@bobfrankston/rmfmail 1.0.676 → 1.0.678

package/TODO.md

@@ -237,7 +237,17 @@ Previously shown as showstoppers; moved here because they haven't recurred on re
 Small, self-contained items. Pick them up between higher-priority blocks without asking. Bump version per fix.
 
 - ~~**Q138 — Quoted-reply image sizes lost.**~~ DONE 2026-05-11 in `client/app.ts:1000` — strip skips `<img>`. Two-pass loop handles multiple stripped attrs per tag.
-- **Q140 — User-configurable holiday calendars (generalization).** Today the holiday-pull list is hardcoded to two Google calendars: `en.usa#holiday` and `en.jewish#holiday`, each with its own checkbox in the sidebar. Bob 2026-05-11: "Static calendars are OK. You can add generalization to the maybe-future list. Unlikely to do unless I want a more general audience." When that audience expands, generalize to `settings.calendar.holidayCalendars: Array<{ id: string; label: string; enabled: boolean }>`. The refresh loop iterates the array; the sidebar renders one checkbox per entry; a small editor in Settings → calendar lets the user add/remove entries by calendar ID (Google publishes `<locale>.<country>#holiday@group.v.calendar.google.com`, `en.christian#holiday`, etc.). Schema-side `calendar_id` column already partitions rows by source, so toggling one off doesn't affect the others — the existing reconcile logic carries straight over.
+- **Q140 — User-configurable holiday calendars (generalization).** Today the holiday-pull list is hardcoded to two Google calendars: `en.usa.official#holiday` (federal-secular) and `en.judaism#holiday` (Jewish), each with its own sidebar checkbox + leading symbol (🇺🇸 / ✡). Bob 2026-05-11: "Static calendars are OK. You can add generalization to the maybe-future list. Unlikely to do unless I want a more general audience." When that audience expands, generalize to `settings.calendar.holidayCalendars: Array<{ id: string; label: string; symbol: string; enabled: boolean }>`. The refresh loop iterates the array; the sidebar renders one checkbox per entry plus its symbol on each row; a small editor in Settings → calendar lets the user add/remove entries by calendar ID. Schema-side `calendar_id` column already partitions rows by source, so toggling one off doesn't affect the others — the existing reconcile logic carries straight over.
+
+  **Curation gotcha worth carrying into the implementation**: Google's `<locale>.<tradition>#holiday@group.v.calendar.google.com` IDs are NOT all clean per-tradition feeds. The "obvious" IDs are mis-curated catch-alls; the `.official` / proper-noun variant is the actually-clean source for each tradition. Documented examples from 2026-05-11 testing:
+  - `en.usa#holiday` — mixed (federal + Christian + Jewish + Orthodox + Armenian + Ethiopian Jewish + …)
+  - `en.usa.official#holiday` — clean federal-secular
+  - `en.jewish#holiday` — mixed (Jewish + Christian + Orthodox neighbors)
+  - `en.judaism#holiday` — clean Jewish-only
+
+  When exposing the calendar picker to users, ship a curated allowlist of vetted IDs rather than a free-form text input, OR show a warning when a user enters a non-`.official` / non-proper-noun ID. The naming asymmetry is on Google.
+
+  Alternative source worth evaluating before generalizing: **Hebcal** (`https://www.hebcal.com/`) publishes a more rigorously curated Jewish-only feed (iCal + JSON API), and similar projects exist for other traditions. A `JsonHolidayProvider` interface that abstracts Google vs Hebcal vs ICS-by-URL behind a common shape would let users plug in whatever feed they trust.
 - **Q139 — General app-message channel from daemon to msger popups.** Bob 2026-05-11: "when an exit handler kills the popups by sending them a message — and can there be a general app message?" Today reminder popups are one-shot `showMessageBoxEx` (we have the handle for cross-platform reap). For graceful close-via-message AND other patterns (theme changes, in-flight content updates), spawn popups in `service: true` mode and use the bidirectional pipe — daemon calls `handle.send({type: "close"})` and the popup's JS listens for `_msgapiServiceEvent` events and reacts (`window.close()`, refresh content, etc.). Reuses the same wire mailx's main WebView already uses. Adapter shape: `showServicePopup(opts)` in `mailx-host` returns a `ServiceHandle` + a `result: Promise`; popup HTML's `<script>` registers `window._msgapiServiceEvent = (msg) => { if (msg.type === "close") window.close(); /* future: themeChanged, eventUpdated, … */ }`. Then `gracefulShutdown` in `bin/mailx.ts` iterates open popup handles and sends `{type:"close"}` instead of relying on the OS reaping. Pre-req: confirm msger's service mode supports the `rawHtml` content shape we use for reminders (may need a small msger PR).
 - **Q138 (original entry) — Quoted-reply image sizes lost.** Bob 2026-05-10: in the reply quote of a marketing email (Qatar Airways), the App Store / Google Play / AppGallery button images render larger than in the original. Cause: `sanitizeQuotedBody` in `client/app.ts` strips `width` / `height` attributes (along with `align`, `valign`, `bgcolor`, `cellpadding`, `cellspacing`, `border`) to flatten marketing-email layout tables. Stripping those attrs from `<img>` is collateral damage — table-only attributes there, but they also size images. Fix: in the regex, scope the attr strip to non-img tags, OR leave width/height alone everywhere (the layout flattening doesn't actually need them on tables either — `<table>→<div>` rewrites are doing the heavy lifting). ~10 line change. Low priority — visual nit, not data loss.
 - **Q136 — Server / provider capability matrix (forward backlog).** Catalog of server-specific features mailx could exploit. Detection is dynamic everywhere — IMAP via `CAPABILITY` + RFC 2971 `ID`, non-IMAP via provider-type at account setup. Each row below is its own future work item; this entry is the index.

