@bobfrankston/rmfmail 1.2.272 → 1.2.276

package/client/app.ts

@@ -156,6 +156,9 @@ propagateAppName();
 let baseTitle = APP_NAME;
 let lastSeenCount = 0;
 let badgeCount = 0;
+/** Last count pushed to the Windows taskbar overlay, so an unchanged count
+ *  is not re-pushed. -1 = nothing pushed yet. See updateBadge. */
+let lastOverlayCount = -1;
 
 function updateBadge(count: number): void {
     badgeCount = count;
@@ -211,7 +214,19 @@ function updateBadge(count: number): void {
         // taskbar for the whole life of this feature (Bob 2026-05-28 "are you
         // able to show the number of new messages").
         const hostApi: any = (window as any).mailxapi;
-        if (hostApi?.setTaskbarOverlay) {
+        // Push ONLY when the number actually changes. Windows keeps the
+        // overlay icon alive until the next SetOverlayIcon, so the host
+        // cannot free the icon it just handed over — each push costs the
+        // host process one HICON plus the two bitmaps inside it, and the
+        // unread-count refresh fires every few seconds. That reached the
+        // 10,000-object per-process GDI cap in about a day, after which the
+        // host logged "CreateIconIndirect failed: Not enough memory
+        // resources" on every tick and could create no further GDI objects
+        // (Bob 2026-08-23, measured: rmfmail.exe at GDI=9995). msger now
+        // frees the PREVIOUS icon so the leak is bounded either way; this
+        // just stops the pointless churn (Claude Code 2026-08-23).
+        if (hostApi?.setTaskbarOverlay && count !== lastOverlayCount) {
+            lastOverlayCount = count;
             if (count > 0) {
                 // BADGE-ONLY overlay. SetOverlayIcon composites the supplied
                 // icon onto the bottom-right corner of the taskbar button —
@@ -4668,6 +4683,26 @@ function applyThreadFilter(): void {
     }
 })();
 
+// Approved-sender index (the shared allowlist). Loaded once so the message
+// list can ask synchronously whether a sender has been vouched for — the
+// display-name warning is suppressed for those. Re-render on change so
+// marking a sender valid clears the warning from rows already on screen.
+(async () => {
+    try {
+        const { refreshApprovedSenders } = await import("./lib/approved-senders.js");
+        await refreshApprovedSenders();
+        document.dispatchEvent(new CustomEvent("mailx-allowlist-changed"));
+    } catch (e: any) {
+        console.warn("approved-sender index load failed:", e?.message || e);
+    }
+})();
+
+document.addEventListener("mailx-allowlist-changed", () => {
+    void import("./components/message-list.js")
+        .then(m => (m as any).reloadCurrentFolder?.())
+        .catch(() => { /* list not mounted yet */ });
+});
+
 // C46: same startup pickup for a pending Windows-share drop (rmfshare.exe
 // spawned the daemon before its fs.watch armed). Live shares during this
 // session arrive via the `openShare` event handled in onEvent above.

