@bobfrankston/mailx-types 0.1.84 → 0.1.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.84",
+  "version": "0.1.88",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -432,6 +432,13 @@ function serverSpamVerdict(input) {
     const senderDomain = (bare(header(input.headerLines, "sender")).split("@")[1] || "").toLowerCase();
     const relay = senderDomain ? a.signers.find(s => sameOrg(s, senderDomain)) : "";
     const via = relay && !a.proved ? { via: relay } : {};
+    // Say WHICH party and HOW, in the finding itself (Bob 2026-09-08: "the
+    // banner should tell which and how"). The action's label is quoted so
+    // the reader can match it to the button — and to the allowlist.jsonc
+    // entry it writes, `trustedIntermediaries`.
+    const relayNote = relay && !a.proved
+        ? `. Sent on the author's behalf by ${relay}, which signed it; "Trust ${relay} as an intermediary" stops this note for mail ${relay} signs.`
+        : "";
     const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold)
         ? `SpamAssassin score ${a.score} of ${a.threshold}`
         : "flagged by SpamAssassin";
@@ -482,7 +489,7 @@ function serverSpamVerdict(input) {
         id: "server-spam-verdict",
         severity: "caution",
         text: "Your mail server classified this as spam before delivering it.",
-        detail: `${proof}${numbers}${why}${bayes}`,
+        detail: `${proof}${numbers}${why}${bayes}${relayNote}`,
         ...via,
     };
 }
@@ -624,6 +631,18 @@ function provedSenderDomain(input) {
  *
  *   1. The redirector and the destination are the same organisation. A site
  *      bouncing through its own hostnames is routing, not hiding.
+ *   4. The link ENDS at the proved sender (2026-09-08). Microsoft 365's
+ *      Message center mail, dmarc=pass header.from=microsoft.com with
+ *      policy reject, links through its click-tracker
+ *      `nam.safelink.emails.azure.net` to `admin.microsoft.com`: two
+ *      organisations by hostname, nobody signed for azure.net, and the
+ *      sender is not the redirector — rules 1 to 3 all miss (Bob: "another
+ *      safe message flagged"). But the reader lands on the site of the party
+ *      that provably sent the mail, which is exactly where a plain link
+ *      would have taken them; the hop hides nothing from the reader. The
+ *      redirector's reputation may be borrowed, but that is the
+ *      redirector's problem, not this reader's — and the sender who chose
+ *      the route is the proved sender, who could have linked openly.
  *   2. The redirector IS the proved sender. Google's account-security notice
  *      (2026-09-02, Bob: "this is valid") links through
  *      `accounts.google.com/AccountChooser?continue=https://myaccount.google.com/…`
@@ -675,16 +694,22 @@ function redirectorLink(input) {
                 continue;
             if (sameOrg(target.hostname, url.hostname))
                 continue; // same site, not laundering
+            if (senderDomain && sameOrg(target.hostname, senderDomain))
+                continue; // ends at the proved sender (rule 4)
             // Name the signer behind this redirector, if there is one, so the
             // viewer can offer "trust google.com as an intermediary" — and
             // only then: a redirector nobody signed for has no party to vouch
             // for, and a list entry could not clear it anyway.
             const signer = signers.find(s => sameOrg(s, url.hostname));
+            // Which party, and how — or why there is no party (Bob 2026-09-08).
+            const how = signer
+                ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.`
+                : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
             return {
                 id: "redirector-link",
                 severity: "caution",
                 text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
-                detail: `${url.hostname} -> ${target.hostname}`,
+                detail: `${url.hostname} -> ${target.hostname}.${how}`,
                 ...(signer ? { via: signer } : {}),
             };
         }