAP special-use folder types */
 export type SpecialUse = "inbox" | "sent" | "drafts" | "trash" | "junk" | "archive" | "all";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.76",
+  "version": "0.1.80",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -56,6 +56,20 @@ function bare(addr) {
     const m = (addr || "").match(/[^\s<>,;]+@[^\s<>,;]+/);
     return (m ? m[0] : addr || "").toLowerCase().replace(/[.,;]+$/, "");
 }
+/** Do two hostnames belong to the same organisation?
+ *
+ *  Equality or a sub/parent-domain relation, never "the last two labels
+ *  match": that would make paypal.co.uk and evil.co.uk relatives, which is
+ *  the case this whole file exists to catch. A subdomain relationship cannot
+ *  be forged across organisations, so it is safe in the other direction.
+ *  Same test displayNameClaimsOtherAddress uses on addresses. */
+function sameOrg(a, b) {
+    const x = (a || "").toLowerCase();
+    const y = (b || "").toLowerCase();
+    if (!x || !y)
+        return false;
+    return x === y || x.endsWith("." + y) || y.endsWith("." + x);
+}
 /** Rules that say THIS message lies about who sent it. The only class that
  *  earns the red banner. `KAM_DMARC_STATUS` is deliberately absent — it is a
  *  0.0-scoring status marker that fired on Mokin, a message the receiving
@@ -514,6 +528,23 @@ function hiddenLinkOverlay(bodyHtml) {
     }
     return null;
 }
+/** The domain the receiving server proved the From line for — "" when nothing
+ *  did. One place answers "is this sender who they say they are", so the
+ *  banner, the chip and the link checks can never disagree about it.
+ *
+ *  dmarcProof is asked first because it needs no SpamAssassin: an
+ *  Authentication-Results header alone is enough, which is what mail arriving
+ *  through the Gmail API carries. analyzeServerSpam adds the two proofs
+ *  SpamAssassin states in its own rule list instead (DKIM_VALID_AU,
+ *  ALL_TRUSTED) and returns null when the server ran no filter at all. */
+function provedSenderDomain(input) {
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    if (!fromDomain)
+        return "";
+    if (dmarcProof(input).pass)
+        return fromDomain;
+    return analyzeServerSpam(input)?.proved ? fromDomain : "";
+}
 /**
  * Does a link route through a redirector carrying its real destination in the
  * query string?
@@ -523,8 +554,30 @@ function hiddenLinkOverlay(bodyHtml) {
  * whose redirect script was left open, and the destination appears only
  * percent-encoded inside a parameter. Reporting the ENDPOINT is the point — a
  * reader cannot be expected to URL-decode a query string.
+ *
+ * Laundering needs a SECOND PARTY — someone whose reputation is being spent
+ * without their consent. Two ways a link has none, both checked below, and
+ * neither of them a threshold:
+ *
+ *   1. The redirector and the destination are the same organisation. A site
+ *      bouncing through its own hostnames is routing, not hiding.
+ *   2. The redirector IS the proved sender. Google's account-security notice
+ *      (2026-09-02, Bob: "this is valid") links through
+ *      `accounts.google.com/AccountChooser?continue=https://myaccount.google.com/…`
+ *      — two hostnames that are neither equal nor sub/parent of each other,
+ *      so rule 1 alone does not save it. But the receiving server recorded
+ *      `dmarc=pass header.from=accounts.google.com`: the host in the visible
+ *      link belongs to the party that provably sent the mail, spending its
+ *      own reputation. That the sender might itself be malicious is a
+ *      different question than the one this check asks.
+ *
+ * The proof has to come from the topmost Authentication-Results, which the
+ * sender cannot write — otherwise the escape is a switch a forger flips by
+ * typing a domain into From. No proof means the check stays on.
  */
-function redirectorLink(bodyHtml) {
+function redirectorLink(input) {
+    const bodyHtml = input.bodyHtml || "";
+    const senderDomain = provedSenderDomain(input);
     for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
         let url;
         try {
@@ -535,6 +588,8 @@ function redirectorLink(bodyHtml) {
         }
         if (!/^https?:$/.test(url.protocol))
             continue;
+        if (senderDomain && sameOrg(url.hostname, senderDomain))
+            continue; // the sender's own host
         for (const [, value] of url.searchParams) {
             let target;
             try {
@@ -545,8 +600,8 @@ function redirectorLink(bodyHtml) {
             }
             if (!/^https?:$/.test(target.protocol))
                 continue;
-            if (target.hostname === url.hostname)
-                continue; // same-site, not laundering
+            if (sameOrg(target.hostname, url.hostname))
+                continue; // same site, not laundering
             return {
                 id: "redirector-link",
                 severity: "caution",
@@ -571,7 +626,7 @@ export function assessMessageTrust(input) {
         relayAuthMismatch(input),
         zeroWidthObfuscation(input.bodyText || ""),
         hiddenLinkOverlay(input.bodyHtml || ""),
-        redirectorLink(input.bodyHtml || ""),
+        redirectorLink(input),
     ].filter(Boolean);
     const rank = { danger: 0, caution: 1, info: 2 };
     return findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
@@ -614,11 +669,9 @@ function relayAuthMismatch(input) {
     for (const name of RELAY_IDENTITY_HEADERS) {
         const stamped = bare(header(input.headerLines, name));
         const stampedDomain = stamped.split("@")[1] || "";
-        if (!stampedDomain || stampedDomain === fromDomain)
-            continue;
         // Sub/parent-domain is the same organisation — mail.example.com
         // sending for example.com is ordinary. Cross-organisation is not.
-        if (stampedDomain.endsWith("." + fromDomain) || fromDomain.endsWith("." + stampedDomain))
+        if (!stampedDomain || sameOrg(stampedDomain, fromDomain))
             continue;
         return {
             id: "relay-auth-mismatch",