@bobfrankston/rmfmail 1.0.679 → 1.0.680

package/client/app.ts

@@ -1071,6 +1071,12 @@ function sanitizeQuotedBody(msg: any): string {
     // future provider/path that didn't go through that pipeline.
     const isPlainText = !msg.bodyHtml;
     if (isPlainText) {
+        // Full HTML escape. Leaving `>` unescaped was tempting for source
+        // readability but breaks HTML in edge cases — TinyMCE's normalize-
+        // on-paste re-interprets the input, and stray `>` near sequences
+        // like `<!--` / `-->` / `<!` in plain-text bodies can be misread
+        // by the parser. Per Bob 2026-05-12: "not just ugly, it breaks
+        // the HTML." Trivial source-clutter is the lesser evil.
         const escaped = String(msg.bodyText || "")
             .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
         return `<div style="white-space:pre-wrap;font-family:inherit;margin:0">${escaped}</div>`;

package/client/compose/compose.bundle.js

@@ -596,6 +596,27 @@ async function createTinyMceEditor(container2, opts = {}) {
       // everything that the schema allows.
       paste_word_valid_elements: "@[style|class],-strong/b,-em/i,-u,-s,-sub,-sup,-strike,-p,-ol,-ul,-li,-h1,-h2,-h3,-h4,-h5,-h6,-blockquote,-table[border|cellpadding|cellspacing|width|height|class|style],-tr,-td[colspan|rowspan|width|height|class|style|valign|align|background|bgcolor],-th,-thead,-tbody,-tfoot,-pre,-br,-a[href|target|title],-img[src|alt|width|height|style|class]",
       paste_retain_style_properties: "color background background-color font-family font-size font-weight font-style text-decoration text-align padding padding-top padding-bottom padding-left padding-right margin margin-top margin-bottom margin-left margin-right border border-top border-bottom border-left border-right",
+      // Auto-link bare URLs in pasted content. TinyMCE's `autolink`
+      // plugin only fires on TYPED space/enter; URLs that arrive via
+      // clipboard (browser address bar, terminal copy) come in as
+      // plain text and stay un-linked. paste_preprocess runs on the
+      // HTML the paste plugin produced.
+      //
+      // CRITICAL: skip auto-link when the content already contains
+      // anchors. Naive regex over the whole content would wrap
+      // `<a href="X">X</a>` in ANOTHER anchor (nested anchors are
+      // invalid HTML and browsers split them, producing visible
+      // junk). For HTML pastes that already have linked URLs (the
+      // common case from a browser address bar or another mail
+      // client), TinyMCE preserves them — no auto-link pass needed.
+      // For plain-text pastes (no anchors present), wrap any bare
+      // http(s)://… runs. Trailing sentence punctuation is excluded
+      // from the URL.
+      paste_preprocess: (_plugin, args) => {
+        if (/<a[\s>]/i.test(args.content))
+          return;
+        args.content = args.content.replace(/(^|[\s(\[])((?:https?|ftp):\/\/[^\s<>"']+[^\s<>"'.,;:!?)\]])/gi, (_m, lead, url) => `${lead}<a href="${url}">${url}</a>`);
+      },
       content_style: "body { font-family: system-ui, sans-serif; font-size: 14px; }",
       init_instance_callback: (ed) => resolve(ed),
       setup: (ed) => {