@bobfrankston/rmfmail 1.1.137 → 1.1.138

package/npmchanges.md

@@ -479,3 +479,25 @@ feat: periodic Sent sweep + body-fetch wallclock timeout
   with the elapsed-time wait indicator (1.1.135) — the indicator
   surfaces a wedge, the timeout breaks one.
 
+## v1.1.137 — 2026-05-24
+
+fix: defensive IMAP-command-leak detection at body-store boundary
+
+When iflow-direct's response parser desyncs on a literal byte count, the
+"body" it returns can begin with one of mailx's own pipelined IMAP
+commands (e.g. `A24624 UID FETCH 52 (UID FLAGS ENVELOPE ...)`). Until
+now those bytes were silently written to disk as the message body and
+rendered as broken (the a39…eml corruption from 2026-05-23).
+
+mailx-store/file-store.putMessage now sniffs the first ≤512 bytes for a
+tag+UPPERCASE-command pattern and throws rather than persist. The
+reconciler treats the rejection as transient so the next fetch (on a
+freshly-acquired connection) re-attempts cleanly, within the 3-attempt
+body-fetch budget.
+
+This doesn't FIX the iflow desync itself — it catches the leak at the
+disk boundary so corrupt bodies never persist and the wedged message
+gets retried instead of staying broken until the next -repair. Pairs
+with the elapsed-time wait indicator (1.1.135) which surfaces the
+in-progress retry to the user.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/rmfmail",
-  "version": "1.1.137",
+  "version": "1.1.138",
   "description": "Local-first email client with IMAP sync and standalone native app",
   "type": "module",
   "main": "bin/mailx.js",

package/.commitmsg

@@ -1,19 +0,0 @@
-fix: defensive IMAP-command-leak detection at body-store boundary
-
-When iflow-direct's response parser desyncs on a literal byte count, the
-"body" it returns can begin with one of mailx's own pipelined IMAP
-commands (e.g. `A24624 UID FETCH 52 (UID FLAGS ENVELOPE ...)`). Until
-now those bytes were silently written to disk as the message body and
-rendered as broken (the a39…eml corruption from 2026-05-23).
-
-mailx-store/file-store.putMessage now sniffs the first ≤512 bytes for a
-tag+UPPERCASE-command pattern and throws rather than persist. The
-reconciler treats the rejection as transient so the next fetch (on a
-freshly-acquired connection) re-attempts cleanly, within the 3-attempt
-body-fetch budget.
-
-This doesn't FIX the iflow desync itself — it catches the leak at the
-disk boundary so corrupt bodies never persist and the wedged message
-gets retried instead of staying broken until the next -repair. Pairs
-with the elapsed-time wait indicator (1.1.135) which surfaces the
-in-progress retry to the user.