package/client/components/invite-card.js

@@ -0,0 +1,107 @@
+import { inviteHasGoogleRsvp } from "@bobfrankston/mailx-types";
+const PARTSTAT_LABEL = {
+    "ACCEPTED": "accepted",
+    "DECLINED": "declined",
+    "TENTATIVE": "maybe",
+    "NEEDS-ACTION": "no reply yet",
+    "DELEGATED": "delegated",
+};
+/** Format the event's span. An invite states wall-clock plus a zone; showing
+ *  it in the reader's zone is the useful reading, but when the two differ the
+ *  original is shown too — a 08:00 America/Los_Angeles meeting read as 11:00
+ *  local is exactly where people mis-book. */
+function formatWhen(inv) {
+    if (!inv.start)
+        return "";
+    if (inv.allDay) {
+        try {
+            const d = new Date(inv.start + "T00:00:00");
+            return d.toLocaleDateString(undefined, { weekday: "long", year: "numeric", month: "long", day: "numeric" }) + " (all day)";
+        }
+        catch {
+            return inv.start + " (all day)";
+        }
+    }
+    // A zoned wall-clock has no offset, so Date would read it as LOCAL time.
+    // Resolve it through the stated zone to get the real instant.
+    const instant = (() => {
+        if (/Z$/.test(inv.start))
+            return new Date(inv.start);
+        if (!inv.tzid)
+            return new Date(inv.start);
+        try {
+            // Probe: what does this wall-clock read as in the stated zone?
+            const guess = new Date(inv.start + "Z");
+            const asZone = new Date(guess.toLocaleString("en-US", { timeZone: inv.tzid }));
+            const asUtc = new Date(guess.toLocaleString("en-US", { timeZone: "UTC" }));
+            return new Date(guess.getTime() + (asUtc.getTime() - asZone.getTime()));
+        }
+        catch {
+            return new Date(inv.start);
+        }
+    })();
+    if (isNaN(instant.getTime()))
+        return inv.start;
+    const localZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    const opts = {
+        weekday: "short", month: "short", day: "numeric",
+        hour: "numeric", minute: "2-digit",
+    };
+    let out = instant.toLocaleString(undefined, opts);
+    if (inv.end && !/Z$/.test(inv.end)) {
+        try {
+            const endInstant = new Date(instant.getTime() + (new Date(inv.end + "Z").getTime() - new Date(inv.start + "Z").getTime()));
+            out += " – " + endInstant.toLocaleString(undefined, { hour: "numeric", minute: "2-digit" });
+        }
+        catch { /* single-point event */ }
+    }
+    if (inv.tzid && inv.tzid !== localZone) {
+        out += `  (sent as ${inv.start.slice(11, 16)} ${inv.tzid})`;
+    }
+    return out;
+}
+const esc = (s) => (s || "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+/** Build the card, or null when there is nothing worth showing. */
+export function buildInviteCard(inv, bodyHtml) {
+    if (!inv || (!inv.summary && !inv.start))
+        return null;
+    const card = document.createElement("div");
+    card.className = "mv-invite";
+    if (inv.method === "CANCEL")
+        card.classList.add("mv-invite-cancelled");
+    const when = formatWhen(inv);
+    const isMeetLink = /^https?:/; //i.test(inv.location);
+    const googleHandles = inv.fromGoogle && inviteHasGoogleRsvp(bodyHtml);
+    const rows = [];
+    if (when)
+        rows.push(`<div class="mv-invite-when">${esc(when)}</div>`);
+    if (inv.location) {
+        rows.push(isMeetLink
+            ? `<div class="mv-invite-row"><span class="mv-invite-label">Where</span><a href="${esc(inv.location)}" target="_blank" rel="noopener noreferrer">${esc(inv.location)}</a></div>`
+            : `<div class="mv-invite-row"><span class="mv-invite-label">Where</span>${esc(inv.location)}</div>`);
+    }
+    if (inv.organizer.email) {
+        rows.push(`<div class="mv-invite-row"><span class="mv-invite-label">Organizer</span>${esc(inv.organizer.name)}${inv.organizer.name !== inv.organizer.email ? " &lt;" + esc(inv.organizer.email) + "&gt;" : ""}</div>`);
+    }
+    if (inv.attendees.length) {
+        const who = inv.attendees
+            .map(a => `${esc(a.name || a.email)} <span class="mv-invite-partstat">(${esc(PARTSTAT_LABEL[a.status] || a.status.toLowerCase())})</span>`)
+            .join(", ");
+        rows.push(`<div class="mv-invite-row"><span class="mv-invite-label">Guests</span>${who}</div>`);
+    }
+    if (inv.rrule)
+        rows.push(`<div class="mv-invite-row"><span class="mv-invite-label">Repeats</span><code>${esc(inv.rrule)}</code></div>`);
+    const badge = inv.method === "CANCEL" ? "Cancelled"
+        : inv.method === "REPLY" ? "Reply"
+            : inv.status === "TENTATIVE" ? "Tentative"
+                : "Invitation";
+    card.innerHTML =
+        `<div class="mv-invite-head"><span class="mv-invite-badge">${esc(badge)}</span>` +
+            `<span class="mv-invite-summary">${esc(inv.summary || "(no title)")}</span></div>` +
+            rows.join("") +
+            (googleHandles
+                ? `<div class="mv-invite-note">Respond with the Yes / No / Maybe buttons in the message below — they go straight to Google Calendar.</div>`
+                : "");
+    return card;
+}
+//# sourceMappingURL=invite-card.js.map