package/bin/build-spellcheck-dict.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+/**
+ * Copy `dictionary-en/index.aff` + `index.dic` into `client/lib/dict/`
+ * so the compose iframe can `fetch()` them via msger's custom protocol
+ * (msger only serves files under `contentDir = client/`). Done at build
+ * time rather than runtime so a fresh install doesn't need to read the
+ * dictionary from node_modules — the published package ships the dict.
+ */
+import fs from "node:fs";
+import path from "node:path";
+
+const root = path.resolve(import.meta.dirname, "..");
+const src = path.join(root, "node_modules", "dictionary-en");
+const dst = path.join(root, "client", "lib", "dict");
+
+if (!fs.existsSync(path.join(src, "index.aff"))) {
+    console.error(`build-spellcheck-dict: source not found at ${src} — run npm install first`);
+    process.exit(1);
+}
+fs.mkdirSync(dst, { recursive: true });
+for (const name of ["index.aff", "index.dic"]) {
+    const dstName = name.replace("index", "en");
+    fs.copyFileSync(path.join(src, name), path.join(dst, dstName));
+}
+console.log(`build-spellcheck-dict: copied dictionary-en → ${path.relative(root, dst)}/{en.aff,en.dic}`);

package/client/app.bundle.js

@@ -3558,7 +3558,7 @@ function renderEvents(events) {
       const cid = (e.calendarId || "").toLowerCase();
       if (cid.includes("usa"))
         holidayKind = "us";
-      else if (cid.includes("jewish"))
+      else if (cid.includes("judaism") || cid.includes("jewish"))
         holidayKind = "jewish";
       else
         holidayKind = "other";
@@ -3970,11 +3970,15 @@ function initCalendarSidebar() {
     if (!cb || cb.__wired)
       return;
     cb.__wired = true;
+    let userTouched = false;
     getSettings().then((s) => {
+      if (userTouched)
+        return;
       cb.checked = !!s?.calendar?.[settingsKey];
     }).catch(() => {
     });
     cb.addEventListener("change", async () => {
+      userTouched = true;
       try {
         const s = await getSettings();
         s.calendar = { ...s.calendar || {}, [settingsKey]: cb.checked };
@@ -6419,25 +6423,18 @@ function addComposeResizeHandles(wrapper, frame) {
   }
 }
 function sanitizeQuotedBody(msg) {
-  let body = msg.bodyHtml || `<div style="white-space:pre-wrap;font-family:inherit;margin:0">${msg.bodyText || ""}</div>`;
-  body = body.replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "");
-  body = body.replace(/\s+style="[^"]*"/gi, "");
-  body = body.replace(/\s+class="[^"]*"/gi, "");
-  body = body.replace(
-    /<(?!img\b)([^>]*?)\s+(width|height|align|valign|bgcolor|cellpadding|cellspacing|border)="[^"]*"([^>]*)>/gi,
-    (_m, before, _attr, after) => `<${before}${after}>`
-  );
-  let prev = "";
-  while (prev !== body) {
-    prev = body;
-    body = body.replace(
-      /<(?!img\b)([^>]*?)\s+(width|height|align|valign|bgcolor|cellpadding|cellspacing|border)="[^"]*"([^>]*)>/gi,
-      (_m, before, _attr, after) => `<${before}${after}>`
-    );
+  const isPlainText = !msg.bodyHtml;
+  if (isPlainText) {
+    const escaped = String(msg.bodyText || "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+    return `<div style="white-space:pre-wrap;font-family:inherit;margin:0">${escaped}</div>`;
   }
-  body = body.replace(/<table[^>]*>/gi, "<div>").replace(/<\/table>/gi, "</div>");
-  body = body.replace(/<t[rdh][^>]*>/gi, "").replace(/<\/t[rdh]>/gi, " ");
-  body = body.replace(/<thead[^>]*>|<\/thead>|<tbody[^>]*>|<\/tbody>/gi, "");
+  let body = msg.bodyHtml;
+  body = body.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "");
+  body = body.replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "");
+  body = body.replace(/<link[^>]*>/gi, "");
+  body = body.replace(/<base[^>]*>/gi, "");
+  body = body.replace(/\s+on\w+="[^"]*"/gi, "");
+  body = body.replace(/\s+on\w+='[^']*'/gi, "");
   return body;
 }
 function quoteBody(msg) {