@bobfrankston/rmfmail 1.2.219 → 1.2.220

package/packages/mailx-service/index.ts

@@ -3443,26 +3443,62 @@ export class MailxService implements MailxApi {
             if (ext) safeName += ext;
         }
         const target = path.join(dir, safeName);
-        fs.writeFileSync(target, att.content);
-        if (process.platform === "win32") {
-            // Mark-of-the-Web: tag the staged file as coming from the Internet
-            // (Zone.Identifier ADS, ZoneId 3) so Office opens it in Protected
-            // View and SmartScreen vets executables — same treatment a browser
-            // download gets. Email attachments are exactly the threat model
-            // MotW exists for (Bob 2026-07-02: "the file should be flagged as
-            // being saved from an unknown source"). Best-effort: ADS needs
-            // NTFS; FAT/exFAT volumes throw and we still open the file.
-            try { fs.writeFileSync(`${target}:Zone.Identifier`, "[ZoneTransfer]\r\nZoneId=3\r\n"); } catch { /* non-NTFS */ }
+        // Mark-of-the-Web: tag the staged file as coming from the Internet
+        // (Zone.Identifier ADS, ZoneId 3) so Office opens it in Protected
+        // View and SmartScreen vets executables — same treatment a browser
+        // download gets. Email attachments are exactly the threat model
+        // MotW exists for (Bob 2026-07-02: "the file should be flagged as
+        // being saved from an unknown source"). Best-effort: ADS needs
+        // NTFS; FAT/exFAT volumes throw and we still open the file.
+        const markOfTheWeb = (p: string): void => {
+            if (process.platform !== "win32") return;
+            try { fs.writeFileSync(`${p}:Zone.Identifier`, "[ZoneTransfer]\r\nZoneId=3\r\n"); } catch { /* non-NTFS or locked */ }
+        };
+        // Staging path collides with itself when the SAME attachment is opened
+        // twice: the viewer launched by the first open (Acrobat, Edge) holds
+        // the file with a deny-write share, so the second writeFileSync throws
+        // EBUSY and the user gets a red banner instead of their PDF (Bob
+        // 2026-08-06, "278 Lake Ave Newton - Bob Frankston.pdf"). Two outs:
+        //   1. Byte-identical file already staged → don't rewrite it at all.
+        //      This is the double-click case; just re-launch. Cheapest and it
+        //      never touches the lock.
+        //   2. Different content but the name is locked (a DIFFERENT
+        //      attachment sharing a filename) → stage under a unique sibling
+        //      so both stay openable.
+        let staged = target;
+        let existing: Buffer | null = null;
+        try { existing = fs.readFileSync(target); } catch { existing = null; }
+        if (!existing || !existing.equals(att.content)) {
+            try {
+                fs.writeFileSync(target, att.content);
+                markOfTheWeb(target);
+            } catch (e: any) {
+                const locked = e?.code === "EBUSY" || e?.code === "EPERM" || e?.code === "EACCES";
+                if (!locked) throw e;
+                const ext = path.extname(safeName);
+                const stem = safeName.slice(0, safeName.length - ext.length);
+                let n = 2;
+                do { staged = path.join(dir, `${stem} (${n++})${ext}`); } while (fs.existsSync(staged) && n <= 99);
+                if (fs.existsSync(staged)) throw e; // 99 locked variants — something is really wrong, surface it
+                console.log(`  [attachment] "${safeName}" locked by another app (${e.code}) — staging as "${path.basename(staged)}"`);
+                fs.writeFileSync(staged, att.content);
+                markOfTheWeb(staged);
+            }
+        } else {
+            // Re-open of an already-staged copy. Re-assert MotW in case the
+            // staged file predates the tagging (or the ADS was stripped);
+            // no-op when it's already there.
+            markOfTheWeb(target);
         }
         const { spawn } = await import("node:child_process");
         if (process.platform === "win32") {
-            spawn("cmd", ["/c", "start", "", target], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+            spawn("cmd", ["/c", "start", "", staged], { detached: true, stdio: "ignore", windowsHide: true }).unref();
         } else if (process.platform === "darwin") {
-            spawn("open", [target], { detached: true, stdio: "ignore" }).unref();
+            spawn("open", [staged], { detached: true, stdio: "ignore" }).unref();
         } else {
-            spawn("xdg-open", [target], { detached: true, stdio: "ignore" }).unref();
+            spawn("xdg-open", [staged], { detached: true, stdio: "ignore" }).unref();
         }
-        return { ok: true, path: target };
+        return { ok: true, path: staged };
     }
 
     /** Open an http/https/mailto URL in the OS default browser/handler from the

package/packages/mailx-service/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-service",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",