package/client/components/invite-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-card.js","sourceRoot":"","sources":["invite-card.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,cAAc,GAA2B;IAC3C,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,UAAU;IACtB,WAAW,EAAE,OAAO;IACpB,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,WAAW;CAC3B,CAAC;AAEF;;;8CAG8C;AAC9C,SAAS,UAAU,CAAC,GAAiB;IACjC,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACb,IAAI,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC;YAC5C,OAAO,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,GAAG,YAAY,CAAC;QAC/H,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,CAAC,KAAK,GAAG,YAAY,CAAC;QAAC,CAAC;IAChD,CAAC;IACD,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE;QAClB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YACD,+DAA+D;YAC/D,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC3E,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IAC3C,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC;IACnE,MAAM,IAAI,GAA+B;QACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS;QAChD,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS;KACrC,CAAC;IACF,IAAI,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3H,GAAG,IAAI,KAAK,GAAG,UAAU,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,IAAI,cAAc,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAC9B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AAEtH,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,GAAoC,EAAE,QAAgB;IAClF,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,UAAU,CAAA,CAAA,uBAAuB;IACpD,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAEtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,+BAA+B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,UAAU;YAChB,CAAC,CAAC,iFAAiF,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,+CAA+C,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY;YAChL,CAAC,CAAC,wEAAwE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,4EAA4E,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3N,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS;aACpB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,sCAAsC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC;aAC1I,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,yEAAyE,GAAG,QAAQ,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,GAAG,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,gFAAgF,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAExI,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW;QAC/C,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO;YAClC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW;gBAC1C,CAAC,CAAC,YAAY,CAAC;IAEnB,IAAI,CAAC,SAAS;QACV,6DAA6D,GAAG,CAAC,KAAK,CAAC,SAAS;YAChF,mCAAmC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC,eAAe;YAClF,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACb,CAAC,aAAa;gBACV,CAAC,CAAC,yIAAyI;gBAC3I,CAAC,CAAC,EAAE,CAAC,CAAC;IAEd,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/client/components/invite-card.ts

@@ -0,0 +1,119 @@
+/**
+ * Calendar-invite card.
+ *
+ * A message carrying a text/calendar part gets a summary rendered ABOVE the
+ * body — time in your zone, location, organizer, who has replied — instead of
+ * mailx handing invite.ics to whatever program happens to own .ics on this
+ * machine (Bob 2026-08-22 saw a bare console window and asked "is this RMF
+ * Mail?"; it was not, and the fact that it could have been is the problem).
+ *
+ * RSVP is deliberately NOT duplicated for Google invitations. Google's own
+ * HTML body carries working Yes / No / Maybe links
+ * (calendar.google.com/calendar/event?action=RESPOND&rst=1|2|3), and two
+ * responders racing to set PARTSTAT is worse than one. For those we show the
+ * summary and point at the buttons already in the message.
+ */
+import type { ParsedInvite } from "@bobfrankston/mailx-types";
+import { inviteHasGoogleRsvp } from "@bobfrankston/mailx-types";
+
+const PARTSTAT_LABEL: Record<string, string> = {
+    "ACCEPTED": "accepted",
+    "DECLINED": "declined",
+    "TENTATIVE": "maybe",
+    "NEEDS-ACTION": "no reply yet",
+    "DELEGATED": "delegated",
+};
+
+/** Format the event's span. An invite states wall-clock plus a zone; showing
+ *  it in the reader's zone is the useful reading, but when the two differ the
+ *  original is shown too — a 08:00 America/Los_Angeles meeting read as 11:00
+ *  local is exactly where people mis-book. */
+function formatWhen(inv: ParsedInvite): string {
+    if (!inv.start) return "";
+    if (inv.allDay) {
+        try {
+            const d = new Date(inv.start + "T00:00:00");
+            return d.toLocaleDateString(undefined, { weekday: "long", year: "numeric", month: "long", day: "numeric" }) + " (all day)";
+        } catch { return inv.start + " (all day)"; }
+    }
+    // A zoned wall-clock has no offset, so Date would read it as LOCAL time.
+    // Resolve it through the stated zone to get the real instant.
+    const instant = (() => {
+        if (/Z$/.test(inv.start)) return new Date(inv.start);
+        if (!inv.tzid) return new Date(inv.start);
+        try {
+            // Probe: what does this wall-clock read as in the stated zone?
+            const guess = new Date(inv.start + "Z");
+            const asZone = new Date(guess.toLocaleString("en-US", { timeZone: inv.tzid }));
+            const asUtc = new Date(guess.toLocaleString("en-US", { timeZone: "UTC" }));
+            return new Date(guess.getTime() + (asUtc.getTime() - asZone.getTime()));
+        } catch { return new Date(inv.start); }
+    })();
+    if (isNaN(instant.getTime())) return inv.start;
+
+    const localZone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+    const opts: Intl.DateTimeFormatOptions = {
+        weekday: "short", month: "short", day: "numeric",
+        hour: "numeric", minute: "2-digit",
+    };
+    let out = instant.toLocaleString(undefined, opts);
+    if (inv.end && !/Z$/.test(inv.end)) {
+        try {
+            const endInstant = new Date(instant.getTime() + (new Date(inv.end + "Z").getTime() - new Date(inv.start + "Z").getTime()));
+            out += " – " + endInstant.toLocaleString(undefined, { hour: "numeric", minute: "2-digit" });
+        } catch { /* single-point event */ }
+    }
+    if (inv.tzid && inv.tzid !== localZone) {
+        out += `  (sent as ${inv.start.slice(11, 16)} ${inv.tzid})`;
+    }
+    return out;
+}
+
+const esc = (s: string): string =>
+    (s || "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]!));
+
+/** Build the card, or null when there is nothing worth showing. */
+export function buildInviteCard(inv: ParsedInvite | null | undefined, bodyHtml: string): HTMLElement | null {
+    if (!inv || (!inv.summary && !inv.start)) return null;
+
+    const card = document.createElement("div");
+    card.className = "mv-invite";
+    if (inv.method === "CANCEL") card.classList.add("mv-invite-cancelled");
+
+    const when = formatWhen(inv);
+    const isMeetLink = /^https?:///i.test(inv.location);
+    const googleHandles = inv.fromGoogle && inviteHasGoogleRsvp(bodyHtml);
+
+    const rows: string[] = [];
+    if (when) rows.push(`<div class="mv-invite-when">${esc(when)}</div>`);
+    if (inv.location) {
+        rows.push(isMeetLink
+            ? `<div class="mv-invite-row"><span class="mv-invite-label">Where</span><a href="${esc(inv.location)}" target="_blank" rel="noopener noreferrer">${esc(inv.location)}</a></div>`
+            : `<div class="mv-invite-row"><span class="mv-invite-label">Where</span>${esc(inv.location)}</div>`);
+    }
+    if (inv.organizer.email) {
+        rows.push(`<div class="mv-invite-row"><span class="mv-invite-label">Organizer</span>${esc(inv.organizer.name)}${inv.organizer.name !== inv.organizer.email ? " &lt;" + esc(inv.organizer.email) + "&gt;" : ""}</div>`);
+    }
+    if (inv.attendees.length) {
+        const who = inv.attendees
+            .map(a => `${esc(a.name || a.email)} <span class="mv-invite-partstat">(${esc(PARTSTAT_LABEL[a.status] || a.status.toLowerCase())})</span>`)
+            .join(", ");
+        rows.push(`<div class="mv-invite-row"><span class="mv-invite-label">Guests</span>${who}</div>`);
+    }
+    if (inv.rrule) rows.push(`<div class="mv-invite-row"><span class="mv-invite-label">Repeats</span><code>${esc(inv.rrule)}</code></div>`);
+
+    const badge = inv.method === "CANCEL" ? "Cancelled"
+        : inv.method === "REPLY" ? "Reply"
+        : inv.status === "TENTATIVE" ? "Tentative"
+        : "Invitation";
+
+    card.innerHTML =
+        `<div class="mv-invite-head"><span class="mv-invite-badge">${esc(badge)}</span>` +
+        `<span class="mv-invite-summary">${esc(inv.summary || "(no title)")}</span></div>` +
+        rows.join("") +
+        (googleHandles
+            ? `<div class="mv-invite-note">Respond with the Yes / No / Maybe buttons in the message below — they go straight to Google Calendar.</div>`
+            : "");
+
+    return card;
+}

package/client/components/message-list.js

@@ -9,6 +9,7 @@ import { showContextMenu } from "./context-menu.js";
 import { pickFolder } from "./folder-picker.js";
 import { foldText } from "../lib/fold-text.js";
 import { seenOf, flaggedOf, draftOf, setSeen, setFlagged, isJunkPreviewText, displayNameClaimsOtherAddress } from "@bobfrankston/mailx-types";
+import { isSenderApproved } from "../lib/approved-senders.js";
 let onMessageSelect;
 let currentAccountId;
 let currentFolderId;
@@ -1929,7 +1930,14 @@ class MessageRow {
             // isn't the real one, show the real one too so the row can't
             // lie on its own (Bob 2026-08-19).
             const fromName = msg.from.name || msg.from.address;
-            const fromClaim = displayNameClaimsOtherAddress(msg.from.name || "", msg.from.address || "");
+            // A sender the user has vouched for is never called out, however
+            // odd the display name looks. Without this the warning fired on
+            // 845 of 1978 qualifying messages — ESP relays, EDAS conference
+            // rewrites, "via SurveyMonkey", list traffic — which trains you to
+            // ignore it (Bob 2026-08-20).
+            const fromClaim = isSenderApproved(msg.from.address || "")
+                ? null
+                : displayNameClaimsOtherAddress(msg.from.name || "", msg.from.address || "");
             from.textContent = fromClaim ? `${fromName} — actually ${msg.from.address}` : fromName;
             if (fromClaim) {
                 from.classList.add("ml-from-spoofed");